<--index.php -->
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel="stylesheet" href="style.css" />
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>PHP Nullifer - By ReMuSoMeGa</title>
</head>
<body>
<div align="center">
<p> </p>
<table width="100" border="0" cellpadding="1" cellspacing="1" bgcolor="#999999">
<tr>
<td bgcolor="#FFFFFF"><table width="100" border="0" cellspacing="0" cellpadding="0">
<tr>
<td><img src="logo.jpg" width="400" height="350" /></td>
</tr>
<tr>
<td><div align="center">
<table width="378" border="0" cellpadding="5" cellspacing="1" bgcolor="#BFBFBF">
<tr>
<td bgcolor="#F6F6F6">PHP Nullifier will scan a script directory, and locate all potential callbacks & remote connections. Make sure the script is not encoded (IE. Zend).<br />
<br />
Enter the <strong>Relative</strong> path of the script directory you intend to scan.<br />
<form id="form1" name="form1" method="post" action="scan.php">
<input name="dir" type="text" id="dir" value="../" />
<input type="submit" name="Submit" value="Scan" />
<br />
eg.; '../' for one directory above this one.
</form>
</td>
</tr>
</table>
<br />
<table width="378" border="0" cellpadding="0" cellspacing="1" bgcolor="#BFBFBF">
<tr>
<td bgcolor="#F6F6F6"><div align="center">Written by ReMuSoMeGa - <a href="http://www.wtalk.org">Wtalk.org</a> </div></td>
</tr>
</table>
<br />
</div></td>
</tr>
</table></td>
</tr>
</table>
<p> </p>
</div>
</body>
</html>
<--/index.php --->
<--style.css --->
body,td,th {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 10px;
color: #A2A2A2;
}
a {
font-size: 10px;
color: #A2A2A2;
}
a:link {
text-decoration: underline;
}
a:visited {
text-decoration: underline;
color: #A2A2A2;
}
a:hover {
text-decoration: none;
color: #000000;
}
a:active {
text-decoration: underline;
color: #000000;
}
<--/style.css --->
<--scan.php --->
<?
require('config.php');
require('inject.class.php');
$SQL=& new SafeSQL_MySQL;
$create='CREATE TABLE `indexer` (`id` INT( 10 ) NOT NULL ,`path` VARCHAR( 100 ) NOT NULL ,`script` LONGTEXT NOT NULL);';
$drop='DROP table `indexer`;';
$dir = $_POST['dir'];
if(!$_POST['dir']){ die("No directory"); }
$tree=shell_exec("ls $dir -R");
$tree=explode("\n\n", $tree);
foreach($tree as $omg){
$omfg=explode("\n", $omg);
foreach($omfg as $wtf){
if(eregi('.php', $wtf)){
$ftree[]=str_replace(':', '',$omfg[0]).'/'.$wtf;
}
}
}
foreach($ftree as $out){
$dirs[]=str_replace('//','/',$out);
}
@mysql_query($drop);
mysql_query($create);
foreach($dirs as $file){
@$content=file_get_contents($file);
$insert=$SQL->query("INSERT INTO `indexer` ( `id` , `path` , `script` ) VALUES ( '', '%s', '%s' );", array($file, $content));
mysql_query($insert);
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel="stylesheet" href="style.css" />
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>PHP Nullifer - By ReMuSoMeGa</title>
</head>
<body>
<div align="center">
<p> </p>
<table width="100" border="0" cellpadding="1" cellspacing="1" bgcolor="#999999">
<tr>
<td bgcolor="#FFFFFF"><table width="100" border="0" cellspacing="0" cellpadding="0">
<tr>
<td><img src="logo.jpg" width="400" height="350" /></td>
</tr>
<tr>
<td><div align="center">
<table width="378" border="0" cellpadding="5" cellspacing="1" bgcolor="#BFBFBF">
<tr>
<td bgcolor="#F6F6F6"><div align="center">Project has been saved under a temporary database.<br />
<br />
<a href="start_scan.php">Click here to begin Scanning.</a><br />
<br />
<strong>Note!</strong> - You may add more alerts by modifying alerts.inc <br />
<br />
</div></td>
</tr>
</table>
<br />
<table width="378" border="0" cellpadding="0" cellspacing="1" bgcolor="#BFBFBF">
<tr>
<td bgcolor="#F6F6F6"><div align="center">Written by ReMuSoMeGa - <a href="http://www.wtalk.org">Wtalk.org</a> </div></td>
</tr>
</table>
<br />
</div></td>
</tr>
</table></td>
</tr>
</table>
<p> </p>
</div>
</body>
</html>
<--/scan.php --->
<--config.php --->
$db_user='';
$db_pass='';
$db_host='';
$db_name='';
mysql_connect($db_host, $db_user, $db_pass);
mysql_select_db($db_name);
?>
<--/config.php --->
<--inject.class.php -->
class SafeSQL
{
var $_drop_values = array('');
function SafeSQL() { }
function query($query_string, $query_vars)
{
if(is_array($query_vars)) {
$_var_count = count($query_vars);
if($_var_count != preg_match_all('!%[sSiIfFcClLqQ]!', $query_string, $_match)) {
$this->_error_msg('unmatched number of vars and % placeholders: ' . $query_string);
}
// get string position for each element
$_var_pos = array();
$_curr_pos = 0;
for( $_x = 0; $_x < $_var_count; $_x++ ) {
$_var_pos[$_x] = strpos($query_string, $_match[0][$_x], $_curr_pos);
$_curr_pos = $_var_pos[$_x] + 1;
}
// build query from passed in variables, escape them
// start from end of query and work backwards so string
// positions are not altered during replacement
$_last_removed_pos = null;
$_last_var_pos = null;
for( $_x = $_var_count-1; $_x >= 0; $_x-- ) {
if(isset($_last_removed_pos) && $_last_removed_pos < $_var_pos[$_x]) {
// already removed, skip
continue;
}
// escape string
$query_vars[$_x] = $this->_sql_escape($query_vars[$_x]);
if(in_array($_match[0][$_x], array('%S','%I','%F','%C','%L','%Q'))) {
// get positions of [ and ]
if(isset($_last_var_pos))
$_right_pos = strpos($query_string, ']', $_last_var_pos);
else
$_right_pos = strpos($query_string, ']', $_var_pos[$_x]);
// no way to get strpos from the right side starting in the middle
// of the string, so slice the first part out then find it
$_str_slice = substr($query_string, 0, $_var_pos[$_x]);
$_left_pos = strrpos($_str_slice, '[');
if($_right_pos === false || $_left_pos === false) {
$this->_error_msg('missing or unmatched brackets: ' . $query_string);
}
if(in_array($query_vars[$_x], $this->_drop_values, true)) {
$_last_removed_pos = $_left_pos;
// remove entire part of string
$query_string = substr_replace($query_string, '', $_left_pos, $_right_pos - $_left_pos + 1);
$_last_var_pos = null;
} else if ($_x > 0 && $_var_pos[$_x-1] > $_left_pos) {
// still variables left in brackets, leave them and just replace var
$_convert_var = $this->_convert_var($query_vars[$_x], $_match[0][$_x]);
$query_string = substr_replace($query_string, $_convert_var, $_var_pos[$_x], 2);
$_last_var_pos = $_var_pos[$_x] + strlen($_convert_var);
} else {
// remove the brackets only, and replace %S
$query_string = substr_replace($query_string, '', $_right_pos, 1);
$query_string = substr_replace($query_string, $this->_convert_var($query_vars[$_x], $_match[0][$_x]), $_var_pos[$_x], 2);
$query_string = substr_replace($query_string, '', $_left_pos, 1);
$_last_var_pos = null;
}
} else {
$query_string = substr_replace($query_string, $this->_convert_var($query_vars[$_x], $_match[0][$_x]), $_var_pos[$_x], 2);
}
}
}
return $query_string;
}
/*======================================================================*\
Function: _convert_var
Purpose: convert a variable to the given type
Input: $var - the variable
$type - the type to convert to:
%i, %I - cast to integer
%f, %F - cast to float
%c, %C - comma separate, cast each element to integer
%l, %L - comma separate, no quotes, no casting
%q, %Q - quote/comma separate
\*======================================================================*/
function _convert_var($var, $type) {
switch($type) {
case '%i':
case '%I':
// cast to integer
settype($var, 'integer');
break;
case '%f':
case '%F':
// cast to float
settype($var, 'float');
break;
case '%c':
case '%C':
// comma separate
settype($var, 'array');
for($_x = 0 , $_y = count($var); $_x < $_y; $_x++) {
// cast to integers
settype($var[$_x], 'integer');
}
$var = implode(',', $var);
if($var == '') {
// force 0, keep syntax from breaking
$var = '0';
}
break;
case '%l':
case '%L':
// comma separate
settype($var, 'array');
$var = implode(',', $var);
break;
case '%q':
case '%Q':
settype($var, 'array');
// quote comma separate
$var = "'" . implode("','", $var) . "'";
break;
}
return $var;
}
/*======================================================================*\
Function: error
Purpose: handle error messages
\*======================================================================*/
function _error_msg($error_msg) {
trigger_error('SafeSQL: ' . $error_msg);
}
/*======================================================================*\
Function: SetDropValues
Purpose:
\*======================================================================*/
function set_drop_values($drop_values) {
if(is_array($drop_values)) {
$this->_drop_values = $drop_values;
} else {
$this->_error_msg('drop values must be an array');
}
}
/*======================================================================*\
Function: GetDropValues
Purpose:
\*======================================================================*/
function get_drop_values() {
return $this->_drop_values;
}
/*======================================================================*\
Function: _sql_escape
Purpose: method overridden by subclass
\*======================================================================*/
function _sql_escape() { }
}
class SafeSQL_MySQL extends SafeSQL {
var $_link_id;
/*======================================================================*\
Function: SafeSQL_MySQL
Purpose: constructor
\*======================================================================*/
function SafeSQL_MySQL($link_id = null) {
$this->_link_id = $link_id;
}
/*======================================================================*\
Function: _sql_escape
Purpose: recursively escape variables/arrays for SQL use
\*======================================================================*/
function _sql_escape($var) {
if(is_array($var)) {
foreach($var as $_element) {
$_newvar[] = $this->_sql_escape($_element);
}
return $_newvar;
}
if(function_exists('mysql_real_escape_string')) {
if(!isset($this->_link_id)) {
return mysql_real_escape_string($var);
} else {
return mysql_real_escape_string($var, $this->_link_id);
}
} elseif(function_exists('mysql_escape_string')) {
return mysql_escape_string($var);
} else {
return addslashes($var);
}
break;
}
}
class SafeSQL_ANSI extends SafeSQL {
/*======================================================================*\
Function: SafeSQL_ANSI
Purpose: constructor
\*======================================================================*/
function SafeSQL_ANSI() { }
/*======================================================================*\
Function: _sql_escape
Purpose: recursively escape variables/arrays for SQL use
\*======================================================================*/
function _sql_escape($var) {
if(is_array($var)) {
foreach($var as $_element) {
$_newvar[] = $this->_sql_escape($_element);
}
return $_newvar;
}
return str_replace("'", "''", $var);
break;
}
}
?>
<-- /inject.class.php-->
<--start_scan.php -->
<?
require('config.php');
$alerts=file_get_contents('alert.inc');
$alerts =explode("\n", $alerts);
$query = "SELECT * FROM `indexer` WHERE";
$status = 0;
foreach($alerts as $q){
$q=str_replace('"', '\'', $q);
$q=trim($q);
$status++;
$query .="(`script` LIKE '%$q%')";
if($status!=count($alerts)){$query .=" OR "; }else{$query .=';';}
}
$res=mysql_query($query);
foreach($alerts as $fix){
$fixed[]=trim($fix);
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel="stylesheet" href="style.css" />
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>PHP Nullifer - By ReMuSoMeGa</title>
<script language=JavaScript>
/*
* This is the function that actually highlights a text string by
* adding HTML tags before and after all occurrences of the search
* term. You can pass your own tags if you'd like, or if the
* highlightStartTag or highlightEndTag parameters are omitted or
* are empty strings then the default <font> tags will be used.
*/
function doHighlight(bodyText, searchTerm, highlightStartTag, highlightEndTag)
{
// the highlightStartTag and highlightEndTag parameters are optional
if ((!highlightStartTag) || (!highlightEndTag)) {
highlightStartTag = "<font style='color:blue; background-color:yellow;'>";
highlightEndTag = "</font>";
}
// find all occurences of the search term in the given text,
// and add some "highlight" tags to them (we're not using a
// regular expression search, because we want to filter out
// matches that occur within HTML tags and script blocks, so
// we have to do a little extra validation)
var newText = "";
var i = -1;
var lcSearchTerm = searchTerm.toLowerCase();
var lcBodyText = bodyText.toLowerCase();
while (bodyText.length > 0) {
i = lcBodyText.indexOf(lcSearchTerm, i+1);
if (i < 0) {
newText += bodyText;
bodyText = "";
} else {
// skip anything inside an HTML tag
if (bodyText.lastIndexOf(">", i) >= bodyText.lastIndexOf("<", i)) {
// skip anything inside a <script> block
if (lcBodyText.lastIndexOf("/script>", i) >= lcBodyText.lastIndexOf("<script", i)) {
newText += bodyText.substring(0, i) + highlightStartTag + bodyText.substr(i, searchTerm.length) + highlightEndTag;
bodyText = bodyText.substr(i + searchTerm.length);
lcBodyText = bodyText.toLowerCase();
i = -1;
}
}
}
}
return newText;
}
/*
* This is sort of a wrapper function to the doHighlight function.
* It takes the searchText that you pass, optionally splits it into
* separate words, and transforms the text on the current web page.
* Only the "searchText" parameter is required; all other parameters
* are optional and can be omitted.
*/
function highlightSearchTerms(searchText, treatAsPhrase, warnOnFailure, highlightStartTag, highlightEndTag)
{
// if the treatAsPhrase parameter is true, then we should search for
// the entire phrase that was entered; otherwise, we will split the
// search string so that each word is searched for and highlighted
// individually
if (treatAsPhrase) {
searchArray = [searchText];
} else {
searchArray = searchText.split(" ");
}
if (!document.body || typeof(document.body.innerHTML) == "undefined") {
if (warnOnFailure) {
alert("Sorry, for some reason the text of this page is unavailable. Searching will not work.");
}
return false;
}
var bodyText = document.body.innerHTML;
for (var i = 0; i < searchArray.length; i++) {
bodyText = doHighlight(bodyText, searchArray[i], highlightStartTag, highlightEndTag);
}
document.body.innerHTML = bodyText;
return true;
}
/*
* This displays a dialog box that allows a user to enter their own
* search terms to highlight on the page, and then passes the search
* text or phrase to the highlightSearchTerms function. All parameters
* are optional.
*/
function searchPrompt(defaultText, treatAsPhrase, textColor, bgColor)
{
// This function prompts the user for any words that should
// be highlighted on this web page
if (!defaultText) {
defaultText = "";
}
// we can optionally use our own highlight tag values
if ((!textColor) || (!bgColor)) {
highlightStartTag = "";
highlightEndTag = "";
} else {
highlightStartTag = "<font style='color:" + textColor + "; background-color:" + bgColor + ";'>";
highlightEndTag = "</font>";
}
if (treatAsPhrase) {
promptText = "Please enter the phrase you'd like to search for:";
} else {
promptText = "Please enter the words you'd like to search for, separated by spaces:";
}
searchText = prompt(promptText, defaultText);
if (!searchText) {
alert("No search terms were entered. Exiting function.");
return false;
}
return highlightSearchTerms(searchText, treatAsPhrase, true, highlightStartTag, highlightEndTag);
}
/*
* This function takes a referer/referrer string and parses it
* to determine if it contains any search terms. If it does, the
* search terms are passed to the highlightSearchTerms function
* so they can be highlighted on the current page.
*/
function highlightGoogleSearchTerms(referrer)
{
// This function has only been very lightly tested against
// typical Google search URLs. If you wanted the Google search
// terms to be automatically highlighted on a page, you could
// call the function in the onload event of your <body> tag,
// like this:
// <body onload='highlightGoogleSearchTerms(document.referrer);'>
//var referrer = document.referrer;
if (!referrer) {
return false;
}
var queryPrefix = "q=";
var startPos = referrer.toLowerCase().indexOf(queryPrefix);
if ((startPos < 0) || (startPos + queryPrefix.length == referrer.length)) {
return false;
}
var endPos = referrer.indexOf("&", startPos);
if (endPos < 0) {
endPos = referrer.length;
}
var queryString = referrer.substring(startPos + queryPrefix.length, endPos);
// fix the space characters
queryString = queryString.replace(/%20/gi, " ");
queryString = queryString.replace(/\+/gi, " ");
// remove the quotes (if you're really creative, you could search for the
// terms within the quotes as phrases, and everything else as single terms)
queryString = queryString.replace(/%22/gi, "");
queryString = queryString.replace(/\"/gi, "");
return highlightSearchTerms(queryString, false);
}
/*
* This function is just an easy way to test the highlightGoogleSearchTerms
* function.
*/
function testHighlightGoogleSearchTerms()
{
var referrerString = "http://www.google.com/search?q=javascript%20highlight&start=0";
referrerString = prompt("Test the following referrer string:", referrerString);
return highlightGoogleSearchTerms(referrerString);
}
</script>
<style type="text/css">
<!--
.style3 {color: #FF0000}
-->
</style>
</head>
<body onload="<? foreach($fixed as $hi){ echo "highlightSearchTerms('$hi');"; }?>">
<body>
<div align="center">
<p> </p>
<table width="100" border="0" cellpadding="1" cellspacing="1" bgcolor="#999999">
<tr>
<td bgcolor="#FFFFFF"><table width="100" border="0" cellspacing="0" cellpadding="0">
<tr>
<td><img src="logo.jpg" width="400" height="350" /></td>
</tr>
<tr>
<td><div align="center">
<table width="378" border="0" cellpadding="5" cellspacing="1" bgcolor="#BFBFBF">
<tr>
<td bgcolor="#F6F6F6"><div align="center"><span class="style3">Any potential call-back attempt is highlighted </span><br />
<? if(mysql_num_rows($res)<1){ echo "No Potential Call-backs were found"; } else{
while($r=mysql_fetch_array($res)){
$path=$r['path'];
$script=htmlspecialchars($r['script']);
//$script=str_replace($fixed, '<FONT style="BACKGROUND-COLOR: red">'.$fixed.'</FONT>', $script);
echo "<b>$path</b><br><div style=\"overflow:auto; height:150px; width:350px\"><div align='left'>$script</div></div><hr>";
}
}
?>
<br />
</div></td>
</tr>
</table>
<br />
<table width="378" border="0" cellpadding="0" cellspacing="1" bgcolor="#BFBFBF">
<tr>
<td bgcolor="#F6F6F6"><div align="center">Written by ReMuSoMeGa - <a href="http://www.wtalk.org">Wtalk.org</a> </div></td>
</tr>
</table>
<br />
</div></td>
</tr>
</table></td>
</tr>
</table>
<p> </p>
</div>
</body>
</html>
< --/start_scan.php -->
<--tree.php-->
function traverseDirTree($base,$fileFunc,$dirFunc=null,$afterDirFunc=null){ $subdirectories=opendir($base); while (($subdirectory=readdir($subdirectories))!==false){ $path=$base.$subdirectory; if (is_file($path)){ if ($fileFunc!==null) $fileFunc($path); }else{ if ($dirFunc!==null) $dirFunc($path); if (($subdirectory!='.') && ($subdirectory!='..')){ traverseDirTree($path.'/',$fileFunc,$dirFunc,$afterDirFunc); } if ($afterDirFunc!==null) $afterDirFunc($path); } } }
function outputPath($path){ $level=substr_count($path,'/'); for ($i=1;$i<$level;$i++) echo ' '; echo basename($path); echo "\n"; } echo '
'; traverseDirTree('./','outputpath','outputpath'); echo '';?>
<--/tree.php-->
<--alert.inc-->
file_get_contents
curl
http://
wget
shell_exec
fopen
fsockopen
<--/--alert.inc-->
1 comments:
http://servahoc.ru/
Post a Comment