AK-74 Security Team Web Shell

.:: :[ AK-74 Security Team Web-shell ]: ::.

Редактирование файла

<?php
header("Content-Type: text/html; charset=utf-8");
include ("include/config.php");
include ("include/connect.php");
include ("include/function.php");
include ("myadmin/member/config.php");
//require_once('PHPMailer/class.phpmailer.php');

$nowDate = date("Y-m-d H:i:s");
$param = '';
foreach ($_GET as $key=>$value) {
	if ( ($key <> "action") && ($key <> 'member_id') && ($key <> 'selectRow') && ($key <> 'frompage') && ($key <> '') && ($key <> 'bSearchMenu') ) {
		$param .= "&" .  $key  . "=" . urlencode($value);
	} // end if
} // end foreach

if ($_GET['action'] == 'alarmImage') { // а№Ђаё•аё·аёаё™аёЈаё№аё›аё аёІаёћ
	$sql = "
		INSERT INTO member_alarm_image(member_id, alarm_date)
		VALUES('".$_GET['member_id']."', '".$nowDate."')
	";
	sql_query($sql);
	
	$sql = "UPDATE $tbl_name SET alarm_image_status = 1, image = 'alert.gif' WHERE member_id = '".$_GET['member_id']."' ";
	$query = sql_query($sql);
	
	$sql = "SELECT COUNT(member_alarm_image_id) AS num FROM member_alarm_image WHERE member_id = '".$_GET['member_id']."' ";
	$query = sql_query($sql);
	$rec = sql_fetch_array($query);
	$num = $rec['num'];
	
	$sql = "SELECT username, email FROM $tbl_name WHERE member_id = '".$_GET['member_id']."' ";
	$query = sql_query($sql);
	$rec = sql_fetch_array($query);
	$username = $rec['username'];
	$email = $rec['email'];
	
	$subject = 'а№Ѓаё€а№‰аё‡а№Ђаё•аё·аёаё™аёЈаё№аё›аё аёІаёћа№„аёЎа№€а№Ђаё«аёЎаёІаё°аёЄаёЎ MSN Ladyboy';
	if ($num > 1)
		$subject .= 'аё„аёЈаё±а№‰аё‡аё—аёµа№€ '.$num;
		
	$message = '<div style="width: 1000px; font-family: Arial, Helvetica, sans-serif; font-size: 12px">а№ЂаёЈаёµаёўаё™ аё—а№€аёІаё™аёЄаёЎаёІаёЉаёґаёЃ : '.$username.'<br />
	<br />
			а№Ђаё™аё·а№€аёаё‡аё€аёІаёЃаё—а№€аёІаё™а№ѓаёЉа№‰аёЈаё№аё›аё аёІаёћа№ѓаё™аёЃаёІаёЈаёҐаё‡аё›аёЈаё°аёЃаёІаёЁа№„аёЎа№€а№Ђаё«аёЎаёІаё°аёЄаёЎ<br />
			а№‚аё”аёўаёЈаё№аё›аё аёІаёћаё‚аёаё‡аё—а№€аёІаё™аёаёІаё€а№Ђаё‚а№‰аёІаё‚а№€аёІаёўа№Ђаё›а№‡аё™аёЈаё№аё›аё аёІаёћаёҐаёІаёЎаёЃ аёаё™аёІаё€аёІаёЈ <br />
			аё‹аё¶а№€аё‡а№Ђаё‚а№‰аёІаё‚а№€аёІаёўаёњаёґаё”аёЃаёЋаё«аёЎаёІаёўаёћаёЈаё°аёЈаёІаёЉаёљаё±аёЌаёЌаё±аё•аёґаё„аёаёЎаёћаёґаё§а№Ђаё•аёаёЈа№Њ аёћ.аёЁ.2550<br />
			аё—аёІаё‡аё—аёµаёЎаё‡аёІаё™аё€аё¶аё‡аё‚аёаё„аё§аёІаёЎаёЃаёЈаёёаё“аёІаё—а№€аёІаё™аёЄаёЎаёІаёЉаёґаёЃа№Ђаё›аёҐаёµа№€аёўаё™аёЈаё№аё›аё аёІаёћаё‚аёаё‡аё—а№€аёІаё™а№‚аё”аёўа№ѓаёЉа№‰аёЈаё№аё›аё аёІаёћаё—аёµа№€аёЄаёёаё аёІаёћаё”а№‰аё§аёўаё™аё°аё„аёЈаё±аёљ<br />
<br />
			аё‚аёаёљаё„аёёаё“аёЎаёІаёЃаё„аёЈаё±аёљ<br />
 <br />
			аё”а№‰аё§аёўаё„аё§аёІаёЎа№Ђаё„аёІаёЈаёћаёаёўа№€аёІаё‡аёЄаё№аё‡,<br />
			Webmaster Msn Ladyboy<br />
			<a href="http://www.msnladyboy.com">http://www.msnladyboy.com</a></div>';
				
			// Send mail
			$frommail = $webmasterMail;
			sendMailEncode($email, $fromname, $frommail, $subject, $message, $cType='html',$CC="",$BCC="",$attach="",$attach_name="");		
	
	//echo 'аёљаё±аё™аё—аё¶аёЃаёЃаёІаёЈа№Ђаё•аё·аёаё™аёЈаё№аё›аё аёІаёћа№ЂаёЄаёЈа№‡аё€а№ЂаёЈаёµаёўаёљаёЈа№‰аёаёўа№ЃаёҐа№‰аё§:::alarmImageId_'.$_GET['member_id'].':::('.$num.' аё„аёЈаё±а№‰аё‡):::showImage_'.$_GET['member_id'].':::<img src="'.$imagePath.'alert.gif" border="0">';
	?>
    <script type="text/javascript">
		alert('аёљаё±аё™аё—аё¶аёЃаёЃаёІаёЈа№Ђаё•аё·аёаё™аёЈаё№аё›аё аёІаёћа№ЂаёЄаёЈа№‡аё€а№ЂаёЈаёµаёўаёљаёЈа№‰аёаёўа№ЃаёҐа№‰аё§');
		window.location='<?php echo $_GET['frompage']?>?<?php echo $param?>#mgt_<?php echo $_GET['selectRow']?>';
	</script>
    <?php
	
} elseif ($_GET['action'] == 'alarm') { // end if ($_GET['action'] == 'alarmImage') {   а№Ђаё•аё·аёаё™аё‚а№‰аёаё„аё§аёІаёЎ
	$sql = "
		INSERT INTO member_alarm(member_id, alarm_date)
		VALUES('".$_GET['member_id']."', '".$nowDate."')
	";
	sql_query($sql);
	
	$sql = "UPDATE $tbl_name SET alarm_status = 1 WHERE member_id = '".$_GET['member_id']."' ";
	$query = sql_query($sql);
	
	$sql = "SELECT COUNT(member_alarm_id) AS num FROM member_alarm WHERE member_id = '".$_GET['member_id']."' ";
	$query = sql_query($sql);
	$rec = sql_fetch_array($query);
	$num = $rec['num'];
	
	$sql = "SELECT username, email FROM $tbl_name WHERE member_id = '".$_GET['member_id']."' ";
	$query = sql_query($sql);
	$rec = sql_fetch_array($query);
	$username = $rec['username'];
	$email = $rec['email'];
	
	$subject = 'а№Ѓаё€а№‰аё‡а№Ђаё•аё·аёаё™аё‚а№‰аёаё„аё§аёІаёЎа№„аёЎа№€а№Ђаё«аёЎаёІаё°аёЄаёЎ Msn Ladyboy';
	if ($num > 1)
		$subject .= 'аё„аёЈаё±а№‰аё‡аё—аёµа№€ '.$num;
		
	$message = '<div style="width: 1000px; font-family: Arial, Helvetica, sans-serif; font-size: 12px">а№ЂаёЈаёµаёўаё™ аё—а№€аёІаё™аёЄаёЎаёІаёЉаёґаёЃ : '.$username.'<br />
	<br />
			а№Ђаё™аё·а№€аёаё‡аё€аёІаёЃаё—а№€аёІаё™а№ѓаёЉа№‰аё‚а№‰аёаё„аё§аёІаёЎа№ѓаё™аёЃаёІаёЈаёҐаё‡аё›аёЈаё°аёЃаёІаёЁа№„аёЎа№€а№Ђаё«аёЎаёІаё°аёЄаёЎ<br />
			аёњаёґаё”аёЃаёЋ аёЃаё•аёґаёЃаёІ аё‚аёаё‡аё—аёІаё‡а№Ђаё§а№‡аёља№„аё‹аё•а№Њ Msn Ladyboy<br />
			аё—аёІаё‡аё—аёµаёЎаё‡аёІаё™аё€аё¶аё‡аё‚аёаё„аё§аёІаёЎаёЃаёЈаёёаё“аёІаё—а№€аёІаё™аёЄаёЎаёІаёЉаёґаёЃа№Ђаё›аёҐаёµа№€аёўаё™аё‚а№‰аёаё„аё§аёІаёЎаё‚аёаё‡аё—а№€аёІаё™а№ѓаё«а№‰а№Ђаё«аёЎаёІаё°аёЄаёЎаё”а№‰аё§аёўаё™аё°аё„аёЈаё±аёљ<br />
<br />
			аё‚аёаёљаё„аёёаё“аёЎаёІаёЃаё„аёЈаё±аёљ<br />
 <br />
			аё”а№‰аё§аёўаё„аё§аёІаёЎа№Ђаё„аёІаёЈаёћаёаёўа№€аёІаё‡аёЄаё№аё‡,<br />
			Webmaster Msn Ladyboy<br />
			<a href="http://www.msnladyboy.com">http://www.msnladyboy.com</a></div>';
			
			// Send mail
			$frommail = $webmasterMail;
			sendMailEncode($email, $fromname, $frommail, $subject, $message, $cType='html',$CC="",$BCC="",$attach="",$attach_name="");		
	
	//echo 'аёљаё±аё™аё—аё¶аёЃаёЃаёІаёЈа№Ђаё•аё·аёаё™а№ЂаёЄаёЈа№‡аё€а№ЂаёЈаёµаёўаёљаёЈа№‰аёаёўа№ЃаёҐа№‰аё§:::alarmId_'.$_GET['member_id'].':::('.$num.' аё„аёЈаё±а№‰аё‡)';
	?>
    <script type="text/javascript">
		alert('аёљаё±аё™аё—аё¶аёЃаёЃаёІаёЈа№Ђаё•аё·аёаё™а№ЂаёЄаёЈа№‡аё€а№ЂаёЈаёµаёўаёљаёЈа№‰аёаёўа№ЃаёҐа№‰аё§');
		window.location='<?php echo $_GET['frompage']?>?<?php echo $param?>#mgt_<?php echo $_GET['selectRow']?>';
	</script>
    <?php
	exit();
	
} elseif ($_GET['action'] == 'swapSection') { // end elseif ($_GET['action'] == 'alarm') {   а№Ѓаё€а№‰аё‡а№Ђаё•аё·аёаё™аёЃаёЈаё“аёµаё—аёµа№€аёЎаёµаёЃаёІаёЈа№‚аёћаёЄа№ѓаё™а№ЂаёЉаёґаё‡а№‚аё†аё©аё“аёІ
	$sql = "SELECT username, email FROM $tbl_name WHERE member_id = '".$_GET['member_id']."' ";
	$query = sql_query($sql);
	$rec = sql_fetch_array($query);
	$username = $rec['username'];
	$email = $rec['email'];
	
	$subject = 'а№Ѓаё€а№‰аё‡а№Ђаё•аё·аёаё™аёЃаёІаёЈа№‚аёћаёЄаё•а№Њаё‚а№‰аёаё„аё§аёІаёЎа№ѓаё™а№ЂаёЉаёґаё‡а№‚аё†аё©аё“аёІ ' . $webmasterName;
	$message = '<div style="width: 1000px; font-family: Arial, Helvetica, sans-serif; font-size: 12px">а№ЂаёЈаёµаёўаё™ аё—а№€аёІаё™аёЄаёЎаёІаёЉаёґаёЃ : '.$username.'<br />
	<br />';
	
		$message .= '
			а№Ђаё™аё·а№€аёаё‡аё€аёІаёЃаёЃаёІаёЈа№‚аёћаёЄаё•а№Њаё‚а№‰аёаё„аё§аёІаёЎаё‚аёаё‡аё„аёёаё“аёЎаёµаёҐаё±аёЃаё©аё“аё°аё—аёµа№€а№Ђаё›а№‡аё™аёЃаёІаёЈа№‚аёћаёЄаё•а№Ња№Ђаёћаё·а№€аёа№‚аё†аё©аё“аёІ<br />
			аё”аё±аё‡аё™аё±а№‰аё™аё—аёІаё‡а№Ђаё§а№‡аёља№„аё‹аё•а№Њ ' . $webmasterName . '<br />
			аё€аё¶аё‡а№„аё”а№‰аё—аёіаёЃаёІаёЈа№Ѓаё€а№‰аё‡а№Ђаё•аё·аёаё™аёЃаёІаёЈа№‚аёћаёЄаё•а№Њаё‚аёаё‡аё„аёёаё“аёЎаёІ аё“ аё—аёµа№€аё™аёµа№‰';
	
	$message .= '<br />
<br />
			аё‚аёаёљаё„аёёаё“аёЎаёІаёЃаё„аёЈаё±аёљ<br />
 <br />
			аё”а№‰аё§аёўаё„аё§аёІаёЎа№Ђаё„аёІаёЈаёћаёаёўа№€аёІаё‡аёЄаё№аё‡,<br />
			Webmaster ' . $webmasterName . '<br />
			<a href="'.substr($configWebsiteName, 0, -1).'">'.substr($configWebsiteName, 0, -1).'</a></div>';
	
	// Send mail
	$frommail = $webmasterMail;
	sendMailEncode($email, $fromname, $frommail, $subject, $message, $cType='html',$CC="",$BCC="",$attach="",$attach_name="");		
	?>
    <script type="text/javascript">
		alert('а№Ѓаё€а№‰аё‡а№Ђаё•аё·аёаё™аёЃаёІаёЈа№‚аёћаёЄаё•а№Ња№ЂаёЈаёµаёўаёљаёЈа№‰аёаёўа№ЃаёҐа№‰аё§');
		window.location='<?php echo $_GET['frompage']?>?<?php echo $param?>#mgt_<?php echo $_GET['selectRow']?>';
	</script>
    <?php
	exit();
	
} elseif ($_GET['action'] == 'Ban IP') { // end if ($_GET['action'] == 'alarm') {

$sql = "DELETE FROM member_post WHERE member_id = '".$_GET['member_id']."' ";
	sql_query($sql);

$sql = "SELECT COUNT(band_ip_id) AS num FROM band_ip WHERE member_id = '".$_GET['member_id']."' ";
	$query = sql_query($sql);
	$rec = sql_fetch_array($query);
	
	if ($rec['num'] == 0) {
		$sql = "
			INSERT INTO band_ip(member_id, band_ip, band_date)
			VALUES('".$_GET['member_id']."', '".$_GET['ip']."', '".$nowDate."')
		";
		sql_query($sql);
		echo 'Band IP : '.$_GET['ip'].' а№ЂаёЈаёµаёўаёљаёЈа№‰аёаёўа№ЃаёҐа№‰аё§';
	} else {
		echo 'IP : '.$_GET['ip'].' а№Ђаё„аёўаё–аё№аёЃ Band а№ЃаёҐа№‰аё§';
	}
	
} elseif ($_GET['action'] == 'Ban Email') { // end elseif ($_GET['action'] == 'Ban IP') {

$sql = "DELETE FROM member_post WHERE member_id = '".$_GET['member_id']."' ";
	sql_query($sql);

$sql = "
		SELECT count(band_email_id) AS num
		FROM band_email
		WHERE member_id = '".$_GET['member_id']."'
	";
	$query = sql_query($sql);
	$rec = sql_fetch_array($query);
	if ($rec['num'] == 0) {
	
		$sql = "
			INSERT INTO band_email(member_id, band_date)
			VALUES('".$_GET['member_id']."', '".$nowDate."')
		";
		sql_query($sql);
		
		echo 'аёўаёЃа№ЂаёҐаёґаёЃаёЃаёІаёЈ Ban Email : '.$_GET['email'].' а№ЂаёЈаёµаёўаёљаёЈа№‰аёаёўа№ЃаёҐа№‰аё§:::'.$_GET['member_id'].':::<input type="button" name="button3" value="Cancel" onclick="if( confirm(\'аё•а№‰аёаё‡аёЃаёІаёЈаёўаёЃа№ЂаёҐаёґаёЃаёЃаёІаёЈ Ban Email : '.$rec['email'].' аё«аёЈаё·аёа№„аёЎа№€ ?\n\nаё«аёІаёЃаёўаёЃа№ЂаёҐаёґаёЃаёЃаёІаёЈ Ban Email а№ЃаёҐа№‰аё§ Email аё™аёµа№‰аё€аё°аёЄаёІаёЎаёІаёЈаё–аёЃаёҐаё±аёљаёЎаёІа№ѓаёЉа№‰аё‡аёІаё™а№Ђаё§а№‡аёља№„аё‹аё•а№Ња№„аё”а№‰аё•аёІаёЎаё›аёЃаё•аёґ\') ) { getQueryEmail(\'Ban Email\', '.$_GET['member_id'].', \''.$_GET['email'].'\') }" />';
	
	} else { // end if ($rec['num'] == 0)
		$sql = "DELETE FROM band_email WHERE member_id = '".$_GET['member_id']."' ";
		sql_query($sql);
		
		echo 'аёўаёЃа№ЂаёҐаёґаёЃаёЃаёІаёЈ Ban Email : '.$_GET['email'].' а№ЂаёЈаёµаёўаёљаёЈа№‰аёаёўа№ЃаёҐа№‰аё§:::'.$_GET['member_id'].':::<input type="button" name="button3" value="Ban Email" onclick="if( confirm(\'аё•а№‰аёаё‡аёЃаёІаёЈ Ban Email : '.$rec['email'].' аё«аёЈаё·аёа№„аёЎа№€ ?\n\nаё«аёІаёЃ Ban Email а№ЃаёҐа№‰аё§ Email аё™аёµа№‰аё€аё°а№„аёЎа№€аёЄаёІаёЎаёІаёЈаё–а№ѓаёЉа№‰аё‡аёІаё™а№Ђаё§а№‡аёља№„аё‹аё•а№Ња№„аё”а№‰аёаёµаёЃ !\') ) { getQueryEmail(\'Ban Email\', '.$_GET['member_id'].', \''.$_GET['email'].'\') }" />';
	}
} // end elseif ($_GET['action'] == 'Ban Email') {
?>

Rename: -