One Hat Cyber Team

Your IP: 216.73.216.19
Server IP: 178.33.27.10
Server: Linux cpanel.dev-unit.com 3.10.0-1160.108.1.el7.x86_64 #1 SMP Thu Jan 25 16:17:31 UTC 2024 x86_64
Server Software: Apache/2.4.57 (Unix) OpenSSL/1.0.2k-fips
PHP Version: 8.2.11
Buat File | Buat Folder

Dir : ~/usr/local/cwpsrv/var/services/users/softaculous/

Edit File: index.php

<?php

header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
header("Content-Type: text/html; charset=UTF-8");
if((@$_GET['act'] == 'backups' || @$_GET['act'] == 'import_export' || @$_GET['act'] == 'templates') && !empty($_GET['download']) && substr_count($_GET['download'], './') == 0){
	header('Content-Disposition: attachment; filename="'.$_GET['download'].'"');
}

if(@$_GET['act'] == 'wordpress' && !empty($_GET['render_image'])){
	header('Content-Type: image/png');
}

//Does not work with custom port
/* if(is_dir('/usr/local/cwpsrv/var/services/users')){
	$admin_port = array('2030','2031','2086','2087');
	if(!array_key_exists('module', $_GET) && !in_array($_SERVER['SERVER_PORT'], $admin_port)){
		header('Location:../?module=softaculous'); 
		die();
	}
} */

if(!function_exists('shell_exec')){
	die('shell_exec function is required for Softaculous to work.');
}

$session_number = md5($_SERVER['REMOTE_ADDR']);
session_name("cwpsrv-".$session_number);

//Session path has been changed in v1
if(posix_getuid() == 0 && is_dir('/usr/local/cwpsrv/var/services/users') && is_dir('/root/.cwp_sessions')){
	$cwp_session_save_path = "/root/.cwp_sessions"; 
	session_save_path($cwp_session_save_path);
}

session_start();

// cwp v0 and v1 has different structure and cookie variables
if(is_dir('/usr/local/cwpsrv/var/services/users')){
	if(empty($_SESSION['username'])){
		header('Location:/login/?acc=logon'); 
		die();
	}
}elseif(!$_SESSION['logged']){
	header("Location: ../login.php");
	die();
}

function soft_unlink_user_file($file){
	
	// Is the file safe to delete ?
	if(!soft_is_safe_file($file)) return false; // Security Fix
	
	@unlink($file);
}

function soft_is_safe_file($path){

// Is it a symlink ?
	if(is_link($path)) return false;
	
	// Is it a file and is a link ?
	$stat = @stat($path);
	if(!is_dir($path) && $stat['nlink'] > 1) return false;
	
	return true;
}

// Is the effective and real userID the same ?
if(posix_getuid() != posix_geteuid()){
	echo "EUID differs from UID. Hacking Attempt !";
	exit;
}

//For enduser
if(posix_getuid() != 0){
	
	$TMP_USER = posix_getpwuid(posix_geteuid());
	$TMP_HOME = $TMP_USER['dir'];

// Create the directory if it does not exist
	if(!is_dir($TMP_HOME.'/.softaculous/sess/')){
		@mkdir($TMP_HOME.'/.softaculous/sess/', 0711, true);
	}

// Load the Panel
	if(function_exists('random_bytes')){
		$sess = md5(bin2hex(random_bytes(32)));
	}else{
		$sess = str_shuffle(md5(uniqid(microtime())));
	}
	
	$file = $TMP_HOME.'/.softaculous/sess/'.$sess;
	
	// Touch the file
	touch($file);
	chmod($file, 0600);
	
	$fp = fopen($file, "a");

if(empty($fp)){
		die('Could not write SESSION DATA.');
	}

$array = array();
	$array['SERVER'] = $_SERVER;
	$array['POST'] = $_POST;
	$array['GET'] = $_GET;
	$array['REQUEST'] = $_REQUEST;
	$array['COOKIE'] = $_COOKIE;
	$array['SESSION'] = $_SESSION;
	$array['FILES'] = $_FILES;

fwrite($fp, json_encode($array));
	fclose($fp);
	chmod($file, 0600);

session_write_close();

if(file_exists('/usr/local/cwpsrv/var/services/users')){
		//echo '/usr/local/cwp/php/bin/php /usr/local/cwp/softaculous/load.php '.$sess;
		//echo shell_exec('/usr/local/cwp/php/bin/php /usr/local/cwpsrv/var/services/users/softaculous/load.php '.$sess);
		echo shell_exec('/usr/local/softaculous/bin/soft sess '.$sess);
	}else{
		//echo '/usr/local/cwp/php/bin/php /usr/local/cwp/softaculous/load.php '.$sess;
		echo shell_exec('/usr/local/cwp/php/bin/php /usr/local/cwp/softaculous/load.php '.$sess);
	}
	@unlink($file); // load.php will also try to delete it!

// Just to ensure that there should not be any files as a security measures.
	$d = date('i');
	if($d % 2 == 0){
		
		if ($dh = opendir($TMP_HOME.'/.softaculous/sess/')) {
			
			while (($dfile = readdir($dh)) !== false) {
				if($dfile == '.' || $dfile == '..') continue;
				
				clearstatcache();
				$stime = filemtime($TMP_HOME.'/.softaculous/sess/'.$dfile);

// Delete the file if its there for more than 10 seconds
				if($stime < (time() - 10)){
					@soft_unlink_user_file($TMP_HOME.'/.softaculous/sess/'.$dfile);
				}
			}
			
			closedir($dh);
		}
	}
}else{
	define('SOFTACULOUS', 1);
	include('/usr/local/softaculous/enduser/universal.php');
	include($globals['path'].'/index.php');
}