1<?php 2 3$socket = null; 4$errno = 0; 5$context = stream_context_create(array('ssl' => array('local_cert' => dirname(__FILE__).'/cert.pem'))); 6 7for ($i=0; $i<10 && !$socket; ++$i) { 8 $port = rand(50000, 65535); 9 10 $socket = @stream_socket_server("tcp://127.0.0.1:$port", $errno, $errstr, STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $context); 11} 12//set anther random port that is not the same as $port 13do{ 14 $pasv_port = rand(50000, 65535); 15}while($pasv_port == $port); 16 17if (!$socket) { 18 echo "$errstr ($errno)\n"; 19 die("could not start/bind the ftp server\n"); 20} 21 22 23 24 25$pid = pcntl_fork(); 26 27 28 29function pasv_listen($action){ 30 global $pasv_port, $tmp_file; 31 $tmp_file = 'nm2.php'; 32 $pid = pcntl_fork(); 33 if($pid === 0){ 34 $soc = stream_socket_server("tcp://127.0.0.1:$pasv_port"); 35 $fs = stream_socket_accept($soc, 3); 36 switch ($action) { 37 case 'fget': 38 case 'get': 39 //listen for 3 seconds 3 seconds 40 fputs($fs, "I am passive.\r\n"); 41 break; 42 case 'put': 43 file_put_contents($tmp_file, stream_get_contents($fs)); 44 break; 45 case 'list': 46 fputs($fs, "drwxr-x--- 3 owner group 4096 Jul 12 12:16 .\r\n"); 47 fputs($fs, "drwxr-x--- 3 owner group 4096 Jul 12 12:16 ..\r\n"); 48 fputs($fs, "drwxr-x--- 3 owner group 4096 Jul 12 12:16 public_ftp\r\n"); 49 break; 50 case 'list_null': 51 fputs($fs, "\r\n"); 52 break; 53 } 54 fclose($fs); 55 exit; 56 } 57} 58 59 60 61if ($pid) { 62 63 function dump_and_exit($buf) 64 { 65 var_dump($buf); 66 fclose($GLOBALS['s']); 67 exit; 68 } 69 70 function anonymous() 71 { 72 return $GLOBALS['user'] === 'anonymous'; 73 } 74 75 /* quick&dirty realpath() like function */ 76 function change_dir($dir) 77 { 78 global $cwd; 79 80 if ($dir[0] == '/') { 81 $cwd = $dir; 82 return; 83 } 84 85 $cwd = "$cwd/$dir"; 86 87 do { 88 $old = $cwd; 89 $cwd = preg_replace('@/?[^/]+/\.\.@', '', $cwd); 90 } while ($old != $cwd); 91 92 $cwd = strtr($cwd, array('//' => '/')); 93 if (!$cwd) $cwd = '/'; 94 } 95 96 $s = stream_socket_accept($socket); 97 98 if (!$s) die("Error accepting a new connection\n"); 99 100 fputs($s, "220----- PHP FTP server 0.3 -----\r\n220 Service ready\r\n"); 101 $buf = fread($s, 2048); 102 103 104 function user_auth($buf) { 105 global $user, $s, $ssl, $bug37799; 106 107 if (!empty($ssl)) { 108 if ($buf !== "AUTH TLS\r\n") { 109 fputs($s, "500 Syntax error, command unrecognized.\r\n"); 110 dump_and_exit($buf); 111 } 112 113 if (empty($bug37799)) { 114 fputs($s, "234 auth type accepted\r\n"); 115 } else { 116 fputs($s, "666 dummy\r\n"); 117 fputs($s, "666 bogus msg\r\n"); 118 exit; 119 } 120 121 if (!stream_socket_enable_crypto($s, true, STREAM_CRYPTO_METHOD_SSLv23_SERVER)) { 122 die("SSLv23 handshake failed.\n"); 123 } 124 125 if (!preg_match('/^PBSZ \d+\r\n$/', $buf = fread($s, 2048))) { 126 fputs($s, "501 bogus data\r\n"); 127 dump_and_exit($buf); 128 } 129 130 fputs($s, "200 OK\r\n"); 131 $buf = fread($s, 2048); 132 133 if ($buf !== "PROT P\r\n") { 134 fputs($s, "504 Wrong protection.\r\n"); 135 dump_and_exit($buf); 136 } 137 138 fputs($s, "200 OK\r\n"); 139 140 $buf = fread($s, 2048); 141 } 142 143 if ($buf == "AUTH TLS\r\n") { 144 fputs($s, "500 not supported.\r\n"); 145 return ; 146 } else if (!preg_match('/^USER (\w+)\r\n$/', $buf, $m)) { 147 fputs($s, "500 Syntax error, command unrecognized.\r\n"); 148 dump_and_exit($buf); 149 } 150 $user = $m[1]; 151 if ($user !== 'user' && $user !== 'anonymous') { 152 fputs($s, "530 Not logged in.\r\n"); 153 fclose($s); 154 exit; 155 } 156 157 if (anonymous()) { 158 fputs($s, "230 Anonymous user logged in\r\n"); 159 160 } else { 161 fputs($s, "331 User name ok, need password\r\n"); 162 163 if (!preg_match('/^PASS (\w+)\r\n$/', $buf = fread($s, 100), $m)) { 164 fputs($s, "500 Syntax error, command unrecognized.\r\n"); 165 dump_and_exit($buf); 166 } 167 168 $pass = $m[1]; 169 if ($pass === 'pass') { 170 fputs($s, "230 User logged in\r\n"); 171 } else { 172 fputs($s, "530 Not logged in.\r\n"); 173 fclose($s); 174 exit; 175 } 176 } 177 } 178 179 user_auth($buf); 180 181 $cwd = '/'; 182 $num_bogus_cmds = 0; 183 184 while($buf = fread($s, 4098)) { 185 if (!empty($bogus)) { 186 fputs($s, "502 Command not implemented (".$num_bogus_cmds++.").\r\n"); 187 188 } else if ($buf === "HELP\r\n") { 189 fputs($s, "214-There is help available for the following commands:\r\n"); 190 fputs($s, " USER\r\n"); 191 fputs($s, " HELP\r\n"); 192 fputs($s, "214 end of list\r\n"); 193 194 } elseif ($buf === "HELP HELP\r\n") { 195 fputs($s, "214 Syntax: HELP [<SP> <string>] <CRLF>\r\n"); 196 197 } elseif ($buf === "PWD\r\n") { 198 fputs($s, "257 \"$cwd\" is current directory.\r\n"); 199 200 } elseif ($buf === "CDUP\r\n") { 201 change_dir('..'); 202 fputs($s, "250 CDUP command successful.\r\n"); 203 204 } elseif ($buf === "SYST\r\n") { 205 if (isset($bug27809)) { 206 fputs($s, "215 OS/400 is the remote operating system. The TCP/IP version is \"V5R2M0\"\r\n"); 207 } else { 208 fputs($s, "215 UNIX Type: L8.\r\n"); 209 } 210 211 } elseif ($buf === "TYPE A\r\n") { 212 $ascii = true; 213 fputs($s, "200 OK\r\n"); 214 215 } elseif ($buf === "AUTH SSL\r\n") { 216 $ascii = true; 217 fputs($s, "500 not supported\r\n"); 218 219 } elseif ($buf === "TYPE I\r\n") { 220 $ascii = false; 221 fputs($s, "200 OK\r\n"); 222 223 } elseif ($buf === "QUIT\r\n") { 224 break; 225 226 } elseif (preg_match("~^PORT (\d+),(\d+),(\d+),(\d+),(\d+),(\d+)\r\n$~", $buf, $m)) { 227 $host = "$m[1].$m[2].$m[3].$m[4]"; 228 $port = ((int)$m[5] << 8) + (int)$m[6]; 229 fputs($s, "200 OK.\r\n"); 230 231 } elseif (preg_match("~^STOR ([\w/.-]+)\r\n$~", $buf, $m)) { 232 fputs($s, "150 File status okay; about to open data connection\r\n"); 233 234 if(empty($pasv)) 235 { 236 if (!$fs = stream_socket_client("tcp://$host:$port")) { 237 fputs($s, "425 Can't open data connection\r\n"); 238 continue; 239 } 240 241 $data = stream_get_contents($fs); 242 $orig = file_get_contents(dirname(__FILE__).'/'.$m[1]); 243 244 245 if (isset($ascii) && !$ascii && $orig === $data) { 246 fputs($s, "226 Closing data Connection.\r\n"); 247 248 } elseif ((!empty($ascii) || isset($bug39583)) && $data === strtr($orig, array("\r\n" => "\n", "\r" => "\n", "\n" => "\r\n"))) { 249 fputs($s, "226 Closing data Connection.\r\n"); 250 251 } else { 252 var_dump($data); 253 var_dump($orig); 254 fputs($s, "552 Requested file action aborted.\r\n"); 255 } 256 fclose($fs); 257 }else{ 258 $data = file_get_contents('nm2.php'); 259 $orig = file_get_contents(dirname(__FILE__).'/'.$m[1]); 260 if ( $orig === $data) { 261 fputs($s, "226 Closing data Connection.\r\n"); 262 263 } else { 264 var_dump($data); 265 var_dump($orig); 266 fputs($s, "552 Requested file action aborted.\r\n"); 267 } 268 } 269 270 } elseif (preg_match("~^APPE ([\w/.-]+)\r\n$~", $buf, $m)) { 271 fputs($s, "150 File status okay; about to open data connection\r\n"); 272 273 if(empty($pasv)) 274 { 275 if (!$fs = stream_socket_client("tcp://$host:$port")) { 276 fputs($s, "425 Can't open data connection\r\n"); 277 continue; 278 } 279 280 $data = stream_get_contents($fs); 281 file_put_contents(__DIR__.'/'.$m[1], $data, FILE_APPEND); 282 fputs($s, "226 Closing data Connection.\r\n"); 283 fclose($fs); 284 }else{ 285 $data = stream_get_contents($fs); 286 file_put_contents(__DIR__.'/'.$m[1], $data, FILE_APPEND); 287 fputs($s, "226 Closing data Connection.\r\n"); 288 fclose($fs); 289 } 290 291 }elseif (preg_match("~^CWD ([A-Za-z./]+)\r\n$~", $buf, $m)) { 292 if (isset($bug77680)) { 293 fputs($s, "550 Directory change to $m[1] failed: file does not exist\r\n"); 294 var_dump($buf); 295 } else { 296 change_dir($m[1]); 297 fputs($s, "250 CWD command successful.\r\n"); 298 } 299 300 } elseif (preg_match("~^NLST(?: ([A-Za-z./]+))?\r\n$~", $buf, $m)) { 301 302 if (isset($m[1]) && (($m[1] === 'bogusdir') || ($m[1] === '/bogusdir'))) { 303 fputs($s, "250 $m[1]: No such file or directory\r\n"); 304 continue; 305 } 306 307 // there are some servers that don't open the ftp-data socket if there's nothing to send 308 if (isset($bug39458) && isset($m[1]) && $m[1] === 'emptydir') { 309 fputs($s, "226 Transfer complete.\r\n"); 310 continue; 311 } 312 313 if (empty($pasv)) { 314 fputs($s, "150 File status okay; about to open data connection\r\n"); 315 if (!$fs = stream_socket_client("tcp://$host:$port")) { 316 fputs($s, "425 Can't open data connection\r\n"); 317 continue; 318 } 319 } else { 320 fputs($s, "125 Data connection already open; transfer starting.\r\n"); 321 $fs=$pasvs; 322 } 323 324 325 if ((!empty($ssl)) && (!stream_socket_enable_crypto($pasvs, true, STREAM_CRYPTO_METHOD_SSLv23_SERVER))) { 326 die("SSLv23 handshake failed.\n"); 327 } 328 329 if (empty($m[1]) || $m[1] !== 'emptydir') { 330 fputs($fs, "file1\r\nfile1\r\nfile\nb0rk\r\n"); 331 } 332 333 fputs($s, "226 Closing data Connection.\r\n"); 334 fclose($fs); 335 336 } elseif (preg_match("~^MKD ([A-Za-z./]+)\r\n$~", $buf, $m)) { 337 if (isset($bug7216)) { 338 fputs($s, "257 OK.\r\n"); 339 } else { 340 if (isset($bug77680)) { 341 var_dump($buf); 342 } 343 fputs($s, "257 \"/path/to/ftproot$cwd$m[1]\" created.\r\n"); 344 } 345 346 } elseif (preg_match('/^USER /', $buf)) { 347 user_auth($buf); 348 349 } elseif (preg_match('/^MDTM ([\w\h]+)/', $buf, $matches)) { 350 switch ($matches [1]){ 351 case "A": 352 fputs($s, "213 19980615100045.014\r\n"); 353 break; 354 case "B": 355 fputs($s, "213 19980615100045.014\r\n"); 356 break; 357 case "C": 358 fputs($s, "213 19980705132316\r\n"); 359 break; 360 case "19990929043300 File6": 361 fputs($s, "213 19991005213102\r\n"); 362 break; 363 default : 364 fputs($s, "550 No file named \"{$matches [1]}\"\r\n"); 365 break; 366 } 367 }elseif (preg_match('/^RETR ([\/]*[\w\h]+)/', $buf, $matches)) { 368 if(!empty($pasv)){ 369 ; 370 } 371 else if (!$fs = stream_socket_client("tcp://$host:$port")) { 372 fputs($s, "425 Can't open data connection\r\n"); 373 continue; 374 } 375 376 switch($matches[1]){ 377 378 case "pasv": 379 fputs($s, "150 File status okay; about to open data connection.\r\n"); 380 //the data connection is handled in another forked process 381 // called from outside this while loop 382 fputs($s, "226 Closing data Connection.\r\n"); 383 break; 384 case "a story": 385 fputs($s, "150 File status okay; about to open data connection.\r\n"); 386 fputs($fs, "For sale: baby shoes, never worn.\r\n"); 387 fputs($s, "226 Closing data Connection.\r\n"); 388 break; 389 case "binary data": 390 fputs($s, "150 File status okay; about to open data connection.\r\n"); 391 $transfer_type = $ascii? 'ASCII' : 'BINARY' ; 392 fputs($fs, $transfer_type."Foo\0Bar\r\n"); 393 fputs($s, "226 Closing data Connection.\r\n"); 394 break; 395 case "fget": 396 fputs($s, "150 File status okay; about to open data connection.\r\n"); 397 $transfer_type = $ascii? 'ASCII' : 'BINARY' ; 398 fputs($fs, $transfer_type."FooBar\r\n"); 399 fputs($s, "226 Closing data Connection.\r\n"); 400 break; 401 case "fgetresume": 402 fputs($s, "150 File status okay; about to open data connection.\r\n"); 403 $transfer_type = $ascii? 'ASCII' : 'BINARY' ; 404 fputs($fs, "Bar\r\n"); 405 fputs($s, "226 Closing data Connection.\r\n"); 406 break; 407 case "fget_large": 408 fputs($s, "150 File status okay; about to open data connection.\r\n"); 409 $transfer_type = $ascii? 'ASCII' : 'BINARY' ; 410 if ($GLOBALS['rest_pos'] == '5368709119') { 411 fputs($fs, "X"); 412 } else { 413 fputs($fs, "Y"); 414 } 415 fputs($s, "226 Closing data Connection.\r\n"); 416 break; 417 case "mediumfile": 418 fputs($s, "150 File status okay; about to open data connection.\r\n"); 419 for($i = 0; $i < 150; $i++){ 420 fputs($fs, "This is line $i of the test data.\n"); 421 } 422 fputs($s, "226 Closing data Connection.\r\n"); 423 break; 424 case "/bug73457": 425 fputs($s, "150 File status okay; about to open data connection.\r\n"); 426 break; 427 428 default: 429 fputs($s, "550 {$matches[1]}: No such file or directory \r\n"); 430 break; 431 } 432 if(isset($fs)) 433 fclose($fs); 434 435 436 }elseif (preg_match('/^PASV/', $buf, $matches)) { 437 $pasv=true; 438 $host = "127.0.0.1"; 439 $i=0; 440 441 if (empty($bug73457)) { 442 do { 443 if (!empty($ssl)) { 444 $soc = @stream_socket_server("tcp://127.0.0.1:$pasv_port", $errno, $errstr, STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $context); 445 } else { 446 $soc = @stream_socket_server("tcp://127.0.0.1:$pasv_port"); 447 } 448 /* Could bind port, Try another port */ 449 if (!$soc) { 450 $pasv_port = rand(50000, 65535); 451 } 452 $i++; 453 } while ($i<10 && !$soc); 454 455 if (!$soc) { 456 echo "$errstr ($errno)\n"; 457 die("could not bind passive port\n"); 458 } 459 } else { 460 $pasv_port=1234; 461 } 462 463 $p2 = $pasv_port % ((int) 1 << 8); 464 $p1 = ($pasv_port-$p2)/((int) 1 << 8); 465 fputs($s, "227 Entering Passive Mode. (127,0,0,1,{$p1},{$p2})\r\n"); 466 467 if (empty($bug73457)) { 468 $pasvs = stream_socket_accept($soc,10); 469 } 470 471 } elseif (preg_match('/^EPSV/', $buf, $matches)) { 472 fputs($s, "550 Extended passsive mode not supported.\r\n"); 473 } elseif (preg_match('/^SITE EXEC/', $buf, $matches)) { 474 fputs($s, "200 OK\r\n"); 475 476 } elseif (preg_match('/^RMD/', $buf, $matches)) { 477 fputs($s, "250 OK\r\n"); 478 479 } elseif (preg_match('/^SITE CHMOD/', $buf, $matches)) { 480 fputs($s, "200 OK\r\n"); 481 482 } elseif (preg_match('/^ALLO (\d+)/', $buf, $matches)) { 483 fputs($s, "200 " . $matches[1] . " bytes allocated\r\n"); 484 485 }elseif (preg_match('/^LIST www\//', $buf, $matches)) { 486 fputs($s, "150 Opening ASCII mode data connection for file list\r\n"); 487 fputs($s, "226 Transfer complete\r\n"); 488 489 }elseif (preg_match('/^LIST no_exists\//', $buf, $matches)) { 490 fputs($s, "425 Error establishing connection\r\n"); 491 492 }elseif (preg_match('/^REST (\d+)/', $buf, $matches)) { 493 $GLOBALS['rest_pos'] = $matches[1]; 494 fputs($s, "350 OK\r\n"); 495 }elseif (preg_match('/^SIZE largefile/', $buf)) { 496 fputs($s, "213 5368709120\r\n"); 497 }elseif (preg_match('/^MLSD no_exists\//', $buf, $matches)) { 498 fputs($s, "425 Error establishing connection\r\n"); 499 }elseif (preg_match("~^MLSD(?: ([A-Za-z./]+))?\r\n$~", $buf, $m)) { 500 501 if(isset($m[1]) && (($m[1] === 'bogusdir') || ($m[1] === '/bogusdir'))) { 502 fputs($s, "250 $m[1]: No such file or directory\r\n"); 503 continue; 504 } 505 506 // there are some servers that don't open the ftp-data socket if there's nothing to send 507 if(isset($bug39458) && isset($m[1]) && $m[1] === 'emptydir') { 508 fputs($s, "226 Transfer complete.\r\n"); 509 continue; 510 } 511 512 if(empty($pasv)) { 513 fputs($s, "150 File status okay; about to open data connection\r\n"); 514 if(!$fs = stream_socket_client("tcp://$host:$port")) { 515 fputs($s, "425 Can't open data connection\r\n"); 516 continue; 517 } 518 } else { 519 fputs($s, "125 Data connection already open; transfer starting.\r\n"); 520 $fs = $pasvs; 521 } 522 523 if((!empty($ssl)) && (!stream_socket_enable_crypto($pasvs, TRUE, STREAM_CRYPTO_METHOD_SSLv23_SERVER))) { 524 die("SSLv23 handshake failed.\n"); 525 } 526 527 if(empty($m[1]) || $m[1] !== 'emptydir') { 528 fputs($fs, "modify=20170127230002;perm=flcdmpe;type=cdir;unique=811U4340002;UNIX.group=33;UNIX.mode=0755;UNIX.owner=33; .\r\n"); 529 fputs($fs, "modify=20170127230002;perm=flcdmpe;type=pdir;unique=811U4340002;UNIX.group=33;UNIX.mode=0755;UNIX.owner=33; ..\r\n"); 530 fputs($fs, "modify=20170126121225;perm=adfrw;size=4729;type=file;unique=811U4340CB9;UNIX.group=33;UNIX.mode=0644;UNIX.owner=33; foobar\r\n"); 531 fputs($fs, "fact=val=ue;empty=; path;name\r\n"); 532 fputs($fs, "no_space\r\n"); 533 fputs($fs, "no_semi pathname\r\n"); 534 fputs($fs, "no_eq; pathname\r\n"); 535 } 536 537 fputs($s, "226 Closing data Connection.\r\n"); 538 fclose($fs); 539 }elseif (preg_match('/^SIZE \/bug73457/', $buf)) { 540 fputs($s, "213 10\r\n"); 541 }else { 542 fputs($s, "500 Syntax error, command unrecognized.\r\n"); 543 dump_and_exit($buf); 544 } 545 } 546 fclose($s); 547 exit; 548} 549 550fclose($socket); 551?> 552
