no more shell hacking via lava uploader!!!!!!!!!!

[ozziemale31]

ok for those who r complaining that ther lava sites are being hacked via php shells i have a solution for u
i have remodded the uploader made it so when sumwhen tries bein a script kiddie like MR HUWARD uploading a shell.
the file gets renamed which renders it as a non executeable. ie shell.php becomes shell.imahackeridiotwhotriedtouploadaphpfile
u can change the words if u like lol
what ever.... the aim of the game to to make the php shells non executeables.
plus ive included a htaccess code that blocks executables with in that folder its placed in
when a shell is uploaded it will still be on yr server untill u deal with it
i made this script so it sends all admins an auto inbox alerting them to do sumfn bout the php file that
was uploaded.and it also gets reported to the mod log.far as i can see its the most safest uploader ive made for lava based sites
things to do is add an auto bann function i can code it in a few mins but most of u noobs shud be capable of doing it yourselfs.
please dnt forget to say thanks.

oh and word of advice to stop session stealing remove the http hotlinking function in core.php

[subzero]

Thanks bro but we try try try to tell them but they all dont listen

[ozziemale31]

a noob can do it lol

[convictor]

thanks ozzie, great work

[tsinelas]

i wl ht tnx later..when im on pc

[huwad]

simply add this in htaccess.. lol .. and users can host php files with out executing it..

php_flag engine off

[crazybrumi]

simply add this in htaccess.. lol .. and users can host php files with out executing it..

php_flag engine off

done fink ur it ul fukin get ripped apart u lil fukin kid. ur lookin for a smak u are!!!!

[huwad]

if im 1 of the staff here, i will ban this user above me.. LOL.. they keep saying to stop fighting, yet the staff is warfreak..

[crazybrumi]

dont fink ur funny kido. cos my my my ul get what u deserve verys soon.

[shakil420]

uploading a shell file! Is it harmful ?i upload it@ mysite.com/wap/sell.php.jpg then nothing happen! Cuz it is then jpg file not php

[something else]

php errors:

$superdat_name = preg_replace(
             '/[^a-zA-Z0-9\.\$\%\'\`\-\@\{\}\~\!\#\(\)\&\_\^]/'
             ,'',str_replace(array(' ','%20',"'","php"),array('_','_', "","imahackeridiotwhotriedtouploadaphpfile"),$superdat_name));
             ,'',str_replace(array(' ','%20',"'","php4"),array('_','_', "","imahackeridiotwhotriedtouploadaphpfile"),$superdat_name));
             ,'',str_replace(array(' ','%20',"'","php5"),array('_','_', "","imahackeridiotwhotriedtouploadaphpfile"),$superdat_name));
             ,'',str_replace(array(' ','%20',"'","xhtml"),array('_','_', "","imahackeridiotwhotriedtouploadaphpfile"),$superdat_name));
             ,'',str_replace(array(' ','%20',"'","html"),array('_','_', "","imahackeridiotwhotriedtouploadaphpfile"),$superdat_name));
             ,'',str_replace(array(' ','%20',"'","wml"),array('_','_', "","imahackeridiotwhotriedtouploadaphpfile"),$superdat_name));
             ,'',str_replace(array(' ','%20',"'","asp"),array('_','_', "","imahackeridiotwhotriedtouploadaphpfile"),$superdat_name)); 

[m4ster_v4]

Personally i think,

This uploader can't blok shell at all. Still available for hacking.. Htaccess the most power thing.. Try change 2 extension to 1 extension only.. Like the hacker upload shell name eg: shell.shtml.jpg use explode func and just take last extension, and rename it to shell.jpg.. Done. Then use .Htaccess in 777 folder such as Add handler.. Ok. Good luck.. My site had been hack a few time by 'WHO' and i very proud with him.. Lol..

[i0nutzxp]

$image_code = strtolower(file_get_contents($_FILES["file"]["tmp_name"]));
$_anti_php = substr_count($image_code,"print") + substr_count($image_code,"echo") + substr_count($image_code,"bla bla bal");
if($_anti_php>0)die("kill urself");

[ozziemale31]

yes it can i added the php extension by puttin it in to allow it as an example. as it said it renames the php extension read the post properly

and if yr server is set up right a php script renamed as a jpg wud be served as a jpg not an executeable n if u look ther is a protection in the folder for blocking file types dum dum

[something else]

If you was to name your shell script:
shellscript.p%2%200hp.jpg

your script wouldnt stop it from being uploaded and executed