Cyber Anakins Lightsaber - A Minishell-based backdoor
<?php
require("design.php");
session_start();
$monthNames = array("январь","февраль","март","апрель","май","июнь","июль","август","сентябрь","октябрь","ноябрь","декабрь");
$monthNamesV = array("январе","феврале","марте","апреле","мае","июне","июле","августе","сентябре","октябре","ноябре","декабре");
function EventsPlane($month, $year)
{
require("contacts.php");
print "<table width=100% cellspacing=0 cellpadding=4 border=1 bordercolor=black>\n";
print "<tr>\n";
print "<th width=1% align=center nowrap>№\\№</th>\n";
print "<th width=30% align=center>Наименование и форма мероприятия</th>\n";
print "<th width=10% align=center>Дата, время проведения</th>\n";
print "<th width=20% align=center>Наименование филиала</th>\n";
print "<th width=20% align=center>Место проведения<br>(соцсеть)</th>\n";
print "<th width=1% align=center nowrap>Возрастной<br>ценз</th>\n";
print "<th width=30% align=center>Краткое содержание мероприятия</th>\n";
print "</tr>\n";
$mysql = mysqlopen();
// offline-мероприятия
$result = mysqli_query($mysql, "SELECT `title`,`desc`,`date`,`filial`,`category` FROM libOnlineEvents WHERE MONTH(`date`)=$month AND YEAR(`date`)=$year ORDER BY `date` ASC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$n = 1;
while($row = mysqli_fetch_assoc($result))
{
$date = '';
if (preg_match("/(\d+)-(\d+)-(\d+) (\d+):(\d+):\d+/", $row['date'], $g))
{
$date = $g[3] . "." . $g[2] . "." . $g[1]."<br>".intval($g[4]) . ":" . $g[5];
}
$filial = $row['filial'];
print "<tr>\n";
print "<td>$n.</td>\n";
print "<td>".$row['title']."</td>\n";
print "<td align=center>$date</td>\n";
print "<td align=center>".preg_replace("библиотека №","библиотека-филиал №",$GLOBALS['filials'][$filial])."</td>\n";
print "<td align=center>";
print "<a href='https://www.youtube.com/channel/UCoLqN5ugT-ibkNbpVEbsXUQ/videos' target=_blank>https://www.youtube.com/channel/UCoLqN5ugT-ibkNbpVEbsXUQ/videos</a><br>\n";
print "<a href='https://vk.com/cbskorolev' target=_blank>https://vk.com/cbskorolev</a><br>\n";
print "<a href='".$GLOBALS['filialContacts'][$filial]['vk']."' target=_blank>".$GLOBALS['filialContacts'][$filial]['vk']."</a>";
print "</td>\n";
print "<td nowrap align=center>".$row['category']."+</td>\n";
print "<td>"._html_br_($row['desc'])."</td>\n";
print "</tr>\n";
$n++;
}
mysqli_free_result($result);
print "</table>";
}
if (isset($_GET['openas']))
{
$month = intval(_GET_('month'));
$y = intval($month / 12);
$m = $month % 12 + 1;
if ($_GET['openas']=='word')
{
header("Content-Type: application/msword; charset=UTF-8", true);
print "<html>\n";
print "<head><meta charset=UTF-8></head>\n";
print "<body>\n";
print "<style>table { border-collapse: collapse; }</style>\n";
print "<h1 style='text-align:center'>План онлайн-мероприятий,<br>проводимых в МБУК ЦБС г.о. Королёв<br>в ".$monthNamesV[$m-1]." $y года</h1>\n";
EventsPlane($m, $y);
print "</body></html>";
exit(0);
}
if ($_GET['openas']=='excel')
{
header("Content-Type: application/excel; charset=UTF-8", true);
print "<html>\n";
print "<head><meta charset=UTF-8></head>\n";
print "<body>\n";
print "<style>table { border-collapse: collapse; }</style>\n";
EventsPlane($m, $y);
print "</body></html>";
exit(0);
}
}
TOP(-1);
$mysql = mysqlopen();
LEFTCOLUMN();
CHANNELS();
MAINCOLUMN();
?>
<h1>online-мероприятия</h1>
<center>Присоединяйтесь к нашим мероприятиям в соц.сетях ВКонтакте и Telegram. Соответствующую ссылку можно найти в описании мероприятия.</center>
<?php
require_once("contacts.php");
$canEdit = false;
if (AdminAuth(RIGHT_EDIT_EVENTS)) $canEdit = true;
$sql = "`title`<>'' AND ";
if ($canEdit)
{
FILIALLISTINFO();
print "<script src='onlineeventeditor.js'></script>\n";
print "<Br><center>[ <a href='#' onclick='newOnlineEvent();return false'>Добавить online-мероприятие</a> ]</center>";
print "<Br><center>[ <a href='onlineeventparser.php'>Добавить online-мероприятие из Word</a> ]</center><br>";
$sql='';
}
function PrintOnlineEvent($row, $canEdit)
{
$id = $row['id'];
print "<table class=event cellspacing=0 cellpadding=><tr><td>\n";
print "<div class=ellipseBlock data-maxheight=290>\n";
if ($row['poster']!=null && $row['poster']!='')
{
$img = "onlineevents/".$row['poster'];
print "<a href='$img' target=_blank><img border=0 align=left class=eventImg src='$img'></a>";
}
$title = $row['title'];
if ($title==null || trim($title)=='') $title="Новое мероприятие";
print "<h2>$title";
if ($canEdit)
{
print "<nobr>";
print "<img class=editBtn title='Редактировать мероприятие' src='edit.png' onclick='editOnlineEvent($id)'>";
print "<img class=editBtn title='Удалить мероприятие' src='del32x32.png' onclick='delOnlineEvent($id)'>";
print "</nobr>";
}
print "</h2>";
if (preg_match("/(\d+)\-(\d+)-(\d+).*?(\d+):(\d+):\d+/", $row['date'],$g))
{
print "<div class=eventDate>". $g[3]. "." . $g[2] . "." . $g[1] . " <span>начало в</span> " . $g[4] . ":" . $g[5]. "</div>\n";
}
print "<p>"._para_($row['desc'])."</p>\n";
$fil = $row['filial'];
print "<div style='margin-top:10; margin-bottom:10'>Проводит: <a href='filials.php?filial=$fil'>".$GLOBALS['filials'][$fil]."</a></div>\n";
print "<div>Присоединяйтесь к нам:</div>\n";
print "<table style='margin-left:32'>\n";
print "<tr><td align=right></td><td><a href='https://www.youtube.com/channel/UCoLqN5ugT-ibkNbpVEbsXUQ/videos' target=_blank><img class=img16x16 src='youtube16x16.png'>Youtube</a></td></tr>\n";
foreach($GLOBALS['filialContacts'][$fil] as $key=>$value)
{
if ($key == "vk")
print "<tr><td align=right></td><td><a href='$value' target=_blank><img class=img16x16 src='vk16x16.png'>ВКонтакте</a></td></tr>\n";
else
if ($key == "telegram")
print "<tr><td align=right></td><td><a href='$value' target=_blank><img class=img16x16 src='telegram16x16.png'>Telegram</a></td></tr>\n";
}
print "</table>\n";
print "<center><b>Категория: ".$row['category']."+</b></center>\n";
$kinds = array("Литературная гостиная","Мастер-классы","Познавательный калейдоскоп");
print "<center style='font-size:10px'>(".$kinds[$row['kind']].")</center><br>\n";
$duration = intval($row['duration']);
$h = intval($duration/60);
$m = $duration%60;
if ($h>0)
{
$duration = "$h ч.";
if ($m > 0) $duration.=" $m мин.";
}
else
$duration = "$m мин.";
print "<center>Продолжительность: $duration</center>\n";
print "</div>\n";
print "<div class=ellipseControl style='display:none' onclick='ellipseClick(this)'>Читать полностью</div>\n";
print "</td></tr></table>\n\n\n";
}
$result = mysqli_query($mysql,
"SELECT
`id`,
`title`,
`date`,
`kind`,
`duration`,
`poster`,
`desc`,
`filial`,
`category`
FROM
libOnlineEvents
WHERE
$sql
`date` >= NOW()
ORDER BY `date` ASC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row = mysqli_fetch_assoc($result))
{
PrintOnlineEvent($row,$canEdit);
}
mysqli_free_result($result);
$result2 = mysqli_query($mysql,
"SELECT
MONTH(`date`) as `month`,
YEAR(`date`) as `year`
FROM
libOnlineEvents
WHERE
$sql
`date`< NOW()
GROUP BY
`year`,`month`
ORDER BY
`year` DESC,`month` DESC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$monthNames = array("","Январь","Февраль","Март","Апрель","Май","Июнь","Июль","Август","Сентябрь","Октябрь","Ноябрь","Декабрь");
if (isset($_GET['monthinx'])) $monthInx = intval($_GET['monthinx']); else $monthInx = 0;
$header = "<h2>Архив online-мероприятий</h2>\n";
while($row2 = mysqli_fetch_assoc($result2))
{
$month = $row2['month'];
$year = $row2['year'];
$mInx = $year * 12 + ($month - 1);
$link = "online.php?monthinx=$mInx#$mInx";
$icon = "plus.gif";
if ($mInx == $monthInx)
{
$icon = "minus.gif";
$link = "online.php#$mInx";
}
print $header;
$header = '';
print "<a name=$mInx></a>\n";
print "<div class=monthBar onclick='location=\"$link\"'><img src='$icon' class=plus22 width=10 height=10> Мероприятия за ".$monthNames[$month]." $year г.</div>\n";
print "<noscript><a href='$link'>Показать мероприятия месяца</a></noscript>\n";
if ($mInx == $monthInx)
{
$result = mysqli_query($mysql,
"SELECT
`id`,
`title`,
`date`,
`duration`,
`kind`,
`poster`,
`desc`,
`filial`,
`category`
FROM
libOnlineEvents
WHERE
$sql
`date`<NOW() AND
MONTH(`date`)=$month AND
YEAR(`date`)=$year
ORDER BY `date` ASC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row = mysqli_fetch_assoc($result))
{
PrintOnlineEvent($row,$canEdit);
}
mysqli_free_result($result);
}
}
mysqli_free_result($result2);
$tm = localtime(time(), true);
$currentMonth = ($tm['tm_year']+1900)*12 + $tm['tm_mon'];
$month = intval(_GD_('month', $currentMonth));
$y = intval($month / 12);
$m = $month % 12 + 1;
print "<br><br><a name=pall></a>";
print "<h1>План online-мероприятий</h1>\n";
print "<form method=get action='online.php#pall'>";
print "<center><table><tr>";
print "<td>Месяц:</td>";
print "<td><select name=month style='font-size:22px' onchange='this.form.submit()'>";
for($i = 1; $i >=-2; $i--)
{
$minx = $currentMonth + $i;
$y = intval($minx / 12);
$m = $minx % 12 + 1;
print "<option value=$minx";
if ($minx == $month) print " selected";
if ($minx == $currentMonth) print " style='font-weight:bold'";
else
if ($minx < $currentMonth) print " style='color:red'";
print ">".$monthNames[$m-1]." $y г.";
if ($minx < $month) print " - архив";
print "</option>\n";
}
print "</select></td><td><input style='height:32' type=submit value='>>' title='Отобразить'></td>";
print "<td>";
print "<button style='height:32' title='Открыть перечень мероприятий с помощью Word' onclick='doOpenWord()'><table><tr><td><img src='wordicon.png' width=16 height=16></td><td>В Word</td></tr></table></button>\n";
print "<button style='height:32' title='Открыть перечень мероприятий с помощью Excel' onclick='doOpenExcel()'><table><tr><td><img src='excelicon.png' width=16 height=16></td><td>В Excel</td></tr></table></button>\n";
print "</td>";
print "</tr></table>";
print "</center><br><br>";
$y = intval($month / 12);
$m = $month % 12 + 1;
?>
<script>
function doOpenWord()
{
var a = document.createElement('a');
a.href='online.php?month=<?php print $month; ?>&openas=word';
a.download = 'Online-мероприятия на <?php print $monthNames[$m-1]." $y г"; ?>.doc';
a.click();
}
function doOpenExcel()
{
var a = document.createElement('a');
a.href='program.php?month=<?php print $month; ?>&openas=excel';
a.download = 'Online-мероприятия на <?php print $monthNames[$m-1]." $y г"; ?>.xls';
a.click();
}
</script>
<br><Br>
<?php
MIDDLECOLUMN2();
print "<center><table><tr><td>";
ACTUALLINKS('actualLinksH');
print "</tr></td></table></center>";
FAQ();
MIDDLECOLUMN();
CHANNELS("channelBlockH");
RIGHTCOLUMN();
ACTUALLINKS();
FAQ();
?>
<?php BOTTOM(); ?>
May the force be with you, always.