Shield=$Shield; $this->TerminalEmulator=$TerminalEmulator; $this->bashfile=$bashfile; $this->params=$params; $this->config=$config; if($this->Shield->isAdmin() && $this->Shield->isInstalled() && !$this->installBashFile($this->bashfile)){ $this->v(["error" => 'Cannot install bash shell in '.__METHOD__.' '.__LINE__]); } } function token() { $client = new IDGenerator(); return $client->formattedId('0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-abcdefghijklmnopqrstuvwxyz', 40, new IDGeneratorGenerator()); } function password_set($config) { return true; // return isset($this->config['password']) && false !== $this->config['password'];// && !empty($config['password']); } protected function installBashFile(string $bashfile = null,int $expires = null):bool{ if(null===$bashfile){ $bashfile=$this->bashfile; } $expired =false; if(is_int($expires) && $expires > 0 && time() - $expires > filemtime($bashfile)){ $expired = true; } if (true !== $expired && file_exists($bashfile)) { return true; } if(dirname($bashfile) === $_SERVER['DOCUMENT_ROOT']){ throw new \Exception('BASH file MUST NOT be public in '.__METHOD__); return false; } if(!is_dir(dirname($bashfile))){ mkdir(dirname($bashfile), 0755, true); } chmod(dirname($bashfile), 0755); $p = dirname($bashfile); //if (!file_exists($bashfile)) { $bashrc = <<Shield->getStubConfig(); $config = $this->Shield->getConfig(); return ( (isset($config['hashed_password']) && true===\password_verify($password, $config['hashed_password']) ) || (isset($StubConfig['hashed_password']) && true===\password_verify($password, $StubConfig['hashed_password']) ) ) && $this->Shield->isAdmin() ; } public function handle(){ if (!isset($_SERVER['HTTP_X_REQUESTED_WITH']) || $_SERVER['HTTP_X_REQUESTED_WITH'] !== 'XMLHttpRequest' || !isset($this->params['action'])) { // throw new Exception('Invalid action param or X_REQUESTED_WITH Header in '.__METHOD__ ); $this->v(['error' => 'Invalid action param or X_REQUESTED_WITH Header in '.__METHOD__ ]); return; } /* if(!$this->Shield->session_started()){ $this->Shield->session_start(); }elseif(session_id() == ''){ $this->v(['error' => 'Cannot use session in '.__METHOD__]); } */ $this->Shield->initialize(); if(!isset($_SESSION[self::SESSIONKEY])){ $_SESSION[self::SESSIONKEY]=[]; } if (!$this->Shield->isAdmin()) { $this->v(['error' => 'You must be logged in as root/admin user in your Webfan PHP Installer/InstallShield (download: https://webfan.de/install/php/) to access this shell!']); } //if ($this->params['action'] !== 'login' && !isset($this->params['password']) && $this->password_set($this->config) && !isset($_SESSION[self::SESSIONKEY]['token'])) { // $this->v(['error' => "Error no Token [".__METHOD__.'::'.__LINE__."]"]); //} if ( $this->Shield->isAdmin() && $this->params['action'] === 'login' && isset($this->params['password']) ) { if ($this->Shield->isAdmin() && $this->login($this->params['password']) === true) { $_SESSION[self::SESSIONKEY]['token'] = $this->token(); $_SESSION[self::SESSIONKEY]['token_time_created'] = time(); $this->v(['result' => $_SESSION[self::SESSIONKEY]['token']]); } else { $this->v(["error" => "Wrong password or tokens"]); } } elseif ( $this->Shield->isAdmin() && isset($_SESSION[self::SESSIONKEY]['token']) && isset($this->params['token']) && $_SESSION[self::SESSIONKEY]['token'] === $this->params['token'] && !isset($this->params['password']) ) { if(!isset($_ENV['FRDL_HPS_PSR4_CACHE_LIMIT'])){ $_ENV['FRDL_HPS_PSR4_CACHE_LIMIT']=getenv('FRDL_HPS_PSR4_CACHE_LIMIT'); } $expires = (!empty($_ENV['FRDL_HPS_PSR4_CACHE_LIMIT'])) ? $_ENV['FRDL_HPS_PSR4_CACHE_LIMIT'] : time()-filemtime($this->Shield->getStub()->location); if(!$this->installBashFile($this->bashfile, $expires)){ $this->v(["error" => 'Cannot install bash shell in '.__METHOD__.' '.__LINE__]); } // chdir(dirname($this->bashfile)); if ( $this->Shield->isAdmin() && $this->params['action'] === 'shell') { try { $this->v($this->TerminalEmulator->shell($this->params['cmd'])); } catch(Exception $e) { $this->v(["error" => $e->getMessage()]); } } else if ( $this->Shield->isAdmin() && $this->params['action'] === 'rpc' && isset($this->params['method'])) { $class = \get_class($this->TerminalEmulator); $methods = \get_class_methods($class); if ($this->params['method'] === 'system.describe') { $this->v(['result' => array_values(array_filter(array_map(function($name) use ($class) { $method = new ReflectionMethod($class, $name); if ($method->isPublic() && !$method->isStatic() && !$method->isConstructor() && !$method->isDestructor()) { return ['name' => $name, 'params' => $method->getNumberOfRequiredParameters()]; } }, $methods)))]); } else { try { $params = isset($this->params['params']) ? $this->params['params'] : []; if (!in_array($this->params['method'], $methods) && !in_array("__call", $methods)) { $this->v(["error" => "Method ".$this->params['method']." not found"]); } else if (in_array("__call", $methods) && !in_array($this->params['method'], $methods)) { $result = call_user_func_array(array($this->TerminalEmulator, $this->params['method']), $params); // $this->v(['result' => $result]); if(is_array($result)){ $this->v($result); }else{ $this->v(['result' => $result]); } } else { $method_object = new ReflectionMethod($class, $this->params['method']); $num_got = count($params); $num_expect = $method_object->getNumberOfRequiredParameters(); if ($num_got != $num_expect) { $msg = "Wrong number of parameters in ".$this->params['method']." method. Got " . "$num_got expect $num_expect"; $this->v(["error" => $msg]); } else { $result = call_user_func_array(array($this->TerminalEmulator, $this->params['method']), $params); $this->v(['result' => $result]); } } } catch (Exception $e) { $this->v(['error' => $e->getMessage()]); } } } } elseif(!$this->Shield->isAdmin()){ $this->v(['error' => 'You must be logged in as root/admin user in your Webfan PHP Installer/InstallShield (download: https://webfan.de/install/php/) to access this shell!']); } elseif(!isset($this->params['password'])) { $this->v(['error' => 'Invalid Token or request [1]']); } else { $this->v(['error' => 'Invalid Token or request [2]']); } } protected function v(array $result){ header('Content-Type: application/json'); echo json_encode($result); die(); } public static function create(array $params=null) :AppTerminalEmulatorKernel { return self::createHandle($params); } public static function createHandle(array $params=null) :AppTerminalEmulatorKernel { if(null===$params){ $params=[]; } //if(!self::session_started()){ // session_start(); //} Shield::getInstance()->initialize(); //$bashFileBasename = '.bashrc_profile'; //$bashFileBasename = '.bashrc-frdl'; $bashFileBasename = Shield::BASH_FILENAME; $CNF = Shield::getInstance()->getConfig(); unset($CNF['hashed_password']); if(isset($CNF['wsdir']) && Shield::getInstance()->isInstalled() ){ $bashfile = $CNF['wsdir'].$bashFileBasename; }else{ $bashfile = Fs::getRootDir(dirname($_SERVER['DOCUMENT_ROOT'])).\DIRECTORY_SEPARATOR.'frdlweb'.\DIRECTORY_SEPARATOR.$bashFileBasename; } $config = array_merge($CNF->export(), [ 'password' => true, 'root' => dirname($bashfile), 'storage' => true, 'is_windows' => strtoupper(substr(\PHP_OS, 0, 3)) === 'WIN' ]); $path = isset($params['path']) ? $params['path'] : ((isset($_SESSION[TerminalEmulator::SESSIONKEY]['cwd']) && is_string($_SESSION[TerminalEmulator::SESSIONKEY]['cwd']) && !empty($_SESSION[TerminalEmulator::SESSIONKEY]['cwd'])) ? $_SESSION[TerminalEmulator::SESSIONKEY]['cwd'] : $config['root']); if(is_dir($path)){ chdir($path); } $TerminalEmulator = new TerminalEmulator($bashfile, $config['root'], $path, $config); $app = new self($params, $config, $TerminalEmulator, Shield::getInstance(), $bashfile); return $app; } }__halt_compiler();----SIGNATURE:----U8c2olOYmV7/BHXsxAFzVR2gSdBRUhj+ugi16q7J/J2fHGn2YIH37hdaWKzJ8ELKoqdIwH/wDLhF8GIKAjuIJf4PgKTx7siG1wduCKEyZ/A8RrBAKgi+wHzQPeDfkKl64lpoSHN/ZRf3kgtG9n+HWqEZd0vgJiLOPYv6/m4v6lL6wh5p/07hI/EzMwriWIba77YpxZlpjxLyP8mWJ7EPdaMZ46AyujgnY3PPWj2acEdmYXaR7WYvs6pe1ASibdIxVth2OD1+KpuE++wHCugJ+eQYs6/hmLBkJmdNDgowz3z3agqWqaaS+JbeQkAnFfv3FsVCyiyBAdYUSt/6UGwp9YYu/fzeV5h40I5M/82MEQ8SgmH/b45bon57640i625FsbUNGXvS/E9NoMyruqt4O/sM2lqD0AzlEGscum3QU8ukTIRYwSeqysxHtHIzOaXEqf6OFxgezArddq8GGDjJwNEv/r0eRotaXTtMV1rXEJ1zxv4pcKwmRxZgPSBDcmRFUupx5FexAqoQVZ64kU29lxNRZKD6OwaIC94HKWFjoV2WqYZvR2S6dySW065hd+MlgHn437skexypVeEz3BuA1HRD0DLTp0qldMPiLtc9/JNzOfDRJs9gGeT/ZWE3vqfl9VlNrwsAUopWF3OGwjmiTSO7ZQV9QElqx0In2hF5VZk=----ATTACHMENT:----NDMzMzMyMjQ4OTU2OTI5MCA0NTcwNDc0NjY5MzE3NDAxIDMzMjUwMjUwMzYzOTIzNw==