Zploit 0-Day Shell

:: Editing File: index.php

<?php 
include "param.php";
include "func.php";
$er = "N";
if (chp('sub_mit') == "Y")
{
	if (chp('txtlogin') != "" && chp('txtpass') != "" && strlen(chp('txtlogin')) < 10 && strlen(chp('txtpass')) < 15)
	{
		$QRY = qry_run("Select * from tbl_admin where plogin = '".md5(filter(chps('txtlogin')))."' AND ppass = '".md5(sha1('My'.md5(filter(chps('txtpass')))))."' AND pshow = 'Yes'");
		if (num_rec($QRY) > 0)
		{
			$rs = fetch_rec($QRY);
			if ($rs['plogin'] == md5(chp('txtlogin')))
			{
				$_SESSION["LINK_LOGIN"] = "Yes";
				$_SESSION["LINK_LOGINID"] = md5(chp('txtlogin'));
				$my_log = md5('MY_@'.date('d').$rs['pname']);
				$_SESSION[$my_log] = md5(sha1("FC@43mtA".date('d').$_SERVER['HTTP_USER_AGENT'].$_SERVER['REMOTE_ADDR']));
				$_SESSION["LINK_USER"] = $rs['pname'];
				$_SESSION["MY_ID"] = rand(111111,9999999);
				$verify_token = sha1("ID".sha1($_SESSION["MY_ID"].md5(date('dMY').$_SERVER['HTTP_USER_AGENT'].$_SERVER['REMOTE_ADDR'])));
				$INC = qry_run("Insert into tbl_my_log (user_id,pdate,ptime,ipadd,vtoken,uid) Values ('".chp('txtlogin')."','".date('Y-m-d')."','".date('H:i:s')."','".$_SERVER['REMOTE_ADDR']."','".$verify_token."','".$_SESSION["MY_ID"]."')");
				session_regenerate_id(true);
				header("Location: main.php");
				die;
			}else{
				$er = "Y";
			}
		}else{
			$er = "Y";
		}
	}else{
		$er = "Y";
	}
}
?>
<html>
<head>
<title><?=$web_title?></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style>
.txt_id{
	font-family:verdana;

font-size:11px;

font-weight:normal;

color:#000000;

text-decoration:none;

border-style:solid;

border-width:1px 1px 1px 1px;

border-color:#D8D8D8;

background:#FFFFFF;

padding-left:4px;

padding-top:2px;

height:21px;

}

.btn{

font-family:tahoma;

font-size:11px;

font-weight:normal;

color:#000000;

text-decoration:none;

}

.base{

font-family:tahoma;

font-size:11px;

font-weight:normal;

color:#000000;

text-decoration:none;

}

</style>

function g_focus(){

document.frm_login.txtlogin.focus();

}

</script>

</head>

<tr>

<tr>

</tr>

<tr>

<tr>

<td><strong>Admin Login</strong></td>

</tr>

<?php if ($er == "Y"){?>

<tr>

<td><font color="#FF0000">Invalid Login ID / Password</font></td>

</tr>

<?php }?>

<tr>

<td width="61" align="right">Login:</td>

</tr>

<tr>

<td align="right">Password:</td>

</tr>
                      <tr>

<td><a href="forgot_password.php">I forgot my password</a></td>

</tr>
                      <tr> 
                        <td align="right">&nbsp;</td>
                        <td><input name="image" type="image" src="imgs/cp/login.jpg"></td>
                      </tr>
                      <tr> 
                        <td align="right">&nbsp;</td>
                        <td>&nbsp;</td>
                      </tr>
                    </form>
                  </table>
                </td>
                <td width="180" align="center"><img src="imgs/cp/login_img.jpg" width="106" height="137"></td>

</tr>

<td height="61" colspan="2" align="center" bgcolor="#FDFEFE">Welcome

to Website Control Panel Use a valid Loginid and password to

gain <br>

access to the administration console</td>

</tr>

<tr>

</tr>

</table></td>

</tr>

<tr>

</tr>

</table></td>

</tr>

</table>

</body>

</html>